2522 files changed, 102535 insertions, 40484 deletions
diff --git a/LayoutTests/fast/dom/DOMImplementation/implementation-identity-expected.txt b/LayoutTests/fast/dom/DOMImplementation/implementation-identity-expected.txt
new file mode 100644
index 0000000..42bdffd
--- /dev/null
+++ b/LayoutTests/fast/dom/DOMImplementation/implementation-identity-expected.txt
@@ -0,0 +1,7 @@
+This test checks that DOMImplementation object is created per document.
+
+If the test passes, you should see a few OK lines below.
+
+OK: Top-level document and iframe document have different DOMImplementation objects
+OK: DOMImplementation object is cached
+
diff --git a/LayoutTests/fast/dom/DOMImplementation/implementation-identity.html b/LayoutTests/fast/dom/DOMImplementation/implementation-identity.html
new file mode 100644
index 0000000..2b3c56c
--- /dev/null
+++ b/LayoutTests/fast/dom/DOMImplementation/implementation-identity.html
@@ -0,0 +1,30 @@
+<body>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function print(message)
+{
+    var paragraph = document.createElement("li");
+    paragraph.appendChild(document.createTextNode(message));
+    document.getElementById("console").appendChild(paragraph);
+}
+
+function test()
+{
+    if (document.implementation != frames[0].document.implementation)
+        print("OK: Top-level document and iframe document have different DOMImplementation objects");
+    else
+        print("BUG: Top-level document and iframe document share a DOMImplementation object");
+
+    if (document.implementation === document.implementation)
+        print("OK: DOMImplementation object is cached");
+    else
+        print("BUG: DOMImplementation object is not cached");
+}
+</script>
+<p>This test checks that DOMImplementation object is created per document.</p>
+<p>If the test passes, you should see a few OK lines below.</p>
+<p><ol id=console></ol></p>
+<iframe src="about:blank" onload="test()"></iframe>
+</body>
diff --git a/LayoutTests/fast/dom/Geolocation/argument-types-expected.txt b/LayoutTests/fast/dom/Geolocation/argument-types-expected.txt
index 23ea685..6c25000 100644
--- a/LayoutTests/fast/dom/Geolocation/argument-types-expected.txt
+++ b/LayoutTests/fast/dom/Geolocation/argument-types-expected.txt
@@ -9,6 +9,8 @@ PASS navigator.geolocation.getCurrentPosition(null) threw exception Error: TYPE_
 PASS navigator.geolocation.getCurrentPosition({}) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
 PASS navigator.geolocation.getCurrentPosition(objectThrowingException) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
 PASS navigator.geolocation.getCurrentPosition(emptyFunction) did not throw exception.
+PASS navigator.geolocation.getCurrentPosition(Math.abs) did not throw exception.
+PASS navigator.geolocation.getCurrentPosition(layoutTestController.setGeolocationPermission) did not throw exception.
 PASS navigator.geolocation.getCurrentPosition(true) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
 PASS navigator.geolocation.getCurrentPosition(42) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
 PASS navigator.geolocation.getCurrentPosition(Infinity) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
@@ -19,6 +21,8 @@ PASS navigator.geolocation.getCurrentPosition(emptyFunction, null) did not throw
 PASS navigator.geolocation.getCurrentPosition(emptyFunction, {}) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
 PASS navigator.geolocation.getCurrentPosition(emptyFunction, objectThrowingException) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
 PASS navigator.geolocation.getCurrentPosition(emptyFunction, emptyFunction) did not throw exception.
+PASS navigator.geolocation.getCurrentPosition(emptyFunction, Math.abs) did not throw exception.
+PASS navigator.geolocation.getCurrentPosition(emptyFunction, layoutTestController.setGeolocationPermission) did not throw exception.
 PASS navigator.geolocation.getCurrentPosition(emptyFunction, true) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
 PASS navigator.geolocation.getCurrentPosition(emptyFunction, 42) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
 PASS navigator.geolocation.getCurrentPosition(emptyFunction, Infinity) threw exception Error: TYPE_MISMATCH_ERR: DOM Exception 17.
diff --git a/LayoutTests/fast/dom/Geolocation/script-tests/argument-types.js b/LayoutTests/fast/dom/Geolocation/script-tests/argument-types.js
index 01c77f5..73ffb41 100644
--- a/LayoutTests/fast/dom/Geolocation/script-tests/argument-types.js
+++ b/LayoutTests/fast/dom/Geolocation/script-tests/argument-types.js
@@ -40,7 +40,8 @@ test('navigator.geolocation.getCurrentPosition(null)', true);
 test('navigator.geolocation.getCurrentPosition({})', true);
 test('navigator.geolocation.getCurrentPosition(objectThrowingException)', true);
 test('navigator.geolocation.getCurrentPosition(emptyFunction)', false);
-//test('navigator.geolocation.getCurrentPosition(Math.abs)', false);
+test('navigator.geolocation.getCurrentPosition(Math.abs)', false);
+test('navigator.geolocation.getCurrentPosition(layoutTestController.setGeolocationPermission)', false);
 test('navigator.geolocation.getCurrentPosition(true)', true);
 test('navigator.geolocation.getCurrentPosition(42)', true);
 test('navigator.geolocation.getCurrentPosition(Infinity)', true);
@@ -52,7 +53,8 @@ test('navigator.geolocation.getCurrentPosition(emptyFunction, null)', false);
 test('navigator.geolocation.getCurrentPosition(emptyFunction, {})', true);
 test('navigator.geolocation.getCurrentPosition(emptyFunction, objectThrowingException)', true);
 test('navigator.geolocation.getCurrentPosition(emptyFunction, emptyFunction)', false);
-//test('navigator.geolocation.getCurrentPosition(emptyFunction, Math.abs)', false);
+test('navigator.geolocation.getCurrentPosition(emptyFunction, Math.abs)', false);
+test('navigator.geolocation.getCurrentPosition(emptyFunction, layoutTestController.setGeolocationPermission)', false);
 test('navigator.geolocation.getCurrentPosition(emptyFunction, true)', true);
 test('navigator.geolocation.getCurrentPosition(emptyFunction, 42)', true);
 test('navigator.geolocation.getCurrentPosition(emptyFunction, Infinity)', true);
diff --git a/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail1-expected.txt b/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail1-expected.txt
new file mode 100644
index 0000000..02d7cb5
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail1-expected.txt
@@ -0,0 +1,4 @@
+This page verifies fix for bug 58247. WebKit should not crash when this page is rendered.
+
+
+PASS
diff --git a/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail1.html b/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail1.html
new file mode 100644
index 0000000..c9d7fe3
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail1.html
@@ -0,0 +1,18 @@
+<head>
+  <script>
+      function pass() {
+          var div = document.createElement('div');
+          div.innerHTML = 'PASS';
+          document.body.appendChild(div);
+      }
+      if (window.layoutTestController)
+          layoutTestController.dumpAsText();
+  </script>
+</head>
+<body onload="pass()">
+<p>This page verifies fix for bug 58247. WebKit should not crash when this page is rendered.</p>
+
+<a </var><form><button  form="f"><progress>
+<keygen form="f"><a </datalist><button>
+</body>
+
diff --git a/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail2-expected.txt b/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail2-expected.txt
new file mode 100644
index 0000000..02d7cb5
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail2-expected.txt
@@ -0,0 +1,4 @@
+This page verifies fix for bug 58247. WebKit should not crash when this page is rendered.
+
+
+PASS
diff --git a/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail2.html b/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail2.html
new file mode 100644
index 0000000..5f68010
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail2.html
@@ -0,0 +1,17 @@
+<head>
+  <script>
+      function pass() {
+          var div = document.createElement('div');
+          div.innerHTML = 'PASS';
+          document.body.appendChild(div);
+      }
+      if (window.layoutTestController)
+          layoutTestController.dumpAsText();
+  </script>
+</head>
+<body onload="pass()">
+<p>This page verifies fix for bug 58247. WebKit should not crash when this page is rendered.</p>
+
+<form><em><ol </del><fieldset  form="f"</sub><option </dt><button  form="f"></em><meter </time>
+</body>
+
diff --git a/LayoutTests/fast/dom/HTMLKeygenElement/keygen-expected.txt b/LayoutTests/fast/dom/HTMLKeygenElement/keygen-expected.txt
index 4d7e1f0..017eeac 100644
--- a/LayoutTests/fast/dom/HTMLKeygenElement/keygen-expected.txt
+++ b/LayoutTests/fast/dom/HTMLKeygenElement/keygen-expected.txt
@@ -1,8 +1,11 @@
 
-Tests the keygen element.
+This tests the keygen element.
 
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+PASS keygen.options is undefined
+PASS shadow.firstChild.tagName is "SELECT"
+PASS layoutTestController.shadowRoot(shadow) is null
+PASS layoutTestController.shadowRoot(shadow.firstChild) is null
+PASS successfullyParsed is true
 
-
-PASS document.getElementById("keys").options is undefined
+TEST COMPLETE
 
diff --git a/LayoutTests/fast/dom/HTMLKeygenElement/keygen.html b/LayoutTests/fast/dom/HTMLKeygenElement/keygen.html
index 59196ac..a9c5c74 100644
--- a/LayoutTests/fast/dom/HTMLKeygenElement/keygen.html
+++ b/LayoutTests/fast/dom/HTMLKeygenElement/keygen.html
@@ -1,27 +1,27 @@
+<!DOCTYPE html>
 <html>
 <head>
-<link rel="stylesheet" href="../../js/resources/js-test-style.css">
 <script src="../../js/resources/js-test-pre.js"></script>
 </head>
 <body>
 <keygen id="keys" />
+<pre id="console">
+This tests the keygen element.
 
-<p id="description"></p>
-<div id="console"></div>
-
+</pre>
 <script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function test(elementId)
-{
-    description('Tests the keygen element.');
+var keygen = document.getElementById('keys');
+shouldBe('keygen.options', 'undefined');  // keygen is not a select
 
-    shouldBe('document.getElementById("keys").options', 'undefined');    
+if (window.layoutTestController) {
+  var shadow = layoutTestController.shadowRoot(keygen);
+  shouldBe('shadow.firstChild.tagName', '"SELECT"');
+  shouldBe('layoutTestController.shadowRoot(shadow)', 'null');
+  shouldBe('layoutTestController.shadowRoot(shadow.firstChild)', 'null');
 }
 
-test("keys");
+var successfullyParsed = true;
 </script>
-
+<script src="../../js/resources/js-test-post.js"></script>
 </body>
 </html>
diff --git a/LayoutTests/fast/dom/HTMLLinkElement/subresource-expected.txt b/LayoutTests/fast/dom/HTMLLinkElement/subresource-expected.txt
new file mode 100644
index 0000000..b65bfe2
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLLinkElement/subresource-expected.txt
@@ -0,0 +1,3 @@
+prefetch.link has MIME type application/octet-stream
+PASS onload called!
+This test will only print "PASS" or "FAIL" if link prefetches are enabled, otherwise it will show nothing below.
diff --git a/LayoutTests/fast/dom/HTMLLinkElement/subresource.html b/LayoutTests/fast/dom/HTMLLinkElement/subresource.html
new file mode 100644
index 0000000..0477e03
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLLinkElement/subresource.html
@@ -0,0 +1,20 @@
+<body>
+<div id="console"></div>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script>
+function prefetch_onload() {
+    testPassed('onload called!');
+    layoutTestController.notifyDone();
+}
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+    layoutTestController.dumpResourceResponseMIMETypes();
+}
+</script>
+<html>
+<p>This test will only print "PASS" or "FAIL" if link prefetches are
+enabled, otherwise it will show nothing below.</p>
+<link href="prefetch.link" rel="prefetch" onload="prefetch_onload()" onerror="testFailed('onerror')" />
+</html>
+
diff --git a/LayoutTests/http/tests/resources/slow-script.pl b/LayoutTests/http/tests/resources/slow-script.pl
new file mode 100755
index 0000000..3accf91
--- /dev/null
+++ b/LayoutTests/http/tests/resources/slow-script.pl
@@ -0,0 +1,23 @@
+#!/usr/bin/perl -w
+
+use strict;
+use CGI;
+use Time::HiRes qw(sleep);
+
+my $cgi = new CGI;
+my $delay = $cgi->param('delay');
+$delay = 5000 unless $delay;
+
+# flush the buffers after each print
+select (STDOUT);
+$| = 1;
+
+print "Content-Type: application/javascript\n";
+print "Expires: Thu, 01 Dec 2003 16:00:00 GMT\n";
+print "Cache-Control: no-store, no-cache, must-revalidate\n";
+print "Pragma: no-cache\n";
+print "\n";
+
+sleep $delay / 1000;
+
+
diff --git a/LayoutTests/storage/script-tests/TEMPLATE.html b/LayoutTests/storage/script-tests/TEMPLATE.html
new file mode 100644
index 0000000..eb1d038
--- /dev/null
+++ b/LayoutTests/storage/script-tests/TEMPLATE.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
+<script src="../fast/js/resources/js-test-pre.js"></script>
+<script src="resources/fs-test-util.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="YOUR_JS_FILE_HERE"></script>
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/storage/script-tests/storageinfo-query-usage.js b/LayoutTests/storage/script-tests/storageinfo-query-usage.js
new file mode 100644
index 0000000..8af9232
--- /dev/null
+++ b/LayoutTests/storage/script-tests/storageinfo-query-usage.js
@@ -0,0 +1,31 @@
+description("This tests webkitStorageInfo API works.");
+
+function errorCallback(error)
+{
+    testFailed("Error occurred: " + error);
+    finishJSTest();
+}
+
+var returnedUsage;
+var returnedQuota;
+function usageCallback(usage, quota)
+{
+    returnedUsage = usage;
+    returnedQuota = quota;
+
+    // Usage should be 0 (if other storage tests have correctly cleaned up their test data before exiting).
+    shouldBe("returnedUsage", "0");
+
+    // Quota value would vary depending on the test environment.
+    shouldBeGreaterThanOrEqual("returnedQuota", "returnedUsage");
+
+    finishJSTest();
+}
+
+if (window.webkitStorageInfo) {
+    window.jsTestIsAsync = true;
+    webkitStorageInfo.queryUsageAndQuota(webkitStorageInfo.TEMPORARY, usageCallback, errorCallback);
+} else
+    debug("This test requires window.webkitStorageInfo.");
+
+window.successfullyParsed = true;
diff --git a/LayoutTests/storage/storageinfo-query-usage-expected.txt b/LayoutTests/storage/storageinfo-query-usage-expected.txt
new file mode 100644
index 0000000..50ef9e6
--- /dev/null
+++ b/LayoutTests/storage/storageinfo-query-usage-expected.txt
@@ -0,0 +1,11 @@
+This tests webkitStorageInfo API works.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS returnedUsage is 0
+PASS returnedQuota is >= returnedUsage
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/storage/storageinfo-query-usage.html b/LayoutTests/storage/storageinfo-query-usage.html
new file mode 100644
index 0000000..6e41d42
--- /dev/null
+++ b/LayoutTests/storage/storageinfo-query-usage.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
+<script src="../fast/js/resources/js-test-pre.js"></script>
+<script src="resources/fs-test-util.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/storageinfo-query-usage.js"></script>
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/Source/Android.mk b/Source/Android.mk
new file mode 100644
index 0000000..b86830a
--- /dev/null
+++ b/Source/Android.mk
@@ -0,0 +1,322 @@
+##
+## Copyright 2009, The Android Open Source Project
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted provided that the following conditions
+## are met:
+##  * Redistributions of source code must retain the above copyright
+##    notice, this list of conditions and the following disclaimer.
+##  * Redistributions in binary form must reproduce the above copyright
+##    notice, this list of conditions and the following disclaimer in the
+##    documentation and/or other materials provided with the distribution.
+##
+## THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+## EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+## IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+## PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+## CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+## EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+## PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+## PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+## OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+## (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+## OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+##
+
+LOCAL_PATH := $(call my-dir)
+
+# Two ways to control which JS engine is used:
+# 1. use JS_ENGINE environment variable, value can be either 'jsc' or 'v8'
+#    This is the preferred way.
+# 2. if JS_ENGINE is not set, or is not 'jsc' or 'v8', this makefile picks
+#    up a default engine to build.
+#    To help setup buildbot, a new environment variable, USE_ALT_JS_ENGINE,
+#    can be set to true, so that two builds can be different but without
+#    specifying which JS engine to use.
+# To enable JIT in Android's JSC, please set ENABLE_JSC_JIT environment
+# variable to true.
+
+# Read JS_ENGINE environment variable
+JAVASCRIPT_ENGINE = $(JS_ENGINE)
+
+ifneq ($(JAVASCRIPT_ENGINE),jsc)
+  ifneq ($(JAVASCRIPT_ENGINE),v8)
+    # No JS engine is specified, pickup the one we want as default.
+    ifeq ($(USE_ALT_JS_ENGINE),true)
+      JAVASCRIPT_ENGINE = v8
+    else
+      JAVASCRIPT_ENGINE = jsc
+    endif
+  endif
+endif
+
+BASE_PATH := $(call my-dir)
+include $(CLEAR_VARS)
+
+# Define our module and find the intermediates directory
+LOCAL_MODULE := libwebcore
+LOCAL_MODULE_CLASS := STATIC_LIBRARIES
+base_intermediates := $(call local-intermediates-dir)
+
+# Using := here prevents recursive expansion
+WEBKIT_SRC_FILES :=
+
+# We have to use bison 2.3
+include $(BASE_PATH)/bison_check.mk
+
+# Build our list of include paths. We include WebKit/android/icu first so that
+# any files that include <unicode/ucnv.h> will include our ucnv.h first. We
+# also add external/ as an include directory so that we can specify the real
+# icu header directory as a more exact reference to avoid including our ucnv.h.
+#
+# Note that JavasCriptCore/ must be included after WebCore/, so that we pick up
+# the right config.h.
+LOCAL_C_INCLUDES := \
+	$(JNI_H_INCLUDE) \
+	$(LOCAL_PATH)/WebKit/android/icu \
+	external/ \
+	external/icu4c/common \
+	external/icu4c/i18n \
+	external/libxml2/include \
+	external/skia/emoji \
+	external/skia/include/core \
+	external/skia/include/effects \
+	external/skia/include/images \
+	external/skia/include/ports \
+	external/skia/include/utils \
+	external/skia/src/ports \
+	external/sqlite/dist \
+	frameworks/base/core/jni/android/graphics
+
+LOCAL_C_INCLUDES := $(LOCAL_C_INCLUDES) \
+	$(LOCAL_PATH)/WebCore \
+	$(LOCAL_PATH)/WebCore/accessibility \
+	$(LOCAL_PATH)/WebCore/bindings/generic \
+	$(LOCAL_PATH)/WebCore/css \
+	$(LOCAL_PATH)/WebCore/dom \
+	$(LOCAL_PATH)/WebCore/editing \
+	$(LOCAL_PATH)/WebCore/history \
+	$(LOCAL_PATH)/WebCore/history/android \
+	$(LOCAL_PATH)/WebCore/html \
+	$(LOCAL_PATH)/WebCore/html/canvas \
+	$(LOCAL_PATH)/WebCore/inspector \
+	$(LOCAL_PATH)/WebCore/loader \
+	$(LOCAL_PATH)/WebCore/loader/appcache \
+	$(LOCAL_PATH)/WebCore/loader/icon \
+	$(LOCAL_PATH)/WebCore/notifications \
+	$(LOCAL_PATH)/WebCore/page \
+	$(LOCAL_PATH)/WebCore/page/android \
+	$(LOCAL_PATH)/WebCore/page/animation \
+	$(LOCAL_PATH)/WebCore/platform \
+	$(LOCAL_PATH)/WebCore/platform/android \
+	$(LOCAL_PATH)/WebCore/platform/animation \
+	$(LOCAL_PATH)/WebCore/platform/graphics \
+	$(LOCAL_PATH)/WebCore/platform/graphics/android \
+	$(LOCAL_PATH)/WebCore/platform/graphics/network \
+	$(LOCAL_PATH)/WebCore/platform/graphics/skia \
+	$(LOCAL_PATH)/WebCore/platform/graphics/transforms \
+	$(LOCAL_PATH)/WebCore/platform/image-decoders \
+	$(LOCAL_PATH)/WebCore/platform/leveldb \
+	$(LOCAL_PATH)/WebCore/platform/mock \
+	$(LOCAL_PATH)/WebCore/platform/network \
+	$(LOCAL_PATH)/WebCore/platform/network/android \
+	$(LOCAL_PATH)/WebCore/platform/sql \
+	$(LOCAL_PATH)/WebCore/platform/text \
+	$(LOCAL_PATH)/WebCore/plugins \
+	$(LOCAL_PATH)/WebCore/plugins/android \
+	$(LOCAL_PATH)/WebCore/rendering \
+	$(LOCAL_PATH)/WebCore/rendering/style \
+	$(LOCAL_PATH)/WebCore/storage \
+	$(LOCAL_PATH)/WebCore/workers \
+	$(LOCAL_PATH)/WebCore/xml
+
+LOCAL_C_INCLUDES := $(LOCAL_C_INCLUDES) \
+	$(LOCAL_PATH)/WebKit/android \
+	$(LOCAL_PATH)/WebKit/android/WebCoreSupport \
+	$(LOCAL_PATH)/WebKit/android/jni \
+	$(LOCAL_PATH)/WebKit/android/nav \
+	$(LOCAL_PATH)/WebKit/android/plugins \
+	$(LOCAL_PATH)/WebKit/android/stl
+
+LOCAL_C_INCLUDES := $(LOCAL_C_INCLUDES) \
+	$(LOCAL_PATH)/JavaScriptCore \
+	$(LOCAL_PATH)/JavaScriptCore/wtf \
+	$(LOCAL_PATH)/JavaScriptCore/wtf/unicode \
+	$(LOCAL_PATH)/JavaScriptCore/wtf/unicode/icu
+
+LOCAL_C_INCLUDES := $(LOCAL_C_INCLUDES) \
+	$(base_intermediates)/WebCore/ \
+	$(base_intermediates)/WebCore/css \
+	$(base_intermediates)/WebCore/html \
+	$(base_intermediates)/WebCore/platform
+
+ifeq ($(ENABLE_SVG), true)
+LOCAL_C_INCLUDES := $(LOCAL_C_INCLUDES) \
+	$(LOCAL_PATH)/WebCore/platform/graphics/filters \
+	$(LOCAL_PATH)/WebCore/svg \
+	$(LOCAL_PATH)/WebCore/svg/animation \
+	$(LOCAL_PATH)/WebCore/svg/graphics \
+	$(LOCAL_PATH)/WebCore/svg/graphics/filters \
+	$(base_intermediates)/WebCore/svg
+endif
+
+ifeq ($(JAVASCRIPT_ENGINE),v8)
+# Include WTF source file.
+d := JavaScriptCore
+LOCAL_PATH := $(BASE_PATH)/$d
+intermediates := $(base_intermediates)/$d
+include $(LOCAL_PATH)/Android.v8.wtf.mk
+WEBKIT_SRC_FILES += $(addprefix $d/,$(LOCAL_SRC_FILES))
+endif  # JAVASCRIPT_ENGINE == v8
+
+# Include source files for WebCore
+d := WebCore
+LOCAL_PATH := $(BASE_PATH)/$d
+JAVASCRIPTCORE_PATH := $(BASE_PATH)/JavaScriptCore
+intermediates := $(base_intermediates)/$d
+include $(LOCAL_PATH)/Android.mk
+ifeq ($(JAVASCRIPT_ENGINE),jsc)
+include $(LOCAL_PATH)/Android.jscbindings.mk
+endif
+ifeq ($(JAVASCRIPT_ENGINE),v8)
+include $(LOCAL_PATH)/Android.v8bindings.mk
+endif
+WEBKIT_SRC_FILES += $(addprefix $d/,$(LOCAL_SRC_FILES))
+LOCAL_C_INCLUDES += $(BINDING_C_INCLUDES)
+
+# Include the derived source files for WebCore. Uses the same path as
+# WebCore
+include $(LOCAL_PATH)/Android.derived.mk
+ifeq ($(JAVASCRIPT_ENGINE),jsc)
+include $(LOCAL_PATH)/Android.derived.jscbindings.mk
+endif
+ifeq ($(JAVASCRIPT_ENGINE),v8)
+include $(LOCAL_PATH)/Android.derived.v8bindings.mk
+endif
+
+# Redefine LOCAL_PATH here so the build system is not confused
+LOCAL_PATH := $(BASE_PATH)
+
+# Define our compiler flags
+LOCAL_CFLAGS += -Wno-endif-labels -Wno-import -Wno-format
+LOCAL_CFLAGS += -fno-strict-aliasing
+LOCAL_CFLAGS += -include "WebCorePrefix.h"
+LOCAL_CFLAGS += -fvisibility=hidden
+
+# Enable JSC JIT if JSC is used and ENABLE_JSC_JIT environment
+# variable is set to true
+ifeq ($(JAVASCRIPT_ENGINE),jsc)
+ifeq ($(ENABLE_JSC_JIT),true)
+LOCAL_CFLAGS += -DENABLE_ANDROID_JSC_JIT=1
+endif
+endif
+
+ifeq ($(TARGET_ARCH),arm)
+LOCAL_CFLAGS += -Darm
+endif
+
+ifeq ($(ENABLE_SVG),true)
+LOCAL_CFLAGS += -DENABLE_SVG=1
+endif
+
+# Temporary disable SVG_ANIMATION.
+ifeq ($(ENABLE_SVG_ANIMATION),true)
+LOCAL_CFLAGS += -DENABLE_SVG_ANIMATION=1
+endif
+
+ifeq ($(WEBCORE_INSTRUMENTATION),true)
+LOCAL_CFLAGS += -DANDROID_INSTRUMENT
+endif
+
+# LOCAL_LDLIBS is used in simulator builds only and simulator builds are only
+# valid on Linux
+LOCAL_LDLIBS += -lpthread -ldl
+
+# Build the list of shared libraries
+LOCAL_SHARED_LIBRARIES := \
+	libandroid_runtime \
+	libnativehelper \
+	libsqlite \
+	libskia \
+	libutils \
+	libui \
+	libcutils \
+	libicuuc \
+	libicudata \
+	libicui18n \
+	libmedia
+
+ifeq ($(WEBCORE_INSTRUMENTATION),true)
+LOCAL_SHARED_LIBRARIES += libhardware_legacy
+endif
+
+# We have to use the android version of libdl when we are not on the simulator
+ifneq ($(TARGET_SIMULATOR),true)
+LOCAL_SHARED_LIBRARIES += libdl
+endif
+
+# Build the list of static libraries
+LOCAL_STATIC_LIBRARIES := libxml2
+ifeq ($(JAVASCRIPT_ENGINE),v8)
+LOCAL_STATIC_LIBRARIES += libv8
+endif
+
+# Redefine LOCAL_SRC_FILES to be all the WebKit source files
+LOCAL_SRC_FILES := $(WEBKIT_SRC_FILES)
+
+# Define this for use in other makefiles.
+WEBKIT_C_INCLUDES := $(LOCAL_C_INCLUDES)
+WEBKIT_CFLAGS := $(LOCAL_CFLAGS)
+WEBKIT_GENERATED_SOURCES := $(LOCAL_GENERATED_SOURCES)
+WEBKIT_LDLIBS := $(LOCAL_LDLIBS)
+WEBKIT_SHARED_LIBRARIES := $(LOCAL_SHARED_LIBRARIES)
+WEBKIT_STATIC_LIBRARIES := $(LOCAL_STATIC_LIBRARIES)
+
+# Build the library all at once
+include $(BUILD_STATIC_LIBRARY)
+
+ifeq ($(JAVASCRIPT_ENGINE),jsc)
+# Now build libjs as a static library.
+include $(CLEAR_VARS)
+LOCAL_MODULE := libjs
+LOCAL_LDLIBS := $(WEBKIT_LDLIBS)
+LOCAL_SHARED_LIBRARIES := $(WEBKIT_SHARED_LIBRARIES)
+LOCAL_STATIC_LIBRARIES := $(WEBKIT_STATIC_LIBRARIES)
+LOCAL_CFLAGS := $(WEBKIT_CFLAGS)
+# Include source files for JavaScriptCore
+d := JavaScriptCore
+LOCAL_PATH := $(BASE_PATH)/$d
+LOCAL_MODULE_CLASS := STATIC_LIBRARIES
+# Cannot use base_intermediates as this is a new module
+intermediates := $(call local-intermediates-dir)
+include $(LOCAL_PATH)/Android.mk
+# Redefine LOCAL_SRC_FILES with the correct prefix
+LOCAL_SRC_FILES := $(addprefix $d/,$(LOCAL_SRC_FILES))
+# Use the base path to resolve file names
+LOCAL_PATH := $(BASE_PATH)
+# Append jsc intermediate include paths to the WebKit include list.
+LOCAL_C_INCLUDES := $(WEBKIT_C_INCLUDES) \
+	$(intermediates) \
+	$(intermediates)/parser \
+	$(intermediates)/runtime \
+# Build libjs
+include $(BUILD_STATIC_LIBRARY)
+endif  # JAVASCRIPT_ENGINE == jsc
+
+# Now build the shared library using only the exported jni entry point. This
+# will strip out any unused code from the entry point.
+include $(CLEAR_VARS)
+# if you need to make webcore huge (for debugging), enable this line
+#LOCAL_PRELINK_MODULE := false
+LOCAL_MODULE := libwebcore
+LOCAL_LDLIBS := $(WEBKIT_LDLIBS)
+LOCAL_SHARED_LIBRARIES := $(WEBKIT_SHARED_LIBRARIES)
+LOCAL_STATIC_LIBRARIES := libwebcore $(WEBKIT_STATIC_LIBRARIES)
+ifeq ($(JAVASCRIPT_ENGINE),jsc)
+LOCAL_STATIC_LIBRARIES += libjs
+endif
+LOCAL_LDFLAGS := -fvisibility=hidden
+LOCAL_CFLAGS := $(WEBKIT_CFLAGS)
+LOCAL_C_INCLUDES := $(WEBKIT_C_INCLUDES)
+LOCAL_PATH := $(BASE_PATH)
+include $(BUILD_SHARED_LIBRARY)
diff --git a/Source/CMakeLists.txt b/Source/CMakeLists.txt
index d6368c0..cdaa555 100644
--- a/Source/CMakeLists.txt
+++ b/Source/CMakeLists.txt
@@ -13,7 +13,8 @@ SET(JAVASCRIPTCORE_DIR "${CMAKE_SOURCE_DIR}/JavaScriptCore")
 SET(WEBCORE_DIR "${CMAKE_SOURCE_DIR}/WebCore")
 SET(WEBKIT_DIR "${CMAKE_SOURCE_DIR}/WebKit")
 SET(TOOLS_DIR "${CMAKE_SOURCE_DIR}/../Tools")
-SET(DERIVED_SOURCES_DIR "${CMAKE_BINARY_DIR}/DerivedSources")
+SET(DERIVED_SOURCES_WEBCORE_DIR "${CMAKE_BINARY_DIR}/DerivedSources/WebCore")
+SET(DERIVED_SOURCES_JAVASCRIPTCORE_DIR "${CMAKE_BINARY_DIR}/DerivedSources/JavaScriptCore")
 
 INCLUDE(WebKitMacros)
 INCLUDE(WebKitFS)
diff --git a/Source/JavaScriptCore/API/JSCallbackConstructor.cpp b/Source/JavaScriptCore/API/JSCallbackConstructor.cpp
index e8ae274..fa9d216 100644
--- a/Source/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/Source/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -38,7 +38,7 @@ namespace JSC {
 
 const ClassInfo JSCallbackConstructor::s_info = { "CallbackConstructor", &JSObjectWithGlobalObject::s_info, 0, 0 };
 
-JSCallbackConstructor::JSCallbackConstructor(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback)
+JSCallbackConstructor::JSCallbackConstructor(JSGlobalObject* globalObject, Structure* structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback)
     : JSObjectWithGlobalObject(globalObject, structure)
     , m_class(jsClass)
     , m_callback(callback)
diff --git a/Source/JavaScriptCore/API/JSCallbackConstructor.h b/Source/JavaScriptCore/API/JSCallbackConstructor.h
index 001c416..64b237d 100644
--- a/Source/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/Source/JavaScriptCore/API/JSCallbackConstructor.h
@@ -33,13 +33,13 @@ namespace JSC {
 
 class JSCallbackConstructor : public JSObjectWithGlobalObject {
 public:
-    JSCallbackConstructor(JSGlobalObject*, NonNullPassRefPtr<Structure>, JSClassRef, JSObjectCallAsConstructorCallback);
+    JSCallbackConstructor(JSGlobalObject*, Structure*, JSClassRef, JSObjectCallAsConstructorCallback);
     virtual ~JSCallbackConstructor();
     JSClassRef classRef() const { return m_class; }
     JSObjectCallAsConstructorCallback callback() const { return m_callback; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
+    static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
     {
         return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.h b/Source/JavaScriptCore/API/JSCallbackFunction.h
index 11fb95c..55c9ed4 100644
--- a/Source/JavaScriptCore/API/JSCallbackFunction.h
+++ b/Source/JavaScriptCore/API/JSCallbackFunction.h
@@ -39,7 +39,7 @@ public:
     
     // InternalFunction mish-mashes constructor and function behavior -- we should 
     // refactor the code so this override isn't necessary
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
+    static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
     { 
         return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
     }
diff --git a/Source/JavaScriptCore/API/JSCallbackObject.cpp b/Source/JavaScriptCore/API/JSCallbackObject.cpp
index e3ef7a4..6a7462a 100644
--- a/Source/JavaScriptCore/API/JSCallbackObject.cpp
+++ b/Source/JavaScriptCore/API/JSCallbackObject.cpp
@@ -39,4 +39,16 @@ ASSERT_CLASS_FITS_IN_CELL(JSCallbackObject<JSGlobalObject>);
 template <> const ClassInfo JSCallbackObject<JSObjectWithGlobalObject>::s_info = { "CallbackObject", &JSObjectWithGlobalObject::s_info, 0, 0 };
 template <> const ClassInfo JSCallbackObject<JSGlobalObject>::s_info = { "CallbackGlobalObject", &JSGlobalObject::s_info, 0, 0 };
 
+void JSCallbackObjectData::finalize(Handle<Unknown> handle, void* context)
+{
+    JSClassRef jsClass = static_cast<JSClassRef>(context);
+    JSObjectRef thisRef = toRef(asObject(handle.get()));
+    
+    for (; jsClass; jsClass = jsClass->parentClass)
+        if (JSObjectFinalizeCallback finalize = jsClass->finalize)
+            finalize(thisRef);
+    HandleSlot slot = handle.slot();
+    HandleHeap::heapFor(slot)->deallocate(slot);
+}
+    
 } // namespace JSC
diff --git a/Source/JavaScriptCore/API/JSCallbackObject.h b/Source/JavaScriptCore/API/JSCallbackObject.h
index a0adb44..d2e0dcb 100644
--- a/Source/JavaScriptCore/API/JSCallbackObject.h
+++ b/Source/JavaScriptCore/API/JSCallbackObject.h
@@ -34,7 +34,7 @@
 
 namespace JSC {
 
-struct JSCallbackObjectData {
+struct JSCallbackObjectData : WeakHandleOwner {
     JSCallbackObjectData(void* privateData, JSClassRef jsClass)
         : privateData(privateData)
         , jsClass(jsClass)
@@ -110,15 +110,15 @@ struct JSCallbackObjectData {
         PrivatePropertyMap m_propertyMap;
     };
     OwnPtr<JSPrivatePropertyMap> m_privateProperties;
+    virtual void finalize(Handle<Unknown>, void*);
 };
 
     
 template <class Base>
 class JSCallbackObject : public Base {
 public:
-    JSCallbackObject(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, JSClassRef, void* data);
-    JSCallbackObject(JSClassRef, NonNullPassRefPtr<Structure>);
-    virtual ~JSCallbackObject();
+    JSCallbackObject(ExecState*, JSGlobalObject*, Structure*, JSClassRef, void* data);
+    JSCallbackObject(JSGlobalData&, JSClassRef, Structure*);
 
     void setPrivate(void* data);
     void* getPrivate();
@@ -128,7 +128,7 @@ public:
     JSClassRef classRef() const { return m_callbackObjectData->jsClass; }
     bool inherits(JSClassRef) const;
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
+    static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
     { 
         return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), Base::AnonymousSlotCount, &s_info); 
     }
diff --git a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
index ca15e1f..8639e1a 100644
--- a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -50,7 +50,7 @@ inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValue
 }
 
 template <class Base>
-JSCallbackObject<Base>::JSCallbackObject(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, JSClassRef jsClass, void* data)
+JSCallbackObject<Base>::JSCallbackObject(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, JSClassRef jsClass, void* data)
     : Base(globalObject, structure)
     , m_callbackObjectData(adoptPtr(new JSCallbackObjectData(data, jsClass)))
 {
@@ -61,8 +61,8 @@ JSCallbackObject<Base>::JSCallbackObject(ExecState* exec, JSGlobalObject* global
 // Global object constructor.
 // FIXME: Move this into a separate JSGlobalCallbackObject class derived from this one.
 template <class Base>
-JSCallbackObject<Base>::JSCallbackObject(JSClassRef jsClass, NonNullPassRefPtr<Structure> structure)
-    : Base(structure)
+JSCallbackObject<Base>::JSCallbackObject(JSGlobalData& globalData, JSClassRef jsClass, Structure* structure)
+    : Base(globalData, structure)
     , m_callbackObjectData(adoptPtr(new JSCallbackObjectData(0, jsClass)))
 {
     ASSERT(Base::inherits(&s_info));
@@ -88,16 +88,16 @@ void JSCallbackObject<Base>::init(ExecState* exec)
         JSObjectInitializeCallback initialize = initRoutines[i];
         initialize(toRef(exec), toRef(this));
     }
-}
 
-template <class Base>
-JSCallbackObject<Base>::~JSCallbackObject()
-{
-    JSObjectRef thisRef = toRef(this);
-    
-    for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass)
-        if (JSObjectFinalizeCallback finalize = jsClass->finalize)
-            finalize(thisRef);
+    bool needsFinalizer = false;
+    for (JSClassRef jsClassPtr = classRef(); jsClassPtr && !needsFinalizer; jsClassPtr = jsClassPtr->parentClass)
+        needsFinalizer = jsClassPtr->finalize;
+    if (needsFinalizer) {
+        HandleSlot slot = exec->globalData().allocateGlobalHandle();
+        HandleHeap::heapFor(slot)->makeWeak(slot, m_callbackObjectData.get(), classRef());
+        HandleHeap::heapFor(slot)->writeBarrier(slot, this);
+        *slot = this;
+    }
 }
 
 template <class Base>
diff --git a/Source/JavaScriptCore/API/JSClassRef.cpp b/Source/JavaScriptCore/API/JSClassRef.cpp
index 70668bd..08dc721 100644
--- a/Source/JavaScriptCore/API/JSClassRef.cpp
+++ b/Source/JavaScriptCore/API/JSClassRef.cpp
@@ -254,7 +254,7 @@ JSObject* OpaqueJSClass::prototype(ExecState* exec)
         jsClassData.cachedPrototype.set(exec->globalData(), new (exec) JSCallbackObject<JSObjectWithGlobalObject>(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData), 0); // set jsClassData as the object's private data, so it can clear our reference on destruction
         if (parentClass) {
             if (JSObject* prototype = parentClass->prototype(exec))
-                jsClassData.cachedPrototype->setPrototype(prototype);
+                jsClassData.cachedPrototype->setPrototype(exec->globalData(), prototype);
         }
     }
     return jsClassData.cachedPrototype.get();
diff --git a/Source/JavaScriptCore/API/JSClassRef.h b/Source/JavaScriptCore/API/JSClassRef.h
index 239c5a4..d346cc5 100644
--- a/Source/JavaScriptCore/API/JSClassRef.h
+++ b/Source/JavaScriptCore/API/JSClassRef.h
@@ -28,10 +28,10 @@
 
 #include "JSObjectRef.h"
 
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
-#include <runtime/UString.h>
-#include <runtime/WeakGCPtr.h>
+#include "Weak.h"
+#include "JSObject.h"
+#include "Protect.h"
+#include "UString.h"
 #include <wtf/HashMap.h>
 
 struct StaticValueEntry {
@@ -82,7 +82,7 @@ public:
 
     OpaqueJSClassStaticValuesTable* staticValues;
     OpaqueJSClassStaticFunctionsTable* staticFunctions;
-    JSC::WeakGCPtr<JSC::JSObject> cachedPrototype;
+    JSC::Weak<JSC::JSObject> cachedPrototype;
 };
 
 struct OpaqueJSClass : public ThreadSafeRefCounted<OpaqueJSClass> {
diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index e5c778f..03d0622 100644
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -97,12 +97,12 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
         return JSGlobalContextRetain(toGlobalRef(globalObject->globalExec()));
     }
 
-    JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(*globalData, jsNull()));
+    JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(*globalData, globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(*globalData, jsNull()));
     ExecState* exec = globalObject->globalExec();
     JSValue prototype = globalObjectClass->prototype(exec);
     if (!prototype)
         prototype = jsNull();
-    globalObject->resetPrototype(prototype);
+    globalObject->resetPrototype(*globalData, prototype);
     return JSGlobalContextRetain(toGlobalRef(exec));
 }
 
@@ -141,9 +141,10 @@ void JSGlobalContextRelease(JSGlobalContextRef ctx)
     //   it may  release a lot of GC memory - run the garbage collector now.
     // * If there are more references remaining the the global object, then do nothing
     //   (specifically that is more protects, which we assume come from other JSGlobalContextRefs).
-    if (releasingContextGroup)
+    if (releasingContextGroup) {
+        globalData.clearBuiltinStructures();
         globalData.heap.destroy();
-    else if (releasingGlobalObject)
+    } else if (releasingGlobalObject)
         globalData.heap.collectAllGarbage();
 
     globalData.deref();
diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index b7030e4..2df010a 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -83,7 +83,7 @@ JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
 
     JSCallbackObject<JSObjectWithGlobalObject>* object = new (exec) JSCallbackObject<JSObjectWithGlobalObject>(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), jsClass, data);
     if (JSObject* prototype = jsClass->prototype(exec))
-        object->setPrototype(prototype);
+        object->setPrototype(exec->globalData(), prototype);
 
     return toRef(object);
 }
@@ -235,7 +235,7 @@ void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
 
-    jsObject->setPrototypeWithCycleCheck(jsValue.isObject() ? jsValue : jsNull());
+    jsObject->setPrototypeWithCycleCheck(exec->globalData(), jsValue.isObject() ? jsValue : jsNull());
 }
 
 bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
diff --git a/Source/JavaScriptCore/Android.mk b/Source/JavaScriptCore/Android.mk
index bf60ab0..4cb76ad 100644
--- a/Source/JavaScriptCore/Android.mk
+++ b/Source/JavaScriptCore/Android.mk
@@ -51,6 +51,14 @@ LOCAL_SRC_FILES := \
 	debugger/DebuggerActivation.cpp \
 	debugger/DebuggerCallFrame.cpp \
 	\
+	heap/ConservativeRoots.cpp \
+	heap/Heap.cpp \
+	heap/MachineStackMarker.cpp \
+	heap/MarkStack.cpp \
+	heap/MarkStackPosix.cpp \
+	heap/MarkedBlock.cpp \
+	heap/MarkedSpace.cpp \
+	\
 	interpreter/CallFrame.cpp \
 	interpreter/Interpreter.cpp \
 	interpreter/RegisterFile.cpp \
@@ -87,9 +95,6 @@ LOCAL_SRC_FILES := \
 	runtime/BooleanObject.cpp \
 	runtime/BooleanPrototype.cpp \
 	runtime/CallData.cpp \
-	runtime/MarkedBlock.cpp \
-	runtime/MarkedSpace.cpp \
-	runtime/Heap.cpp \
 	runtime/CommonIdentifiers.cpp \
 	runtime/Completion.cpp \
 	runtime/ConstructData.cpp \
@@ -120,10 +125,8 @@ LOCAL_SRC_FILES := \
 	runtime/JSGlobalData.cpp \
 	runtime/JSGlobalObject.cpp \
 	runtime/JSGlobalObjectFunctions.cpp \
-	runtime/JSImmediate.cpp \
 	runtime/JSLock.cpp \
 	runtime/JSNotAnObject.cpp \
-	runtime/JSNumberCell.cpp \
 	runtime/JSONObject.cpp \
 	runtime/JSObject.cpp \
 	runtime/JSObjectWithGlobalObject.cpp \
@@ -135,10 +138,6 @@ LOCAL_SRC_FILES := \
 	runtime/JSWrapperObject.cpp \
 	runtime/LiteralParser.cpp \
 	runtime/Lookup.cpp \
-	runtime/MachineStackMarker.cpp \
-	runtime/ConservativeSet.cpp \
-	runtime/MarkStack.cpp \
-	runtime/MarkStackPosix.cpp \
 	runtime/MathObject.cpp \
 	runtime/NativeErrorConstructor.cpp \
 	runtime/NativeErrorPrototype.cpp \
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 247d372..c994611 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -6,7 +6,7 @@ SET(JavaScriptCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/assembler"
     "${JAVASCRIPTCORE_DIR}/bytecode"
     "${JAVASCRIPTCORE_DIR}/bytecompiler"
-    "${JAVASCRIPTCORE_DIR}/collector/handles"
+    "${JAVASCRIPTCORE_DIR}/heap"
     "${JAVASCRIPTCORE_DIR}/debugger"
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
@@ -41,8 +41,14 @@ SET(JavaScriptCore_SOURCES
     bytecompiler/BytecodeGenerator.cpp
     bytecompiler/NodesCodegen.cpp
 
-    collector/handles/HandleHeap.cpp
-    collector/handles/HandleStack.cpp
+    heap/Heap.cpp
+    heap/HandleHeap.cpp
+    heap/HandleStack.cpp
+    heap/MachineStackMarker.cpp
+    heap/MarkedBlock.cpp
+    heap/MarkedSpace.cpp
+    heap/ConservativeRoots.cpp
+    heap/MarkStack.cpp
 
     debugger/Debugger.cpp
     debugger/DebuggerActivation.cpp
@@ -85,9 +91,6 @@ SET(JavaScriptCore_SOURCES
     runtime/BooleanObject.cpp
     runtime/BooleanPrototype.cpp
     runtime/CallData.cpp
-    runtime/MarkedBlock.cpp
-    runtime/MarkedSpace.cpp
-    runtime/Heap.cpp
     runtime/CommonIdentifiers.cpp
     runtime/Completion.cpp
     runtime/ConstructData.cpp
@@ -117,10 +120,8 @@ SET(JavaScriptCore_SOURCES
     runtime/JSGlobalData.cpp
     runtime/JSGlobalObject.cpp
     runtime/JSGlobalObjectFunctions.cpp
-    runtime/JSImmediate.cpp
     runtime/JSLock.cpp
     runtime/JSNotAnObject.cpp
-    runtime/JSNumberCell.cpp
     runtime/JSObject.cpp
     runtime/JSObjectWithGlobalObject.cpp
     runtime/JSONObject.cpp
@@ -133,9 +134,6 @@ SET(JavaScriptCore_SOURCES
     runtime/JSZombie.cpp
     runtime/LiteralParser.cpp
     runtime/Lookup.cpp
-    runtime/MachineStackMarker.cpp
-    runtime/ConservativeSet.cpp
-    runtime/MarkStack.cpp
     runtime/MathObject.cpp
     runtime/NativeErrorConstructor.cpp
     runtime/NativeErrorPrototype.cpp
@@ -197,28 +195,29 @@ SET(JavaScriptCore_LIBRARIES
 # GENERATOR 1-A: LUT creator
 FOREACH (_file ${JavaScriptCore_LUT_FILES})
     GET_FILENAME_COMPONENT(_name ${_file} NAME_WE)
-    GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/${_file} ${DERIVED_SOURCES_DIR}/${_name}.lut.h)
-    LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_DIR}/${_name}.lut.h)
+    GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/${_file} ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/${_name}.lut.h)
+    LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/${_name}.lut.h)
 ENDFOREACH ()
 
 
 # GENERATOR 1-B: particular LUT creator (for 1 file only)
-GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/parser/Keywords.table ${DERIVED_SOURCES_DIR}/Lexer.lut.h MAIN_DEPENDENCY)
-LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_DIR}/Lexer.lut.h)
+GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/parser/Keywords.table ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Lexer.lut.h MAIN_DEPENDENCY)
+LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Lexer.lut.h)
 
 #GENERATOR: "RegExpJitTables.h": tables used by Yarr
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/RegExpJitTables.h
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h
     MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/create_regex_tables
-    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/create_regex_tables > ${DERIVED_SOURCES_DIR}/RegExpJitTables.h
+    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/create_regex_tables > ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h
     VERBATIM)
-ADD_SOURCE_DEPENDENCIES(${JAVASCRIPTCORE_DIR}/yarr/YarrPattern.cpp ${DERIVED_SOURCES_DIR}/RegExpJitTables.h)
+ADD_SOURCE_DEPENDENCIES(${JAVASCRIPTCORE_DIR}/yarr/YarrPattern.cpp ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h)
 
 
 
 IF (WTF_CPU_ARM)
     LIST(APPEND JavaScriptCore_SOURCES
         assembler/ARMAssembler.cpp
+        assembler/ARMv7Assembler.cpp
         assembler/MacroAssemblerARM.cpp
     )
 ELSEIF (WTF_CPU_MIPS)
diff --git a/Source/JavaScriptCore/CMakeListsEfl.txt b/Source/JavaScriptCore/CMakeListsEfl.txt
index 9d3c71e..cdc3fe2 100644
--- a/Source/JavaScriptCore/CMakeListsEfl.txt
+++ b/Source/JavaScriptCore/CMakeListsEfl.txt
@@ -1,7 +1,7 @@
 LIST(APPEND JavaScriptCore_SOURCES
     jit/ExecutableAllocatorFixedVMPool.cpp
     jit/ExecutableAllocator.cpp
-    runtime/MarkStackPosix.cpp
+    heap/MarkStackPosix.cpp
     wtf/OSAllocatorPosix.cpp
 )
 
diff --git a/Source/JavaScriptCore/CMakeListsWinCE.txt b/Source/JavaScriptCore/CMakeListsWinCE.txt
index 58a535e..d878863 100644
--- a/Source/JavaScriptCore/CMakeListsWinCE.txt
+++ b/Source/JavaScriptCore/CMakeListsWinCE.txt
@@ -1,7 +1,7 @@
 LIST(APPEND JavaScriptCore_SOURCES
     jit/ExecutableAllocator.cpp
 
-    runtime/MarkStackWin.cpp
+    heap/MarkStackWin.cpp
 )
 
 IF (ENABLE_JIT AND WTF_CPU_ARM)
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 7cc1d15..bb10264 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,2847 @@
+2011-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove unneeded deprecated methods from MarkStack
+        https://bugs.webkit.org/show_bug.cgi?id=58853
+
+        Remove deprecated methods
+
+        * heap/MarkStack.h:
+
+2011-04-19  Mark Rowe  <mrowe@apple.com>
+
+        Things work best when the Xcode project refers to the file at a path that exists.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-04-19  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move the alignment related macros in Vector.h to new Alignment.h.
+        https://bugs.webkit.org/show_bug.cgi?id=56000
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Alignment.h: Added.
+        * wtf/CMakeLists.txt:
+        * wtf/Vector.h:
+
+2011-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
+
+        Remove the class an all functions that still exist to support it.
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+
+2011-04-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by David Levin
+
+        Add U+FEFF (Zero width no-break space) to CharacterNames.h.
+        It's added to the list of characters to treat as zero-width
+        in WebCore.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48860
+
+        * wtf/unicode/CharacterNames.h:
+
+2011-04-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] REGRESSION(84176): http/tests/xmlhttprequest/event-listener-gc.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=58871
+
+        Unreviewed, rolling out r84176, r84178, r84186, r84212 and r84231.
+        http://trac.webkit.org/changeset/84176 (original patch)
+        http://trac.webkit.org/changeset/84178 (original patch - part 2)
+        http://trac.webkit.org/changeset/84186 (build fix)
+        http://trac.webkit.org/changeset/84212
+        http://trac.webkit.org/changeset/84231 (skip failing test)
+
+        original bugs:
+         - https://bugs.webkit.org/show_bug.cgi?id=58718
+         - https://bugs.webkit.org/show_bug.cgi?id=58853
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::deprecatedAppend):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::operator==):
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove unneeded deprecated methods from MarkStack
+        https://bugs.webkit.org/show_bug.cgi?id=58853
+
+        Remove deprecated methods
+
+        * heap/MarkStack.h:
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Off by one initialising repeat callframe
+        https://bugs.webkit.org/show_bug.cgi?id=58838
+        <rdar://problem/8756810>
+
+        If the end of a callframe made for a repeat call landed on
+        a page boundary the following page may not have been committed
+        which means that the off by one could lead to a crash.  However
+        it could only happen in this case and only on windows which is
+        why it was so hard to repro.  Alas given the steps needed to
+        reproduce are such that it's not really possible to make a
+        testcase.
+
+        This fix makes the code a little less squirrely by not trying
+        to avoid the unnecessary initialisation of |this|.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+
+2011-04-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 58829 - DFG JIT - Optimize add/sub immediate, multiply.
+
+        Add code generation for add/subtract instruction with immediate operands
+        (where a child is a constant), and don't bail to non-speculative if an
+        integer multiple results in a +0 result (only if it should be generating -0).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isDoubleConstantWithInt32Value):
+
+2011-04-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 58817 - DFG JIT - if speculative compilation fails, throw away code.
+
+        If we detect a logical conflict, throw away generated code,
+        and only compile through the NonSpeculativeJIT.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::rewindToLabel):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::rewindToOffset):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::rewindToLabel):
+        (JSC::X86Assembler::X86InstructionFormatter::rewindToLabel):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkSpeculationChecks):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculationCheckIndexIterator::SpeculationCheckIndexIterator):
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
+
+        As simple as it sounds.
+
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+
+2011-04-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        JSC no longer builds with Clang due to -Woverloaded-virtual warning
+        https://bugs.webkit.org/show_bug.cgi?id=58760
+
+        Rename Structure's specificValue overload of put to putSpecificValue to avoid
+        Clang's warning for overloading a virtual function.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::putSpecificValue):
+        * runtime/Structure.h:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Remove WTF_PLATFORM_SGL
+        https://bugs.webkit.org/show_bug.cgi?id=58743
+
+        WTF_PLATFORM_SGL and PLATFORM(SGL) are not used in the code anywhere.
+
+        * wtf/Platform.h:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CA) to USE(CA)
+        https://bugs.webkit.org/show_bug.cgi?id=58742
+
+        * wtf/Platform.h:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CG) to USE(CG)
+        https://bugs.webkit.org/show_bug.cgi?id=58729
+
+        * wtf/Platform.h:
+
+2011-04-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Rename PLATFORM(CAIRO) to USE(CAIRO)
+        https://bugs.webkit.org/show_bug.cgi?id=55192
+
+        * wtf/Platform.h:
+        * wtf/gobject/GTypedefs.h:
+
+2011-04-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84067.
+        http://trac.webkit.org/changeset/84067
+        https://bugs.webkit.org/show_bug.cgi?id=58724
+
+        qt build are failing. (Requested by loislo2 on #webkit).
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::operator==):
+
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Errrk! - build fix from !x86-64.
+
+        * dfg/DFGNode.h:
+
+2011-04-15  David Levin  <levin@chromium.org>
+
+        Revert of r83974.
+
+        JavaScriptCore shouldn't depend on ../ThirdParty/gtest/xcode/gtest.xcodeproj
+        https://bugs.webkit.org/show_bug.cgi?id=58716
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/tests/RunAllWtfTests.cpp: Removed.
+        * wtf/tests/StringTests.cpp: Removed.
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
+
+        As simple as it sounds.
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add a simple tool to gather statistics on whether functions
+        are completed through the new or old JIT.
+
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        GC allocate Structure
+        https://bugs.webkit.org/show_bug.cgi?id=58483
+
+        Rolling r83894 r83827 r83810 r83809 r83808 back in with
+        a workaround for the gcc bug seen by the gtk bots
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::markStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::MethodCallLinkInfo::setSeen):
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * heap/Handle.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * heap/Strong.h:
+        (JSC::Strong::Strong):
+        (JSC::Strong::set):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::uncachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::uncacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::storePtrWithWriteBarrier):
+        * jsc.cpp:
+        (cleanupGlobalData):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        (JSC::arrayProtoFuncSplice):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::createStructure):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::isZombie):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::JSCell):
+        (JSC::JSCell::JSCell::addressOfStructure):
+        (JSC::JSCell::JSCell::structure):
+        (JSC::JSCell::JSCell::markChildren):
+        (JSC::JSCell::JSValue::isZombie):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::clearBuiltinStructures):
+        (JSC::JSGlobalData::createLeaked):
+        * runtime/JSGlobalData.h:
+        (JSC::allocateGlobalHandle):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        (JSC::JSGlobalObject::copyGlobalsFrom):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::isValid):
+        (JSC::constructEmptyArray):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSFinalObject::create):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::constructEmptyObject):
+        (JSC::createEmptyObjectStructure):
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::setStructure):
+        (JSC::JSObject::inheritorID):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::transitionTo):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::createStructure):
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::Structure::setEnumerationCache):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        (JSC::JSVariableObject::JSVariableObject):
+        (JSC::JSVariableObject::copyRegisterArray):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/JSZombie.cpp:
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::createStructure):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::markChildren):
+        (JSC::constructWithNativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::markChildren):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::createStructure):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::StructureTransitionTable::keyForWeakGCMapFinalizer):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        (JSC::StructureChain::markChildren):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::head):
+        (JSC::StructureChain::createStructure):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::WeakGCMapFinalizerCallback::finalizerContextFor):
+        (JSC::StructureTransitionTable::WeakGCMapFinalizerCallback::keyForFinalizer):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::slot):
+        (JSC::StructureTransitionTable::setMap):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::clearSingleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        * runtime/WeakGCMap.h:
+        (JSC::DefaultWeakGCMapFinalizerCallback::finalizerContextFor):
+        (JSC::DefaultWeakGCMapFinalizerCallback::keyForFinalizer):
+        (JSC::WeakGCMap::contains):
+        (JSC::WeakGCMap::find):
+        (JSC::WeakGCMap::remove):
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::finalize):
+        * runtime/WriteBarrier.h:
+        (JSC::writeBarrier):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+
+2011-04-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gavin Barraclough.
+
+        Correctly prefix symbols. Since gcc 4.5.0, Windows x64 symbols
+        are not prefixed by underscore anymore. This is consistent with
+        what MSVC does.
+        https://bugs.webkit.org/show_bug.cgi?id=58573
+
+        * jit/JITStubs.cpp:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 58705 - DFG JIT Add support for flow control (branch, jump).
+
+        Add support for control flow by breaking the CodeBlock up into multiple
+        basic blocks, generating code for each basic block in turn through the
+        speculative JIT & then the non-speculative JIT.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setTemporary):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::BasicBlock::getBytecodeOffset):
+        (JSC::DFG::Graph::blockIndexForBytecodeOffset):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::JITCodeGenerator):
+        (JSC::DFG::JITCodeGenerator::addBranch):
+        (JSC::DFG::JITCodeGenerator::linkBranches):
+        (JSC::DFG::JITCodeGenerator::BranchRecord::BranchRecord):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::isJump):
+        (JSC::DFG::Node::isBranch):
+        (JSC::DFG::Node::takenBytecodeOffset):
+        (JSC::DFG::Node::notTakenBytecodeOffset):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 58701 - DFG JIT - add GetLocal/SetLocal nodes
+
+        Use these for both access to arguments & local variables, adds ability
+        to set locals, such that values will persist between basic blocks.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::getThis):
+        (JSC::DFG::ByteCodeParser::setThis):
+        (JSC::DFG::ByteCodeParser::VariableRecord::VariableRecord):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::derefChildren):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasLocal):
+        (JSC::DFG::Node::local):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 58696 - DFG JIT split handling of vars/temporaries
+
+        Presently all callee registers are treated as having single block scope,
+        since the DFG JIT can only compile single block functions. In order to
+        expand the JIT to support control flow we will need to change to retaining
+        locals (but not temporaries) across basic block boundaries.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getTemporary):
+        (JSC::DFG::ByteCodeParser::setTemporary):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::getInt32Constant):
+        (JSC::DFG::ByteCodeParser::getDoubleConstant):
+        (JSC::DFG::ByteCodeParser::getJSConstant):
+        (JSC::DFG::ByteCodeParser::constantUndefined):
+        (JSC::DFG::ByteCodeParser::constantNull):
+        (JSC::DFG::ByteCodeParser::one):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        (JSC::DFG::parse):
+        * dfg/DFGNode.h:
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::ScoreBoard):
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::allocate):
+        (JSC::DFG::ScoreBoard::use):
+
+2011-04-15  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        globalObject moved to JSObjectWithGlobalObject.cpp inhibits inlining
+        https://bugs.webkit.org/show_bug.cgi?id=58677
+
+        Moved JSObjectWithGlobalObject::globalObject() to 
+        runtime/JSObjectWithGlobalObject.h to allow the compiler to inline
+        it for a performance benefit.  An equivalent instance had been in
+        a header file before r60057.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObjectWithGlobalObject.cpp:
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::globalObject):
+
+2011-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make JSNodeFilterCondition handle its lifetime correctly
+        https://bugs.webkit.org/show_bug.cgi?id=58622
+
+        Add export
+
+        * JavaScriptCore.exp:
+
+2011-04-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Password field input does not switch to ASCII-compatible source
+        https://bugs.webkit.org/show_bug.cgi?id=58583
+        <rdar://problem/9059651>
+
+        * wtf/Platform.h: Removed WTF_USE_CARBON_SECURE_INPUT_MODE. It's now only used by Chromium,
+        and shouldn't be enabled on any other platforms, so there is no reason to make it
+        configurable via Platform.h.
+
+2011-04-15  Dmitry Lomov  <dslomov@google.com>
+
+        Reviewed by David Levin.
+
+        Add a sample test case for GTest framework
+        https://bugs.webkit.org/show_bug.cgi?id=58509
+
+        Add an example of GTest testcase, complete with a runner, to JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/tests/RunAllWtfTests.cpp: Added.
+        (main):
+        * wtf/tests/StringTests.cpp: Added.
+
+2011-04-15  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Renaming TRACK feature define to VIDEO_TRACK
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoffrey Garen.
+
+        Hide DFG_JIT_RESTRICTIONS behind ARITHMETIC_OP() macro, and rename
+        m_regressionGuard to m_parseFailed, such that it can be reused for
+        other failure cases.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parse):
+
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 58620 - DFG JIT - loading of arguments should not be lazy
+
+        This optimization is overly simplistic. It only works because we never
+        write out definitions to arguments (since we currently only compile
+        single block functions). Revert this for now, we may want to reintroduce
+        something like this again in the future, but it will need to be aware
+        how to schedule definitions to arguments versus lazy loads that have not
+        yet been performed.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::needsSpill):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::initConstantInfo):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        (JSC::DFG::JITCompiler::fillToJS):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::isKnownInteger):
+        (JSC::DFG::NonSpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 58600 - DFG JIT bugs in ValueToInt, PutByVal
+
+        The bug in PutByVal is that an operand is in JSValueOperand - when this
+        locks an integer into a register it will always retag the value without
+        checking if the register is already locked. This is a problem where the
+        value being stored by a PutByVal is the same as the subscript.
+        The subscript is locked into a register first, as a strict integer.
+        Locking the value results in the subscript being modified.
+
+        The bug in ValueToInt related to the function of sillentFillAllRegisters.
+        The problem is that this method will restore all register values from
+        prior to the call, overwriting the result of the call out. Allow a
+        register to be passed to specifically be excluded from being preserved.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::debugOffset):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::debugOffset):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::debugOffset):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::debugOffset):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::debugAddress):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::debugOffset):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::orPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::debugOffset):
+        (JSC::X86Assembler::X86InstructionFormatter::debugOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGenerationInfo.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::isConstant):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::isConstant):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::valueToNumber):
+        (JSC::DFG::NonSpeculativeJIT::valueToInt32):
+        (JSC::DFG::NonSpeculativeJIT::numberToInt32):
+        (JSC::DFG::NonSpeculativeJIT::isKnownInteger):
+        (JSC::DFG::NonSpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        (JSC::DFG::NonSpeculativeJIT::silentSpillGPR):
+        (JSC::DFG::NonSpeculativeJIT::silentSpillFPR):
+        (JSC::DFG::NonSpeculativeJIT::silentFillGPR):
+        (JSC::DFG::NonSpeculativeJIT::silentFillFPR):
+        (JSC::DFG::NonSpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::NonSpeculativeJIT::silentFillAllRegisters):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Drain the mark stack while marking weak handles, not after.
+        https://bugs.webkit.org/show_bug.cgi?id=58574
+
+        Otherwise, items that would have caused more weak handle marking are
+        processed after all weak handle marking has finished, and referenced
+        weak handles get recycled.
+
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles): Removed looping from here, since we
+        want Heap::markRoots to be responsible for draining the mark stack.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots): Moved looping to here, as explained above.
+        
+        For efficiency's sake, drain the mark stack before starting to mark weak
+        handles. Otherwise, items drained while marking weak handles may force
+        an extra trip through the weak handle list.
+
+        For correctness's sake, drain the mark stack each time through the weak
+        handle list. Otherwise, opaque roots that would make weak handles reachable
+        are not discovered until after weak handle marking is over.
+
+2011-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make protected object list in caches window reflect reality
+        https://bugs.webkit.org/show_bug.cgi?id=58565
+
+        Make sure the heap includes objects protected by Strong handles
+        in its list of protected objects.
+
+        * heap/HandleHeap.h:
+        * heap/Heap.cpp:
+        (JSC::HandleHeap::protectedObjectTypeCounts):
+
+2011-04-14  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        Don't emit RegExp tables for chromium where they are not used
+        https://bugs.webkit.org/show_bug.cgi?id=58544
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * create_regex_tables: Added the "--notables" command line argument.
+
+2011-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix ASSERTs seen on Windows bots.
+
+        * wtf/HashTable.h:
+        (WTF::hashTableSwap): Force MSVC to use the right version of swap.
+
+2011-04-13  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMAKE] Separate DerivedSources.
+        https://bugs.webkit.org/show_bug.cgi?id=58427
+
+        * CMakeLists.txt: Change DERIVED_SOURCES_DIR to DERIVED_SOURCES_JAVASCRIPTCORE_DIR.
+
+2011-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Switched DOM wrappers to use HashMap of Weak<T> instead of WeakGCMap<T>
+        https://bugs.webkit.org/show_bug.cgi?id=58482
+        
+        This will allow wrappers to make individual decisions about their lifetimes.
+
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::copyWeak): New function for copying a weak handle.
+        It's wasn't previously possible to perform this operation using HandleHeap
+        API because the HandleHeap doesn't expose its underlying Node structure.
+
+        * heap/Local.h:
+        (JSC::::set):
+        * heap/Strong.h:
+        (JSC::Strong::set): Added ASSERTs to verify that dead objects are not
+        resurrected by placement into handles.
+
+        (JSC::swap): Added a swap helper, so use of Strong<T> inside a hash table
+        is efficient.
+
+        * heap/Weak.h:
+        (JSC::Weak::Weak): Fixed a bug where copying a weak pointer would not
+        copy its weak callback and context.
+
+        (JSC::Weak::operator=): Added an assignment operator, since the default
+        C++ assignment operator did the wrong thing.
+
+        (JSC::Weak::set): Added ASSERTs to verify that dead objects are not
+        resurrected by placement into handles.
+
+        (JSC::swap): Added a swap helper, so use of Strong<T> inside a hash table
+        is efficient, and can be done without copying, which is illegal during
+        the handle finalization phase.
+
+2011-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make PropertyMapEntry use a WriteBarrier for specificValue
+        https://bugs.webkit.org/show_bug.cgi?id=58407
+
+        Make PropertyMapEntry use a WriteBarrier for specificValue, and then
+        propagate the required JSGlobalData through all the methods it ends
+        up being needed.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectSetPrototype):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorCreate):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::copy):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::put):
+        (JSC::Structure::getPropertyNames):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+
+2011-04-13  Paul Knight  <pknight@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        BACKTRACE() macro should check for Debug configuration in macro, not WTFReportBacktrace definition
+        https://bugs.webkit.org/show_bug.cgi?id=58405
+
+        The BACKTRACE() macro requires JavaScriptCore be built with a Debug
+        configuration in order for it to be enabled. Move the NDEBUG check to
+        the header so it will be enabled when the calling framework or
+        application is built with a Debug configuration, similar to how
+        ASSERT() and friends work.
+
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2011-04-12  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58131
+
+        Provide a workaround for an obscure Studio 12 compiler bug, which
+        couldn't call src->~T() on a const T *src.
+
+        * wtf/Vector.h:
+
+2011-04-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58395
+        Exceptions thrown from property getters called from Array prototype functions can be missed
+
+        This is caught by an ASSERT in the top of Interpreter::executeCall.
+        Check for exceptions after accessing properties that could be getters.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+            - Add exception checks.
+
+2011-04-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make API callback objects use weak handles to run their finalizers
+        https://bugs.webkit.org/show_bug.cgi?id=58389
+
+        Make the API object's private data struct act as a finalizer for
+        an api object if the callback object has a API defined finalizer.
+
+        * API/JSCallbackObject.cpp:
+        (JSC::JSCallbackObjectData::finalize):
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        * heap/Handle.h:
+
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Cleaned up hash traits, and added hash traits for handles
+        https://bugs.webkit.org/show_bug.cgi?id=58381
+
+        * heap/Handle.h:
+        (JSC::HandleBase::swap):
+        (JSC::Handle::Handle):
+        (JSC::Handle::swap): Implemented swap, so we can rehash efficiently, and
+        without creating new handles (which is not allowed during handle finalization).
+
+        * heap/Strong.h:
+        (JSC::Strong::swap): Use new SimpleClassHashTraits to avoid duplication.
+
+        * heap/Weak.h:
+        (JSC::Weak::isHashTableDeletedValue):
+        (JSC::Weak::Weak):
+        (JSC::Weak::swap):
+        (JSC::Weak::hashTableDeletedValue): Ditto.
+
+        * wtf/HashTraits.h:
+        (WTF::SimpleClassHashTraits::constructDeletedValue):
+        (WTF::SimpleClassHashTraits::isDeletedValue): Added SimpleClassHashTraits,
+        which are analogous to SimpleClassVectorTraits, since they are used in a
+        bunch of places.
+
+        * wtf/RetainPtr.h: Use new SimpleClassHashTraits to avoid duplication.
+
+        * wtf/text/StringHash.h: Use new SimpleClassHashTraits to avoid duplication.
+
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Cleaned up some Vector traits, and added missing Vector traits for handles
+        https://bugs.webkit.org/show_bug.cgi?id=58372
+
+        * heap/Local.h: Inherit from SimpleClassVectorTraits to avoid duplication.
+
+        * heap/Strong.h: Ditto.
+
+        * heap/Weak.h: Ditto.
+
+        * parser/JSParser.cpp: Fixed a traits error. No test case because this
+        particular trait is not currently exercised by the parser.
+
+        * runtime/UString.h: No need to override canInitializeWithMemset, since
+        our base class sets it to true.
+
+        * wtf/VectorTraits.h: Inherit from VectorTraitsBase to avoid duplication.
+
+        * wtf/text/WTFString.h: No need to override canInitializeWithMemset, since
+        our base class sets it to true.
+
+2011-04-12  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Enable JIT build for SH4 platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=58317
+        enable JIT build for QT backend  for SH4 platforms.
+
+        * JavaScriptCore.pro:
+        * wtf/Platform.h:
+
+2011-04-11  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58289
+
+        Fix compilation on Solaris/Studio 12 C++ in wtf/FastMalloc.cpp,
+        WTF::TCMalloc_PageHeap::runScavengerThread(void*) expected to return a value.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::runScavengerThread):
+
+2011-04-11  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Headers used outside of JavaScriptCore need to be marked as private.
+
+2011-04-11  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix a few builds.
+        
+        Updated a few more build configurations for file moves.
+
+        * CMakeListsWinCE.txt:
+
+2011-04-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 58263 - Use EncodedValueDescriptor on both JSVALUE32_64, JSVALUE64
+
+        The JSJITInterface already uses EncodedValueDescriptor to access the tag/payload
+        separately on JSVALUE64, even though EncodedValueDescriptor is not used in
+        JSVALUE64's implementation of JSValue. Remove the separate definition for m_ptr
+        on X86_64. Using the union allows us to remove a layer of makeImmediate()/
+        immedaiteValue() methods.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emitSlow_op_not):
+        * runtime/JSCell.h:
+        * runtime/JSValue.h:
+        * runtime/JSValueInlineMethods.h:
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::asCell):
+
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix a few builds.
+        
+        Updated a few more build configurations for file moves.
+
+        * CMakeListsEfl.txt:
+        * wscript:
+
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Updated a file name.
+
+        * CMakeLists.txt:
+
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+        
+        Moved remaining heap implementation files to the heap folder.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/ConservativeRoots.cpp: Copied from runtime/ConservativeSet.cpp.
+        * heap/ConservativeRoots.h: Copied from runtime/ConservativeSet.h.
+        * heap/Handle.h:
+        * heap/Heap.cpp:
+        * heap/MachineStackMarker.cpp: Copied from runtime/MachineStackMarker.cpp.
+        * heap/MachineStackMarker.h: Copied from runtime/MachineStackMarker.h.
+        * heap/MarkStack.cpp: Copied from runtime/MarkStack.cpp.
+        * heap/MarkStack.h: Copied from runtime/MarkStack.h.
+        * heap/MarkStackPosix.cpp: Copied from runtime/MarkStackPosix.cpp.
+        * heap/MarkStackSymbian.cpp: Copied from runtime/MarkStackSymbian.cpp.
+        * heap/MarkStackWin.cpp: Copied from runtime/MarkStackWin.cpp.
+        * heap/MarkedBlock.cpp: Copied from runtime/MarkedBlock.cpp.
+        * heap/MarkedBlock.h: Copied from runtime/MarkedBlock.h.
+        * heap/MarkedSpace.cpp: Copied from runtime/MarkedSpace.cpp.
+        * heap/MarkedSpace.h: Copied from runtime/MarkedSpace.h.
+        * interpreter/RegisterFile.cpp:
+        * runtime/ConservativeSet.cpp: Removed.
+        * runtime/ConservativeSet.h: Removed.
+        * runtime/MachineStackMarker.cpp: Removed.
+        * runtime/MachineStackMarker.h: Removed.
+        * runtime/MarkStack.cpp: Removed.
+        * runtime/MarkStack.h: Removed.
+        * runtime/MarkStackPosix.cpp: Removed.
+        * runtime/MarkStackSymbian.cpp: Removed.
+        * runtime/MarkStackWin.cpp: Removed.
+        * runtime/MarkedBlock.cpp: Removed.
+        * runtime/MarkedBlock.h: Removed.
+        * runtime/MarkedSpace.cpp: Removed.
+        * runtime/MarkedSpace.h: Removed.
+
+2011-04-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-04-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 58198 - Clean up JSValue implementation for JSVALUE64
+
+        Remove JSNumberCell, JSImmediate, unify some methods between JSVALUE32_64/JSVALUE64
+
+        JSNumberCell.h largely just contained the constructors for JSValue on JSVALUE64,
+        which should not have been here.  JSImmediate mostly contained uncalled methods,
+        along with the internal implementation of the JSValue constructors split unnecessarily
+        across a number of layers of function calls. These could largely be merged back
+        together. Many methods and constructors from JSVALUE32_64 and JSVALUE64 can by unified.
+
+        The .cpp files were empty.
+
+        Moving all these methods into JSValue.h seems to be a repro measurable regression, so
+        I have kept these methods in a separate JSValueInlineMethods.h. Adding the 64-bit tag
+        values as static const members of JSValue also measures as a repro regression, so I
+        have made these #defines.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+            - Removed class JSImmediate.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+            - Removed class JSImmediate.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Removed class JSImmediate.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+            - Removed class JSImmediate.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate):
+            - Removed class JSImmediate.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emitSlow_op_not):
+            - Removed class JSImmediate.
+        * jit/JSInterfaceJIT.h:
+            - Removed class JSImmediate.
+        * runtime/JSCell.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSImmediate.cpp: Removed.
+        * runtime/JSImmediate.h: Removed.
+        * runtime/JSNumberCell.cpp: Removed.
+        * runtime/JSNumberCell.h: Removed.
+            - Removed.
+        * runtime/JSObject.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSString.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSValue.h:
+            - Added tags for JSVALUE64, moved out some JSVALUE32_64 methods, unified with JSVALUE64.
+        * runtime/JSValueInlineMethods.h: Added.
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::asUInt32):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::JSValue::toJSNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::isDouble):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::tag):
+        (JSC::JSValue::payload):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::makeImmediate):
+        (JSC::JSValue::immediateValue):
+        (JSC::reinterpretDoubleToIntptr):
+        (JSC::reinterpretIntptrToDouble):
+            - Methods moved here from JSImmediate.h/JSNumberCell.h/JSValue.h.
+        * runtime/Operations.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * wtf/StdLibExtras.h:
+            - Export bitwise_cast.
+
+2011-04-11  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Oliver Hunt.
+
+        SH4 JIT SUPPORT.
+        https://bugs.webkit.org/show_bug.cgi?id=44329
+
+        Add JIT remaining part for SH4 platforms.
+
+        * assembler/MacroAssemblerSH4.h:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+
+2011-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Beth Dakin.
+
+        Moved Heap.h and Heap.cpp to the heap folder, because anything less 
+        would be uncivilized.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp: Copied from JavaScriptCore/runtime/Heap.cpp.
+        * heap/Heap.h: Copied from JavaScriptCore/runtime/Heap.h.
+        * runtime/Heap.cpp: Removed.
+        * runtime/Heap.h: Removed.
+
+2011-04-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove duplicated code from AtomicString::fromUTF8()
+        https://bugs.webkit.org/show_bug.cgi?id=53711
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8Internal):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-04-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed.
+
+        Fix build (at least on Lion) by adding some newish header files to
+        PrivateHeaders.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try recommitting some things svn left out of its last commit.
+
+        * heap/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::HandleBase):
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::setSlot):
+        (JSC::Handle::Handle):
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::isValidWeakNode):
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::globalData):
+
+2011-04-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A few heap-related renames and file moves.
+        
+        WeakGCPtr<T> => Weak<T>
+        Global<T> => Strong<T>
+        collector/ => heap/
+        collector/* => heap/*
+        runtime/WeakGCPtr.h => heap/Weak.h
+        
+        (Eventually, even more files should move into the heap directory. Like
+        Heap.h and Heap.cpp, for example.)
+
+        * API/JSClassRef.h:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SamplingTool.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * collector: Removed.
+        * collector/handles: Removed.
+        * collector/handles/Global.h: Removed.
+        * collector/handles/Handle.h: Removed.
+        * collector/handles/HandleHeap.cpp: Removed.
+        * collector/handles/HandleHeap.h: Removed.
+        * collector/handles/HandleStack.cpp: Removed.
+        * collector/handles/HandleStack.h: Removed.
+        * collector/handles/Local.h: Removed.
+        * collector/handles/LocalScope.h: Removed.
+        * heap: Copied from collector.
+        * heap/Handle.h: Copied from collector/handles/Handle.h.
+        * heap/HandleHeap.cpp: Copied from collector/handles/HandleHeap.cpp.
+        * heap/HandleHeap.h: Copied from collector/handles/HandleHeap.h.
+        * heap/HandleStack.cpp: Copied from collector/handles/HandleStack.cpp.
+        * heap/HandleStack.h: Copied from collector/handles/HandleStack.h.
+        * heap/Local.h: Copied from collector/handles/Local.h.
+        * heap/LocalScope.h: Copied from collector/handles/LocalScope.h.
+        * heap/Strong.h: Copied from collector/handles/Global.h.
+        (JSC::Strong::Strong):
+        (JSC::Strong::~Strong):
+        (JSC::Strong::operator=):
+        * heap/Weak.h: Copied from runtime/WeakGCPtr.h.
+        (JSC::Weak::Weak):
+        (JSC::Weak::~Weak):
+        * heap/handles: Removed.
+        * interpreter/RegisterFile.h:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * runtime/Structure.h:
+        * runtime/WeakGCPtr.h: Removed.
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Ooops, typo, build fix.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+
+2011-04-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 58154 - Add support for comparison operators to the DFG JIT.
+
+        Add support for <, <=, ==, ===, and also !.  Add support for all corresponding
+        bytecode ops, including the not- and -null forms.  Initially add functionally
+        correct support, we'll revisit the performance.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::constantNull):
+        (JSC::DFG::ByteCodeParser::parse):
+            - Add support for parsing of bytecode opcodes, 
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::callOperation):
+            - Add new operation call types, return bool values.
+        * dfg/DFGNode.h:
+            - Add new node types.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+            - Add code generation for new nodes.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationCompareLess):
+        (JSC::DFG::operationCompareLessEq):
+        (JSC::DFG::operationCompareEq):
+        (JSC::DFG::operationCompareStrictEq):
+        (JSC::DFG::dfgConvertJSValueToBoolean):
+        * dfg/DFGOperations.h:
+            - Add operation callbacks to implement new ops.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Add code generation for new nodes.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            - Switched to a simpler <0 check, rather than relying on an internal value in JSImmediate.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+            - Switched to a simpler <0 check, rather than relying on an internal value in JSImmediate.
+        * runtime/JSImmediate.h:
+            - Make tag values public, rather than relying on a friend - this matches JSVALUE32_64.
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [WK2][Qt][GTK] Introduce common use flag for the shared UNIX domain socket IPC implementation
+        https://bugs.webkit.org/show_bug.cgi?id=58030
+
+        * wtf/Platform.h: Introduce USE(UNIX_DOMAIN_SOCKETS) for WebKit2.
+
+2011-04-08  Adam Roben  <aroben@apple.com>
+
+        Clean build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Don't try to delete directories that
+        don't exist. Also switched from del /s to rmdir /s, which has the benefit of deleting the
+        directory itself in addition to the files it contains.
+
+2011-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Some Handle<T> cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=58109
+
+        * bytecode/SamplingTool.h: Sorted alphabetically because that's the
+        WebKit style. Added a Global.h #include that was previously missing
+        but harmless.
+
+        * collector/handles/Global.h:
+        (JSC::Global::Global): Added a null constructor. No need for a special
+        tag, and the tag is incompatible with some data structures.
+        
+        (JSC::Global::isHashTableDeletedValue):
+        (JSC::Global::~Global):
+        (JSC::Global::set):
+        (JSC::Global::operator=):
+        (JSC::Global::clear):
+        (JSC::Global::hashTableDeletedValue): Reordered constructors to be near
+        each other.
+
+        (JSC::Global::setWithWriteBarrier): Renamed internalSet to
+        setWithWriteBarrier for clarity, and funneled more code into using set
+        and setWithWriteBarrier to reduce duplication.
+
+        * collector/handles/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::HandleBase): Removed isEmpty(), since we already have
+        boolean and ! operators.
+
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::setSlot):
+        (JSC::Handle::Handle): Added general support for null Handles. This was
+        previously outlawed by ASSERTs, but our code has grown to support and
+        rely on null Handles.
+        
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::isValidWeakNode): Migrated from isValidWeakHandle,
+        and beefed this up a bit.
+
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::globalData): Added accessor, used by some new set functions.
+
+        * collector/handles/Local.h: Moved hash traits to the bottom of the file,
+        since this file is about the Local class, not the traits.
+
+        (JSC::::Local): Updated for removal of invalidate().
+
+        (JSC::::operator): Deployed "using" to avoid a lot of this->
+        template funny business.
+
+        (JSC::::setWithSlotCheck): Renamed from internalSet, more specific now.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile): Updated to use null constructor.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Structure::setEnumerationCache):
+        * runtime/Structure.h: Removed clearEnumerationCache
+        because it was an unused holdover from when the enumeration cache was
+        not a handle.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set): Finish initializing our handle before putting it
+        in the table. This seemed more logical, and at one point was required
+        to avoid triggering an ASSERT.
+
+        * runtime/WeakGCPtr.h: Inherit from Handle instead of rolling our own
+        handle-like behavior, to avoid duplication.
+
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::~WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::set):
+        (JSC::WeakGCPtr::setWithWriteBarrier): Removed duplicate code and
+        standardized on Handle idioms.
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Martin Robinson.
+
+        Refactor Gtk build system to separate list of files
+        https://bugs.webkit.org/show_bug.cgi?id=58090
+
+        This is the first step towards generating part of the GTK build system
+        using GYP.  In the first iteration, our plan is to just generate the
+        list of files.  This patch is the first step, which is to separate out
+        the part of JavaScriptCore build system that we intend to generate from
+        the rest of the build system.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am: Added.
+
+2011-04-07  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Mapping booleans the same way as integers
+        https://bugs.webkit.org/show_bug.cgi?id=56913
+
+        Instead of having a seperate tag field for booleans,
+        the logical values are stored in the payload field
+        (for JSValue32_64 representation).
+
+        1.007x speedup on SunSpider.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitStoreBool):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JSInterfaceJIT.h:
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::getBoolean):
+
+2011-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add stub support for generating Gtk build system from gyp
+        https://bugs.webkit.org/show_bug.cgi?id=58086
+
+        This does not produce a buildable JavaScriptCore, but it
+        does allow running gyp/configure --port=gtk and having
+        it generate a gtk.Makefile which we can use for testing
+        the rest of the plumbing.
+
+        * gyp/gtk.gyp: Added.
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Fix whitespace in GNUmakefile.am.
+
+        * GNUmakefile.am:
+
+2011-04-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix a couple of typos in comments that Darin spotted.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        * runtime/JSImmediate.h:
+
+2011-04-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+        Bug 58057 - Store boolean payload in low bit of JSImmediate
+
+        And remove some uncalled functions from JSImmediate.h
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::asInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::asUInt32):
+
+2011-04-07  Liang Qi  <liang.qi@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Enable webkit build with GCCE on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=57841
+
+        * wtf/MathExtras.h: GCCE compiler doesn't support those std static functions.
+
+2011-04-06  Dai Mikurube  <dmikurube@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add QUOTA build flag for unified quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57918
+
+        * Configurations/FeatureDefines.xcconfig: Added QUOTA build flag
+
+2011-04-06  Kevin Ollivier  <kevino@theolliviers.com>
+        
+        Reviewed by Darin Adler.
+        
+        Make sure JS_EXPORT_PRIVATE is an empty define when we aren't using the export macros.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * config.h:
+
+2011-04-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Stop JSObject::isUsingInlineStorage() from using the structure
+        https://bugs.webkit.org/show_bug.cgi?id=57986
+
+        Make the isUsingInlineStorage() implementation just look at
+        whether the property storage is inside the object.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::JSObject):
+
+2011-04-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Update comments documenting JSVALUE64/JSVALUE32_64 JSValue representations.
+
+        * runtime/JSImmediate.h:
+        * runtime/JSValue.h:
+
+2011-04-06  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        cmake: Fix build for ARMv7
+
+        * CMakeLists.txt: add missing file.
+
+2011-04-06  Liang Qi  <liang.qi@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        Correct a include file name.
+        https://bugs.webkit.org/show_bug.cgi?id=57839
+
+        * wtf/PageAllocatorSymbian.h: It should be case sensitive. This fix 
+        builds on Unix hosts.
+
+2011-04-06  Adam Roben  <aroben@apple.com>
+
+        Build fix after r83056
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Added property svn:executable.
+
+2011-04-06  Adam Roben  <aroben@apple.com>
+
+        Move JavaScriptCoreGenerated's file-copying logic out to a new script
+
+        Hopefully this will make it easier to modify this logic in the future. I also made the
+        script much quieter than the old logic, since it didn't seem helpful to see long lists of
+        filenames during the copying phase.
+
+        If we like this new style, we could copy it for our other projects.
+
+        Fixes <http://webkit.org/b/57950> JavaScriptCoreGenerated's file-copying logic is hard to
+        modify and noisy
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Moved logic to copy
+        files from here...
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: ...to here. (Added.)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Added copy-files.cmd
+        for convenience.
+
+2011-04-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Who likes export files? I do!
+
+2011-04-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Introduced the concept of opaque roots, in preparation for marking the DOM with them
+        https://bugs.webkit.org/show_bug.cgi?id=57903
+
+        * JavaScriptCore.exp: Who likes export files? I do!
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::isValidWeakHandle): Factored out a helper function for ASSERTs.
+
+        (JSC::WeakHandleOwner::~WeakHandleOwner): Moved from header to avoid
+        weak linkage problems.
+
+        (JSC::WeakHandleOwner::isReachableFromOpaqueRoots): New callback.
+        Currently unused.
+
+        (JSC::WeakHandleOwner::finalize): Switched from pure virtual to a
+        default empty implementation, since not all clients necessarily want
+        or need non-trivial finalizers.
+
+        (JSC::HandleHeap::markWeakHandles): Split updateWeakHandles into two
+        passes. The first pass marks all reachable weak handles. The second pass
+        finalizes all unreachable weak handles. This must be two passes because
+        we don't know the set of finalizable weak handles until we're done
+        marking all weak handles.
+
+        (JSC::HandleHeap::finalizeWeakHandles): Use new helper function.
+
+        * collector/handles/HandleHeap.h: Ditto.
+
+        * runtime/Heap.cpp: 
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::reset): Split out handle marking from handle finalization.
+
+        * runtime/MarkStack.cpp:
+        (JSC::MarkStack::reset):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::addOpaqueRoot):
+        (JSC::MarkStack::containsOpaqueRoot):
+        (JSC::MarkStack::opaqueRootCount):
+        (JSC::HeapRootMarker::markStack): New helper functions for managing the
+        set of opaque roots.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::finalize): Renamed to match parent class declaration.
+
+2011-04-05  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Build fix for YarrParser.h
+        https://bugs.webkit.org/show_bug.cgi?id=57822
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+
+2011-04-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Follow-up Windows build fix.
+        Don't skip react-to-vsprops-changes.py for all production builds,
+        only those initiated via JavaScriptCore.make.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2011-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r82849): 85,000+ JSC-related leaks seen on SnowLeopard Intel Leaks
+        https://bugs.webkit.org/show_bug.cgi?id=57857
+
+        Whoops, accidentally removed a deref().
+
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+
+2011-04-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Add per-configuration vsprops files.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Removed inheritance from common.vsprops.
+        Set production environment variable before calling make.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops: Added.
+
+2011-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make caches window show more info about non-jsobject GC values
+        https://bugs.webkit.org/show_bug.cgi?id=57874
+
+        Add ClassInfo to the various internal JS types that currently
+        don't have any, and make the text for caches window show the
+        classname for non-JSObject instances.
+
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/Heap.cpp:
+        (JSC::TypeCounter::typeName):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/ScopeChain.cpp:
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+
+2011-04-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        Cleanup StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=57836
+
+        Don't use PassRefPtr in local variables, properly store in RefPtrs and release on return.
+        Add a makeString() variant taking 9 arguments, needed by a follow-up patch.
+
+        * wtf/text/StringConcatenate.h:
+        (WTF::tryMakeString):
+        (WTF::makeString):
+
+2011-04-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82876.
+        http://trac.webkit.org/changeset/82876
+        https://bugs.webkit.org/show_bug.cgi?id=57816
+
+        Caused a lot of test crashes (Requested by tkent on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::fastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::tryFastRealloc):
+        (WTF::fastRealloc):
+        (WTF::fastMallocSize):
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMallocStats::malloc):
+        (WTF::TCMallocStats::free):
+        (WTF::TCMallocStats::fastCalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::calloc):
+        (WTF::TCMallocStats::fastRealloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        (WTF::TCMallocStats::realloc):
+        (WTF::TCMallocStats::fastMallocSize):
+        * wtf/FastMalloc.h:
+        (WTF::Internal::fastMallocMatchValidationType):
+        (WTF::Internal::fastMallocMatchValidationValue):
+        (WTF::Internal::setFastMallocMatchValidationType):
+        (WTF::fastMallocMatchValidateFree):
+        * wtf/Platform.h:
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Stop JSCell.h from including Structure.h
+        https://bugs.webkit.org/show_bug.cgi?id=57809
+
+        * runtime/GetterSetter.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        * runtime/JSString.h:
+        * runtime/ScopeChain.h:
+        * runtime/Structure.h:
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        (JSC::JSCell::classInfo):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::MarkStack::internalAppend):
+        * runtime/StructureChain.h:
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Fix clang build.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Remove accidental change to Platform.h
+
+        * wtf/Platform.h:
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a weak-handle-related leak in RegisterFile
+        https://bugs.webkit.org/show_bug.cgi?id=57793
+
+        * interpreter/RegisterFile.cpp: Nixed leaky GlobalObjectNotifier.
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::GlobalObjectOwner::finalize):
+        (JSC::RegisterFile::RegisterFile): Replaced GlobalObjectNotifier with
+        a per-RegisterFile weak handle owner, which does not leak.
+
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::set): Allow set() to take a context argument, since
+        RegisterFile now needs this. (Seems like it was an accidental omission
+        all along.)
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make malloc validation useful
+        https://bugs.webkit.org/show_bug.cgi?id=57502
+
+        This patch changes FAST_MALLOC_MATCH_VALIDATION with a general
+        corruption check that tags the beginning and end of all allocations
+        to check for write overflows and overwrites the contents of
+        memory on free in order to (hopefully) show up use-after-free issues
+        sooner.
+
+        We also turn it on by default for debug builds.
+
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::fastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::tryFastRealloc):
+        (WTF::fastRealloc):
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMallocStats::malloc):
+        (WTF::TCMallocStats::free):
+        (WTF::TCMallocStats::fastCalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::calloc):
+        (WTF::TCMallocStats::fastRealloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        (WTF::TCMallocStats::realloc):
+        * wtf/FastMalloc.h:
+        (WTF::Internal::fastMallocValidationHeader):
+        (WTF::Internal::fastMallocValidationSuffix):
+        (WTF::Internal::fastMallocMatchValidationType):
+        (WTF::Internal::setFastMallocMatchValidationType):
+        (WTF::fastMallocMatchValidateFree):
+        (WTF::fastMallocValidate):
+        * wtf/Platform.h:
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Renamed clearWeakPointers => updateWeakHandles and removed misleading comment
+        https://bugs.webkit.org/show_bug.cgi?id=57790
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::updateWeakHandles): Updated for rename.
+
+        * collector/handles/HandleHeap.h: Removed comment claiming that this
+        function should only be called during teardown, because it's actually
+        called after every GC pass.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots): Updated for rename.
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Standardized handling of handles for immediate values
+        https://bugs.webkit.org/show_bug.cgi?id=57788
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Don't check for null or non-cell
+        values here, because our write barrier guarantees that such values are
+        not in the weak list.
+
+        (JSC::HandleHeap::writeBarrier): Standardized on checking for null before
+        checking for cell, and on using early return instead of if/else.
+
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::deallocate):
+        (JSC::HandleHeap::makeWeak): Ditto.
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Removed a redundant variable from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57786
+        
+        Forgot to commit the file that actually removes the data member!
+        
+        * collector/handles/HandleHeap.h:
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed a redundant variable from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57786
+        
+        We don't need a specific variable to indicate that we're in the middle
+        of the finalization phase, since m_nextToFinalize already does this.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::HandleHeap):
+        (JSC::HandleHeap::clearWeakPointers):
+        (JSC::HandleHeap::writeBarrier):
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Renamed Finalizer => WeakHandleOwner (in preparation for adding a reachability callback)
+        https://bugs.webkit.org/show_bug.cgi?id=57775
+        
+        Also renamed noFinalizer => emptyWeakOwner, since this is really an
+        optimization for a weak owner with empty callbacks.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Updated for renames. Removed
+        redundant initialization of m_nextToFinalize. Moved deletion check inside
+        weak owner check, since the weak owner can't delete the node if there is
+        no weak owner!
+
+        * collector/handles/HandleHeap.h:
+        (JSC::WeakHandleOwner::~WeakHandleOwner):
+        (JSC::HandleHeap::makeWeak): Updated for renames.
+
+        (JSC::HandleHeap::hasWeakOwner): Changed getFinalizer to hasWeakOwner,
+        to clarify this function's role in assertions.
+
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::makeWeak):
+        (JSC::HandleHeap::Node::isWeak):
+        (JSC::HandleHeap::Node::weakOwner):
+        (JSC::HandleHeap::Node::weakOwnerContext):
+        (JSC::HandleHeap::Node::emptyWeakOwner):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::globalObjectCollectedNotifier):
+        * interpreter/RegisterFile.h:
+        * runtime/WeakGCMap.h:
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::set): Updated for renames.
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Fix WinCE build.
+
+        * bytecode/Instruction.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+
+2011-04-04  Adam Roben  <aroben@apple.com>
+
+        Delete mt.dep files when doing a clean build due to .vsprops file changes
+
+        Apparently this is yet another file that Visual Studio can't figure out it needs to rebuild.
+
+        Fixes <http://webkit.org/b/57777> r82850 failed to build on Windows Debug (Build)
+
+        Reviewed by Brian Weinstein.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Added dep to the list of extensions we look for when choosing files to delete.
+
+2011-04-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make StructureChain GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=56695
+
+        Make StructureChain GC allocated, and make the various owners
+        mark it correctly.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * collector/handles/Handle.h:
+        (JSC::HandleConverter::operator->):
+        (JSC::HandleConverter::operator*):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::markAggregate):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        (JSC::StructureChain::~StructureChain):
+        (JSC::StructureChain::markChildren):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::createStructure):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+
+2011-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some complexity from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57650
+        
+        Eliminated pointer-tagging flags.
+        
+        Tied being weak to having a finalizer (or at least a finalizer sentinel).
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Removed the special self-destroying
+        flag. It was unused. If we bring it back, we'll probably use a shared
+        autodeallocating finalizer instead.
+
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::makeWeak): makeWeak and adding a finalizer are now
+        a single, atomic operation -- this makes the relationship between
+        finalizers and weak pointers clearer, and impossible to get wrong.
+
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::handleHeap): No more flags.
+
+        (JSC::HandleHeap::Node::makeWeak):
+        (JSC::HandleHeap::Node::isWeak): Ditto above. We use a special sentienl
+        value in the finalizer slot to indicate that a handle is weak but doesn't
+        require an external function call for finalization.
+
+2011-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed WeakGCMap::deprecatedRemove because it was deprecated and unused
+        https://bugs.webkit.org/show_bug.cgi?id=57648
+
+        * runtime/WeakGCMap.h:
+
+2011-04-01  Adam Roben  <aroben@apple.com>
+
+        Maintain the invariant that Lexer::m_current is set to -1 when at the end of the code buffer
+
+        Covered by existing tests.
+
+        Fixes <http://webkit.org/b/56699>.
+
+        Reviewed by Oliver Hunt.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset): Copied code from Lexer::shift to update m_current, because
+        supposedly the idiom that function uses is fast.
+
+2011-03-31  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Oliver Hunt.
+
+        SH4 JIT SUPPORT.
+        https://bugs.webkit.org/show_bug.cgi?id=44329
+
+        Add YARR support for SH4 platforms (disabled by default).
+
+        * GNUmakefile.am:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerSH4.cpp: Added.
+        * assembler/MacroAssemblerSH4.h: Added.
+        * assembler/SH4Assembler.h: Added.
+        * yarr/YarrJIT.cpp:
+
+2011-03-30  Adam Roben  <aroben@apple.com>
+
+        Clean build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Serialized project dependencies so projects
+        don't try to build in parallel (which doesn't mesh with our buildfailed mechanism).
+
+2011-03-30  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r82500
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+
+2011-03-29  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Use the Accelerate vImage vectorized (un)premultiplyImageData functions for ImageBufferCG
+
+        https://bugs.webkit.org/show_bug.cgi?id=53134
+
+        * wtf/Platform.h: Added in WTF flag for using the Accelerate framework
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Share most vsprops between Release and Production builds in releaseproduction.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=57508
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscRelease.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiRelease.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops:
+
+2011-03-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Explicitly prevent testapi and minidom from being installed rather than relying
+        on Xcode's current behavior of not installing if INSTALL_PATH is not explicitly
+        set at the target level.
+
+        <rdar://problem/9206357>
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-03-30  Timur Iskhodzhanov  <timurrrr@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add some dynamic annotations to JavaScriptCore/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=53747
+
+        By using these annotations we can improve the precision of finding
+        WebKit errors using dynamic analysis tools like ThreadSanitizer and Valgrind.
+        These annotations don't affect the compiled binaries unless USE(DYNAMIC_ANNOTATIONS) is "1".
+
+        These files don't add new functionality, so don't need extra tests.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/DynamicAnnotations.cpp: Added.
+        (WTFAnnotateBenignRaceSized):
+        (WTFAnnotateHappensBefore):
+        (WTFAnnotateHappensAfter):
+        * wtf/DynamicAnnotations.h: Added.
+        * wtf/ThreadSafeRefCounted.h:
+        (WTF::ThreadSafeRefCountedBase::derefBase):
+        * wtf/text/StringStatics.cpp:
+        (WTF::StringImpl::empty):
+
 2011-03-30  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 0c1d13c..73d3a47 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -23,8 +23,8 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 // The contents of this file must be kept in sync with FeatureDefines.xcconfig in JavaScriptCore,
-// WebCore and WebKit.  Also the default values of the ENABLE_FEATURE_NAME macros in build-webkit
-// should match the values below, but they do not need to be in the same order.
+// WebCore, WebKit and WebKit2.  Also the default values of the ENABLE_FEATURE_NAME macros in
+// build-webkit should match the values below, but they do not need to be in the same order.
 
 // Keep this list of features (not enabled/disabled state) in sync with FeatureDefines.vsprops
 // and FeatureDefinesCairo.vsprops in WebKitLibraries/win/tools/vsprops.
@@ -91,8 +91,11 @@ ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
+ENABLE_PAGE_VISIBILITY_API = ;
 ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 
+ENABLE_QUOTA = ;
+
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
@@ -109,6 +112,7 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
+ENABLE_VIDEO_TRACK = ;
 
 ENABLE_MEDIA_STATISTICS = ;
 
@@ -127,4 +131,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_QUOTA) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index 59988e3..8ea0822 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 27;
+MINOR_VERSION = 30;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/GNUmakefile.am b/Source/JavaScriptCore/GNUmakefile.am
index 31e70a0..9030a21 100644
--- a/Source/JavaScriptCore/GNUmakefile.am
+++ b/Source/JavaScriptCore/GNUmakefile.am
@@ -1,3 +1,5 @@
+include $(srcdir)/Source/JavaScriptCore/GNUmakefile.list.am
+
 javascriptcore_cppflags += \
 	-I$(srcdir)/Source \
 	-I$(srcdir)/Source/JavaScriptCore \
@@ -5,7 +7,7 @@ javascriptcore_cppflags += \
 	-I$(srcdir)/Source/JavaScriptCore/assembler \
 	-I$(srcdir)/Source/JavaScriptCore/bytecode \
 	-I$(srcdir)/Source/JavaScriptCore/bytecompiler \
-	-I$(srcdir)/Source/JavaScriptCore/collector/handles \
+	-I$(srcdir)/Source/JavaScriptCore/heap \
 	-I$(srcdir)/Source/JavaScriptCore/debugger \
 	-I$(srcdir)/Source/JavaScriptCore/ForwardingHeaders \
 	-I$(srcdir)/Source/JavaScriptCore/interpreter \
@@ -25,593 +27,6 @@ javascriptcore_cppflags += \
 	-I$(top_builddir)/Source/JavaScriptCore/parser \
 	-I$(top_builddir)/Source/JavaScriptCore/runtime
 
-javascriptcore_h_api += \
-	Source/JavaScriptCore/API/JSBase.h \
-	Source/JavaScriptCore/API/JSContextRef.h \
-	Source/JavaScriptCore/API/JSObjectRef.h \
-	Source/JavaScriptCore/API/JSStringRef.h \
-	Source/JavaScriptCore/API/JSStringRefBSTR.h \
-	Source/JavaScriptCore/API/JSStringRefCF.h \
-	Source/JavaScriptCore/API/JSValueRef.h \
-	Source/JavaScriptCore/API/JavaScript.h \
-	Source/JavaScriptCore/API/JavaScriptCore.h \
-	Source/JavaScriptCore/API/WebKitAvailability.h
-
-javascriptcore_built_nosources += \
-	Source/JavaScriptCore/Lexer.lut.h \
-	Source/JavaScriptCore/RegExpJitTables.h \
-	Source/JavaScriptCore/runtime/ArrayPrototype.lut.h \
-	Source/JavaScriptCore/runtime/DatePrototype.lut.h \
-	Source/JavaScriptCore/runtime/JSONObject.lut.h \
-	Source/JavaScriptCore/runtime/MathObject.lut.h \
-	Source/JavaScriptCore/runtime/NumberConstructor.lut.h \
-	Source/JavaScriptCore/runtime/ObjectConstructor.lut.h \
-	Source/JavaScriptCore/runtime/RegExpConstructor.lut.h \
-	Source/JavaScriptCore/runtime/RegExpObject.lut.h \
-	Source/JavaScriptCore/runtime/StringPrototype.lut.h
-
-javascriptcore_sources += \
-	Source/JavaScriptCore/API/APICast.h \
-	Source/JavaScriptCore/API/APIShims.h \
-	Source/JavaScriptCore/API/JSBase.cpp \
-	Source/JavaScriptCore/API/JSBasePrivate.h \
-	Source/JavaScriptCore/API/JSCallbackConstructor.cpp \
-	Source/JavaScriptCore/API/JSCallbackConstructor.h \
-	Source/JavaScriptCore/API/JSCallbackFunction.cpp \
-	Source/JavaScriptCore/API/JSCallbackFunction.h \
-	Source/JavaScriptCore/API/JSCallbackObject.cpp \
-	Source/JavaScriptCore/API/JSCallbackObjectFunctions.h \
-	Source/JavaScriptCore/API/JSCallbackObject.h \
-	Source/JavaScriptCore/API/JSClassRef.cpp \
-	Source/JavaScriptCore/API/JSClassRef.h \
-	Source/JavaScriptCore/API/JSContextRef.cpp \
-	Source/JavaScriptCore/API/JSContextRefPrivate.h \
-	Source/JavaScriptCore/API/JSObjectRef.cpp \
-	Source/JavaScriptCore/API/JSObjectRefPrivate.h \
-	Source/JavaScriptCore/API/JSRetainPtr.h \
-	Source/JavaScriptCore/API/JSStringRef.cpp \
-	Source/JavaScriptCore/API/JSValueRef.cpp \
-	Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h \
-	Source/JavaScriptCore/API/OpaqueJSString.cpp \
-	Source/JavaScriptCore/API/OpaqueJSString.h \
-	Source/JavaScriptCore/assembler/AbstractMacroAssembler.h \
-	Source/JavaScriptCore/assembler/ARMAssembler.cpp \
-	Source/JavaScriptCore/assembler/ARMAssembler.h \
-	Source/JavaScriptCore/assembler/ARMv7Assembler.cpp \
-	Source/JavaScriptCore/assembler/ARMv7Assembler.h \
-	Source/JavaScriptCore/assembler/AssemblerBuffer.h \
-	Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h \
-	Source/JavaScriptCore/assembler/CodeLocation.h \
-	Source/JavaScriptCore/assembler/LinkBuffer.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp \
-	Source/JavaScriptCore/assembler/MacroAssemblerARM.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h \
-	Source/JavaScriptCore/assembler/MacroAssembler.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerX86.h \
-	Source/JavaScriptCore/assembler/RepatchBuffer.h \
-	Source/JavaScriptCore/assembler/X86Assembler.h \
-	Source/JavaScriptCore/bytecode/CodeBlock.cpp \
-	Source/JavaScriptCore/bytecode/CodeBlock.h \
-	Source/JavaScriptCore/bytecode/EvalCodeCache.h \
-	Source/JavaScriptCore/bytecode/Instruction.h \
-	Source/JavaScriptCore/bytecode/JumpTable.cpp \
-	Source/JavaScriptCore/bytecode/JumpTable.h \
-	Source/JavaScriptCore/bytecode/Opcode.cpp \
-	Source/JavaScriptCore/bytecode/Opcode.h \
-	Source/JavaScriptCore/bytecode/SamplingTool.cpp \
-	Source/JavaScriptCore/bytecode/SamplingTool.h \
-	Source/JavaScriptCore/bytecode/StructureStubInfo.cpp \
-	Source/JavaScriptCore/bytecode/StructureStubInfo.h \
-	Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp \
-	Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h \
-	Source/JavaScriptCore/bytecompiler/Label.h \
-	Source/JavaScriptCore/bytecompiler/LabelScope.h \
-	Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp \
-	Source/JavaScriptCore/bytecompiler/RegisterID.h \
-	Source/JavaScriptCore/collector/handles/Global.h \
-	Source/JavaScriptCore/collector/handles/Handle.h \
-	Source/JavaScriptCore/collector/handles/HandleHeap.cpp \
-	Source/JavaScriptCore/collector/handles/HandleHeap.h \
-	Source/JavaScriptCore/collector/handles/HandleStack.cpp \
-	Source/JavaScriptCore/collector/handles/HandleStack.h \
-	Source/JavaScriptCore/collector/handles/Local.h \
-	Source/JavaScriptCore/collector/handles/LocalScope.h \
-	Source/JavaScriptCore/config.h \
-	Source/JavaScriptCore/debugger/DebuggerActivation.cpp \
-	Source/JavaScriptCore/debugger/DebuggerActivation.h \
-	Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp \
-	Source/JavaScriptCore/debugger/DebuggerCallFrame.h \
-	Source/JavaScriptCore/debugger/Debugger.cpp \
-	Source/JavaScriptCore/debugger/Debugger.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APICast.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APIShims.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScript.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSBase.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSContextRef.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSObjectRef.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRef.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSValueRef.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h \
-	Source/JavaScriptCore/icu/unicode/parseerr.h \
-	Source/JavaScriptCore/icu/unicode/platform.h \
-	Source/JavaScriptCore/icu/unicode/putil.h \
-	Source/JavaScriptCore/icu/unicode/uchar.h \
-	Source/JavaScriptCore/icu/unicode/ucnv_err.h \
-	Source/JavaScriptCore/icu/unicode/ucnv.h \
-	Source/JavaScriptCore/icu/unicode/ucol.h \
-	Source/JavaScriptCore/icu/unicode/uconfig.h \
-	Source/JavaScriptCore/icu/unicode/uenum.h \
-	Source/JavaScriptCore/icu/unicode/uiter.h \
-	Source/JavaScriptCore/icu/unicode/uloc.h \
-	Source/JavaScriptCore/icu/unicode/umachine.h \
-	Source/JavaScriptCore/icu/unicode/unorm.h \
-	Source/JavaScriptCore/icu/unicode/urename.h \
-	Source/JavaScriptCore/icu/unicode/uset.h \
-	Source/JavaScriptCore/icu/unicode/ustring.h \
-	Source/JavaScriptCore/icu/unicode/utf16.h \
-	Source/JavaScriptCore/icu/unicode/utf8.h \
-	Source/JavaScriptCore/icu/unicode/utf.h \
-	Source/JavaScriptCore/icu/unicode/utf_old.h \
-	Source/JavaScriptCore/icu/unicode/utypes.h \
-	Source/JavaScriptCore/icu/unicode/uversion.h \
-	Source/JavaScriptCore/interpreter/CachedCall.h \
-	Source/JavaScriptCore/interpreter/CallFrameClosure.h \
-	Source/JavaScriptCore/interpreter/CallFrame.cpp \
-	Source/JavaScriptCore/interpreter/CallFrame.h \
-	Source/JavaScriptCore/interpreter/Interpreter.cpp \
-	Source/JavaScriptCore/interpreter/Interpreter.h \
-	Source/JavaScriptCore/interpreter/RegisterFile.cpp \
-	Source/JavaScriptCore/interpreter/RegisterFile.h \
-	Source/JavaScriptCore/interpreter/Register.h \
-	Source/JavaScriptCore/JavaScriptCorePrefix.h \
-	Source/JavaScriptCore/jit/ExecutableAllocator.cpp \
-	Source/JavaScriptCore/jit/ExecutableAllocator.h \
-	Source/JavaScriptCore/jit/JITArithmetic32_64.cpp \
-	Source/JavaScriptCore/jit/JITArithmetic.cpp \
-	Source/JavaScriptCore/jit/JITCall32_64.cpp \
-	Source/JavaScriptCore/jit/JITCall.cpp \
-	Source/JavaScriptCore/jit/JITCode.h \
-	Source/JavaScriptCore/jit/JIT.cpp \
-	Source/JavaScriptCore/jit/JIT.h \
-	Source/JavaScriptCore/jit/JITInlineMethods.h \
-	Source/JavaScriptCore/jit/JITOpcodes32_64.cpp \
-	Source/JavaScriptCore/jit/JITOpcodes.cpp \
-	Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp \
-	Source/JavaScriptCore/jit/JITPropertyAccess.cpp \
-	Source/JavaScriptCore/jit/JITStubCall.h \
-	Source/JavaScriptCore/jit/JITStubs.cpp \
-	Source/JavaScriptCore/jit/JITStubs.h \
-	Source/JavaScriptCore/jit/JSInterfaceJIT.h \
-	Source/JavaScriptCore/jit/SpecializedThunkJIT.h \
-	Source/JavaScriptCore/jit/ThunkGenerators.cpp \
-	Source/JavaScriptCore/jit/ThunkGenerators.h \
-	Source/JavaScriptCore/os-win32/stdbool.h \
-	Source/JavaScriptCore/os-win32/stdint.h \
-	Source/JavaScriptCore/parser/ASTBuilder.h \
-	Source/JavaScriptCore/parser/JSParser.cpp \
-	Source/JavaScriptCore/parser/JSParser.h \
-	Source/JavaScriptCore/parser/Lexer.cpp \
-	Source/JavaScriptCore/parser/Lexer.h \
-	Source/JavaScriptCore/parser/NodeConstructors.h \
-	Source/JavaScriptCore/parser/NodeInfo.h \
-	Source/JavaScriptCore/parser/Nodes.cpp \
-	Source/JavaScriptCore/parser/Nodes.h \
-	Source/JavaScriptCore/parser/ParserArena.cpp \
-	Source/JavaScriptCore/parser/ParserArena.h \
-	Source/JavaScriptCore/parser/Parser.cpp \
-	Source/JavaScriptCore/parser/Parser.h \
-	Source/JavaScriptCore/parser/ResultType.h \
-	Source/JavaScriptCore/parser/SourceCode.h \
-	Source/JavaScriptCore/parser/SourceProvider.h \
-	Source/JavaScriptCore/parser/SourceProviderCache.cpp \
-	Source/JavaScriptCore/parser/SourceProviderCache.h \
-	Source/JavaScriptCore/parser/SourceProviderCacheItem.h \
-	Source/JavaScriptCore/parser/SyntaxChecker.h \
-	Source/JavaScriptCore/profiler/CallIdentifier.h \
-	Source/JavaScriptCore/profiler/Profile.cpp \
-	Source/JavaScriptCore/profiler/ProfileGenerator.cpp \
-	Source/JavaScriptCore/profiler/ProfileGenerator.h \
-	Source/JavaScriptCore/profiler/Profile.h \
-	Source/JavaScriptCore/profiler/ProfileNode.cpp \
-	Source/JavaScriptCore/profiler/ProfileNode.h \
-	Source/JavaScriptCore/profiler/Profiler.cpp \
-	Source/JavaScriptCore/profiler/Profiler.h \
-	Source/JavaScriptCore/runtime/ArgList.cpp \
-	Source/JavaScriptCore/runtime/ArgList.h \
-	Source/JavaScriptCore/runtime/Arguments.cpp \
-	Source/JavaScriptCore/runtime/Arguments.h \
-	Source/JavaScriptCore/runtime/ArrayConstructor.cpp \
-	Source/JavaScriptCore/runtime/ArrayConstructor.h \
-	Source/JavaScriptCore/runtime/ArrayPrototype.cpp \
-	Source/JavaScriptCore/runtime/ArrayPrototype.h \
-	Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h \
-	Source/JavaScriptCore/runtime/BooleanConstructor.cpp \
-	Source/JavaScriptCore/runtime/BooleanConstructor.h \
-	Source/JavaScriptCore/runtime/BooleanObject.cpp \
-	Source/JavaScriptCore/runtime/BooleanObject.h \
-	Source/JavaScriptCore/runtime/BooleanPrototype.cpp \
-	Source/JavaScriptCore/runtime/BooleanPrototype.h \
-	Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h \
-	Source/JavaScriptCore/runtime/CallData.cpp \
-	Source/JavaScriptCore/runtime/CallData.h \
-	Source/JavaScriptCore/runtime/ClassInfo.h \
-	Source/JavaScriptCore/runtime/MarkedBlock.cpp \
-	Source/JavaScriptCore/runtime/MarkedBlock.h \
-	Source/JavaScriptCore/runtime/MarkedSpace.cpp \
-	Source/JavaScriptCore/runtime/MarkedSpace.h \
-	Source/JavaScriptCore/runtime/Heap.cpp \
-	Source/JavaScriptCore/runtime/Heap.h \
-	Source/JavaScriptCore/runtime/CommonIdentifiers.cpp \
-	Source/JavaScriptCore/runtime/CommonIdentifiers.h \
-	Source/JavaScriptCore/runtime/Completion.cpp \
-	Source/JavaScriptCore/runtime/Completion.h \
-	Source/JavaScriptCore/runtime/ConstructData.cpp \
-	Source/JavaScriptCore/runtime/ConstructData.h \
-	Source/JavaScriptCore/runtime/DateConstructor.cpp \
-	Source/JavaScriptCore/runtime/DateConstructor.h \
-	Source/JavaScriptCore/runtime/DateConversion.cpp \
-	Source/JavaScriptCore/runtime/DateConversion.h \
-	Source/JavaScriptCore/runtime/DateInstanceCache.h \
-	Source/JavaScriptCore/runtime/DateInstance.cpp \
-	Source/JavaScriptCore/runtime/DateInstance.h \
-	Source/JavaScriptCore/runtime/DatePrototype.cpp \
-	Source/JavaScriptCore/runtime/DatePrototype.h \
-	Source/JavaScriptCore/runtime/ErrorConstructor.cpp \
-	Source/JavaScriptCore/runtime/ErrorConstructor.h \
-	Source/JavaScriptCore/runtime/Error.cpp \
-	Source/JavaScriptCore/runtime/Error.h \
-	Source/JavaScriptCore/runtime/ErrorInstance.cpp \
-	Source/JavaScriptCore/runtime/ErrorInstance.h \
-	Source/JavaScriptCore/runtime/ErrorPrototype.cpp \
-	Source/JavaScriptCore/runtime/ErrorPrototype.h \
-	Source/JavaScriptCore/runtime/ExceptionHelpers.cpp \
-	Source/JavaScriptCore/runtime/ExceptionHelpers.h \
-	Source/JavaScriptCore/runtime/Executable.cpp \
-	Source/JavaScriptCore/runtime/Executable.h \
-	Source/JavaScriptCore/runtime/FunctionConstructor.cpp \
-	Source/JavaScriptCore/runtime/FunctionConstructor.h \
-	Source/JavaScriptCore/runtime/FunctionPrototype.cpp \
-	Source/JavaScriptCore/runtime/FunctionPrototype.h \
-	Source/JavaScriptCore/runtime/GCActivityCallback.cpp \
-	Source/JavaScriptCore/runtime/GCActivityCallback.h \
-	Source/JavaScriptCore/runtime/GetterSetter.cpp \
-	Source/JavaScriptCore/runtime/GetterSetter.h \
-	Source/JavaScriptCore/runtime/Identifier.cpp \
-	Source/JavaScriptCore/runtime/Identifier.h \
-	Source/JavaScriptCore/runtime/InitializeThreading.cpp \
-	Source/JavaScriptCore/runtime/InitializeThreading.h \
-	Source/JavaScriptCore/runtime/InternalFunction.cpp \
-	Source/JavaScriptCore/runtime/InternalFunction.h \
-	Source/JavaScriptCore/runtime/JSActivation.cpp \
-	Source/JavaScriptCore/runtime/JSActivation.h \
-	Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp \
-	Source/JavaScriptCore/runtime/JSAPIValueWrapper.h \
-	Source/JavaScriptCore/runtime/JSArray.cpp \
-	Source/JavaScriptCore/runtime/JSArray.h \
-	Source/JavaScriptCore/runtime/JSByteArray.cpp \
-	Source/JavaScriptCore/runtime/JSByteArray.h \
-	Source/JavaScriptCore/runtime/JSCell.cpp \
-	Source/JavaScriptCore/runtime/JSCell.h \
-	Source/JavaScriptCore/runtime/JSFunction.cpp \
-	Source/JavaScriptCore/runtime/JSFunction.h \
-	Source/JavaScriptCore/runtime/JSGlobalData.cpp \
-	Source/JavaScriptCore/runtime/JSGlobalData.h \
-	Source/JavaScriptCore/runtime/JSGlobalObject.cpp \
-	Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp \
-	Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h \
-	Source/JavaScriptCore/runtime/JSGlobalObject.h \
-	Source/JavaScriptCore/runtime/JSImmediate.cpp \
-	Source/JavaScriptCore/runtime/JSImmediate.h \
-	Source/JavaScriptCore/runtime/JSLock.cpp \
-	Source/JavaScriptCore/runtime/JSLock.h \
-	Source/JavaScriptCore/runtime/JSNotAnObject.cpp \
-	Source/JavaScriptCore/runtime/JSNotAnObject.h \
-	Source/JavaScriptCore/runtime/JSNumberCell.cpp \
-	Source/JavaScriptCore/runtime/JSNumberCell.h \
-	Source/JavaScriptCore/runtime/JSObject.cpp \
-	Source/JavaScriptCore/runtime/JSObject.h \
-	Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp \
-	Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h \
-	Source/JavaScriptCore/runtime/JSONObject.cpp \
-	Source/JavaScriptCore/runtime/JSONObject.h \
-	Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp \
-	Source/JavaScriptCore/runtime/JSPropertyNameIterator.h \
-	Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp \
-	Source/JavaScriptCore/runtime/JSStaticScopeObject.h \
-	Source/JavaScriptCore/runtime/JSStringBuilder.h \
-	Source/JavaScriptCore/runtime/JSString.cpp \
-	Source/JavaScriptCore/runtime/JSString.h \
-	Source/JavaScriptCore/runtime/JSType.h \
-	Source/JavaScriptCore/runtime/JSTypeInfo.h \
-	Source/JavaScriptCore/runtime/JSValue.cpp \
-	Source/JavaScriptCore/runtime/JSValue.h \
-	Source/JavaScriptCore/runtime/JSVariableObject.cpp \
-	Source/JavaScriptCore/runtime/JSVariableObject.h \
-	Source/JavaScriptCore/runtime/JSWrapperObject.cpp \
-	Source/JavaScriptCore/runtime/JSWrapperObject.h \
-	Source/JavaScriptCore/runtime/JSZombie.h \
-	Source/JavaScriptCore/runtime/LiteralParser.cpp \
-	Source/JavaScriptCore/runtime/LiteralParser.h \
-	Source/JavaScriptCore/runtime/Lookup.cpp \
-	Source/JavaScriptCore/runtime/Lookup.h \
-	Source/JavaScriptCore/runtime/MachineStackMarker.cpp \
-	Source/JavaScriptCore/runtime/MachineStackMarker.h \
-        Source/JavaScriptCore/runtime/ConservativeSet.cpp \
-        Source/JavaScriptCore/runtime/ConservativeSet.h \
-	Source/JavaScriptCore/runtime/MarkStack.cpp \
-	Source/JavaScriptCore/runtime/MarkStack.h \
-	Source/JavaScriptCore/runtime/MathObject.cpp \
-	Source/JavaScriptCore/runtime/MathObject.h \
-	Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp \
-	Source/JavaScriptCore/runtime/NativeErrorConstructor.h \
-	Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp \
-	Source/JavaScriptCore/runtime/NativeErrorPrototype.h \
-	Source/JavaScriptCore/runtime/NumberConstructor.cpp \
-	Source/JavaScriptCore/runtime/NumberConstructor.h \
-	Source/JavaScriptCore/runtime/NumberObject.cpp \
-	Source/JavaScriptCore/runtime/NumberObject.h \
-	Source/JavaScriptCore/runtime/NumberPrototype.cpp \
-	Source/JavaScriptCore/runtime/NumberPrototype.h \
-	Source/JavaScriptCore/runtime/NumericStrings.h \
-	Source/JavaScriptCore/runtime/ObjectConstructor.cpp \
-	Source/JavaScriptCore/runtime/ObjectConstructor.h \
-	Source/JavaScriptCore/runtime/ObjectPrototype.cpp \
-	Source/JavaScriptCore/runtime/ObjectPrototype.h \
-	Source/JavaScriptCore/runtime/Operations.cpp \
-	Source/JavaScriptCore/runtime/Operations.h \
-	Source/JavaScriptCore/runtime/PropertyDescriptor.cpp \
-	Source/JavaScriptCore/runtime/PropertyDescriptor.h \
-	Source/JavaScriptCore/runtime/PropertyMapHashTable.h \
-	Source/JavaScriptCore/runtime/PropertyNameArray.cpp \
-	Source/JavaScriptCore/runtime/PropertyNameArray.h \
-	Source/JavaScriptCore/runtime/PropertySlot.cpp \
-	Source/JavaScriptCore/runtime/PropertySlot.h \
-	Source/JavaScriptCore/runtime/Protect.h \
-	Source/JavaScriptCore/runtime/PutPropertySlot.h \
-	Source/JavaScriptCore/runtime/RegExpCache.cpp \
-	Source/JavaScriptCore/runtime/RegExpCache.h \
-	Source/JavaScriptCore/runtime/RegExpConstructor.cpp \
-	Source/JavaScriptCore/runtime/RegExpConstructor.h \
-	Source/JavaScriptCore/runtime/RegExp.cpp \
-	Source/JavaScriptCore/runtime/RegExp.h \
-	Source/JavaScriptCore/runtime/RegExpKey.h \
-	Source/JavaScriptCore/runtime/RegExpMatchesArray.h \
-	Source/JavaScriptCore/runtime/RegExpObject.cpp \
-	Source/JavaScriptCore/runtime/RegExpObject.h \
-	Source/JavaScriptCore/runtime/RegExpPrototype.cpp \
-	Source/JavaScriptCore/runtime/RegExpPrototype.h \
-	Source/JavaScriptCore/runtime/RopeImpl.cpp \
-	Source/JavaScriptCore/runtime/RopeImpl.h \
-	Source/JavaScriptCore/runtime/ScopeChain.cpp \
-	Source/JavaScriptCore/runtime/ScopeChain.h \
-	Source/JavaScriptCore/runtime/ScopeChainMark.h \
-	Source/JavaScriptCore/runtime/SmallStrings.cpp \
-	Source/JavaScriptCore/runtime/SmallStrings.h \
-	Source/JavaScriptCore/runtime/StrictEvalActivation.cpp \
-	Source/JavaScriptCore/runtime/StrictEvalActivation.h \
-	Source/JavaScriptCore/runtime/StringConstructor.cpp \
-	Source/JavaScriptCore/runtime/StringConstructor.h \
-	Source/JavaScriptCore/runtime/StringObject.cpp \
-	Source/JavaScriptCore/runtime/StringObject.h \
-	Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h \
-	Source/JavaScriptCore/runtime/StringPrototype.cpp \
-	Source/JavaScriptCore/runtime/StringPrototype.h \
-	Source/JavaScriptCore/runtime/StringRecursionChecker.cpp \
-	Source/JavaScriptCore/runtime/StringRecursionChecker.h \
-	Source/JavaScriptCore/runtime/StructureChain.cpp \
-	Source/JavaScriptCore/runtime/StructureChain.h \
-	Source/JavaScriptCore/runtime/Structure.cpp \
-	Source/JavaScriptCore/runtime/Structure.h \
-	Source/JavaScriptCore/runtime/StructureTransitionTable.h \
-	Source/JavaScriptCore/runtime/SymbolTable.h \
-	Source/JavaScriptCore/runtime/Terminator.h \
-	Source/JavaScriptCore/runtime/TimeoutChecker.cpp \
-	Source/JavaScriptCore/runtime/TimeoutChecker.h \
-	Source/JavaScriptCore/runtime/Tracing.h \
-	Source/JavaScriptCore/runtime/UString.cpp \
-	Source/JavaScriptCore/runtime/UString.h \
-	Source/JavaScriptCore/runtime/UStringBuilder.h \
-	Source/JavaScriptCore/runtime/UStringConcatenate.h \
-	Source/JavaScriptCore/runtime/WeakGCMap.h \
-	Source/JavaScriptCore/runtime/WeakGCPtr.h \
-	Source/JavaScriptCore/runtime/WeakRandom.h \
-	Source/JavaScriptCore/runtime/WriteBarrier.h \
-	Source/JavaScriptCore/wtf/AlwaysInline.h \
-	Source/JavaScriptCore/wtf/ASCIICType.h \
-	Source/JavaScriptCore/wtf/Assertions.cpp \
-	Source/JavaScriptCore/wtf/Assertions.h \
-	Source/JavaScriptCore/wtf/Atomics.h \
-	Source/JavaScriptCore/wtf/AVLTree.h \
-	Source/JavaScriptCore/wtf/Bitmap.h \
-	Source/JavaScriptCore/wtf/BlockStack.h \
-	Source/JavaScriptCore/wtf/BloomFilter.h \
-	Source/JavaScriptCore/wtf/BumpPointerAllocator.h \
-	Source/JavaScriptCore/wtf/ByteArray.cpp \
-	Source/JavaScriptCore/wtf/ByteArray.h \
-	Source/JavaScriptCore/wtf/CrossThreadRefCounted.h \
-	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp \
-	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h \
-	Source/JavaScriptCore/wtf/CurrentTime.cpp \
-	Source/JavaScriptCore/wtf/CurrentTime.h \
-	Source/JavaScriptCore/wtf/DateMath.cpp \
-	Source/JavaScriptCore/wtf/DateMath.h \
-	Source/JavaScriptCore/wtf/DecimalNumber.h \
-	Source/JavaScriptCore/wtf/DecimalNumber.cpp \
-	Source/JavaScriptCore/wtf/Decoder.h \
-	Source/JavaScriptCore/wtf/Deque.h \
-	Source/JavaScriptCore/wtf/DisallowCType.h \
-	Source/JavaScriptCore/wtf/DoublyLinkedList.h \
-	Source/JavaScriptCore/wtf/dtoa.cpp \
-	Source/JavaScriptCore/wtf/dtoa.h \
-	Source/JavaScriptCore/wtf/Encoder.h \
-	Source/JavaScriptCore/wtf/FastAllocBase.h \
-	Source/JavaScriptCore/wtf/FastMalloc.cpp \
-	Source/JavaScriptCore/wtf/FastMalloc.h \
-	Source/JavaScriptCore/wtf/FixedArray.h \
-	Source/JavaScriptCore/wtf/Forward.h \
-	Source/JavaScriptCore/wtf/GetPtr.h \
-	Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp \
-	Source/JavaScriptCore/wtf/gobject/GOwnPtr.h \
-	Source/JavaScriptCore/wtf/gobject/GRefPtr.cpp \
-	Source/JavaScriptCore/wtf/gobject/GRefPtr.h \
-	Source/JavaScriptCore/wtf/gobject/GTypedefs.h \
-	Source/JavaScriptCore/wtf/gtk/MainThreadGtk.cpp \
-	Source/JavaScriptCore/wtf/gtk/ThreadingGtk.cpp \
-	Source/JavaScriptCore/wtf/HashCountedSet.h \
-	Source/JavaScriptCore/wtf/HashFunctions.h \
-	Source/JavaScriptCore/wtf/HashIterators.h \
-	Source/JavaScriptCore/wtf/HashMap.h \
-	Source/JavaScriptCore/wtf/HashSet.h \
-	Source/JavaScriptCore/wtf/HashTable.cpp \
-	Source/JavaScriptCore/wtf/HashTable.h \
-	Source/JavaScriptCore/wtf/HashTraits.h \
-	Source/JavaScriptCore/wtf/HexNumber.h \
-	Source/JavaScriptCore/wtf/ListHashSet.h \
-	Source/JavaScriptCore/wtf/ListRefPtr.h \
-	Source/JavaScriptCore/wtf/Locker.h \
-	Source/JavaScriptCore/wtf/MainThread.cpp \
-	Source/JavaScriptCore/wtf/MainThread.h \
-	Source/JavaScriptCore/wtf/MallocZoneSupport.h \
-	Source/JavaScriptCore/wtf/MathExtras.h \
-	Source/JavaScriptCore/wtf/MD5.cpp \
-	Source/JavaScriptCore/wtf/MD5.h \
-	Source/JavaScriptCore/wtf/MessageQueue.h \
-	Source/JavaScriptCore/wtf/NonCopyingSort.h \
-	Source/JavaScriptCore/wtf/Noncopyable.h \
-	Source/JavaScriptCore/wtf/NotFound.h \
-	Source/JavaScriptCore/wtf/NullPtr.h \
-	Source/JavaScriptCore/wtf/OSAllocator.h \
-	Source/JavaScriptCore/wtf/OSRandomSource.cpp \
-	Source/JavaScriptCore/wtf/OSRandomSource.h \
-	Source/JavaScriptCore/wtf/OwnArrayPtr.h \
-	Source/JavaScriptCore/wtf/OwnFastMallocPtr.h \
-	Source/JavaScriptCore/wtf/OwnPtrCommon.h \
-	Source/JavaScriptCore/wtf/OwnPtr.h \
-	Source/JavaScriptCore/wtf/PageAllocation.h \
-	Source/JavaScriptCore/wtf/PageAllocationAligned.cpp \
-	Source/JavaScriptCore/wtf/PageAllocationAligned.h \
-	Source/JavaScriptCore/wtf/PageReservation.h \
-	Source/JavaScriptCore/wtf/PageBlock.cpp \
-	Source/JavaScriptCore/wtf/PageBlock.h \
-	Source/JavaScriptCore/wtf/PassOwnArrayPtr.h \
-	Source/JavaScriptCore/wtf/PassOwnPtr.h \
-	Source/JavaScriptCore/wtf/PassRefPtr.h \
-	Source/JavaScriptCore/wtf/Platform.h \
-	Source/JavaScriptCore/wtf/PossiblyNull.h \
-	Source/JavaScriptCore/wtf/RandomNumber.cpp \
-	Source/JavaScriptCore/wtf/RandomNumber.h \
-	Source/JavaScriptCore/wtf/RandomNumberSeed.h \
-	Source/JavaScriptCore/wtf/RefCounted.h \
-	Source/JavaScriptCore/wtf/RefCountedLeakCounter.cpp \
-	Source/JavaScriptCore/wtf/RefCountedLeakCounter.h \
-	Source/JavaScriptCore/wtf/RefPtr.h \
-	Source/JavaScriptCore/wtf/RefPtrHashMap.h \
-	Source/JavaScriptCore/wtf/RetainPtr.h \
-	Source/JavaScriptCore/wtf/SegmentedVector.h \
-	Source/JavaScriptCore/wtf/SentinelLinkedList.h \
-	Source/JavaScriptCore/wtf/SHA1.cpp \
-	Source/JavaScriptCore/wtf/SHA1.h \
-	Source/JavaScriptCore/wtf/SinglyLinkedList.h \
-	Source/JavaScriptCore/wtf/StackBounds.cpp \
-	Source/JavaScriptCore/wtf/StackBounds.h \
-	Source/JavaScriptCore/wtf/StaticConstructors.h \
-	Source/JavaScriptCore/wtf/StdLibExtras.h \
-	Source/JavaScriptCore/wtf/StringExtras.h \
-	Source/JavaScriptCore/wtf/StringHasher.h \
-	Source/JavaScriptCore/wtf/TCPackedCache.h \
-	Source/JavaScriptCore/wtf/TCPageMap.h \
-	Source/JavaScriptCore/wtf/TCSpinLock.h \
-	Source/JavaScriptCore/wtf/TCSystemAlloc.cpp \
-	Source/JavaScriptCore/wtf/TCSystemAlloc.h \
-	Source/JavaScriptCore/wtf/text/AtomicString.cpp \
-	Source/JavaScriptCore/wtf/text/AtomicString.h \
-	Source/JavaScriptCore/wtf/text/AtomicStringHash.h \
-	Source/JavaScriptCore/wtf/text/AtomicStringImpl.h \
-	Source/JavaScriptCore/wtf/text/CString.cpp \
-	Source/JavaScriptCore/wtf/text/CString.h \
-	Source/JavaScriptCore/wtf/text/StringBuffer.h \
-	Source/JavaScriptCore/wtf/text/StringBuilder.cpp \
-	Source/JavaScriptCore/wtf/text/StringBuilder.h \
-	Source/JavaScriptCore/wtf/text/StringConcatenate.h \
-	Source/JavaScriptCore/wtf/text/StringHash.h \
-	Source/JavaScriptCore/wtf/text/StringImplBase.h \
-	Source/JavaScriptCore/wtf/text/StringImpl.cpp \
-	Source/JavaScriptCore/wtf/text/StringImpl.h \
-	Source/JavaScriptCore/wtf/text/StringStatics.cpp \
-	Source/JavaScriptCore/wtf/text/TextPosition.h \
-	Source/JavaScriptCore/wtf/text/WTFString.cpp \
-	Source/JavaScriptCore/wtf/text/WTFString.h \
-	Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp \
-	Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h \
-	Source/JavaScriptCore/wtf/Threading.cpp \
-	Source/JavaScriptCore/wtf/Threading.h \
-	Source/JavaScriptCore/wtf/ThreadingPrimitives.h \
-	Source/JavaScriptCore/wtf/ThreadingPthreads.cpp \
-	Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h \
-	Source/JavaScriptCore/wtf/ThreadSpecific.h \
-	Source/JavaScriptCore/wtf/TypeTraits.cpp \
-	Source/JavaScriptCore/wtf/TypeTraits.h \
-	Source/JavaScriptCore/wtf/unicode/CharacterNames.h \
-	Source/JavaScriptCore/wtf/unicode/CollatorDefault.cpp \
-	Source/JavaScriptCore/wtf/unicode/Collator.h \
-	Source/JavaScriptCore/wtf/unicode/Unicode.h \
-	Source/JavaScriptCore/wtf/unicode/UTF8.cpp \
-	Source/JavaScriptCore/wtf/unicode/UTF8.h \
-	Source/JavaScriptCore/wtf/UnusedParam.h \
-	Source/JavaScriptCore/wtf/ValueCheck.h \
-	Source/JavaScriptCore/wtf/Vector.h \
-	Source/JavaScriptCore/wtf/VectorTraits.h \
-	Source/JavaScriptCore/wtf/VMTags.h \
-	Source/JavaScriptCore/wtf/WTFThreadData.cpp \
-	Source/JavaScriptCore/wtf/WTFThreadData.h \
-	Source/JavaScriptCore/yarr/Yarr.h \
-	Source/JavaScriptCore/yarr/YarrInterpreter.cpp \
-	Source/JavaScriptCore/yarr/YarrInterpreter.h \
-	Source/JavaScriptCore/yarr/YarrJIT.cpp \
-	Source/JavaScriptCore/yarr/YarrJIT.h \
-	Source/JavaScriptCore/yarr/YarrParser.h \
-	Source/JavaScriptCore/yarr/YarrPattern.cpp \
-	Source/JavaScriptCore/yarr/YarrPattern.h \
-	Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp \
-	Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
-
-if TARGET_WIN32
-javascriptcore_sources += \
-	Source/JavaScriptCore/runtime/MarkStackWin.cpp \
-	Source/JavaScriptCore/wtf/OSAllocatorWin.cpp
-else
-javascriptcore_sources += \
-	Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp \
-	Source/JavaScriptCore/runtime/MarkStackPosix.cpp \
-	Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
-endif
-
-# ----
-# icu unicode backend
-# ----
-if USE_ICU_UNICODE
-javascriptcore_sources += \
-	Source/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp \
-	Source/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
-endif # USE_ICU_UNICODE
-
-# ----
-# glib unicode backend
-# ----
-if USE_GLIB_UNICODE
-javascriptcore_sources += \
-	Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h \
-	Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h \
-	Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
-endif
-
 Source/JavaScriptCore/Lexer.lut.h: $(srcdir)/Source/JavaScriptCore/create_hash_table $(srcdir)/Source/JavaScriptCore/parser/Keywords.table
 	$(AM_V_GEN)$(PERL) $^ > $@
 
@@ -630,18 +45,6 @@ noinst_PROGRAMS += \
 	Programs/jsc \
 	Programs/minidom
 
-# minidom
-Programs_minidom_SOURCES = \
-	Source/JavaScriptCore/API/tests/JSNode.c \
-	Source/JavaScriptCore/API/tests/JSNode.h \
-	Source/JavaScriptCore/API/tests/JSNodeList.c \
-	Source/JavaScriptCore/API/tests/JSNodeList.h \
-	Source/JavaScriptCore/API/tests/Node.c \
-	Source/JavaScriptCore/API/tests/Node.h \
-	Source/JavaScriptCore/API/tests/NodeList.c \
-	Source/JavaScriptCore/API/tests/NodeList.h \
-	Source/JavaScriptCore/API/tests/minidom.c
-
 Programs_minidom_CPPFLAGS = \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags)
@@ -668,9 +71,6 @@ Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@$(EXEEXT): Programs/jsc$(EXEEXT)
 Programs_jsc_@WEBKITGTK_API_MAJOR_VERSION@_LDADD =
 Programs_jsc_@WEBKITGTK_API_MAJOR_VERSION@_SOURCES =
 
-Programs_jsc_SOURCES = \
-	Source/JavaScriptCore/jsc.cpp
-
 Programs_jsc_CPPFLAGS = \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags)
@@ -698,6 +98,7 @@ EXTRA_DIST += \
 	Source/JavaScriptCore/THANKS
 
 # Clean rules for JavaScriptCore
+# FIXME: Should this list be generated from javascriptcore_built_nosources?
 CLEANFILES += \
 	Source/JavaScriptCore/runtime/ArrayPrototype.lut.h \
 	Source/JavaScriptCore/runtime/DatePrototype.lut.h \
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
new file mode 100644
index 0000000..ade4691
--- /dev/null
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -0,0 +1,603 @@
+javascriptcore_h_api += \
+	Source/JavaScriptCore/API/JSBase.h \
+	Source/JavaScriptCore/API/JSContextRef.h \
+	Source/JavaScriptCore/API/JSObjectRef.h \
+	Source/JavaScriptCore/API/JSStringRef.h \
+	Source/JavaScriptCore/API/JSStringRefBSTR.h \
+	Source/JavaScriptCore/API/JSStringRefCF.h \
+	Source/JavaScriptCore/API/JSValueRef.h \
+	Source/JavaScriptCore/API/JavaScript.h \
+	Source/JavaScriptCore/API/JavaScriptCore.h \
+	Source/JavaScriptCore/API/WebKitAvailability.h
+
+javascriptcore_built_nosources += \
+	Source/JavaScriptCore/Lexer.lut.h \
+	Source/JavaScriptCore/RegExpJitTables.h \
+	Source/JavaScriptCore/runtime/ArrayPrototype.lut.h \
+	Source/JavaScriptCore/runtime/DatePrototype.lut.h \
+	Source/JavaScriptCore/runtime/JSONObject.lut.h \
+	Source/JavaScriptCore/runtime/MathObject.lut.h \
+	Source/JavaScriptCore/runtime/NumberConstructor.lut.h \
+	Source/JavaScriptCore/runtime/ObjectConstructor.lut.h \
+	Source/JavaScriptCore/runtime/RegExpConstructor.lut.h \
+	Source/JavaScriptCore/runtime/RegExpObject.lut.h \
+	Source/JavaScriptCore/runtime/StringPrototype.lut.h
+
+javascriptcore_sources += \
+	Source/JavaScriptCore/API/APICast.h \
+	Source/JavaScriptCore/API/APIShims.h \
+	Source/JavaScriptCore/API/JSBase.cpp \
+	Source/JavaScriptCore/API/JSBasePrivate.h \
+	Source/JavaScriptCore/API/JSCallbackConstructor.cpp \
+	Source/JavaScriptCore/API/JSCallbackConstructor.h \
+	Source/JavaScriptCore/API/JSCallbackFunction.cpp \
+	Source/JavaScriptCore/API/JSCallbackFunction.h \
+	Source/JavaScriptCore/API/JSCallbackObject.cpp \
+	Source/JavaScriptCore/API/JSCallbackObjectFunctions.h \
+	Source/JavaScriptCore/API/JSCallbackObject.h \
+	Source/JavaScriptCore/API/JSClassRef.cpp \
+	Source/JavaScriptCore/API/JSClassRef.h \
+	Source/JavaScriptCore/API/JSContextRef.cpp \
+	Source/JavaScriptCore/API/JSContextRefPrivate.h \
+	Source/JavaScriptCore/API/JSObjectRef.cpp \
+	Source/JavaScriptCore/API/JSObjectRefPrivate.h \
+	Source/JavaScriptCore/API/JSRetainPtr.h \
+	Source/JavaScriptCore/API/JSStringRef.cpp \
+	Source/JavaScriptCore/API/JSValueRef.cpp \
+	Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h \
+	Source/JavaScriptCore/API/OpaqueJSString.cpp \
+	Source/JavaScriptCore/API/OpaqueJSString.h \
+	Source/JavaScriptCore/assembler/AbstractMacroAssembler.h \
+	Source/JavaScriptCore/assembler/ARMAssembler.cpp \
+	Source/JavaScriptCore/assembler/ARMAssembler.h \
+	Source/JavaScriptCore/assembler/ARMv7Assembler.cpp \
+	Source/JavaScriptCore/assembler/ARMv7Assembler.h \
+	Source/JavaScriptCore/assembler/AssemblerBuffer.h \
+	Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h \
+	Source/JavaScriptCore/assembler/CodeLocation.h \
+	Source/JavaScriptCore/assembler/LinkBuffer.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp \
+	Source/JavaScriptCore/assembler/MacroAssemblerARM.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h \
+	Source/JavaScriptCore/assembler/MacroAssembler.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerX86.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerSH4.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerSH4.cpp \
+	Source/JavaScriptCore/assembler/SH4Assembler.h \
+	Source/JavaScriptCore/assembler/RepatchBuffer.h \
+	Source/JavaScriptCore/assembler/X86Assembler.h \
+	Source/JavaScriptCore/bytecode/CodeBlock.cpp \
+	Source/JavaScriptCore/bytecode/CodeBlock.h \
+	Source/JavaScriptCore/bytecode/EvalCodeCache.h \
+	Source/JavaScriptCore/bytecode/Instruction.h \
+	Source/JavaScriptCore/bytecode/JumpTable.cpp \
+	Source/JavaScriptCore/bytecode/JumpTable.h \
+	Source/JavaScriptCore/bytecode/Opcode.cpp \
+	Source/JavaScriptCore/bytecode/Opcode.h \
+	Source/JavaScriptCore/bytecode/SamplingTool.cpp \
+	Source/JavaScriptCore/bytecode/SamplingTool.h \
+	Source/JavaScriptCore/bytecode/StructureStubInfo.cpp \
+	Source/JavaScriptCore/bytecode/StructureStubInfo.h \
+	Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp \
+	Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h \
+	Source/JavaScriptCore/bytecompiler/Label.h \
+	Source/JavaScriptCore/bytecompiler/LabelScope.h \
+	Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp \
+	Source/JavaScriptCore/bytecompiler/RegisterID.h \
+	Source/JavaScriptCore/heap/ConservativeRoots.cpp \
+	Source/JavaScriptCore/heap/ConservativeRoots.h \
+	Source/JavaScriptCore/heap/Handle.h \
+	Source/JavaScriptCore/heap/HandleHeap.cpp \
+	Source/JavaScriptCore/heap/HandleHeap.h \
+	Source/JavaScriptCore/heap/HandleStack.cpp \
+	Source/JavaScriptCore/heap/HandleStack.h \
+	Source/JavaScriptCore/heap/Heap.cpp \
+	Source/JavaScriptCore/heap/Heap.h \
+	Source/JavaScriptCore/heap/Local.h \
+	Source/JavaScriptCore/heap/LocalScope.h \
+	Source/JavaScriptCore/heap/MachineStackMarker.cpp \
+	Source/JavaScriptCore/heap/MachineStackMarker.h \
+	Source/JavaScriptCore/heap/MarkStack.cpp \
+	Source/JavaScriptCore/heap/MarkStack.h \
+	Source/JavaScriptCore/heap/MarkedBlock.cpp \
+	Source/JavaScriptCore/heap/MarkedBlock.h \
+	Source/JavaScriptCore/heap/MarkedSpace.cpp \
+	Source/JavaScriptCore/heap/MarkedSpace.h \
+	Source/JavaScriptCore/heap/Strong.h \
+	Source/JavaScriptCore/heap/Weak.h \
+	Source/JavaScriptCore/config.h \
+	Source/JavaScriptCore/debugger/DebuggerActivation.cpp \
+	Source/JavaScriptCore/debugger/DebuggerActivation.h \
+	Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp \
+	Source/JavaScriptCore/debugger/DebuggerCallFrame.h \
+	Source/JavaScriptCore/debugger/Debugger.cpp \
+	Source/JavaScriptCore/debugger/Debugger.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APICast.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APIShims.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScript.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSBase.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSContextRef.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSObjectRef.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRef.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSValueRef.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h \
+	Source/JavaScriptCore/icu/unicode/parseerr.h \
+	Source/JavaScriptCore/icu/unicode/platform.h \
+	Source/JavaScriptCore/icu/unicode/putil.h \
+	Source/JavaScriptCore/icu/unicode/uchar.h \
+	Source/JavaScriptCore/icu/unicode/ucnv_err.h \
+	Source/JavaScriptCore/icu/unicode/ucnv.h \
+	Source/JavaScriptCore/icu/unicode/ucol.h \
+	Source/JavaScriptCore/icu/unicode/uconfig.h \
+	Source/JavaScriptCore/icu/unicode/uenum.h \
+	Source/JavaScriptCore/icu/unicode/uiter.h \
+	Source/JavaScriptCore/icu/unicode/uloc.h \
+	Source/JavaScriptCore/icu/unicode/umachine.h \
+	Source/JavaScriptCore/icu/unicode/unorm.h \
+	Source/JavaScriptCore/icu/unicode/urename.h \
+	Source/JavaScriptCore/icu/unicode/uset.h \
+	Source/JavaScriptCore/icu/unicode/ustring.h \
+	Source/JavaScriptCore/icu/unicode/utf16.h \
+	Source/JavaScriptCore/icu/unicode/utf8.h \
+	Source/JavaScriptCore/icu/unicode/utf.h \
+	Source/JavaScriptCore/icu/unicode/utf_old.h \
+	Source/JavaScriptCore/icu/unicode/utypes.h \
+	Source/JavaScriptCore/icu/unicode/uversion.h \
+	Source/JavaScriptCore/interpreter/CachedCall.h \
+	Source/JavaScriptCore/interpreter/CallFrameClosure.h \
+	Source/JavaScriptCore/interpreter/CallFrame.cpp \
+	Source/JavaScriptCore/interpreter/CallFrame.h \
+	Source/JavaScriptCore/interpreter/Interpreter.cpp \
+	Source/JavaScriptCore/interpreter/Interpreter.h \
+	Source/JavaScriptCore/interpreter/RegisterFile.cpp \
+	Source/JavaScriptCore/interpreter/RegisterFile.h \
+	Source/JavaScriptCore/interpreter/Register.h \
+	Source/JavaScriptCore/JavaScriptCorePrefix.h \
+	Source/JavaScriptCore/jit/ExecutableAllocator.cpp \
+	Source/JavaScriptCore/jit/ExecutableAllocator.h \
+	Source/JavaScriptCore/jit/JITArithmetic32_64.cpp \
+	Source/JavaScriptCore/jit/JITArithmetic.cpp \
+	Source/JavaScriptCore/jit/JITCall32_64.cpp \
+	Source/JavaScriptCore/jit/JITCall.cpp \
+	Source/JavaScriptCore/jit/JITCode.h \
+	Source/JavaScriptCore/jit/JIT.cpp \
+	Source/JavaScriptCore/jit/JIT.h \
+	Source/JavaScriptCore/jit/JITInlineMethods.h \
+	Source/JavaScriptCore/jit/JITOpcodes32_64.cpp \
+	Source/JavaScriptCore/jit/JITOpcodes.cpp \
+	Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp \
+	Source/JavaScriptCore/jit/JITPropertyAccess.cpp \
+	Source/JavaScriptCore/jit/JITStubCall.h \
+	Source/JavaScriptCore/jit/JITStubs.cpp \
+	Source/JavaScriptCore/jit/JITStubs.h \
+	Source/JavaScriptCore/jit/JSInterfaceJIT.h \
+	Source/JavaScriptCore/jit/SpecializedThunkJIT.h \
+	Source/JavaScriptCore/jit/ThunkGenerators.cpp \
+	Source/JavaScriptCore/jit/ThunkGenerators.h \
+	Source/JavaScriptCore/os-win32/stdbool.h \
+	Source/JavaScriptCore/os-win32/stdint.h \
+	Source/JavaScriptCore/parser/ASTBuilder.h \
+	Source/JavaScriptCore/parser/JSParser.cpp \
+	Source/JavaScriptCore/parser/JSParser.h \
+	Source/JavaScriptCore/parser/Lexer.cpp \
+	Source/JavaScriptCore/parser/Lexer.h \
+	Source/JavaScriptCore/parser/NodeConstructors.h \
+	Source/JavaScriptCore/parser/NodeInfo.h \
+	Source/JavaScriptCore/parser/Nodes.cpp \
+	Source/JavaScriptCore/parser/Nodes.h \
+	Source/JavaScriptCore/parser/ParserArena.cpp \
+	Source/JavaScriptCore/parser/ParserArena.h \
+	Source/JavaScriptCore/parser/Parser.cpp \
+	Source/JavaScriptCore/parser/Parser.h \
+	Source/JavaScriptCore/parser/ResultType.h \
+	Source/JavaScriptCore/parser/SourceCode.h \
+	Source/JavaScriptCore/parser/SourceProvider.h \
+	Source/JavaScriptCore/parser/SourceProviderCache.cpp \
+	Source/JavaScriptCore/parser/SourceProviderCache.h \
+	Source/JavaScriptCore/parser/SourceProviderCacheItem.h \
+	Source/JavaScriptCore/parser/SyntaxChecker.h \
+	Source/JavaScriptCore/profiler/CallIdentifier.h \
+	Source/JavaScriptCore/profiler/Profile.cpp \
+	Source/JavaScriptCore/profiler/ProfileGenerator.cpp \
+	Source/JavaScriptCore/profiler/ProfileGenerator.h \
+	Source/JavaScriptCore/profiler/Profile.h \
+	Source/JavaScriptCore/profiler/ProfileNode.cpp \
+	Source/JavaScriptCore/profiler/ProfileNode.h \
+	Source/JavaScriptCore/profiler/Profiler.cpp \
+	Source/JavaScriptCore/profiler/Profiler.h \
+	Source/JavaScriptCore/runtime/ArgList.cpp \
+	Source/JavaScriptCore/runtime/ArgList.h \
+	Source/JavaScriptCore/runtime/Arguments.cpp \
+	Source/JavaScriptCore/runtime/Arguments.h \
+	Source/JavaScriptCore/runtime/ArrayConstructor.cpp \
+	Source/JavaScriptCore/runtime/ArrayConstructor.h \
+	Source/JavaScriptCore/runtime/ArrayPrototype.cpp \
+	Source/JavaScriptCore/runtime/ArrayPrototype.h \
+	Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h \
+	Source/JavaScriptCore/runtime/BooleanConstructor.cpp \
+	Source/JavaScriptCore/runtime/BooleanConstructor.h \
+	Source/JavaScriptCore/runtime/BooleanObject.cpp \
+	Source/JavaScriptCore/runtime/BooleanObject.h \
+	Source/JavaScriptCore/runtime/BooleanPrototype.cpp \
+	Source/JavaScriptCore/runtime/BooleanPrototype.h \
+	Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h \
+	Source/JavaScriptCore/runtime/CallData.cpp \
+	Source/JavaScriptCore/runtime/CallData.h \
+	Source/JavaScriptCore/runtime/ClassInfo.h \
+	Source/JavaScriptCore/runtime/CommonIdentifiers.cpp \
+	Source/JavaScriptCore/runtime/CommonIdentifiers.h \
+	Source/JavaScriptCore/runtime/Completion.cpp \
+	Source/JavaScriptCore/runtime/Completion.h \
+	Source/JavaScriptCore/runtime/ConstructData.cpp \
+	Source/JavaScriptCore/runtime/ConstructData.h \
+	Source/JavaScriptCore/runtime/DateConstructor.cpp \
+	Source/JavaScriptCore/runtime/DateConstructor.h \
+	Source/JavaScriptCore/runtime/DateConversion.cpp \
+	Source/JavaScriptCore/runtime/DateConversion.h \
+	Source/JavaScriptCore/runtime/DateInstanceCache.h \
+	Source/JavaScriptCore/runtime/DateInstance.cpp \
+	Source/JavaScriptCore/runtime/DateInstance.h \
+	Source/JavaScriptCore/runtime/DatePrototype.cpp \
+	Source/JavaScriptCore/runtime/DatePrototype.h \
+	Source/JavaScriptCore/runtime/ErrorConstructor.cpp \
+	Source/JavaScriptCore/runtime/ErrorConstructor.h \
+	Source/JavaScriptCore/runtime/Error.cpp \
+	Source/JavaScriptCore/runtime/Error.h \
+	Source/JavaScriptCore/runtime/ErrorInstance.cpp \
+	Source/JavaScriptCore/runtime/ErrorInstance.h \
+	Source/JavaScriptCore/runtime/ErrorPrototype.cpp \
+	Source/JavaScriptCore/runtime/ErrorPrototype.h \
+	Source/JavaScriptCore/runtime/ExceptionHelpers.cpp \
+	Source/JavaScriptCore/runtime/ExceptionHelpers.h \
+	Source/JavaScriptCore/runtime/Executable.cpp \
+	Source/JavaScriptCore/runtime/Executable.h \
+	Source/JavaScriptCore/runtime/FunctionConstructor.cpp \
+	Source/JavaScriptCore/runtime/FunctionConstructor.h \
+	Source/JavaScriptCore/runtime/FunctionPrototype.cpp \
+	Source/JavaScriptCore/runtime/FunctionPrototype.h \
+	Source/JavaScriptCore/runtime/GCActivityCallback.cpp \
+	Source/JavaScriptCore/runtime/GCActivityCallback.h \
+	Source/JavaScriptCore/runtime/GetterSetter.cpp \
+	Source/JavaScriptCore/runtime/GetterSetter.h \
+	Source/JavaScriptCore/runtime/Identifier.cpp \
+	Source/JavaScriptCore/runtime/Identifier.h \
+	Source/JavaScriptCore/runtime/InitializeThreading.cpp \
+	Source/JavaScriptCore/runtime/InitializeThreading.h \
+	Source/JavaScriptCore/runtime/InternalFunction.cpp \
+	Source/JavaScriptCore/runtime/InternalFunction.h \
+	Source/JavaScriptCore/runtime/JSActivation.cpp \
+	Source/JavaScriptCore/runtime/JSActivation.h \
+	Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp \
+	Source/JavaScriptCore/runtime/JSAPIValueWrapper.h \
+	Source/JavaScriptCore/runtime/JSArray.cpp \
+	Source/JavaScriptCore/runtime/JSArray.h \
+	Source/JavaScriptCore/runtime/JSByteArray.cpp \
+	Source/JavaScriptCore/runtime/JSByteArray.h \
+	Source/JavaScriptCore/runtime/JSCell.cpp \
+	Source/JavaScriptCore/runtime/JSCell.h \
+	Source/JavaScriptCore/runtime/JSFunction.cpp \
+	Source/JavaScriptCore/runtime/JSFunction.h \
+	Source/JavaScriptCore/runtime/JSGlobalData.cpp \
+	Source/JavaScriptCore/runtime/JSGlobalData.h \
+	Source/JavaScriptCore/runtime/JSGlobalObject.cpp \
+	Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp \
+	Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h \
+	Source/JavaScriptCore/runtime/JSGlobalObject.h \
+	Source/JavaScriptCore/runtime/JSLock.cpp \
+	Source/JavaScriptCore/runtime/JSLock.h \
+	Source/JavaScriptCore/runtime/JSNotAnObject.cpp \
+	Source/JavaScriptCore/runtime/JSNotAnObject.h \
+	Source/JavaScriptCore/runtime/JSObject.cpp \
+	Source/JavaScriptCore/runtime/JSObject.h \
+	Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp \
+	Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h \
+	Source/JavaScriptCore/runtime/JSONObject.cpp \
+	Source/JavaScriptCore/runtime/JSONObject.h \
+	Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp \
+	Source/JavaScriptCore/runtime/JSPropertyNameIterator.h \
+	Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp \
+	Source/JavaScriptCore/runtime/JSStaticScopeObject.h \
+	Source/JavaScriptCore/runtime/JSStringBuilder.h \
+	Source/JavaScriptCore/runtime/JSString.cpp \
+	Source/JavaScriptCore/runtime/JSString.h \
+	Source/JavaScriptCore/runtime/JSType.h \
+	Source/JavaScriptCore/runtime/JSTypeInfo.h \
+	Source/JavaScriptCore/runtime/JSValue.cpp \
+	Source/JavaScriptCore/runtime/JSValue.h \
+	Source/JavaScriptCore/runtime/JSValueInlineMethods.h \
+	Source/JavaScriptCore/runtime/JSVariableObject.cpp \
+	Source/JavaScriptCore/runtime/JSVariableObject.h \
+	Source/JavaScriptCore/runtime/JSWrapperObject.cpp \
+	Source/JavaScriptCore/runtime/JSWrapperObject.h \
+	Source/JavaScriptCore/runtime/JSZombie.h \
+	Source/JavaScriptCore/runtime/LiteralParser.cpp \
+	Source/JavaScriptCore/runtime/LiteralParser.h \
+	Source/JavaScriptCore/runtime/Lookup.cpp \
+	Source/JavaScriptCore/runtime/Lookup.h \
+	Source/JavaScriptCore/runtime/MathObject.cpp \
+	Source/JavaScriptCore/runtime/MathObject.h \
+	Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp \
+	Source/JavaScriptCore/runtime/NativeErrorConstructor.h \
+	Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp \
+	Source/JavaScriptCore/runtime/NativeErrorPrototype.h \
+	Source/JavaScriptCore/runtime/NumberConstructor.cpp \
+	Source/JavaScriptCore/runtime/NumberConstructor.h \
+	Source/JavaScriptCore/runtime/NumberObject.cpp \
+	Source/JavaScriptCore/runtime/NumberObject.h \
+	Source/JavaScriptCore/runtime/NumberPrototype.cpp \
+	Source/JavaScriptCore/runtime/NumberPrototype.h \
+	Source/JavaScriptCore/runtime/NumericStrings.h \
+	Source/JavaScriptCore/runtime/ObjectConstructor.cpp \
+	Source/JavaScriptCore/runtime/ObjectConstructor.h \
+	Source/JavaScriptCore/runtime/ObjectPrototype.cpp \
+	Source/JavaScriptCore/runtime/ObjectPrototype.h \
+	Source/JavaScriptCore/runtime/Operations.cpp \
+	Source/JavaScriptCore/runtime/Operations.h \
+	Source/JavaScriptCore/runtime/PropertyDescriptor.cpp \
+	Source/JavaScriptCore/runtime/PropertyDescriptor.h \
+	Source/JavaScriptCore/runtime/PropertyMapHashTable.h \
+	Source/JavaScriptCore/runtime/PropertyNameArray.cpp \
+	Source/JavaScriptCore/runtime/PropertyNameArray.h \
+	Source/JavaScriptCore/runtime/PropertySlot.cpp \
+	Source/JavaScriptCore/runtime/PropertySlot.h \
+	Source/JavaScriptCore/runtime/Protect.h \
+	Source/JavaScriptCore/runtime/PutPropertySlot.h \
+	Source/JavaScriptCore/runtime/RegExpCache.cpp \
+	Source/JavaScriptCore/runtime/RegExpCache.h \
+	Source/JavaScriptCore/runtime/RegExpConstructor.cpp \
+	Source/JavaScriptCore/runtime/RegExpConstructor.h \
+	Source/JavaScriptCore/runtime/RegExp.cpp \
+	Source/JavaScriptCore/runtime/RegExp.h \
+	Source/JavaScriptCore/runtime/RegExpKey.h \
+	Source/JavaScriptCore/runtime/RegExpMatchesArray.h \
+	Source/JavaScriptCore/runtime/RegExpObject.cpp \
+	Source/JavaScriptCore/runtime/RegExpObject.h \
+	Source/JavaScriptCore/runtime/RegExpPrototype.cpp \
+	Source/JavaScriptCore/runtime/RegExpPrototype.h \
+	Source/JavaScriptCore/runtime/RopeImpl.cpp \
+	Source/JavaScriptCore/runtime/RopeImpl.h \
+	Source/JavaScriptCore/runtime/ScopeChain.cpp \
+	Source/JavaScriptCore/runtime/ScopeChain.h \
+	Source/JavaScriptCore/runtime/ScopeChainMark.h \
+	Source/JavaScriptCore/runtime/SmallStrings.cpp \
+	Source/JavaScriptCore/runtime/SmallStrings.h \
+	Source/JavaScriptCore/runtime/StrictEvalActivation.cpp \
+	Source/JavaScriptCore/runtime/StrictEvalActivation.h \
+	Source/JavaScriptCore/runtime/StringConstructor.cpp \
+	Source/JavaScriptCore/runtime/StringConstructor.h \
+	Source/JavaScriptCore/runtime/StringObject.cpp \
+	Source/JavaScriptCore/runtime/StringObject.h \
+	Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h \
+	Source/JavaScriptCore/runtime/StringPrototype.cpp \
+	Source/JavaScriptCore/runtime/StringPrototype.h \
+	Source/JavaScriptCore/runtime/StringRecursionChecker.cpp \
+	Source/JavaScriptCore/runtime/StringRecursionChecker.h \
+	Source/JavaScriptCore/runtime/StructureChain.cpp \
+	Source/JavaScriptCore/runtime/StructureChain.h \
+	Source/JavaScriptCore/runtime/Structure.cpp \
+	Source/JavaScriptCore/runtime/Structure.h \
+	Source/JavaScriptCore/runtime/StructureTransitionTable.h \
+	Source/JavaScriptCore/runtime/SymbolTable.h \
+	Source/JavaScriptCore/runtime/Terminator.h \
+	Source/JavaScriptCore/runtime/TimeoutChecker.cpp \
+	Source/JavaScriptCore/runtime/TimeoutChecker.h \
+	Source/JavaScriptCore/runtime/Tracing.h \
+	Source/JavaScriptCore/runtime/UString.cpp \
+	Source/JavaScriptCore/runtime/UString.h \
+	Source/JavaScriptCore/runtime/UStringBuilder.h \
+	Source/JavaScriptCore/runtime/UStringConcatenate.h \
+	Source/JavaScriptCore/runtime/WeakGCMap.h \
+	Source/JavaScriptCore/runtime/WeakRandom.h \
+	Source/JavaScriptCore/runtime/WriteBarrier.h \
+	Source/JavaScriptCore/wtf/AlwaysInline.h \
+	Source/JavaScriptCore/wtf/ASCIICType.h \
+	Source/JavaScriptCore/wtf/Assertions.cpp \
+	Source/JavaScriptCore/wtf/Assertions.h \
+	Source/JavaScriptCore/wtf/Atomics.h \
+	Source/JavaScriptCore/wtf/AVLTree.h \
+	Source/JavaScriptCore/wtf/Bitmap.h \
+	Source/JavaScriptCore/wtf/BlockStack.h \
+	Source/JavaScriptCore/wtf/BloomFilter.h \
+	Source/JavaScriptCore/wtf/BumpPointerAllocator.h \
+	Source/JavaScriptCore/wtf/ByteArray.cpp \
+	Source/JavaScriptCore/wtf/ByteArray.h \
+	Source/JavaScriptCore/wtf/CrossThreadRefCounted.h \
+	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp \
+	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h \
+	Source/JavaScriptCore/wtf/CurrentTime.cpp \
+	Source/JavaScriptCore/wtf/CurrentTime.h \
+	Source/JavaScriptCore/wtf/DateMath.cpp \
+	Source/JavaScriptCore/wtf/DateMath.h \
+	Source/JavaScriptCore/wtf/DecimalNumber.h \
+	Source/JavaScriptCore/wtf/DecimalNumber.cpp \
+	Source/JavaScriptCore/wtf/Decoder.h \
+	Source/JavaScriptCore/wtf/Deque.h \
+	Source/JavaScriptCore/wtf/DisallowCType.h \
+	Source/JavaScriptCore/wtf/DoublyLinkedList.h \
+	Source/JavaScriptCore/wtf/dtoa.cpp \
+	Source/JavaScriptCore/wtf/dtoa.h \
+	Source/JavaScriptCore/wtf/DynamicAnnotations.cpp \
+	Source/JavaScriptCore/wtf/DynamicAnnotations.h \
+	Source/JavaScriptCore/wtf/Encoder.h \
+	Source/JavaScriptCore/wtf/FastAllocBase.h \
+	Source/JavaScriptCore/wtf/FastMalloc.cpp \
+	Source/JavaScriptCore/wtf/FastMalloc.h \
+	Source/JavaScriptCore/wtf/FixedArray.h \
+	Source/JavaScriptCore/wtf/Forward.h \
+	Source/JavaScriptCore/wtf/GetPtr.h \
+	Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp \
+	Source/JavaScriptCore/wtf/gobject/GOwnPtr.h \
+	Source/JavaScriptCore/wtf/gobject/GRefPtr.cpp \
+	Source/JavaScriptCore/wtf/gobject/GRefPtr.h \
+	Source/JavaScriptCore/wtf/gobject/GTypedefs.h \
+	Source/JavaScriptCore/wtf/gtk/MainThreadGtk.cpp \
+	Source/JavaScriptCore/wtf/gtk/ThreadingGtk.cpp \
+	Source/JavaScriptCore/wtf/HashCountedSet.h \
+	Source/JavaScriptCore/wtf/HashFunctions.h \
+	Source/JavaScriptCore/wtf/HashIterators.h \
+	Source/JavaScriptCore/wtf/HashMap.h \
+	Source/JavaScriptCore/wtf/HashSet.h \
+	Source/JavaScriptCore/wtf/HashTable.cpp \
+	Source/JavaScriptCore/wtf/HashTable.h \
+	Source/JavaScriptCore/wtf/HashTraits.h \
+	Source/JavaScriptCore/wtf/HexNumber.h \
+	Source/JavaScriptCore/wtf/ListHashSet.h \
+	Source/JavaScriptCore/wtf/ListRefPtr.h \
+	Source/JavaScriptCore/wtf/Locker.h \
+	Source/JavaScriptCore/wtf/MainThread.cpp \
+	Source/JavaScriptCore/wtf/MainThread.h \
+	Source/JavaScriptCore/wtf/MallocZoneSupport.h \
+	Source/JavaScriptCore/wtf/MathExtras.h \
+	Source/JavaScriptCore/wtf/MD5.cpp \
+	Source/JavaScriptCore/wtf/MD5.h \
+	Source/JavaScriptCore/wtf/MessageQueue.h \
+	Source/JavaScriptCore/wtf/NonCopyingSort.h \
+	Source/JavaScriptCore/wtf/Noncopyable.h \
+	Source/JavaScriptCore/wtf/NotFound.h \
+	Source/JavaScriptCore/wtf/NullPtr.h \
+	Source/JavaScriptCore/wtf/OSAllocator.h \
+	Source/JavaScriptCore/wtf/OSRandomSource.cpp \
+	Source/JavaScriptCore/wtf/OSRandomSource.h \
+	Source/JavaScriptCore/wtf/OwnArrayPtr.h \
+	Source/JavaScriptCore/wtf/OwnFastMallocPtr.h \
+	Source/JavaScriptCore/wtf/OwnPtrCommon.h \
+	Source/JavaScriptCore/wtf/OwnPtr.h \
+	Source/JavaScriptCore/wtf/PageAllocation.h \
+	Source/JavaScriptCore/wtf/PageAllocationAligned.cpp \
+	Source/JavaScriptCore/wtf/PageAllocationAligned.h \
+	Source/JavaScriptCore/wtf/PageReservation.h \
+	Source/JavaScriptCore/wtf/PageBlock.cpp \
+	Source/JavaScriptCore/wtf/PageBlock.h \
+	Source/JavaScriptCore/wtf/PassOwnArrayPtr.h \
+	Source/JavaScriptCore/wtf/PassOwnPtr.h \
+	Source/JavaScriptCore/wtf/PassRefPtr.h \
+	Source/JavaScriptCore/wtf/Platform.h \
+	Source/JavaScriptCore/wtf/PossiblyNull.h \
+	Source/JavaScriptCore/wtf/RandomNumber.cpp \
+	Source/JavaScriptCore/wtf/RandomNumber.h \
+	Source/JavaScriptCore/wtf/RandomNumberSeed.h \
+	Source/JavaScriptCore/wtf/RefCounted.h \
+	Source/JavaScriptCore/wtf/RefCountedLeakCounter.cpp \
+	Source/JavaScriptCore/wtf/RefCountedLeakCounter.h \
+	Source/JavaScriptCore/wtf/RefPtr.h \
+	Source/JavaScriptCore/wtf/RefPtrHashMap.h \
+	Source/JavaScriptCore/wtf/RetainPtr.h \
+	Source/JavaScriptCore/wtf/SegmentedVector.h \
+	Source/JavaScriptCore/wtf/SentinelLinkedList.h \
+	Source/JavaScriptCore/wtf/SHA1.cpp \
+	Source/JavaScriptCore/wtf/SHA1.h \
+	Source/JavaScriptCore/wtf/SinglyLinkedList.h \
+	Source/JavaScriptCore/wtf/StackBounds.cpp \
+	Source/JavaScriptCore/wtf/StackBounds.h \
+	Source/JavaScriptCore/wtf/StaticConstructors.h \
+	Source/JavaScriptCore/wtf/StdLibExtras.h \
+	Source/JavaScriptCore/wtf/StringExtras.h \
+	Source/JavaScriptCore/wtf/StringHasher.h \
+	Source/JavaScriptCore/wtf/TCPackedCache.h \
+	Source/JavaScriptCore/wtf/TCPageMap.h \
+	Source/JavaScriptCore/wtf/TCSpinLock.h \
+	Source/JavaScriptCore/wtf/TCSystemAlloc.cpp \
+	Source/JavaScriptCore/wtf/TCSystemAlloc.h \
+	Source/JavaScriptCore/wtf/text/AtomicString.cpp \
+	Source/JavaScriptCore/wtf/text/AtomicString.h \
+	Source/JavaScriptCore/wtf/text/AtomicStringHash.h \
+	Source/JavaScriptCore/wtf/text/AtomicStringImpl.h \
+	Source/JavaScriptCore/wtf/text/CString.cpp \
+	Source/JavaScriptCore/wtf/text/CString.h \
+	Source/JavaScriptCore/wtf/text/StringBuffer.h \
+	Source/JavaScriptCore/wtf/text/StringBuilder.cpp \
+	Source/JavaScriptCore/wtf/text/StringBuilder.h \
+	Source/JavaScriptCore/wtf/text/StringConcatenate.h \
+	Source/JavaScriptCore/wtf/text/StringHash.h \
+	Source/JavaScriptCore/wtf/text/StringImplBase.h \
+	Source/JavaScriptCore/wtf/text/StringImpl.cpp \
+	Source/JavaScriptCore/wtf/text/StringImpl.h \
+	Source/JavaScriptCore/wtf/text/StringStatics.cpp \
+	Source/JavaScriptCore/wtf/text/TextPosition.h \
+	Source/JavaScriptCore/wtf/text/WTFString.cpp \
+	Source/JavaScriptCore/wtf/text/WTFString.h \
+	Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp \
+	Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h \
+	Source/JavaScriptCore/wtf/Threading.cpp \
+	Source/JavaScriptCore/wtf/Threading.h \
+	Source/JavaScriptCore/wtf/ThreadingPrimitives.h \
+	Source/JavaScriptCore/wtf/ThreadingPthreads.cpp \
+	Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h \
+	Source/JavaScriptCore/wtf/ThreadSpecific.h \
+	Source/JavaScriptCore/wtf/TypeTraits.cpp \
+	Source/JavaScriptCore/wtf/TypeTraits.h \
+	Source/JavaScriptCore/wtf/unicode/CharacterNames.h \
+	Source/JavaScriptCore/wtf/unicode/CollatorDefault.cpp \
+	Source/JavaScriptCore/wtf/unicode/Collator.h \
+	Source/JavaScriptCore/wtf/unicode/Unicode.h \
+	Source/JavaScriptCore/wtf/unicode/UTF8.cpp \
+	Source/JavaScriptCore/wtf/unicode/UTF8.h \
+	Source/JavaScriptCore/wtf/UnusedParam.h \
+	Source/JavaScriptCore/wtf/ValueCheck.h \
+	Source/JavaScriptCore/wtf/Vector.h \
+	Source/JavaScriptCore/wtf/VectorTraits.h \
+	Source/JavaScriptCore/wtf/VMTags.h \
+	Source/JavaScriptCore/wtf/WTFThreadData.cpp \
+	Source/JavaScriptCore/wtf/WTFThreadData.h \
+	Source/JavaScriptCore/yarr/Yarr.h \
+	Source/JavaScriptCore/yarr/YarrInterpreter.cpp \
+	Source/JavaScriptCore/yarr/YarrInterpreter.h \
+	Source/JavaScriptCore/yarr/YarrJIT.cpp \
+	Source/JavaScriptCore/yarr/YarrJIT.h \
+	Source/JavaScriptCore/yarr/YarrParser.h \
+	Source/JavaScriptCore/yarr/YarrPattern.cpp \
+	Source/JavaScriptCore/yarr/YarrPattern.h \
+	Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp \
+	Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
+
+if TARGET_WIN32
+javascriptcore_sources += \
+	Source/JavaScriptCore/heap/MarkStackWin.cpp \
+	Source/JavaScriptCore/wtf/OSAllocatorWin.cpp
+else
+javascriptcore_sources += \
+	Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp \
+	Source/JavaScriptCore/heap/MarkStackPosix.cpp \
+	Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
+endif
+
+# ----
+# icu unicode backend
+# ----
+if USE_ICU_UNICODE
+javascriptcore_sources += \
+	Source/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp \
+	Source/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+endif # USE_ICU_UNICODE
+
+# ----
+# glib unicode backend
+# ----
+if USE_GLIB_UNICODE
+javascriptcore_sources += \
+	Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h \
+	Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h \
+	Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
+endif # USE_GLIB_UNICODE
+
+# minidom
+Programs_minidom_SOURCES = \
+	Source/JavaScriptCore/API/tests/JSNode.c \
+	Source/JavaScriptCore/API/tests/JSNode.h \
+	Source/JavaScriptCore/API/tests/JSNodeList.c \
+	Source/JavaScriptCore/API/tests/JSNodeList.h \
+	Source/JavaScriptCore/API/tests/Node.c \
+	Source/JavaScriptCore/API/tests/Node.h \
+	Source/JavaScriptCore/API/tests/NodeList.c \
+	Source/JavaScriptCore/API/tests/NodeList.h \
+	Source/JavaScriptCore/API/tests/minidom.c
+
+Programs_jsc_SOURCES = \
+	Source/JavaScriptCore/jsc.cpp
diff --git a/Source/JavaScriptCore/JavaScriptCore.JSVALUE32_64only.exp b/Source/JavaScriptCore/JavaScriptCore.JSVALUE32_64only.exp
index 2f1166c..f9eee85 100644
--- a/Source/JavaScriptCore/JavaScriptCore.JSVALUE32_64only.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.JSVALUE32_64only.exp
@@ -1 +1 @@
-__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFxS2_E
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureEiRKNS_10IdentifierEPFxS2_E
diff --git a/Source/JavaScriptCore/JavaScriptCore.JSVALUE64only.exp b/Source/JavaScriptCore/JavaScriptCore.JSVALUE64only.exp
index c693322..eaa9f51 100644
--- a/Source/JavaScriptCore/JavaScriptCore.JSVALUE64only.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.JSVALUE64only.exp
@@ -1 +1 @@
-__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFPvS2_E
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureEiRKNS_10IdentifierEPFPvS2_E
diff --git a/Source/JavaScriptCore/JavaScriptCore.exp b/Source/JavaScriptCore/JavaScriptCore.exp
index e2647d1..1b00c66 100644
--- a/Source/JavaScriptCore/JavaScriptCore.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.exp
@@ -114,14 +114,14 @@ __ZN3JSC10throwErrorEPNS_9ExecStateENS_7JSValueE
 __ZN3JSC10throwErrorEPNS_9ExecStateEPNS_8JSObjectE
 __ZN3JSC11JSByteArray13s_defaultInfoE
 __ZN3JSC11JSByteArray15createStructureERNS_12JSGlobalDataENS_7JSValueEPKNS_9ClassInfoE
-__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEPNS3_9ByteArrayE
+__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEPNS_9StructureEPN3WTF9ByteArrayE
 __ZN3JSC11MarkedSpace21allocateFromSizeClassERNS0_9SizeClassE
 __ZN3JSC11ParserArena5resetEv
 __ZN3JSC11checkSyntaxEPNS_9ExecStateERKNS_10SourceCodeE
 __ZN3JSC11createErrorEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC11regExpFlagsERKNS_7UStringE
 __ZN3JSC12DateInstance6s_infoE
-__ZN3JSC12DateInstanceC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEd
+__ZN3JSC12DateInstanceC1EPNS_9ExecStateEPNS_9StructureEd
 __ZN3JSC12JSGlobalData10ClientDataD2Ev
 __ZN3JSC12JSGlobalData11jsArrayVPtrE
 __ZN3JSC12JSGlobalData12createLeakedENS_15ThreadStackTypeE
@@ -132,10 +132,11 @@ __ZN3JSC12JSGlobalData14dumpSampleDataEPNS_9ExecStateE
 __ZN3JSC12JSGlobalData14resetDateCacheEv
 __ZN3JSC12JSGlobalData14sharedInstanceEv
 __ZN3JSC12JSGlobalData15dumpRegExpTraceEv
+__ZN3JSC12JSGlobalData22clearBuiltinStructuresEv
 __ZN3JSC12JSGlobalData6createENS_15ThreadStackTypeE
 __ZN3JSC12JSGlobalDataD1Ev
 __ZN3JSC12RegExpObject6s_infoE
-__ZN3JSC12RegExpObjectC1EPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEENS4_INS_6RegExpEEE
+__ZN3JSC12RegExpObjectC1EPNS_14JSGlobalObjectEPNS_9StructureEN3WTF17NonNullPassRefPtrINS_6RegExpEEE
 __ZN3JSC12SamplingTool5setupEv
 __ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
 __ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_12JSGlobalDataEh
@@ -146,8 +147,7 @@ __ZN3JSC12StringObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArr
 __ZN3JSC12StringObject24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC12StringObject6s_infoE
-__ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_7UStringE
-__ZN3JSC12jsNumberCellEPNS_9ExecStateEd
+__ZN3JSC12StringObjectC2EPNS_9ExecStateEPNS_9StructureERKNS_7UStringE
 __ZN3JSC12nonInlineNaNEv
 __ZN3JSC13SamplingFlags4stopEv
 __ZN3JSC13SamplingFlags5startEv
@@ -169,11 +169,14 @@ __ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
 __ZN3JSC14TimeoutChecker5resetEv
 __ZN3JSC14throwTypeErrorEPNS_9ExecStateE
 __ZN3JSC15JSWrapperObject12markChildrenERNS_9MarkStackE
+__ZN3JSC15WeakHandleOwner26isReachableFromOpaqueRootsENS_6HandleINS_7UnknownEEEPvRNS_9MarkStackE
+__ZN3JSC15WeakHandleOwner8finalizeENS_6HandleINS_7UnknownEEEPv
+__ZN3JSC15WeakHandleOwnerD2Ev
 __ZN3JSC15createTypeErrorEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC16InternalFunction12vtableAnchorEv
 __ZN3JSC16InternalFunction4nameEPNS_9ExecStateE
 __ZN3JSC16InternalFunction6s_infoE
-__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_10IdentifierE
+__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEPNS_14JSGlobalObjectEPNS_9StructureERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject14symbolTableGetERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC16JSVariableObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
@@ -204,7 +207,8 @@ __ZN3JSC23AbstractSamplingCounter4dumpEv
 __ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateE
 __ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC24DynamicGlobalObjectScopeC1ERNS_12JSGlobalDataEPNS_14JSGlobalObjectE
-__ZN3JSC24JSObjectWithGlobalObjectC2EPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEE
+__ZN3JSC24JSObjectWithGlobalObjectC2EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC24JSObjectWithGlobalObjectC2ERNS_12JSGlobalDataEPNS_14JSGlobalObjectEPNS_9StructureE
 __ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
 __ZN3JSC25evaluateInGlobalCallFrameERKNS_7UStringERNS_7JSValueEPNS_14JSGlobalObjectE
 __ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
@@ -253,9 +257,9 @@ __ZN3JSC7JSArray15setSubclassDataEPv
 __ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
 __ZN3JSC7JSArray6s_infoE
 __ZN3JSC7JSArray9setLengthEj
-__ZN3JSC7JSArrayC1EN3WTF17NonNullPassRefPtrINS_9StructureEEE
-__ZN3JSC7JSArrayC1ERNS_12JSGlobalDataEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_7ArgListE
-__ZN3JSC7JSArrayC2EN3WTF17NonNullPassRefPtrINS_9StructureEEE
+__ZN3JSC7JSArrayC1ERNS_12JSGlobalDataEPNS_9StructureE
+__ZN3JSC7JSArrayC1ERNS_12JSGlobalDataEPNS_9StructureERKNS_7ArgListE
+__ZN3JSC7JSArrayC2ERNS_12JSGlobalDataEPNS_9StructureE
 __ZN3JSC7JSArrayD2Ev
 __ZN3JSC7JSValue13isValidCalleeEv
 __ZN3JSC7Profile10restoreAllEv
@@ -308,21 +312,20 @@ __ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler14startProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler8profilerEv
 __ZN3JSC8evaluateEPNS_9ExecStateEPNS_14ScopeChainNodeERKNS_10SourceCodeENS_7JSValueE
+__ZN3JSC8isZombieEPKNS_6JSCellE
 __ZN3JSC9CodeBlockD1Ev
 __ZN3JSC9CodeBlockD2Ev
 __ZN3JSC9MarkStack10s_pageSizeE
 __ZN3JSC9MarkStack18initializePagesizeEv
-__ZN3JSC9Structure17stopIgnoringLeaksEv
-__ZN3JSC9Structure18startIgnoringLeaksEv
-__ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
-__ZN3JSC9Structure22materializePropertyMapEv
-__ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_7JSValueE
-__ZN3JSC9Structure27despecifyDictionaryFunctionERKNS_10IdentifierE
-__ZN3JSC9Structure27despecifyFunctionTransitionEPS0_RKNS_10IdentifierE
-__ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEjPNS_6JSCellE
-__ZN3JSC9Structure3getEPN3WTF10StringImplERjRPNS_6JSCellE
+__ZN3JSC9Structure21addPropertyTransitionERNS_12JSGlobalDataEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
+__ZN3JSC9Structure22materializePropertyMapERNS_12JSGlobalDataE
+__ZN3JSC9Structure25changePrototypeTransitionERNS_12JSGlobalDataEPS0_NS_7JSValueE
+__ZN3JSC9Structure27despecifyDictionaryFunctionERNS_12JSGlobalDataERKNS_10IdentifierE
+__ZN3JSC9Structure27despecifyFunctionTransitionERNS_12JSGlobalDataEPS0_RKNS_10IdentifierE
+__ZN3JSC9Structure28addPropertyWithoutTransitionERNS_12JSGlobalDataERKNS_10IdentifierEjPNS_6JSCellE
+__ZN3JSC9Structure3getERNS_12JSGlobalDataEPN3WTF10StringImplERjRPNS_6JSCellE
 __ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
-__ZN3JSC9StructureC1ENS_7JSValueERKNS_8TypeInfoEjPKNS_9ClassInfoE
+__ZN3JSC9StructureC1ERNS_12JSGlobalDataENS_7JSValueERKNS_8TypeInfoEjPKNS_9ClassInfoE
 __ZN3JSC9StructureD1Ev
 __ZN3JSC9constructEPNS_9ExecStateENS_7JSValueENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
 __ZN3JSCeqERKNS_7UStringEPKc
@@ -371,22 +374,21 @@ __ZN3WTF11dtoaRoundDPEPcdiRbRiRj
 __ZN3WTF11dtoaRoundSFEPcdiRbRiRj
 __ZN3WTF11fastReallocEPvm
 __ZN3WTF12AtomicString11addSlowCaseEPNS_10StringImplE
+__ZN3WTF12AtomicString16fromUTF8InternalEPKcS2_
 __ZN3WTF12AtomicString3addEPKc
 __ZN3WTF12AtomicString3addEPKt
 __ZN3WTF12AtomicString3addEPKtj
 __ZN3WTF12AtomicString3addEPKtjj
 __ZN3WTF12AtomicString4findEPKtjj
 __ZN3WTF12AtomicString4initEv
-__ZN3WTF12AtomicString8fromUTF8EPKc
-__ZN3WTF12AtomicString8fromUTF8EPKcm
 __ZN3WTF12createThreadEPFPvS0_ES0_
 __ZN3WTF12createThreadEPFPvS0_ES0_PKc
 __ZN3WTF12detachThreadEj
 __ZN3WTF12isMainThreadEv
 __ZN3WTF12randomNumberEv
-__ZN3WTF13StringBuilder15reserveCapacityEj
 __ZN3WTF13StringBuilder11reifyStringEv
 __ZN3WTF13StringBuilder11shrinkToFitEv
+__ZN3WTF13StringBuilder15reserveCapacityEj
 __ZN3WTF13StringBuilder6appendEPKcj
 __ZN3WTF13StringBuilder6appendEPKtj
 __ZN3WTF13StringBuilder6resizeEj
@@ -526,7 +528,6 @@ __ZNK3JSC18PropertyDescriptor6getterEv
 __ZNK3JSC18PropertyDescriptor6setterEv
 __ZNK3JSC18PropertyDescriptor8writableEv
 __ZNK3JSC19SourceProviderCache8byteSizeEv
-__ZNK3JSC24JSObjectWithGlobalObject12globalObjectEv
 __ZNK3JSC4Heap11objectCountEv
 __ZNK3JSC4Heap4sizeEv
 __ZNK3JSC4Heap8capacityEv
@@ -596,6 +597,7 @@ __ZTVN3JSC12StringObjectE
 __ZTVN3JSC14JSGlobalObjectE
 __ZTVN3JSC14ScopeChainNodeE
 __ZTVN3JSC15JSWrapperObjectE
+__ZTVN3JSC15WeakHandleOwnerE
 __ZTVN3JSC16InternalFunctionE
 __ZTVN3JSC16JSVariableObjectE
 __ZTVN3JSC8DebuggerE
diff --git a/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp b/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
index 9b93d97..27596fc 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
+++ b/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
@@ -206,10 +206,13 @@
           'inputs': [
             '../create_regex_tables',
           ],
+          'arguments': [
+            '--no-tables',
+          ],
           'outputs': [
             '<(INTERMEDIATE_DIR)/RegExpJitTables.h',
           ],
-          'action': ['python', '<@(_inputs)', '<@(_outputs)'],
+          'action': ['python', '<@(_inputs)', '<@(_arguments)', '<@(_outputs)'],
         },
       ],
       'include_dirs': [
diff --git a/Source/JavaScriptCore/JavaScriptCore.gypi b/Source/JavaScriptCore/JavaScriptCore.gypi
index cb93a29..352ec97 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gypi
+++ b/Source/JavaScriptCore/JavaScriptCore.gypi
@@ -27,12 +27,15 @@
             'API/OpaqueJSString.h',
             'assembler/MacroAssemblerCodeRef.h',
             'bytecode/Opcode.h',
-            'collector/handles/Global.h',
-            'collector/handles/Handle.h',
-            'collector/handles/HandleHeap.h',
-            'collector/handles/HandleStack.h',
-            'collector/handles/Local.h',
-            'collector/handles/LocalScope.h',
+            'heap/ConservativeRoots.h',
+            'heap/Handle.h',
+            'heap/HandleHeap.h',
+            'heap/HandleStack.h',
+            'heap/Heap.h',
+            'heap/Local.h',
+            'heap/LocalScope.h',
+            'heap/Strong.h',
+            'heap/Weak.h',
             'config.h',
             'debugger/Debugger.h',
             'debugger/DebuggerActivation.h',
@@ -69,7 +72,6 @@
             'runtime/FunctionConstructor.h',
             'runtime/FunctionPrototype.h',
             'runtime/GCActivityCallback.h',
-            'runtime/Heap.h',
             'runtime/Identifier.h',
             'runtime/InitializeThreading.h',
             'runtime/InternalFunction.h',
@@ -80,7 +82,6 @@
             'runtime/JSFunction.h',
             'runtime/JSGlobalData.h',
             'runtime/JSGlobalObject.h',
-            'runtime/JSImmediate.h',
             'runtime/JSLock.h',
             'runtime/JSNumberCell.h',
             'runtime/JSObject.h',
@@ -89,13 +90,10 @@
             'runtime/JSType.h',
             'runtime/JSTypeInfo.h',
             'runtime/JSValue.h',
+            'runtime/JSValueInlineMethods.h',
             'runtime/JSVariableObject.h',
             'runtime/JSWrapperObject.h',
             'runtime/Lookup.h',
-            'runtime/MachineStackMarker.h',
-            'runtime/MarkStack.h',
-            'runtime/MarkedBlock.h',
-            'runtime/MarkedSpace.h',
             'runtime/MathObject.h',
             'runtime/MemoryStatistics.h',
             'runtime/NumberObject.h',
@@ -128,11 +126,11 @@
             'runtime/UString.h',
             'runtime/UStringBuilder.h',
             'runtime/WeakGCMap.h',
-            'runtime/WeakGCPtr.h',
             'runtime/WeakRandom.h',
             'runtime/WriteBarrier.h',
             'wtf/ASCIICType.h',
             'wtf/AVLTree.h',
+            'wtf/Alignment.h',
             'wtf/AlwaysInline.h',
             'wtf/Assertions.h',
             'wtf/Atomics.h',
@@ -310,8 +308,21 @@
             'bytecompiler/LabelScope.h',
             'bytecompiler/NodesCodegen.cpp',
             'bytecompiler/RegisterID.h',
-            'collector/handles/HandleHeap.cpp',
-            'collector/handles/HandleStack.cpp',
+            'heap/ConservativeRoots.cpp',
+            'heap/HandleHeap.cpp',
+            'heap/HandleStack.cpp',
+            'heap/Heap.cpp',
+            'heap/MachineStackMarker.cpp',
+            'heap/MachineStackMarker.h',
+            'heap/MarkStack.cpp',
+            'heap/MarkStack.h',
+            'heap/MarkStackPosix.cpp',
+            'heap/MarkStackSymbian.cpp',
+            'heap/MarkStackWin.cpp',
+            'heap/MarkedBlock.cpp',
+            'heap/MarkedBlock.h',
+            'heap/MarkedSpace.cpp',
+            'heap/MarkedSpace.h',
             'debugger/Debugger.cpp',
             'debugger/DebuggerActivation.cpp',
             'debugger/DebuggerCallFrame.cpp',
@@ -456,8 +467,6 @@
             'runtime/CallData.cpp',
             'runtime/CommonIdentifiers.cpp',
             'runtime/Completion.cpp',
-            'runtime/ConservativeSet.cpp',
-            'runtime/ConservativeSet.h',
             'runtime/ConstructData.cpp',
             'runtime/DateConstructor.cpp',
             'runtime/DateConstructor.h',
@@ -482,7 +491,6 @@
             'runtime/GCActivityCallbackCF.cpp',
             'runtime/GetterSetter.cpp',
             'runtime/GetterSetter.h',
-            'runtime/Heap.cpp',
             'runtime/Identifier.cpp',
             'runtime/InitializeThreading.cpp',
             'runtime/InternalFunction.cpp',
@@ -497,7 +505,6 @@
             'runtime/JSGlobalObject.cpp',
             'runtime/JSGlobalObjectFunctions.cpp',
             'runtime/JSGlobalObjectFunctions.h',
-            'runtime/JSImmediate.cpp',
             'runtime/JSLock.cpp',
             'runtime/JSNotAnObject.cpp',
             'runtime/JSNotAnObject.h',
@@ -520,13 +527,6 @@
             'runtime/LiteralParser.cpp',
             'runtime/LiteralParser.h',
             'runtime/Lookup.cpp',
-            'runtime/MachineStackMarker.cpp',
-            'runtime/MarkStack.cpp',
-            'runtime/MarkStackPosix.cpp',
-            'runtime/MarkStackSymbian.cpp',
-            'runtime/MarkStackWin.cpp',
-            'runtime/MarkedBlock.cpp',
-            'runtime/MarkedSpace.cpp',
             'runtime/MathObject.cpp',
             'runtime/MemoryStatistics.cpp',
             'runtime/NativeErrorConstructor.cpp',
@@ -577,6 +577,8 @@
             'wtf/CurrentTime.cpp',
             'wtf/DateMath.cpp',
             'wtf/DecimalNumber.cpp',
+            'wtf/DynamicAnnotations.cpp',
+            'wtf/DynamicAnnotations.h',
             'wtf/FastMalloc.cpp',
             'wtf/HashTable.cpp',
             'wtf/MD5.cpp',
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index 941a708..c342936 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -25,7 +25,7 @@ JAVASCRIPTCORE_INCLUDEPATH = \
     $$PWD/assembler \
     $$PWD/bytecode \
     $$PWD/bytecompiler \
-    $$PWD/collector/handles \
+    $$PWD/heap \
     $$PWD/dfg \
     $$PWD/debugger \
     $$PWD/interpreter \
diff --git a/Source/JavaScriptCore/JavaScriptCore.pro b/Source/JavaScriptCore/JavaScriptCore.pro
index 80ad3e8..7a3653b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pro
+++ b/Source/JavaScriptCore/JavaScriptCore.pro
@@ -62,6 +62,9 @@ SOURCES += \
     assembler/ARMAssembler.cpp \
     assembler/ARMv7Assembler.cpp \
     assembler/MacroAssemblerARM.cpp \
+    assembler/MacroAssemblerSH4.h \
+    assembler/MacroAssemblerSH4.cpp \
+    assembler/SH4Assembler.h \
     bytecode/CodeBlock.cpp \
     bytecode/JumpTable.cpp \
     bytecode/Opcode.cpp \
@@ -69,8 +72,17 @@ SOURCES += \
     bytecode/StructureStubInfo.cpp \
     bytecompiler/BytecodeGenerator.cpp \
     bytecompiler/NodesCodegen.cpp \
-    collector/handles/HandleHeap.cpp \
-    collector/handles/HandleStack.cpp \
+    heap/ConservativeRoots.cpp \
+    heap/HandleHeap.cpp \
+    heap/HandleStack.cpp \
+    heap/Heap.cpp \
+    heap/MachineStackMarker.cpp \
+    heap/MarkStack.cpp \
+    heap/MarkStackPosix.cpp \
+    heap/MarkStackSymbian.cpp \
+    heap/MarkStackWin.cpp \
+    heap/MarkedBlock.cpp \
+    heap/MarkedSpace.cpp \
     debugger/DebuggerActivation.cpp \
     debugger/DebuggerCallFrame.cpp \
     debugger/Debugger.cpp \
@@ -115,9 +127,6 @@ SOURCES += \
     runtime/BooleanObject.cpp \
     runtime/BooleanPrototype.cpp \
     runtime/CallData.cpp \
-    runtime/MarkedBlock.cpp \
-    runtime/MarkedSpace.cpp \
-    runtime/Heap.cpp \
     runtime/CommonIdentifiers.cpp \
     runtime/Completion.cpp \
     runtime/ConstructData.cpp \
@@ -147,10 +156,8 @@ SOURCES += \
     runtime/JSGlobalData.cpp \
     runtime/JSGlobalObject.cpp \
     runtime/JSGlobalObjectFunctions.cpp \
-    runtime/JSImmediate.cpp \
     runtime/JSLock.cpp \
     runtime/JSNotAnObject.cpp \
-    runtime/JSNumberCell.cpp \
     runtime/JSObject.cpp \
     runtime/JSObjectWithGlobalObject.cpp \
     runtime/JSONObject.cpp \
@@ -162,12 +169,6 @@ SOURCES += \
     runtime/JSWrapperObject.cpp \
     runtime/LiteralParser.cpp \
     runtime/Lookup.cpp \
-    runtime/MachineStackMarker.cpp \
-    runtime/MarkStackPosix.cpp \
-    runtime/MarkStackSymbian.cpp \
-    runtime/MarkStackWin.cpp \
-    runtime/ConservativeSet.cpp \
-    runtime/MarkStack.cpp \
     runtime/MathObject.cpp \
     runtime/NativeErrorConstructor.cpp \
     runtime/NativeErrorPrototype.cpp \
@@ -199,6 +200,11 @@ SOURCES += \
     runtime/UString.cpp \
     yarr/YarrJIT.cpp \
 
+*sh4* {
+    QMAKE_CXXFLAGS += -mieee -w
+    QMAKE_CFLAGS   += -mieee -w
+}
+
 # Generated files, simply list them for JavaScriptCore
 
 symbian: {
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
index b5461e4..bd47530 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
@@ -5,6 +5,7 @@ BUILDSTYLE=Release_PGO
 !ENDIF
 
 install:
+    set OFFICIAL_BUILD=1
     set WebKitLibrariesDir=$(SRCROOT)\AppleInternal
     set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
index 0b610e2..f2846cc 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
@@ -3,18 +3,23 @@ Microsoft Visual Studio Solution File, Format Version 9.00
 # Visual Studio 2005
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"
 	ProjectSection(ProjectDependencies) = postProject
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"
 	ProjectSection(ProjectDependencies) = postProject
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "WTF\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"
+	ProjectSection(ProjectDependencies) = postProject
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
+	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FindSafari", "..\..\..\Tools\FindSafari\FindSafari.vcproj", "{DA31DA52-6675-48D4-89E0-333A7144397C}"
+	ProjectSection(ProjectDependencies) = postProject
+		{C59E5129-B453-49B7-A52B-1E104715F76E} = {C59E5129-B453-49B7-A52B-1E104715F76E}
+	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
 EndProject
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index d7cddf4..0fa73f1 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -3,24 +3,25 @@ EXPORTS
     ??0CString@WTF@@QAE@PBD@Z
     ??0CString@WTF@@QAE@PBDI@Z
     ??0Collator@WTF@@QAE@PBD@Z
-    ??0DateInstance@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@N@Z
+    ??0DateInstance@JSC@@QAE@PAVExecState@1@PAVStructure@1@N@Z
     ??0DefaultGCActivityCallback@JSC@@QAE@PAVHeap@1@@Z
     ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
-    ??0DynamicGlobalObjectScope@JSC@@QAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@@Z
-    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
-    ??0JSArray@JSC@@QAE@AAVJSGlobalData@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVArgList@1@@Z  
-    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
-    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@@Z
-    ??0JSFunction@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I_J0@Z@Z
+    ??0DynamicGlobalObjectScope@JSC@@QAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@@Z  
+    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@PAVJSGlobalObject@1@PAVStructure@1@ABVIdentifier@1@@Z
+    ??0JSArray@JSC@@QAE@AAVJSGlobalData@1@PAVStructure@1@@Z
+    ??0JSArray@JSC@@QAE@AAVJSGlobalData@1@PAVStructure@1@ABVArgList@1@@Z
+    ??0JSByteArray@JSC@@QAE@PAVExecState@1@PAVStructure@1@PAVByteArray@WTF@@@Z
+    ??0JSFunction@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@PAVStructure@1@HABVIdentifier@1@P6I_J0@Z@Z
     ??0JSLock@JSC@@QAE@PAVExecState@1@@Z
-    ??0JSObjectWithGlobalObject@JSC@@IAE@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
+    ??0JSObjectWithGlobalObject@JSC@@IAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@PAVStructure@1@@Z
+    ??0JSObjectWithGlobalObject@JSC@@IAE@PAVJSGlobalObject@1@PAVStructure@1@@Z
     ??0MD5@WTF@@QAE@XZ
     ??0Mutex@WTF@@QAE@XZ
     ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z
-    ??0RegExpObject@JSC@@QAE@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@V?$NonNullPassRefPtr@VRegExp@JSC@@@4@@Z
+    ??0RegExpObject@JSC@@QAE@PAVJSGlobalObject@1@PAVStructure@1@V?$NonNullPassRefPtr@VRegExp@JSC@@@WTF@@@Z
     ??0SHA1@WTF@@QAE@XZ
-    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
-    ??0Structure@JSC@@AAE@VJSValue@1@ABVTypeInfo@1@IPBUClassInfo@1@@Z
+    ??0StringObject@JSC@@QAE@PAVExecState@1@PAVStructure@1@ABVUString@1@@Z
+    ??0Structure@JSC@@AAE@AAVJSGlobalData@1@VJSValue@1@ABVTypeInfo@1@IPBUClassInfo@1@@Z
     ??0ThreadCondition@WTF@@QAE@XZ
     ??0UString@JSC@@QAE@PBD@Z
     ??0UString@JSC@@QAE@PBDI@Z
@@ -37,9 +38,9 @@ EXPORTS
     ??1RefCountedLeakCounter@WTF@@QAE@XZ
     ??1RegExp@JSC@@QAE@XZ
     ??1SourceProviderCache@JSC@@QAE@XZ
-    ??1Structure@JSC@@QAE@XZ
     ??1ThreadCondition@WTF@@QAE@XZ
     ??1WTFThreadData@WTF@@QAE@XZ
+    ??1WeakHandleOwner@JSC@@UAE@XZ
     ??2JSGlobalObject@JSC@@SAPAXIPAVJSGlobalData@1@@Z
     ??8JSC@@YA_NABVUString@0@0@Z
     ??8WTF@@YA_NABVCString@0@0@Z
@@ -51,9 +52,9 @@ EXPORTS
     ?addBytes@MD5@WTF@@QAEXPBEI@Z
     ?addBytes@SHA1@WTF@@QAEXPBEI@Z
     ?addCurrentThread@MachineThreads@JSC@@QAEXXZ
-    ?addPropertyTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
-    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
-    ?addPropertyWithoutTransition@Structure@JSC@@QAEIABVIdentifier@2@IPAVJSCell@2@@Z
+    ?addPropertyTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
+    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SAPAV12@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
+    ?addPropertyWithoutTransition@Structure@JSC@@QAEIAAVJSGlobalData@2@ABVIdentifier@2@IPAVJSCell@2@@Z
     ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@VStringImpl@WTF@@@WTF@@PAVExecState@2@PAVStringImpl@4@@Z
     ?allocate@Heap@JSC@@QAEPAXI@Z
     ?allocateFromSizeClass@MarkedSpace@JSC@@AAEPAXAAUSizeClass@12@@Z
@@ -69,8 +70,7 @@ EXPORTS
     ?byteCompile@Yarr@JSC@@YA?AV?$PassOwnPtr@UBytecodePattern@Yarr@JSC@@@WTF@@AAUYarrPattern@12@PAVBumpPointerAllocator@4@@Z
     ?byteSize@SourceProviderCache@JSC@@QBEIXZ
     ?calculateDSTOffset@WTF@@YANNN@Z
-    ?calculateStringHashAndLengthFromUTF8@Unicode@WTF@@YAIPBDAAI1@Z
-    ?calculateStringHashFromUTF8@Unicode@WTF@@YAIPBD0AAI@Z
+    ?calculateStringHashAndLengthFromUTF8@Unicode@WTF@@YAIPBD0AAI1@Z
     ?calculateUTCOffset@WTF@@YAHXZ
     ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
     ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
@@ -78,13 +78,14 @@ EXPORTS
     ?callOnMainThreadAndWait@WTF@@YAXP6AXPAX@Z0@Z
     ?cancelCallOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
     ?capacity@Heap@JSC@@QBEIXZ
-    ?changePrototypeTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@VJSValue@2@@Z
+    ?changePrototypeTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@VJSValue@2@@Z
     ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVExecState@2@@Z
     ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@@Z
     ?checkSyntax@JSC@@YA?AVCompletion@1@PAVExecState@1@ABVSourceCode@1@@Z
     ?checksum@MD5@WTF@@QAEXAAV?$Vector@E$0BA@@2@@Z
     ?className@JSObject@JSC@@UBE?AVUString@2@XZ
     ?clear@SourceProviderCache@JSC@@QAEXXZ
+    ?clearBuiltinStructures@JSGlobalData@JSC@@QAEXXZ
     ?collate@Collator@WTF@@QBE?AW4Result@12@PB_WI0I@Z
     ?collectAllGarbage@Heap@JSC@@QAEXXZ
     ?computeHash@SHA1@WTF@@QAEXAAV?$Vector@E$0BE@@2@@Z
@@ -108,7 +109,7 @@ EXPORTS
     ?createReferenceError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createSingleCharacterString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@E@Z
     ?createStackOverflowError@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@AAVJSGlobalData@2@VJSValue@2@PBUClassInfo@2@@Z
+    ?createStructure@JSByteArray@JSC@@SAPAVStructure@2@AAVJSGlobalData@2@VJSValue@2@PBUClassInfo@2@@Z
     ?createSyntaxError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
@@ -143,8 +144,8 @@ EXPORTS
     ?deleteProperty@JSVariableObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
     ?deleteProperty@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
     ?deleteTable@HashTable@JSC@@QBEXXZ
-    ?despecifyDictionaryFunction@Structure@JSC@@QAEXABVIdentifier@2@@Z
-    ?despecifyFunctionTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@@Z
+    ?despecifyDictionaryFunction@Structure@JSC@@QAEXAAVJSGlobalData@2@ABVIdentifier@2@@Z
+    ?despecifyFunctionTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@ABVIdentifier@2@@Z
     ?destroy@Heap@JSC@@QAEXXZ
     ?detach@Debugger@JSC@@UAEXPAVJSGlobalObject@2@@Z
     ?detachThread@WTF@@YAXI@Z
@@ -166,12 +167,14 @@ EXPORTS
     ?fastStrDup@WTF@@YAPADPBD@Z
     ?fastZeroedMalloc@WTF@@YAPAXI@Z
     ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAV?$WriteBarrierBase@W4Unknown@JSC@@@2@@Z
+    ?finalize@WeakHandleOwner@JSC@@UAEXV?$Handle@W4Unknown@JSC@@@2@PAX@Z
     ?focus@Profile@JSC@@QAEXPBVProfileNode@2@@Z
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@H@Z
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@I@Z
     ?functionGetter@PropertySlot@JSC@@ABE?AVJSValue@2@PAVExecState@2@@Z
     ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
-    ?get@Structure@JSC@@QAEIPAVStringImpl@WTF@@AAIAAPAVJSCell@2@@Z
+    ?get@Structure@JSC@@QAEIAAVJSGlobalData@2@ABVIdentifier@2@AAIAAPAVJSCell@2@@Z
+    ?get@Structure@JSC@@QAEIAAVJSGlobalData@2@PAVStringImpl@WTF@@AAIAAPAVJSCell@2@@Z
     ?getCallData@JSCell@JSC@@UAE?AW4CallType@2@AATCallData@2@@Z
     ?getConstructData@JSCell@JSC@@UAE?AW4ConstructType@2@AATConstructData@2@@Z
     ?getJSNumber@JSCell@JSC@@UAE?AVJSValue@2@XZ
@@ -222,9 +225,9 @@ EXPORTS
     ?isGetterSetter@JSCell@JSC@@UBE_NXZ
     ?isHostFunctionNonInline@JSFunction@JSC@@ABE_NXZ
     ?isMainThread@WTF@@YA_NXZ
+    ?isReachableFromOpaqueRoots@WeakHandleOwner@JSC@@UAE_NV?$Handle@W4Unknown@JSC@@@2@PAXAAVMarkStack@2@@Z
     ?isValidCallee@JSValue@JSC@@QAE_NXZ
     ?isVariableObject@JSVariableObject@JSC@@UBE_NXZ
-    ?jsNumberCell@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
     ?jsOwnedString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
     ?jsString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
     ?length@CString@WTF@@QBEIXZ
@@ -238,7 +241,7 @@ EXPORTS
     ?markChildren@JSObject@JSC@@UAEXAAVMarkStack@2@@Z
     ?markChildren@JSWrapperObject@JSC@@EAEXAAVMarkStack@2@@Z
     ?markChildren@ScopeChainNode@JSC@@UAEXAAVMarkStack@2@@Z
-    ?materializePropertyMap@Structure@JSC@@AAEXXZ
+    ?materializePropertyMap@Structure@JSC@@AAEXAAVJSGlobalData@2@@Z
     ?monthFromDayInYear@WTF@@YAHH_N@Z
     ?msToYear@WTF@@YAHN@Z
     ?name@InternalFunction@JSC@@QAEABVUString@2@PAVExecState@2@@Z
@@ -266,6 +269,7 @@ EXPORTS
     ?put@StringObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
     ?putDirectFunction@JSObject@JSC@@QAEXPAVExecState@2@PAVInternalFunction@2@I@Z
     ?putDirectFunction@JSObject@JSC@@QAEXPAVExecState@2@PAVJSFunction@2@I@Z
+    ?putDirectInternal@JSObject@JSC@@AAE_NAAVJSGlobalData@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@PAVJSCell@2@@Z
     ?putWithAttributes@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
     ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
     ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@@Z
@@ -277,11 +281,11 @@ EXPORTS
     ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
     ?regExpFlags@JSC@@YA?AW4RegExpFlags@1@ABVUString@1@@Z
     ?reifyString@StringBuilder@WTF@@AAEXXZ
-    ?reserveCapacity@StringBuilder@WTF@@QAEXI@Z
     ?releaseDecommitted@OSAllocator@WTF@@SAXPAXI@Z
     ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
     ?reportExtraMemoryCostSlowCase@Heap@JSC@@AAEXI@Z
     ?reserveAndCommit@OSAllocator@WTF@@SAPAXIW4Usage@12@_N1@Z
+    ?reserveCapacity@StringBuilder@WTF@@QAEXI@Z
     ?reset@ParserArena@JSC@@QAEXXZ
     ?reset@TimeoutChecker@JSC@@QAEXXZ
     ?resetDateCache@JSGlobalData@JSC@@QAEXXZ
@@ -300,6 +304,7 @@ EXPORTS
     ?setLoc@StatementNode@JSC@@QAEXHH@Z
     ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z
     ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
+    ?setPrototype@JSObject@JSC@@QAEXAAVJSGlobalData@2@VJSValue@2@@Z
     ?setSetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
     ?setUndefined@PropertyDescriptor@JSC@@QAEXXZ
     ?setUpStaticFunctionSlot@JSC@@YAXPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@ABVIdentifier@1@AAVPropertySlot@1@@Z
@@ -309,10 +314,8 @@ EXPORTS
     ?signal@ThreadCondition@WTF@@QAEXXZ
     ?size@Heap@JSC@@QBEIXZ
     ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
-    ?startIgnoringLeaks@Structure@JSC@@SAXXZ
     ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
     ?startSampling@JSGlobalData@JSC@@QAEXXZ
-    ?stopIgnoringLeaks@Structure@JSC@@SAXXZ
     ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
     ?stopSampling@JSGlobalData@JSC@@QAEXXZ
     ?strtod@WTF@@YANPBDPAPAD@Z
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 30b014a..4d5da54 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -602,14 +602,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\ConservativeSet.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ConservativeSet.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\ConstructData.cpp"
 				>
 			</File>
@@ -742,14 +734,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\Heap.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Heap.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\Identifier.cpp"
 				>
 			</File>
@@ -838,14 +822,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\JSImmediate.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSImmediate.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\JSLock.cpp"
 				>
 			</File>
@@ -862,14 +838,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\JSNumberCell.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSNumberCell.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\JSObject.cpp"
 				>
 			</File>
@@ -934,6 +902,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\runtime\JSValueInlineMethods.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\runtime\JSVariableObject.cpp"
 				>
 			</File>
@@ -974,42 +946,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\MachineStackMarker.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MachineStackMarker.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkedBlock.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkedBlock.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkedSpace.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkedSpace.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkStack.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkStack.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkStackWin.cpp"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\MathObject.cpp"
 				>
 			</File>
@@ -1298,10 +1234,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\WeakGCPtr.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\WeakRandom.h"
 				>
 			</File>
@@ -1939,44 +1871,96 @@
 			</File>
 		</Filter>
 		<Filter
-			Name="collector"
+			Name="heap"
 			>
-			<Filter
-				Name="handles"
-				>
-				<File
-					RelativePath="..\..\collector\handles\Global.h"
-					>
-				</File>
-				<File
-					RelativePath="..\..\collector\handles\Handle.h"
-					>
-				</File>
-				<File
-					RelativePath="..\..\collector\handles\HandleHeap.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\..\collector\handles\HandleHeap.h"
-					>
-				</File>
-				<File
-					RelativePath="..\..\collector\handles\HandleStack.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\..\collector\handles\HandleStack.h"
-					>
-				</File>
-				<File
-					RelativePath="..\..\collector\handles\Local.h"
-					>
-				</File>
-				<File
-					RelativePath="..\..\collector\handles\LocalScope.h"
-					>
-				</File>
-			</Filter>
+                            <File
+                                    RelativePath="..\..\heap\ConservativeRoots.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\ConservativeRoots.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MachineStackMarker.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MachineStackMarker.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkedBlock.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkedBlock.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkedSpace.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkedSpace.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkStack.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkStack.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkStackWin.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Heap.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Heap.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Strong.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Handle.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\HandleHeap.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\HandleHeap.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\HandleStack.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\HandleStack.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Local.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\LocalScope.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Weak.h"
+                                    >
+                            </File>
 		</Filter>
 		<File
 			RelativePath="..\..\config.h"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index cb7362d..204ec63 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../collector/handles/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
 		PreprocessorDefinitions="__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 	/>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
index ba95c46..9a59841 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
@@ -1,62 +1,15 @@
 all:
     touch "%ConfigurationBuildDir%\buildfailed"
     bash build-generated-files.sh "%ConfigurationBuildDir%" "$(WEBKITLIBRARIESDIR)"
-!IF "$(PRODUCTION)"!="1"
+!IF "$(OFFICIAL_BUILD)"!="1"
     bash -c "python react-to-vsprops-changes.py"
 !ENDIF
-    -mkdir 2>NUL "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\APICast.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\APIShims.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JavaScript.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSBase.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSContextRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSContextRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSObjectRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSObjectRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRefCF.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRefBSTR.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSValueRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JavaScriptCore.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSRetainPtr.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSWeakObjectMapRefInternal.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSWeakObjectMapRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSRetainPtr.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\OpaqueJSString.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\WebKitAvailability.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    
-    -mkdir 2>NUL "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    copy-files.cmd
 
-    xcopy /y /d "..\..\wtf\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\unicode\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\unicode\icu\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\parser\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\runtime\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\bytecode\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\interpreter\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\assembler\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\jit\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\collector\handles\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\debugger\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\profiler\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\create_hash_table" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\AtomicString.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\StringBuilder.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\StringImpl.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\WTFString.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\yarr\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-
-
-    -mkdir 2>NUL "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
-    xcopy /y /d "..\JavaScriptCore.resources\*" "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
-    
     -del "%ConfigurationBuildDir%\include\private\JavaScriptCore\stdbool.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore\stdint.h"
     -del "%ConfigurationBuildDir%\buildfailed"
 
 clean:
     -del "%ConfigurationBuildDir%\buildfailed"
-    -del /s /q "%ConfigurationBuildDir%\include\JavaScriptCore\JavaScriptCore"
+    copy-files.cmd clean
     -del /s /q "%ConfigurationBuildDir%\obj\JavaScriptCore\DerivedSources"
-    -del /s /q "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    -del /s /q "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
index ebff713..59d1183 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebug.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -27,7 +27,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebugAll.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -36,7 +36,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedRelease.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -45,7 +45,7 @@
 		<Configuration
 			Name="Production|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedProduction.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -54,7 +54,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -63,7 +63,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebugCairoCFLite.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -72,7 +72,7 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleasePGO.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -87,6 +87,10 @@
 			>
 		</File>
 		<File
+			RelativePath=".\copy-files.cmd"
+			>
+		</File>
+		<File
 			RelativePath="..\..\DerivedSources.make"
 			>
 		</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
index 248eb59..1b718df 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
@@ -4,12 +4,11 @@
 	Version="8.00"
 	Name="JavaScriptCoreGeneratedCommon"
 	OutputDirectory="$(ConfigurationBuildDir)\lib"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops"
 	>
 	<Tool
 		Name="VCNMakeTool"
-		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make"
-		ReBuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean&#x0D;&#x0A;nmake -f JavaScriptCoreGenerated.make"
-		CleanCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean"
+		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make"
+		ReBuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean&#x0D;&#x0A;nmake -f JavaScriptCoreGenerated.make"
+		CleanCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean"
 	/>
 </VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops
new file mode 100644
index 0000000..d8e1748
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops
new file mode 100644
index 0000000..3347b74
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..9620384
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops
new file mode 100644
index 0000000..a02f833
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops
new file mode 100644
index 0000000..833b674
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..3fdc37a
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops
new file mode 100644
index 0000000..096e42e
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
index 1d8e82d..77781cc 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\JavaScriptCoreCommon.vsprops;
       .\JavaScriptCoreCF.vsprops"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
index e4612c3..5f31896 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\JavaScriptCoreCommon.vsprops;
       .\JavaScriptCoreCF.vsprops"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
index 64699b5..1fc6aab 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\JavaScriptCoreCommon.vsprops;
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
index ada0b8e..2fd658a 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\JavaScriptCoreCommon.vsprops;
       .\JavaScriptCoreCF.vsprops"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
index 3e207e7..907c9e5 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\JavaScriptCoreCommon.vsprops;
       .\JavaScriptCoreCF.vsprops;
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
new file mode 100755
index 0000000..e4075a4
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
@@ -0,0 +1,79 @@
+@echo off
+
+set PublicHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\JavaScriptCore
+set PrivateHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\private\JavaScriptCore
+set ResourcesDirectory=%CONFIGURATIONBUILDDIR%\bin\JavaScriptCore.resources
+
+if "%1" EQU "clean" goto :clean
+if "%1" EQU "rebuild" call :clean
+
+echo Copying public headers...
+mkdir "%PublicHeadersDirectory%" 2>NUL
+for %%f in (
+    APICast.h
+    APIShims.h
+    JSBase.h
+    JSContextRef.h
+    JSContextRefPrivate.h
+    JSObjectRef.h
+    JSObjectRefPrivate.h
+    JSRetainPtr.h
+    JSRetainPtr.h
+    JSStringRef.h
+    JSStringRefBSTR.h
+    JSStringRefCF.h
+    JSValueRef.h
+    JSWeakObjectMapRefInternal.h
+    JSWeakObjectMapRefPrivate.h
+    JavaScript.h
+    JavaScriptCore.h
+    OpaqueJSString.h
+    WebKitAvailability.h
+) do (
+    xcopy /y /d ..\..\API\%%f "%PublicHeadersDirectory%" >NUL
+)
+
+echo Copying private headers...
+mkdir "%PrivateHeadersDirectory%" 2>NUL
+for %%d in (
+    assembler
+    bytecode
+    heap
+    debugger
+    interpreter
+    jit
+    parser
+    profiler
+    runtime
+    wtf
+    wtf\text
+    wtf\unicode
+    wtf\unicode\icu
+    yarr
+) do (
+    xcopy /y /d ..\..\%%d\*.h "%PrivateHeadersDirectory%" >NUL
+)
+
+echo Copying resources...
+mkdir "%ResourcesDirectory%" 2>NUL
+xcopy /y /d ..\JavaScriptCore.resources\* "%ResourcesDirectory%" >NUL
+
+echo Copying other files...
+for %%f in (
+    create_hash_table
+    wtf\text\AtomicString.cpp
+    wtf\text\StringBuilder.cpp
+    wtf\text\StringImpl.cpp
+    wtf\text\WTFString.cpp
+) do (
+    xcopy /y /d ..\..\%%f "%PrivateHeadersDirectory%" >NUL
+)
+
+goto :EOF
+
+:clean
+
+echo Deleting copied files...
+if exist "%PublicHeadersDirectory%" rmdir /s /q "%PublicHeadersDirectory%" >NUL
+if exist "%PrivateHeadersDirectory%" rmdir /s /q "%PrivateHeadersDirectory%" >NUL
+if exist "%ResourcesDirectory%" rmdir /s /q "%ResourcesDirectory%" >NUL
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
index aafe511..4552321 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
@@ -21,7 +21,7 @@ def main():
     # Visual Studio isn't smart enough to figure out it needs to rebuild these file types when
     # .vsprops files change (even if we touch wtf/Platform.h below), so we delete them to force them
     # to be rebuilt.
-    for extension in ('manifest', 'pch', 'res'):
+    for extension in ('dep', 'manifest', 'pch', 'res'):
         for filepath in glob.iglob(os.path.join(obj_directory, '*', '*.%s' % extension)):
             delete_if_older_than(filepath, newest_vsprops_time)
 
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index aa337b3..7c83339 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -509,6 +509,10 @@
 			</File>
 		</Filter>
 		<File
+			RelativePath="..\..\wtf\Alignment.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\AlwaysInline.h"
 			>
 		</File>
@@ -605,6 +609,14 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\DynamicAnnotations.cpp"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\DynamicAnnotations.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\dtoa.cpp"
 			>
 		</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops
index 3de342c..842f6ea 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WTFCommon.vsprops"
 	>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops
index 3960f98..2050eec 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WTFCommon.vsprops"
 	>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops
index 3267d79..fc795a3 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\WTFCommon.vsprops"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops
index ac4f8a5..bc2aba9 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WTFCommon.vsprops"
 	>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
index 604a66e..ac8a8fa 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../collector/handles/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../heap/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"
 		PreprocessorDefinitions="__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 		ForcedUsingFiles=""
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
index 408871b..26e9623 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="jscProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\jscCommon.vsprops"
 	>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
index ba9b288..493dd58 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="jscRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\jscCommon.vsprops"
 	>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
index 2104fe4..e4dd761 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="jscReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\jscCommon.vsprops"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
index 78f3672..c610302 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
@@ -5,7 +5,7 @@
 	Name="jscReleasePGO"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\jscCommon.vsprops"
 	>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
index 03fceab..c79ee0c 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="testapiProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\testapiCommon.vsprops;
       ..\JavaScriptCore\JavaScriptCoreCF.vsprops"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
index 1c041ff..42b1232 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="testapiRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\testapiCommon.vsprops;
       ..\JavaScriptCore\JavaScriptCoreCF.vsprops"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
index c025283..3036bf8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="testapiReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\testapiCommon.vsprops;
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 44e108c..98c90e8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -50,15 +50,10 @@
 		0F29479C126E698C00B3ABF5 /* DecimalNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F29479B126E698C00B3ABF5 /* DecimalNumber.cpp */; };
 		1400067712A6F7830064D123 /* OSAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 1400067612A6F7830064D123 /* OSAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1400069312A6F9E10064D123 /* OSAllocatorPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */; };
-		14035DB110DBFB2A00FFFFE7 /* WeakGCPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */; };
 		140566D1107EC267005DBC8D /* JSStaticScopeObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */; };
 		140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85E0255597D01FF60F7 /* JSFunction.cpp */; };
 		140B7D1D0DC69AF7009C42B8 /* JSActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */; };
-		140CDC7C12DC09BF0013CFC5 /* MarkedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 140CDC7612DBEA330013CFC5 /* MarkedSpace.cpp */; };
-		140CDE7012DE97A00013CFC5 /* Heap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 140CDE6C12DE977E0013CFC5 /* Heap.cpp */; };
-		140CDE7112DE97B10013CFC5 /* Heap.h in Headers */ = {isa = PBXBuildFile; fileRef = 140CDE6D12DE977E0013CFC5 /* Heap.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		140CDF0C12DECE5C0013CFC5 /* MarkedSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = 140CDC7712DBEA330013CFC5 /* MarkedSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		141211310A48794D00480255 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
 		141211340A48795800480255 /* minidom.c in Sources */ = {isa = PBXBuildFile; fileRef = 141211020A48780900480255 /* minidom.c */; };
@@ -74,7 +69,6 @@
 		14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BF0E1706A7002C7E82 /* RegExpPrototype.cpp */; };
 		14280850107EC0D70013E7B2 /* Operations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8770255597D01FF60F7 /* Operations.cpp */; };
 		14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B80E184545000F9297 /* GetterSetter.cpp */; };
-		1428085D107EC0F80013E7B2 /* JSNumberCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B90E184580000F9297 /* JSNumberCell.cpp */; };
 		14280863107EC11A0013E7B2 /* BooleanConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952320E15EB5600A898AB /* BooleanConstructor.cpp */; };
 		14280864107EC11A0013E7B2 /* BooleanObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8500255597D01FF60F7 /* BooleanObject.cpp */; };
 		14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */; };
@@ -90,6 +84,22 @@
 		1429D92F0ED22D7000B89619 /* JIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D92D0ED22D7000B89619 /* JIT.cpp */; };
 		1429D9300ED22D7000B89619 /* JIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 1429D92E0ED22D7000B89619 /* JIT.h */; };
 		142D3939103E4560007DCB52 /* NumericStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D3938103E4560007DCB52 /* NumericStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F0813539A2800B02E86 /* MarkedBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F0613539A2800B02E86 /* MarkedBlock.cpp */; };
+		142D6F0913539A2800B02E86 /* MarkedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D6F0713539A2800B02E86 /* MarkedBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F0C13539A2F00B02E86 /* MarkedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F0A13539A2F00B02E86 /* MarkedSpace.cpp */; };
+		142D6F0D13539A2F00B02E86 /* MarkedSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D6F0B13539A2F00B02E86 /* MarkedSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F1113539A4100B02E86 /* MarkStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F0E13539A4100B02E86 /* MarkStack.cpp */; };
+		142D6F1213539A4100B02E86 /* MarkStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D6F0F13539A4100B02E86 /* MarkStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F1313539A4100B02E86 /* MarkStackPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F1013539A4100B02E86 /* MarkStackPosix.cpp */; };
+		142E3134134FF0A600AFADB5 /* Handle.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312B134FF0A600AFADB5 /* Handle.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3135134FF0A600AFADB5 /* HandleHeap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142E312C134FF0A600AFADB5 /* HandleHeap.cpp */; };
+		142E3136134FF0A600AFADB5 /* HandleHeap.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312D134FF0A600AFADB5 /* HandleHeap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3137134FF0A600AFADB5 /* HandleStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142E312E134FF0A600AFADB5 /* HandleStack.cpp */; };
+		142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312F134FF0A600AFADB5 /* HandleStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3139134FF0A600AFADB5 /* Local.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3130134FF0A600AFADB5 /* Local.h */; };
+		142E313A134FF0A600AFADB5 /* LocalScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3131134FF0A600AFADB5 /* LocalScope.h */; };
+		142E313B134FF0A600AFADB5 /* Strong.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3132134FF0A600AFADB5 /* Strong.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E313C134FF0A600AFADB5 /* Weak.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3133134FF0A600AFADB5 /* Weak.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		143A97E60A4A06E200456B66 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
 		1440057F0A5335640005F061 /* JSNode.c in Sources */ = {isa = PBXBuildFile; fileRef = 1440F6420A4F8B6A0005F061 /* JSNode.c */; };
 		144005CB0A5338D10005F061 /* JSNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 1440F6410A4F8B6A0005F061 /* JSNode.h */; };
@@ -121,9 +131,9 @@
 		14469DEC107EC7E700650446 /* StringObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C20E16EE3300B34460 /* StringObject.cpp */; };
 		14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */; };
 		14469DEE107EC7E700650446 /* UString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8850255597D01FF60F7 /* UString.cpp */; };
-		144836E7132DA7BE005BE785 /* ConservativeSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 149DAAF212EB559D0083B12B /* ConservativeSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		144836E7132DA7BE005BE785 /* ConservativeRoots.h in Headers */ = {isa = PBXBuildFile; fileRef = 149DAAF212EB559D0083B12B /* ConservativeRoots.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */; };
-		146B16D812EB5B59001BEC1B /* ConservativeSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */; };
+		146B16D812EB5B59001BEC1B /* ConservativeRoots.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */; };
 		146FE51211A710430087AE66 /* JITCall32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146FE51111A710430087AE66 /* JITCall32_64.cpp */; };
 		147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */; };
 		147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B84620E6DE6B1004775A4 /* PutPropertySlot.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -148,7 +158,6 @@
 		147F39D0107EC37600427A48 /* JSArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93ADFCE60CCBD7AC00D30B08 /* JSArray.cpp */; };
 		147F39D1107EC37600427A48 /* JSCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */; };
 		147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */; };
-		147F39D3107EC37600427A48 /* JSImmediate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14760863099C633800437128 /* JSImmediate.cpp */; };
 		147F39D4107EC37600427A48 /* JSObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC22A3980E16E14800AF21C8 /* JSObject.cpp */; };
 		147F39D5107EC37600427A48 /* JSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B60E1842FA000F9297 /* JSString.cpp */; };
 		147F39D6107EC37600427A48 /* JSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8870255597D01FF60F7 /* JSValue.cpp */; };
@@ -176,10 +185,11 @@
 		14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */; };
 		14BFCE6910CDB1FC00364CCE /* WeakGCMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14C5242B0F5355E900BA3D04 /* JITStubs.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A6581A0F4E36F4000150FD /* JITStubs.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		14C824AD12F7C785008F35E0 /* MarkedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14C824AC12F7C785008F35E0 /* MarkedBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */; };
 		14F8BA3E107EC886009892DC /* FastMalloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B908E7EECC0023E5F6 /* FastMalloc.cpp */; };
 		14F8BA43107EC88C009892DC /* TCSystemAlloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */; };
+		14FB986D135225410085A5DB /* Heap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14FB986B135225410085A5DB /* Heap.cpp */; };
+		14FB986E135225410085A5DB /* Heap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14FB986C135225410085A5DB /* Heap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14FFF98C12BFFF7500795BB8 /* PageAllocationAligned.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14FFF98A12BFFF7500795BB8 /* PageAllocationAligned.cpp */; };
 		14FFF98D12BFFF7500795BB8 /* PageAllocationAligned.h in Headers */ = {isa = PBXBuildFile; fileRef = 14FFF98B12BFFF7500795BB8 /* PageAllocationAligned.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 180B9AF00F16C569009BDBC5 /* CurrentTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -229,6 +239,7 @@
 		86438FC41265503E00E0DFCA /* StringBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86438FC31265503E00E0DFCA /* StringBuilder.cpp */; };
 		86565742115BE3DA00291F40 /* CString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86565740115BE3DA00291F40 /* CString.cpp */; };
 		86565743115BE3DA00291F40 /* CString.h in Headers */ = {isa = PBXBuildFile; fileRef = 86565741115BE3DA00291F40 /* CString.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		865A30F1135007E100CDB49E /* JSValueInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = 865A30F0135007E100CDB49E /* JSValueInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		865F408810E7D56300947361 /* APIShims.h in Headers */ = {isa = PBXBuildFile; fileRef = 865F408710E7D56300947361 /* APIShims.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86676D5211FED9BC004B6863 /* BumpPointerAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 86676D4D11FED55D004B6863 /* BumpPointerAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */; };
@@ -358,6 +369,7 @@
 		A1712B3B11C7B212007A5315 /* RegExpCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1712B3A11C7B212007A5315 /* RegExpCache.cpp */; };
 		A1712B3F11C7B228007A5315 /* RegExpCache.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B3E11C7B228007A5315 /* RegExpCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A1712B4111C7B235007A5315 /* RegExpKey.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B4011C7B235007A5315 /* RegExpKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A1D764521354448B00C5C7C0 /* Alignment.h in Headers */ = {isa = PBXBuildFile; fileRef = A1D764511354448B00C5C7C0 /* Alignment.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A71236E51195F33C00BD2174 /* JITOpcodes32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */; };
 		A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A72700780DAC605600E548D7 /* JSNotAnObject.cpp */; };
 		A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; };
@@ -372,16 +384,10 @@
 		A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */; };
 		A7482E93116A7CAD003B0712 /* JSWeakObjectMapRefInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482E37116A697B003B0712 /* JSWeakObjectMapRefInternal.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A74B3499102A5F8E0032AB98 /* MarkStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A74B3498102A5F8E0032AB98 /* MarkStack.cpp */; };
 		A74DE1D0120B875600D40D5B /* ARMv7Assembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A74DE1CB120B86D600D40D5B /* ARMv7Assembler.cpp */; };
 		A75706DE118A2BCF0057F88F /* JITArithmetic32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */; };
 		A766B44F0EE8DCD1009518CA /* ExecutableAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A76BE39F132EEA7C008F7F0B /* HandleStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A76BE1B7132DAC68008F7F0B /* HandleStack.cpp */; };
-		A76BE3A0132EEA7C008F7F0B /* HandleStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A76BE1B8132DAC68008F7F0B /* HandleStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A76BE3A1132EEA7C008F7F0B /* Local.h in Headers */ = {isa = PBXBuildFile; fileRef = A76BE1B5132DABF5008F7F0B /* Local.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A76BE3A2132EEA7C008F7F0B /* LocalScope.h in Headers */ = {isa = PBXBuildFile; fileRef = A76BE1B6132DAC24008F7F0B /* LocalScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = A76C51741182748D00715B05 /* JSInterfaceJIT.h */; };
-		A7795590101A74D500114E55 /* MarkStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A779558F101A74D500114E55 /* MarkStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A783A0D111A36DCA00563D20 /* JSObjectWithGlobalObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A783A0D011A36DCA00563D20 /* JSObjectWithGlobalObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A783A2AB11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A783A2AA11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp */; };
 		A784A26111D16622005776AC /* ASTBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */; };
@@ -392,21 +398,15 @@
 		A791EF290F11E07900AE1F68 /* JSByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A791EF270F11E07900AE1F68 /* JSByteArray.cpp */; };
 		A7A1F7AC0F252B3C00E184E2 /* ByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7A1F7AA0F252B3C00E184E2 /* ByteArray.cpp */; };
 		A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7AC25BD1304D146003396DE /* MarkedBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */; };
 		A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
 		A7C1E8E4112E72EF00A37F98 /* JITPropertyAccess32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */; };
 		A7C40C0A130B057D00D002A1 /* BlockStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C07130B057D00D002A1 /* BlockStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7C40C0B130B057D00D002A1 /* SentinelLinkedList.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C08130B057D00D002A1 /* SentinelLinkedList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7C40C0C130B057D00D002A1 /* SinglyLinkedList.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C09130B057D00D002A1 /* SinglyLinkedList.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */; };
 		A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D649A91015224E009B2E1B /* PossiblyNull.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DCB77912E3D90500911940 /* WriteBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
 		A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */; };
-		A7E4FC8F12F8E4CA00AF4CF4 /* Global.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E4FC8712F8E4CA00AF4CF4 /* Global.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7E4FC9012F8E4CA00AF4CF4 /* Handle.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E4FC8812F8E4CA00AF4CF4 /* Handle.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7E4FC9112F8E4CA00AF4CF4 /* HandleHeap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E4FC8912F8E4CA00AF4CF4 /* HandleHeap.cpp */; };
-		A7E4FC9212F8E4CA00AF4CF4 /* HandleHeap.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E4FC8A12F8E4CA00AF4CF4 /* HandleHeap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7F19ECE11DD490900931E70 /* FixedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F19ECD11DD490900931E70 /* FixedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7F9935F0FD7325100A0B2D0 /* JSONObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F9935D0FD7325100A0B2D0 /* JSONObject.h */; };
 		A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */; };
@@ -471,7 +471,6 @@
 		BC18C41F0E16F5CD00B34460 /* JSFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A85F0255597D01FF60F7 /* JSFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4200E16F5CD00B34460 /* JSGlobalData.h in Headers */ = {isa = PBXBuildFile; fileRef = E18E3A560DF9278C00D90B34 /* JSGlobalData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A8E894330CD0603F00367179 /* JSGlobalObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4220E16F5CD00B34460 /* JSImmediate.h in Headers */ = {isa = PBXBuildFile; fileRef = 1483B589099BC1950016E4F0 /* JSImmediate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4230E16F5CD00B34460 /* JSLock.h in Headers */ = {isa = PBXBuildFile; fileRef = 65EA4C9A092AF9E20093D800 /* JSLock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */ = {isa = PBXBuildFile; fileRef = BC22A3990E16E14800AF21C8 /* JSObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 1482B7E10A43076000517CFC /* JSObjectRef.h */; settings = {ATTRIBUTES = (Public, ); }; };
@@ -559,7 +558,6 @@
 		BC5F7BC011823B590052C02C /* ThreadSafeRefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
-		BC7F8FB90E19D1C3008632C0 /* JSNumberCell.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
 		BC9041480EB9250900FE26FA /* StructureTransitionTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9041470EB9250900FE26FA /* StructureTransitionTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC95437D0EBA70FD0072B6D3 /* PropertyMapHashTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -579,6 +577,7 @@
 		BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFD8C900EEB2EE700283848 /* JumpTable.cpp */; };
 		BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFD8C910EEB2EE700283848 /* JumpTable.h */; };
 		C0A272630E50A06300E96E15 /* NotFound.h in Headers */ = {isa = PBXBuildFile; fileRef = C0A2723F0E509F1E00E96E15 /* NotFound.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		D7A46A4F1338FFEA00ED695C /* DynamicAnnotations.h in Headers */ = {isa = PBXBuildFile; fileRef = D75AF59612F8CB9500FC0ADF /* DynamicAnnotations.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DD377CBC12072C18006A2517 /* Bitmap.h in Headers */ = {isa = PBXBuildFile; fileRef = DD377CBB12072C18006A2517 /* Bitmap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DDF7ABD411F60ED200108E36 /* GCActivityCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = DDF7ABD211F60ED200108E36 /* GCActivityCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DDF7ABD511F60ED200108E36 /* GCActivityCallbackCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DDF7ABD311F60ED200108E36 /* GCActivityCallbackCF.cpp */; };
@@ -704,11 +703,6 @@
 		0F29479B126E698C00B3ABF5 /* DecimalNumber.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DecimalNumber.cpp; sourceTree = "<group>"; };
 		1400067612A6F7830064D123 /* OSAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OSAllocator.h; sourceTree = "<group>"; };
 		1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OSAllocatorPosix.cpp; sourceTree = "<group>"; };
-		14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCPtr.h; sourceTree = "<group>"; };
-		140CDC7612DBEA330013CFC5 /* MarkedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedSpace.cpp; sourceTree = "<group>"; };
-		140CDC7712DBEA330013CFC5 /* MarkedSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedSpace.h; sourceTree = "<group>"; };
-		140CDE6C12DE977E0013CFC5 /* Heap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Heap.cpp; sourceTree = "<group>"; };
-		140CDE6D12DE977E0013CFC5 /* Heap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Heap.h; sourceTree = "<group>"; };
 		140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBasePrivate.h; sourceTree = "<group>"; };
 		141211020A48780900480255 /* minidom.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = minidom.c; path = tests/minidom.c; sourceTree = "<group>"; };
 		1412110D0A48788700480255 /* minidom.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = minidom.js; path = tests/minidom.js; sourceTree = "<group>"; };
@@ -728,6 +722,22 @@
 		1429D92D0ED22D7000B89619 /* JIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JIT.cpp; sourceTree = "<group>"; };
 		1429D92E0ED22D7000B89619 /* JIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JIT.h; sourceTree = "<group>"; };
 		142D3938103E4560007DCB52 /* NumericStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumericStrings.h; sourceTree = "<group>"; };
+		142D6F0613539A2800B02E86 /* MarkedBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedBlock.cpp; sourceTree = "<group>"; };
+		142D6F0713539A2800B02E86 /* MarkedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedBlock.h; sourceTree = "<group>"; };
+		142D6F0A13539A2F00B02E86 /* MarkedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedSpace.cpp; sourceTree = "<group>"; };
+		142D6F0B13539A2F00B02E86 /* MarkedSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedSpace.h; sourceTree = "<group>"; };
+		142D6F0E13539A4100B02E86 /* MarkStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStack.cpp; sourceTree = "<group>"; };
+		142D6F0F13539A4100B02E86 /* MarkStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkStack.h; sourceTree = "<group>"; };
+		142D6F1013539A4100B02E86 /* MarkStackPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStackPosix.cpp; sourceTree = "<group>"; };
+		142E312B134FF0A600AFADB5 /* Handle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Handle.h; sourceTree = "<group>"; };
+		142E312C134FF0A600AFADB5 /* HandleHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HandleHeap.cpp; sourceTree = "<group>"; };
+		142E312D134FF0A600AFADB5 /* HandleHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleHeap.h; sourceTree = "<group>"; };
+		142E312E134FF0A600AFADB5 /* HandleStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HandleStack.cpp; sourceTree = "<group>"; };
+		142E312F134FF0A600AFADB5 /* HandleStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleStack.h; sourceTree = "<group>"; };
+		142E3130134FF0A600AFADB5 /* Local.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Local.h; sourceTree = "<group>"; };
+		142E3131134FF0A600AFADB5 /* LocalScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalScope.h; sourceTree = "<group>"; };
+		142E3132134FF0A600AFADB5 /* Strong.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Strong.h; sourceTree = "<group>"; };
+		142E3133134FF0A600AFADB5 /* Weak.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Weak.h; sourceTree = "<group>"; };
 		1440051F0A531D3B0005F061 /* Node.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Node.h; path = tests/Node.h; sourceTree = "<group>"; };
 		144005200A531D3B0005F061 /* Node.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = Node.c; path = tests/Node.c; sourceTree = "<group>"; };
 		144007480A536CC20005F061 /* NodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NodeList.h; path = tests/NodeList.h; sourceTree = "<group>"; };
@@ -746,9 +756,8 @@
 		145C507F0D9DF63B0088F6B9 /* CallData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallData.h; sourceTree = "<group>"; };
 		146AAB2A0B66A84900E55F16 /* JSStringRefCF.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSStringRefCF.h; sourceTree = "<group>"; };
 		146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringRefCF.cpp; sourceTree = "<group>"; };
-		146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConservativeSet.cpp; sourceTree = "<group>"; };
+		146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConservativeRoots.cpp; sourceTree = "<group>"; };
 		146FE51111A710430087AE66 /* JITCall32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITCall32_64.cpp; sourceTree = "<group>"; };
-		14760863099C633800437128 /* JSImmediate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSImmediate.cpp; sourceTree = "<group>"; };
 		147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BatchedTransitionOptimizer.h; sourceTree = "<group>"; };
 		147B84620E6DE6B1004775A4 /* PutPropertySlot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutPropertySlot.h; sourceTree = "<group>"; };
 		1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerCallFrame.h; sourceTree = "<group>"; };
@@ -764,7 +773,7 @@
 		148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextRefPrivate.h; sourceTree = "<group>"; };
 		149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerCallFrame.cpp; sourceTree = "<group>"; };
 		149B24FF0D8AF6D1009CB8C7 /* Register.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Register.h; sourceTree = "<group>"; };
-		149DAAF212EB559D0083B12B /* ConservativeSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConservativeSet.h; sourceTree = "<group>"; };
+		149DAAF212EB559D0083B12B /* ConservativeRoots.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConservativeRoots.h; sourceTree = "<group>"; };
 		14A1563010966365006FA260 /* DateInstanceCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateInstanceCache.h; sourceTree = "<group>"; };
 		14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITStubs.cpp; sourceTree = "<group>"; };
 		14A396A60CD2933100B5B4FF /* SymbolTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolTable.h; sourceTree = "<group>"; };
@@ -786,14 +795,14 @@
 		14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSValueRef.cpp; sourceTree = "<group>"; };
 		14BD5A2D0A3E91F600BAF59C /* testapi.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = testapi.c; path = API/tests/testapi.c; sourceTree = "<group>"; };
 		14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCMap.h; sourceTree = "<group>"; };
-		14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedBlock.cpp; sourceTree = "<group>"; };
-		14C824AC12F7C785008F35E0 /* MarkedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedBlock.h; sourceTree = "<group>"; };
 		14D792640DAA03FB001A9F05 /* RegisterFile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterFile.h; sourceTree = "<group>"; };
 		14D857740A4696C80032146C /* testapi.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = testapi.js; path = API/tests/testapi.js; sourceTree = "<group>"; };
 		14DA818E0D99FD2000B0A4FB /* JSActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSActivation.h; sourceTree = "<group>"; };
 		14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSActivation.cpp; sourceTree = "<group>"; };
 		14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObject.cpp; sourceTree = "<group>"; };
 		14F252560D08DD8D004ECFFF /* JSVariableObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSVariableObject.h; sourceTree = "<group>"; };
+		14FB986B135225410085A5DB /* Heap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Heap.cpp; sourceTree = "<group>"; };
+		14FB986C135225410085A5DB /* Heap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Heap.h; sourceTree = "<group>"; };
 		14FFF98A12BFFF7500795BB8 /* PageAllocationAligned.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageAllocationAligned.cpp; sourceTree = "<group>"; };
 		14FFF98B12BFFF7500795BB8 /* PageAllocationAligned.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageAllocationAligned.h; sourceTree = "<group>"; };
 		180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CurrentTime.cpp; sourceTree = "<group>"; };
@@ -893,6 +902,7 @@
 		86438FC31265503E00E0DFCA /* StringBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StringBuilder.cpp; path = text/StringBuilder.cpp; sourceTree = "<group>"; };
 		86565740115BE3DA00291F40 /* CString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CString.cpp; path = text/CString.cpp; sourceTree = "<group>"; };
 		86565741115BE3DA00291F40 /* CString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CString.h; path = text/CString.h; sourceTree = "<group>"; };
+		865A30F0135007E100CDB49E /* JSValueInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSValueInlineMethods.h; sourceTree = "<group>"; };
 		865F408710E7D56300947361 /* APIShims.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APIShims.h; sourceTree = "<group>"; };
 		86676D4D11FED55D004B6863 /* BumpPointerAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BumpPointerAllocator.h; sourceTree = "<group>"; };
 		86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrSyntaxChecker.cpp; path = yarr/YarrSyntaxChecker.cpp; sourceTree = "<group>"; };
@@ -1056,6 +1066,7 @@
 		A1712B3A11C7B212007A5315 /* RegExpCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpCache.cpp; sourceTree = "<group>"; };
 		A1712B3E11C7B228007A5315 /* RegExpCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpCache.h; sourceTree = "<group>"; };
 		A1712B4011C7B235007A5315 /* RegExpKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpKey.h; sourceTree = "<group>"; };
+		A1D764511354448B00C5C7C0 /* Alignment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Alignment.h; sourceTree = "<group>"; };
 		A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITOpcodes32_64.cpp; sourceTree = "<group>"; };
 		A718F61A11754A21002465A7 /* RegExpJitTables.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpJitTables.h; sourceTree = "<group>"; };
 		A718F8211178EB4B002465A7 /* create_regex_tables */ = {isa = PBXFileReference; explicitFileType = text.script.python; fileEncoding = 4; path = create_regex_tables; sourceTree = "<group>"; };
@@ -1072,15 +1083,9 @@
 		A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefPrivate.h; sourceTree = "<group>"; };
 		A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakObjectMapRefPrivate.cpp; sourceTree = "<group>"; };
 		A7482E37116A697B003B0712 /* JSWeakObjectMapRefInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefInternal.h; sourceTree = "<group>"; };
-		A74B3498102A5F8E0032AB98 /* MarkStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStack.cpp; sourceTree = "<group>"; };
 		A74DE1CB120B86D600D40D5B /* ARMv7Assembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ARMv7Assembler.cpp; sourceTree = "<group>"; };
 		A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic32_64.cpp; sourceTree = "<group>"; };
-		A76BE1B5132DABF5008F7F0B /* Local.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Local.h; path = collector/handles/Local.h; sourceTree = "<group>"; };
-		A76BE1B6132DAC24008F7F0B /* LocalScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LocalScope.h; path = collector/handles/LocalScope.h; sourceTree = "<group>"; };
-		A76BE1B7132DAC68008F7F0B /* HandleStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HandleStack.cpp; path = collector/handles/HandleStack.cpp; sourceTree = "<group>"; };
-		A76BE1B8132DAC68008F7F0B /* HandleStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HandleStack.h; path = collector/handles/HandleStack.h; sourceTree = "<group>"; };
 		A76C51741182748D00715B05 /* JSInterfaceJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInterfaceJIT.h; sourceTree = "<group>"; };
-		A779558F101A74D500114E55 /* MarkStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkStack.h; sourceTree = "<group>"; };
 		A783A0D011A36DCA00563D20 /* JSObjectWithGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectWithGlobalObject.h; sourceTree = "<group>"; };
 		A783A2AA11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSObjectWithGlobalObject.cpp; sourceTree = "<group>"; };
 		A791EF260F11E07900AE1F68 /* JSByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSByteArray.h; sourceTree = "<group>"; };
@@ -1098,17 +1103,12 @@
 		A7C40C07130B057D00D002A1 /* BlockStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BlockStack.h; sourceTree = "<group>"; };
 		A7C40C08130B057D00D002A1 /* SentinelLinkedList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SentinelLinkedList.h; sourceTree = "<group>"; };
 		A7C40C09130B057D00D002A1 /* SinglyLinkedList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SinglyLinkedList.h; sourceTree = "<group>"; };
-		A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStackPosix.cpp; sourceTree = "<group>"; };
 		A7D649A91015224E009B2E1B /* PossiblyNull.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PossiblyNull.h; sourceTree = "<group>"; };
 		A7DCB77912E3D90500911940 /* WriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrier.h; sourceTree = "<group>"; };
 		A7E2EA690FB460CF00601F06 /* LiteralParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiteralParser.h; sourceTree = "<group>"; };
 		A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LiteralParser.cpp; sourceTree = "<group>"; };
 		A7E42C180E3938830065A544 /* JSStaticScopeObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStaticScopeObject.h; sourceTree = "<group>"; };
 		A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStaticScopeObject.cpp; sourceTree = "<group>"; };
-		A7E4FC8712F8E4CA00AF4CF4 /* Global.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Global.h; path = collector/handles/Global.h; sourceTree = "<group>"; };
-		A7E4FC8812F8E4CA00AF4CF4 /* Handle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Handle.h; path = collector/handles/Handle.h; sourceTree = "<group>"; };
-		A7E4FC8912F8E4CA00AF4CF4 /* HandleHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HandleHeap.cpp; path = collector/handles/HandleHeap.cpp; sourceTree = "<group>"; };
-		A7E4FC8A12F8E4CA00AF4CF4 /* HandleHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HandleHeap.h; path = collector/handles/HandleHeap.h; sourceTree = "<group>"; };
 		A7F19ECD11DD490900931E70 /* FixedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FixedArray.h; sourceTree = "<group>"; };
 		A7F8690E0F9584A100558697 /* CachedCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedCall.h; sourceTree = "<group>"; };
 		A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameClosure.h; sourceTree = "<group>"; };
@@ -1132,7 +1132,6 @@
 		BC02E98B0E183E38000F9297 /* ErrorInstance.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorInstance.h; sourceTree = "<group>"; };
 		BC02E9B60E1842FA000F9297 /* JSString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSString.cpp; sourceTree = "<group>"; };
 		BC02E9B80E184545000F9297 /* GetterSetter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetterSetter.cpp; sourceTree = "<group>"; };
-		BC02E9B90E184580000F9297 /* JSNumberCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNumberCell.cpp; sourceTree = "<group>"; };
 		BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSAPIValueWrapper.cpp; path = ../runtime/JSAPIValueWrapper.cpp; sourceTree = "<group>"; };
 		BC0894D60FAFBA2D00001865 /* JSAPIValueWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSAPIValueWrapper.h; path = ../runtime/JSAPIValueWrapper.h; sourceTree = "<group>"; };
 		BC1166000E1997B1008066DD /* DateInstance.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DateInstance.cpp; sourceTree = "<group>"; };
@@ -1184,7 +1183,6 @@
 		BC7952330E15EB5600A898AB /* BooleanConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanConstructor.h; sourceTree = "<group>"; };
 		BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BooleanPrototype.cpp; sourceTree = "<group>"; };
 		BC7952350E15EB5600A898AB /* BooleanPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanPrototype.h; sourceTree = "<group>"; };
-		BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNumberCell.h; sourceTree = "<group>"; };
 		BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCell.cpp; sourceTree = "<group>"; };
 		BC8149AF12F89F53007B2C32 /* HeaderDetection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeaderDetection.h; sourceTree = "<group>"; };
 		BC87CDB810712ACA000614CF /* JSONObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.lut.h; sourceTree = "<group>"; };
@@ -1218,6 +1216,8 @@
 		C0A2723F0E509F1E00E96E15 /* NotFound.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NotFound.h; sourceTree = "<group>"; };
 		D21202280AD4310C00ED79B6 /* DateConversion.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = DateConversion.cpp; sourceTree = "<group>"; };
 		D21202290AD4310C00ED79B6 /* DateConversion.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DateConversion.h; sourceTree = "<group>"; };
+		D75AF59512F8CB9500FC0ADF /* DynamicAnnotations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DynamicAnnotations.cpp; sourceTree = "<group>"; };
+		D75AF59612F8CB9500FC0ADF /* DynamicAnnotations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DynamicAnnotations.h; sourceTree = "<group>"; };
 		DD377CBB12072C18006A2517 /* Bitmap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Bitmap.h; sourceTree = "<group>"; };
 		DDF7ABD211F60ED200108E36 /* GCActivityCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCActivityCallback.h; sourceTree = "<group>"; };
 		DDF7ABD311F60ED200108E36 /* GCActivityCallbackCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCActivityCallbackCF.cpp; sourceTree = "<group>"; };
@@ -1364,9 +1364,9 @@
 				9688CB120ED12B4E001D649F /* assembler */,
 				969A078F0ED1D3AE00F1F681 /* bytecode */,
 				7E39D81D0EC38EFA003AF11A /* bytecompiler */,
-				A7E4FC8312F8E4A300AF4CF4 /* collector */,
 				1480DB9A0DDC2231003CFDF2 /* debugger */,
 				86EC9DB31328DF44002B2AD7 /* dfg */,
+				142E312A134FF0A600AFADB5 /* heap */,
 				1429D77A0ED20D7300B89619 /* interpreter */,
 				1429D92C0ED22D7000B89619 /* jit */,
 				7E39D8370EC3A388003AF11A /* parser */,
@@ -1455,6 +1455,35 @@
 			path = jit;
 			sourceTree = "<group>";
 		};
+		142E312A134FF0A600AFADB5 /* heap */ = {
+			isa = PBXGroup;
+			children = (
+				146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */,
+				149DAAF212EB559D0083B12B /* ConservativeRoots.h */,
+				142E312B134FF0A600AFADB5 /* Handle.h */,
+				142E312C134FF0A600AFADB5 /* HandleHeap.cpp */,
+				142E312D134FF0A600AFADB5 /* HandleHeap.h */,
+				142E312E134FF0A600AFADB5 /* HandleStack.cpp */,
+				142E312F134FF0A600AFADB5 /* HandleStack.h */,
+				14FB986B135225410085A5DB /* Heap.cpp */,
+				14FB986C135225410085A5DB /* Heap.h */,
+				142E3130134FF0A600AFADB5 /* Local.h */,
+				142E3131134FF0A600AFADB5 /* LocalScope.h */,
+				14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */,
+				14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */,
+				142D6F0613539A2800B02E86 /* MarkedBlock.cpp */,
+				142D6F0713539A2800B02E86 /* MarkedBlock.h */,
+				142D6F0A13539A2F00B02E86 /* MarkedSpace.cpp */,
+				142D6F0B13539A2F00B02E86 /* MarkedSpace.h */,
+				142D6F0E13539A4100B02E86 /* MarkStack.cpp */,
+				142D6F0F13539A4100B02E86 /* MarkStack.h */,
+				142D6F1013539A4100B02E86 /* MarkStackPosix.cpp */,
+				142E3132134FF0A600AFADB5 /* Strong.h */,
+				142E3133134FF0A600AFADB5 /* Weak.h */,
+			);
+			path = heap;
+			sourceTree = "<group>";
+		};
 		1432EBD70A34CAD400717B9F /* API */ = {
 			isa = PBXGroup;
 			children = (
@@ -1573,6 +1602,7 @@
 		65162EF108E6A21C007556CD /* wtf */ = {
 			isa = PBXGroup;
 			children = (
+				A1D764511354448B00C5C7C0 /* Alignment.h */,
 				A7C40C07130B057D00D002A1 /* BlockStack.h */,
 				A7C40C08130B057D00D002A1 /* SentinelLinkedList.h */,
 				A7C40C09130B057D00D002A1 /* SinglyLinkedList.h */,
@@ -1603,6 +1633,8 @@
 				14456A311314657800212CA3 /* DoublyLinkedList.h */,
 				651F6412039D5B5F0078395C /* dtoa.cpp */,
 				651F6413039D5B5F0078395C /* dtoa.h */,
+				D75AF59512F8CB9500FC0ADF /* DynamicAnnotations.cpp */,
+				D75AF59612F8CB9500FC0ADF /* DynamicAnnotations.h */,
 				E48E0F2C0F82151700A8CA37 /* FastAllocBase.h */,
 				65E217B908E7EECC0023E5F6 /* FastMalloc.cpp */,
 				65E217BA08E7EECC0023E5F6 /* FastMalloc.h */,
@@ -1771,8 +1803,6 @@
 				65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */,
 				969A09220ED1E09C00F1F681 /* Completion.cpp */,
 				F5BB2BC5030F772101FCFE1D /* Completion.h */,
-				146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */,
-				149DAAF212EB559D0083B12B /* ConservativeSet.h */,
 				BCA62DFF0E2826310004F30D /* ConstructData.cpp */,
 				BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */,
 				BCD203450E17135E002C7E82 /* DateConstructor.cpp */,
@@ -1804,8 +1834,6 @@
 				DDF7ABD311F60ED200108E36 /* GCActivityCallbackCF.cpp */,
 				BC02E9B80E184545000F9297 /* GetterSetter.cpp */,
 				BC337BDE0E1AF0B80076918A /* GetterSetter.h */,
-				140CDE6C12DE977E0013CFC5 /* Heap.cpp */,
-				140CDE6D12DE977E0013CFC5 /* Heap.h */,
 				933A349D038AE80F008635CE /* Identifier.cpp */,
 				933A349A038AE7C6008635CE /* Identifier.h */,
 				E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */,
@@ -1828,14 +1856,11 @@
 				A8E894330CD0603F00367179 /* JSGlobalObject.h */,
 				BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */,
 				BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */,
-				14760863099C633800437128 /* JSImmediate.cpp */,
 				1483B589099BC1950016E4F0 /* JSImmediate.h */,
 				65EA4C99092AF9E20093D800 /* JSLock.cpp */,
 				65EA4C9A092AF9E20093D800 /* JSLock.h */,
 				A72700780DAC605600E548D7 /* JSNotAnObject.cpp */,
 				A72700770DAC605600E548D7 /* JSNotAnObject.h */,
-				BC02E9B90E184580000F9297 /* JSNumberCell.cpp */,
-				BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */,
 				BC22A3980E16E14800AF21C8 /* JSObject.cpp */,
 				BC22A3990E16E14800AF21C8 /* JSObject.h */,
 				A783A2AA11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp */,
@@ -1853,6 +1878,7 @@
 				6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
 				F692A8870255597D01FF60F7 /* JSValue.cpp */,
 				14ABB36E099C076400E2A24F /* JSValue.h */,
+				865A30F0135007E100CDB49E /* JSValueInlineMethods.h */,
 				BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */,
 				14F252560D08DD8D004ECFFF /* JSVariableObject.h */,
 				65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */,
@@ -1863,15 +1889,6 @@
 				A7E2EA690FB460CF00601F06 /* LiteralParser.h */,
 				F692A8680255597D01FF60F7 /* Lookup.cpp */,
 				F692A8690255597D01FF60F7 /* Lookup.h */,
-				14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */,
-				14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */,
-				14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */,
-				14C824AC12F7C785008F35E0 /* MarkedBlock.h */,
-				140CDC7612DBEA330013CFC5 /* MarkedSpace.cpp */,
-				140CDC7712DBEA330013CFC5 /* MarkedSpace.h */,
-				A74B3498102A5F8E0032AB98 /* MarkStack.cpp */,
-				A779558F101A74D500114E55 /* MarkStack.h */,
-				A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */,
 				F692A86A0255597D01FF60F7 /* MathObject.cpp */,
 				F692A86B0255597D01FF60F7 /* MathObject.h */,
 				90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */,
@@ -1948,7 +1965,6 @@
 				08DDA5BB12645F1D00751732 /* UStringBuilder.h */,
 				0896C29B1265AAF600B1CDD3 /* UStringConcatenate.h */,
 				14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */,
-				14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */,
 				1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */,
 				A7DCB77912E3D90500911940 /* WriteBarrier.h */,
 			);
@@ -2136,29 +2152,6 @@
 			name = api;
 			sourceTree = "<group>";
 		};
-		A7E4FC8312F8E4A300AF4CF4 /* collector */ = {
-			isa = PBXGroup;
-			children = (
-				A7E4FC8512F8E4B100AF4CF4 /* handles */,
-			);
-			name = collector;
-			sourceTree = "<group>";
-		};
-		A7E4FC8512F8E4B100AF4CF4 /* handles */ = {
-			isa = PBXGroup;
-			children = (
-				A7E4FC8712F8E4CA00AF4CF4 /* Global.h */,
-				A7E4FC8812F8E4CA00AF4CF4 /* Handle.h */,
-				A7E4FC8912F8E4CA00AF4CF4 /* HandleHeap.cpp */,
-				A7E4FC8A12F8E4CA00AF4CF4 /* HandleHeap.h */,
-				A76BE1B7132DAC68008F7F0B /* HandleStack.cpp */,
-				A76BE1B8132DAC68008F7F0B /* HandleStack.h */,
-				A76BE1B5132DABF5008F7F0B /* Local.h */,
-				A76BE1B6132DAC24008F7F0B /* LocalScope.h */,
-			);
-			name = handles;
-			sourceTree = "<group>";
-		};
 		E195678D09E7CF1200B89D13 /* unicode */ = {
 			isa = PBXGroup;
 			children = (
@@ -2224,6 +2217,8 @@
 				BC18C3EB0E16F5CD00B34460 /* AVLTree.h in Headers */,
 				147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */,
 				DD377CBC12072C18006A2517 /* Bitmap.h in Headers */,
+				A7C40C0A130B057D00D002A1 /* BlockStack.h in Headers */,
+				E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */,
 				BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */,
 				86676D5211FED9BC004B6863 /* BumpPointerAllocator.h in Headers */,
 				A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */,
@@ -2241,9 +2236,10 @@
 				BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */,
 				FDA15C1E12B0305C003A583A /* Complex.h in Headers */,
 				BC18C3F50E16F5CD00B34460 /* config.h in Headers */,
-				144836E7132DA7BE005BE785 /* ConservativeSet.h in Headers */,
+				144836E7132DA7BE005BE785 /* ConservativeRoots.h in Headers */,
 				BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */,
 				0BDFFAE00FC6192900D69EF4 /* CrossThreadRefCounted.h in Headers */,
+				97941A7F1302A098004A3447 /* CryptographicallyRandomNumber.h in Headers */,
 				86565743115BE3DA00291F40 /* CString.h in Headers */,
 				180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */,
 				BCD2034A0E17135E002C7E82 /* DateConstructor.h in Headers */,
@@ -2259,9 +2255,24 @@
 				862AF4B612239C7B0024E5B8 /* DecimalNumber.h in Headers */,
 				5135FAF212D26ACE003C083B /* Decoder.h in Headers */,
 				BC18C3FC0E16F5CD00B34460 /* Deque.h in Headers */,
+				86ECA4F1132EAA6D002B2AD7 /* DFGAliasTracker.h in Headers */,
+				86EC9DC51328DF82002B2AD7 /* DFGByteCodeParser.h in Headers */,
+				86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */,
+				86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */,
+				86EC9DCA1328DF82002B2AD7 /* DFGJITCodeGenerator.h in Headers */,
+				86EC9DCC1328DF82002B2AD7 /* DFGJITCompiler.h in Headers */,
+				86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */,
+				86EC9DCE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h in Headers */,
+				142E3136134FF0A600AFADB5 /* HandleHeap.h in Headers */,
+				142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */,
+				86EC9DD01328DF82002B2AD7 /* DFGOperations.h in Headers */,
+				86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */,
+				86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */,
+				86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */,
 				BC18C3FD0E16F5CD00B34460 /* DisallowCType.h in Headers */,
 				14456A321314657800212CA3 /* DoublyLinkedList.h in Headers */,
 				BC18C3FE0E16F5CD00B34460 /* dtoa.h in Headers */,
+				D7A46A4F1338FFEA00ED695C /* DynamicAnnotations.h in Headers */,
 				5135FAF312D26AD1003C083B /* Encoder.h in Headers */,
 				BC3046070E1F497F003232CF /* Error.h in Headers */,
 				BC02E90D0E1839DB000F9297 /* ErrorConstructor.h in Headers */,
@@ -2285,8 +2296,8 @@
 				BC18C40B0E16F5CD00B34460 /* HashMap.h in Headers */,
 				BC18C40C0E16F5CD00B34460 /* HashSet.h in Headers */,
 				BC18C40D0E16F5CD00B34460 /* HashTable.h in Headers */,
+				142E3134134FF0A600AFADB5 /* Handle.h in Headers */,
 				BC18C40E0E16F5CD00B34460 /* HashTraits.h in Headers */,
-				140CDE7112DE97B10013CFC5 /* Heap.h in Headers */,
 				7186A6EC13100BA5004479E1 /* HexNumber.h in Headers */,
 				BC18C40F0E16F5CD00B34460 /* Identifier.h in Headers */,
 				BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */,
@@ -2319,10 +2330,8 @@
 				BC18C4200E16F5CD00B34460 /* JSGlobalData.h in Headers */,
 				BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */,
 				BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */,
-				BC18C4220E16F5CD00B34460 /* JSImmediate.h in Headers */,
 				A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */,
 				BC18C4230E16F5CD00B34460 /* JSLock.h in Headers */,
-				BC7F8FB90E19D1C3008632C0 /* JSNumberCell.h in Headers */,
 				BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */,
 				BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */,
 				A7280A2811557E3000D56957 /* JSObjectRefPrivate.h in Headers */,
@@ -2354,6 +2363,8 @@
 				BC18C4340E16F5CD00B34460 /* ListHashSet.h in Headers */,
 				BC18C4350E16F5CD00B34460 /* ListRefPtr.h in Headers */,
 				A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */,
+				142E3139134FF0A600AFADB5 /* Local.h in Headers */,
+				142E313A134FF0A600AFADB5 /* LocalScope.h in Headers */,
 				BC18C4360E16F5CD00B34460 /* Locker.h in Headers */,
 				BC18C4370E16F5CD00B34460 /* Lookup.h in Headers */,
 				14B723B812D7DA6F003BD5ED /* MachineStackMarker.h in Headers */,
@@ -2367,8 +2378,6 @@
 				860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
 				BC18C4390E16F5CD00B34460 /* MainThread.h in Headers */,
 				BC18C43A0E16F5CD00B34460 /* MallocZoneSupport.h in Headers */,
-				140CDF0C12DECE5C0013CFC5 /* MarkedSpace.h in Headers */,
-				A7795590101A74D500114E55 /* MarkStack.h in Headers */,
 				BC18C43B0E16F5CD00B34460 /* MathExtras.h in Headers */,
 				BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */,
 				BC18C52A0E16FCC200B34460 /* MathObject.lut.h in Headers */,
@@ -2395,6 +2404,7 @@
 				969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */,
 				BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
 				1400067712A6F7830064D123 /* OSAllocator.h in Headers */,
+				97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */,
 				BC18C4490E16F5CD00B34460 /* OwnArrayPtr.h in Headers */,
 				0BDFFAE10FC6193100D69EF4 /* OwnFastMallocPtr.h in Headers */,
 				BC18C44A0E16F5CD00B34460 /* OwnPtr.h in Headers */,
@@ -2447,10 +2457,14 @@
 				1429D8860ED21C3D00B89619 /* SamplingTool.h in Headers */,
 				BC18C4610E16F5CD00B34460 /* ScopeChain.h in Headers */,
 				969A072C0ED1CE6900F1F681 /* SegmentedVector.h in Headers */,
+				A7C40C0B130B057D00D002A1 /* SentinelLinkedList.h in Headers */,
 				76FB9F0F12E851860051A2EB /* SHA1.h in Headers */,
+				A7C40C0C130B057D00D002A1 /* SinglyLinkedList.h in Headers */,
 				933040040E6A749400786E6A /* SmallStrings.h in Headers */,
 				BC18C4640E16F5CD00B34460 /* SourceCode.h in Headers */,
 				BC18C4630E16F5CD00B34460 /* SourceProvider.h in Headers */,
+				E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */,
+				E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */,
 				A7386554118697B400540279 /* SpecializedThunkJIT.h in Headers */,
 				86D87DDB12BCAF94008E73A1 /* StackBounds.h in Headers */,
 				868BFA60117D048200B908B1 /* StaticConstructors.h in Headers */,
@@ -2469,6 +2483,7 @@
 				BC18C4690E16F5CD00B34460 /* StringObjectThatMasqueradesAsUndefined.h in Headers */,
 				BC18C46A0E16F5CD00B34460 /* StringPrototype.h in Headers */,
 				BC18C5260E16FCA700B34460 /* StringPrototype.lut.h in Headers */,
+				142E313B134FF0A600AFADB5 /* Strong.h in Headers */,
 				BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */,
 				7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */,
 				BCCF0D080EF0AAB900413C8F /* StructureStubInfo.h in Headers */,
@@ -2505,48 +2520,27 @@
 				BC18C4780E16F5CD00B34460 /* Vector.h in Headers */,
 				BC18C4790E16F5CD00B34460 /* VectorTraits.h in Headers */,
 				96DD73790F9DA3100027FBCC /* VMTags.h in Headers */,
+				142E313C134FF0A600AFADB5 /* Weak.h in Headers */,
 				14BFCE6910CDB1FC00364CCE /* WeakGCMap.h in Headers */,
-				14035DB110DBFB2A00FFFFE7 /* WeakGCPtr.h in Headers */,
 				1420BE7B10AA6DDB00F455D2 /* WeakRandom.h in Headers */,
 				BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */,
+				A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
 				868BFA18117CF19900B908B1 /* WTFString.h in Headers */,
 				86D08D5411793613006E5ED0 /* WTFThreadData.h in Headers */,
 				9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */,
+				451539B912DC994500EF7AC4 /* Yarr.h in Headers */,
 				86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */,
 				86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */,
 				86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */,
 				86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */,
 				86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */,
 				5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */,
-				451539B912DC994500EF7AC4 /* Yarr.h in Headers */,
-				A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
-				E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */,
-				E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */,
-				14C824AD12F7C785008F35E0 /* MarkedBlock.h in Headers */,
-				E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */,
-				97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */,
-				97941A7F1302A098004A3447 /* CryptographicallyRandomNumber.h in Headers */,
-				A7E4FC8F12F8E4CA00AF4CF4 /* Global.h in Headers */,
-				A7E4FC9012F8E4CA00AF4CF4 /* Handle.h in Headers */,
-				A7E4FC9212F8E4CA00AF4CF4 /* HandleHeap.h in Headers */,
-				A7C40C0A130B057D00D002A1 /* BlockStack.h in Headers */,
-				A7C40C0B130B057D00D002A1 /* SentinelLinkedList.h in Headers */,
-				A7C40C0C130B057D00D002A1 /* SinglyLinkedList.h in Headers */,
-				A76BE3A0132EEA7C008F7F0B /* HandleStack.h in Headers */,
-				A76BE3A1132EEA7C008F7F0B /* Local.h in Headers */,
-				A76BE3A2132EEA7C008F7F0B /* LocalScope.h in Headers */,
-				86EC9DC51328DF82002B2AD7 /* DFGByteCodeParser.h in Headers */,
-				86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */,
-				86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */,
-				86EC9DCA1328DF82002B2AD7 /* DFGJITCodeGenerator.h in Headers */,
-				86EC9DCC1328DF82002B2AD7 /* DFGJITCompiler.h in Headers */,
-				86EC9DCE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h in Headers */,
-				86EC9DD01328DF82002B2AD7 /* DFGOperations.h in Headers */,
-				86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */,
-				86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */,
-				86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */,
-				86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */,
-				86ECA4F1132EAA6D002B2AD7 /* DFGAliasTracker.h in Headers */,
+				14FB986E135225410085A5DB /* Heap.h in Headers */,
+				865A30F1135007E100CDB49E /* JSValueInlineMethods.h in Headers */,
+				142D6F0913539A2800B02E86 /* MarkedBlock.h in Headers */,
+				142D6F0D13539A2F00B02E86 /* MarkedSpace.h in Headers */,
+				142D6F1213539A4100B02E86 /* MarkStack.h in Headers */,
+				A1D764521354448B00C5C7C0 /* Alignment.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2819,8 +2813,9 @@
 				E1A862A90D7EBB76001EC6AA /* CollatorICU.cpp in Sources */,
 				147F39C1107EC37600427A48 /* CommonIdentifiers.cpp in Sources */,
 				147F39C2107EC37600427A48 /* Completion.cpp in Sources */,
-				146B16D812EB5B59001BEC1B /* ConservativeSet.cpp in Sources */,
+				146B16D812EB5B59001BEC1B /* ConservativeRoots.cpp in Sources */,
 				1428082E107EC0570013E7B2 /* ConstructData.cpp in Sources */,
+				97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */,
 				86565742115BE3DA00291F40 /* CString.cpp in Sources */,
 				180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */,
 				147F39C3107EC37600427A48 /* DateConstructor.cpp in Sources */,
@@ -2832,6 +2827,13 @@
 				BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */,
 				149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */,
 				0F29479C126E698C00B3ABF5 /* DecimalNumber.cpp in Sources */,
+				86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */,
+				86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */,
+				86EC9DC91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp in Sources */,
+				86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */,
+				86EC9DCD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp in Sources */,
+				86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */,
+				86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */,
 				14469DD7107EC79E00650446 /* dtoa.cpp in Sources */,
 				147F39C7107EC37600427A48 /* Error.cpp in Sources */,
 				147F39C8107EC37600427A48 /* ErrorConstructor.cpp in Sources */,
@@ -2846,8 +2848,9 @@
 				147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */,
 				DDF7ABD511F60ED200108E36 /* GCActivityCallbackCF.cpp in Sources */,
 				14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */,
+				142E3135134FF0A600AFADB5 /* HandleHeap.cpp in Sources */,
+				142E3137134FF0A600AFADB5 /* HandleStack.cpp in Sources */,
 				65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */,
-				140CDE7012DE97A00013CFC5 /* Heap.cpp in Sources */,
 				147F39CE107EC37600427A48 /* Identifier.cpp in Sources */,
 				E178636D0D9BEEC300D74E75 /* InitializeThreading.cpp in Sources */,
 				147F39CF107EC37600427A48 /* InternalFunction.cpp in Sources */,
@@ -2877,10 +2880,8 @@
 				E18E3A590DF9278C00D90B34 /* JSGlobalData.cpp in Sources */,
 				147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */,
 				14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */,
-				147F39D3107EC37600427A48 /* JSImmediate.cpp in Sources */,
 				14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,
 				A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */,
-				1428085D107EC0F80013E7B2 /* JSNumberCell.cpp in Sources */,
 				147F39D4107EC37600427A48 /* JSObject.cpp in Sources */,
 				1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */,
 				A783A2AB11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp in Sources */,
@@ -2906,9 +2907,6 @@
 				86C568E011A213EE0007F7F0 /* MacroAssemblerARM.cpp in Sources */,
 				06D358B30DAADAA4003B174E /* MainThread.cpp in Sources */,
 				06D358B40DAADAAA003B174E /* MainThreadMac.mm in Sources */,
-				140CDC7C12DC09BF0013CFC5 /* MarkedSpace.cpp in Sources */,
-				A74B3499102A5F8E0032AB98 /* MarkStack.cpp in Sources */,
-				A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */,
 				14469DDF107EC7E700650446 /* MathObject.cpp in Sources */,
 				511FC4C9117EE28700425272 /* MD5.cpp in Sources */,
 				90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */,
@@ -2926,6 +2924,7 @@
 				969A079A0ED1D3AE00F1F681 /* Opcode.cpp in Sources */,
 				14280850107EC0D70013E7B2 /* Operations.cpp in Sources */,
 				1400069312A6F9E10064D123 /* OSAllocatorPosix.cpp in Sources */,
+				97941A5713029AAB004A3447 /* OSRandomSource.cpp in Sources */,
 				14FFF98C12BFFF7500795BB8 /* PageAllocationAligned.cpp in Sources */,
 				14B3EF0612BC24DD00D29EFF /* PageBlock.cpp in Sources */,
 				9714AF5E122F32070092D9F5 /* ParsedURL.cpp in Sources */,
@@ -2953,6 +2952,7 @@
 				76FB9F1112E851960051A2EB /* SHA1.cpp in Sources */,
 				0BF28A2911A33DC300638F84 /* SizeLimits.cpp in Sources */,
 				9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */,
+				E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
 				86D87DAE12BCA7D1008E73A1 /* StackBounds.cpp in Sources */,
 				A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */,
 				86438FC41265503E00E0DFCA /* StringBuilder.cpp in Sources */,
@@ -2981,19 +2981,11 @@
 				86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */,
 				86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */,
 				86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */,
-				E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
-				97941A5713029AAB004A3447 /* OSRandomSource.cpp in Sources */,
-				97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */,
-				A7E4FC9112F8E4CA00AF4CF4 /* HandleHeap.cpp in Sources */,
-				A7AC25BD1304D146003396DE /* MarkedBlock.cpp in Sources */,
-				A76BE39F132EEA7C008F7F0B /* HandleStack.cpp in Sources */,
-				86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */,
-				86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */,
-				86EC9DC91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp in Sources */,
-				86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */,
-				86EC9DCD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp in Sources */,
-				86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */,
-				86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */,
+				14FB986D135225410085A5DB /* Heap.cpp in Sources */,
+				142D6F0813539A2800B02E86 /* MarkedBlock.cpp in Sources */,
+				142D6F0C13539A2F00B02E86 /* MarkedSpace.cpp in Sources */,
+				142D6F1113539A4100B02E86 /* MarkStack.cpp in Sources */,
+				142D6F1313539A4100B02E86 /* MarkStackPosix.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3055,6 +3047,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = minidom;
+				SKIP_INSTALL = YES;
 			};
 			name = Debug;
 		};
@@ -3062,6 +3055,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = minidom;
+				SKIP_INSTALL = YES;
 			};
 			name = Release;
 		};
@@ -3069,6 +3063,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = minidom;
+				SKIP_INSTALL = YES;
 			};
 			name = Production;
 		};
@@ -3169,6 +3164,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = testapi;
+				SKIP_INSTALL = YES;
 			};
 			name = Debug;
 		};
@@ -3176,6 +3172,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = testapi;
+				SKIP_INSTALL = YES;
 			};
 			name = Release;
 		};
@@ -3183,6 +3180,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = testapi;
+				SKIP_INSTALL = YES;
 			};
 			name = Production;
 		};
@@ -3241,6 +3239,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = minidom;
+				SKIP_INSTALL = YES;
 			};
 			name = Profiling;
 		};
@@ -3248,6 +3247,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = testapi;
+				SKIP_INSTALL = YES;
 			};
 			name = Profiling;
 		};
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.h b/Source/JavaScriptCore/assembler/ARMAssembler.h
index a711d56..e553492 100644
--- a/Source/JavaScriptCore/assembler/ARMAssembler.h
+++ b/Source/JavaScriptCore/assembler/ARMAssembler.h
@@ -722,6 +722,10 @@ namespace JSC {
 
         void* executableCopy(ExecutablePool* allocator);
 
+#ifndef NDEBUG
+        unsigned debugOffset() { return m_formatter.debugOffset(); }
+#endif
+
         // Patching helpers
 
         static ARMWord* getLdrImmAddress(ARMWord* insn)
diff --git a/Source/JavaScriptCore/assembler/ARMv7Assembler.h b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
index f03e554..d9d4f5d 100644
--- a/Source/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -2292,6 +2292,10 @@ private:
         void* data() const { return m_buffer.data(); }
         void* executableCopy(ExecutablePool* allocator) { return m_buffer.executableCopy(allocator); }
 
+#ifndef NDEBUG
+        unsigned debugOffset() { return m_formatter.debugOffset(); }
+#endif
+
     private:
         AssemblerBuffer m_buffer;
     } m_formatter;
diff --git a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 8e81784..8b6613d 100644
--- a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -503,10 +503,19 @@ public:
     {
         return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
     }
-    
+
+    // Temporary interface; likely to be removed, since may be hard to port to all architectures.
+#if CPU(X86) || CPU(X86_64)
+    void rewindToLabel(Label rewindTo) { m_assembler.rewindToLabel(rewindTo.m_label); }
+#endif
+
     void beginUninterruptedSequence() { }
     void endUninterruptedSequence() { }
 
+#ifndef NDEBUG
+    unsigned debugOffset() { return m_assembler.debugOffset(); }
+#endif
+
 protected:
     AssemblerType m_assembler;
 
diff --git a/Source/JavaScriptCore/assembler/AssemblerBuffer.h b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
index a90efc6..802fa7f 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -154,6 +154,16 @@ namespace JSC {
             return memcpy(result, m_buffer, m_size);
         }
 
+        void rewindToOffset(int offset)
+        {
+            ASSERT(offset >= 0);
+            m_size = offset;
+        }
+
+#ifndef NDEBUG
+        unsigned debugOffset() { return m_size; }
+#endif
+
     protected:
         void append(const char* data, int size)
         {
diff --git a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index 9a9618f..3cfc67b 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -85,7 +85,14 @@ namespace JSC {
 template <int maxPoolSize, int barrierSize, int maxInstructionSize, class AssemblerType>
 class AssemblerBufferWithConstantPool: public AssemblerBuffer {
     typedef SegmentedVector<uint32_t, 512> LoadOffsets;
+    using AssemblerBuffer::putIntegral;
+    using AssemblerBuffer::putIntegralUnchecked;
 public:
+    typedef struct {
+        short high;
+        short low;
+    } TwoShorts;
+
     enum {
         UniqueConst,
         ReusableConst,
@@ -171,6 +178,19 @@ public:
         correctDeltas(8);
     }
 
+    void putIntegral(TwoShorts value)
+    {
+        if (m_size > m_capacity - sizeof(TwoShorts))
+            grow();
+        putIntegralUnchecked(value);
+    }
+
+    void putIntegralUnchecked(TwoShorts value)
+    {
+        putIntegralUnchecked(value.high);
+        putIntegralUnchecked(value.low);
+    }
+
     int size()
     {
         flushIfNoSpaceFor(maxInstructionSize, sizeof(uint64_t));
diff --git a/Source/JavaScriptCore/assembler/LinkBuffer.h b/Source/JavaScriptCore/assembler/LinkBuffer.h
index c5a7d5b..7fa6a99 100644
--- a/Source/JavaScriptCore/assembler/LinkBuffer.h
+++ b/Source/JavaScriptCore/assembler/LinkBuffer.h
@@ -183,6 +183,13 @@ public:
         return CodePtr(MacroAssembler::AssemblerType_T::getRelocatedAddress(code(), applyOffset(label.m_label)));
     }
 
+#ifndef NDEBUG
+    void* debugAddress()
+    {
+        return m_code;
+    }
+#endif
+
 private:
     template <typename T> T applyOffset(T src)
     {
diff --git a/Source/JavaScriptCore/assembler/MIPSAssembler.h b/Source/JavaScriptCore/assembler/MIPSAssembler.h
index 6030680..4c17e40 100644
--- a/Source/JavaScriptCore/assembler/MIPSAssembler.h
+++ b/Source/JavaScriptCore/assembler/MIPSAssembler.h
@@ -719,6 +719,10 @@ public:
         return result;
     }
 
+#ifndef NDEBUG
+    unsigned debugOffset() { return m_formatter.debugOffset(); }
+#endif
+
     static unsigned getCallReturnOffset(JmpSrc call)
     {
         // The return address is after a call and a delay slot instruction
diff --git a/Source/JavaScriptCore/assembler/MacroAssembler.h b/Source/JavaScriptCore/assembler/MacroAssembler.h
index bb19a98..cffb41d 100644
--- a/Source/JavaScriptCore/assembler/MacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/MacroAssembler.h
@@ -50,6 +50,12 @@ namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 #include "MacroAssemblerX86_64.h"
 namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
 
+#elif CPU(SH4)
+#include "MacroAssemblerSH4.h"
+namespace JSC {
+typedef MacroAssemblerSH4 MacroAssemblerBase;
+};
+
 #else
 #error "The MacroAssembler is not supported on this platform."
 #endif
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerSH4.cpp b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.cpp
new file mode 100644
index 0000000..f718845
--- /dev/null
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 STMicroelectronics. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && CPU(SH4)
+
+#include "MacroAssemblerSH4.h"
+
+namespace JSC {
+const Condition MacroAssemblerSH4::Equal = SH4Assembler::EQ;
+const Condition MacroAssemblerSH4::NotEqual = SH4Assembler::NE;
+const Condition MacroAssemblerSH4::GreaterThan = SH4Assembler::GT;
+const Condition MacroAssemblerSH4::GreaterThanOrEqual = SH4Assembler::GE;
+const Condition MacroAssemblerSH4::LessThan = SH4Assembler::LT;
+const Condition MacroAssemblerSH4::LessThanOrEqual = SH4Assembler::LE;
+const Condition MacroAssemblerSH4::UGreaterThan = SH4Assembler::HI;
+const Condition MacroAssemblerSH4::UGreaterThanOrEqual = SH4Assembler::HS;
+const Condition MacroAssemblerSH4::ULessThan = SH4Assembler::LI;
+const Condition MacroAssemblerSH4::ULessThanOrEqual = SH4Assembler::LS;
+const Condition MacroAssemblerSH4::Zero = SH4Assembler::EQ;
+const Condition MacroAssemblerSH4::NonZero = SH4Assembler::NE;
+const Condition MacroAssemblerSH4::Overflow = SH4Assembler::OF;
+const Condition MacroAssemblerSH4::Above = SH4Assembler::HI;
+const Condition MacroAssemblerSH4::AboveOrEqual = SH4Assembler::HS;
+const Condition MacroAssemblerSH4::Below = SH4Assembler::LI;
+const Condition MacroAssemblerSH4::BelowOrEqual = SH4Assembler::LS;
+const Condition MacroAssemblerSH4::DoubleEqual = SH4Assembler::EQ;
+const Condition MacroAssemblerSH4::DoubleNotEqual = SH4Assembler::NE;
+const Condition MacroAssemblerSH4::DoubleGreaterThan = SH4Assembler::GT;
+const Condition MacroAssemblerSH4::DoubleGreaterThanOrEqual = SH4Assembler::GE;
+const Condition MacroAssemblerSH4::DoubleLessThan = SH4Assembler::LT;
+const Condition MacroAssemblerSH4::DoubleLessThanOrEqual = SH4Assembler::LE;
+const Condition MacroAssemblerSH4::DoubleEqualOrUnordered = SH4Assembler::EQU;
+const Condition MacroAssemblerSH4::DoubleNotEqualOrUnordered = SH4Assembler::NEU;
+const Condition MacroAssemblerSH4::DoubleGreaterThanOrUnordered = SH4Assembler::GTU;
+const Condition MacroAssemblerSH4::DoubleGreaterThanOrEqualOrUnordered = SH4Assembler::GEU;
+const Condition MacroAssemblerSH4::DoubleLessThanOrUnordered = SH4Assembler::LTU;
+const Condition MacroAssemblerSH4::DoubleLessThanOrEqualOrUnordered = SH4Assembler::LEU;
+const Condition MacroAssemblerSH4::Signed = SH4Assembler::SI;
+
+void MacroAssemblerSH4::linkCall(void* code, Call call, FunctionPtr function)
+{
+    SH4Assembler::linkCall(code, call.m_jmp, function.value());
+}
+
+void MacroAssemblerSH4::repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+{
+    SH4Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+}
+
+void MacroAssemblerSH4::repatchCall(CodeLocationCall call, FunctionPtr destination)
+{
+    SH4Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+}
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
new file mode 100644
index 0000000..7e15e6c
--- /dev/null
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
@@ -0,0 +1,1751 @@
+/*
+ * Copyright (C) 2009-2011 STMicroelectronics. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef MacroAssemblerSH4_h
+#define MacroAssemblerSH4_h
+
+#if ENABLE(ASSEMBLER) && CPU(SH4)
+
+#include "AbstractMacroAssembler.h"
+#include "SH4Assembler.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+typedef SH4Assembler::Condition Condition;
+
+class MacroAssemblerSH4 : public AbstractMacroAssembler<SH4Assembler> {
+public:
+    typedef SH4Assembler::FPRegisterID FPRegisterID;
+
+    static const Condition Equal;
+    static const Condition NotEqual;
+    static const Condition GreaterThan;
+    static const Condition GreaterThanOrEqual;
+    static const Condition LessThan;
+    static const Condition LessThanOrEqual;
+    static const Condition UGreaterThan;
+    static const Condition UGreaterThanOrEqual;
+    static const Condition ULessThan;
+    static const Condition ULessThanOrEqual;
+    static const Condition Zero;
+    static const Condition NonZero;
+    static const Condition Overflow;
+    static const Condition Above;
+    static const Condition AboveOrEqual;
+    static const Condition Below;
+    static const Condition BelowOrEqual;
+    static const Condition DoubleEqual;
+    static const Condition DoubleNotEqual;
+    static const Condition DoubleGreaterThan;
+    static const Condition DoubleGreaterThanOrEqual;
+    static const Condition DoubleLessThan;
+    static const Condition DoubleLessThanOrEqual;
+    static const Condition DoubleEqualOrUnordered;
+    static const Condition DoubleNotEqualOrUnordered;
+    static const Condition DoubleGreaterThanOrUnordered;
+    static const Condition DoubleGreaterThanOrEqualOrUnordered;
+    static const Condition DoubleLessThanOrUnordered;
+    static const Condition DoubleLessThanOrEqualOrUnordered;
+    static const Condition Signed;
+    static const Scale ScalePtr = TimesFour;
+    static const FPRegisterID fscratch = SH4Registers::fr10;
+    static const RegisterID stackPointerRegister = SH4Registers::sp;
+    static const RegisterID linkRegister = SH4Registers::pr;
+    static const RegisterID scratchReg3 = SH4Registers::r13;
+
+    RegisterID claimScratch()
+    {
+        return m_assembler.claimScratch();
+    }
+
+    void releaseScratch(RegisterID reg)
+    {
+        m_assembler.releaseScratch(reg);
+    }
+
+    // Integer arithmetic operations
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addlRegReg(src, dest);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (m_assembler.isImmediate(imm.m_value)) {
+            m_assembler.addlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.addlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.movlRegReg(src, dest);
+        add32(imm, dest);
+    }
+
+    void add32(TrustedImm32 imm, Address address)
+    {
+        RegisterID scr = claimScratch();
+        load32(address, scr);
+        add32(imm, scr);
+        store32(scr, address);
+        releaseScratch(scr);
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        m_assembler.addlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andlRegReg(src, dest);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID dest)
+    {
+        if ((imm.m_value <= 255) && (imm.m_value >= 0) && (dest == SH4Registers::r0)) {
+            m_assembler.andlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant((imm.m_value), scr);
+        m_assembler.andlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void lshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        m_assembler.shllRegReg(dest, shiftamount);
+    }
+
+    void rshift32(int imm, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(-imm, scr);
+        m_assembler.shaRegReg(dest, scr);
+        releaseScratch(scr);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        if ((imm.m_value == 1) || (imm.m_value == 2) || (imm.m_value == 8) || (imm.m_value == 16)) {
+            m_assembler.shllImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.shllRegReg(dest, scr);
+        releaseScratch(scr);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.imullRegReg(src, dest);
+        m_assembler.stsmacl(dest);
+    }
+
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        move(imm, scr);
+        if  (src != dest)
+            move(src, dest);
+        mul32(scr,  dest);
+        releaseScratch(scr);
+    }
+
+    void not32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.notlReg(src, dest);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orlRegReg(src, dest);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID dest)
+    {
+        if ((imm.m_value <= 255) && (imm.m_value >= 0) && (dest == SH4Registers::r0)) {
+            m_assembler.orlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.orlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void rshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        compare32(32, shiftamount, Equal);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.branch(BT_OPCODE, 1);
+        m_assembler.neg(shiftamount, shiftamount);
+        m_assembler.shaRegReg(dest, shiftamount);
+    }
+
+    void rshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value & 0x1f)
+            rshift32(imm.m_value & 0x1f, dest);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sublRegReg(src, dest);
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address, RegisterID scratchReg)
+    {
+        RegisterID result = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(-imm.m_value))
+            m_assembler.addlImm8r(-imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.sublRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        RegisterID result = claimScratch();
+        RegisterID scratchReg = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(-imm.m_value))
+            m_assembler.addlImm8r(-imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.sublRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+        releaseScratch(scratchReg);
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address, RegisterID scratchReg)
+    {
+        RegisterID result = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(imm.m_value))
+            m_assembler.addlImm8r(imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.addlRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        RegisterID result = claimScratch();
+        RegisterID scratchReg = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(imm.m_value))
+            m_assembler.addlImm8r(imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.addlRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+        releaseScratch(scratchReg);
+    }
+
+    void sub32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (m_assembler.isImmediate(-imm.m_value)) {
+            m_assembler.addlImm8r(-imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.sublRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        m_assembler.sublRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorlRegReg(src, dest);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID srcDest)
+    {
+        if ((srcDest != SH4Registers::r0) || (imm.m_value > 255) || (imm.m_value < 0)) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant((imm.m_value), scr);
+            m_assembler.xorlRegReg(scr, srcDest);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.xorlImm8r(imm.m_value, srcDest);
+    }
+
+    void compare32(int imm, RegisterID dst, Condition cond)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && (dst == SH4Registers::r0) && m_assembler.isImmediate(imm)) {
+            m_assembler.cmpEqImmR0(imm, dst, cond);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm, scr);
+        m_assembler.cmplRegReg(scr, dst, cond);
+        releaseScratch(scr);
+    }
+
+    void compare32(int offset, RegisterID base, RegisterID left, Condition cond)
+    {
+        RegisterID scr = claimScratch();
+        if (!offset) {
+            m_assembler.movlMemReg(base, scr);
+            m_assembler.cmplRegReg(scr, left, cond);
+            releaseScratch(scr);
+            return;
+        }
+
+        if ((offset < 0) || (offset >= 64)) {
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+            m_assembler.cmplRegReg(scr, left, cond);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.movlMemReg(offset >> 2, base, scr);
+        m_assembler.cmplRegReg(scr, left, cond);
+        releaseScratch(scr);
+    }
+
+    void testImm(int imm, int offset, RegisterID base)
+    {
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+
+        if ((offset < 0) || (offset >= 64)) {
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+        } else if (offset)
+            m_assembler.movlMemReg(offset >> 2, base, scr);
+        else
+            m_assembler.movlMemReg(base, scr);
+        if (m_assembler.isImmediate(imm))
+            m_assembler.movImm8(imm, scr1);
+        else
+            m_assembler.loadConstant(imm, scr1);
+
+        m_assembler.testlRegReg(scr, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void testlImm(int imm, RegisterID dst)
+    {
+        if ((dst == SH4Registers::r0) && (imm <= 255) && (imm >= 0)) {
+            m_assembler.testlImm8r(imm, dst);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm, scr);
+        m_assembler.testlRegReg(scr, dst);
+        releaseScratch(scr);
+    }
+
+    void compare32(RegisterID right, int offset, RegisterID base, Condition cond)
+    {
+        if (!offset) {
+            RegisterID scr = claimScratch();
+            m_assembler.movlMemReg(base, scr);
+            m_assembler.cmplRegReg(right, scr, cond);
+            releaseScratch(scr);
+            return;
+        }
+
+        if ((offset < 0) || (offset >= 64)) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+            m_assembler.cmplRegReg(right, scr, cond);
+            releaseScratch(scr);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.movlMemReg(offset >> 2, base, scr);
+        m_assembler.cmplRegReg(right, scr, cond);
+        releaseScratch(scr);
+    }
+
+    void compare32(int imm, int offset, RegisterID base, Condition cond)
+    {
+        if (!offset) {
+            RegisterID scr = claimScratch();
+            RegisterID scr1 = claimScratch();
+            m_assembler.movlMemReg(base, scr);
+            m_assembler.loadConstant(imm, scr1);
+            m_assembler.cmplRegReg(scr1, scr, cond);
+            releaseScratch(scr1);
+            releaseScratch(scr);
+            return;
+        }
+
+        if ((offset < 0) || (offset >= 64)) {
+            RegisterID scr = claimScratch();
+            RegisterID scr1 = claimScratch();
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+            m_assembler.loadConstant(imm, scr1);
+            m_assembler.cmplRegReg(scr1, scr, cond);
+            releaseScratch(scr1);
+            releaseScratch(scr);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+        m_assembler.movlMemReg(offset >> 2, base, scr);
+        m_assembler.loadConstant(imm, scr1);
+        m_assembler.cmplRegReg(scr1, scr, cond);
+        releaseScratch(scr1);
+        releaseScratch(scr);
+    }
+
+    // Memory access operation
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        load32(address.base, address.offset, dest);
+    }
+
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        load8(address.base, address.offset, dest);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        load32(scr, address.offset, dest);
+        releaseScratch(scr);
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address), dest);
+        m_assembler.movlMemReg(dest, dest);
+    }
+
+    void load32(RegisterID base, int offset, RegisterID dest)
+    {
+        if (!offset) {
+            m_assembler.movlMemReg(base, dest);
+            return;
+        }
+
+        if ((offset >= 0) && (offset < 64)) {
+            m_assembler.movlMemReg(offset >> 2, base, dest);
+            return;
+        }
+
+        if ((dest == SH4Registers::r0) && (dest != base)) {
+            m_assembler.loadConstant((offset), dest);
+            m_assembler.movlR0mr(base, dest);
+            return;
+        }
+
+        RegisterID scr;
+        if (dest == base)
+            scr = claimScratch();
+        else
+            scr = dest;
+        m_assembler.loadConstant((offset), scr);
+        m_assembler.addlRegReg(base, scr);
+        m_assembler.movlMemReg(scr, dest);
+
+        if (dest == base)
+            releaseScratch(scr);
+    }
+
+    void load8(RegisterID base, int offset, RegisterID dest)
+    {
+        if (!offset) {
+            m_assembler.movbMemReg(base, dest);
+            return;
+        }
+
+        if ((offset > 0) && (offset < 64) && (dest == SH4Registers::r0)) {
+            m_assembler.movbMemReg(offset, base, dest);
+            return;
+        }
+
+        if (base != dest) {
+            m_assembler.loadConstant((offset), dest);
+            m_assembler.addlRegReg(base, dest);
+            m_assembler.movbMemReg(dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant((offset), scr);
+        m_assembler.addlRegReg(base, scr);
+        m_assembler.movbMemReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void load32(RegisterID r0, RegisterID src, RegisterID dst)
+    {
+        ASSERT(r0 == SH4Registers::r0);
+        m_assembler.movlR0mr(src, dst);
+    }
+
+    void load32(RegisterID src, RegisterID dst)
+    {
+        m_assembler.movlMemReg(src, dst);
+    }
+
+    void load16(ImplicitAddress address, RegisterID dest)
+    {
+        if (!address.offset) {
+            m_assembler.movwMemReg(address.base, dest);
+            return;
+        }
+
+        if ((address.offset > 0) && (address.offset < 64) && (dest == SH4Registers::r0)) {
+            m_assembler.movwMemReg(address.offset, address.base, dest);
+            return;
+        }
+
+        if (address.base != dest) {
+            m_assembler.loadConstant((address.offset), dest);
+            m_assembler.addlRegReg(address.base, dest);
+            m_assembler.movwMemReg(dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant((address.offset), scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movwMemReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void load16(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movwMemReg(src, dest);
+    }
+
+    void load16(RegisterID r0, RegisterID src, RegisterID dest)
+    {
+        ASSERT(r0 == SH4Registers::r0);
+        m_assembler.movwR0mr(src, dest);
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+
+        if (address.offset)
+            add32(TrustedImm32(address.offset), scr);
+        if (scr == SH4Registers::r0)
+            m_assembler.movwR0mr(address.base, scr);
+        else {
+            add32(address.base, scr);
+            load16(scr, scr);
+        }
+
+        extuw(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        store32(src, address.offset, address.base, scr);
+        releaseScratch(scr);
+    }
+
+    void store32(RegisterID src, int offset, RegisterID base, RegisterID scr)
+    {
+        if (!offset) {
+            m_assembler.movlRegMem(src, base);
+            return;
+        }
+
+        if ((offset >=0) && (offset < 64)) {
+            m_assembler.movlRegMem(src, offset >> 2, base);
+            return;
+        }
+
+        m_assembler.loadConstant((offset), scr);
+        if (scr == SH4Registers::r0) {
+            m_assembler.movlRegMemr0(src, base);
+            return;
+        }
+
+        m_assembler.addlRegReg(base, scr);
+        m_assembler.movlRegMem(src, scr);
+    }
+
+    void store32(RegisterID src, RegisterID offset, RegisterID base)
+    {
+        ASSERT(offset == SH4Registers::r0);
+        m_assembler.movlRegMemr0(src, base);
+    }
+
+    void store32(RegisterID src, RegisterID dst)
+    {
+        m_assembler.movlRegMem(src, dst);
+    }
+
+    void store32(TrustedImm32 imm, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+        m_assembler.loadConstant((imm.m_value), scr);
+        store32(scr, address.offset, address.base, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        store32(src, Address(scr, address.offset));
+
+        releaseScratch(scr);
+    }
+
+    void store32(TrustedImm32 imm, void* address)
+    {
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+        m_assembler.loadConstant((imm.m_value), scr);
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address), scr1);
+        m_assembler.movlMemReg(scr, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address), scr);
+        m_assembler.movlMemReg(src, scr);
+        releaseScratch(scr);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        DataLabel32 label(this);
+        m_assembler.loadConstantUnReusable(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movlMemReg(scr, dest);
+        releaseScratch(scr);
+        return label;
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        RegisterID scr = claimScratch();
+        DataLabel32 label(this);
+        m_assembler.loadConstantUnReusable(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movlRegMem(src, scr);
+        releaseScratch(scr);
+        return label;
+    }
+
+     // Floating-point operations
+
+    bool supportsFloatingPoint() const { return true; }
+    bool supportsFloatingPointTruncate() const { return true; }
+    bool supportsFloatingPointSqrt() const { return true; }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstant(address.offset, scr);
+        if (address.base == SH4Registers::r0) {
+            m_assembler.fmovsReadr0r(scr, (FPRegisterID)(dest + 1));
+            m_assembler.addlImm8r(4, scr);
+            m_assembler.fmovsReadr0r(scr, dest);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.fmovsReadrminc(scr, (FPRegisterID)(dest + 1));
+        m_assembler.fmovsReadrm(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void loadDouble(const void* address, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address), scr);
+        m_assembler.fmovsReadrminc(scr, (FPRegisterID)(dest + 1));
+        m_assembler.fmovsReadrm(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.fmovsWriterm((FPRegisterID)(src + 1), scr);
+        m_assembler.addlImm8r(4, scr);
+        m_assembler.fmovsWriterm(src, scr);
+        releaseScratch(scr);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.daddRegReg(src, dest);
+    }
+
+    void addDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        addDouble(fscratch, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.dsubRegReg(src, dest);
+    }
+
+    void subDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        subDouble(fscratch, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.dmulRegReg(src, dest);
+    }
+
+    void mulDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        mulDouble(fscratch, dest);
+    }
+
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.ddivRegReg(src, dest);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.ldsrmfpul(src);
+        m_assembler.floatfpulDreg(dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(src.m_ptr), scr);
+        convertInt32ToDouble(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        convertInt32ToDouble(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+
+        if (address.offset)
+            add32(TrustedImm32(address.offset), scr);
+
+        RegisterID scr1 = claimScratch();
+        load16(scr, scr1);
+        add32(TrustedImm32(2), scr);
+        load16(scr, dest);
+        move(TrustedImm32(16), scr);
+        m_assembler.shllRegReg(dest, scr);
+        or32(scr1, dest);
+
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
+    {
+        RegisterID scr = scratchReg3;
+        load32WithUnalignedHalfWords(left, scr);
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testlRegReg(scr, scr);
+        else
+            compare32(right.m_value, scr, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.movImm8(0, scratchReg3);
+        convertInt32ToDouble(scratchReg3, scratch);
+        return branchDouble(DoubleNotEqual, reg, scratch);
+    }
+
+    Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.movImm8(0, scratchReg3);
+        convertInt32ToDouble(scratchReg3, scratch);
+        return branchDouble(DoubleEqualOrUnordered, reg, scratch);
+    }
+
+    Jump branchDouble(Condition cond, FPRegisterID left, FPRegisterID right)
+    {
+        if (cond == DoubleEqual) {
+            m_assembler.dcmppeq(right, left);
+            return branchTrue();
+        }
+
+        if (cond == DoubleNotEqual) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 8);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 4);
+            m_assembler.dcmppeq(right, left);
+            releaseScratch(scr);
+            return branchFalse();
+        }
+
+        if (cond == DoubleGreaterThan) {
+            m_assembler.dcmppgt(right, left);
+            return branchTrue();
+        }
+
+        if (cond == DoubleGreaterThanOrEqual) {
+            m_assembler.dcmppgt(left, right);
+            return branchFalse();
+        }
+
+        if (cond == DoubleLessThan) {
+            m_assembler.dcmppgt(left, right);
+            return branchTrue();
+        }
+
+        if (cond == DoubleLessThanOrEqual) {
+            m_assembler.dcmppgt(right, left);
+            return branchFalse();
+        }
+
+        if (cond == DoubleEqualOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppeq(left, right);
+            releaseScratch(scr);
+            return branchTrue();
+        }
+
+        if (cond == DoubleGreaterThanOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppgt(right, left);
+            releaseScratch(scr);
+            return branchTrue();
+        }
+
+        if (cond == DoubleGreaterThanOrEqualOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppgt(left, right);
+            releaseScratch(scr);
+            return branchFalse();
+        }
+
+        if (cond == DoubleLessThanOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppgt(left, right);
+            releaseScratch(scr);
+            return branchTrue();
+        }
+
+        if (cond == DoubleLessThanOrEqualOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppgt(right, left);
+            releaseScratch(scr);
+            return branchFalse();
+        }
+
+        ASSERT(cond == DoubleNotEqualOrUnordered);
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+        m_assembler.dcnvds(right);
+        m_assembler.stsfpulReg(scr);
+        m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+        m_assembler.branch(BT_OPCODE, 5);
+        m_assembler.dcnvds(left);
+        m_assembler.stsfpulReg(scr);
+        m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+        m_assembler.branch(BT_OPCODE, 1);
+        m_assembler.dcmppeq(right, left);
+        releaseScratch(scr);
+        return branchFalse();
+    }
+
+    Jump branchTrue()
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 6, sizeof(uint32_t));
+        Jump m_jump = Jump(m_assembler.je());
+        m_assembler.loadConstantUnReusable(0x0, scratchReg3);
+        m_assembler.nop();
+        m_assembler.nop();
+        return m_jump;
+    }
+
+    Jump branchFalse()
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 6, sizeof(uint32_t));
+        Jump m_jump = Jump(m_assembler.jne());
+        m_assembler.loadConstantUnReusable(0x0, scratchReg3);
+        m_assembler.nop();
+        m_assembler.nop();
+        return m_jump;
+    }
+
+    void set8Compare32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        set32Compare32(cond, left, right, dest);
+    }
+
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (left != dest) {
+            m_assembler.loadConstant(right.m_value, dest);
+            set32Compare32(cond, left, dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(right.m_value, scr);
+        set32Compare32(cond, left, scr, dest);
+        releaseScratch(scr);
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
+    {
+        RegisterID scr = claimScratch();
+        move(left.index, scr);
+        lshift32(TrustedImm32(left.scale), scr);
+        add32(left.base, scr);
+        load32(scr, left.offset, scr);
+        compare32(right.m_value, scr, cond);
+        releaseScratch(scr);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    void sqrtDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        if (dest != src)
+            m_assembler.dmovRegReg(src, dest);
+        m_assembler.dsqrt(dest);
+    }
+
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        RegisterID addressTempRegister = claimScratch();
+        load8(address, addressTempRegister);
+        Jump jmp = branchTest32(cond, addressTempRegister, mask);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+    }
+
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
+    {
+        RegisterID addressTempRegister = claimScratch();
+        load8(left, addressTempRegister);
+        Jump jmp = branch32(cond, addressTempRegister, right);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.ftrcdrmfpul(src);
+        m_assembler.stsfpulReg(dest);
+        m_assembler.loadConstant(0x7fffffff, scratchReg3);
+        m_assembler.cmplRegReg(dest, scratchReg3, Equal);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 14, sizeof(uint32_t));
+        m_assembler.branch(BT_OPCODE, 2);
+        m_assembler.addlImm8r(1, scratchReg3);
+        m_assembler.cmplRegReg(dest, scratchReg3, Equal);
+        return branchTrue();
+    }
+
+    // Stack manipulation operations
+
+    void pop(RegisterID dest)
+    {
+        m_assembler.popReg(dest);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.pushReg(src);
+    }
+
+    void push(Address address)
+    {
+        if (!address.offset) {
+            push(address.base);
+            return;
+        }
+
+        if ((address.offset < 0) || (address.offset >= 64)) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(address.offset, scr);
+            m_assembler.addlRegReg(address.base, scr);
+            m_assembler.movlMemReg(scr, SH4Registers::sp);
+            m_assembler.addlImm8r(-4, SH4Registers::sp);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.movlMemReg(address.offset >> 2, address.base, SH4Registers::sp);
+        m_assembler.addlImm8r(-4, SH4Registers::sp);
+    }
+
+    void push(TrustedImm32 imm)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        push(scr);
+        releaseScratch(scr);
+    }
+
+    // Register move operations
+
+    void move(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.loadConstant(imm.m_value, dest);
+    }
+
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
+    {
+        DataLabelPtr dataLabel(this);
+        m_assembler.loadConstantUnReusable(reinterpret_cast<uint32_t>(initialValue.m_value), dest, true);
+        return dataLabel;
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movlRegReg(src, dest);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        m_assembler.loadConstant(imm.asIntptr(), dest);
+    }
+
+    void extuw(RegisterID src, RegisterID dst)
+    {
+        m_assembler.extuw(src, dst);
+    }
+
+    void set32Compare32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmplRegReg(right, left, cond);
+        if (cond != NotEqual) {
+            m_assembler.movt(dest);
+            return;
+        }
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.movImm8(0, dest);
+        m_assembler.branch(BT_OPCODE, 0);
+        m_assembler.movImm8(1, dest);
+    }
+
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (left != dest) {
+            move(right, dest);
+            set32Compare32(cond, left, dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        move(right, scr);
+        set32Compare32(cond, left, scr, dest);
+        releaseScratch(scr);
+    }
+
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        load8(address, dest);
+        if (mask.m_value == -1)
+            compare32(0, dest, cond);
+        else
+            testlImm(mask.m_value, dest);
+        if (cond != NonZero) {
+            m_assembler.movt(dest);
+            return;
+        }
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.movImm8(0, dest);
+        m_assembler.branch(BT_OPCODE, 0);
+        m_assembler.movImm8(1, dest);
+    }
+
+    void loadPtrLinkReg(ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        load32(address, scr);
+        m_assembler.ldspr(scr);
+        releaseScratch(scr);
+    }
+
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmplRegReg(right, left, cond);
+        /* BT label => BF off
+           nop         LDR reg
+           nop         braf @reg
+           nop         nop
+         */
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testlRegReg(left, left);
+        else
+            compare32(right.m_value, left, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        compare32(right.offset, right.base, left, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        compare32(right, left.offset, left.base, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
+    {
+        compare32(right.m_value, left.offset, left.base, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        RegisterID scr = claimScratch();
+
+        move(TrustedImm32(reinterpret_cast<uint32_t>(left.m_ptr)), scr);
+        m_assembler.cmplRegReg(right, scr, cond);
+        releaseScratch(scr);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        RegisterID addressTempRegister = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(left.m_ptr), addressTempRegister);
+        m_assembler.movlMemReg(addressTempRegister, addressTempRegister);
+        compare32(right.m_value, addressTempRegister, cond);
+        releaseScratch(addressTempRegister);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch16(Condition cond,  BaseIndex left, RegisterID right)
+    {
+        RegisterID scr = claimScratch();
+
+        move(left.index, scr);
+        lshift32(TrustedImm32(left.scale), scr);
+
+        if (left.offset)
+            add32(TrustedImm32(left.offset), scr);
+        add32(left.base, scr);
+        load16(scr, scr);
+        extuw(scr, scr);
+        releaseScratch(scr);
+
+        return branch32(cond, scr, right);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
+    {
+        RegisterID scr = claimScratch();
+
+        move(left.index, scr);
+        lshift32(TrustedImm32(left.scale), scr);
+
+        if (left.offset)
+            add32(TrustedImm32(left.offset), scr);
+        add32(left.base, scr);
+        load16(scr, scr);
+        extuw(scr, scr);
+        RegisterID scr1 = claimScratch();
+        m_assembler.loadConstant(right.m_value, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+
+        return branch32(cond, scr, scr1);
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        m_assembler.testlRegReg(reg, mask);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        if (mask.m_value == -1)
+            m_assembler.testlRegReg(reg, reg);
+        else
+            testlImm(mask.m_value, reg);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        if (mask.m_value == -1)
+            compare32(0, address.offset, address.base, cond);
+        else
+            testImm(mask.m_value, address.offset, address.base);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        load32(scr, address.offset, scr);
+
+        if (mask.m_value == -1)
+            m_assembler.testlRegReg(scr, scr);
+        else
+            testlImm(mask.m_value, scr);
+
+        releaseScratch(scr);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump jump()
+    {
+        return Jump(m_assembler.jmp());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jmpReg(target);
+    }
+
+    void jump(Address address)
+    {
+        RegisterID scr = claimScratch();
+
+        if ((address.offset < 0) || (address.offset >= 64)) {
+            m_assembler.loadConstant(address.offset, scr);
+            m_assembler.addlRegReg(address.base, scr);
+            m_assembler.movlMemReg(scr, scr);
+        } else if (address.offset)
+            m_assembler.movlMemReg(address.offset >> 2, address.base, scr);
+        else
+            m_assembler.movlMemReg(address.base, scr);
+        m_assembler.jmpReg(scr);
+
+        releaseScratch(scr);
+    }
+
+    // Arithmetic control flow operations
+
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            m_assembler.addvlRegReg(src, dest);
+            return branchTrue();
+        }
+
+        if (cond == Signed) {
+            m_assembler.addlRegReg(src, dest);
+            // Check if dest is negative
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        m_assembler.addlRegReg(src, dest);
+        compare32(0, dest, Equal);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        move(imm, scratchReg3);
+        return branchAdd32(cond, scratchReg3, dest);
+    }
+
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            RegisterID scr1 = claimScratch();
+            RegisterID scr = claimScratch();
+            m_assembler.dmullRegReg(src, dest);
+            m_assembler.stsmacl(dest);
+            m_assembler.movImm8(-31, scr);
+            m_assembler.movlRegReg(dest, scr1);
+            m_assembler.shaRegReg(scr1, scr);
+            m_assembler.stsmach(scr);
+            m_assembler.cmplRegReg(scr, scr1, Zero);
+            releaseScratch(scr1);
+            releaseScratch(scr);
+            return branchFalse();
+        }
+
+        m_assembler.imullRegReg(src, dest);
+        m_assembler.stsmacl(dest);
+        if (cond == Signed) {
+            // Check if dest is negative
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        compare32(0, dest, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        move(imm, scratchReg3);
+        if (src != dest)
+            move(src, dest);
+
+        return branchMul32(cond, scratchReg3, dest);
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            m_assembler.subvlRegReg(src, dest);
+            return branchTrue();
+        }
+
+        if (cond == Signed) {
+            // Check if dest is negative
+            m_assembler.sublRegReg(src, dest);
+            compare32(0, dest, LessThan);
+            return branchTrue();
+        }
+
+        sub32(src, dest);
+        compare32(0, dest, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        move(imm, scratchReg3);
+        return branchSub32(cond, scratchReg3, dest);
+    }
+
+    Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Signed) {
+            or32(src, dest);
+            compare32(0, dest, LessThan);
+            return branchTrue();
+        }
+
+        or32(src, dest);
+        compare32(0, dest, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        m_assembler.ftrcdrmfpul(src);
+        m_assembler.stsfpulReg(dest);
+        convertInt32ToDouble(dest, fscratch);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, fscratch, src));
+
+        if (dest == SH4Registers::r0)
+            m_assembler.cmpEqImmR0(0, dest, Equal);
+        else {
+            m_assembler.movImm8(0, scratchReg3);
+            m_assembler.cmplRegReg(scratchReg3, dest, Equal);
+        }
+        failureCases.append(branchTrue());
+    }
+
+    void neg32(RegisterID dst)
+    {
+        m_assembler.neg(dst, dst);
+    }
+
+    void not32(RegisterID dst)
+    {
+        m_assembler.notlReg(dst, dst);
+    }
+
+    void urshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        compare32(32, shiftamount, Equal);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.branch(BT_OPCODE, 1);
+        m_assembler.neg(shiftamount, shiftamount);
+        m_assembler.shllRegReg(dest, shiftamount);
+    }
+
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(-(imm.m_value), scr);
+        m_assembler.shaRegReg(dest, scr);
+        releaseScratch(scr);
+    }
+
+    Call call()
+    {
+        return Call(m_assembler.call(), Call::Linkable);
+    }
+
+    Call nearCall()
+    {
+        return Call(m_assembler.call(), Call::LinkableNear);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.call(target), Call::None);
+    }
+
+    void call(Address address, RegisterID target)
+    {
+        load32(address.base, address.offset, target);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 2);
+        m_assembler.branch(JSR_OPCODE, target);
+        m_assembler.nop();
+    }
+
+    void breakpoint()
+    {
+        m_assembler.bkpt();
+        m_assembler.nop();
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        RegisterID dataTempRegister = claimScratch();
+
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        m_assembler.cmplRegReg(dataTempRegister, left, cond);
+        releaseScratch(dataTempRegister);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstant(left.offset, scr);
+        m_assembler.addlRegReg(left.base, scr);
+        m_assembler.movlMemReg(scr, scr);
+        RegisterID scr1 = claimScratch();
+        dataLabel = moveWithPatch(initialRightValue, scr1);
+        m_assembler.cmplRegReg(scr1, scr, cond);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    void ret()
+    {
+        m_assembler.ret();
+        m_assembler.nop();
+    }
+
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        DataLabelPtr label = moveWithPatch(initialValue, scr);
+        store32(scr, address);
+        releaseScratch(scr);
+        return label;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(TrustedImmPtr(0), address); }
+
+    int sizeOfConstantPool()
+    {
+        return m_assembler.sizeOfConstantPool();
+    }
+
+    Call tailRecursiveCall()
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstantUnReusable(0x0, scr, true);
+        Jump m_jump = Jump(m_assembler.jmp(scr));
+        releaseScratch(scr);
+
+        return Call::fromTailJump(m_jump);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+private:
+    friend class LinkBuffer;
+    friend class RepatchBuffer;
+
+    static void linkCall(void*, Call, FunctionPtr);
+    static void repatchCall(CodeLocationCall, CodeLocationLabel);
+    static void repatchCall(CodeLocationCall, FunctionPtr);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerSH4_h
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index f5829dd..027a4ce 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -1004,7 +1004,7 @@ public:
         return branchAdd32(cond, src1, dest);
     }
 
-    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
+    Jump branchAdd32(Condition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
     {
         move(src, dest);
         return branchAdd32(cond, imm, dest);
@@ -1083,6 +1083,12 @@ public:
         return branchSub32(cond, src2, dest);
     }
 
+    Jump branchSub32(Condition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest)
+    {
+        move(src1, dest);
+        return branchSub32(cond, src2, dest);
+    }
+
     Jump branchNeg32(Condition cond, RegisterID srcDest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index bd417aa..30c717f 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -197,6 +197,24 @@ public:
         m_assembler.orq_ir(imm.m_value, dest);
     }
 
+    void orPtr(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            move(op1, dest);
+        else if (op1 == dest)
+            orPtr(op2, dest);
+        else {
+            move(op2, dest);
+            orPtr(op1, dest);
+        }
+    }
+
+    void orPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        orPtr(imm, dest);
+    }
+
     void subPtr(RegisterID src, RegisterID dest)
     {
         m_assembler.subq_rr(src, dest);
diff --git a/Source/JavaScriptCore/assembler/SH4Assembler.h b/Source/JavaScriptCore/assembler/SH4Assembler.h
new file mode 100644
index 0000000..5726ae8
--- /dev/null
+++ b/Source/JavaScriptCore/assembler/SH4Assembler.h
@@ -0,0 +1,2067 @@
+/*
+ * Copyright (C) 2009-2011 STMicroelectronics. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SH4Assembler_h
+#define SH4Assembler_h
+
+#if ENABLE(ASSEMBLER) && CPU(SH4)
+
+#include "AssemblerBuffer.h"
+#include "AssemblerBufferWithConstantPool.h"
+#include <stdarg.h>
+#include <stdint.h>
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+
+#ifndef NDEBUG
+#define SH4_ASSEMBLER_TRACING
+#endif
+
+namespace JSC {
+typedef uint16_t SH4Word;
+
+enum {
+    INVALID_OPCODE = 0xffff,
+    ADD_OPCODE = 0x300c,
+    ADDIMM_OPCODE = 0x7000,
+    ADDC_OPCODE = 0x300e,
+    ADDV_OPCODE = 0x300f,
+    AND_OPCODE = 0x2009,
+    ANDIMM_OPCODE = 0xc900,
+    DIV0_OPCODE = 0x2007,
+    DIV1_OPCODE = 0x3004,
+    BF_OPCODE = 0x8b00,
+    BFS_OPCODE = 0x8f00,
+    BRA_OPCODE = 0xa000,
+    BRAF_OPCODE = 0x0023,
+    NOP_OPCODE = 0x0009,
+    BSR_OPCODE = 0xb000,
+    RTS_OPCODE = 0x000b,
+    BT_OPCODE = 0x8900,
+    BTS_OPCODE = 0x8d00,
+    BSRF_OPCODE = 0x0003,
+    BRK_OPCODE = 0x003b,
+    FTRC_OPCODE = 0xf03d,
+    CMPEQ_OPCODE = 0x3000,
+    CMPEQIMM_OPCODE = 0x8800,
+    CMPGE_OPCODE = 0x3003,
+    CMPGT_OPCODE = 0x3007,
+    CMPHI_OPCODE = 0x3006,
+    CMPHS_OPCODE = 0x3002,
+    CMPPL_OPCODE = 0x4015,
+    CMPPZ_OPCODE = 0x4011,
+    CMPSTR_OPCODE = 0x200c,
+    DT_OPCODE = 0x4010,
+    FCMPEQ_OPCODE = 0xf004,
+    FCMPGT_OPCODE = 0xf005,
+    FMOV_OPCODE = 0xf00c,
+    FADD_OPCODE = 0xf000,
+    FMUL_OPCODE = 0xf002,
+    FSUB_OPCODE = 0xf001,
+    FDIV_OPCODE = 0xf003,
+    FNEG_OPCODE = 0xf04d,
+    JMP_OPCODE = 0x402b,
+    JSR_OPCODE = 0x400b,
+    LDSPR_OPCODE = 0x402a,
+    LDSLPR_OPCODE = 0x4026,
+    MOV_OPCODE = 0x6003,
+    MOVIMM_OPCODE = 0xe000,
+    MOVB_WRITE_RN_OPCODE = 0x2000,
+    MOVB_WRITE_RNDEC_OPCODE = 0x2004,
+    MOVB_WRITE_R0RN_OPCODE = 0x0004,
+    MOVB_WRITE_OFFGBR_OPCODE = 0xc000,
+    MOVB_WRITE_OFFRN_OPCODE = 0x8000,
+    MOVB_READ_RM_OPCODE = 0x6000,
+    MOVB_READ_RMINC_OPCODE = 0x6004,
+    MOVB_READ_R0RM_OPCODE = 0x000c,
+    MOVB_READ_OFFGBR_OPCODE = 0xc400,
+    MOVB_READ_OFFRM_OPCODE = 0x8400,
+    MOVL_WRITE_RN_OPCODE = 0x2002,
+    MOVL_WRITE_RNDEC_OPCODE = 0x2006,
+    MOVL_WRITE_R0RN_OPCODE = 0x0006,
+    MOVL_WRITE_OFFGBR_OPCODE = 0xc200,
+    MOVL_WRITE_OFFRN_OPCODE = 0x1000,
+    MOVL_READ_RM_OPCODE = 0x6002,
+    MOVL_READ_RMINC_OPCODE = 0x6006,
+    MOVL_READ_R0RM_OPCODE = 0x000e,
+    MOVL_READ_OFFGBR_OPCODE = 0xc600,
+    MOVL_READ_OFFPC_OPCODE = 0xd000,
+    MOVL_READ_OFFRM_OPCODE = 0x5000,
+    MOVW_WRITE_RN_OPCODE = 0x2001,
+    MOVW_READ_RM_OPCODE = 0x6001,
+    MOVW_READ_R0RM_OPCODE = 0x000d,
+    MOVW_READ_OFFRM_OPCODE = 0x8500,
+    MOVW_READ_OFFPC_OPCODE = 0x9000,
+    MOVA_READ_OFFPC_OPCODE = 0xc700,
+    MOVT_OPCODE = 0x0029,
+    MULL_OPCODE = 0x0007,
+    DMULL_L_OPCODE = 0x3005,
+    STSMACL_OPCODE = 0x001a,
+    STSMACH_OPCODE = 0x000a,
+    DMULSL_OPCODE = 0x300d,
+    NEG_OPCODE = 0x600b,
+    NEGC_OPCODE = 0x600a,
+    NOT_OPCODE = 0x6007,
+    OR_OPCODE = 0x200b,
+    ORIMM_OPCODE = 0xcb00,
+    ORBIMM_OPCODE = 0xcf00,
+    SETS_OPCODE = 0x0058,
+    SETT_OPCODE = 0x0018,
+    SHAD_OPCODE = 0x400c,
+    SHAL_OPCODE = 0x4020,
+    SHAR_OPCODE = 0x4021,
+    SHLD_OPCODE = 0x400d,
+    SHLL_OPCODE = 0x4000,
+    SHLL2_OPCODE = 0x4008,
+    SHLL8_OPCODE = 0x4018,
+    SHLL16_OPCODE = 0x4028,
+    SHLR_OPCODE = 0x4001,
+    SHLR2_OPCODE = 0x4009,
+    SHLR8_OPCODE = 0x4019,
+    SHLR16_OPCODE = 0x4029,
+    STSPR_OPCODE = 0x002a,
+    STSLPR_OPCODE = 0x4022,
+    FLOAT_OPCODE = 0xf02d,
+    SUB_OPCODE = 0x3008,
+    SUBC_OPCODE = 0x300a,
+    SUBV_OPCODE = 0x300b,
+    TST_OPCODE = 0x2008,
+    TSTIMM_OPCODE = 0xc800,
+    TSTB_OPCODE = 0xcc00,
+    EXTUW_OPCODE = 0x600d,
+    XOR_OPCODE = 0x200a,
+    XORIMM_OPCODE = 0xca00,
+    XORB_OPCODE = 0xce00,
+    FMOVS_READ_RM_INC_OPCODE = 0xf009,
+    FMOVS_READ_RM_OPCODE = 0xf008,
+    FMOVS_READ_R0RM_OPCODE = 0xf006,
+    FMOVS_WRITE_RN_OPCODE = 0xf00a,
+    FMOVS_WRITE_RN_DEC_OPCODE = 0xf00b,
+    FMOVS_WRITE_R0RN_OPCODE = 0xf007,
+    FCNVDS_DRM_FPUL_OPCODE = 0xf0bd,
+    LDS_RM_FPUL_OPCODE = 0x405a,
+    FLDS_FRM_FPUL_OPCODE = 0xf01d,
+    STS_FPUL_RN_OPCODE = 0x005a,
+    FSTS_FPUL_FRN_OPCODE = 0xF00d,
+    LDSFPSCR_OPCODE = 0x406a,
+    STSFPSCR_OPCODE = 0x006a,
+    LDSRMFPUL_OPCODE = 0x405a,
+    FSTSFPULFRN_OPCODE = 0xf00d,
+    FSQRT_OPCODE = 0xf06d,
+    FSCHG_OPCODE = 0xf3fd,
+    CLRT_OPCODE = 8,
+};
+
+namespace SH4Registers {
+typedef enum {
+    r0,
+    r1,
+    r2,
+    r3,
+    r4,
+    r5,
+    r6,
+    r7,
+    r8,
+    r9,
+    r10,
+    r11,
+    r12,
+    r13,
+    r14, fp = r14,
+    r15, sp = r15,
+    pc,
+    pr,
+} RegisterID;
+
+typedef enum {
+    fr0, dr0 = fr0,
+    fr1,
+    fr2, dr2 = fr2,
+    fr3,
+    fr4, dr4 = fr4,
+    fr5,
+    fr6, dr6 = fr6,
+    fr7,
+    fr8, dr8 = fr8,
+    fr9,
+    fr10, dr10 = fr10,
+    fr11,
+    fr12, dr12 = fr12,
+    fr13,
+    fr14, dr14 = fr14,
+    fr15,
+} FPRegisterID;
+}
+
+inline uint16_t getOpcodeGroup1(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0xf) << 4));
+}
+
+inline uint16_t getOpcodeGroup2(uint16_t opc, int rm)
+{
+    return (opc | ((rm & 0xf) << 8));
+}
+
+inline uint16_t getOpcodeGroup3(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | (rn & 0xff));
+}
+
+inline uint16_t getOpcodeGroup4(uint16_t opc, int rm, int rn, int offset)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0xf) << 4) | (offset & 0xf));
+}
+
+inline uint16_t getOpcodeGroup5(uint16_t opc, int rm)
+{
+    return (opc | (rm & 0xff));
+}
+
+inline uint16_t getOpcodeGroup6(uint16_t opc, int rm)
+{
+    return (opc | (rm & 0xfff));
+}
+
+inline uint16_t getOpcodeGroup7(uint16_t opc, int rm)
+{
+    return (opc | ((rm & 0x7) << 9));
+}
+
+inline uint16_t getOpcodeGroup8(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0x7) << 9) | ((rn & 0x7) << 5));
+}
+
+inline uint16_t getOpcodeGroup9(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0x7) << 5));
+}
+
+inline uint16_t getOpcodeGroup10(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0x7) << 9) | ((rn & 0xf) << 4));
+}
+
+inline uint16_t getOpcodeGroup11(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 4) | (rn & 0xf));
+}
+
+inline uint16_t getRn(uint16_t x)
+{
+    return ((x & 0xf00) >> 8);
+}
+
+inline uint16_t getRm(uint16_t x)
+{
+    return ((x & 0xf0) >> 4);
+}
+
+inline uint16_t getDisp(uint16_t x)
+{
+    return (x & 0xf);
+}
+
+inline uint16_t getImm8(uint16_t x)
+{
+    return (x & 0xff);
+}
+
+inline uint16_t getImm12(uint16_t x)
+{
+    return (x & 0xfff);
+}
+
+inline uint16_t getDRn(uint16_t x)
+{
+    return ((x & 0xe00) >> 9);
+}
+
+inline uint16_t getDRm(uint16_t x)
+{
+    return ((x & 0xe0) >> 5);
+}
+
+class SH4Assembler {
+public:
+    typedef SH4Registers::RegisterID RegisterID;
+    typedef SH4Registers::FPRegisterID FPRegisterID;
+    typedef AssemblerBufferWithConstantPool<512, 4, 2, SH4Assembler> SH4Buffer;
+    static const RegisterID scratchReg1 = SH4Registers::r3;
+    static const RegisterID scratchReg2 = SH4Registers::r11;
+    static const uint32_t maxInstructionSize = 16;
+
+    enum {
+        padForAlign8 = 0x00,
+        padForAlign16 = 0x0009,
+        padForAlign32 = 0x00090009,
+    };
+
+    SH4Assembler()
+    {
+        m_claimscratchReg = 0x0;
+    }
+
+    // SH4 condition codes
+    typedef enum {
+        EQ = 0x0, // Equal
+        NE = 0x1, // Not Equal
+        HS = 0x2, // Unsigend Greater Than equal
+        HI = 0x3, // Unsigend Greater Than
+        LS = 0x4, // Unsigend Lower or Same
+        LI = 0x5, // Unsigend Lower
+        GE = 0x6, // Greater or Equal
+        LT = 0x7, // Less Than
+        GT = 0x8, // Greater Than
+        LE = 0x9, // Less or Equal
+        OF = 0xa, // OverFlow
+        SI = 0xb, // Signed
+        EQU= 0xc, // Equal or unordered(NaN)
+        NEU= 0xd,
+        GTU= 0xe,
+        GEU= 0xf,
+        LTU= 0x10,
+        LEU= 0x11,
+    } Condition;
+
+    // Opaque label types
+public:
+    class JmpSrc {
+        friend class SH4Assembler;
+    public:
+        JmpSrc()
+            : m_offset(-1)
+        {
+        }
+
+    private:
+        JmpSrc(int offset)
+            : m_offset(offset)
+        {
+        }
+
+        int m_offset;
+    };
+
+    class JmpDst {
+        friend class SH4Assembler;
+    public:
+        JmpDst()
+            : m_offset(-1)
+            , m_used(false)
+        {
+        }
+
+        bool isUsed() const { return m_used; }
+        bool isSet() const { return (m_offset != -1); }
+        void used() { m_used = true; }
+
+    private:
+        JmpDst(int offset)
+            : m_offset(offset)
+            , m_used(false)
+        {
+            ASSERT(m_offset == offset);
+        }
+
+        int m_offset : 31;
+        int m_used : 1;
+    };
+
+    bool isImmediate(int constant)
+    {
+        return ((constant <= 127) && (constant >= -128));
+    }
+
+    RegisterID claimScratch()
+    {
+        ASSERT((m_claimscratchReg != 0x3));
+
+        if (!(m_claimscratchReg & 0x1)) {
+            m_claimscratchReg = (m_claimscratchReg | 0x1);
+            return scratchReg1;
+        }
+
+        m_claimscratchReg = (m_claimscratchReg | 0x2);
+        return scratchReg2;
+    }
+
+    void releaseScratch(RegisterID scratchR)
+    {
+        if (scratchR == scratchReg1)
+            m_claimscratchReg = (m_claimscratchReg & 0x2);
+        else
+            m_claimscratchReg = (m_claimscratchReg & 0x1);
+    }
+
+    // Stack operations
+
+    void pushReg(RegisterID reg)
+    {
+        if (reg == SH4Registers::pr) {
+            oneShortOp(getOpcodeGroup2(STSLPR_OPCODE, SH4Registers::sp));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup1(MOVL_WRITE_RNDEC_OPCODE, SH4Registers::sp, reg));
+    }
+
+    void popReg(RegisterID reg)
+    {
+        if (reg == SH4Registers::pr) {
+            oneShortOp(getOpcodeGroup2(LDSLPR_OPCODE, SH4Registers::sp));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup1(MOVL_READ_RMINC_OPCODE, reg, SH4Registers::sp));
+    }
+
+    void movt(RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(MOVT_OPCODE, dst);
+        oneShortOp(opc);
+    }
+
+    // Arithmetic operations
+
+    void addlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADD_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addclRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADDC_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addvlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADDV_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 127) && (imm8 >= -128));
+
+        uint16_t opc = getOpcodeGroup3(ADDIMM_OPCODE, dst, imm8);
+        oneShortOp(opc);
+    }
+
+    void andlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(AND_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void andlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(ANDIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void div1lRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DIV1_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void div0lRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DIV0_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void notlReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(NOT_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void orlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(OR_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void orlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(ORIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void sublRegReg(RegisterID src, RegisterID dst)
+    {
+         uint16_t opc = getOpcodeGroup1(SUB_OPCODE, dst, src);
+         oneShortOp(opc);
+    }
+
+    void subvlRegReg(RegisterID src, RegisterID dst)
+    {
+         uint16_t opc = getOpcodeGroup1(SUBV_OPCODE, dst, src);
+         oneShortOp(opc);
+    }
+
+    void xorlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(XOR_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void xorlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(XORIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void shllImm8r(int imm, RegisterID dst)
+    {
+        switch (imm) {
+        case 1:
+            oneShortOp(getOpcodeGroup2(SHLL_OPCODE, dst));
+            break;
+        case 2:
+            oneShortOp(getOpcodeGroup2(SHLL2_OPCODE, dst));
+            break;
+        case 8:
+            oneShortOp(getOpcodeGroup2(SHLL8_OPCODE, dst));
+            break;
+        case 16:
+            oneShortOp(getOpcodeGroup2(SHLL16_OPCODE, dst));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void neg(RegisterID dst, RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup1(NEG_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void shllRegReg(RegisterID dst, RegisterID rShift)
+    {
+        uint16_t opc = getOpcodeGroup1(SHLD_OPCODE, dst, rShift);
+        oneShortOp(opc);
+    }
+
+    void shlrRegReg(RegisterID dst, RegisterID rShift)
+    {
+        neg(rShift, rShift);
+        shllRegReg(dst, rShift);
+    }
+
+    void sharRegReg(RegisterID dst, RegisterID rShift)
+    {
+        neg(rShift, rShift);
+        shaRegReg(dst, rShift);
+    }
+
+    void shaRegReg(RegisterID dst, RegisterID rShift)
+    {
+        uint16_t opc = getOpcodeGroup1(SHAD_OPCODE, dst, rShift);
+        oneShortOp(opc);
+    }
+
+    void shlrImm8r(int imm, RegisterID dst)
+    {
+        switch (imm) {
+        case 1:
+            oneShortOp(getOpcodeGroup2(SHLR_OPCODE, dst));
+            break;
+        case 2:
+            oneShortOp(getOpcodeGroup2(SHLR2_OPCODE, dst));
+            break;
+        case 8:
+            oneShortOp(getOpcodeGroup2(SHLR8_OPCODE, dst));
+            break;
+        case 16:
+            oneShortOp(getOpcodeGroup2(SHLR16_OPCODE, dst));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void imullRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MULL_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void dmullRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DMULL_L_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void dmulslRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DMULSL_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void stsmacl(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSMACL_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stsmach(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSMACH_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    // Comparisons
+
+    void cmplRegReg(RegisterID left, RegisterID right, Condition cond)
+    {
+        switch (cond) {
+        case NE:
+            oneShortOp(getOpcodeGroup1(CMPEQ_OPCODE, right, left));
+            break;
+        case GT:
+            oneShortOp(getOpcodeGroup1(CMPGT_OPCODE, right, left));
+            break;
+        case EQ:
+            oneShortOp(getOpcodeGroup1(CMPEQ_OPCODE, right, left));
+            break;
+        case GE:
+            oneShortOp(getOpcodeGroup1(CMPGE_OPCODE, right, left));
+            break;
+        case HS:
+            oneShortOp(getOpcodeGroup1(CMPHS_OPCODE, right, left));
+            break;
+        case HI:
+            oneShortOp(getOpcodeGroup1(CMPHI_OPCODE, right, left));
+            break;
+        case LI:
+            oneShortOp(getOpcodeGroup1(CMPHI_OPCODE, left, right));
+            break;
+        case LS:
+            oneShortOp(getOpcodeGroup1(CMPHS_OPCODE, left, right));
+            break;
+        case LE:
+            oneShortOp(getOpcodeGroup1(CMPGE_OPCODE, left, right));
+            break;
+        case LT:
+            oneShortOp(getOpcodeGroup1(CMPGT_OPCODE, left, right));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void cmppl(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(CMPPL_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void cmppz(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(CMPPZ_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void cmpEqImmR0(int imm, RegisterID dst, Condition cond)
+    {
+        uint16_t opc = getOpcodeGroup5(CMPEQIMM_OPCODE, imm);
+        oneShortOp(opc);
+    }
+
+    void testlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(TST_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void testlImm8r(int imm, RegisterID dst)
+    {
+        ASSERT((dst == SH4Registers::r0) && (imm <= 255) && (imm >= 0));
+
+        uint16_t opc = getOpcodeGroup5(TSTIMM_OPCODE, imm);
+        oneShortOp(opc);
+    }
+
+    void nop()
+    {
+        oneShortOp(NOP_OPCODE, false);
+    }
+
+    void sett()
+    {
+        oneShortOp(SETT_OPCODE);
+    }
+
+    void clrt()
+    {
+        oneShortOp(CLRT_OPCODE);
+    }
+
+    void fschg()
+    {
+        oneShortOp(FSCHG_OPCODE);
+    }
+
+    void bkpt()
+    {
+        oneShortOp(BRK_OPCODE, false);
+    }
+
+    void branch(uint16_t opc, int label)
+    {
+        switch (opc) {
+        case BT_OPCODE:
+            ASSERT((label <= 127) && (label >= -128));
+            oneShortOp(getOpcodeGroup5(BT_OPCODE, label));
+            break;
+        case BRA_OPCODE:
+            ASSERT((label <= 2047) && (label >= -2048));
+            oneShortOp(getOpcodeGroup6(BRA_OPCODE, label));
+            break;
+        case BF_OPCODE:
+            ASSERT((label <= 127) && (label >= -128));
+            oneShortOp(getOpcodeGroup5(BF_OPCODE, label));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void branch(uint16_t opc, RegisterID reg)
+    {
+        switch (opc) {
+        case BRAF_OPCODE:
+            oneShortOp(getOpcodeGroup2(BRAF_OPCODE, reg));
+            break;
+        case JMP_OPCODE:
+            oneShortOp(getOpcodeGroup2(JMP_OPCODE, reg));
+            break;
+        case JSR_OPCODE:
+            oneShortOp(getOpcodeGroup2(JSR_OPCODE, reg));
+            break;
+        case BSRF_OPCODE:
+            oneShortOp(getOpcodeGroup2(BSRF_OPCODE, reg));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void ldspr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(LDSPR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stspr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSPR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void extuw(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(EXTUW_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    // float operations
+
+    void ldsrmfpul(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(LDS_RM_FPUL_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void fneg(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(FNEG_OPCODE, dst);
+        oneShortOp(opc, true, false);
+    }
+
+    void fsqrt(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(FSQRT_OPCODE, dst);
+        oneShortOp(opc, true, false);
+    }
+
+    void stsfpulReg(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(STS_FPUL_RN_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void floatfpulfrn(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FLOAT_OPCODE, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmull(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMUL_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadrm(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriterm(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_RN_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriter0r(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_R0RN_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadr0r(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadrminc(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_RM_INC_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriterndec(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_RN_DEC_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void ftrcRegfpul(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FTRC_OPCODE, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fldsfpul(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FLDS_FRM_FPUL_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void fstsfpul(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FSTS_FPUL_FRN_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void ldsfpscr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(LDSFPSCR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stsfpscr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSFPSCR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    // double operations
+
+    void dcnvds(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FCNVDS_DRM_FPUL_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dcmppeq(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FCMPEQ_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dcmppgt(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FCMPGT_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dmulRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FMUL_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dsubRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FSUB_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void daddRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FADD_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dmovRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FMOV_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void ddivRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FDIV_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dsqrt(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup7(FSQRT_OPCODE, dst >> 1);
+        oneShortOp(opc);
+    }
+
+    void dneg(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup7(FNEG_OPCODE, dst >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovReadrm(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_RM_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovWriterm(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_RN_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovWriter0r(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_R0RN_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovReadr0r(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_R0RM_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovReadrminc(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_RM_INC_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovWriterndec(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_RN_DEC_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void floatfpulDreg(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FLOAT_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void ftrcdrmfpul(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FTRC_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    // Various move ops
+
+    void movImm8(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 127) && (imm8 >= -128));
+
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, imm8);
+        oneShortOp(opc);
+    }
+
+    void movlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOV_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwRegMem(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_WRITE_RN_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwMemReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwPCReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT(base == SH4Registers::pc);
+        ASSERT((offset <= 255) && (offset >= 0));
+
+        uint16_t opc = getOpcodeGroup3(MOVW_READ_OFFPC_OPCODE, dst, offset);
+        oneShortOp(opc);
+    }
+
+    void movwMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup11(MOVW_READ_OFFRM_OPCODE, base, offset);
+        oneShortOp(opc);
+    }
+
+    void movwR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlRegMem(RegisterID src, int offset, RegisterID base)
+    {
+        ASSERT((offset <= 15) && (offset >= 0));
+
+        if (!offset) {
+            oneShortOp(getOpcodeGroup1(MOVL_WRITE_RN_OPCODE, base, src));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup4(MOVL_WRITE_OFFRN_OPCODE, base, src, offset));
+    }
+
+    void movlRegMem(RegisterID src, RegisterID base)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_WRITE_RN_OPCODE, base, src);
+        oneShortOp(opc);
+    }
+
+    void movlMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        if (base == SH4Registers::pc) {
+            ASSERT((offset <= 255) && (offset >= 0));
+            oneShortOp(getOpcodeGroup3(MOVL_READ_OFFPC_OPCODE, dst, offset));
+            return;
+        }
+
+        ASSERT((offset <= 15) && (offset >= 0));
+        if (!offset) {
+            oneShortOp(getOpcodeGroup1(MOVL_READ_RM_OPCODE, dst, base));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup4(MOVL_READ_OFFRM_OPCODE, dst, base, offset));
+    }
+
+    void movbMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup11(MOVB_READ_OFFRM_OPCODE, base, offset);
+        oneShortOp(opc);
+    }
+
+    void movbR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movbMemReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlMemReg(RegisterID base, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_RM_OPCODE, dst, base);
+        oneShortOp(opc);
+    }
+
+    void movlMemRegIn(RegisterID base, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_RMINC_OPCODE, dst, base);
+        oneShortOp(opc);
+    }
+
+    void movlR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlRegMemr0(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_WRITE_R0RN_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 127) && (imm8 >= -128));
+
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, imm8);
+        oneShortOp(opc);
+    }
+
+    void loadConstant(uint32_t constant, RegisterID dst)
+    {
+        if (((int)constant <= 0x7f) && ((int)constant >= -0x80)) {
+            movImm8(constant, dst);
+            return;
+        }
+
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, 0);
+
+        m_buffer.ensureSpace(maxInstructionSize, sizeof(uint32_t));
+        printInstr(getOpcodeGroup3(MOVIMM_OPCODE, dst, constant), m_buffer.uncheckedSize());
+        m_buffer.putShortWithConstantInt(opc, constant, true);
+    }
+
+    void loadConstantUnReusable(uint32_t constant, RegisterID dst, bool ensureSpace = false)
+    {
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, 0);
+
+        if (ensureSpace)
+            m_buffer.ensureSpace(maxInstructionSize, sizeof(uint32_t));
+
+        printInstr(getOpcodeGroup3(MOVIMM_OPCODE, dst, constant), m_buffer.uncheckedSize());
+        m_buffer.putShortWithConstantInt(opc, constant);
+    }
+
+    // Flow control
+
+    JmpSrc call()
+    {
+        RegisterID scr = claimScratch();
+        m_buffer.ensureSpace(maxInstructionSize + 4, sizeof(uint32_t));
+        loadConstantUnReusable(0x0, scr);
+        branch(JSR_OPCODE, scr);
+        nop();
+        releaseScratch(scr);
+        return JmpSrc(m_buffer.uncheckedSize());
+    }
+
+    JmpSrc call(RegisterID dst)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        branch(JSR_OPCODE, dst);
+        nop();
+        return JmpSrc(m_buffer.uncheckedSize());
+    }
+
+    JmpSrc jmp()
+    {
+        RegisterID scr = claimScratch();
+        m_buffer.ensureSpace(maxInstructionSize + 4, sizeof(uint32_t));
+        int m_size = m_buffer.uncheckedSize();
+        loadConstantUnReusable(0x0, scr);
+        branch(BRAF_OPCODE, scr);
+        nop();
+        releaseScratch(scr);
+        return JmpSrc(m_size);
+    }
+
+    JmpSrc jmp(RegisterID dst)
+    {
+        jmpReg(dst);
+        return JmpSrc(m_buffer.uncheckedSize());
+    }
+
+    void jmpReg(RegisterID dst)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        branch(JMP_OPCODE, dst);
+        nop();
+    }
+
+    JmpSrc jne()
+    {
+        int m_size = m_buffer.uncheckedSize();
+        branch(BF_OPCODE, 0);
+        return JmpSrc(m_size);
+    }
+
+    JmpSrc je()
+    {
+        int m_size = m_buffer.uncheckedSize();
+        branch(BT_OPCODE, 0);
+        return JmpSrc(m_size);
+    }
+
+    void ret()
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        oneShortOp(RTS_OPCODE, false);
+    }
+
+    JmpDst label()
+    {
+        return JmpDst(m_buffer.size());
+    }
+
+    int sizeOfConstantPool()
+    {
+         return m_buffer.sizeOfConstantPool();
+    }
+
+    JmpDst align(int alignment)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        while (!m_buffer.isAligned(alignment)) {
+            nop();
+            m_buffer.ensureSpace(maxInstructionSize + 2);
+        }
+        return label();
+    }
+
+    static void changePCrelativeAddress(int offset, uint16_t* instructionPtr, uint32_t newAddress)
+    {
+        uint32_t address = (offset << 2) + ((reinterpret_cast<uint32_t>(instructionPtr) + 4) &(~0x3));
+        *reinterpret_cast<uint32_t*>(address) = newAddress;
+    }
+
+    static uint16_t* getInstructionPtr(void* code, int offset)
+    {
+        return reinterpret_cast<uint16_t*> (reinterpret_cast<uint32_t>(code) + offset);
+    }
+
+    static void linkJump(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(from.m_offset != -1);
+
+        uint16_t* instructionPtr = getInstructionPtr(code, from.m_offset);
+        uint16_t instruction = *instructionPtr;
+        int offsetBits = (reinterpret_cast<uint32_t>(to) - reinterpret_cast<uint32_t>(code)) - from.m_offset;
+
+        if (((instruction & 0xff00) == BT_OPCODE) || ((instruction & 0xff00) == BF_OPCODE)) {
+            /* BT label ==> BF 2
+               nop          LDR reg
+               nop          braf @reg
+               nop          nop
+            */
+            offsetBits -= 8;
+            instruction ^= 0x0202;
+            *instructionPtr++ = instruction;
+            changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits);
+            instruction = (BRAF_OPCODE | (*instructionPtr++ & 0xf00));
+            *instructionPtr = instruction;
+            printBlockInstr(instructionPtr - 2, from.m_offset, 3);
+            return;
+         }
+
+         /* MOV #imm, reg => LDR reg
+            braf @reg        braf @reg
+            nop              nop
+         */
+        ASSERT((*(instructionPtr + 1) & BRAF_OPCODE) == BRAF_OPCODE);
+
+        offsetBits -= 4;
+        if (offsetBits >= -4096 && offsetBits <= 4094) {
+            *instructionPtr = getOpcodeGroup6(BRA_OPCODE, offsetBits >> 1);
+            *(++instructionPtr) = NOP_OPCODE;
+            printBlockInstr(instructionPtr - 1, from.m_offset, 2);
+            return;
+        }
+
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits - 2);
+        printInstr(*instructionPtr, from.m_offset + 2);
+    }
+
+    static void linkCall(void* code, JmpSrc from, void* to)
+    {
+        uint16_t* instructionPtr = getInstructionPtr(code, from.m_offset);
+        instructionPtr -= 3;
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(to));
+    }
+
+    static void linkPointer(void* code, JmpDst where, void* value)
+    {
+        uint16_t* instructionPtr = getInstructionPtr(code, where.m_offset);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(value));
+    }
+
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        ASSERT(call.m_offset >= 0);
+        return call.m_offset;
+    }
+
+    static uint32_t* getLdrImmAddressOnPool(SH4Word* insn, uint32_t* constPool)
+    {
+        return (constPool + (*insn & 0xff));
+    }
+
+    static SH4Word patchConstantPoolLoad(SH4Word load, int value)
+    {
+        return ((load & ~0xff) | value);
+    }
+
+    static SH4Buffer::TwoShorts placeConstantPoolBarrier(int offset)
+    {
+        ASSERT(((offset >> 1) <=2047) && ((offset >> 1) >= -2048));
+
+        SH4Buffer::TwoShorts m_barrier;
+        m_barrier.high = (BRA_OPCODE | (offset >> 1));
+        m_barrier.low = NOP_OPCODE;
+        printInstr(((BRA_OPCODE | (offset >> 1))), 0);
+        printInstr(NOP_OPCODE, 0);
+        return m_barrier;
+    }
+
+    static void patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
+    {
+        SH4Word* instructionPtr = reinterpret_cast<SH4Word*>(loadAddr);
+        SH4Word instruction = *instructionPtr;
+        SH4Word index = instruction & 0xff;
+
+        if ((instruction & 0xf000) != MOVIMM_OPCODE)
+            return;
+
+        ASSERT((((reinterpret_cast<uint32_t>(constPoolAddr) - reinterpret_cast<uint32_t>(loadAddr)) + index * 4)) < 1024);
+
+        int offset = reinterpret_cast<uint32_t>(constPoolAddr) + (index * 4) - ((reinterpret_cast<uint32_t>(instructionPtr) & ~0x03) + 4);
+        instruction &=0xf00;
+        instruction |= 0xd000;
+        offset &= 0x03ff;
+        instruction |= (offset >> 2);
+        *instructionPtr = instruction;
+        printInstr(instruction, reinterpret_cast<uint32_t>(loadAddr));
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        patchPointer(where, value);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*>(where);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, value);
+    }
+
+    static void relinkCall(void* from, void* to)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*>(from);
+        instructionPtr -= 3;
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(to));
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*> (from);
+        uint16_t instruction = *instructionPtr;
+        int32_t offsetBits = (reinterpret_cast<uint32_t>(to) - reinterpret_cast<uint32_t>(from));
+
+        if (((*instructionPtr & 0xff00) == BT_OPCODE) || ((*instructionPtr & 0xff00) == BF_OPCODE)) {
+            offsetBits -= 8;
+            instructionPtr++;
+            changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits);
+            instruction = (BRAF_OPCODE | (*instructionPtr++ & 0xf00));
+            *instructionPtr = instruction;
+            printBlockInstr(instructionPtr, reinterpret_cast<uint32_t>(from) + 1, 3);
+            return;
+        }
+
+        ASSERT((*(instructionPtr + 1) & BRAF_OPCODE) == BRAF_OPCODE);
+        offsetBits -= 4;
+        if (offsetBits >= -4096 && offsetBits <= 4094) {
+            *instructionPtr = getOpcodeGroup6(BRA_OPCODE, offsetBits >> 1);
+            *(++instructionPtr) = NOP_OPCODE;
+            printBlockInstr(instructionPtr - 2, reinterpret_cast<uint32_t>(from), 2);
+            return;
+        }
+
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits - 2);
+        printInstr(*instructionPtr, reinterpret_cast<uint32_t>(from));
+    }
+
+    // Linking & patching
+
+    void linkJump(JmpSrc from, JmpDst to)
+    {
+        ASSERT(to.m_offset != -1);
+        ASSERT(from.m_offset != -1);
+
+        uint16_t* instructionPtr = getInstructionPtr(data(), from.m_offset);
+        uint16_t instruction = *instructionPtr;
+        int offsetBits;
+
+        if (((instruction & 0xff00) == BT_OPCODE) || ((instruction & 0xff00) == BF_OPCODE)) {
+            /* BT label => BF 2
+               nop        LDR reg
+               nop        braf @reg
+               nop        nop
+            */
+            offsetBits = (to.m_offset - from.m_offset) - 8;
+            instruction ^= 0x0202;
+            *instructionPtr++ = instruction;
+            if ((*instructionPtr & 0xf000) == 0xe000) {
+                uint32_t* addr = getLdrImmAddressOnPool(instructionPtr, m_buffer.poolAddress());
+                *addr = offsetBits;
+            } else
+                changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits);
+            instruction = (BRAF_OPCODE | (*instructionPtr++ & 0xf00));
+            *instructionPtr = instruction;
+            printBlockInstr(instructionPtr - 2, from.m_offset, 3);
+            return;
+        }
+
+        /* MOV # imm, reg => LDR reg
+           braf @reg         braf @reg
+           nop               nop
+        */
+        ASSERT((*(instructionPtr + 1) & BRAF_OPCODE) == BRAF_OPCODE);
+        offsetBits = (to.m_offset - from.m_offset) - 4;
+        if (offsetBits >= -4096 && offsetBits <= 4094) {
+            *instructionPtr = getOpcodeGroup6(BRA_OPCODE, offsetBits >> 1);
+            *(++instructionPtr) = NOP_OPCODE;
+            printBlockInstr(instructionPtr - 1, from.m_offset, 2);
+            return;
+        }
+
+        instruction = *instructionPtr;
+        if ((instruction  & 0xf000) == 0xe000) {
+            uint32_t* addr = getLdrImmAddressOnPool(instructionPtr, m_buffer.poolAddress());
+            *addr = offsetBits - 2;
+            printInstr(*instructionPtr, from.m_offset + 2);
+            return;
+        }
+
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits - 2);
+        printInstr(*instructionPtr, from.m_offset + 2);
+    }
+
+    static void* getRelocatedAddress(void* code, JmpSrc jump)
+    {
+        return reinterpret_cast<void*>(reinterpret_cast<uint32_t>(code) + jump.m_offset);
+    }
+
+    static void* getRelocatedAddress(void* code, JmpDst destination)
+    {
+        ASSERT(destination.m_offset != -1);
+        return reinterpret_cast<void*>(reinterpret_cast<uint32_t>(code) + destination.m_offset);
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst src, JmpDst dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst src, JmpSrc dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpSrc src, JmpDst dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+
+    static void patchPointer(void* code, JmpDst where, void* value)
+    {
+        patchPointer(reinterpret_cast<uint32_t*>(code) + where.m_offset, value);
+    }
+
+    static void patchPointer(void* code, void* value)
+    {
+        patchInt32(code, reinterpret_cast<uint32_t>(value));
+    }
+
+    static void patchInt32(void* code, uint32_t value)
+    {
+        changePCrelativeAddress((*(reinterpret_cast<uint16_t*>(code)) & 0xff), reinterpret_cast<uint16_t*>(code), value);
+    }
+
+    void* executableCopy(ExecutablePool* allocator)
+    {
+        void* copy = m_buffer.executableCopy(allocator);
+        ASSERT(copy);
+        return copy;
+    }
+
+    void prefix(uint16_t pre)
+    {
+        m_buffer.putByte(pre);
+    }
+
+    void oneShortOp(uint16_t opcode, bool checksize = true, bool isDouble = true)
+    {
+        printInstr(opcode, m_buffer.uncheckedSize(), isDouble);
+        if (checksize)
+            m_buffer.ensureSpace(maxInstructionSize);
+        m_buffer.putShortUnchecked(opcode);
+    }
+
+    void ensureSpace(int space)
+    {
+        m_buffer.ensureSpace(space);
+    }
+
+    void ensureSpace(int insnSpace, int constSpace)
+    {
+        m_buffer.ensureSpace(insnSpace, constSpace);
+    }
+
+    // Administrative methods
+
+    void* data() const { return m_buffer.data(); }
+    int size()
+    {
+        return m_buffer.size();
+    }
+
+#ifdef SH4_ASSEMBLER_TRACING
+    static void printInstr(uint16_t opc, unsigned int size, bool isdoubleInst = true)
+    {
+        if (!getenv("JavaScriptCoreDumpJIT"))
+            return;
+
+        const char *format = 0;
+        printfStdoutInstr("offset: 0x%8.8x\t", size);
+        switch (opc) {
+        case BRK_OPCODE:
+            format = "    BRK\n";
+            break;
+        case NOP_OPCODE:
+            format = "    NOP\n";
+            break;
+        case RTS_OPCODE:
+            format ="    *RTS\n";
+            break;
+        case SETS_OPCODE:
+            format = "    SETS\n";
+            break;
+        case SETT_OPCODE:
+            format = "    SETT\n";
+            break;
+        case CLRT_OPCODE:
+            format = "    CLRT\n";
+            break;
+        case FSCHG_OPCODE:
+            format = "    FSCHG\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format);
+            return;
+        }
+        switch (opc & 0xf0ff) {
+        case BRAF_OPCODE:
+            format = "    *BRAF R%d\n";
+            break;
+        case DT_OPCODE:
+            format = "    DT R%d\n";
+            break;
+        case CMPPL_OPCODE:
+            format = "    CMP/PL R%d\n";
+            break;
+        case CMPPZ_OPCODE:
+            format = "    CMP/PZ R%d\n";
+            break;
+        case JMP_OPCODE:
+            format = "    *JMP @R%d\n";
+            break;
+        case JSR_OPCODE:
+            format = "    *JSR @R%d\n";
+            break;
+        case LDSPR_OPCODE:
+            format = "    LDS R%d, PR\n";
+            break;
+        case LDSLPR_OPCODE:
+            format = "    LDS.L @R%d+, PR\n";
+            break;
+        case MOVT_OPCODE:
+            format = "    MOVT R%d\n";
+            break;
+        case SHAL_OPCODE:
+            format = "    SHAL R%d\n";
+            break;
+        case SHAR_OPCODE:
+            format = "    SHAR R%d\n";
+            break;
+        case SHLL_OPCODE:
+            format = "    SHLL R%d\n";
+            break;
+        case SHLL2_OPCODE:
+            format = "    SHLL2 R%d\n";
+            break;
+        case SHLL8_OPCODE:
+            format = "    SHLL8 R%d\n";
+            break;
+        case SHLL16_OPCODE:
+            format = "    SHLL16 R%d\n";
+            break;
+        case SHLR_OPCODE:
+            format = "    SHLR R%d\n";
+            break;
+        case SHLR2_OPCODE:
+            format = "    SHLR2 R%d\n";
+            break;
+        case SHLR8_OPCODE:
+            format = "    SHLR8 R%d\n";
+            break;
+        case SHLR16_OPCODE:
+            format = "    SHLR16 R%d\n";
+            break;
+        case STSPR_OPCODE:
+            format = "    STS PR, R%d\n";
+            break;
+        case STSLPR_OPCODE:
+            format = "    STS.L PR, @-R%d\n";
+            break;
+        case LDS_RM_FPUL_OPCODE:
+            format = "    LDS R%d, FPUL\n";
+            break;
+        case STS_FPUL_RN_OPCODE:
+            format = "    STS FPUL, R%d \n";
+            break;
+        case FLDS_FRM_FPUL_OPCODE:
+            format = "    FLDS FR%d, FPUL\n";
+            break;
+        case FSTS_FPUL_FRN_OPCODE:
+            format = "    FSTS FPUL, R%d \n";
+            break;
+        case LDSFPSCR_OPCODE:
+            format = "    LDS R%d, FPSCR \n";
+            break;
+        case STSFPSCR_OPCODE:
+            format = "    STS FPSCR, R%d \n";
+            break;
+        case STSMACL_OPCODE:
+            format = "    STS MACL, R%d \n";
+            break;
+        case STSMACH_OPCODE:
+            format = "    STS MACH, R%d \n";
+            break;
+        case BSRF_OPCODE:
+            format = "    *BSRF R%d";
+            break;
+        case FTRC_OPCODE:
+            format = "    FTRC FR%d, FPUL\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getRn(opc));
+            return;
+        }
+        switch (opc & 0xf0ff) {
+        case FNEG_OPCODE:
+            format = "    FNEG DR%d\n";
+            break;
+        case FLOAT_OPCODE:
+            format = "    FLOAT DR%d\n";
+            break;
+        case FTRC_OPCODE:
+            format = "    FTRC FR%d, FPUL\n";
+            break;
+        case FSQRT_OPCODE:
+            format = "    FSQRT FR%d\n";
+            break;
+        case FCNVDS_DRM_FPUL_OPCODE:
+            format = "    FCNVDS FR%d, FPUL\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case ADD_OPCODE:
+            format = "    ADD R%d, R%d\n";
+            break;
+        case ADDC_OPCODE:
+            format = "    ADDC R%d, R%d\n";
+            break;
+        case ADDV_OPCODE:
+            format = "    ADDV R%d, R%d\n";
+            break;
+        case AND_OPCODE:
+            format = "    AND R%d, R%d\n";
+            break;
+        case DIV1_OPCODE:
+            format = "    DIV1 R%d, R%d\n";
+            break;
+        case CMPEQ_OPCODE:
+            format = "    CMP/EQ R%d, R%d\n";
+            break;
+        case CMPGE_OPCODE:
+            format = "    CMP/GE R%d, R%d\n";
+            break;
+        case CMPGT_OPCODE:
+            format = "    CMP/GT R%d, R%d\n";
+            break;
+        case CMPHI_OPCODE:
+            format = "    CMP/HI R%d, R%d\n";
+            break;
+        case CMPHS_OPCODE:
+            format = "    CMP/HS R%d, R%d\n";
+            break;
+        case MOV_OPCODE:
+            format = "    MOV R%d, R%d\n";
+            break;
+        case MOVB_WRITE_RN_OPCODE:
+            format = "    MOV.B R%d, @R%d\n";
+            break;
+        case MOVB_WRITE_RNDEC_OPCODE:
+            format = "    MOV.B R%d, @-R%d\n";
+            break;
+        case MOVB_WRITE_R0RN_OPCODE:
+            format = "    MOV.B R%d, @(R0, R%d)\n";
+            break;
+        case MOVB_READ_RM_OPCODE:
+            format = "    MOV.B @R%d, R%d\n";
+            break;
+        case MOVB_READ_RMINC_OPCODE:
+            format = "    MOV.B @R%d+, R%d\n";
+            break;
+        case MOVB_READ_R0RM_OPCODE:
+            format = "    MOV.B @(R0, R%d), R%d\n";
+            break;
+        case MOVL_WRITE_RN_OPCODE:
+            format = "    MOV.L R%d, @R%d\n";
+            break;
+        case MOVL_WRITE_RNDEC_OPCODE:
+            format = "    MOV.L R%d, @-R%d\n";
+            break;
+        case MOVL_WRITE_R0RN_OPCODE:
+            format = "    MOV.L R%d, @(R0, R%d)\n";
+            break;
+        case MOVL_READ_RM_OPCODE:
+            format = "    MOV.L @R%d, R%d\n";
+            break;
+        case MOVL_READ_RMINC_OPCODE:
+            format = "    MOV.L @R%d+, R%d\n";
+            break;
+        case MOVL_READ_R0RM_OPCODE:
+            format = "    MOV.L @(R0, R%d), R%d\n";
+            break;
+        case MULL_OPCODE:
+            format = "    MUL.L R%d, R%d\n";
+            break;
+        case DMULL_L_OPCODE:
+            format = "    DMULU.L R%d, R%d\n";
+            break;
+        case DMULSL_OPCODE:
+            format = "    DMULS.L R%d, R%d\n";
+            break;
+        case NEG_OPCODE:
+            format = "    NEG R%d, R%d\n";
+            break;
+        case NEGC_OPCODE:
+            format = "    NEGC R%d, R%d\n";
+            break;
+        case NOT_OPCODE:
+            format = "    NOT R%d, R%d\n";
+            break;
+        case OR_OPCODE:
+            format = "    OR R%d, R%d\n";
+            break;
+        case SHAD_OPCODE:
+            format = "    SHAD R%d, R%d\n";
+            break;
+        case SHLD_OPCODE:
+            format = "    SHLD R%d, R%d\n";
+            break;
+        case SUB_OPCODE:
+            format = "    SUB R%d, R%d\n";
+            break;
+        case SUBC_OPCODE:
+            format = "    SUBC R%d, R%d\n";
+            break;
+        case SUBV_OPCODE:
+            format = "    SUBV R%d, R%d\n";
+            break;
+        case TST_OPCODE:
+            format = "    TST R%d, R%d\n";
+            break;
+        case XOR_OPCODE:
+            format = "    XOR R%d, R%d\n";break;
+        case MOVW_WRITE_RN_OPCODE:
+            format = "    MOV.W R%d, @R%d\n";
+            break;
+        case MOVW_READ_RM_OPCODE:
+            format = "    MOV.W @R%d, R%d\n";
+            break;
+        case MOVW_READ_R0RM_OPCODE:
+            format = "    MOV.W @(R0, R%d), R%d\n";
+            break;
+        case EXTUW_OPCODE:
+            format = "    EXTU.W R%d, R%d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FSUB_OPCODE:
+            format = "    FSUB FR%d, FR%d\n";
+            break;
+        case FADD_OPCODE:
+            format = "    FADD FR%d, FR%d\n";
+            break;
+        case FDIV_OPCODE:
+            format = "    FDIV FR%d, FR%d\n";
+            break;
+        case FMUL_OPCODE:
+            format = "    DMULL FR%d, FR%d\n";
+            break;
+        case FMOV_OPCODE:
+            format = "    FMOV FR%d, FR%d\n";
+            break;
+        case FCMPEQ_OPCODE:
+            format = "    FCMP/EQ FR%d, FR%d\n";
+            break;
+        case FCMPGT_OPCODE:
+            format = "    FCMP/GT FR%d, FR%d\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, getDRm(opc) << 1, getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FMOVS_WRITE_RN_DEC_OPCODE:
+            format = "    %s FR%d, @-R%d\n";
+            break;
+        case FMOVS_WRITE_RN_OPCODE:
+            format = "    %s FR%d, @R%d\n";
+            break;
+        case FMOVS_WRITE_R0RN_OPCODE:
+            format = "    %s FR%d, @(R0, R%d)\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, "FMOV", getDRm(opc) << 1, getDRn(opc));
+            else
+                printfStdoutInstr(format, "FMOV.S", getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FMOVS_READ_RM_OPCODE:
+            format = "    %s @R%d, FR%d\n";
+            break;
+        case FMOVS_READ_RM_INC_OPCODE:
+            format = "    %s @R%d+, FR%d\n";
+            break;
+        case FMOVS_READ_R0RM_OPCODE:
+            format = "    %s @(R0, R%d), FR%d\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, "FMOV", getDRm(opc), getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, "FMOV.S", getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xff00) {
+        case BF_OPCODE:
+            format = "    BF %d\n";
+            break;
+        case BFS_OPCODE:
+            format = "    *BF/S %d\n";
+            break;
+        case ANDIMM_OPCODE:
+            format = "    AND #%d, R0\n";
+            break;
+        case BT_OPCODE:
+            format = "    BT %d\n";
+            break;
+        case BTS_OPCODE:
+            format = "    *BT/S %d\n";
+            break;
+        case CMPEQIMM_OPCODE:
+            format = "    CMP/EQ #%d, R0\n";
+            break;
+        case MOVB_WRITE_OFFGBR_OPCODE:
+            format = "    MOV.B R0, @(%d, GBR)\n";
+            break;
+        case MOVB_READ_OFFGBR_OPCODE:
+            format = "    MOV.B @(%d, GBR), R0\n";
+            break;
+        case MOVL_WRITE_OFFGBR_OPCODE:
+            format = "    MOV.L R0, @(%d, GBR)\n";
+            break;
+        case MOVL_READ_OFFGBR_OPCODE:
+            format = "    MOV.L @(%d, GBR), R0\n";
+            break;
+        case MOVA_READ_OFFPC_OPCODE:
+            format = "    MOVA @(%d, PC), R0\n";
+            break;
+        case ORIMM_OPCODE:
+            format = "    OR #%d, R0\n";
+            break;
+        case ORBIMM_OPCODE:
+            format = "    OR.B #%d, @(R0, GBR)\n";
+            break;
+        case TSTIMM_OPCODE:
+            format = "    TST #%d, R0\n";
+            break;
+        case TSTB_OPCODE:
+            format = "    TST.B %d, @(R0, GBR)\n";
+            break;
+        case XORIMM_OPCODE:
+            format = "    XOR #%d, R0\n";
+            break;
+        case XORB_OPCODE:
+            format = "    XOR.B %d, @(R0, GBR)\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm8(opc));
+            return;
+        }
+        switch (opc & 0xff00) {
+        case MOVB_WRITE_OFFRN_OPCODE:
+            format = "    MOV.B R0, @(%d, R%d)\n";
+            break;
+        case MOVB_READ_OFFRM_OPCODE:
+            format = "    MOV.B @(%d, R%d), R0\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getDisp(opc), getRm(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case BRA_OPCODE:
+            format = "    *BRA %d\n";
+            break;
+        case BSR_OPCODE:
+            format = "    *BSR %d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm12(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case MOVL_READ_OFFPC_OPCODE:
+            format = "    MOV.L @(%d, PC), R%d\n";
+            break;
+        case ADDIMM_OPCODE:
+            format = "    ADD #%d, R%d\n";
+            break;
+        case MOVIMM_OPCODE:
+            format = "    MOV #%d, R%d\n";
+            break;
+        case MOVW_READ_OFFPC_OPCODE:
+            format = "    MOV.W @(%d, PC), R%d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm8(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case MOVL_WRITE_OFFRN_OPCODE:
+            format = "    MOV.L R%d, @(%d, R%d)\n";
+            printfStdoutInstr(format, getRm(opc), getDisp(opc), getRn(opc));
+            break;
+        case MOVL_READ_OFFRM_OPCODE:
+            format = "    MOV.L @(%d, R%d), R%d\n";
+            printfStdoutInstr(format, getDisp(opc), getRm(opc), getRn(opc));
+            break;
+        }
+    }
+
+    static void printfStdoutInstr(const char* format, ...)
+    {
+        if (getenv("JavaScriptCoreDumpJIT")) {
+            va_list args;
+            va_start(args, format);
+            vprintfStdoutInstr(format, args);
+            va_end(args);
+        }
+    }
+
+    static void vprintfStdoutInstr(const char* format, va_list args)
+    {
+        if (getenv("JavaScriptCoreDumpJIT"))
+            vfprintf(stdout, format, args);
+    }
+
+    static void printBlockInstr(uint16_t* first, unsigned int offset, int nbInstr)
+    {
+        printfStdoutInstr(">> repatch instructions after link\n");
+        for (int i = 0; i <= nbInstr; i++)
+           printInstr(*(first + i), offset + i);
+        printfStdoutInstr(">> end repatch\n");
+    }
+#else
+    static void printInstr(uint16_t opc, unsigned int size, bool isdoubleInst = true) {};
+    static void printBlockInstr(uint16_t* first, unsigned int offset, int nbInstr) {};
+#endif
+
+private:
+    SH4Buffer m_buffer;
+    int m_claimscratchReg;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(SH4)
+
+#endif // SH4Assembler_h
diff --git a/Source/JavaScriptCore/assembler/X86Assembler.h b/Source/JavaScriptCore/assembler/X86Assembler.h
index 4851c1e..1fcfc93 100644
--- a/Source/JavaScriptCore/assembler/X86Assembler.h
+++ b/Source/JavaScriptCore/assembler/X86Assembler.h
@@ -1637,6 +1637,12 @@ public:
         return copy;
     }
 
+    void rewindToLabel(JmpDst rewindTo) { m_formatter.rewindToLabel(rewindTo); }
+
+#ifndef NDEBUG
+    unsigned debugOffset() { return m_formatter.debugOffset(); }
+#endif
+
 private:
 
     static void setPointer(void* where, void* value)
@@ -1936,6 +1942,12 @@ private:
         void* data() const { return m_buffer.data(); }
         void* executableCopy(ExecutablePool* allocator) { return m_buffer.executableCopy(allocator); }
 
+        void rewindToLabel(JmpDst rewindTo) { m_buffer.rewindToOffset(rewindTo.m_offset); }
+
+#ifndef NDEBUG
+        unsigned debugOffset() { return m_buffer.debugOffset(); }
+#endif
+
     private:
 
         // Internals; ModRm and REX formatters.
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 98bbb3c..0e648ba 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -1390,31 +1390,9 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
 
 CodeBlock::~CodeBlock()
 {
-#if ENABLE(INTERPRETER)
-    for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i)
-        derefStructures(&m_instructions[m_globalResolveInstructions[i]]);
-
-    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
-        derefStructures(&m_instructions[m_propertyAccessInstructions[i]]);
-#endif
 #if ENABLE(JIT)
-    for (size_t size = m_globalResolveInfos.size(), i = 0; i < size; ++i) {
-        if (m_globalResolveInfos[i].structure)
-            m_globalResolveInfos[i].structure->deref();
-    }
-
     for (size_t size = m_structureStubInfos.size(), i = 0; i < size; ++i)
         m_structureStubInfos[i].deref();
-
-    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
-        if (Structure* structure = m_methodCallLinkInfos[i].cachedStructure) {
-            structure->deref();
-            // Both members must be filled at the same time
-            ASSERT(!!m_methodCallLinkInfos[i].cachedPrototypeStructure);
-            m_methodCallLinkInfos[i].cachedPrototypeStructure->deref();
-        }
-    }
-
 #endif // ENABLE(JIT)
 
 #if DUMP_CODE_BLOCK_STATISTICS
@@ -1422,35 +1400,37 @@ CodeBlock::~CodeBlock()
 #endif
 }
 
-void CodeBlock::derefStructures(Instruction* vPC) const
+void CodeBlock::markStructures(MarkStack& markStack, Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
-        vPC[4].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto)) {
-        vPC[4].u.structure->deref();
-        vPC[5].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
-        vPC[4].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structureChain);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
-        vPC[4].u.structure->deref();
-        vPC[5].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structure);
+        markStack.append(&vPC[6].u.structureChain);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_replace)) {
-        vPC[4].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_resolve_global) || vPC[0].u.opcode == interpreter->getOpcode(op_resolve_global_dynamic)) {
         if (vPC[3].u.structure)
-            vPC[3].u.structure->deref();
+            markStack.append(&vPC[3].u.structure);
         return;
     }
     if ((vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto_list))
@@ -1460,7 +1440,7 @@ void CodeBlock::derefStructures(Instruction* vPC) const
         || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto_list))
         || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self_list))) {
         PolymorphicAccessStructureList* polymorphicStructures = vPC[4].u.polymorphicStructures;
-        polymorphicStructures->derefStructures(vPC[5].u.operand);
+        polymorphicStructures->markAggregate(markStack, vPC[5].u.operand);
         delete polymorphicStructures;
         return;
     }
@@ -1469,37 +1449,6 @@ void CodeBlock::derefStructures(Instruction* vPC) const
     ASSERT(vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_get_array_length) || vPC[0].u.opcode == interpreter->getOpcode(op_get_string_length));
 }
 
-void CodeBlock::refStructures(Instruction* vPC) const
-{
-    Interpreter* interpreter = m_globalData->interpreter;
-
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
-        vPC[4].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto)) {
-        vPC[4].u.structure->ref();
-        vPC[5].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
-        vPC[4].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
-        vPC[4].u.structure->ref();
-        vPC[5].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_replace)) {
-        vPC[4].u.structure->ref();
-        return;
-    }
-    
-    // These instructions don't ref their Structures.
-    ASSERT(vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_generic));
-}
-
 void EvalCodeCache::markAggregate(MarkStack& markStack)
 {
     EvalCacheMap::iterator end = m_cacheMap.end();
@@ -1524,18 +1473,26 @@ void CodeBlock::markAggregate(MarkStack& markStack)
             markStack.append(&callLinkInfo(i).callee);
 #endif
 #if ENABLE(INTERPRETER)
-    Interpreter* interpreter = m_globalData->interpreter;
-    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i) {
-        Instruction* vPC = &m_instructions[m_propertyAccessInstructions[i]];
-        if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain))
-            markStack.append(&vPC[5].u.structureChain);
-        else if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition))
-            markStack.append(&vPC[6].u.structureChain);
-    }
+    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
+        markStructures(markStack, &m_instructions[m_propertyAccessInstructions[i]]);
 #endif
 #if ENABLE(JIT)
+    for (size_t size = m_globalResolveInfos.size(), i = 0; i < size; ++i) {
+        if (m_globalResolveInfos[i].structure)
+            markStack.append(&m_globalResolveInfos[i].structure);
+    }
+
     for (size_t size = m_structureStubInfos.size(), i = 0; i < size; ++i)
         m_structureStubInfos[i].markAggregate(markStack);
+
+    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
+        if (m_methodCallLinkInfos[i].cachedStructure) {
+            // Both members must be filled at the same time
+            markStack.append(&m_methodCallLinkInfos[i].cachedStructure);
+            ASSERT(!!m_methodCallLinkInfos[i].cachedPrototypeStructure);
+            markStack.append(&m_methodCallLinkInfos[i].cachedPrototypeStructure);
+        }
+    }
 #endif
 }
 
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 25e65f4..af68eb5 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -122,8 +122,6 @@ namespace JSC {
 
     struct MethodCallLinkInfo {
         MethodCallLinkInfo()
-            : cachedStructure(0)
-            , cachedPrototypeStructure(0)
         {
         }
 
@@ -142,24 +140,23 @@ namespace JSC {
             //     - Once this transition has been taken once, cachedStructure is
             //       null and cachedPrototypeStructure is set to a nun-null value.
             //     - Once the call is linked both structures are set to non-null values.
-            cachedPrototypeStructure = (Structure*)1;
+            cachedPrototypeStructure.setWithoutWriteBarrier((Structure*)1);
         }
 
         CodeLocationCall callReturnLocation;
         CodeLocationDataLabelPtr structureLabel;
-        Structure* cachedStructure;
-        Structure* cachedPrototypeStructure;
+        WriteBarrier<Structure> cachedStructure;
+        WriteBarrier<Structure> cachedPrototypeStructure;
     };
 
     struct GlobalResolveInfo {
         GlobalResolveInfo(unsigned bytecodeOffset)
-            : structure(0)
-            , offset(0)
+            : offset(0)
             , bytecodeOffset(bytecodeOffset)
         {
         }
 
-        Structure* structure;
+        WriteBarrier<Structure> structure;
         unsigned offset;
         unsigned bytecodeOffset;
     };
@@ -215,8 +212,6 @@ namespace JSC {
         virtual ~CodeBlock();
 
         void markAggregate(MarkStack&);
-        void refStructures(Instruction* vPC) const;
-        void derefStructures(Instruction* vPC) const;
 
         static void dumpStatistics();
 
@@ -486,6 +481,7 @@ namespace JSC {
         void printGetByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
         void printPutByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
 #endif
+        void markStructures(MarkStack&, Instruction* vPC) const;
 
         void createRareDataIfNecessary()
         {
diff --git a/Source/JavaScriptCore/bytecode/Instruction.h b/Source/JavaScriptCore/bytecode/Instruction.h
index da0821d..d9cbb11 100644
--- a/Source/JavaScriptCore/bytecode/Instruction.h
+++ b/Source/JavaScriptCore/bytecode/Instruction.h
@@ -33,6 +33,7 @@
 #include "Opcode.h"
 #include "PropertySlot.h"
 #include "Structure.h"
+#include "StructureChain.h"
 #include <wtf/VectorTraits.h>
 
 #define POLYMORPHIC_LIST_CACHE_SIZE 8
@@ -60,45 +61,45 @@ namespace JSC {
         struct PolymorphicStubInfo {
             bool isChain;
             PolymorphicAccessStructureListStubRoutineType stubRoutine;
-            Structure* base;
+            WriteBarrier<Structure> base;
             union {
-                Structure* proto;
+                WriteBarrierBase<Structure> proto;
                 WriteBarrierBase<StructureChain> chain;
             } u;
 
-            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
+            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
-                u.proto = 0;
+                base.set(globalData, owner, _base);
+                u.proto.clear();
                 isChain = false;
             }
             
-            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto)
+            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
-                u.proto = _proto;
+                base.set(globalData, owner, _base);
+                u.proto.set(globalData, owner, _proto);
                 isChain = false;
             }
             
             void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
+                base.set(globalData, owner, _base);
                 u.chain.set(globalData, owner, _chain);
                 isChain = true;
             }
         } list[POLYMORPHIC_LIST_CACHE_SIZE];
         
-        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase)
         {
-            list[0].set(stubRoutine, firstBase);
+            list[0].set(globalData, owner, stubRoutine, firstBase);
         }
 
-        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto)
         {
-            list[0].set(stubRoutine, firstBase, firstProto);
+            list[0].set(globalData, owner, stubRoutine, firstBase, firstProto);
         }
 
         PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain)
@@ -106,28 +107,16 @@ namespace JSC {
             list[0].set(globalData, owner, stubRoutine, firstBase, firstChain);
         }
 
-        void derefStructures(int count)
-        {
-            for (int i = 0; i < count; ++i) {
-                PolymorphicStubInfo& info = list[i];
-
-                ASSERT(info.base);
-                info.base->deref();
-
-                if (info.u.proto) {
-                    if (!info.isChain)
-                        info.u.proto->deref();
-                }
-            }
-        }
-
         void markAggregate(MarkStack& markStack, int count)
         {
             for (int i = 0; i < count; ++i) {
                 PolymorphicStubInfo& info = list[i];
                 ASSERT(info.base);
                 
-                if (info.u.proto && info.isChain)
+                markStack.append(&info.base);
+                if (info.u.proto && !info.isChain)
+                    markStack.append(&info.u.proto);
+                if (info.u.chain && info.isChain)
                     markStack.append(&info.u.chain);
             }
         }
@@ -152,7 +141,11 @@ namespace JSC {
             u.operand = operand;
         }
 
-        Instruction(Structure* structure) { u.structure = structure; }
+        Instruction(JSGlobalData& globalData, JSCell* owner, Structure* structure)
+        {
+            u.structure.clear();
+            u.structure.set(globalData, owner, structure);
+        }
         Instruction(JSGlobalData& globalData, JSCell* owner, StructureChain* structureChain)
         {
             u.structureChain.clear();
@@ -169,12 +162,16 @@ namespace JSC {
         union {
             Opcode opcode;
             int operand;
-            Structure* structure;
+            WriteBarrierBase<Structure> structure;
             WriteBarrierBase<StructureChain> structureChain;
             WriteBarrierBase<JSCell> jsCell;
             PolymorphicAccessStructureList* polymorphicStructures;
             PropertySlot::GetValueFunc getterFunc;
         } u;
+        
+    private:
+        Instruction(StructureChain*);
+        Instruction(Structure*);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.h b/Source/JavaScriptCore/bytecode/SamplingTool.h
index a0696b1..74b4852 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.h
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.h
@@ -29,13 +29,13 @@
 #ifndef SamplingTool_h
 #define SamplingTool_h
 
+#include "Strong.h"
+#include "Nodes.h"
+#include "Opcode.h"
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
 #include <wtf/Threading.h>
 
-#include "Nodes.h"
-#include "Opcode.h"
-
 namespace JSC {
 
     class ScriptExecutable;
@@ -113,7 +113,7 @@ namespace JSC {
         
         void sample(CodeBlock*, Instruction*);
 
-        Global<ScriptExecutable> m_executable;
+        Strong<ScriptExecutable> m_executable;
         CodeBlock* m_codeBlock;
         int m_sampleCount;
         int m_opcodeSampleCount;
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
index 4d59ac1..be5760a 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
@@ -35,42 +35,28 @@ namespace JSC {
 void StructureStubInfo::deref()
 {
     switch (accessType) {
-    case access_get_by_id_self:
-        u.getByIdSelf.baseObjectStructure->deref();
-        return;
-    case access_get_by_id_proto:
-        u.getByIdProto.baseObjectStructure->deref();
-        u.getByIdProto.prototypeStructure->deref();
-        return;
-    case access_get_by_id_chain:
-        u.getByIdChain.baseObjectStructure->deref();
-        return;
     case access_get_by_id_self_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
-        polymorphicStructures->derefStructures(u.getByIdSelfList.listSize);
         delete polymorphicStructures;
         return;
     }
     case access_get_by_id_proto_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdProtoList.structureList;
-        polymorphicStructures->derefStructures(u.getByIdProtoList.listSize);
         delete polymorphicStructures;
         return;
     }
+    case access_get_by_id_self:
+    case access_get_by_id_proto:
+    case access_get_by_id_chain:
     case access_put_by_id_transition:
-        u.putByIdTransition.previousStructure->deref();
-        u.putByIdTransition.structure->deref();
-        return;
     case access_put_by_id_replace:
-        u.putByIdReplace.baseObjectStructure->deref();
-        return;
     case access_get_by_id:
     case access_put_by_id:
     case access_get_by_id_generic:
     case access_put_by_id_generic:
     case access_get_array_length:
     case access_get_string_length:
-        // These instructions don't ref their Structures.
+        // These instructions don't have to release any allocated memory
         return;
     default:
         ASSERT_NOT_REACHED();
@@ -81,10 +67,15 @@ void StructureStubInfo::markAggregate(MarkStack& markStack)
 {
     switch (accessType) {
     case access_get_by_id_self:
+        markStack.append(&u.getByIdSelf.baseObjectStructure);
         return;
     case access_get_by_id_proto:
+        markStack.append(&u.getByIdProto.baseObjectStructure);
+        markStack.append(&u.getByIdProto.prototypeStructure);
         return;
     case access_get_by_id_chain:
+        markStack.append(&u.getByIdChain.baseObjectStructure);
+        markStack.append(&u.getByIdChain.chain);
         return;
     case access_get_by_id_self_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
@@ -97,8 +88,12 @@ void StructureStubInfo::markAggregate(MarkStack& markStack)
         return;
     }
     case access_put_by_id_transition:
+        markStack.append(&u.putByIdTransition.previousStructure);
+        markStack.append(&u.putByIdTransition.structure);
+        markStack.append(&u.putByIdTransition.chain);
         return;
     case access_put_by_id_replace:
+        markStack.append(&u.putByIdReplace.baseObjectStructure);
         return;
     case access_get_by_id:
     case access_put_by_id:
@@ -106,7 +101,7 @@ void StructureStubInfo::markAggregate(MarkStack& markStack)
     case access_put_by_id_generic:
     case access_get_array_length:
     case access_get_string_length:
-        // These instructions don't ref their Structures.
+        // These instructions don't need to mark anything
         return;
     default:
         ASSERT_NOT_REACHED();
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.h b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
index 28202f9..bfeeb1e 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -58,33 +58,27 @@ namespace JSC {
         {
         }
 
-        void initGetByIdSelf(Structure* baseObjectStructure)
+        void initGetByIdSelf(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure)
         {
             accessType = access_get_by_id_self;
 
-            u.getByIdSelf.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
+            u.getByIdSelf.baseObjectStructure.set(globalData, owner, baseObjectStructure);
         }
 
-        void initGetByIdProto(Structure* baseObjectStructure, Structure* prototypeStructure)
+        void initGetByIdProto(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure, Structure* prototypeStructure)
         {
             accessType = access_get_by_id_proto;
 
-            u.getByIdProto.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
-
-            u.getByIdProto.prototypeStructure = prototypeStructure;
-            prototypeStructure->ref();
+            u.getByIdProto.baseObjectStructure.set(globalData, owner, baseObjectStructure);
+            u.getByIdProto.prototypeStructure.set(globalData, owner, prototypeStructure);
         }
 
-        void initGetByIdChain(Structure* baseObjectStructure, StructureChain* chain)
+        void initGetByIdChain(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure, StructureChain* chain)
         {
             accessType = access_get_by_id_chain;
 
-            u.getByIdChain.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
-
-            u.getByIdChain.chain = chain;
+            u.getByIdChain.baseObjectStructure.set(globalData, owner, baseObjectStructure);
+            u.getByIdChain.chain.set(globalData, owner, chain);
         }
 
         void initGetByIdSelfList(PolymorphicAccessStructureList* structureList, int listSize)
@@ -105,25 +99,20 @@ namespace JSC {
 
         // PutById*
 
-        void initPutByIdTransition(Structure* previousStructure, Structure* structure, StructureChain* chain)
+        void initPutByIdTransition(JSGlobalData& globalData, JSCell* owner, Structure* previousStructure, Structure* structure, StructureChain* chain)
         {
             accessType = access_put_by_id_transition;
 
-            u.putByIdTransition.previousStructure = previousStructure;
-            previousStructure->ref();
-
-            u.putByIdTransition.structure = structure;
-            structure->ref();
-
-            u.putByIdTransition.chain = chain;
+            u.putByIdTransition.previousStructure.set(globalData, owner, previousStructure);
+            u.putByIdTransition.structure.set(globalData, owner, structure);
+            u.putByIdTransition.chain.set(globalData, owner, chain);
         }
 
-        void initPutByIdReplace(Structure* baseObjectStructure)
+        void initPutByIdReplace(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure)
         {
             accessType = access_put_by_id_replace;
     
-            u.putByIdReplace.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
+            u.putByIdReplace.baseObjectStructure.set(globalData, owner, baseObjectStructure);
         }
 
         void deref();
@@ -144,15 +133,15 @@ namespace JSC {
 
         union {
             struct {
-                Structure* baseObjectStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
             } getByIdSelf;
             struct {
-                Structure* baseObjectStructure;
-                Structure* prototypeStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
+                WriteBarrierBase<Structure> prototypeStructure;
             } getByIdProto;
             struct {
-                Structure* baseObjectStructure;
-                StructureChain* chain;
+                WriteBarrierBase<Structure> baseObjectStructure;
+                WriteBarrierBase<StructureChain> chain;
             } getByIdChain;
             struct {
                 PolymorphicAccessStructureList* structureList;
@@ -163,12 +152,12 @@ namespace JSC {
                 int listSize;
             } getByIdProtoList;
             struct {
-                Structure* previousStructure;
-                Structure* structure;
-                StructureChain* chain;
+                WriteBarrierBase<Structure> previousStructure;
+                WriteBarrierBase<Structure> structure;
+                WriteBarrierBase<StructureChain> chain;
             } putByIdTransition;
             struct {
-                Structure* baseObjectStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
             } putByIdReplace;
         } u;
 
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 5af3420..83e4592 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -262,7 +262,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
         Vector<std::pair<int, bool>, 16> functionInfo(functionStack.size());
         for (size_t i = 0; i < functionStack.size(); ++i) {
             FunctionBodyNode* function = functionStack[i];
-            globalObject->removeDirect(function->ident()); // Make sure our new function is not shadowed by an old property.
+            globalObject->removeDirect(*m_globalData, function->ident()); // Make sure our new function is not shadowed by an old property.
             SymbolTableEntry entry = symbolTable->inlineGet(function->ident().impl());
             
             if (entry.isNull())
@@ -1103,7 +1103,7 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, bool b)
 
 RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, double number)
 {
-    // FIXME: Our hash tables won't hold infinity, so we make a new JSNumberCell each time.
+    // FIXME: Our hash tables won't hold infinity, so we make a new JSValue each time.
     // Later we can do the extra work to handle that like the other cases.  They also don't
     // work correctly with NaN as a key.
     if (isnan(number) || number == HashTraits<double>::emptyValue() || HashTraits<double>::isDeletedValue(number))
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 3a40390..05a955b 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -513,7 +513,7 @@ namespace JSC {
         bool m_shouldEmitProfileHooks;
         bool m_shouldEmitRichSourceInfo;
 
-        Global<ScopeChainNode> m_scopeChain;
+        Strong<ScopeChainNode> m_scopeChain;
         SymbolTable* m_symbolTable;
 
         ScopeNode* m_scopeNode;
diff --git a/Source/JavaScriptCore/collector/handles/Global.h b/Source/JavaScriptCore/collector/handles/Global.h
deleted file mode 100644
index 571fe31..0000000
--- a/Source/JavaScriptCore/collector/handles/Global.h
+++ /dev/null
@@ -1,159 +0,0 @@
-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef Global_h
-#define Global_h
-
-#include "Assertions.h"
-#include "Handle.h"
-#include "HandleHeap.h"
-#include "JSGlobalData.h"
-
-namespace JSC {
-
-/*
-    A Global is a persistent handle whose lifetime is not limited to any given
-    scope. Use Globals for data members and global variables.
-*/
-
-template <typename T> class Global : public Handle<T> {
-public:
-    typedef typename Handle<T>::ExternalType ExternalType;
-    Global(JSGlobalData& globalData, ExternalType ptr = ExternalType())
-        : Handle<T>(globalData.allocateGlobalHandle())
-    {
-        internalSet(ptr);
-    }
-
-    Global(JSGlobalData& globalData, Handle<T> handle)
-        : Handle<T>(globalData.allocateGlobalHandle())
-    {
-        internalSet(handle.get());
-    }
-    
-    enum EmptyValueTag { EmptyValue };
-    Global(EmptyValueTag)
-        : Handle<T>(0, HandleBase::DontNullCheckSlot)
-    {
-    }
-
-    ~Global()
-    {
-        HandleSlot slot = this->slot();
-        if (slot)
-            HandleHeap::heapFor(slot)->deallocate(slot);
-    }
-
-    void set(JSGlobalData& globalData, ExternalType value)
-    {
-        if (!value) {
-            clear();
-            return;
-        }
-        if (!this->slot())
-            this->setSlot(globalData.allocateGlobalHandle());
-        internalSet(value);
-    }
-
-    template <typename U> Global& operator=(const Global<U>& handle)
-    {
-        if (handle.slot()) {
-            if (!this->slot())
-                this->setSlot(HandleHeap::heapFor(handle.slot())->allocate());
-            internalSet(handle.get());
-        } else
-            clear();
-        
-        return *this;
-    }
-    
-    Global& operator=(const Global& handle)
-    {
-        if (handle.slot()) {
-            if (!this->slot())
-                this->setSlot(HandleHeap::heapFor(handle.slot())->allocate());
-            internalSet(handle.get());
-        } else
-            clear();
-        
-        return *this;
-    }
-
-    void clear()
-    {
-        if (this->slot())
-            internalSet(ExternalType());
-    }
-
-    enum HashTableDeletedValueType { HashTableDeletedValue };
-    const static intptr_t HashTableDeletedValueTag = 0x1;
-    Global(HashTableDeletedValueType)
-        : Handle<T>(reinterpret_cast<HandleSlot>(HashTableDeletedValueTag))
-    {
-    }
-    bool isHashTableDeletedValue() const { return slot() == reinterpret_cast<HandleSlot>(HashTableDeletedValueTag); }
-
-    template <typename U> Global(const Global<U>& other)
-        : Handle<T>(other.slot() ? HandleHeap::heapFor(other.slot())->allocate() : 0, Handle<T>::DontNullCheckSlot)
-    {
-        if (other.slot())
-            internalSet(other.get());
-    }
-    
-    Global(const Global& other)
-        : Handle<T>(other.slot() ? HandleHeap::heapFor(other.slot())->allocate() : 0, Handle<T>::DontNullCheckSlot)
-    {
-        if (other.slot())
-            internalSet(other.get());
-    }
-
-protected:
-    void internalSet(ExternalType value)
-    {
-        JSValue newValue(HandleTypes<T>::toJSValue(value));
-        HandleSlot slot = this->slot();
-        ASSERT(slot);
-        HandleHeap::heapFor(slot)->writeBarrier(slot, newValue);
-        *slot = newValue;
-    }
-
-    using Handle<T>::slot;
-    
-};
-
-}
-
-namespace WTF {
-
-template<typename P> struct HashTraits<JSC::Global<P> > : GenericHashTraits<JSC::Global<P> > {
-    static const bool emptyValueIsZero = true;
-    static JSC::Global<P> emptyValue() { return JSC::Global<P>(JSC::Global<P>::EmptyValue); }
-    static void constructDeletedValue(JSC::Global<P>& slot) { new (&slot) JSC::Global<P>(JSC::Global<P>::HashTableDeletedValue); }
-    static bool isDeletedValue(const JSC::Global<P>& value) { return value.isHashTableDeletedValue(); }
-};
-
-}
-
-#endif // Global_h
diff --git a/Source/JavaScriptCore/config.h b/Source/JavaScriptCore/config.h
index ea10e77..394bba5 100644
--- a/Source/JavaScriptCore/config.h
+++ b/Source/JavaScriptCore/config.h
@@ -59,8 +59,8 @@
 #define JS_EXPORTCLASS
 #endif
 
-#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
-#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
 
 #endif /* USE(EXPORT_MACROS) */
 
diff --git a/Source/JavaScriptCore/create_regex_tables b/Source/JavaScriptCore/create_regex_tables
index c6ce995..bd799ba 100644
--- a/Source/JavaScriptCore/create_regex_tables
+++ b/Source/JavaScriptCore/create_regex_tables
@@ -35,6 +35,7 @@ types = {
 entriesPerLine = 50
 arrays = "";
 functions = "";
+emitTables = (len(sys.argv) < 2 or sys.argv[1] != "--no-tables")
 
 for name, classes in types.items():
     ranges = [];
@@ -56,7 +57,7 @@ for name, classes in types.items():
             ranges.append((min,max))
     ranges.sort();
     
-    if classes["UseTable"] and (not "Inverse" in classes):
+    if emitTables and classes["UseTable"] and (not "Inverse" in classes):
         array = ("static const char _%sData[65536] = {\n" % name);
         i = 0
         for (min,max) in ranges:
@@ -87,7 +88,7 @@ for name, classes in types.items():
     function = "";
     function += ("CharacterClass* %sCreate()\n" % name)
     function += ("{\n")
-    if classes["UseTable"]:
+    if emitTables and classes["UseTable"]:
         if "Inverse" in classes:
             function += ("    CharacterClass* characterClass = new CharacterClass(CharacterClassTable::create(_%sData, true));\n" % (classes["Inverse"]))
         else:
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
index 50ba746..67a796a 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -31,7 +31,7 @@
 namespace JSC {
 
 DebuggerActivation::DebuggerActivation(JSGlobalData& globalData, JSObject* activation)
-    : JSNonFinalObject(DebuggerActivation::createStructure(globalData, jsNull()))
+    : JSNonFinalObject(globalData, DebuggerActivation::createStructure(globalData, jsNull()))
 {
     ASSERT(activation);
     ASSERT(activation->isActivationObject());
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.h b/Source/JavaScriptCore/debugger/DebuggerActivation.h
index f22d2ff..bfb36db 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.h
@@ -49,7 +49,7 @@ namespace JSC {
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
         virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) 
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 03f5d4f..1d4c36a 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -34,6 +34,13 @@
 
 namespace JSC { namespace DFG {
 
+#if ENABLE(DFG_JIT_RESTRICTIONS)
+// FIXME: Temporarily disable arithmetic, until we fix associated performance regressions.
+#define ARITHMETIC_OP() m_parseFailed = true
+#else
+#define ARITHMETIC_OP() ((void)0)
+#endif
+
 // === ByteCodeParser ===
 //
 // This class is used to compile the dataflow graph from a CodeBlock.
@@ -44,93 +51,137 @@ public:
         , m_codeBlock(codeBlock)
         , m_graph(graph)
         , m_currentIndex(0)
-        , m_noArithmetic(true)
+        , m_parseFailed(false)
         , m_constantUndefined(UINT_MAX)
+        , m_constantNull(UINT_MAX)
         , m_constant1(UINT_MAX)
+        , m_constants(codeBlock->numberOfConstantRegisters())
+        , m_arguments(codeBlock->m_numParameters)
+        , m_variables(codeBlock->m_numVars)
+        , m_temporaries(codeBlock->m_numCalleeRegisters - codeBlock->m_numVars)
     {
-        unsigned numberOfConstants = codeBlock->numberOfConstantRegisters();
-        m_constantRecords.grow(numberOfConstants);
-
-        unsigned numberOfParameters = codeBlock->m_numParameters;
-        m_arguments.grow(numberOfParameters);
-        for (unsigned i = 0; i < numberOfParameters; ++i)
-            m_arguments[i] = NoNode;
-
-        unsigned numberOfRegisters = codeBlock->m_numCalleeRegisters;
-        m_calleeRegisters.grow(numberOfRegisters);
-        for (unsigned i = 0; i < numberOfRegisters; ++i)
-            m_calleeRegisters[i] = NoNode;
+        for (unsigned i = 0; i < m_temporaries.size(); ++i)
+            m_temporaries[i] = NoNode;
     }
 
+    // Parse a full CodeBlock of bytecode.
     bool parse();
 
 private:
+    // Parse a single basic block of bytecode instructions.
+    bool parseBlock(unsigned limit);
+
     // Get/Set the operands/result of a bytecode instruction.
     NodeIndex get(int operand)
     {
         // Is this a constant?
         if (operand >= FirstConstantRegisterIndex) {
             unsigned constant = operand - FirstConstantRegisterIndex;
-            ASSERT(constant < m_constantRecords.size());
+            ASSERT(constant < m_constants.size());
             return getJSConstant(constant);
         }
 
         // Is this an argument?
-        if (operand < 0) {
-            unsigned argument = operand + m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize;
-            ASSERT(argument < m_arguments.size());
-            return getArgument(argument);
-        }
-
-        // Must be a local or temporary.
-        ASSERT((unsigned)operand < m_calleeRegisters.size());
-        return getRegister((unsigned)operand);
+        if (operand < 0)
+            return getArgument(operand);
+
+        // Is this a variable?
+        unsigned numVariables = m_variables.size();
+        if ((unsigned)operand < numVariables)
+            return getVariable((unsigned)operand);
+        
+        // Must be a temporary.
+        unsigned temporary = (unsigned)operand - numVariables;
+        ASSERT(temporary < m_temporaries.size());
+        return getTemporary(temporary);
     }
     void set(int operand, NodeIndex value)
     {
         // Is this an argument?
         if (operand < 0) {
-            unsigned argument = operand + m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize;
-            ASSERT(argument < m_arguments.size());
-            return setArgument(argument, value);
+            setArgument(operand, value);
+            return;
+        }
+
+        // Is this a variable?
+        unsigned numVariables = m_variables.size();
+        if ((unsigned)operand < numVariables) {
+            setVariable((unsigned)operand, value);
+            return;
         }
+        
+        // Must be a temporary.
+        unsigned temporary = (unsigned)operand - numVariables;
+        ASSERT(temporary < m_temporaries.size());
+        setTemporary(temporary, value);
+    }
 
-        // Must be a local or temporary.
-        ASSERT((unsigned)operand < m_calleeRegisters.size());
-        return setRegister((unsigned)operand, value);
+    // Used in implementing get/set, above, where the operand is a local variable.
+    NodeIndex getVariable(unsigned operand)
+    {
+        NodeIndex setNode = m_variables[operand].set;
+        if (setNode != NoNode)
+            return m_graph[setNode].child1;
+
+        NodeIndex getNode = m_variables[operand].get;
+        if (getNode != NoNode)
+            return getNode;
+
+        getNode = addToGraph(GetLocal, OpInfo(operand));
+        m_variables[operand].get = getNode;
+        return getNode;
+    }
+    void setVariable(unsigned operand, NodeIndex value)
+    {
+        NodeIndex priorSet = m_variables[operand].set;
+        m_variables[operand].set = addToGraph(SetLocal, OpInfo(operand), value);
+        if (priorSet != NoNode)
+            m_graph.deref(priorSet);
     }
 
-    // Used in implementing get/set, above, where the operand is a local or temporary.
-    NodeIndex getRegister(unsigned operand)
+    // Used in implementing get/set, above, where the operand is a temporary.
+    NodeIndex getTemporary(unsigned operand)
     {
-        NodeIndex index = m_calleeRegisters[operand];
+        NodeIndex index = m_temporaries[operand];
         if (index != NoNode)
             return index;
-        // We have not yet seen a definition for this value in this block.
-        // For now, since we are only generating single block functions,
-        // this value must be undefined.
-        // For example:
-        //     function f() { var x; return x; }
+        
+        // Detect a read of an temporary that is not a yet defined within this block (e.g. use of ?:).
+        m_parseFailed = true;
         return constantUndefined();
     }
-    void setRegister(int operand, NodeIndex value)
+    void setTemporary(unsigned operand, NodeIndex value)
     {
-        m_calleeRegisters[operand] = value;
+        m_temporaries[operand] = value;
     }
 
     // Used in implementing get/set, above, where the operand is an argument.
-    NodeIndex getArgument(unsigned argument)
+    NodeIndex getArgument(unsigned operand)
     {
-        NodeIndex index = m_arguments[argument];
-        if (index != NoNode)
-            return index;
-        NodeIndex resultIndex = (NodeIndex)m_graph.size();
-        m_graph.append(Node(Argument, m_currentIndex, OpInfo(argument)));
-        return m_arguments[argument] = resultIndex;
+        unsigned argument = operand + m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize;
+        ASSERT(argument < m_arguments.size());
+
+        NodeIndex setNode = m_arguments[argument].set;
+        if (setNode != NoNode)
+            return m_graph[setNode].child1;
+
+        NodeIndex getNode = m_arguments[argument].get;
+        if (getNode != NoNode)
+            return getNode;
+
+        getNode = addToGraph(GetLocal, OpInfo(operand));
+        m_arguments[argument].get = getNode;
+        return getNode;
     }
     void setArgument(int operand, NodeIndex value)
     {
-        m_arguments[operand] = value;
+        unsigned argument = operand + m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize;
+        ASSERT(argument < m_arguments.size());
+
+        NodeIndex priorSet = m_arguments[argument].set;
+        m_arguments[argument].set = addToGraph(SetLocal, OpInfo(operand), value);
+        if (priorSet != NoNode)
+            m_graph.deref(priorSet);
     }
 
     // Get an operand, and perform a ToInt32/ToNumber conversion on it.
@@ -229,46 +280,43 @@ private:
     // Used in implementing get, above, where the operand is a constant.
     NodeIndex getInt32Constant(int32_t value, unsigned constant)
     {
-        NodeIndex index = m_constantRecords[constant].asInt32;
+        NodeIndex index = m_constants[constant].asInt32;
         if (index != NoNode)
             return index;
-        NodeIndex resultIndex = (NodeIndex)m_graph.size();
-        m_graph.append(Node(Int32Constant, m_currentIndex, OpInfo(constant)));
+        NodeIndex resultIndex = addToGraph(Int32Constant, OpInfo(constant));
         m_graph[resultIndex].setInt32Constant(value);
-        m_constantRecords[constant].asInt32 = resultIndex;
+        m_constants[constant].asInt32 = resultIndex;
         return resultIndex;
     }
     NodeIndex getDoubleConstant(double value, unsigned constant)
     {
-        NodeIndex index = m_constantRecords[constant].asNumeric;
+        NodeIndex index = m_constants[constant].asNumeric;
         if (index != NoNode)
             return index;
-        NodeIndex resultIndex = (NodeIndex)m_graph.size();
-        m_graph.append(Node(DoubleConstant, m_currentIndex, OpInfo(constant)));
+        NodeIndex resultIndex = addToGraph(DoubleConstant, OpInfo(constant));
         m_graph[resultIndex].setDoubleConstant(value);
-        m_constantRecords[constant].asNumeric = resultIndex;
+        m_constants[constant].asNumeric = resultIndex;
         return resultIndex;
     }
     NodeIndex getJSConstant(unsigned constant)
     {
-        NodeIndex index = m_constantRecords[constant].asJSValue;
+        NodeIndex index = m_constants[constant].asJSValue;
         if (index != NoNode)
             return index;
 
-        NodeIndex resultIndex = (NodeIndex)m_graph.size();
-        m_graph.append(Node(JSConstant, m_currentIndex, OpInfo(constant)));
-        m_constantRecords[constant].asJSValue = resultIndex;
+        NodeIndex resultIndex = addToGraph(JSConstant, OpInfo(constant));
+        m_constants[constant].asJSValue = resultIndex;
         return resultIndex;
     }
 
     // Helper functions to get/set the this value.
     NodeIndex getThis()
     {
-        return getArgument(0);
+        return getArgument(m_codeBlock->thisRegister());
     }
     void setThis(NodeIndex value)
     {
-        setArgument(0, value);
+        setArgument(m_codeBlock->thisRegister(), value);
     }
 
     // Convenience methods for checking nodes for constants.
@@ -315,11 +363,11 @@ private:
                     return getJSConstant(m_constantUndefined);
             }
 
-            // Add undefined to the CodeBlock's constants, and add a corresponding slot in m_constantRecords.
-            ASSERT(m_constantRecords.size() == numberOfConstants);
+            // Add undefined to the CodeBlock's constants, and add a corresponding slot in m_constants.
+            ASSERT(m_constants.size() == numberOfConstants);
             m_codeBlock->addConstant(jsUndefined());
-            m_constantRecords.append(ConstantRecord());
-            ASSERT(m_constantRecords.size() == m_codeBlock->numberOfConstantRegisters());
+            m_constants.append(ConstantRecord());
+            ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());
         }
 
         // m_constantUndefined must refer to an entry in the CodeBlock's constant pool that has the value 'undefined'.
@@ -327,6 +375,31 @@ private:
         return getJSConstant(m_constantUndefined);
     }
 
+    // This method returns a JSConstant with the value 'null'.
+    NodeIndex constantNull()
+    {
+        // Has m_constantNull been set up yet?
+        if (m_constantNull == UINT_MAX) {
+            // Search the constant pool for null, if we find it, we can just reuse this!
+            unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();
+            for (m_constantNull = 0; m_constantNull < numberOfConstants; ++m_constantNull) {
+                JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNull);
+                if (testMe.isNull())
+                    return getJSConstant(m_constantNull);
+            }
+
+            // Add null to the CodeBlock's constants, and add a corresponding slot in m_constants.
+            ASSERT(m_constants.size() == numberOfConstants);
+            m_codeBlock->addConstant(jsNull());
+            m_constants.append(ConstantRecord());
+            ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());
+        }
+
+        // m_constantNull must refer to an entry in the CodeBlock's constant pool that has the value 'null'.
+        ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNull).isNull());
+        return getJSConstant(m_constantNull);
+    }
+
     // This method returns a DoubleConstant with the value 1.
     NodeIndex one()
     {
@@ -340,11 +413,11 @@ private:
                     return getDoubleConstant(1, m_constant1);
             }
 
-            // Add the value 1 to the CodeBlock's constants, and add a corresponding slot in m_constantRecords.
-            ASSERT(m_constantRecords.size() == numberOfConstants);
+            // Add the value 1 to the CodeBlock's constants, and add a corresponding slot in m_constants.
+            ASSERT(m_constants.size() == numberOfConstants);
             m_codeBlock->addConstant(jsNumber(1));
-            m_constantRecords.append(ConstantRecord());
-            ASSERT(m_constantRecords.size() == m_codeBlock->numberOfConstantRegisters());
+            m_constants.append(ConstantRecord());
+            ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());
         }
 
         // m_constant1 must refer to an entry in the CodeBlock's constant pool that has the integer value 1.
@@ -374,6 +447,15 @@ private:
             m_graph.ref(resultIndex);
         return resultIndex;
     }
+    NodeIndex addToGraph(NodeType op, OpInfo info1, OpInfo info2, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    {
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(op, m_currentIndex, info1, info2, child1, child2, child3));
+
+        if (op & NodeMustGenerate)
+            m_graph.ref(resultIndex);
+        return resultIndex;
+    }
 
     JSGlobalData* m_globalData;
     CodeBlock* m_codeBlock;
@@ -382,8 +464,8 @@ private:
     // The bytecode index of the current instruction being generated.
     unsigned m_currentIndex;
 
-    // FIXME: used to temporarily disable arithmetic, until we fix associated performance regressions.
-    bool m_noArithmetic;
+    // Record failures due to unimplemented functionality or regressions.
+    bool m_parseFailed;
 
     // We use these values during code generation, and to avoid the need for
     // special handling we make sure they are available as constants in the
@@ -391,6 +473,7 @@ private:
     // UINT_MAX, and lazily updated to hold an index into the CodeBlock's
     // constant pool, as necessary.
     unsigned m_constantUndefined;
+    unsigned m_constantNull;
     unsigned m_constant1;
 
     // A constant in the constant pool may be represented by more than one
@@ -407,12 +490,27 @@ private:
         NodeIndex asNumeric;
         NodeIndex asJSValue;
     };
-    Vector <ConstantRecord, 32> m_constantRecords;
+
+    // For every local variable we track any existing get or set of the value.
+    // We track the get so that these may be shared, and we track the set to
+    // retrieve the current value, and to reference the final definition.
+    struct VariableRecord {
+        VariableRecord()
+            : get(NoNode)
+            , set(NoNode)
+        {
+        }
+
+        NodeIndex get;
+        NodeIndex set;
+    };
 
     // Track the index of the node whose result is the current value for every
     // register value in the bytecode - argument, local, and temporary.
-    Vector <NodeIndex, 32> m_arguments;
-    Vector <NodeIndex, 32> m_calleeRegisters;
+    Vector <ConstantRecord, 32> m_constants;
+    Vector <VariableRecord, 32> m_arguments;
+    Vector <VariableRecord, 32> m_variables;
+    Vector <NodeIndex, 32> m_temporaries;
 
     // These maps are used to unique ToNumber and ToInt32 operations.
     typedef HashMap<NodeIndex, NodeIndex> UnaryOpMap;
@@ -422,15 +520,37 @@ private:
 
 #define NEXT_OPCODE(name) \
     m_currentIndex += OPCODE_LENGTH(name); \
-    continue;
+    continue
 
-bool ByteCodeParser::parse()
+#define LAST_OPCODE(name) \
+    m_currentIndex += OPCODE_LENGTH(name); \
+    return !m_parseFailed
+
+bool ByteCodeParser::parseBlock(unsigned limit)
 {
+    // No need to reset state initially, since it has been set by the constructor.
+    if (m_currentIndex) {
+        for (unsigned i = 0; i < m_constants.size(); ++i)
+            m_constants[i] = ConstantRecord();
+        for (unsigned i = 0; i < m_variables.size(); ++i)
+            m_variables[i] = VariableRecord();
+        for (unsigned i = 0; i < m_arguments.size(); ++i)
+            m_arguments[i] = VariableRecord();
+        for (unsigned i = 0; i < m_temporaries.size(); ++i)
+            m_temporaries[i] = NoNode;
+    }
+
     AliasTracker aliases(m_graph);
 
     Interpreter* interpreter = m_globalData->interpreter;
     Instruction* instructionsBegin = m_codeBlock->instructions().begin();
     while (true) {
+        // Don't extend over jump destinations.
+        if (m_currentIndex == limit) {
+            addToGraph(Jump, OpInfo(m_currentIndex));
+            return !m_parseFailed;
+        }
+
         // Switch on the current bytecode opcode.
         Instruction* currentInstruction = instructionsBegin + m_currentIndex;
         switch (interpreter->getOpcodeID(currentInstruction->u.opcode)) {
@@ -438,8 +558,9 @@ bool ByteCodeParser::parse()
         // === Function entry opcodes ===
 
         case op_enter:
-            // This is a no-op for now - may need to initialize locals, if
-            // DCE analysis cannot determine that the values are never read.
+            // Initialize all locals to undefined.
+            for (int i = 0; i < m_codeBlock->m_numVars; ++i)
+                set(i, constantUndefined());
             NEXT_OPCODE(op_enter);
 
         case op_convert_this: {
@@ -561,7 +682,7 @@ bool ByteCodeParser::parse()
         // === Arithmetic operations ===
 
         case op_add: {
-            m_noArithmetic = false;
+            ARITHMETIC_OP();
             NodeIndex op1 = get(currentInstruction[2].u.operand);
             NodeIndex op2 = get(currentInstruction[3].u.operand);
             // If both operands can statically be determined to the numbers, then this is an arithmetic add.
@@ -574,7 +695,7 @@ bool ByteCodeParser::parse()
         }
 
         case op_sub: {
-            m_noArithmetic = false;
+            ARITHMETIC_OP();
             NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
             NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
             set(currentInstruction[1].u.operand, addToGraph(ArithSub, op1, op2));
@@ -582,7 +703,7 @@ bool ByteCodeParser::parse()
         }
 
         case op_mul: {
-            m_noArithmetic = false;
+            ARITHMETIC_OP();
             NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
             NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
             set(currentInstruction[1].u.operand, addToGraph(ArithMul, op1, op2));
@@ -590,7 +711,7 @@ bool ByteCodeParser::parse()
         }
 
         case op_mod: {
-            m_noArithmetic = false;
+            ARITHMETIC_OP();
             NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
             NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
             set(currentInstruction[1].u.operand, addToGraph(ArithMod, op1, op2));
@@ -598,7 +719,7 @@ bool ByteCodeParser::parse()
         }
 
         case op_div: {
-            m_noArithmetic = false;
+            ARITHMETIC_OP();
             NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
             NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
             set(currentInstruction[1].u.operand, addToGraph(ArithDiv, op1, op2));
@@ -613,6 +734,75 @@ bool ByteCodeParser::parse()
             NEXT_OPCODE(op_mov);
         }
 
+        case op_not: {
+            ARITHMETIC_OP();
+            NodeIndex value = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(LogicalNot, value));
+            NEXT_OPCODE(op_not);
+        }
+
+        case op_less: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareLess, op1, op2));
+            NEXT_OPCODE(op_less);
+        }
+
+        case op_lesseq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareLessEq, op1, op2));
+            NEXT_OPCODE(op_lesseq);
+        }
+
+        case op_eq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareEq, op1, op2));
+            NEXT_OPCODE(op_eq);
+        }
+
+        case op_eq_null: {
+            ARITHMETIC_OP();
+            NodeIndex value = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareEq, value, constantNull()));
+            NEXT_OPCODE(op_eq_null);
+        }
+
+        case op_stricteq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareStrictEq, op1, op2));
+            NEXT_OPCODE(op_stricteq);
+        }
+
+        case op_neq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(LogicalNot, addToGraph(CompareEq, op1, op2)));
+            NEXT_OPCODE(op_neq);
+        }
+
+        case op_neq_null: {
+            ARITHMETIC_OP();
+            NodeIndex value = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(LogicalNot, addToGraph(CompareEq, value, constantNull())));
+            NEXT_OPCODE(op_neq_null);
+        }
+
+        case op_nstricteq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(LogicalNot, addToGraph(CompareStrictEq, op1, op2)));
+            NEXT_OPCODE(op_nstricteq);
+        }
+
         // === Property access operations ===
 
         case op_get_by_val: {
@@ -624,7 +814,7 @@ bool ByteCodeParser::parse()
             aliases.recordGetByVal(getByVal);
 
             NEXT_OPCODE(op_get_by_val);
-        };
+        }
 
         case op_put_by_val: {
             NodeIndex base = get(currentInstruction[1].u.operand);
@@ -636,7 +826,7 @@ bool ByteCodeParser::parse()
             aliases.recordPutByVal(putByVal);
 
             NEXT_OPCODE(op_put_by_val);
-        };
+        }
 
         case op_get_by_id: {
             NodeIndex base = get(currentInstruction[2].u.operand);
@@ -680,35 +870,169 @@ bool ByteCodeParser::parse()
 
         // === Block terminators. ===
 
+        case op_jmp: {
+            unsigned relativeOffset = currentInstruction[1].u.operand;
+            addToGraph(Jump, OpInfo(m_currentIndex + relativeOffset));
+            LAST_OPCODE(op_jmp);
+        }
+
+        case op_loop: {
+            unsigned relativeOffset = currentInstruction[1].u.operand;
+            addToGraph(Jump, OpInfo(m_currentIndex + relativeOffset));
+            LAST_OPCODE(op_loop);
+        }
+
+        case op_jtrue: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex condition = get(currentInstruction[1].u.operand);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_jtrue)), condition);
+            LAST_OPCODE(op_jtrue);
+        }
+
+        case op_jfalse: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex condition = get(currentInstruction[1].u.operand);
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jfalse)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_jfalse);
+        }
+
+        case op_loop_if_true: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex condition = get(currentInstruction[1].u.operand);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_loop_if_true)), condition);
+            LAST_OPCODE(op_loop_if_true);
+        }
+
+        case op_loop_if_false: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex condition = get(currentInstruction[1].u.operand);
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_loop_if_false)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_loop_if_false);
+        }
+
+        case op_jeq_null: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex value = get(currentInstruction[1].u.operand);
+            NodeIndex condition = addToGraph(CompareEq, value, constantNull());
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_jeq_null)), condition);
+            LAST_OPCODE(op_jeq_null);
+        }
+
+        case op_jneq_null: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex value = get(currentInstruction[1].u.operand);
+            NodeIndex condition = addToGraph(CompareEq, value, constantNull());
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jneq_null)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_jneq_null);
+        }
+
+        case op_jnless: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLess, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jnless)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_jnless);
+        }
+
+        case op_jnlesseq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLessEq, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jnlesseq)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_jnlesseq);
+        }
+
+        case op_jless: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLess, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_jless)), condition);
+            LAST_OPCODE(op_jless);
+        }
+
+        case op_jlesseq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLessEq, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_jlesseq)), condition);
+            LAST_OPCODE(op_jlesseq);
+        }
+
+        case op_loop_if_less: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLess, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_loop_if_less)), condition);
+            LAST_OPCODE(op_loop_if_less);
+        }
+
+        case op_loop_if_lesseq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLessEq, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_loop_if_lesseq)), condition);
+            LAST_OPCODE(op_loop_if_lesseq);
+        }
+
         case op_ret: {
             addToGraph(Return, get(currentInstruction[1].u.operand));
-            m_currentIndex += OPCODE_LENGTH(op_ret);
-#if ENABLE(DFG_JIT_RESTRICTIONS)
-            // FIXME: temporarily disabling the DFG JIT for functions containing arithmetic.
-            return m_noArithmetic;
-#else
-            return true;
-#endif
+
+            // FIXME: throw away terminal definitions of variables;
+            // should not be necessary once we have proper DCE!
+            for (unsigned i = 0; i < m_variables.size(); ++i) {
+                NodeIndex priorSet = m_variables[i].set;
+                if (priorSet != NoNode)
+                    m_graph.deref(priorSet);
+            }
+
+            LAST_OPCODE(op_ret);
         }
 
         default:
-            // parse failed!
+            // Parse failed!
             return false;
         }
     }
 }
 
-bool parse(Graph& graph, JSGlobalData* globalData, CodeBlock* codeBlock)
+bool ByteCodeParser::parse()
 {
-    // Call ByteCodeParser::parse to build the dataflow for the basic block at 'startIndex'.
-    ByteCodeParser state(globalData, codeBlock, graph);
-    if (!state.parse())
-        return false;
+    // Set during construction.
+    ASSERT(!m_currentIndex);
+
+    for (unsigned jumpTargetIndex = 0; jumpTargetIndex <= m_codeBlock->numberOfJumpTargets(); ++jumpTargetIndex) {
+        // The maximum bytecode offset to go into the current basicblock is either the next jump target, or the end of the instructions.
+        unsigned limit = jumpTargetIndex < m_codeBlock->numberOfJumpTargets() ? m_codeBlock->jumpTarget(jumpTargetIndex) : m_codeBlock->instructions().size();
+        ASSERT(m_currentIndex < limit);
+
+        // Loop until we reach the current limit (i.e. next jump target).
+        do {
+            unsigned bytecodeBegin = m_currentIndex;
+            NodeIndex begin = m_graph.size();
+
+            if (!parseBlock(limit))
+                return false;
+            // We should not have gone beyond the limit.
+            ASSERT(m_currentIndex <= limit);
+
+            NodeIndex end = m_graph.size();
+            m_graph.m_blocks.append(BasicBlock(bytecodeBegin, begin, end));
+        } while (m_currentIndex < limit);
+    }
+
+    // Should have reached the end of the instructions.
+    ASSERT(m_currentIndex == m_codeBlock->instructions().size());
 
     // Assign VirtualRegisters.
-    ScoreBoard scoreBoard(graph);
-    Node* nodes = graph.begin();
-    size_t size = graph.size();
+    ScoreBoard scoreBoard(m_graph, m_variables.size());
+    Node* nodes = m_graph.begin();
+    size_t size = m_graph.size();
     for (size_t i = 0; i < size; ++i) {
         Node& node = nodes[i];
         if (node.refCount) {
@@ -730,15 +1054,29 @@ bool parse(Graph& graph, JSGlobalData* globalData, CodeBlock* codeBlock)
     // 'm_numCalleeRegisters' is the number of locals and temporaries allocated
     // for the function (and checked for on entry). Since we perform a new and
     // different allocation of temporaries, more registers may now be required.
-    if ((unsigned)codeBlock->m_numCalleeRegisters < scoreBoard.allocatedCount())
-        codeBlock->m_numCalleeRegisters = scoreBoard.allocatedCount();
+    unsigned calleeRegisters = scoreBoard.allocatedCount() + m_variables.size();
+    if ((unsigned)m_codeBlock->m_numCalleeRegisters < calleeRegisters)
+        m_codeBlock->m_numCalleeRegisters = calleeRegisters;
 
 #if DFG_DEBUG_VERBOSE
-    graph.dump(codeBlock);
+    m_graph.dump(m_codeBlock);
 #endif
+
     return true;
 }
 
+bool parse(Graph& graph, JSGlobalData* globalData, CodeBlock* codeBlock)
+{
+#if DFG_DEBUG_LOCAL_DISBALE
+    UNUSED_PARAM(graph);
+    UNUSED_PARAM(globalData);
+    UNUSED_PARAM(codeBlock);
+    return false;
+#else
+    return ByteCodeParser(globalData, codeBlock, graph).parse();
+#endif
+}
+
 } } // namespace JSC::DFG
 
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGGenerationInfo.h b/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
index b3aa0cd..1c72e09 100644
--- a/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
+++ b/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
@@ -69,16 +69,6 @@ public:
     {
     }
 
-    // Used to set the generation info according the the result
-    // of various operations.
-    void initArgument(NodeIndex nodeIndex, uint32_t useCount)
-    {
-        m_nodeIndex = nodeIndex;
-        m_useCount = useCount;
-        m_registerFormat = DataFormatNone;
-        m_spillFormat = DataFormatNone;
-        m_canFill = true;
-    }
     void initConstant(NodeIndex nodeIndex, uint32_t useCount)
     {
         m_nodeIndex = nodeIndex;
@@ -168,12 +158,12 @@ public:
     {
         // This should only be called on values that are currently in a register.
         ASSERT(m_registerFormat != DataFormatNone);
-        // Constants and arguments do not need spilling, nor do values
-        // that have already been spilled to the RegisterFile.
+        // Constants do not need spilling, nor do values that have already been
+        // spilled to the RegisterFile.
         return !m_canFill;
     }
 
-    // Called when a VirtualRegister is being spilled †o the RegisterFile for the first time.
+    // Called when a VirtualRegister is being spilled to the RegisterFile for the first time.
     void spill(DataFormat spillFormat)
     {
         // We shouldn't be spill values that don't need spilling.
@@ -190,9 +180,8 @@ public:
         m_canFill = true;
     }
 
-    // Called on values that don't need spilling (constants, arguments,
-    // values that have already been spilled), to mark them as no longer
-    // being in machine registers.
+    // Called on values that don't need spilling (constants and values that have
+    // already been spilled), to mark them as no longer being in machine registers.
     void setSpilled()
     {
         // Should only be called on values that don't need spilling, and are currently in registers.
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index be3beec..84e2d4d 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -33,88 +33,108 @@
 namespace JSC { namespace DFG {
 
 #ifndef NDEBUG
-void Graph::dump(CodeBlock* codeBlock)
-{
-    // Creates an array of stringized names.
+
+// Creates an array of stringized names.
+static const char* dfgOpNames[] = {
 #define STRINGIZE_DFG_OP_ENUM(opcode, flags) #opcode ,
-    const char* dfgOpNames[] = {
-        FOR_EACH_DFG_OP(STRINGIZE_DFG_OP_ENUM)
-    };
+    FOR_EACH_DFG_OP(STRINGIZE_DFG_OP_ENUM)
 #undef STRINGIZE_DFG_OP_ENUM
+};
+
+void Graph::dump(NodeIndex nodeIndex, CodeBlock* codeBlock)
+{
+    Node& node = at(nodeIndex);
+    NodeType op = node.op;
+
+    unsigned refCount = node.refCount;
+    if (!refCount)
+        return;
+    bool mustGenerate = node.mustGenerate();
+    if (mustGenerate)
+        --refCount;
+
+    // Example/explanation of dataflow dump output
+    //
+    //   14:   <!2:7>  GetByVal(@3, @13)
+    //   ^1     ^2 ^3     ^4       ^5
+    //
+    // (1) The nodeIndex of this operation.
+    // (2) The reference count. The number printed is the 'real' count,
+    //     not including the 'mustGenerate' ref. If the node is
+    //     'mustGenerate' then the count it prefixed with '!'.
+    // (3) The virtual register slot assigned to this node.
+    // (4) The name of the operation.
+    // (5) The arguments to the operation. The may be of the form:
+    //         @#   - a NodeIndex referencing a prior node in the graph.
+    //         arg# - an argument number.
+    //         $#   - the index in the CodeBlock of a constant { for numeric constants the value is displayed | for integers, in both decimal and hex }.
+    //         id#  - the index in the CodeBlock of an identifier { if codeBlock is passed to dump(), the string representation is displayed }.
+    //         var# - the index of a var on the global object, used by GetGlobalVar/PutGlobalVar operations.
+    printf("% 4d:\t<%c%u:%u>\t%s(", (int)nodeIndex, mustGenerate ? '!' : ' ', refCount, node.virtualRegister, dfgOpNames[op & NodeIdMask]);
+    if (node.child1 != NoNode)
+        printf("@%u", node.child1);
+    if (node.child2 != NoNode)
+        printf(", @%u", node.child2);
+    if (node.child3 != NoNode)
+        printf(", @%u", node.child3);
+    bool hasPrinted = node.child1 != NoNode;
+
+    if (node.hasVarNumber()) {
+        printf("%svar%u", hasPrinted ? ", " : "", node.varNumber());
+        hasPrinted = true;
+    }
+    if (node.hasIdentifier()) {
+        if (codeBlock)
+            printf("%sid%u{%s}", hasPrinted ? ", " : "", node.identifierNumber(), codeBlock->identifier(node.identifierNumber()).ustring().utf8().data());
+        else
+            printf("%sid%u", hasPrinted ? ", " : "", node.identifierNumber());
+        hasPrinted = true;
+    }
+    if (node.hasLocal()) {
+        int local = node.local();
+        if (local < 0)
+            printf("%sarg%u", hasPrinted ? ", " : "", local - codeBlock->thisRegister());
+        else
+            printf("%sr%u", hasPrinted ? ", " : "", local);
+        hasPrinted = true;
+    }
+    if (op == Int32Constant) {
+        printf("%s$%u{%d|0x%08x}", hasPrinted ? ", " : "", node.constantNumber(), node.int32Constant(), node.int32Constant());
+        hasPrinted = true;
+    }
+    if (op == DoubleConstant) {
+        printf("%s$%u{%f})", hasPrinted ? ", " : "", node.constantNumber(), node.numericConstant());
+        hasPrinted = true;
+    }
+    if (op == JSConstant) {
+        printf("%s$%u", hasPrinted ? ", " : "", node.constantNumber());
+        hasPrinted = true;
+    }
+    if  (node.isBranch() || node.isJump()) {
+        printf("%sT:#%u", hasPrinted ? ", " : "", blockIndexForBytecodeOffset(node.takenBytecodeOffset()));
+        hasPrinted = true;
+    }
+    if  (node.isBranch()) {
+        printf("%sF:#%u", hasPrinted ? ", " : "", blockIndexForBytecodeOffset(node.notTakenBytecodeOffset()));
+        hasPrinted = true;
+    }
+
+    printf(")\n");
+}
 
-    Node* nodes = this->begin();
-
-    for (size_t i = 0; i < size(); ++i) {
-        Node& node = nodes[i];
-        NodeType op = node.op;
-
-        unsigned refCount = node.refCount;
-        if (!refCount)
-            continue;
-        bool mustGenerate = node.mustGenerate();
-        if (mustGenerate)
-            --refCount;
-
-        // Example/explanation of dataflow dump output
-        //
-        //   14:   <!2:7>  GetByVal(@3, @13)
-        //   ^1     ^2 ^3     ^4       ^5
-        //
-        // (1) The nodeIndex of this operation.
-        // (2) The reference count. The number printed is the 'real' count,
-        //     not including the 'mustGenerate' ref. If the node is
-        //     'mustGenerate' then the count it prefixed with '!'.
-        // (3) The virtual register slot assigned to this node.
-        // (4) The name of the operation.
-        // (5) The arguments to the operation. The may be of the form:
-        //         @#   - a NodeIndex referencing a prior node in the graph.
-        //         arg# - an argument number.
-        //         $#   - the index in the CodeBlock of a constant { for numeric constants the value is displayed | for integers, in both decimal and hex }.
-        //         id#  - the index in the CodeBlock of an identifier { if codeBlock is passed to dump(), the string representation is displayed }.
-        //         var# - the index of a var on the global object, used by GetGlobalVar/PutGlobalVar operations.
-        printf("% 4d:\t<%c%u:%u>\t%s(", (int)i, mustGenerate ? '!' : ' ', refCount, node.virtualRegister, dfgOpNames[op & NodeIdMask]);
-        if (node.child1 != NoNode)
-            printf("@%u", node.child1);
-        if (node.child2 != NoNode)
-            printf(", @%u", node.child2);
-        if (node.child3 != NoNode)
-            printf(", @%u", node.child3);
-        bool hasPrinted = node.child1 != NoNode;
-
-        if (node.hasVarNumber()) {
-            printf("%svar%u", hasPrinted ? ", " : "", node.varNumber());
-            hasPrinted = true;
-        }
-        if (node.hasIdentifier()) {
-            if (codeBlock)
-                printf("%sid%u{%s}", hasPrinted ? ", " : "", node.identifierNumber(), codeBlock->identifier(node.identifierNumber()).ustring().utf8().data());
-            else
-                printf("%sid%u", hasPrinted ? ", " : "", node.identifierNumber());
-            hasPrinted = true;
-        }
-        if (node.isArgument()) {
-            printf("%sarg%u", hasPrinted ? ", " : "", node.argumentNumber());
-            hasPrinted = true;
-        }
-        if (op == Int32Constant) {
-            printf("%s$%u{%d|0x%08x}", hasPrinted ? ", " : "", node.constantNumber(), node.int32Constant(), node.int32Constant());
-            hasPrinted = true;
-        }
-        if (op == DoubleConstant) {
-            printf("%s$%u{%f})", hasPrinted ? ", " : "", node.constantNumber(), node.numericConstant());
-            hasPrinted = true;
-        }
-        if (op == JSConstant) {
-            printf("%s$%u", hasPrinted ? ", " : "", node.constantNumber());
-            hasPrinted = true;
-        }
-
-        printf(")\n");
+void Graph::dump(CodeBlock* codeBlock)
+{
+    for (size_t b = 0; b < m_blocks.size(); ++b) {
+        printf("Block #%u:\n", (int)b);
+        BasicBlock& block = m_blocks[b];
+        for (size_t i = block.begin; i < block.end; ++i)
+            dump(i, codeBlock);
     }
 }
+
 #endif
 
-// FIXME: Convert this method to be iterative, not recursive.
+// FIXME: Convert these methods to be iterative, not recursive.
 void Graph::refChildren(NodeIndex op)
 {
     Node& node = at(op);
@@ -135,6 +155,26 @@ void Graph::refChildren(NodeIndex op)
         return;
     ref(node.child3);
 }
+void Graph::derefChildren(NodeIndex op)
+{
+    Node& node = at(op);
+
+    if (node.child1 == NoNode) {
+        ASSERT(node.child2 == NoNode && node.child3 == NoNode);
+        return;
+    }
+    deref(node.child1);
+
+    if (node.child2 == NoNode) {
+        ASSERT(node.child3 == NoNode);
+        return;
+    }
+    deref(node.child2);
+
+    if (node.child3 == NoNode)
+        return;
+    deref(node.child3);
+}
 
 } } // namespace JSC::DFG
 
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index c02110e..c6bc7df 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -30,6 +30,7 @@
 
 #include <dfg/DFGNode.h>
 #include <wtf/Vector.h>
+#include <wtf/StdLibExtras.h>
 
 namespace JSC {
 
@@ -37,6 +38,26 @@ class CodeBlock;
 
 namespace DFG {
 
+typedef uint32_t BlockIndex;
+
+struct BasicBlock {
+    BasicBlock(unsigned bytecodeBegin, NodeIndex begin, NodeIndex end)
+        : bytecodeBegin(bytecodeBegin)
+        , begin(begin)
+        , end(end)
+    {
+    }
+
+    static inline BlockIndex getBytecodeBegin(BasicBlock* block)
+    {
+        return block->bytecodeBegin;
+    }
+
+    unsigned bytecodeBegin;
+    NodeIndex begin;
+    NodeIndex end;
+};
+
 // 
 // === Graph ===
 //
@@ -48,19 +69,40 @@ public:
     // Mark a node as being referenced.
     void ref(NodeIndex nodeIndex)
     {
-        // If the value (before incrementing) was at reCount zero then we need to ref its children.
-        if (!at(nodeIndex).refCount++)
+        Node& node = at(nodeIndex);
+        // If the value (before incrementing) was at refCount zero then we need to ref its children.
+        if (!node.refCount++)
             refChildren(nodeIndex);
     }
+    void deref(NodeIndex nodeIndex)
+    {
+        Node& node = at(nodeIndex);
+        ASSERT(node.refCount);
+        // If the value (after decrementing) becomes refCount zero then we need to deref its children.
+        if (!--node.refCount)
+            derefChildren(nodeIndex);
+    }
 
 #ifndef NDEBUG
     // CodeBlock is optional, but may allow additional information to be dumped (e.g. Identifier names).
     void dump(CodeBlock* = 0);
+    void dump(NodeIndex, CodeBlock* = 0);
 #endif
 
+    Vector<BasicBlock> m_blocks;
+
+    BlockIndex blockIndexForBytecodeOffset(unsigned bytecodeBegin)
+    {
+        BasicBlock* begin = m_blocks.begin();
+        BasicBlock* block = binarySearch<BasicBlock, unsigned, BasicBlock::getBytecodeBegin>(begin, m_blocks.size(), bytecodeBegin);
+        ASSERT(block >= m_blocks.begin() && block < m_blocks.end());
+        return static_cast<BlockIndex>(block - begin);
+    }
+
 private:
-    // When a node's refCount goes from 0 to 1, it must (logically) recursively ref all of its children.
+    // When a node's refCount goes from 0 to 1, it must (logically) recursively ref all of its children, and vice versa.
     void refChildren(NodeIndex);
+    void derefChildren(NodeIndex);
 };
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp
index b945b5a..52e0abe 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp
+++ b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp
@@ -60,9 +60,6 @@ GPRReg JITCodeGenerator::fillInteger(NodeIndex nodeIndex, DataFormat& returnForm
                 JSValue jsValue = valueOfJSConstant(nodeIndex);
                 m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
             }
-        } else if (node.isArgument()) {
-            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
-            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
         } else {
             ASSERT(info.spillFormat() == DataFormatJS || info.spillFormat() == DataFormatJSInteger);
             m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
@@ -143,11 +140,6 @@ FPRReg JITCodeGenerator::fillDouble(NodeIndex nodeIndex)
                 info.fillJSValue(gpr, DataFormatJS);
                 unlock(gpr);
             }
-        } else if (node.isArgument()) {
-            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
-            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
-            info.fillJSValue(gpr, DataFormatJS);
-            unlock(gpr);
         } else {
             DataFormat spillFormat = info.spillFormat();
             ASSERT(spillFormat & DataFormatJS);
@@ -267,10 +259,6 @@ GPRReg JITCodeGenerator::fillJSValue(NodeIndex nodeIndex)
             }
 
             m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-        } else if (node.isArgument()) {
-            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
-            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
-            info.fillJSValue(gpr, DataFormatJS);
         } else {
             DataFormat spillFormat = info.spillFormat();
             ASSERT(spillFormat & DataFormatJS);
@@ -283,6 +271,13 @@ GPRReg JITCodeGenerator::fillJSValue(NodeIndex nodeIndex)
 
     case DataFormatInteger: {
         GPRReg gpr = info.gpr();
+        // If the register has already been locked we need to take a copy.
+        // If not, we'll zero extend in place, so mark on the info that this is now type DataFormatInteger, not DataFormatJSInteger.
+        if (m_gprs.isLocked(gpr)) {
+            GPRReg result = allocate();
+            m_jit.orPtr(JITCompiler::tagTypeNumberRegister, JITCompiler::gprToRegisterID(gpr), JITCompiler::gprToRegisterID(result));
+            return result;
+        }
         m_gprs.lock(gpr);
         m_jit.orPtr(JITCompiler::tagTypeNumberRegister, JITCompiler::gprToRegisterID(gpr));
         info.fillJSValue(gpr, DataFormatJSInteger);
diff --git a/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h
index a84cdc6..0abd3c7 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h
+++ b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h
@@ -59,7 +59,6 @@ protected:
         SpillOrderNone,
         SpillOrderConstant = 1, // no spill, and cheap fill
         SpillOrderSpilled = 2,  // no spill
-        SpillOrderArgument = 3, // no spill, but we may lose typeinfo
         SpillOrderJS = 4,       // needs spill
         SpillOrderCell = 4,     // needs spill
         SpillOrderInteger = 5,  // needs spill and box
@@ -152,6 +151,7 @@ protected:
         , m_isSpeculative(isSpeculative)
         , m_compileIndex(0)
         , m_generationInfo(m_jit.codeBlock()->m_numCalleeRegisters)
+        , m_blockHeads(jit.graph().m_blocks.size())
     {
     }
 
@@ -237,6 +237,7 @@ protected:
     }
 
     // Checks/accessors for constant values.
+    bool isConstant(NodeIndex nodeIndex) { return m_jit.isConstant(nodeIndex); }
     bool isInt32Constant(NodeIndex nodeIndex) { return m_jit.isInt32Constant(nodeIndex); }
     bool isDoubleConstant(NodeIndex nodeIndex) { return m_jit.isDoubleConstant(nodeIndex); }
     bool isJSConstant(NodeIndex nodeIndex) { return m_jit.isJSConstant(nodeIndex); }
@@ -444,11 +445,6 @@ protected:
         Node& node = m_jit.graph()[nodeIndex];
         m_generationInfo[node.virtualRegister].initConstant(nodeIndex, node.refCount);
     }
-    void initArgumentInfo(NodeIndex nodeIndex)
-    {
-        Node& node = m_jit.graph()[nodeIndex];
-        m_generationInfo[node.virtualRegister].initArgument(nodeIndex, node.refCount);
-    }
 
     // These methods used to sort arguments into the correct registers.
     template<GPRReg destA, GPRReg destB>
@@ -607,6 +603,26 @@ protected:
         appendCallWithExceptionCheck(operation);
         m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
     }
+    void callOperation(Z_DFGOperation_EJ operation, GPRReg result, GPRReg arg1)
+    {
+        ASSERT(isFlushed());
+
+        m_jit.move(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(Z_DFGOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        ASSERT(isFlushed());
+
+        setupStubArguments(arg1, arg2);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
     void callOperation(J_DFGOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
     {
         ASSERT(isFlushed());
@@ -655,6 +671,19 @@ protected:
         m_jit.appendCallWithExceptionCheck(function, m_jit.graph()[m_compileIndex].exceptionInfo);
     }
 
+    void addBranch(const MacroAssembler::Jump& jump, BlockIndex destination)
+    {
+        m_branches.append(BranchRecord(jump, destination));
+    }
+
+    void linkBranches()
+    {
+        for (size_t i = 0; i < m_branches.size(); ++i) {
+            BranchRecord& branch = m_branches[i];
+            branch.jump.linkTo(m_blockHeads[branch.destination], &m_jit);
+        }
+    }
+
 #ifndef NDEBUG
     void dump(const char* label = 0);
 #endif
@@ -679,11 +708,25 @@ protected:
     // the value may have been boxed differently on the two paths.
     bool m_isSpeculative;
     // The current node being generated.
+    BlockIndex m_block;
     NodeIndex m_compileIndex;
     // Virtual and physical register maps.
     Vector<GenerationInfo, 32> m_generationInfo;
     RegisterBank<GPRReg, numberOfGPRs, SpillOrder, SpillOrderNone, SpillOrderMax> m_gprs;
     RegisterBank<FPRReg, numberOfFPRs, SpillOrder, SpillOrderNone, SpillOrderMax> m_fprs;
+
+    Vector<MacroAssembler::Label> m_blockHeads;
+    struct BranchRecord {
+        BranchRecord(MacroAssembler::Jump jump, BlockIndex destination)
+            : jump(jump)
+            , destination(destination)
+        {
+        }
+
+        MacroAssembler::Jump jump;
+        BlockIndex destination;
+    };
+    Vector<BranchRecord, 8> m_branches;
 };
 
 // === Operand types ===
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
index 5c5d5fe..5cd044a 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
@@ -45,9 +45,6 @@ void JITCompiler::fillNumericToDouble(NodeIndex nodeIndex, FPRReg fpr, GPRReg te
     Node& node = graph()[nodeIndex];
     MacroAssembler::RegisterID tempReg = gprToRegisterID(temporary);
 
-    // Arguments can't be know to be double, would need to have been a ValueToNumber node in the way!
-    ASSERT(!node.isArgument());
-
     if (node.isConstant()) {
         ASSERT(node.op == DoubleConstant);
         move(MacroAssembler::ImmPtr(reinterpret_cast<void*>(reinterpretDoubleToIntptr(valueOfDoubleConstant(nodeIndex)))), tempReg);
@@ -70,9 +67,6 @@ void JITCompiler::fillInt32ToInteger(NodeIndex nodeIndex, GPRReg gpr)
 {
     Node& node = graph()[nodeIndex];
 
-    // Arguments can't be know to be int32, would need to have been a ValueToInt32 node in the way!
-    ASSERT(!node.isArgument());
-
     if (node.isConstant()) {
         ASSERT(node.op == Int32Constant);
         move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gprToRegisterID(gpr));
@@ -91,11 +85,6 @@ void JITCompiler::fillToJS(NodeIndex nodeIndex, GPRReg gpr)
 {
     Node& node = graph()[nodeIndex];
 
-    if (node.isArgument()) {
-        loadPtr(addressForArgument(node.argumentNumber()), gprToRegisterID(gpr));
-        return;
-    }
-
     if (node.isConstant()) {
         if (isInt32Constant(nodeIndex)) {
             JSValue jsValue = jsNumber(valueOfInt32Constant(nodeIndex));
@@ -198,8 +187,8 @@ void JITCompiler::jumpFromSpeculativeToNonSpeculative(const SpeculationCheck& ch
 void JITCompiler::linkSpeculationChecks(SpeculativeJIT& speculative, NonSpeculativeJIT& nonSpeculative)
 {
     // Iterators to walk over the set of bail outs & corresponding entry points.
-    SpeculativeJIT::SpeculationCheckVector::Iterator checksIter = speculative.speculationChecks().begin();
-    SpeculativeJIT::SpeculationCheckVector::Iterator checksEnd = speculative.speculationChecks().end();
+    SpeculationCheckVector::Iterator checksIter = speculative.speculationChecks().begin();
+    SpeculationCheckVector::Iterator checksEnd = speculative.speculationChecks().end();
     NonSpeculativeJIT::EntryLocationVector::Iterator entriesIter = nonSpeculative.entryLocations().begin();
     NonSpeculativeJIT::EntryLocationVector::Iterator entriesEnd = nonSpeculative.entryLocations().end();
 
@@ -267,25 +256,36 @@ void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
     // register values around, rebox values, and ensure spilled, to match the
     // non-speculative path's requirements).
 
-#if DFG_JIT_BREAK_ON_ENTRY
+#if DFG_JIT_BREAK_ON_EVERY_FUNCTION
     // Handy debug tool!
     breakpoint();
 #endif
 
     // First generate the speculative path.
+    Label speculativePathBegin = label();
     SpeculativeJIT speculative(*this);
-    speculative.compile();
+    bool compiledSpeculative = speculative.compile();
 
     // Next, generate the non-speculative path. We pass this a SpeculationCheckIndexIterator
     // to allow it to check which nodes in the graph may bail out, and may need to reenter the
     // non-speculative path.
-    SpeculationCheckIndexIterator checkIterator(speculative);
-    NonSpeculativeJIT nonSpeculative(*this);
-    nonSpeculative.compile(checkIterator);
-
-    // Link the bail-outs from the speculative path to the corresponding entry points into the non-speculative one.
-    linkSpeculationChecks(speculative, nonSpeculative);
+    if (compiledSpeculative) {
+        SpeculationCheckIndexIterator checkIterator(speculative.speculationChecks());
+        NonSpeculativeJIT nonSpeculative(*this);
+        nonSpeculative.compile(checkIterator);
 
+        // Link the bail-outs from the speculative path to the corresponding entry points into the non-speculative one.
+        linkSpeculationChecks(speculative, nonSpeculative);
+    } else {
+        // If compilation through the SpeculativeJIT failed, throw away the code we generated.
+        m_calls.clear();
+        rewindToLabel(speculativePathBegin);
+
+        SpeculationCheckVector noChecks;
+        SpeculationCheckIndexIterator checkIterator(noChecks);
+        NonSpeculativeJIT nonSpeculative(*this);
+        nonSpeculative.compile(checkIterator);
+    }
 
     // === Stage 3 - Function footer code generation ===
     //
@@ -349,6 +349,10 @@ void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
 
     LinkBuffer linkBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()), 0);
 
+#if DFG_DEBUG_VERBOSE
+    fprintf(stderr, "JIT code start at %p\n", linkBuffer.debugAddress());
+#endif
+
     // Link all calls out from the JIT code to their respective functions.
     for (unsigned i = 0; i < m_calls.size(); ++i)
         linkBuffer.link(m_calls[i].m_call, m_calls[i].m_function);
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
index 8b68434..03ae2b8 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.h
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
@@ -248,6 +248,10 @@ public:
     }
 
     // Helper methods to check nodes for constants.
+    bool isConstant(NodeIndex nodeIndex)
+    {
+        return graph()[nodeIndex].isConstant();
+    }
     bool isInt32Constant(NodeIndex nodeIndex)
     {
         return graph()[nodeIndex].op == Int32Constant;
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 11dbf0d..2a5b6dd 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -26,10 +26,6 @@
 #ifndef DFGNode_h
 #define DFGNode_h
 
-#if ENABLE(DFG_JIT)
-
-#include <wtf/Vector.h>
-
 // Emit various logging information for debugging, including dumping the dataflow graphs.
 #define DFG_DEBUG_VERBOSE 0
 // Enable generation of dynamic checks into the instruction stream.
@@ -37,9 +33,21 @@
 // Consistency check contents compiler data structures.
 #define DFG_CONSISTENCY_CHECK 0
 // Emit a breakpoint into the head of every generated function, to aid debugging in GDB.
-#define DFG_JIT_BREAK_ON_ENTRY 0
+#define DFG_JIT_BREAK_ON_EVERY_FUNCTION 0
+// Emit a breakpoint into the head of every generated node, to aid debugging in GDB.
+#define DFG_JIT_BREAK_ON_EVERY_BLOCK 0
+// Emit a breakpoint into the head of every generated node, to aid debugging in GDB.
+#define DFG_JIT_BREAK_ON_EVERY_NODE 0
+// Disable the DFG JIT without having to touch Platform.h!
+#define DFG_DEBUG_LOCAL_DISBALE 0
+// Generate stats on how successful we were in making use of the DFG jit, and remaining on the hot path.
+#define DFG_SUCCESS_STATS 0
 
 
+#if ENABLE(DFG_JIT)
+
+#include <wtf/Vector.h>
+
 namespace JSC { namespace DFG {
 
 // Type for a virtual register number (spill location).
@@ -61,6 +69,8 @@ typedef uint32_t ExceptionInfo;
 #define NodeResultMask     0xF000
 #define NodeMustGenerate  0x10000 // set on nodes that have side effects, and may not trivially be removed by DCE.
 #define NodeIsConstant    0x20000
+#define NodeIsJump        0x40000
+#define NodeIsBranch      0x80000
 
 // These values record the result type of the node (as checked by NodeResultMask, above), 0 for no result.
 #define NodeResultJS      0x1000
@@ -73,9 +83,12 @@ typedef uint32_t ExceptionInfo;
     macro(JSConstant, NodeResultJS | NodeIsConstant) \
     macro(Int32Constant, NodeResultJS | NodeIsConstant) \
     macro(DoubleConstant, NodeResultJS | NodeIsConstant) \
-    macro(Argument, NodeResultJS) \
     macro(ConvertThis, NodeResultJS) \
     \
+    /* Nodes for local variable access. */\
+    macro(GetLocal, NodeResultJS) \
+    macro(SetLocal, NodeMustGenerate) \
+    \
     /* Nodes for bitwise operations. */\
     macro(BitAnd, NodeResultInt32) \
     macro(BitOr, NodeResultInt32) \
@@ -115,6 +128,18 @@ typedef uint32_t ExceptionInfo;
     macro(GetGlobalVar, NodeResultJS | NodeMustGenerate) \
     macro(PutGlobalVar, NodeMustGenerate) \
     \
+    /* Nodes for comparison operations. */\
+    macro(CompareLess, NodeResultJS | NodeMustGenerate) \
+    macro(CompareLessEq, NodeResultJS | NodeMustGenerate) \
+    macro(CompareEq, NodeResultJS | NodeMustGenerate) \
+    macro(CompareStrictEq, NodeResultJS) \
+    \
+    /* Nodes for misc operations. */\
+    macro(LogicalNot, NodeResultJS) \
+    \
+    /* Block terminals. */\
+    macro(Jump, NodeMustGenerate | NodeIsJump) \
+    macro(Branch, NodeMustGenerate | NodeIsBranch) \
     macro(Return, NodeMustGenerate)
 
 // This enum generates a monotonically increasing id for all Node types,
@@ -170,6 +195,20 @@ struct Node {
     {
     }
 
+    // Construct a node with up to 3 children and two immediate values.
+    Node(NodeType op, ExceptionInfo exceptionInfo, OpInfo imm1, OpInfo imm2, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+        : op(op)
+        , exceptionInfo(exceptionInfo)
+        , child1(child1)
+        , child2(child2)
+        , child3(child3)
+        , virtualRegister(InvalidVirtualRegister)
+        , refCount(0)
+        , m_opInfo(imm1.m_value)
+    {
+        m_constantValue.opInfo2 = imm2.m_value;
+    }
+
     bool mustGenerate()
     {
         return op & NodeMustGenerate;
@@ -186,15 +225,15 @@ struct Node {
         return m_opInfo;
     }
 
-    bool isArgument()
+    bool hasLocal()
     {
-        return op == Argument;
+        return op == GetLocal || op == SetLocal;
     }
 
-    unsigned argumentNumber()
+    VirtualRegister local()
     {
-        ASSERT(isArgument());
-        return m_opInfo;
+        ASSERT(hasLocal());
+        return (VirtualRegister)m_opInfo;
     }
 
     bool hasIdentifier()
@@ -266,6 +305,28 @@ struct Node {
         m_constantValue.asDouble = value;
     }
 
+    bool isJump()
+    {
+        return op & NodeIsJump;
+    }
+
+    bool isBranch()
+    {
+        return op & NodeIsBranch;
+    }
+
+    unsigned takenBytecodeOffset()
+    {
+        ASSERT(isBranch() || isJump());
+        return m_opInfo;
+    }
+
+    unsigned notTakenBytecodeOffset()
+    {
+        ASSERT(isBranch());
+        return m_constantValue.opInfo2;
+    }
+
     // This enum value describes the type of the node.
     NodeType op;
     // Used to look up exception handling information (currently implemented as a bytecode index).
@@ -284,6 +345,7 @@ private:
     union {
         int32_t asInt32;
         double asDouble;
+        unsigned opInfo2;
     } m_constantValue;
 };
 
diff --git a/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp
index 945c98a..87c4234 100644
--- a/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp
@@ -78,7 +78,7 @@ void NonSpeculativeJIT::valueToNumber(JSValueOperand& operand, FPRReg fpr)
 
     // Next handle cells (& other JS immediates)
     nonNumeric.link(&m_jit);
-    silentSpillAllRegisters(jsValueGpr);
+    silentSpillAllRegisters(fpr, jsValueGpr);
     m_jit.move(jsValueReg, JITCompiler::argumentRegister1);
     m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
     appendCallWithExceptionCheck(dfgConvertJSValueToNumber);
@@ -105,7 +105,7 @@ void NonSpeculativeJIT::valueToInt32(JSValueOperand& operand, GPRReg result)
     JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueReg, JITCompiler::tagTypeNumberRegister);
 
     // First handle non-integers
-    silentSpillAllRegisters(jsValueGpr);
+    silentSpillAllRegisters(result, jsValueGpr);
     m_jit.move(jsValueReg, JITCompiler::argumentRegister1);
     m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
     appendCallWithExceptionCheck(dfgConvertJSValueToInt32);
@@ -126,7 +126,7 @@ void NonSpeculativeJIT::numberToInt32(FPRReg fpr, GPRReg gpr)
 
     JITCompiler::Jump truncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpReg, reg, JITCompiler::BranchIfTruncateSuccessful);
 
-    silentSpillAllRegisters(gpr); // don't really care!
+    silentSpillAllRegisters(gpr);
 
     m_jit.moveDouble(fpReg, JITCompiler::fpArgumentRegister0);
     appendCallWithExceptionCheck(toInt32);
@@ -137,6 +137,40 @@ void NonSpeculativeJIT::numberToInt32(FPRReg fpr, GPRReg gpr)
     truncatedToInteger.link(&m_jit);
 }
 
+bool NonSpeculativeJIT::isKnownInteger(NodeIndex nodeIndex)
+{
+    GenerationInfo& info = m_generationInfo[m_jit.graph()[nodeIndex].virtualRegister];
+
+    DataFormat registerFormat = info.registerFormat();
+    if (registerFormat != DataFormatNone)
+        return (registerFormat | DataFormatJS) == DataFormatJSInteger;
+
+    DataFormat spillFormat = info.spillFormat();
+    if (spillFormat != DataFormatNone)
+        return (spillFormat | DataFormatJS) == DataFormatJSInteger;
+
+    ASSERT(isConstant(nodeIndex));
+    return isInt32Constant(nodeIndex);
+}
+
+bool NonSpeculativeJIT::isKnownNumeric(NodeIndex nodeIndex)
+{
+    GenerationInfo& info = m_generationInfo[m_jit.graph()[nodeIndex].virtualRegister];
+
+    DataFormat registerFormat = info.registerFormat();
+    if (registerFormat != DataFormatNone)
+        return (registerFormat | DataFormatJS) == DataFormatJSInteger
+            || (registerFormat | DataFormatJS) == DataFormatJSDouble;
+
+    DataFormat spillFormat = info.spillFormat();
+    if (spillFormat != DataFormatNone)
+        return (spillFormat | DataFormatJS) == DataFormatJSInteger
+            || (spillFormat | DataFormatJS) == DataFormatJSDouble;
+
+    ASSERT(isConstant(nodeIndex));
+    return isInt32Constant(nodeIndex) || isDoubleConstant(nodeIndex);
+}
+
 void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, Node& node)
 {
     // ...
@@ -144,7 +178,6 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
         trackEntry(m_jit.label());
 
     checkConsistency();
-
     NodeType op = node.op;
 
     switch (op) {
@@ -164,10 +197,20 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
     case JSConstant:
         initConstantInfo(m_compileIndex);
         break;
-    
-    case Argument:
-        initArgumentInfo(m_compileIndex);
+
+    case GetLocal: {
+        GPRTemporary result(this);
+        m_jit.loadPtr(JITCompiler::addressFor(node.local()), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
         break;
+    }
+
+    case SetLocal: {
+        JSValueOperand value(this, node.child1);
+        m_jit.storePtr(value.registerID(), JITCompiler::addressFor(node.local()));
+        noResult(m_compileIndex);
+        break;
+    }
 
     case BitAnd:
     case BitOr:
@@ -250,10 +293,8 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
     case NumberToInt32:
     case ValueToInt32: {
         ASSERT(!isInt32Constant(node.child1));
-        GenerationInfo& operandInfo = m_generationInfo[m_jit.graph()[node.child1].virtualRegister];
 
-        switch (operandInfo.registerFormat()) {
-        case DataFormatInteger: {
+        if (isKnownInteger(node.child1)) {
             IntegerOperand op1(this, node.child1);
             GPRTemporary result(this, op1);
             m_jit.move(op1.registerID(), result.registerID());
@@ -261,7 +302,7 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
             break;
         }
 
-        case DataFormatDouble: {
+        if (isKnownNumeric(node.child1)) {
             DoubleOperand op1(this, node.child1);
             GPRTemporary result(this);
             numberToInt32(op1.fpr(), result.gpr());
@@ -269,84 +310,29 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
             break;
         }
 
-        default: {
-            JSValueOperand op1(this, node.child1);
-            GPRTemporary result(this, op1);
-            op1.gpr(); // force op1 to be filled!
-            result.gpr(); // force result to be allocated!
-            
-            switch (operandInfo.registerFormat()) {
-            case DataFormatNone:
-            case DataFormatInteger:
-            case DataFormatDouble:
-                // The operand has been filled as a JSValue; it cannot be in a !DataFormatJS state.
-                CRASH();
-
-            case DataFormatCell:
-            case DataFormatJS:
-            case DataFormatJSCell: {
-                if (op == NumberToInt32) {
-                    FPRTemporary fpTemp(this);
-                    FPRReg fpr = fpTemp.fpr();
-
-                    JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, op1.registerID(), JITCompiler::tagTypeNumberRegister);
-
-                    m_jit.move(op1.registerID(), result.registerID());
-                    m_jit.addPtr(JITCompiler::tagTypeNumberRegister, result.registerID());
-                    m_jit.movePtrToDouble(result.registerID(), fpTemp.registerID());
-                    numberToInt32(fpr, result.gpr());
-                    JITCompiler::Jump wasDouble = m_jit.jump();
-                    
-                    isInteger.link(&m_jit);
-                    m_jit.zeroExtend32ToPtr(op1.registerID(), result.registerID());
-
-                    wasDouble.link(&m_jit);
-                } else
-                    valueToInt32(op1, result.gpr());
-                integerResult(result.gpr(), m_compileIndex);
-                break;
-            }
-
-            case DataFormatJSDouble: {
-                FPRTemporary fpTemp(this);
-                m_jit.move(op1.registerID(), result.registerID());
-                m_jit.addPtr(JITCompiler::tagTypeNumberRegister, result.registerID());
-                m_jit.movePtrToDouble(result.registerID(), fpTemp.registerID());
-                numberToInt32(fpTemp.fpr(), result.gpr());
-                integerResult(result.gpr(), m_compileIndex);
-                break;
-            }
-
-            case DataFormatJSInteger: {
-                m_jit.move(op1.registerID(), result.registerID());
-                jsValueResult(result.gpr(), m_compileIndex, DataFormatJSInteger);
-                break;
-            }
-            }
-        }
+        // We should have handled this via isKnownInteger, or isKnownNumeric!
+        ASSERT(op != NumberToInt32);
 
-        }
+        JSValueOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        valueToInt32(op1, result.gpr());
+        integerResult(result.gpr(), m_compileIndex);
         break;
     }
 
     case ValueToNumber: {
         ASSERT(!isInt32Constant(node.child1));
         ASSERT(!isDoubleConstant(node.child1));
-        GenerationInfo& operandInfo = m_generationInfo[m_jit.graph()[node.child1].virtualRegister];
-        switch (operandInfo.registerFormat()) {
-        case DataFormatNone:
-        case DataFormatCell:
-        case DataFormatJS:
-        case DataFormatJSCell: {
-            JSValueOperand op1(this, node.child1);
+
+        if (isKnownInteger(node.child1)) {
+            IntegerOperand op1(this, node.child1);
             FPRTemporary result(this);
-            valueToNumber(op1, result.fpr());
+            m_jit.convertInt32ToDouble(op1.registerID(), result.registerID());
             doubleResult(result.fpr(), m_compileIndex);
             break;
         }
 
-        case DataFormatJSDouble:
-        case DataFormatDouble: {
+        if (isKnownNumeric(node.child1)) {
             DoubleOperand op1(this, node.child1);
             FPRTemporary result(this, op1);
             m_jit.moveDouble(op1.registerID(), result.registerID());
@@ -354,15 +340,10 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
             break;
         }
 
-        case DataFormatJSInteger:
-        case DataFormatInteger: {
-            IntegerOperand op1(this, node.child1);
-            FPRTemporary result(this);
-            m_jit.convertInt32ToDouble(op1.registerID(), result.registerID());
-            doubleResult(result.fpr(), m_compileIndex);
-            break;
-        }
-        }
+        JSValueOperand op1(this, node.child1);
+        FPRTemporary result(this);
+        valueToNumber(op1, result.fpr());
+        doubleResult(result.fpr(), m_compileIndex);
         break;
     }
 
@@ -446,6 +427,80 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
         break;
     }
 
+    case LogicalNot: {
+        JSValueOperand arg1(this, node.child1);
+        GPRReg arg1GPR = arg1.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(dfgConvertJSValueToBoolean, result.gpr(), arg1GPR);
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.xor32(TrustedImm32(ValueTrue), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareLess: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationCompareLess, result.gpr(), arg1GPR, arg2GPR);
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareLessEq: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationCompareLessEq, result.gpr(), arg1GPR, arg2GPR);
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareEq: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationCompareEq, result.gpr(), arg1GPR, arg2GPR);
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareStrictEq: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationCompareStrictEq, result.gpr(), arg1GPR, arg2GPR);
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
     case GetByVal: {
         JSValueOperand arg1(this, node.child1);
         JSValueOperand arg2(this, node.child2);
@@ -535,11 +590,43 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
         break;
     }
 
+    case DFG::Jump: {
+        BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+        if (taken != (m_block + 1))
+            addBranch(m_jit.jump(), taken);
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case Branch: {
+        JSValueOperand value(this, node.child1);
+        GPRReg valueGPR = value.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(dfgConvertJSValueToBoolean, result.gpr(), valueGPR);
+
+        BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+        BlockIndex notTaken = m_jit.graph().blockIndexForBytecodeOffset(node.notTakenBytecodeOffset());
+
+        addBranch(m_jit.branchTest8(MacroAssembler::NonZero, result.registerID()), taken);
+        if (notTaken != (m_block + 1))
+            addBranch(m_jit.jump(), notTaken);
+
+        noResult(m_compileIndex);
+        break;
+    }
+
     case Return: {
         ASSERT(JITCompiler::callFrameRegister != JITCompiler::regT1);
         ASSERT(JITCompiler::regT1 != JITCompiler::returnValueRegister);
         ASSERT(JITCompiler::returnValueRegister != JITCompiler::callFrameRegister);
 
+#if DFG_SUCCESS_STATS
+        static SamplingCounter counter("NonSpeculativeJIT");
+        m_jit.emitCount(counter);
+#endif
+
         // Return the result in returnValueRegister.
         JSValueOperand op1(this, node.child1);
         m_jit.move(op1.registerID(), JITCompiler::returnValueRegister);
@@ -563,23 +650,40 @@ void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, No
     checkConsistency();
 }
 
-void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator)
+void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, BasicBlock& block)
 {
-    ASSERT(!m_compileIndex);
-    Node* nodes = m_jit.graph().begin();
+    ASSERT(m_compileIndex == block.begin);
+    m_blockHeads[m_block] = m_jit.label();
 
-    for (; m_compileIndex < m_jit.graph().size(); ++m_compileIndex) {
-#if DFG_DEBUG_VERBOSE
-        fprintf(stderr, "index(%d)\n", (int)m_compileIndex);
+#if DFG_JIT_BREAK_ON_EVERY_BLOCK
+    m_jit.breakpoint();
 #endif
 
-        Node& node = nodes[m_compileIndex];
+    for (; m_compileIndex < block.end; ++m_compileIndex) {
+        Node& node = m_jit.graph()[m_compileIndex];
         if (!node.refCount)
             continue;
+
+#if DFG_DEBUG_VERBOSE
+        fprintf(stderr, "NonSpeculativeJIT generating Node @%d at code offset 0x%x\n", (int)m_compileIndex, m_jit.debugOffset());
+#endif
+#if DFG_JIT_BREAK_ON_EVERY_NODE
+    m_jit.breakpoint();
+#endif
+
         compile(checkIterator, node);
     }
 }
 
+void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator)
+{
+    ASSERT(!m_compileIndex);
+    Vector<BasicBlock> blocks = m_jit.graph().m_blocks;
+    for (m_block = 0; m_block < blocks.size(); ++m_block)
+        compile(checkIterator, blocks[m_block]);
+    linkBranches();
+}
+
 } } // namespace JSC::DFG
 
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h
index e140e45..de4c04b 100644
--- a/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h
@@ -80,92 +80,140 @@ public:
 
 private:
     void compile(SpeculationCheckIndexIterator&, Node&);
+    void compile(SpeculationCheckIndexIterator&, BasicBlock&);
+
+    bool isKnownInteger(NodeIndex);
+    bool isKnownNumeric(NodeIndex);
 
     // These methods are used when generating 'unexpected'
     // calls out from JIT code to C++ helper routines -
     // they spill all live values to the appropriate
     // slots in the RegisterFile without changing any state
     // in the GenerationInfo.
-    void silentSpill(VirtualRegister spillMe, GPRReg canTrample)
+    void silentSpillGPR(VirtualRegister spillMe, GPRReg exclude = InvalidGPRReg)
     {
         GenerationInfo& info = m_generationInfo[spillMe];
-        ASSERT(info.registerFormat() != DataFormatNone);
-        if (info.needsSpill()) {
-            DataFormat spillFormat = info.registerFormat();
-
-            if (spillFormat == DataFormatDouble) {
-                boxDouble(info.fpr(), canTrample);
-                m_jit.storePtr(JITCompiler::gprToRegisterID(canTrample), JITCompiler::addressFor(spillMe));
-            } else {
-                JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
-
-                if (spillFormat == DataFormatInteger) {
-                    m_jit.orPtr(JITCompiler::tagTypeNumberRegister, reg);
-                    m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
-                } else {
-                    ASSERT(spillFormat & DataFormatJS || spillFormat == DataFormatCell);
-                    m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
-                }
-            }
+        ASSERT(info.registerFormat() != DataFormatNone && info.registerFormat() != DataFormatDouble);
+
+        if (!info.needsSpill() || (info.gpr() == exclude))
+            return;
+
+        DataFormat registerFormat = info.registerFormat();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+
+        if (registerFormat == DataFormatInteger) {
+            m_jit.orPtr(JITCompiler::tagTypeNumberRegister, reg);
+            m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
+        } else {
+            ASSERT(registerFormat & DataFormatJS || registerFormat == DataFormatCell);
+            m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
         }
     }
-    void silentFill(VirtualRegister spillMe, GPRReg canTrample)
+    void silentSpillFPR(VirtualRegister spillMe, GPRReg canTrample, FPRReg exclude = InvalidFPRReg)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+        ASSERT(info.registerFormat() == DataFormatDouble);
+
+        if (!info.needsSpill() || (info.fpr() == exclude))
+            return;
+
+        boxDouble(info.fpr(), canTrample);
+        m_jit.storePtr(JITCompiler::gprToRegisterID(canTrample), JITCompiler::addressFor(spillMe));
+    }
+
+    void silentFillGPR(VirtualRegister spillMe, GPRReg exclude = InvalidGPRReg)
     {
         GenerationInfo& info = m_generationInfo[spillMe];
+        if (info.gpr() == exclude)
+            return;
+
         NodeIndex nodeIndex = info.nodeIndex();
         Node& node = m_jit.graph()[nodeIndex];
-        ASSERT(info.registerFormat() != DataFormatNone);
-        DataFormat spillFormat = info.registerFormat();
+        ASSERT(info.registerFormat() != DataFormatNone && info.registerFormat() != DataFormatDouble);
+        DataFormat registerFormat = info.registerFormat();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+
+        if (registerFormat == DataFormatInteger) {
+            if (node.isConstant()) {
+                ASSERT(isInt32Constant(nodeIndex));
+                m_jit.move(Imm32(valueOfInt32Constant(nodeIndex)), reg);
+            } else
+                m_jit.load32(JITCompiler::addressFor(spillMe), reg);
+            return;
+        }
+
+        if (node.isConstant())
+            m_jit.move(constantAsJSValueAsImmPtr(nodeIndex), reg);
+        else {
+            ASSERT(registerFormat & DataFormatJS || registerFormat == DataFormatCell);
+            m_jit.loadPtr(JITCompiler::addressFor(spillMe), reg);
+        }
+    }
+    void silentFillFPR(VirtualRegister spillMe, GPRReg canTrample, FPRReg exclude = InvalidFPRReg)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+        if (info.fpr() == exclude)
+            return;
+
+        NodeIndex nodeIndex = info.nodeIndex();
+        Node& node = m_jit.graph()[nodeIndex];
+        ASSERT(info.registerFormat() == DataFormatDouble);
 
         if (node.isConstant()) {
             JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
             m_jit.move(constantAsJSValueAsImmPtr(nodeIndex), reg);
-        } else if (node.isArgument()) {
-            JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
-            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
-        } else if (spillFormat == DataFormatDouble) {
+        } else {
             m_jit.loadPtr(JITCompiler::addressFor(spillMe), JITCompiler::gprToRegisterID(canTrample));
             unboxDouble(canTrample, info.fpr());
-        } else if (spillFormat == DataFormatInteger) {
-            JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
-            m_jit.load32(JITCompiler::addressFor(spillMe), reg);
-        } else {
-            ASSERT(spillFormat & DataFormatJS || spillFormat == DataFormatCell);
-            JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
-            m_jit.loadPtr(JITCompiler::addressFor(spillMe), reg);
         }
     }
-    void silentSpillAllRegisters(GPRReg dontTrample)
+
+    void silentSpillAllRegisters(GPRReg exclude, GPRReg preserve = InvalidGPRReg)
+    {
+        GPRReg canTrample = (preserve == gpr0) ? gpr1 : gpr0;
+        
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                silentSpillGPR(name, exclude);
+        }
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister)
+                silentSpillFPR(name, canTrample);
+        }
+    }
+    void silentSpillAllRegisters(FPRReg exclude, GPRReg preserve = InvalidGPRReg)
     {
-        GPRReg canTrample = (dontTrample == gpr0) ? gpr1 : gpr0;
+        GPRReg canTrample = (preserve == gpr0) ? gpr1 : gpr0;
         
         for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
             VirtualRegister name = m_gprs.name(gpr);
             if (name != InvalidVirtualRegister)
-                silentSpill(name, canTrample);
+                silentSpillGPR(name);
         }
         for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
             VirtualRegister name = m_fprs.name(fpr);
             if (name != InvalidVirtualRegister)
-                silentSpill(name, canTrample);
+                silentSpillFPR(name, canTrample, exclude);
         }
     }
-    void silentFillAllRegisters(GPRReg dontTrample)
+    void silentFillAllRegisters(GPRReg exclude)
     {
-        GPRReg canTrample = (dontTrample == gpr0) ? gpr1 : gpr0;
+        GPRReg canTrample = (exclude == gpr0) ? gpr1 : gpr0;
         
         for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
             VirtualRegister name = m_fprs.name(fpr);
             if (name != InvalidVirtualRegister)
-                silentFill(name, canTrample);
+                silentFillFPR(name, canTrample);
         }
         for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
             VirtualRegister name = m_gprs.name(gpr);
             if (name != InvalidVirtualRegister)
-                silentFill(name, canTrample);
+                silentFillGPR(name, exclude);
         }
     }
-    void silentFillAllRegisters(FPRReg dontTrample)
+    void silentFillAllRegisters(FPRReg exclude)
     {
         GPRReg canTrample = gpr0;
         
@@ -173,17 +221,17 @@ private:
             VirtualRegister name = m_fprs.name(fpr);
             if (name != InvalidVirtualRegister) {
 #ifndef NDEBUG
-                ASSERT(fpr != dontTrample);
+                ASSERT(fpr != exclude);
 #else
-                UNUSED_PARAM(dontTrample);
+                UNUSED_PARAM(exclude);
 #endif
-                silentFill(name, canTrample);
+                silentFillFPR(name, canTrample, exclude);
             }
         }
         for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
             VirtualRegister name = m_gprs.name(gpr);
             if (name != InvalidVirtualRegister)
-                silentFill(name, canTrample);
+                silentFillGPR(name);
         }
     }
 
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index de14415..a310d22 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -192,6 +192,26 @@ void operationPutByIdDirectNonStrict(ExecState* exec, EncodedJSValue encodedValu
     JSValue::decode(encodedBase).putDirect(exec, *identifier, JSValue::decode(encodedValue), slot);
 }
 
+bool operationCompareLess(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return jsLess(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+bool operationCompareLessEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return jsLessEq(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+bool operationCompareEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return JSValue::equal(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+bool operationCompareStrictEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return JSValue::strictEqual(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
 DFGHandler lookupExceptionHandler(ExecState* exec, ReturnAddressPtr faultLocation)
 {
     JSValue exceptionValue = exec->exception();
@@ -215,6 +235,11 @@ int32_t dfgConvertJSValueToInt32(ExecState* exec, EncodedJSValue value)
     return JSValue::decode(value).toInt32(exec);
 }
 
+bool dfgConvertJSValueToBoolean(ExecState* exec, EncodedJSValue encodedOp)
+{
+    return JSValue::decode(encodedOp).toBoolean(exec);
+}
+
 } } // namespace JSC::DFG
 
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
index 18570e2..d4c7c0f 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.h
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -42,6 +42,8 @@ typedef EncodedJSValue (*J_DFGOperation_EJJ)(ExecState*, EncodedJSValue, Encoded
 typedef EncodedJSValue (*J_DFGOperation_EJ)(ExecState*, EncodedJSValue);
 typedef EncodedJSValue (*J_DFGOperation_EJP)(ExecState*, EncodedJSValue, void*);
 typedef EncodedJSValue (*J_DFGOperation_EJI)(ExecState*, EncodedJSValue, Identifier*);
+typedef bool (*Z_DFGOperation_EJ)(ExecState*, EncodedJSValue);
+typedef bool (*Z_DFGOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
 typedef void (*V_DFGOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
 typedef void (*V_DFGOperation_EJJP)(ExecState*, EncodedJSValue, EncodedJSValue, void*);
 typedef void (*V_DFGOperation_EJJI)(ExecState*, EncodedJSValue, EncodedJSValue, Identifier*);
@@ -58,6 +60,10 @@ void operationPutByIdStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSVa
 void operationPutByIdNonStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
 void operationPutByIdDirectStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
 void operationPutByIdDirectNonStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+bool operationCompareLess(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+bool operationCompareLessEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+bool operationCompareEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+bool operationCompareStrictEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
 
 // This method is used to lookup an exception hander, keyed by faultLocation, which is
 // the return location from one of the calls out to one of the helper operations above.
@@ -73,9 +79,10 @@ struct DFGHandler {
 };
 DFGHandler lookupExceptionHandler(ExecState*, ReturnAddressPtr faultLocation);
 
-// These operations implement the implicitly called ToInt32 and ToNumber conversions from ES5.
+// These operations implement the implicitly called ToInt32, ToNumber, and ToBoolean conversions from ES5.
 double dfgConvertJSValueToNumber(ExecState*, EncodedJSValue);
 int32_t dfgConvertJSValueToInt32(ExecState*, EncodedJSValue);
+bool dfgConvertJSValueToBoolean(ExecState*, EncodedJSValue);
 
 } } // namespace JSC::DFG
 
diff --git a/Source/JavaScriptCore/dfg/DFGScoreBoard.h b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
index eefed9e..b9bf1fd 100644
--- a/Source/JavaScriptCore/dfg/DFGScoreBoard.h
+++ b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
@@ -42,8 +42,9 @@ namespace JSC { namespace DFG {
 // another node.
 class ScoreBoard {
 public:
-    ScoreBoard(Graph& graph)
+    ScoreBoard(Graph& graph, uint32_t firstTemporary)
         : m_graph(graph)
+        , m_firstTemporary(firstTemporary)
     {
     }
 
@@ -58,7 +59,7 @@ public:
         // * By setting m_used to a non-zero value after checking it, we are checking that all
         //   entries in m_free are unique (otherwise the second test of m_used will fail).
         for (size_t i = 0; i < m_free.size(); ++i) {
-            VirtualRegister virtualRegister = m_free[i];
+            uint32_t virtualRegister = m_free[i];
             ASSERT(!m_used[virtualRegister]);
             m_used[virtualRegister] = 1;
         }
@@ -70,17 +71,17 @@ public:
         // Do we have any VirtualRegsiters in the free list, that were used by
         // prior nodes, but are now available?
         if (!m_free.isEmpty()) {
-            VirtualRegister result = m_free.last();
+            uint32_t index = m_free.last();
             m_free.removeLast();
             // Use count must have hit zero for it to have been added to the free list!
-            ASSERT(!m_used[result]);
-            return result;
+            ASSERT(!m_used[index]);
+            return (VirtualRegister)(m_firstTemporary + index);
         }
 
         // Allocate a new VirtualRegister, and add a corresponding entry to m_used.
         size_t next = allocatedCount();
         m_used.append(0);
-        return (VirtualRegister)next;
+        return (VirtualRegister)(m_firstTemporary + next);
     }
 
     // Increment the usecount for the VirtualRegsiter associated with 'child',
@@ -92,7 +93,7 @@ public:
 
         // Find the virtual register number for this child, increment its use count.
         Node& node = m_graph[child];
-        VirtualRegister index = node.virtualRegister;
+        uint32_t index = node.virtualRegister - m_firstTemporary;
         if (node.refCount == ++m_used[index]) {
             // If the use count in the scoreboard reaches the use count for the node,
             // then this was its last use; the virtual register is now free.
@@ -111,6 +112,9 @@ public:
 private:
     // The graph, so we can get refCounts for nodes, to determine when values are dead.
     Graph& m_graph;
+    // The first VirtualRegsiter to be used as a temporary.
+    uint32_t m_firstTemporary;
+    
     // For every virtual register that has been allocated (either currently alive, or in
     // the free list), we keep a count of the number of remaining uses until it is dead
     // (0, in the case of entries in the free list). Since there is an entry for every
@@ -118,7 +122,7 @@ private:
     // next available VirtualRegister number.
     Vector<uint32_t, 64> m_used;
     // A free list of VirtualRegsiters no longer alive.
-    Vector<VirtualRegister, 64> m_free;
+    Vector<uint32_t, 64> m_free;
 };
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 95472e1..7963184 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -51,9 +51,6 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
                 return gpr;
             }
             m_jit.move(constantAsJSValueAsImmPtr(nodeIndex), reg);
-        } else if (node.isArgument()) {
-            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
-            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
         } else {
             DataFormat spillFormat = info.spillFormat();
             ASSERT(spillFormat & DataFormatJS);
@@ -203,13 +200,6 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
             terminateSpeculativeExecution();
             return gpr;
         }
-        if (node.isArgument()) {
-            m_gprs.retain(gpr, virtualRegister, SpillOrderArgument);
-            m_jit.loadPtr(m_jit.addressForArgument(m_jit.graph()[nodeIndex].argumentNumber()), reg);
-            speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, reg, JITCompiler::tagMaskRegister));
-            info.fillJSValue(gpr, DataFormatJSCell);
-            return gpr;
-        }
         ASSERT(info.spillFormat() & DataFormatJS);
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
         m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
@@ -252,7 +242,6 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
 bool SpeculativeJIT::compile(Node& node)
 {
     checkConsistency();
-
     NodeType op = node.op;
 
     switch (op) {
@@ -261,10 +250,20 @@ bool SpeculativeJIT::compile(Node& node)
     case JSConstant:
         initConstantInfo(m_compileIndex);
         break;
-    
-    case Argument:
-        initArgumentInfo(m_compileIndex);
+
+    case GetLocal: {
+        GPRTemporary result(this);
+        m_jit.loadPtr(JITCompiler::addressFor(node.local()), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case SetLocal: {
+        JSValueOperand value(this, node.child1);
+        m_jit.storePtr(value.registerID(), JITCompiler::addressFor(node.local()));
+        noResult(m_compileIndex);
         break;
+    }
 
     case BitAnd:
     case BitOr:
@@ -347,6 +346,7 @@ bool SpeculativeJIT::compile(Node& node)
         integerResult(result.gpr(), m_compileIndex, op1.format());
         break;
     }
+
     case ValueToInt32: {
         SpeculateIntegerOperand op1(this, node.child1);
         GPRTemporary result(this, op1);
@@ -365,6 +365,30 @@ bool SpeculativeJIT::compile(Node& node)
 
     case ValueAdd:
     case ArithAdd: {
+        int32_t imm1;
+        if (isDoubleConstantWithInt32Value(node.child1, imm1)) {
+            SpeculateIntegerOperand op2(this, node.child2);
+            GPRTemporary result(this);
+
+            MacroAssembler::RegisterID reg = op2.registerID();
+            speculationCheck(m_jit.branchAdd32(MacroAssembler::Overflow, reg, Imm32(imm1), result.registerID()));
+
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+            
+        int32_t imm2;
+        if (isDoubleConstantWithInt32Value(node.child2, imm2)) {
+            SpeculateIntegerOperand op1(this, node.child1);
+            GPRTemporary result(this);
+
+            MacroAssembler::RegisterID reg = op1.registerID();
+            speculationCheck(m_jit.branchAdd32(MacroAssembler::Overflow, reg, Imm32(imm2), result.registerID()));
+
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+            
         SpeculateIntegerOperand op1(this, node.child1);
         SpeculateIntegerOperand op2(this, node.child2);
         GPRTemporary result(this, op1, op2);
@@ -386,6 +410,18 @@ bool SpeculativeJIT::compile(Node& node)
     }
 
     case ArithSub: {
+        int32_t imm2;
+        if (isDoubleConstantWithInt32Value(node.child2, imm2)) {
+            SpeculateIntegerOperand op1(this, node.child1);
+            GPRTemporary result(this);
+
+            MacroAssembler::RegisterID reg = op1.registerID();
+            speculationCheck(m_jit.branchSub32(MacroAssembler::Overflow, reg, Imm32(imm2), result.registerID()));
+
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+            
         SpeculateIntegerOperand op1(this, node.child1);
         SpeculateIntegerOperand op2(this, node.child2);
         GPRTemporary result(this);
@@ -406,7 +442,11 @@ bool SpeculativeJIT::compile(Node& node)
         MacroAssembler::RegisterID reg1 = op1.registerID();
         MacroAssembler::RegisterID reg2 = op2.registerID();
         speculationCheck(m_jit.branchMul32(MacroAssembler::Overflow, reg1, reg2, result.registerID()));
-        speculationCheck(m_jit.branchTest32(MacroAssembler::Zero, result.registerID()));
+
+        MacroAssembler::Jump resultNonZero = m_jit.branchTest32(MacroAssembler::NonZero, result.registerID());
+        speculationCheck(m_jit.branch32(MacroAssembler::LessThan, reg1, TrustedImm32(0)));
+        speculationCheck(m_jit.branch32(MacroAssembler::LessThan, reg2, TrustedImm32(0)));
+        resultNonZero.link(&m_jit);
 
         integerResult(result.gpr(), m_compileIndex);
         break;
@@ -434,6 +474,72 @@ bool SpeculativeJIT::compile(Node& node)
         break;
     }
 
+    case LogicalNot: {
+        JSValueOperand value(this, node.child1);
+        GPRTemporary result(this); // FIXME: We could reuse, but on speculation fail would need recovery to restore tag (akin to add).
+
+        m_jit.move(value.registerID(), result.registerID());
+        m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), result.registerID());
+        speculationCheck(m_jit.branchTestPtr(JITCompiler::NonZero, result.registerID(), TrustedImm32(static_cast<int32_t>(~1))));
+        m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueTrue)), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareLess: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        m_jit.set32Compare32(JITCompiler::LessThan, op1.registerID(), op2.registerID(), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareLessEq: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        m_jit.set32Compare32(JITCompiler::LessThanOrEqual, op1.registerID(), op2.registerID(), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareEq: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        m_jit.set32Compare32(JITCompiler::Equal, op1.registerID(), op2.registerID(), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareStrictEq: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        m_jit.set32Compare32(JITCompiler::Equal, op1.registerID(), op2.registerID(), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
     case GetByVal: {
         NodeIndex alias = node.child3;
         if (alias != NoNode) {
@@ -472,73 +578,110 @@ bool SpeculativeJIT::compile(Node& node)
         break;
     }
 
-    case PutByVal:
-    case PutByValAlias: {
+    case PutByVal: {
+        SpeculateCellOperand base(this, node.child1);
         SpeculateStrictInt32Operand property(this, node.child2);
+        JSValueOperand value(this, node.child3);
         GPRTemporary storage(this);
 
-        MacroAssembler::RegisterID propertyReg;
-        MacroAssembler::RegisterID storageReg;
+        // Map base, property & value into registers, allocate a register for storage.
+        MacroAssembler::RegisterID baseReg = base.registerID();
+        MacroAssembler::RegisterID propertyReg = property.registerID();
+        MacroAssembler::RegisterID valueReg = value.registerID();
+        MacroAssembler::RegisterID storageReg = storage.registerID();
 
-        // This block also defines the scope for base, and all bails to the non-speculative path.
-        // At the end of this scope base will be release, and as such may be reused by for 'value'.
-        //
-        // If we've already read from this location on the speculative pass, then it cannot be beyond array bounds, or a hole.
-        if (op == PutByValAlias) {
-            SpeculateCellOperand base(this, node.child1);
+        // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
+        speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+        speculationCheck(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
 
-            // Map base & property into registers, allocate a register for storage.
-            propertyReg = property.registerID();
-            storageReg = storage.registerID();
-            MacroAssembler::RegisterID baseReg = base.registerID();
+        // Get the array storage.
+        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
 
-            // Get the array storage.
-            m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-        } else {
-            SpeculateCellOperand base(this, node.child1);
+        // Check if we're writing to a hole; if so increment m_numValuesInVector.
+        MacroAssembler::Jump notHoleValue = m_jit.branchTestPtr(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+        m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
 
-            // Map base & property into registers, allocate a register for storage.
-            propertyReg = property.registerID();
-            storageReg = storage.registerID();
-            MacroAssembler::RegisterID baseReg = base.registerID();
+        // If we're writing to a hole we might be growing the array; 
+        MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+        m_jit.add32(TrustedImm32(1), propertyReg);
+        m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+        m_jit.sub32(TrustedImm32(1), propertyReg);
 
-            // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
-            speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
-            speculationCheck(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+        lengthDoesNotNeedUpdate.link(&m_jit);
+        notHoleValue.link(&m_jit);
 
-            // Get the array storage.
-            m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+        // Store the value to the array.
+        m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
-            // Check if we're writing to a hole; if so increment m_numValuesInVector.
-            MacroAssembler::Jump notHoleValue = m_jit.branchTestPtr(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
-            m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+        noResult(m_compileIndex);
+        break;
+    }
 
-            // If we're writing to a hole we might be growing the array; 
-            MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-            m_jit.add32(TrustedImm32(1), propertyReg);
-            m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-            m_jit.sub32(TrustedImm32(1), propertyReg);
+    case PutByValAlias: {
+        SpeculateCellOperand base(this, node.child1);
+        SpeculateStrictInt32Operand property(this, node.child2);
+        JSValueOperand value(this, node.child3);
+        GPRTemporary storage(this, base); // storage may overwrite base.
 
-            lengthDoesNotNeedUpdate.link(&m_jit);
-            notHoleValue.link(&m_jit);
-        }
-        // After this point base goes out of scope. This may free the register.
-        // As such, after this point we'd better not have any bails out to the non-speculative path!
+        // Get the array storage.
+        MacroAssembler::RegisterID storageReg = storage.registerID();
+        m_jit.loadPtr(MacroAssembler::Address(base.registerID(), JSArray::storageOffset()), storageReg);
 
-        // Store the value to the array.
-        JSValueOperand value(this, node.child3);
+        // Map property & value into registers.
+        MacroAssembler::RegisterID propertyReg = property.registerID();
         MacroAssembler::RegisterID valueReg = value.registerID();
+
+        // Store the value to the array.
         m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
         noResult(m_compileIndex);
         break;
     }
 
+    case DFG::Jump: {
+        BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+        if (taken != (m_block + 1))
+            addBranch(m_jit.jump(), taken);
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case Branch: {
+        JSValueOperand value(this, node.child1);
+        MacroAssembler::RegisterID valueReg = value.registerID();
+
+        BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+        BlockIndex notTaken = m_jit.graph().blockIndexForBytecodeOffset(node.notTakenBytecodeOffset());
+
+        // Integers
+        addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueReg, MacroAssembler::ImmPtr(JSValue::encode(jsNumber(0)))), notTaken);
+        MacroAssembler::Jump isNonZeroInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, valueReg, JITCompiler::tagTypeNumberRegister);
+
+        // Booleans
+        addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueReg, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false)))), notTaken);
+        speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, valueReg, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(true)))));
+
+        if (taken == (m_block + 1))
+            isNonZeroInteger.link(&m_jit);
+        else {
+            addBranch(isNonZeroInteger, taken);
+            addBranch(m_jit.jump(), taken);
+        }
+
+        noResult(m_compileIndex);
+        break;
+    }
+
     case Return: {
         ASSERT(JITCompiler::callFrameRegister != JITCompiler::regT1);
         ASSERT(JITCompiler::regT1 != JITCompiler::returnValueRegister);
         ASSERT(JITCompiler::returnValueRegister != JITCompiler::callFrameRegister);
 
+#if DFG_SUCCESS_STATS
+        static SamplingCounter counter("SpeculativeJIT");
+        m_jit.emitCount(counter);
+#endif
+
         // Return the result in returnValueRegister.
         JSValueOperand op1(this, node.child1);
         m_jit.move(op1.registerID(), JITCompiler::returnValueRegister);
@@ -639,25 +782,43 @@ bool SpeculativeJIT::compile(Node& node)
     return true;
 }
 
-bool SpeculativeJIT::compile()
+bool SpeculativeJIT::compile(BasicBlock& block)
 {
-    ASSERT(!m_compileIndex);
-    Node* nodes = m_jit.graph().begin();
-
-    for (; m_compileIndex < m_jit.graph().size(); ++m_compileIndex) {
-#if DFG_DEBUG_VERBOSE
-        fprintf(stderr, "index(%d)\n", (int)m_compileIndex);
+    ASSERT(m_compileIndex == block.begin);
+    m_blockHeads[m_block] = m_jit.label();
+#if DFG_JIT_BREAK_ON_EVERY_BLOCK
+    m_jit.breakpoint();
 #endif
 
-        Node& node = nodes[m_compileIndex];
+    for (; m_compileIndex < block.end; ++m_compileIndex) {
+        Node& node = m_jit.graph()[m_compileIndex];
         if (!node.refCount)
             continue;
+
+#if DFG_DEBUG_VERBOSE
+        fprintf(stderr, "SpeculativeJIT generating Node @%d at JIT offset 0x%x\n", (int)m_compileIndex, m_jit.debugOffset());
+#endif
+#if DFG_JIT_BREAK_ON_EVERY_NODE
+    m_jit.breakpoint();
+#endif
         if (!compile(node))
             return false;
     }
     return true;
 }
 
+bool SpeculativeJIT::compile()
+{
+    ASSERT(!m_compileIndex);
+    Vector<BasicBlock> blocks = m_jit.graph().m_blocks;
+    for (m_block = 0; m_block < blocks.size(); ++m_block) {
+        if (!compile(blocks[m_block]))
+            return false;
+    }
+    linkBranches();
+    return true;
+}
+
 } } // namespace JSC::DFG
 
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index 93983c6..965cdbe 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -88,6 +88,7 @@ struct SpeculationCheck {
     RegisterInfo m_gprInfo[numberOfGPRs];
     NodeIndex m_fprInfo[numberOfFPRs];
 };
+typedef SegmentedVector<SpeculationCheck, 16> SpeculationCheckVector;
 
 
 // === SpeculativeJIT ===
@@ -103,9 +104,6 @@ struct SpeculationCheck {
 class SpeculativeJIT : public JITCodeGenerator {
     friend struct SpeculationCheck;
 public:
-    // The speculation 
-    typedef SegmentedVector<SpeculationCheck, 16> SpeculationCheckVector;
-
     SpeculativeJIT(JITCompiler& jit)
         : JITCodeGenerator(jit, true)
         , m_didTerminate(false)
@@ -135,6 +133,23 @@ public:
 
 private:
     bool compile(Node&);
+    bool compile(BasicBlock&);
+
+    bool isDoubleConstantWithInt32Value(NodeIndex nodeIndex, int32_t& out)
+    {
+        if (!m_jit.isDoubleConstant(nodeIndex))
+            return false;
+        double value = m_jit.valueOfDoubleConstant(nodeIndex);
+
+        int32_t asInt32 = static_cast<int32_t>(value);
+        if (value != asInt32)
+            return false;
+        if (!asInt32 && signbit(value))
+            return false;
+
+        out = asInt32;
+        return true;
+    }
 
     // Add a speculation check without additional recovery.
     void speculationCheck(MacroAssembler::Jump jumpToFail)
@@ -325,8 +340,8 @@ private:
 // nodes require entry points from the speculative path.
 class SpeculationCheckIndexIterator {
 public:
-    SpeculationCheckIndexIterator(SpeculativeJIT& speculativeJIT)
-        : m_speculationChecks(speculativeJIT.speculationChecks())
+    SpeculationCheckIndexIterator(SpeculationCheckVector& speculationChecks)
+        : m_speculationChecks(speculationChecks)
         , m_iter(m_speculationChecks.begin())
         , m_end(m_speculationChecks.end())
     {
@@ -344,11 +359,12 @@ public:
     }
 
 private:
-    SpeculativeJIT::SpeculationCheckVector& m_speculationChecks;
-    SpeculativeJIT::SpeculationCheckVector::Iterator m_iter;
-    SpeculativeJIT::SpeculationCheckVector::Iterator m_end;
+    SpeculationCheckVector& m_speculationChecks;
+    SpeculationCheckVector::Iterator m_iter;
+    SpeculationCheckVector::Iterator m_end;
 };
 
+
 } } // namespace JSC::DFG
 
 #endif
diff --git a/Source/JavaScriptCore/gyp/gtk.gyp b/Source/JavaScriptCore/gyp/gtk.gyp
new file mode 100644
index 0000000..33eaa17
--- /dev/null
+++ b/Source/JavaScriptCore/gyp/gtk.gyp
@@ -0,0 +1,18 @@
+{ # Just a stub file to allow Source/gyp/configure to run successfully for testing.
+  'includes': [
+    '../../gyp/common.gypi',
+    '../JavaScriptCore.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'JavaScriptCore',
+      'type': 'static_library',
+      'sources': [
+        '<@(javascriptcore_files)',
+        '<@(javascriptcore_publicheader_files)',
+        '<@(javascriptcore_privateheader_files)',
+        '<@(javascriptcore_derived_source_files)',
+      ],
+    },
+  ], # targets
+}
diff --git a/Source/JavaScriptCore/runtime/ConservativeSet.cpp b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
index 8872023..1aad779 100644
--- a/Source/JavaScriptCore/runtime/ConservativeSet.cpp
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
@@ -24,7 +24,7 @@
  */
 
 #include "config.h"
-#include "ConservativeSet.h"
+#include "ConservativeRoots.h"
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/ConservativeSet.h b/Source/JavaScriptCore/heap/ConservativeRoots.h
index d078606..d078606 100644
--- a/Source/JavaScriptCore/runtime/ConservativeSet.h
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.h
diff --git a/Source/JavaScriptCore/collector/handles/Handle.h b/Source/JavaScriptCore/heap/Handle.h
index d4e38c0..531d535 100644
--- a/Source/JavaScriptCore/collector/handles/Handle.h
+++ b/Source/JavaScriptCore/heap/Handle.h
@@ -27,7 +27,6 @@
 #define Handle_h
 
 #include "WriteBarrier.h"
-
 #include <wtf/Assertions.h>
 
 namespace JSC {
@@ -45,43 +44,32 @@ template <class T> class Handle;
 // Creating a JSValue Handle is invalid
 template <> class Handle<JSValue>;
 
+// Forward declare WeakGCMap
+template<typename KeyType, typename MappedType, typename FinalizerCallback, typename HashArg, typename KeyTraitsArg> class WeakGCMap;
+
 class HandleBase {
     friend class HandleHeap;
+    friend struct JSCallbackObjectData;
+    template <typename KeyType, typename MappedType, typename FinalizerCallback, typename HashArg, typename KeyTraitsArg> friend class WeakGCMap;
 
 public:
-    bool operator!() const { return isEmpty(); }
+    bool operator!() const { return !m_slot || !*m_slot; }
 
     // This conversion operator allows implicit conversion to bool but not to other integer types.
     typedef JSValue (HandleBase::*UnspecifiedBoolType);
     operator UnspecifiedBoolType*() const { return (m_slot && *m_slot) ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
 
-    bool isEmpty() const { return !m_slot || !*m_slot; }
-
 protected:
     HandleBase(HandleSlot slot)
         : m_slot(slot)
     {
-        ASSERT(slot);
-    }
-
-    enum DontNullCheckSlotTag { DontNullCheckSlot };
-    HandleBase(HandleSlot slot, DontNullCheckSlotTag)
-        : m_slot(slot)
-    {
     }
     
-    HandleSlot slot() const { return m_slot; }
-    void invalidate()
-    {
-        // It is unsafe to use a handle after invalidating it.
-        m_slot = 0;
-    }
+    void swap(HandleBase& other) { std::swap(m_slot, other.m_slot); }
 
-    // needed by Global<>::operator= and Global<>::set if it's an empty handle
+    HandleSlot slot() const { return m_slot; }
     void setSlot(HandleSlot slot)
     {
-        ASSERT(!m_slot);
-        ASSERT(slot);
         m_slot = slot;
     }
 
@@ -104,10 +92,35 @@ template <> struct HandleTypes<Unknown> {
 };
 
 template <typename Base, typename T> struct HandleConverter {
-    T* operator->() { return static_cast<Base*>(this)->get(); }
-    const T* operator->() const { return static_cast<const Base*>(this)->get(); }
-    T* operator*() { return static_cast<Base*>(this)->get(); }
-    const T* operator*() const { return static_cast<const Base*>(this)->get(); }
+    T* operator->()
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get()->isZombie());
+#endif
+        return static_cast<Base*>(this)->get();
+    }
+    const T* operator->() const
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get()->isZombie());
+#endif
+        return static_cast<const Base*>(this)->get();
+    }
+
+    T* operator*()
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get()->isZombie());
+#endif
+        return static_cast<Base*>(this)->get();
+    }
+    const T* operator*() const
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get()->isZombie());
+#endif
+        return static_cast<const Base*>(this)->get();
+    }
 };
 
 template <typename Base> struct HandleConverter<Base, Unknown> {
@@ -118,7 +131,13 @@ template <typename Base> struct HandleConverter<Base, Unknown> {
     bool isUndefinedOrNull() const { return jsValue().isUndefinedOrNull(); }
 
 private:
-    JSValue jsValue() const { return static_cast<const Base*>(this)->get(); }
+    JSValue jsValue() const
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get().isZombie());
+#endif
+        return static_cast<const Base*>(this)->get();
+    }
 };
 
 template <typename T> class Handle : public HandleBase, public HandleConverter<Handle<T>, T> {
@@ -128,21 +147,18 @@ public:
     template <typename U> Handle(Handle<U> o)
     {
         typename HandleTypes<T>::template validateUpcast<U>();
-        m_slot = o.slot();
+        setSlot(o.slot());
     }
 
+    void swap(Handle& other) { HandleBase::swap(other); }
+
     ExternalType get() const { return HandleTypes<T>::getFromSlot(this->slot()); }
 
 protected:
-
-    Handle(HandleSlot slot)
+    Handle(HandleSlot slot = 0)
         : HandleBase(slot)
     {
     }
-    Handle(HandleSlot slot, HandleBase::DontNullCheckSlotTag)
-        : HandleBase(slot, HandleBase::DontNullCheckSlot)
-    {
-    }
     
 private:
     friend class HandleHeap;
diff --git a/Source/JavaScriptCore/collector/handles/HandleHeap.cpp b/Source/JavaScriptCore/heap/HandleHeap.cpp
index 1beb407..1a0051e 100644
--- a/Source/JavaScriptCore/collector/handles/HandleHeap.cpp
+++ b/Source/JavaScriptCore/heap/HandleHeap.cpp
@@ -24,19 +24,28 @@
  */
 
 #include "config.h"
-
 #include "HandleHeap.h"
 
 #include "JSObject.h"
 
 namespace JSC {
 
+WeakHandleOwner::~WeakHandleOwner()
+{
+}
+
+bool WeakHandleOwner::isReachableFromOpaqueRoots(Handle<Unknown>, void*, MarkStack&)
+{
+    return false;
+}
+
+void WeakHandleOwner::finalize(Handle<Unknown>, void*)
+{
+}
+
 HandleHeap::HandleHeap(JSGlobalData* globalData)
     : m_globalData(globalData)
     , m_nextToFinalize(0)
-#if !ASSERT_DISABLED
-    , m_handlingFinalizers(false)
-#endif
 {
     grow();
 }
@@ -58,71 +67,73 @@ void HandleHeap::markStrongHandles(HeapRootMarker& heapRootMarker)
         heapRootMarker.mark(node->slot());
 }
 
-void HandleHeap::updateAfterMark()
+void HandleHeap::markWeakHandles(HeapRootMarker& heapRootMarker)
 {
-    clearWeakPointers();
+    MarkStack& markStack = heapRootMarker.markStack();
+
+    Node* end = m_weakList.end();
+    for (Node* node = m_weakList.begin(); node != end; node = node->next()) {
+        ASSERT(isValidWeakNode(node));
+        JSCell* cell = node->slot()->asCell();
+        if (Heap::isMarked(cell))
+            continue;
+
+        WeakHandleOwner* weakOwner = node->weakOwner();
+        if (!weakOwner)
+            continue;
+
+        if (!weakOwner->isReachableFromOpaqueRoots(Handle<Unknown>::wrapSlot(node->slot()), node->weakOwnerContext(), markStack))
+            continue;
+
+        heapRootMarker.mark(node->slot());
+    }
 }
 
-void HandleHeap::clearWeakPointers()
+void HandleHeap::finalizeWeakHandles()
 {
-#if !ASSERT_DISABLED
-    m_handlingFinalizers = true;
-#endif
     Node* end = m_weakList.end();
-    for (Node* node = m_weakList.begin(); node != end;) {
-        Node* current = node;
-        node = current->next();
-        
-        JSValue value = *current->slot();
-        if (!value || !value.isCell())
-            continue;
-        
-        JSCell* cell = value.asCell();
-        ASSERT(!cell || cell->structure());
-        
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!cell->isZombie());
-#endif
+    for (Node* node = m_weakList.begin(); node != end; node = m_nextToFinalize) {
+        m_nextToFinalize = node->next();
+
+        ASSERT(isValidWeakNode(node));
+        JSCell* cell = node->slot()->asCell();
         if (Heap::isMarked(cell))
             continue;
-        
-        if (Finalizer* finalizer = current->finalizer()) {
-            m_nextToFinalize = node;
-            finalizer->finalize(Handle<Unknown>::wrapSlot(current->slot()), current->finalizerContext());
-            node = m_nextToFinalize;
-            m_nextToFinalize = 0;
-        } 
-        
-        if (current->isSelfDestroying()) {
-            ASSERT(node != current);
-            ASSERT(current->next() == node);
-            deallocate(toHandle(current));
-        } else if (current->next() == node) { // if current->next() != node, then current has been deallocated
-            SentinelLinkedList<Node>::remove(current);
-            *current->slot() = JSValue();
-            m_immediateList.push(current);
+
+        if (WeakHandleOwner* weakOwner = node->weakOwner()) {
+            weakOwner->finalize(Handle<Unknown>::wrapSlot(node->slot()), node->weakOwnerContext());
+            if (m_nextToFinalize != node->next()) // Owner deallocated node.
+                continue;
         }
+
+        *node->slot() = JSValue();
+        SentinelLinkedList<Node>::remove(node);
+        m_immediateList.push(node);
     }
-#if !ASSERT_DISABLED
-    m_handlingFinalizers = false;
-#endif
+    
+    m_nextToFinalize = 0;
 }
 
 void HandleHeap::writeBarrier(HandleSlot slot, const JSValue& value)
 {
-    ASSERT(!m_handlingFinalizers);
-    if (slot->isCell() == value.isCell() && !value == !*slot)
+    ASSERT(!m_nextToFinalize); // Forbid assignment to handles during the finalization phase, since it would violate many GC invariants.
+
+    if (!value == !*slot && slot->isCell() == value.isCell())
         return;
+
     Node* node = toNode(slot);
     SentinelLinkedList<Node>::remove(node);
-    if (!value.isCell() || !value) {
+    if (!value || !value.isCell()) {
         m_immediateList.push(node);
         return;
     }
-    if (node->isWeak())
+
+    if (node->isWeak()) {
         m_weakList.push(node);
-    else
-        m_strongList.push(node);
+        return;
+    }
+
+    m_strongList.push(node);
 }
 
 unsigned HandleHeap::protectedGlobalObjectCount()
@@ -137,4 +148,27 @@ unsigned HandleHeap::protectedGlobalObjectCount()
     return count;
 }
 
+#if !ASSERT_DISABLED
+bool HandleHeap::isValidWeakNode(Node* node)
+{
+    if (!node->isWeak())
+        return false;
+
+    JSValue value = *node->slot();
+    if (!value || !value.isCell())
+        return false;
+
+    JSCell* cell = value.asCell();
+    if (!cell || !cell->structure())
+        return false;
+
+#if ENABLE(JSC_ZOMBIES)
+    if (cell->isZombie())
+        return false;
+#endif
+
+    return true;
 }
+#endif
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/collector/handles/HandleHeap.h b/Source/JavaScriptCore/heap/HandleHeap.h
index ed462d4..886c94a 100644
--- a/Source/JavaScriptCore/collector/handles/HandleHeap.h
+++ b/Source/JavaScriptCore/heap/HandleHeap.h
@@ -34,14 +34,17 @@
 namespace JSC {
 
 class HandleHeap;
+class HeapRootMarker;
 class JSGlobalData;
 class JSValue;
-class HeapRootMarker;
+class MarkStack;
+class TypeCounter;
 
-class Finalizer {
+class WeakHandleOwner {
 public:
-    virtual void finalize(Handle<Unknown>, void*) = 0;
-    virtual ~Finalizer() {}
+    virtual ~WeakHandleOwner();
+    virtual bool isReachableFromOpaqueRoots(Handle<Unknown>, void* context, MarkStack&);
+    virtual void finalize(Handle<Unknown>, void* context);
 };
 
 class HandleHeap {
@@ -49,33 +52,29 @@ public:
     static HandleHeap* heapFor(HandleSlot);
 
     HandleHeap(JSGlobalData*);
+    
+    JSGlobalData* globalData();
 
     HandleSlot allocate();
     void deallocate(HandleSlot);
-    
-    void makeWeak(HandleSlot, Finalizer*, void* context);
-    void makeSelfDestroying(HandleSlot, Finalizer*, void* context);
+
+    void makeWeak(HandleSlot, WeakHandleOwner* = 0, void* context = 0);
+    HandleSlot copyWeak(HandleSlot);
 
     void markStrongHandles(HeapRootMarker&);
-    void updateAfterMark();
-    
-    // Should only be called during teardown.
-    void clearWeakPointers();
+    void markWeakHandles(HeapRootMarker&);
+    void finalizeWeakHandles();
 
     void writeBarrier(HandleSlot, const JSValue&);
 
 #if !ASSERT_DISABLED
-    Finalizer* getFinalizer(HandleSlot handle)
-    {
-        return toNode(handle)->finalizer();
-    }
+    bool hasWeakOwner(HandleSlot, WeakHandleOwner*);
 #endif
 
     unsigned protectedGlobalObjectCount();
-    
+    void protectedObjectTypeCounts(TypeCounter&);
+
 private:
-    typedef uintptr_t HandleHeapWithFlags;
-    enum { FlagsMask = 3, WeakFlag = 1, SelfDestroyingFlag = 2 };
     class Node {
     public:
         Node(WTF::SentinelTag);
@@ -84,9 +83,11 @@ private:
         HandleSlot slot();
         HandleHeap* handleHeap();
 
-        void setFinalizer(Finalizer*, void* context);
-        Finalizer* finalizer();
-        void* finalizerContext();
+        void makeWeak(WeakHandleOwner*, void* context);
+        bool isWeak();
+        
+        WeakHandleOwner* weakOwner();
+        void* weakOwnerContext();
 
         void setPrev(Node*);
         Node* prev();
@@ -94,17 +95,13 @@ private:
         void setNext(Node*);
         Node* next();
 
-        bool isWeak();
-        void makeWeak();
-        
-        bool isSelfDestroying();
-        void makeSelfDestroying();
-
     private:
+        WeakHandleOwner* emptyWeakOwner();
+
         JSValue m_value;
-        HandleHeapWithFlags m_handleHeapWithFlags;
-        Finalizer* m_finalizer;
-        void* m_finalizerContext;
+        HandleHeap* m_handleHeap;
+        WeakHandleOwner* m_weakOwner;
+        void* m_weakOwnerContext;
         Node* m_prev;
         Node* m_next;
     };
@@ -113,6 +110,10 @@ private:
     static Node* toNode(HandleSlot);
 
     void grow();
+    
+#if !ASSERT_DISABLED
+    bool isValidWeakNode(Node*);
+#endif
 
     JSGlobalData* m_globalData;
     BlockStack<Node> m_blockStack;
@@ -122,10 +123,6 @@ private:
     SentinelLinkedList<Node> m_immediateList;
     SinglyLinkedList<Node> m_freeList;
     Node* m_nextToFinalize;
-
-#if !ASSERT_DISABLED
-    bool m_handlingFinalizers;
-#endif
 };
 
 inline HandleHeap* HandleHeap::heapFor(HandleSlot handle)
@@ -133,6 +130,11 @@ inline HandleHeap* HandleHeap::heapFor(HandleSlot handle)
     return toNode(handle)->handleHeap();
 }
 
+inline JSGlobalData* HandleHeap::globalData()
+{
+    return m_globalData;
+}
+
 inline HandleSlot HandleHeap::toHandle(Node* node)
 {
     return reinterpret_cast<HandleSlot>(node);
@@ -157,44 +159,56 @@ inline HandleSlot HandleHeap::allocate()
 inline void HandleHeap::deallocate(HandleSlot handle)
 {
     Node* node = toNode(handle);
-    if (m_nextToFinalize == node) {
+    if (node == m_nextToFinalize) {
         m_nextToFinalize = node->next();
         ASSERT(m_nextToFinalize->next());
     }
+
     SentinelLinkedList<Node>::remove(node);
     m_freeList.push(node);
 }
 
-inline void HandleHeap::makeWeak(HandleSlot handle, Finalizer* finalizer, void* context)
+inline HandleSlot HandleHeap::copyWeak(HandleSlot other)
+{
+    Node* node = toNode(allocate());
+    node->makeWeak(toNode(other)->weakOwner(), toNode(other)->weakOwnerContext());
+    writeBarrier(node->slot(), *other);
+    *node->slot() = *other;
+    return toHandle(node);
+}
+
+inline void HandleHeap::makeWeak(HandleSlot handle, WeakHandleOwner* weakOwner, void* context)
 {
     Node* node = toNode(handle);
+    node->makeWeak(weakOwner, context);
+
     SentinelLinkedList<Node>::remove(node);
-    node->setFinalizer(finalizer, context);
-    node->makeWeak();
-    if (handle->isCell() && *handle)
-        m_weakList.push(node);
-    else
+    if (!*handle || !handle->isCell()) {
         m_immediateList.push(node);
+        return;
+    }
+
+    m_weakList.push(node);
 }
 
-inline void HandleHeap::makeSelfDestroying(HandleSlot handle, Finalizer* finalizer, void* context)
+#if !ASSERT_DISABLED
+inline bool HandleHeap::hasWeakOwner(HandleSlot handle, WeakHandleOwner* weakOwner)
 {
-    makeWeak(handle, finalizer, context);
-    Node* node = toNode(handle);
-    node->makeSelfDestroying();
+    return toNode(handle)->weakOwner() == weakOwner;
 }
+#endif
 
 inline HandleHeap::Node::Node(HandleHeap* handleHeap)
-    : m_handleHeapWithFlags(reinterpret_cast<uintptr_t>(handleHeap))
-    , m_finalizer(0)
-    , m_finalizerContext(0)
+    : m_handleHeap(handleHeap)
+    , m_weakOwner(0)
+    , m_weakOwnerContext(0)
 {
 }
 
 inline HandleHeap::Node::Node(WTF::SentinelTag)
-    : m_handleHeapWithFlags(0)
-    , m_finalizer(0)
-    , m_finalizerContext(0)
+    : m_handleHeap(0)
+    , m_weakOwner(0)
+    , m_weakOwnerContext(0)
 {
 }
 
@@ -205,47 +219,29 @@ inline HandleSlot HandleHeap::Node::slot()
 
 inline HandleHeap* HandleHeap::Node::handleHeap()
 {
-    return reinterpret_cast<HandleHeap*>(m_handleHeapWithFlags & ~FlagsMask);
+    return m_handleHeap;
 }
 
-inline void HandleHeap::Node::setFinalizer(Finalizer* finalizer, void* context)
+inline void HandleHeap::Node::makeWeak(WeakHandleOwner* weakOwner, void* context)
 {
-    m_finalizer = finalizer;
-    m_finalizerContext = context;
-}
-
-inline void HandleHeap::Node::makeWeak()
-{
-    ASSERT(!(m_handleHeapWithFlags & WeakFlag));
-    m_handleHeapWithFlags |= WeakFlag;
+    m_weakOwner = weakOwner ? weakOwner : emptyWeakOwner();
+    m_weakOwnerContext = context;
 }
 
 inline bool HandleHeap::Node::isWeak()
 {
-    return !!(m_handleHeapWithFlags & WeakFlag);
-}
-
-inline void HandleHeap::Node::makeSelfDestroying()
-{
-    ASSERT(m_handleHeapWithFlags & WeakFlag);
-    ASSERT(!(m_handleHeapWithFlags & SelfDestroyingFlag));
-    m_handleHeapWithFlags |= SelfDestroyingFlag;
+    return m_weakOwner; // True for emptyWeakOwner().
 }
 
-inline bool HandleHeap::Node::isSelfDestroying()
+inline WeakHandleOwner* HandleHeap::Node::weakOwner()
 {
-    return !!(m_handleHeapWithFlags & SelfDestroyingFlag);
+    return m_weakOwner == emptyWeakOwner() ? 0 : m_weakOwner; // 0 for emptyWeakOwner().
 }
 
-inline Finalizer* HandleHeap::Node::finalizer()
+inline void* HandleHeap::Node::weakOwnerContext()
 {
-    return m_finalizer;
-}
-
-inline void* HandleHeap::Node::finalizerContext()
-{
-    ASSERT(m_finalizer);
-    return m_finalizerContext;
+    ASSERT(weakOwner());
+    return m_weakOwnerContext;
 }
 
 inline void HandleHeap::Node::setPrev(Node* prev)
@@ -268,6 +264,13 @@ inline HandleHeap::Node* HandleHeap::Node::next()
     return m_next;
 }
 
+// Sentinel to indicate that a node is weak, but its owner has no meaningful
+// callbacks. This allows us to optimize by skipping such nodes.
+inline WeakHandleOwner* HandleHeap::Node::emptyWeakOwner()
+{
+    return reinterpret_cast<WeakHandleOwner*>(-1);
+}
+
 }
 
 #endif
diff --git a/Source/JavaScriptCore/collector/handles/HandleStack.cpp b/Source/JavaScriptCore/heap/HandleStack.cpp
index 1c151af..1c151af 100644
--- a/Source/JavaScriptCore/collector/handles/HandleStack.cpp
+++ b/Source/JavaScriptCore/heap/HandleStack.cpp
diff --git a/Source/JavaScriptCore/collector/handles/HandleStack.h b/Source/JavaScriptCore/heap/HandleStack.h
index 54e6c60..54e6c60 100644
--- a/Source/JavaScriptCore/collector/handles/HandleStack.h
+++ b/Source/JavaScriptCore/heap/HandleStack.h
diff --git a/Source/JavaScriptCore/runtime/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index e3ef8bb..11999b7 100644
--- a/Source/JavaScriptCore/runtime/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -22,7 +22,7 @@
 #include "Heap.h"
 
 #include "CodeBlock.h"
-#include "ConservativeSet.h"
+#include "ConservativeRoots.h"
 #include "GCActivityCallback.h"
 #include "Interpreter.h"
 #include "JSGlobalData.h"
@@ -82,7 +82,7 @@ void Heap::destroy()
     delete m_markListSet;
     m_markListSet = 0;
     m_markedSpace.clearMarks();
-    m_handleHeap.clearWeakPointers();
+    m_handleHeap.finalizeWeakHandles();
     m_markedSpace.destroy();
 
     m_globalData = 0;
@@ -240,16 +240,28 @@ void Heap::markRoots()
     markStack.drain();
 
     m_handleHeap.markStrongHandles(heapRootMarker);
+    markStack.drain();
+
     m_handleStack.mark(heapRootMarker);
+    markStack.drain();
 
-    // Mark the small strings cache last, since it will clear itself if nothing
-    // else has marked it.
+    // Mark the small strings cache as late as possible, since it will clear
+    // itself if nothing else has marked it.
+    // FIXME: Change the small strings cache to use Weak<T>.
     m_globalData->smallStrings.markChildren(heapRootMarker);
-
     markStack.drain();
-    markStack.compact();
     
-    m_handleHeap.updateAfterMark();
+    // Weak handles must be marked last, because their owners use the set of
+    // opaque roots to determine reachability.
+    int lastOpaqueRootCount;
+    do {
+        lastOpaqueRootCount = markStack.opaqueRootCount();
+        m_handleHeap.markWeakHandles(heapRootMarker);
+        markStack.drain();
+    // If the set of opaque roots has grown, more weak handles may have become reachable.
+    } while (lastOpaqueRootCount != markStack.opaqueRootCount());
+
+    markStack.reset();
 
     m_operationInProgress = NoOperation;
 }
@@ -318,10 +330,11 @@ inline const char* TypeCounter::typeName(JSCell* cell)
         return "API wrapper";
     if (cell->isPropertyNameIterator())
         return "For-in iterator";
+    if (const ClassInfo* info = cell->classInfo())
+        return info->className;
     if (!cell->isObject())
         return "[empty cell]";
-    const ClassInfo* info = cell->classInfo();
-    return info ? info->className : "Object";
+    return "Object";
 }
 
 inline void TypeCounter::operator()(JSCell* cell)
@@ -341,10 +354,21 @@ PassOwnPtr<TypeCountSet> Heap::protectedObjectTypeCounts()
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
         typeCounter(it->first);
+    m_handleHeap.protectedObjectTypeCounts(typeCounter);
 
     return typeCounter.take();
 }
 
+void HandleHeap::protectedObjectTypeCounts(TypeCounter& typeCounter)
+{
+    Node* end = m_strongList.end();
+    for (Node* node = m_strongList.begin(); node != end; node = node->next()) {
+        JSValue value = *node->slot();
+        if (value && value.isCell())
+            typeCounter(value.asCell());
+    }
+}
+
 PassOwnPtr<TypeCountSet> Heap::objectTypeCounts()
 {
     TypeCounter typeCounter;
@@ -368,6 +392,7 @@ void Heap::reset(SweepToggle sweepToggle)
     JAVASCRIPTCORE_GC_BEGIN();
 
     markRoots();
+    m_handleHeap.finalizeWeakHandles();
 
     JAVASCRIPTCORE_GC_MARKED();
 
diff --git a/Source/JavaScriptCore/runtime/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index c2d3bac..c2d3bac 100644
--- a/Source/JavaScriptCore/runtime/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
diff --git a/Source/JavaScriptCore/collector/handles/Local.h b/Source/JavaScriptCore/heap/Local.h
index 035e9e9..ac7d136 100644
--- a/Source/JavaScriptCore/collector/handles/Local.h
+++ b/Source/JavaScriptCore/heap/Local.h
@@ -30,70 +30,48 @@
 #include "JSGlobalData.h"
 
 /*
-    A Local is a temporary handle whose lifetime is tied to a given LocalScope.
-    Use Locals for local values on the stack. It is an error to create a Local
-    outside of any LocalScope.
+    A strongly referenced handle whose lifetime is temporary, limited to a given
+    LocalScope. Use Locals for local values on the stack. It is an error to
+    create a Local outside of any LocalScope.
 */
 
 namespace JSC {
-template <typename T> class Local;
-}
-
-namespace WTF {
-
-template<typename T> struct VectorTraits<JSC::Local<T> > {
-    static const bool needsDestruction = false;
-    static const bool needsInitialization = true;
-    static const bool canInitializeWithMemset = false;
-    static const bool canMoveWithMemcpy = true;
-    static const bool canCopyWithMemcpy = false;
-    static const bool canFillWithMemset = false;
-    static const bool canCompareWithMemcmp = true;
-};
-
-}
-
-namespace JSC {
 
 template <typename T> class Local : public Handle<T> {
     friend class LocalScope;
+    using Handle<T>::slot;
+
 public:
     typedef typename Handle<T>::ExternalType ExternalType;
+
     Local(JSGlobalData&, ExternalType = ExternalType());
     Local(JSGlobalData&, Handle<T>);
     Local(const Local<T>&); // Adopting constructor. Used to return a Local to a calling function.
 
     Local& operator=(ExternalType);
     Local& operator=(Handle<T>);
-    
-    using Handle<T>::slot;
 
 private:
     Local(HandleSlot, ExternalType); // Used by LocalScope::release() to move a Local to a containing scope.
-    void internalSet(ExternalType value)
-    {
-        JSValue newValue(HandleTypes<T>::toJSValue(value));
-        HandleSlot slot = this->slot();
-        *slot = newValue;
-    }
+    void set(ExternalType);
 };
 
 template <typename T> inline Local<T>::Local(JSGlobalData& globalData, ExternalType value)
     : Handle<T>(globalData.allocateLocalHandle())
 {
-    internalSet(value);
+    set(value);
 }
 
-template <typename T> inline Local<T>::Local(JSGlobalData& globalData, Handle<T> handle)
+template <typename T> inline Local<T>::Local(JSGlobalData& globalData, Handle<T> other)
     : Handle<T>(globalData.allocateLocalHandle())
 {
-    internalSet(handle.get());
+    set(other.get());
 }
 
-template <typename T> inline Local<T>::Local(const Local<T>& o)
-    : Handle<T>(o.slot())
+template <typename T> inline Local<T>::Local(const Local<T>& other)
+    : Handle<T>(other.slot())
 {
-    const_cast<Local<T>&>(o).invalidate(); // Prevent accidental sharing.
+    const_cast<Local<T>&>(other).setSlot(0); // Prevent accidental sharing.
 }
 
 template <typename T> inline Local<T>::Local(HandleSlot slot, ExternalType value)
@@ -103,16 +81,24 @@ template <typename T> inline Local<T>::Local(HandleSlot slot, ExternalType value
 
 template <typename T> inline Local<T>& Local<T>::operator=(ExternalType value)
 {
-    internalSet(value);
+    set(value);
     return *this;
 }
 
-template <typename T> inline Local<T>& Local<T>::operator=(Handle<T> handle)
+template <typename T> inline Local<T>& Local<T>::operator=(Handle<T> other)
 {
-    internalSet(handle.get());
+    set(other.get());
     return *this;
 }
 
+template <typename T> inline void Local<T>::set(ExternalType externalType)
+{
+    ASSERT(slot());
+    ASSERT(!HandleTypes<T>::toJSValue(externalType) || !HandleTypes<T>::toJSValue(externalType).isCell() || Heap::isMarked(HandleTypes<T>::toJSValue(externalType).asCell()));
+    *slot() = externalType;
+}
+
+
 template <typename T, unsigned inlineCapacity = 0> class LocalStack {
     typedef typename Handle<T>::ExternalType ExternalType;
 public:
@@ -154,4 +140,14 @@ private:
 
 }
 
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Local<T> > : SimpleClassVectorTraits {
+    static const bool needsDestruction = false;
+    static const bool canInitializeWithMemset = false;
+    static const bool canCompareWithMemcmp = false;
+};
+
+}
+
 #endif
diff --git a/Source/JavaScriptCore/collector/handles/LocalScope.h b/Source/JavaScriptCore/heap/LocalScope.h
index cd27b32..cd27b32 100644
--- a/Source/JavaScriptCore/collector/handles/LocalScope.h
+++ b/Source/JavaScriptCore/heap/LocalScope.h
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
index 3e205a1..1f4f3ce 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
@@ -22,7 +22,7 @@
 #include "config.h"
 #include "MachineStackMarker.h"
 
-#include "ConservativeSet.h"
+#include "ConservativeRoots.h"
 #include "Heap.h"
 #include "JSArray.h"
 #include "JSGlobalData.h"
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.h b/Source/JavaScriptCore/heap/MachineStackMarker.h
index c814ac5..c814ac5 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.h
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.h
diff --git a/Source/JavaScriptCore/runtime/MarkStack.cpp b/Source/JavaScriptCore/heap/MarkStack.cpp
index e9d1b13..3fb1a98 100644
--- a/Source/JavaScriptCore/runtime/MarkStack.cpp
+++ b/Source/JavaScriptCore/heap/MarkStack.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "MarkStack.h"
 
-#include "ConservativeSet.h"
+#include "ConservativeRoots.h"
 #include "Heap.h"
 #include "JSArray.h"
 #include "JSCell.h"
@@ -38,11 +38,12 @@ namespace JSC {
 
 size_t MarkStack::s_pageSize = 0;
 
-void MarkStack::compact()
+void MarkStack::reset()
 {
     ASSERT(s_pageSize);
     m_values.shrinkAllocation(s_pageSize);
     m_markSets.shrinkAllocation(s_pageSize);
+    m_opaqueRoots.clear();
 }
 
 void MarkStack::append(ConservativeRoots& conservativeRoots)
@@ -56,7 +57,13 @@ void MarkStack::append(ConservativeRoots& conservativeRoots)
 inline void MarkStack::markChildren(JSCell* cell)
 {
     ASSERT(Heap::isMarked(cell));
+    if (cell->structure()->typeInfo().type() < CompoundType) {
+        cell->JSCell::markChildren(*this);
+        return;
+    }
+
     if (!cell->structure()->typeInfo().overridesMarkChildren()) {
+        ASSERT(cell->isObject());
 #ifdef NDEBUG
         asObject(cell)->markChildrenDirect(*this);
 #else
@@ -104,6 +111,7 @@ void MarkStack::drain()
             }
 
             if (cell->structure()->typeInfo().type() < CompoundType) {
+                cell->JSCell::markChildren(*this);
                 if (current.m_values == end) {
                     m_markSets.removeLast();
                     continue;
diff --git a/Source/JavaScriptCore/runtime/MarkStack.h b/Source/JavaScriptCore/heap/MarkStack.h
index 7131917..aba7647 100644
--- a/Source/JavaScriptCore/runtime/MarkStack.h
+++ b/Source/JavaScriptCore/heap/MarkStack.h
@@ -29,6 +29,7 @@
 #include "JSValue.h"
 #include "Register.h"
 #include "WriteBarrier.h"
+#include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OSAllocator.h>
@@ -59,18 +60,8 @@ namespace JSC {
             ASSERT(m_values.isEmpty());
         }
 
-        void deprecatedAppend(JSValue*);
         void deprecatedAppend(JSCell**);
-        void deprecatedAppend(Register*);
         template <typename T> void append(WriteBarrierBase<T>*);
-        template <typename T> void append(DeprecatedPtr<T>*);
-        
-        ALWAYS_INLINE void deprecatedAppendValues(Register* registers, size_t count, MarkSetProperties properties = NoNullValues)
-        {
-            JSValue* values = reinterpret_cast<JSValue*>(registers);
-            if (count)
-                m_markSets.append(MarkSet(values, values + count, properties));
-        }
 
         void appendValues(WriteBarrierBase<Unknown>* barriers, size_t count, MarkSetProperties properties = NoNullValues)
         {
@@ -81,8 +72,12 @@ namespace JSC {
         
         void append(ConservativeRoots&);
 
+        bool addOpaqueRoot(void* root) { return m_opaqueRoots.add(root).second; }
+        bool containsOpaqueRoot(void* root) { return m_opaqueRoots.contains(root); }
+        int opaqueRootCount() { return m_opaqueRoots.size(); }
+
         void drain();
-        void compact();
+        void reset();
 
     private:
         friend class HeapRootMarker; // Allowed to mark a JSValue* or JSCell** directly.
@@ -198,6 +193,7 @@ namespace JSC {
         MarkStackArray<MarkSet> m_markSets;
         MarkStackArray<JSCell*> m_values;
         static size_t s_pageSize;
+        HashSet<void*> m_opaqueRoots; // Handle-owning data structures not visible to the garbage collector.
 
 #if !ASSERT_DISABLED
     public:
@@ -212,11 +208,6 @@ namespace JSC {
             return;
         m_markSets.append(MarkSet(slot, slot + count, NoNullValues));
     }
-
-    template <typename T> inline void MarkStack::append(DeprecatedPtr<T>* slot)
-    {
-        internalAppend(*slot->slot());
-    }
     
     template <typename T> inline void MarkStack::append(WriteBarrierBase<T>* slot)
     {
@@ -229,12 +220,6 @@ namespace JSC {
         internalAppend(*value);
     }
 
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSValue* value)
-    {
-        ASSERT(value);
-        internalAppend(*value);
-    }
-    
     ALWAYS_INLINE void MarkStack::append(JSValue* value)
     {
         ASSERT(value);
@@ -247,12 +232,6 @@ namespace JSC {
         internalAppend(*value);
     }
 
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(Register* value)
-    {
-        ASSERT(value);
-        internalAppend(value->jsValue());
-    }
-
     ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
     {
         ASSERT(value);
@@ -274,6 +253,8 @@ namespace JSC {
         void mark(JSValue*, size_t);
         void mark(JSString**);
         void mark(JSCell**);
+        
+        MarkStack& markStack();
 
     private:
         MarkStack& m_markStack;
@@ -304,6 +285,11 @@ namespace JSC {
         m_markStack.append(slot);
     }
 
+    inline MarkStack& HeapRootMarker::markStack()
+    {
+        return m_markStack;
+    }
+
 } // namespace JSC
 
 #endif
diff --git a/Source/JavaScriptCore/runtime/MarkStackPosix.cpp b/Source/JavaScriptCore/heap/MarkStackPosix.cpp
index 2a5b298..2a5b298 100644
--- a/Source/JavaScriptCore/runtime/MarkStackPosix.cpp
+++ b/Source/JavaScriptCore/heap/MarkStackPosix.cpp
diff --git a/Source/JavaScriptCore/runtime/MarkStackSymbian.cpp b/Source/JavaScriptCore/heap/MarkStackSymbian.cpp
index a3893d7..a3893d7 100644
--- a/Source/JavaScriptCore/runtime/MarkStackSymbian.cpp
+++ b/Source/JavaScriptCore/heap/MarkStackSymbian.cpp
diff --git a/Source/JavaScriptCore/runtime/MarkStackWin.cpp b/Source/JavaScriptCore/heap/MarkStackWin.cpp
index 2d2a1b3..2d2a1b3 100644
--- a/Source/JavaScriptCore/runtime/MarkStackWin.cpp
+++ b/Source/JavaScriptCore/heap/MarkStackWin.cpp
diff --git a/Source/JavaScriptCore/runtime/MarkedBlock.cpp b/Source/JavaScriptCore/heap/MarkedBlock.cpp
index cae701f..a10a778 100644
--- a/Source/JavaScriptCore/runtime/MarkedBlock.cpp
+++ b/Source/JavaScriptCore/heap/MarkedBlock.cpp
@@ -60,14 +60,12 @@ MarkedBlock::MarkedBlock(const PageAllocationAligned& allocation, JSGlobalData*
 
     Structure* dummyMarkableCellStructure = globalData->dummyMarkableCellStructure.get();
     for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell)
-        new (&atoms()[i]) JSCell(dummyMarkableCellStructure);
+        new (&atoms()[i]) JSCell(*globalData, dummyMarkableCellStructure);
 }
 
 void MarkedBlock::sweep()
 {
-#if !ENABLE(JSC_ZOMBIES)
     Structure* dummyMarkableCellStructure = m_heap->globalData()->dummyMarkableCellStructure.get();
-#endif
 
     for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
         if (m_marks.get(i))
@@ -75,15 +73,15 @@ void MarkedBlock::sweep()
 
         JSCell* cell = reinterpret_cast<JSCell*>(&atoms()[i]);
 #if ENABLE(JSC_ZOMBIES)
-        if (!cell->isZombie()) {
+        if (cell->structure() && cell->structure() != dummyMarkableCellStructure && !cell->isZombie()) {
             const ClassInfo* info = cell->classInfo();
             cell->~JSCell();
-            new (cell) JSZombie(info, JSZombie::leakedZombieStructure());
+            new (cell) JSZombie(*m_heap->globalData(), info, m_heap->globalData()->zombieStructure.get());
             m_marks.set(i);
         }
 #else
         cell->~JSCell();
-        new (cell) JSCell(dummyMarkableCellStructure);
+        new (cell) JSCell(*m_heap->globalData(), dummyMarkableCellStructure);
 #endif
     }
 }
diff --git a/Source/JavaScriptCore/runtime/MarkedBlock.h b/Source/JavaScriptCore/heap/MarkedBlock.h
index 0e2b59c..0e2b59c 100644
--- a/Source/JavaScriptCore/runtime/MarkedBlock.h
+++ b/Source/JavaScriptCore/heap/MarkedBlock.h
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.cpp b/Source/JavaScriptCore/heap/MarkedSpace.cpp
index d9a1e42..d9a1e42 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.cpp
+++ b/Source/JavaScriptCore/heap/MarkedSpace.cpp
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.h b/Source/JavaScriptCore/heap/MarkedSpace.h
index 29a8cd0..29a8cd0 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.h
+++ b/Source/JavaScriptCore/heap/MarkedSpace.h
diff --git a/Source/JavaScriptCore/heap/Strong.h b/Source/JavaScriptCore/heap/Strong.h
new file mode 100644
index 0000000..9f2aa05
--- /dev/null
+++ b/Source/JavaScriptCore/heap/Strong.h
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Strong_h
+#define Strong_h
+
+#include "Assertions.h"
+#include "Handle.h"
+#include "HandleHeap.h"
+
+namespace JSC {
+
+class JSGlobalData;
+HandleSlot allocateGlobalHandle(JSGlobalData&);
+
+// A strongly referenced handle that prevents the object it points to from being garbage collected.
+template <typename T> class Strong : public Handle<T> {
+    using Handle<T>::slot;
+    using Handle<T>::setSlot;
+
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+    
+    Strong()
+        : Handle<T>()
+    {
+    }
+    
+    Strong(JSGlobalData& globalData, ExternalType value = ExternalType())
+        : Handle<T>(allocateGlobalHandle(globalData))
+    {
+        set(value);
+    }
+
+    Strong(JSGlobalData& globalData, Handle<T> handle)
+        : Handle<T>(allocateGlobalHandle(globalData))
+    {
+        set(handle.get());
+    }
+    
+    Strong(const Strong& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleHeap::heapFor(other.slot())->allocate());
+        set(other.get());
+    }
+
+    template <typename U> Strong(const Strong<U>& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleHeap::heapFor(other.slot())->allocate());
+        set(other.get());
+    }
+    
+    enum HashTableDeletedValueTag { HashTableDeletedValue };
+    bool isHashTableDeletedValue() const { return slot() == hashTableDeletedValue(); }
+    Strong(HashTableDeletedValueTag)
+        : Handle<T>(hashTableDeletedValue())
+    {
+    }
+
+    ~Strong()
+    {
+        clear();
+    }
+
+    void swap(Strong& other)
+    {
+        Handle<T>::swap(other);
+    }
+
+    void set(JSGlobalData& globalData, ExternalType value)
+    {
+        if (!slot())
+            setSlot(allocateGlobalHandle(globalData));
+        set(value);
+    }
+
+    template <typename U> Strong& operator=(const Strong<U>& other)
+    {
+        if (!other.slot()) {
+            clear();
+            return *this;
+        }
+
+        set(*HandleHeap::heapFor(other.slot())->globalData(), other.get());
+        return *this;
+    }
+    
+    Strong& operator=(const Strong& other)
+    {
+        if (!other.slot()) {
+            clear();
+            return *this;
+        }
+
+        set(*HandleHeap::heapFor(other.slot())->globalData(), other.get());
+        return *this;
+    }
+
+    void clear()
+    {
+        if (!slot())
+            return;
+        HandleHeap::heapFor(slot())->deallocate(slot());
+        setSlot(0);
+    }
+
+private:
+    static HandleSlot hashTableDeletedValue() { return reinterpret_cast<HandleSlot>(-1); }
+
+    void set(ExternalType externalType)
+    {
+        ASSERT(slot());
+        JSValue value = HandleTypes<T>::toJSValue(externalType);
+        HandleHeap::heapFor(slot())->writeBarrier(slot(), value);
+        *slot() = value;
+    }
+};
+
+template<class T> inline void swap(Strong<T>& a, Strong<T>& b)
+{
+    a.swap(b);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Strong<T> > : SimpleClassVectorTraits {
+    static const bool canCompareWithMemcmp = false;
+};
+
+template<typename P> struct HashTraits<JSC::Strong<P> > : SimpleClassHashTraits<JSC::Strong<P> > { };
+
+}
+
+#endif // Strong_h
diff --git a/Source/JavaScriptCore/heap/Weak.h b/Source/JavaScriptCore/heap/Weak.h
new file mode 100644
index 0000000..62e2596
--- /dev/null
+++ b/Source/JavaScriptCore/heap/Weak.h
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Weak_h
+#define Weak_h
+
+#include "Assertions.h"
+#include "Handle.h"
+#include "HandleHeap.h"
+#include "JSGlobalData.h"
+
+namespace JSC {
+
+// A weakly referenced handle that becomes 0 when the value it points to is garbage collected.
+template <typename T> class Weak : public Handle<T> {
+    using Handle<T>::slot;
+    using Handle<T>::setSlot;
+
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+
+    Weak()
+        : Handle<T>()
+    {
+    }
+
+    Weak(JSGlobalData& globalData, ExternalType value = ExternalType(), WeakHandleOwner* weakOwner = 0, void* context = 0)
+        : Handle<T>(globalData.allocateGlobalHandle())
+    {
+        HandleHeap::heapFor(slot())->makeWeak(slot(), weakOwner, context);
+        set(value);
+    }
+
+    Weak(const Weak& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
+    }
+
+    template <typename U> Weak(const Weak<U>& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
+    }
+    
+    enum HashTableDeletedValueTag { HashTableDeletedValue };
+    bool isHashTableDeletedValue() const { return slot() == hashTableDeletedValue(); }
+    Weak(HashTableDeletedValueTag)
+        : Handle<T>(hashTableDeletedValue())
+    {
+    }
+
+    ~Weak()
+    {
+        clear();
+    }
+
+    void swap(Weak& other)
+    {
+        Handle<T>::swap(other);
+    }
+
+    ExternalType get() const { return  HandleTypes<T>::getFromSlot(slot()); }
+    
+    void clear()
+    {
+        if (!slot())
+            return;
+        HandleHeap::heapFor(slot())->deallocate(slot());
+        setSlot(0);
+    }
+    
+    void set(JSGlobalData& globalData, ExternalType value, WeakHandleOwner* weakOwner = 0, void* context = 0)
+    {
+        if (!slot()) {
+            setSlot(globalData.allocateGlobalHandle());
+            HandleHeap::heapFor(slot())->makeWeak(slot(), weakOwner, context);
+        }
+        ASSERT(HandleHeap::heapFor(slot())->hasWeakOwner(slot(), weakOwner));
+        set(value);
+    }
+
+    template <typename U> Weak& operator=(const Weak<U>& other)
+    {
+        clear();
+        if (other.slot())
+            setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
+        return *this;
+    }
+
+    Weak& operator=(const Weak& other)
+    {
+        clear();
+        if (other.slot())
+            setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
+        return *this;
+    }
+
+private:
+    static HandleSlot hashTableDeletedValue() { return reinterpret_cast<HandleSlot>(-1); }
+
+    void set(ExternalType externalType)
+    {
+        ASSERT(slot());
+        JSValue value = HandleTypes<T>::toJSValue(externalType);
+        ASSERT(!value || !value.isCell() || Heap::isMarked(value.asCell()));
+        HandleHeap::heapFor(slot())->writeBarrier(slot(), value);
+        *slot() = value;
+    }
+};
+
+template<class T> inline void swap(Weak<T>& a, Weak<T>& b)
+{
+    a.swap(b);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Weak<T> > : SimpleClassVectorTraits {
+    static const bool canCompareWithMemcmp = false;
+};
+
+template<typename P> struct HashTraits<JSC::Weak<P> > : SimpleClassHashTraits<JSC::Weak<P> > { };
+
+}
+
+#endif // Weak_h
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index 6021279..4a6ffb6 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -164,7 +164,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     JSGlobalObject* globalObject = codeBlock->globalObject();
     ASSERT(globalObject->isGlobalObject());
     int property = vPC[2].u.operand;
-    Structure* structure = vPC[3].u.structure;
+    Structure* structure = vPC[3].u.structure.get();
     int offset = vPC[4].u.operand;
 
     if (structure == globalObject->structure()) {
@@ -177,10 +177,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
         if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
-            if (vPC[3].u.structure)
-                vPC[3].u.structure->deref();
-            globalObject->structure()->ref();
-            vPC[3] = globalObject->structure();
+            vPC[3].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
             vPC[4] = slot.cachedOffset();
             callFrame->uncheckedR(dst) = JSValue(result);
             return true;
@@ -204,7 +201,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
     JSGlobalObject* globalObject = codeBlock->globalObject();
     ASSERT(globalObject->isGlobalObject());
     int property = vPC[2].u.operand;
-    Structure* structure = vPC[3].u.structure;
+    Structure* structure = vPC[3].u.structure.get();
     int offset = vPC[4].u.operand;
     int skip = vPC[5].u.operand;
     
@@ -255,10 +252,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
         if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
-            if (vPC[3].u.structure)
-                vPC[3].u.structure->deref();
-            globalObject->structure()->ref();
-            vPC[3] = globalObject->structure();
+            vPC[3].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
             vPC[4] = slot.cachedOffset();
             ASSERT(result);
             callFrame->uncheckedR(dst) = JSValue(result);
@@ -620,7 +614,7 @@ static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception,
         return;
 
     JSGlobalData* globalData = &callFrame->globalData();
-    JSValue jsMessage = exception->getDirect(globalData->propertyNames->message);
+    JSValue jsMessage = exception->getDirect(*globalData, globalData->propertyNames->message);
     if (!jsMessage || !jsMessage.isString())
         return;
 
@@ -994,9 +988,10 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionE
     }
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
+    // We initialise |this| unnecessarily here for the sake of code clarity
     size_t dst = 0;
     for (int i = 0; i < argc; ++i)
-        newCallFrame->uncheckedR(++dst) = jsUndefined();
+        newCallFrame->uncheckedR(dst++) = jsUndefined();
     
     JSObject* error = FunctionExecutable->compileForCall(callFrame, scopeChain);
     if (error) {
@@ -1225,11 +1220,11 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
     }
 
     // Cache miss: record Structure to compare against next time.
-    Structure* lastStructure = vPC[4].u.structure;
+    Structure* lastStructure = vPC[4].u.structure.get();
     if (structure != lastStructure) {
         // First miss: record Structure to compare against next time.
         if (!lastStructure) {
-            vPC[4] = structure;
+            vPC[4].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
             return;
         }
 
@@ -1255,24 +1250,23 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
 
         // put_by_id_transition checks the prototype chain for setters.
         normalizePrototypeChain(callFrame, baseCell);
-
+        JSCell* owner = codeBlock->ownerExecutable();
+        JSGlobalData& globalData = callFrame->globalData();
         vPC[0] = getOpcode(op_put_by_id_transition);
-        vPC[4] = structure->previousID();
-        vPC[5] = structure;
-        vPC[6] = structure->prototypeChain(callFrame);
+        vPC[4].u.structure.set(globalData, owner, structure->previousID());
+        vPC[5].u.structure.set(globalData, owner, structure);
+        vPC[6].u.structureChain.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure->prototypeChain(callFrame));
+        ASSERT(vPC[6].u.structureChain);
         vPC[7] = slot.cachedOffset();
-        codeBlock->refStructures(vPC);
         return;
     }
 
     vPC[0] = getOpcode(op_put_by_id_replace);
     vPC[5] = slot.cachedOffset();
-    codeBlock->refStructures(vPC);
 }
 
-NEVER_INLINE void Interpreter::uncachePutByID(CodeBlock* codeBlock, Instruction* vPC)
+NEVER_INLINE void Interpreter::uncachePutByID(CodeBlock*, Instruction* vPC)
 {
-    codeBlock->derefStructures(vPC);
     vPC[0] = getOpcode(op_put_by_id);
     vPC[4] = 0;
 }
@@ -1314,11 +1308,11 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
     }
 
     // Cache miss
-    Structure* lastStructure = vPC[4].u.structure;
+    Structure* lastStructure = vPC[4].u.structure.get();
     if (structure != lastStructure) {
         // First miss: record Structure to compare against next time.
         if (!lastStructure) {
-            vPC[4] = structure;
+            vPC[4].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
             return;
         }
 
@@ -1344,8 +1338,6 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
             vPC[5] = slot.cachedOffset();
             break;
         }
-
-        codeBlock->refStructures(vPC);
         return;
     }
 
@@ -1364,7 +1356,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         // should not be treated as a dictionary.
         if (baseObject->structure()->isDictionary()) {
             baseObject->flattenDictionaryObject(callFrame->globalData());
-            offset = baseObject->structure()->get(propertyName);
+            offset = baseObject->structure()->get(callFrame->globalData(), propertyName);
         }
 
         ASSERT(!baseObject->structure()->isUncacheableDictionary());
@@ -1383,9 +1375,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
             vPC[6] = offset;
             break;
         }
-        vPC[5] = baseObject->structure();
-
-        codeBlock->refStructures(vPC);
+        vPC[5].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), baseObject->structure());
         return;
     }
 
@@ -1411,15 +1401,13 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         vPC[7] = offset;
         break;
     }
-    vPC[4] = structure;
-    vPC[5] = structure->prototypeChain(callFrame);
+    vPC[4].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
+    vPC[5].u.structureChain.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure->prototypeChain(callFrame));
     vPC[6] = count;
-    codeBlock->refStructures(vPC);
 }
 
-NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock* codeBlock, Instruction* vPC)
+NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock*, Instruction* vPC)
 {
-    codeBlock->derefStructures(vPC);
     vPC[0] = getOpcode(op_get_by_id);
     vPC[4] = 0;
 }
@@ -2528,7 +2516,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
 
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(baseCell->isObject());
@@ -2559,12 +2547,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
 
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(structure->prototypeForLookup(callFrame).isObject());
                 JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-                Structure* prototypeStructure = vPC[5].u.structure;
+                Structure* prototypeStructure = vPC[5].u.structure.get();
 
                 if (LIKELY(protoObject->structure() == prototypeStructure)) {
                     int dst = vPC[1].u.operand;
@@ -2598,12 +2586,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(structure->prototypeForLookup(callFrame).isObject());
                 JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-                Structure* prototypeStructure = vPC[5].u.structure;
+                Structure* prototypeStructure = vPC[5].u.structure.get();
                 
                 if (LIKELY(protoObject->structure() == prototypeStructure)) {
                     int dst = vPC[1].u.operand;
@@ -2643,12 +2631,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(structure->prototypeForLookup(callFrame).isObject());
                 JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-                Structure* prototypeStructure = vPC[5].u.structure;
+                Structure* prototypeStructure = vPC[5].u.structure.get();
                 
                 if (LIKELY(protoObject->structure() == prototypeStructure)) {
                     int dst = vPC[1].u.operand;
@@ -2712,6 +2700,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
         NEXT_INSTRUCTION();
     }
+#if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+    goto *(&&skip_get_by_id_chain);
+#endif
     DEFINE_OPCODE(op_get_by_id_chain) {
         /* op_get_by_id_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
 
@@ -2724,12 +2715,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
 
             if (LIKELY(baseCell->structure() == structure)) {
-                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                WriteBarrier<Structure>* it = vPC[5].u.structureChain->head();
                 size_t count = vPC[6].u.operand;
-                RefPtr<Structure>* end = it + count;
+                WriteBarrier<Structure>* end = it + count;
 
                 while (true) {
                     JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
@@ -2759,6 +2750,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         NEXT_INSTRUCTION();
     }
 #if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+    skip_get_by_id_chain:
     goto *(&&skip_id_getter_self);
 #endif
     DEFINE_OPCODE(op_get_by_id_getter_self) {
@@ -2773,7 +2765,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(baseCell->isObject());
@@ -2816,7 +2808,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(baseCell->isObject());
@@ -2873,12 +2865,12 @@ skip_id_custom_self:
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
-                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                WriteBarrier<Structure>* it = vPC[5].u.structureChain->head();
                 size_t count = vPC[6].u.operand;
-                RefPtr<Structure>* end = it + count;
+                WriteBarrier<Structure>* end = it + count;
                 
                 while (true) {
                     JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
@@ -2928,12 +2920,12 @@ skip_id_custom_self:
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
-                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                WriteBarrier<Structure>* it = vPC[5].u.structureChain->head();
                 size_t count = vPC[6].u.operand;
-                RefPtr<Structure>* end = it + count;
+                WriteBarrier<Structure>* end = it + count;
                 
                 while (true) {
                     JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
@@ -2964,6 +2956,7 @@ skip_id_custom_self:
     }
 #if USE(GCC_COMPUTED_GOTO_WORKAROUND)
     skip_id_custom_chain:
+    goto *(&&skip_get_array_length);
 #endif
     DEFINE_OPCODE(op_get_array_length) {
         /* op_get_array_length dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
@@ -2985,6 +2978,10 @@ skip_id_custom_self:
         uncacheGetByID(codeBlock, vPC);
         NEXT_INSTRUCTION();
     }
+#if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+    skip_get_array_length:
+    goto *(&&skip_get_string_length);
+#endif
     DEFINE_OPCODE(op_get_string_length) {
         /* op_get_string_length dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
 
@@ -3005,6 +3002,10 @@ skip_id_custom_self:
         uncacheGetByID(codeBlock, vPC);
         NEXT_INSTRUCTION();
     }
+#if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+    skip_get_string_length:
+    goto *(&&skip_put_by_id);
+#endif
     DEFINE_OPCODE(op_put_by_id) {
         /* put_by_id base(r) property(id) value(r) nop(n) nop(n) nop(n) nop(n) direct(b)
 
@@ -3038,6 +3039,9 @@ skip_id_custom_self:
         vPC += OPCODE_LENGTH(op_put_by_id);
         NEXT_INSTRUCTION();
     }
+#if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+      skip_put_by_id:
+#endif
     DEFINE_OPCODE(op_put_by_id_transition) {
         /* op_put_by_id_transition base(r) property(id) value(r) oldStructure(sID) newStructure(sID) structureChain(chain) offset(n) direct(b)
          
@@ -3054,8 +3058,8 @@ skip_id_custom_self:
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* oldStructure = vPC[4].u.structure;
-            Structure* newStructure = vPC[5].u.structure;
+            Structure* oldStructure = vPC[4].u.structure.get();
+            Structure* newStructure = vPC[5].u.structure.get();
             
             if (LIKELY(baseCell->structure() == oldStructure)) {
                 ASSERT(baseCell->isObject());
@@ -3063,7 +3067,7 @@ skip_id_custom_self:
                 int direct = vPC[8].u.operand;
                 
                 if (!direct) {
-                    RefPtr<Structure>* it = vPC[6].u.structureChain->head();
+                    WriteBarrier<Structure>* it = vPC[6].u.structureChain->head();
 
                     JSValue proto = baseObject->structure()->prototypeForLookup(callFrame);
                     while (!proto.isNull()) {
@@ -3075,11 +3079,11 @@ skip_id_custom_self:
                         proto = asObject(proto)->structure()->prototypeForLookup(callFrame);
                     }
                 }
-                baseObject->transitionTo(newStructure);
+                baseObject->transitionTo(*globalData, newStructure);
 
                 int value = vPC[3].u.operand;
                 unsigned offset = vPC[7].u.operand;
-                ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(codeBlock->identifier(vPC[2].u.operand))) == offset);
+                ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(*globalData, codeBlock->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(callFrame->globalData(), offset, callFrame->r(value).jsValue());
 
                 vPC += OPCODE_LENGTH(op_put_by_id_transition);
@@ -3106,7 +3110,7 @@ skip_id_custom_self:
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
 
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(baseCell->isObject());
@@ -3114,7 +3118,7 @@ skip_id_custom_self:
                 int value = vPC[3].u.operand;
                 unsigned offset = vPC[5].u.operand;
                 
-                ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(codeBlock->identifier(vPC[2].u.operand))) == offset);
+                ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(*globalData, codeBlock->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(callFrame->globalData(), offset, callFrame->r(value).jsValue());
 
                 vPC += OPCODE_LENGTH(op_put_by_id_replace);
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.cpp b/Source/JavaScriptCore/interpreter/RegisterFile.cpp
index b3a87e5..e3b34bb 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -29,7 +29,7 @@
 #include "config.h"
 #include "RegisterFile.h"
 
-#include "ConservativeSet.h"
+#include "ConservativeRoots.h"
 #include "Interpreter.h"
 #include "JSGlobalData.h"
 #include "JSGlobalObject.h"
@@ -72,24 +72,7 @@ void RegisterFile::releaseExcessCapacity()
 
 void RegisterFile::setGlobalObject(JSGlobalObject* globalObject)
 {
-    m_globalObject.set(globalObject->globalData(), globalObject, RegisterFile::globalObjectCollectedNotifier());
-}
-
-class GlobalObjectNotifier : public Finalizer {
-public:
-    void finalize(Handle<Unknown> value, void*)
-    {
-        JSGlobalObject* globalObject = asGlobalObject(value.get());
-        globalObject->globalData().interpreter->registerFile().setNumGlobals(0);
-    }
-};
-
-Finalizer* RegisterFile::globalObjectCollectedNotifier()
-{
-    // This will leak alas, but we only create one of them, and it doesn't
-    // take up any significant amount of space.
-    static GlobalObjectNotifier* notifier = new GlobalObjectNotifier;
-    return notifier;
+    m_globalObject.set(globalObject->globalData(), globalObject, &m_globalObjectOwner, this);
 }
 
 JSGlobalObject* RegisterFile::globalObject()
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.h b/Source/JavaScriptCore/interpreter/RegisterFile.h
index 4d04085..f59c13a 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.h
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.h
@@ -32,7 +32,7 @@
 #include "Heap.h"
 #include "ExecutableAllocator.h"
 #include "Register.h"
-#include "WeakGCPtr.h"
+#include "Weak.h"
 #include <stdio.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PageReservation.h>
@@ -135,8 +135,6 @@ namespace JSC {
         static size_t committedByteCount();
         static void initializeThreading();
 
-        static Finalizer* globalObjectCollectedNotifier();
-
         Register* const * addressOfEnd() const
         {
             return &m_end;
@@ -154,7 +152,13 @@ namespace JSC {
         Register* m_commitEnd;
         PageReservation m_reservation;
 
-        WeakGCPtr<JSGlobalObject> m_globalObject; // The global object whose vars are currently stored in the register file.
+        Weak<JSGlobalObject> m_globalObject; // The global object whose vars are currently stored in the register file.
+        class GlobalObjectOwner : public WeakHandleOwner {
+            virtual void finalize(Handle<Unknown>, void* context)
+            {
+                static_cast<RegisterFile*>(context)->setNumGlobals(0);
+            }
+        } m_globalObjectOwner;
     };
 
     inline RegisterFile::RegisterFile(JSGlobalData& globalData, size_t capacity, size_t maxGlobals)
@@ -163,7 +167,7 @@ namespace JSC {
         , m_start(0)
         , m_end(0)
         , m_max(0)
-        , m_globalObject(globalData, RegisterFile::globalObjectCollectedNotifier())
+        , m_globalObject(globalData, 0, &m_globalObjectOwner, this)
     {
         ASSERT(maxGlobals && isPageAligned(maxGlobals));
         ASSERT(capacity && isPageAligned(capacity));
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 063ae8c..b983427 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -44,6 +44,7 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #include "RepatchBuffer.h"
 #include "ResultType.h"
 #include "SamplingTool.h"
+#include "dfg/DFGNode.h" // for DFG_SUCCESS_STATS
 
 using namespace std;
 
@@ -471,6 +472,11 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
 
     Jump registerFileCheck;
     if (m_codeBlock->codeType() == FunctionCode) {
+#if DFG_SUCCESS_STATS
+        static SamplingCounter counter("orignalJIT");
+        emitCount(counter);
+#endif
+
         // In the case of a fast linked call, we do not set this up in the caller.
         emitPutImmediateToCallFrameHeader(m_codeBlock, RegisterFile::CodeBlock);
 
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index 61bd2ab..6b8c6dd 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -235,7 +235,7 @@ namespace JSC {
 
         static void patchGetByIdSelf(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
         static void patchPutByIdReplace(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress, bool direct);
-        static void patchMethodCallProto(CodeBlock* codeblock, MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*, ReturnAddressPtr);
+        static void patchMethodCallProto(JSGlobalData&, CodeBlock* codeblock, MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*, ReturnAddressPtr);
 
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
@@ -311,7 +311,7 @@ namespace JSC {
         void emitStoreInt32(unsigned index, RegisterID payload, bool indexIsInt32 = false);
         void emitStoreInt32(unsigned index, TrustedImm32 payload, bool indexIsInt32 = false);
         void emitStoreCell(unsigned index, RegisterID payload, bool indexIsCell = false);
-        void emitStoreBool(unsigned index, RegisterID tag, bool indexIsBool = false);
+        void emitStoreBool(unsigned index, RegisterID payload, bool indexIsBool = false);
         void emitStoreDouble(unsigned index, FPRegisterID value);
 
         bool isLabeled(unsigned bytecodeOffset);
@@ -473,6 +473,48 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoStruct = 52;
         static const int patchOffsetMethodCheckPutFunction = 84;
 #endif
+#elif CPU(SH4)
+       // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetGetByIdStructure = 6;
+        static const int patchOffsetPutByIdPropertyMapOffset = 24;
+        static const int patchOffsetPutByIdStructure = 6;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdBranchToSlowCase = 10;
+        static const int patchOffsetGetByIdPropertyMapOffset = 24;
+        static const int patchOffsetGetByIdPutResult = 32;
+
+        // sequenceOpCall
+        static const int sequenceOpCallInstructionSpace = 12;
+        static const int sequenceOpCallConstantSpace = 2;
+        // sequenceMethodCheck
+        static const int sequenceMethodCheckInstructionSpace = 40;
+        static const int sequenceMethodCheckConstantSpace = 6;
+        // sequenceGetByIdHotPath
+        static const int sequenceGetByIdHotPathInstructionSpace = 36;
+        static const int sequenceGetByIdHotPathConstantSpace = 5;
+        // sequenceGetByIdSlowCase
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 26;
+        static const int sequenceGetByIdSlowCaseConstantSpace = 2;
+        // sequencePutById
+        static const int sequencePutByIdInstructionSpace = 36;
+        static const int sequencePutByIdConstantSpace = 5;
+
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 26;
+
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 26;
+
+#if ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 0; // FIMXE
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 22;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 4;
+
+        static const int patchOffsetMethodCheckProtoObj = 12;
+        static const int patchOffsetMethodCheckProtoStruct = 20;
+        static const int patchOffsetMethodCheckPutFunction = 32;
 #else
 #error "JSVALUE32_64 not supported on this platform."
 #endif
@@ -665,14 +707,16 @@ namespace JSC {
 
 #if (defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL)
 #define BEGIN_UNINTERRUPTED_SEQUENCE(name) do { beginUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace); } while (false)
-#define END_UNINTERRUPTED_SEQUENCE(name) do { endUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace); } while (false)
+#define END_UNINTERRUPTED_SEQUENCE_FOR_PUT(name, dst) do { endUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace, dst); } while (false)
+#define END_UNINTERRUPTED_SEQUENCE(name) END_UNINTERRUPTED_SEQUENCE_FOR_PUT(name, 0)
 
         void beginUninterruptedSequence(int, int);
-        void endUninterruptedSequence(int, int);
+        void endUninterruptedSequence(int, int, int);
 
 #else
 #define BEGIN_UNINTERRUPTED_SEQUENCE(name)  do { beginUninterruptedSequence(); } while (false)
 #define END_UNINTERRUPTED_SEQUENCE(name)  do { endUninterruptedSequence(); } while (false)
+#define END_UNINTERRUPTED_SEQUENCE_FOR_PUT(name, dst) do { endUninterruptedSequence(); } while (false)
 #endif
 
         void emit_op_add(Instruction*);
diff --git a/Source/JavaScriptCore/jit/JITArithmetic.cpp b/Source/JavaScriptCore/jit/JITArithmetic.cpp
index edf2290..734cc1d 100644
--- a/Source/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/Source/JavaScriptCore/jit/JITArithmetic.cpp
@@ -966,7 +966,7 @@ void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsign
 void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned result, unsigned op1, unsigned op2, OperandTypes types, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase)
 {
     // We assume that subtracting TagTypeNumber is equivalent to adding DoubleEncodeOffset.
-    COMPILE_ASSERT(((JSImmediate::TagTypeNumber + JSImmediate::DoubleEncodeOffset) == 0), TagTypeNumber_PLUS_DoubleEncodeOffset_EQUALS_0);
+    COMPILE_ASSERT(((TagTypeNumber + DoubleEncodeOffset) == 0), TagTypeNumber_PLUS_DoubleEncodeOffset_EQUALS_0);
 
     Jump notImm1;
     Jump notImm2;
diff --git a/Source/JavaScriptCore/jit/JITInlineMethods.h b/Source/JavaScriptCore/jit/JITInlineMethods.h
index 16c2335..dabfdd2 100644
--- a/Source/JavaScriptCore/jit/JITInlineMethods.h
+++ b/Source/JavaScriptCore/jit/JITInlineMethods.h
@@ -123,6 +123,13 @@ ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace
 
     ensureSpace(insnSpace, constSpace);
 
+#elif CPU(SH4)
+#ifndef NDEBUG
+    insnSpace += sizeof(SH4Word);
+    constSpace += sizeof(uint64_t);
+#endif
+
+    m_assembler.ensureSpace(insnSpace + m_assembler.maxInstructionSize + 2, constSpace + 8);
 #endif
 
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
@@ -133,8 +140,9 @@ ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace
 #endif
 }
 
-ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
+ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace, int dst)
 {
+    UNUSED_PARAM(dst);
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
     /* There are several cases when the uninterrupted sequence is larger than
      * maximum required offset for pathing the same sequence. Eg.: if in a
@@ -143,6 +151,15 @@ ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
      * calculation of length of uninterrupted sequence. So, the insnSpace and
      * constSpace should be upper limit instead of hard limit.
      */
+#if CPU(SH4)
+    if ((dst > 15) || (dst < -16)) {
+        insnSpace += 8;
+        constSpace += 2;
+    }
+
+    if (((dst >= -16) && (dst < 0)) || ((dst > 7) && (dst <= 15)))
+        insnSpace += 8;
+#endif
     ASSERT(differenceBetween(m_uninterruptedInstructionSequenceBegin, label()) <= insnSpace);
     ASSERT(sizeOfConstantPool() - m_uninterruptedConstantSequenceBegin <= constSpace);
 #endif
@@ -167,6 +184,22 @@ ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 {
     loadPtr(address, linkRegister);
 }
+#elif CPU(SH4)
+
+ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
+{
+    m_assembler.stspr(reg);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
+{
+    m_assembler.ldspr(reg);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
+{
+    loadPtrLinkReg(address);
+}
 
 #elif CPU(MIPS)
 
@@ -217,6 +250,8 @@ ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
     addPtr(TrustedImm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
 #elif CPU(ARM)
     move(stackPointerRegister, firstArgumentRegister);
+#elif CPU(SH4)
+    move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
 }
@@ -453,11 +488,11 @@ inline void JIT::emitStoreCell(unsigned index, RegisterID payload, bool indexIsC
         store32(TrustedImm32(JSValue::CellTag), tagFor(index, callFrameRegister));
 }
 
-inline void JIT::emitStoreBool(unsigned index, RegisterID tag, bool indexIsBool)
+inline void JIT::emitStoreBool(unsigned index, RegisterID payload, bool indexIsBool)
 {
+    store32(payload, payloadFor(index, callFrameRegister));
     if (!indexIsBool)
-        store32(TrustedImm32(0), payloadFor(index, callFrameRegister));
-    store32(tag, tagFor(index, callFrameRegister));
+        store32(TrustedImm32(JSValue::BooleanTag), tagFor(index, callFrameRegister));
 }
 
 inline void JIT::emitStoreDouble(unsigned index, FPRegisterID value)
@@ -674,7 +709,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
 #if USE(JSVALUE64)
     return branchTestPtr(Zero, reg, tagMaskRegister);
 #else
-    return branchTest32(Zero, reg, TrustedImm32(JSImmediate::TagMask));
+    return branchTest32(Zero, reg, TrustedImm32(TagMask));
 #endif
 }
 
@@ -695,7 +730,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotJSCell(RegisterID reg)
 #if USE(JSVALUE64)
     return branchTestPtr(NonZero, reg, tagMaskRegister);
 #else
-    return branchTest32(NonZero, reg, TrustedImm32(JSImmediate::TagMask));
+    return branchTest32(NonZero, reg, TrustedImm32(TagMask));
 #endif
 }
 
@@ -736,7 +771,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
 #if USE(JSVALUE64)
     return branchPtr(AboveOrEqual, reg, tagTypeNumberRegister);
 #else
-    return branchTest32(NonZero, reg, TrustedImm32(JSImmediate::TagTypeNumber));
+    return branchTest32(NonZero, reg, TrustedImm32(TagTypeNumber));
 #endif
 }
 
@@ -745,7 +780,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateInteger(RegisterID reg)
 #if USE(JSVALUE64)
     return branchPtr(Below, reg, tagTypeNumberRegister);
 #else
-    return branchTest32(Zero, reg, TrustedImm32(JSImmediate::TagTypeNumber));
+    return branchTest32(Zero, reg, TrustedImm32(TagTypeNumber));
 #endif
 }
 
@@ -774,12 +809,12 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateNumber(RegisterID reg)
 #if USE(JSVALUE32_64)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
-    subPtr(TrustedImm32(JSImmediate::TagTypeNumber), reg);
+    subPtr(TrustedImm32(TagTypeNumber), reg);
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitFastArithDeTagImmediateJumpIfZero(RegisterID reg)
 {
-    return branchSubPtr(Zero, TrustedImm32(JSImmediate::TagTypeNumber), reg);
+    return branchSubPtr(Zero, TrustedImm32(TagTypeNumber), reg);
 }
 #endif
 
@@ -790,7 +825,7 @@ ALWAYS_INLINE void JIT::emitFastArithReTagImmediate(RegisterID src, RegisterID d
 #else
     if (src != dest)
         move(src, dest);
-    addPtr(TrustedImm32(JSImmediate::TagTypeNumber), dest);
+    addPtr(TrustedImm32(TagTypeNumber), dest);
 #endif
 }
 
@@ -810,8 +845,7 @@ ALWAYS_INLINE void JIT::emitFastArithIntToImmNoCheck(RegisterID src, RegisterID
 
 ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
 {
-    lshift32(TrustedImm32(JSImmediate::ExtendedPayloadShift), reg);
-    or32(TrustedImm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), reg);
+    or32(TrustedImm32(static_cast<int32_t>(ValueFalse)), reg);
 }
 
 #endif // USE(JSVALUE32_64)
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index daceea6..53bc1df 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -57,7 +57,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // Checks out okay! - get the length from the Ustring.
     load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT0);
 
-    Jump string_failureCases3 = branch32(Above, regT0, TrustedImm32(JSImmediate::maxImmediateInt));
+    Jump string_failureCases3 = branch32(LessThan, regT0, TrustedImm32(0));
 
     // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
     emitFastArithIntToImmNoCheck(regT0, regT0);
@@ -695,9 +695,14 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
 void JIT::emit_op_not(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
-    xorPtr(TrustedImm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
-    addSlowCase(branchTestPtr(NonZero, regT0, TrustedImm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
-    xorPtr(TrustedImm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), regT0);
+
+    // Invert against JSValue(false); if the value was tagged as a boolean, then all bits will be
+    // clear other than the low bit (which will be 0 or 1 for false or true inputs respectively).
+    // Then invert against JSValue(true), which will add the tag back in, and flip the low bit.
+    xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), regT0);
+    addSlowCase(branchTestPtr(NonZero, regT0, TrustedImm32(static_cast<int32_t>(~1))));
+    xorPtr(TrustedImm32(static_cast<int32_t>(ValueTrue)), regT0);
+
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -731,7 +736,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
-    andPtr(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    andPtr(TrustedImm32(~TagBitUndefined), regT0);
     addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
@@ -752,7 +757,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
-    andPtr(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    andPtr(TrustedImm32(~TagBitUndefined), regT0);
     addJump(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
@@ -909,8 +914,8 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
 
     isNotObject.link(this);
     move(regT0, regT1);
-    and32(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT1);
-    addJump(branch32(Equal, regT1, TrustedImm32(JSImmediate::FullTagTypeNull)), breakTarget);
+    and32(TrustedImm32(~TagBitUndefined), regT1);
+    addJump(branch32(Equal, regT1, TrustedImm32(ValueNull)), breakTarget);
 
     JITStubCall toObjectStubCall(this, cti_to_object);
     toObjectStubCall.addArgument(regT0);
@@ -1163,8 +1168,8 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
 
     isImmediate.link(this);
 
-    andPtr(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    setPtr(Equal, regT0, TrustedImm32(JSImmediate::FullTagTypeNull), regT0);
+    andPtr(TrustedImm32(~TagBitUndefined), regT0);
+    setPtr(Equal, regT0, TrustedImm32(ValueNull), regT0);
 
     wasNotImmediate.link(this);
 
@@ -1188,8 +1193,8 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
 
     isImmediate.link(this);
 
-    andPtr(TrustedImm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    setPtr(NotEqual, regT0, TrustedImm32(JSImmediate::FullTagTypeNull), regT0);
+    andPtr(TrustedImm32(~TagBitUndefined), regT0);
+    setPtr(NotEqual, regT0, TrustedImm32(ValueNull), regT0);
 
     wasNotImmediate.link(this);
 
@@ -1374,7 +1379,7 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    xorPtr(TrustedImm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), regT0);
     JITStubCall stubCall(this, cti_op_not);
     stubCall.addArgument(regT0);
     stubCall.call(currentInstruction[1].u.operand);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index bc0b2cb..edce21c 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -245,7 +245,26 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     call(Address(regT2, executableOffsetToFunction));
 
     restoreReturnAddressBeforeReturn(regT3);
+#elif CPU(SH4)
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+
+    preserveReturnAddressAfterCall(regT3); // Callee preserved
+    emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
+
+    // Calling convention: f(r0 == regT4, r1 == regT5, ...);
+    // Host function signature: f(ExecState*);
+    move(callFrameRegister, regT4);
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT5);
+    move(regT2, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
+    loadPtr(Address(regT5, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
+    call(Address(regT2, executableOffsetToFunction), regT0);
+    restoreReturnAddressBeforeReturn(regT3);
 #elif CPU(MIPS)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
@@ -394,7 +413,28 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     addPtr(TrustedImm32(16), stackPointerRegister);
 
     restoreReturnAddressBeforeReturn(regT3);
+#elif CPU(SH4)
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
+    preserveReturnAddressAfterCall(regT3); // Callee preserved
+    emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
+
+    // Calling convention: f(r0 == regT4, r1 == regT5, ...);
+    // Host function signature: f(ExecState*);
+    move(callFrameRegister, regT4);
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT5);
+    move(regT2, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
+    loadPtr(Address(regT5, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    // call the function
+    nativeCall = call();
+
+    restoreReturnAddressBeforeReturn(regT3);
 #elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
 #error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
 #else
@@ -553,7 +593,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
-    move(TrustedImm32(JSValue::TrueTag), regT0);
+    move(TrustedImm32(1), regT0);
     Label loop(this);
 
     // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!
@@ -564,7 +604,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     branchTest32(NonZero, regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    move(TrustedImm32(JSValue::FalseTag), regT0);
+    move(TrustedImm32(0), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
     isInstance.link(this);
@@ -829,9 +869,9 @@ void JIT::emit_op_not(Instruction* currentInstruction)
 
     emitLoadTag(src, regT0);
 
-    xor32(TrustedImm32(JSValue::FalseTag), regT0);
-    addSlowCase(branchTest32(NonZero, regT0, TrustedImm32(~1)));
-    xor32(TrustedImm32(JSValue::TrueTag), regT0);
+    emitLoad(src, regT1, regT0);
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::BooleanTag)));
+    xor32(TrustedImm32(1), regT0);
 
     emitStoreBool(dst, regT0, (dst == src));
 }
@@ -855,25 +895,9 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
     emitLoad(cond, regT1, regT0);
 
-    Jump isTrue = branch32(Equal, regT1, TrustedImm32(JSValue::TrueTag));
-    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::FalseTag)), target);
-
-    Jump isNotInteger = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
-    Jump isTrue2 = branch32(NotEqual, regT0, TrustedImm32(0));
-    addJump(jump(), target);
-
-    if (supportsFloatingPoint()) {
-        isNotInteger.link(this);
-
-        addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
-
-        emitLoadDouble(cond, fpRegT0);
-        addJump(branchDoubleZeroOrNaN(fpRegT0, fpRegT1), target);
-    } else
-        addSlowCase(isNotInteger);
-
-    isTrue.link(this);
-    isTrue2.link(this);
+    ASSERT((JSValue::BooleanTag + 1 == JSValue::Int32Tag) && !(JSValue::Int32Tag + 1));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::BooleanTag)));
+    addJump(branchTest32(Zero, regT0), target);
 }
 
 void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -882,6 +906,18 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     unsigned target = currentInstruction[2].u.operand;
 
     linkSlowCase(iter);
+
+    if (supportsFloatingPoint()) {
+        // regT1 contains the tag from the hot path.
+        Jump notNumber = branch32(Above, regT1, Imm32(JSValue::LowestTag));
+
+        emitLoadDouble(cond, fpRegT0);
+        emitJumpSlowToHot(branchDoubleZeroOrNaN(fpRegT0, fpRegT1), target);
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jfalse));
+
+        notNumber.link(this);
+    }
+
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
@@ -895,25 +931,9 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
 
     emitLoad(cond, regT1, regT0);
 
-    Jump isFalse = branch32(Equal, regT1, TrustedImm32(JSValue::FalseTag));
-    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::TrueTag)), target);
-
-    Jump isNotInteger = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
-    Jump isFalse2 = branch32(Equal, regT0, TrustedImm32(0));
-    addJump(jump(), target);
-
-    if (supportsFloatingPoint()) {
-        isNotInteger.link(this);
-
-        addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
-
-        emitLoadDouble(cond, fpRegT0);
-        addJump(branchDoubleNonZero(fpRegT0, fpRegT1), target);
-    } else
-        addSlowCase(isNotInteger);
-
-    isFalse.link(this);
-    isFalse2.link(this);
+    ASSERT((JSValue::BooleanTag + 1 == JSValue::Int32Tag) && !(JSValue::Int32Tag + 1));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::BooleanTag)));
+    addJump(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -922,6 +942,18 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
     unsigned target = currentInstruction[2].u.operand;
 
     linkSlowCase(iter);
+
+    if (supportsFloatingPoint()) {
+        // regT1 contains the tag from the hot path.
+        Jump notNumber = branch32(Above, regT1, Imm32(JSValue::LowestTag));
+
+        emitLoadDouble(cond, fpRegT0);
+        emitJumpSlowToHot(branchDoubleNonZero(fpRegT0, fpRegT1), target);
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jtrue));
+
+        notNumber.link(this);
+    }
+
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
@@ -946,8 +978,9 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
 
-    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && !(JSValue::NullTag + 1));
-    addJump(branch32(AboveOrEqual, regT1, TrustedImm32(JSValue::UndefinedTag)), target);
+    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && (JSValue::NullTag & 0x1));
+    or32(TrustedImm32(1), regT1);
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::NullTag)), target);
 
     wasNotImmediate.link(this);
 }
@@ -970,8 +1003,9 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
 
-    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && !(JSValue::NullTag + 1));
-    addJump(branch32(Below, regT1, TrustedImm32(JSValue::UndefinedTag)), target);
+    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && (JSValue::NullTag & 0x1));
+    or32(TrustedImm32(1), regT1);
+    addJump(branch32(NotEqual, regT1, TrustedImm32(JSValue::NullTag)), target);
 
     wasNotImmediate.link(this);
 }
@@ -1012,8 +1046,7 @@ void JIT::emit_op_eq(Instruction* currentInstruction)
     addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::CellTag)));
     addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
 
-    set8Compare32(Equal, regT0, regT2, regT0);
-    or32(TrustedImm32(JSValue::FalseTag), regT0);
+    set32Compare32(Equal, regT0, regT2, regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1049,7 +1082,6 @@ void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>:
     stubCallEq.call(regT0);
 
     storeResult.link(this);
-    or32(TrustedImm32(JSValue::FalseTag), regT0);
     emitStoreBool(dst, regT0);
 }
 
@@ -1064,8 +1096,7 @@ void JIT::emit_op_neq(Instruction* currentInstruction)
     addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::CellTag)));
     addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
 
-    set8Compare32(NotEqual, regT0, regT2, regT0);
-    or32(TrustedImm32(JSValue::FalseTag), regT0);
+    set32Compare32(NotEqual, regT0, regT2, regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1100,7 +1131,6 @@ void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>
 
     storeResult.link(this);
     xor32(TrustedImm32(0x1), regT0);
-    or32(TrustedImm32(JSValue::FalseTag), regT0);
     emitStoreBool(dst, regT0);
 }
 
@@ -1121,11 +1151,9 @@ void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqTy
     addSlowCase(branch32(AboveOrEqual, regT2, TrustedImm32(JSValue::CellTag)));
 
     if (type == OpStrictEq)
-        set8Compare32(Equal, regT0, regT1, regT0);
+        set32Compare32(Equal, regT0, regT1, regT0);
     else
-        set8Compare32(NotEqual, regT0, regT1, regT0);
-
-    or32(TrustedImm32(JSValue::FalseTag), regT0);
+        set32Compare32(NotEqual, regT0, regT1, regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1185,14 +1213,12 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
 
     isImmediate.link(this);
 
-    set8Compare32(Equal, regT1, TrustedImm32(JSValue::NullTag), regT2);
-    set8Compare32(Equal, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
+    set32Compare32(Equal, regT1, TrustedImm32(JSValue::NullTag), regT2);
+    set32Compare32(Equal, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
     wasNotImmediate.link(this);
 
-    or32(TrustedImm32(JSValue::FalseTag), regT1);
-
     emitStoreBool(dst, regT1);
 }
 
@@ -1211,14 +1237,12 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
 
     isImmediate.link(this);
 
-    set8Compare32(NotEqual, regT1, TrustedImm32(JSValue::NullTag), regT2);
-    set8Compare32(NotEqual, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
+    set32Compare32(NotEqual, regT1, TrustedImm32(JSValue::NullTag), regT2);
+    set32Compare32(NotEqual, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
     and32(regT2, regT1);
 
     wasNotImmediate.link(this);
 
-    or32(TrustedImm32(JSValue::FalseTag), regT1);
-
     emitStoreBool(dst, regT1);
 }
 
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index 68f8dda..a1f1fe6 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -581,7 +581,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
 
     // ecx = baseObject->m_structure
     if (!direct) {
-        for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it)
             testPrototype((*it)->storedPrototype(), failureCases);
     }
 
@@ -606,11 +606,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         restoreReturnAddressBeforeReturn(regT3);
     }
 
-    // Assumes m_refCount can be decremented easily, refcount decrement is safe as 
-    // codeblock should ensure oldStructure->m_refCount > 0
-    sub32(TrustedImm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(TrustedImm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(TrustedImmPtr(newStructure), Address(regT0, JSCell::structureOffset()));
+    storePtrWithWriteBarrier(TrustedImmPtr(newStructure), regT0, Address(regT0, JSCell::structureOffset()));
 
     // write the value
     compilePutDirectOffset(regT0, regT1, newStructure, cachedOffset);
@@ -652,17 +648,15 @@ void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, St
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset), offset);
 }
 
-void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+void JIT::patchMethodCallProto(JSGlobalData& globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
 {
     RepatchBuffer repatchBuffer(codeBlock);
 
     ASSERT(!methodCallLinkInfo.cachedStructure);
-    methodCallLinkInfo.cachedStructure = structure;
-    structure->ref();
+    methodCallLinkInfo.cachedStructure.set(globalData, codeBlock->ownerExecutable(), structure);
 
     Structure* prototypeStructure = proto->structure();
-    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
-    prototypeStructure->ref();
+    methodCallLinkInfo.cachedPrototypeStructure.set(globalData, codeBlock->ownerExecutable(), prototypeStructure);
 
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
@@ -697,7 +691,7 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     // Checks out okay! - get the length from the storage
     loadPtr(Address(regT0, JSArray::storageOffset()), regT3);
     load32(Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
-    Jump failureCases2 = branch32(Above, regT2, TrustedImm32(JSImmediate::maxImmediateInt));
+    Jump failureCases2 = branch32(LessThan, regT2, TrustedImm32(0));
 
     emitFastArithIntToImmNoCheck(regT2, regT0);
     Jump success = jump();
@@ -735,7 +729,7 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
-    Structure* const * prototypeStructureAddress = protoObject->addressOfStructure();
+    const void* prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
     move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
@@ -839,8 +833,7 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
 
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
-    structure->ref();
-    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
+    polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -858,7 +851,7 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
-    Structure* const * prototypeStructureAddress = protoObject->addressOfStructure();
+    const void* prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
     move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
@@ -907,10 +900,7 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    structure->ref();
-    prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
+    prototypeStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure, prototypeStructure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -928,7 +918,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     bucketsOfFail.append(baseObjectCheck);
 
     Structure* currStructure = structure;
-    RefPtr<Structure>* it = chain->head();
+    WriteBarrier<Structure>* it = chain->head();
     JSObject* protoObject = 0;
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
@@ -978,7 +968,6 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     // Track the stub we have created so that it will be deleted later.
-    structure->ref();
     prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, chain);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
@@ -997,7 +986,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     bucketsOfFail.append(checkStructure(regT0, structure));
 
     Structure* currStructure = structure;
-    RefPtr<Structure>* it = chain->head();
+    WriteBarrier<Structure>* it = chain->head();
     JSObject* protoObject = 0;
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 2a47e5c..d0c3688 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -475,7 +475,7 @@ void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<Sl
     stubCall.addArgument(TrustedImmPtr(ident));
     Call call = stubCall.call(dst);
     
-    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+    END_UNINTERRUPTED_SEQUENCE_FOR_PUT(sequenceGetByIdSlowCase, dst);
     
     ASSERT_JIT_OFFSET(differenceBetween(coldPathBegin, call), patchOffsetGetByIdSlowCaseCall);
     
@@ -597,7 +597,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     
     if (!direct) {
         // Verify that nothing in the prototype chain has a setter for this property. 
-        for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it)
             testPrototype((*it)->storedPrototype(), failureCases);
     }
 
@@ -619,12 +619,10 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         
         restoreReturnAddressBeforeReturn(regT3);
     }
+
+    storePtrWithWriteBarrier(TrustedImmPtr(newStructure), regT0, Address(regT0, JSCell::structureOffset()));
     
-    sub32(TrustedImm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(TrustedImm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(TrustedImmPtr(newStructure), Address(regT0, JSCell::structureOffset()));
-    
-#if CPU(MIPS)
+#if CPU(MIPS) || CPU(SH4)
     // For MIPS, we don't add sizeof(void*) to the stack offset.
     load32(Address(stackPointerRegister, OBJECT_OFFSETOF(JITStackFrame, args[2]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT3);
     load32(Address(stackPointerRegister, OBJECT_OFFSETOF(JITStackFrame, args[2]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT2);
@@ -674,17 +672,14 @@ void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, St
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)); // tag
 }
 
-void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+void JIT::patchMethodCallProto(JSGlobalData& globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
 {
     RepatchBuffer repatchBuffer(codeBlock);
     
     ASSERT(!methodCallLinkInfo.cachedStructure);
-    methodCallLinkInfo.cachedStructure = structure;
-    structure->ref();
-    
+    methodCallLinkInfo.cachedStructure.set(globalData, codeBlock->ownerExecutable(), structure);
     Structure* prototypeStructure = proto->structure();
-    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
-    prototypeStructure->ref();
+    methodCallLinkInfo.cachedPrototypeStructure.set(globalData, codeBlock->ownerExecutable(), prototypeStructure);
     
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
@@ -762,7 +757,7 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     Jump failureCases1 = checkStructure(regT0, structure);
     
     // Check the prototype object's Structure had not changed.
-    Structure* const * prototypeStructureAddress = protoObject->addressOfStructure();
+    const void* prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
     move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
@@ -867,9 +862,8 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    
-    structure->ref();
-    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
+
+    polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -889,7 +883,7 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     Jump failureCases1 = checkStructure(regT0, structure);
     
     // Check the prototype object's Structure had not changed.
-    Structure* const * prototypeStructureAddress = protoObject->addressOfStructure();
+    const void* prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
     move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
@@ -935,10 +929,8 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
     
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    
-    structure->ref();
-    prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
+
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, prototypeStructure);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -957,7 +949,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     bucketsOfFail.append(checkStructure(regT0, structure));
     
     Structure* currStructure = structure;
-    RefPtr<Structure>* it = chain->head();
+    WriteBarrier<Structure>* it = chain->head();
     JSObject* protoObject = 0;
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
@@ -1006,7 +998,6 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
     
     // Track the stub we have created so that it will be deleted later.
-    structure->ref();
     prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, chain);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
@@ -1026,7 +1017,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     bucketsOfFail.append(checkStructure(regT0, structure));
     
     Structure* currStructure = structure;
-    RefPtr<Structure>* it = chain->head();
+    WriteBarrier<Structure>* it = chain->head();
     JSObject* protoObject = 0;
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index e52c7c8..953bd11 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -40,7 +40,7 @@
 #include "Debugger.h"
 #include "ExceptionHelpers.h"
 #include "GetterSetter.h"
-#include "Global.h"
+#include "Strong.h"
 #include "JIT.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -67,7 +67,7 @@ using namespace std;
 
 namespace JSC {
 
-#if OS(DARWIN) || OS(WINDOWS)
+#if OS(DARWIN) || (OS(WINDOWS) && CPU(X86))
 #define SYMBOL_STRING(name) "_" #name
 #else
 #define SYMBOL_STRING(name) #name
@@ -81,7 +81,7 @@ namespace JSC {
 
 #if (OS(LINUX) || OS(FREEBSD)) && CPU(X86_64)
 #define SYMBOL_STRING_RELOCATION(name) #name "@plt"
-#elif OS(DARWIN)
+#elif OS(DARWIN) || (CPU(X86_64) && COMPILER(MINGW) && !GCC_VERSION_AT_LEAST(4, 5, 0))
 #define SYMBOL_STRING_RELOCATION(name) "_" #name
 #elif CPU(X86) && COMPILER(MINGW)
 #define SYMBOL_STRING_RELOCATION(name) "@" #name "@4"
@@ -314,7 +314,79 @@ extern "C" {
 #define ENABLE_PROFILER_REFERENCE_OFFSET 96
 #define GLOBAL_DATA_OFFSET         100
 #define STACK_LENGTH               104
+#elif CPU(SH4)
+#define SYMBOL_STRING(name) #name
+/* code (r4), RegisterFile* (r5), CallFrame* (r6), JSValue* exception (r7), Profiler**(sp), JSGlobalData (sp)*/
 
+asm volatile (
+".text\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "mov.l r7, @-r15" "\n"
+    "mov.l r6, @-r15" "\n"
+    "mov.l r5, @-r15" "\n"
+    "mov.l r8, @-r15" "\n"
+    "mov #127, r8" "\n"
+    "mov.l r14, @-r15" "\n"
+    "sts.l pr, @-r15" "\n"
+    "mov.l r13, @-r15" "\n"
+    "mov.l r11, @-r15" "\n"
+    "mov.l r10, @-r15" "\n"
+    "add #-60, r15" "\n"
+    "mov r6, r14" "\n"
+    "jsr @r4" "\n"
+    "nop" "\n"
+    "add #60, r15" "\n"
+    "mov.l @r15+,r10" "\n"
+    "mov.l @r15+,r11" "\n"
+    "mov.l @r15+,r13" "\n"
+    "lds.l @r15+,pr" "\n"
+    "mov.l @r15+,r14" "\n"
+    "mov.l @r15+,r8" "\n"
+    "add #12, r15" "\n"
+    "rts" "\n"
+    "nop" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "mov.l .L2"SYMBOL_STRING(cti_vm_throw)",r0" "\n"
+    "mov r15, r4" "\n"
+    "mov.l @(r0,r12),r11" "\n"
+    "jsr @r11" "\n"
+    "nop" "\n"
+    "add #60, r15" "\n"
+    "mov.l @r15+,r10" "\n"
+    "mov.l @r15+,r11" "\n"
+    "mov.l @r15+,r13" "\n"
+    "lds.l @r15+,pr" "\n"
+    "mov.l @r15+,r14" "\n"
+    "mov.l @r15+,r8" "\n"
+    "add #12, r15" "\n"
+    "rts" "\n"
+    "nop" "\n"
+    ".align 2" "\n"
+    ".L2"SYMBOL_STRING(cti_vm_throw)":.long " SYMBOL_STRING(cti_vm_throw)"@GOT \n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "add #60, r15" "\n"
+    "mov.l @r15+,r10" "\n"
+    "mov.l @r15+,r11" "\n"
+    "mov.l @r15+,r13" "\n"
+    "lds.l @r15+,pr" "\n"
+    "mov.l @r15+,r14" "\n"
+    "mov.l @r15+,r8" "\n"
+    "add #12, r15" "\n"
+    "rts" "\n"
+    "nop" "\n"
+);
 #else
     #error "JIT not supported on this platform."
 #endif
@@ -771,12 +843,12 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
         normalizePrototypeChain(callFrame, baseCell);
 
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        stubInfo->initPutByIdTransition(structure->previousID(), structure, prototypeChain);
+        stubInfo->initPutByIdTransition(callFrame->globalData(), codeBlock->ownerExecutable(), structure->previousID(), structure, prototypeChain);
         JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress, direct);
         return;
     }
     
-    stubInfo->initPutByIdReplace(structure);
+    stubInfo->initPutByIdReplace(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
 
     JIT::patchPutByIdReplace(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress, direct);
 }
@@ -824,7 +896,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     if (slot.slotBase() == baseValue) {
         // set this up, so derefStructures can do it's job.
-        stubInfo->initGetByIdSelf(structure);
+        stubInfo->initGetByIdSelf(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
         if (slot.cachedPropertyType() != PropertySlot::Value)
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
         else
@@ -847,10 +919,10 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary()) {
             slotBaseObject->flattenDictionaryObject(callFrame->globalData());
-            offset = slotBaseObject->structure()->get(propertyName);
+            offset = slotBaseObject->structure()->get(callFrame->globalData(), propertyName);
         }
         
-        stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
+        stubInfo->initGetByIdProto(callFrame->globalData(), codeBlock->ownerExecutable(), structure, slotBaseObject->structure());
 
         ASSERT(!structure->isDictionary());
         ASSERT(!slotBaseObject->structure()->isDictionary());
@@ -866,7 +938,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     }
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-    stubInfo->initGetByIdChain(structure, prototypeChain);
+    stubInfo->initGetByIdChain(callFrame->globalData(), codeBlock->ownerExecutable(), structure, prototypeChain);
     JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, propertyName, slot, offset, returnAddress);
 }
 
@@ -1156,6 +1228,29 @@ MSVC()
 MSVC_END(    END)
 */
 
+#elif CPU(SH4)
+#define DEFINE_STUB_FUNCTION(rtype, op) \
+    extern "C" { \
+        rtype JITStubThunked_##op(STUB_ARGS_DECLARATION); \
+    }; \
+    asm volatile( \
+    ".align 2" "\n" \
+    ".globl " SYMBOL_STRING(cti_##op) "\n" \
+    SYMBOL_STRING(cti_##op) ":" "\n" \
+    "sts pr, r11" "\n" \
+    "mov.l r11, @(0x38, r15)" "\n" \
+    "mov.l .L2"SYMBOL_STRING(JITStubThunked_##op)",r0" "\n" \
+    "mov.l @(r0,r12),r11" "\n" \
+    "jsr @r11" "\n" \
+    "nop" "\n" \
+    "mov.l @(0x38, r15), r11 " "\n" \
+    "lds r11, pr " "\n" \
+    "rts" "\n" \
+    "nop" "\n" \
+    ".align 2" "\n" \
+    ".L2"SYMBOL_STRING(JITStubThunked_##op)":.long " SYMBOL_STRING(JITStubThunked_##op)"@GOT \n" \
+    ); \
+    rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 #else
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
 #endif
@@ -1465,7 +1560,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
 
         // Check to see if the function is on the object's prototype.  Patch up the code to optimize.
         if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
-            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, slotBaseObject, STUB_RETURN_ADDRESS);
+            JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, callee, structure, slotBaseObject, STUB_RETURN_ADDRESS);
             return JSValue::encode(result);
         }
 
@@ -1476,7 +1571,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // for now.  For now it performs a check on a special object on the global object only used for this
         // purpose.  The object is in no way exposed, and as such the check will always pass.
         if (slot.slotBase() == baseValue) {
-            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject->methodCallDummy(), STUB_RETURN_ADDRESS);
+            JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject->methodCallDummy(), STUB_RETURN_ADDRESS);
             return JSValue::encode(result);
         }
     }
@@ -1535,7 +1630,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
 
         if (stubInfo->accessType == access_get_by_id_self) {
             ASSERT(!stubInfo->stubRoutine);
-            polymorphicStructureList = new PolymorphicAccessStructureList(CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure);
+            polymorphicStructureList = new PolymorphicAccessStructureList(callFrame->globalData(), codeBlock->ownerExecutable(), CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure.get());
             stubInfo->initGetByIdSelfList(polymorphicStructureList, 1);
         } else {
             polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
@@ -1560,12 +1655,12 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(JSG
 
     switch (stubInfo->accessType) {
     case access_get_by_id_proto:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure, stubInfo->u.getByIdProto.prototypeStructure);
+        prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure.get(), stubInfo->u.getByIdProto.prototypeStructure.get());
         stubInfo->stubRoutine = CodeLocationLabel();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
     case access_get_by_id_chain:
-        prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
+        prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure.get(), stubInfo->u.getByIdChain.chain.get());
         stubInfo->stubRoutine = CodeLocationLabel();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
@@ -1649,7 +1744,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary()) {
             slotBaseObject->flattenDictionaryObject(callFrame->globalData());
-            offset = slotBaseObject->structure()->get(propertyName);
+            offset = slotBaseObject->structure()->get(callFrame->globalData(), propertyName);
         }
 
         int listIndex;
@@ -2658,10 +2753,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
         JSValue result = slot.getValue(callFrame, ident);
         if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = codeBlock->globalResolveInfo(globalResolveInfoIndex);
-            if (globalResolveInfo.structure)
-                globalResolveInfo.structure->deref();
-            globalObject->structure()->ref();
-            globalResolveInfo.structure = globalObject->structure();
+            globalResolveInfo.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
             globalResolveInfo.offset = slot.cachedOffset();
             return JSValue::encode(result);
         }
@@ -3495,7 +3587,7 @@ MacroAssemblerCodePtr JITThunks::ctiStub(JSGlobalData* globalData, ThunkGenerato
 
 NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function)
 {
-    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Global<NativeExecutable>(Global<NativeExecutable>::EmptyValue));
+    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Strong<NativeExecutable>());
     if (entry.second)
         entry.first->second.set(*globalData, NativeExecutable::create(*globalData, JIT::compileCTINativeCall(globalData, m_executablePool, function), function, ctiNativeConstruct(), callHostFunctionAsConstructor));
     return entry.first->second.get();
@@ -3503,7 +3595,7 @@ NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFu
 
 NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function, ThunkGenerator generator)
 {
-    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Global<NativeExecutable>(Global<NativeExecutable>::EmptyValue));
+    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Strong<NativeExecutable>());
     if (entry.second) {
         MacroAssemblerCodePtr code = globalData->canUseJIT() ? generator(globalData, m_executablePool.get()) : MacroAssemblerCodePtr();
         entry.first->second.set(*globalData, NativeExecutable::create(*globalData, code, function, ctiNativeConstruct(), callHostFunctionAsConstructor));
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index af6e13f..7c67f6e 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -229,6 +229,27 @@ namespace JSC {
 
         ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
+#elif CPU(SH4)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[6];
+
+        ReturnAddressPtr thunkReturnAddress;
+        void* savedR10;
+        void* savedR11;
+        void* savedR13;
+        void* savedRPR;
+        void* savedR14;
+        void* savedTimeoutReg;
+
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+
+        ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
+    };
 #else
 #error "JITStackFrame not defined for this platform."
 #endif
@@ -254,7 +275,7 @@ namespace JSC {
     extern "C" void ctiOpThrowNotCaught();
     extern "C" EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, void* /*unused1*/, Profiler**, JSGlobalData*);
 
-    template <typename T> class Global;
+    template <typename T> class Strong;
 
     class JITThunks {
     public:
@@ -283,7 +304,7 @@ namespace JSC {
     private:
         typedef HashMap<ThunkGenerator, MacroAssemblerCodePtr> CTIStubMap;
         CTIStubMap m_ctiStubMap;
-        typedef HashMap<NativeFunction, Global<NativeExecutable> > HostFunctionStubMap;
+        typedef HashMap<NativeFunction, Strong<NativeExecutable> > HostFunctionStubMap;
         OwnPtr<HostFunctionStubMap> m_hostFunctionStubMap;
         RefPtr<ExecutablePool> m_executablePool;
 
diff --git a/Source/JavaScriptCore/jit/JSInterfaceJIT.h b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
index 5d3f239..e1d9353 100644
--- a/Source/JavaScriptCore/jit/JSInterfaceJIT.h
+++ b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
@@ -28,7 +28,6 @@
 
 #include "JITCode.h"
 #include "JITStubs.h"
-#include "JSImmediate.h"
 #include "JSValue.h"
 #include "MacroAssembler.h"
 #include "RegisterFile.h"
@@ -154,21 +153,51 @@ namespace JSC {
         static const FPRegisterID fpRegT1 = MIPSRegisters::f6;
         static const FPRegisterID fpRegT2 = MIPSRegisters::f8;
         static const FPRegisterID fpRegT3 = MIPSRegisters::f10;
+#elif CPU(SH4)
+        static const RegisterID timeoutCheckRegister = SH4Registers::r8;
+        static const RegisterID callFrameRegister = SH4Registers::fp;
+
+        static const RegisterID regT0 = SH4Registers::r0;
+        static const RegisterID regT1 = SH4Registers::r1;
+        static const RegisterID regT2 = SH4Registers::r2;
+        static const RegisterID regT3 = SH4Registers::r10;
+        static const RegisterID regT4 = SH4Registers::r4;
+        static const RegisterID regT5 = SH4Registers::r5;
+        static const RegisterID regT6 = SH4Registers::r6;
+        static const RegisterID regT7 = SH4Registers::r7;
+        static const RegisterID firstArgumentRegister =regT4;
+
+        static const RegisterID returnValueRegister = SH4Registers::r0;
+        static const RegisterID cachedResultRegister = SH4Registers::r0;
+
+        static const FPRegisterID fpRegT0  = SH4Registers::fr0;
+        static const FPRegisterID fpRegT1  = SH4Registers::fr2;
+        static const FPRegisterID fpRegT2  = SH4Registers::fr4;
+        static const FPRegisterID fpRegT3  = SH4Registers::fr6;
+        static const FPRegisterID fpRegT4  = SH4Registers::fr8;
+        static const FPRegisterID fpRegT5  = SH4Registers::fr10;
+        static const FPRegisterID fpRegT6  = SH4Registers::fr12;
+        static const FPRegisterID fpRegT7  = SH4Registers::fr14;
 #else
 #error "JIT not supported on this platform."
 #endif
 
 #if USE(JSVALUE32_64)
         // Can't just propogate JSValue::Int32Tag as visual studio doesn't like it
-        static const unsigned Int32Tag = 0xfffffffd;
+        static const unsigned Int32Tag = 0xffffffff;
         COMPILE_ASSERT(Int32Tag == JSValue::Int32Tag, Int32Tag_out_of_sync);
 #else
-        static const unsigned Int32Tag = JSImmediate::TagTypeNumber >> 32;
+        static const unsigned Int32Tag = TagTypeNumber >> 32;
 #endif
         inline Jump emitLoadJSCell(unsigned virtualRegisterIndex, RegisterID payload);
         inline Jump emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst);
         inline Jump emitLoadDouble(unsigned virtualRegisterIndex, FPRegisterID dst, RegisterID scratch);
 
+        inline void storePtrWithWriteBarrier(TrustedImmPtr ptr, RegisterID /* owner */, Address dest)
+        {
+            storePtr(ptr, dest);
+        }
+
 #if USE(JSVALUE32_64)
         inline Jump emitJumpIfNotJSCell(unsigned virtualRegisterIndex);
         inline Address tagFor(int index, RegisterID base = callFrameRegister);
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index 8ccb039..729dce9 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -366,6 +366,7 @@ int main(int argc, char** argv)
 static void cleanupGlobalData(JSGlobalData* globalData)
 {
     JSLock lock(SilenceAssertionsOnly);
+    globalData->clearBuiltinStructures();
     globalData->heap.destroy();
     globalData->deref();
 }
diff --git a/Source/JavaScriptCore/parser/JSParser.cpp b/Source/JavaScriptCore/parser/JSParser.cpp
index 9245eb0..314691d 100644
--- a/Source/JavaScriptCore/parser/JSParser.cpp
+++ b/Source/JavaScriptCore/parser/JSParser.cpp
@@ -2168,5 +2168,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseUnaryExpression(TreeB
 
 namespace WTF
 {
-    template <> struct VectorTraits<JSC::JSParser::Scope> : SimpleClassVectorTraits { };
+    template <> struct VectorTraits<JSC::JSParser::Scope> : SimpleClassVectorTraits {
+        static const bool canInitializeWithMemset = false; // Not all Scope data members initialize to 0.
+    };
 }
diff --git a/Source/JavaScriptCore/parser/Lexer.h b/Source/JavaScriptCore/parser/Lexer.h
index d4145c1..9dc553a 100644
--- a/Source/JavaScriptCore/parser/Lexer.h
+++ b/Source/JavaScriptCore/parser/Lexer.h
@@ -71,11 +71,12 @@ namespace JSC {
         {
             m_error = 0;
             m_code = m_codeStart + offset;
-            m_current = *m_code;
             m_buffer8.resize(0);
             m_buffer16.resize(0);
-            if (UNLIKELY(m_code == m_codeEnd))
-                m_current = -1;
+            // Faster than an if-else sequence
+            m_current = -1;
+            if (LIKELY(m_code < m_codeEnd))
+                m_current = *m_code;
         }
         void setLineNumber(int line)
         {
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index 950bb4e..b5aa46b 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -92,7 +92,7 @@ namespace JSC {
             d->registers = &activation->registerAt(0);
         }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
@@ -143,7 +143,7 @@ namespace JSC {
     }
 
     inline Arguments::Arguments(CallFrame* callFrame)
-        : JSNonFinalObject(callFrame->lexicalGlobalObject()->argumentsStructure())
+        : JSNonFinalObject(callFrame->globalData(), callFrame->lexicalGlobalObject()->argumentsStructure())
         , d(adoptPtr(new ArgumentsData))
     {
         ASSERT(inherits(&s_info));
@@ -185,7 +185,7 @@ namespace JSC {
     }
 
     inline Arguments::Arguments(CallFrame* callFrame, NoParametersType)
-        : JSNonFinalObject(callFrame->lexicalGlobalObject()->argumentsStructure())
+        : JSNonFinalObject(callFrame->globalData(), callFrame->lexicalGlobalObject()->argumentsStructure())
         , d(adoptPtr(new ArgumentsData))
     {
         ASSERT(inherits(&s_info));
@@ -247,7 +247,7 @@ namespace JSC {
         int registerOffset = m_numParametersMinusThis + RegisterFile::CallFrameHeaderSize;
         size_t registerArraySize = numLocals + RegisterFile::CallFrameHeaderSize;
 
-        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = copyRegisterArray(globalData, m_registers - registerOffset, registerArraySize);
+        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = copyRegisterArray(globalData, m_registers - registerOffset, registerArraySize, m_numParametersMinusThis + 1);
         WriteBarrier<Unknown>* registers = registerArray.get() + registerOffset;
         setRegisters(registers, registerArray.release());
     }
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
index e0f4b23..050e989 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -37,7 +37,7 @@ ASSERT_CLASS_FITS_IN_CELL(ArrayConstructor);
     
 static EncodedJSValue JSC_HOST_CALL arrayConstructorIsArray(ExecState*);
 
-ArrayConstructor::ArrayConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, ArrayPrototype* arrayPrototype, Structure* functionStructure)
+ArrayConstructor::ArrayConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, ArrayPrototype* arrayPrototype, Structure* functionStructure)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, arrayPrototype->classInfo()->className))
 {
     // ECMA 15.4.3.1 Array.prototype
@@ -59,7 +59,7 @@ static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgLi
         uint32_t n = args.at(0).toUInt32(exec);
         if (n != args.at(0).toNumber(exec))
             return throwError(exec, createRangeError(exec, "Array size is not a small enough positive integer."));
-        return new (exec) JSArray(globalObject->arrayStructure(), n, CreateInitialized);
+        return new (exec) JSArray(exec->globalData(), globalObject->arrayStructure(), n, CreateInitialized);
     }
 
     // otherwise the array is constructed with the arguments in it
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.h b/Source/JavaScriptCore/runtime/ArrayConstructor.h
index 5e1408f..97b26c5 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.h
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ArrayConstructor : public InternalFunction {
     public:
-        ArrayConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, ArrayPrototype*, Structure*);
+        ArrayConstructor(ExecState*, JSGlobalObject*, Structure*, ArrayPrototype*, Structure*);
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index fdbcd95..29caece 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -114,8 +114,8 @@ const ClassInfo ArrayPrototype::s_info = {"Array", &JSArray::s_info, 0, ExecStat
 */
 
 // ECMA 15.4.4
-ArrayPrototype::ArrayPrototype(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
-    : JSArray(structure)
+ArrayPrototype::ArrayPrototype(JSGlobalObject* globalObject, Structure* structure)
+    : JSArray(globalObject->globalData(), structure)
 {
     ASSERT(inherits(&s_info));
     putAnonymousValue(globalObject->globalData(), 0, globalObject);
@@ -514,10 +514,14 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
     // or quicksort, and much less swapping than bubblesort/insertionsort.
     for (unsigned i = 0; i < length - 1; ++i) {
         JSValue iObj = thisObj->get(exec, i);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         unsigned themin = i;
         JSValue minObj = iObj;
         for (unsigned j = i + 1; j < length; ++j) {
             JSValue jObj = thisObj->get(exec, j);
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
             double compareResult;
             if (jObj.isUndefined())
                 compareResult = 1; // don't check minObj because there's no need to differentiate == (0) from > (1)
@@ -570,7 +574,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
             deleteCount = static_cast<unsigned>(deleteDouble);
     }
 
-    JSArray* resObj = new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), deleteCount, CreateCompact);
+    JSArray* resObj = new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), deleteCount, CreateCompact);
     JSValue result = resObj;
     JSGlobalData& globalData = exec->globalData();
     for (unsigned k = 0; k < deleteCount; k++)
@@ -682,20 +686,19 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
     }
     for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
-
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
-
         JSValue v = slot.getValue(exec, k);
 
-        MarkedArgumentBuffer eachArguments;
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
 
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(v);
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
         JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
-
         if (result.toBoolean(exec))
             resultArray->put(exec, filterIndex++, v);
     }
@@ -739,15 +742,19 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
-
         JSValue v = slot.getValue(exec, k);
 
-        MarkedArgumentBuffer eachArguments;
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
 
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(v);
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+
         JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
         resultArray->put(exec, k, result);
     }
@@ -797,18 +804,18 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
     }
     for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
-
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
         MarkedArgumentBuffer eachArguments;
-
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
-        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
 
+        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
         if (!predicateResult) {
             result = jsBoolean(false);
             break;
@@ -860,6 +867,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+
         call(exec, function, callType, callData, applyThis, eachArguments);
     }
     return JSValue::encode(jsUndefined());
@@ -910,8 +920,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
-        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
 
+        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
         if (predicateResult) {
             result = jsBoolean(true);
             break;
@@ -979,6 +991,8 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 
     for (; i < length && !exec->hadException(); ++i) {
         JSValue prop = getProperty(exec, thisObj, i);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         if (!prop)
             continue;
         
@@ -1051,6 +1065,8 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
     for (; i < length && !exec->hadException(); ++i) {
         unsigned idx = length - i - 1;
         JSValue prop = getProperty(exec, thisObj, idx);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         if (!prop)
             continue;
         
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.h b/Source/JavaScriptCore/runtime/ArrayPrototype.h
index 96641bd..6dadf51 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.h
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.h
@@ -28,14 +28,14 @@ namespace JSC {
 
     class ArrayPrototype : public JSArray {
     public:
-        explicit ArrayPrototype(JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        explicit ArrayPrototype(JSGlobalObject*, Structure*);
 
         bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index 0f6a646..df7b7f6 100644
--- a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -39,7 +39,7 @@ namespace JSC {
             , m_object(object)
         {
             if (!m_object->structure()->isDictionary())
-                m_object->setStructure(Structure::toCacheableDictionaryTransition(m_object->structure()));
+                m_object->setStructure(globalData, Structure::toCacheableDictionaryTransition(globalData, m_object->structure()));
         }
 
         ~BatchedTransitionOptimizer()
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
index e5b0f3d..a1a4ed4 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -28,7 +28,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(BooleanConstructor);
 
-BooleanConstructor::BooleanConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, BooleanPrototype* booleanPrototype)
+BooleanConstructor::BooleanConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, BooleanPrototype* booleanPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, booleanPrototype->classInfo()->className))
 {
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, booleanPrototype, DontEnum | DontDelete | ReadOnly);
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.h b/Source/JavaScriptCore/runtime/BooleanConstructor.h
index 2550b3b..fa0d05e 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.h
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class BooleanConstructor : public InternalFunction {
     public:
-        BooleanConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, BooleanPrototype*);
+        BooleanConstructor(ExecState*, JSGlobalObject*, Structure*, BooleanPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.cpp b/Source/JavaScriptCore/runtime/BooleanObject.cpp
index 2945c0e..e24a30a 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanObject.cpp
@@ -27,8 +27,8 @@ ASSERT_CLASS_FITS_IN_CELL(BooleanObject);
 
 const ClassInfo BooleanObject::s_info = { "Boolean", &JSWrapperObject::s_info, 0, 0 };
 
-BooleanObject::BooleanObject(JSGlobalData&, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(structure)
+BooleanObject::BooleanObject(JSGlobalData& globalData, Structure* structure)
+    : JSWrapperObject(globalData, structure)
 {
     ASSERT(inherits(&s_info));
 }
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.h b/Source/JavaScriptCore/runtime/BooleanObject.h
index ef2d403..def44b4 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.h
+++ b/Source/JavaScriptCore/runtime/BooleanObject.h
@@ -27,11 +27,11 @@ namespace JSC {
 
     class BooleanObject : public JSWrapperObject {
     public:
-        explicit BooleanObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure>);
+        explicit BooleanObject(JSGlobalData&, Structure*);
 
         static const ClassInfo s_info;
         
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
index d0a64af..20990e1 100644
--- a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -37,7 +37,7 @@ static EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState*);
 
 // ECMA 15.6.4
 
-BooleanPrototype::BooleanPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* functionStructure)
+BooleanPrototype::BooleanPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure)
     : BooleanObject(exec->globalData(), structure)
 {
     setInternalValue(exec->globalData(), jsBoolean(false));
diff --git a/Source/JavaScriptCore/runtime/BooleanPrototype.h b/Source/JavaScriptCore/runtime/BooleanPrototype.h
index d6d3d9f..5ccbd2b 100644
--- a/Source/JavaScriptCore/runtime/BooleanPrototype.h
+++ b/Source/JavaScriptCore/runtime/BooleanPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class BooleanPrototype : public BooleanObject {
     public:
-        BooleanPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* functionStructure);
+        BooleanPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.cpp b/Source/JavaScriptCore/runtime/DateConstructor.cpp
index 0a06148..9bbb688 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/DateConstructor.cpp
@@ -57,7 +57,7 @@ static EncodedJSValue JSC_HOST_CALL dateParse(ExecState*);
 static EncodedJSValue JSC_HOST_CALL dateNow(ExecState*);
 static EncodedJSValue JSC_HOST_CALL dateUTC(ExecState*);
 
-DateConstructor::DateConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* functionStructure, DatePrototype* datePrototype)
+DateConstructor::DateConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure, DatePrototype* datePrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, datePrototype->classInfo()->className))
 {
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, datePrototype, DontEnum | DontDelete | ReadOnly);
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.h b/Source/JavaScriptCore/runtime/DateConstructor.h
index bd529f1..23a0311 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.h
+++ b/Source/JavaScriptCore/runtime/DateConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class DateConstructor : public InternalFunction {
     public:
-        DateConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* functionStructure, DatePrototype*);
+        DateConstructor(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure, DatePrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/Source/JavaScriptCore/runtime/DateInstance.cpp b/Source/JavaScriptCore/runtime/DateInstance.cpp
index 74adda4..d8ca072 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.cpp
+++ b/Source/JavaScriptCore/runtime/DateInstance.cpp
@@ -34,15 +34,15 @@ namespace JSC {
 
 const ClassInfo DateInstance::s_info = {"Date", &JSWrapperObject::s_info, 0, 0};
 
-DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(structure)
+DateInstance::DateInstance(ExecState* exec, Structure* structure)
+    : JSWrapperObject(exec->globalData(), structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsNaN());
 }
 
-DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure, double time)
-    : JSWrapperObject(structure)
+DateInstance::DateInstance(ExecState* exec, Structure* structure, double time)
+    : JSWrapperObject(exec->globalData(), structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsNumber(timeClip(time)));
diff --git a/Source/JavaScriptCore/runtime/DateInstance.h b/Source/JavaScriptCore/runtime/DateInstance.h
index d0dcf0b..6195c85 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.h
+++ b/Source/JavaScriptCore/runtime/DateInstance.h
@@ -31,8 +31,8 @@ namespace JSC {
 
     class DateInstance : public JSWrapperObject {
     public:
-        DateInstance(ExecState*, NonNullPassRefPtr<Structure>, double);
-        explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);
+        DateInstance(ExecState*, Structure*, double);
+        explicit DateInstance(ExecState*, Structure*);
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
@@ -52,7 +52,7 @@ namespace JSC {
             return calculateGregorianDateTimeUTC(exec);
         }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index 314baa4..444fa98 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -429,7 +429,7 @@ const ClassInfo DatePrototype::s_info = {"Date", &DateInstance::s_info, 0, ExecS
 
 // ECMA 15.9.4
 
-DatePrototype::DatePrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+DatePrototype::DatePrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : DateInstance(exec, structure)
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.h b/Source/JavaScriptCore/runtime/DatePrototype.h
index 0ebbedc..2e1030d 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.h
+++ b/Source/JavaScriptCore/runtime/DatePrototype.h
@@ -29,14 +29,14 @@ namespace JSC {
 
     class DatePrototype : public DateInstance {
     public:
-        DatePrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        DatePrototype(ExecState*, JSGlobalObject*, Structure*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index b84f5ea..7eda19f 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -167,7 +167,7 @@ JSObject* throwSyntaxError(ExecState* exec)
 
 class StrictModeTypeErrorFunction : public InternalFunction {
 public:
-    StrictModeTypeErrorFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const UString& message)
+    StrictModeTypeErrorFunction(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const UString& message)
         : InternalFunction(&exec->globalData(), globalObject, structure, exec->globalData().propertyNames->emptyIdentifier)
         , m_message(message)
     {
diff --git a/Source/JavaScriptCore/runtime/ErrorConstructor.cpp b/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
index 7f4f82c..df112dd 100644
--- a/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -29,7 +29,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ErrorConstructor);
 
-ErrorConstructor::ErrorConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, ErrorPrototype* errorPrototype)
+ErrorConstructor::ErrorConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, ErrorPrototype* errorPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, errorPrototype->classInfo()->className))
 {
     // ECMA 15.11.3.1 Error.prototype
diff --git a/Source/JavaScriptCore/runtime/ErrorConstructor.h b/Source/JavaScriptCore/runtime/ErrorConstructor.h
index 3d0d706..ceec005 100644
--- a/Source/JavaScriptCore/runtime/ErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/ErrorConstructor.h
@@ -30,7 +30,7 @@ namespace JSC {
 
     class ErrorConstructor : public InternalFunction {
     public:
-        ErrorConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, ErrorPrototype*);
+        ErrorConstructor(ExecState*, JSGlobalObject*, Structure*, ErrorPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.cpp b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
index 0db2af8..ed95ba4 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
@@ -25,28 +25,28 @@ namespace JSC {
 
 const ClassInfo ErrorInstance::s_info = { "Error", &JSNonFinalObject::s_info, 0, 0 };
 
-ErrorInstance::ErrorInstance(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure)
-    : JSNonFinalObject(structure)
+ErrorInstance::ErrorInstance(JSGlobalData* globalData, Structure* structure)
+    : JSNonFinalObject(*globalData, structure)
     , m_appendSourceToMessage(false)
 {
     ASSERT(inherits(&s_info));
     putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, ""));
 }
 
-ErrorInstance::ErrorInstance(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure, const UString& message)
-    : JSNonFinalObject(structure)
+ErrorInstance::ErrorInstance(JSGlobalData* globalData, Structure* structure, const UString& message)
+    : JSNonFinalObject(*globalData, structure)
     , m_appendSourceToMessage(false)
 {
     ASSERT(inherits(&s_info));
     putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, message));
 }
 
-ErrorInstance* ErrorInstance::create(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure, const UString& message)
+ErrorInstance* ErrorInstance::create(JSGlobalData* globalData, Structure* structure, const UString& message)
 {
     return new (globalData) ErrorInstance(globalData, structure, message);
 }
 
-ErrorInstance* ErrorInstance::create(ExecState* exec, NonNullPassRefPtr<Structure> structure, JSValue message)
+ErrorInstance* ErrorInstance::create(ExecState* exec, Structure* structure, JSValue message)
 {
     if (message.isUndefined())
         return new (exec) ErrorInstance(&exec->globalData(), structure);
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.h b/Source/JavaScriptCore/runtime/ErrorInstance.h
index 82dbf0f..afcf158 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.h
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.h
@@ -29,13 +29,13 @@ namespace JSC {
     public:
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
-        static ErrorInstance* create(JSGlobalData*, NonNullPassRefPtr<Structure>, const UString&);
-        static ErrorInstance* create(ExecState* exec, NonNullPassRefPtr<Structure>, JSValue message);
+        static ErrorInstance* create(JSGlobalData*, Structure*, const UString&);
+        static ErrorInstance* create(ExecState*, Structure*, JSValue message);
 
 
         bool appendSourceToMessage() { return m_appendSourceToMessage; }
@@ -45,8 +45,8 @@ namespace JSC {
         virtual bool isErrorInstance() const { return true; }
 
     protected:
-        explicit ErrorInstance(JSGlobalData*, NonNullPassRefPtr<Structure>);
-        explicit ErrorInstance(JSGlobalData*, NonNullPassRefPtr<Structure>, const UString&);
+        explicit ErrorInstance(JSGlobalData*, Structure*);
+        explicit ErrorInstance(JSGlobalData*, Structure*, const UString&);
 
         bool m_appendSourceToMessage;
     };
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
index e13251c..a57e947 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -35,7 +35,7 @@ ASSERT_CLASS_FITS_IN_CELL(ErrorPrototype);
 static EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState*);
 
 // ECMA 15.9.4
-ErrorPrototype::ErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* functionStructure)
+ErrorPrototype::ErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure)
     : ErrorInstance(&exec->globalData(), structure)
 {
     // The constructor will be added later in ErrorConstructor's constructor
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.h b/Source/JavaScriptCore/runtime/ErrorPrototype.h
index 3c2fed3..9437d3a 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.h
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ErrorPrototype : public ErrorInstance {
     public:
-        ErrorPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* functionStructure);
+        ErrorPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
index d3c637e..1d74315 100644
--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -44,7 +44,7 @@ namespace JSC {
 class InterruptedExecutionError : public JSNonFinalObject {
 public:
     InterruptedExecutionError(JSGlobalData* globalData)
-        : JSNonFinalObject(globalData->interruptedExecutionErrorStructure)
+        : JSNonFinalObject(*globalData, globalData->interruptedExecutionErrorStructure.get())
     {
     }
 
@@ -61,7 +61,7 @@ JSObject* createInterruptedExecutionException(JSGlobalData* globalData)
 class TerminatedExecutionError : public JSNonFinalObject {
 public:
     TerminatedExecutionError(JSGlobalData* globalData)
-        : JSNonFinalObject(globalData->terminatedExecutionErrorStructure)
+        : JSNonFinalObject(*globalData, globalData->terminatedExecutionErrorStructure.get())
     {
     }
 
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index a059ed2..fa14ad5 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -40,13 +40,15 @@
 
 namespace JSC {
 
+const ClassInfo ExecutableBase::s_info = { "Executable", 0, 0, 0 };
+
+const ClassInfo NativeExecutable::s_info = { "NativeExecutable", &ExecutableBase::s_info, 0, 0 };
+
 NativeExecutable::~NativeExecutable()
 {
 }
 
-VPtrHackExecutable::~VPtrHackExecutable()
-{
-}
+const ClassInfo EvalExecutable::s_info = { "EvalExecutable", &ScriptExecutable::s_info, 0, 0 };
 
 EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode& source, bool inStrictContext)
     : ScriptExecutable(exec->globalData().evalExecutableStructure.get(), exec, source, inStrictContext)
@@ -57,6 +59,8 @@ EvalExecutable::~EvalExecutable()
 {
 }
 
+const ClassInfo ProgramExecutable::s_info = { "ProgramExecutable", &ScriptExecutable::s_info, 0, 0 };
+
 ProgramExecutable::ProgramExecutable(ExecState* exec, const SourceCode& source)
     : ScriptExecutable(exec->globalData().programExecutableStructure.get(), exec, source, false)
 {
@@ -66,6 +70,8 @@ ProgramExecutable::~ProgramExecutable()
 {
 }
 
+const ClassInfo FunctionExecutable::s_info = { "FunctionExecutable", &ScriptExecutable::s_info, 0, 0 };
+
 FunctionExecutable::FunctionExecutable(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext, int firstLine, int lastLine)
     : ScriptExecutable(globalData->functionExecutableStructure.get(), globalData, source, inStrictContext)
     , m_numCapturedVariables(0)
diff --git a/Source/JavaScriptCore/runtime/Executable.h b/Source/JavaScriptCore/runtime/Executable.h
index f15df07..fbe33cf 100644
--- a/Source/JavaScriptCore/runtime/Executable.h
+++ b/Source/JavaScriptCore/runtime/Executable.h
@@ -52,8 +52,8 @@ namespace JSC {
         static const int NUM_PARAMETERS_NOT_COMPILED = -1;
     
     public:
-        ExecutableBase(Structure* structure, int numParameters)
-            : JSCell(structure)
+        ExecutableBase(JSGlobalData& globalData, Structure* structure, int numParameters)
+            : JSCell(globalData, structure)
             , m_numParametersForCall(numParameters)
             , m_numParametersForConstruct(numParameters)
         {
@@ -65,10 +65,11 @@ namespace JSC {
             return m_numParametersForCall == NUM_PARAMETERS_IS_HOST;
         }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info); }
 
     protected:
         static const unsigned StructureFlags = 0;
+        static const ClassInfo s_info;
         int m_numParametersForCall;
         int m_numParametersForConstruct;
 
@@ -115,10 +116,12 @@ namespace JSC {
 
         NativeFunction function() { return m_function; }
 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(LeafType, StructureFlags), AnonymousSlotCount, &s_info); }
+
     private:
 #if ENABLE(JIT)
         NativeExecutable(JSGlobalData& globalData, JITCode callThunk, NativeFunction function, JITCode constructThunk, NativeFunction constructor)
-            : ExecutableBase(globalData.executableStructure.get(), NUM_PARAMETERS_IS_HOST)
+            : ExecutableBase(globalData, globalData.nativeExecutableStructure.get(), NUM_PARAMETERS_IS_HOST)
             , m_function(function)
             , m_constructor(constructor)
         {
@@ -129,7 +132,7 @@ namespace JSC {
         }
 #else
         NativeExecutable(JSGlobalData& globalData, NativeFunction function, NativeFunction constructor)
-            : ExecutableBase(globalData.executableStructure.get(), NUM_PARAMETERS_IS_HOST)
+            : ExecutableBase(globalData, globalData.nativeExecutableStructure.get(), NUM_PARAMETERS_IS_HOST)
             , m_function(function)
             , m_constructor(constructor)
         {
@@ -140,22 +143,13 @@ namespace JSC {
         // Probably should be a NativeConstructor, but this will currently require rewriting the JIT
         // trampoline. It may be easier to make NativeFunction be passed 'this' as a part of the ArgList.
         NativeFunction m_constructor;
-    };
-
-    class VPtrHackExecutable : public ExecutableBase {
-    public:
-        VPtrHackExecutable(Structure* structure)
-            : ExecutableBase(structure, NUM_PARAMETERS_IS_HOST)
-        {
-        }
-
-        ~VPtrHackExecutable();
+        static const ClassInfo s_info;
     };
 
     class ScriptExecutable : public ExecutableBase {
     public:
         ScriptExecutable(Structure* structure, JSGlobalData* globalData, const SourceCode& source, bool isInStrictContext)
-            : ExecutableBase(structure, NUM_PARAMETERS_NOT_COMPILED)
+            : ExecutableBase(*globalData, structure, NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
             , m_features(isInStrictContext ? StrictModeFeature : 0)
         {
@@ -169,7 +163,7 @@ namespace JSC {
         }
 
         ScriptExecutable(Structure* structure, ExecState* exec, const SourceCode& source, bool isInStrictContext)
-            : ExecutableBase(structure, NUM_PARAMETERS_NOT_COMPILED)
+            : ExecutableBase(exec->globalData(), structure, NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
             , m_features(isInStrictContext ? StrictModeFeature : 0)
         {
@@ -238,10 +232,11 @@ namespace JSC {
             return generatedJITCodeForCall();
         }
 #endif
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
         static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
+        static const ClassInfo s_info;
         EvalExecutable(ExecState*, const SourceCode&, bool);
 
         JSObject* compileInternal(ExecState*, ScopeChainNode*);
@@ -284,10 +279,11 @@ namespace JSC {
         }
 #endif
         
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
         static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
+        static const ClassInfo s_info;
         ProgramExecutable(ExecState*, const SourceCode&);
 
         JSObject* compileInternal(ExecState*, ScopeChainNode*);
@@ -376,7 +372,7 @@ namespace JSC {
         void discardCode();
         void markChildren(MarkStack&);
         static FunctionExecutable* fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
         FunctionExecutable(JSGlobalData*, const Identifier& name, const SourceCode&, bool forceUsesArguments, FunctionParameters*, bool, int firstLine, int lastLine);
@@ -386,6 +382,7 @@ namespace JSC {
         JSObject* compileForConstructInternal(ExecState*, ScopeChainNode*);
         
         static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
+        static const ClassInfo s_info;
         unsigned m_numCapturedVariables : 31;
         bool m_forceUsesArguments : 1;
 
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
index a9f0a06..9e7d8d5 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -37,7 +37,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(FunctionConstructor);
 
-FunctionConstructor::FunctionConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, FunctionPrototype* functionPrototype)
+FunctionConstructor::FunctionConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, FunctionPrototype* functionPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, functionPrototype->classInfo()->className))
 {
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, functionPrototype, DontEnum | DontDelete | ReadOnly);
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.h b/Source/JavaScriptCore/runtime/FunctionConstructor.h
index 7f21b20..31a04c9 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class FunctionConstructor : public InternalFunction {
     public:
-        FunctionConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, FunctionPrototype*);
+        FunctionConstructor(ExecState*, JSGlobalObject*, Structure*, FunctionPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
index c2d8ad3..e2a4941 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -37,7 +37,7 @@ static EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionProtoFuncApply(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionProtoFuncCall(ExecState*);
 
-FunctionPrototype::FunctionPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+FunctionPrototype::FunctionPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : InternalFunction(&exec->globalData(), globalObject, structure, exec->propertyNames().nullIdentifier)
 {
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.h b/Source/JavaScriptCore/runtime/FunctionPrototype.h
index 447f00b..ab708dd 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.h
@@ -27,10 +27,10 @@ namespace JSC {
 
     class FunctionPrototype : public InternalFunction {
     public:
-        FunctionPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        FunctionPrototype(ExecState*, JSGlobalObject*, Structure*);
         void addFunctionProperties(ExecState*, JSGlobalObject*, Structure* functionStructure, JSFunction** callFunction, JSFunction** applyFunction);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto)
         {
             return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/GetterSetter.h b/Source/JavaScriptCore/runtime/GetterSetter.h
index 8241275..a222c7a 100644
--- a/Source/JavaScriptCore/runtime/GetterSetter.h
+++ b/Source/JavaScriptCore/runtime/GetterSetter.h
@@ -26,6 +26,7 @@
 #include "JSCell.h"
 
 #include "CallFrame.h"
+#include "Structure.h"
 
 namespace JSC {
 
@@ -37,7 +38,7 @@ namespace JSC {
         friend class JIT;
     public:
         GetterSetter(ExecState* exec)
-            : JSCell(exec->globalData().getterSetterStructure.get())
+            : JSCell(exec->globalData(), exec->globalData().getterSetterStructure.get())
         {
         }
 
@@ -47,7 +48,7 @@ namespace JSC {
         void setGetter(JSGlobalData& globalData, JSObject* getter) { m_getter.set(globalData, this, getter); }
         JSObject* setter() const { return m_setter.get(); }
         void setSetter(JSGlobalData& globalData, JSObject* setter) { m_setter.set(globalData, this, setter); }
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount, 0);
         }
diff --git a/Source/JavaScriptCore/runtime/InitializeThreading.cpp b/Source/JavaScriptCore/runtime/InitializeThreading.cpp
index aef60c8..27611b7 100644
--- a/Source/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/Source/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -59,7 +59,6 @@ static void initializeThreadingOnce()
     s_dtoaP5Mutex = new Mutex;
     initializeDates();
     RegisterFile::initializeThreading();
-    Structure::initializeThreading();
 #endif
 }
 
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.cpp b/Source/JavaScriptCore/runtime/InternalFunction.cpp
index 27106a1..c3b07f8 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/Source/JavaScriptCore/runtime/InternalFunction.cpp
@@ -36,13 +36,12 @@ ASSERT_CLASS_FITS_IN_CELL(InternalFunction);
 
 const ClassInfo InternalFunction::s_info = { "Function", &JSObjectWithGlobalObject::s_info, 0, 0 };
 
-InternalFunction::InternalFunction(NonNullPassRefPtr<Structure> structure)
-    : JSObjectWithGlobalObject(structure)
+InternalFunction::InternalFunction(VPtrStealingHackType)
+    : JSObjectWithGlobalObject(VPtrStealingHack)
 {
-    ASSERT(inherits(&s_info));
 }
 
-InternalFunction::InternalFunction(JSGlobalData* globalData, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const Identifier& name)
+InternalFunction::InternalFunction(JSGlobalData* globalData, JSGlobalObject* globalObject, Structure* structure, const Identifier& name)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
     ASSERT(inherits(&s_info));
@@ -51,12 +50,12 @@ InternalFunction::InternalFunction(JSGlobalData* globalData, JSGlobalObject* glo
 
 const UString& InternalFunction::name(ExecState* exec)
 {
-    return asString(getDirect(exec->globalData().propertyNames->name))->tryGetValue();
+    return asString(getDirect(exec->globalData(), exec->globalData().propertyNames->name))->tryGetValue();
 }
 
 const UString InternalFunction::displayName(ExecState* exec)
 {
-    JSValue displayName = getDirect(exec->globalData().propertyNames->displayName);
+    JSValue displayName = getDirect(exec->globalData(), exec->globalData().propertyNames->displayName);
     
     if (displayName && isJSString(&exec->globalData(), displayName))
         return asString(displayName)->tryGetValue();
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.h b/Source/JavaScriptCore/runtime/InternalFunction.h
index 08c98a5..28e260e 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.h
+++ b/Source/JavaScriptCore/runtime/InternalFunction.h
@@ -39,7 +39,7 @@ namespace JSC {
         const UString displayName(ExecState*);
         const UString calculatedDisplayName(ExecState*);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
             return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
@@ -48,9 +48,9 @@ namespace JSC {
         static const unsigned StructureFlags = ImplementsHasInstance | JSObject::StructureFlags;
 
         // Only used to allow us to determine the JSFunction vptr
-        InternalFunction(NonNullPassRefPtr<Structure> structure);
+        InternalFunction(VPtrStealingHackType);
 
-        InternalFunction(JSGlobalData*, JSGlobalObject*, NonNullPassRefPtr<Structure>, const Identifier&);
+        InternalFunction(JSGlobalData*, JSGlobalObject*, Structure*, const Identifier&);
 
     private:
         virtual CallType getCallData(CallData&) = 0;
diff --git a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
index 54fe909..0165488 100644
--- a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -25,6 +25,7 @@
 
 #include "JSCell.h"
 #include "CallFrame.h"
+#include "Structure.h"
 
 namespace JSC {
 
@@ -35,7 +36,7 @@ namespace JSC {
 
         virtual bool isAPIValueWrapper() const { return true; }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount, 0);
         }
@@ -43,7 +44,7 @@ namespace JSC {
         
     private:
         JSAPIValueWrapper(ExecState* exec, JSValue value)
-            : JSCell(exec->globalData().apiWrapperStructure.get())
+            : JSCell(exec->globalData(), exec->globalData().apiWrapperStructure.get())
         {
             m_value.set(exec->globalData(), this, value);
             ASSERT(!value.isCell());
diff --git a/Source/JavaScriptCore/runtime/JSActivation.cpp b/Source/JavaScriptCore/runtime/JSActivation.cpp
index d0c50dd..4e36641 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.cpp
+++ b/Source/JavaScriptCore/runtime/JSActivation.cpp
@@ -40,7 +40,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSActivation);
 const ClassInfo JSActivation::s_info = { "JSActivation", &Base::s_info, 0, 0 };
 
 JSActivation::JSActivation(CallFrame* callFrame, FunctionExecutable* functionExecutable)
-    : Base(callFrame->globalData().activationStructure, functionExecutable->symbolTable(), callFrame->registers())
+    : Base(callFrame->globalData(), callFrame->globalData().activationStructure.get(), functionExecutable->symbolTable(), callFrame->registers())
     , m_numParametersMinusThis(static_cast<int>(functionExecutable->parameterCount()))
     , m_numCapturedVars(functionExecutable->capturedVariableCount())
     , m_requiresDynamicChecks(functionExecutable->usesEval())
@@ -142,7 +142,7 @@ bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     if (symbolTableGet(propertyName, slot))
         return true;
 
-    if (WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName)) {
+    if (WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName)) {
         slot.setValue(location->get());
         return true;
     }
diff --git a/Source/JavaScriptCore/runtime/JSActivation.h b/Source/JavaScriptCore/runtime/JSActivation.h
index 7463f47..65642f1 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.h
+++ b/Source/JavaScriptCore/runtime/JSActivation.h
@@ -66,7 +66,7 @@ namespace JSC {
         
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 1d621fe..bf61097 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -127,26 +127,12 @@ inline void JSArray::checkConsistency(ConsistencyCheckType)
 #endif
 
 JSArray::JSArray(VPtrStealingHackType)
-    : JSNonFinalObject(Structure::create(Structure::VPtrStealingHack, &s_info))
+    : JSNonFinalObject(VPtrStealingHack)
 {
-    ASSERT(inherits(&s_info));
-
-    unsigned initialCapacity = 0;
-
-    m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
-    m_storage->m_allocBase = m_storage;
-    m_indexBias = 0;
-    m_vectorLength = initialCapacity;
-
-    checkConsistency();
-    
-    // It's not safe to call Heap::heap(this) in order to report extra memory
-    // cost here, because the VPtrStealingHackType JSArray is not allocated on
-    // the heap. For the same reason, it's OK not to report extra cost.
 }
 
-JSArray::JSArray(NonNullPassRefPtr<Structure> structure)
-    : JSNonFinalObject(structure)
+JSArray::JSArray(JSGlobalData& globalData, Structure* structure)
+    : JSNonFinalObject(globalData, structure)
 {
     ASSERT(inherits(&s_info));
 
@@ -162,8 +148,8 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure)
     Heap::heap(this)->reportExtraMemoryCost(storageSize(0));
 }
 
-JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength, ArrayCreationMode creationMode)
-    : JSNonFinalObject(structure)
+JSArray::JSArray(JSGlobalData& globalData, Structure* structure, unsigned initialLength, ArrayCreationMode creationMode)
+    : JSNonFinalObject(globalData, structure)
 {
     ASSERT(inherits(&s_info));
 
@@ -204,8 +190,8 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength,
     Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
 }
 
-JSArray::JSArray(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure, const ArgList& list)
-    : JSNonFinalObject(structure)
+JSArray::JSArray(JSGlobalData& globalData, Structure* structure, const ArgList& list)
+    : JSNonFinalObject(globalData, structure)
 {
     ASSERT(inherits(&s_info));
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index 1a6eba8..8be8513 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -61,12 +61,11 @@ namespace JSC {
         friend class Walker;
 
     public:
-        enum VPtrStealingHackType { VPtrStealingHack };
         JSArray(VPtrStealingHackType);
 
-        explicit JSArray(NonNullPassRefPtr<Structure>);
-        JSArray(NonNullPassRefPtr<Structure>, unsigned initialLength, ArrayCreationMode);
-        JSArray(JSGlobalData&, NonNullPassRefPtr<Structure>, const ArgList& initialValues);
+        explicit JSArray(JSGlobalData&, Structure*);
+        JSArray(JSGlobalData&, Structure*, unsigned initialLength, ArrayCreationMode);
+        JSArray(JSGlobalData&, Structure*, const ArgList& initialValues);
         virtual ~JSArray();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
@@ -124,7 +123,7 @@ namespace JSC {
         void fillArgList(ExecState*, MarkedArgumentBuffer&);
         void copyToRegisters(ExecState*, Register*, uint32_t);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.cpp b/Source/JavaScriptCore/runtime/JSByteArray.cpp
index fbaea1d..c2abaee 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSByteArray.cpp
@@ -35,8 +35,8 @@ namespace JSC {
 
 const ClassInfo JSByteArray::s_defaultInfo = { "ByteArray", &Base::s_info, 0, 0 };
 
-JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure, ByteArray* storage)
-    : JSNonFinalObject(structure)
+JSByteArray::JSByteArray(ExecState* exec, Structure* structure, ByteArray* storage)
+    : JSNonFinalObject(exec->globalData(), structure)
     , m_storage(storage)
 {
     putDirect(exec->globalData(), exec->globalData().propertyNames->length, jsNumber(m_storage->length()), ReadOnly | DontDelete);
@@ -50,7 +50,7 @@ JSByteArray::~JSByteArray()
 #endif
 
 
-PassRefPtr<Structure> JSByteArray::createStructure(JSGlobalData& globalData, JSValue prototype, const JSC::ClassInfo* classInfo)
+Structure* JSByteArray::createStructure(JSGlobalData& globalData, JSValue prototype, const JSC::ClassInfo* classInfo)
 {
     return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, classInfo);
 }
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.h b/Source/JavaScriptCore/runtime/JSByteArray.h
index e674958..c481bb4 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.h
+++ b/Source/JavaScriptCore/runtime/JSByteArray.h
@@ -75,8 +75,8 @@ namespace JSC {
                 setIndex(i, byteValue);
         }
 
-        JSByteArray(ExecState*, NonNullPassRefPtr<Structure>, WTF::ByteArray* storage);
-        static PassRefPtr<Structure> createStructure(JSGlobalData&, JSValue prototype, const JSC::ClassInfo* = &s_defaultInfo);
+        JSByteArray(ExecState*, Structure*, WTF::ByteArray* storage);
+        static Structure* createStructure(JSGlobalData&, JSValue prototype, const JSC::ClassInfo* = &s_defaultInfo);
 
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
@@ -100,9 +100,8 @@ namespace JSC {
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
 
     private:
-        enum VPtrStealingHackType { VPtrStealingHack };
         JSByteArray(VPtrStealingHackType)
-            : JSNonFinalObject(Structure::create(Structure::VPtrStealingHack, &s_info))
+            : JSNonFinalObject(VPtrStealingHack)
         {
         }
 
diff --git a/Source/JavaScriptCore/runtime/JSCell.cpp b/Source/JavaScriptCore/runtime/JSCell.cpp
index ce7fe22..afd8450 100644
--- a/Source/JavaScriptCore/runtime/JSCell.cpp
+++ b/Source/JavaScriptCore/runtime/JSCell.cpp
@@ -209,4 +209,14 @@ JSObject* JSCell::toObject(ExecState*, JSGlobalObject*) const
     return 0;
 }
 
+bool isZombie(const JSCell* cell)
+{
+#if ENABLE(JSC_ZOMBIES)
+    return cell && cell->isZombie();
+#else
+    UNUSED_PARAM(cell);
+    return false;
+#endif
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index ab0e237..7ee871c 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -24,18 +24,18 @@
 #define JSCell_h
 
 #include "CallData.h"
+#include "CallFrame.h"
 #include "ConstructData.h"
 #include "Heap.h"
-#include "JSImmediate.h"
 #include "JSLock.h"
-#include "JSValue.h"
+#include "JSValueInlineMethods.h"
 #include "MarkStack.h"
-#include "Structure.h"
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
 
     class JSGlobalObject;
+    class Structure;
 
 #if COMPILER(MSVC)
     // If WTF_MAKE_NONCOPYABLE is applied to JSCell we end up with a bunch of
@@ -68,17 +68,19 @@ namespace JSC {
         friend class MarkedSpace;
         friend class MarkedBlock;
         friend class ScopeChainNode;
+        friend class Structure;
         friend class StructureChain;
 
+    protected:
+        enum VPtrStealingHackType { VPtrStealingHack };
+
     private:
-        explicit JSCell(Structure*);
+        explicit JSCell(VPtrStealingHackType) { }
+        JSCell(JSGlobalData&, Structure*);
         virtual ~JSCell();
 
     public:
-        static PassRefPtr<Structure> createDummyStructure(JSGlobalData& globalData)
-        {
-            return Structure::create(globalData, jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount, 0);
-        }
+        static Structure* createDummyStructure(JSGlobalData&);
 
         // Querying the type.
         bool isString() const;
@@ -122,7 +124,7 @@ namespace JSC {
 #endif
 
         // Object operations, with the toObject operation included.
-        const ClassInfo* classInfo() const { return m_structure->classInfo(); }
+        const ClassInfo* classInfo() const;
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
@@ -144,7 +146,7 @@ namespace JSC {
             return OBJECT_OFFSETOF(JSCell, m_structure);
         }
 
-        Structure* const * addressOfStructure() const
+        const void* addressOfStructure() const
         {
             return &m_structure;
         }
@@ -157,35 +159,28 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         
-        Structure* m_structure;
+        WriteBarrier<Structure> m_structure;
     };
 
-    inline JSCell::JSCell(Structure* structure)
-        : m_structure(structure)
+    inline JSCell::JSCell(JSGlobalData& globalData, Structure* structure)
+        : m_structure(globalData, this, structure)
     {
+        // Very first set of allocations won't have a real structure.
+        ASSERT(m_structure || !globalData.dummyMarkableCellStructure);
     }
 
     inline JSCell::~JSCell()
     {
     }
 
-    inline bool JSCell::isObject() const
-    {
-        return m_structure->typeInfo().type() == ObjectType;
-    }
-
-    inline bool JSCell::isString() const
-    {
-        return m_structure->typeInfo().type() == StringType;
-    }
-
     inline Structure* JSCell::structure() const
     {
-        return m_structure;
+        return m_structure.get();
     }
 
-    inline void JSCell::markChildren(MarkStack&)
+    inline void JSCell::markChildren(MarkStack& markStack)
     {
+        markStack.append(&m_structure);
     }
 
     // --- JSValue inlines ----------------------------
@@ -254,14 +249,6 @@ namespace JSC {
         return false;
     }
 
-#if USE(JSVALUE64)
-    ALWAYS_INLINE JSCell* JSValue::asCell() const
-    {
-        ASSERT(isCell());
-        return m_ptr;
-    }
-#endif // USE(JSVALUE64)
-
     inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
     {
         return isCell() ? asCell()->toPrimitive(exec, preferredType) : asValue();
@@ -321,13 +308,6 @@ namespace JSC {
         return isUndefined() ? nonInlineNaN() : 0; // null and false both convert to 0.
     }
 
-    inline bool JSValue::needsThisConversion() const
-    {
-        if (UNLIKELY(!isCell()))
-            return true;
-        return asCell()->structure()->typeInfo().needsThisConversion();
-    }
-
     inline JSValue JSValue::getJSNumber()
     {
         if (isInt32() || isDouble())
@@ -351,16 +331,6 @@ namespace JSC {
     {
         return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
     }
-    
-    ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
-    {
-        ASSERT(!m_isCheckingForDefaultMarkViolation);
-        ASSERT(cell);
-        if (Heap::testAndSetMarked(cell))
-            return;
-        if (cell->structure()->typeInfo().type() >= CompoundType)
-            m_values.append(cell);
-    }
 
     inline Heap* Heap::heap(JSValue v)
     {
@@ -377,7 +347,7 @@ namespace JSC {
 #if ENABLE(JSC_ZOMBIES)
     inline bool JSValue::isZombie() const
     {
-        return isCell() && asCell() && asCell()->isZombie();
+        return isCell() && asCell() > (JSCell*)0x1ffffffffL && asCell()->isZombie();
     }
 #endif
 
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index dbfc606..a18e973 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -56,14 +56,12 @@ bool JSFunction::isHostFunctionNonInline() const
     return isHostFunction();
 }
 
-JSFunction::JSFunction(NonNullPassRefPtr<Structure> structure, VPtrHackExecutable* executable)
-    : Base(structure)
+JSFunction::JSFunction(VPtrStealingHackType)
+    : Base(VPtrStealingHack)
 {
-    ASSERT(inherits(&s_info));
-    m_executable.setWithoutWriteBarrier(executable);
 }
 
-JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int length, const Identifier& name, NativeExecutable* thunk)
+JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, int length, const Identifier& name, NativeExecutable* thunk)
     : Base(globalObject, structure)
     , m_executable(exec->globalData(), this, thunk)
     , m_scopeChain(exec->globalData(), this, globalObject->globalScopeChain())
@@ -73,7 +71,7 @@ JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPas
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
 
-JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
+JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, int length, const Identifier& name, NativeFunction func)
     : Base(globalObject, structure)
     , m_scopeChain(exec->globalData(), this, globalObject->globalScopeChain())
 {
@@ -112,12 +110,12 @@ static void createDescriptorForThrowingProperty(ExecState* exec, PropertyDescrip
 
 const UString& JSFunction::name(ExecState* exec)
 {
-    return asString(getDirect(exec->globalData().propertyNames->name))->tryGetValue();
+    return asString(getDirect(exec->globalData(), exec->globalData().propertyNames->name))->tryGetValue();
 }
 
 const UString JSFunction::displayName(ExecState* exec)
 {
-    JSValue displayName = getDirect(exec->globalData().propertyNames->displayName);
+    JSValue displayName = getDirect(exec->globalData(), exec->globalData().propertyNames->displayName);
     
     if (displayName && isJSString(&exec->globalData(), displayName))
         return asString(displayName)->tryGetValue();
@@ -186,13 +184,13 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
         return Base::getOwnPropertySlot(exec, propertyName, slot);
 
     if (propertyName == exec->propertyNames().prototype) {
-        WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName);
+        WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName);
 
         if (!location) {
             JSObject* prototype = constructEmptyObject(exec, scope()->globalObject->emptyObjectStructure());
             prototype->putDirect(exec->globalData(), exec->propertyNames().constructor, this, DontEnum);
             putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | DontEnum);
-            location = getDirectLocation(propertyName);
+            location = getDirectLocation(exec->globalData(), propertyName);
         }
 
         slot.setValue(this, location->get(), offsetForLocation(location));
diff --git a/Source/JavaScriptCore/runtime/JSFunction.h b/Source/JavaScriptCore/runtime/JSFunction.h
index 505b9de..174cd38 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.h
+++ b/Source/JavaScriptCore/runtime/JSFunction.h
@@ -45,8 +45,8 @@ namespace JSC {
         typedef JSObjectWithGlobalObject Base;
 
     public:
-        JSFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
-        JSFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int length, const Identifier&, NativeExecutable*);
+        JSFunction(ExecState*, JSGlobalObject*, Structure*, int length, const Identifier&, NativeFunction);
+        JSFunction(ExecState*, JSGlobalObject*, Structure*, int length, const Identifier&, NativeExecutable*);
         JSFunction(ExecState*, FunctionExecutable*, ScopeChainNode*);
         virtual ~JSFunction();
 
@@ -73,7 +73,7 @@ namespace JSC {
 
         static JS_EXPORTDATA const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
@@ -87,7 +87,7 @@ namespace JSC {
         const static unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
 
     private:
-        JSFunction(NonNullPassRefPtr<Structure>, VPtrHackExecutable*);
+        explicit JSFunction(VPtrStealingHackType);
 
         bool isHostFunctionNonInline() const;
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index ee1829b..d9e5df0 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -45,6 +45,7 @@
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
 #include "JSStaticScopeObject.h"
+#include "JSZombie.h"
 #include "Lexer.h"
 #include "Lookup.h"
 #include "Nodes.h"
@@ -106,6 +107,15 @@ void* JSGlobalData::jsByteArrayVPtr;
 void* JSGlobalData::jsStringVPtr;
 void* JSGlobalData::jsFunctionVPtr;
 
+#if COMPILER(GCC)
+// Work around for gcc trying to coalesce our reads of the various cell vptrs
+#define CLOBBER_MEMORY() do { \
+    asm volatile ("" : : : "memory"); \
+} while (false)
+#else
+#define CLOBBER_MEMORY() do { } while (false)
+#endif
+
 void JSGlobalData::storeVPtrs()
 {
     // Enough storage to fit a JSArray, JSByteArray, JSString, or JSFunction.
@@ -114,27 +124,23 @@ void JSGlobalData::storeVPtrs()
 
     COMPILE_ASSERT(sizeof(JSArray) <= sizeof(storage), sizeof_JSArray_must_be_less_than_storage);
     JSCell* jsArray = new (storage) JSArray(JSArray::VPtrStealingHack);
+    CLOBBER_MEMORY();
     JSGlobalData::jsArrayVPtr = jsArray->vptr();
-    jsArray->~JSCell();
 
     COMPILE_ASSERT(sizeof(JSByteArray) <= sizeof(storage), sizeof_JSByteArray_must_be_less_than_storage);
     JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
+    CLOBBER_MEMORY();
     JSGlobalData::jsByteArrayVPtr = jsByteArray->vptr();
-    jsByteArray->~JSCell();
 
     COMPILE_ASSERT(sizeof(JSString) <= sizeof(storage), sizeof_JSString_must_be_less_than_storage);
     JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
+    CLOBBER_MEMORY();
     JSGlobalData::jsStringVPtr = jsString->vptr();
-    jsString->~JSCell();
 
     COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(storage), sizeof_JSFunction_must_be_less_than_storage);
-    char executableStorage[sizeof(VPtrHackExecutable)];
-    RefPtr<Structure> executableStructure = Structure::create(Structure::VPtrStealingHack, 0);
-    JSCell* executable = new (executableStorage) VPtrHackExecutable(executableStructure.get());
-    JSCell* jsFunction = new (storage) JSFunction(Structure::create(Structure::VPtrStealingHack, &JSFunction::s_info), static_cast<VPtrHackExecutable*>(executable));
+    JSCell* jsFunction = new (storage) JSFunction(JSCell::VPtrStealingHack);
+    CLOBBER_MEMORY();
     JSGlobalData::jsFunctionVPtr = jsFunction->vptr();
-    executable->~JSCell();
-    jsFunction->~JSCell();
 }
 
 JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType threadStackType)
@@ -168,28 +174,39 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , exclusiveThread(0)
 #endif
 {
-    activationStructure = JSActivation::createStructure(*this, jsNull());
-    interruptedExecutionErrorStructure = JSNonFinalObject::createStructure(*this, jsNull());
-    terminatedExecutionErrorStructure = JSNonFinalObject::createStructure(*this, jsNull());
-    staticScopeStructure = JSStaticScopeObject::createStructure(*this, jsNull());
-    strictEvalActivationStructure = StrictEvalActivation::createStructure(*this, jsNull());
-    stringStructure = JSString::createStructure(*this, jsNull());
-    notAnObjectStructure = JSNotAnObject::createStructure(*this, jsNull());
-    propertyNameIteratorStructure = JSPropertyNameIterator::createStructure(*this, jsNull());
-    getterSetterStructure = GetterSetter::createStructure(*this, jsNull());
-    apiWrapperStructure = JSAPIValueWrapper::createStructure(*this, jsNull());
-    scopeChainNodeStructure = ScopeChainNode::createStructure(*this, jsNull());
-    executableStructure = ExecutableBase::createStructure(*this, jsNull());
-    evalExecutableStructure = EvalExecutable::createStructure(*this, jsNull());
-    programExecutableStructure = ProgramExecutable::createStructure(*this, jsNull());
-    functionExecutableStructure = FunctionExecutable::createStructure(*this, jsNull());
-    dummyMarkableCellStructure = JSCell::createDummyStructure(*this);
-    structureChainStructure = StructureChain::createStructure(*this, jsNull());
-
     interpreter = new Interpreter(*this);
     if (globalDataType == Default)
         m_stack = wtfThreadData().stack();
 
+    // Need to be careful to keep everything consistent here
+    IdentifierTable* existingEntryIdentifierTable = wtfThreadData().setCurrentIdentifierTable(identifierTable);
+    JSLock lock(SilenceAssertionsOnly);
+    structureStructure.set(*this, Structure::createStructure(*this));
+    activationStructure.set(*this, JSActivation::createStructure(*this, jsNull()));
+    interruptedExecutionErrorStructure.set(*this, JSNonFinalObject::createStructure(*this, jsNull()));
+    terminatedExecutionErrorStructure.set(*this, JSNonFinalObject::createStructure(*this, jsNull()));
+    staticScopeStructure.set(*this, JSStaticScopeObject::createStructure(*this, jsNull()));
+    strictEvalActivationStructure.set(*this, StrictEvalActivation::createStructure(*this, jsNull()));
+    stringStructure.set(*this, JSString::createStructure(*this, jsNull()));
+    notAnObjectStructure.set(*this, JSNotAnObject::createStructure(*this, jsNull()));
+    propertyNameIteratorStructure.set(*this, JSPropertyNameIterator::createStructure(*this, jsNull()));
+    getterSetterStructure.set(*this, GetterSetter::createStructure(*this, jsNull()));
+    apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, jsNull()));
+    scopeChainNodeStructure.set(*this, ScopeChainNode::createStructure(*this, jsNull()));
+    executableStructure.set(*this, ExecutableBase::createStructure(*this, jsNull()));
+    nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, jsNull()));
+    evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, jsNull()));
+    programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, jsNull()));
+    functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, jsNull()));
+    dummyMarkableCellStructure.set(*this, JSCell::createDummyStructure(*this));
+    structureChainStructure.set(*this, StructureChain::createStructure(*this, jsNull()));
+
+#if ENABLE(JSC_ZOMBIES)
+    zombieStructure.set(*this, JSZombie::createStructure(*this, jsNull()));
+#endif
+
+    wtfThreadData().setCurrentIdentifierTable(existingEntryIdentifierTable);
+
 #if PLATFORM(MAC)
     startProfilerServerIfNeeded();
 #endif
@@ -221,6 +238,33 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 #endif
 }
 
+void JSGlobalData::clearBuiltinStructures()
+{
+    structureStructure.clear();
+    activationStructure.clear();
+    interruptedExecutionErrorStructure.clear();
+    terminatedExecutionErrorStructure.clear();
+    staticScopeStructure.clear();
+    strictEvalActivationStructure.clear();
+    stringStructure.clear();
+    notAnObjectStructure.clear();
+    propertyNameIteratorStructure.clear();
+    getterSetterStructure.clear();
+    apiWrapperStructure.clear();
+    scopeChainNodeStructure.clear();
+    executableStructure.clear();
+    nativeExecutableStructure.clear();
+    evalExecutableStructure.clear();
+    programExecutableStructure.clear();
+    functionExecutableStructure.clear();
+    dummyMarkableCellStructure.clear();
+    structureChainStructure.clear();
+    
+#if ENABLE(JSC_ZOMBIES)
+    zombieStructure.clear();
+#endif
+}
+
 JSGlobalData::~JSGlobalData()
 {
     // By the time this is destroyed, heap.destroy() must already have been called.
@@ -281,10 +325,7 @@ PassRefPtr<JSGlobalData> JSGlobalData::create(ThreadStackType type)
 
 PassRefPtr<JSGlobalData> JSGlobalData::createLeaked(ThreadStackType type)
 {
-    Structure::startIgnoringLeaks();
-    RefPtr<JSGlobalData> data = create(type);
-    Structure::stopIgnoringLeaks();
-    return data.release();
+    return create(type);
 }
 
 bool JSGlobalData::sharedInstanceExists()
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index 34ea75d..f1085af 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -33,6 +33,7 @@
 #include "Heap.h"
 #include "DateInstanceCache.h"
 #include "ExecutableAllocator.h"
+#include "Strong.h"
 #include "JITStubs.h"
 #include "JSValue.h"
 #include "NumericStrings.h"
@@ -145,23 +146,29 @@ namespace JSC {
         const HashTable* regExpConstructorTable;
         const HashTable* stringTable;
         
-        RefPtr<Structure> activationStructure;
-        RefPtr<Structure> interruptedExecutionErrorStructure;
-        RefPtr<Structure> terminatedExecutionErrorStructure;
-        RefPtr<Structure> staticScopeStructure;
-        RefPtr<Structure> strictEvalActivationStructure;
-        RefPtr<Structure> stringStructure;
-        RefPtr<Structure> notAnObjectStructure;
-        RefPtr<Structure> propertyNameIteratorStructure;
-        RefPtr<Structure> getterSetterStructure;
-        RefPtr<Structure> apiWrapperStructure;
-        RefPtr<Structure> scopeChainNodeStructure;
-        RefPtr<Structure> executableStructure;
-        RefPtr<Structure> evalExecutableStructure;
-        RefPtr<Structure> programExecutableStructure;
-        RefPtr<Structure> functionExecutableStructure;
-        RefPtr<Structure> dummyMarkableCellStructure;
-        RefPtr<Structure> structureChainStructure;
+        Strong<Structure> structureStructure;
+        Strong<Structure> activationStructure;
+        Strong<Structure> interruptedExecutionErrorStructure;
+        Strong<Structure> terminatedExecutionErrorStructure;
+        Strong<Structure> staticScopeStructure;
+        Strong<Structure> strictEvalActivationStructure;
+        Strong<Structure> stringStructure;
+        Strong<Structure> notAnObjectStructure;
+        Strong<Structure> propertyNameIteratorStructure;
+        Strong<Structure> getterSetterStructure;
+        Strong<Structure> apiWrapperStructure;
+        Strong<Structure> scopeChainNodeStructure;
+        Strong<Structure> executableStructure;
+        Strong<Structure> nativeExecutableStructure;
+        Strong<Structure> evalExecutableStructure;
+        Strong<Structure> programExecutableStructure;
+        Strong<Structure> functionExecutableStructure;
+        Strong<Structure> dummyMarkableCellStructure;
+        Strong<Structure> structureChainStructure;
+
+#if ENABLE(JSC_ZOMBIES)
+        Strong<Structure> zombieStructure;
+#endif
 
         static void storeVPtrs();
         static JS_EXPORTDATA void* jsArrayVPtr;
@@ -260,6 +267,7 @@ namespace JSC {
         void dumpRegExpTrace();
         HandleSlot allocateGlobalHandle() { return heap.allocateGlobalHandle(); }
         HandleSlot allocateLocalHandle() { return heap.allocateLocalHandle(); }
+        void clearBuiltinStructures();
 
     private:
         JSGlobalData(GlobalDataType, ThreadStackType);
@@ -271,6 +279,11 @@ namespace JSC {
         StackBounds m_stack;
     };
 
+    inline HandleSlot allocateGlobalHandle(JSGlobalData& globalData)
+    {
+        return globalData.allocateGlobalHandle();
+    }
+
 } // namespace JSC
 
 #endif // JSGlobalData_h
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index a2bbfbd..b82949a 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -84,14 +84,6 @@ template <typename T> static inline void markIfNeeded(MarkStack& markStack, Writ
         markStack.append(v);
 }
 
-static inline void markIfNeeded(MarkStack& markStack, const RefPtr<Structure>& s)
-{
-    if (s && s->storedPrototype())
-        markStack.append(s->storedPrototypeSlot());
-    if (s && *s->cachedPrototypeChainSlot())
-        markStack.append(s->cachedPrototypeChainSlot());
-}
-
 JSGlobalObject::~JSGlobalObject()
 {
     ASSERT(JSLock::currentThreadIsHoldingLock());
@@ -139,11 +131,11 @@ void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& proper
     if (symbolTablePutWithAttributes(exec->globalData(), propertyName, value, attributes))
         return;
 
-    JSValue valueBefore = getDirect(propertyName);
+    JSValue valueBefore = getDirect(exec->globalData(), propertyName);
     PutPropertySlot slot;
     JSVariableObject::put(exec, propertyName, value, slot);
     if (!valueBefore) {
-        JSValue valueAfter = getDirect(propertyName);
+        JSValue valueAfter = getDirect(exec->globalData(), propertyName);
         if (valueAfter)
             JSObject::putWithAttributes(exec, propertyName, valueAfter, attributes);
     }
@@ -178,46 +170,46 @@ void JSGlobalObject::reset(JSValue prototype)
     // Prototypes
 
     m_functionPrototype.set(exec->globalData(), this, new (exec) FunctionPrototype(exec, this, FunctionPrototype::createStructure(exec->globalData(), jsNull()))); // The real prototype will be set once ObjectPrototype is created.
-    m_functionStructure = JSFunction::createStructure(exec->globalData(), m_functionPrototype.get());
-    m_internalFunctionStructure = InternalFunction::createStructure(exec->globalData(), m_functionPrototype.get());
+    m_functionStructure.set(exec->globalData(), this, JSFunction::createStructure(exec->globalData(), m_functionPrototype.get()));
+    m_internalFunctionStructure.set(exec->globalData(), this, InternalFunction::createStructure(exec->globalData(), m_functionPrototype.get()));
     JSFunction* callFunction = 0;
     JSFunction* applyFunction = 0;
     m_functionPrototype->addFunctionProperties(exec, this, m_functionStructure.get(), &callFunction, &applyFunction);
     m_callFunction.set(exec->globalData(), this, callFunction);
     m_applyFunction.set(exec->globalData(), this, applyFunction);
     m_objectPrototype.set(exec->globalData(), this, new (exec) ObjectPrototype(exec, this, ObjectPrototype::createStructure(exec->globalData(), jsNull()), m_functionStructure.get()));
-    m_functionPrototype->structure()->setPrototypeWithoutTransition(m_objectPrototype.get());
+    m_functionPrototype->structure()->setPrototypeWithoutTransition(exec->globalData(), m_objectPrototype.get());
 
-    m_emptyObjectStructure = m_objectPrototype->inheritorID(exec->globalData());
+    m_emptyObjectStructure.set(exec->globalData(), this, m_objectPrototype->inheritorID(exec->globalData()));
 
-    m_callbackFunctionStructure = JSCallbackFunction::createStructure(exec->globalData(), m_functionPrototype.get());
-    m_argumentsStructure = Arguments::createStructure(exec->globalData(), m_objectPrototype.get());
-    m_callbackConstructorStructure = JSCallbackConstructor::createStructure(exec->globalData(), m_objectPrototype.get());
-    m_callbackObjectStructure = JSCallbackObject<JSObjectWithGlobalObject>::createStructure(exec->globalData(), m_objectPrototype.get());
+    m_callbackFunctionStructure.set(exec->globalData(), this, JSCallbackFunction::createStructure(exec->globalData(), m_functionPrototype.get()));
+    m_argumentsStructure.set(exec->globalData(), this, Arguments::createStructure(exec->globalData(), m_objectPrototype.get()));
+    m_callbackConstructorStructure.set(exec->globalData(), this, JSCallbackConstructor::createStructure(exec->globalData(), m_objectPrototype.get()));
+    m_callbackObjectStructure.set(exec->globalData(), this, JSCallbackObject<JSObjectWithGlobalObject>::createStructure(exec->globalData(), m_objectPrototype.get()));
 
     m_arrayPrototype.set(exec->globalData(), this, new (exec) ArrayPrototype(this, ArrayPrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
-    m_arrayStructure = JSArray::createStructure(exec->globalData(), m_arrayPrototype.get());
-    m_regExpMatchesArrayStructure = RegExpMatchesArray::createStructure(exec->globalData(), m_arrayPrototype.get());
+    m_arrayStructure.set(exec->globalData(), this, JSArray::createStructure(exec->globalData(), m_arrayPrototype.get()));
+    m_regExpMatchesArrayStructure.set(exec->globalData(), this, RegExpMatchesArray::createStructure(exec->globalData(), m_arrayPrototype.get()));
 
     m_stringPrototype.set(exec->globalData(), this, new (exec) StringPrototype(exec, this, StringPrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
-    m_stringObjectStructure = StringObject::createStructure(exec->globalData(), m_stringPrototype.get());
+    m_stringObjectStructure.set(exec->globalData(), this, StringObject::createStructure(exec->globalData(), m_stringPrototype.get()));
 
     m_booleanPrototype.set(exec->globalData(), this, new (exec) BooleanPrototype(exec, this, BooleanPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
-    m_booleanObjectStructure = BooleanObject::createStructure(exec->globalData(), m_booleanPrototype.get());
+    m_booleanObjectStructure.set(exec->globalData(), this, BooleanObject::createStructure(exec->globalData(), m_booleanPrototype.get()));
 
     m_numberPrototype.set(exec->globalData(), this, new (exec) NumberPrototype(exec, this, NumberPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
-    m_numberObjectStructure = NumberObject::createStructure(exec->globalData(), m_numberPrototype.get());
+    m_numberObjectStructure.set(exec->globalData(), this, NumberObject::createStructure(exec->globalData(), m_numberPrototype.get()));
 
     m_datePrototype.set(exec->globalData(), this, new (exec) DatePrototype(exec, this, DatePrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
-    m_dateStructure = DateInstance::createStructure(exec->globalData(), m_datePrototype.get());
+    m_dateStructure.set(exec->globalData(), this, DateInstance::createStructure(exec->globalData(), m_datePrototype.get()));
 
     m_regExpPrototype.set(exec->globalData(), this, new (exec) RegExpPrototype(exec, this, RegExpPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
-    m_regExpStructure = RegExpObject::createStructure(exec->globalData(), m_regExpPrototype.get());
+    m_regExpStructure.set(exec->globalData(), this, RegExpObject::createStructure(exec->globalData(), m_regExpPrototype.get()));
 
     m_methodCallDummy.set(exec->globalData(), this, constructEmptyObject(exec));
 
     ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, this, ErrorPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get());
-    m_errorStructure = ErrorInstance::createStructure(exec->globalData(), errorPrototype);
+    m_errorStructure.set(exec->globalData(), this, ErrorInstance::createStructure(exec->globalData(), errorPrototype));
 
     // Constructors
 
@@ -233,8 +225,8 @@ void JSGlobalObject::reset(JSValue prototype)
 
     m_errorConstructor.set(exec->globalData(), this, new (exec) ErrorConstructor(exec, this, ErrorConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), errorPrototype));
 
-    RefPtr<Structure> nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(exec->globalData(), errorPrototype);
-    RefPtr<Structure> nativeErrorStructure = NativeErrorConstructor::createStructure(exec->globalData(), m_functionPrototype.get());
+    Structure* nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(exec->globalData(), errorPrototype);
+    Structure* nativeErrorStructure = NativeErrorConstructor::createStructure(exec->globalData(), m_functionPrototype.get());
     m_evalErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "EvalError"));
     m_rangeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "RangeError"));
     m_referenceErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "ReferenceError"));
@@ -301,18 +293,18 @@ void JSGlobalObject::reset(JSValue prototype)
     putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
 #endif
 
-    resetPrototype(prototype);
+    resetPrototype(exec->globalData(), prototype);
 }
 
 // Set prototype, and also insert the object prototype at the end of the chain.
-void JSGlobalObject::resetPrototype(JSValue prototype)
+void JSGlobalObject::resetPrototype(JSGlobalData& globalData, JSValue prototype)
 {
-    setPrototype(prototype);
+    setPrototype(globalData, prototype);
 
     JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
     JSObject* objectPrototype = m_objectPrototype.get();
     if (oldLastInPrototypeChain != objectPrototype)
-        oldLastInPrototypeChain->setPrototype(objectPrototype);
+        oldLastInPrototypeChain->setPrototype(globalData, objectPrototype);
 }
 
 void JSGlobalObject::markChildren(MarkStack& markStack)
@@ -344,21 +336,21 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
     markIfNeeded(markStack, &m_datePrototype);
     markIfNeeded(markStack, &m_regExpPrototype);
 
-    markIfNeeded(markStack, m_argumentsStructure);
-    markIfNeeded(markStack, m_arrayStructure);
-    markIfNeeded(markStack, m_booleanObjectStructure);
-    markIfNeeded(markStack, m_callbackConstructorStructure);
-    markIfNeeded(markStack, m_callbackFunctionStructure);
-    markIfNeeded(markStack, m_callbackObjectStructure);
-    markIfNeeded(markStack, m_dateStructure);
-    markIfNeeded(markStack, m_emptyObjectStructure);
-    markIfNeeded(markStack, m_errorStructure);
-    markIfNeeded(markStack, m_functionStructure);
-    markIfNeeded(markStack, m_numberObjectStructure);
-    markIfNeeded(markStack, m_regExpMatchesArrayStructure);
-    markIfNeeded(markStack, m_regExpStructure);
-    markIfNeeded(markStack, m_stringObjectStructure);
-    markIfNeeded(markStack, m_internalFunctionStructure);
+    markIfNeeded(markStack, &m_argumentsStructure);
+    markIfNeeded(markStack, &m_arrayStructure);
+    markIfNeeded(markStack, &m_booleanObjectStructure);
+    markIfNeeded(markStack, &m_callbackConstructorStructure);
+    markIfNeeded(markStack, &m_callbackFunctionStructure);
+    markIfNeeded(markStack, &m_callbackObjectStructure);
+    markIfNeeded(markStack, &m_dateStructure);
+    markIfNeeded(markStack, &m_emptyObjectStructure);
+    markIfNeeded(markStack, &m_errorStructure);
+    markIfNeeded(markStack, &m_functionStructure);
+    markIfNeeded(markStack, &m_numberObjectStructure);
+    markIfNeeded(markStack, &m_regExpMatchesArrayStructure);
+    markIfNeeded(markStack, &m_regExpStructure);
+    markIfNeeded(markStack, &m_stringObjectStructure);
+    markIfNeeded(markStack, &m_internalFunctionStructure);
 
     if (m_registerArray) {
         // Outside the execution of global code, when our variables are torn off,
@@ -393,7 +385,7 @@ void JSGlobalObject::copyGlobalsFrom(RegisterFile& registerFile)
         return;
     }
 
-    OwnArrayPtr<WriteBarrier<Unknown> > registerArray = copyRegisterArray(globalData(), reinterpret_cast<WriteBarrier<Unknown>*>(registerFile.lastGlobal()), numGlobals);
+    OwnArrayPtr<WriteBarrier<Unknown> > registerArray = copyRegisterArray(globalData(), reinterpret_cast<WriteBarrier<Unknown>*>(registerFile.lastGlobal()), numGlobals, numGlobals);
     WriteBarrier<Unknown>* registers = registerArray.get() + numGlobals;
     setRegisters(registers, registerArray.release(), numGlobals);
 }
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 04f63eb..0e36920 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -87,21 +87,21 @@ namespace JSC {
         WriteBarrier<DatePrototype> m_datePrototype;
         WriteBarrier<RegExpPrototype> m_regExpPrototype;
 
-        RefPtr<Structure> m_argumentsStructure;
-        RefPtr<Structure> m_arrayStructure;
-        RefPtr<Structure> m_booleanObjectStructure;
-        RefPtr<Structure> m_callbackConstructorStructure;
-        RefPtr<Structure> m_callbackFunctionStructure;
-        RefPtr<Structure> m_callbackObjectStructure;
-        RefPtr<Structure> m_dateStructure;
-        RefPtr<Structure> m_emptyObjectStructure;
-        RefPtr<Structure> m_errorStructure;
-        RefPtr<Structure> m_functionStructure;
-        RefPtr<Structure> m_numberObjectStructure;
-        RefPtr<Structure> m_regExpMatchesArrayStructure;
-        RefPtr<Structure> m_regExpStructure;
-        RefPtr<Structure> m_stringObjectStructure;
-        RefPtr<Structure> m_internalFunctionStructure;
+        WriteBarrier<Structure> m_argumentsStructure;
+        WriteBarrier<Structure> m_arrayStructure;
+        WriteBarrier<Structure> m_booleanObjectStructure;
+        WriteBarrier<Structure> m_callbackConstructorStructure;
+        WriteBarrier<Structure> m_callbackFunctionStructure;
+        WriteBarrier<Structure> m_callbackObjectStructure;
+        WriteBarrier<Structure> m_dateStructure;
+        WriteBarrier<Structure> m_emptyObjectStructure;
+        WriteBarrier<Structure> m_errorStructure;
+        WriteBarrier<Structure> m_functionStructure;
+        WriteBarrier<Structure> m_numberObjectStructure;
+        WriteBarrier<Structure> m_regExpMatchesArrayStructure;
+        WriteBarrier<Structure> m_regExpStructure;
+        WriteBarrier<Structure> m_stringObjectStructure;
+        WriteBarrier<Structure> m_internalFunctionStructure;
 
         unsigned m_profileGroup;
         Debugger* m_debugger;
@@ -115,7 +115,7 @@ namespace JSC {
         void* operator new(size_t, JSGlobalData*);
         
         explicit JSGlobalObject(JSGlobalData& globalData)
-            : JSVariableObject(JSGlobalObject::createStructure(globalData, jsNull()), &m_symbolTable, 0)
+            : JSVariableObject(globalData, JSGlobalObject::createStructure(globalData, jsNull()), &m_symbolTable, 0)
             , m_registerArraySize(0)
             , m_globalScopeChain()
             , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
@@ -125,8 +125,8 @@ namespace JSC {
             init(this);
         }
         
-        explicit JSGlobalObject(NonNullPassRefPtr<Structure> structure)
-            : JSVariableObject(structure, &m_symbolTable, 0)
+        explicit JSGlobalObject(JSGlobalData& globalData, Structure* structure)
+            : JSVariableObject(globalData, structure, &m_symbolTable, 0)
             , m_registerArraySize(0)
             , m_globalScopeChain()
             , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
@@ -137,8 +137,8 @@ namespace JSC {
         }
 
     protected:
-        JSGlobalObject(NonNullPassRefPtr<Structure> structure, JSObject* thisValue)
-            : JSVariableObject(structure, &m_symbolTable, 0)
+        JSGlobalObject(JSGlobalData& globalData, Structure* structure, JSObject* thisValue)
+            : JSVariableObject(globalData, structure, &m_symbolTable, 0)
             , m_registerArraySize(0)
             , m_globalScopeChain()
             , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
@@ -235,11 +235,11 @@ namespace JSC {
         void copyGlobalsTo(RegisterFile&);
         void resizeRegisters(int oldSize, int newSize);
 
-        void resetPrototype(JSValue prototype);
+        void resetPrototype(JSGlobalData&, JSValue prototype);
 
         JSGlobalData& globalData() const { return *m_globalData.get(); }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
@@ -363,7 +363,7 @@ namespace JSC {
         // We cache our prototype chain so our clients can share it.
         if (!isValid(exec, m_cachedPrototypeChain.get())) {
             JSValue prototype = prototypeForLookup(exec);
-            m_cachedPrototypeChain = StructureChain::create(exec->globalData(), prototype.isNull() ? 0 : asObject(prototype)->structure());
+            m_cachedPrototypeChain.set(exec->globalData(), this, StructureChain::create(exec->globalData(), prototype.isNull() ? 0 : asObject(prototype)->structure()));
         }
         return m_cachedPrototypeChain.get();
     }
@@ -374,9 +374,9 @@ namespace JSC {
             return false;
 
         JSValue prototype = prototypeForLookup(exec);
-        RefPtr<Structure>* cachedStructure = cachedPrototypeChain->head();
+        WriteBarrier<Structure>* cachedStructure = cachedPrototypeChain->head();
         while(*cachedStructure && !prototype.isNull()) {
-            if (asObject(prototype)->structure() != *cachedStructure)
+            if (asObject(prototype)->structure() != cachedStructure->get())
                 return false;
             ++cachedStructure;
             prototype = asObject(prototype)->prototype();
@@ -407,17 +407,17 @@ namespace JSC {
     
     inline JSArray* constructEmptyArray(ExecState* exec)
     {
-        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
+        return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure());
     }
     
     inline JSArray* constructEmptyArray(ExecState* exec, JSGlobalObject* globalObject)
     {
-        return new (exec) JSArray(globalObject->arrayStructure());
+        return new (exec) JSArray(exec->globalData(), globalObject->arrayStructure());
     }
 
     inline JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
     {
-        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength, CreateInitialized);
+        return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), initialLength, CreateInitialized);
     }
 
     inline JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
diff --git a/Source/JavaScriptCore/runtime/JSImmediate.cpp b/Source/JavaScriptCore/runtime/JSImmediate.cpp
deleted file mode 100644
index 846238d..0000000
--- a/Source/JavaScriptCore/runtime/JSImmediate.cpp
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- *  Copyright (C) 2003-2006, 2008 Apple Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "JSImmediate.h"
-
-namespace JSC {
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSImmediate.h b/Source/JavaScriptCore/runtime/JSImmediate.h
deleted file mode 100644
index 68ba75c..0000000
--- a/Source/JavaScriptCore/runtime/JSImmediate.h
+++ /dev/null
@@ -1,568 +0,0 @@
-/*
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef JSImmediate_h
-#define JSImmediate_h
-
-#if USE(JSVALUE64)
-
-#include <wtf/Assertions.h>
-#include <wtf/AlwaysInline.h>
-#include <wtf/MathExtras.h>
-#include <wtf/StdLibExtras.h>
-#include "JSValue.h"
-#include <limits>
-#include <limits.h>
-#include <stdarg.h>
-#include <stdint.h>
-#include <stdlib.h>
-
-namespace JSC {
-
-    class ExecState;
-    class JSCell;
-    class JSGlobalData;
-    class JSObject;
-    class UString;
-
-    inline intptr_t reinterpretDoubleToIntptr(double value)
-    {
-        return WTF::bitwise_cast<intptr_t>(value);
-    }
-
-    inline double reinterpretIntptrToDouble(intptr_t value)
-    {
-        return WTF::bitwise_cast<double>(value);
-    }
-
-    /*
-     * A JSValue* is either a pointer to a cell (a heap-allocated object) or an immediate (a type-tagged 
-     * value masquerading as a pointer). The low two bits in a JSValue* are available for type tagging
-     * because allocator alignment guarantees they will be 00 in cell pointers.
-     *
-     * For example, on a 32 bit system:
-     *
-     * JSCell*:             XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX                     00
-     *                      [ high 30 bits: pointer address ]  [ low 2 bits -- always 0 ]
-     * JSImmediate:         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX                     TT
-     *                      [ high 30 bits: 'payload' ]             [ low 2 bits -- tag ]
-     *
-     * Where the bottom two bits are non-zero they either indicate that the immediate is a 31 bit signed
-     * integer, or they mark the value as being an immediate of a type other than integer, with a secondary
-     * tag used to indicate the exact type.
-     *
-     * Where the lowest bit is set (TT is equal to 01 or 11) the high 31 bits form a 31 bit signed int value.
-     * Where TT is equal to 10 this indicates this is a type of immediate other than an integer, and the next
-     * two bits will form an extended tag.
-     *
-     * 31 bit signed int:   XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX                     X1
-     *                      [ high 30 bits of the value ]      [ high bit part of value ]
-     * Other:               YYYYYYYYYYYYYYYYYYYYYYYYYYYY      ZZ               10
-     *                      [ extended 'payload' ]  [  extended tag  ]  [  tag 'other'  ]
-     *
-     * Where the first bit of the extended tag is set this flags the value as being a boolean, and the following
-     * bit would flag the value as undefined.  If neither bits are set, the value is null.
-     *
-     * Other:               YYYYYYYYYYYYYYYYYYYYYYYYYYYY      UB               10
-     *                      [ extended 'payload' ]  [ undefined | bool ]  [ tag 'other' ]
-     *
-     * For boolean value the lowest bit in the payload holds the value of the bool, all remaining bits are zero.
-     * For undefined or null immediates the payload is zero.
-     *
-     * Boolean:             000000000000000000000000000V      01               10
-     *                      [ boolean value ]              [ bool ]       [ tag 'other' ]
-     * Undefined:           0000000000000000000000000000      10               10
-     *                      [ zero ]                    [ undefined ]     [ tag 'other' ]
-     * Null:                0000000000000000000000000000      00               10
-     *                      [ zero ]                       [ zero ]       [ tag 'other' ]
-     */
-
-    /*
-     * On 64-bit platforms, we support an alternative encoding form for immediates, if
-     * USE(JSVALUE64) is defined.  When this format is used, double precision
-     * floating point values may also be encoded as JSImmediates.
-     *
-     * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
-     * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
-     * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
-     * have a payload of zero.  We assume that non-zero payloads are available to encode
-     * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
-     * all set represents a NaN with a non-zero payload, we can use this space in the NaN
-     * ranges to encode other values (however there are also other ranges of NaN space that
-     * could have been selected).  This range of NaN space is represented by 64-bit numbers
-     * begining with the 16-bit hex patterns 0xFFFE and 0xFFFF - we rely on the fact that no
-     * valid double-precision numbers will begin fall in these ranges.
-     *
-     * The scheme we have implemented encodes double precision values by adding 2^48 to the
-     * 64-bit integer representation of the number.  After this manipulation, no encoded
-     * double-precision value will begin with the pattern 0x0000 or 0xFFFF.
-     *
-     * The top 16-bits denote the type of the encoded JSImmediate:
-     *
-     * Pointer: 0000:PPPP:PPPP:PPPP
-     *          0001:****:****:****
-     * Double:{         ...
-     *          FFFE:****:****:****
-     * Integer: FFFF:0000:IIII:IIII
-     *
-     * 32-bit signed integers are marked with the 16-bit tag 0xFFFF.  The tag 0x0000
-     * denotes a pointer, or another form of tagged immediate.  Boolean, null and undefined
-     * values are encoded in the same manner as the default format.
-     */
-
-    class JSImmediate {
-    private:
-        friend class JIT;
-        friend class JSValue;
-        friend class JSInterfaceJIT;
-        friend class SpecializedThunkJIT;
-        friend JSValue jsNumber(ExecState* exec, double d);
-        friend JSValue jsNumber(ExecState*, char i);
-        friend JSValue jsNumber(ExecState*, unsigned char i);
-        friend JSValue jsNumber(ExecState*, short i);
-        friend JSValue jsNumber(ExecState*, unsigned short i);
-        friend JSValue jsNumber(ExecState* exec, int i);
-        friend JSValue jsNumber(ExecState* exec, unsigned i);
-        friend JSValue jsNumber(ExecState* exec, long i);
-        friend JSValue jsNumber(ExecState* exec, unsigned long i);
-        friend JSValue jsNumber(ExecState* exec, long long i);
-        friend JSValue jsNumber(ExecState* exec, unsigned long long i);
-        friend JSValue jsNumber(JSGlobalData* globalData, double d);
-        friend JSValue jsNumber(JSGlobalData* globalData, short i);
-        friend JSValue jsNumber(JSGlobalData* globalData, unsigned short i);
-        friend JSValue jsNumber(JSGlobalData* globalData, int i);
-        friend JSValue jsNumber(JSGlobalData* globalData, unsigned i);
-        friend JSValue jsNumber(JSGlobalData* globalData, long i);
-        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long i);
-        friend JSValue jsNumber(JSGlobalData* globalData, long long i);
-        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long long i);
-
-        // If all bits in the mask are set, this indicates an integer number,
-        // if any but not all are set this value is a double precision number.
-        static const intptr_t TagTypeNumber = 0xffff000000000000ll;
-        // This value is 2^48, used to encode doubles such that the encoded value will begin
-        // with a 16-bit pattern within the range 0x0001..0xFFFE.
-        static const intptr_t DoubleEncodeOffset = 0x1000000000000ll;
-        static const intptr_t TagBitTypeOther   = 0x2; // second bit set indicates immediate other than an integer
-        static const intptr_t TagMask           = TagTypeNumber | TagBitTypeOther;
-
-        static const intptr_t ExtendedTagMask         = 0xC; // extended tag holds a further two bits
-        static const intptr_t ExtendedTagBitBool      = 0x4;
-        static const intptr_t ExtendedTagBitUndefined = 0x8;
-
-        static const intptr_t FullTagTypeMask      = TagMask | ExtendedTagMask;
-        static const intptr_t FullTagTypeBool      = TagBitTypeOther | ExtendedTagBitBool;
-        static const intptr_t FullTagTypeUndefined = TagBitTypeOther | ExtendedTagBitUndefined;
-        static const intptr_t FullTagTypeNull      = TagBitTypeOther;
-
-        static const int32_t IntegerPayloadShift  = 0;
-        static const int32_t ExtendedPayloadShift = 4;
-
-        static const intptr_t ExtendedPayloadBitBoolValue = 1 << ExtendedPayloadShift;
-
-        static const int32_t signBit = 0x80000000;
- 
-        static ALWAYS_INLINE bool isImmediate(JSValue v)
-        {
-            return rawValue(v) & TagMask;
-        }
-        
-        static ALWAYS_INLINE bool isNumber(JSValue v)
-        {
-            return rawValue(v) & TagTypeNumber;
-        }
-
-        static ALWAYS_INLINE bool isIntegerNumber(JSValue v)
-        {
-            return (rawValue(v) & TagTypeNumber) == TagTypeNumber;
-        }
-
-        static ALWAYS_INLINE bool isDouble(JSValue v)
-        {
-            return isNumber(v) && !isIntegerNumber(v);
-        }
-
-        static ALWAYS_INLINE bool isPositiveIntegerNumber(JSValue v)
-        {
-            // A single mask to check for the sign bit and the number tag all at once.
-            return (rawValue(v) & (signBit | TagTypeNumber)) == TagTypeNumber;
-        }
-        
-        static ALWAYS_INLINE bool isBoolean(JSValue v)
-        {
-            return (rawValue(v) & FullTagTypeMask) == FullTagTypeBool;
-        }
-        
-        static ALWAYS_INLINE bool isUndefinedOrNull(JSValue v)
-        {
-            // Undefined and null share the same value, bar the 'undefined' bit in the extended tag.
-            return (rawValue(v) & ~ExtendedTagBitUndefined) == FullTagTypeNull;
-        }
-
-        static JSValue from(char);
-        static JSValue from(signed char);
-        static JSValue from(unsigned char);
-        static JSValue from(short);
-        static JSValue from(unsigned short);
-        static JSValue from(int);
-        static JSValue from(unsigned);
-        static JSValue from(long);
-        static JSValue from(unsigned long);
-        static JSValue from(long long);
-        static JSValue from(unsigned long long);
-        static JSValue from(double);
-
-        static ALWAYS_INLINE bool isEitherImmediate(JSValue v1, JSValue v2)
-        {
-            return (rawValue(v1) | rawValue(v2)) & TagMask;
-        }
-
-        static ALWAYS_INLINE bool areBothImmediate(JSValue v1, JSValue v2)
-        {
-            return isImmediate(v1) & isImmediate(v2);
-        }
-
-        static ALWAYS_INLINE bool areBothImmediateIntegerNumbers(JSValue v1, JSValue v2)
-        {
-            return (rawValue(v1) & rawValue(v2) & TagTypeNumber) == TagTypeNumber;
-        }
-
-        static double toDouble(JSValue);
-        static bool toBoolean(JSValue);
-
-        static bool getUInt32(JSValue, uint32_t&);
-        static bool getTruncatedInt32(JSValue, int32_t&);
-        static bool getTruncatedUInt32(JSValue, uint32_t&);
-
-        static int32_t getTruncatedInt32(JSValue);
-        static uint32_t getTruncatedUInt32(JSValue);
-
-        static JSValue trueImmediate();
-        static JSValue falseImmediate();
-        static JSValue undefinedImmediate();
-        static JSValue nullImmediate();
-        static JSValue zeroImmediate();
-        static JSValue oneImmediate();
-
-    private:
-        static const int minImmediateInt = ((-INT_MAX) - 1);
-        static const int maxImmediateInt = INT_MAX;
-        static const unsigned maxImmediateUInt = maxImmediateInt;
-
-        static ALWAYS_INLINE JSValue makeValue(intptr_t integer)
-        {
-            return JSValue::makeImmediate(integer);
-        }
-
-        // With USE(JSVALUE64) we want the argument to be zero extended, so the
-        // integer doesn't interfere with the tag bits in the upper word.  In the default encoding,
-        // if intptr_t id larger then int32_t we sign extend the value through the upper word.
-        static ALWAYS_INLINE JSValue makeInt(uint32_t value)
-        {
-            return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeNumber);
-        }
-        
-        static ALWAYS_INLINE JSValue makeDouble(double value)
-        {
-            return makeValue(reinterpretDoubleToIntptr(value) + DoubleEncodeOffset);
-        }
-        
-        static ALWAYS_INLINE JSValue makeBool(bool b)
-        {
-            return makeValue((static_cast<intptr_t>(b) << ExtendedPayloadShift) | FullTagTypeBool);
-        }
-        
-        static ALWAYS_INLINE JSValue makeUndefined()
-        {
-            return makeValue(FullTagTypeUndefined);
-        }
-        
-        static ALWAYS_INLINE JSValue makeNull()
-        {
-            return makeValue(FullTagTypeNull);
-        }
-
-        template<typename T>
-        static JSValue fromNumberOutsideIntegerRange(T);
-
-        static ALWAYS_INLINE double doubleValue(JSValue v)
-        {
-            return reinterpretIntptrToDouble(rawValue(v) - DoubleEncodeOffset);
-        }
-
-        static ALWAYS_INLINE int32_t intValue(JSValue v)
-        {
-            return static_cast<int32_t>(rawValue(v) >> IntegerPayloadShift);
-        }
-        
-        static ALWAYS_INLINE uint32_t uintValue(JSValue v)
-        {
-            return static_cast<uint32_t>(rawValue(v) >> IntegerPayloadShift);
-        }
-        
-        static ALWAYS_INLINE bool boolValue(JSValue v)
-        {
-            return rawValue(v) & ExtendedPayloadBitBoolValue;
-        }
-        
-        static ALWAYS_INLINE intptr_t rawValue(JSValue v)
-        {
-            return v.immediateValue();
-        }
-    };
-
-    ALWAYS_INLINE JSValue JSImmediate::trueImmediate() { return makeBool(true); }
-    ALWAYS_INLINE JSValue JSImmediate::falseImmediate() { return makeBool(false); }
-    ALWAYS_INLINE JSValue JSImmediate::undefinedImmediate() { return makeUndefined(); }
-    ALWAYS_INLINE JSValue JSImmediate::nullImmediate() { return makeNull(); }
-    ALWAYS_INLINE JSValue JSImmediate::zeroImmediate() { return makeInt(0); }
-    ALWAYS_INLINE JSValue JSImmediate::oneImmediate() { return makeInt(1); }
-
-    inline bool doubleToBoolean(double value)
-    {
-        return value < 0.0 || value > 0.0;
-    }
-
-    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
-    {
-        ASSERT(isImmediate(v));
-        return isNumber(v) ? isIntegerNumber(v) ? v != zeroImmediate()
-            : doubleToBoolean(doubleValue(v)) : v == trueImmediate();
-    }
-
-    ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValue v)
-    {
-        // FIXME: should probably be asserting isPositiveIntegerNumber here.
-        ASSERT(isIntegerNumber(v));
-        return intValue(v);
-    }
-
-    template<typename T>
-    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T value)
-    {
-        return makeDouble(static_cast<double>(value));
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(char i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(signed char i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned char i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(short i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned short i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(int i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned i)
-    {
-        if (i > maxImmediateUInt)
-            return fromNumberOutsideIntegerRange(i);
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(long i)
-    {
-        if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return fromNumberOutsideIntegerRange(i);
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long i)
-    {
-        if (i > maxImmediateUInt)
-            return fromNumberOutsideIntegerRange(i);
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(long long i)
-    {
-        if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return JSValue();
-        return makeInt(static_cast<intptr_t>(i));
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long long i)
-    {
-        if (i > maxImmediateUInt)
-            return fromNumberOutsideIntegerRange(i);
-        return makeInt(static_cast<intptr_t>(i));
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(double d)
-    {
-        const int intVal = static_cast<int>(d);
-
-        // Check for data loss from conversion to int.
-        if (intVal != d || (!intVal && signbit(d)))
-            return fromNumberOutsideIntegerRange(d);
-
-        return from(intVal);
-    }
-
-    ALWAYS_INLINE int32_t JSImmediate::getTruncatedInt32(JSValue v)
-    {
-        ASSERT(isIntegerNumber(v));
-        return intValue(v);
-    }
-
-    ALWAYS_INLINE double JSImmediate::toDouble(JSValue v)
-    {
-        ASSERT(isImmediate(v));
-
-        if (isIntegerNumber(v))
-            return intValue(v);
-
-        if (isNumber(v)) {
-            ASSERT(isDouble(v));
-            return doubleValue(v);
-        }
-
-        if (rawValue(v) == FullTagTypeUndefined)
-            return nonInlineNaN();
-
-        ASSERT(JSImmediate::isBoolean(v) || (v == JSImmediate::nullImmediate()));
-        return rawValue(v) >> ExtendedPayloadShift;
-    }
-
-    ALWAYS_INLINE bool JSImmediate::getUInt32(JSValue v, uint32_t& i)
-    {
-        i = uintValue(v);
-        return isPositiveIntegerNumber(v);
-    }
-
-    ALWAYS_INLINE bool JSImmediate::getTruncatedInt32(JSValue v, int32_t& i)
-    {
-        i = intValue(v);
-        return isIntegerNumber(v);
-    }
-
-    ALWAYS_INLINE bool JSImmediate::getTruncatedUInt32(JSValue v, uint32_t& i)
-    {
-        return getUInt32(v, i);
-    }
-
-    inline JSValue::JSValue(JSNullTag)
-    {
-        *this = JSImmediate::nullImmediate();
-    }
-    
-    inline JSValue::JSValue(JSUndefinedTag)
-    {
-        *this = JSImmediate::undefinedImmediate();
-    }
-
-    inline JSValue::JSValue(JSTrueTag)
-    {
-        *this = JSImmediate::trueImmediate();
-    }
-
-    inline JSValue::JSValue(JSFalseTag)
-    {
-        *this = JSImmediate::falseImmediate();
-    }
-
-    inline bool JSValue::isUndefinedOrNull() const
-    {
-        return JSImmediate::isUndefinedOrNull(asValue());
-    }
-
-    inline bool JSValue::isBoolean() const
-    {
-        return JSImmediate::isBoolean(asValue());
-    }
-
-    inline bool JSValue::isTrue() const
-    {
-        return asValue() == JSImmediate::trueImmediate();
-    }
-
-    inline bool JSValue::isFalse() const
-    {
-        return asValue() == JSImmediate::falseImmediate();
-    }
-
-    inline bool JSValue::getBoolean(bool& v) const
-    {
-        if (JSImmediate::isBoolean(asValue())) {
-            v = JSImmediate::toBoolean(asValue());
-            return true;
-        }
-        
-        return false;
-    }
-
-    inline bool JSValue::getBoolean() const
-    {
-        return asValue() == jsBoolean(true);
-    }
-
-    inline bool JSValue::isCell() const
-    {
-        return !JSImmediate::isImmediate(asValue());
-    }
-
-    inline bool JSValue::isInt32() const
-    {
-        return JSImmediate::isIntegerNumber(asValue());
-    }
-
-    inline int32_t JSValue::asInt32() const
-    {
-        ASSERT(isInt32());
-        return JSImmediate::getTruncatedInt32(asValue());
-    }
-
-    inline bool JSValue::isUInt32() const
-    {
-        return JSImmediate::isPositiveIntegerNumber(asValue());
-    }
-
-    inline uint32_t JSValue::asUInt32() const
-    {
-        ASSERT(isUInt32());
-        return JSImmediate::getTruncatedUInt32(asValue());
-    }
-
-} // namespace JSC
-
-#endif // USE(JSVALUE64)
-
-#endif // JSImmediate_h
diff --git a/Source/JavaScriptCore/runtime/JSNotAnObject.h b/Source/JavaScriptCore/runtime/JSNotAnObject.h
index 75bca18..4c6806a 100644
--- a/Source/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/Source/JavaScriptCore/runtime/JSNotAnObject.h
@@ -39,11 +39,11 @@ namespace JSC {
     class JSNotAnObject : public JSNonFinalObject {
     public:
         JSNotAnObject(ExecState* exec)
-            : JSNonFinalObject(exec->globalData().notAnObjectStructure)
+            : JSNonFinalObject(exec->globalData(), exec->globalData().notAnObjectStructure.get())
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/JSNumberCell.h b/Source/JavaScriptCore/runtime/JSNumberCell.h
deleted file mode 100644
index 1ccdf50..0000000
--- a/Source/JavaScriptCore/runtime/JSNumberCell.h
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2007, 2008 Apple Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef JSNumberCell_h
-#define JSNumberCell_h
-
-#include "CallFrame.h"
-#include "JSCell.h"
-#include "JSImmediate.h"
-#include "Heap.h"
-#include "UString.h"
-#include <stddef.h> // for size_t
-
-namespace JSC {
-
-    extern const double NaN;
-    extern const double Inf;
-
-#if USE(JSVALUE64)
-    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
-    {
-        *this = JSImmediate::fromNumberOutsideIntegerRange(d);
-    }
-
-    inline JSValue::JSValue(double d)
-    {
-        JSValue v = JSImmediate::from(d);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(int i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(unsigned i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(unsigned long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(long long i)
-    {
-        JSValue v = JSImmediate::from(static_cast<double>(i));
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(unsigned long long i)
-    {
-        JSValue v = JSImmediate::from(static_cast<double>(i));
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline bool JSValue::isDouble() const
-    {
-        return JSImmediate::isDouble(asValue());
-    }
-
-    inline double JSValue::asDouble() const
-    {
-        return JSImmediate::doubleValue(asValue());
-    }
-
-    inline bool JSValue::isNumber() const
-    {
-        return JSImmediate::isNumber(asValue());
-    }
-
-    inline double JSValue::uncheckedGetNumber() const
-    {
-        ASSERT(isNumber());
-        return JSImmediate::toDouble(asValue());
-    }
-
-#endif // USE(JSVALUE64)
-
-#if USE(JSVALUE64)
-
-    inline JSValue::JSValue(char i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(unsigned char i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(short i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(unsigned short i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue jsNaN()
-    {
-        return jsNumber(NaN);
-    }
-
-    // --- JSValue inlines ----------------------------
-
-    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
-    {
-        return isNumber() ? asValue() : jsNumber(this->toNumber(exec));
-    }
-
-    inline bool JSValue::getNumber(double &result) const
-    {
-        if (isInt32())
-            result = asInt32();
-        else if (LIKELY(isDouble()))
-            result = asDouble();
-        else {
-            ASSERT(!isNumber());
-            return false;
-        }
-        return true;
-    }
-
-#endif // USE(JSVALUE64)
-
-} // namespace JSC
-
-#endif // JSNumberCell_h
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index 8fc7ac9..27fc569 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -53,7 +53,7 @@ static EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState*);
 
 namespace JSC {
 
-JSONObject::JSONObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+JSONObject::JSONObject(JSGlobalObject* globalObject, Structure* structure)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/runtime/JSONObject.h b/Source/JavaScriptCore/runtime/JSONObject.h
index a52c543..c87c641 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.h
+++ b/Source/JavaScriptCore/runtime/JSONObject.h
@@ -34,9 +34,9 @@ namespace JSC {
 
     class JSONObject : public JSObjectWithGlobalObject {
     public:
-        JSONObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure);
+        JSONObject(JSGlobalObject*, Structure*);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index b307540..9677f23 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -109,7 +109,7 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue valu
         // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
         if (!value.isObject() && !value.isNull())
             return;
-        if (!setPrototypeWithCycleCheck(value))
+        if (!setPrototypeWithCycleCheck(exec->globalData(), value))
             throwError(exec, createError(exec, "cyclic __proto__ value"));
         return;
     }
@@ -127,14 +127,14 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue valu
     
     unsigned attributes;
     JSCell* specificValue;
-    if ((m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly) {
+    if ((m_structure->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly) {
         if (slot.isStrictMode())
             throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
         return;
     }
 
     for (JSObject* obj = this; ; obj = asObject(prototype)) {
-        if (JSValue gs = obj->getDirect(propertyName)) {
+        if (JSValue gs = obj->getDirect(exec->globalData(), propertyName)) {
             if (gs.isGetterSetter()) {
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
@@ -218,10 +218,10 @@ bool JSObject::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     unsigned attributes;
     JSCell* specificValue;
-    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) {
+    if (m_structure->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound) {
         if ((attributes & DontDelete))
             return false;
-        removeDirect(propertyName);
+        removeDirect(exec->globalData(), propertyName);
         return true;
     }
 
@@ -312,34 +312,33 @@ const HashEntry* JSObject::findPropertyHashEntry(ExecState* exec, const Identifi
 
 void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
-    JSValue object = getDirect(propertyName);
+    JSValue object = getDirect(exec->globalData(), propertyName);
     if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setGetter(exec->globalData(), getterFunction);
         return;
     }
 
+    JSGlobalData& globalData = exec->globalData();
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter(exec);
-    putDirectInternal(exec->globalData(), propertyName, getterSetter, attributes | Getter, true, slot);
+    putDirectInternal(globalData, propertyName, getterSetter, attributes | Getter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
     // if we override an existing non-getter or non-setter.
     if (slot.type() != PutPropertySlot::NewProperty) {
-        if (!m_structure->isDictionary()) {
-            RefPtr<Structure> structure = Structure::getterSetterTransition(m_structure);
-            setStructure(structure.release());
-        }
+        if (!m_structure->isDictionary())
+            setStructure(exec->globalData(), Structure::getterSetterTransition(globalData, m_structure.get()));
     }
 
     m_structure->setHasGetterSetterProperties(true);
-    getterSetter->setGetter(exec->globalData(), getterFunction);
+    getterSetter->setGetter(globalData, getterFunction);
 }
 
 void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
-    JSValue object = getDirect(propertyName);
+    JSValue object = getDirect(exec->globalData(), propertyName);
     if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setSetter(exec->globalData(), setterFunction);
@@ -354,21 +353,19 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
     // getters and setters, though, we also need to change our Structure
     // if we override an existing non-getter or non-setter.
     if (slot.type() != PutPropertySlot::NewProperty) {
-        if (!m_structure->isDictionary()) {
-            RefPtr<Structure> structure = Structure::getterSetterTransition(m_structure);
-            setStructure(structure.release());
-        }
+        if (!m_structure->isDictionary())
+            setStructure(exec->globalData(), Structure::getterSetterTransition(exec->globalData(), m_structure.get()));
     }
 
     m_structure->setHasGetterSetterProperties(true);
     getterSetter->setSetter(exec->globalData(), setterFunction);
 }
 
-JSValue JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValue value = object->getDirect(propertyName)) {
+        if (JSValue value = object->getDirect(exec->globalData(), propertyName)) {
             if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->getter();
@@ -383,11 +380,11 @@ JSValue JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
     }
 }
 
-JSValue JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValue value = object->getDirect(propertyName)) {
+        if (JSValue value = object->getDirect(exec->globalData(), propertyName)) {
             if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->setter();
@@ -428,10 +425,10 @@ bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyN
     return descriptor.enumerable();
 }
 
-bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
+bool JSObject::getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificValue) const
 {
     unsigned attributes;
-    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
+    if (m_structure->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound)
         return true;
 
     // This could be a function within the static table? - should probably
@@ -464,7 +461,7 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
 
 void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_structure->getPropertyNames(propertyNames, mode);
+    m_structure->getPropertyNames(exec->globalData(), propertyNames, mode);
     getClassPropertyNames(exec, classInfo(), propertyNames, mode);
 }
 
@@ -509,34 +506,33 @@ JSObject* JSObject::unwrappedObject()
     return this;
 }
 
-void JSObject::seal()
+void JSObject::seal(JSGlobalData& globalData)
 {
-    setStructure(Structure::sealTransition(m_structure));
+    setStructure(globalData, Structure::sealTransition(globalData, m_structure.get()));
 }
 
-void JSObject::freeze()
+void JSObject::freeze(JSGlobalData& globalData)
 {
-    setStructure(Structure::freezeTransition(m_structure));
+    setStructure(globalData, Structure::freezeTransition(globalData, m_structure.get()));
 }
 
-void JSObject::preventExtensions()
+void JSObject::preventExtensions(JSGlobalData& globalData)
 {
     if (isExtensible())
-        setStructure(Structure::preventExtensionsTransition(m_structure));
+        setStructure(globalData, Structure::preventExtensionsTransition(globalData, m_structure.get()));
 }
 
-void JSObject::removeDirect(const Identifier& propertyName)
+void JSObject::removeDirect(JSGlobalData& globalData, const Identifier& propertyName)
 {
     size_t offset;
     if (m_structure->isUncacheableDictionary()) {
-        offset = m_structure->removePropertyWithoutTransition(propertyName);
+        offset = m_structure->removePropertyWithoutTransition(globalData, propertyName);
         if (offset != WTF::notFound)
             putUndefinedAtDirectOffset(offset);
         return;
     }
 
-    RefPtr<Structure> structure = Structure::removePropertyTransition(m_structure, propertyName, offset);
-    setStructure(structure.release());
+    setStructure(globalData, Structure::removePropertyTransition(globalData, m_structure.get(), propertyName, offset));
     if (offset != WTF::notFound)
         putUndefinedAtDirectOffset(offset);
 }
@@ -574,7 +570,8 @@ NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, WriteBarr
 
 Structure* JSObject::createInheritorID(JSGlobalData& globalData)
 {
-    m_inheritorID = createEmptyObjectStructure(globalData, this);
+    m_inheritorID.set(globalData, this, createEmptyObjectStructure(globalData, this));
+    ASSERT(m_inheritorID->isEmpty());
     return m_inheritorID.get();
 }
 
@@ -598,11 +595,11 @@ void JSObject::allocatePropertyStorage(size_t oldSize, size_t newSize)
     m_propertyStorage = newPropertyStorage;
 }
 
-bool JSObject::getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     unsigned attributes = 0;
     JSCell* cell = 0;
-    size_t offset = m_structure->get(propertyName, attributes, cell);
+    size_t offset = m_structure->get(exec->globalData(), propertyName, attributes, cell);
     if (offset == WTF::notFound)
         return false;
     descriptor.setDescriptor(getDirectOffset(offset), attributes);
@@ -754,7 +751,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
             return false;
         }
     }
-    JSValue accessor = getDirect(propertyName);
+    JSValue accessor = getDirect(exec->globalData(), propertyName);
     if (!accessor)
         return false;
     GetterSetter* getterSetter = asGetterSetter(accessor);
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 578b3cf..80735f8 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -29,7 +29,6 @@
 #include "Completion.h"
 #include "CallFrame.h"
 #include "JSCell.h"
-#include "JSNumberCell.h"
 #include "MarkStack.h"
 #include "PropertySlot.h"
 #include "PutPropertySlot.h"
@@ -88,10 +87,10 @@ namespace JSC {
         virtual ~JSObject();
 
         JSValue prototype() const;
-        void setPrototype(JSValue prototype);
-        bool setPrototypeWithCycleCheck(JSValue prototype);
+        void setPrototype(JSGlobalData&, JSValue prototype);
+        bool setPrototypeWithCycleCheck(JSGlobalData&, JSValue prototype);
         
-        void setStructure(NonNullPassRefPtr<Structure>);
+        void setStructure(JSGlobalData&, Structure*);
         Structure* inheritorID(JSGlobalData&);
 
         virtual UString className() const;
@@ -147,22 +146,22 @@ namespace JSC {
         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
-        JSValue getDirect(const Identifier& propertyName) const
+        JSValue getDirect(JSGlobalData& globalData, const Identifier& propertyName) const
         {
-            size_t offset = m_structure->get(propertyName);
+            size_t offset = m_structure->get(globalData, propertyName);
             return offset != WTF::notFound ? getDirectOffset(offset) : JSValue();
         }
 
-        WriteBarrierBase<Unknown>* getDirectLocation(const Identifier& propertyName)
+        WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, const Identifier& propertyName)
         {
-            size_t offset = m_structure->get(propertyName);
+            size_t offset = m_structure->get(globalData, propertyName);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        WriteBarrierBase<Unknown>* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
+        WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, const Identifier& propertyName, unsigned& attributes)
         {
             JSCell* specificFunction;
-            size_t offset = m_structure->get(propertyName, attributes, specificFunction);
+            size_t offset = m_structure->get(globalData, propertyName, attributes, specificFunction);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
@@ -171,9 +170,9 @@ namespace JSC {
             return location - propertyStorage();
         }
 
-        void transitionTo(Structure*);
+        void transitionTo(JSGlobalData&, Structure*);
 
-        void removeDirect(const Identifier& propertyName);
+        void removeDirect(JSGlobalData&, const Identifier& propertyName);
         bool hasCustomProperties() { return !m_structure->isEmpty(); }
         bool hasGetterSetterProperties() { return m_structure->hasGetterSetterProperties(); }
 
@@ -210,17 +209,17 @@ namespace JSC {
         virtual bool isStrictModeFunction() const { return false; }
         virtual bool isErrorInstance() const { return false; }
 
-        void seal();
-        void freeze();
-        void preventExtensions();
-        bool isSealed() { return m_structure->isSealed(); }
-        bool isFrozen() { return m_structure->isFrozen(); }
+        void seal(JSGlobalData&);
+        void freeze(JSGlobalData&);
+        void preventExtensions(JSGlobalData&);
+        bool isSealed(JSGlobalData& globalData) { return m_structure->isSealed(globalData); }
+        bool isFrozen(JSGlobalData& globalData) { return m_structure->isFrozen(globalData); }
         bool isExtensible() { return m_structure->isExtensible(); }
 
         virtual ComplType exceptionType() const { return Throw; }
 
         void allocatePropertyStorage(size_t oldSize, size_t newSize);
-        bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
+        bool isUsingInlineStorage() const { return static_cast<const void*>(m_propertyStorage) == static_cast<const void*>(this + 1); }
 
         static const unsigned baseExternalStorageCapacity = 16;
 
@@ -250,7 +249,7 @@ namespace JSC {
         static JS_EXPORTDATA const ClassInfo s_info;
 
     protected:
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
@@ -264,7 +263,12 @@ namespace JSC {
 
         // To instantiate objects you likely want JSFinalObject, below.
         // To create derived types you likely want JSNonFinalObject, below.
-        JSObject(NonNullPassRefPtr<Structure>, PropertyStorage inlineStorage);
+        JSObject(JSGlobalData&, Structure*, PropertyStorage inlineStorage);
+        JSObject(VPtrStealingHackType, PropertyStorage inlineStorage)
+            : JSCell(VPtrStealingHack)
+            , m_propertyStorage(inlineStorage)
+        {
+        }
 
     private:
         // Nobody should ever ask any of these questions on something already known to be a JSObject.
@@ -299,7 +303,7 @@ namespace JSC {
         Structure* createInheritorID(JSGlobalData&);
 
         PropertyStorage m_propertyStorage;
-        RefPtr<Structure> m_inheritorID;
+        WriteBarrier<Structure> m_inheritorID;
     };
 
 
@@ -320,14 +324,19 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
         friend class JSObject;
 
     public:
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        explicit JSNonFinalObject(NonNullPassRefPtr<Structure> structure)
-            : JSObject(structure, m_inlineStorage)
+        explicit JSNonFinalObject(VPtrStealingHackType)
+            : JSObject(VPtrStealingHack, m_inlineStorage)
+        {
+        }
+    
+        explicit JSNonFinalObject(JSGlobalData& globalData, Structure* structure)
+            : JSObject(globalData, structure, m_inlineStorage)
         {
             ASSERT(!(OBJECT_OFFSETOF(JSNonFinalObject, m_inlineStorage) % sizeof(double)));
             ASSERT(this->structure()->propertyStorageCapacity() == JSNonFinalObject_inlineStorageCapacity);
@@ -343,19 +352,19 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
         friend class JSObject;
 
     public:
-        static JSFinalObject* create(ExecState* exec, NonNullPassRefPtr<Structure> structure)
+        static JSFinalObject* create(ExecState* exec, Structure* structure)
         {
-            return new (exec) JSFinalObject(structure);
+            return new (exec) JSFinalObject(exec->globalData(), structure);
         }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     private:
-        explicit JSFinalObject(NonNullPassRefPtr<Structure> structure)
-            : JSObject(structure, m_inlineStorage)
+        explicit JSFinalObject(JSGlobalData& globalData, Structure* structure)
+            : JSObject(globalData, structure, m_inlineStorage)
         {
             ASSERT(OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage) % sizeof(double) == 0);
             ASSERT(this->structure()->propertyStorageCapacity() == JSFinalObject_inlineStorageCapacity);
@@ -372,12 +381,12 @@ inline size_t JSObject::offsetOfInlineStorage()
     return OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage);
 }
 
-inline JSObject* constructEmptyObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
+inline JSObject* constructEmptyObject(ExecState* exec, Structure* structure)
 {
     return JSFinalObject::create(exec, structure);
 }
 
-inline PassRefPtr<Structure> createEmptyObjectStructure(JSGlobalData& globalData, JSValue prototype)
+inline Structure* createEmptyObjectStructure(JSGlobalData& globalData, JSValue prototype)
 {
     return JSFinalObject::createStructure(globalData, prototype);
 }
@@ -393,22 +402,22 @@ inline JSObject* asObject(JSValue value)
     return asObject(value.asCell());
 }
 
-inline JSObject::JSObject(NonNullPassRefPtr<Structure> structure, PropertyStorage inlineStorage)
-    : JSCell(structure.releaseRef()) // ~JSObject balances this ref()
+inline JSObject::JSObject(JSGlobalData& globalData, Structure* structure, PropertyStorage inlineStorage)
+    : JSCell(globalData, structure)
     , m_propertyStorage(inlineStorage)
 {
     ASSERT(inherits(&s_info));
     ASSERT(m_structure->propertyStorageCapacity() < baseExternalStorageCapacity);
     ASSERT(m_structure->isEmpty());
     ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
+    ASSERT(static_cast<void*>(inlineStorage) == static_cast<void*>(this + 1));
+    ASSERT(m_structure->typeInfo().type() == ObjectType);
 }
 
 inline JSObject::~JSObject()
 {
-    ASSERT(m_structure);
     if (!isUsingInlineStorage())
         delete [] m_propertyStorage;
-    m_structure->deref();
 }
 
 inline JSValue JSObject::prototype() const
@@ -416,7 +425,7 @@ inline JSValue JSObject::prototype() const
     return m_structure->storedPrototype();
 }
 
-inline bool JSObject::setPrototypeWithCycleCheck(JSValue prototype)
+inline bool JSObject::setPrototypeWithCycleCheck(JSGlobalData& globalData, JSValue prototype)
 {
     JSValue nextPrototypeValue = prototype;
     while (nextPrototypeValue && nextPrototypeValue.isObject()) {
@@ -425,27 +434,27 @@ inline bool JSObject::setPrototypeWithCycleCheck(JSValue prototype)
             return false;
         nextPrototypeValue = nextPrototype->prototype();
     }
-    setPrototype(prototype);
+    setPrototype(globalData, prototype);
     return true;
 }
 
-inline void JSObject::setPrototype(JSValue prototype)
+inline void JSObject::setPrototype(JSGlobalData& globalData, JSValue prototype)
 {
     ASSERT(prototype);
-    RefPtr<Structure> newStructure = Structure::changePrototypeTransition(m_structure, prototype);
-    setStructure(newStructure.release());
+    setStructure(globalData, Structure::changePrototypeTransition(globalData, m_structure.get(), prototype));
 }
 
-inline void JSObject::setStructure(NonNullPassRefPtr<Structure> structure)
+inline void JSObject::setStructure(JSGlobalData& globalData, Structure* structure)
 {
-    m_structure->deref();
-    m_structure = structure.leakRef(); // ~JSObject balances this ref()
+    m_structure.set(globalData, this, structure);
 }
 
 inline Structure* JSObject::inheritorID(JSGlobalData& globalData)
 {
-    if (m_inheritorID)
+    if (m_inheritorID) {
+        ASSERT(m_inheritorID->isEmpty());
         return m_inheritorID.get();
+    }
     return createInheritorID(globalData);
 }
 
@@ -471,7 +480,7 @@ inline bool JSValue::inherits(const ClassInfo* classInfo) const
 
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName)) {
+    if (WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName)) {
         if (m_structure->hasGetterSetterProperties() && location->isGetterSetter())
             fillGetterPropertySlot(slot, location);
         else
@@ -557,12 +566,12 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     if (m_structure->isDictionary()) {
         unsigned currentAttributes;
         JSCell* currentSpecificFunction;
-        size_t offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
+        size_t offset = m_structure->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
         if (offset != WTF::notFound) {
             // If there is currently a specific function, and there now either isn't,
             // or the new value is different, then despecify.
             if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
-                m_structure->despecifyDictionaryFunction(propertyName);
+                m_structure->despecifyDictionaryFunction(globalData, propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return false;
 
@@ -582,7 +591,7 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
             return false;
 
         size_t currentCapacity = m_structure->propertyStorageCapacity();
-        offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, specificFunction);
+        offset = m_structure->addPropertyWithoutTransition(globalData, propertyName, attributes, specificFunction);
         if (currentCapacity != m_structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
 
@@ -596,12 +605,12 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
 
     size_t offset;
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    if (RefPtr<Structure> structure = Structure::addPropertyTransitionToExistingStructure(m_structure, propertyName, attributes, specificFunction, offset)) {    
+    if (Structure* structure = Structure::addPropertyTransitionToExistingStructure(m_structure.get(), propertyName, attributes, specificFunction, offset)) {    
         if (currentCapacity != structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
         ASSERT(offset < structure->propertyStorageCapacity());
-        setStructure(structure.release());
+        setStructure(globalData, structure);
         putDirectOffset(globalData, offset, value);
         // This is a new property; transitions with specific values are not currently cachable,
         // so leave the slot in an uncachable state.
@@ -612,7 +621,7 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
 
     unsigned currentAttributes;
     JSCell* currentSpecificFunction;
-    offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
+    offset = m_structure->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
     if (offset != WTF::notFound) {
         if (checkReadOnly && currentAttributes & ReadOnly)
             return false;
@@ -633,7 +642,7 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
                 return true;
             }
             // case (2) Despecify, fall through to (3).
-            setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
+            setStructure(globalData, Structure::despecifyFunctionTransition(globalData, m_structure.get(), propertyName));
         }
 
         // case (3) set the slot, do the put, return.
@@ -645,13 +654,13 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     if (!isExtensible())
         return false;
 
-    RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, specificFunction, offset);
+    Structure* structure = Structure::addPropertyTransition(globalData, m_structure.get(), propertyName, attributes, specificFunction, offset);
 
     if (currentCapacity != structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
     ASSERT(offset < structure->propertyStorageCapacity());
-    setStructure(structure.release());
+    setStructure(globalData, structure);
     putDirectOffset(globalData, offset, value);
     // This is a new property; transitions with specific values are not currently cachable,
     // so leave the slot in an uncachable state.
@@ -707,7 +716,7 @@ inline void JSObject::putDirectFunction(JSGlobalData& globalData, const Identifi
 inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, 0);
+    size_t offset = m_structure->addPropertyWithoutTransition(globalData, propertyName, attributes, 0);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
     putDirectOffset(globalData, offset, value);
@@ -716,17 +725,17 @@ inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, const
 inline void JSObject::putDirectFunctionWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, JSCell* value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, value);
+    size_t offset = m_structure->addPropertyWithoutTransition(globalData, propertyName, attributes, value);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
     putDirectOffset(globalData, offset, value);
 }
 
-inline void JSObject::transitionTo(Structure* newStructure)
+inline void JSObject::transitionTo(JSGlobalData& globalData, Structure* newStructure)
 {
     if (m_structure->propertyStorageCapacity() != newStructure->propertyStorageCapacity())
         allocatePropertyStorage(m_structure->propertyStorageCapacity(), newStructure->propertyStorageCapacity());
-    setStructure(newStructure);
+    setStructure(globalData, newStructure);
 }
 
 inline JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
@@ -814,13 +823,12 @@ inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
 ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
-    
-    markStack.append(m_structure->storedPrototypeSlot());
-    if (*m_structure->cachedPrototypeChainSlot())
-        markStack.append(m_structure->cachedPrototypeChainSlot());
+
     PropertyStorage storage = propertyStorage();
     size_t storageSize = m_structure->propertyStorageSize();
     markStack.appendValues(storage, storageSize);
+    if (m_inheritorID)
+        markStack.append(&m_inheritorID);
 }
 
 // --- JSValue inlines ----------------------------
diff --git a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
index 9370139..2b489a2 100644
--- a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
@@ -30,8 +30,8 @@
 
 namespace JSC {
 
-JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
-    : JSNonFinalObject(structure)
+JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalObject* globalObject, Structure* structure)
+    : JSNonFinalObject(globalObject->globalData(), structure)
 {
     COMPILE_ASSERT(AnonymousSlotCount == 1, AnonymousSlotCount_must_be_one);
     ASSERT(!globalObject || globalObject->isGlobalObject());
@@ -41,9 +41,15 @@ JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalObject* globalObject,
         putAnonymousValue(globalObject->globalData(), GlobalObjectSlot, globalObject);
 }
 
-JSGlobalObject* JSObjectWithGlobalObject::globalObject() const
+JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalData& globalData, JSGlobalObject* globalObject, Structure* structure)
+    : JSNonFinalObject(globalData, structure)
 {
-    return asGlobalObject((getAnonymousValue(GlobalObjectSlot).asCell()));
+    COMPILE_ASSERT(AnonymousSlotCount == 1, AnonymousSlotCount_must_be_one);
+    ASSERT(!globalObject || globalObject->isGlobalObject());
+    if (!globalObject)
+        clearAnonymousValue(GlobalObjectSlot);
+    else
+        putAnonymousValue(globalData, GlobalObjectSlot, globalObject);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
index 8380514..844bcd8 100644
--- a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
@@ -26,7 +26,7 @@
 #ifndef JSObjectWithGlobalObject_h
 #define JSObjectWithGlobalObject_h
 
-#include "JSObject.h"
+#include "JSGlobalObject.h"
 
 namespace JSC {
 
@@ -34,18 +34,22 @@ class JSGlobalObject;
 
 class JSObjectWithGlobalObject : public JSNonFinalObject {
 public:
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue proto)
     {
         return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
-    JSGlobalObject* globalObject() const;
+    JSGlobalObject* globalObject() const
+    {
+        return asGlobalObject((getAnonymousValue(GlobalObjectSlot).asCell()));
+    }
 
 protected:
-    JSObjectWithGlobalObject(JSGlobalObject*, NonNullPassRefPtr<Structure>);
+    JSObjectWithGlobalObject(JSGlobalObject*, Structure*);
+    JSObjectWithGlobalObject(JSGlobalData&, JSGlobalObject*, Structure*);
 
-    JSObjectWithGlobalObject(NonNullPassRefPtr<Structure> structure)
-        : JSNonFinalObject(structure)
+    JSObjectWithGlobalObject(VPtrStealingHackType)
+        : JSNonFinalObject(VPtrStealingHack)
     {
         // Should only be used by JSFunction when we aquire the JSFunction vptr.
     }
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 6f31f99..d5af044 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -35,9 +35,10 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSPropertyNameIterator);
 
+const ClassInfo JSPropertyNameIterator::s_info = { "JSPropertyNameIterator", 0, 0, 0 };
+
 inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
-    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_cachedStructure(0)
+    : JSCell(exec->globalData(), exec->globalData().propertyNameIteratorStructure.get())
     , m_numCacheableSlots(numCacheableSlots)
     , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
     , m_jsStrings(adoptArrayPtr(new WriteBarrier<Unknown>[m_jsStringsSize]))
@@ -71,14 +72,14 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
     
     size_t count = normalizePrototypeChain(exec, o);
     StructureChain* structureChain = o->structure()->prototypeChain(exec);
-    RefPtr<Structure>* structure = structureChain->head();
+    WriteBarrier<Structure>* structure = structureChain->head();
     for (size_t i = 0; i < count; ++i) {
         if (structure[i]->typeInfo().overridesGetPropertyNames())
             return jsPropertyNameIterator;
     }
 
     jsPropertyNameIterator->setCachedPrototypeChain(exec->globalData(), structureChain);
-    jsPropertyNameIterator->setCachedStructure(o->structure());
+    jsPropertyNameIterator->setCachedStructure(exec->globalData(), o->structure());
     o->structure()->setEnumerationCache(exec->globalData(), jsPropertyNameIterator);
     return jsPropertyNameIterator;
 }
@@ -86,7 +87,7 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
 JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 {
     JSValue identifier = m_jsStrings[i].get();
-    if (m_cachedStructure == base->structure() && m_cachedPrototypeChain.get() == base->structure()->prototypeChain(exec))
+    if (m_cachedStructure.get() == base->structure() && m_cachedPrototypeChain.get() == base->structure()->prototypeChain(exec))
         return identifier;
 
     if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value(exec))))
@@ -101,12 +102,4 @@ void JSPropertyNameIterator::markChildren(MarkStack& markStack)
         markStack.append(&m_cachedPrototypeChain);
 }
 
-#if !ASSERT_DISABLED
-
-JSPropertyNameIterator::~JSPropertyNameIterator()
-{
-    ASSERT(!m_cachedStructure || m_cachedStructure->enumerationCache() != this);
-}
-
-#endif
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 499396c..b857dc0 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -45,9 +45,9 @@ namespace JSC {
     public:
         static JSPropertyNameIterator* create(ExecState*, JSObject*);
         
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount, 0);
+            return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount, &s_info);
         }
 
         virtual bool isPropertyNameIterator() const { return true; }
@@ -65,11 +65,11 @@ namespace JSC {
         JSValue get(ExecState*, JSObject*, size_t i);
         size_t size() { return m_jsStringsSize; }
 
-        void setCachedStructure(Structure* structure)
+        void setCachedStructure(JSGlobalData& globalData, Structure* structure)
         {
             ASSERT(!m_cachedStructure);
             ASSERT(structure);
-            m_cachedStructure = structure;
+            m_cachedStructure.set(globalData, this, structure);
         }
         Structure* cachedStructure() { return m_cachedStructure.get(); }
 
@@ -77,13 +77,10 @@ namespace JSC {
         StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
 
     private:
+        static const ClassInfo s_info;
         JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
-        
-#if !ASSERT_DISABLED
-        virtual ~JSPropertyNameIterator();
-#endif
 
-        RefPtr<Structure> m_cachedStructure;
+        WriteBarrier<Structure> m_cachedStructure;
         WriteBarrier<StructureChain> m_cachedPrototypeChain;
         uint32_t m_numCacheableSlots;
         uint32_t m_jsStringsSize;
@@ -93,12 +90,7 @@ namespace JSC {
     inline void Structure::setEnumerationCache(JSGlobalData& globalData, JSPropertyNameIterator* enumerationCache)
     {
         ASSERT(!isDictionary());
-        m_enumerationCache.set(globalData, enumerationCache, 0);
-    }
-
-    inline void Structure::clearEnumerationCache()
-    {
-        m_enumerationCache.clear();
+        m_enumerationCache.set(globalData, this, enumerationCache);
     }
 
     inline JSPropertyNameIterator* Structure::enumerationCache()
diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
index 3e19bbc..8c3a249 100644
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -33,7 +33,7 @@ namespace JSC{
     class JSStaticScopeObject : public JSVariableObject {
     public:
         JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValue value, unsigned attributes)
-            : JSVariableObject(exec->globalData().staticScopeStructure, &m_symbolTable, reinterpret_cast<Register*>(&m_registerStore + 1))
+            : JSVariableObject(exec->globalData(), exec->globalData().staticScopeStructure.get(), &m_symbolTable, reinterpret_cast<Register*>(&m_registerStore + 1))
         {
             m_registerStore.set(exec->globalData(), this, value);
             symbolTable().add(ident.impl(), SymbolTableEntry(-1, attributes));
@@ -47,7 +47,7 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 9113d4a..3422dad 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -26,10 +26,10 @@
 #include "CallFrame.h"
 #include "CommonIdentifiers.h"
 #include "Identifier.h"
-#include "JSNumberCell.h"
 #include "PropertyDescriptor.h"
 #include "PropertySlot.h"
 #include "RopeImpl.h"
+#include "Structure.h"
 
 namespace JSC {
 
@@ -185,7 +185,7 @@ namespace JSC {
         };
 
         ALWAYS_INLINE JSString(JSGlobalData* globalData, const UString& value)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(value.length())
             , m_value(value)
             , m_fiberCount(0)
@@ -196,7 +196,7 @@ namespace JSC {
 
         enum HasOtherOwnerType { HasOtherOwner };
         JSString(JSGlobalData* globalData, const UString& value, HasOtherOwnerType)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(value.length())
             , m_value(value)
             , m_fiberCount(0)
@@ -204,7 +204,7 @@ namespace JSC {
             ASSERT(!m_value.isNull());
         }
         JSString(JSGlobalData* globalData, PassRefPtr<StringImpl> value, HasOtherOwnerType)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(value->length())
             , m_value(value)
             , m_fiberCount(0)
@@ -212,7 +212,7 @@ namespace JSC {
             ASSERT(!m_value.isNull());
         }
         JSString(JSGlobalData* globalData, PassRefPtr<RopeImpl> rope)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(rope->length())
             , m_fiberCount(1)
         {
@@ -221,7 +221,7 @@ namespace JSC {
         // This constructor constructs a new string by concatenating s1 & s2.
         // This should only be called with fiberCount <= 3.
         JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, JSString* s2)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(s1->length() + s2->length())
             , m_fiberCount(fiberCount)
         {
@@ -234,7 +234,7 @@ namespace JSC {
         // This constructor constructs a new string by concatenating s1 & s2.
         // This should only be called with fiberCount <= 3.
         JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, const UString& u2)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(s1->length() + u2.length())
             , m_fiberCount(fiberCount)
         {
@@ -247,7 +247,7 @@ namespace JSC {
         // This constructor constructs a new string by concatenating s1 & s2.
         // This should only be called with fiberCount <= 3.
         JSString(JSGlobalData* globalData, unsigned fiberCount, const UString& u1, JSString* s2)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(u1.length() + s2->length())
             , m_fiberCount(fiberCount)
         {
@@ -262,7 +262,7 @@ namespace JSC {
         // value must require a fiberCount of at least one implies that the length
         // for each value must be exactly 1!
         JSString(ExecState* exec, JSValue v1, JSValue v2, JSValue v3)
-            : JSCell(exec->globalData().stringStructure.get())
+            : JSCell(exec->globalData(), exec->globalData().stringStructure.get())
             , m_length(0)
             , m_fiberCount(s_maxInternalRopeLength)
         {
@@ -275,7 +275,7 @@ namespace JSC {
 
         // This constructor constructs a new string by concatenating u1 & u2.
         JSString(JSGlobalData* globalData, const UString& u1, const UString& u2)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(u1.length() + u2.length())
             , m_fiberCount(2)
         {
@@ -287,7 +287,7 @@ namespace JSC {
 
         // This constructor constructs a new string by concatenating u1, u2 & u3.
         JSString(JSGlobalData* globalData, const UString& u1, const UString& u2, const UString& u3)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(u1.length() + u2.length() + u3.length())
             , m_fiberCount(s_maxInternalRopeLength)
         {
@@ -299,7 +299,7 @@ namespace JSC {
         }
 
         JSString(JSGlobalData* globalData, const UString& value, JSStringFinalizerCallback finalizer, void* context)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(value.length())
             , m_value(value)
             , m_fiberCount(0)
@@ -349,12 +349,11 @@ namespace JSC {
 
         JSValue replaceCharacter(ExecState*, UChar, const UString& replacement);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount, 0); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount, 0); }
 
     private:
-        enum VPtrStealingHackType { VPtrStealingHack };
         JSString(VPtrStealingHackType) 
-            : JSCell(0)
+            : JSCell(VPtrStealingHack)
             , m_fiberCount(0)
         {
         }
diff --git a/Source/JavaScriptCore/runtime/JSType.h b/Source/JavaScriptCore/runtime/JSType.h
index 882b218..dba03f6 100644
--- a/Source/JavaScriptCore/runtime/JSType.h
+++ b/Source/JavaScriptCore/runtime/JSType.h
@@ -33,10 +33,11 @@ namespace JSC {
         NumberType        = 3,
         NullType          = 4,
         StringType        = 5,
+        LeafType          = 6,
         // The CompoundType value must come before any JSType that may have children
-        CompoundType      = 6,
-        ObjectType        = 7,
-        GetterSetterType  = 8
+        CompoundType      = 7,
+        ObjectType        = 8,
+        GetterSetterType  = 9
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSTypeInfo.h b/Source/JavaScriptCore/runtime/JSTypeInfo.h
index 284d2b2..acde81f 100644
--- a/Source/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/Source/JavaScriptCore/runtime/JSTypeInfo.h
@@ -54,6 +54,7 @@ namespace JSC {
         {
             ASSERT(flags <= 0x1FF);
             ASSERT(type <= 0xFF);
+            ASSERT(type >= CompoundType || !(flags & OverridesMarkChildren));
             // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
             if ((m_flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
                 m_flags |= ImplementsDefaultHasInstance;
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index 098123e..de50011 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -30,15 +30,18 @@
 #include <wtf/Assertions.h>
 #include <wtf/HashTraits.h>
 #include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
 
 namespace JSC {
 
+    extern const double NaN;
+    extern const double Inf;
+
     class ExecState;
     class Identifier;
     class JSCell;
     class JSGlobalData;
     class JSGlobalObject;
-    class JSImmediate;
     class JSObject;
     class JSString;
     class PropertySlot;
@@ -48,7 +51,6 @@ namespace JSC {
     struct ClassInfo;
     struct Instruction;
 
-    template <class T> class DeprecatedPtr;
     template <class T> class WriteBarrierBase;
 
     enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
@@ -61,7 +63,7 @@ namespace JSC {
 #endif
     
     union EncodedValueDescriptor {
-        EncodedJSValue asEncodedJSValue;
+        int64_t asInt64;
 #if USE(JSVALUE32_64)
         double asDouble;
 #elif USE(JSVALUE64)
@@ -95,7 +97,6 @@ namespace JSC {
     }
 
     class JSValue {
-        friend class JSImmediate;
         friend struct EncodedJSValueHashTraits;
         friend class JIT;
         friend class JITStubs;
@@ -104,14 +105,9 @@ namespace JSC {
         friend class SpecializedThunkJIT;
 
     public:
-        static EncodedJSValue encode(JSValue value);
-        static JSValue decode(EncodedJSValue ptr);
-#if USE(JSVALUE64)
-    private:
-        static JSValue makeImmediate(intptr_t value);
-        intptr_t immediateValue();
-    public:
-#endif
+        static EncodedJSValue encode(JSValue);
+        static JSValue decode(EncodedJSValue);
+
         enum JSNullTag { JSNull };
         enum JSUndefinedTag { JSUndefined };
         enum JSTrueTag { JSTrue };
@@ -239,7 +235,6 @@ namespace JSC {
 #endif
 
     private:
-        template <class T> JSValue(DeprecatedPtr<T>);
         template <class T> JSValue(WriteBarrierBase<T>);
 
         enum HashTableDeletedValueTag { HashTableDeletedValue };
@@ -253,24 +248,120 @@ namespace JSC {
         JSObject* synthesizeObject(ExecState*) const;
 
 #if USE(JSVALUE32_64)
-        enum { NullTag =         0xffffffff };
-        enum { UndefinedTag =    0xfffffffe };
-        enum { Int32Tag =        0xfffffffd };
-        enum { CellTag =         0xfffffffc };
-        enum { TrueTag =         0xfffffffb };
-        enum { FalseTag =        0xfffffffa };
-        enum { EmptyValueTag =   0xfffffff9 };
-        enum { DeletedValueTag = 0xfffffff8 };
-        
+        /*
+         * On 32-bit platforms USE(JSVALUE32_64) should be defined, and we use a NaN-encoded
+         * form for immediates.
+         *
+         * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
+         * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
+         * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
+         * have a payload of zero.  We assume that non-zero payloads are available to encode
+         * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
+         * all set represents a NaN with a non-zero payload, we can use this space in the NaN
+         * ranges to encode other values (however there are also other ranges of NaN space that
+         * could have been selected).
+         *
+         * For JSValues that do not contain a double value, the high 32 bits contain the tag
+         * values listed in the enums below, which all correspond to NaN-space. In the case of
+         * cell, integer and bool values the lower 32 bits (the 'payload') contain the pointer
+         * integer or boolean value; in the case of all other tags the payload is 0.
+         */
+        enum { Int32Tag =        0xffffffff };
+        enum { BooleanTag =      0xfffffffe };
+        enum { NullTag =         0xfffffffd };
+        enum { UndefinedTag =    0xfffffffc };
+        enum { CellTag =         0xfffffffb };
+        enum { EmptyValueTag =   0xfffffffa };
+        enum { DeletedValueTag = 0xfffffff9 };
+
         enum { LowestTag =  DeletedValueTag };
 
         uint32_t tag() const;
         int32_t payload() const;
-
-        EncodedValueDescriptor u;
 #elif USE(JSVALUE64)
-        JSCell* m_ptr;
+        /*
+         * On 64-bit platforms USE(JSVALUE64) should be defined, and we use a NaN-encoded
+         * form for immediates.
+         *
+         * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
+         * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
+         * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
+         * have a payload of zero.  We assume that non-zero payloads are available to encode
+         * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
+         * all set represents a NaN with a non-zero payload, we can use this space in the NaN
+         * ranges to encode other values (however there are also other ranges of NaN space that
+         * could have been selected).
+         *
+         * This range of NaN space is represented by 64-bit numbers begining with the 16-bit
+         * hex patterns 0xFFFE and 0xFFFF - we rely on the fact that no valid double-precision
+         * numbers will begin fall in these ranges.
+         *
+         * The top 16-bits denote the type of the encoded JSValue:
+         *
+         *     Pointer {  0000:PPPP:PPPP:PPPP
+         *              / 0001:****:****:****
+         *     Double  {         ...
+         *              \ FFFE:****:****:****
+         *     Integer {  FFFF:0000:IIII:IIII
+         *
+         * The scheme we have implemented encodes double precision values by performing a
+         * 64-bit integer addition of the value 2^48 to the number. After this manipulation
+         * no encoded double-precision value will begin with the pattern 0x0000 or 0xFFFF.
+         * Values must be decoded by reversing this operation before subsequent floating point
+         * operations my be peformed.
+         *
+         * 32-bit signed integers are marked with the 16-bit tag 0xFFFF.
+         *
+         * The tag 0x0000 denotes a pointer, or another form of tagged immediate. Boolean,
+         * null and undefined values are represented by specific, invalid pointer values:
+         *
+         *     False:     0x06
+         *     True:      0x07
+         *     Undefined: 0x0a
+         *     Null:      0x02
+         *
+         * These values have the following properties:
+         * - Bit 1 (TagBitTypeOther) is set for all four values, allowing real pointers to be
+         *   quickly distinguished from all immediate values, including these invalid pointers.
+         * - With bit 3 is masked out (TagBitUndefined) Undefined and Null share the
+         *   same value, allowing null & undefined to be quickly detected.
+         *
+         * No valid JSValue will have the bit pattern 0x0, this is used to represent array
+         * holes, and as a C++ 'no value' result (e.g. JSValue() has an internal value of 0).
+         */
+
+        // These values are #defines since using static const integers here is a ~1% regression!
+
+        // This value is 2^48, used to encode doubles such that the encoded value will begin
+        // with a 16-bit pattern within the range 0x0001..0xFFFE.
+        #define DoubleEncodeOffset 0x1000000000000ll
+        // If all bits in the mask are set, this indicates an integer number,
+        // if any but not all are set this value is a double precision number.
+        #define TagTypeNumber 0xffff000000000000ll
+
+        // All non-numeric (bool, null, undefined) immediates have bit 2 set.
+        #define TagBitTypeOther 0x2ll
+        #define TagBitBool      0x4ll
+        #define TagBitUndefined 0x8ll
+        // Combined integer value for non-numeric immediates.
+        #define ValueFalse     (TagBitTypeOther | TagBitBool | false)
+        #define ValueTrue      (TagBitTypeOther | TagBitBool | true)
+        #define ValueUndefined (TagBitTypeOther | TagBitUndefined)
+        #define ValueNull      (TagBitTypeOther)
+
+        // TagMask is used to check for all types of immediate values (either number or 'other').
+        #define TagMask (TagTypeNumber | TagBitTypeOther)
+
+        // These special values are never visible to JavaScript code; Empty is used to represent
+        // Array holes, and for uninitialized JSValues. Deleted is used in hash table code.
+        // These values would map to cell types in the JSValue encoding, but not valid GC cell
+        // pointer should have either of these values (Empty is null, deleted is at an invalid
+        // alignment for a GC cell, and in the zero page).
+        #define ValueEmpty   0x0ll
+        #define ValueDeleted 0x4ll
 #endif
+
+        EncodedValueDescriptor u;
     };
 
 #if USE(JSVALUE32_64)
@@ -373,409 +464,7 @@ namespace JSC {
     inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
     inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
 
-    ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
-    {
-        if (isInt32())
-            return asInt32();
-        return JSC::toInt32(toNumber(exec));
-    }
-
-    inline uint32_t JSValue::toUInt32(ExecState* exec) const
-    {
-        // See comment on JSC::toUInt32, above.
-        return toInt32(exec);
-    }
-
-#if USE(JSVALUE32_64)
-    inline JSValue jsNaN()
-    {
-        return JSValue(nonInlineNaN());
-    }
-
-    // JSValue member functions.
-    inline EncodedJSValue JSValue::encode(JSValue value)
-    {
-        return value.u.asEncodedJSValue;
-    }
-
-    inline JSValue JSValue::decode(EncodedJSValue encodedJSValue)
-    {
-        JSValue v;
-        v.u.asEncodedJSValue = encodedJSValue;
-        return v;
-    }
-
-    inline JSValue::JSValue()
-    {
-        u.asBits.tag = EmptyValueTag;
-        u.asBits.payload = 0;
-    }
-
-    inline JSValue::JSValue(JSNullTag)
-    {
-        u.asBits.tag = NullTag;
-        u.asBits.payload = 0;
-    }
-    
-    inline JSValue::JSValue(JSUndefinedTag)
-    {
-        u.asBits.tag = UndefinedTag;
-        u.asBits.payload = 0;
-    }
-    
-    inline JSValue::JSValue(JSTrueTag)
-    {
-        u.asBits.tag = TrueTag;
-        u.asBits.payload = 0;
-    }
-    
-    inline JSValue::JSValue(JSFalseTag)
-    {
-        u.asBits.tag = FalseTag;
-        u.asBits.payload = 0;
-    }
-
-    inline JSValue::JSValue(HashTableDeletedValueTag)
-    {
-        u.asBits.tag = DeletedValueTag;
-        u.asBits.payload = 0;
-    }
-
-    inline JSValue::JSValue(JSCell* ptr)
-    {
-        if (ptr)
-            u.asBits.tag = CellTag;
-        else
-            u.asBits.tag = EmptyValueTag;
-        u.asBits.payload = reinterpret_cast<int32_t>(ptr);
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!isZombie());
-#endif
-    }
-
-    inline JSValue::JSValue(const JSCell* ptr)
-    {
-        if (ptr)
-            u.asBits.tag = CellTag;
-        else
-            u.asBits.tag = EmptyValueTag;
-        u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!isZombie());
-#endif
-    }
-
-    inline JSValue::operator bool() const
-    {
-        ASSERT(tag() != DeletedValueTag);
-        return tag() != EmptyValueTag;
-    }
-
-    inline bool JSValue::operator==(const JSValue& other) const
-    {
-        return u.asEncodedJSValue == other.u.asEncodedJSValue;
-    }
-
-    inline bool JSValue::operator!=(const JSValue& other) const
-    {
-        return u.asEncodedJSValue != other.u.asEncodedJSValue;
-    }
-
-    inline bool JSValue::isUndefined() const
-    {
-        return tag() == UndefinedTag;
-    }
-
-    inline bool JSValue::isNull() const
-    {
-        return tag() == NullTag;
-    }
-
-    inline bool JSValue::isUndefinedOrNull() const
-    {
-        return isUndefined() || isNull();
-    }
-
-    inline bool JSValue::isCell() const
-    {
-        return tag() == CellTag;
-    }
-
-    inline bool JSValue::isInt32() const
-    {
-        return tag() == Int32Tag;
-    }
-
-    inline bool JSValue::isUInt32() const
-    {
-        return tag() == Int32Tag && asInt32() > -1;
-    }
-
-    inline bool JSValue::isDouble() const
-    {
-        return tag() < LowestTag;
-    }
-
-    inline bool JSValue::isTrue() const
-    {
-        return tag() == TrueTag;
-    }
-
-    inline bool JSValue::isFalse() const
-    {
-        return tag() == FalseTag;
-    }
-
-    inline uint32_t JSValue::tag() const
-    {
-        return u.asBits.tag;
-    }
-    
-    inline int32_t JSValue::payload() const
-    {
-        return u.asBits.payload;
-    }
-    
-    inline int32_t JSValue::asInt32() const
-    {
-        ASSERT(isInt32());
-        return u.asBits.payload;
-    }
-    
-    inline uint32_t JSValue::asUInt32() const
-    {
-        ASSERT(isUInt32());
-        return u.asBits.payload;
-    }
-    
-    inline double JSValue::asDouble() const
-    {
-        ASSERT(isDouble());
-        return u.asDouble;
-    }
-    
-    ALWAYS_INLINE JSCell* JSValue::asCell() const
-    {
-        ASSERT(isCell());
-        return reinterpret_cast<JSCell*>(u.asBits.payload);
-    }
-
-    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
-    {
-        u.asDouble = d;
-    }
-
-    inline JSValue::JSValue(double d)
-    {
-        const int32_t asInt32 = static_cast<int32_t>(d);
-        if (asInt32 != d || (!asInt32 && signbit(d))) { // true for -0.0
-            u.asDouble = d;
-            return;
-        }
-        *this = JSValue(static_cast<int32_t>(d));
-    }
-
-    inline JSValue::JSValue(char i)
-    {
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(unsigned char i)
-    {
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(short i)
-    {
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(unsigned short i)
-    {
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(int i)
-    {
-        u.asBits.tag = Int32Tag;
-        u.asBits.payload = i;
-    }
-
-    inline JSValue::JSValue(unsigned i)
-    {
-        if (static_cast<int32_t>(i) < 0) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(long i)
-    {
-        if (static_cast<int32_t>(i) != i) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(unsigned long i)
-    {
-        if (static_cast<uint32_t>(i) != i) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<uint32_t>(i));
-    }
-
-    inline JSValue::JSValue(long long i)
-    {
-        if (static_cast<int32_t>(i) != i) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(unsigned long long i)
-    {
-        if (static_cast<uint32_t>(i) != i) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<uint32_t>(i));
-    }
-
-    inline bool JSValue::isNumber() const
-    {
-        return isInt32() || isDouble();
-    }
-
-    inline bool JSValue::isBoolean() const
-    {
-        return isTrue() || isFalse();
-    }
-
-    inline bool JSValue::getBoolean(bool& v) const
-    {
-        if (isTrue()) {
-            v = true;
-            return true;
-        }
-        if (isFalse()) {
-            v = false;
-            return true;
-        }
-        
-        return false;
-    }
-
-    inline bool JSValue::getBoolean() const
-    {
-        ASSERT(isBoolean());
-        return tag() == TrueTag;
-    }
-
-    inline double JSValue::uncheckedGetNumber() const
-    {
-        ASSERT(isNumber());
-        return isInt32() ? asInt32() : asDouble();
-    }
-
-    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
-    {
-        return isNumber() ? asValue() : jsNumber(this->toNumber(exec));
-    }
-
-    inline bool JSValue::getNumber(double& result) const
-    {
-        if (isInt32()) {
-            result = asInt32();
-            return true;
-        }
-        if (isDouble()) {
-            result = asDouble();
-            return true;
-        }
-        return false;
-    }
-
-#else // USE(JSVALUE32_64)
-
-    // JSValue member functions.
-    inline EncodedJSValue JSValue::encode(JSValue value)
-    {
-        return reinterpret_cast<EncodedJSValue>(value.m_ptr);
-    }
-
-    inline JSValue JSValue::decode(EncodedJSValue ptr)
-    {
-        return JSValue(reinterpret_cast<JSCell*>(ptr));
-    }
-
-    inline JSValue JSValue::makeImmediate(intptr_t value)
-    {
-        return JSValue(reinterpret_cast<JSCell*>(value));
-    }
-
-    inline intptr_t JSValue::immediateValue()
-    {
-        return reinterpret_cast<intptr_t>(m_ptr);
-    }
-    
-    // 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
-    inline JSValue::JSValue()
-        : m_ptr(0)
-    {
-    }
-
-    // 0x4 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x4, which is in the (invalid) zero page.
-    inline JSValue::JSValue(HashTableDeletedValueTag)
-        : m_ptr(reinterpret_cast<JSCell*>(0x4))
-    {
-    }
-
-    inline JSValue::JSValue(JSCell* ptr)
-        : m_ptr(ptr)
-    {
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!isZombie());
-#endif
-    }
-
-    inline JSValue::JSValue(const JSCell* ptr)
-        : m_ptr(const_cast<JSCell*>(ptr))
-    {
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!isZombie());
-#endif
-    }
-
-    inline JSValue::operator bool() const
-    {
-        return m_ptr;
-    }
-
-    inline bool JSValue::operator==(const JSValue& other) const
-    {
-        return m_ptr == other.m_ptr;
-    }
-
-    inline bool JSValue::operator!=(const JSValue& other) const
-    {
-        return m_ptr != other.m_ptr;
-    }
-
-    inline bool JSValue::isUndefined() const
-    {
-        return asValue() == jsUndefined();
-    }
-
-    inline bool JSValue::isNull() const
-    {
-        return asValue() == jsNull();
-    }
-#endif // USE(JSVALUE32_64)
+    bool isZombie(const JSCell*);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSValueInlineMethods.h b/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
new file mode 100644
index 0000000..b4f6f80
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
@@ -0,0 +1,532 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSValueInlineMethods_h
+#define JSValueInlineMethods_h
+
+#include "JSValue.h"
+
+namespace JSC {
+
+    ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
+    {
+        if (isInt32())
+            return asInt32();
+        return JSC::toInt32(toNumber(exec));
+    }
+
+    inline uint32_t JSValue::toUInt32(ExecState* exec) const
+    {
+        // See comment on JSC::toUInt32, above.
+        return toInt32(exec);
+    }
+
+    inline bool JSValue::isUInt32() const
+    {
+        return isInt32() && asInt32() >= 0;
+    }
+
+    inline uint32_t JSValue::asUInt32() const
+    {
+        ASSERT(isUInt32());
+        return asInt32();
+    }
+
+    inline double JSValue::uncheckedGetNumber() const
+    {
+        ASSERT(isNumber());
+        return isInt32() ? asInt32() : asDouble();
+    }
+
+    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
+    {
+        return isNumber() ? asValue() : jsNumber(this->toNumber(exec));
+    }
+
+    inline JSValue jsNaN()
+    {
+        return JSValue(nonInlineNaN());
+    }
+
+    inline bool JSValue::getNumber(double& result) const
+    {
+        if (isInt32()) {
+            result = asInt32();
+            return true;
+        }
+        if (isDouble()) {
+            result = asDouble();
+            return true;
+        }
+        return false;
+    }
+
+    inline bool JSValue::getBoolean(bool& v) const
+    {
+        if (isTrue()) {
+            v = true;
+            return true;
+        }
+        if (isFalse()) {
+            v = false;
+            return true;
+        }
+        
+        return false;
+    }
+
+    inline JSValue::JSValue(char i)
+    {
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned char i)
+    {
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(short i)
+    {
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned short i)
+    {
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned i)
+    {
+        if (static_cast<int32_t>(i) < 0) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(long i)
+    {
+        if (static_cast<int32_t>(i) != i) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned long i)
+    {
+        if (static_cast<uint32_t>(i) != i) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<uint32_t>(i));
+    }
+
+    inline JSValue::JSValue(long long i)
+    {
+        if (static_cast<int32_t>(i) != i) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned long long i)
+    {
+        if (static_cast<uint32_t>(i) != i) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<uint32_t>(i));
+    }
+
+    inline JSValue::JSValue(double d)
+    {
+        const int32_t asInt32 = static_cast<int32_t>(d);
+        if (asInt32 != d || (!asInt32 && signbit(d))) { // true for -0.0
+            *this = JSValue(EncodeAsDouble, d);
+            return;
+        }
+        *this = JSValue(static_cast<int32_t>(d));
+    }
+
+#if USE(JSVALUE32_64)
+    inline EncodedJSValue JSValue::encode(JSValue value)
+    {
+        return value.u.asInt64;
+    }
+
+    inline JSValue JSValue::decode(EncodedJSValue encodedJSValue)
+    {
+        JSValue v;
+        v.u.asInt64 = encodedJSValue;
+        return v;
+    }
+
+    inline JSValue::JSValue()
+    {
+        u.asBits.tag = EmptyValueTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(JSNullTag)
+    {
+        u.asBits.tag = NullTag;
+        u.asBits.payload = 0;
+    }
+    
+    inline JSValue::JSValue(JSUndefinedTag)
+    {
+        u.asBits.tag = UndefinedTag;
+        u.asBits.payload = 0;
+    }
+    
+    inline JSValue::JSValue(JSTrueTag)
+    {
+        u.asBits.tag = BooleanTag;
+        u.asBits.payload = 1;
+    }
+    
+    inline JSValue::JSValue(JSFalseTag)
+    {
+        u.asBits.tag = BooleanTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(HashTableDeletedValueTag)
+    {
+        u.asBits.tag = DeletedValueTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(JSCell* ptr)
+    {
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
+        u.asBits.payload = reinterpret_cast<int32_t>(ptr);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
+    }
+
+    inline JSValue::JSValue(const JSCell* ptr)
+    {
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
+        u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
+    }
+
+    inline JSValue::operator bool() const
+    {
+        ASSERT(tag() != DeletedValueTag);
+        return tag() != EmptyValueTag;
+    }
+
+    inline bool JSValue::operator==(const JSValue& other) const
+    {
+        return u.asInt64 == other.u.asInt64;
+    }
+
+    inline bool JSValue::operator!=(const JSValue& other) const
+    {
+        return u.asInt64 != other.u.asInt64;
+    }
+
+    inline bool JSValue::isUndefined() const
+    {
+        return tag() == UndefinedTag;
+    }
+
+    inline bool JSValue::isNull() const
+    {
+        return tag() == NullTag;
+    }
+
+    inline bool JSValue::isUndefinedOrNull() const
+    {
+        return isUndefined() || isNull();
+    }
+
+    inline bool JSValue::isCell() const
+    {
+        return tag() == CellTag;
+    }
+
+    inline bool JSValue::isInt32() const
+    {
+        return tag() == Int32Tag;
+    }
+
+    inline bool JSValue::isDouble() const
+    {
+        return tag() < LowestTag;
+    }
+
+    inline bool JSValue::isTrue() const
+    {
+        return tag() == BooleanTag && payload();
+    }
+
+    inline bool JSValue::isFalse() const
+    {
+        return tag() == BooleanTag && !payload();
+    }
+
+    inline uint32_t JSValue::tag() const
+    {
+        return u.asBits.tag;
+    }
+    
+    inline int32_t JSValue::payload() const
+    {
+        return u.asBits.payload;
+    }
+    
+    inline int32_t JSValue::asInt32() const
+    {
+        ASSERT(isInt32());
+        return u.asBits.payload;
+    }
+    
+    inline double JSValue::asDouble() const
+    {
+        ASSERT(isDouble());
+        return u.asDouble;
+    }
+    
+    ALWAYS_INLINE JSCell* JSValue::asCell() const
+    {
+        ASSERT(isCell());
+        return reinterpret_cast<JSCell*>(u.asBits.payload);
+    }
+
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
+    {
+        u.asDouble = d;
+    }
+
+    inline JSValue::JSValue(int i)
+    {
+        u.asBits.tag = Int32Tag;
+        u.asBits.payload = i;
+    }
+
+    inline bool JSValue::isNumber() const
+    {
+        return isInt32() || isDouble();
+    }
+
+    inline bool JSValue::isBoolean() const
+    {
+        return isTrue() || isFalse();
+    }
+
+    inline bool JSValue::getBoolean() const
+    {
+        ASSERT(isBoolean());
+        return payload();
+    }
+
+#else // USE(JSVALUE32_64)
+
+    // JSValue member functions.
+    inline EncodedJSValue JSValue::encode(JSValue value)
+    {
+        return value.u.ptr;
+    }
+
+    inline JSValue JSValue::decode(EncodedJSValue ptr)
+    {
+        return JSValue(reinterpret_cast<JSCell*>(ptr));
+    }
+
+    // 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
+    inline JSValue::JSValue()
+    {
+        u.asInt64 = ValueEmpty;
+    }
+
+    // 0x4 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x4, which is in the (invalid) zero page.
+    inline JSValue::JSValue(HashTableDeletedValueTag)
+    {
+        u.asInt64 = ValueDeleted;
+    }
+
+    inline JSValue::JSValue(JSCell* ptr)
+    {
+        u.ptr = ptr;
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
+    }
+
+    inline JSValue::JSValue(const JSCell* ptr)
+    {
+        u.ptr = const_cast<JSCell*>(ptr);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
+    }
+
+    inline JSValue::operator bool() const
+    {
+        return u.ptr;
+    }
+
+    inline bool JSValue::operator==(const JSValue& other) const
+    {
+        return u.ptr == other.u.ptr;
+    }
+
+    inline bool JSValue::operator!=(const JSValue& other) const
+    {
+        return u.ptr != other.u.ptr;
+    }
+
+    inline bool JSValue::isUndefined() const
+    {
+        return asValue() == jsUndefined();
+    }
+
+    inline bool JSValue::isNull() const
+    {
+        return asValue() == jsNull();
+    }
+
+    inline bool JSValue::isTrue() const
+    {
+        return asValue() == JSValue(JSTrue);
+    }
+
+    inline bool JSValue::isFalse() const
+    {
+        return asValue() == JSValue(JSFalse);
+    }
+
+    inline bool JSValue::getBoolean() const
+    {
+        ASSERT(asValue() == jsBoolean(true) || asValue() == jsBoolean(false));
+        return asValue() == jsBoolean(true);
+    }
+
+    inline int32_t JSValue::asInt32() const
+    {
+        ASSERT(isInt32());
+        return static_cast<int32_t>(u.asInt64);
+    }
+
+    inline bool JSValue::isDouble() const
+    {
+        return isNumber() && !isInt32();
+    }
+
+    inline JSValue::JSValue(JSNullTag)
+    {
+        u.asInt64 = ValueNull;
+    }
+    
+    inline JSValue::JSValue(JSUndefinedTag)
+    {
+        u.asInt64 = ValueUndefined;
+    }
+
+    inline JSValue::JSValue(JSTrueTag)
+    {
+        u.asInt64 = ValueTrue;
+    }
+
+    inline JSValue::JSValue(JSFalseTag)
+    {
+        u.asInt64 = ValueFalse;
+    }
+
+    inline bool JSValue::isUndefinedOrNull() const
+    {
+        // Undefined and null share the same value, bar the 'undefined' bit in the extended tag.
+        return (u.asInt64 & ~TagBitUndefined) == ValueNull;
+    }
+
+    inline bool JSValue::isBoolean() const
+    {
+        return (u.asInt64 & ~1) == ValueFalse;
+    }
+
+    inline bool JSValue::isCell() const
+    {
+        return !(u.asInt64 & TagMask);
+    }
+
+    inline bool JSValue::isInt32() const
+    {
+        return (u.asInt64 & TagTypeNumber) == TagTypeNumber;
+    }
+
+    inline intptr_t reinterpretDoubleToIntptr(double value)
+    {
+        return bitwise_cast<intptr_t>(value);
+    }
+    inline double reinterpretIntptrToDouble(intptr_t value)
+    {
+        return bitwise_cast<double>(value);
+    }
+
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
+    {
+        u.asInt64 = reinterpretDoubleToIntptr(d) + DoubleEncodeOffset;
+    }
+
+    inline JSValue::JSValue(int i)
+    {
+        u.asInt64 = TagTypeNumber | static_cast<uint32_t>(i);
+    }
+
+    inline double JSValue::asDouble() const
+    {
+        return reinterpretIntptrToDouble(u.asInt64 - DoubleEncodeOffset);
+    }
+
+    inline bool JSValue::isNumber() const
+    {
+        return u.asInt64 & TagTypeNumber;
+    }
+
+    ALWAYS_INLINE JSCell* JSValue::asCell() const
+    {
+        ASSERT(isCell());
+        return u.ptr;
+    }
+
+#endif // USE(JSVALUE64)
+
+} // namespace JSC
+
+#endif // JSValueInlineMethods_h
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.h b/Source/JavaScriptCore/runtime/JSVariableObject.h
index 891ada8..89bb6b0 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.h
@@ -58,7 +58,7 @@ namespace JSC {
 
         WriteBarrier<Unknown>* const * addressOfRegisters() const { return &m_registers; }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
@@ -66,8 +66,8 @@ namespace JSC {
     protected:
         static const unsigned StructureFlags = OverridesGetPropertyNames | JSObject::StructureFlags;
 
-        JSVariableObject(NonNullPassRefPtr<Structure> structure, SymbolTable* symbolTable, Register* registers)
-            : JSNonFinalObject(structure)
+        JSVariableObject(JSGlobalData& globalData, Structure* structure, SymbolTable* symbolTable, Register* registers)
+            : JSNonFinalObject(globalData, structure)
             , m_symbolTable(symbolTable)
             , m_registers(reinterpret_cast<WriteBarrier<Unknown>*>(registers))
         {
@@ -75,7 +75,7 @@ namespace JSC {
             COMPILE_ASSERT(sizeof(WriteBarrier<Unknown>) == sizeof(Register), Register_should_be_same_size_as_WriteBarrier);
         }
 
-        PassOwnArrayPtr<WriteBarrier<Unknown> > copyRegisterArray(JSGlobalData&, WriteBarrier<Unknown>* src, size_t count);
+        PassOwnArrayPtr<WriteBarrier<Unknown> > copyRegisterArray(JSGlobalData&, WriteBarrier<Unknown>* src, size_t count, size_t callframeStarts);
         void setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray);
 
         bool symbolTableGet(const Identifier&, PropertySlot&);
@@ -137,10 +137,12 @@ namespace JSC {
         return true;
     }
 
-    inline PassOwnArrayPtr<WriteBarrier<Unknown> > JSVariableObject::copyRegisterArray(JSGlobalData& globalData, WriteBarrier<Unknown>* src, size_t count)
+    inline PassOwnArrayPtr<WriteBarrier<Unknown> > JSVariableObject::copyRegisterArray(JSGlobalData& globalData, WriteBarrier<Unknown>* src, size_t count, size_t callframeStarts)
     {
         OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[count]);
-        for (size_t i = 0; i < count; i++)
+        for (size_t i = 0; i < callframeStarts; i++)
+            registerArray[i].set(globalData, this, src[i].get());
+        for (size_t i = callframeStarts + RegisterFile::CallFrameHeaderSize; i < count; i++)
             registerArray[i].set(globalData, this, src[i].get());
 
         return registerArray.release();
diff --git a/Source/JavaScriptCore/runtime/JSWrapperObject.h b/Source/JavaScriptCore/runtime/JSWrapperObject.h
index 63833e9..a7dbe0d 100644
--- a/Source/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/Source/JavaScriptCore/runtime/JSWrapperObject.h
@@ -30,13 +30,13 @@ namespace JSC {
     // Number, Boolean and Date which are wrappers for primitive types.
     class JSWrapperObject : public JSNonFinalObject {
     protected:
-        explicit JSWrapperObject(NonNullPassRefPtr<Structure>);
+        explicit JSWrapperObject(JSGlobalData&, Structure*);
 
     public:
         JSValue internalValue() const;
         void setInternalValue(JSGlobalData&, JSValue);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
@@ -50,8 +50,8 @@ namespace JSC {
         WriteBarrier<Unknown> m_internalValue;
     };
 
-    inline JSWrapperObject::JSWrapperObject(NonNullPassRefPtr<Structure> structure)
-        : JSNonFinalObject(structure)
+    inline JSWrapperObject::JSWrapperObject(JSGlobalData& globalData, Structure* structure)
+        : JSNonFinalObject(globalData, structure)
     {
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSZombie.cpp b/Source/JavaScriptCore/runtime/JSZombie.cpp
index 23cf135..efabc93 100644
--- a/Source/JavaScriptCore/runtime/JSZombie.cpp
+++ b/Source/JavaScriptCore/runtime/JSZombie.cpp
@@ -35,16 +35,6 @@ namespace JSC {
 
 const ClassInfo JSZombie::s_info = { "Zombie", 0, 0, 0 };
 
-Structure* JSZombie::leakedZombieStructure() {
-    static Structure* structure = 0;
-    if (!structure) {
-        Structure::startIgnoringLeaks();
-        structure = Structure::create(jsNull(), TypeInfo(UnspecifiedType), 0, &s_info).leakRef();
-        Structure::stopIgnoringLeaks();
-    }
-    return structure;
-}
-
 }
 
 #endif // ENABLE(JSC_ZOMBIES)
diff --git a/Source/JavaScriptCore/runtime/JSZombie.h b/Source/JavaScriptCore/runtime/JSZombie.h
index 179ff53..0559b96 100644
--- a/Source/JavaScriptCore/runtime/JSZombie.h
+++ b/Source/JavaScriptCore/runtime/JSZombie.h
@@ -27,21 +27,21 @@
 #define JSZombie_h
 
 #include "JSCell.h"
+#include "Structure.h"
 
 #if ENABLE(JSC_ZOMBIES)
 namespace JSC {
 
 class JSZombie : public JSCell {
 public:
-    JSZombie(const ClassInfo* oldInfo, Structure* structure)
-        : JSCell(structure)
+    JSZombie(JSGlobalData& globalData, const ClassInfo* oldInfo, Structure* structure)
+        : JSCell(globalData, structure)
         , m_oldInfo(oldInfo)
     {
         ASSERT(inherits(&s_info));
     }
 
     virtual bool isZombie() const { return true; }
-    static Structure* leakedZombieStructure();
 
     virtual bool isGetterSetter() const { ASSERT_NOT_REACHED(); return false; }
     virtual bool isAPIValueWrapper() const { ASSERT_NOT_REACHED(); return false; }
@@ -66,9 +66,9 @@ public:
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
     
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(globalData, prototype, TypeInfo(ObjectType, 0), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(LeafType, 0), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
diff --git a/Source/JavaScriptCore/runtime/Lookup.cpp b/Source/JavaScriptCore/runtime/Lookup.cpp
index 307bceb..25b516e 100644
--- a/Source/JavaScriptCore/runtime/Lookup.cpp
+++ b/Source/JavaScriptCore/runtime/Lookup.cpp
@@ -73,7 +73,7 @@ void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject*
     ASSERT(thisObj->structure()->anonymousSlotCount() > 0);
     ASSERT(thisObj->getAnonymousValue(0).isCell() && asObject(thisObj->getAnonymousValue(0).asCell())->isGlobalObject());
     ASSERT(entry->attributes() & Function);
-    WriteBarrierBase<Unknown>* location = thisObj->getDirectLocation(propertyName);
+    WriteBarrierBase<Unknown>* location = thisObj->getDirectLocation(exec->globalData(), propertyName);
 
     if (!location) {
         JSFunction* function;
@@ -86,7 +86,7 @@ void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject*
             function = new (exec) JSFunction(exec, globalObject, globalObject->functionStructure(), entry->functionLength(), propertyName, entry->function());
 
         thisObj->putDirectFunction(exec->globalData(), propertyName, function, entry->attributes());
-        location = thisObj->getDirectLocation(propertyName);
+        location = thisObj->getDirectLocation(exec->globalData(), propertyName);
     }
 
     slot.setValue(thisObj, location->get(), thisObj->offsetForLocation(location));
diff --git a/Source/JavaScriptCore/runtime/MathObject.cpp b/Source/JavaScriptCore/runtime/MathObject.cpp
index 7b856a1..52bd76a 100644
--- a/Source/JavaScriptCore/runtime/MathObject.cpp
+++ b/Source/JavaScriptCore/runtime/MathObject.cpp
@@ -86,7 +86,7 @@ const ClassInfo MathObject::s_info = { "Math", &JSObjectWithGlobalObject::s_info
 @end
 */
 
-MathObject::MathObject(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+MathObject::MathObject(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/runtime/MathObject.h b/Source/JavaScriptCore/runtime/MathObject.h
index 26eaae0..75753be 100644
--- a/Source/JavaScriptCore/runtime/MathObject.h
+++ b/Source/JavaScriptCore/runtime/MathObject.h
@@ -27,14 +27,14 @@ namespace JSC {
 
     class MathObject : public JSObjectWithGlobalObject {
     public:
-        MathObject(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        MathObject(ExecState*, JSGlobalObject*, Structure*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index d8fda69..9cd5dcb 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -32,7 +32,7 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 
 const ClassInfo NativeErrorConstructor::s_info = { "Function", &InternalFunction::s_info, 0, 0 };
 
-NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, NonNullPassRefPtr<Structure> prototypeStructure, const UString& nameAndMessage)
+NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* prototypeStructure, const UString& nameAndMessage)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, nameAndMessage))
 {
     ASSERT(inherits(&s_info));
@@ -41,13 +41,23 @@ NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, JSGlobalObject*
 
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
     putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | ReadOnly | DontEnum);
-    m_errorStructure = ErrorInstance::createStructure(exec->globalData(), prototype);
+    m_errorStructure.set(exec->globalData(), this, ErrorInstance::createStructure(exec->globalData(), prototype));
+    ASSERT(m_errorStructure);
+    ASSERT(m_errorStructure->typeInfo().type() == ObjectType);
+}
+
+void NativeErrorConstructor::markChildren(MarkStack& markStack)
+{
+    InternalFunction::markChildren(markStack);
+    if (m_errorStructure)
+        markStack.append(&m_errorStructure);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithNativeErrorConstructor(ExecState* exec)
 {
     JSValue message = exec->argumentCount() ? exec->argument(0) : jsUndefined();
     Structure* errorStructure = static_cast<NativeErrorConstructor*>(exec->callee())->errorStructure();
+    ASSERT(errorStructure);
     return JSValue::encode(ErrorInstance::create(exec, errorStructure, message));
 }
 
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
index 23f798e..e96daf6 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
@@ -31,11 +31,11 @@ namespace JSC {
 
     class NativeErrorConstructor : public InternalFunction {
     public:
-        NativeErrorConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure> structure, NonNullPassRefPtr<Structure> prototypeStructure, const UString&);
+        NativeErrorConstructor(ExecState*, JSGlobalObject*, Structure*, Structure* prototypeStructure, const UString&);
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
@@ -43,10 +43,12 @@ namespace JSC {
         Structure* errorStructure() { return m_errorStructure.get(); }
 
     private:
+        static const unsigned StructureFlags = OverridesMarkChildren | InternalFunction::StructureFlags;
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
+        virtual void markChildren(MarkStack&);
 
-        RefPtr<Structure> m_errorStructure;
+        WriteBarrier<Structure> m_errorStructure;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp b/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
index 4e10268..de27d59 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
@@ -31,7 +31,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NativeErrorPrototype);
 
-NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const UString& nameAndMessage, NativeErrorConstructor* constructor)
+NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const UString& nameAndMessage, NativeErrorConstructor* constructor)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
     putDirect(exec->globalData(), exec->propertyNames().name, jsString(exec, nameAndMessage), 0);
diff --git a/Source/JavaScriptCore/runtime/NativeErrorPrototype.h b/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
index 30690d5..e1b05ce 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
@@ -28,7 +28,7 @@ namespace JSC {
 
     class NativeErrorPrototype : public JSObjectWithGlobalObject {
     public:
-        NativeErrorPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, const UString&, NativeErrorConstructor*);
+        NativeErrorPrototype(ExecState*, JSGlobalObject*, Structure*, const UString&, NativeErrorConstructor*);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NumberConstructor.cpp b/Source/JavaScriptCore/runtime/NumberConstructor.cpp
index aee143a..4193f79 100644
--- a/Source/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -54,7 +54,7 @@ const ClassInfo NumberConstructor::s_info = { "Function", &InternalFunction::s_i
 @end
 */
 
-NumberConstructor::NumberConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, NumberPrototype* numberPrototype)
+NumberConstructor::NumberConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, NumberPrototype* numberPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, numberPrototype->s_info.className))
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/runtime/NumberConstructor.h b/Source/JavaScriptCore/runtime/NumberConstructor.h
index ab4507e..69aa8a1 100644
--- a/Source/JavaScriptCore/runtime/NumberConstructor.h
+++ b/Source/JavaScriptCore/runtime/NumberConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class NumberConstructor : public InternalFunction {
     public:
-        NumberConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, NumberPrototype*);
+        NumberConstructor(ExecState*, JSGlobalObject*, Structure*, NumberPrototype*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
@@ -37,7 +37,7 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
             return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
diff --git a/Source/JavaScriptCore/runtime/NumberObject.cpp b/Source/JavaScriptCore/runtime/NumberObject.cpp
index 74b5e98..6ee103b 100644
--- a/Source/JavaScriptCore/runtime/NumberObject.cpp
+++ b/Source/JavaScriptCore/runtime/NumberObject.cpp
@@ -31,8 +31,8 @@ ASSERT_CLASS_FITS_IN_CELL(NumberObject);
 
 const ClassInfo NumberObject::s_info = { "Number", &JSWrapperObject::s_info, 0, 0 };
 
-NumberObject::NumberObject(JSGlobalData&, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(structure)
+NumberObject::NumberObject(JSGlobalData& globalData, Structure* structure)
+    : JSWrapperObject(globalData, structure)
 {
     ASSERT(inherits(&s_info));
 }
diff --git a/Source/JavaScriptCore/runtime/NumberObject.h b/Source/JavaScriptCore/runtime/NumberObject.h
index 90d0b26..cba65dd 100644
--- a/Source/JavaScriptCore/runtime/NumberObject.h
+++ b/Source/JavaScriptCore/runtime/NumberObject.h
@@ -27,11 +27,11 @@ namespace JSC {
 
     class NumberObject : public JSWrapperObject {
     public:
-        explicit NumberObject(JSGlobalData&, NonNullPassRefPtr<Structure>);
+        explicit NumberObject(JSGlobalData&, Structure*);
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/NumberPrototype.cpp b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
index 6c027b3..24532dd 100644
--- a/Source/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -45,7 +45,7 @@ static EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*);
 
 // ECMA 15.7.4
 
-NumberPrototype::NumberPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* functionStructure)
+NumberPrototype::NumberPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure)
     : NumberObject(exec->globalData(), structure)
 {
     setInternalValue(exec->globalData(), jsNumber(0));
diff --git a/Source/JavaScriptCore/runtime/NumberPrototype.h b/Source/JavaScriptCore/runtime/NumberPrototype.h
index 191ab47..45bdfe7 100644
--- a/Source/JavaScriptCore/runtime/NumberPrototype.h
+++ b/Source/JavaScriptCore/runtime/NumberPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class NumberPrototype : public NumberObject {
     public:
-        NumberPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* functionStructure);
+        NumberPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index c642a5b..aed5e24 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -75,7 +75,7 @@ const ClassInfo ObjectConstructor::s_info = { "Function", &InternalFunction::s_i
 @end
 */
 
-ObjectConstructor::ObjectConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, ObjectPrototype* objectPrototype)
+ObjectConstructor::ObjectConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, ObjectPrototype* objectPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, "Object"))
 {
     // ECMA 15.2.3.1
@@ -342,7 +342,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
     if (!exec->argument(0).isObject() && !exec->argument(0).isNull())
         return throwVMError(exec, createTypeError(exec, "Object prototype may only be an Object or null."));
     JSObject* newObject = constructEmptyObject(exec);
-    newObject->setPrototype(exec->argument(0));
+    newObject->setPrototype(exec->globalData(), exec->argument(0));
     if (exec->argument(1).isUndefined())
         return JSValue::encode(newObject);
     if (!exec->argument(1).isObject())
@@ -355,7 +355,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorSeal(ExecState* exec)
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.seal can only be called on Objects."));
-    asObject(obj)->seal();
+    asObject(obj)->seal(exec->globalData());
     return JSValue::encode(obj);
 }
 
@@ -364,7 +364,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorFreeze(ExecState* exec)
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.freeze can only be called on Objects."));
-    asObject(obj)->freeze();
+    asObject(obj)->freeze(exec->globalData());
     return JSValue::encode(obj);
 }
 
@@ -373,7 +373,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorPreventExtensions(ExecState* exec)
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.preventExtensions can only be called on Objects."));
-    asObject(obj)->preventExtensions();
+    asObject(obj)->preventExtensions(exec->globalData());
     return JSValue::encode(obj);
 }
 
@@ -382,7 +382,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorIsSealed(ExecState* exec)
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.isSealed can only be called on Objects."));
-    return JSValue::encode(jsBoolean(asObject(obj)->isSealed()));
+    return JSValue::encode(jsBoolean(asObject(obj)->isSealed(exec->globalData())));
 }
 
 EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState* exec)
@@ -390,7 +390,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState* exec)
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.isFrozen can only be called on Objects."));
-    return JSValue::encode(jsBoolean(asObject(obj)->isFrozen()));
+    return JSValue::encode(jsBoolean(asObject(obj)->isFrozen(exec->globalData())));
 }
 
 EncodedJSValue JSC_HOST_CALL objectConstructorIsExtensible(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.h b/Source/JavaScriptCore/runtime/ObjectConstructor.h
index b7bfc1d..6ebafcd 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.h
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.h
@@ -29,14 +29,14 @@ namespace JSC {
 
     class ObjectConstructor : public InternalFunction {
     public:
-        ObjectConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, ObjectPrototype*);
+        ObjectConstructor(ExecState*, JSGlobalObject*, Structure*, ObjectPrototype*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
         static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
index 187456f..7469172 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -40,8 +40,8 @@ static EncodedJSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState*);
 static EncodedJSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState*);
 static EncodedJSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState*);
 
-ObjectPrototype::ObjectPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> stucture, Structure* functionStructure)
-    : JSNonFinalObject(stucture)
+ObjectPrototype::ObjectPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* stucture, Structure* functionStructure)
+    : JSNonFinalObject(exec->globalData(), stucture)
     , m_hasNoPropertiesWithUInt32Names(true)
 {
     putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.h b/Source/JavaScriptCore/runtime/ObjectPrototype.h
index 61c8f57..9fb7fae 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.h
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class ObjectPrototype : public JSNonFinalObject {
     public:
-        ObjectPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* functionStructure);
+        ObjectPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
 
     private:
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
diff --git a/Source/JavaScriptCore/runtime/Operations.h b/Source/JavaScriptCore/runtime/Operations.h
index 181f912..c102eeb 100644
--- a/Source/JavaScriptCore/runtime/Operations.h
+++ b/Source/JavaScriptCore/runtime/Operations.h
@@ -24,9 +24,8 @@
 
 #include "ExceptionHelpers.h"
 #include "Interpreter.h"
-#include "JSImmediate.h"
-#include "JSNumberCell.h"
 #include "JSString.h"
+#include "JSValueInlineMethods.h"
 
 namespace JSC {
 
@@ -431,7 +430,7 @@ namespace JSC {
             if (cell->structure()->isDictionary()) {
                 asObject(cell)->flattenDictionaryObject(callFrame->globalData());
                 if (slotBase == cell)
-                    slotOffset = cell->structure()->get(propertyName); 
+                    slotOffset = cell->structure()->get(callFrame->globalData(), propertyName); 
             }
 
             ++count;
diff --git a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
index c000dc8..fc195cd 100644
--- a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -22,6 +22,7 @@
 #define PropertyMapHashTable_h
 
 #include "UString.h"
+#include "WriteBarrier.h"
 #include <wtf/HashTable.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
@@ -73,13 +74,13 @@ struct PropertyMapEntry {
     StringImpl* key;
     unsigned offset;
     unsigned attributes;
-    JSCell* specificValue;
+    WriteBarrier<JSCell> specificValue;
 
-    PropertyMapEntry(StringImpl* key, unsigned offset, unsigned attributes, JSCell* specificValue)
+    PropertyMapEntry(JSGlobalData& globalData, JSCell* owner, StringImpl* key, unsigned offset, unsigned attributes, JSCell* specificValue)
         : key(key)
         , offset(offset)
         , attributes(attributes)
-        , specificValue(specificValue)
+        , specificValue(globalData, owner, specificValue)
     {
     }
 };
@@ -141,9 +142,9 @@ public:
     typedef std::pair<ValueType*, unsigned> find_iterator;
 
     // Constructor is passed an initial capacity, a PropertyTable to copy, or both.
-    PropertyTable(unsigned initialCapacity);
-    PropertyTable(const PropertyTable&);
-    PropertyTable(unsigned initialCapacity, const PropertyTable&);
+    explicit PropertyTable(unsigned initialCapacity);
+    PropertyTable(JSGlobalData&, JSCell*, const PropertyTable&);
+    PropertyTable(JSGlobalData&, JSCell*, unsigned initialCapacity, const PropertyTable&);
     ~PropertyTable();
 
     // Ordered iteration methods.
@@ -176,7 +177,7 @@ public:
     void addDeletedOffset(unsigned offset);
 
     // Copy this PropertyTable, ensuring the copy has at least the capacity provided.
-    PassOwnPtr<PropertyTable> copy(unsigned newCapacity);
+    PassOwnPtr<PropertyTable> copy(JSGlobalData&, JSCell* owner, unsigned newCapacity);
 
 #ifndef NDEBUG
     size_t sizeInMemory();
@@ -184,6 +185,7 @@ public:
 #endif
 
 private:
+    PropertyTable(const PropertyTable&);
     // Used to insert a value known not to be in the table, and where we know capacity to be available.
     void reinsert(const ValueType& entry);
 
@@ -243,7 +245,7 @@ inline PropertyTable::PropertyTable(unsigned initialCapacity)
     ASSERT(isPowerOf2(m_indexSize));
 }
 
-inline PropertyTable::PropertyTable(const PropertyTable& other)
+inline PropertyTable::PropertyTable(JSGlobalData& globalData, JSCell* owner, const PropertyTable& other)
     : m_indexSize(other.m_indexSize)
     , m_indexMask(other.m_indexMask)
     , m_index(static_cast<unsigned*>(fastMalloc(dataSize())))
@@ -255,8 +257,10 @@ inline PropertyTable::PropertyTable(const PropertyTable& other)
     memcpy(m_index, other.m_index, dataSize());
 
     iterator end = this->end();
-    for (iterator iter = begin(); iter != end; ++iter)
+    for (iterator iter = begin(); iter != end; ++iter) {
         iter->key->ref();
+        writeBarrier(globalData, owner, iter->specificValue.get());
+    }
 
     // Copy the m_deletedOffsets vector.
     Vector<unsigned>* otherDeletedOffsets = other.m_deletedOffsets.get();
@@ -264,7 +268,7 @@ inline PropertyTable::PropertyTable(const PropertyTable& other)
         m_deletedOffsets.set(new Vector<unsigned>(*otherDeletedOffsets));
 }
 
-inline PropertyTable::PropertyTable(unsigned initialCapacity, const PropertyTable& other)
+inline PropertyTable::PropertyTable(JSGlobalData& globalData, JSCell* owner, unsigned initialCapacity, const PropertyTable& other)
     : m_indexSize(sizeForCapacity(initialCapacity))
     , m_indexMask(m_indexSize - 1)
     , m_index(static_cast<unsigned*>(fastZeroedMalloc(dataSize())))
@@ -279,6 +283,7 @@ inline PropertyTable::PropertyTable(unsigned initialCapacity, const PropertyTabl
         ASSERT(canInsert());
         reinsert(*iter);
         iter->key->ref();
+        writeBarrier(globalData, owner, iter->specificValue.get());
     }
 
     // Copy the m_deletedOffsets vector.
@@ -443,15 +448,15 @@ inline void PropertyTable::addDeletedOffset(unsigned offset)
     m_deletedOffsets->append(offset);
 }
 
-inline PassOwnPtr<PropertyTable> PropertyTable::copy(unsigned newCapacity)
+inline PassOwnPtr<PropertyTable> PropertyTable::copy(JSGlobalData& globalData, JSCell* owner, unsigned newCapacity)
 {
     ASSERT(newCapacity >= m_keyCount);
 
     // Fast case; if the new table will be the same m_indexSize as this one, we can memcpy it,
     // save rehashing all keys.
     if (sizeForCapacity(newCapacity) == m_indexSize)
-        return new PropertyTable(*this);
-    return new PropertyTable(newCapacity, *this);
+        return new PropertyTable(globalData, owner, *this);
+    return new PropertyTable(globalData, owner, newCapacity, *this);
 }
 
 #ifndef NDEBUG
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
index 19b4b36..3da0198 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -95,7 +95,7 @@ const ClassInfo RegExpConstructor::s_info = { "Function", &InternalFunction::s_i
 @end
 */
 
-RegExpConstructor::RegExpConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, RegExpPrototype* regExpPrototype)
+RegExpConstructor::RegExpConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, RegExpPrototype* regExpPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, "RegExp"))
     , d(adoptPtr(new RegExpConstructorPrivate))
 {
@@ -109,7 +109,7 @@ RegExpConstructor::RegExpConstructor(ExecState* exec, JSGlobalObject* globalObje
 }
 
 RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate* data)
-    : JSArray(exec->lexicalGlobalObject()->regExpMatchesArrayStructure(), data->lastNumSubPatterns + 1, CreateInitialized)
+    : JSArray(exec->globalData(), exec->lexicalGlobalObject()->regExpMatchesArrayStructure(), data->lastNumSubPatterns + 1, CreateInitialized)
 {
     RegExpConstructorPrivate* d = new RegExpConstructorPrivate;
     d->input = data->lastInput;
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.h b/Source/JavaScriptCore/runtime/RegExpConstructor.h
index 5e0b2b8..548664e 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.h
@@ -57,9 +57,9 @@ namespace JSC {
 
     class RegExpConstructor : public InternalFunction {
     public:
-        RegExpConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, RegExpPrototype*);
+        RegExpConstructor(ExecState*, JSGlobalObject*, Structure*, RegExpPrototype*);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index 4b5028b..d824ecd 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -61,7 +61,7 @@ const ClassInfo RegExpObject::s_info = { "RegExp", &JSObjectWithGlobalObject::s_
 @end
 */
 
-RegExpObject::RegExpObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, NonNullPassRefPtr<RegExp> regExp)
+RegExpObject::RegExpObject(JSGlobalObject* globalObject, Structure* structure, NonNullPassRefPtr<RegExp> regExp)
     : JSObjectWithGlobalObject(globalObject, structure)
     , d(adoptPtr(new RegExpObjectData(regExp)))
 {
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.h b/Source/JavaScriptCore/runtime/RegExpObject.h
index fa2024d..4274fff 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.h
+++ b/Source/JavaScriptCore/runtime/RegExpObject.h
@@ -30,7 +30,7 @@ namespace JSC {
     public:
         typedef JSObjectWithGlobalObject Base;
 
-        RegExpObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure>, NonNullPassRefPtr<RegExp>);
+        RegExpObject(JSGlobalObject*, Structure*, NonNullPassRefPtr<RegExp>);
         virtual ~RegExpObject();
 
         void setRegExp(PassRefPtr<RegExp> r) { d->regExp = r; }
@@ -58,7 +58,7 @@ namespace JSC {
 
         static JS_EXPORTDATA const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index 61747b1..5bb8ad8 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -47,7 +47,7 @@ static EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState*);
 
 // ECMA 15.10.5
 
-RegExpPrototype::RegExpPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* functionStructure)
+RegExpPrototype::RegExpPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure)
     : RegExpObject(globalObject, structure, RegExp::create(&exec->globalData(), "", NoFlags))
 {
     putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 2, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.h b/Source/JavaScriptCore/runtime/RegExpPrototype.h
index 70d77d9..2cc5405 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.h
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.h
@@ -28,7 +28,7 @@ namespace JSC {
 
     class RegExpPrototype : public RegExpObject {
     public:
-        RegExpPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* functionStructure);
+        RegExpPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.cpp b/Source/JavaScriptCore/runtime/ScopeChain.cpp
index 4615f9a..026d729 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.cpp
+++ b/Source/JavaScriptCore/runtime/ScopeChain.cpp
@@ -51,6 +51,8 @@ void ScopeChainNode::print()
 
 #endif
 
+const ClassInfo ScopeChainNode::s_info = { "ScopeChainNode", 0, 0, 0 };
+
 int ScopeChainNode::localDepth()
 {
     int scopeDepth = 0;
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.h b/Source/JavaScriptCore/runtime/ScopeChain.h
index cb70a34..d0a2672 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.h
+++ b/Source/JavaScriptCore/runtime/ScopeChain.h
@@ -22,6 +22,7 @@
 #define ScopeChain_h
 
 #include "JSCell.h"
+#include "Structure.h"
 #include <wtf/FastAllocBase.h>
 
 namespace JSC {
@@ -35,7 +36,7 @@ namespace JSC {
     class ScopeChainNode : public JSCell {
     public:
         ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
-            : JSCell(globalData->scopeChainNodeStructure.get())
+            : JSCell(*globalData, globalData->scopeChainNodeStructure.get())
             , globalData(globalData)
             , next(*globalData, this, next)
             , object(*globalData, this, object)
@@ -64,10 +65,11 @@ namespace JSC {
         void print();
 #endif
         
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info); }
         virtual void markChildren(MarkStack&);
     private:
         static const unsigned StructureFlags = OverridesMarkChildren;
+        static const ClassInfo s_info;
     };
 
     inline ScopeChainNode* ScopeChainNode::push(JSObject* o)
diff --git a/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp b/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
index 24c501e..e666dee 100644
--- a/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
+++ b/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
@@ -29,7 +29,7 @@
 namespace JSC {
 
 StrictEvalActivation::StrictEvalActivation(ExecState* exec)
-    : JSNonFinalObject(exec->globalData().strictEvalActivationStructure)
+    : JSNonFinalObject(exec->globalData(), exec->globalData().strictEvalActivationStructure.get())
 {
 }
 
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.cpp b/Source/JavaScriptCore/runtime/StringConstructor.cpp
index ed088e4..560202a 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/StringConstructor.cpp
@@ -48,7 +48,7 @@ static EncodedJSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec)
 
 ASSERT_CLASS_FITS_IN_CELL(StringConstructor);
 
-StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* functionStructure, StringPrototype* stringPrototype)
+StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure, StringPrototype* stringPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, stringPrototype->classInfo()->className))
 {
     // ECMA 15.5.3.1 String.prototype
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.h b/Source/JavaScriptCore/runtime/StringConstructor.h
index 3a42c7e..117cce8 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.h
+++ b/Source/JavaScriptCore/runtime/StringConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class StringConstructor : public InternalFunction {
     public:
-        StringConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* functionStructure, StringPrototype*);
+        StringConstructor(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure, StringPrototype*);
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/Source/JavaScriptCore/runtime/StringObject.cpp b/Source/JavaScriptCore/runtime/StringObject.cpp
index 47e5860..67dc291 100644
--- a/Source/JavaScriptCore/runtime/StringObject.cpp
+++ b/Source/JavaScriptCore/runtime/StringObject.cpp
@@ -29,22 +29,22 @@ ASSERT_CLASS_FITS_IN_CELL(StringObject);
 
 const ClassInfo StringObject::s_info = { "String", &JSWrapperObject::s_info, 0, 0 };
 
-StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
-    : JSWrapperObject(structure)
+StringObject::StringObject(ExecState* exec, Structure* structure)
+    : JSWrapperObject(exec->globalData(), structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsEmptyString(exec));
 }
 
-StringObject::StringObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure, JSString* string)
-    : JSWrapperObject(structure)
+StringObject::StringObject(JSGlobalData& globalData, Structure* structure, JSString* string)
+    : JSWrapperObject(globalData, structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(globalData, string);
 }
 
-StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& string)
-    : JSWrapperObject(structure)
+StringObject::StringObject(ExecState* exec, Structure* structure, const UString& string)
+    : JSWrapperObject(exec->globalData(), structure)
 {
     ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsString(exec, string));
diff --git a/Source/JavaScriptCore/runtime/StringObject.h b/Source/JavaScriptCore/runtime/StringObject.h
index ae3376d..4c16044 100644
--- a/Source/JavaScriptCore/runtime/StringObject.h
+++ b/Source/JavaScriptCore/runtime/StringObject.h
@@ -28,8 +28,8 @@ namespace JSC {
 
     class StringObject : public JSWrapperObject {
     public:
-        StringObject(ExecState*, NonNullPassRefPtr<Structure>);
-        StringObject(ExecState*, NonNullPassRefPtr<Structure>, const UString&);
+        StringObject(ExecState*, Structure*);
+        StringObject(ExecState*, Structure*, const UString&);
 
         static StringObject* create(ExecState*, JSGlobalObject*, JSString*);
 
@@ -45,14 +45,14 @@ namespace JSC {
 
         JSString* internalValue() const { return asString(JSWrapperObject::internalValue());}
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
-        StringObject(JSGlobalData&, NonNullPassRefPtr<Structure>, JSString*);
+        StringObject(JSGlobalData&, Structure*, JSString*);
     };
 
     StringObject* asStringObject(JSValue);
diff --git a/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index e4c7061..3133944 100644
--- a/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -37,12 +37,12 @@ namespace JSC {
         }
 
     private:
-        StringObjectThatMasqueradesAsUndefined(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& string)
+        StringObjectThatMasqueradesAsUndefined(ExecState* exec, Structure* structure, const UString& string)
             : StringObject(exec, structure, string)
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue proto) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
             return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index a6bf4e6..91112a5 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -131,7 +131,7 @@ const ClassInfo StringPrototype::s_info = { "String", &StringObject::s_info, 0,
 */
 
 // ECMA 15.5.4
-StringPrototype::StringPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+StringPrototype::StringPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : StringObject(exec, structure)
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.h b/Source/JavaScriptCore/runtime/StringPrototype.h
index 57def22..6c4b475 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.h
+++ b/Source/JavaScriptCore/runtime/StringPrototype.h
@@ -29,12 +29,12 @@ namespace JSC {
 
     class StringPrototype : public StringObject {
     public:
-        StringPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        StringPrototype(ExecState*, JSGlobalObject*, Structure*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
             return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index 829e3db..dcc8e7c 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -61,21 +61,6 @@ int numRemoves;
 
 namespace JSC {
 
-#ifndef NDEBUG
-static WTF::RefCountedLeakCounter structureCounter("Structure");
-
-#if ENABLE(JSC_MULTIPLE_THREADS)
-static Mutex& ignoreSetMutex()
-{
-    DEFINE_STATIC_LOCAL(Mutex, mutex, ());
-    return mutex;
-}
-#endif
-
-static bool shouldIgnoreLeaks;
-static HashSet<Structure*>& ignoreSet = *(new HashSet<Structure*>);
-#endif
-
 #if DUMP_STRUCTURE_ID_STATISTICS
 static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
 #endif
@@ -106,41 +91,41 @@ inline void StructureTransitionTable::remove(Structure* structure)
         // map mode).
         // As such, the passed structure *must* be the existing transition.
         ASSERT(singleTransition() == structure);
-        setSingleTransition(0);
+        clearSingleTransition();
     } else {
         // Check whether a mapping exists for structure's key, and whether the
         // entry is structure (the latter check may fail if we initially had a
         // transition with a specific value, and this has been despecified).
         TransitionMap::iterator entry = map()->find(make_pair(structure->m_nameInPrevious, structure->m_attributesInPrevious));
-        if (entry != map()->end() && structure == entry->second)
+        if (entry != map()->end() && structure == entry.get().second)
             map()->remove(entry);
     }
 }
 
-inline void StructureTransitionTable::add(Structure* structure)
+inline void StructureTransitionTable::add(JSGlobalData& globalData, Structure* structure)
 {
     if (isUsingSingleSlot()) {
         Structure* existingTransition = singleTransition();
 
         // This handles the first transition being added.
         if (!existingTransition) {
-            setSingleTransition(structure);
+            setSingleTransition(globalData, structure);
             return;
         }
 
         // This handles the second transition being added
         // (or the first transition being despecified!)
         setMap(new TransitionMap());
-        add(existingTransition);
+        add(globalData, existingTransition);
     }
 
     // Add the structure to the map.
-    std::pair<TransitionMap::iterator, bool> result = map()->add(make_pair(structure->m_nameInPrevious, structure->m_attributesInPrevious), structure);
+    std::pair<TransitionMap::iterator, bool> result = map()->add(globalData, make_pair(structure->m_nameInPrevious, structure->m_attributesInPrevious), structure);
     if (!result.second) {
         // There already is an entry! - we should only hit this when despecifying.
-        ASSERT(result.first->second->m_specificValueInPrevious);
+        ASSERT(result.first.get().second->m_specificValueInPrevious);
         ASSERT(!structure->m_specificValueInPrevious);
-        result.first->second = structure;
+        map()->set(result.first, structure);
     }
 }
 
@@ -189,10 +174,10 @@ void Structure::dumpStatistics()
 #endif
 }
 
-Structure::Structure(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount, const ClassInfo* classInfo)
-    : m_typeInfo(typeInfo)
-    , m_prototype(prototype)
-    , m_specificValueInPrevious(0)
+Structure::Structure(JSGlobalData& globalData, JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount, const ClassInfo* classInfo)
+    : JSCell(globalData, globalData.structureStructure.get())
+    , m_typeInfo(typeInfo)
+    , m_prototype(globalData, this, prototype)
     , m_classInfo(classInfo)
     , m_propertyStorageCapacity(typeInfo.isFinal() ? JSFinalObject_inlineStorageCapacity : JSNonFinalObject_inlineStorageCapacity)
     , m_offset(noOffset)
@@ -206,27 +191,36 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo, unsigned anony
     , m_preventExtensions(false)
 {
     ASSERT(m_prototype);
-    ASSERT(m_prototype->isObject() || m_prototype->isNull());
+    ASSERT(m_prototype.isObject() || m_prototype.isNull());
+}
 
-#ifndef NDEBUG
-#if ENABLE(JSC_MULTIPLE_THREADS)
-    MutexLocker protect(ignoreSetMutex());
-#endif
-    if (shouldIgnoreLeaks)
-        ignoreSet.add(this);
-    else
-        structureCounter.increment();
-#endif
+const ClassInfo Structure::s_info = { "Structure", 0, 0, 0 };
 
-#if DUMP_STRUCTURE_ID_STATISTICS
-    liveStructureSet.add(this);
-#endif
+Structure::Structure(JSGlobalData& globalData)
+    : JSCell(globalData, this)
+    , m_typeInfo(CompoundType, OverridesMarkChildren)
+    , m_prototype(globalData, this, jsNull())
+    , m_classInfo(&s_info)
+    , m_propertyStorageCapacity(0)
+    , m_offset(noOffset)
+    , m_dictionaryKind(NoneDictionaryKind)
+    , m_isPinnedPropertyTable(false)
+    , m_hasGetterSetterProperties(false)
+    , m_hasNonEnumerableProperties(false)
+    , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(0)
+    , m_anonymousSlotCount(0)
+    , m_preventExtensions(false)
+{
+    ASSERT(m_prototype);
+    ASSERT(m_prototype.isNull());
+    ASSERT(!globalData.structureStructure);
 }
 
-Structure::Structure(const Structure* previous)
-    : m_typeInfo(previous->typeInfo())
-    , m_prototype(previous->storedPrototype())
-    , m_specificValueInPrevious(0)
+Structure::Structure(JSGlobalData& globalData, const Structure* previous)
+    : JSCell(globalData, globalData.structureStructure.get())
+    , m_typeInfo(previous->typeInfo())
+    , m_prototype(globalData, this, previous->storedPrototype())
     , m_classInfo(previous->m_classInfo)
     , m_propertyStorageCapacity(previous->m_propertyStorageCapacity)
     , m_offset(noOffset)
@@ -240,61 +234,14 @@ Structure::Structure(const Structure* previous)
     , m_preventExtensions(previous->m_preventExtensions)
 {
     ASSERT(m_prototype);
-    ASSERT(m_prototype->isObject() || m_prototype->isNull());
-
-#ifndef NDEBUG
-#if ENABLE(JSC_MULTIPLE_THREADS)
-    MutexLocker protect(ignoreSetMutex());
-#endif
-    if (shouldIgnoreLeaks)
-        ignoreSet.add(this);
-    else
-        structureCounter.increment();
-#endif
-
-#if DUMP_STRUCTURE_ID_STATISTICS
-    liveStructureSet.add(this);
-#endif
+    ASSERT(m_prototype.isObject() || m_prototype.isNull());
 }
 
 Structure::~Structure()
 {
-    if (m_previous) {
-        ASSERT(m_nameInPrevious);
-        m_previous->m_transitionTable.remove(this);
-    }
-
-#ifndef NDEBUG
-#if ENABLE(JSC_MULTIPLE_THREADS)
-    MutexLocker protect(ignoreSetMutex());
-#endif
-    HashSet<Structure*>::iterator it = ignoreSet.find(this);
-    if (it != ignoreSet.end())
-        ignoreSet.remove(it);
-    else
-        structureCounter.decrement();
-#endif
-
-#if DUMP_STRUCTURE_ID_STATISTICS
-    liveStructureSet.remove(this);
-#endif
-}
-
-void Structure::startIgnoringLeaks()
-{
-#ifndef NDEBUG
-    shouldIgnoreLeaks = true;
-#endif
 }
 
-void Structure::stopIgnoringLeaks()
-{
-#ifndef NDEBUG
-    shouldIgnoreLeaks = false;
-#endif
-}
-
-void Structure::materializePropertyMap()
+void Structure::materializePropertyMap(JSGlobalData& globalData)
 {
     ASSERT(!m_propertyTable);
 
@@ -309,7 +256,7 @@ void Structure::materializePropertyMap()
             ASSERT(structure->m_propertyTable);
             ASSERT(!structure->m_previous);
 
-            m_propertyTable = structure->m_propertyTable->copy(m_offset + 1);
+            m_propertyTable = structure->m_propertyTable->copy(globalData, 0, m_offset + 1);
             break;
         }
 
@@ -321,7 +268,7 @@ void Structure::materializePropertyMap()
 
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
-        PropertyMapEntry entry(structure->m_nameInPrevious.get(), m_anonymousSlotCount + structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious);
+        PropertyMapEntry entry(globalData, this, structure->m_nameInPrevious.get(), m_anonymousSlotCount + structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious.get());
         m_propertyTable->add(entry);
     }
 }
@@ -334,27 +281,27 @@ void Structure::growPropertyStorageCapacity()
         m_propertyStorageCapacity *= 2;
 }
 
-void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
+void Structure::despecifyDictionaryFunction(JSGlobalData& globalData, const Identifier& propertyName)
 {
     StringImpl* rep = propertyName.impl();
 
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
 
     ASSERT(isDictionary());
     ASSERT(m_propertyTable);
 
     PropertyMapEntry* entry = m_propertyTable->find(rep).first;
     ASSERT(entry);
-    entry->specificValue = 0;
+    entry->specificValue.clear();
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
+Structure* Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
 
     if (Structure* existingTransition = structure->m_transitionTable.get(propertyName.impl(), attributes)) {
-        JSCell* specificValueInPrevious = existingTransition->m_specificValueInPrevious;
+        JSCell* specificValueInPrevious = existingTransition->m_specificValueInPrevious.get();
         if (specificValueInPrevious && specificValueInPrevious != specificValue)
             return 0;
         ASSERT(existingTransition->m_offset != noOffset);
@@ -367,7 +314,7 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
     return 0;
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
+Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     // If we have a specific function, we may have got to this point if there is
     // already a transition with the correct property name and attributes, but
@@ -387,37 +334,37 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
         specificValue = 0;
 
     if (structure->transitionCount() > s_maxTransitionLength) {
-        RefPtr<Structure> transition = toCacheableDictionaryTransition(structure);
+        Structure* transition = toCacheableDictionaryTransition(globalData, structure);
         ASSERT(structure != transition);
-        offset = transition->put(propertyName, attributes, specificValue);
+        offset = transition->putSpecificValue(globalData, propertyName, attributes, specificValue);
         ASSERT(offset >= structure->m_anonymousSlotCount);
         ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();
-        return transition.release();
+        return transition;
     }
 
-    RefPtr<Structure> transition = create(structure);
+    Structure* transition = create(globalData, structure);
 
-    transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
-    transition->m_previous = structure;
+    transition->m_cachedPrototypeChain.set(globalData, transition, structure->m_cachedPrototypeChain.get());
+    transition->m_previous.set(globalData, transition, structure);
     transition->m_nameInPrevious = propertyName.impl();
     transition->m_attributesInPrevious = attributes;
-    transition->m_specificValueInPrevious = specificValue;
+    transition->m_specificValueInPrevious.set(globalData, transition, specificValue);
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
-            transition->m_propertyTable = structure->m_propertyTable->copy(structure->m_propertyTable->size() + 1);
+            transition->m_propertyTable = structure->m_propertyTable->copy(globalData, 0, structure->m_propertyTable->size() + 1);
         else
             transition->m_propertyTable = structure->m_propertyTable.release();
     } else {
         if (structure->m_previous)
-            transition->materializePropertyMap();
+            transition->materializePropertyMap(globalData);
         else
             transition->createPropertyMap();
     }
 
-    offset = transition->put(propertyName, attributes, specificValue);
+    offset = transition->putSpecificValue(globalData, propertyName, attributes, specificValue);
     ASSERT(offset >= structure->m_anonymousSlotCount);
     ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
     if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
@@ -425,106 +372,106 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
 
     transition->m_offset = offset - structure->m_anonymousSlotCount;
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    structure->m_transitionTable.add(transition.get());
-    return transition.release();
+    structure->m_transitionTable.add(globalData, transition);
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure, const Identifier& propertyName, size_t& offset)
+Structure* Structure::removePropertyTransition(JSGlobalData& globalData, Structure* structure, const Identifier& propertyName, size_t& offset)
 {
     ASSERT(!structure->isUncacheableDictionary());
 
-    RefPtr<Structure> transition = toUncacheableDictionaryTransition(structure);
+    Structure* transition = toUncacheableDictionaryTransition(globalData, structure);
 
     offset = transition->remove(propertyName);
     ASSERT(offset >= structure->m_anonymousSlotCount);
     ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
 
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
+Structure* Structure::changePrototypeTransition(JSGlobalData& globalData, Structure* structure, JSValue prototype)
 {
-    RefPtr<Structure> transition = create(structure);
+    Structure* transition = create(globalData, structure);
 
-    transition->m_prototype = prototype;
+    transition->m_prototype.set(globalData, transition, prototype);
 
     // Don't set m_offset, as one can not transition to this.
 
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
     
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
+Structure* Structure::despecifyFunctionTransition(JSGlobalData& globalData, Structure* structure, const Identifier& replaceFunction)
 {
     ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
-    RefPtr<Structure> transition = create(structure);
+    Structure* transition = create(globalData, structure);
 
     ++transition->m_specificFunctionThrashCount;
 
     // Don't set m_offset, as one can not transition to this.
 
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
 
     if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
-        transition->despecifyAllFunctions();
+        transition->despecifyAllFunctions(globalData);
     else {
-        bool removed = transition->despecifyFunction(replaceFunction);
+        bool removed = transition->despecifyFunction(globalData, replaceFunction);
         ASSERT_UNUSED(removed, removed);
     }
     
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
+Structure* Structure::getterSetterTransition(JSGlobalData& globalData, Structure* structure)
 {
-    RefPtr<Structure> transition = create(structure);
+    Structure* transition = create(globalData, structure);
 
     // Don't set m_offset, as one can not transition to this.
 
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
     
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, DictionaryKind kind)
+Structure* Structure::toDictionaryTransition(JSGlobalData& globalData, Structure* structure, DictionaryKind kind)
 {
     ASSERT(!structure->isUncacheableDictionary());
     
-    RefPtr<Structure> transition = create(structure);
+    Structure* transition = create(globalData, structure);
 
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
     transition->m_dictionaryKind = kind;
     
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::toCacheableDictionaryTransition(Structure* structure)
+Structure* Structure::toCacheableDictionaryTransition(JSGlobalData& globalData, Structure* structure)
 {
-    return toDictionaryTransition(structure, CachedDictionaryKind);
+    return toDictionaryTransition(globalData, structure, CachedDictionaryKind);
 }
 
-PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* structure)
+Structure* Structure::toUncacheableDictionaryTransition(JSGlobalData& globalData, Structure* structure)
 {
-    return toDictionaryTransition(structure, UncachedDictionaryKind);
+    return toDictionaryTransition(globalData, structure, UncachedDictionaryKind);
 }
 
 // In future we may want to cache this transition.
-PassRefPtr<Structure> Structure::sealTransition(Structure* structure)
+Structure* Structure::sealTransition(JSGlobalData& globalData, Structure* structure)
 {
-    RefPtr<Structure> transition = preventExtensionsTransition(structure);
+    Structure* transition = preventExtensionsTransition(globalData, structure);
 
     if (transition->m_propertyTable) {
         PropertyTable::iterator end = transition->m_propertyTable->end();
@@ -532,13 +479,13 @@ PassRefPtr<Structure> Structure::sealTransition(Structure* structure)
             iter->attributes |= DontDelete;
     }
 
-    return transition.release();
+    return transition;
 }
 
 // In future we may want to cache this transition.
-PassRefPtr<Structure> Structure::freezeTransition(Structure* structure)
+Structure* Structure::freezeTransition(JSGlobalData& globalData, Structure* structure)
 {
-    RefPtr<Structure> transition = preventExtensionsTransition(structure);
+    Structure* transition = preventExtensionsTransition(globalData, structure);
 
     if (transition->m_propertyTable) {
         PropertyTable::iterator end = transition->m_propertyTable->end();
@@ -546,32 +493,32 @@ PassRefPtr<Structure> Structure::freezeTransition(Structure* structure)
             iter->attributes |= (DontDelete | ReadOnly);
     }
 
-    return transition.release();
+    return transition;
 }
 
 // In future we may want to cache this transition.
-PassRefPtr<Structure> Structure::preventExtensionsTransition(Structure* structure)
+Structure* Structure::preventExtensionsTransition(JSGlobalData& globalData, Structure* structure)
 {
-    RefPtr<Structure> transition = create(structure);
+    Structure* transition = create(globalData, structure);
 
     // Don't set m_offset, as one can not transition to this.
 
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
     transition->m_preventExtensions = true;
 
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
 // In future we may want to cache this property.
-bool Structure::isSealed()
+bool Structure::isSealed(JSGlobalData& globalData)
 {
     if (isExtensible())
         return false;
 
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
         return true;
 
@@ -584,12 +531,12 @@ bool Structure::isSealed()
 }
 
 // In future we may want to cache this property.
-bool Structure::isFrozen()
+bool Structure::isFrozen(JSGlobalData& globalData)
 {
     if (isExtensible())
         return false;
 
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
         return true;
 
@@ -601,7 +548,7 @@ bool Structure::isFrozen()
     return true;
 }
 
-PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSGlobalData& globalData, JSObject* object)
+Structure* Structure::flattenDictionaryStructure(JSGlobalData& globalData, JSObject* object)
 {
     ASSERT(isDictionary());
     if (isUncacheableDictionary()) {
@@ -630,30 +577,30 @@ PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSGlobalData& global
     return this;
 }
 
-size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
+size_t Structure::addPropertyWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_enumerationCache);
 
     if (m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
         specificValue = 0;
 
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
 
     m_isPinnedPropertyTable = true;
 
-    size_t offset = put(propertyName, attributes, specificValue);
+    size_t offset = putSpecificValue(globalData, propertyName, attributes, specificValue);
     ASSERT(offset >= m_anonymousSlotCount);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
     return offset;
 }
 
-size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName)
+size_t Structure::removePropertyWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName)
 {
     ASSERT(isUncacheableDictionary());
     ASSERT(!m_enumerationCache);
 
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
 
     m_isPinnedPropertyTable = true;
     size_t offset = remove(propertyName);
@@ -688,14 +635,14 @@ inline void Structure::checkConsistency()
 
 #endif
 
-PropertyTable* Structure::copyPropertyTable()
+PropertyTable* Structure::copyPropertyTable(JSGlobalData& globalData, Structure* owner)
 {
-    return m_propertyTable ? new PropertyTable(*m_propertyTable) : 0;
+    return m_propertyTable ? new PropertyTable(globalData, owner, *m_propertyTable) : 0;
 }
 
-size_t Structure::get(StringImpl* propertyName, unsigned& attributes, JSCell*& specificValue)
+size_t Structure::get(JSGlobalData& globalData, StringImpl* propertyName, unsigned& attributes, JSCell*& specificValue)
 {
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
         return WTF::notFound;
 
@@ -704,14 +651,14 @@ size_t Structure::get(StringImpl* propertyName, unsigned& attributes, JSCell*& s
         return WTF::notFound;
 
     attributes = entry->attributes;
-    specificValue = entry->specificValue;
+    specificValue = entry->specificValue.get();
     ASSERT(entry->offset >= m_anonymousSlotCount);
     return entry->offset;
 }
 
-bool Structure::despecifyFunction(const Identifier& propertyName)
+bool Structure::despecifyFunction(JSGlobalData& globalData, const Identifier& propertyName)
 {
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
         return false;
 
@@ -721,25 +668,25 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
         return false;
 
     ASSERT(entry->specificValue);
-    entry->specificValue = 0;
+    entry->specificValue.clear();
     return true;
 }
 
-void Structure::despecifyAllFunctions()
+void Structure::despecifyAllFunctions(JSGlobalData& globalData)
 {
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
         return;
 
     PropertyTable::iterator end = m_propertyTable->end();
     for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter)
-        iter->specificValue = 0;
+        iter->specificValue.clear();
 }
 
-size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
+size_t Structure::putSpecificValue(JSGlobalData& globalData, const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!propertyName.isNull());
-    ASSERT(get(propertyName) == notFound);
+    ASSERT(get(globalData, propertyName) == notFound);
 
     checkConsistency();
     if (attributes & DontEnum)
@@ -758,7 +705,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         newOffset = m_propertyTable->size() + m_anonymousSlotCount;
     ASSERT(newOffset >= m_anonymousSlotCount);
 
-    m_propertyTable->add(PropertyMapEntry(rep, newOffset, attributes, specificValue));
+    m_propertyTable->add(PropertyMapEntry(globalData, this, rep, newOffset, attributes, specificValue));
 
     checkConsistency();
     return newOffset;
@@ -798,9 +745,9 @@ void Structure::createPropertyMap(unsigned capacity)
     checkConsistency();
 }
 
-void Structure::getPropertyNames(PropertyNameArray& propertyNames, EnumerationMode mode)
+void Structure::getPropertyNames(JSGlobalData& globalData, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
         return;
 
@@ -818,11 +765,26 @@ void Structure::getPropertyNames(PropertyNameArray& propertyNames, EnumerationMo
     }
 }
 
-void Structure::initializeThreading()
-{
-#if !defined(NDEBUG) && ENABLE(JSC_MULTIPLE_THREADS)
-    ignoreSetMutex();
-#endif
+void Structure::markChildren(MarkStack& markStack)
+{
+    JSCell::markChildren(markStack);
+    if (m_prototype)
+        markStack.append(&m_prototype);
+    if (m_cachedPrototypeChain)
+        markStack.append(&m_cachedPrototypeChain);
+    if (m_previous)
+        markStack.append(&m_previous);
+    if (m_specificValueInPrevious)
+        markStack.append(&m_specificValueInPrevious);
+    if (m_enumerationCache)
+        markStack.append(&m_enumerationCache);
+    if (m_propertyTable) {
+        PropertyTable::iterator end = m_propertyTable->end();
+        for (PropertyTable::iterator ptr = m_propertyTable->begin(); ptr != end; ++ptr) {
+            if (ptr->specificValue)
+                markStack.append(&ptr->specificValue);
+        }
+    }
 }
 
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index c9f900a..fe9ce6b 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -27,6 +27,7 @@
 #define Structure_h
 
 #include "Identifier.h"
+#include "JSCell.h"
 #include "JSType.h"
 #include "JSValue.h"
 #include "PropertyMapHashTable.h"
@@ -35,7 +36,7 @@
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
 #include "UString.h"
-#include "WeakGCPtr.h"
+#include "Weak.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -54,49 +55,41 @@ namespace JSC {
         IncludeDontEnumProperties
     };
 
-    class Structure : public RefCounted<Structure> {
+    class Structure : public JSCell {
     public:
         friend class StructureTransitionTable;
-        static PassRefPtr<Structure> create(JSGlobalData&, JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount, const ClassInfo* classInfo)
+        static Structure* create(JSGlobalData& globalData, JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount, const ClassInfo* classInfo)
         {
-            return adoptRef(new Structure(prototype, typeInfo, anonymousSlotCount, classInfo));
+            ASSERT(globalData.structureStructure);
+            return new (&globalData) Structure(globalData, prototype, typeInfo, anonymousSlotCount, classInfo);
         }
 
-        enum VPtrStealingHackType { VPtrStealingHack };
-        static PassRefPtr<Structure> create(VPtrStealingHackType, const ClassInfo* classInfo)
-        {
-            return adoptRef(new Structure(jsNull(), TypeInfo(UnspecifiedType), 0, classInfo));
-        }
-
-        static void startIgnoringLeaks();
-        static void stopIgnoringLeaks();
-
         static void dumpStatistics();
 
-        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
-        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
-        static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
-        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
-        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
-        static PassRefPtr<Structure> getterSetterTransition(Structure*);
-        static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
-        static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
-        static PassRefPtr<Structure> sealTransition(Structure*);
-        static PassRefPtr<Structure> freezeTransition(Structure*);
-        static PassRefPtr<Structure> preventExtensionsTransition(Structure*);
-
-        bool isSealed();
-        bool isFrozen();
+        static Structure* addPropertyTransition(JSGlobalData&, Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
+        static Structure* addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
+        static Structure* removePropertyTransition(JSGlobalData&, Structure*, const Identifier& propertyName, size_t& offset);
+        static Structure* changePrototypeTransition(JSGlobalData&, Structure*, JSValue prototype);
+        static Structure* despecifyFunctionTransition(JSGlobalData&, Structure*, const Identifier&);
+        static Structure* getterSetterTransition(JSGlobalData&, Structure*);
+        static Structure* toCacheableDictionaryTransition(JSGlobalData&, Structure*);
+        static Structure* toUncacheableDictionaryTransition(JSGlobalData&, Structure*);
+        static Structure* sealTransition(JSGlobalData&, Structure*);
+        static Structure* freezeTransition(JSGlobalData&, Structure*);
+        static Structure* preventExtensionsTransition(JSGlobalData&, Structure*);
+
+        bool isSealed(JSGlobalData&);
+        bool isFrozen(JSGlobalData&);
         bool isExtensible() const { return !m_preventExtensions; }
 
-        PassRefPtr<Structure> flattenDictionaryStructure(JSGlobalData&, JSObject*);
+        Structure* flattenDictionaryStructure(JSGlobalData&, JSObject*);
 
         ~Structure();
 
         // These should be used with caution.  
-        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
-        size_t removePropertyWithoutTransition(const Identifier& propertyName);
-        void setPrototypeWithoutTransition(JSValue prototype) { m_prototype = prototype; }
+        size_t addPropertyWithoutTransition(JSGlobalData&, const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
+        size_t removePropertyWithoutTransition(JSGlobalData&, const Identifier& propertyName);
+        void setPrototypeWithoutTransition(JSGlobalData& globalData, JSValue prototype) { m_prototype.set(globalData, this, prototype); }
         
         bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
         bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
@@ -104,10 +97,9 @@ namespace JSC {
         const TypeInfo& typeInfo() const { return m_typeInfo; }
 
         JSValue storedPrototype() const { return m_prototype.get(); }
-        DeprecatedPtr<Unknown>* storedPrototypeSlot() { return &m_prototype; }
         JSValue prototypeForLookup(ExecState*) const;
         StructureChain* prototypeChain(ExecState*) const;
-        DeprecatedPtr<StructureChain>* cachedPrototypeChainSlot() { return &m_cachedPrototypeChain; }
+        void markChildren(MarkStack&);
 
         Structure* previousID() const { return m_previous.get(); }
 
@@ -116,12 +108,12 @@ namespace JSC {
         unsigned propertyStorageSize() const { return m_anonymousSlotCount + (m_propertyTable ? m_propertyTable->propertyStorageSize() : static_cast<unsigned>(m_offset + 1)); }
         bool isUsingInlineStorage() const;
 
-        size_t get(const Identifier& propertyName);
-        size_t get(StringImpl* propertyName, unsigned& attributes, JSCell*& specificValue);
-        size_t get(const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
+        size_t get(JSGlobalData&, const Identifier& propertyName);
+        size_t get(JSGlobalData&, StringImpl* propertyName, unsigned& attributes, JSCell*& specificValue);
+        size_t get(JSGlobalData& globalData, const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
         {
             ASSERT(!propertyName.isNull());
-            return get(propertyName.impl(), attributes, specificValue);
+            return get(globalData, propertyName.impl(), attributes, specificValue);
         }
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
@@ -134,18 +126,15 @@ namespace JSC {
         
         bool isEmpty() const { return m_propertyTable ? m_propertyTable->isEmpty() : m_offset == noOffset; }
 
-        void despecifyDictionaryFunction(const Identifier& propertyName);
+        void despecifyDictionaryFunction(JSGlobalData&, const Identifier& propertyName);
         void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
 
         void setEnumerationCache(JSGlobalData&, JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
-        void clearEnumerationCache(); // Defined in JSPropertyNameIterator.h.
         JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
-        void getPropertyNames(PropertyNameArray&, EnumerationMode mode);
+        void getPropertyNames(JSGlobalData&, PropertyNameArray&, EnumerationMode mode);
 
         const ClassInfo* classInfo() const { return m_classInfo; }
 
-        static void initializeThreading();
-
         static ptrdiff_t prototypeOffset()
         {
             return OBJECT_OFFSETOF(Structure, m_prototype);
@@ -161,37 +150,47 @@ namespace JSC {
             return OBJECT_OFFSETOF(Structure, m_typeInfo) + TypeInfo::typeOffset();
         }
 
+        static Structure* createStructure(JSGlobalData& globalData)
+        {
+            ASSERT(!globalData.structureStructure);
+            return new (&globalData) Structure(globalData);
+        }
+
     private:
-        Structure(JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount, const ClassInfo*);
-        Structure(const Structure*);
+        Structure(JSGlobalData&, JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount, const ClassInfo*);
+        Structure(JSGlobalData&);
+        Structure(JSGlobalData&, const Structure*);
 
-        static PassRefPtr<Structure> create(const Structure* structure)
+        static Structure* create(JSGlobalData& globalData, const Structure* structure)
         {
-            return adoptRef(new Structure(structure));
+            ASSERT(globalData.structureStructure);
+            return new (&globalData) Structure(globalData, structure);
         }
-        
+
+        static const ClassInfo s_info;
+
         typedef enum { 
             NoneDictionaryKind = 0,
             CachedDictionaryKind = 1,
             UncachedDictionaryKind = 2
         } DictionaryKind;
-        static PassRefPtr<Structure> toDictionaryTransition(Structure*, DictionaryKind);
+        static Structure* toDictionaryTransition(JSGlobalData&, Structure*, DictionaryKind);
 
-        size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
+        size_t putSpecificValue(JSGlobalData&, const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
 
         void createPropertyMap(unsigned keyCount = 0);
         void checkConsistency();
 
-        bool despecifyFunction(const Identifier&);
-        void despecifyAllFunctions();
+        bool despecifyFunction(JSGlobalData&, const Identifier&);
+        void despecifyAllFunctions(JSGlobalData&);
 
-        PropertyTable* copyPropertyTable();
-        void materializePropertyMap();
-        void materializePropertyMapIfNecessary()
+        PropertyTable* copyPropertyTable(JSGlobalData&, Structure* owner);
+        void materializePropertyMap(JSGlobalData&);
+        void materializePropertyMapIfNecessary(JSGlobalData& globalData)
         {
             if (!m_propertyTable && m_previous)
-                materializePropertyMap();
+                materializePropertyMap(globalData);
         }
 
         signed char transitionCount() const
@@ -210,18 +209,18 @@ namespace JSC {
 
         TypeInfo m_typeInfo;
 
-        DeprecatedPtr<Unknown> m_prototype;
-        mutable DeprecatedPtr<StructureChain> m_cachedPrototypeChain;
+        WriteBarrier<Unknown> m_prototype;
+        mutable WriteBarrier<StructureChain> m_cachedPrototypeChain;
 
-        RefPtr<Structure> m_previous;
+        WriteBarrier<Structure> m_previous;
         RefPtr<StringImpl> m_nameInPrevious;
-        JSCell* m_specificValueInPrevious;
+        WriteBarrier<JSCell> m_specificValueInPrevious;
 
         const ClassInfo* m_classInfo;
 
         StructureTransitionTable m_transitionTable;
 
-        WeakGCPtr<JSPropertyNameIterator> m_enumerationCache;
+        WriteBarrier<JSPropertyNameIterator> m_enumerationCache;
 
         OwnPtr<PropertyTable> m_propertyTable;
 
@@ -248,9 +247,9 @@ namespace JSC {
         // 4 free bits
     };
 
-    inline size_t Structure::get(const Identifier& propertyName)
+    inline size_t Structure::get(JSGlobalData& globalData, const Identifier& propertyName)
     {
-        materializePropertyMapIfNecessary();
+        materializePropertyMapIfNecessary(globalData);
         if (!m_propertyTable)
             return notFound;
 
@@ -259,6 +258,48 @@ namespace JSC {
         return entry ? entry->offset : notFound;
     }
 
+    inline bool JSCell::isObject() const
+    {
+        return m_structure->typeInfo().type() == ObjectType;
+    }
+
+    inline bool JSCell::isString() const
+    {
+        return m_structure->typeInfo().type() == StringType;
+    }
+
+    inline const ClassInfo* JSCell::classInfo() const
+    {
+        return m_structure->classInfo();
+    }
+
+    inline Structure* JSCell::createDummyStructure(JSGlobalData& globalData)
+    {
+        return Structure::create(globalData, jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount, 0);
+    }
+
+    inline bool JSValue::needsThisConversion() const
+    {
+        if (UNLIKELY(!isCell()))
+            return true;
+        return asCell()->structure()->typeInfo().needsThisConversion();
+    }
+
+    ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
+    {
+        ASSERT(!m_isCheckingForDefaultMarkViolation);
+        ASSERT(cell);
+        if (Heap::testAndSetMarked(cell))
+            return;
+        if (cell->structure()->typeInfo().type() >= CompoundType)
+            m_values.append(cell);
+    }
+
+    inline StructureTransitionTable::Hash::Key StructureTransitionTable::keyForWeakGCMapFinalizer(void*, Structure* structure)
+    {
+        return Hash::Key(structure->m_nameInPrevious.get(), structure->m_attributesInPrevious);
+    }
+
 } // namespace JSC
 
 #endif // Structure_h
diff --git a/Source/JavaScriptCore/runtime/StructureChain.cpp b/Source/JavaScriptCore/runtime/StructureChain.cpp
index 4fa4a4b..ad6abff 100644
--- a/Source/JavaScriptCore/runtime/StructureChain.cpp
+++ b/Source/JavaScriptCore/runtime/StructureChain.cpp
@@ -31,20 +31,33 @@
 #include <wtf/RefPtr.h>
 
 namespace JSC {
+    
+ClassInfo StructureChain::s_info = { "StructureChain", 0, 0, 0 };
 
-StructureChain::StructureChain(NonNullPassRefPtr<Structure> structure, Structure* head)
-    : JSCell(structure.releaseRef())
+StructureChain::StructureChain(JSGlobalData& globalData, Structure* structure, Structure* head)
+    : JSCell(globalData, structure)
 {
     size_t size = 0;
     for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
         ++size;
     
-    m_vector = adoptArrayPtr(new RefPtr<Structure>[size + 1]);
+    m_vector = adoptArrayPtr(new WriteBarrier<Structure>[size + 1]);
 
     size_t i = 0;
     for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
-        m_vector[i++] = current;
-    m_vector[i] = 0;
+        m_vector[i++].set(globalData, this, current);
+    m_vector[i].clear();
+}
+
+StructureChain::~StructureChain()
+{
+}
+
+void StructureChain::markChildren(MarkStack& markStack)
+{
+    size_t i = 0;
+    while (m_vector[i])
+        markStack.append(&m_vector[i++]);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/StructureChain.h b/Source/JavaScriptCore/runtime/StructureChain.h
index 88592dc..b984be6 100644
--- a/Source/JavaScriptCore/runtime/StructureChain.h
+++ b/Source/JavaScriptCore/runtime/StructureChain.h
@@ -27,6 +27,7 @@
 #define StructureChain_h
 
 #include "JSCell.h"
+#include "Structure.h"
 
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -41,14 +42,17 @@ namespace JSC {
         friend class JIT;
 
     public:
-        static StructureChain* create(JSGlobalData& globalData, Structure* head) { return new (&globalData) StructureChain(globalData.structureChainStructure, head); }
-        RefPtr<Structure>* head() { return m_vector.get(); }
+        static StructureChain* create(JSGlobalData& globalData, Structure* head) { return new (&globalData) StructureChain(globalData, globalData.structureChainStructure.get(), head); }
+        WriteBarrier<Structure>* head() { return m_vector.get(); }
+        void markChildren(MarkStack&);
 
-        static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype) { return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren), 0, 0); }
-    private:
-        StructureChain(NonNullPassRefPtr<Structure>, Structure* head);
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) { return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren), 0, &s_info); }
 
-        OwnArrayPtr<RefPtr<Structure> > m_vector;
+    private:
+        StructureChain(JSGlobalData&, Structure*, Structure* head);
+        ~StructureChain();
+        OwnArrayPtr<WriteBarrier<Structure> > m_vector;
+        static ClassInfo s_info;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/StructureTransitionTable.h b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
index da78e1b..adebad2 100644
--- a/Source/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -27,8 +27,8 @@
 #define StructureTransitionTable_h
 
 #include "UString.h"
+#include "WeakGCMap.h"
 #include <wtf/HashFunctions.h>
-#include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
@@ -69,7 +69,21 @@ class StructureTransitionTable {
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
     };
 
-    typedef HashMap<Hash::Key, Structure*, Hash, HashTraits> TransitionMap;
+    struct WeakGCMapFinalizerCallback {
+        static void* finalizerContextFor(Hash::Key)
+        {
+            return 0;
+        }
+
+        static inline Hash::Key keyForFinalizer(void* context, Structure* structure)
+        {
+            return keyForWeakGCMapFinalizer(context, structure);
+        }
+    };
+
+    typedef WeakGCMap<Hash::Key, Structure, WeakGCMapFinalizerCallback, Hash, HashTraits> TransitionMap;
+
+    static Hash::Key keyForWeakGCMapFinalizer(void* context, Structure*);
 
 public:
     StructureTransitionTable()
@@ -81,9 +95,11 @@ public:
     {
         if (!isUsingSingleSlot())
             delete map();
+        else
+            clearSingleTransition();
     }
 
-    inline void add(Structure*);
+    inline void add(JSGlobalData&, Structure*);
     inline void remove(Structure*);
     inline bool contains(StringImpl* rep, unsigned attributes) const;
     inline Structure* get(StringImpl* rep, unsigned attributes) const;
@@ -100,9 +116,18 @@ private:
         return reinterpret_cast<TransitionMap*>(m_data);
     }
 
+    HandleSlot slot() const
+    {
+        ASSERT(isUsingSingleSlot());
+        return reinterpret_cast<HandleSlot>(m_data & ~UsingSingleSlotFlag);
+    }
+
     void setMap(TransitionMap* map)
     {
         ASSERT(isUsingSingleSlot());
+        
+        if (HandleSlot slot = this->slot())
+            HandleHeap::heapFor(slot)->deallocate(slot);
 
         // This implicitly clears the flag that indicates we're using a single transition
         m_data = reinterpret_cast<intptr_t>(map);
@@ -113,13 +138,31 @@ private:
     Structure* singleTransition() const
     {
         ASSERT(isUsingSingleSlot());
-        return reinterpret_cast<Structure*>(m_data & ~UsingSingleSlotFlag);
+        if (HandleSlot slot = this->slot()) {
+            if (*slot)
+                return reinterpret_cast<Structure*>(slot->asCell());
+        }
+        return 0;
     }
-
-    void setSingleTransition(Structure* structure)
+    
+    void clearSingleTransition()
     {
         ASSERT(isUsingSingleSlot());
-        m_data = reinterpret_cast<intptr_t>(structure) | UsingSingleSlotFlag;
+        if (HandleSlot slot = this->slot())
+            HandleHeap::heapFor(slot)->deallocate(slot);
+    }
+    
+    void setSingleTransition(JSGlobalData& globalData, Structure* structure)
+    {
+        ASSERT(isUsingSingleSlot());
+        HandleSlot slot = this->slot();
+        if (!slot) {
+            slot = globalData.allocateGlobalHandle();
+            HandleHeap::heapFor(slot)->makeWeak(slot, 0, 0);
+            m_data = reinterpret_cast<intptr_t>(slot) | UsingSingleSlotFlag;
+        }
+        HandleHeap::heapFor(slot)->writeBarrier(slot, reinterpret_cast<JSCell*>(structure));
+        *slot = reinterpret_cast<JSCell*>(structure);
     }
 
     intptr_t m_data;
diff --git a/Source/JavaScriptCore/runtime/UString.h b/Source/JavaScriptCore/runtime/UString.h
index 8f6c083..b98e7b4 100644
--- a/Source/JavaScriptCore/runtime/UString.h
+++ b/Source/JavaScriptCore/runtime/UString.h
@@ -252,10 +252,7 @@ template<> struct DefaultHash<JSC::UString> {
     typedef JSC::UStringHash Hash;
 };
 
-template <> struct VectorTraits<JSC::UString> : SimpleClassVectorTraits
-{
-    static const bool canInitializeWithMemset = true;
-};
+template <> struct VectorTraits<JSC::UString> : SimpleClassVectorTraits { };
 
 } // namespace WTF
 
diff --git a/Source/JavaScriptCore/runtime/WeakGCMap.h b/Source/JavaScriptCore/runtime/WeakGCMap.h
index a40e684..5ad1c62 100644
--- a/Source/JavaScriptCore/runtime/WeakGCMap.h
+++ b/Source/JavaScriptCore/runtime/WeakGCMap.h
@@ -34,17 +34,31 @@ namespace JSC {
 
 // A HashMap for GC'd values that removes entries when the associated value
 // dies.
-template<typename KeyType, typename MappedType> class WeakGCMap : private Finalizer {
+template <typename KeyType, typename MappedType> struct DefaultWeakGCMapFinalizerCallback {
+    static void* finalizerContextFor(KeyType key)
+    {
+        return reinterpret_cast<void*>(key);
+    }
+
+    static KeyType keyForFinalizer(void* context, typename HandleTypes<MappedType>::ExternalType)
+    {
+        return reinterpret_cast<KeyType>(context);
+    }
+};
+
+template<typename KeyType, typename MappedType, typename FinalizerCallback = DefaultWeakGCMapFinalizerCallback<KeyType, MappedType>, typename HashArg = typename DefaultHash<KeyType>::Hash, typename KeyTraitsArg = HashTraits<KeyType> >
+class WeakGCMap : private WeakHandleOwner {
     WTF_MAKE_FAST_ALLOCATED;
     WTF_MAKE_NONCOPYABLE(WeakGCMap);
 
-    typedef HashMap<KeyType, HandleSlot> MapType;
+    typedef HashMap<KeyType, HandleSlot, HashArg, KeyTraitsArg> MapType;
     typedef typename HandleTypes<MappedType>::ExternalType ExternalType;
     typedef typename MapType::iterator map_iterator;
 
 public:
 
     struct iterator {
+        friend class WeakGCMap;
         iterator(map_iterator iter)
             : m_iterator(iter)
         {
@@ -62,7 +76,7 @@ public:
         bool operator!=(const iterator& other) const { return m_iterator != other.m_iterator; }
         
     private:
-            map_iterator m_iterator;
+        map_iterator m_iterator;
     };
 
     WeakGCMap()
@@ -78,6 +92,25 @@ public:
         m_map.clear();
     }
 
+    bool contains(const KeyType& key) const
+    {
+        return m_map.contains(key);
+    }
+
+    iterator find(const KeyType& key)
+    {
+        return m_map.find(key);
+    }
+
+    void remove(iterator iter)
+    {
+        ASSERT(iter.m_iterator != m_map.end());
+        HandleSlot slot = iter.m_iterator->second;
+        ASSERT(slot);
+        HandleHeap::heapFor(slot)->deallocate(slot);
+        m_map.remove(iter.m_iterator);
+    }
+
     ExternalType get(const KeyType& key) const
     {
         return HandleTypes<MappedType>::getFromSlot(m_map.get(key));
@@ -88,14 +121,35 @@ public:
         return m_map.get(key);
     }
 
+    pair<iterator, bool> add(JSGlobalData& globalData, const KeyType& key, ExternalType value)
+    {
+        pair<typename MapType::iterator, bool> iter = m_map.add(key, 0);
+        if (iter.second) {
+            HandleSlot slot = globalData.allocateGlobalHandle();
+            iter.first->second = slot;
+            HandleHeap::heapFor(slot)->makeWeak(slot, this, FinalizerCallback::finalizerContextFor(key));
+            HandleHeap::heapFor(slot)->writeBarrier(slot, value);
+            *slot = value;
+        }
+        return iter;
+    }
+    
+    void set(iterator iter, ExternalType value)
+    {
+        HandleSlot slot = iter.m_iterator->second;
+        ASSERT(slot);
+        HandleHeap::heapFor(slot)->writeBarrier(slot, value);
+        *slot = value;
+    }
+
     void set(JSGlobalData& globalData, const KeyType& key, ExternalType value)
     {
         pair<typename MapType::iterator, bool> iter = m_map.add(key, 0);
         HandleSlot slot = iter.first->second;
         if (iter.second) {
             slot = globalData.allocateGlobalHandle();
-            iter.first->second = slot;
             HandleHeap::heapFor(slot)->makeWeak(slot, this, key);
+            iter.first->second = slot;
         }
         HandleHeap::heapFor(slot)->writeBarrier(slot, value);
         *slot = value;
@@ -113,22 +167,6 @@ public:
 
     size_t size() { return m_map.size(); }
 
-    bool deprecatedRemove(const KeyType& key, ExternalType value)
-    {
-        // This only exists in order to allow some semblance of correctness to
-        // the JSWeakObjectMapClear API
-        typename MapType::iterator iter = m_map.find(key);
-        if (iter == m_map.end())
-            return false;
-        HandleSlot slot = iter->second;
-        ExternalType inmap = HandleTypes<MappedType>::getFromSlot(slot);
-        if (inmap && inmap != value)
-            return false;
-        m_map.remove(iter);
-        HandleHeap::heapFor(slot)->deallocate(slot);
-        return true;        
-    }
-
     iterator begin() { return iterator(m_map.begin()); }
     iterator end() { return iterator(m_map.end()); }
     
@@ -138,9 +176,9 @@ public:
     }
     
 private:
-    virtual void finalize(Handle<Unknown>, void* key)
+    virtual void finalize(Handle<Unknown> handle, void* context)
     {
-        HandleSlot slot = m_map.take(static_cast<KeyType>(key));
+        HandleSlot slot = m_map.take(FinalizerCallback::keyForFinalizer(context, HandleTypes<MappedType>::getFromSlot(handle.slot())));
         ASSERT(slot);
         HandleHeap::heapFor(slot)->deallocate(slot);
     }
diff --git a/Source/JavaScriptCore/runtime/WeakGCPtr.h b/Source/JavaScriptCore/runtime/WeakGCPtr.h
deleted file mode 100644
index 3f87b83..0000000
--- a/Source/JavaScriptCore/runtime/WeakGCPtr.h
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WeakGCPtr_h
-#define WeakGCPtr_h
-
-#include "Global.h"
-#include "Heap.h"
-
-namespace JSC {
-// A smart pointer whose get() function returns 0 for cells that have died
-
-template <typename T> class WeakGCPtr : public HandleConverter<WeakGCPtr<T>, T> {
-    WTF_MAKE_NONCOPYABLE(WeakGCPtr);
-
-public:
-    typedef typename HandleTypes<T>::ExternalType ExternalType;
-    
-    WeakGCPtr()
-        : m_slot(0)
-    {
-    }
-    
-    WeakGCPtr(JSGlobalData& globalData, Finalizer* finalizer = 0, void* context = 0)
-        : m_slot(globalData.allocateGlobalHandle())
-    {
-        HandleHeap::heapFor(m_slot)->makeWeak(m_slot, finalizer, context);
-    }
-    
-    WeakGCPtr(JSGlobalData& globalData, ExternalType value, Finalizer* finalizer = 0, void* context = 0)
-        : m_slot(globalData.allocateGlobalHandle())
-    {
-        HandleHeap::heapFor(m_slot)->makeWeak(m_slot, finalizer, context);
-        internalSet(value);
-    }
-
-    ExternalType get() const { return  HandleTypes<T>::getFromSlot(m_slot); }
-    
-    void clear()
-    {
-        if (m_slot)
-            internalSet(ExternalType());
-    }
-    
-    bool operator!() const { return !m_slot || !*m_slot; }
-
-    // This conversion operator allows implicit conversion to bool but not to other integer types.
-    typedef ExternalType (WeakGCPtr::*UnspecifiedBoolType);
-    operator UnspecifiedBoolType*() const { return !*this ? 0 : reinterpret_cast<UnspecifiedBoolType*>(1); }
-
-    ~WeakGCPtr()
-    {
-        if (!m_slot)
-            return;
-        HandleHeap::heapFor(m_slot)->deallocate(m_slot);
-    }
-
-    void set(JSGlobalData& globalData, ExternalType value, Finalizer* finalizer)
-    {
-        if (!this->m_slot) {
-            this->m_slot = globalData.allocateGlobalHandle();
-            HandleHeap::heapFor(this->m_slot)->makeWeak(this->m_slot, finalizer, 0);
-        } else
-            ASSERT(HandleHeap::heapFor(this->m_slot)->getFinalizer(this->m_slot) == finalizer);
-        this->internalSet(value);
-    }
-
-private:
-    void internalSet(ExternalType value)
-    {
-        ASSERT(m_slot);
-        JSValue newValue(HandleTypes<T>::toJSValue(value));
-        HandleHeap::heapFor(m_slot)->writeBarrier(m_slot, newValue);
-        *m_slot = newValue;
-    }
-
-    HandleSlot m_slot;
-};
-
-} // namespace JSC
-
-#endif // WeakGCPtr_h
diff --git a/Source/JavaScriptCore/runtime/WriteBarrier.h b/Source/JavaScriptCore/runtime/WriteBarrier.h
index af018a8..32cb968 100644
--- a/Source/JavaScriptCore/runtime/WriteBarrier.h
+++ b/Source/JavaScriptCore/runtime/WriteBarrier.h
@@ -32,54 +32,17 @@ namespace JSC {
 class JSCell;
 class JSGlobalData;
 
-typedef enum { } Unknown;
-typedef JSValue* HandleSlot;
-
-// FIXME: Remove all uses of this class.
-template <class T> class DeprecatedPtr {
-public:
-    DeprecatedPtr() : m_cell(0) { }
-    DeprecatedPtr(T* cell) : m_cell(reinterpret_cast<JSCell*>(cell)) { }
-    T* get() const { return reinterpret_cast<T*>(m_cell); }
-    T* operator*() const { return static_cast<T*>(m_cell); }
-    T* operator->() const { return static_cast<T*>(m_cell); }
-    
-    JSCell** slot() { return &m_cell; }
-    
-    typedef T* (DeprecatedPtr::*UnspecifiedBoolType);
-    operator UnspecifiedBoolType*() const { return m_cell ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
-
-    bool operator!() const { return !m_cell; }
-
-protected:
-    JSCell* m_cell;
-};
-
-// FIXME: Remove all uses of this class.
-template <> class DeprecatedPtr<Unknown> {
-public:
-    DeprecatedPtr() { }
-    DeprecatedPtr(JSValue value) : m_value(value) { }
-    DeprecatedPtr(JSCell* value) : m_value(value) { }
-    const JSValue& get() const { return m_value; }
-    const JSValue* operator*() const { return &m_value; }
-    const JSValue* operator->() const { return &m_value; }
-    
-    JSValue* slot() { return &m_value; }
-    
-    typedef JSValue (DeprecatedPtr::*UnspecifiedBoolType);
-    operator UnspecifiedBoolType*() const { return m_value ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
-    bool operator!() const { return !m_value; }
-    
-private:
-    JSValue m_value;
-};
+inline void writeBarrier(JSGlobalData&, const JSCell*, JSValue)
+{
+}
 
-template <typename U, typename V> inline bool operator==(const DeprecatedPtr<U>& lhs, const DeprecatedPtr<V>& rhs)
+inline void writeBarrier(JSGlobalData&, const JSCell*, JSCell*)
 {
-    return lhs.get() == rhs.get();
 }
 
+typedef enum { } Unknown;
+typedef JSValue* HandleSlot;
+
 template <typename T> struct JSValueChecker {
     static const bool IsJSValue = false;
 };
@@ -92,11 +55,36 @@ template <> struct JSValueChecker<JSValue> {
 template <typename T> class WriteBarrierBase {
 public:
     COMPILE_ASSERT(!JSValueChecker<T>::IsJSValue, WriteBarrier_JSValue_is_invalid__use_unknown);
-    void set(JSGlobalData&, const JSCell*, T* value) { this->m_cell = reinterpret_cast<JSCell*>(value); }
+    void set(JSGlobalData& globalData, const JSCell* owner, T* value)
+    {
+        this->m_cell = reinterpret_cast<JSCell*>(value);
+        writeBarrier(globalData, owner, this->m_cell);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie(owner));
+        ASSERT(!isZombie(m_cell));
+#endif
+    }
     
-    T* get() const { return reinterpret_cast<T*>(m_cell); }
-    T* operator*() const { return static_cast<T*>(m_cell); }
-    T* operator->() const { return static_cast<T*>(m_cell); }
+    T* get() const
+    {
+        return reinterpret_cast<T*>(m_cell);
+    }
+
+    T* operator*() const
+    {
+        ASSERT(m_cell);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie(m_cell));
+#endif
+        return static_cast<T*>(m_cell);
+    }
+
+    T* operator->() const
+    {
+        ASSERT(m_cell);
+        return static_cast<T*>(m_cell);
+    }
+
     void clear() { m_cell = 0; }
     
     JSCell** slot() { return &m_cell; }
@@ -106,7 +94,13 @@ public:
     
     bool operator!() const { return !m_cell; }
 
-    void setWithoutWriteBarrier(T* value) { this->m_cell = reinterpret_cast<JSCell*>(value); }
+    void setWithoutWriteBarrier(T* value)
+    {
+        this->m_cell = reinterpret_cast<JSCell*>(value);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!m_cell || !isZombie(m_cell));
+#endif
+    }
 
 private:
     JSCell* m_cell;
@@ -114,12 +108,32 @@ private:
 
 template <> class WriteBarrierBase<Unknown> {
 public:
-    void set(JSGlobalData&, const JSCell*, JSValue value) { m_value = JSValue::encode(value); }
-    void setWithoutWriteBarrier(JSValue value) { m_value = JSValue::encode(value); }
-    JSValue get() const { return JSValue::decode(m_value); }
+    void set(JSGlobalData& globalData, const JSCell* owner, JSValue value)
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie(owner));
+        ASSERT(!value.isZombie());
+#endif
+        m_value = JSValue::encode(value);
+        writeBarrier(globalData, owner, value);
+    }
+    void setWithoutWriteBarrier(JSValue value)
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!value.isZombie());
+#endif
+        m_value = JSValue::encode(value);
+    }
+
+    JSValue get() const
+    {
+        return JSValue::decode(m_value);
+    }
     void clear() { m_value = JSValue::encode(JSValue()); }
     void setUndefined() { m_value = JSValue::encode(jsUndefined()); }
     bool isNumber() const { return get().isNumber(); }
+    bool isObject() const { return get().isObject(); }
+    bool isNull() const { return get().isNull(); }
     bool isGetterSetter() const { return get().isGetterSetter(); }
     
     JSValue* slot()
diff --git a/Source/JavaScriptCore/wscript b/Source/JavaScriptCore/wscript
index 214ef91..88d3b68 100644
--- a/Source/JavaScriptCore/wscript
+++ b/Source/JavaScriptCore/wscript
@@ -39,7 +39,7 @@ jscore_excludes.extend(get_excludes(jscore_dir, ['*None.cpp']))
 if build_port == "wx":
     if building_on_win32:
         jscore_excludes += ['MarkStackPosix.cpp', 'OSAllocatorPosix.cpp', 'ThreadingPthreads.cpp']
-        sources += ['runtime/MarkStackWin.cpp']
+        sources += ['heap/MarkStackWin.cpp']
     else:
         jscore_excludes.append('JSStringRefBSTR.cpp')
         jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp']))
diff --git a/Source/JavaScriptCore/runtime/JSNumberCell.cpp b/Source/JavaScriptCore/wtf/Alignment.h
index 79f2d2a..2541e01 100644
--- a/Source/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/Source/JavaScriptCore/wtf/Alignment.h
@@ -1,7 +1,5 @@
 /*
- *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
- *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2004, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -20,21 +18,19 @@
  *
  */
 
-#include "config.h"
-#include "JSNumberCell.h"
-#include "JSObject.h"
-#include "ScopeChain.h"
+#ifndef WTF_Alignment_h
+#define WTF_Alignment_h
 
-// Keep our exported symbols lists happy.
-namespace JSC {
+#include <wtf/Platform.h>
 
-JSValue jsNumberCell(ExecState*, double);
-
-JSValue jsNumberCell(ExecState*, double)
-{
-    ASSERT_NOT_REACHED();
-    return JSValue();
-}
-
-} // namespace JSC
+#if COMPILER(GCC) || COMPILER(MINGW) || COMPILER(RVCT) || COMPILER(WINSCW)
+    #define WTF_ALIGN_OF(type) __alignof__(type)
+    #define WTF_ALIGNED(variable_type, variable, n) variable_type variable __attribute__((__aligned__(n)))
+#elif COMPILER(MSVC)
+    #define WTF_ALIGN_OF(type) __alignof(type)
+    #define WTF_ALIGNED(variable_type, variable, n) __declspec(align(n)) variable_type variable
+#else
+    #error WTF_ALIGN macros need alignment control.
+#endif
 
+#endif // WTF_Alignment_h
diff --git a/Source/JavaScriptCore/wtf/Assertions.cpp b/Source/JavaScriptCore/wtf/Assertions.cpp
index 77e30c1..930368c 100644
--- a/Source/JavaScriptCore/wtf/Assertions.cpp
+++ b/Source/JavaScriptCore/wtf/Assertions.cpp
@@ -215,7 +215,7 @@ void WTFReportArgumentAssertionFailure(const char* file, int line, const char* f
 
 void WTFReportBacktrace()
 {
-#if PLATFORM(MAC) && !defined(NDEBUG)
+#if PLATFORM(MAC)
     static const int maxFrames = 32;
     void* samples[maxFrames];
     int frames = backtrace(samples, maxFrames);
diff --git a/Source/JavaScriptCore/wtf/Assertions.h b/Source/JavaScriptCore/wtf/Assertions.h
index 1d108e4..72f8d36 100644
--- a/Source/JavaScriptCore/wtf/Assertions.h
+++ b/Source/JavaScriptCore/wtf/Assertions.h
@@ -73,6 +73,10 @@
 #define HAVE_VARIADIC_MACRO 1
 #endif
 
+#ifndef BACKTRACE_DISABLED
+#define BACKTRACE_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#endif
+
 #ifndef ASSERT_DISABLED
 #define ASSERT_DISABLED ASSERTIONS_DISABLED_DEFAULT
 #endif
@@ -188,10 +192,17 @@ WTF_EXPORT_PRIVATE void WTFLogVerbose(const char* file, int line, const char* fu
 
   Print a backtrace to the same location as ASSERT messages.
 */
-#ifndef BACKTRACE
+
+#if BACKTRACE_DISABLED
+
+#define BACKTRACE() ((void)0)
+
+#else
+
 #define BACKTRACE() do { \
     WTFReportBacktrace(); \
 } while(false)
+
 #endif
 
 /* ASSERT, ASSERT_NOT_REACHED, ASSERT_UNUSED
diff --git a/Source/JavaScriptCore/wtf/CMakeLists.txt b/Source/JavaScriptCore/wtf/CMakeLists.txt
index 304be73..97aad2d 100644
--- a/Source/JavaScriptCore/wtf/CMakeLists.txt
+++ b/Source/JavaScriptCore/wtf/CMakeLists.txt
@@ -1,6 +1,7 @@
 SET(WTF_HEADERS
     ASCIICType.h
     AVLTree.h
+    Alignment.h
     AlwaysInline.h
     Assertions.h
     Atomics.h
@@ -17,6 +18,7 @@ SET(WTF_HEADERS
     Deque.h
     DisallowCType.h
     DoublyLinkedList.h
+    DynamicAnnotations.h
     Encoder.h
     FastAllocBase.h
     FastMalloc.h
@@ -111,6 +113,7 @@ SET(WTF_SOURCES
     CryptographicallyRandomNumber.cpp
     CurrentTime.cpp
     DecimalNumber.cpp
+    DynamicAnnotations.cpp
     FastMalloc.cpp
     HashTable.cpp
     MainThread.cpp
diff --git a/Source/JavaScriptCore/wtf/DynamicAnnotations.cpp b/Source/JavaScriptCore/wtf/DynamicAnnotations.cpp
new file mode 100644
index 0000000..b7d4b41
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/DynamicAnnotations.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "DynamicAnnotations.h"
+
+#if USE(DYNAMIC_ANNOTATIONS)
+void WTFAnnotateBenignRaceSized(const char*, int, const volatile void*, long, const char*) { }
+void WTFAnnotateHappensBefore(const char*, int, const volatile void*) { }
+void WTFAnnotateHappensAfter(const char*, int, const volatile void*) { }
+#endif // USE(DYNAMIC_ANNOTATIONS)
diff --git a/Source/JavaScriptCore/wtf/DynamicAnnotations.h b/Source/JavaScriptCore/wtf/DynamicAnnotations.h
new file mode 100644
index 0000000..38acce3
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/DynamicAnnotations.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WTF_DynamicAnnotations_h
+#define WTF_DynamicAnnotations_h
+
+/* This file defines dynamic annotations for use with dynamic analysis
+ * tool such as ThreadSanitizer, Valgrind, etc.
+ *
+ * Dynamic annotation is a source code annotation that affects
+ * the generated code (that is, the annotation is not a comment).
+ * Each such annotation is attached to a particular
+ * instruction and/or to a particular object (address) in the program.
+ *
+ * By using dynamic annotations a developer can give more details to the dynamic
+ * analysis tool to improve its precision.
+ *
+ * In C/C++ program the annotations are represented as C macros.
+ * With the default build flags, these macros are empty, hence don't affect
+ * performance of a compiled binary.
+ * If dynamic annotations are enabled, they just call no-op functions.
+ * The dynamic analysis tools can intercept these functions and replace them
+ * with their own implementations.
+ *
+ * See http://code.google.com/p/data-race-test/wiki/DynamicAnnotations for more information.
+ */
+
+#if USE(DYNAMIC_ANNOTATIONS)
+/* Tell data race detector that we're not interested in reports on the given address range. */
+#define WTF_ANNOTATE_BENIGN_RACE_SIZED(address, size, description) WTFAnnotateBenignRaceSized(__FILE__, __LINE__, address, size, description)
+#define WTF_ANNOTATE_BENIGN_RACE(pointer, description) WTFAnnotateBenignRaceSized(__FILE__, __LINE__, pointer, sizeof(*(pointer)), description)
+
+/* Annotations for user-defined synchronization mechanisms.
+ * These annotations can be used to define happens-before arcs in user-defined
+ * synchronization mechanisms: the race detector will infer an arc from
+ * the former to the latter when they share the same argument pointer.
+ *
+ * The most common case requiring annotations is atomic reference counting:
+ * bool deref() {
+ *     ANNOTATE_HAPPENS_BEFORE(&m_refCount);
+ *     if (!atomicDecrement(&m_refCount)) {
+ *         // m_refCount is now 0
+ *         ANNOTATE_HAPPENS_AFTER(&m_refCount);
+ *         // "return true; happens-after each atomicDecrement of m_refCount"
+ *         return true;
+ *     }
+ *     return false;
+ * }
+ */
+#define WTF_ANNOTATE_HAPPENS_BEFORE(address) WTFAnnotateHappensBefore(__FILE__, __LINE__, address)
+#define WTF_ANNOTATE_HAPPENS_AFTER(address) WTFAnnotateHappensAfter(__FILE__, __LINE__, address)
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+/* Don't use these directly, use the above macros instead. */
+void WTFAnnotateBenignRaceSized(const char* file, int line, const volatile void* memory, long size, const char* description);
+void WTFAnnotateHappensBefore(const char* file, int line, const volatile void* address);
+void WTFAnnotateHappensAfter(const char* file, int line, const volatile void* address);
+#ifdef __cplusplus
+} // extern "C"
+#endif
+
+#else // USE(DYNAMIC_ANNOTATIONS)
+/* These macros are empty when dynamic annotations are not enabled so you can
+ * use them without affecting the performance of release binaries. */
+#define WTF_ANNOTATE_BENIGN_RACE_SIZED(address, size, description)
+#define WTF_ANNOTATE_BENIGN_RACE(pointer, description)
+#define WTF_ANNOTATE_HAPPENS_BEFORE(address)
+#define WTF_ANNOTATE_HAPPENS_AFTER(address)
+#endif // USE(DYNAMIC_ANNOTATIONS)
+
+#endif // WTF_DynamicAnnotations_h
diff --git a/Source/JavaScriptCore/wtf/FastMalloc.cpp b/Source/JavaScriptCore/wtf/FastMalloc.cpp
index 29e9a1a..95a9aff 100644
--- a/Source/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/Source/JavaScriptCore/wtf/FastMalloc.cpp
@@ -245,7 +245,8 @@ void* fastMalloc(size_t n)
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
     TryMallocReturnValue returnValue = tryFastMalloc(n);
     void* result;
-    returnValue.getValue(result);
+    if (!returnValue.getValue(result))
+        CRASH();
 #else
     void* result = malloc(n);
 #endif
@@ -293,7 +294,8 @@ void* fastCalloc(size_t n_elements, size_t element_size)
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
     TryMallocReturnValue returnValue = tryFastCalloc(n_elements, element_size);
     void* result;
-    returnValue.getValue(result);
+    if (!returnValue.getValue(result))
+        CRASH();
 #else
     void* result = calloc(n_elements, element_size);
 #endif
@@ -362,7 +364,8 @@ void* fastRealloc(void* p, size_t n)
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
     TryMallocReturnValue returnValue = tryFastRealloc(p, n);
     void* result;
-    returnValue.getValue(result);
+    if (!returnValue.getValue(result))
+        CRASH();
 #else
     void* result = realloc(p, n);
 #endif
@@ -1615,10 +1618,10 @@ void TCMalloc_PageHeap::initializeScavenger()
 
 void* TCMalloc_PageHeap::runScavengerThread(void* context)
 {
-  static_cast<TCMalloc_PageHeap*>(context)->scavengerThread();
-#if COMPILER(MSVC)
-  // Without this, Visual Studio will complain that this method does not return a value.
-  return 0;
+    static_cast<TCMalloc_PageHeap*>(context)->scavengerThread();
+#if (COMPILER(MSVC) || COMPILER(SUNCC))
+    // Without this, Visual Studio and Sun Studio will complain that this method does not return a value.
+    return 0;
 #endif
 }
 
diff --git a/Source/JavaScriptCore/wtf/HashTable.h b/Source/JavaScriptCore/wtf/HashTable.h
index 1c4ae6d..c2bc49b 100644
--- a/Source/JavaScriptCore/wtf/HashTable.h
+++ b/Source/JavaScriptCore/wtf/HashTable.h
@@ -259,19 +259,21 @@ namespace WTF {
 
     using std::swap;
 
-#if !COMPILER(MSVC)
-    // Visual C++ has a swap for pairs defined.
+    // Work around MSVC's standard library, whose swap for pairs does not swap by component.
+    template<typename T> inline void hashTableSwap(T& a, T& b)
+    {
+        swap(a, b);
+    }
 
-    // swap pairs by component, in case of pair members that specialize swap
-    template<typename T, typename U> inline void swap(pair<T, U>& a, pair<T, U>& b)
+    // Swap pairs by component, in case of pair members that specialize swap.
+    template<typename T, typename U> inline void hashTableSwap(pair<T, U>& a, pair<T, U>& b)
     {
         swap(a.first, b.first);
         swap(a.second, b.second);
     }
-#endif
 
     template<typename T, bool useSwap> struct Mover;
-    template<typename T> struct Mover<T, true> { static void move(T& from, T& to) { swap(from, to); } };
+    template<typename T> struct Mover<T, true> { static void move(T& from, T& to) { hashTableSwap(from, to); } };
     template<typename T> struct Mover<T, false> { static void move(T& from, T& to) { to = from; } };
 
     template<typename Key, typename Value, typename HashFunctions> class IdentityHashTranslator {
diff --git a/Source/JavaScriptCore/wtf/HashTraits.h b/Source/JavaScriptCore/wtf/HashTraits.h
index c8d40f7..fba5afe 100644
--- a/Source/JavaScriptCore/wtf/HashTraits.h
+++ b/Source/JavaScriptCore/wtf/HashTraits.h
@@ -81,12 +81,14 @@ namespace WTF {
         static bool isDeletedValue(P* value) { return value == reinterpret_cast<P*>(-1); }
     };
 
-    template<typename P> struct HashTraits<RefPtr<P> > : GenericHashTraits<RefPtr<P> > {
+    template<typename T> struct SimpleClassHashTraits : GenericHashTraits<T> {
         static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(RefPtr<P>& slot) { new (&slot) RefPtr<P>(HashTableDeletedValue); }
-        static bool isDeletedValue(const RefPtr<P>& value) { return value.isHashTableDeletedValue(); }
+        static void constructDeletedValue(T& slot) { new (&slot) T(HashTableDeletedValue); }
+        static bool isDeletedValue(const T& value) { return value.isHashTableDeletedValue(); }
     };
 
+    template<typename P> struct HashTraits<RefPtr<P> > : SimpleClassHashTraits<RefPtr<P> > { };
+
     // special traits for pairs, helpful for their use in HashMap implementation
 
     template<typename FirstTraitsArg, typename SecondTraitsArg>
diff --git a/Source/JavaScriptCore/wtf/MathExtras.h b/Source/JavaScriptCore/wtf/MathExtras.h
index 66e557f..fac187c 100644
--- a/Source/JavaScriptCore/wtf/MathExtras.h
+++ b/Source/JavaScriptCore/wtf/MathExtras.h
@@ -238,7 +238,7 @@ inline int clampToInteger(unsigned value)
     return static_cast<int>(std::min(value, static_cast<unsigned>(std::numeric_limits<int>::max())));
 }
 
-#if !COMPILER(MSVC) && !COMPILER(WINSCW) && !(COMPILER(RVCT) && (OS(SYMBIAN) || PLATFORM(BREWMP))) && !OS(SOLARIS)
+#if !COMPILER(MSVC) && !(COMPILER(RVCT) && PLATFORM(BREWMP)) && !OS(SOLARIS) && !OS(SYMBIAN)
 using std::isfinite;
 using std::isinf;
 using std::isnan;
diff --git a/Source/JavaScriptCore/wtf/PageAllocatorSymbian.h b/Source/JavaScriptCore/wtf/PageAllocatorSymbian.h
index 48a8464..eba5b03 100644
--- a/Source/JavaScriptCore/wtf/PageAllocatorSymbian.h
+++ b/Source/JavaScriptCore/wtf/PageAllocatorSymbian.h
@@ -30,7 +30,7 @@
 #define PageAllocatorSymbian_h
 
 #include <e32std.h>
-#include <wtf/BitMap.h>
+#include <wtf/Bitmap.h>
 
 namespace WTF { 
 
diff --git a/Source/JavaScriptCore/wtf/Platform.h b/Source/JavaScriptCore/wtf/Platform.h
index aee03e6..3e93b60 100644
--- a/Source/JavaScriptCore/wtf/Platform.h
+++ b/Source/JavaScriptCore/wtf/Platform.h
@@ -352,6 +352,10 @@
 #  error "Cannot use both of WTF_CPU_ARM_TRADITIONAL and WTF_CPU_ARM_THUMB2 platforms"
 #endif /* !defined(WTF_CPU_ARM_TRADITIONAL) && !defined(WTF_CPU_ARM_THUMB2) */
 
+#if defined(__ARM_NEON__) && !defined(WTF_CPU_ARM_NEON)
+#define WTF_CPU_ARM_NEON 1
+#endif
+
 #endif /* ARM */
 
 #if CPU(ARM) || CPU(MIPS)
@@ -535,18 +539,18 @@
 
 /* Graphics engines */
 
-/* PLATFORM(CG) and PLATFORM(CI) */
+/* USE(CG) and PLATFORM(CI) */
 #if PLATFORM(MAC) || PLATFORM(IOS)
-#define WTF_PLATFORM_CG 1
+#define WTF_USE_CG 1
 #endif
-#if PLATFORM(MAC) || PLATFORM(IOS) || (PLATFORM(WIN) && PLATFORM(CG))
-#define WTF_PLATFORM_CA 1
+#if PLATFORM(MAC) || PLATFORM(IOS) || (PLATFORM(WIN) && USE(CG))
+#define WTF_USE_CA 1
 #endif
 
 /* USE(SKIA) for Win/Linux, CG for Mac */
 #if PLATFORM(CHROMIUM)
 #if OS(DARWIN)
-#define WTF_PLATFORM_CG 1
+#define WTF_USE_CG 1
 #define WTF_USE_ATSUI 1
 #define WTF_USE_CORE_TEXT 1
 #define WTF_USE_ICCJPEG 1
@@ -561,7 +565,7 @@
 #endif
 
 #if PLATFORM(GTK)
-#define WTF_PLATFORM_CAIRO 1
+#define WTF_USE_CAIRO 1
 #endif
 
 
@@ -632,6 +636,7 @@
 #define ENABLE_WEB_ARCHIVE 1
 #endif /* PLATFORM(MAC) && !PLATFORM(IOS) */
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
 #define ENABLE_FULLSCREEN_API 1
 #endif
@@ -640,11 +645,12 @@
 #define WTF_USE_CARBON_SECURE_INPUT_MODE 1
 #endif
 
+=======
+>>>>>>> WebKit.org at r84325
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
 #define WTF_USE_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
-#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
 #endif
 
 #if PLATFORM(BREWMP)
@@ -680,7 +686,10 @@
 
 #if PLATFORM(ANDROID)
 #define WTF_USE_PTHREADS 1
+<<<<<<< HEAD
 #define WTF_USE_SKIA 1
+=======
+>>>>>>> WebKit.org at r84325
 #define USE_SYSTEM_MALLOC 1
 #define ENABLE_JAVA_BRIDGE 1
 #define LOG_DISABLED 1
@@ -786,6 +795,7 @@
 #define HAVE_SYS_PARAM_H 1
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
+#define WTF_USE_ACCELERATE 1
 
 #if !defined(TARGETING_TIGER) && !defined(TARGETING_LEOPARD)
 
@@ -1046,6 +1056,14 @@
 #error You have to have at least one execution model enabled to build JSC
 #endif
 
+#if CPU(SH4) && PLATFORM(QT)
+#define ENABLE_JIT 1
+#define ENABLE_YARR 1
+#define ENABLE_YARR_JIT 1
+#define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
+#define ENABLE_ASSEMBLER 1
+#endif
+
 /* Configure the JIT */
 #if ENABLE(JIT)
     #if CPU(ARM)
@@ -1210,4 +1228,8 @@
    breakages one port at a time. */
 #define WTF_USE_EXPORT_MACROS 0
 
+#if PLATFORM(QT) || PLATFORM(GTK)
+#define WTF_USE_UNIX_DOMAIN_SOCKETS 1
+#endif
+
 #endif /* WTF_Platform_h */
diff --git a/Source/JavaScriptCore/wtf/RetainPtr.h b/Source/JavaScriptCore/wtf/RetainPtr.h
index 3a11589..a716390 100644
--- a/Source/JavaScriptCore/wtf/RetainPtr.h
+++ b/Source/JavaScriptCore/wtf/RetainPtr.h
@@ -234,11 +234,7 @@ namespace WTF {
         return a != b.get(); 
     }
     
-    template<typename P> struct HashTraits<RetainPtr<P> > : GenericHashTraits<RetainPtr<P> > {
-        static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(RetainPtr<P>& slot) { new (&slot) RetainPtr<P>(HashTableDeletedValue); }
-        static bool isDeletedValue(const RetainPtr<P>& value) { return value == reinterpret_cast<P*>(-1); }
-    };
+    template<typename P> struct HashTraits<RetainPtr<P> > : SimpleClassHashTraits<RetainPtr<P> > { };
     
     template<typename P> struct PtrHash<RetainPtr<P> > : PtrHash<P*> {
         using PtrHash<P*>::hash;
diff --git a/Source/JavaScriptCore/wtf/StdLibExtras.h b/Source/JavaScriptCore/wtf/StdLibExtras.h
index 0dacb91..a8582e9 100644
--- a/Source/JavaScriptCore/wtf/StdLibExtras.h
+++ b/Source/JavaScriptCore/wtf/StdLibExtras.h
@@ -162,5 +162,6 @@ inline ArrayType* binarySearch(ArrayType* array, size_t size, KeyType key)
 } // namespace WTF
 
 using WTF::binarySearch;
+using WTF::bitwise_cast;
 
 #endif // WTF_StdLibExtras_h
diff --git a/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h b/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
index c9beec4..ca11db3 100644
--- a/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
+++ b/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
@@ -62,6 +62,7 @@
 #include "Platform.h"
 
 #include <wtf/Atomics.h>
+#include <wtf/DynamicAnnotations.h>
 #include <wtf/ThreadingPrimitives.h>
 
 namespace WTF {
@@ -103,8 +104,11 @@ protected:
     bool derefBase()
     {
 #if USE(LOCKFREE_THREADSAFEREFCOUNTED)
-        if (atomicDecrement(&m_refCount) <= 0)
+        WTF_ANNOTATE_HAPPENS_BEFORE(&m_refCount);
+        if (atomicDecrement(&m_refCount) <= 0) {
+            WTF_ANNOTATE_HAPPENS_AFTER(&m_refCount);
             return true;
+        }
 #else
         int refCount;
         {
diff --git a/Source/JavaScriptCore/wtf/Vector.h b/Source/JavaScriptCore/wtf/Vector.h
index b26857c..03c03d5 100644
--- a/Source/JavaScriptCore/wtf/Vector.h
+++ b/Source/JavaScriptCore/wtf/Vector.h
@@ -29,6 +29,7 @@
 #include "VectorTraits.h"
 #include <limits>
 #include <utility>
+#include <wtf/Alignment.h>
 
 #if PLATFORM(QT)
 #include <QDataStream>
@@ -39,17 +40,6 @@ namespace WTF {
     using std::min;
     using std::max;
 
-    // WTF_ALIGN_OF / WTF_ALIGNED
-    #if COMPILER(GCC) || COMPILER(MINGW) || COMPILER(RVCT) || COMPILER(WINSCW) || COMPILER(SUNCC)
-        #define WTF_ALIGN_OF(type) __alignof__(type)
-        #define WTF_ALIGNED(variable_type, variable, n) variable_type variable __attribute__((__aligned__(n)))
-    #elif COMPILER(MSVC)
-        #define WTF_ALIGN_OF(type) __alignof(type)
-        #define WTF_ALIGNED(variable_type, variable, n) __declspec(align(n)) variable_type variable
-    #else
-        #error WTF_ALIGN macros need alignment control.
-    #endif
-
     #if COMPILER(GCC) && !COMPILER(INTEL) && (((__GNUC__ * 100) + __GNUC_MINOR__) >= 303)
         typedef char __attribute__((__may_alias__)) AlignedBufferChar; 
     #else
@@ -129,7 +119,11 @@ namespace WTF {
         {
             while (src != srcEnd) {
                 new (dst) T(*src);
+#if COMPILER(SUNCC) && __SUNPRO_CC <= 0x590
+                const_cast<T*>(src)->~T(); // Work around obscure SunCC 12 compiler bug.
+#else
                 src->~T();
+#endif
                 ++dst;
                 ++src;
             }
diff --git a/Source/JavaScriptCore/wtf/VectorTraits.h b/Source/JavaScriptCore/wtf/VectorTraits.h
index 3f33b29..6777c9e 100644
--- a/Source/JavaScriptCore/wtf/VectorTraits.h
+++ b/Source/JavaScriptCore/wtf/VectorTraits.h
@@ -61,14 +61,10 @@ namespace WTF {
     template<typename T>
     struct VectorTraits : VectorTraitsBase<IsPod<T>::value, T> { };
 
-    struct SimpleClassVectorTraits
+    struct SimpleClassVectorTraits : VectorTraitsBase<false, void>
     {
-        static const bool needsDestruction = true;
-        static const bool needsInitialization = true;
         static const bool canInitializeWithMemset = true;
         static const bool canMoveWithMemcpy = true;
-        static const bool canCopyWithMemcpy = false;
-        static const bool canFillWithMemset = false;
         static const bool canCompareWithMemcmp = true;
     };
 
diff --git a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
index 8061e8a..c7f7ac4 100644
--- a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
+++ b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
@@ -61,7 +61,7 @@ typedef struct _GSource GSource;
 typedef struct _GVariant GVariant;
 typedef union _GdkEvent GdkEvent;
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 typedef struct _cairo_surface cairo_surface_t;
 #endif
 
diff --git a/Source/JavaScriptCore/wtf/text/AtomicString.cpp b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
index eb0dbbb..9dd655e 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicString.cpp
+++ b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
@@ -351,41 +351,14 @@ AtomicString AtomicString::lower() const
     return AtomicString(newImpl);
 }
 
-AtomicString AtomicString::fromUTF8(const char* characters, size_t length)
+AtomicString AtomicString::fromUTF8Internal(const char* charactersStart, const char* charactersEnd)
 {
-    if (!characters)
-        return AtomicString();
-
-    if (!length)
-        return emptyAtom;
-
-    HashAndUTF8Characters buffer;
-    buffer.characters = characters;
-    buffer.length = length;
-    buffer.hash = calculateStringHashFromUTF8(characters, characters + length, buffer.utf16Length);
-
-    if (!buffer.hash)
-        return AtomicString();
-
-    AtomicString atomicString;
-    atomicString.m_string = addToStringTable<HashAndUTF8Characters, HashAndUTF8CharactersTranslator>(buffer);
-    return atomicString;
-}
-
-AtomicString AtomicString::fromUTF8(const char* characters)
-{
-    if (!characters)
-        return AtomicString();
-
-    if (!*characters)
-        return emptyAtom;
-
     HashAndUTF8Characters buffer;
-    buffer.characters = characters;
-    buffer.hash = calculateStringHashAndLengthFromUTF8(characters, buffer.length, buffer.utf16Length);
+    buffer.characters = charactersStart;
+    buffer.hash = calculateStringHashAndLengthFromUTF8(charactersStart, charactersEnd, buffer.length, buffer.utf16Length);
 
     if (!buffer.hash)
-        return AtomicString();
+        return nullAtom;
 
     AtomicString atomicString;
     atomicString.m_string = addToStringTable<HashAndUTF8Characters, HashAndUTF8CharactersTranslator>(buffer);
diff --git a/Source/JavaScriptCore/wtf/text/AtomicString.h b/Source/JavaScriptCore/wtf/text/AtomicString.h
index 45a71e7..440700c 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicString.h
+++ b/Source/JavaScriptCore/wtf/text/AtomicString.h
@@ -127,6 +127,7 @@ private:
         return addSlowCase(r);
     }
     static PassRefPtr<StringImpl> addSlowCase(StringImpl*);
+    static AtomicString fromUTF8Internal(const char*, const char*);
 };
 
 inline bool operator==(const AtomicString& a, const AtomicString& b) { return a.impl() == b.impl(); }
@@ -154,20 +155,38 @@ inline bool equalIgnoringCase(const String& a, const AtomicString& b) { return e
 // Define external global variables for the commonly used atomic strings.
 // These are only usable from the main thread.
 #ifndef ATOMICSTRING_HIDE_GLOBALS
-    extern const JS_EXPORTDATA AtomicString nullAtom;
-    extern const JS_EXPORTDATA AtomicString emptyAtom;
-    extern const JS_EXPORTDATA AtomicString textAtom;
-    extern const JS_EXPORTDATA AtomicString commentAtom;
-    extern const JS_EXPORTDATA AtomicString starAtom;
-    extern const JS_EXPORTDATA AtomicString xmlAtom;
-    extern const JS_EXPORTDATA AtomicString xmlnsAtom;
+extern const JS_EXPORTDATA AtomicString nullAtom;
+extern const JS_EXPORTDATA AtomicString emptyAtom;
+extern const JS_EXPORTDATA AtomicString textAtom;
+extern const JS_EXPORTDATA AtomicString commentAtom;
+extern const JS_EXPORTDATA AtomicString starAtom;
+extern const JS_EXPORTDATA AtomicString xmlAtom;
+extern const JS_EXPORTDATA AtomicString xmlnsAtom;
+
+inline AtomicString AtomicString::fromUTF8(const char* characters, size_t length)
+{
+    if (!characters)
+        return nullAtom;
+    if (!length)
+        return emptyAtom;
+    return fromUTF8Internal(characters, characters + length);
+}
+
+inline AtomicString AtomicString::fromUTF8(const char* characters)
+{
+    if (!characters)
+        return nullAtom;
+    if (!*characters)
+        return emptyAtom;
+    return fromUTF8Internal(characters, 0);
+}
 #endif
 
-    // AtomicStringHash is the default hash for AtomicString
-    template<typename T> struct DefaultHash;
-    template<> struct DefaultHash<AtomicString> {
-        typedef AtomicStringHash Hash;
-    };
+// AtomicStringHash is the default hash for AtomicString
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<AtomicString> {
+    typedef AtomicStringHash Hash;
+};
 
 } // namespace WTF
 
diff --git a/Source/JavaScriptCore/wtf/text/StringConcatenate.h b/Source/JavaScriptCore/wtf/text/StringConcatenate.h
index 7fa7d2c..8500200 100644
--- a/Source/JavaScriptCore/wtf/text/StringConcatenate.h
+++ b/Source/JavaScriptCore/wtf/text/StringConcatenate.h
@@ -204,7 +204,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2)
     sumWithOverflow(length, adapter2.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -213,7 +213,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2)
     result += adapter1.length();
     adapter2.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3>
@@ -230,7 +230,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter3.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -241,7 +241,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter2.length();
     adapter3.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
@@ -260,7 +260,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter4.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -273,7 +273,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter3.length();
     adapter4.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
@@ -294,7 +294,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter5.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -309,7 +309,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter4.length();
     adapter5.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
@@ -332,7 +332,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter6.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -349,7 +349,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter5.length();
     adapter6.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
@@ -374,7 +374,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter7.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -393,7 +393,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter6.length();
     adapter7.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
@@ -420,7 +420,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter8.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -441,9 +441,62 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter7.length();
     adapter8.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8, typename StringType9>
+PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8, StringType9 string9)
+{
+    StringTypeAdapter<StringType1> adapter1(string1);
+    StringTypeAdapter<StringType2> adapter2(string2);
+    StringTypeAdapter<StringType3> adapter3(string3);
+    StringTypeAdapter<StringType4> adapter4(string4);
+    StringTypeAdapter<StringType5> adapter5(string5);
+    StringTypeAdapter<StringType6> adapter6(string6);
+    StringTypeAdapter<StringType7> adapter7(string7);
+    StringTypeAdapter<StringType8> adapter8(string8);
+    StringTypeAdapter<StringType9> adapter9(string9);
+
+    UChar* buffer;
+    bool overflow = false;
+    unsigned length = adapter1.length();
+    sumWithOverflow(length, adapter2.length(), overflow);
+    sumWithOverflow(length, adapter3.length(), overflow);
+    sumWithOverflow(length, adapter4.length(), overflow);
+    sumWithOverflow(length, adapter5.length(), overflow);
+    sumWithOverflow(length, adapter6.length(), overflow);
+    sumWithOverflow(length, adapter7.length(), overflow);
+    sumWithOverflow(length, adapter8.length(), overflow);
+    sumWithOverflow(length, adapter9.length(), overflow);
+    if (overflow)
+        return 0;
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    if (!resultImpl)
+        return 0;
+
+    UChar* result = buffer;
+    adapter1.writeTo(result);
+    result += adapter1.length();
+    adapter2.writeTo(result);
+    result += adapter2.length();
+    adapter3.writeTo(result);
+    result += adapter3.length();
+    adapter4.writeTo(result);
+    result += adapter4.length();
+    adapter5.writeTo(result);
+    result += adapter5.length();
+    adapter6.writeTo(result);
+    result += adapter6.length();
+    adapter7.writeTo(result);
+    result += adapter7.length();
+    adapter8.writeTo(result);
+    result += adapter8.length();
+    adapter9.writeTo(result);
+
+    return resultImpl.release();
+}
+
+
 // Convenience only.
 template<typename StringType1>
 String makeString(StringType1 string1)
@@ -454,64 +507,73 @@ String makeString(StringType1 string1)
 template<typename StringType1, typename StringType2>
 String makeString(StringType1 string1, StringType2 string2)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl.release();
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8, typename StringType9>
+String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8, StringType9 string9)
+{
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8, string9);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/text/StringHash.h b/Source/JavaScriptCore/wtf/text/StringHash.h
index 80193a6..c47c1d8 100644
--- a/Source/JavaScriptCore/wtf/text/StringHash.h
+++ b/Source/JavaScriptCore/wtf/text/StringHash.h
@@ -179,11 +179,7 @@ namespace WTF {
         }
     };
 
-    template<> struct HashTraits<String> : GenericHashTraits<String> {
-        static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(String& slot) { new (&slot) String(HashTableDeletedValue); }
-        static bool isDeletedValue(const String& slot) { return slot.isHashTableDeletedValue(); }
-    };
+    template<> struct HashTraits<String> : SimpleClassHashTraits<String> { };
 
 }
 
diff --git a/Source/JavaScriptCore/wtf/text/StringStatics.cpp b/Source/JavaScriptCore/wtf/text/StringStatics.cpp
index 5654044..ce08728 100644
--- a/Source/JavaScriptCore/wtf/text/StringStatics.cpp
+++ b/Source/JavaScriptCore/wtf/text/StringStatics.cpp
@@ -30,6 +30,7 @@
 #endif
 
 #include "AtomicString.h"
+#include "DynamicAnnotations.h"
 #include "StaticConstructors.h"
 #include "StringImpl.h"
 
@@ -46,6 +47,7 @@ StringImpl* StringImpl::empty()
     // PCRE goes away.
     static UChar emptyUCharData = 0;
     DEFINE_STATIC_LOCAL(StringImpl, emptyString, (&emptyUCharData, 0, ConstructStaticString));
+    WTF_ANNOTATE_BENIGN_RACE(&emptyString, "Benign race on StringImpl::emptyString reference counter");
     return &emptyString;
 }
 
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.h b/Source/JavaScriptCore/wtf/text/WTFString.h
index 713a6c3..b593d20 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.h
+++ b/Source/JavaScriptCore/wtf/text/WTFString.h
@@ -499,10 +499,7 @@ template<> struct DefaultHash<String> {
     typedef StringHash Hash;
 };
 
-template <> struct VectorTraits<String> : SimpleClassVectorTraits
-{
-    static const bool canInitializeWithMemset = true;
-};
+template <> struct VectorTraits<String> : SimpleClassVectorTraits { };
 
 }
 
diff --git a/Source/JavaScriptCore/wtf/unicode/CharacterNames.h b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
index 3d093a6..10fdbf0 100644
--- a/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
+++ b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
@@ -85,6 +85,7 @@ const UChar yenSign = 0x00A5;
 const UChar zeroWidthJoiner = 0x200D;
 const UChar zeroWidthNonJoiner = 0x200C;
 const UChar zeroWidthSpace = 0x200B;
+const UChar zeroWidthNoBreakSpace = 0xFEFF;
 
 } // namespace Unicode
 } // namespace WTF
@@ -138,5 +139,6 @@ using WTF::Unicode::yenSign;
 using WTF::Unicode::zeroWidthJoiner;
 using WTF::Unicode::zeroWidthNonJoiner;
 using WTF::Unicode::zeroWidthSpace;
+using WTF::Unicode::zeroWidthNoBreakSpace;
 
 #endif // CharacterNames_h
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
index 6981fe4..3a88906 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -314,7 +314,7 @@ ConversionResult convertUTF8ToUTF16(
     return result;
 }
 
-static inline unsigned calculateStringHashAndLengthFromUTF8Internal(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length)
+unsigned calculateStringHashAndLengthFromUTF8(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length)
 {
     if (!data)
         return 0;
@@ -365,17 +365,6 @@ static inline unsigned calculateStringHashAndLengthFromUTF8Internal(const char*
     return stringHasher.hash();
 }
 
-unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length)
-{
-    unsigned dataLength;
-    return calculateStringHashAndLengthFromUTF8Internal(data, dataEnd, dataLength, utf16Length);
-}
-
-unsigned calculateStringHashAndLengthFromUTF8(const char* data, unsigned& dataLength, unsigned& utf16Length)
-{
-    return calculateStringHashAndLengthFromUTF8Internal(data, 0, dataLength, utf16Length);
-}
-
 bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd)
 {
     while (b < bEnd) {
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.h b/Source/JavaScriptCore/wtf/unicode/UTF8.h
index bbfaa84..7b7b75d 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.h
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.h
@@ -70,8 +70,7 @@ namespace Unicode {
                     const UChar** sourceStart, const UChar* sourceEnd, 
                     char** targetStart, char* targetEnd, bool strict = true);
 
-    unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length);
-    unsigned calculateStringHashAndLengthFromUTF8(const char* data, unsigned& dataLength, unsigned& utf16Length);
+    unsigned calculateStringHashAndLengthFromUTF8(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length);
 
     bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd);
 
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index bc61a6e..f74107b 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -59,6 +59,16 @@ class YarrGenerator : private MacroAssembler {
     static const RegisterID regT1 = MIPSRegisters::t5;
 
     static const RegisterID returnRegister = MIPSRegisters::v0;
+#elif CPU(SH4)
+    static const RegisterID input = SH4Registers::r4;
+    static const RegisterID index = SH4Registers::r5;
+    static const RegisterID length = SH4Registers::r6;
+    static const RegisterID output = SH4Registers::r7;
+
+    static const RegisterID regT0 = SH4Registers::r0;
+    static const RegisterID regT1 = SH4Registers::r1;
+
+    static const RegisterID returnRegister = SH4Registers::r0;
 #elif CPU(X86)
     static const RegisterID input = X86Registers::eax;
     static const RegisterID index = X86Registers::edx;
@@ -2179,6 +2189,9 @@ class YarrGenerator : private MacroAssembler {
         push(ARMRegisters::r8); // scratch register
 #endif
         move(ARMRegisters::r3, output);
+#elif CPU(SH4)
+        push(SH4Registers::r11);
+        push(SH4Registers::r13);
 #elif CPU(MIPS)
         // Do nothing.
 #endif
@@ -2201,6 +2214,9 @@ class YarrGenerator : private MacroAssembler {
         pop(ARMRegisters::r6);
         pop(ARMRegisters::r5);
         pop(ARMRegisters::r4);
+#elif CPU(SH4)
+        pop(SH4Registers::r13);
+        pop(SH4Registers::r11);
 #elif CPU(MIPS)
         // Do nothing
 #endif
diff --git a/Source/JavaScriptCore/yarr/YarrParser.h b/Source/JavaScriptCore/yarr/YarrParser.h
index c59310a..65fb41d 100644
--- a/Source/JavaScriptCore/yarr/YarrParser.h
+++ b/Source/JavaScriptCore/yarr/YarrParser.h
@@ -78,6 +78,7 @@ private:
             : m_delegate(delegate)
             , m_err(err)
             , m_state(Empty)
+            , m_character(0)
         {
         }
 
diff --git a/Source/JavaScriptGlue/ChangeLog b/Source/JavaScriptGlue/ChangeLog
index 6093c84..3b8abdd 100644
--- a/Source/JavaScriptGlue/ChangeLog
+++ b/Source/JavaScriptGlue/ChangeLog
@@ -1,3 +1,76 @@
+2011-04-19  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move the alignment related macros in Vector.h to new Alignment.h.
+        https://bugs.webkit.org/show_bug.cgi?id=56000
+
+        Adding the new file to the forwarding headers of JavaScriptGlue.
+
+        * ForwardingHeaders/wtf/Alignment.h: Added.
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        GC allocate Structure
+        https://bugs.webkit.org/show_bug.cgi?id=58483
+
+        Rolling r83894 r83827 r83810 r83809 r83808 back in with
+        a workaround for the gcc bug seen by the gtk bots
+
+        * JSRun.cpp:
+        (JSGlueGlobalObject::JSGlueGlobalObject):
+        * JSRun.h:
+        * JSUtils.cpp:
+        (JSObjectKJSValue):
+        * UserObjectImp.cpp:
+        (UserObjectImp::UserObjectImp):
+        * UserObjectImp.h:
+        (UserObjectImp::createStructure):
+
+2011-04-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A few heap-related renames and file moves.
+        
+        WeakGCPtr<T> => Weak<T>
+        Global<T> => Strong<T>
+        collector/ => heap/
+        collector/* => heap/*
+        runtime/WeakGCPtr.h => heap/Weak.h
+        
+        (Eventually, even more files should move into the heap directory. Like
+        Heap.h and Heap.cpp, for example.)
+
+        * JSRun.h:
+        * JSValueWrapper.h:
+
+2011-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Some Handle<T> cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=58109
+
+        * JSRun.h:
+        * JSValueWrapper.h: #include a file that was missing before, but was
+        harmlessly so until now.
+
+2011-03-30  Timur Iskhodzhanov  <timurrrr@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add some dynamic annotations to JavaScriptCore/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=53747
+
+        By using these annotations we can improve the precision of finding
+        WebKit errors using dynamic analysis tools like ThreadSanitizer and Valgrind.
+        These annotations don't affect the compiled binaries unless USE(DYNAMIC_ANNOTATIONS) is "1".
+
+        These files don't add new functionality, so don't need extra tests.
+
+        * ForwardingHeaders/wtf/DynamicAnnotations.h: Added.
+
 2011-03-25  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
diff --git a/Source/JavaScriptGlue/Configurations/Version.xcconfig b/Source/JavaScriptGlue/Configurations/Version.xcconfig
index 59988e3..8ea0822 100644
--- a/Source/JavaScriptGlue/Configurations/Version.xcconfig
+++ b/Source/JavaScriptGlue/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 27;
+MINOR_VERSION = 30;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptGlue/ForwardingHeaders/wtf/Alignment.h b/Source/JavaScriptGlue/ForwardingHeaders/wtf/Alignment.h
new file mode 100644
index 0000000..e83483e
--- /dev/null
+++ b/Source/JavaScriptGlue/ForwardingHeaders/wtf/Alignment.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Alignment.h>
diff --git a/Source/JavaScriptGlue/ForwardingHeaders/wtf/DynamicAnnotations.h b/Source/JavaScriptGlue/ForwardingHeaders/wtf/DynamicAnnotations.h
new file mode 100644
index 0000000..1280da8
--- /dev/null
+++ b/Source/JavaScriptGlue/ForwardingHeaders/wtf/DynamicAnnotations.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/DynamicAnnotations.h>
diff --git a/Source/JavaScriptGlue/JSRun.cpp b/Source/JavaScriptGlue/JSRun.cpp
index a8096aa..3b9d245 100644
--- a/Source/JavaScriptGlue/JSRun.cpp
+++ b/Source/JavaScriptGlue/JSRun.cpp
@@ -33,10 +33,10 @@
 #include <JavaScriptCore/Completion.h>
 #include <JavaScriptCore/SourceCode.h>
 
-JSGlueGlobalObject::JSGlueGlobalObject(JSGlobalData& globalData, PassRefPtr<Structure> structure, JSFlags flags)
-    : JSGlobalObject(structure)
+JSGlueGlobalObject::JSGlueGlobalObject(JSGlobalData& globalData, Structure* structure, JSFlags flags)
+    : JSGlobalObject(globalData, structure)
     , m_flags(flags)
-    , m_userObjectStructure(UserObjectImp::createStructure(globalData, jsNull()))
+    , m_userObjectStructure(globalData, UserObjectImp::createStructure(globalData, jsNull()))
 {
 }
 
diff --git a/Source/JavaScriptGlue/JSRun.h b/Source/JavaScriptGlue/JSRun.h
index d7aa682..9fe7767 100644
--- a/Source/JavaScriptGlue/JSRun.h
+++ b/Source/JavaScriptGlue/JSRun.h
@@ -29,19 +29,20 @@
 #ifndef JSRun_h
 #define JSRun_h
 
+#include <JavaScriptCore/Strong.h>
 #include "JSBase.h"
 #include "JSUtils.h"
 
 class JSGlueGlobalObject : public JSGlobalObject {
     public:
-        JSGlueGlobalObject(JSGlobalData&, PassRefPtr<Structure>, JSFlags = kJSFlagNone);
+        JSGlueGlobalObject(JSGlobalData&, Structure*, JSFlags = kJSFlagNone);
 
         JSFlags Flags() const { return m_flags; }
         Structure* userObjectStructure() const { return m_userObjectStructure.get(); }
 
     private:
         JSFlags m_flags;
-        RefPtr<Structure> m_userObjectStructure;
+        Strong<Structure> m_userObjectStructure;
 };
 
 class JSRun : public JSBase {
@@ -56,7 +57,7 @@ class JSRun : public JSBase {
         JSFlags Flags() const;
     private:
         UString fSource;
-        Global<JSGlobalObject> fGlobalObject;
+        Strong<JSGlobalObject> fGlobalObject;
         JSFlags fFlags;
 };
 
diff --git a/Source/JavaScriptGlue/JSUtils.cpp b/Source/JavaScriptGlue/JSUtils.cpp
index b62e7bf..7db650f 100644
--- a/Source/JavaScriptGlue/JSUtils.cpp
+++ b/Source/JavaScriptGlue/JSUtils.cpp
@@ -184,7 +184,7 @@ JSValue JSObjectKJSValue(JSUserObject* ptr)
         if (!handled)
         {
             ExecState* exec = getThreadGlobalExecState();
-            result = new (exec) UserObjectImp(getThreadGlobalObject()->userObjectStructure(), ptr);
+            result = new (exec) UserObjectImp(exec->globalData(), getThreadGlobalObject()->userObjectStructure(), ptr);
         }
     }
     return result;
diff --git a/Source/JavaScriptGlue/JSValueWrapper.h b/Source/JavaScriptGlue/JSValueWrapper.h
index 9d27f89..66e0c59 100644
--- a/Source/JavaScriptGlue/JSValueWrapper.h
+++ b/Source/JavaScriptGlue/JSValueWrapper.h
@@ -29,6 +29,7 @@
 #ifndef JSValueWrapper_h
 #define JSValueWrapper_h
 
+#include <JavaScriptCore/Strong.h>
 #include "JSUtils.h"
 #include "JSBase.h"
 #include "JSObject.h"
@@ -43,7 +44,7 @@ public:
     JSValue GetValue();
 
 private:
-    Global<Unknown> fValue;
+    Strong<Unknown> fValue;
     
     static void JSObjectDispose(void *data);
     static CFArrayRef JSObjectCopyPropertyNames(void *data);
diff --git a/Source/JavaScriptGlue/UserObjectImp.cpp b/Source/JavaScriptGlue/UserObjectImp.cpp
index a04f58e..c93748f 100644
--- a/Source/JavaScriptGlue/UserObjectImp.cpp
+++ b/Source/JavaScriptGlue/UserObjectImp.cpp
@@ -34,8 +34,8 @@
 
 const ClassInfo UserObjectImp::s_info = { "UserObject", &JSNonFinalObject::s_info, 0, 0 };
 
-UserObjectImp::UserObjectImp(PassRefPtr<Structure> structure, JSUserObject* userObject)
-    : JSNonFinalObject(structure)
+UserObjectImp::UserObjectImp(JSGlobalData& globalData, Structure* structure, JSUserObject* userObject)
+    : JSNonFinalObject(globalData, structure)
     , fJSUserObject((JSUserObject*)userObject->Retain())
 {
 }
diff --git a/Source/JavaScriptGlue/UserObjectImp.h b/Source/JavaScriptGlue/UserObjectImp.h
index c6b8d86..9bd6f0f 100644
--- a/Source/JavaScriptGlue/UserObjectImp.h
+++ b/Source/JavaScriptGlue/UserObjectImp.h
@@ -36,7 +36,7 @@
 
 class UserObjectImp : public JSNonFinalObject {
 public:
-    UserObjectImp(PassRefPtr<Structure>, JSUserObject*);
+    UserObjectImp(JSGlobalData&, Structure*, JSUserObject*);
     virtual ~UserObjectImp();
 
     static const ClassInfo s_info;
@@ -58,7 +58,7 @@ public:
 
     JSUserObject *GetJSUserObject() const;
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/Android.derived.jscbindings.mk b/Source/WebCore/Android.derived.jscbindings.mk
index 8045dd6..0aef3f6 100644
--- a/Source/WebCore/Android.derived.jscbindings.mk
+++ b/Source/WebCore/Android.derived.jscbindings.mk
@@ -207,6 +207,10 @@ $(patsubst %.h,%.cpp,$(GEN)): $(intermediates)/fileapi/%.cpp : $(intermediates)/
 
 # HTML
 GEN := \
+<<<<<<< HEAD
+=======
+    $(intermediates)/html/JSBlob.h \
+>>>>>>> WebKit.org at r84325
     $(intermediates)/html/JSDOMFormData.h \
     $(intermediates)/html/JSDOMSettableTokenList.h \
     $(intermediates)/html/JSDOMTokenList.h \
@@ -293,7 +297,8 @@ GEN := \
     $(intermediates)/html/JSTextMetrics.h \
     $(intermediates)/html/JSTimeRanges.h \
     $(intermediates)/html/JSValidityState.h \
-    $(intermediates)/html/JSVoidCallback.h
+    $(intermediates)/html/JSVoidCallback.h \
+    $(intermediates)/html/JSWebKitBlobBuilder.h
 
 $(GEN): PRIVATE_PATH := $(LOCAL_PATH)
 $(GEN): PRIVATE_CUSTOM_TOOL = perl -I$(PRIVATE_PATH)/bindings/scripts $(PRIVATE_PATH)/bindings/scripts/generate-bindings.pl --defines "$(FEATURE_DEFINES) LANGUAGE_JAVASCRIPT" --generator JS --include dom --include html --outputdir $(dir $@) $<
@@ -374,6 +379,9 @@ GEN := \
     $(intermediates)/page/JSLocation.h \
     $(intermediates)/page/JSMemoryInfo.h \
     $(intermediates)/page/JSNavigator.h \
+    $(intermediates)/page/JSNavigatorUserMediaError.h \
+    $(intermediates)/page/JSNavigatorUserMediaErrorCallback.h \
+    $(intermediates)/page/JSNavigatorUserMediaSuccessCallback.h \
     $(intermediates)/page/JSPositionError.h \
     $(intermediates)/page/JSScreen.h \
     $(intermediates)/page/JSSpeechInputEvent.h \
diff --git a/Source/WebCore/Android.derived.v8bindings.mk b/Source/WebCore/Android.derived.v8bindings.mk
index 12aca59..6d08c1a 100644
--- a/Source/WebCore/Android.derived.v8bindings.mk
+++ b/Source/WebCore/Android.derived.v8bindings.mk
@@ -149,6 +149,7 @@ $(patsubst %.h,%.cpp,$(GEN)): $(intermediates)/bindings/%.cpp : $(intermediates)
 # Fileapi
 GEN := \
     $(intermediates)/bindings/V8Blob.h \
+<<<<<<< HEAD
     $(intermediates)/bindings/V8BlobBuilder.h \
     $(intermediates)/bindings/V8DOMFileSystem.h \
     $(intermediates)/bindings/V8DOMFileSystemSync.h \
@@ -192,6 +193,9 @@ $(patsubst %.h,%.cpp,$(GEN)): $(intermediates)/bindings/%.cpp : $(intermediates)
 # HTML
 GEN := \
     $(intermediates)/bindings/V8DOMFormData.h \
+=======
+    $(intermediates)/bindings/V8DOMTokenList.h \
+>>>>>>> WebKit.org at r84325
     $(intermediates)/bindings/V8DOMSettableTokenList.h \
     $(intermediates)/bindings/V8DOMTokenList.h \
     $(intermediates)/bindings/V8DOMURL.h \
@@ -277,7 +281,8 @@ GEN := \
     $(intermediates)/bindings/V8TextMetrics.h \
     $(intermediates)/bindings/V8TimeRanges.h \
     $(intermediates)/bindings/V8ValidityState.h \
-    $(intermediates)/bindings/V8VoidCallback.h
+    $(intermediates)/bindings/V8VoidCallback.h \
+    $(intermediates)/bindings/V8WebKitBlobBuilder.h
 
 $(GEN): PRIVATE_PATH := $(LOCAL_PATH)
 $(GEN): PRIVATE_CUSTOM_TOOL = SOURCE_ROOT=$(PRIVATE_PATH) perl -I$(PRIVATE_PATH)/bindings/scripts $(PRIVATE_PATH)/bindings/scripts/generate-bindings.pl --defines "$(FEATURE_DEFINES) LANGUAGE_JAVASCRIPT" --generator V8 --include dom --include html --outputdir $(dir $@) $<
@@ -360,6 +365,9 @@ GEN := \
     $(intermediates)/bindings/V8Location.h \
     $(intermediates)/bindings/V8MemoryInfo.h \
     $(intermediates)/bindings/V8Navigator.h \
+    $(intermediates)/bindings/V8NavigatorUserMediaError.h \
+    $(intermediates)/bindings/V8NavigatorUserMediaErrorCallback.h \
+    $(intermediates)/bindings/V8NavigatorUserMediaSuccessCallback.h \
     $(intermediates)/bindings/V8PositionError.h \
     $(intermediates)/bindings/V8Screen.h \
     $(intermediates)/bindings/V8SpeechInputEvent.h \
diff --git a/Source/WebCore/Android.jscbindings.mk b/Source/WebCore/Android.jscbindings.mk
index d4affb7..d21e7cf 100644
--- a/Source/WebCore/Android.jscbindings.mk
+++ b/Source/WebCore/Android.jscbindings.mk
@@ -60,8 +60,12 @@ BINDING_C_INCLUDES := \
 	$(WEBCORE_INTERMEDIATES_PATH)/xml
 
 LOCAL_SRC_FILES += \
+<<<<<<< HEAD
 	bindings/js/DOMObjectHashTableMap.cpp \
 	bindings/js/DOMWrapperWorld.cpp \
+=======
+	bindings/js/CallbackFunction.cpp \
+>>>>>>> WebKit.org at r84325
 	bindings/js/GCController.cpp \
 	bindings/js/IDBBindingUtilities.cpp \
 	bindings/js/JSArrayBufferCustom.cpp \
diff --git a/Source/WebCore/Android.mk b/Source/WebCore/Android.mk
index 83bfc91..33c134e 100644
--- a/Source/WebCore/Android.mk
+++ b/Source/WebCore/Android.mk
@@ -188,6 +188,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/ScriptRunner.cpp \
 	dom/SelectElement.cpp \
 	dom/SelectorNodeList.cpp \
+	dom/ShadowRoot.cpp \
 	dom/SpaceSplitString.cpp \
 	dom/StaticHashSetNodeList.cpp \
 	dom/StaticNodeList.cpp \
@@ -201,6 +202,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/TouchEvent.cpp \
 	dom/TouchList.cpp \
 	dom/Traversal.cpp \
+	dom/TreeScope.cpp \
 	dom/TreeWalker.cpp \
 	dom/UIEvent.cpp \
 	dom/UIEventWithKeyState.cpp \
@@ -408,6 +410,11 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	html/parser/XSSFilter.cpp \
 	\
 	html/shadow/MediaControls.cpp \
+	html/shadow/MediaControlElements.cpp \
+	html/shadow/MediaControlRootElement.cpp \
+	html/shadow/MeterShadowElement.cpp \
+	html/shadow/DetailControlElement.cpp \
+	html/shadow/ProgressShadowElement.cpp \
 	html/shadow/SliderThumbElement.cpp \
 	html/shadow/TextControlInnerElements.cpp \
 	\
@@ -546,8 +553,12 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/LocalizedStrings.cpp \
 	platform/Logging.cpp \
 	platform/MIMETypeRegistry.cpp \
+<<<<<<< HEAD
 	platform/SchemeRegistry.cpp \
 	platform/ScrollAnimator.cpp \
+=======
+	platform/RuntimeApplicationChecks.cpp \
+>>>>>>> WebKit.org at r84325
 	platform/ScrollView.cpp \
 	platform/Scrollbar.cpp \
 	platform/ScrollableArea.cpp \
@@ -714,7 +725,12 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/image-decoders/gif/GIFImageDecoder.cpp \
 	platform/image-decoders/gif/GIFImageReader.cpp \
 	\
+<<<<<<< HEAD
 	platform/image-encoders/skia/JPEGImageEncoder.cpp \
+=======
+	platform/leveldb/LevelDBDatabase.cpp \
+	platform/leveldb/LevelDBIterator.cpp \
+>>>>>>> WebKit.org at r84325
 	\
 	platform/mock/DeviceOrientationClientMock.cpp \
 	platform/mock/GeolocationClientMock.cpp \
@@ -807,7 +823,6 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	rendering/InlineFlowBox.cpp \
 	rendering/InlineTextBox.cpp \
 	rendering/LayoutState.cpp \
-	rendering/MediaControlElements.cpp \
 	rendering/PointerEventsHitRules.cpp \
 	rendering/RenderApplet.cpp \
 	rendering/RenderArena.cpp \
diff --git a/Source/WebCore/Android.v8bindings.mk b/Source/WebCore/Android.v8bindings.mk
index fe2b126..791d8d4 100644
--- a/Source/WebCore/Android.v8bindings.mk
+++ b/Source/WebCore/Android.v8bindings.mk
@@ -157,6 +157,7 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8MessageChannelConstructor.cpp \
 	bindings/v8/custom/V8MessagePortCustom.cpp \
 	bindings/v8/custom/V8MessageEventCustom.cpp \
+	bindings/v8/custom/V8NavigatorCustom.cpp \
 	bindings/v8/custom/V8NamedNodeMapCustom.cpp \
 	bindings/v8/custom/V8NamedNodesCollection.cpp \
 	bindings/v8/custom/V8NavigatorCustom.cpp \
@@ -199,6 +200,7 @@ LOCAL_SRC_FILES += \
 	bridge/jni/JavaMethodJobject.cpp \
 	bridge/jni/JobjectWrapper.cpp \
 	bridge/jni/v8/JNIUtilityPrivate.cpp \
+<<<<<<< HEAD
 	bridge/jni/v8/JavaClassV8.cpp \
 	bridge/jni/v8/JavaFieldV8.cpp \
 	bridge/jni/v8/JavaInstanceV8.cpp \
@@ -211,3 +213,10 @@ LOCAL_SRC_FILES += \
 # For XSLT.
 LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8XSLTProcessorCustom.cpp
+=======
+	bridge/jni/v8/JavaClassJobjectV8.cpp \
+	bridge/jni/v8/JavaFieldJobjectV8.cpp \
+	bridge/jni/v8/JavaInstanceJobjectV8.cpp \
+	bridge/jni/v8/JavaNPObject.cpp \
+	bridge/jni/v8/JobjectWrapper.cpp
+>>>>>>> WebKit.org at r84325
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 630f76e..9941b76 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -38,6 +38,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/image-decoders/jpeg"
     "${WEBCORE_DIR}/platform/image-decoders/png"
     "${WEBCORE_DIR}/platform/image-decoders/webp"
+    "${WEBCORE_DIR}/platform/leveldb"
     "${WEBCORE_DIR}/platform/mock"
     "${WEBCORE_DIR}/platform/network"
     "${WEBCORE_DIR}/platform/sql"
@@ -65,7 +66,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/assembler"
     "${JAVASCRIPTCORE_DIR}/bytecode"
     "${JAVASCRIPTCORE_DIR}/bytecompiler"
-    "${JAVASCRIPTCORE_DIR}/collector/handles"
+    "${JAVASCRIPTCORE_DIR}/heap"
     "${JAVASCRIPTCORE_DIR}/debugger"
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
@@ -75,7 +76,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/wtf"
     "${JAVASCRIPTCORE_DIR}/wtf/unicode"
     "${JAVASCRIPTCORE_DIR}/yarr"
-    "${DERIVED_SOURCES_DIR}"
+    "${DERIVED_SOURCES_WEBCORE_DIR}"
     "${CMAKE_SOURCE_DIR}"
     "${CMAKE_BINARY_DIR}"
 )
@@ -185,11 +186,11 @@ SET(WebCore_IDL_FILES
     dom/WheelEvent.idl
 
     fileapi/Blob.idl
-    fileapi/BlobBuilder.idl
     fileapi/FileError.idl
     fileapi/File.idl
     fileapi/FileList.idl
     fileapi/FileReader.idl
+    fileapi/WebKitBlobBuilder.idl
 
     html/DataGridColumn.idl
     html/DataGridColumnList.idl
@@ -270,6 +271,7 @@ SET(WebCore_IDL_FILES
     html/HTMLTableSectionElement.idl
     html/HTMLTextAreaElement.idl
     html/HTMLTitleElement.idl
+    html/HTMLTrackElement.idl
     html/HTMLUListElement.idl
     html/HTMLVideoElement.idl
     html/ImageData.idl
@@ -330,6 +332,8 @@ SET(WebCore_IDL_FILES
     page/Location.idl
     page/MemoryInfo.idl
     page/Navigator.idl
+    page/NavigatorUserMediaErrorCallback.idl
+    page/NavigatorUserMediaSuccessCallback.idl
     page/Performance.idl
     page/PerformanceNavigation.idl
     page/PerformanceTiming.idl
@@ -376,6 +380,9 @@ SET(WebCore_IDL_FILES
     storage/SQLTransactionSyncCallback.idl
     storage/Storage.idl
     storage/StorageEvent.idl
+    storage/StorageInfo.idl
+    storage/StorageInfoErrorCallback.idl
+    storage/StorageInfoUsageCallback.idl
 
     webaudio/AudioBuffer.idl
     webaudio/AudioBufferSourceNode.idl
@@ -423,8 +430,6 @@ SET(WebCore_IDL_FILES
 )
 
 SET(WebCore_SOURCES
-    ${DERIVED_SOURCES_DIR}/JSWebSocket.cpp
-
     accessibility/AXObjectCache.cpp
     accessibility/AccessibilityARIAGrid.cpp
     accessibility/AccessibilityARIAGridCell.cpp
@@ -453,6 +458,8 @@ SET(WebCore_SOURCES
     bindings/generic/ActiveDOMCallback.cpp
     bindings/generic/RuntimeEnabledFeatures.cpp
 
+    bindings/js/CallbackFunction.cpp
+
     css/CSSBorderImageValue.cpp
     css/CSSCanvasValue.cpp
     css/CSSCharsetRule.cpp
@@ -603,6 +610,7 @@ SET(WebCore_SOURCES
     dom/ScriptRunner.cpp
     dom/SelectElement.cpp
     dom/SelectorNodeList.cpp
+    dom/ShadowRoot.cpp
     dom/SpaceSplitString.cpp
     dom/StaticHashSetNodeList.cpp
     dom/StaticNodeList.cpp
@@ -616,6 +624,7 @@ SET(WebCore_SOURCES
     dom/TouchList.cpp
     dom/TransformSourceLibxslt.cpp
     dom/Traversal.cpp
+    dom/TreeScope.cpp
     dom/TreeWalker.cpp
     dom/UIEvent.cpp
     dom/UIEventWithKeyState.cpp
@@ -670,6 +679,7 @@ SET(WebCore_SOURCES
     editing/SetNodeAttributeCommand.cpp
     editing/SmartReplace.cpp
     editing/SpellChecker.cpp
+    editing/SpellingCorrectionController.cpp
     editing/SplitElementCommand.cpp
     editing/SplitTextNodeCommand.cpp
     editing/SplitTextNodeContainingElementCommand.cpp
@@ -685,11 +695,11 @@ SET(WebCore_SOURCES
     editing/visible_units.cpp
 
     fileapi/Blob.cpp
-    fileapi/BlobBuilder.cpp
     fileapi/BlobURL.cpp
     fileapi/File.cpp
     fileapi/FileList.cpp
     fileapi/ThreadableBlobRegistry.cpp
+    fileapi/WebKitBlobBuilder.cpp
 
     history/BackForwardController.cpp
     history/BackForwardListImpl.cpp
@@ -874,12 +884,17 @@ SET(WebCore_SOURCES
     html/parser/TextViewSourceParser.cpp
     html/parser/XSSFilter.cpp
 
+    html/shadow/DetailsMarkerControl.cpp
     html/shadow/MediaControls.cpp
+    html/shadow/MediaControlRootElement.cpp
+    html/shadow/MeterShadowElement.cpp
+    html/shadow/ProgressShadowElement.cpp
     html/shadow/SliderThumbElement.cpp
     html/shadow/TextControlInnerElements.cpp
 
     inspector/ConsoleMessage.cpp
     inspector/DOMNodeHighlighter.cpp
+    inspector/EventsCollector.cpp
     inspector/InjectedScript.cpp
     inspector/InjectedScriptHost.cpp
     inspector/InjectedScriptManager.cpp
@@ -899,6 +914,7 @@ SET(WebCore_SOURCES
     inspector/InspectorDebuggerAgent.cpp
     inspector/InspectorFrontendClientLocal.cpp
     inspector/InspectorFrontendHost.cpp
+    inspector/InspectorFrontendProxy.cpp
     inspector/InspectorInstrumentation.cpp
     inspector/InspectorProfilerAgent.cpp
     inspector/InspectorResourceAgent.cpp
@@ -913,6 +929,7 @@ SET(WebCore_SOURCES
     inspector/ScriptCallStack.cpp
     inspector/TimelineRecordFactory.cpp
     inspector/WorkerDebuggerAgent.cpp
+    inspector/WorkerInspectorController.cpp
 
     loader/CrossOriginAccessControl.cpp
     loader/CrossOriginPreflightResultCache.cpp
@@ -1046,6 +1063,7 @@ SET(WebCore_SOURCES
     platform/LinkHash.cpp
     platform/Logging.cpp
     platform/MIMETypeRegistry.cpp
+    platform/RuntimeApplicationChecks.cpp
     platform/ScrollAnimator.cpp
     platform/ScrollableArea.cpp
     platform/Scrollbar.cpp
@@ -1215,7 +1233,6 @@ SET(WebCore_SOURCES
     rendering/RenderImage.cpp
     rendering/RenderImageResource.cpp
     rendering/RenderImageResourceStyleImage.cpp
-    rendering/RenderIndicator.cpp
     rendering/RenderInline.cpp
     rendering/RenderLayer.cpp
     rendering/RenderLineBoxList.cpp
@@ -1325,6 +1342,7 @@ SET(WebCore_SOURCES
     storage/StorageAreaSync.cpp
     storage/StorageEvent.cpp
     storage/StorageEventDispatcher.cpp
+    storage/StorageInfo.cpp
     storage/StorageMap.cpp
     storage/StorageNamespace.cpp
     storage/StorageNamespaceImpl.cpp
@@ -1433,6 +1451,13 @@ IF (ENABLE_DATA_TRANSFER_ITEMS)
     )
 ENDIF ()
 
+IF (ENABLE_LEVELDB)
+    LIST(APPEND WebCore_SOURCES
+        platform/leveldb/LevelDBDatabase.cpp
+        platform/leveldb/LevelDBIterator.cpp
+    )
+ENDIF ()
+
 IF (ENABLE_MATHML)
     LIST(APPEND WebCore_SOURCES
         mathml/MathMLElement.cpp
@@ -1525,7 +1550,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/FileWriterCallback.idl
         fileapi/FileWriter.idl
         fileapi/FileWriterSync.idl
-        fileapi/Flags.idl
+        fileapi/WebKitFlags.idl
         fileapi/Metadata.idl
         fileapi/MetadataCallback.idl
     )
@@ -1882,20 +1907,25 @@ ENDIF()
 
 IF (ENABLE_VIDEO)
     LIST(APPEND WebCore_SOURCES
-        ${DERIVED_SOURCES_DIR}/JSTimeRanges.cpp
         bindings/js/JSAudioConstructor.cpp
         html/HTMLAudioElement.cpp
         html/HTMLMediaElement.cpp
         html/HTMLSourceElement.cpp
         html/HTMLVideoElement.cpp
+        html/shadow/MediaControlElements.cpp
         html/TimeRanges.cpp
         platform/graphics/MediaPlayer.cpp
-        rendering/MediaControlElements.cpp
         rendering/RenderMedia.cpp
         rendering/RenderVideo.cpp
     )
 ENDIF()
 
+IF (ENABLE_VIDEO_TRACK)
+    LIST(APPEND WebCore_SOURCES
+        html/HTMLTrackElement.cpp
+    )
+ENDIF()
+
 IF (ENABLE_WML)
     LIST(APPEND WebCore_SOURCES
         wml/WMLAElement.cpp
@@ -1943,6 +1973,15 @@ IF (ENABLE_PROGRESS_TAG)
     )
 ENDIF ()
 
+IF (ENABLE_MEDIA_STREAM)
+    LIST(APPEND WebCore_SOURCES
+        bindings/js/JSNavigatorCustom.cpp
+    )
+
+    LIST(APPEND WebCore_IDL_FILES
+        page/NavigatorUserMediaError.idl
+    )
+ENDIF ()
 
 
 # Modules that the bindings generator scripts may use
@@ -1956,164 +1995,173 @@ INCLUDE(${WEBCORE_DIR}/UseJSC.cmake)
  
 # All Web Inspector generated files are created with this one call to CodeGeneratorInspector.pm
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/Inspector.idl
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/Inspector.idl
     MAIN_DEPENDENCY inspector/Inspector.json
     DEPENDS ${WEBCORE_DIR}/inspector/generate-inspector-idl ${WEBCORE_DIR}/inspector/Inspector.json
-    COMMAND ${PYTHON_EXECUTABLE} ${WEBCORE_DIR}/inspector/generate-inspector-idl -o ${DERIVED_SOURCES_DIR}/Inspector.idl ${WEBCORE_DIR}/inspector/Inspector.json
+    COMMAND ${PYTHON_EXECUTABLE} ${WEBCORE_DIR}/inspector/generate-inspector-idl -o ${DERIVED_SOURCES_WEBCORE_DIR}/Inspector.idl ${WEBCORE_DIR}/inspector/Inspector.json
     VERBATIM)
 
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.h ${DERIVED_SOURCES_DIR}/InspectorFrontend.cpp ${DERIVED_SOURCES_DIR}/InspectorFrontend.h
-    MAIN_DEPENDENCY ${DERIVED_SOURCES_DIR}/Inspector.idl
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/inspector/CodeGeneratorInspector.pm ${DERIVED_SOURCES_DIR}/Inspector.idl
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts -I${WEBCORE_DIR}/inspector ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator Inspector ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${DERIVED_SOURCES_DIR}/Inspector.idl
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/InspectorBackendDispatcher.h ${DERIVED_SOURCES_WEBCORE_DIR}/InspectorFrontend.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/InspectorFrontend.h
+    MAIN_DEPENDENCY ${DERIVED_SOURCES_WEBCORE_DIR}/Inspector.idl
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/inspector/CodeGeneratorInspector.pm ${DERIVED_SOURCES_WEBCORE_DIR}/Inspector.idl
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts -I${WEBCORE_DIR}/inspector ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator Inspector ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${DERIVED_SOURCES_WEBCORE_DIR}/Inspector.idl
     VERBATIM)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_DIR}/InspectorFrontend.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/InspectorFrontend.cpp)
 
 
 # Generate InjectedScriptSource.h
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/InjectedScriptSource.h
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedScriptSource.h
     MAIN_DEPENDENCY inspector/InjectedScriptSource.js
-    COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/inspector/xxd.pl InjectedScriptSource_js ${WEBCORE_DIR}/inspector/InjectedScriptSource.js ${DERIVED_SOURCES_DIR}/InjectedScriptSource.h
+    COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/inspector/xxd.pl InjectedScriptSource_js ${WEBCORE_DIR}/inspector/InjectedScriptSource.js ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedScriptSource.h
     VERBATIM)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/InjectedScriptSource.h)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedScriptSource.h)
 
 
 MAKE_HASH_TOOLS(${WEBCORE_DIR}/platform/ColorData)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/ColorData.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/ColorData.cpp)
 
 
 MAKE_HASH_TOOLS(${WEBCORE_DIR}/html/DocTypeStrings)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/DocTypeStrings.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/DocTypeStrings.cpp)
+
+
+# Generate XMLViewerCSS.h
+ADD_CUSTOM_COMMAND(
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/XMLViewerCSS.h
+    MAIN_DEPENDENCY xml/XMLViewer.css
+    COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/inspector/xxd.pl XMLViewer_css ${WEBCORE_DIR}/xml/XMLViewer.css ${DERIVED_SOURCES_WEBCORE_DIR}/XMLViewerCSS.h
+    VERBATIM)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/XMLViewerCSS.h)
 
 
-# Generate XMLViewerXSL.h
+# Generate XMLViewerJS.h
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/XMLViewerXSL.h
-    MAIN_DEPENDENCY xml/XMLViewer.xsl
-    COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/inspector/xxd.pl XMLViewer_xsl ${WEBCORE_DIR}/xml/XMLViewer.xsl ${DERIVED_SOURCES_DIR}/XMLViewerXSL.h
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/XMLViewerJS.h
+    MAIN_DEPENDENCY xml/XMLViewer.js
+    COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/inspector/xxd.pl XMLViewer_js ${WEBCORE_DIR}/xml/XMLViewer.js ${DERIVED_SOURCES_WEBCORE_DIR}/XMLViewerJS.h
     VERBATIM)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/XMLViewerXSL.h)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/XMLViewerJS.h)
 
 
 # Generate HTML entity table
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/HTMLEntityTable.cpp
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLEntityTable.cpp
     MAIN_DEPENDENCY ${WEBCORE_DIR}/html/parser/HTMLEntityNames.in
     DEPENDS ${WEBCORE_DIR}/html/parser/create-html-entity-table
-    COMMAND ${PYTHON_EXECUTABLE} ${WEBCORE_DIR}/html/parser/create-html-entity-table -o ${DERIVED_SOURCES_DIR}/HTMLEntityTable.cpp ${WEBCORE_DIR}/html/parser/HTMLEntityNames.in
+    COMMAND ${PYTHON_EXECUTABLE} ${WEBCORE_DIR}/html/parser/create-html-entity-table -o ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLEntityTable.cpp ${WEBCORE_DIR}/html/parser/HTMLEntityNames.in
     VERBATIM)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/HTMLEntityTable.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLEntityTable.cpp)
 
 
 # Generate tokenizer
 FILE(TO_NATIVE_PATH ${PERL_EXECUTABLE} PERL_EXECUTABLE_NATIVE_PATH)
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/tokenizer.cpp
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/tokenizer.cpp
     MAIN_DEPENDENCY ${WEBCORE_DIR}/css/maketokenizer
     DEPENDS ${WEBCORE_DIR}/css/tokenizer.flex
-    COMMAND ${FLEX_EXECUTABLE} -t ${WEBCORE_DIR}/css/tokenizer.flex | ${PERL_EXECUTABLE_NATIVE_PATH} ${WEBCORE_DIR}/css/maketokenizer > ${DERIVED_SOURCES_DIR}/tokenizer.cpp
+    COMMAND ${FLEX_EXECUTABLE} -t ${WEBCORE_DIR}/css/tokenizer.flex | ${PERL_EXECUTABLE_NATIVE_PATH} ${WEBCORE_DIR}/css/maketokenizer > ${DERIVED_SOURCES_WEBCORE_DIR}/tokenizer.cpp
     VERBATIM)
-ADD_SOURCE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSParser.cpp tokenizer.cpp)
+ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSParser.cpp tokenizer.cpp)
 
 
 # Generate CSS property names
 ADD_CUSTOM_COMMAND (
-    OUTPUT ${DERIVED_SOURCES_DIR}/CSSPropertyNames.in ${DERIVED_SOURCES_DIR}/CSSPropertyNames.h ${DERIVED_SOURCES_DIR}/CSSPropertyNames.cpp ${DERIVED_SOURCES_DIR}/CSSPropertyNames.gperf
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.in ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.h ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.gperf
     MAIN_DEPENDENCY ${WEBCORE_DIR}/css/makeprop.pl
     DEPENDS ${WebCore_CSS_PROPERTY_NAMES}
-    WORKING_DIRECTORY ${DERIVED_SOURCES_DIR}
-    COMMAND ${PERL_EXECUTABLE} -ne "print" ${WebCore_CSS_PROPERTY_NAMES} > ${DERIVED_SOURCES_DIR}/CSSPropertyNames.in
+    WORKING_DIRECTORY ${DERIVED_SOURCES_WEBCORE_DIR}
+    COMMAND ${PERL_EXECUTABLE} -ne "print" ${WebCore_CSS_PROPERTY_NAMES} > ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.in
     COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/css/makeprop.pl
     VERBATIM)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/CSSPropertyNames.cpp)
-ADD_SOURCE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSParser.cpp CSSValueKeywords.h)
-ADD_SOURCE_DERIVED_DEPENDENCIES(${DERIVED_SOURCES_DIR}/CSSGrammar.cpp CSSPropertyNames.h)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/CSSPropertyNames.cpp)
+ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSParser.cpp CSSValueKeywords.h)
+ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${DERIVED_SOURCES_WEBCORE_DIR}/CSSGrammar.cpp CSSPropertyNames.h)
 
 
 # Generate CSS value keywords
 ADD_CUSTOM_COMMAND (
-    OUTPUT ${DERIVED_SOURCES_DIR}/CSSValueKeywords.in ${DERIVED_SOURCES_DIR}/CSSValueKeywords.h ${DERIVED_SOURCES_DIR}/CSSValueKeywords.cpp ${DERIVED_SOURCES_DIR}/CSSValueKeywords.gperf
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/CSSValueKeywords.in ${DERIVED_SOURCES_WEBCORE_DIR}/CSSValueKeywords.h ${DERIVED_SOURCES_WEBCORE_DIR}/CSSValueKeywords.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/CSSValueKeywords.gperf
     MAIN_DEPENDENCY ${WEBCORE_DIR}/css/makevalues.pl
     DEPENDS ${WebCore_CSS_VALUE_KEYWORDS}
-    WORKING_DIRECTORY ${DERIVED_SOURCES_DIR}
-    COMMAND ${PERL_EXECUTABLE} -ne "print lc" ${WebCore_CSS_VALUE_KEYWORDS} > ${DERIVED_SOURCES_DIR}/CSSValueKeywords.in
+    WORKING_DIRECTORY ${DERIVED_SOURCES_WEBCORE_DIR}
+    COMMAND ${PERL_EXECUTABLE} -ne "print lc" ${WebCore_CSS_VALUE_KEYWORDS} > ${DERIVED_SOURCES_WEBCORE_DIR}/CSSValueKeywords.in
     COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/css/makevalues.pl
     VERBATIM)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/CSSValueKeywords.cpp)
-ADD_SOURCE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSParser.cpp CSSValueKeywords.h)
-ADD_SOURCE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSPrimitiveValueMappings.h CSSValueKeywords.h)
-ADD_SOURCE_DERIVED_DEPENDENCIES(${DERIVED_SOURCES_DIR}/CSSGrammar.cpp CSSValueKeywords.h)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/CSSValueKeywords.cpp)
+ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSParser.cpp CSSValueKeywords.h)
+ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSPrimitiveValueMappings.h CSSValueKeywords.h)
+ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${DERIVED_SOURCES_WEBCORE_DIR}/CSSGrammar.cpp CSSValueKeywords.h)
 
 
 # Generate user agent styles
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/UserAgentStyleSheetsData.cpp ${DERIVED_SOURCES_DIR}/UserAgentStyleSheets.h
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheetsData.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheets.h
     MAIN_DEPENDENCY ${WEBCORE_DIR}/css/make-css-file-arrays.pl
     DEPENDS ${WebCore_USER_AGENT_STYLE_SHEETS}
-    COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/css/make-css-file-arrays.pl ${DERIVED_SOURCES_DIR}/UserAgentStyleSheets.h ${DERIVED_SOURCES_DIR}/UserAgentStyleSheetsData.cpp ${WebCore_USER_AGENT_STYLE_SHEETS}
+    COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/css/make-css-file-arrays.pl ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheets.h ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheetsData.cpp ${WebCore_USER_AGENT_STYLE_SHEETS}
     VERBATIM)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/UserAgentStyleSheetsData.cpp)
-ADD_SOURCE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSStyleSelector.cpp UserAgentStyleSheetsData.cpp UserAgentStyleSheets.h)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/UserAgentStyleSheetsData.cpp)
+ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/css/CSSStyleSelector.cpp UserAgentStyleSheetsData.cpp UserAgentStyleSheets.h)
 
 
-GENERATE_GRAMMAR(cssyy ${WEBCORE_DIR}/css/CSSGrammar.y ${DERIVED_SOURCES_DIR}/CSSGrammar.h ${DERIVED_SOURCES_DIR}/CSSGrammar.cpp)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/CSSGrammar.cpp)
+GENERATE_GRAMMAR(cssyy ${WEBCORE_DIR}/css/CSSGrammar.y ${DERIVED_SOURCES_WEBCORE_DIR}/CSSGrammar.h ${DERIVED_SOURCES_WEBCORE_DIR}/CSSGrammar.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/CSSGrammar.cpp)
 
 
-GENERATE_GRAMMAR(xpathyy ${WEBCORE_DIR}/xml/XPathGrammar.y ${DERIVED_SOURCES_DIR}/XPathGrammar.h ${DERIVED_SOURCES_DIR}/XPathGrammar.cpp)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/XPathGrammar.cpp)
+GENERATE_GRAMMAR(xpathyy ${WEBCORE_DIR}/xml/XPathGrammar.y ${DERIVED_SOURCES_WEBCORE_DIR}/XPathGrammar.h ${DERIVED_SOURCES_WEBCORE_DIR}/XPathGrammar.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/XPathGrammar.cpp)
 
 
 
-ADD_SOURCE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/html/HTMLTreeBuilder.cpp MathMLNames.cpp)
+ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES(${WEBCORE_DIR}/html/HTMLTreeBuilder.cpp MathMLNames.cpp)
 
 
 GENERATE_DOM_NAMES(HTML ${WEBCORE_DIR}/html/HTMLAttributeNames.in ${WEBCORE_DIR}/html/HTMLTagNames.in "${HTML_FEATURES}")
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/HTMLNames.cpp ${DERIVED_SOURCES_DIR}/HTMLElementFactory.cpp ${DERIVED_SOURCES_DIR}/JSHTMLElementWrapperFactory.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLNames.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLElementFactory.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JSHTMLElementWrapperFactory.cpp)
 
 
 GENERATE_DOM_NAMES(MathML ${WEBCORE_DIR}/mathml/mathattrs.in ${WEBCORE_DIR}/mathml/mathtags.in "${MATHML_FEATURES}")
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/MathMLNames.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/MathMLNames.cpp)
 IF (ENABLE_MATHML)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/MathMLElementFactory.cpp)
+    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/MathMLElementFactory.cpp)
 ENDIF ()
 
 
 GENERATE_DOM_NAMES(SVG ${WEBCORE_DIR}/svg/svgattrs.in ${WEBCORE_DIR}/svg/svgtags.in "${SVG_FEATURES}")
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/SVGNames.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/SVGNames.cpp)
 IF (ENABLE_SVG)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/SVGElementFactory.cpp ${DERIVED_SOURCES_DIR}/JSSVGElementWrapperFactory.cpp)
+    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/SVGElementFactory.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JSSVGElementWrapperFactory.cpp)
 ENDIF ()
 
 
 GENERATE_DOM_NAMES(WML ${WEBCORE_DIR}/wml/WMLAttributeNames.in ${WEBCORE_DIR}/wml/WMLTagNames.in "${WML_FEATURES}")
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/WMLNames.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/WMLNames.cpp)
 IF (ENABLE_WML)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/WMLElementFactory.cpp)
+    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/WMLElementFactory.cpp)
 ENDIF ()
 
 
 GENERATE_DOM_NAMES(XLink ${WEBCORE_DIR}/svg/xlinkattrs.in)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/XLinkNames.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/XLinkNames.cpp)
 
 
 GENERATE_DOM_NAMES(XMLNS ${WEBCORE_DIR}/xml/xmlnsattrs.in)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/XMLNSNames.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/XMLNSNames.cpp)
 
 
 GENERATE_DOM_NAMES(XML ${WEBCORE_DIR}/xml/xmlattrs.in)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/XMLNames.cpp)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/XMLNames.cpp)
 
 
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/WebKitVersion.h
+    OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/WebKitVersion.h
     MAIN_DEPENDENCY ${WEBKIT_DIR}/scripts/generate-webkitversion.pl
     DEPENDS ${WEBKIT_DIR}/mac/Configurations/Version.xcconfig
-    COMMAND ${PERL_EXECUTABLE} ${WEBKIT_DIR}/scripts/generate-webkitversion.pl --config ${WEBKIT_DIR}/mac/Configurations/Version.xcconfig --outputDir ${DERIVED_SOURCES_DIR}
+    COMMAND ${PERL_EXECUTABLE} ${WEBKIT_DIR}/scripts/generate-webkitversion.pl --config ${WEBKIT_DIR}/mac/Configurations/Version.xcconfig --outputDir ${DERIVED_SOURCES_WEBCORE_DIR}
     VERBATIM)
-LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/WebKitVersion.h)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/WebKitVersion.h)
 
 
 SET(WebCore_LIBRARIES
diff --git a/Source/WebCore/CMakeListsEfl.txt b/Source/WebCore/CMakeListsEfl.txt
index 8c19c19..88de248 100644
--- a/Source/WebCore/CMakeListsEfl.txt
+++ b/Source/WebCore/CMakeListsEfl.txt
@@ -75,7 +75,7 @@ LIST(APPEND WebCore_SOURCES
   plugins/PluginDataNone.cpp
 )
 
-IF (WTF_PLATFORM_CAIRO)
+IF (WTF_USE_CAIRO)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/cairo"
   )
@@ -90,6 +90,8 @@ IF (WTF_PLATFORM_CAIRO)
     platform/graphics/cairo/OwnPtrCairo.cpp
     platform/graphics/cairo/PathCairo.cpp
     platform/graphics/cairo/PatternCairo.cpp
+    platform/graphics/cairo/PlatformContextCairo.cpp
+    platform/graphics/cairo/PlatformPathCairo.cpp
     platform/graphics/cairo/RefPtrCairo.cpp
     platform/graphics/cairo/TransformationMatrixCairo.cpp
 
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 204f540..b0b0239 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,9 +1,16490 @@
+2011-04-19  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Initialize depth mask to known value before getBooleanv call
+        https://bugs.webkit.org/show_bug.cgi?id=58948
+
+        This trips an assert in the GPU command buffer client code if the
+        pointed-to value is not initialized to 0 or -1.
+
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        (WebCore::DrawingBuffer::clearFramebuffer):
+
+2011-04-19  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        BitmapImage::destroyMetadataAndNotify should clear m_checkedForSolidColor
+        https://bugs.webkit.org/show_bug.cgi?id=58926
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyMetadataAndNotify): Set m_checkedForSolidColor to false.
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::assertNotSolidColor):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern): Add assert to make sure this is not called for a 1x1 image.
+
+2011-04-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Ojan Vafai.
+
+        REGRESSION(r83967): Crash in selectionExtentRespectingEditingBoundary
+        https://bugs.webkit.org/show_bug.cgi?id=58910
+
+        The crash was caused by selectionExtentRespectingEditingBoundary's incorrectly assuming that
+        targetNode always have renderer when there selection has an editable root and the target node
+        is outside of the editable root.
+        
+        Fixed the bug by adding an early exit when the target node is null.
+
+        No new tests are added since we don't have a reduction for this crash.
+
+        * page/EventHandler.cpp:
+        (WebCore::selectionExtentRespectingEditingBoundary):
+
+2011-04-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix v8 build.
+
+        * bindings/scripts/CodeGeneratorV8.pm: This is a pretty bad system.
+
+2011-04-19  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        REGRESSION(r55762): Highlight color can't be copied in gmail.
+        https://bugs.webkit.org/show_bug.cgi?id=58925
+        <rdar://problem/9253057>
+
+        Test: editing/pasteboard/copy-text-with-backgroundcolor.html
+
+        The changes of r55762 uncovered the underlying issue here. The markup fragment
+        placed in the pasteboard does not contain the background color style.
+        This occurs only if the selection is limited to a single text node, whereas if the
+        selection spans across multiple nodes, the style is preserved correctly.
+        The fix consists in changing the logic that decides whether we should include the wrapping
+        node in the markup. That logic is based on the code in highestAncestorToWrapMarkup which relies
+        on isElementPresentational to choose candidates to be the wrapping node.
+        I've extended it to accept nodes that have non fully transparent background colors.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::hasTransparentBackgroundColor): Now is a static method of the class.
+        * editing/Editor.h:
+        * editing/markup.cpp:
+        (WebCore::isElementPresentational): Modified to use hasTransparentBackgroundColor.
+
+2011-04-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed a use of markDOMObjectWrapper: NodeLists
+        https://bugs.webkit.org/show_bug.cgi?id=58939
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren): No need to mark node lists, because
+        now they use the opaque roots system to decide their lifetimes.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp: Removed stray newline.
+
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeListOwner::isReachableFromOpaqueRoots):
+        (WebCore::JSNodeListOwner::finalize):
+        (WebCore::wrapperOwner):
+        (WebCore::wrapperContext):
+        (WebCore::toJS): Use the opaque roots system to avoid relying on
+        markDOMObjectWrapper.
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::isDynamicNodeList):
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicNodeList::rootNode): Added the ability to get the node
+        backing a NodeList, for use in the opaque roots system.
+
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/NodeList.h:
+        (WebCore::NodeList::isDynamicNodeList): Ditto. Removed cruft related
+        to the old way of marking NodeLists.
+
+        * dom/NodeList.idl: We need a custom toJS so we can specify a custom
+        WeakHandleOwner at construction time.
+
+2011-04-19  Antoine Labour  <piman@chromium.org>
+
+        Reviewed by James Robinson.
+
+        For invisible iframes, propagate compositing to parent instead of setting self
+        as root.
+        https://bugs.webkit.org/show_bug.cgi?id=58414
+
+        Tests: compositing/iframes/invisible-iframe.html
+               compositing/iframes/invisible-nested-iframe-hide.html
+               compositing/iframes/invisible-nested-iframe-show.html
+               compositing/iframes/invisible-nested-iframe.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::shouldPropagateCompositingToEnclosingFrame):
+        Propagate compositing to parent even if frame owner has no renderer.
+
+2011-04-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/9271848> Crash when the document element is removed
+
+        Test: fast/events/overflow-viewport-renderer-deleted.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::calculateScrollbarModesForLayout): Reset m_viewportRenderer, in case this
+        function takes a code path that doesn’t call applyOverflowToViewport().
+        (WebCore::FrameView::layout): Whitespace change.
+
+2011-04-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57898
+        REGRESSION (r82185): Scroll position not restored on navigation back to a page in 
+        the page cache
+        -and corresponding-
+        <rdar://problem/9226652>
+
+        Setting the contentsSize of a ScrollView to (0, 0) necessarily causes the scroll 
+        position to be lost. (The scroll position is computed based on the 
+        visibleContentSize.) This patch provides a mechanism to cache the current scroll 
+        position, and then the HistoryController accesses only the cached position rather 
+        than calling scrollPosition() which does a computation based on the 
+        visibleContentSize. 
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::resetScrollbarsAndClearContentsSize):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::cacheCurrentScrollPosition):
+        (WebCore::ScrollView::cachedScrollPosition):
+
+2011-04-19  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move the alignment related macros in Vector.h to new Alignment.h.
+        https://bugs.webkit.org/show_bug.cgi?id=56000
+
+        Adding the new file to the forwarding headers of WebCore.
+
+        * ForwardingHeaders/wtf/Alignment.h: Added.
+
+2011-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtInstance method cache ownership rules are unclear
+        https://bugs.webkit.org/show_bug.cgi?id=58820
+
+        Make the QtInstance method cache use WriteBarrier, and handle
+        ownership properly.
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
+        (JSC::Bindings::QtClass::fieldNamed):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::removeCachedMethod):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+
+2011-04-19  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/57867> Re-order enum ResourceLoadPriority to make Unresolved value less important
+
+        Reviewed by Antti Koivisto.
+
+        * platform/network/ResourceLoadPriority.h:
+        (enum ResourceLoadPriority): Moved Unresolved enum to the top of
+        the list and set to -1 to emphasize the fact that this is an
+        unresolved priority (rather than one higher than the highest
+        priority).  Removed whitespace from the end of all enum lines.
+
+2011-04-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Background radius is wrong for split inline
+        https://bugs.webkit.org/show_bug.cgi?id=58843
+        
+        When computing the radii for a segment of a split inline, we have to
+        constrain those radii for the current segment, while still drawing
+        using the entire logical width.
+
+        Tests: fast/backgrounds/border-radius-split-background-image.html
+               fast/backgrounds/border-radius-split-background.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayer):
+        Pass height and width for this box only to paintFillLayer()
+        
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintFillLayer):
+        Pass 0 for unused inlineBox height and width.
+
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect):
+        When computing the rounded background rect, we have to take the size of
+        this segment of the inline box into account for radius constraining.
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        Call getBackgroundRoundedRect() in two places.
+
+2011-04-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix. For some reason RenderBoxModelObject.cpp
+        was missing from my last commit.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::borderWillArcInnerEdge):
+        (WebCore::edgeFlagForSide):
+        (WebCore::includesEdge):
+        (WebCore::BorderEdge::BorderEdge):
+        (WebCore::BorderEdge::hasVisibleColorAndStyle):
+        (WebCore::BorderEdge::shouldRender):
+        (WebCore::BorderEdge::presentButInvisible):
+        (WebCore::BorderEdge::usedWidth):
+        (WebCore::BorderEdge::getDoubleBorderStripeWidths):
+        (WebCore::edgesShareColor):
+        (WebCore::styleRequiresClipPolygon):
+        (WebCore::borderStyleFillsBorderArea):
+        (WebCore::borderStyleHasInnerDetail):
+        (WebCore::borderStyleIsDottedOrDashed):
+        (WebCore::borderStyleHasUnmatchedColorsAtCorner):
+        (WebCore::colorsMatchAtCorner):
+        (WebCore::willBeOverdrawn):
+        (WebCore::borderStylesRequireMitre):
+        (WebCore::joinRequiresMitre):
+        (WebCore::RenderBoxModelObject::paintOneBorderSide):
+        (WebCore::RenderBoxModelObject::paintBorderSides):
+        (WebCore::RenderBoxModelObject::paintTranslucentBorderSides):
+        (WebCore::RenderBoxModelObject::paintBorder):
+        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
+        (WebCore::findInnerVertex):
+        (WebCore::RenderBoxModelObject::clipBorderSidePolygon):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+
+2011-04-19  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Refactor GLES2Canvas state application out into its own function.
+        https://bugs.webkit.org/show_bug.cgi?id=58906
+
+        Covered by existing tests in fast/canvas and canvas/philip.
+
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::applyState):
+        New function to apply compositing and clipping state.
+        (WebCore::GLES2Canvas::fillPath):
+        (WebCore::GLES2Canvas::fillRect):
+        (WebCore::GLES2Canvas::beginShadowDraw):
+        (WebCore::GLES2Canvas::endShadowDraw):
+        Refactor calls to applyState().
+        * platform/graphics/chromium/GLES2Canvas.h:
+
+2011-04-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix multiple border rendering issues
+        https://bugs.webkit.org/show_bug.cgi?id=58761
+        
+        Fix various border-drawing bugs, and optimize some common cases.
+        Also refactors a lot of the border-drawing code to be more maintainable.
+        
+            Rounded border rendering with different border widths looks strange
+            https://bugs.webkit.org/show_bug.cgi?id=17468
+            
+            paintBorder in RenderObject paint two times the corners
+            https://bugs.webkit.org/show_bug.cgi?id=20495
+            
+            Overdraw at box corners when using RGBA colors with alpha
+            https://bugs.webkit.org/show_bug.cgi?id=21835
+            
+            Enable antialiasing for border drawing, when transformed
+            https://bugs.webkit.org/show_bug.cgi?id=22746
+            
+            Drawing border-radius from path sometimes fails to round outer border in the double style when it should
+            https://bugs.webkit.org/show_bug.cgi?id=41301
+            
+            Drawing border-radius from path doesn't appear to always match up border edges correctly
+            https://bugs.webkit.org/show_bug.cgi?id=41302
+            
+        Also fixes
+            Should be able to create Path from RoundedIntRect
+            https://bugs.webkit.org/show_bug.cgi?id=58809
+
+        Tests: fast/borders/border-radius-different-width-001.html
+               fast/borders/border-radius-inset-outset.html
+               fast/borders/table-borders.html
+
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::findSlope):
+        (WebCore::findIntersection):
+        New geometry helper functions (should eventually move into a new
+        GeometryUtilities file).
+        
+        * platform/graphics/Path.h:
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::addRoundedRect):
+        Add an overload of addRoundedRect() that takes a RoundedIntRect.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::addRoundedRectClip):
+        (WebCore::GraphicsContext::clipOutRoundedRect):
+        (WebCore::GraphicsContext::fillRectWithRoundedHole):
+        Can now add a RoundedIntRect to a Path directly.
+        
+        * platform/graphics/IntRect.h:
+        (WebCore::IntRect::minXMinYCorner):
+        (WebCore::IntRect::maxXMinYCorner):
+        (WebCore::IntRect::minXMaxYCorner):
+        (WebCore::IntRect::maxXMaxYCorner):
+        Convenience functions to get the rect corners, in a writing-mode-
+        friendly way.
+
+        * platform/graphics/RoundedIntRect.h:
+        * platform/graphics/RoundedIntRect.cpp:
+        (WebCore::RoundedIntRect::isRenderable):
+        We need to know when Path::addRoundedRect() will fail because
+        the sum of the radii exceed the height or width. This method tells
+        us that.
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillRectWithRoundedHole):
+        Can now add a RoundedIntRect to a Path directly.
+
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::borderWillArcInnerEdge):
+        This can just to see if there are inner radii now.
+        
+        (WebCore::edgeFlagForSide):
+        (WebCore::includesEdge):
+        Convenience functions for the BorderEdgeFlags bitmask.
+        
+        (WebCore::BorderEdge::BorderEdge):
+        (WebCore::BorderEdge::hasVisibleColorAndStyle):
+        (WebCore::BorderEdge::shouldRender):
+        (WebCore::BorderEdge::presentButInvisible):
+        (WebCore::BorderEdge::usedWidth):
+        (WebCore::BorderEdge::getDoubleBorderStripeWidths):
+        Convenience class to hold data about how a single edge
+        is drawn, and to contain some commonly used width-related methods.
+        
+        (WebCore::edgesShareColor):
+        (WebCore::styleRequiresClipPolygon):
+        (WebCore::borderStyleFillsBorderArea):
+        (WebCore::borderStyleHasInnerDetail):
+        (WebCore::borderStyleIsDottedOrDashed):
+        (WebCore::borderStyleHasUnmatchedColorsAtCorner):
+        (WebCore::colorsMatchAtCorner):
+        (WebCore::willBeOverdrawn):
+        (WebCore::borderStylesRequireMitre):
+        (WebCore::joinRequiresMitre):
+        Functions used to make the border drawing code more readable,
+        which are used to determine when corners need a mitre, and
+        need antialiasing.
+        
+        (WebCore::RenderBoxModelObject::paintOneBorderSide):
+        Code to paint one side of a border, either via the path, or
+        using rects/polygons, the appropriate mitres and antialiasing
+        at the corners. includeLogicalLeftEdge and includeLogicalRightEdge need
+        to be passed all the way down here so that when we recompute the
+        path for double and ridge/groove borders, we correctly handle split box
+        borders.
+        
+        (WebCore::RenderBoxModelObject::paintBorderSides):
+        Paints the 4 border sides (if present).
+        
+        (WebCore::RenderBoxModelObject::paintTranslucentBorderSides):
+        Called when one or more of the borders has a non-opaque color,
+        and uses a transparency layer for each set of same-colored
+        sides to avoid overdraw at the corners.
+        
+        (WebCore::RenderBoxModelObject::paintBorder):
+        Builds an array of BorderEdge so we can iterate over them to 
+        detect different border compbinations, and optimizations. Has
+        a fast path for all-solid borders.
+        
+        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
+        Moved from RenderObject, since all callers are in RenderBoxModelObject.
+        Has the following changes:
+          * Don't attempt to draw dashes if there is only space for a few,
+            since it looks bad.
+          * Handle double and groove borders on split inlines correctly,
+            making use of includeLogicalLeftEdge, includeLogicalRightEdge
+
+        (WebCore::findInnerVertex):
+        For borders with a radiused inner edge, the per-side clip polygon
+        has to project inside the padding box to avoid clipping the inner edge.
+        This function computes a reasonable inner corner for the clipping
+        polygon.
+        (WebCore::RenderBoxModelObject::clipBorderSidePolygon):
+        Have the corner joins pass through the corners of the inner and outer
+        border rectangles, ensure we don't clip the inside if necessary,
+        and handle antialiasing on the two mitres.
+        
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        Use RenderStyle::getRoundedInnerBorderFor() rather than computeBorderInnerRect()
+        etc.
+
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        Moved to RenderBoxModelObject.
+        
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getRoundedBorderFor):
+        (WebCore::RenderStyle::getRoundedInnerBorderFor):
+        There was some very clumsy code that computed a rounded rect
+        given the border rect and side widths. Cleaned this up by moving
+        some code into RenderStyle. The overloaded getRoundedInnerBorderFor()
+        which takes the border widths is used by the double and groove drawing
+        code.
+
+2011-04-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION(r74228-75294): removing nodes is 200+ times slower when selection is inside a shadow DOM
+        https://bugs.webkit.org/show_bug.cgi?id=57061
+
+        The bug was caused by Range::compareNode's incorrectly returning NODE_INSIDE when the selection is inside
+        a shadow DOM and the node is outside of the shadow DOM. This caused respondToNodeModification to call
+        RenderView::clearSelection every time a node is removed when selection is in a shadow DOM and resulted in
+        a significant performance regression.
+
+        Fixed Ranged::compareNode by making Range::compareBoundaryPoints throw a WRONG_DOCUMENT_ERR when there are
+        no common ancestors between containerA and containerB. This will force compareNode to also throw an exception
+        and prevents respondToNodeModification from clearing selection.
+
+        No new tests because this is a performance improvement and the fix in Range cannot be tested since shadow DOM
+        isn't exposed to JavaScript.
+
+        * dom/Range.cpp:
+        (WebCore::Range::setStart): Calls compareBoundaryPoints; since we ensures that the root container noes of
+        start and end nodes are same, we should never get an exception from compareBoundaryPoints.
+        (WebCore::Range::setEnd): Ditto.
+        (WebCore::Range::isPointInRange): Calls compareBoundaryPoints; returns false when compareBoundaryPoints
+        throws an exception.
+        (WebCore::Range::comparePoint): Calls compareBoundaryPoints; exit early when an exception is thrown by
+        compareBoundaryPoints.
+        (WebCore::Range::compareBoundaryPoints): Throws an exception when two containers do not have a common ancestor.
+        (WebCore::Range::boundaryPointsValid): Calls compareBoundaryPoints and checks that it didn't throw an exception.
+        * dom/Range.h:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::respondToNodeModification):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions): Calls compareBoundaryPoints.
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Calls compareBoundaryPoints; since startNode and pastEnd are both in the same document
+        and neither are in a shadow DOM, it should never throw an exception.
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::containsNode): Calls compareBoundaryPoints; node is fully selected only if no exception
+        was thrown.
+
+2011-04-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by David Levin
+
+        Make U+FEFF be treated as a zero-width character in both
+        simple script and complex script code paths. In Chromium
+        Windows, UniscribeHelper needs a rather extensive changes
+        summarized below.  Other ports need minor changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48860
+
+        Test: fast/text/zero-width-characters-complex-script.html
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::treatAsZeroWidthSpace): U+FEFF is added to the list
+        (WebCore::Font::treatAsZeroWidthSpaceInComplexScript): Added. Same as the above except that ZWNJ and ZWJ are excluded.
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage): U+FEFF is made to have zero-width characters in simple script (fast) code path.
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::FontMap::getSpaceGlyph): Added to get the gid for space glyph to use in adjustSpaceAdvance when zero-width glyph character has a non-zero width and potentially 'visible' glyph.
+        (WebCore::FontMap::FontData::FontData): spaceGlyph member added.
+        (WebCore::getDerivedFontData): spaceGlyph is retrieved as well.
+        * platform/graphics/chromium/FontUtilsChromiumWin.h:
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::UniscribeHelper): m_spaceGlyph added.
+        (WebCore::UniscribeHelper::shape): spaceGlyph is obtained stored for a font tried for each item.
+        (WebCore::UniscribeHelper::adjustSpaceAdvances): For zero-width complex script characters, set the advance width to zero and replace a non-zero-width/visible glyph with a space glyph.
+        (WebCore::UniscribeHelper::applySpacing):
+        (WebCore::UniscribeHelper::containsMissingGlyphs): turned to a member function because it cannot work on glyphs alone any more but need to take into account a character corresponding to a glyph
+        * platform/graphics/chromium/UniscribeHelper.h: 
+        (WebCore::UniscribeHelper::Shaping::Shaping): m_spaceGlyph is added
+        * platform/graphics/chromium/UniscribeHelperTextRun.cpp:
+        (WebCore::UniscribeHelperTextRun::UniscribeHelperTextRun): When calling UniscriberHelper, add a new argument for spaceGlyph.
+
+2011-04-19  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Extend the DIBPixelData class with the facility for writing the
+        bitmap representation to disk for debugging purposes.
+        https://bugs.webkit.org/show_bug.cgi?id=58862.
+
+        * platform/graphics/win/DIBPixelData.cpp:
+        (WebCore::DIBPixelData::writeToFile): New function.
+        * platform/graphics/win/DIBPixelData.h:
+
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename lengthReceived to encodedDataLength/dataLength
+        https://bugs.webkit.org/show_bug.cgi?id=58883
+
+        * fileapi/FileReaderLoader.cpp:
+        (WebCore::FileReaderLoader::didReceiveData):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveContentLengthImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::didReceiveContentLength):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveContentLength):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype.dataReceived):
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::didReceiveData):
+        (WebCore::DocumentThreadableLoader::didReceiveCachedMetadata):
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveData):
+        * loader/MainResourceLoader.h:
+        * loader/NetscapePlugInStreamLoader.cpp:
+        (WebCore::NetscapePlugInStreamLoader::didReceiveData):
+        * loader/NetscapePlugInStreamLoader.h:
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveData):
+        * loader/ResourceLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::didReceiveData):
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        (WebCore::SubresourceLoaderClient::didReceiveData):
+        (WebCore::SubresourceLoaderClient::didReceiveCachedMetadata):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveCachedMetadata):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveData):
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * notifications/Notification.cpp:
+        (WebCore::Notification::didReceiveData):
+        * notifications/Notification.h:
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (StreamingClient::didReceiveData):
+        * platform/network/BlobResourceHandle.cpp:
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::didReceiveData):
+        * platform/network/android/ResourceHandleAndroid.cpp:
+        (WebCore::SyncLoader::didReceiveData):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoaderClient::didReceiveData):
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreSynchronousLoaderClient::didReceiveData):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        * platform/network/win/ResourceHandleWin.cpp:
+        * workers/WorkerScriptLoader.h:
+        * xml/XMLHttpRequest.h:
+
+2011-04-19  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Pull framebuffer clearing out into its own function.
+        https://bugs.webkit.org/show_bug.cgi?id=58897
+
+        Covered by fast/canvas and canvas/philip tests.
+
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        (WebCore::DrawingBuffer::clearFramebuffer):
+        (WebCore::DrawingBuffer::reset):
+        * platform/graphics/gpu/DrawingBuffer.h:
+
+2011-04-19 Brian Salomon <bsalomon@google.com>
+
+        Reviewed by Eric Seidel.
+
+        When flushing GrContext in ~PlatformContextSkia be sure correct GL context is set
+        https://bugs.webkit.org/show_bug.cgi?id=58788
+
+        Chromium browser test will be added that loads canvas page and then an 
+        acclerated-composited page. Test must trigger ~PlatformContextSkia() 
+        followed by invocation of GL compositor.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::~PlatformContextSkia):
+
+2011-04-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] REGRESSION(84176): http/tests/xmlhttprequest/event-listener-gc.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=58871
+
+        Unreviewed, rolling out r84176, r84178, r84186, r84212 and r84231.
+        http://trac.webkit.org/changeset/84176 (original patch)
+        http://trac.webkit.org/changeset/84178 (original patch - part 2)
+        http://trac.webkit.org/changeset/84186 (build fix)
+        http://trac.webkit.org/changeset/84212
+        http://trac.webkit.org/changeset/84231 (skip failing test)
+
+        original bugs:
+         - https://bugs.webkit.org/show_bug.cgi?id=58718
+         - https://bugs.webkit.org/show_bug.cgi?id=58853
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::removeCachedMethod):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+
+2011-04-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84050.
+        http://trac.webkit.org/changeset/84050
+        https://bugs.webkit.org/show_bug.cgi?id=58892
+
+        fast/dom/HTMLKeygenElement/keygen.html is crashing on Chromium
+        (Requested by jknotten on #webkit).
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::takeAllChildrenFrom):
+        (WebCore::ContainerNode::removeBetween):
+        (WebCore::ContainerNode::removeChildren):
+        (WebCore::ContainerNode::parserAddChild):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::setDocType):
+        * dom/Element.h:
+        * dom/Node.cpp:
+        (WebCore::Node::treeScope):
+        (WebCore::Node::setTreeScope):
+        (WebCore::Node::setTreeScopeRecursively):
+        * dom/Node.h:
+        (WebCore::Node::document):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        * dom/ShadowRoot.h:
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::TreeScope):
+        (WebCore::TreeScope::setParentTreeScope):
+        * dom/TreeScope.h:
+        * rendering/RenderSlider.cpp:
+
+2011-04-19  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Not reviewed; windows build fix attempt.
+
+        * storage/StorageInfo.cpp:
+        (WebCore::StorageInfo::~StorageInfo):
+        * storage/StorageInfo.h:
+
+2011-04-19  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Enable QUOTA API at runtime if enable-quota flag is given
+        https://bugs.webkit.org/show_bug.cgi?id=58784
+
+        No new tests as this does not change any functionality.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::quotaEnabled):
+        (WebCore::RuntimeEnabledFeatures::setQuotaEnabled):
+        * page/DOMWindow.idl:
+
+2011-04-19  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Enable folder drag-n-drop when using a "webkitdirectory" file input
+        https://bugs.webkit.org/show_bug.cgi?id=58401
+
+        This uses a new ChromeClient API to enumerate the directory and 
+        return all the files, as if the user had selected that directory
+        by clicking the control in the normal way.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::enumerateChosenDirectory):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::enumerateChosenDirectory):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::appendKeyValuePairItems):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::receiveDropForDirectoryUpload):
+        (WebCore::RenderFileUploadControl::receiveDroppedFiles):
+        * rendering/RenderFileUploadControl.h:
+
+2011-04-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84150.
+        http://trac.webkit.org/changeset/84150
+        https://bugs.webkit.org/show_bug.cgi?id=58875
+
+        Broken backspace in Search box of Web Inspector (Requested by
+        apavlov on #webkit).
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2011-04-19  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: NPE in TextEditorModel
+        https://bugs.webkit.org/show_bug.cgi?id=58870
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._frameAdded):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype.setText):
+
+2011-04-19  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        IndexedDB: Remove accidental header include directive from LevelDB backend.
+        https://bugs.webkit.org/show_bug.cgi?id=58872
+
+        No new functionality, no new tests.
+
+        * storage/IDBLevelDBBackingStore.cpp:
+
+2011-04-19  Herczeg Zoltan  <zherczeg@webkit.org>
+
+        Build fix.
+
+        LEFilter change doesn't compile on ARM neon targets
+        https://bugs.webkit.org/show_bug.cgi?id=58671
+
+        Thanks for Charlie Lee to fixing this.
+
+        * WebCore.gypi:
+
+2011-04-19  Daniel Bates  <dbates@webkit.org>
+
+        Attempt to fix the Qt Linux Release Minimal build after changeset 84225
+        <http://trac.webkit.org/changeset/84225> (https://bugs.webkit.org/show_bug.cgi?id=52788).
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::ensureEventAncestors): Add ENABLE(SVG) guards around call
+        to Node::svgShadowHost() since this method is only defined when building with SVG enabled.
+
+2011-04-18  Dominic Cooney  <dominicc@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Makes SVG shadow roots and DOM shadow roots distinct.
+        https://bugs.webkit.org/show_bug.cgi?id=52788
+
+        Not a functional change. Covered by existing SVG tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::findElementInstance):
+        (WebCore::EventDispatcher::adjustToShadowBoundaries):
+        (WebCore::EventDispatcher::adjustRelatedTarget):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+        * dom/Node.cpp:
+        (WebCore::Node::setShadowHost):
+        (WebCore::Node::svgShadowHost):
+        (WebCore::Node::shadowTreeRootNode):
+        * dom/Node.h:
+        (WebCore::Node::isSVGShadowRoot):
+        (WebCore::Node::parentNode):
+        (WebCore::Node::parentNodeGuaranteedHostFree):
+        * rendering/svg/RenderSVGShadowTreeRootContainer.cpp:
+        (WebCore::RenderSVGShadowTreeRootContainer::~RenderSVGShadowTreeRootContainer):
+        (WebCore::RenderSVGShadowTreeRootContainer::updateFromElement):
+        * rendering/svg/SVGShadowTreeElements.cpp:
+        (WebCore::SVGShadowTreeRootElement::SVGShadowTreeRootElement):
+        (WebCore::SVGShadowTreeRootElement::create):
+        (WebCore::SVGShadowTreeRootElement::attachElement):
+        (WebCore::SVGShadowTreeRootElement::clearSVGShadowHost):
+        * rendering/svg/SVGShadowTreeElements.h:
+        (WebCore::SVGShadowTreeRootElement::isSVGShadowRoot):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::title):
+
+2011-04-18  Taiju TSUIKI  <develop@tzik.jp>
+
+        Reviewed by Darin Fisher.
+
+        Vendor-prefix requestFileSystem in FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=58517
+
+        Prefix from:
+        - window.requestFileSystem to window.webkitRequestFileSystem
+        - window.resolveLocalFileSystemURL to window.webkitResolveLocalFileSystemURL
+        - window.Flags to window.WebKitFlags
+        - WorkerContext.requestFileSystem to WorkerContext.webkitRequestFileSystem
+        - WorkerContext.resolveLocalFileSystemURL to WorkerContext.webkitResolveLocalFileSystemURL
+        - WorkerContext.Flags to WorkerContext.WebKitFlags
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDirectoryEntryCustom.cpp:
+        (WebCore::JSDirectoryEntry::getFile):
+        (WebCore::JSDirectoryEntry::getDirectory):
+        * bindings/js/JSDirectoryEntrySyncCustom.cpp:
+        (WebCore::getFlags):
+        (WebCore::JSDirectoryEntrySync::getFile):
+        (WebCore::JSDirectoryEntrySync::getDirectory):
+        * bindings/v8/custom/V8DirectoryEntryCustom.cpp:
+        (WebCore::V8DirectoryEntry::getDirectoryCallback):
+        (WebCore::V8DirectoryEntry::getFileCallback):
+        * bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp:
+        (WebCore::getFlags):
+        (WebCore::V8DirectoryEntrySync::getDirectoryCallback):
+        (WebCore::V8DirectoryEntrySync::getFileCallback):
+        * fileapi/DOMFileSystemBase.cpp:
+        (WebCore::DOMFileSystemBase::getFile):
+        (WebCore::DOMFileSystemBase::getDirectory):
+        * fileapi/DOMFileSystemBase.h:
+        * fileapi/DirectoryEntry.cpp:
+        (WebCore::DirectoryEntry::getFile):
+        (WebCore::DirectoryEntry::getDirectory):
+        * fileapi/DirectoryEntry.h:
+        * fileapi/DirectoryEntry.idl:
+        * fileapi/DirectoryEntrySync.cpp:
+        (WebCore::DirectoryEntrySync::getFile):
+        (WebCore::DirectoryEntrySync::getDirectory):
+        * fileapi/DirectoryEntrySync.h:
+        * fileapi/DirectoryEntrySync.idl:
+        * fileapi/WebKitFlags.h: Renamed from Source/WebCore/fileapi/Flags.h.
+        (WebCore::WebKitFlags::create):
+        (WebCore::WebKitFlags::isCreate):
+        (WebCore::WebKitFlags::setCreate):
+        (WebCore::WebKitFlags::isExclusive):
+        (WebCore::WebKitFlags::setExclusive):
+        (WebCore::WebKitFlags::WebKitFlags):
+        * fileapi/WebKitFlags.idl: Renamed from Source/WebCore/fileapi/Flags.idl.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitRequestFileSystem):
+        (WebCore::DOMWindow::webkitResolveLocalFileSystemURL):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::webkitRequestFileSystem):
+        (WebCore::WorkerContext::webkitRequestFileSystemSync):
+        (WebCore::WorkerContext::webkitResolveLocalFileSystemURL):
+        (WebCore::WorkerContext::webkitResolveLocalFileSystemSyncURL):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+
+2011-04-18  Steve Lacey  <sjl@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Decouple media controls usage from implementation.
+        This allows each port to implement thier own controls in a different
+        manner to the default webkit implementation.
+
+        Convert media controls hooks to a client interface
+        https://bugs.webkit.org/show_bug.cgi?id=58346
+
+        No new tests as there is no functional change.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaControls):
+        (WebCore::HTMLMediaElement::ensureMediaControls):
+        (WebCore::HTMLMediaElement::preDispatchEventHandler):
+        * html/HTMLMediaElement.h:
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlPanelMuteButtonElement::MediaControlPanelMuteButtonElement):
+        (WebCore::MediaControlPanelMuteButtonElement::create):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::create):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        (WebCore::MediaControlFullscreenButtonElement::create):
+        * html/shadow/MediaControlElements.h:
+        * html/shadow/MediaControlRootElement.cpp:
+        (WebCore::MediaControlRootElement::MediaControlRootElement):
+        (WebCore::MediaControls::create):
+        * html/shadow/MediaControlRootElement.h:
+        * html/shadow/MediaControls.cpp: Added.
+        (WebCore::MediaControls::MediaControls):
+        * html/shadow/MediaControls.h: Added.
+        (WebCore::MediaControls::~MediaControls):
+
+2011-04-18  Pascal Massimino  <pascal.massimino@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Add incremental decoding to WebP decoder
+        https://bugs.webkit.org/show_bug.cgi?id=58851
+
+        No new tests, as it's not possible for the layout test framework to
+        force the decoders to decode incrementally.
+
+        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
+        (WebCore::WEBPImageDecoder::WEBPImageDecoder):
+        (WebCore::WEBPImageDecoder::decode):
+        * platform/image-decoders/webp/WEBPImageDecoder.h:
+
+2011-04-18  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Roben.
+
+        With PAN_SCROLLING, mousedown events for a mouse button aren't dispatched while
+        pressing-and-holding another mouse button
+        https://bugs.webkit.org/show_bug.cgi?id=58700
+
+        Fixes an issue where mousedown events weren't dispatched when pressing a mouse button A
+        while pressing and holding a mouse button B, where A != B. This issue only affects builds
+        that enable PAN_SCROLLING.
+
+        On mouse press with autoscroll in progress (m_autoscrollInProgress == true) we stopped
+        the autoscroll timer, invalidated the click, and swallowed the mouse press. Instead, we
+        should only stop the autoscroll timer.
+
+        Test: fast/events/fire-mousedown-while-pressing-mouse-button.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+
+2011-04-18  Jon Lee  <jonlee@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        With overlay scrollbars, textarea resize corner gains borders when the textarea becomes scrollable
+        https://bugs.webkit.org/show_bug.cgi?id=58617
+        <rdar://problem/9048012>
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer): Check for overlay scrollbars first, and then if the bars were created, before displaying the borders
+
+2011-04-18  Jon Lee  <jonlee@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Selected item background in list box gets rendered on top of overlay scrollbar knob (58824)
+        https://bugs.webkit.org/show_bug.cgi?id=58824
+        <rdar://problem/9292680>
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintObject): Moving the stage of painting the scrollbars to the foreground if using overlay scrollbars
+
+2011-04-18  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Don't cast BitmapImageSingleFrameSkia to BitmapImage
+        https://bugs.webkit.org/show_bug.cgi?id=58821
+
+        BitmapImageSingleFrameSkia has isBitmap return true, but
+        can't be cast to a BitmapImage. Instead of using BitmapImage,
+        use isOpaque from SkBitmap to determine if the image has alpha.
+
+        No new tests.
+
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2011-04-18  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        If deleting the StorageTracker.db file fails, local storage is left in a strange state.
+        https://bugs.webkit.org/show_bug.cgi?id=58805
+
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
+        When cleaning up the StorageTracker.db file, is not enough to call syncDeleteOrigin.
+        deleteOrigin itself must be called to update the data structures that syncDeleteOrigin
+        depends on and to prevent clashes between a theoretical web page editing local storage
+        at the same time this method is called.
+        (WebCore::StorageTracker::syncDeleteAllOrigins):
+        If it is not possible to delete the StorageTracker.db file, empty it.
+        (WebCore::StorageTracker::deleteOriginOnMainThread):
+        Wrapper for deleteOrigin.
+        * storage/StorageTracker.h:
+
+2011-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        Added back missing #include.
+
+        * bindings/js/DOMWrapperWorld.cpp:
+
+2011-04-18  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Dropping a file in a WKView (WebKit2) doesn't load the file.
+        https://bugs.webkit.org/show_bug.cgi?id=58842
+        <rdar://problem/8514409>
+        
+        The URL string for the file contains an extra %00 at the end
+        that causes the network framework to fail to load the file.
+        
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::getURL):
+
+2011-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Discovered and rubber-stamped by Stephanie Lewis.
+
+        Restored some code I accidentally deleted in <http://trac.webkit.org/changeset/83990>
+
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        (WebCore::DOMWrapperWorld::clearWrappers): Do clear / destroy all our
+        window shells when clearing / destroying ourselves. r83990 removed this
+        behavior for documents since there are no per-document maps anymore,
+        but removing this behavior for window shells too was a typo.
+
+2011-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Made DOM handle ownership customizable, and customized it for Nodes and NamedAttrMaps
+        https://bugs.webkit.org/show_bug.cgi?id=58828
+
+        * WebCore.exp.in: Blah.
+
+        * bindings/js/DOMWrapperWorld.cpp: Moved code related to JSNode ownership
+        to JSNodeCustom, where other custom JSNode-related code goes.
+
+        (WebCore::JSDOMWrapperOwner::finalize):
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        * bindings/js/DOMWrapperWorld.h:
+        (WebCore::JSDOMWrapperOwner::JSDOMWrapperOwner):
+        (WebCore::DOMWrapperWorld::defaultWrapperOwner): Renamed DOMObjectHandleOwner
+        to JSDOMWrapperOwner, to match the name of JSDOMWrapper.
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore::toJSArrayBufferView):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::toJS): Removed "DOMObject" and "Node" from the names of wrapper-
+        related functions, since there is no meaningful distinction between the
+        two anymore -- they both use the same extensible interface.
+        
+        * bindings/js/JSDOMBinding.cpp: Removed some now-unused functions.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getInlineCachedWrapper):
+        (WebCore::setInlineCachedWrapper):
+        (WebCore::clearInlineCachedWrapper):
+        (WebCore::wrapperOwner):
+        (WebCore::wrapperContext):
+        (WebCore::getCachedWrapper):
+        (WebCore::cacheWrapper):
+        (WebCore::uncacheWrapper):
+        (WebCore::createWrapper):
+        (WebCore::wrap): Created a generic, extensible mechanism for creating,
+        caching, retrieving, marking, and destroying DOM wrappers. This eliminates
+        the difference between DOM object wrappers and DOM node wrappers, and
+        lays the groundwork for getting rid of MarkStack::deprecatedAppend usage
+        for marking the remainder of our DOM objects.
+        
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDataViewCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS): Updated for renames mentioned above.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMapOwner::isReachableFromOpaqueRoots):
+        (WebCore::JSNamedNodeMapOwner::finalize):
+        (WebCore::wrapperOwner):
+        (WebCore::wrapperContext):
+        (WebCore::JSNamedNodeMap::markChildren):
+        (WebCore::toJS): Updated to use our new interface for customizing wrapper
+        lifetime management through function overloading without using
+        MarkStack::deprecatedAppend.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::isObservable):
+        (WebCore::isReachableFromDOM):
+        (WebCore::JSNodeOwner::isReachableFromOpaqueRoots):
+        (WebCore::JSNodeOwner::finalize):
+        (WebCore::createWrapperInline): Moved node-related code from JSDOMBinding
+        to here. Removed special case marking code for JSNamedNodeMap because
+        JSNamedNodeMap now knows how to maintain its own lifetime invariants.
+
+        * bindings/js/JSNodeCustom.h:
+        (WebCore::wrapperOwner):
+        (WebCore::wrapperContext):
+        (WebCore::getInlineCachedWrapper):
+        (WebCore::setInlineCachedWrapper):
+        (WebCore::clearInlineCachedWrapper):
+        (WebCore::toJS): Updated to use our new interface for customizing wrapper
+        lifetime management through function overloading without using
+        MarkStack::deprecatedAppend or special-case code for nodes.
+        
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): Updated for renames mentioned above.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Fixed up newlines. Updated for
+        renames mentioned above.
+
+        * dom/NamedNodeMap.idl: NamedNodeMap needs a custom toJS function now
+        because it needs to provide a custom WeakHandleOwner at wrapper creation time.
+
+2011-04-18  Jessie Berlin  <jberlin@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        REGRESSION (r84094): Many tests failing assertions in WebCore::localizedString on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=58747
+
+        Copy the WebCore Localizable.strings file into the output directory.
+
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        * WebCore.vcproj/WebCoreGeneratedCairo.vsprops:
+        * WebCore.vcproj/WebCoreGeneratedCommon.vsprops:
+        * WebCore.vcproj/copyInspectorFiles.cmd: Removed.
+        * WebCore.vcproj/copyWebCoreResourceFiles.cmd: Copied from Source/WebCore/WebCore.vcproj/copyInspectorFiles.cmd.
+
+2011-04-18  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] PluginViewQt needs to update geometry of plugin widget before scheduling a repaint
+
+        When scheduling a repaint for the plugin's widget, PluginViewQt
+        needs to make sure the widget's geometry is up to date. Otherwise
+        the paint event happens on the widget's old location.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57179
+
+        Added a manual test. 
+
+        * manual-tests/qt/plugin-painting.html: Added.
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::invalidateRect):
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt build
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::removeCachedMethod):
+        * bridge/qt/qt_instance.h:
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
+
+        Replace use of DeprecatedPtr<> with Global<> as ownership rules
+        aren't obvious, have filed bug #58820 on seeing if this is safe.
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::removeCachedMethod):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+
+2011-04-14  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        [CG] Use vImage (un)premultiplyImageData functions for get/putImageData with IOSurfaces
+        https://bugs.webkit.org/show_bug.cgi?id=58088
+
+        * platform/graphics/cg/ImageBufferDataCG.cpp:
+        (WebCore::convertScanline): un/premultiplies and converts a scanline of image data from/to BGRA to/from RGBA
+        (WebCore::unpremultitplyScanline):
+        (WebCore::premultitplyScanline):
+        (WebCore::ImageBufferData::getData):
+        (WebCore::ImageBufferData::putData):
+
+2011-04-18  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Allow all log channels to be initialized from WebCoreLogLevel Windows environment variable
+        https://bugs.webkit.org/show_bug.cgi?id=58811
+
+        * platform/win/LoggingWin.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary): Support initializing LogResourceLoading, LogProgress, and LogFileAPI from WebCoreLogLevel Windows environment variable.
+
+2011-04-18  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Reset fullscreen element reference when leaving fullscreen mode and some other cleanup.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58719
+
+        Test: fullscreen/full-screen-cancel.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Remove m_isFullscreen.
+        (WebCore::Document::webkitWillEnterFullScreenForElement):
+        (WebCore::Document::webkitWillExitFullScreenForElement): Remove duplicate call to setAnimating().
+        (WebCore::Document::webkitDidExitFullScreenForElement): Reset m_fullScreenElement reference.
+        * dom/Document.h:
+        (WebCore::Document::webkitIsFullScreen): Use m_fullScreenElement instead of m_isFullscreen.
+        (WebCore::Document::webkitFullScreenKeyboardInputAllowed): Ditto.
+
+2011-04-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        <rdar://problem/9282486> REGRESSION (r81992): Facebook photo tags can get cut off when moving the mouse.
+        https://bugs.webkit.org/show_bug.cgi?id=58500
+
+        Test: fast/repaint/text-in-relative-positioned-inline.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::clippedOverflowRectForRepaint): Use the container’s repaint rect, not
+        the containing block’s. This matters when the containing block is outside the RenderText’s
+        enclosing layer, as is the case here.
+
+2011-04-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Speed up DrawingBuffer::reset().
+        https://bugs.webkit.org/show_bug.cgi?id=58706
+
+        When DrawingBuffer::reset() is called, it should not reallocate
+        the FBOs if the size has not changed.  It should just do a glClear().
+
+        Covered by tests in fast/canvas and canvas/philip.
+
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        Initialize the size to -1, -1, so the size change check will work on
+        first reset.
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        (WebCore::DrawingBuffer::reset):
+        If the size hasn't changed, don't resize the FBOs.  Just clear the
+        relevant buffers.
+
+2011-04-18  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: group resources by type in the resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=58796
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._frameAdded):
+        (WebInspector.ResourcesPanel.prototype._resourceAdded):
+        (WebInspector.BaseStorageTreeElement):
+        (WebInspector.BaseStorageTreeElement.prototype.onattach):
+        (WebInspector.StorageCategoryTreeElement):
+        (WebInspector.FrameTreeElement):
+        (WebInspector.FrameTreeElement.prototype.setTitles):
+        (WebInspector.FrameTreeElement.prototype.set hovered):
+        (WebInspector.FrameTreeElement.prototype.appendResource):
+        (WebInspector.FrameTreeElement.prototype.appendChild):
+        (WebInspector.FrameTreeElement.prototype._insertInPresentationOrder):
+        (WebInspector.FrameTreeElement.prototype._insertInPresentationOrder.compare):
+
+2011-04-18  Timothy Hatcher  <timothy@apple.com>
+
+        Make update-webkit-localizable-strings put WebKit/win strings in WebCore
+        now that all localized strings in WebKit/win use WEB_UI_STRING.
+
+        https://webkit.org/b/58747
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/Localizable.strings: Updated with strings from WebKit/win.
+
+2011-04-15  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION: <progress> doesn't animate if it doesn't have value
+        https://bugs.webkit.org/show_bug.cgi?id=58693
+
+        The initial value of RenderProgress::m_position is accidentally same as
+        the indeterminate value, that makes update code on updateFromElement() skipped.
+        This change set unique invalid value for the initial value of m_position.
+        
+        No new tests. Testing animated bar is not possible with DRT.
+
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::position):
+        * html/HTMLProgressElement.h:
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::isDeterminate):
+
+2011-04-18  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION: [Chromium Win] details-add-summary-1.html start crashing after r84039
+        https://bugs.webkit.org/show_bug.cgi?id=58791
+        
+        On refreshMainSummary(), findMainSummary() possibly releases oldSummary.
+        We should guard it again RefPtr.
+
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::refreshMainSummary):
+
+2011-04-18  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        CSSSelector double frees
+        https://bugs.webkit.org/show_bug.cgi?id=56124
+        <rdar://problem/9119036>
+
+        In all stacks this is occuring when the document is kept alive by the guard ref only
+        and the node holding it is deleted.
+
+        As a speculative fix, clear the document stylesheets when it turns into a guard ref zombie.
+        This has a pretty good chance of fixing the actual bug. At minimum it will move the
+        crash to an earlier, more easily traceble point.
+
+        No tests, crash stacks only, no idea how to reproduce.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+
+2011-04-18  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Backspace in the Console is broken
+        https://bugs.webkit.org/show_bug.cgi?id=58764
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2011-04-18  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Steve Block.
+
+        LevelDB backend for IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=57372
+
+        Only available behind a run-time flag. Covered by existing layout
+        tests.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/leveldb/LevelDBComparator.h: Added.
+        (WebCore::LevelDBComparator::~LevelDBComparator):
+        * platform/leveldb/LevelDBDatabase.cpp: Added.
+        (WebCore::makeSlice):
+        (WebCore::makeLevelDBSlice):
+        (WebCore::makeVector):
+        (WebCore::LevelDBDatabase::LevelDBDatabase):
+        (WebCore::LevelDBDatabase::~LevelDBDatabase):
+        (WebCore::LevelDBDatabase::open):
+        (WebCore::LevelDBDatabase::put):
+        (WebCore::LevelDBDatabase::remove):
+        (WebCore::LevelDBDatabase::get):
+        (WebCore::LevelDBDatabase::newIterator):
+        * platform/leveldb/LevelDBDatabase.h: Added.
+        * platform/leveldb/LevelDBIterator.cpp: Added.
+        (WebCore::LevelDBIterator::~LevelDBIterator):
+        (WebCore::LevelDBIterator::LevelDBIterator):
+        (WebCore::makeSlice):
+        (WebCore::makeLevelDBSlice):
+        (WebCore::LevelDBIterator::isValid):
+        (WebCore::LevelDBIterator::seekToLast):
+        (WebCore::LevelDBIterator::seek):
+        (WebCore::LevelDBIterator::next):
+        (WebCore::LevelDBIterator::prev):
+        (WebCore::LevelDBIterator::key):
+        (WebCore::LevelDBIterator::value):
+        * platform/leveldb/LevelDBIterator.h: Added.
+        * platform/leveldb/LevelDBSlice.h: Added.
+        (WebCore::LevelDBSlice::LevelDBSlice):
+        (WebCore::LevelDBSlice::~LevelDBSlice):
+        (WebCore::LevelDBSlice::begin):
+        (WebCore::LevelDBSlice::end):
+        * storage/IDBLevelDBBackingStore.cpp:
+        (WebCore::encodeByte):
+        (WebCore::maxIDBKey):
+        (WebCore::minIDBKey):
+        (WebCore::encodeInt):
+        (WebCore::decodeInt):
+        (WebCore::encodeVarInt):
+        (WebCore::decodeVarInt):
+        (WebCore::encodeString):
+        (WebCore::decodeString):
+        (WebCore::encodeStringWithLength):
+        (WebCore::decodeStringWithLength):
+        (WebCore::encodeDouble):
+        (WebCore::decodeDouble):
+        (WebCore::encodeIDBKey):
+        (WebCore::decodeIDBKey):
+        (WebCore::extractEncodedIDBKey):
+        (WebCore::compareEncodedIDBKeys):
+        (WebCore::getInt):
+        (WebCore::putInt):
+        (WebCore::getString):
+        (WebCore::putString):
+        (WebCore::KeyPrefix::SchemaVersionKey::encode):
+        (WebCore::KeyPrefix::MaxDatabaseIdKey::encode):
+        (WebCore::KeyPrefix::DatabaseFreeListKey::DatabaseFreeListKey):
+        (WebCore::KeyPrefix::DatabaseFreeListKey::decode):
+        (WebCore::KeyPrefix::DatabaseFreeListKey::encode):
+        (WebCore::KeyPrefix::DatabaseFreeListKey::databaseId):
+        (WebCore::KeyPrefix::DatabaseFreeListKey::compare):
+        (WebCore::KeyPrefix::DatabaseNameKey::decode):
+        (WebCore::KeyPrefix::DatabaseNameKey::encode):
+        (WebCore::KeyPrefix::DatabaseNameKey::origin):
+        (WebCore::KeyPrefix::DatabaseNameKey::databaseName):
+        (WebCore::KeyPrefix::DatabaseNameKey::compare):
+        (WebCore::KeyPrefix::DatabaseMetaDataKey::encode):
+        (WebCore::KeyPrefix::ObjectStoreMetaDataKey::ObjectStoreMetaDataKey):
+        (WebCore::KeyPrefix::ObjectStoreMetaDataKey::decode):
+        (WebCore::KeyPrefix::ObjectStoreMetaDataKey::encode):
+        (WebCore::KeyPrefix::ObjectStoreMetaDataKey::objectStoreId):
+        (WebCore::KeyPrefix::ObjectStoreMetaDataKey::metaDataType):
+        (WebCore::KeyPrefix::ObjectStoreMetaDataKey::compare):
+        (WebCore::KeyPrefix::IndexMetaDataKey::IndexMetaDataKey):
+        (WebCore::KeyPrefix::IndexMetaDataKey::decode):
+        (WebCore::KeyPrefix::IndexMetaDataKey::encode):
+        (WebCore::KeyPrefix::IndexMetaDataKey::compare):
+        (WebCore::KeyPrefix::IndexMetaDataKey::indexId):
+        (WebCore::KeyPrefix::IndexMetaDataKey::metaDataType):
+        (WebCore::KeyPrefix::ObjectStoreFreeListKey::ObjectStoreFreeListKey):
+        (WebCore::KeyPrefix::ObjectStoreFreeListKey::decode):
+        (WebCore::KeyPrefix::ObjectStoreFreeListKey::encode):
+        (WebCore::KeyPrefix::ObjectStoreFreeListKey::objectStoreId):
+        (WebCore::KeyPrefix::ObjectStoreFreeListKey::compare):
+        (WebCore::KeyPrefix::IndexFreeListKey::IndexFreeListKey):
+        (WebCore::KeyPrefix::IndexFreeListKey::decode):
+        (WebCore::KeyPrefix::IndexFreeListKey::encode):
+        (WebCore::KeyPrefix::IndexFreeListKey::compare):
+        (WebCore::KeyPrefix::IndexFreeListKey::objectStoreId):
+        (WebCore::KeyPrefix::IndexFreeListKey::indexId):
+        (WebCore::KeyPrefix::ObjectStoreNamesKey::decode):
+        (WebCore::KeyPrefix::ObjectStoreNamesKey::encode):
+        (WebCore::KeyPrefix::ObjectStoreNamesKey::compare):
+        (WebCore::KeyPrefix::ObjectStoreNamesKey::objectStoreName):
+        (WebCore::KeyPrefix::IndexNamesKey::IndexNamesKey):
+        (WebCore::KeyPrefix::IndexNamesKey::decode):
+        (WebCore::KeyPrefix::IndexNamesKey::encode):
+        (WebCore::KeyPrefix::IndexNamesKey::compare):
+        (WebCore::KeyPrefix::IndexNamesKey::indexName):
+        (WebCore::KeyPrefix::ObjectStoreDataKey::decode):
+        (WebCore::KeyPrefix::ObjectStoreDataKey::encode):
+        (WebCore::KeyPrefix::ObjectStoreDataKey::compare):
+        (WebCore::KeyPrefix::ObjectStoreDataKey::userKey):
+        (WebCore::KeyPrefix::ExistsEntryKey::decode):
+        (WebCore::KeyPrefix::ExistsEntryKey::encode):
+        (WebCore::KeyPrefix::ExistsEntryKey::compare):
+        (WebCore::KeyPrefix::ExistsEntryKey::userKey):
+        (WebCore::KeyPrefix::IndexDataKey::IndexDataKey):
+        (WebCore::KeyPrefix::IndexDataKey::decode):
+        (WebCore::KeyPrefix::IndexDataKey::encode):
+        (WebCore::KeyPrefix::IndexDataKey::encodeMaxKey):
+        (WebCore::KeyPrefix::IndexDataKey::compare):
+        (WebCore::KeyPrefix::IndexDataKey::databaseId):
+        (WebCore::KeyPrefix::IndexDataKey::objectStoreId):
+        (WebCore::KeyPrefix::IndexDataKey::indexId):
+        (WebCore::KeyPrefix::IndexDataKey::userKey):
+        (WebCore::KeyPrefix::realCompare):
+        (WebCore::KeyPrefix::compareKeys):
+        (WebCore::KeyPrefix::compareIndexKeys):
+        (WebCore::KeyPrefix::Comparator::compare):
+        (WebCore::KeyPrefix::Comparator::name):
+        (WebCore::setUpMetadata):
+        (WebCore::IDBLevelDBBackingStore::IDBLevelDBBackingStore):
+        (WebCore::IDBLevelDBBackingStore::open):
+        (WebCore::IDBLevelDBBackingStore::extractIDBDatabaseMetaData):
+        (WebCore::getNewDatabaseId):
+        (WebCore::IDBLevelDBBackingStore::setIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::getObjectStores):
+        (WebCore::getNewObjectStoreId):
+        (WebCore::IDBLevelDBBackingStore::createObjectStore):
+        (WebCore::deleteRange):
+        (WebCore::IDBLevelDBBackingStore::deleteObjectStore):
+        (WebCore::IDBLevelDBBackingStore::getObjectStoreRecord):
+        (WebCore::getNewVersionNumber):
+        (WebCore::IDBLevelDBBackingStore::putObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::clearObjectStore):
+        (WebCore::IDBLevelDBBackingStore::createInvalidRecordIdentifier):
+        (WebCore::IDBLevelDBBackingStore::deleteObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::nextAutoIncrementNumber):
+        (WebCore::IDBLevelDBBackingStore::keyExistsInObjectStore):
+        (WebCore::IDBLevelDBBackingStore::forEachObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::getIndexes):
+        (WebCore::getNewIndexId):
+        (WebCore::IDBLevelDBBackingStore::createIndex):
+        (WebCore::IDBLevelDBBackingStore::deleteIndex):
+        (WebCore::IDBLevelDBBackingStore::putIndexDataForRecord):
+        (WebCore::findGreatestKeyLessThan):
+        (WebCore::IDBLevelDBBackingStore::deleteIndexDataForRecord):
+        (WebCore::IDBLevelDBBackingStore::getObjectViaIndex):
+        (WebCore::versionExists):
+        (WebCore::IDBLevelDBBackingStore::getPrimaryKeyViaIndex):
+        (WebCore::IDBLevelDBBackingStore::keyExistsInIndex):
+        (WebCore::findLastIndexKeyEqualTo):
+        (WebCore::IDBLevelDBBackingStore::openObjectStoreCursor):
+        (WebCore::IDBLevelDBBackingStore::openIndexKeyCursor):
+        (WebCore::IDBLevelDBBackingStore::openIndexCursor):
+        (WebCore::IDBLevelDBBackingStore::createTransaction):
+        * storage/IDBLevelDBBackingStore.h:
+
+2011-04-18  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add test for CSS-resource binding.
+        https://bugs.webkit.org/show_bug.cgi?id=58786
+
+        Test: inspector/styles/styles-history.html
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::setPropertyText):
+        (WebCore::InspectorStyle::toggleProperty):
+        (WebCore::InspectorStyleSheet::setPropertyText):
+        (WebCore::InspectorStyleSheet::toggleProperty):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged.if):
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged.mycallback):
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype.setStyleSheetText):
+        (WebInspector.CSSStyleDeclaration.prototype.insertPropertyAt):
+        (WebInspector.CSSProperty.prototype.setText.callback):
+        (WebInspector.CSSProperty.prototype.setText):
+
+2011-04-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r83996.
+        http://trac.webkit.org/changeset/83996
+        https://bugs.webkit.org/show_bug.cgi?id=58790
+
+        layout test editing/selection/move-by-word-visually.html is
+        failing (Requested by jknotten on #webkit).
+
+        * editing/visible_units.cpp:
+        (WebCore::nextWordBreakInBoxInsideBlockWithDifferentDirectionality):
+        (WebCore::collectWordBreaksInBoxInsideBlockWithDifferntDirectionality):
+        (WebCore::previousWordBreakInBox):
+        (WebCore::leftWordBoundary):
+        (WebCore::rightWordBoundary):
+        (WebCore::leftWordPosition):
+        (WebCore::rightWordPosition):
+
+2011-04-18  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Daniel Bates.
+
+        Modify make_names.pl to not include conditional includes unconditionally
+        https://bugs.webkit.org/show_bug.cgi?id=53672
+
+        Fixed conditional includes being unconditionally included.
+
+        No new tests (no change in functionality)
+
+        * dom/make_names.pl:
+            - Modified printJSElementIncludes() to only print unconditional element includes.
+            - Modified printElementIncludes() to only print unconditional element includes.
+            - Added printConditionalElementIncludes() which takes care of printing conditional element includes.
+
+2011-04-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r83803.
+        http://trac.webkit.org/changeset/83803
+        https://bugs.webkit.org/show_bug.cgi?id=58782
+
+        Caused focus rings to appear in youtube videos (Requested by
+        inferno-sec on #webkit).
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2011-04-18  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Need a workaround for bug 58422
+        https://bugs.webkit.org/show_bug.cgi?id=58780
+
+        Instead of the A:before content, the link text is displayed as the A tag content.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.linkifyUncopyable):
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/inspector.css:
+
+2011-04-18  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix WebKit2 GTK build after 82465.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::localizedString):
+
+2011-04-18  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: TAB should not move focus from the text editor while live editing
+        https://bugs.webkit.org/show_bug.cgi?id=58537
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._registerShortcuts):
+        (WebInspector.TextViewer.prototype._cancelEditing):
+        (WebInspector.TextEditorMainPanel.prototype.handleUndoRedo):
+        (WebInspector.TextEditorMainPanel.prototype.handleTabKeyPress):
+        (WebInspector.TextEditorMainPanel.prototype._setCaretLocation):
+        (WebInspector.TextEditorMainPanel.prototype._applyDomUpdates):
+        (WebInspector.TextEditorMainPanel.prototype._setText):
+
+2011-04-18  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Incorrect content area dimensions in Metrics pane for box-sizing: border-box
+        https://bugs.webkit.org/show_bug.cgi?id=58551
+
+        Test: inspector/styles/metrics-box-sizing.html
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype._getPropertyValueAsPx):
+        (WebInspector.MetricsSidebarPane.prototype._getBox):
+        (WebInspector.MetricsSidebarPane.prototype._update.getContentAreaWidthPx):
+        (WebInspector.MetricsSidebarPane.prototype._update.getContentAreaHeightPx):
+        (WebInspector.MetricsSidebarPane.prototype._update):
+        (WebInspector.MetricsSidebarPane.prototype.startEditing):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted.setEnabledValueCallback):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+
+2011-04-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Database agent stops to propagate it's events after navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=58776
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::InspectorDatabaseAgent):
+        (WebCore::InspectorDatabaseAgent::clearFrontend):
+        (WebCore::InspectorDatabaseAgent::enable):
+        (WebCore::InspectorDatabaseAgent::disable):
+        (WebCore::InspectorDatabaseAgent::restore):
+        * inspector/InspectorDatabaseAgent.h:
+        (WebCore::InspectorDatabaseAgent::create):
+
+2011-04-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r83968.
+        http://trac.webkit.org/changeset/83968
+        https://bugs.webkit.org/show_bug.cgi?id=58769
+
+        Breaks Backspace in Web Inspector console (Requested by
+        apavlov on #webkit).
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2011-04-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: introduce WorkerInspectorController
+        https://bugs.webkit.org/show_bug.cgi?id=58668
+
+        WorkerInspectorController will be owned by WorkerContext and will hold all inspector
+        agents and will also manage connection to the inspector frontend.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromWorkerContext):
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromWorkerContext):
+        * bindings/v8/ScriptState.h:
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::updateCookie):
+        * inspector/WorkerInspectorController.cpp: Added.
+        (WebCore::WorkerInspectorController::WorkerInspectorController):
+        (WebCore::WorkerInspectorController::~WorkerInspectorController):
+        (WebCore::WorkerInspectorController::connectFrontend):
+        (WebCore::WorkerInspectorController::disconnectFrontend):
+        (WebCore::WorkerInspectorController::dispatchMessageFromFrontend):
+        * inspector/WorkerInspectorController.h: Copied from Source/WebCore/bindings/js/ScriptState.h.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::workerInspectorController):
+
+2011-04-17  Thierry Reding  <thierry.reding@avionic-design.de>
+
+        Reviewed by Adam Barth.
+
+        Fix build with GCC 4.6.
+
+        * dom/make_names.pl: Execute preprocessor without the -P option. The
+        preprocessor in GCC 4.6 eats empty lines, effectively breaking the
+        parsing performed by this script. Dropping the -P option when invoking
+        the preprocessor keeps the empty lines but as a side-effect also adds
+        additional linemarkers.
+
+        From the cpp manpage:
+
+          -P  Inhibit generation of linemarkers in the output from the
+              preprocessor. This might be useful when running the preprocessor
+              on something that is not C code, and will be sent to a program
+              which might be confused by the linemarkers.
+
+        The linemarkers are not problematic, however, because the script
+        properly handles them by ignoring all lines starting with a #.
+
+2011-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/58463> Switch HTTP pipelining from user default to private setting
+        <rdar://problem/9268729>
+
+        Reviewed by Dan Bernstein.
+
+        This replaces support for the WebKitEnableHTTPPipelining user
+        default with methods on the WebCore::ResourceRequest class in
+        WebCore, the WebView class in WebKit1, and the WebContext class
+        in WebKit2.  It also removes support for the
+        WebKitForceHTTPPipeliningPriorityHigh user default which was not
+        needed.
+
+        Run these commands if you set the user defaults previously,
+        replacing "BUNDLE.ID" with your application's bundle ID:
+
+            defaults delete BUNDLE.ID WebKitEnableHTTPPipelining
+            defaults delete BUNDLE.ID WebKitForceHTTPPipeliningPriorityHigh
+
+        * WebCore.exp.in: Export ResourceRequest::httpPipeliningEnabled()
+        and ResourceRequest::setHTTPPipeliningEnabled().
+
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::isHTTPPipeliningEnabled): Removed declaration.
+        (WebCore::shouldForceHTTPPipeliningPriorityHigh): Removed declaration.
+
+        * platform/network/cf/ResourceRequest.h:
+        (WebCore::ResourceRequest::httpPipeliningEnabled): Added declaration.
+        (WebCore::ResourceRequest::setHTTPPipeliningEnabled): Added declaration.
+        (WebCore::ResourceRequest::s_httpPipeliningEnabled): Added declaration.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::s_httpPipeliningEnabled): Added.
+        (WebCore::ResourceRequest::httpPipeliningEnabled): Added.
+        (WebCore::ResourceRequest::setHTTPPipeliningEnabled): Added.
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Switched
+        to use ResourceRequest::httpPipeliningEnabled().
+        (WebCore::readBooleanPreference): Removed.
+        (WebCore::isHTTPPipeliningEnabled): Removed.
+        (WebCore::shouldForceHTTPPipeliningPriorityHigh): Removed.
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest): Switched to
+        use ResourceRequest::httpPipeliningEnabled().  Removed check for
+        shouldForceHTTPPipeliningPriorityHigh().
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Ditto.
+
+2011-04-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r84096): <br> moved to the right in fast/block/float/032.html
+        https://bugs.webkit.org/show_bug.cgi?id=58736
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::appendFloatingObjectToLastLine): It is enough to extend the float so
+        that it touches the bottom of the previous line, since RenderBlock::markLinesDirtyInBlockRange()
+        always dirties the line after the last one in the range.
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Add missing include to fix build without precompiled header.
+
+        * rendering/RenderMediaControls.cpp:
+
+2011-04-17  Daniel Bates  <dbates@webkit.org>
+
+        Attempt to fix the Chromium build after changeset 84110 <http://trac.webkit.org/changeset/84110>
+        (https://bugs.webkit.org/show_bug.cgi?id=57842).
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest): Rename CachedResource::LinkPrefetch to CachedResource::LinkResource.
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove pthread dependency of GCController
+        https://bugs.webkit.org/show_bug.cgi?id=54833
+
+        * bindings/js/GCController.cpp:
+        (WebCore::GCController::garbageCollectOnAlternateThreadForDebugging):
+
+2011-04-17  Gavin Peters  <gavinp@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for link rel type "subresource"
+        https://bugs.webkit.org/show_bug.cgi?id=57842
+
+        Link rel=prefetch is great for cache warming for resources on
+        subsequent pages, but it launches requests at too low a priority
+        to use for subresources of the current page.
+
+        Particularly after https://bugs.webkit.org/show_bug.cgi?id=51940
+        is implemented, a rel type that launches requests at an higher
+        priority is going to be very useful.  This rel type is in the
+        HTML5 spec at http://wiki.whatwg.org/wiki/RelExtensions .  An
+        expected use case will be for servers to provide subresource hints
+        in link headers, which will allow servers to help make the web
+        faster.
+
+        This feature continues my implementation of the Link header, which
+        we've talked about in WebKit-dev in
+        https://lists.webkit.org/pipermail/webkit-dev/2011-February/016034.html.
+
+        Tests: fast/dom/HTMLLinkElement/subresource.html
+               http/tests/misc/link-rel-prefetch-and-subresource.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::~HTMLLinkElement):
+        (WebCore::HTMLLinkElement::tokenizeRelAttribute):
+        (WebCore::HTMLLinkElement::process):
+        (WebCore::HTMLLinkElement::onloadTimerFired):
+        (WebCore::HTMLLinkElement::notifyFinished):
+        * html/HTMLLinkElement.h:
+        (WebCore::HTMLLinkElement::RelAttribute::RelAttribute):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::defaultPriorityForResourceType):
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::isLinkResource):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::createResource):
+        (WebCore::CachedResourceLoader::requestLinkResource):
+        (WebCore::CachedResourceLoader::canRequest):
+        (WebCore::CachedResourceLoader::incrementRequestCount):
+        (WebCore::CachedResourceLoader::decrementRequestCount):
+        * loader/cache/CachedResourceLoader.h:
+        * loader/cache/CachedResourceRequest.cpp:
+        (WebCore::cachedResourceTypeToTargetType):
+        (WebCore::CachedResourceRequest::load):
+
+2011-04-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Joseph Pecoraro.
+
+        <rdar://problem/9296211> REGRESSION (r83514): Failing fast/repaint/trailing-floats-root-line-box-overflow.html
+        https://bugs.webkit.org/show_bug.cgi?id=58745
+
+        This is really a regression from r82611, but it went unnoticed due to a mistake in r73385,
+        which was fixed in r83514.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Actually assign the bottom visual overflow to the
+        variable so named, not the top layout overflow.
+
+2011-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Strongly suggested, but not necessarily reviewed, by
+        Sam Weinig and Maciej Stachowiak.
+
+        Renamed DOMObject* => JSDOMWrapper*.
+
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::isObservable):
+        (WebCore::DOMObjectHandleOwner::finalize):
+        * bindings/js/DOMWrapperWorld.h:
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore::toJSArrayBufferView):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::JSDOMWrapperWithGlobalPointer::globalObject):
+        (WebCore::JSDOMWrapperWithGlobalPointer::JSDOMWrapperWithGlobalPointer):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        * bindings/js/JSDOMWrapper.cpp:
+        (WebCore::JSDOMWrapper::~JSDOMWrapper):
+        * bindings/js/JSDOMWrapper.h:
+        (WebCore::JSDOMWrapper::JSDOMWrapper):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::toJS):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CA) to USE(CA)
+        https://bugs.webkit.org/show_bug.cgi?id=58742
+
+        * config.h:
+        * platform/graphics/ca/TransformationMatrixCA.cpp:
+        * platform/graphics/cg/ImageBufferDataCG.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/mac/WebCoreSystemInterface.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::containsPaintedContent):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+
+2011-04-17  Young Han Lee  <joybro@company100.net>
+
+        Reviewed by Benjamin Poulain.
+
+        [Texmap] [Qt] Improve readability by using gInVertexAttributeIndex instead of 0.
+        https://bugs.webkit.org/show_bug.cgi?id=58739
+
+        gInVertexAttributeIndex is a constant variable to point the location of
+        "InVertex" attribute of the vertex shaders.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::TextureMapperGL::paintToTarget):
+
+2011-04-17  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Not reviewed: Fix copyright (I had submitted the file with wrong
+        copyright line).
+
+        * storage/StorageInfo.idl:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CG) to USE(CG)
+        https://bugs.webkit.org/show_bug.cgi?id=58729
+
+        * config.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * loader/cache/CachedFont.cpp:
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::createImage):
+        * platform/FloatConversion.h:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/DashArray.h:
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hash):
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::add):
+        (WebCore::GlyphBuffer::expandLastAdvance):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setLegacyShadow):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/Image.cpp:
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageBuffer.cpp:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/ImageBufferData.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/IntSize.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cg/ColorCG.cpp:
+        * platform/graphics/cg/FloatPointCG.cpp:
+        * platform/graphics/cg/FloatRectCG.cpp:
+        * platform/graphics/cg/FloatSizeCG.cpp:
+        * platform/graphics/cg/ImageCG.cpp:
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        * platform/graphics/cg/IntPointCG.cpp:
+        * platform/graphics/cg/IntRectCG.cpp:
+        * platform/graphics/cg/IntSizeCG.cpp:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        * platform/graphics/cg/PDFDocumentImage.h:
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::resize):
+        (WebCore::PlatformCanvas::AutoLocker::AutoLocker):
+        (WebCore::PlatformCanvas::Painter::Painter):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        * platform/graphics/chromium/PlatformImage.cpp:
+        (WebCore::PlatformImage::updateFromImage):
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        * platform/graphics/transforms/AffineTransform.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/win/DIBPixelData.h:
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::createGDIFont):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        * platform/image-decoders/ImageDecoder.cpp:
+        * platform/image-decoders/ImageDecoder.h:
+        * rendering/RenderObject.h:
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::postApplyResource):
+        * rendering/svg/RenderSVGResourceGradient.cpp:
+        (WebCore::RenderSVGResourceGradient::RenderSVGResourceGradient):
+        (WebCore::RenderSVGResourceGradient::applyResource):
+        * rendering/svg/RenderSVGResourceGradient.h:
+        * rendering/svg/RenderSVGResourceMasker.cpp:
+        (WebCore::RenderSVGResourceMasker::drawContentIntoMaskImage):
+        * rendering/svg/RenderSVGResourcePattern.cpp:
+        (WebCore::RenderSVGResourcePattern::applyResource):
+
+2011-04-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        about:blank documents in new tabs can XHR anywhere
+        https://bugs.webkit.org/show_bug.cgi?id=58712
+
+        Empty security origins have supposed to be low-privilege, we should
+        mark them as having a unique origin.
+
+        * manual-tests/about-blank-xhr.html: Added.
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        * page/SecurityOrigin.h:
+
+2011-04-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/9190108> Crash when hiding a float
+
+        Test: fast/block/float/overhanging-tall-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverhangingFloats): Moved the call to childLogicalTop() out of the loop.
+        Capped the logical bottom so that we get the correct maximum.
+        * rendering/RenderBlock.h: Decleared appendFloatingObjectToLastLine().
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::appendFloatingObjectToLastLine): Added. Ensures correct bookkeeping by
+        extending the float if needed so that it touches the line.
+        (WebCore::RenderBlock::layoutInlineChildren): Changed to call appendFloatingObjectToLastLine().
+        (WebCore::RenderBlock::checkFloatsInCleanLine): Capped the float height so the we mark the right
+        range of lines as dirty.
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::appendFloat): Replaced the floats() accessor with this function, which
+        allows the creation of the vector to be combined with appending the first float.
+
+2011-04-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Pages in the PageCache don't have the correct visited link coloring after being restored
+        https://bugs.webkit.org/show_bug.cgi?id=58721
+
+        * WebCore.exp.in:
+        Add export of markPagesForVistedLinkStyleRecalc for use by WebKit2.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        (WebCore::CachedPage::clear):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::markForVistedLinkStyleRecalc):
+        Add bit, set by calling markForVistedLinkStyleRecalc, which forces a visited link
+        style recalc when being restored.
+
+        * history/PageCache.h:
+        * history/PageCache.cpp:
+        (WebCore::PageCache::markPagesForVistedLinkStyleRecalc):
+        Mark all pages in the page cache as requiring visited link style recalc.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addVisitedLink):
+        (WebCore::PageGroup::removeVisitedLinks):
+        (WebCore::PageGroup::removeAllVisitedLinks):
+        Set dirty bit when changing any visited link information.
+        
+
+2011-04-16  Leo Yang  <leoyang.webkit@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        ASSERT failure when svg <use> element changes href
+        https://bugs.webkit.org/show_bug.cgi?id=58726
+
+        m_resourceId was not empty after the pending resource
+        becomes available. This will trigger the assertion at
+        line 509 of SVGUseElement.cpp when the <use> element's
+        href becomes empty or invalid.
+
+        This patch makes m_resourceId be empty after the pending
+        resource becomes available to avoid assertion failure.
+
+        Test: svg/custom/use-crash-when-href-change.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+
+2011-04-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Rename PLATFORM(CAIRO) to USE(CAIRO)
+        https://bugs.webkit.org/show_bug.cgi?id=55192
+
+        * CMakeListsEfl.txt:
+        * config.h:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/ContextShadow.h:
+        * platform/graphics/DashArray.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::glyphAt):
+        (WebCore::GlyphBuffer::add):
+        * platform/graphics/Gradient.cpp:
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/ImageBufferData.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/DrawErrorUnderline.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        * platform/graphics/gstreamer/ImageGStreamer.h:
+        * platform/graphics/transforms/AffineTransform.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::createGDIFont):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        * rendering/RenderObject.h:
+
+2011-04-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r84033.
+
+        * platform/win/LocalizedStringsWin.cpp:
+        (WebCore::localizedString):
+
+2011-04-16  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Only allow inline child for SVG text since we cannot
+        handle block childs.
+        https://bugs.webkit.org/show_bug.cgi?id=58678
+
+        Test: svg/text/text-block-child-crash.xhtml
+
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::isChildAllowed):
+        * rendering/svg/RenderSVGText.h:
+
+2011-04-15  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: The list of Database entries is empty if the page opens a database just before Web Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=57833
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::didOpenDatabase):
+        (WebCore::InspectorDatabaseAgent::InspectorDatabaseAgent):
+        (WebCore::InspectorDatabaseAgent::setFrontend):
+        (WebCore::InspectorDatabaseAgent::clearFrontend):
+        (WebCore::InspectorDatabaseAgent::enable):
+        (WebCore::InspectorDatabaseAgent::disable):
+        (WebCore::InspectorDatabaseAgent::getDatabaseTableNames):
+        (WebCore::InspectorDatabaseAgent::executeSQL):
+        * inspector/InspectorDatabaseAgent.h:
+        * inspector/front-end/inspector.js:
+
+2011-04-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CSP media-src is missing
+        https://bugs.webkit.org/show_bug.cgi?id=58642
+
+        Yay HTMLMediaElement for having the exact hook we need!
+
+        Tests: http/tests/security/contentSecurityPolicy/media-src-allowed.html
+               http/tests/security/contentSecurityPolicy/media-src-blocked.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+            - Although it's tempting to add this branch to the previous
+              if-block, that results in the wrong error message being logged to
+              the console (covered by the "blocked" test).
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
+        (WebCore::ContentSecurityPolicy::addDirective):
+        * page/ContentSecurityPolicy.h:
+            - These changes are routine.
+
+2011-04-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CSP should block string arguments to setTimeout and setInterval unless options eval-script
+        https://bugs.webkit.org/show_bug.cgi?id=58610
+
+        It's somewhat sadness that the JSC and V8 code for setTimeout and
+        setInterval are so different.  I struggled for a while with how to
+        handle the worker case, but I decided to punt on it for now.
+
+        Tests: http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-allowed.html
+               http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-blocked.html
+               http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-allowed.html
+               http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-blocked.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        * bindings/js/ScheduledAction.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowEval):
+        * page/ContentSecurityPolicy.h:
+
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Martin Robinson.
+
+        Make plugins compile during WebKit GTK Windows build.
+        Ifdef properly relevant parts so that the PluginViewGtk compiles on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=58580
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformGetValue):
+        (WebCore::PluginView::platformStart):
+
+2011-04-15  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Simon Fraser.
+
+        Calls to WebCore::Document::mayCauseFlashOfUnstyledContent make frequently-run drawing methods slower
+        https://bugs.webkit.org/show_bug.cgi?id=58512
+        
+        Manually rolled out r72367 at which mayCauseFlashOfUnstyledContent() was introduced.
+        This change keeps an small refactoring on
+        FrameView::shouldUpdate(), which doesn't affect on the behavior.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::invalidateRect):
+        (WebCore::FrameView::shouldUpdate):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintContents):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+
+2011-04-15  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Reduce default kernel size of SincResampler to favor better speed over quality
+        https://bugs.webkit.org/show_bug.cgi?id=58710
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/SincResampler.h:
+
+2011-04-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Martin Robinson.
+
+        Expand the ntohs, ntohl, htons and htonl defines for OS(WINDOWS)
+        These have to be defined for Windows in general, since win32 API
+        does not provide them.
+        https://bugs.webkit.org/show_bug.cgi?id=58582
+
+        * platform/graphics/WOFFFileFormat.cpp:
+
+2011-04-15  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Show a console message when X-Frame-Options blocks a load
+        https://bugs.webkit.org/show_bug.cgi?id=39087
+
+        Added console message when X-Frame-Options headers block resource loading
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+
+2011-04-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Martin Robinson.
+
+        Evaluate PLATFORM(GTK) before the all-encompassing OS(WINDOWS)
+        test. This allows Windows build of WebKit GTK to chose the right
+        path.
+        https://bugs.webkit.org/show_bug.cgi?id=58576
+
+        * platform/FileSystem.h:
+
+2011-04-08  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPage MIME type handling inconsistency with other web browsers
+        https://bugs.webkit.org/show_bug.cgi?id=46968
+
+        Implementing mime type sniffing based on
+        http://tools.ietf.org/html/draft-abarth-mime-sniff-06.
+
+        * WebCore.pro:
+        * platform/network/MIMESniffing.cpp: Added.
+        (MagicNumbers::dataSizeNeededForImageSniffing):
+        (MagicNumbers::maskedCompare):
+        (MagicNumbers::checkSpaceOrBracket):
+        (MagicNumbers::compare):
+        (MagicNumbers::findMIMEType):
+        (MagicNumbers::findSimpleMIMEType):
+        (MagicNumbers::textOrBinaryTypeSniffingProcedure):
+        (MagicNumbers::unknownTypeSniffingProcedure):
+        (MagicNumbers::imageTypeSniffingProcedure):
+        (MagicNumbers::checkText):
+        (MagicNumbers::checkRDF):
+        (MagicNumbers::skipTag):
+        (MagicNumbers::feedTypeSniffingProcedure):
+        (MIMESniffer::MIMESniffer):
+        * platform/network/MIMESniffing.h: Added.
+        (MIMESniffer::dataSize):
+        (MIMESniffer::sniff):
+        (MIMESniffer::isValid):
+        * platform/network/NetworkingContext.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::release):
+        (WebCore::QNetworkReplyWrapper::receiveMetaData):
+        (WebCore::QNetworkReplyWrapper::receiveSniffedMIMEType):
+        (WebCore::QNetworkReplyWrapper::emitMetaDataChanged):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::sendNetworkRequest):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyWrapper::advertisedMIMEType):
+        (WebCore::QNetworkReplyWrapper::mimeType):
+        * platform/network/qt/QtMIMETypeSniffer.cpp: Added.
+        (QtMIMETypeSniffer::QtMIMETypeSniffer):
+        (QtMIMETypeSniffer::sniff):
+        (QtMIMETypeSniffer::trySniffing):
+        * platform/network/qt/QtMIMETypeSniffer.h: Added.
+        (QtMIMETypeSniffer::mimeType):
+        (QtMIMETypeSniffer::isFinished):
+
+2011-04-15  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        input field with focus makes appendChild operation ~42x slower
+        https://bugs.webkit.org/show_bug.cgi?id=57059
+
+        Change ContainerNode::cloneChildNodes to only disable the
+        deleteButtonController if the container itself (or any of its children)
+        is being edited. Thus avoiding a reflow in cases where it's not.
+
+        Test: perf/clone-with-focus.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::cloneChildNodes):
+
+2011-04-15  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Expose unified Quota API if QUOTA build flag is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=58648
+
+        Test: storage/storageinfo-query-usage.html
+
+        * CMakeLists.txt: Added new file entries.
+        * DerivedSources.cpp: Added new file entries.
+        * DerivedSources.make: Added new file entries.
+        * GNUmakefile.am: Added new file entries.
+        * WebCore.gypi: Added new file entries.
+        * WebCore.vcproj/WebCore.vcproj: Added new file entries.
+        * WebCore.xcodeproj/project.pbxproj: Added new file entries.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitStorageInfo): Added.
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/StorageInfo.h: Added storage type enum.
+        * storage/StorageInfo.idl: Added.
+        * storage/StorageInfoErrorCallback.idl: Added.
+        * storage/StorageInfoUsageCallback.idl: Added.
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        GC allocate Structure
+        https://bugs.webkit.org/show_bug.cgi?id=58483
+
+        Rolling r83894 r83827 r83810 r83809 r83808 back in with
+        a workaround for the gcc bug seen by the gtk bots
+
+        * WebCore.exp.in:
+        * bindings/js/JSAudioConstructor.h:
+        (WebCore::JSAudioConstructor::createStructure):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMConstructorObject::createStructure):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::markChildren):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::createStructure):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::createStructure):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSDOMWrapper.h:
+        (WebCore::DOMObject::DOMObject):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        * bindings/js/JSImageConstructor.h:
+        (WebCore::JSImageConstructor::createStructure):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSOptionConstructor.h:
+        (WebCore::JSOptionConstructor::createStructure):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/JSWorkerContextBase.h:
+        (WebCore::JSWorkerContextBase::createStructure):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/SerializedScriptValue.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        (WebCore::WorkerScriptController::initScript):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/CRuntimeObject.h:
+        (JSC::Bindings::CRuntimeObject::createStructure):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CRuntimeMethod::createStructure):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaRuntimeMethod::createStructure):
+        * bridge/jni/jsc/JavaRuntimeObject.h:
+        (JSC::Bindings::JavaRuntimeObject::createStructure):
+        * bridge/objc/ObjCRuntimeObject.h:
+        (JSC::Bindings::ObjCRuntimeObject::createStructure):
+        * bridge/objc/objc_instance.mm:
+        (ObjCRuntimeMethod::createStructure):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObject::createStructure):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapRuntimeObject::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::RuntimeArray):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::RuntimeMethod):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::RuntimeObject):
+        * bridge/runtime_object.h:
+        (JSC::Bindings::RuntimeObject::createStructure):
+        * history/HistoryItem.h:
+
+2011-04-15  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Brian Weinstein.
+
+        Hang underneath ApplicationCacheStorage::writeDataToUniqueFileInDirectory when loading
+        http://www.webkit.org/demos/calendar.
+        https://bugs.webkit.org/show_bug.cgi?id=58698
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openFile):
+        Add breaks to the case statement.
+        (WebCore::directoryName):
+        Remove any trailing slash in directoryName. After closer inspection of all callers, it
+        appears the that callers do not need the trailing slash, and those that use the length do
+        so only to change the direction of the slashes throughout the length of the path.
+
+2011-04-15  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 52963 - Enable O(1) access to root from any node in shadow DOM subtree
+        https://bugs.webkit.org/show_bug.cgi?id=52963
+
+        .) Change base class of ShadowRoot from DocumentFragment to TreeScope.
+        .) Re-enable tree scope handling in Node (had ASSERT_NOT_REACHED, etc.).
+        .) Merged setTreeScope() with setTreeScopeRecursively()
+        .) Call setTreeScopeRecursively in DOM manipulation functions where applicable.
+
+        No new tests. (refactoring)
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::takeAllChildrenFrom):
+        (WebCore::ContainerNode::removeBetween):
+        (WebCore::ContainerNode::removeChildren):
+        (WebCore::ContainerNode::parserAddChild):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::setDocType):
+        * dom/Element.h:
+        * dom/Node.cpp:
+        (WebCore::Node::treeScope):
+        (WebCore::Node::setTreeScopeRecursively):
+        * dom/Node.h:
+        (WebCore::Node::document):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::~ShadowRoot):
+        (WebCore::ShadowRoot::nodeType):
+        (WebCore::ShadowRoot::cloneNode):
+        (WebCore::ShadowRoot::childTypeAllowed):
+        * dom/ShadowRoot.h:
+        (WebCore::toShadowRoot):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::TreeScope):
+        (WebCore::TreeScope::setParentTreeScope):
+        * dom/TreeScope.h:
+        * rendering/RenderSlider.cpp:
+
+2011-04-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        DOM object handles are never removed from cache
+        https://bugs.webkit.org/show_bug.cgi?id=58707
+
+        We were trying to remove hash table items by value instead of by key.
+
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::JSNodeHandleOwner::finalize): Changed to work more like
+        DOMObjectHandleOwner::finalize because I'm going to merge them.
+
+        (WebCore::DOMObjectHandleOwner::finalize): Remove hash table items
+        by key, not value. (Oops!) Use a helper function to make sure we get
+        this right.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMObjectWrapper): Store the hash table key as our weak
+        handle context, so we can use it at destruction time.
+
+        * bindings/js/JSDOMBinding.h: Removed unnecessary include.
+
+        * bindings/js/JSNodeCustom.h:
+        (WebCore::cacheDOMNodeWrapper): Store the hash table key as our weak
+        handle context, so we can use it at destruction time.
+
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::setWrapper): Forward context parameter, to
+        support the above.
+
+2011-04-15  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed. Chromium Linux Release build fix due to unused variables.
+
+        * platform/audio/mkl/FFTFrameMKL.cpp:
+        (WebCore::FFTFrame::doFFT):
+        (WebCore::FFTFrame::doInverseFFT):
+        (WebCore::FFTFrame::cleanup):
+
+2011-04-15  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build change after r83945.
+
+        New 'PlatformPathCairo.cpp' was not added to the WinCairo build.
+
+        * WebCore.vcproj/WebCore.vcproj: Add missing file to WinCairo
+          build.  Exclude for standard Apple build.
+
+2011-04-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fade the find page overlay
+        https://bugs.webkit.org/show_bug.cgi?id=58697
+
+        Add a symbol that WebKit2 needs.
+
+        * WebCore.exp.in:
+
+2011-04-15  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        RenderDetailsMarker should belong to shadow element.
+        https://bugs.webkit.org/show_bug.cgi?id=58591
+
+        - Introduced DetailsMarkerControl element, which is a shadow element of <summary>, creates RenderDetailsMarker.
+        - Removed custom layout code from RenderDetails, RenderDetailsMarker, which is now done by usual CSS layout.
+          Note that marker size is given via style for -webkit-details-marker pseudo class.
+        - Converted default summary implementation from pure-renderer style to shadow of HTMLDetailsElement.
+          Now RenderDetails knows nothing about default summary.
+        - Moved event handling code from HTMLDetailsElement to HTMLSummaryElement because now the marker is always child of 
+          <summary>, and the clickable area is now <summary> itself.
+
+        - Note that the rendering result is changed due to the conversion from custom layout code to usual CSS styling.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/html.css:
+        (summary::-webkit-details-marker):
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+        * dom/Node.cpp:
+        (WebCore::shouldCreateRendererFor):
+        * dom/Node.h:
+        (WebCore::Node::canHaveLightChildRendererWithShadow):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::findSummaryFor):
+        (WebCore::HTMLDetailsElement::findMainSummary):
+        (WebCore::HTMLDetailsElement::refreshMainSummary):
+        (WebCore::HTMLDetailsElement::createShadowSubtree):
+        (WebCore::HTMLDetailsElement::childrenChanged):
+        (WebCore::HTMLDetailsElement::finishParsingChildren):
+        (WebCore::HTMLDetailsElement::toggleOpen):
+        * html/HTMLDetailsElement.h:
+        (WebCore::HTMLDetailsElement::canHaveLightChildRendererWithShadow):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::create):
+        (WebCore::HTMLSummaryElement::createShadowSubtree):
+        (WebCore::HTMLSummaryElement::detailsElement):
+        (WebCore::HTMLSummaryElement::isMainSummary):
+        (WebCore::HTMLSummaryElement::defaultEventHandler):
+        * html/HTMLSummaryElement.h:
+        (WebCore::HTMLSummaryElement::canHaveLightChildRendererWithShadow):
+        * html/shadow/DetailsMarkerControl.cpp: Added.
+        (WebCore::DetailsMarkerControl::DetailsMarkerControl):
+        (WebCore::DetailsMarkerControl::createRenderer):
+        (WebCore::DetailsMarkerControl::rendererIsNeeded):
+        (WebCore::DetailsMarkerControl::shadowPseudoId):
+        (WebCore::DetailsMarkerControl::summaryElement):
+        * html/shadow/DetailsMarkerControl.h: Added.
+        (WebCore::DetailsMarkerControl::create):
+        * rendering/RenderDetails.cpp:
+        (WebCore::RenderDetails::RenderDetails):
+        (WebCore::RenderDetails::styleDidChange):
+        (WebCore::RenderDetails::moveSummaryToContents):
+        (WebCore::RenderDetails::checkMainSummary):
+        (WebCore::RenderDetails::layout):
+        * rendering/RenderDetails.h:
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::RenderDetailsMarker):
+        (WebCore::RenderDetailsMarker::isOpen):
+        (WebCore::RenderDetailsMarker::getPath):
+        (WebCore::RenderDetailsMarker::paint):
+        (WebCore::RenderDetailsMarker::details):
+        * rendering/RenderDetailsMarker.h:
+
+2011-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Implement localize strings for windows WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=58688
+
+        * platform/win/LocalizedStringsWin.cpp:
+        (WebCore::createWebKitBundle):
+        (WebCore::webKitBundle):
+        (WebCore::localizedString):
+        Add implementation of localizedString for Windows.
+
+2011-04-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Some mechanical DOM wrapper cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=58689
+
+        * WebCore.exp.in: Export!
+
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::isReachableFromDOM): Inverted the inDocument test to make the
+        relationship of the special cases to the normal case clearer.
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore::toJSArrayBufferView):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMObjectWrapper):
+        (WebCore::cacheDOMObjectWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper): Changed DOM wrapper functions to operate
+        in terms of DOMWrapperWorlds instead of ExecStates. This is clearer,
+        and ever-so-slightly faster.
+        
+        Removed hasCachedXXX functions, now that they're unused.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/js/JSNodeCustom.h:
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): Updated for changes above.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection): Removed use of hasCachedDOMObjectWrapper
+        because XHR is almost always created and used by JavaScript, so it's
+        simpler to just always report extra cost.
+
+2011-04-15  Andreas Kling  <kling@webkit.org>
+
+        Rolling out accidental part of r84010.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::setButtonPadding):
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Forgot windows build fix.
+
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::WeakOwner::isReachableFromOpaqueRoots):
+
+2011-04-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Frontend Part of Web Inspector: Remote Web Inspector - Cross Platform InspectorServer
+        https://bugs.webkit.org/show_bug.cgi?id=51364
+
+        The front end should not use a transparent background when
+        loaded as a web page (remote debugging) but should when loaded
+        regularly in a custom window. This adds a "remote" style class
+        onto the document body when the page is loaded remotely.
+
+        * inspector/front-end/inspector.css:
+        (body.detached.platform-mac-snowleopard:not(.remote) #toolbar): respect the "remote" class.
+        * inspector/front-end/inspector.js: add a "remote" class on the body when loaded remotely.
+
+2011-04-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        JSLock ASSERT seen often when using the inspector for long
+        periods of time. We should take the JSLock whenever we
+        might allocate memory in the JavaScript Heap.
+
+        JSC InjectedScriptHost::nodeAsScriptValue should take JSLock before possible JavaScript Allocations
+        https://bugs.webkit.org/show_bug.cgi?id=58674
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::nodeAsScriptValue): take the JSLock.
+
+2011-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make JSNodeFilterCondition handle its lifetime correctly
+        https://bugs.webkit.org/show_bug.cgi?id=58622
+
+        Switch over to a WeakHandle and external roots to keep the
+        condition value live.
+
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::JSNodeFilterCondition):
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        (WebCore::JSNodeFilterCondition::WeakOwner::isReachableFromOpaqueRoots):
+        * bindings/js/JSNodeFilterCondition.h:
+        (WebCore::JSNodeFilterCondition::create):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2011-04-13  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QNetworkReplyHandler refactoring: some adjustments
+        https://bugs.webkit.org/show_bug.cgi?id=57092
+
+        - Removing flag m_redirected from QNetworkReplyHandler and using m_redirectionTargetUrl.isValid() instead.
+        - Moving flag m_responseContainsData from QNetworkReplyHandler to the reply wrapper and removing the connection of
+        signal metaDataChanged for m_responseContainsData to be consistent.
+        - Using an OwnPtr to keep the reference to the QNetworkReplyWrapper.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::receiveMetaData):
+        (WebCore::QNetworkReplyWrapper::didReceiveReadyRead):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::release):
+        (WebCore::shouldIgnoreHttpError):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::redirect):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyWrapper::responseContainsData):
+        (WebCore::QNetworkReplyWrapper::redirected):
+
+2011-04-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Chromium build fix.
+
+        * platform/SecureTextInput.h: CARBON_SECURE_INPUT_MODE no longer exists.
+
+2011-04-15  Mike Reed  <reed@google.com>
+
+        Reviewed by Darin Fisher.
+
+        hide unused static function when SKIA_GPU is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=58670
+
+        No new tests. Just fixes a warning (treated as an error) when SKIA_GPU is enabled
+
+        * platform/graphics/skia/ImageSkia.cpp:
+
+2011-04-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Some borders with border-radius do not have rounded inner edges
+        https://bugs.webkit.org/show_bug.cgi?id=58457
+        
+        Improve the logic used to compute the inner radii on curved
+        borders, to maintain borders of even thickness around the curve.
+        
+        Tests: fast/borders/mixed-border-styles-radius.html
+               fast/borders/mixed-border-styles.html
+
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::computeBorderOuterRect):
+        (WebCore::RenderBoxModelObject::computeBorderInnerRect):
+        Two new utility functions to share some code that was in both paintBorder()
+        and paintBoxShaadow().
+        getRoundedInnerBorderWithBorderWidths() now takes the outer border box
+        as well as the inner box.
+        
+        (WebCore::RenderBoxModelObject::paintBorder): Call new methods.
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Ditto.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawBoxSideFromPath):
+        getRoundedInnerBorderWithBorderWidths() now takes the outer border box
+        as well as the inner box.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getRoundedInnerBorderWithBorderWidths):
+        * rendering/style/RenderStyle.h:
+        Compute the inner radii by starting with teh radii used for the
+        outer box, and then shrinking them down based on the border thickness.
+
+2011-04-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Password field input does not switch to ASCII-compatible source
+        https://bugs.webkit.org/show_bug.cgi?id=58583
+        <rdar://problem/9059651>
+
+        * platform/SecureTextInput.cpp:
+        (WebCore::enableSecureTextInput):
+        (WebCore::disableSecureTextInput):
+        This is now only used by Chromium. There is no need to change TSMDocument properties in
+        renderer process (and really, all secure text input logic in WebCore should be eliminated).
+
+2011-04-13  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Continue (3rd) experiment with moving caret by word in visual order.
+        https://bugs.webkit.org/show_bug.cgi?id=58294
+
+        This patch along with r82588 and r83483 implements moving caret by
+        word in visual order.
+        
+        The overall algorithm is:
+        1. First get the InlineBox and offset of the pass-in VisiblePosition.
+        2. Based on the position (left boundary, middle, right boundary) of the offset and the
+           direction of the movement, look for visually adjacent word breaks.
+        2.1 If the offset is the minimum offset of the box,
+            return the rightmost word boundary in previous boxes if moving left.
+            return the leftmost word boundary in box and next boxes if moving right.
+        2.2 Similar for the case when offset is at the maximum offset of the box.
+        2.3 When offset is inside the box (not at boundaries), first find the previousWordPosition 
+            or nextWordPosition based on the directionality of the box. If this word break position 
+            is also inside the same box, return it. Otherwise (the nextWordPosition or 
+            previousWordPosition is not in the same box or is at the box boundary), collect all the 
+            word breaks in the box and search for the one closest to the input "offset" based on 
+            box directionality, block directionality, and movement direction. Continue search in 
+            adjacent boxes if needed.
+
+        Notes:
+        1. Word boundaries are collected one box at a time. Only when a boundary that is closest to 
+           the input position (in the moving direction) is not available in current box, word 
+           boundaries in adjacent box will be collected. So, there is no need to save InlineBox in 
+           word boundaries. Instead, the word boundaries are saved as a pair 
+           (VisiblePosition, offset) to avoid recomputing VisiblePosition.
+ 
+        2. We only collect boundaries of the right kind (i.e. left boundary of a word in LTR block
+           and right boundary of a word in RTL block). And word boundaries are collected using 
+           previousWordPosition() and nextWordPosition(). So when box directionality is the same as 
+           block directionality, word boundaries are collected from right to left visually in a LTR 
+           box, and word boundaries are collected from left to right visually in a RTL box. It is
+           the other way around when box directionality is different from block directionality.
+
+        3. To find the right kinds of word boundaries, we must move back and forth between words
+           in some situations. For example, if we're moving to the right in a LTR box in LTR block,
+           we cannot simply return nextWordPosition() because it would return the right boundary
+           of a word. Instead, we return nextWordPosition()'s nextWordPosition()'s previousWordPosition().
+
+        4. When collecting word breaks inside a box, it first computes a start position, then
+           collect the right kind of word breaks until it reaches the end of (or beyond) the box.
+           In the meanwhile, it might need special handling on the rightmost or leftmost position 
+           based on the directionality of the box and block. These computations do not consider the 
+           box's bidi level.
+
+        * editing/visible_units.cpp:
+        (WebCore::nextWordBreakInBoxInsideBlockWithDifferentDirectionality):
+        (WebCore::collectWordBreaksInBox):
+        (WebCore::previousWordBoundaryInBox):
+        (WebCore::nextWordBoundaryInBox):
+        (WebCore::visuallyLastWordBoundaryInBox):
+        (WebCore::leftWordBoundary):
+        (WebCore::rightWordBoundary):
+        (WebCore::leftWordPosition):
+        (WebCore::rightWordPosition):
+
+2011-04-14  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Use HTMLImageElement in Canvas 2D / WebGL before response is ready causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=58501
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texImage2D): Call validateHTMLImageElement().
+        (WebCore::WebGLRenderingContext::texSubImage2D): Ditto.
+        (WebCore::WebGLRenderingContext::validateHTMLImageElement): Make sure image is ready.
+        * html/canvas/WebGLRenderingContext.h:
+
+2011-04-07  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        DocumentMaker::AllMarkers should not be a part of DocumentMarker::MarkerType
+        https://bugs.webkit.org/show_bug.cgi?id=58112
+        
+        - Converted DocumentMarker::MarkerTypes from unsigned int to a class.
+        - Converted DocumentMarker::AllMarkers from an enum entry to a subclass of MarkerTypes.
+        - Changed type of some MarkerType argument on DocumentMarkerController API to MarkerTypes
+          which should allow a combination of MarkerType constansts.
+        - Removed some MarkerType arguments on DocumentMarkerController API
+          which only received AllMarkers.
+        
+        No new tests, no behavior change.
+
+        * WebCore.exp.in:
+        * dom/DocumentMarker.h:
+        (WebCore::DocumentMarker::MarkerTypes::MarkerTypes):
+        (WebCore::DocumentMarker::MarkerTypes::contains):
+        (WebCore::DocumentMarker::MarkerTypes::intersects):
+        (WebCore::DocumentMarker::MarkerTypes::operator==):
+        (WebCore::DocumentMarker::MarkerTypes::add):
+        (WebCore::DocumentMarker::MarkerTypes::remove):
+        (WebCore::DocumentMarker::AllMarkers::AllMarkers):
+        * dom/DocumentMarkerController.cpp:
+        (WebCore::DocumentMarkerController::possiblyHasMarkers):
+        (WebCore::DocumentMarkerController::addMarker):
+        (WebCore::DocumentMarkerController::copyMarkers):
+        (WebCore::DocumentMarkerController::removeMarkers):
+        (WebCore::DocumentMarkerController::markerContainingPoint):
+        (WebCore::DocumentMarkerController::markersInRange):
+        (WebCore::DocumentMarkerController::renderedRectsForMarkers):
+        (WebCore::DocumentMarkerController::removeMarkersFromMarkerMapVectorPair):
+        (WebCore::DocumentMarkerController::repaintMarkers):
+        (WebCore::DocumentMarkerController::shiftMarkers):
+        (WebCore::DocumentMarkerController::setMarkersActive):
+        (WebCore::DocumentMarkerController::hasMarkers):
+        (WebCore::DocumentMarkerController::clearDescriptionOnMarkersIntersectingRange):
+        * dom/DocumentMarkerController.h:
+
+2011-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Complicated hash table is complicated
+        https://bugs.webkit.org/show_bug.cgi?id=58631
+        
+        Now that we use the opaque roots system to track node wrapper lifetime,
+        we can remove a lot of complicated hash-tablery that used to do the same.
+        
+        Now normal world node wrappers are just set as direct properties of
+        ScriptWrappable, while isolated world node wrappers and other DOM object
+        wrappers are stored in a shared, per-world hash table.
+
+        In addition to reducing complexity, this makes DOM wrapper allocation
+        1.6X faster (tested with scratch-gc-dom3.html), and it reduces the memory
+        footprint of normal world wrappers by ~2/3, and isolated world wrappers
+        by ~1/3.
+
+        * WebCore.exp.in: Paying the patch tithe.
+
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        (WebCore::DOMWrapperWorld::clearWrappers): No more per-document hash tables.
+
+        (WebCore::JSNodeHandleOwner::finalize): Changed to call a helper function,
+        so the code to destroy a wrapper can live next to the code to create one.
+
+        * bindings/js/DOMWrapperWorld.h: No more per-document hash tables.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::uncacheDOMObjectWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper): No more per-document hash tables.
+        Added uncacheDOMObjectWrapper to be symmetrical with cacheDOMObjectWrapper.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline): Ditto.
+
+        * bindings/js/JSNodeCustom.h:
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::uncacheDOMNodeWrapper):
+        (WebCore::toJS): Implemented the scheme described above.
+
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper): ScriptWrappable needs a handle
+        owner now, since we don't have an extra handle living in a hash table
+        to maintain ownership for us.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument): No more per-document hash tables.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer): Removed call to
+        hasCachedDOMNodeWrapperUnchecked because that was the old way of doing
+        things, and I was in the mood for getting rid of the old way. It's
+        debatable whether the check was ever a good idea. Even when a <canvas>
+        doesn't have a direct JS wrapper, other JS references can still keep
+        the <canvas> alive. So, it's probably best always to report extra cost.
+
+2011-04-15  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename rawRequestHeadersText and RawResponseHeadersText to requestHeadersText and responseHeadersText
+        https://bugs.webkit.org/show_bug.cgi?id=58650
+
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForResourceResponse):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithResponse):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.get requestHeadersText):
+        (WebInspector.Resource.prototype.set requestHeadersText):
+        (WebInspector.Resource.prototype.get requestHeadersSize):
+        (WebInspector.Resource.prototype.get responseHeadersText):
+        (WebInspector.Resource.prototype.set responseHeadersText):
+        (WebInspector.Resource.prototype.get responseHeadersSize):
+        (WebInspector.Resource.prototype._headersSize):
+        * inspector/front-end/ResourceHeadersView.js:
+        (WebInspector.ResourceHeadersView):
+        (WebInspector.ResourceHeadersView.prototype._refreshRequestHeaders):
+        (WebInspector.ResourceHeadersView.prototype._refreshResponseHeaders):
+        (WebInspector.ResourceHeadersView.prototype._refreshHeadersTitle):
+        (WebInspector.ResourceHeadersView.prototype._refreshHeadersText):
+        (WebInspector.ResourceHeadersView.prototype._toggleRequestHeadersText):
+        (WebInspector.ResourceHeadersView.prototype._toggleResponseHeadersText):
+        (WebInspector.ResourceHeadersView.prototype._createHeadersToggleButton):
+        * inspector/front-end/networkPanel.css:
+        (.resource-headers-view .outline-disclosure li.headers-text):
+        * platform/network/ResourceLoadInfo.h:
+
+2011-04-15  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement css overflow properties in CSSStyleApplyProperty
+        https://bugs.webkit.org/show_bug.cgi?id=58633
+
+        No new tests required as no functionality changes.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        Add initializers for CSSPropertyOverflowX, CSSPropertyOverflowY and CSSPropertyOverflow.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Delete existing implementations.
+
+2011-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make mac WebKit1 use the default localization strategy
+        https://bugs.webkit.org/show_bug.cgi?id=58628
+
+        * English.lproj/Localizable.strings:
+        Update by running update-webkit-localizable-strings.
+
+        * platform/DefaultLocalizationStrategy.cpp:
+        (WebCore::DefaultLocalizationStrategy::contextMenuItemTagLookUpInDictionary):
+        (WebCore::DefaultLocalizationStrategy::keygenKeychainItemName):
+        (WebCore::DefaultLocalizationStrategy::imageTitle):
+        Match the WebKit1 versions of these functions by special casing CF platforms.
+
+2011-04-15  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: No console message and headers in inspector when X-Frame-Options header blocks a load
+        https://bugs.webkit.org/show_bug.cgi?id=58136
+
+        Passed response info to inspector when X-Frame-Options header blocks resource loading.
+
+        Test: http/tests/inspector/network/x-frame-options-deny.html
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::continueAfterXFrameOptionsDeniedImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::continueAfterXFrameOptionsDenied):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+
+2011-04-15  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: TextViewer and TextEditorModel must support both \n and \r\n as line separators
+        https://bugs.webkit.org/show_bug.cgi?id=58449
+
+        Test: inspector/editor/text-editor-model.html
+
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel):
+        (WebInspector.TextEditorModel.prototype.get text):
+        (WebInspector.TextEditorModel.prototype.setText):
+        (WebInspector.TextEditorModel.prototype._innerSetText):
+        (WebInspector.TextEditorModel.prototype.copyRange):
+
+2011-04-15  Sergey Vorobyev  <sergeyvorobyev@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Network events don't preserves,
+        when inspector frontend closed and open again
+        https://bugs.webkit.org/show_bug.cgi?id=58064
+
+        Added InspectorFrontendProxy and EventsCollector.
+        They allow captured messages from InspectorResourceAgent
+        to frontend (or mockFrontend if frontend disabled) and
+        push collected data when frontend reconnect.
+        This functionality is disabled by default.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/EventsCollector.cpp: Added.
+        (WebCore::EventsCollector::EventsCollector):
+        (WebCore::EventsCollector::addEvent):
+        (WebCore::EventsCollector::sendCollectedEvents):
+        * inspector/EventsCollector.h: Added.
+        (WebCore::EventsCollector::~EventsCollector):
+        * inspector/Inspector.json:
+        * inspector/InspectorFrontendProxy.cpp: Added.
+        (WebCore::InspectorFrontendProxy::InspectorFrontendProxy):
+        (WebCore::InspectorFrontendProxy::setInspectorFrontendChannel):
+        (WebCore::InspectorFrontendProxy::setEventsCollector):
+        (WebCore::InspectorFrontendProxy::sendMessageToFrontend):
+        * inspector/InspectorFrontendProxy.h: Added.
+        (WebCore::InspectorFrontendProxy::~InspectorFrontendProxy):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl):
+        (WebCore::InspectorInstrumentation::loadEventFiredImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::willSendRequest):
+        (WebCore::InspectorInstrumentation::willReceiveResourceResponse):
+        (WebCore::InspectorInstrumentation::didReceiveContentLength):
+        (WebCore::InspectorInstrumentation::didFinishLoading):
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFired):
+        (WebCore::InspectorInstrumentation::loadEventFired):
+        (WebCore::InspectorInstrumentation::frameDetachedFromParent):
+        (WebCore::InspectorInstrumentation::didCreateWebSocket):
+        (WebCore::InspectorInstrumentation::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorInstrumentation::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorInstrumentation::didCloseWebSocket):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setFrontend):
+        (WebCore::InspectorResourceAgent::resourceContent):
+        (WebCore::InspectorResourceAgent::~InspectorResourceAgent):
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::domContentEventFired):
+        (WebCore::InspectorResourceAgent::loadEventFired):
+        (WebCore::InspectorResourceAgent::enabledBackgoundEventsCoollection):
+        (WebCore::InspectorResourceAgent::enable):
+        (WebCore::InspectorResourceAgent::InspectorResourceAgent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype.domContentEventFired):
+        (WebInspector.NetworkDispatcher.prototype.loadEventFired):
+        * inspector/front-end/inspector.js:
+        (WebInspector.domContentEventFired):
+        (WebInspector.loadEventFired):
+
+2011-04-15  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION(r83397) [Qt] When clicking on the media elements they grow 2 pixels.
+        https://bugs.webkit.org/show_bug.cgi?id=58477
+
+        Since r83397 the media controls elements are actual DOM elements.
+        Therefore the global style-sheet applies to them. html.css defines
+        input[type="button"]:active to be border-style: inset which means
+        that when the buttons are active they grow by their border size. Therefore
+        ports which are not using the borders must explicitly disable them in their custom
+        stylesheet.
+
+        * css/mediaControlsQt.css:
+        (audio::-webkit-media-controls-mute-button):
+        (video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button):
+        (video::-webkit-media-controls-play-button):
+        (video::-webkit-media-controls-fullscreen-button):
+        * css/mediaControlsQuickTime.css:
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button):
+        (audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button):
+        (audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button):
+        (audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button):
+        (audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button):
+        (audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button):
+
+2011-04-15  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Added enums for external file system type.
+        https://bugs.webkit.org/show_bug.cgi?id=58456
+
+        * fileapi/DOMFileSystemBase.cpp:
+        (WebCore::DOMFileSystemBase::crackFileSystemURL):
+        * fileapi/DOMFileSystemBase.h:
+        * fileapi/EntryBase.cpp:
+        (WebCore::EntryBase::toURL):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::requestFileSystem):
+        * page/DOMWindow.h:
+        * platform/AsyncFileSystem.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::requestFileSystem):
+        (WebCore::WorkerContext::requestFileSystemSync):
+        * workers/WorkerContext.h:
+
+2011-04-15  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: make resource revisions use dedicated type (not Resource clone).
+        https://bugs.webkit.org/show_bug.cgi?id=58659
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.setStyleSheetText):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.addRevision):
+        (WebInspector.Resource.prototype._innerRequestContent.onResourceContent):
+        (WebInspector.Resource.prototype._innerRequestContent):
+        (WebInspector.ResourceRevision):
+        (WebInspector.ResourceRevision.prototype.get resource):
+        (WebInspector.ResourceRevision.prototype.get timestamp):
+        (WebInspector.ResourceRevision.prototype.get content):
+        (WebInspector.ResourceRevision.prototype.revertToThis):
+        (WebInspector.ResourceRevision.prototype.requestContent.mycallback):
+        (WebInspector.ResourceRevision.prototype.requestContent):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.resourceViewTypeMatchesResource):
+        (WebInspector.ResourceView.resourceViewForResource):
+        (WebInspector.ResourceView.recreateResourceView):
+        (WebInspector.ResourceView.existingResourceViewForResource):
+        (WebInspector.RevisionSourceFrame):
+        (WebInspector.RevisionSourceFrame.prototype.get resource):
+        (WebInspector.RevisionSourceFrame.prototype.isContentEditable):
+        (WebInspector.RevisionSourceFrame.prototype.requestContent):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._showResourceView):
+        (WebInspector.ResourcesPanel.prototype._showRevisionView):
+        (WebInspector.ResourcesPanel.prototype._fetchAndApplyDiffMarkup.step1):
+        (WebInspector.ResourcesPanel.prototype._fetchAndApplyDiffMarkup.step2):
+        (WebInspector.ResourcesPanel.prototype._fetchAndApplyDiffMarkup):
+        (WebInspector.ResourceRevisionTreeElement):
+        (WebInspector.ResourceRevisionTreeElement.prototype.get itemURL):
+        (WebInspector.ResourceRevisionTreeElement.prototype.onselect):
+        (WebInspector.ResourceRevisionTreeElement.prototype._ondragstart):
+        (WebInspector.ResourceRevisionTreeElement.prototype._handleContextMenuEvent):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._ensureContentLoaded):
+        (WebInspector.SourceFrame.prototype.requestContent):
+        (WebInspector.SourceFrame.prototype.commitEditing.didEditContent):
+        (WebInspector.SourceFrame.prototype.commitEditing):
+
+2011-04-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Prevent Backspace keypresses from routing into the inspected page
+        https://bugs.webkit.org/show_bug.cgi?id=58653
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2011-04-15  Alice Boxhall  <aboxhall@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Text selection changes unexpectedly when dragging out of the <input>
+        https://bugs.webkit.org/show_bug.cgi?id=55552
+
+        Tests: editing/selection/select-out-of-editable.html
+               editing/selection/select-out-of-floated-contenteditable.html
+               editing/selection/select-out-of-floated-input.html
+               editing/selection/select-out-of-floated-textarea.html
+
+        * page/EventHandler.cpp:
+        (WebCore::selectionExtentRespectingEditingBoundary): When dragging from an editable element, check that
+        the endpoint is not outside the element. If it is, translate the point into a local point within
+        the editable element.
+        (WebCore::EventHandler::updateSelectionForMouseDrag): Call targetPositionForSelectionEndpoint() to
+        calculate the selection endpoint.
+
+2011-04-15  Adam Roben  <aroben@apple.com>
+
+        Roll out r83954
+
+        It was causing fast/dom/Window/timer-null-script-execution-context.html to crash on multiple
+        bots.
+
+        See <http://webkit.org/b/58610>.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        * bindings/js/ScheduledAction.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
+        * page/ContentSecurityPolicy.cpp:
+        * page/ContentSecurityPolicy.h:
+
+2011-04-15  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor resource setContent / revisions infrastructure to get
+        rid of onRevert callback.
+        https://bugs.webkit.org/show_bug.cgi?id=58649
+
+        Instead, we will have DomainModel/Resource binding responsible for changing
+        underlying model upon resource changes and vice versa.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getStyleSheet):
+        (WebCore::InspectorCSSAgent::getStyleSheetText):
+        (WebCore::InspectorCSSAgent::setStyleSheetText):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::setRuleSelector):
+        (WebCore::InspectorCSSAgent::assertStyleSheetForId):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype.setStyleSheetText):
+        (WebInspector.CSSStyleDeclaration.prototype.insertPropertyAt):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setText.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+        (WebInspector.CSSStyleModelResourceBinding):
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setContent):
+        (WebInspector.CSSStyleModelResourceBinding.prototype._frameNavigated):
+        (WebInspector.CSSStyleModelResourceBinding.prototype._innerSetContent):
+        (WebInspector.CSSStyleModelResourceBinding.prototype._loadStyleSheetHeaders):
+        (WebInspector.CSSStyleModelResourceBinding.prototype._styleSheetChanged.setContent):
+        (WebInspector.CSSStyleModelResourceBinding.prototype._styleSheetChanged):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource.didReceiveSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource):
+        (WebInspector.DebuggerPresentationModelResourceBinding):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.canSetContent):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.setContent):
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.hasEventListeners):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.registerDomainModelBinding):
+        (WebInspector.Resource.prototype.isEditable):
+        (WebInspector.Resource.prototype.setContent):
+        (WebInspector.Resource.prototype.addRevision):
+        (WebInspector.Resource.prototype.revertToThis.callback):
+        (WebInspector.Resource.prototype.revertToThis):
+        (WebInspector.ResourceDomainModelBinding):
+        (WebInspector.ResourceDomainModelBinding.prototype.canSetContent):
+        (WebInspector.ResourceDomainModelBinding.prototype.setContent):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.createResourceView):
+        (WebInspector.ResourceView.resourceViewTypeMatchesResource):
+        (WebInspector.ResourceSourceFrame.prototype.isContentEditable):
+        (WebInspector.ResourceSourceFrame.prototype.editContent):
+        (WebInspector.ResourceSourceFrame.prototype.endEditing):
+        (WebInspector.ResourceSourceFrame.prototype._clearIncrementalUpdateTimer):
+        (WebInspector.ResourceSourceFrame.prototype._requestContent):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._resourceAdded):
+        (WebInspector.FrameResourceTreeElement):
+        (WebInspector.FrameResourceTreeElement.prototype._populateRevisions):
+        (WebInspector.FrameResourceTreeElement.prototype._revisionAdded):
+        (WebInspector.FrameResourceTreeElement.prototype._appendRevision):
+        * inspector/front-end/inspector.html:
+
+2011-04-15  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed, rolling out r83949.
+        http://trac.webkit.org/changeset/83949
+        https://bugs.webkit.org/show_bug.cgi?id=57960
+
+        broke 31 tests in chromium win & linux
+
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        * platform/graphics/chromium/GLES2Canvas.h:
+        * platform/graphics/gpu/Texture.cpp:
+        (WebCore::copySubRect):
+        (WebCore::Texture::load):
+        (WebCore::Texture::updateSubRect):
+        * platform/graphics/gpu/Texture.h:
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+
+2011-04-15  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix building with Sun Studio 12: function pointers for extern "C" are treated differently
+        https://bugs.webkit.org/show_bug.cgi?id=58508
+
+        Since extern "C" makes a different type (although most compilers ignore that),
+        we should be more careful when passing NPAPI callback functions.
+
+        * plugins/npapi.cpp:
+        (NPN_PluginThreadAsyncCall):
+
+2011-04-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CSP should block string arguments to setTimeout and setInterval unless options eval-script
+        https://bugs.webkit.org/show_bug.cgi?id=58610
+
+        It's somewhat sadness that the JSC and V8 code for setTimeout and
+        setInterval are so different.  I struggled for a while with how to
+        handle the worker case, but I decided to punt on it for now.
+
+        Tests: http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-allowed.html
+               http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-blocked.html
+               http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-allowed.html
+               http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-blocked.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        * bindings/js/ScheduledAction.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowEval):
+        * page/ContentSecurityPolicy.h:
+
+2011-04-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for CSP's 'self' source
+        https://bugs.webkit.org/show_bug.cgi?id=58604
+
+        This change is now trivially easy.
+
+        Test: http/tests/security/contentSecurityPolicy/script-src-self.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPSourceList::addSourceSelf):
+
+2011-04-15  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Renaming TRACK feature define to VIDEO_TRACK
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        No new tests. No new functionality.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * features.pri:
+        * html/HTMLTagNames.in:
+        * html/HTMLTrackElement.cpp:
+        * html/HTMLTrackElement.h:
+        * html/HTMLTrackElement.idl:
+
+2011-04-14  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Ctrl+Left/Right switch panels during live editing
+        https://bugs.webkit.org/show_bug.cgi?id=58521
+
+        Disable Ctrl+Left/Right keyboard shortcuts while in live edit.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.readOnlyStateChanged):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.set readOnly):
+        (WebInspector.TextViewer.prototype.get readOnly):
+        (WebInspector.TextViewer.prototype._doubleClick):
+        (WebInspector.TextViewer.prototype._commitEditing.didCommitEditing):
+        (WebInspector.TextViewer.prototype._commitEditing):
+        (WebInspector.TextViewer.prototype._cancelEditing):
+        (WebInspector.TextViewerDelegate.prototype.readOnlyStateChanged):
+        (WebInspector.TextEditorMainPanel.prototype.set readOnly):
+        * inspector/front-end/inspector.js:
+        (WebInspector.markBeingEdited):
+        (WebInspector.isEditingAnyField):
+        (WebInspector.startEditing.cleanUpAfterEditing):
+
+2011-04-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Enable raw HTTP headers support
+        https://bugs.webkit.org/show_bug.cgi?id=58259
+
+        Added raw headers text support to inspector.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForResourceResponse):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithResponse):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.get transferSize):
+        (WebInspector.Resource.prototype.set requestHeaders):
+        (WebInspector.Resource.prototype.get rawRequestHeadersText):
+        (WebInspector.Resource.prototype.set rawRequestHeadersText):
+        (WebInspector.Resource.prototype.get requestHeadersSize):
+        (WebInspector.Resource.prototype.set responseHeaders):
+        (WebInspector.Resource.prototype.get rawResponseHeadersText):
+        (WebInspector.Resource.prototype.set rawResponseHeadersText):
+        (WebInspector.Resource.prototype.get responseHeadersSize):
+        (WebInspector.Resource.prototype._headersSize):
+        * inspector/front-end/ResourceHeadersView.js:
+        (WebInspector.ResourceHeadersView):
+        (WebInspector.ResourceHeadersView.prototype._refreshParms):
+        (WebInspector.ResourceHeadersView.prototype._refreshRequestHeaders):
+        (WebInspector.ResourceHeadersView.prototype._refreshResponseHeaders):
+        (WebInspector.ResourceHeadersView.prototype._refreshHeadersTitle):
+        (WebInspector.ResourceHeadersView.prototype._refreshHeaders):
+        (WebInspector.ResourceHeadersView.prototype._refreshRawHeadersText):
+        (WebInspector.ResourceHeadersView.prototype._toggleRawRequestHeadersText):
+        (WebInspector.ResourceHeadersView.prototype._toggleRawResponseHeadersText):
+        (WebInspector.ResourceHeadersView.prototype._createToggleButton):
+        (WebInspector.ResourceHeadersView.prototype._createHeadersToggleButton):
+        * inspector/front-end/networkPanel.css:
+        (.resource-headers-view .outline-disclosure li .header-toggle):
+        (.resource-headers-view .outline-disclosure li.expanded .header-toggle):
+        (.resource-headers-view .outline-disclosure li .header-toggle:hover):
+        (.resource-headers-view .outline-disclosure li.raw-headers-text):
+        * platform/network/ResourceLoadInfo.h:
+
+2011-04-14  Justin Novosad  <junov@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [Chromium] Accelerated 2D Canvas is slow to execute putImageData
+        https://bugs.webkit.org/show_bug.cgi?id=57960
+
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        Added an option for using the blend ops for alpha multiplication
+        instead of compositing.
+        (WebCore::GLES2Canvas::applyClipping):
+        (WebCore::GLES2Canvas::putImageData):
+        New method for drawing raw pixel data from memory to the canvas
+        (WebCore::GLES2Canvas::putUnmultipliedImageData):
+        Wrapper for putImageData
+        (WebCore::GLES2Canvas::putPremultipliedImageData):
+        Wrapper for putImageData
+        * platform/graphics/chromium/GLES2Canvas.h:
+        * platform/graphics/gpu/Texture.cpp:
+        (WebCore::copySubRect):
+        (WebCore::Texture::load):
+        (WebCore::Texture::updateSubRect):
+        Added an overload of the updateSubRect method that can receive a pixel 
+        of a size that is different from texture size. Improved the performance
+        of updateSubrect by avoiding the allocation of a temporary buffer when
+        not required.
+        * platform/graphics/gpu/Texture.h:
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        In the unmultiplied path, division by alpha now performs proper
+        rounding in order to avoid generational degradation with putImageData
+        (WebCore::putImageData):
+        Alpha multiplication now performs proper rounding in order to be
+        consistent with the hardware rendering path: OpenGL always rounds when
+        converting to fixed point representation.
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        Now supports a hardware rendering path, which eliminates the need
+        for a readback from the GPU
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        Now supports a hardware rendering path, which eliminates the need
+        for a readback from the GPU
+
+2011-04-14  Joone Hur  <joone.hur@collabora.co.uk>
+
+        Reviewed by Martin Robinson.
+
+        Creating a CairoPath instance is not thread safe
+        https://bugs.webkit.org/show_bug.cgi?id=58514
+
+        This patch allows a cairo surface to be created just one time in order to 
+        guarantee thread safety.
+        In addition, CairoPath.{h,cpp} is renamed to PlatformPathCairo.{h,cpp} to 
+        prevent confusing them with PathCairo.cpp
+
+        * CMakeListsEfl.txt: Added PlatformPathCairo.cpp
+        * GNUmakefile.list.am: Added PlatformPathCairo.{h,cpp} instead of CairoPath.h.
+        * platform/graphics/cairo/CairoPath.h: Removed.
+        * platform/graphics/cairo/CairoUtilities.cpp: Include PlatformPathCairo.h instead of CairoPath.h.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp: Ditto.
+        * platform/graphics/cairo/PathCairo.cpp: Ditto.
+        * platform/graphics/cairo/PlatformPathCairo.cpp: Added.
+        (WebCore::getPathSurface): Getting a static cairo surface.
+        (WebCore::CairoPath::CairoPath): Moved the implementation of the constructor 
+        into the CPP file.
+        * platform/graphics/cairo/PlatformPathCairo.h: Renamed CairoPath.h to this.
+        (WebCore::CairoPath::~CairoPath):
+        (WebCore::CairoPath::context):
+
+2011-04-14  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Add lowpass filter and graph to fps indicator
+        https://bugs.webkit.org/show_bug.cgi?id=58186
+
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::CCHeadsUpDisplay):
+        (WebCore::CCHeadsUpDisplay::drawHudContents):
+        (WebCore::CCHeadsUpDisplay::drawFPSCounter):
+        (WebCore::CCHeadsUpDisplay::drawPlatformLayerTree):
+        (WebCore::CCHeadsUpDisplay::onPresent):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
+
+2011-04-14  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58612
+        Crash switching overlay/non-overlay scrollbar preference 
+        (WebCore::Page::setNeedsRecalcStyleInAllFrames + 9)
+        -and corresponding-
+        <rdar://problem/9241920> 
+
+        Speculative fix: Page could definitely be null here. 
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollbarStyleChanged):
+
+2011-04-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: ResourceResponse should have encodedDataLength field for synchronous requests transfer size
+        https://bugs.webkit.org/show_bug.cgi?id=58447
+
+        FrameLoader now takes encoded data length for synchronous requests from the field with the same name.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * platform/network/ResourceLoadInfo.h:
+        (WebCore::ResourceLoadInfo::ResourceLoadInfo):
+
+2011-04-14  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Remove dependency on chromium skia::PlatformCanvas
+        https://bugs.webkit.org/show_bug.cgi?id=57563
+
+        This patch does not change any functionality, just the type of object skia::PlatformCanvas -> SkCanvas. The object is still being created by a factory method skia::CreateBitmapCanvas defined in Chromium. We will eventually define an API that every port using skia will define.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/ImageBufferDataSkia.h:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::resize):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+        (WebCore::TransparencyWin::makeLayerOpaque):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::PlatformContextSkia):
+        (WebCore::PlatformContextSkia::setCanvas):
+        (WebCore::PlatformContextSkia::isNativeFontRenderingAllowed):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (WebCore::PlatformContextSkia::canvas):
+        (WebCore::PlatformContextSkia::printing):
+        (WebCore::PlatformContextSkia::setPrinting):
+
+2011-04-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        PumpSession should not call currentTime() in the constructor
+        https://bugs.webkit.org/show_bug.cgi?id=55211
+
+        currentTime() is expensive.  So we avoid calling it in the constructor
+        and instead set startTime on the first check for a yield
+        (which in the synchronous case never happens, and in the yielding
+        case will happen immediately after the first token due to
+        processedTokens being set to INT_MAX).
+
+        This ended up being a large win on (my local copy of)
+        peacekeeper's domDynamicCreationCreateElement:
+
+        Before:
+        avg 366.3333333333333
+        median 366
+        stdev 2.712112747574399
+        min 362
+        max 377
+
+        After:
+        avg 345.96666666666664
+        median 346
+        stdev 1.6829207415152454
+        min 343
+        max 349
+
+        * html/parser/HTMLDocumentParser.cpp:
+        * html/parser/HTMLParserScheduler.h:
+        (WebCore::PumpSession::PumpSession):
+        (WebCore::HTMLParserScheduler::checkForYieldBeforeToken):
+
+2011-04-14  Ami Fischman  <fischman@google.com>
+
+        Reviewed by Eric Carlson.
+
+        Remove unnecessary bottom margin of controls in video elements on media documents.
+        This makes the cases of media documents and non-media documents consistent,
+        and makes it possible to reason about the height of a rendered media document
+        (needed e.g. for sizing iframes).
+
+        This change is covered by (the currently Skipped, but soon-to-be-un-Skipped)
+        media/video-controls-in-media-document.html layouttest (see bug 54634 for
+        the un-Skipping).
+
+        https://bugs.webkit.org/show_bug.cgi?id=58442
+
+        * css/mediaControls.css:
+        (video:-webkit-full-page-media::-webkit-media-controls-panel):
+        * css/mediaControlsEfl.css:
+        (video:-webkit-full-page-media::-webkit-media-controls-panel):
+        * css/mediaControlsQuickTime.css:
+        (video:-webkit-full-page-media::-webkit-media-controls-panel):
+
+2011-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use opaque roots instead of direct marking for nodes in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=58624
+
+        A node treats the root of its tree (usually the document) as its opaque
+        root during GC.
+        
+        This is needed for correctness in a generational GC world, but it also
+        happens to be a 3.5X speedup in a DOM-heavy GC test (scratch-gc-dom2.html).
+
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::isObservable):
+        (WebCore::isReachableFromDOM): Moved a helper function from JSDOMBinding.
+        We use this function to determine whether a node is observable.
+
+        (WebCore::JSNodeHandleOwner::isReachableFromOpaqueRoots): Start using
+        our weak handle callback to determine reachability, instead of direct
+        marking traversal through the DOM.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren): Updated to use the opaque roots mechanism
+        instead of direct marking.
+
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h: Moved code mentioned above. Removed
+        markDOMNodeWrapper because it is now unused. This is a good thing because
+        markDOMNodeWrapper used deprecatedAppend, which is not compatible
+        with generational GC.
+
+        * bindings/js/JSDOMImplementationCustom.cpp:
+        (WebCore::JSDOMImplementation::markChildren): Updated to use opaque roots.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren): No need to mark our child nodes directly,
+        since they will take care of themselves through the opaque roots mechanism.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren): Updated to use opaque roots.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): No need to mark our tree or our document
+        directly, since they will take care of themselves through the opaque
+        roots mechanism.
+
+        * bindings/js/JSNodeCustom.h:
+        (WebCore::root): Helper function for accessing the root of a node tree.
+        This is O(1) while you're in the document, O(log(N)) when you're in a
+        reasonably balanced disconnected tree, and O(N) in the pathological case
+        of a disconnected tree that's shaped like a linked list. If average case
+        O(long(N)) turns out to be too slow, we can optimize through use of
+        rare data or an external hash table, but it is so uncommon that I have
+        ignored it for now.
+
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren): Updated to use opaque roots.
+
+2011-04-14  Mike Reed  <reed@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        fix shadows with gradients
+        https://bugs.webkit.org/show_bug.cgi?id=58376
+
+        No new tests. Existing tests exercise this
+        LayoutTests/fast/canvas/canvas-fillPath-gradient-shadow.html
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2011-04-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: No headers information in network panel for downloads.
+        https://bugs.webkit.org/show_bug.cgi?id=58139
+
+        Passed resource response to inspector for PolicyDownload and PolicyIgnore requests.
+
+        Test: http/tests/inspector/network/download.html
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponseButCanceledImpl):
+        (WebCore::InspectorInstrumentation::continueWithPolicyDownloadImpl):
+        (WebCore::InspectorInstrumentation::continueWithPolicyIgnoreImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::continueWithPolicyDownload):
+        (WebCore::InspectorInstrumentation::continueWithPolicyIgnore):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+
+2011-04-14  Joone Hur  <joone.hur@collabora.co.uk>
+
+        Reviewed by Martin Robinson.
+
+        Convert use of raw pointers to RefPtr in using Cairo
+        https://bugs.webkit.org/show_bug.cgi?id=57717
+
+        No new tests added becaue of just replacing raw pointers with smart pointers.
+
+        * platform/graphics/cairo/ContextShadowCairo.cpp: Use a RefPtr<cairo_surface_t> instead of raw pointer.
+        (WebCore::purgeScratchBuffer):
+        (WebCore::getScratchBuffer):
+        * platform/graphics/cairo/ImageBufferCairo.cpp: Use a RefPtr<cairo_t> instead of raw pointer.
+        (copySurface):
+
+2011-04-14  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium]Change menu list background fallback value to transparent to work background:none for HTML select tag.
+        https://bugs.webkit.org/show_bug.cgi?id=57818
+
+        Test: fast/forms/select-background-none.html
+
+        This fix is only for Chromium on Linux. Chromium on Mac already works fine.
+        But Windows has the same problem. This change doesn't include Windows part.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::paintMenuList): Change the default color to transparent.
+
+2011-04-14  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement border style css properties in CSSStyleApplyProperty
+        https://bugs.webkit.org/show_bug.cgi?id=58506
+
+        No new functionality added.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        Added new property initializers.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Removed old property handlers.
+
+2011-04-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Presence of shadow DOM should suppress rendering of ordinary child nodes
+        https://bugs.webkit.org/show_bug.cgi?id=58073
+
+        Test: fast/dom/shadow/no-renderers-for-light-children.html
+
+        * dom/Node.cpp:
+        (WebCore::shadowRoot): Added a helper function.
+        (WebCore::Node::setDocumentRecursively): Changed to use the helper.
+        (WebCore::shouldCreateRendererFor): Expanded a long condition check into a helper function,
+            added a check for children of an element with a shadow DOM.
+        (WebCore::Node::createRendererAndStyle): Changed to use the helper.
+
+2011-04-14  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Tile content and image layers
+        https://bugs.webkit.org/show_bug.cgi?id=57113
+
+        Layers tile by default if any dimension is larger than 512.  Smaller
+        layers are contained within a single texture but still use the tiler
+        infrastructure so that there's only one code path.
+
+        Remove large layer support from content layers.  Content layers no
+        longer own a platform canvas--they own a tiler.  Refactor tiler to
+        allow for better separation of update/upload/paint.  Add rect
+        parameter to update and draw functions on layers for the layer-space
+        rect of interest.  This is necessary to know which tiles need to be
+        drawn.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::ContentLayerChromium):
+        (WebCore::ContentLayerChromium::~ContentLayerChromium):
+        (WebCore::ContentLayerPainter::ContentLayerPainter):
+        (WebCore::ContentLayerPainter::paint):
+        (WebCore::ContentLayerChromium::paintContentsIfDirty):
+        (WebCore::ContentLayerChromium::setLayerRenderer):
+        (WebCore::ContentLayerChromium::tilingTransform):
+        (WebCore::ContentLayerChromium::visibleLayerRect):
+        (WebCore::ContentLayerChromium::layerBounds):
+        (WebCore::ContentLayerChromium::updateLayerSize):
+        (WebCore::ContentLayerChromium::draw):
+        (WebCore::ContentLayerChromium::createTilerIfNeeded):
+        (WebCore::ContentLayerChromium::updateCompositorResources):
+        (WebCore::ContentLayerChromium::setTilingOption):
+        (WebCore::ContentLayerChromium::bindContentsTexture):
+        (WebCore::ContentLayerChromium::unreserveContentsTexture):
+        (WebCore::ContentLayerChromium::setIsMask):
+        (WebCore::ContentLayerChromium::dumpLayerProperties):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (WebCore::ContentLayerChromium::drawsContent):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::paintContentsIfDirty):
+        (WebCore::ImageLayerChromium::updateCompositorResources):
+        (WebCore::ImageLayerChromium::layerBounds):
+        (WebCore::ImageLayerChromium::tilingTransform):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::invalidateRect):
+        (WebCore::LayerChromium::paintContentsIfDirty):
+        (WebCore::LayerChromium::setIsMask):
+        (WebCore::LayerChromium::draw):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawRootLayer):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::paintContentsRecursive):
+        (WebCore::LayerRendererChromium::copyOffscreenTextureToDisplay):
+        (WebCore::LayerRendererChromium::drawLayer):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::setTileSize):
+        (WebCore::LayerTilerChromium::getSingleTexture):
+        (WebCore::LayerTilerChromium::invalidateRect):
+        (WebCore::LayerTilerChromium::update):
+        (WebCore::LayerTilerChromium::uploadCanvas):
+        (WebCore::LayerTilerChromium::updateFromPixels):
+        (WebCore::LayerTilerChromium::draw):
+        (WebCore::LayerTilerChromium::unreserveTextures):
+        * platform/graphics/chromium/LayerTilerChromium.h:
+        (WebCore::LayerTilerChromium::setLayerRenderer):
+        (WebCore::LayerTilerChromium::skipsDraw):
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::AutoLocker::AutoLocker):
+        (WebCore::PlatformCanvas::Painter::Painter):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::draw):
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp:
+        (WebCore::CCCanvasLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.h:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp:
+        (WebCore::CCPluginLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+
+2011-04-14  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] REGRESSION(83820): Composited scrollbar layers sometimes not positioned when initially creating frame
+        https://bugs.webkit.org/show_bug.cgi?id=58575
+
+        Tell the RenderLayerCompositor to create/destroy composited layers for overflow controls on a FrameView when visibleContentsResized()
+        is called, not contentsResized() so that we always update layers when adding or removing scrollbars.
+
+        Covered by several chromium pixel tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::contentsResized):
+        (WebCore::FrameView::visibleContentsResized):
+
+2011-04-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix some threading issues in IconDatabase.
+        https://bugs.webkit.org/show_bug.cgi?id=57985
+
+        No functionality change so no new tests. It would be very hard to test this, but
+        I am working on a change for bug 31639 to detect these (which makes layout tests
+        fail for at least one of these issues).
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::setIconDataForIconURL): Release imageData so that it won't get deref'ed outside of locks.
+        (WebCore::IconDatabase::readFromDatabase): Ditto.
+        (WebCore::IconDatabase::writeToDatabase): Acquire m_urlAndIconLock because the SharedBuffer<> data
+        is used, and this lock seems to be the one which consistently guards it.
+
+2011-04-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Simplifying Worker termination sequence (removing unnecessary mutex)
+        https://bugs.webkit.org/show_bug.cgi?id=57090
+
+        No new tests. Existing Worker tests should pass.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        Check for Terminator-caused exception (or Terminator::shouldTerminate since sometimes
+        JS might not run significant enough chunk to be terminated by Terminator) and set
+        the flag to forbid future reentry into JS.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::scheduleExecutionTermination):
+        (WebCore::WorkerScriptController::forbidExecution):
+        (WebCore::WorkerScriptController::isExecutionForbidden):
+        * bindings/js/WorkerScriptController.h:
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::scheduleExecutionTermination):
+        (WebCore::WorkerScriptController::forbidExecution):
+        (WebCore::WorkerScriptController::isExecutionForbidden):
+        * bindings/v8/WorkerScriptController.h:
+        (WebCore::WorkerScriptController::proxy):
+        Symmetrical changes to JSC and V8 WorkerScriptControllers:
+        - remove Mutex around operations with executionForbidden flag.
+        - set/check that flag only on Worker thread.
+        - some renaming in attempt to better reflect what the methods do.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        Check for v8::TryCatch::CanContinue() and set forbidExecution flag.
+        This result indicates that TerminateExecution() was in effect - we should
+        not reenter V8 anymore after that.
+
+        * dom/Document.h:
+        (WebCore::Document::isJSExecutionForbidden):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        Stop dispatching messages once the worker context started to close.
+        Per Workers spec, once WorkerGlobalScope.Close() is called, the next
+        JS execution does not happen, including onmessage events. Before this
+        change, Close() was setting the forbidExecution flag, indirectly stopping
+        events from dispatching.
+
+        * dom/ScriptExecutionContext.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        (WebCore::WorkerContext::isJSExecutionForbidden):
+        * workers/WorkerContext.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThread::stop):
+
+2011-04-14  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56493
+        Drag-scrolling overlay scrollbars thumb in overflow regions does not work
+        -and corresponding-
+        <rdar://problem/9112688>
+
+        There was an original change to fix this in the normal hit-testing case, but hit 
+        testing of transformed and/or positioned objects was still broken. The transformed 
+        case is fixed by sending an OverlayScrollbarSizeRelevancy parameter to 
+        calculateRects(). Getting positioned objects right is a little trickier. Those need 
+        to opt into using temporary clip rects during hit testing. To avoid doing that when 
+        it is not necessary, I added a new bit to ScrollView to track whether there are 
+        currently overlay scrollbars painted in the view.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::containsScrollableAreaWithOverlayScrollbars):
+        (WebCore::ScrollView::setContainsScrollableAreaWithOverlayScrollbars):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateClipRects):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::parentClipRects):
+        (WebCore::RenderLayer::backgroundClipRect):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayer.h:
+
+2011-04-14  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION(r74107): Including svg format in @font-face rules makes Web Fonts fail to load
+        https://bugs.webkit.org/show_bug.cgi?id=57766
+        <rdar://problem/9232183>
+
+        Move the knowledge of whether to interpret a font as SVG from CachedFont to CSSFontFaceSource. This way
+        we can try to interpret the same cached resource in multiple ways.
+
+        Test: fast/css/font-face-repeated-url.html
+
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::CSSFontFaceSource):
+        (WebCore::CSSFontFaceSource::getFontData):
+        * css/CSSFontFaceSource.h:
+        (WebCore::CSSFontFaceSource::setHasExternalSVGFont):
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::ensureSVGFontData):
+
+            Use TextResourceDecoder correctly.
+
+        (WebCore::CachedFont::getSVGFontById):
+        * loader/cache/CachedFont.h:
+        * svg/SVGFontFaceUriElement.cpp:
+        (WebCore::SVGFontFaceUriElement::loadFont):
+
+2011-04-14  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enable building Web Audio with MKL in Chrome-branded builds
+        https://bugs.webkit.org/show_bug.cgi?id=58561
+
+        Factored out MKL support into a separate GYP file that is
+        incorporated in Chrome-branded builds. Changed how the FFTFrame
+        implementations are pulled in and chosen so that all files can be
+        unconditionally compiled.
+
+        Tested with both Chrome-branded build (incorporating MKL) and
+        Chromium build (building just FFTFrameStub.cpp) on Linux.
+
+        * WebCore.gyp/WebCore.gyp:
+        * platform/audio/fftw/FFTFrameFFTW.cpp:
+        * platform/audio/mkl/FFTFrameMKL.cpp:
+
+2011-04-14  Ragner Magalhaes  <ragner.magalhaes@openbossa.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Web Inspector does not highlight elements
+        https://bugs.webkit.org/show_bug.cgi?id=35125
+
+        We should call drawNodeHighlight() just if a highlighted node exists
+        to avoid do save()/restore() on the Graphics Context unnecessarily.
+
+        Added highlightedNode() method to check if we need to call drawNodeHighlight()
+        and only on this case do save()/restore() on the Graphics Context.
+
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::highlightedNode):
+
+2011-04-14  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] TilingData should return 1 tile when tile size is texture size.
+        https://bugs.webkit.org/show_bug.cgi?id=58364
+
+        * platform/graphics/gpu/TilingData.cpp:
+        (WebCore::computeNumTiles):
+
+2011-04-14  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r72141): Acid3 rendering is not pixel perfect.
+        https://bugs.webkit.org/show_bug.cgi?id=55734
+        
+        WebCore should render text with a 0px font size at 0px regardless of
+        minimum font size settings. This is compatible with other browsers that
+        have a minimum font size preference and ensures pixel-perfect rendering
+        on Acid3.
+
+        Test: fast/text/zero-font-size.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize): If
+        specifiedSize is 0, return specified size regardless of zoom factor or
+        minimum font size.
+
+2011-04-14  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Have canvas drawImageFromRect just redirect to use drawImage
+        https://bugs.webkit.org/show_bug.cgi?id=58516
+
+        Test: fast/canvas/drawImageFromRect_withToDataURLAsSource.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2011-04-14  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r83820): Lots of compositing tests failing on Windows 7 Release (Tests)
+        https://bugs.webkit.org/show_bug.cgi?id=58535
+
+        Change PLATFORM(MAC) guards to !PLATFORM(CHROMIUM) so they apply correctly to the windows build.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::requiresHorizontalScrollbarLayer):
+        (WebCore::RenderLayerBacking::requiresVerticalScrollbarLayer):
+        (WebCore::RenderLayerBacking::requiresScrollCornerLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::shouldCompositeOverflowControls):
+
+2011-04-14  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        BlobBuilder should be vendor-prefixed
+        https://bugs.webkit.org/show_bug.cgi?id=58518
+
+        Renamed BlobBuilder to WebKitBlobBuilder.
+
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * fileapi/WebKitBlobBuilder.cpp: Renamed from Source/WebCore/fileapi/BlobBuilder.cpp.
+        (WebCore::WebKitBlobBuilder::WebKitBlobBuilder):
+        (WebCore::WebKitBlobBuilder::getBuffer):
+        (WebCore::WebKitBlobBuilder::append):
+        (WebCore::WebKitBlobBuilder::getBlob):
+        * fileapi/WebKitBlobBuilder.h: Renamed from Source/WebCore/fileapi/BlobBuilder.h.
+        (WebCore::WebKitBlobBuilder::create):
+        * fileapi/WebKitBlobBuilder.idl: Renamed from Source/WebCore/fileapi/BlobBuilder.idl.
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2011-04-14  Adam Barth  <abarth@webkit.org>
+
+        Remove some trailing whitespace.  I'm making this change to initialize
+        the SVN credentials on a new commit-queue machine.  I'm sure there's a
+        better way to do this, but I don't know it.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+
+2011-04-14  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Set minimum priority for fast lane connections
+        https://bugs.webkit.org/show_bug.cgi?id=58353
+
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Call
+        wkSetHTTPPipeliningMinimumFastLanePriority to allow javascript resources to use the fast
+        lane connections.
+
+2011-04-14  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix Web Audio build on Linux Debug and with stub FFTFrame
+        https://bugs.webkit.org/show_bug.cgi?id=58555
+
+        Built Chromium/Linux in Debug mode to test.
+
+        * platform/audio/FFTFrame.cpp:
+        * platform/audio/FFTFrameStub.cpp:
+        (WebCore::FFTFrame::initialize):
+        * webaudio/AudioContext.cpp:
+        * webaudio/DefaultAudioDestinationNode.cpp:
+
+2011-04-14  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [v8] Web Inspector: add initial implementation of WorkerScriptDebugServer
+        https://bugs.webkit.org/show_bug.cgi?id=58552
+
+        * bindings/v8/DebuggerScript.js:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): each worker context
+        now have a debug id (similar to frame contexts).
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::retrieveWorkerContext):
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        (WebCore::WorkerScriptDebugServer::getDebugListenerForContext):
+        (WebCore::WorkerScriptDebugServer::runMessageLoopOnPause): run message loop until
+        debugger command is received and execution is resumed.
+        (WebCore::WorkerScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/WorkerScriptDebugServer.h:
+        * inspector/WorkerDebuggerAgent.cpp:
+        (WebCore::WorkerDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::stopListeningScriptDebugServer):
+
+2011-04-14  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add webkit prefix to Blob.slice method and change its semantics to be
+        like Array.slice
+        https://bugs.webkit.org/show_bug.cgi?id=58496
+
+        Renamed Blob.slice to blob.webkitSlice and made it take start and end
+        parameters that're like Array.slice.
+
+        Test: fast/files/blob-slice-test.html
+
+        * fileapi/Blob.cpp:
+        (WebCore::Blob::webkitSlice):
+        * fileapi/Blob.h:
+        * fileapi/Blob.idl:
+
+2011-04-14  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Height of "Ahem" font differs from all other ports.
+        https://bugs.webkit.org/show_bug.cgi?id=57954
+
+        QFontMetricsF::descent() returns the actual descent minus 1,
+        to account for the baseline. Add it back to get correct metrics
+        for WebKit.
+
+        QFontMetricsF::leading() may return negative values on some
+        platforms (those using FreeType), this breaks WebKit's assumption
+        that lineSpacing >= (ascent + descent), so we work around this in
+        the same fashion as SimpleFontDataFreeType and SimpleFontDataPango.
+
+        This is covered by thousands of layout tests.
+
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-04-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fixes for wxMSW and wx 2.9.1.1.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::writeToFile):
+
+2011-04-14  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        RuntimeApplicationChecks.h needs to be a private header so WebKit can find it.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2011-04-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Unreviewed, build fix for r83864.
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._childNodeRemoved):
+
+2011-04-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Content area highlight does not cover scrollbars
+        https://bugs.webkit.org/show_bug.cgi?id=58528
+
+        * inspector/DOMNodeHighlighter.cpp:
+        (WebCore::DOMNodeHighlighter::DrawNodeHighlight):
+
+2011-04-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: re-implement dom breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=57038
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/BreakpointManager.js: Removed.
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.NativeBreakpointsSidebarPane):
+        (WebInspector.NativeBreakpointsSidebarPane.prototype._reset):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype.setStatus):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMAgent.prototype._childNodeRemoved):
+        * inspector/front-end/DOMBreakpointsSidebarPane.js: Added.
+        (WebInspector.DOMBreakpointsSidebarPane):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.setInspectedURL):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.populateNodeContextMenu.toggleBreakpoint):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.populateNodeContextMenu):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.createBreakpointHitStatusMessage.didPushNodeToFrontend):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.createBreakpointHitStatusMessage):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._doCreateBreakpointHitStatusMessage.formatters.s):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._doCreateBreakpointHitStatusMessage.append):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._doCreateBreakpointHitStatusMessage):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.nodeRemoved):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._removeBreakpointsForNode):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._contextMenu.removeBreakpoint):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._contextMenu):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._checkboxClicked):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._createBreakpointId):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.DOMBreakpointsSidebarPane.prototype.restoreBreakpoints):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.show):
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumbSizes.coalesceCollapsedCrumbs):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused.didCreateBreakpointHitStatusMessage):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused.else.didGetSourceLocation):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        (WebInspector.Settings.prototype._set):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.inspectedURLChanged):
+        * inspector/front-end/utilities.js:
+        ():
+
+2011-04-14  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Disable speech input for readonly and disabled input fields.
+        https://bugs.webkit.org/show_bug.cgi?id=58540
+
+        Test: fast/speech/input-readonly-and-disabled.html
+
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
+        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
+
+2011-04-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed. Rollout r83849 and r83857.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::didOpenDatabase):
+        (WebCore::InspectorDatabaseAgent::InspectorDatabaseAgent):
+        (WebCore::InspectorDatabaseAgent::setFrontend):
+        (WebCore::InspectorDatabaseAgent::clearFrontend):
+        (WebCore::InspectorDatabaseAgent::getDatabaseTableNames):
+        (WebCore::InspectorDatabaseAgent::executeSQL):
+        * inspector/InspectorDatabaseAgent.h:
+        * inspector/front-end/inspector.js:
+
+2011-04-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r83847.
+        http://trac.webkit.org/changeset/83847
+        https://bugs.webkit.org/show_bug.cgi?id=58477
+
+        Chromium media controls do use button borders, so this change
+        is incorrect.
+
+        * css/mediaControls.css:
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
+        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
+        (audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button):
+        (audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button):
+        (audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button):
+        (audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button):
+        (audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button):
+        (audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button):
+
+2011-04-14  Andrew Wason  <rectalogic@rectalogic.com>
+
+        Reviewed by Andreas Kling.
+
+        Fix GraphicsContext3DQt.cpp compilation warnings treated as errors
+        https://bugs.webkit.org/show_bug.cgi?id=58478
+
+        No new tests.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::getProcAddress):
+         Do not use deprecated QString constructor to avoid warning.
+        (WebCore::GraphicsContext3D::reshape):
+         Use parenthesis to avoid warning.
+
+2011-04-14  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed. Removed ScrollableArea::paintScrollCorner() added in r83820,
+        as it breaks chromium clang build (shadowed by RenderLayer::paintScrollCorner()
+        with a different signature)
+
+        * platform/ScrollableArea.h:
+
+2011-04-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Ready to move detailed heap snapshots storage and processing into workers.
+        https://bugs.webkit.org/show_bug.cgi?id=58534
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get _countPercent):
+        (WebInspector.HeapSnapshotDiffNode):
+        (WebInspector.HeapSnapshotDiffNode.prototype.calculateDiff.diffCalculated):
+        (WebInspector.HeapSnapshotDiffNode.prototype.calculateDiff):
+        (WebInspector.HeapSnapshotDiffNode.prototype.calculateDiff.baseIdsReceived):
+        (WebInspector.HeapSnapshotDiffNode.prototype.calculateDiff.idsReceived):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider.createProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype.get data):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.setBaseDataSource):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.populateChildren.baseAggregatesReceived.aggregatesReceived.addNodeIfNonZeroDiff):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.populateChildren.baseAggregatesReceived.aggregatesReceived):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.populateChildren):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype.dispose):
+        (WebInspector.HeapSnapshot.prototype.nodeFieldValuesByIndex):
+        (WebInspector.HeapSnapshot.prototype._numbersComparator):
+        (WebInspector.HeapSnapshot.prototype.baseSnapshotHasNode):
+        (WebInspector.HeapSnapshot.prototype.updateBaseNodeIds):
+        (WebInspector.HeapSnapshotsDiff):
+        (WebInspector.HeapSnapshotsDiff.prototype.set baseIds):
+        (WebInspector.HeapSnapshotsDiff.prototype.set baseSelfSizes):
+        (WebInspector.HeapSnapshotsDiff.prototype.calculate):
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotProxy):
+        (WebInspector.HeapSnapshotProxy.prototype.createDiff):
+        (WebInspector.HeapSnapshotProxy.prototype.createEdgesProvider):
+        (WebInspector.HeapSnapshotProxy.prototype.createNodesProvider):
+        (WebInspector.HeapSnapshotProxy.prototype.dispose):
+        (WebInspector.HeapSnapshotProxy.prototype.nodeFieldValuesByIndex):
+        (WebInspector.HeapSnapshotProxy.prototype.pushBaseIds):
+        (WebInspector.HeapSnapshotsDiffProxy):
+        (WebInspector.HeapSnapshotsDiffProxy.prototype.calculate):
+        (WebInspector.HeapSnapshotsDiffProxy.prototype.pushBaseIds):
+        (WebInspector.HeapSnapshotsDiffProxy.prototype.pushBaseSelfSizes):
+
+2011-04-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: The list of Database entries is empty if the page opens a database just before Web Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=57833
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::didOpenDatabase):
+        (WebCore::InspectorDatabaseAgent::InspectorDatabaseAgent):
+        (WebCore::InspectorDatabaseAgent::setFrontend):
+        (WebCore::InspectorDatabaseAgent::enable):
+        (WebCore::InspectorDatabaseAgent::disable):
+        (WebCore::InspectorDatabaseAgent::getDatabaseTableNames):
+        (WebCore::InspectorDatabaseAgent::executeSQL):
+        * inspector/InspectorDatabaseAgent.h:
+        * inspector/front-end/inspector.js:
+
+2011-04-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [Chromium] "Remove Breakpoint" menu item is absent in the DOM breakpoints sidebar pane
+        https://bugs.webkit.org/show_bug.cgi?id=58530
+
+        * inspector/front-end/ElementsPanel.js:
+
+2011-04-14  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION(r83397) [Qt] When clicking on the media elements they
+        grow 2 pixels.
+        https://bugs.webkit.org/show_bug.cgi?id=58477
+
+        Since r83397 the media controls elements are actual DOM elements.
+        Therefore the global style-sheet applies to them. html.css defines
+        input[type="button"]:active to be border-style: inset which means
+        that when the buttons are active they grow by their border size.
+
+        * css/mediaControls.css:
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
+        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
+        (audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button):
+        (audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button):
+        (audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button):
+        (audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button):
+        (audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button):
+        (audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button):
+
+2011-04-14  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve disable style for input elements in mobile theme
+        https://bugs.webkit.org/show_bug.cgi?id=58480
+
+        * platform/qt/QtMobileWebStyle.cpp:
+        (QtMobileWebStyle::drawControl):
+        (QtMobileWebStyle::drawPrimitive):
+        (QtMobileWebStyle::drawComplexControl):
+
+2011-04-14  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: restore previous selection in Resources panel upon front-end reopen.
+        https://bugs.webkit.org/show_bug.cgi?id=58533
+
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype._processCachedResources):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._initDefaultSelection):
+        (WebInspector.ResourcesPanel.prototype._populateResourceTree):
+        (WebInspector.ResourcesPanel.prototype._cachedResourcesLoaded):
+        * inspector/front-end/inspector.css:
+        (#close-button-left, #close-button-right):
+
+2011-04-14  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: implement incremental CSS free flow editing.
+        https://bugs.webkit.org/show_bug.cgi?id=58529
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleSheet.prototype.setText):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.isResourceRevision):
+        (WebInspector.Resource.prototype.setContent):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.CSSSourceFrame.prototype.isContentEditable):
+        (WebInspector.CSSSourceFrame.prototype.editContent):
+        (WebInspector.CSSSourceFrame.prototype.endEditing.commitIncrementalEdit):
+        (WebInspector.CSSSourceFrame.prototype.endEditing):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.commitEditing):
+        (WebInspector.SourceFrame.prototype.editContent):
+
+2011-04-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector:Duplicated display of storage db when running Web SQL from an iframe.
+        https://bugs.webkit.org/show_bug.cgi?id=57830
+
+        There was created a new InspectorDatabaseResource entry for every didOpenDatabase event.
+        Moreover there is new WebCore::Database for each didOpenDatabase event.
+        I decided to change the old instance of the Database to a new one if they both use the same file.
+
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::didOpenDatabase):
+        (WebCore::InspectorDatabaseAgent::findByFileName):
+        * inspector/InspectorDatabaseAgent.h:
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::setDatabase):
+
+2011-04-14  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Dirk Schulze.
+
+        svg/W3C-SVG-1.1-SE/svgdom-over-01-f.svg crashes in Debug build
+        https://bugs.webkit.org/show_bug.cgi?id=58525
+
+        A renderer is created even for those filter primitives
+        which parent is not a filter. A rendererIsNeeded() is
+        added to SVGFilterPrimitiveStandardAttributes.
+
+        Test: svg/W3C-SVG-1.1-SE/svgdom-over-01-f.svg
+
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::rendererIsNeeded):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+
+2011-04-14  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        REGRESSION(r83397) [Qt] When the video is loading and the poster is shown
+        all the controls are not visible except the play button.
+        https://bugs.webkit.org/show_bug.cgi?id=58484
+
+        r83397 introduces a new API hasOwnDisabledStateHandlingFor to handle when
+        the controls should be disabled. Qt port paints its own controls, we don't want
+        the default implementation to handle the hidden/disable state for us.
+
+        Existing tests covers the visibility of the controls.
+
+        * platform/qt/RenderThemeQt.h:
+        (WebCore::RenderThemeQt::hasOwnDisabledStateHandlingFor):
+
+2011-04-14  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Disabled form controls don't actually look disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=58490
+
+        Unsetting QStyle::State_Enabled is not enough to get the "disabled" appearance
+        when painting controls. We must also set the QStyleOption's palette's current
+        color group.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::initializeCommonQStyleOptions):
+
+2011-04-14  Nancy Piedra  <nancy.piedra@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] MediaPlayerPrivateQt::supportsType does not parse codec parameter
+        https://bugs.webkit.org/show_bug.cgi?id=58188
+
+        The codec parameter in MediaPlayerPrivateQt::supportsType was not parsed into
+        a QStringList. This change parses and trims the list.
+
+        An additional test was added to video-can-play-type.html to test parsing of codec parameter.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::supportsType):
+
+2011-04-14  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Optimizing lightning filter to ARM-NEON SIMD instruction set
+        https://bugs.webkit.org/show_bug.cgi?id=54456
+
+        NEON is the SIMD instruction set for ARM. This instruction set
+        allows to speed-up the lighting filter by 4 times on ARM
+        (on WebCore/manual-tests/svg-filter-animation.svg).
+
+        * WebCore.pri:
+        * WebCore.pro:
+        * platform/graphics/filters/FELighting.cpp:
+        (WebCore::FELighting::drawLighting):
+        (WebCore::getPowerCoefficients):
+        (WebCore::FELighting::drawInteriorPixels):
+        * platform/graphics/filters/FELighting.h:
+        * platform/graphics/filters/arm/FELightingNEON.cpp: Added.
+        (__attribute__):
+        * platform/graphics/filters/arm/FELightingNEON.h: Added.
+
+2011-04-14  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] GraphicsContext3D internal buffers are not freed
+        https://bugs.webkit.org/show_bug.cgi?id=57530
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::~GraphicsContext3DInternal):
+
+2011-04-14  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r75555): Safari RSS sidebar jiggles when scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=52988
+        
+        Safari RSS relies on synchronous dispatch of ScrollEvent to update the
+        position of its sidebar during scrolling without producing a jiggling
+        effect. Due to r75555, this event is no longer dispatched synchronously
+        which results in stale repaints before the onscroll handler gets a
+        chance to update the position of the sidebar.
+        
+        Since it is impractical to resolve this issue in Safari RSS itself, add
+        a quirk that restores synchronous ScrollEvent dispatch for Safari RSS.
+        
+        No tests. This is an app-specific change that doesn't affect web
+        content.
+
+        * Android.mk: Add platform/RuntimeApplicationChecks.[cpp|h]
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/EventQueue.cpp:
+        (WebCore::shouldDispatchScrollEventSynchronously): Send ScrollEvent
+        synchronously if the embedding application is Safari and the document's
+        URL scheme is "feed" or "feeds".
+        (WebCore::EventQueue::enqueueOrDispatchScrollEvent): Dispatch
+        ScrollEvent synchronously if shouldDispatchScrollEventSynchronously()
+        returns true.
+        * dom/EventQueue.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendScrollEvent): Call enqueueOrDispatchScrollEvent().
+        * platform/RuntimeApplicationChecks.cpp: Added.
+        (WebCore::mainBundleIsEqualTo): Add a helper routine for CF platforms
+        that checks if the main bundle's identifier is equal to a given string.
+        This function returns false for non-CF platforms.
+        (WebCore::applicationIsSafari): Call mainBundleIsEqualTo().
+        (WebCore::applicationIsAppleMail): Ditto.
+        (WebCore::applicationIsMicrosoftMessenger): Ditto.
+        (WebCore::applicationIsAdobeInstaller): Ditto.
+        (WebCore::applicationIsAOLInstantMessenger): Ditto.
+        (WebCore::applicationIsMicrosoftMyDay): Ditto.
+        (WebCore::applicationIsMicrosoftOutlook): Ditto.
+        * platform/mac/RuntimeApplicationChecks.mm: Removed. Functions moved to
+        RuntimeApplicationChecks.cpp.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollTo): Call enqueueOrDispatchScrollEvent().
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollTo): Call enqueueOrDispatchScrollEvent().
+
+2011-04-14  John Bates  <jbates@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Fix bug with adding wrong context to LayerRendererChromium and get rid of RefPtr loop.
+        https://bugs.webkit.org/show_bug.cgi?id=58383
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::addChildContext):
+        (WebCore::LayerRendererChromium::removeChildContext):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+
+2011-04-14  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        CSS related SVG*Element changes doesn't require relayout
+        https://bugs.webkit.org/show_bug.cgi?id=56906
+
+        The changes of some CSS related SVGFilter properties e.g. lighting_color, flood_color, flood_opacity
+        need only repaint. To avoid the default invalidation of filters in SVGResourceCache::clientStyleChange()
+        we need an early return. So RenderSVGResourceFilterPrimitive::styleDidChange() can handle these properties
+        via RenderSVGResourceFilter::primitiveAttributeChanged() the same way like we do it for the other SVGAttributes.
+
+        Tests: svg/dynamic-updates/SVGFEDiffuseLightingElement-inherit-lighting-color-css-prop.html
+               svg/dynamic-updates/SVGFEFloodElement-inherit-flood-color.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-inherit-lighting-color-css-prop.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-lighting-color-css-prop.html
+
+        * platform/graphics/filters/FEFlood.cpp:
+        (WebCore::FEFlood::setFloodColor):
+        (WebCore::FEFlood::setFloodOpacity):
+        * platform/graphics/filters/FEFlood.h:
+        * platform/graphics/filters/FESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::setLightingColor):
+        * platform/graphics/filters/FESpecularLighting.h:
+        * rendering/svg/RenderSVGResourceFilterPrimitive.cpp:
+        (WebCore::RenderSVGResourceFilterPrimitive::styleDidChange):
+        * rendering/svg/RenderSVGResourceFilterPrimitive.h:
+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::clientStyleChanged):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::setFilterEffectAttribute):
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::setFilterEffectAttribute):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::setFilterEffectAttribute):
+
+2011-04-13  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Allow setting composited backing stores for scrollbars and scroll corners
+        https://bugs.webkit.org/show_bug.cgi?id=57202
+
+        This teaches ScrollableArea to manage GraphicsLayer backings for the two scrollbars and
+        scroll corner. ScrollableArea can position the layers and route invalidation and paint calls to
+        the correct place but depends on subclasses to manage the lifetime of the GraphicsLayers and
+        place them into the correct place in the hierarchy.
+
+        FrameView and RenderLayerCompositor updated to provide layers for frames with overflow controls.
+        that need them.  The overflow control layers are siblings of the frame's clip layer.
+
+        RenderLayer and RenderLayerBacking updated to provide overflow control layers for layers that
+        need them.  Currently, layers are only created for overflow controls on layers that are already composited
+        for other reasons and not necessarily for every RenderLayer with overflow.  Overflow control layers are siblings
+        of the RenderLayerBacking's clipping layer if it exists, otherwise they are siblings of the layer's normal
+        children.
+
+        Tested by a number of compositing/ tests that have scrollbars and by these new tests:
+               compositing/iframes/repaint-after-losing-scrollbars.html
+               compositing/overflow/clip-content-under-overflow-controls.html
+               compositing/overflow/content-gains-scrollbars.html
+               compositing/overflow/content-loses-scrollbars.html
+               compositing/overflow/overflow-scrollbar-layers.html
+               compositing/overflow/repaint-after-losing-scrollbars.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layerForHorizontalScrollbar):
+        (WebCore::FrameView::layerForVerticalScrollbar):
+        (WebCore::FrameView::layerForScrollCorner):
+        (WebCore::FrameView::syncCompositingStateForThisFrame):
+        (WebCore::FrameView::contentsResized):
+        (WebCore::FrameView::updateScrollCorner):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::invalidateScrollbar):
+        (WebCore::ScrollableArea::invalidateScrollCorner):
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::paintScrollCorner):
+        (WebCore::ScrollableArea::layerForHorizontalScrollbar):
+        (WebCore::ScrollableArea::layerForVerticalScrollbar):
+        (WebCore::ScrollableArea::layerForScrollCorner):
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::invalidateRect):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::paintContentsIfDirty):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::create):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::invalidateRootLayerRect):
+        (WebCore::LayerRendererChromium::drawRootLayer):
+        (WebCore::LayerRendererChromium::setViewport):
+        (WebCore::LayerRendererChromium::updateAndDrawLayers):
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::setRootLayer):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPartAnimation setCurrentProgress:]):
+        * platform/win/PopupMenuWin.h:
+        (WebCore::PopupMenuWin::invalidateScrollCornerRect):
+        (WebCore::PopupMenuWin::isScrollCornerVisible):
+        (WebCore::PopupMenuWin::scrollCornerRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollCornerRect):
+        (WebCore::RenderLayer::scrollCornerAndResizerRect):
+        (WebCore::RenderLayer::isScrollCornerVisible):
+        (WebCore::RenderLayer::invalidateScrollbarRect):
+        (WebCore::RenderLayer::invalidateScrollCornerRect):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::layerForHorizontalScrollbar):
+        (WebCore::RenderLayer::layerForVerticalScrollbar):
+        (WebCore::RenderLayer::layerForScrollCorner):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::horizontalScrollbar):
+        (WebCore::RenderLayer::verticalScrollbar):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::~RenderLayerBacking):
+        (WebCore::RenderLayerBacking::updateAfterWidgetResize):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+        (WebCore::RenderLayerBacking::updateClippingLayers):
+        (WebCore::RenderLayerBacking::requiresHorizontalScrollbarLayer):
+        (WebCore::RenderLayerBacking::requiresVerticalScrollbarLayer):
+        (WebCore::RenderLayerBacking::requiresScrollCornerLayer):
+        (WebCore::RenderLayerBacking::updateOverflowControlsLayers):
+        (WebCore::paintScrollbar):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::layerForHorizontalScrollbar):
+        (WebCore::RenderLayerBacking::layerForVerticalScrollbar):
+        (WebCore::RenderLayerBacking::layerForScrollCorner):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::frameViewDidChangeLocation):
+        (WebCore::RenderLayerCompositor::frameViewDidChangeSize):
+        (WebCore::RenderLayerCompositor::rootPlatformLayer):
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
+        (WebCore::paintScrollbar):
+        (WebCore::RenderLayerCompositor::paintContents):
+        (WebCore::shouldCompositeOverflowControls):
+        (WebCore::RenderLayerCompositor::requiresHorizontalScrollbarLayer):
+        (WebCore::RenderLayerCompositor::requiresVerticalScrollbarLayer):
+        (WebCore::RenderLayerCompositor::requiresScrollCornerLayer):
+        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::detachRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::layerForHorizontalScrollbar):
+        (WebCore::RenderLayerCompositor::layerForVerticalScrollbar):
+        (WebCore::RenderLayerCompositor::layerForScrollCorner):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::isScrollCornerVisible):
+        (WebCore::RenderListBox::scrollCornerRect):
+        (WebCore::RenderListBox::invalidateScrollCornerRect):
+
+2011-04-13  Cary Clark  <caryclark@chromium.org>
+ 
+         Reviewed by Eric Seidel.
+          
+         [Chromium] allow concurrent Skia and CG datatypes
+         https://bugs.webkit.org/show_bug.cgi?id=57848
+
+         The Chromium port is experimenting with running Skia as the WebKit rendering engine, and CoreGraphics
+         as the UI rendering engine. This permits Chromium to unify its graphics story while leveraging OS X to
+         draw elements like scrollbars and buttons.
+ 
+         Restructure the common graphics units, points, and rectangles, to convert to Sk-types and CG-types at
+         the same time. This requires only adding to the existing preprocessor commands, and will have no effect
+         on any existing platform.
+         
+         Eventually, WTF_USE_SKIA_ON_MAC_CHROME will be defined to enable this, but for now, there's no
+         functional change.
+ 
+         No new tests as this provides no new functionality.
+ 
+         * platform/graphics/FloatPoint.h: Add USE(SKIA_ON_MAC_CHROME) to make CG type and operators visible
+         to a Skia-based Chrome Mac build.
+         * platform/graphics/FloatRect.h: Ditto.
+         * platform/graphics/FloatSize.h: Ditto.
+         * platform/graphics/IntPoint.h: Ditto.
+         * platform/graphics/IntRect.h: Ditto.
+         * platform/graphics/IntSize.h: Ditto.
+         * platform/graphics/cg/FloatPointCG.cpp: Ditto.
+         * platform/graphics/cg/FloatRectCG.cpp: Ditto.
+         * platform/graphics/cg/FloatSizeCG.cpp: Ditto.
+         * platform/graphics/cg/IntPointCG.cpp: Ditto.
+         * platform/graphics/cg/IntRectCG.cpp: Ditto.
+         * platform/graphics/cg/IntSizeCG.cpp: Ditto.
+ 
+2011-04-13  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 58460 - childTypeAllowed() should be const
+        https://bugs.webkit.org/show_bug.cgi?id=58460
+
+        Made childTypeAllowed const.
+
+        No new tests. (minor refactoring).
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::childTypeAllowed):
+        * dom/Attr.h:
+        * dom/CDATASection.cpp:
+        (WebCore::CDATASection::childTypeAllowed):
+        * dom/CDATASection.h:
+        * dom/Comment.cpp:
+        (WebCore::Comment::childTypeAllowed):
+        * dom/Comment.h:
+        * dom/Document.cpp:
+        (WebCore::Document::childTypeAllowed):
+        * dom/Document.h:
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::childTypeAllowed):
+        * dom/DocumentFragment.h:
+        * dom/Element.cpp:
+        (WebCore::Element::childTypeAllowed):
+        * dom/Element.h:
+        * dom/Node.h:
+        (WebCore::Node::childTypeAllowed):
+        * dom/Notation.cpp:
+        (WebCore::Notation::childTypeAllowed):
+        * dom/Notation.h:
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::childTypeAllowed):
+        * dom/ProcessingInstruction.h:
+        * dom/Text.cpp:
+        (WebCore::Text::childTypeAllowed):
+        * dom/Text.h:
+
+2011-04-13  Jon Lee  <jonlee@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION(r81880): Paste menu is disabled for many edit fields (yahoo and google search, yahoo mail msg, forms, etc)
+        https://bugs.webkit.org/show_bug.cgi?id=58284
+        <rdar://problem/9246149>
+
+        * WebCore.exp.in: Exporting EditingBehavior.h for use in WebKit2
+        * editing/EditingBehavior.h:
+        (WebCore::EditingBehavior::shouldClearSelectionWhenLosingWebPageFocus): moving the platform-specific code out of an #ifdef and into this class for run-time instead of compile-time checking
+
+2011-04-13  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        constructLine should take bidiRuns as a parameter
+        https://bugs.webkit.org/show_bug.cgi?id=58458
+
+        Pass bidiRuns to constructLine and move reachedEndOfTextRenderer so that it is
+        declared before constructLine.
+
+        No new tests as this is refactoring only.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::reachedEndOfTextRenderer):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2011-04-13  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Allow CG Font support in Chrome Darwin build using Skia
+        https://bugs.webkit.org/show_bug.cgi?id=58321
+        
+        This allows Chrome to use Skia to do WebKit rendering, while
+        using CoreGraphics for glyph creation and computing font metrics.
+        It relies on an undefined platform token, WTF_USE_SKIA_ON_MAC_CHROME.
+
+        No new tests needed, no functionality change.
+
+        * loader/cache/CachedFont.cpp: Make CGFontRef functions and
+        CG-specific font code available to Chrome builds on Darwin using Skia.
+        * platform/graphics/FontPlatformData.h: Ditto.
+        (WebCore::FontPlatformData::hash): Ditto.
+        * platform/graphics/GlyphBuffer.h: Ditto.
+        (WebCore::GlyphBuffer::advanceAt): Ditto.
+        (WebCore::GlyphBuffer::add): Ditto.
+        (WebCore::GlyphBuffer::expandLastAdvance): Ditto.
+        * platform/graphics/SimpleFontData.h: Ditto.
+
+2011-04-13  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The timeline of the video controls is unusable if the multimedia backend returns a
+        infinite duration.
+        https://bugs.webkit.org/show_bug.cgi?id=58452
+
+        In case the underlaying media element backend returns crazy values, e.g.
+        an infinite duration for the video we need to bail out and hide the timeline
+        rather than in a broken state where you can't use it. The previous code was just
+        checking if the duration was NaN.
+
+        We can't control from JS what the backend will return as a duration for the video
+        so we can't make an test for it.
+
+        * html/shadow/MediaControlRootElement.cpp:
+        (WebCore::MediaControlRootElement::reset):
+
+2011-04-13  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Draw outline for render widgets.
+        https://bugs.webkit.org/show_bug.cgi?id=57439
+
+        Test: fast/frames/iframe-outline.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2011-04-13  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Change the representation of ShadowRoot nodes in render tree dumps
+        https://bugs.webkit.org/show_bug.cgi?id=58432
+
+        Show "#shadow-root" for ShadorRoot nodes instead of "#document-fragment"
+        in DRT results.
+
+        No new tests. This change doesn't affect existing tests yet.
+
+        * dom/DocumentFragment.h:
+          Make nodeName() protected in order that ShdowRoot can override it.
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::nodeName): Returns "#shadow-root".
+        * dom/ShadowRoot.h: Declare nodeName().
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::nodePosition): Don't show "child N " if the node is a shadow boundary.
+          We don't use isShadowRoot() here because the legacy shadow root nodes
+          return true for isShadowRoot() and we don't want to update existing
+          test results.
+
+2011-04-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Merge LineOffsets and LineWidth
+        https://bugs.webkit.org/show_bug.cgi?id=58411
+
+        Merged lineOffsets into LineWidth.
+
+        After this patch, available width is updated in positionNewFloatOnLine via updateAvailableWidth and
+        shrinkAvailableWidthForNewFloatIfNeeded instead of findNextBreak. This is correct because
+        - LineOffsets::update and LineOffsets::shrinkWidthForNewFloatIfNeeded were only called in positionNewFloatOnLine
+          besides LineOffsets' constructor
+        - positionNewFloatOnLine was only called in skipLeadingWhitespace and findNextLineBreak
+        - findNextLineBreak updates the available width whenever it calls skipLeadingWhitespace or positionNewFloatOnLine
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::skipLeadingWhitespace): Takes LineWidth instead of LineOffset
+        (WebCore::LineWidth::LineWidth): Takes RenderBlock* and boolean isFirstLine; call updateAvailableWidth
+        because the initial available width was used to be computed from lineOffsets.width().
+        (WebCore::LineWidth::computeAvailableWidthFromLeftAndRight): Added.
+        (WebCore::LineWidth::updateAvailableWidth): Renamed from LineOffsets::update; this function now updates
+        m_availableWidth via computeAvailableWidthFromLeftAndRight as well as m_left and m_right.
+        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded): Renamed from
+        LineOffsets::shrinkWidthForNewFloatIfNeeded. This function also calls computeAvailableWidthFromLeftAndRight.
+        (WebCore::LineWidth::applyOverhang): No longer takes arguments since both arguments were member variables
+        of LineOffsets.
+        (WebCore::LineWidth::fitBelowFloats): No longer takes isFirstLine.
+        (WebCore::RenderBlock::findNextLineBreak): Uses LineWidth.
+        (WebCore::RenderBlock::positionNewFloatOnLine): Takes a reference to LineWidth.
+
+2011-04-13  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMAKE] Separate DerivedSources.
+        https://bugs.webkit.org/show_bug.cgi?id=58427
+
+        No new tests since these are refactoring only.
+
+        * CMakeLists.txt:
+        * UseJSC.cmake:
+
+2011-04-13  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Fix canvas.toDataURL mimeType assertion
+        https://bugs.webkit.org/show_bug.cgi?id=58425
+
+        Following r81213, reassert expected toDataURL() mimeType, remove an unused variable.
+
+        No new tests. Covered by existing tests.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageToDataURL):
+        (WebCore::ImageBuffer::toDataURL):
+
+2011-04-12  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QNetworkReplyHandler refactoring: remove nested event loop.
+        https://bugs.webkit.org/show_bug.cgi?id=58375
+
+        As QNAM now makes actual synchronous loads there is no need for a nested event loop
+        in ResourceHandleQt.
+
+        Moving the call for QNetworkReplyWrapper::synchronousLoad from
+        ResourceHandle::loadResourceSynchronously to QNetworkReplyHandler::start for the
+        redirections to work in synchronous requests.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2011-04-13  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 55930 - Incorrect handling of 'display:' property within nested <ruby> tags
+        https://bugs.webkit.org/show_bug.cgi?id=55930
+
+        Non-inline :before/:after generated content is now wrapped with an anonymous inline block.
+
+        Also, added an additional check in RenderObjectChildList::updateBeforeAfterContent()
+        to verify that the created render object is legal under the parent.
+
+        Tests: fast/ruby/after-block-doesnt-crash.html
+               fast/ruby/after-table-doesnt-crash.html
+               fast/ruby/before-block-doesnt-crash.html
+               fast/ruby/before-table-doesnt-crash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+        * rendering/RenderRuby.cpp:
+        (WebCore::isAnonymousRubyInlineBlock):
+        (WebCore::rubyBeforeBlock):
+        (WebCore::rubyAfterBlock):
+        (WebCore::createAnonymousRubyInlineBlock):
+        (WebCore::lastRubyRun):
+        (WebCore::RenderRubyAsInline::addChild):
+        (WebCore::RenderRubyAsInline::removeChild):
+        (WebCore::RenderRubyAsBlock::addChild):
+        (WebCore::RenderRubyAsBlock::removeChild):
+        * rendering/RenderRuby.h:
+
+2011-04-13  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        [CG] Refactor get/putImageData routines from ImageBufferCG into a (new) ImageBufferDataCG.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=58084
+
+        No new tests. Does not affect outward behavior.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/ImageBufferData.h: Added.
+        * platform/graphics/cairo/ImageBufferData.h: Removed.
+        * platform/graphics/cairo/ImageBufferDataCairo.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/cg/ImageBufferDataCG.cpp: Added.
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::haveVImageRoundingErrorFix):
+        (WebCore::ImageBufferData::getData):
+        (WebCore::ImageBufferData::putData):
+        * platform/graphics/cg/ImageBufferData.h: Removed.
+        * platform/graphics/cg/ImageBufferDataCG.h: Added.
+        * platform/graphics/chromium/ImageBufferData.h: Removed.
+        * platform/graphics/chromium/ImageBufferDataSkia.h: Added.
+        * platform/graphics/haiku/ImageBufferData.h: Removed.
+        * platform/graphics/haiku/ImageBufferDataHaiku.h: Added.
+        * platform/graphics/qt/ImageBufferData.h: Removed.
+        * platform/graphics/qt/ImageBufferDataQt.h: Added.
+        * platform/graphics/wince/ImageBufferData.h: Removed.
+        * platform/graphics/wince/ImageBufferDataWince.h: Added.
+        * platform/graphics/wx/ImageBufferData.h: Removed.
+        * platform/graphics/wx/ImageBufferDataWx.h: Added.
+
+2011-04-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove std:: prefix on some min/max calls
+        https://bugs.webkit.org/show_bug.cgi?id=58493
+
+        Remove std:: namespacing on min/max in favor of a 'using' clause.
+
+        * platform/graphics/RoundedIntRect.cpp:
+        (WebCore::RoundedIntRect::Radii::expand):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::calcConstraintScaleFor):
+
+2011-04-13  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        Replace our own RenderThemeQt::getMediaElementFromRenderObject by
+        MediaControlsElement::toParentMediaElement used by every other port.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
+        (WebCore::RenderThemeQt::paintMediaMuteButton):
+        (WebCore::RenderThemeQt::paintMediaPlayButton):
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+        * platform/qt/RenderThemeQt.h:
+
+2011-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Switched DOM wrappers to use HashMap of Weak<T> instead of WeakGCMap<T>
+        https://bugs.webkit.org/show_bug.cgi?id=58482
+
+        This will allow wrappers to make individual decisions about their lifetimes.
+
+        * bindings/js/DOMWrapperWorld.cpp:
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::JSNodeHandleOwner::isReachableFromOpaqueRoots):
+        (WebCore::JSNodeHandleOwner::finalize):
+        (WebCore::DOMObjectHandleOwner::isReachableFromOpaqueRoots):
+        (WebCore::DOMObjectHandleOwner::finalize):
+        * bindings/js/DOMWrapperWorld.h:
+        (WebCore::JSNodeHandleOwner::JSNodeHandleOwner):
+        (WebCore::DOMObjectHandleOwner::DOMObjectHandleOwner):
+        (WebCore::DOMWrapperWorld::jsNodeHandleOwner):
+        (WebCore::DOMWrapperWorld::domObjectHandleOwner): Added handle owners
+        for JSNode and DOMObject, our two hash table values. For now, the owners
+        just take care to remove their handles from their respective hash tables.
+        
+        Changed the hash table type to be a standard HashMap of weak pointers,
+        instead of a WeakGCMap.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMObjectWrapper):
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper): Updated wrapper hash table access to
+        accomodate its new data type.
+
+        * bindings/js/JSNodeCustom.h:
+        (WebCore::getCachedDOMNodeWrapper): Ditto.
+
+        * dom/Document.h: Updated declaration to match the above.
+
+2011-04-13  Sam Weinig  <sam@webkit.org>
+
+        Fix Mac builds.
+
+        * WebCore.exp.in:
+
+2011-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        WebKit2 doesn't keep overlay scrollers shown while scroll gesture held
+        <rdar://problem/9260518>
+
+        Notify the scrollbar painter controller when gesture scrolls begin and end.
+
+        * WebCore.exp.in:
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::didBeginScrollGesture):
+        (WebCore::ScrollAnimatorMac::didEndScrollGesture):
+        (WebCore::ScrollAnimatorMac::beginScrollGesture):
+        (WebCore::ScrollAnimatorMac::endScrollGesture):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2011-04-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MediaPlayerPrivateAVFoundationObjC should adopt [AVURLAsset isPlayableExtendedMIMEType:]
+        https://bugs.webkit.org/show_bug.cgi?id=58451
+        <rdar://problem/9278468>
+
+        No new tests, supported MIME types haven't changed.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsType): Use 
+        [AVURLAsset isPlayableExtendedMIMEType] instead of just the list of types.
+
+2011-04-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Media engine fallback doesn't always work
+        https://bugs.webkit.org/show_bug.cgi?id=58462
+
+        No new tests, this was verified manually with the url noted in the bug.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::networkStateChanged):
+
+2011-04-13  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Extension3D needs to provide a way to check if an extension is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=58410
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::setupFlags): Use isEnabled() instead of supports().
+        * platform/graphics/Extensions3D.h: Add isEnabled().
+        * platform/graphics/chromium/Extensions3DChromium.h: Ditto.
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp: Ditto.
+        (WebCore::Extensions3DOpenGL::isEnabled):
+        * platform/graphics/opengl/Extensions3DOpenGL.h: Ditto.
+        * platform/graphics/qt/Extensions3DQt.cpp: Ditto.
+        (WebCore::Extensions3DQt::isEnabled):
+        * platform/graphics/qt/Extensions3DQt.h: Ditto.
+
+2011-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make PropertyMapEntry use a WriteBarrier for specificValue
+        https://bugs.webkit.org/show_bug.cgi?id=58407
+
+        Pass JSGlobalData reference on to APIs that now need them
+
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::all):
+
+2011-04-12  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: fix source mapping for de-obfuscated scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=58231
+
+        * inspector/front-end/ScriptFormatterWorker.js:
+        (buildMapping):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceMapping):
+        (WebInspector.SourceMapping.prototype.sourceLineToScriptLocation):
+        (WebInspector.SourceMapping.prototype._sourceLocationToScriptLocation):
+        (WebInspector):
+        (WebInspector.FormattedSourceMapping):
+        (WebInspector.FormattedSourceMapping.prototype.scriptLocationToSourceLine):
+        (WebInspector.FormattedSourceMapping.prototype.sourceLineToScriptLocation):
+
+2011-04-13  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Consider editable and non editable nodes when calculating selection offsets
+        https://bugs.webkit.org/show_bug.cgi?id=58431
+
+        Use firstPositionInOrBeforeNode() and lastPositionInOrAfterNode().
+
+        This is needed to ensure that getSelectionOffsetsForObject() works
+        well when non editable nodes are present in the selection, since
+        firstPositionInNode() and lastPositionInNode() don't work in those
+        cases (they assume the node is editable).
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getSelectionOffsetsForObject): Updated calls.
+
+2011-04-13  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Missing nullchecks in GTK's a11y wrapper
+        https://bugs.webkit.org/show_bug.cgi?id=58429
+
+        Add missing nullchecks for coreObject->document().
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkParentOfRootObject): Add missing nullcheck.
+        (getPangoLayoutForAtk): Ditto.
+        (webkit_accessible_text_get_caret_offset): Ditto.
+        (textExtents): Ditto.
+        (webkit_accessible_editable_text_insert_text): Ditto.
+        (webkit_accessible_editable_text_delete_text): Ditto.
+
+2011-04-13  Thierry Reding  <thierry.reding@avionic-design.de>
+
+        Gtk+ port fails to build when enabling WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=58434
+
+        Fix the GTK+ WebGL build after the introduction of PlatformContextCairo.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+        (WebCore::GraphicsContext3D::paintToCanvas):
+
+2011-04-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        REGRESSION(r83561): doesn't pause in-window playback during fullscreen playback
+        https://bugs.webkit.org/show_bug.cgi?id=58312
+
+        Make sure to link the videoValve in all cases, fpsdisplaysink
+        being used or not.
+
+        No new test, this patch fixes an internal feature of the player,
+        not publicly exposed. Having two video sinks and pausing one while
+        the other displays the fullscreen video is an implementation
+        detail of the GStreamer player.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
+
+2011-04-13  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: there is a problem if an optional param is not at the end of a params list.
+        https://bugs.webkit.org/show_bug.cgi?id=58440
+
+        In InspectorBackend.dispatch method we are converting the message's params object into array of arguments
+        for a callback. But in some cases the optional parameter is declared in the middle of the params list.
+        That gets us into a problem if this param has been skipped in the message. In that case the tail of the
+        event params will be shifted. We can slightly modify dispatcher and it will put the params in right places.
+
+        * inspector/CodeGeneratorInspector.pm:
+
+2011-04-13  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57337
+
+        Work around a bug in ternary opertions in the Solaris Studio
+        12/12.1/12.2 compilers, using an if clause.
+
+        * dom/NodeRenderStyle.h:
+        (WebCore::Node::renderStyle):
+
+2011-04-13  Brian Salomon  <bsalomon@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Use new skia API for wrapping DrawingBuffer's FBO/Tex IDs in skia object
+        https://bugs.webkit.org/show_bug.cgi?id=58363
+
+        No new tests needed, exercised by all existing canvas2d tests.
+
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::getGrPlatformSurfaceDesc):
+        * platform/graphics/gpu/DrawingBuffer.h:
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::setSharedGraphicsContext3D):
+
+2011-04-13  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed. Fix chromium clang build problem:
+        ApplyPropertyExpandingSuppressValue::applyValue() shadows a virtual method
+        with a different signature in base class instead of overriding it.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyExpandingSuppressValue::applyValue):
+
+2011-04-13  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add mock implementation and plumbing code for unified Quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57927
+
+        Added mock implementation and some plumbing code for the quota API,
+        that is based on the discussion on public-webapps:
+        http://lists.w3.org/Archives/Public/public-webapps/2011JanMar/0346.html
+
+        No new tests: tests will be added when we expose the API.
+
+        * CMakeLists.txt: Added new file entries.
+        * DerivedSources.cpp: Added new file entries.
+        * DerivedSources.make: Added new file entries.
+        * GNUmakefile.am: Added new file entries.
+        * WebCore.gypi: Added new file entries.
+        * WebCore.pro: Added new file entries.
+        * WebCore.vcproj/WebCore.vcproj: Added new file entries.
+        * WebCore.xcodeproj/project.pbxproj: Added new file entries.
+        * storage/StorageInfo.cpp: Added.
+        * storage/StorageInfo.h: Added.
+        * storage/StorageInfoErrorCallback.h: Added.
+        * storage/StorageInfoQuotaCallback.h: Added.
+        * storage/StorageInfoUsageCallback.h: Added.
+
+2011-04-13  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] PluginPackage should check whether a plugin mixes GTK+ 2 and 3 symbols itself
+        https://bugs.webkit.org/show_bug.cgi?id=58297
+
+        Make sure we do not load plugins that use symbols of a different
+        GTK+ major version to avoid bugs and crashes.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::moduleMixesGtkSymbols):
+        (WebCore::PluginPackage::load):
+
+2011-04-13  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Implement undo/redo in text editor
+        https://bugs.webkit.org/show_bug.cgi?id=58426
+
+        Native undo/redo does not work because we modify DOM structure (highlights, chunks and etc.)
+        Implement it via keyboard shortcuts for now (Cmd/Ctrl+Z and Cmd/Ctrl+Shift+Z).
+        FIXME: Do something with the popup's Undo and Redo menu options - they invoke native's undo/redo.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.endEditing):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype.setText):
+        (WebInspector.TextEditorModel.prototype._innerSetText):
+        (WebInspector.TextEditorModel.prototype._pushUndoableCommand):
+        (WebInspector.TextEditorModel.prototype.undo):
+        (WebInspector.TextEditorModel.prototype.redo):
+        (WebInspector.TextEditorModel.prototype._doUndo):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._textChanged):
+        (WebInspector.TextViewer.prototype._enterInternalTextChangeMode):
+        (WebInspector.TextViewer.prototype._exitInternalTextChangeMode):
+        (WebInspector.TextViewer.prototype._registerShortcuts):
+        (WebInspector.TextViewer.prototype._cancelEditing):
+        (WebInspector.TextViewer.prototype._handleUndoRedo):
+        (WebInspector.TextEditorChunkedPanel.prototype.makeLineAChunk):
+        (WebInspector.TextEditorChunkedPanel.prototype._repaintAll):
+        (WebInspector.TextEditorGutterPanel.prototype.textChanged):
+        (WebInspector.TextEditorMainPanel.prototype.handleUndoRedo.callback):
+        (WebInspector.TextEditorMainPanel.prototype.handleUndoRedo):
+        (WebInspector.TextEditorMainPanel.prototype._restoreSelection):
+        (WebInspector.TextEditorMainPanel.prototype._applyDomUpdates):
+        (WebInspector.TextEditorMainPanel.prototype.textChanged):
+        (WebInspector.TextEditorMainPanel.prototype._updateChunksForRanges):
+
+2011-04-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: make optional event parameter last to prevent regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=58433
+
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype.requestWillBeSent):
+
+2011-04-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: revert Inspector.json change for breaking world.
+
+        * inspector/Inspector.json:
+
+2011-04-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: swap methods in the Inspector.json.
+
+        * inspector/Inspector.json:
+
+2011-04-13  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r83695.
+        http://trac.webkit.org/changeset/83695
+        https://bugs.webkit.org/show_bug.cgi?id=58375
+
+        [Qt][WK2]It broke http tests
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::synchronousLoad):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::resourceResponse):
+        (WebCore::WebCoreSynchronousLoader::resourceError):
+        (WebCore::WebCoreSynchronousLoader::data):
+        (WebCore::WebCoreSynchronousLoader::setReplyFinished):
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2011-04-13  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: inactive style sheets should be read only.
+        https://bugs.webkit.org/show_bug.cgi?id=58423
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.CSSSourceFrame):
+        (WebInspector.CSSSourceFrame.prototype.isContentEditable):
+        (WebInspector.CSSSourceFrame.prototype._loadStyleSheet.didGetAllStyleSheets.didCreateForId):
+        (WebInspector.CSSSourceFrame.prototype._loadStyleSheet):
+
+2011-04-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Prepare to move detailed heap snapshots storage and processing into workers.
+        https://bugs.webkit.org/show_bug.cgi?id=58320
+
+        Introduce a proxy object that emulates worker behavior and change UI code to cope with it.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype._populate.doPopulate.sorted):
+        (WebInspector.HeapSnapshotGridNode.prototype._populate.doPopulate):
+        (WebInspector.HeapSnapshotGridNode.prototype._populate):
+        (WebInspector.HeapSnapshotGridNode.prototype.populateChildren.childrenRetrieved.notify):
+        (WebInspector.HeapSnapshotGridNode.prototype.populateChildren.childrenRetrieved):
+        (WebInspector.HeapSnapshotGridNode.prototype.populateChildren):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort.doSort.afterSort.afterPopulate):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort.doSort.afterSort):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort):
+        (WebInspector.HeapSnapshotGenericObjectNode):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get _shallowSizePercent):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype._updateHasChildren):
+        (WebInspector.HeapSnapshotObjectNode):
+        (WebInspector.HeapSnapshotObjectNode.prototype._createChildNode):
+        (WebInspector.HeapSnapshotObjectNode.prototype._createProvider):
+        (WebInspector.HeapSnapshotInstanceNode):
+        (WebInspector.HeapSnapshotInstanceNode.prototype._createChildNode):
+        (WebInspector.HeapSnapshotInstanceNode.prototype._createProvider):
+        (WebInspector.HeapSnapshotConstructorNode.prototype._createChildNode):
+        (WebInspector.HeapSnapshotConstructorNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotIteratorsTuple.prototype.sortAndRewind):
+        (WebInspector.HeapSnapshotDiffNode.prototype._calculateDiff):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createChildNode):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider.createProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._childHashForEntity):
+        (WebInspector.HeapSnapshotDiffNode.prototype._childHashForNode):
+        (WebInspector.HeapSnapshotDiffNode.prototype.populateChildren.firstProviderPopulated):
+        (WebInspector.HeapSnapshotDiffNode.prototype.populateChildren.else.firstProviderPopulated):
+        (WebInspector.HeapSnapshotDiffNode.prototype.populateChildren):
+        (WebInspector.HeapSnapshotDominatorObjectNode):
+        (WebInspector.HeapSnapshotDominatorObjectNode.prototype._createChildNode):
+        (WebInspector.HeapSnapshotDominatorObjectNode.prototype._createProvider):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype.sortingChanged):
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype._performSorting):
+        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype.setDataSource):
+        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype.populateChildren):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.setBaseDataSource.baseSnapshotNodeIdsReceived):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.setBaseDataSource.pushBaseSnapshotNodeIds):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.setBaseDataSource.snapshotNodeIdsReceived):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.setBaseDataSource):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.populateChildren.baseAggregatesReceived.aggregatesReceived):
+        (WebInspector.HeapSnapshotDiffDataGrid.prototype.populateChildren):
+        (WebInspector.HeapSnapshotRetainingPathsList):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype._resetPaths):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.setDataSource):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.refresh):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.showNext.pathFound):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.showNext.startSearching):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.showNext):
+        (WebInspector.DetailedHeapshotView.profileCallback):
+        (WebInspector.DetailedHeapshotView):
+        (WebInspector.DetailedHeapshotView.prototype.get profileWrapper):
+        (WebInspector.DetailedHeapshotView.prototype.get baseProfileWrapper):
+        (WebInspector.DetailedHeapshotView.prototype.show.profileCallback1):
+        (WebInspector.DetailedHeapshotView.prototype.show.profileCallback2):
+        (WebInspector.DetailedHeapshotView.prototype.show):
+        (WebInspector.DetailedHeapshotView.prototype._changeBase.baseProfileLoaded):
+        * inspector/front-end/HeapSnapshot.js:
+        * inspector/front-end/HeapSnapshotProxy.js: Added.
+        * inspector/front-end/PleaseWaitMessage.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._reset):
+        (WebInspector.ProfilesPanel.prototype.loadHeapSnapshot):
+        (WebInspector.ProfilesPanel.prototype._addHeapSnapshotChunk):
+        (WebInspector.ProfilesPanel.prototype._finishHeapSnapshot.doParse):
+        (WebInspector.ProfilesPanel.prototype._finishHeapSnapshot.else.parsed):
+        (WebInspector.ProfilesPanel.prototype._finishHeapSnapshot):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-04-13  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Web Page Performance auditing fails
+        https://bugs.webkit.org/show_bug.cgi?id=58322
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.documentLoaded):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.externalStylesheetsReceived):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.inlineStylesReceived):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.onDocumentAvailable):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.cssBeforeInlineReceived):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.lateStylesReceived):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.onDocumentAvailable):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+
+2011-04-13  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: enumerate properties in Inspector.json using array, not object keys.
+        https://bugs.webkit.org/show_bug.cgi?id=58418
+
+        * inspector/Inspector.json:
+
+2011-04-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: add "De-obfuscate Source" item to source frame text area context menu.
+        https://bugs.webkit.org/show_bug.cgi?id=57942
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.formatSourceFilesToggled):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.releaseEvaluationResult):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.toggleFormatSourceFiles):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.formatSourceFilesToggled):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._populateLineGutterContextMenu):
+        (WebInspector.SourceFrame.prototype._populateTextAreaContextMenu):
+        (WebInspector.SourceFrameDelegate.prototype.releaseEvaluationResult):
+        (WebInspector.SourceFrameDelegate.prototype.toggleFormatSourceFiles):
+        (WebInspector.SourceFrameDelegate.prototype.formatSourceFilesToggled):
+
+2011-04-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        SVGTextContentElements textLength returns 0
+        https://bugs.webkit.org/show_bug.cgi?id=52543
+
+        Add proper handling of the SVGTextContentElement textLength property, according to SVG 1.1 2nd edition.
+
+        If the textLength attributes is not explicitely set "textContentElement.textLength.baseVal"
+        will return the same as "textContentElement.getComputedTextLength()". If it's set the values
+        aren't equal anymore. getComputedTextLength() ignores the textLength attributes as well as the
+        lengthAdjust attribute. Adapt all of SVGTextQuery to ignore the lengthAdjust/textLength attributes.
+        This is how Opera implements it, and it makes sense to a certain degree, as otherwhise getComputedTextLength()
+        and textLength.baseVal.value would always be the same. Nor does the spec mention that textLength is honored
+        in the SVG Text DOM API.
+
+        Fixes svg/custom/text-dom-01-f.svg (from SVG 1.1 2nd edition, should be moved into the new W3C-SVG-1.1-SE directory).
+        Fixes svg/W3C-SVG-1.1-SE/svgdom-over-01-f.svg (last subtest related to textLength now passes).
+
+        Added new svg/dynamic-updates testcases covering dynamic changes of lengthAdjust/textLength and the synchronization
+        with getComputedTextLength().
+
+        Tests: svg/W3C-SVG-1.1-SE/svgdom-over-01-f.svg
+               svg/dynamic-updates/SVGTextElement-dom-lengthAdjust-attr.html
+               svg/dynamic-updates/SVGTextElement-dom-textLength-attr.html
+               svg/dynamic-updates/SVGTextElement-svgdom-lengthAdjust-prop.html
+               svg/dynamic-updates/SVGTextElement-svgdom-textLength-prop.html
+
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForPoint):
+        * rendering/svg/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer):
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::offsetForPositionInFragment):
+        (WebCore::SVGInlineTextBox::selectionRect):
+        (WebCore::SVGInlineTextBox::paintSelectionBackground):
+        (WebCore::SVGInlineTextBox::paint):
+        (WebCore::SVGInlineTextBox::calculateBoundaries):
+        * rendering/svg/SVGTextChunkBuilder.cpp:
+        (WebCore::SVGTextChunkBuilder::buildTextChunks):
+        (WebCore::SVGTextChunkBuilder::layoutTextChunks):
+        (WebCore::SVGTextChunkBuilder::addTextChunk):
+        (WebCore::SVGTextChunkBuilder::processTextChunk):
+        (WebCore::SVGTextChunkBuilder::processTextLengthSpacingCorrection):
+        (WebCore::SVGTextChunkBuilder::processTextAnchorCorrection):
+        * rendering/svg/SVGTextFragment.h:
+        (WebCore::SVGTextFragment::SVGTextFragment):
+        (WebCore::SVGTextFragment::buildFragmentTransform):
+        (WebCore::SVGTextFragment::transformAroundOrigin):
+        (WebCore::SVGTextFragment::buildTransformForTextOnPath):
+        (WebCore::SVGTextFragment::buildTransformForTextOnLine):
+        * rendering/svg/SVGTextLayoutEngine.cpp:
+        (WebCore::SVGTextLayoutEngine::parentDefinesTextLength):
+        (WebCore::SVGTextLayoutEngine::beginTextPathLayout):
+        (WebCore::dumpTextBoxes):
+        (WebCore::SVGTextLayoutEngine::finalizeTransformMatrices):
+        (WebCore::SVGTextLayoutEngine::finishLayout):
+        (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath):
+        * rendering/svg/SVGTextQuery.cpp:
+        (WebCore::SVGTextQuery::textLengthCallback):
+        (WebCore::SVGTextQuery::subStringLengthCallback):
+        (WebCore::SVGTextQuery::startPositionOfCharacterCallback):
+        (WebCore::SVGTextQuery::endPositionOfCharacterCallback):
+        (WebCore::SVGTextQuery::rotationOfCharacterCallback):
+        (WebCore::calculateGlyphBoundaries):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        (WebCore::SVGTextContentElement::synchronizeTextLength):
+        (WebCore::SVGTextContentElement::textLengthAnimated):
+        (WebCore::SVGTextContentElement::parseMappedAttribute):
+        (WebCore::SVGTextContentElement::svgAttributeChanged):
+        * svg/SVGTextContentElement.h:
+        (WebCore::SVGTextContentElement::specifiedTextLength):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::svgAttributeChanged):
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::svgAttributeChanged):
+
+2011-04-13  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: requestDocument can result in race condition in DOMAgent.js
+        https://bugs.webkit.org/show_bug.cgi?id=58415
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.requestDocument.onDocumentAvailable):
+        (WebInspector.DOMAgent.prototype.requestDocument):
+
+2011-04-12  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: another pass of protocol renames.
+        https://bugs.webkit.org/show_bug.cgi?id=58340
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getDocument):
+        (WebCore::InspectorDOMAgent::performSearch):
+        (WebCore::InspectorDOMAgent::setSearchingForNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._setSearchingForNode):
+        (WebInspector.ElementsPanel.prototype.setSearchingForNode):
+
+2011-04-12  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement remaining Background and Mask css properties in CSSStyleApplyProperty
+        https://bugs.webkit.org/show_bug.cgi?id=58390
+
+        No new tests required as no functionality changed.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyExpanding): Class to expand one property to 0-4 properties.
+        (WebCore::ApplyPropertyExpandingSuppressValue): Expand properties but suppress applyValue.
+
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        (WebCore::CSSStyleSelector::applyProperty): Remove implementations that have been moved to CSSStyleApplyProperty.
+
+2011-04-12  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Element::setAttribute should check the namespace of an id attribute
+        https://bugs.webkit.org/show_bug.cgi?id=58359
+
+        Test: fast/dom/id-attribute-with-namespace-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+
+2011-04-12  Mike Lawther  <mikelawther@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Update boolean operators in RenderStyle to be compatible with check-webkit-style
+        https://bugs.webkit.org/show_bug.cgi?id=58409
+
+        No new functionality, so no new tests.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::operator==):
+        (WebCore::RenderStyle::inheritedNotEqual):
+        (WebCore::positionedObjectMoved):
+        (WebCore::RenderStyle::diff):
+        (WebCore::RenderStyle::applyTransform):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::isOriginalDisplayInlineType):
+
+2011-04-12  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QNetworkReplyHandler refactoring: remove nested event loop.
+        https://bugs.webkit.org/show_bug.cgi?id=58375
+
+        As QNAM now makes actual synchronous loads there is no need for a nested event loop
+        in ResourceHandleQt.
+
+        Moving the call for QNetworkReplyWrapper::synchronousLoad from
+        ResourceHandle::loadResourceSynchronously to QNetworkReplyHandler::start for the
+        redirections to work in synchronous requests.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2011-04-12  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Move the calculation of the layer's z coordinate to the
+        right spot so that it can be picked up by its sublayers.
+        https://bugs.webkit.org/show_bug.cgi?id=58397
+
+        Test: platform/chromium/compositing/child-layer-3d-sorting.html
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updatePropertiesAndRenderSurfaces):
+
+2011-04-12  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QNetworkReplyHandler refactoring: signal queue
+        https://bugs.webkit.org/show_bug.cgi?id=57075
+
+        The idea is to make all signals that come from the QNetworkReply to pass through a queue and to
+        stop that queue when loading is deferred. This way almost all the deferred logic can be removed
+        from QNetworkReplyHandler class and encapsulated in its own class.
+
+        To stop the queue during wrapper methods execution avoids stacking handler methods over wrapper
+        methods. Because of this there is no chance for the wrapper to be destroyed inside one of its methods.
+        This together with empting the queue at wrapper destruction time makes sure that the handler will
+        not receive calls from a dead wrapper.
+
+        The new class is named QNetworkReplyHandlerCallQueue.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandlerCallQueue::QNetworkReplyHandlerCallQueue):
+        (WebCore::QNetworkReplyHandlerCallQueue::push):
+        (WebCore::QNetworkReplyHandlerCallQueue::lock):
+        (WebCore::QNetworkReplyHandlerCallQueue::unlock):
+        (WebCore::QNetworkReplyHandlerCallQueue::setDeferSignals):
+        (WebCore::QNetworkReplyHandlerCallQueue::flush):
+        (WebCore::QueueLocker::QueueLocker):
+        (WebCore::QueueLocker::~QueueLocker):
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::~QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::receiveMetaData):
+        (WebCore::QNetworkReplyWrapper::readyRead):
+        (WebCore::QNetworkReplyWrapper::didReceiveFinished):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::resetState):
+        (WebCore::QNetworkReplyHandler::release):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::synchronousLoad):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandlerCallQueue::deferSignals):
+        (WebCore::QNetworkReplyHandlerCallQueue::clear):
+        (WebCore::QNetworkReplyWrapper::synchronousLoad):
+        (WebCore::QNetworkReplyHandler::setLoadingDeferred):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2011-04-12  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Fix wrong calculation of HTMLFormElement::m_associatedElementsAfterIndex.
+        https://bugs.webkit.org/show_bug.cgi?id=58247
+
+        - Increment m_associatedElementsAfterIndex when the form owner and an
+        inserted form associated element have the same parent chain.
+        - Always iterate over m_associatedElements to decrease indexes when a
+        form associated element is removed. This is needed for a case that the
+        form associated element is removed from the form element due to
+        deleting the 'form' attribute. No behavioral change expected with this
+        change.
+
+        Tests: fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail1.html
+               fast/dom/HTMLFormElement/associated-elements-after-index-assertion-fail2.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::formElementIndexWithFormAttribute):
+        Incremet m_associatedElementsAfterIndex when compareDocumentPosition()
+        returns DOCUMENT_POSITION_CONTAINED_BY.
+        (WebCore::HTMLFormElement::removeFormElement):
+        Always iterate m_associatedElements to adjust indexes.
+
+2011-04-12  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Do not show scrollbars when use mobile theme
+        https://bugs.webkit.org/show_bug.cgi?id=58380
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::scrollbarThickness):
+
+2011-04-12  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        The default backspace event handler should mark the event as handled if navigation succeeds.
+        https://bugs.webkit.org/show_bug.cgi?id=58379
+
+        We should mark the event as handled only if we were able to successfully navigate backwards or forwards.
+        These navigations can fail if there is now back/forward history. This can occur in cases like ChromeFrame
+        where history is managed by an external browser like IE.
+
+        No new tests added as this scenario can occur when the history view is split across two browsers (WebKit and IE)
+        It is non trivial to simulate this environment.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultBackspaceEventHandler):
+
+2011-04-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make availableWidth and totalOverhangWidth in findNextLineBreak member variables of LineWidth
+        https://bugs.webkit.org/show_bug.cgi?id=58400
+
+        Added m_availableWidth and m_overhangWidth to LineWidth this allows us to encapsulate m_overhangWidth.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::LineWidth):
+        (WebCore::LineWidth::fitsOnLine): Added; returns true if current width + first argument <= availableWidth.
+        (WebCore::LineWidth::availableWidth): Added.
+        (WebCore::LineWidth::setAvailableWidth): Added; takes LineOffsets.
+        (WebCore::LineWidth::applyOverhang): Added; obtains the overhang width from ruby run and inflates
+        the available width.
+        (WebCore::LineWidth::fitBelowFloats): Moved from RenderBlock.
+        (WebCore::RenderBlock::findNextLineBreak): Uses LineWidth.
+
+2011-04-12  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Unreviewed warning fix.
+
+        MediaControlElements has been moved to html/shadow.
+
+        * WebCore.pro:
+
+2011-04-12  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Rename onEndChain and make it a static method.
+        https://bugs.webkit.org/show_bug.cgi?id=58403
+
+        No new tests since this is refactoring only.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::isLastChildForRenderer):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        * rendering/InlineFlowBox.h:
+
+2011-04-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Not reviewed, build fix.
+
+        Fix non-accelerated build after r83667.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerFirstVideoFrameAvailable): Guard call to 
+            mediaPlayerRenderingModeChanged with USE(ACCELERATED_COMPOSITING.
+
+2011-04-12  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] TilingData mishandles very small texture sizes
+        https://bugs.webkit.org/show_bug.cgi?id=58364
+
+        Use zero tiles when the texture size is too small for tiling.
+
+        * platform/graphics/gpu/TilingData.cpp:
+        (WebCore::TilingData::TilingData):
+        (WebCore::TilingData::setMaxTextureSize):
+
+2011-04-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r83634 and r83659.
+        http://trac.webkit.org/changeset/83634
+        http://trac.webkit.org/changeset/83659
+        https://bugs.webkit.org/show_bug.cgi?id=57075
+
+        It made 2 tests time out
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::~QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::receiveMetaData):
+        (WebCore::QNetworkReplyWrapper::didReceiveFinished):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::resetState):
+        (WebCore::QNetworkReplyHandler::setLoadingDeferred):
+        (WebCore::QNetworkReplyHandler::resumeDeferredLoad):
+        (WebCore::QNetworkReplyHandler::release):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::resourceResponse):
+        (WebCore::WebCoreSynchronousLoader::resourceError):
+        (WebCore::WebCoreSynchronousLoader::data):
+        (WebCore::WebCoreSynchronousLoader::setReplyFinished):
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2011-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Frames prevent scrolling containing page
+        <rdar://problem/8990409>
+        https://bugs.webkit.org/show_bug.cgi?id=58392
+
+        Also fixes:
+        Should rubber-band on pages with no scrollbars
+        <rdar://problem/9034280>
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        Make the main frame rubber-band horizontally and vertically always.
+
+        * platform/ScrollTypes.h:
+        Add ScrollElasticity enum.
+
+        * platform/ScrollableArea.cpp:
+        Default to no elasticity.
+
+        (WebCore::ScrollableArea::ScrollableArea):
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::setVerticalScrollElasticity):
+        (WebCore::ScrollableArea::verticalScrollElasticity):
+        (WebCore::ScrollableArea::setHorizontalScrollElasticity):
+        (WebCore::ScrollableArea::horizontalScrollElasticity):
+        Add state for horizontal and vertical elasticity.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::handleWheelEvent):
+        Bail out of new scrolling behavior if we can't rubber-band. By bailing before
+        accepting the wheel event, we allow the wheel event to be forwarded. We will
+        need to refine this logic to allow subframe scrolling in the future.
+
+        (WebCore::ScrollAnimatorMac::allowsVerticalStretching):
+        (WebCore::ScrollAnimatorMac::allowsHorizontalStretching):
+        Switch stretching behavior based on the ScrollableArea's elasticity.
+
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix the Chromium build.
+        
+        Why have one URL when you can have two at twice the price?
+
+        * platform/KURL.h:
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::isHashTableDeletedValue):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURLGooglePrivate::KURLGooglePrivate):
+        * platform/KURLGooglePrivate.h: Added a GoogleURL path for KURL's hash
+        table deleted value constructor.
+
+2011-04-12  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+        https://bugs.webkit.org/show_bug.cgi?id=58280
+        Fix a layout test by correctly comparing enums, and not adding exceptions.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+
+2011-04-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Apple movie trailers play only audio
+        https://bugs.webkit.org/show_bug.cgi?id=58339
+        <rdar://problem/9237606>
+
+        No new tests, covered by existing layout and manual tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerEngineUpdated): Do the logging before calling any functions.
+        (WebCore::HTMLMediaElement::mediaPlayerFirstVideoFrameAvailable): New, if still displaying the poster 
+            change the display mode to Video and force a style recalc so the video layer gets hooked
+            up the the render tree.
+        * html/HTMLMediaElement.h: Define new display mode, PosterWaitingForVideo, to signal that we
+            want to stop displaying the poster as soon as the first frame of video is available.
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::setDisplayMode): Change display mode to PosterWaitingForVideo when
+            we want to display Video but the media engines doesn't have the first frame yet.
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::shouldDisplayPosterImage): Update to return true when display mode
+            is PosterWaitingForVideo.
+
+        * manual-tests/media-elements/video-replaces-poster.html: Clean up bit-rot from patch changes.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::firstVideoFrameAvailable): New, passthrough from media engien to element.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerFirstVideoFrameAvailable):
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation): Initialize 
+            m_haveReportedFirstVideoFrame and m_playWhenFramesAvailable.
+        (WebCore::MediaPlayerPrivateAVFoundation::play): Don't actually start playback until the first
+            frame of video has loaded, or audio will begin to play before we can show video.
+        (WebCore::MediaPlayerPrivateAVFoundation::pause): Clear m_playWhenFramesAvailable.
+        (WebCore::MediaPlayerPrivateAVFoundation::updateStates): When first frame of video is
+            available, inform elment and begin playback if it was previousl requested.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer): Correct logging.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformPlay): Renamed from play.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformPause): Rename from pause.
+
+2011-04-12  Jian Li  <jianli@chromium.org>
+
+        Unreviewed, rolling out r83649.
+        http://trac.webkit.org/changeset/83649
+        https://bugs.webkit.org/show_bug.cgi?id=57563
+
+        This patch causes compiling errors for chromium
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/ImageBufferData.h:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::resize):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+        (WebCore::TransparencyWin::makeLayerOpaque):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::PlatformContextSkia):
+        (WebCore::PlatformContextSkia::setCanvas):
+        (WebCore::PlatformContextSkia::isPrinting):
+        (WebCore::PlatformContextSkia::isNativeFontRenderingAllowed):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (WebCore::PlatformContextSkia::canvas):
+
+2011-04-12  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Implement non-activating clicks to allow dragging out of a background window.
+        https://bugs.webkit.org/show_bug.cgi?id=55053
+        <rdar://problem/9042197>
+
+        * WebCore.exp.in: Added new exported method.
+
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Cleaned up hash traits, and added hash traits for handles
+        https://bugs.webkit.org/show_bug.cgi?id=58381
+
+        * dom/QualifiedName.h: Use new SimpleClassHashTraits to avoid duplication.
+
+        * platform/KURL.h:
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::isHashTableDeletedValue): Added explicit hash table
+        deleted value constructor, to be more explicit and enable use of
+        SimpleClassHashTraits.
+
+        * platform/KURLHash.h: Use new SimpleClassHashTraits to avoid duplication.
+
+        * platform/graphics/FontCache.cpp: Ditto.
+        * platform/network/ProtectionSpaceHash.h: Ditto.
+        * svg/properties/SVGAnimatedPropertyDescription.h: Ditto.
+
+2011-04-12  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QNetworkReplyHandler refactoring: remove nested event loop.
+        https://bugs.webkit.org/show_bug.cgi?id=58375
+
+        As QNAM now makes actual synchronous loads there is no need for a nested event loop
+        in ResourceHandleQt.
+
+        Moving the call for QNetworkReplyWrapper::synchronousLoad from
+        ResourceHandle::loadResourceSynchronously to QNetworkReplyHandler::start for the
+        redirections to work in synchronous requests.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2011-04-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: Vimeo fullscreen video displays incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=58291
+
+        Set the RenderFullScreen's zIndex to the max.  And make sure to override
+        a video element's specified width and height by making its full screen rules
+        important.  Also, always show the controls when a media element is in full
+        screen mode.
+
+        Test: fullscreen/video-specified-size.html
+        Test: fullscreen/full-screen-zIndex.html
+
+        * css/fullscreen.css:
+        (video:-webkit-full-screen): 
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls): Always show controls in full screen mode.
+        (WebCore::HTMLMediaElement::preDispatchEventHandler): Added. Handle the fullscreen
+            change event and hide or show the controls accordingly.
+        * html/HTMLMediaElement.h:
+        * rendering/RenderFullScreen.cpp:
+        (RenderFullScreen::createFullScreenStyle): Set the zIndex to INT_MAX and use a 
+            vertical flexbox instead of a horizontal one.
+
+2011-04-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Page tears and stutters in WebKit2 when page is > 2048 pixels wide
+        https://bugs.webkit.org/show_bug.cgi?id=58330
+
+        Added API to GraphicsLayer to disable switching to tiled layers. This is 
+        set in the nonCompositedContentLayer in WK2, causing that layer to never
+        switch to tiles and avoiding the asynchronous update of the content during
+        scroll.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+            Implement setAllowTiledLayer() to simulate a SizeChanged action to 
+            properly switch between tiled and untiled layer.
+        * platform/graphics/ca/GraphicsLayerCA.h:
+
+2011-04-12  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Remove dependency on chromium skia::PlatformCanvas
+        https://bugs.webkit.org/show_bug.cgi?id=57563
+
+        This patch does not change any functionality, just the type of object skia::PlatformCanvas -> SkCanvas.
+        The object is still being created by a factory method skia::CreateBitmapCanvas defined in Chromium.
+        We will eventually define an API that every port using skia will define.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/ImageBufferData.h:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::resize):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+        (WebCore::TransparencyWin::makeLayerOpaque):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::PlatformContextSkia):
+        (WebCore::PlatformContextSkia::setCanvas):
+        (WebCore::PlatformContextSkia::isNativeFontRenderingAllowed):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (WebCore::PlatformContextSkia::canvas):
+        (WebCore::PlatformContextSkia::printing):
+        (WebCore::PlatformContextSkia::setPrinting):
+
+2011-04-11  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58280
+        <rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception
+        Currently serialization and deserialization can throw javascript exceptions.  Since SerializedScriptValue is called in
+        several places that do not always involve direct calls into javascript have the functions return an error code and the callers
+        decide whether or not to throw exceptions.
+
+        Don't allow SerializedScriptValue to attempt to serialize objects that inherit from JSNavigator.h.  Walking that object creates
+        additional objects which eventually causes serialization to end up throwing a stack overflow error.  Instead fail immediately.
+
+        Untangle header includes.  SerializedScriptValue was inheriting ScriptValue.h, but not using it.  Since ScriptValue depends on
+        SerializedScriptValue this could lead to a circular header dependency.
+
+        No change in functionality, covered by current tests
+
+        * WebCore.exp.in:
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::initMessageEvent):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        (WebCore::ScriptValue::deserialize):
+        * bindings/js/ScriptValue.h:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneSerializer::serialize):
+        (WebCore::CloneSerializer::dumpIfTerminal):
+        (WebCore::CloneDeserializer::deserialize):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        (WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
+        (WebCore::SerializedScriptValue::serializationDidCompleteSuccessfully):
+        * bindings/js/SerializedScriptValue.h:
+
+        * bindings/js/JSWorkerContextBase.cpp: header include fix
+        * loader/FrameLoader.h: header include fix
+        * page/Frame.cpp: header include fix
+
+2011-03-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Kenneth Russell.
+
+        Move libtess from WebCore/thirdparty to ThirdParty
+        https://bugs.webkit.org/show_bug.cgi?id=57288
+
+        * WebCore.gyp/WebCore.gyp:
+            - Add libtess as a legit dependency.
+        * WebCore.gypi:
+            - Remove libtess files from the gypi.
+        * thirdparty/glu: Removed.
+
+2011-04-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Bundle w and tmpW in findNextLineBreak together as a class
+        https://bugs.webkit.org/show_bug.cgi?id=58362
+
+        Renamed w, tempW, and width in findNextLineBreak to committedWidth, uncommittedWidth,
+        and availableWidth respectively. Also bundled committedWidth and uncommittedWith as a class
+        named LineWidth.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::LineWidth): Added.
+        (WebCore::LineWidth::currentWidth): Added; returns the sum of committed and uncommitted width.
+        (WebCore::LineWidth::uncommittedWidth): Added.
+        (WebCore::LineWidth::committedWidth): Added.
+        (WebCore::LineWidth::addUncommittedWidth): Added; adds the specified width to the uncommitted width.
+        (WebCore::LineWidth::commit): Added; commits the current width and clears the uncommitted width.
+        (WebCore::RenderBlock::findNextLineBreak): Uses LineWidth.
+
+2011-04-12  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r82419): extra border in t0805-c5519-ibrdr-r-00-a.html
+        https://bugs.webkit.org/show_bug.cgi?id=57459
+
+        Slightly change the way we decide if a InlineFlowBox is the last box for its renderer.
+        We include the border in that box under these conditions:
+        (1) The next line was not created, or it is constructed. We check the previous line for rtl.
+        (2) The logicallyLastRun is not a descendant of this renderer.
+        (3) The logicallyLastRun is a descendant of this renderer, but it is the last child of this renderer and it does not wrap to the next line.
+        I added the tests from bug 47210, because now the draw the borders correctly.
+
+        Tests: fast/borders/bidi-002.html
+               fast/borders/bidi-004.html
+               fast/borders/bidi-009a.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::onEndChain):
+        (WebCore::isAnsectorAndWithinBlock):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Cleaned up some Vector traits, and added missing Vector traits for handles
+        https://bugs.webkit.org/show_bug.cgi?id=58372
+
+        * platform/graphics/BitmapImage.h: Added a FIXME because the current
+        Vector traits for FrameData are logically incorrect, but I couldn't find
+        a place where this currently results in bad behavior, and it's not
+        immediately obvious what the right solution is.
+
+2011-04-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Move MediaControlElements to html/shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=58347
+
+        Mechanical move of the files.
+
+        * Android.mk: Updated the build file.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto, also ran sort-XCode-project-files.
+        * html/shadow/MediaControlElements.cpp: Copied from Source/WebCore/rendering/MediaControlElements.cpp.
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        * html/shadow/MediaControlElements.h: Copied from Source/WebCore/rendering/MediaControlElements.h.
+        * rendering/MediaControlElements.cpp: Removed.
+        * rendering/MediaControlElements.h: Removed.
+        * rendering/RenderingAllInOne.cpp: Removed the files that were moved.
+
+2011-04-12  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QNetworkReplyHandler refactoring: signal queue
+        https://bugs.webkit.org/show_bug.cgi?id=57075
+
+        The idea is to make all signals that come from the QNetworkReply to pass through a queue and to
+        stop that queue when loading is deferred. This way almost all the deferred logic can be removed
+        from QNetworkReplyHandler class and encapsulated in its own class.
+
+        To stop the queue during wrapper methods execution avoids stacking handler methods over wrapper
+        methods. Because of this there is no chance for the wrapper to be destroyed inside one of its methods.
+        This together with empting the queue at wrapper destruction time makes sure that the handler will
+        not receive calls from a dead wrapper.
+
+        The new class is named QNetworkReplyHandlerCallQueue.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandlerCallQueue::QNetworkReplyHandlerCallQueue):
+        (WebCore::QNetworkReplyHandlerCallQueue::push):
+        (WebCore::QNetworkReplyHandlerCallQueue::lock):
+        (WebCore::QNetworkReplyHandlerCallQueue::unlock):
+        (WebCore::QNetworkReplyHandlerCallQueue::setDeferSignals):
+        (WebCore::QueueLocker::QueueLocker):
+        (WebCore::QueueLocker::~QueueLocker):
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::~QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::receiveMetaData):
+        (WebCore::QNetworkReplyWrapper::readyRead):
+        (WebCore::QNetworkReplyWrapper::didReceiveFinished):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::resetState):
+        (WebCore::QNetworkReplyHandler::release):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::synchronousLoad):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandlerCallQueue::deferSignals):
+        (WebCore::QNetworkReplyHandlerCallQueue::clear):
+        (WebCore::QNetworkReplyWrapper::synchronousLoad):
+        (WebCore::QNetworkReplyHandler::setLoadingDeferred):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2011-04-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58176
+        
+        Inline replaced elements following positioned elements on lines are not rendered. Make sure the
+        logic for skipping run construction in appendRunsForObject matches the new logic that I added
+        to findNextLineBreak. If they don't match up, you risk confusing the run construction code and
+        causing it to not make runs for objects that follow the positioned object on the line.
+
+        Added fast/inline/positioned-object-between-replaced-elements.html
+        
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::appendRunsForObject):
+
+2011-04-12  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58292
+        Provide new setting to allow site icon loading despite disabling automatic image loading in general.
+
+        Test: http/tests/misc/favicon-loads-with-icon-loading-override.html
+
+        * WebCore.exp.in: Added export symbol
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::startIconLoader): Check new setting before deciding that site icon images shouldn't be loaded.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Add initializer for new setting
+        (WebCore::Settings::setLoadsSiteIconsIgnoringImageLoadingSetting): Add setter for new setting.
+        * page/Settings.h: Explain nuances regarding loadsImagesAutomatically setting.
+        (WebCore::Settings::loadsSiteIconsIgnoringImageLoadingSetting): Added getter.
+
+2011-04-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move StyleChange and other global functions from ApplyStyleCommand to EditingStyle
+        https://bugs.webkit.org/show_bug.cgi?id=55974
+
+        Moved StyleChange, getIdentifierValue, and legacyFontSizeFromCSSValue from ApplyStyleCommand
+        to EditingStyle. Also moved reconcileTextDecorationProperties, getIdentifierValue,
+        setTextDecorationProperty, isCSSValueLength, legacyFontSizeFromCSSValue, extractTextStyles,
+        diffTextDecorations, fontWeightIsBold, getTextAlignment, and getPropertiesNotIn.
+
+        Because of this move, getPropertiesNotIn is no longer visible outside of EditingStyle.cpp
+
+        * editing/ApplyStyleCommand.cpp:
+        * editing/ApplyStyleCommand.h:
+        * editing/EditingStyle.cpp:
+        (WebCore::reconcileTextDecorationProperties):
+        (WebCore::StyleChange::StyleChange):
+        (WebCore::setTextDecorationProperty):
+        (WebCore::getRGBAFontColor):
+        (WebCore::StyleChange::extractTextStyles):
+        (WebCore::diffTextDecorations):
+        (WebCore::fontWeightIsBold):
+        (WebCore::getTextAlignment):
+        (WebCore::getPropertiesNotIn):
+        (WebCore::getIdentifierValue):
+        (WebCore::isCSSValueLength):
+        (WebCore::legacyFontSizeFromCSSValue):
+        * editing/EditingStyle.h:
+        (WebCore::StyleChange::cssStyle):
+        (WebCore::StyleChange::applyBold):
+        (WebCore::StyleChange::applyItalic):
+        (WebCore::StyleChange::applyUnderline):
+        (WebCore::StyleChange::applyLineThrough):
+        (WebCore::StyleChange::applySubscript):
+        (WebCore::StyleChange::applySuperscript):
+        (WebCore::StyleChange::applyFontColor):
+        (WebCore::StyleChange::applyFontFace):
+        (WebCore::StyleChange::applyFontSize):
+        (WebCore::StyleChange::fontColor):
+        (WebCore::StyleChange::fontFace):
+        (WebCore::StyleChange::fontSize):
+        (WebCore::StyleChange::operator==):
+        (WebCore::StyleChange::operator!=):
+
+2011-04-12  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Better padding for inputs and comboxes in mobile theme
+        https://bugs.webkit.org/show_bug.cgi?id=58248
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::setButtonPadding):
+        (WebCore::RenderThemeQt::adjustTextFieldStyle):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::adjustMenuListStyle):
+
+2011-04-11  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Replace insertChildNode with addChild in handleRunIn's reparenting
+        of inlineRunIn to currBlock.
+        https://bugs.webkit.org/show_bug.cgi?id=58228
+
+        Use addChild instead of insertChildNode since it handles 
+        correct placement of the children, esp where we cannot insert
+        anything before the first child. e.g. details tag requires that its
+        first child be a summary child and won't be able to remove child if
+        that is not the case.
+
+        Test: fast/runin/runin-reparent-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2011-04-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Unreviewed. Fixing Leopard build.
+
+        REGRESSION: WK2: misspelled AX attributes no longer returned from text fields
+        https://bugs.webkit.org/show_bug.cgi?id=58304
+
+        checkTextOfParagraph is not available on Leopard. That code needs to be conditionalized with USE(UNIFIED_TEXT_CHECKING).
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetSpelling):
+
+2011-04-12  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Unreviewed. Added missing files to GNUmakefile.list.am.
+
+        * GNUmakefile.list.am: Added IDBLevelDBBackingStore.[h|cpp].
+
+2011-04-12  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add handling for non-svg inline text boxes in text box lists.
+        https://bugs.webkit.org/show_bug.cgi?id=57933
+
+        Test: svg/text/svg-rtl-text-crash.html
+
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForPoint):
+        * rendering/svg/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer):
+        * rendering/svg/SVGRenderTreeAsText.cpp:
+        (WebCore::writeSVGInlineTextBoxes):
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::closestLeafChildForPosition):
+        (WebCore::reverseInlineBoxRangeAndValueListsIfNeeded):
+        * rendering/svg/SVGTextQuery.cpp:
+        (WebCore::SVGTextQuery::collectTextBoxesInFlowBox):
+
+2011-04-12  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [GTK] Expose menu items and menus as children of a menu bar
+        https://bugs.webkit.org/show_bug.cgi?id=56659
+
+        Ensure menu items get exposed when they're children of menu bars.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        Consider menu bars as potential parent objects for menu items.
+
+2011-04-12  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: remove scriptWorldType from the protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=58324
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/ScriptDebugListener.h:
+        (WebCore::ScriptDebugListener::~ScriptDebugListener):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerDispatcher.prototype.scriptParsed):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile):
+
+2011-04-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Should MediaControls::changedNetworkState fiddle with Fullscreen controls?
+        https://bugs.webkit.org/show_bug.cgi?id=58163
+
+        Covered by existing tests and manual-tests/media-controls.html.
+
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::reset): Moved fullscreen showing/hiding here.
+        (WebCore::MediaControls::changedNetworkState): ... from here.
+
+2011-04-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove unnecessary method InspectorAgent.didEvaluateForTestInFrontend.
+        https://bugs.webkit.org/show_bug.cgi?id=58335
+
+        It was the method for Inspector layout tests.
+        We can use RuntimeAgent.evaluate instead.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::connectFrontend):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+
+2011-04-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] some public callbacks remain
+        https://bugs.webkit.org/show_bug.cgi?id=58307
+
+        Cleanup of the player public/private APIs. Moving the GstMessage
+        handling code inside of the player allowed some APIs to move to
+        the private scope of the class.
+
+        No new tests, this patch is a cleanup and should not affect
+        current tests coverage.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::mediaPlayerPrivateMuteChangedCallback):
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
+        (WebCore::MediaPlayerPrivateGStreamer::currentTime):
+        (WebCore::MediaPlayerPrivateGStreamer::seek):
+        (WebCore::MediaPlayerPrivateGStreamer::setRate):
+        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
+        (WebCore::MediaPlayerPrivateGStreamer::sourceChanged):
+        (WebCore::MediaPlayerPrivateGStreamer::triggerRepaint):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+
+2011-04-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] advertize HTTP Live Streaming mime-type
+        https://bugs.webkit.org/show_bug.cgi?id=58318
+
+        Register the hls mime-type in the internal cache if found in the
+        typefind factories.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2011-04-11  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+        
+        RenderIndicator and ShadowBlockElement are no longer used.
+        https://bugs.webkit.org/show_bug.cgi?id=58277
+
+        Removed RenderIndicator and ShadowBlockElement.
+        
+        No new tests. Just removed unused code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderIndicator.cpp: Removed.
+        * rendering/RenderIndicator.h: Removed.
+        * rendering/RenderMeter.h:
+        * rendering/RenderingAllInOne.cpp:
+        * rendering/ShadowElement.cpp:
+        * rendering/ShadowElement.h:
+
+2011-04-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        fast/css/dashboard-regions-attr-crash.html asserts
+        https://bugs.webkit.org/show_bug.cgi?id=58233
+
+        Move DASHBOARD_SUPPORT feature detection from features.pri to CodeGenerators.pri
+        not to generate incorrect properties into CSSPropertyNames.h.
+
+        * CodeGenerators.pri:
+        * features.pri:
+
+2011-04-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: WK2: misspelled AX attributes no longer returned from text fields
+        https://bugs.webkit.org/show_bug.cgi?id=58304
+
+        checkSpellingOfString is no longer implemented in WK2. Accessibility needs to change to use
+        checkTextOfParagraph in order to retrieve misspelled ranges.
+
+        Existing tests cover this functionality.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetSpelling):
+
+2011-04-12  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Remove m_idleHandler from ResourceHandleSoup
+        https://bugs.webkit.org/show_bug.cgi?id=58319
+
+        The m_idleHandler attribute is no longer used in ResourceHandleSoup.
+        No new tests needed, no functionality change.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+
+2011-04-12  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Breakpoints and execution line decoration should stay in place if the edited line is not whitespace
+        https://bugs.webkit.org/show_bug.cgi?id=58314
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._lineNumberAfterEditing):
+
+2011-04-11  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move shortcut handlers from SourceFrame to TextViewer.
+        https://bugs.webkit.org/show_bug.cgi?id=58238
+
+        Commit/cancel editing functionality is common for all resource types, and it deals with TextViewer state.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.isContentEditable):
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        (WebInspector.SourceFrame.prototype.commitEditing.didEditContent):
+        (WebInspector.SourceFrame.prototype.commitEditing):
+        (WebInspector.SourceFrame.prototype.cancelEditing):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._doubleClick):
+        (WebInspector.TextViewer.prototype._registerShortcuts):
+        (WebInspector.TextViewer.prototype._handleKeyDown):
+        (WebInspector.TextViewer.prototype._commitEditing.didCommitEditing):
+        (WebInspector.TextViewer.prototype._commitEditing):
+        (WebInspector.TextViewer.prototype._cancelEditing):
+        (WebInspector.TextViewerDelegate.prototype.endEditing):
+        (WebInspector.TextViewerDelegate.prototype.commitEditing):
+        (WebInspector.TextViewerDelegate.prototype.cancelEditing):
+
+2011-04-12  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: cookies view is empty even for sites with cookies.
+        https://bugs.webkit.org/show_bug.cgi?id=58316
+
+        Test: http/tests/inspector/resource-tree-model.html
+
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype._callForFrameResources):
+
+2011-04-11  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] GPU-accelerated canvas-to-canvas drawImage is incorrect.
+        https://bugs.webkit.org/show_bug.cgi?id=58258
+
+        When one accelerated canvas is drawn to another via drawImage(), if the
+        prior call in the source canvas was non-accelerated, the 
+        hardware canvas is not up-to-date, and the results will be incorrect.
+        Fixed by calling prepareForHardwareDraw() on the source context.
+
+        Test: fast/canvas/canvas-to-canvas.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::draw):
+
+2011-04-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Add some more tests for detailed heap snapshots UI.
+        https://bugs.webkit.org/show_bug.cgi?id=58146
+
+        Tests: inspector/profiler/detailed-heapshots-comparison-expansion-preserved-when-sorting.html
+               inspector/profiler/detailed-heapshots-comparison-show-all.html
+               inspector/profiler/detailed-heapshots-comparison-show-next.html
+               inspector/profiler/detailed-heapshots-comparison-shown-node-count-preserved-when-sorting.html
+               inspector/profiler/detailed-heapshots-comparison-sorting.html
+               inspector/profiler/detailed-heapshots-containment-shown-node-count-preserved-when-sorting.html
+               inspector/profiler/detailed-heapshots-dominators-expansion-preserved-when-sorting.html
+               inspector/profiler/detailed-heapshots-dominators-show-all.html
+               inspector/profiler/detailed-heapshots-dominators-show-next.html
+               inspector/profiler/detailed-heapshots-dominators-shown-node-count-preserved-when-sorting.html
+               inspector/profiler/detailed-heapshots-dominators-sorting.html
+               inspector/profiler/detailed-heapshots-summary-shown-node-count-preserved-when-sorting.html
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotDiffDataGrid):
+
+2011-04-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: there was incorrect value of id property of responses for malformed json-rpc 2.0 requests.
+        https://bugs.webkit.org/show_bug.cgi?id=58305
+
+        It was 0 if the message is not a json object or it has no id property. But according to spec it must be null.
+
+        * inspector/CodeGeneratorInspector.pm:
+
+2011-04-11  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [chromium] script formatting doesn't work when chromium is built with debug_devtools=1.
+        https://bugs.webkit.org/show_bug.cgi?id=58232
+
+        * WebCore.gypi:
+
+2011-04-12  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: REGRESSION: Most resources in the Network panel show a blank panel when clicked.
+        https://bugs.webkit.org/show_bug.cgi?id=58273
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.get visible):
+        (WebInspector.SourceFrame.prototype.set visible):
+        (WebInspector.SourceFrame.prototype.show):
+        (WebInspector.SourceFrame.prototype.hide):
+        (WebInspector.SourceFrame.prototype.detach):
+        (WebInspector.SourceFrame.prototype._ensureContentLoaded):
+        (WebInspector.SourceFrame.prototype.markDiff):
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.get scrollTop):
+        (WebInspector.SourceFrame.prototype.set scrollTop):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._clearLineHighlight):
+        (WebInspector.SourceFrame.prototype._initializeTextViewer):
+        (WebInspector.SourceFrame.prototype.performSearch):
+        (WebInspector.SourceFrame.prototype.searchCanceled):
+        (WebInspector.SourceFrame.prototype._jumpToSearchResult):
+        (WebInspector.SourceFrame.prototype.setExecutionLine):
+        (WebInspector.SourceFrame.prototype.clearExecutionLine):
+        (WebInspector.SourceFrame.prototype.resize):
+
+2011-04-12  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: document runtime agent, share remote object definition between domains.
+        https://bugs.webkit.org/show_bug.cgi?id=58246
+
+        * inspector/Inspector.json:
+
+2011-04-12  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: document console domain, support cross-domain type references.
+        https://bugs.webkit.org/show_bug.cgi?id=58240
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::messageSourceValue):
+        (WebCore::messageTypeValue):
+        (WebCore::messageLevelValue):
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/Inspector.json:
+        * inspector/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::buildInspectorObject):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.messageAdded):
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype._populateStackTraceTreeElement):
+        (WebInspector.ConsoleMessage.prototype.isEqual):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype.requestWillBeSent):
+        * inspector/generate-inspector-idl:
+        * page/Console.h:
+
+2011-04-06  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] RTSP playback broken
+        https://bugs.webkit.org/show_bug.cgi?id=56930
+
+        Rely on {audio,video}-changed playbin2 signals instead of the
+        -tags-changed signals because some media don't provide tags and
+        then can trick the media-player to not paint video, for instance.
+
+        Also trigger a video size calculation after the video sink
+        negotiated its caps. This is useful in the cases where
+        audio-changed signal is emitted but the video sink takes more time
+        to negociate caps with its peer.
+
+        This patch also fixes the rtsp manual-test with a new stream url
+        which seems to be more permanent than the previous WWDC keynote
+        stream.
+
+        * manual-tests/video-rtsp.html:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateVideoChangedCallback):
+        (WebCore::mediaPlayerPrivateAudioChangedCallback):
+        (WebCore::mediaPlayerPrivateAudioChangeTimeoutCallback):
+        (WebCore::mediaPlayerPrivateVideoChangeTimeoutCallback):
+        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
+        (WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer):
+        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
+        (WebCore::MediaPlayerPrivateGStreamer::videoChanged):
+        (WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfVideo):
+        (WebCore::MediaPlayerPrivateGStreamer::audioChanged):
+        (WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfAudio):
+        (WebCore::MediaPlayerPrivateGStreamer::paint):
+        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+
+2011-04-12  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Failed/canceled resource requests kept showing as Pending in network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=58135
+
+        Added statuses for failed/canceled resource loading.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didFailLoading):
+        * inspector/front-end/NetworkManager.js:
+        * inspector/front-end/NetworkPanel.js:
+        * inspector/front-end/Resource.js:
+
+2011-04-12  Steve Block  <steveblock@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Callable objects created via JavaScriptCore API cannot be used as Geolocation callbacks
+        https://bugs.webkit.org/show_bug.cgi?id=40012
+
+        Covered by fast/dom/Geolocation/argument-types.html
+
+        * bindings/js/CallbackFunction.cpp:
+        (WebCore::checkFunctionOnlyCallback):
+
+2011-04-07  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] report playback statistics
+        https://bugs.webkit.org/show_bug.cgi?id=58033
+
+        Provide media playback statistics using fpsdisplaysink and
+        position queries.
+
+        * manual-tests/video-statistics.html: Added.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::decodedFrameCount):
+        (WebCore::MediaPlayerPrivateGStreamer::droppedFrameCount):
+        (WebCore::MediaPlayerPrivateGStreamer::audioDecodedByteCount):
+        (WebCore::MediaPlayerPrivateGStreamer::videoDecodedByteCount):
+        (WebCore::MediaPlayerPrivateGStreamer::updateAudioSink):
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
+        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+
+2011-04-11  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] warnings in media/video-set-rate-from-pause.html
+        https://bugs.webkit.org/show_bug.cgi?id=58220
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::setRate): Pause the
+        pipeline if new rate is zero, like advised in the GStreamer
+        documentation of gst_event_new_seek().
+
+2011-04-11  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Properly invalidate the contents of ImageLayerChromium's
+        when the actual image contents change.
+        https://bugs.webkit.org/show_bug.cgi?id=58181
+
+        Test: compositing/images/content-image-change.html
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::updateTexture):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::ImageLayerChromium):
+        (WebCore::ImageLayerChromium::setContents):
+        (WebCore::ImageLayerChromium::paintContentsIfDirty):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+
+2011-04-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        -webkit-box-shadow:inset does not animate transform as an inset shadow
+        https://bugs.webkit.org/show_bug.cgi?id=45176
+        
+        Two fixes:
+        1. Don't run transitions between different shadow styles (normal vs. inset).
+        2. When either source or destination is null, use a default shadow with a
+        matching style so that the transition runs.
+
+        Test: transitions/mismatched-shadow-styles.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        (WebCore::PropertyWrapperShadow::blend):
+
+2011-04-11  John Bates  <jbates@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        chromium support for glSetLatch and glWaitLatch between 3D contexts
+        https://bugs.webkit.org/show_bug.cgi?id=58003
+
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::~Canvas2DLayerChromium):
+        (WebCore::Canvas2DLayerChromium::setDrawingBuffer):
+        (WebCore::Canvas2DLayerChromium::setLayerRenderer):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::Cubic::Cubic):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::updateAndDrawLayers):
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::addChildContext):
+        (WebCore::LayerRendererChromium::removeChildContext):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::~WebGLLayerChromium):
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        (WebCore::WebGLLayerChromium::setContext):
+        (WebCore::WebGLLayerChromium::setLayerRenderer):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+
+2011-04-11  Alexey Marinichev  <amarinichev@chromium.org>
+
+        Reviewed by James Robinson.
+
+        LayerChromium/CCLayerImpl ownership fix
+        https://bugs.webkit.org/show_bug.cgi?id=58283
+
+        CCLayerImpl's m_owner field lifetime should match the lifetime of the
+        corresponding LayerChromium.  This change moves resetting of m_owner
+        into LayerChromium's destructor.
+
+        Tested similarly to bug 57577.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::~LayerChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::cleanupResources):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::resetOwner):
+
+2011-04-11  Daniel Bates  <dbates@rim.com>
+
+        Attempt to fix the GTK build after changeset 83527 <http://trac.webkit.org/changeset/83527>
+        (https://bugs.webkit.org/show_bug.cgi?id=53556).
+
+        * GNUmakefile.list.am: Append files HTMLTrackElement.{h, cpp} to the list webcore_sources.
+
+2011-04-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9251515> and https://bugs.webkit.org/show_bug.cgi?id=58072
+        URLs accessed as a result of pushState/replaceState should count as "visited" and be in the global history
+
+        Test: fast/loader/stateobjects/state-url-sets-links-visited.html
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState): Notify the history client and add the visited link.
+        (WebCore::HistoryController::replaceState): Ditto.
+
+2011-04-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Rename MediaControls to MediaControlRootElement.
+        https://bugs.webkit.org/show_bug.cgi?id=58250
+
+        Mechanical move using do-webcore-rename.
+
+2011-04-11  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58285
+        CompositeAnimation is cleared while an AnimationBase is waiting for notification
+
+        Occasionally hardware animations would trigger a state where
+        they would tell the AnimationControllerPrivate that it should notify
+        any waiting animations that they are ready to start, even though
+        the RenderObject had gone away and hence the CompositeAnimation
+        had been destroyed. The fix is to zero the pointer from AnimationBase
+        when the CompositeAnimation destructor runs (or its animations are
+        cleared) and test the validity of the CompositeAnimation before it
+        is used in AnimationBase.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
+        (WebCore::AnimationBase::updatePlayState):
+        (WebCore::AnimationBase::freezeAtTime):
+        (WebCore::AnimationBase::beginAnimationUpdateTime):
+        - test that the CompositeAnimation exists
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::clear):
+        - rename clearRenderer() to clear() as it now also clears the CompositeAnimation
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        - call clear() rather than clearRenderer()
+
+2011-04-11  Justin Novosad  <junov@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [Chromium] Text anti-aliasing fails when rendering text with shadow
+        https://bugs.webkit.org/show_bug.cgi?id=57584
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::drawGlyphsWin): new static function, code factored-out
+        from WebCore::Font::drawGlyphs
+        (WebCore::Font::drawGlyphs): may separate font rendering into two
+        passes to allow foreground glyphs to be rendered with GDI when Skia 
+        is required for rendering shadows
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleDrawTextShadow):
+        Modified method so that it does not assume a shadow is present, and
+        returns true if there is no shadow (GDI can draw 'no shadow')
+        (WebCore::windowsCanHandleTextDrawing):
+        Factored out into sub methods so that the the shadow and foregound
+        glyph properties can be tested separately independently.
+        (WebCore::windowsCanHandleTextDrawingWithoutShadow):
+        New method returns true if the foreground glyph only has effect
+        that can be draw with GDI
+        (WebCore::paintSkiaText):
+        * platform/graphics/skia/SkiaFontWin.h:
+
+2011-04-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed, rolling out r83515.
+        http://trac.webkit.org/changeset/83515
+        https://bugs.webkit.org/show_bug.cgi?id=57178
+
+        Broke GTK builds. nextOnLineExists and prevOnLineExists are still used in AccessibilityObjectWrapperAtk.cpp.
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::nextOnLineExists):
+        (WebCore::InlineBox::prevOnLineExists):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+
+2011-04-11  Brady Eidson  <beidson@apple.com>
+
+        Reverting, seeing something else still broken.  Sorry.
+
+        * html/HTMLTrackElement.cpp:
+
+2011-04-11  Brady Eidson  <beidson@apple.com>
+
+        Fix the build.
+
+        * html/HTMLTrackElement.cpp: Case-sensitive, please.
+
+2011-04-11  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Unreviewed build fix for Mac.
+
+        An idl file was added in the wrong place.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2011-04-11  Chris Marrin  <cmarrin@apple.com>
+
+        Rubberstamped by Dan Bernstein.
+
+        xhr.responseType = 'arraybuffer' works on Mac but not on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=50334
+
+        Got rid of guards around arraybuffer logic in XHR. ArrayBuffer and friends
+        are always turned on now, so there's not need for the guard. I reenabled the
+        test that was Skipped on Windows and it works now.
+
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::response):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::responseArrayBuffer):
+        (WebCore::XMLHttpRequest::setResponseType):
+        (WebCore::XMLHttpRequest::send):
+        (WebCore::XMLHttpRequest::clearResponseBuffers):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::optionalResponseArrayBuffer):
+
+2011-04-11  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define + initial HTMLTrackElement
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        No new tests. No real functionality added just yet.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * features.pri:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLTagNames.in:
+        * html/HTMLTrackElement.cpp: Added.
+        (WebCore::HTMLTrackElement::HTMLTrackElement):
+        (WebCore::HTMLTrackElement::create):
+        (WebCore::HTMLTrackElement::insertedIntoTree):
+        (WebCore::HTMLTrackElement::willRemove):
+        (WebCore::HTMLTrackElement::src):
+        (WebCore::HTMLTrackElement::setSrc):
+        (WebCore::HTMLTrackElement::kind):
+        (WebCore::HTMLTrackElement::setKind):
+        (WebCore::HTMLTrackElement::srclang):
+        (WebCore::HTMLTrackElement::setSrclang):
+        (WebCore::HTMLTrackElement::label):
+        (WebCore::HTMLTrackElement::setLabel):
+        (WebCore::HTMLTrackElement::isDefault):
+        (WebCore::HTMLTrackElement::setIsDefault):
+        (WebCore::HTMLTrackElement::isURLAttribute):
+        * html/HTMLTrackElement.h: Added.
+        * html/HTMLTrackElement.idl: Added.
+
+2011-04-11  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57535
+
+        Better compile fix for Solaris 10/Sun Studio 12 CC 
+        needing <sys/time.h>
+
+        * loader/icon/IconRecord.h:
+        * page/Page.h:
+        * platform/network/ResourceResponseBase.h:
+
+2011-04-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Cannot use Ctrl-Delete as a custom keyboard shortcut
+        https://bugs.webkit.org/show_bug.cgi?id=58265
+        <rdar://problem/9221468>
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultKeyboardEventHandler): Handle Backspace.
+        (WebCore::EventHandler::defaultSpaceEventHandler): Enabled this on Mac, and added checks for
+        other modifiers - no one wants to scroll on Ctrl+Alt+Space and such.
+        (WebCore::EventHandler::defaultBackspaceEventHandler): Backspace goes back, Shift-backspace
+        goes forward. All browsers do it.
+        (WebCore::EventHandler::defaultArrowEventHandler): Assert that this function was called
+        for a correct event.
+        (WebCore::EventHandler::defaultTabEventHandler): Ditto.
+
+        * page/EventHandler.h: Added defaultBackspaceEventHandler.
+
+2011-04-11  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        [CG] drawImage with a subimage bleeds pixel data at borders
+        https://bugs.webkit.org/show_bug.cgi?id=58267
+
+        Test: fast/canvas/DrawImageSinglePixelStretch.html
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw): Any interpolation quality other than 'none' will graft out the subimage first now.
+
+2011-04-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        iframe/compositing propagation should also work for <object> and framesets
+        https://bugs.webkit.org/show_bug.cgi?id=39037
+
+        Generalized the code that handles the parenting of composited <iframe> elements
+        to include <frame> and <object> elements. This includes forcing the parent
+        element to be composited and constructing the layer tree in the child document
+        and properly parenting it. Much of the change is giving the function calls more
+        generic names (from ...IFrame... to ...Frame...)
+        
+        Compositing tests that were done in RenderIFrame have been moved to RenderPart
+        since this is the highest base class common to all 3 elements.
+        
+        I also renamed several ...IFrame... functions to
+        ...Frame... and changed them so they work on a RenderPart for determining
+        if the renderer is composited. One other detail is that <iframe> and 
+        <object> never share style since they might be composited. I had to add
+        <frame> to that list.
+
+        Tests: compositing/framesets/composited-frame-alignment.html
+               compositing/objects/composited-object-alignment.html
+
+        * css/CSSStyleSelector.cpp: Add <frame> to list of element types that should never share style since it might be composited.
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hasCompositedContentIncludingDescendants):
+        (WebCore::FrameView::setIsOverlapped):
+        * rendering/RenderIFrame.cpp: Moved methods to RenderPart
+        * rendering/RenderIFrame.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterWidgetResize):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::paintingGoesToWindow):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::frameContentsCompositor):
+        (WebCore::RenderLayerCompositor::parentFrameContentLayers):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::allowsIndependentlyCompositedFrames):
+        (WebCore::RenderLayerCompositor::shouldPropagateCompositingToEnclosingFrame):
+        (WebCore::RenderLayerCompositor::enclosingFrameElement):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForFrame):
+        (WebCore::RenderLayerCompositor::requiresScrollLayer):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::attachRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::detachRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderPart.cpp: Functions moved from RenderIFrame
+        (WebCore::RenderPart::requiresLayer):
+        (WebCore::RenderPart::requiresAcceleratedCompositing):
+        * rendering/RenderPart.h:
+
+2011-04-11  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        InlineBox::prevOnline and InlineBox::prevOnlineExists() are confusing and should be renamed
+        https://bugs.webkit.org/show_bug.cgi?id=57178
+
+        Remove prevOnLineExists() and nextOnLineExists() as they are not used anymore.
+        No new tests needed because this is cleanup only.
+
+        * rendering/InlineBox.cpp:
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::setPrevOnLine):
+
+2011-04-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58261
+
+        Fix for layout regression on marketwatch.com. When I converted TrailingFloatsRootInlineBox over
+        to the new overflow model, I messed up the math and passed a bottom value where I should have
+        passed a height value. This patch fixes the code to be logically equivalent to the way it
+        was prior to my changes.
+
+        Added fast/overflow/trailing-float-linebox.html.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2011-04-11  Adrienne Walker  <enne@google.com>
+
+        Unreviewed, rolling out r83500.
+        http://trac.webkit.org/changeset/83500
+        https://bugs.webkit.org/show_bug.cgi?id=57113
+
+        Regresses huge-layer-rotated test
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::ContentLayerChromium):
+        (WebCore::ContentLayerChromium::~ContentLayerChromium):
+        (WebCore::ContentLayerChromium::cleanupResources):
+        (WebCore::ContentLayerChromium::requiresClippedUpdateRect):
+        (WebCore::ContentLayerChromium::paintContentsIfDirty):
+        (WebCore::ContentLayerChromium::resizeUploadBuffer):
+        (WebCore::ContentLayerChromium::updateTextureIfNeeded):
+        (WebCore::ContentLayerChromium::updateTexture):
+        (WebCore::ContentLayerChromium::draw):
+        (WebCore::ContentLayerChromium::updateCompositorResources):
+        (WebCore::ContentLayerChromium::unreserveContentsTexture):
+        (WebCore::ContentLayerChromium::bindContentsTexture):
+        (WebCore::ContentLayerChromium::dumpLayerProperties):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (WebCore::ContentLayerChromium::drawsContent):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::paintContentsIfDirty):
+        (WebCore::ImageLayerChromium::updateTextureIfNeeded):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::draw):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawRootLayer):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::paintContentsRecursive):
+        (WebCore::LayerRendererChromium::copyOffscreenTextureToDisplay):
+        (WebCore::LayerRendererChromium::drawLayer):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::contentLayerProgram):
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::invalidateRect):
+        (WebCore::LayerTilerChromium::update):
+        (WebCore::LayerTilerChromium::updateFromPixels):
+        (WebCore::LayerTilerChromium::draw):
+        * platform/graphics/chromium/LayerTilerChromium.h:
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::AutoLocker::AutoLocker):
+        (WebCore::PlatformCanvas::Painter::Painter):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::draw):
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp:
+        (WebCore::CCCanvasLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.h:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp:
+        (WebCore::CCPluginLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+
+2011-04-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/9267042> Assertion failure on launch in
+        LayerChangesFlusher::setHook().
+
+        https://bugs.webkit.org/show_bug.cgi?id=58270
+
+        Reviewed by Adam Roben.
+
+        * platform/graphics/ca/win/LayerChangesFlusher.cpp:
+        (WebCore::LayerChangesFlusher::setHook):
+        MSDN says that the HINSTANCE passed in must be null if the thread ID
+        passed is a thread created by this process and the hook procedure is
+        within this process.
+
+2011-04-11  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix.
+
+        Changeset 83492 broke Leopard build.
+        https://bugs.webkit.org/show_bug.cgi?id=58268
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+
+2011-03-25  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Tile content and image layers
+        https://bugs.webkit.org/show_bug.cgi?id=57113
+
+        Layers tile by default if any dimension is larger than 512.  Smaller
+        layers are contained within a single texture but still use the tiler
+        infrastructure so that there's only one code path.
+
+        Remove large layer support from content layers.  Content layers no
+        longer own a platform canvas--they own a tiler.  Refactor tiler to
+        allow for better separation of update/upload/paint.  Add rect
+        parameter to update and draw functions on layers for the layer-space
+        rect of interest.  This is necessary to know which tiles need to be
+        drawn.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::ContentLayerChromium):
+        (WebCore::ContentLayerChromium::~ContentLayerChromium):
+        (WebCore::ContentLayerPainter::ContentLayerPainter):
+        (WebCore::ContentLayerPainter::paint):
+        (WebCore::ContentLayerChromium::paintContentsIfDirty):
+        (WebCore::ContentLayerChromium::setLayerRenderer):
+        (WebCore::ContentLayerChromium::tilingTransform):
+        (WebCore::ContentLayerChromium::visibleLayerRect):
+        (WebCore::ContentLayerChromium::layerBounds):
+        (WebCore::ContentLayerChromium::updateLayerSize):
+        (WebCore::ContentLayerChromium::draw):
+        (WebCore::ContentLayerChromium::createTilerIfNeeded):
+        (WebCore::ContentLayerChromium::updateCompositorResources):
+        (WebCore::ContentLayerChromium::setTilingOption):
+        (WebCore::ContentLayerChromium::bindContentsTexture):
+        (WebCore::ContentLayerChromium::unreserveContentsTexture):
+        (WebCore::ContentLayerChromium::setIsMask):
+        (WebCore::ContentLayerChromium::dumpLayerProperties):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (WebCore::ContentLayerChromium::drawsContent):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::paintContentsIfDirty):
+        (WebCore::ImageLayerChromium::updateCompositorResources):
+        (WebCore::ImageLayerChromium::layerBounds):
+        (WebCore::ImageLayerChromium::tilingTransform):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::invalidateRect):
+        (WebCore::LayerChromium::paintContentsIfDirty):
+        (WebCore::LayerChromium::setIsMask):
+        (WebCore::LayerChromium::draw):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawRootLayer):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::paintContentsRecursive):
+        (WebCore::LayerRendererChromium::copyOffscreenTextureToDisplay):
+        (WebCore::LayerRendererChromium::drawLayer):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::getSingleTexture):
+        (WebCore::LayerTilerChromium::invalidateRect):
+        (WebCore::LayerTilerChromium::update):
+        (WebCore::LayerTilerChromium::uploadCanvas):
+        (WebCore::LayerTilerChromium::updateFromPixels):
+        (WebCore::LayerTilerChromium::draw):
+        (WebCore::LayerTilerChromium::unreserveTextures):
+        * platform/graphics/chromium/LayerTilerChromium.h:
+        (WebCore::LayerTilerChromium::setLayerRenderer):
+        (WebCore::LayerTilerChromium::skipsDraw):
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::AutoLocker::AutoLocker):
+        (WebCore::PlatformCanvas::Painter::Painter):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::draw):
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp:
+        (WebCore::CCCanvasLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.h:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp:
+        (WebCore::CCPluginLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+
+2011-04-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Ignore context change callbacks when not on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=58256
+        <rdar://problem/9266090>
+
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
+        (WebCore::WKCACFViewLayerTreeHost::contextDidChange): Do nothing when not called
+            on the main thread. This should only happen when no changes have actually 
+            been committed to the context, eg. when a video frame has been added to an image
+            queue, so return without triggering animations etc.
+
+2011-04-11  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        [chromium] Implement image/png support in DataTransferItems
+        https://bugs.webkit.org/show_bug.cgi?id=58106
+
+        This patch implements DataTransferItem::getAsFile() using Blobs. In
+        addition, plumbing for image/png has been added so image paste will be
+        supported as long as the renderer makes that data available.
+
+        Tests: editing/pasteboard/data-transfer-items-image-png.html
+
+        * dom/DataTransferItem.h:
+        * dom/DataTransferItem.idl:
+        * platform/chromium/ClipboardMimeTypes.cpp:
+        * platform/chromium/ClipboardMimeTypes.h:
+        * platform/chromium/DataTransferItemChromium.cpp:
+        (WebCore::DataTransferItemChromium::getAsString):
+        (WebCore::DataTransferItemChromium::getAsFile):
+        * platform/chromium/DataTransferItemChromium.h:
+        * platform/chromium/PlatformBridge.h:
+
+2011-04-11  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [Gtk] Implement support for Embedded Objects
+        https://bugs.webkit.org/show_bug.cgi?id=52148
+
+        Expose special OBJECT character for replaced elements, implementing
+        AtkText and AtkHyperlink when required.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::textIteratorBehaviorForTextRange): New helper function,
+        to return the right behavior, depending on the platform, so it
+        ensures that object replacement characters get emitted for GTK.
+        (WebCore::AccessibilityRenderObject::textUnderElement): Use the
+        new helper function textIteratorBehaviorForTextRange.
+        (WebCore::AccessibilityRenderObject::stringValue): Ditto.
+        (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+        Consider replaced elements when calculating range length in GTK.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (textForRenderer): Ouput the 'object replacement character' for
+        replaced objects.
+        (getSelectionOffsetsForObject): Consider replaced elements when
+        calculating range length in GTK.
+        (webkitAccessibleHypertextGetLink): Remove wrong extra check that
+        were causing only links to be considered.
+        (webkitAccessibleHypertextGetNLinks): Replace wrong 'isLink()'
+        check with the right one, by checking that the right ATK interface
+        is being implemented by the AtkObject.
+        (getInterfaceMaskFromObject): Implement the Hyperlink interface
+        both for links and replaced objects.
+        (objectAndOffsetUnignored): Consider replaced elements when
+        calculating range length in GTK.
+
+        * accessibility/gtk/WebKitAccessibleHyperlink.cpp:
+        (getRangeLengthForObject): Ensure spaces are used for replaced
+        elements when calling to TextIterator::rangeLength().
+
+        * editing/TextIterator.h: New value in the TextIteratorBehavior
+        enumeration (TextIteratorEmitsObjectReplacementCharacters) and new
+        private variable to consider that new option internally.
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::TextIterator): Initialize the new private
+        attribute m_emitsObjectReplacementCharacters in constructors.
+        (WebCore::TextIterator::handleReplacedElement): Emit the 'object
+        replacement character' when m_emitsObjectReplacementCharacters.
+
+2011-04-11  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Shouldn't carry out autocorrection when start typing a new word
+        https://bugs.webkit.org/show_bug.cgi?id=58241
+        <rdar://problem/9264736>
+
+        Tests: platform/mac/editing/spelling/autocorrection-at-beginning-of-word-1.html
+               platform/mac/editing/spelling/autocorrection-at-beginning-of-word-2.html
+
+        In TypingCommand::markMisspellingsAfterTyping(), we want to call Editor::markMisspellingsAfterTypingToWord()
+        only when the typing command is an insertion command, and preceding word contains at least one non-whitespace
+        character.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+
+2011-04-11  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        PerformanceTiming returns inconsistent values when timing is null.
+        https://bugs.webkit.org/show_bug.cgi?id=58143
+
+        Made PerformanceTiming returned values consistent when there is no timing object.
+
+        * page/PerformanceTiming.cpp:
+        (WebCore::PerformanceTiming::domainLookupStart):
+        (WebCore::PerformanceTiming::domainLookupEnd):
+        (WebCore::PerformanceTiming::connectStart):
+        (WebCore::PerformanceTiming::connectEnd):
+        (WebCore::PerformanceTiming::requestStart):
+        (WebCore::PerformanceTiming::responseStart):
+        (WebCore::PerformanceTiming::domLoading):
+
+2011-04-05  Stephen White  <senorblanco@chromium.org>
+
+        Fix for jittering when animating a rotated image.
+        https://bugs.webkit.org/show_bug.cgi?id=50775
+
+        Make GraphicsContext::roundToDevicePixels a no-op on Chrome/Mac.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels):
+
+2011-04-06  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Continue experiment with moving caret by word in visual order.
+        https://bugs.webkit.org/show_bug.cgi?id=57806
+
+        This is the 2nd patch, which adds implementation when caret is inside box
+        (not at boundaries). If the word break is inside the same box and not at the boundaries
+        either, the word break will be returned. If need to search the adjacent boxes for word
+        breaks, then, only the cases implemented in bug 57336 work.
+
+        * editing/visible_units.cpp:
+        (WebCore::leftmostPositionInRTLBoxInLTRBlock):
+        (WebCore::rightmostPositionInLTRBoxInRTLBlock):
+        (WebCore::lastWordBreakInBox):
+        (WebCore::positionIsVisuallyOrderedInBoxInBlockWithDifferentDirectionality):
+        (WebCore::nextWordBreakInBoxInsideBlockWithDifferentDirectionality):
+        (WebCore::WordBoundaryEntry::WordBoundaryEntry):
+        (WebCore::collectWordBreaksInBoxInsideBlockWithSameDirectionality):
+        (WebCore::collectWordBreaksInBoxInsideBlockWithDifferntDirectionality):
+        (WebCore::greatestValueUnder):
+        (WebCore::smallestOffsetAbove):
+        (WebCore::positionIsInsideBox):
+        (WebCore::positionBeforeNextWord):
+        (WebCore::positionAfterPreviousWord):
+        (WebCore::leftWordPosition):
+        (WebCore::rightWordPosition):
+
+2011-04-11  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [GTK] Unskip accessibility/input-slider.html and accessibility/media-element.html
+        https://bugs.webkit.org/show_bug.cgi?id=58040
+
+        Don't expose objects of role SliderThumbRoles in GTK.
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::addChildren): Allow the platform
+        make a final decision before including children in the hierarchy.
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        Implemented by relying on accessibilityPlatformIncludesObject().
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ignore accessibility objects with role SliderThumbRole.
+
+2011-04-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Divide by zero in calcColumnWidth
+        https://bugs.webkit.org/show_bug.cgi?id=58230
+
+        Test: fast/multicol/huge-column-count.html
+        
+        Make sure we have at least one column, to avoid divide by zero.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcColumnWidth):
+
+2011-04-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 58198 - Clean up JSValue implementation for JSVALUE64
+
+        JSNumberCell.h has been deprecated.
+
+        * ForwardingHeaders/runtime/JSNumberCell.h: Removed.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/c_instance.cpp:
+
+2011-04-11  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::State::State):
+
+2011-04-11  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Tony Gentilcore.
+
+        Document source preload scanned repeatedly
+        https://bugs.webkit.org/show_bug.cgi?id=58123
+        
+        Don't clear the preload scanner after execution resumes. This would lose the current
+        scanning point and lead to rescanning when the preload scanner would get reconstructed
+        due to main parser blocking again.
+
+        Instead clear the scanner only in the specific case of receiving new data while the main
+        parser has already reached the end of the current input.
+
+        Also switched to using isWaitingForScripts() instead of m_treeBuilder->isPaused() for consistency.
+
+        The case the clearing in resumeParsingAfterScriptExecution() was added for is covered by 
+        http/tests/loading/preload-slow-loading.php.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::insert):
+        (WebCore::HTMLDocumentParser::append):
+        (WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution):
+
+2011-04-11  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::State::State):
+
+2011-04-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Assertion failure in CanvasRenderingContext2D::State::fontsNeedUpdate when invalidating the font cache after opening canvas/philip/tests/initial.reset.2dstate.html (occurs on Qt debug test bot)
+        https://bugs.webkit.org/show_bug.cgi?id=58229
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::State::State): Added copy constructor, to register the copy with
+        the font selector if needed.
+        (WebCore::CanvasRenderingContext2D::State::operator=): Added assignment constructor, to handle
+        registration with the font selector as needed.
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2011-04-11  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [GTK] ARIA tables not exposing cells as HTML tables do
+        https://bugs.webkit.org/show_bug.cgi?id=57463
+
+        Expose cells for ARIA grids consistently with HTML tables in GTK,
+        keeping the same behaviour for the other platforms.
+
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::addChild): Add the row's children
+        to the accessibility hierarchy when accessibility objects for rows
+        are ignoring accessibility, otherwise add the row.
+        (WebCore::AccessibilityARIAGrid::addChildren): Do not check at
+        this point whether every child of the table ignores or not
+        accessibility, letting addChild() make the proper decision later.
+
+        * accessibility/AccessibilityARIAGridCell.cpp:
+        (WebCore::AccessibilityARIAGridCell::parentTable): Consider that
+        rows could be ignoring accessibility, hence the parent could be
+        retrieved in the first call to parentObjectUnignored().
+        (WebCore::AccessibilityARIAGridCell::rowIndexRange): Ditto.
+        (WebCore::AccessibilityARIAGridCell::columnIndexRange): Ditto..
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole): Map ColumnHeader and RowHeader to ATK_ROLE_TABLE_CELL.
+
+2011-04-11  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix make distcheck
+        https://bugs.webkit.org/show_bug.cgi?id=58224
+
+        Removed a file that is no longer in the source tree.
+
+        * GNUmakefile.list.am:
+
+2011-04-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Martin Robinson.
+
+        REGRESSION(r83397): Most GTK media controls are hidden when no valid source is specified
+        https://bugs.webkit.org/show_bug.cgi?id=58204
+
+        Covered by existing tests.
+
+        * platform/gtk/RenderThemeGtk.h:
+        (WebCore::RenderThemeGtk::hasOwnDisabledStateHandlingFor): Let GTK handle
+            the the state of media controls.
+
+2011-04-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Remove obsolete comment, which was mistakenly landed in r83397.
+
+        Though potentially a work of art, the comment lost its functional meaning a long time ago.
+
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::create): Removed comment.
+
+2011-04-05  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Steve Block.
+
+        IndexedDB: Introduce skeleton for LevelDB backend
+        https://bugs.webkit.org/show_bug.cgi?id=57827
+
+        No new tests: no new functionality (yet).
+
+        * WebCore.gyp/WebCore.gyp:
+            Add dependency on leveldb when ENABLE_LEVELDB=1 in feature_defines.
+        * WebCore.gypi:
+            Add new files.
+        * storage/IDBBackingStore.h:
+        (WebCore::IDBBackingStore::ObjectStoreRecordIdentifier::~ObjectStoreRecordIdentifier):
+            Introduce abstract type ObjectStoreRecordIdentifier. The SQLite
+            backend uses integers to refer to a specific row in a table, but
+            the LevelDB backend will use something else.
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::createObjectStoreInternal):
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStoreInternal):
+        (WebCore::IDBDatabaseBackendImpl::loadObjectStores):
+            Change functions to pass along the database id for operations that
+            concern object stores. We want to be able to group object stores
+            ids per database.
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::open):
+            Decide which backend to use based on the backingStoreType
+            parameter.
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::IDBIndexBackendImpl):
+        (WebCore::IDBIndexBackendImpl::openCursorInternal):
+        (WebCore::IDBIndexBackendImpl::getInternal):
+        (WebCore::IDBIndexBackendImpl::addingKeyAllowed):
+        * storage/IDBIndexBackendImpl.h:
+        (WebCore::IDBIndexBackendImpl::create):
+            Pass database and object store id to backend functions concerning
+            indexes.
+        * storage/IDBLevelDBBackingStore.cpp: Added.
+        (WebCore::IDBLevelDBBackingStore::IDBLevelDBBackingStore):
+        (WebCore::IDBLevelDBBackingStore::~IDBLevelDBBackingStore):
+        (WebCore::IDBLevelDBBackingStore::open):
+        (WebCore::IDBLevelDBBackingStore::extractIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::setIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::getObjectStores):
+        (WebCore::IDBLevelDBBackingStore::createObjectStore):
+        (WebCore::IDBLevelDBBackingStore::deleteObjectStore):
+        (WebCore::IDBLevelDBBackingStore::getObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::putObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::clearObjectStore):
+        (WebCore::IDBLevelDBBackingStore::deleteObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::nextAutoIncrementNumber):
+        (WebCore::IDBLevelDBBackingStore::keyExistsInObjectStore):
+        (WebCore::IDBLevelDBBackingStore::forEachObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::getIndexes):
+        (WebCore::IDBLevelDBBackingStore::createIndex):
+        (WebCore::IDBLevelDBBackingStore::deleteIndex):
+        (WebCore::IDBLevelDBBackingStore::putIndexDataForRecord):
+        (WebCore::IDBLevelDBBackingStore::deleteIndexDataForRecord):
+        (WebCore::IDBLevelDBBackingStore::getObjectViaIndex):
+        (WebCore::IDBLevelDBBackingStore::getPrimaryKeyViaIndex):
+        (WebCore::IDBLevelDBBackingStore::keyExistsInIndex):
+        (WebCore::IDBLevelDBBackingStore::openObjectStoreCursor):
+        (WebCore::IDBLevelDBBackingStore::openIndexKeyCursor):
+        (WebCore::IDBLevelDBBackingStore::openIndexCursor):
+        (WebCore::IDBLevelDBBackingStore::createTransaction):
+        * storage/IDBLevelDBBackingStore.h: Added.
+            Add an empty implementation of the LevelDB backend.
+        * storage/IDBObjectStoreBackendImpl.cpp:
+            Keep track of database id, use the new RecordIdentifier.
+        (WebCore::IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl):
+        (WebCore::IDBObjectStoreBackendImpl::getInternal):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        (WebCore::IDBObjectStoreBackendImpl::clearInternal):
+        (WebCore::populateIndex):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
+        (WebCore::IDBObjectStoreBackendImpl::loadIndexes):
+        (WebCore::IDBObjectStoreBackendImpl::genAutoIncrementKey):
+        * storage/IDBObjectStoreBackendImpl.h:
+        (WebCore::IDBObjectStoreBackendImpl::create):
+        (WebCore::IDBObjectStoreBackendImpl::databaseId):
+        * storage/IDBSQLiteBackingStore.cpp:
+        (WebCore::IDBSQLiteBackingStore::open):
+        (WebCore::IDBSQLiteBackingStore::createObjectStore):
+        (WebCore::IDBSQLiteBackingStore::deleteObjectStore):
+        (WebCore::IDBSQLiteBackingStore::getObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::putObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::clearObjectStore):
+        (WebCore::IDBSQLiteBackingStore::deleteObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::nextAutoIncrementNumber):
+        (WebCore::IDBSQLiteBackingStore::keyExistsInObjectStore):
+        (WebCore::IDBSQLiteBackingStore::forEachObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::getIndexes):
+        (WebCore::IDBSQLiteBackingStore::createIndex):
+        (WebCore::IDBSQLiteBackingStore::deleteIndex):
+        (WebCore::IDBSQLiteBackingStore::putIndexDataForRecord):
+        (WebCore::IDBSQLiteBackingStore::deleteIndexDataForRecord):
+        (WebCore::IDBSQLiteBackingStore::getObjectViaIndex):
+        (WebCore::IDBSQLiteBackingStore::getPrimaryKeyViaIndex):
+        (WebCore::IDBSQLiteBackingStore::keyExistsInIndex):
+        (WebCore::IDBSQLiteBackingStore::openObjectStoreCursor):
+        (WebCore::IDBSQLiteBackingStore::openIndexKeyCursor):
+        (WebCore::IDBSQLiteBackingStore::openIndexCursor):
+        * storage/IDBSQLiteBackingStore.h:
+
+2011-04-11  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Duplicate CSS properties are reported for non-lowercase property names in the Styles sidebar
+        https://bugs.webkit.org/show_bug.cgi?id=58226
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::populateAllProperties):
+
+2011-04-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: get rid of source frame delegates for resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=58041
+
+        Use TextViewer configured with a domain-specific delegate to show/edit resource contents in resources panel.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.createResourceView):
+        (WebInspector.ResourceView.resourceViewTypeMatchesResource):
+        (WebInspector.ResourceSourceFrame):
+        (WebInspector.ResourceSourceFrame.prototype.get resource):
+        (WebInspector.ResourceSourceFrame.prototype.contentEditable):
+        (WebInspector.ResourceSourceFrame.prototype._requestContent):
+        (WebInspector.CSSSourceFrame):
+        (WebInspector.CSSSourceFrame.prototype.contentEditable):
+        (WebInspector.CSSSourceFrame.prototype._editContent):
+        (WebInspector.CSSSourceFrame.prototype._editContent.handleInfos):
+        (WebInspector.CSSSourceFrame.prototype._saveStyleSheet):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._ensureContentLoaded):
+        (WebInspector.SourceFrame.prototype._requestContent):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._editContent):
+
+2011-04-11  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Regression : r83051 Oxygen's lineedits are not rendered properly
+        https://bugs.webkit.org/show_bug.cgi?id=58076
+
+        State_Sunken is more generic than pressed. It is used by items such as frames or
+        line edits because they are "sunken" frames (e.g. QLineEdit). It can be required
+        by some style like Oxygen. Therefore only in the mobile theme we check if the object
+        is pressed.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintTextField):
+
+2011-04-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add support for optional output parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=58207
+
+        Output parameters such as "redirectResponse" are optional, but
+        do not allow specifying them as such.
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForResourceResponse):
+        (WebCore::buildObjectForCachedResource):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithResponse):
+        * inspector/generate-inspector-idl:
+
+2011-04-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor / document call frames in debugger domain.
+        https://bugs.webkit.org/show_bug.cgi?id=58187
+
+        Note that we are not special casing with(element) and with(document) anymore
+        and do not tell user that it is "Event target" and "Event document". Strictly speaking,
+        we should not have done it for with(element) not necessarily being related to an event.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InjectedScriptSource.js:
+        * inspector/Inspector.json:
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2011-04-10  ChangSeok Oh  <shivamidow@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Make correspondence of file name related with event to other port.
+        https://bugs.webkit.org/show_bug.cgi?id=57416
+
+        Some file names are changed to make correspondence naming rule.
+        Keyboard, mouse and wheel event file names for GTK port have been different from other ports.
+        This has made user hard to find a specific file related with event for GTK port. 
+
+        No test required. This patch just changes some file names.
+
+        * GNUmakefile.list.am:
+        * platform/gtk/KeyEventGtk.cpp: Removed.
+        * platform/gtk/MouseEventGtk.cpp: Removed.
+        * platform/gtk/PlatformKeyboardEventGtk.cpp: Added.
+        * platform/gtk/PlatformMouseEventGtk.cpp: Added.
+        * platform/gtk/PlatformWheelEventGtk.cpp: Added.
+        * platform/gtk/WheelEventGtk.cpp: Removed.
+
+2011-04-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Revert the FloatRect.cpp part of r83422, since
+        clampToInteger() is broken for some inputs. I filed
+        https://bugs.webkit.org/show_bug.cgi?id=58216
+
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::safeFloatToInt):
+        (WebCore::enclosingIntRect):
+
+2011-04-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Car model dropdowns at audiusa.com lay out incorrectly with compositing enabled
+        https://bugs.webkit.org/show_bug.cgi?id=56660
+        
+        When overflow on an element changes, we need to inform compositing
+        layers which create and position an "ancestor clipping" layer based
+        on that overflow. Do this by triggering a rebuild of compositing layers
+        when overflow changes on a layer whose stacking context has compositing
+        descendants. (We can't just check whether the layer itself has compositing
+        descendants, because overflow follows the render tree, but compositing
+        follows the z-order tree.)
+
+        Test: compositing/geometry/ancestor-overflow-change.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2011-04-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Allow ShadowBlur to re-use the last buffer if it already contains the correct shadow
+        https://bugs.webkit.org/show_bug.cgi?id=58161
+        
+        ShadowBlur already has a singleton scratch buffer that is re-used
+        between shadows. Enhance use of this scratch buffer to avoid drawing
+        and blurring the shadow if the results will match what is already
+        in the buffer.
+        
+        Cleaned up ShadowBlur code to remove beginShadowLayer() and endShadowLayer(),
+        which ended up with little reusable code after adding the re-use logic.
+
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::enclosingIntRect): Replace safeFloatToInt() with the existing
+        clampToInteger() from MathExtras.h
+        
+        * platform/graphics/FloatSize.h:
+        (WebCore::expandedIntSize): New method to safely ceil() the size.
+        
+        * platform/graphics/RoundedIntRect.h:
+        Add operator== for Radii and RoundedIntRect.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ScratchBuffer::ScratchBuffer):
+        (WebCore::ScratchBuffer::setLastShadowValues):
+        (WebCore::ScratchBuffer::setLastInsetShadowValues):
+        (WebCore::ScratchBuffer::matchesLastShadow):
+        (WebCore::ScratchBuffer::matchesLastInsetShadow):
+        (WebCore::ScratchBuffer::clearScratchBuffer):
+        Have the scratch buffer remember what shadow parameters were used
+        to render the buffer contents.
+        
+        (WebCore::ShadowBlur::drawShadowBuffer):
+        Renamed from endShadowLayer(), and only contains the drawing
+        logic now.
+        
+        (WebCore::ShadowBlur::drawRectShadow):
+        Promote some code from beginShadowLayer().
+        
+        (WebCore::ShadowBlur::drawInsetShadow):
+        Promote some code from beginShadowLayer().
+
+        (WebCore::ShadowBlur::drawRectShadowWithoutTiling):
+        (WebCore::ShadowBlur::drawInsetShadowWithoutTiling):
+        (WebCore::ShadowBlur::drawInsetShadowWithTiling):
+        (WebCore::ShadowBlur::drawRectShadowWithTiling):
+        These methods now check to see if the buffer already matches
+        their required parameters, and avoid work if it does.
+        
+        (WebCore::ShadowBlur::blurShadowBuffer):
+        Factored some code into this new method.
+        
+        (WebCore::ShadowBlur::blurAndColorShadowBuffer):
+        Minor refactoring.
+
+        * platform/graphics/ShadowBlur.h:
+
+2011-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Updated for file move.
+
+        * bindings/js/GCController.cpp:
+        * bindings/js/ScriptGCEvent.cpp:
+
+2011-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Beth Dakin.
+
+        Moved Heap.h and Heap.cpp to the heap folder, because anything less 
+        would be uncivilized.
+
+        * ForwardingHeaders/heap/Heap.h: Copied from WebCore/ForwardingHeaders/runtime/Heap.h.
+        * ForwardingHeaders/runtime/Heap.h: Removed.
+
+2011-04-10  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Rename CSSStyleApplyProperty::inherit,initial,value applyInheritValue,applyInitialValue,applyValue
+        https://bugs.webkit.org/show_bug.cgi?id=58212
+
+        No new tests - function renaming only / no functionality changes.
+
+        * css/CSSStyleApplyProperty.cpp:
+        Rename all instances of inherit, initial and value.
+        * css/CSSStyleApplyProperty.h:
+        Rename all instances of inherit, initial and value.
+        * css/CSSStyleSelector.cpp:
+        Rename all instances of inherit, initial and value.
+
+2011-04-10  Mike Lawther  <mikelawther@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        flex/bison tokens and grammar for CSS calc
+        https://bugs.webkit.org/show_bug.cgi?id=54412
+
+        Tests: css3/calc/calc-errors.html
+               css3/calc/lexer-regression-57581-2.html
+               css3/calc/lexer-regression-57581-3.html
+               css3/calc/lexer-regression-57581.html
+               css3/calc/minmax-errors.html
+               css3/calc/nested-rounded-corners.html
+               css3/calc/simple-calcs.html
+               css3/calc/simple-minmax.html
+
+        * css/CSSGrammar.y:
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValueList::insertValueAt):
+        (WebCore::CSSParserValueList::extend):
+        * css/CSSParserValues.h:
+        * css/tokenizer.flex:
+
+2011-04-10  Alice Boxhall  <aboxhall@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Change EventHandler::updateSelectionForMouseDrag to take a HitTestResult only.
+        https://bugs.webkit.org/show_bug.cgi?id=57923
+
+        Change EventHandler::updateSelectionForMouseDrag to take a HitTestResult
+        rather than a Node* and an IntPoint&, as the selection may actually not
+        extend into the Node found by the HitTest.
+
+        No new tests. Refactoring only.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        * page/EventHandler.h:
+
+2011-04-10  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, rolling out r83353.
+        http://trac.webkit.org/changeset/83353
+        https://bugs.webkit.org/show_bug.cgi?id=58106
+
+        The new test doesn't pass on all Chromium platforms.
+
+        * dom/DataTransferItem.h:
+        * dom/DataTransferItem.idl:
+        * platform/chromium/ClipboardMimeTypes.cpp:
+        * platform/chromium/ClipboardMimeTypes.h:
+        * platform/chromium/DataTransferItemChromium.cpp:
+        (WebCore::DataTransferItemChromium::getAsString):
+        * platform/chromium/DataTransferItemChromium.h:
+        * platform/chromium/PlatformBridge.h:
+
+2011-04-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Eric Carlson.
+
+        [EFL] Add seek forward / backward buttons to MediaControl UI.
+        https://bugs.webkit.org/show_bug.cgi?id=56810
+
+        Add seek forward / backward buttons to media control. And, change formType name
+        for media control.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
+        (WebCore::RenderThemeEfl::emitMediaButtonSignal):
+        (WebCore::RenderThemeEfl::paintMediaMuteButton):
+        (WebCore::RenderThemeEfl::paintMediaPlayButton):
+        (WebCore::RenderThemeEfl::paintMediaSeekBackButton):
+        (WebCore::RenderThemeEfl::paintMediaSeekForwardButton):
+        * platform/efl/RenderThemeEfl.h:
+
+2011-04-10  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Remove unused function declaration in PlatformContextSkia.h.
+        https://bugs.webkit.org/show_bug.cgi?id=55983
+
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2011-04-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for !ENABLE(XSLT) after r82562.
+
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::doEnd):
+
+2011-04-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for !ENABLE(XSLT) after r82562.
+
+        * xml/XMLTreeViewer.cpp: Readded #if ENABLE(XSLT).
+
+2011-04-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION(r83256): Text-decoration bleeds into shadow DOM
+        https://bugs.webkit.org/show_bug.cgi?id=58205
+
+        Now that the shadow root is a never-styled element, we need to walk to
+        parent to find out if we're inside of a shadow DOM subtree.
+
+        Test: media/controls-styling.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::isAtShadowBoundary): Added helper function.
+        (WebCore::CSSStyleSelector::adjustRenderStyle): Changed to use the helper.
+
+2011-04-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        [Meta] Convert HTMLMediaElement to use the new shadow DOM
+        https://bugs.webkit.org/show_bug.cgi?id=53020
+
+        This conversion is non-trivial, for several reasons:
+
+        1) Since HTMLMediaElement now hosts the shadow DOM for controls, hiding
+        and showing controls does not result in destroying and re-creating the
+        shadow DOM tree. Instead, the tree is created as needed and shown/hidden
+        using inline styles.
+        
+        2) Instead of detaching/attaching on each style change, the control parts
+        are now using a set of higher fidelity callbacks that notify MediaControls
+        about changes to which it should react. Each reaction results in hiding,
+        showing, or changing the state of the control parts using inline styles
+        and DOM APIs.
+
+        3) Hiding and showing controls is accomplished using inline styles, rather
+        than wiring rendererIsNeeded, because renderers are now re-created less
+        frequently.
+
+        4) Instead of constantly querying RenderTheme about visibility of a particular
+        control part, we let the theme determine which parts are supported and
+        which parts are visible in certain conditions.
+
+        5) Custom hit-testing, event forwarding, and style updates are completely
+        removed, since they are now unnecessary.
+
+        6) Fading controls in/out is now done as CSS animation, since shadow DOM
+        supports it.
+
+        Test: manual-tests/media-controls.html
+
+2011-04-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/9215280> Detached canvas draws with incorrect font
+
+        Test: fast/canvas/font-update.html
+
+        The existing mechanism for updating the font in a canvas 2D context was lacking in at least
+        two ways: it neglected to update fonts in all but the topmost state in the stack, and since it
+        was based on HTMLCanvasElemen's attach() and recalcStyle(), it did not work when the element
+        was not attached.
+
+        This change takes the responsibility for font updates away from the canvas element and gives it
+        to the canvas context and its graphics state.
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::registerForInvalidationCallbacks): Added. Adds to the set of registered
+        font selector clients.
+        (WebCore::CSSFontSelector::unregisterForInvalidationCallbacks): Added. Removes from the set of
+        registered font selector clients.
+        (WebCore::CSSFontSelector::dispatchInvalidationCallbacks): Calls fontsNeedUpdate() on all registered
+        clients and forces a style recalc on the document.
+        (WebCore::CSSFontSelector::fontLoaded): Changed to call dispatchInvalidationCallbacks().
+        (WebCore::CSSFontSelector::fontCacheInvalidated): Ditto.
+        * css/CSSFontSelector.h:
+        * html/HTMLCanvasElement.cpp: Removed overrides of attach() and recalcStyle().
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::State::~State): Added. Unregisters with the font selector.
+        (WebCore::CanvasRenderingContext2D::State::fontsNeedUpdate): Added. Called by the font selector
+        when its fonts need to be updated. Updates the font.
+        (WebCore::CanvasRenderingContext2D::setFont): Registers the state with the font selector.
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/FontSelector.h:
+        (WebCore::FontSelectorClient::~FontSelectorClient):
+
+2011-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try recommitting some things svn left out of my last commit.
+
+        * bridge/qt/qt_runtime.h:
+
+2011-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try recommitting some things svn left out of my last commit.
+
+        * ForwardingHeaders/collector: Removed.
+        * ForwardingHeaders/collector/handles: Removed.
+        * ForwardingHeaders/collector/handles/Global.h: Removed.
+
+2011-04-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Implement proper handling of mouseover/mouseout events in regard to shadow DOM boundaries.
+        https://bugs.webkit.org/show_bug.cgi?id=55515
+
+        This implements XBL 2.0's specified handling of mouseover/mouseout events:
+        http://dev.w3.org/2006/xbl2/Overview.html#the-mouseover-and-mouseout-events
+
+        To do this, we:
+        1) calculate lowest common ancestor between relatedTarget and target, and
+           the nearest boundaries around them: the outer (common) boundary, and the
+           inner (specific to relatedTarget) boundary. Then, we
+        2) ensure that events only propagate up to the common boundary (or
+           all the way if boundary is not found), while
+        3) updating relatedTarget be the inner boundary.
+
+        We also detect the most common case when no common boundary could exist
+        and provide a fast path to short-circuit most of the boundary detection
+        logic.
+
+        Test: fast/events/shadow-boundary-crossing.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::adjustToShadowBoundaries): Added a helper to determine lowest
+            common ancestor, the boundaries around it, and compute adjustments
+            to relatedTarget and event target ancestor chain.
+        (WebCore::ancestorsCrossShadowBoundaries): Added.
+        (WebCore::EventDispatcher::adjustRelatedTarget): Changed to calculate
+            inner/outer shadow DOM boundaries and adjust ancestors chain accordingly.
+        (WebCore::EventDispatcher::EventDispatcher): Added flag initializer
+        (WebCore::EventDispatcher::ensureEventAncestors): Renamed from getEventAncestors,
+            converted to use initialization flag, rather than testing for empty.
+        * dom/EventDispatcher.h: Adjusted decls.
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEventDispatchMediator::dispatchEvent): Changed to send event
+            to adjustRelatedTarget.
+
+2011-04-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A few heap-related renames and file moves.
+        
+        WeakGCPtr<T> => Weak<T>
+        Global<T> => Strong<T>
+        collector/ => heap/
+        collector/* => heap/*
+        runtime/WeakGCPtr.h => heap/Weak.h
+        
+        (Eventually, even more files should move into the heap directory. Like
+        Heap.h and Heap.cpp, for example.)
+
+        * CMakeLists.txt:
+        * ForwardingHeaders/collector: Removed.
+        * ForwardingHeaders/heap: Copied from ForwardingHeaders/collector.
+        * ForwardingHeaders/heap/Strong.h: Copied from ForwardingHeaders/collector/handles/Global.h.
+        * ForwardingHeaders/heap/Weak.h: Copied from ForwardingHeaders/runtime/WeakGCPtr.h.
+        * ForwardingHeaders/runtime/WeakGCPtr.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * bindings/js/JSCallbackData.h:
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDataGridDataSource.h:
+        * bindings/js/JSEventListener.h:
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createWindowShell):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptState.h:
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/js/ScriptWrappable.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        * bindings/js/WorkerScriptController.h:
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime_root.h:
+        * xml/XMLHttpRequest.cpp:
+
+2011-04-09  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Don't link against fontconfig or X11 if embedded
+        https://bugs.webkit.org/show_bug.cgi?id=58104
+
+        No functional change so no new tests.
+
+        * WebCore.pri: qpa=>embedded should be done very early so all cases of embedded are uniform.
+
+2011-04-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed trivial fix after r83344.
+
+        * WebCore.pro: Update HEADERS list.
+
+2011-04-09  Jon Lee  <jonlee@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Overlay scrollbar flashes in scrollable <textarea> with each keystroke (58180)
+        https://bugs.webkit.org/show_bug.cgi?id=58180
+        <rdar://problem/9047984>
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::immediateScrollToPoint): Check that there is a change before submitting
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaX):
+        (WebCore::ScrollAnimatorMac::immediateScrollByDeltaY):
+
+2011-04-09  Sreeram Ramachandran  <sreeram@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        Gather data on modal dialogs shown during unload events
+        https://bugs.webkit.org/show_bug.cgi?id=58115
+
+        Add a new method to the ChromeClient API to allow clients to receive
+        notifications of modal dialogs dispatched during page dismissal events.
+        The new method has a default empty definition; only chromium overrides
+        it to keep track of histograms.
+
+        No tests because this is a no-op for all ports except chromium (and it's
+        not clear how to test chromium histograms from webkit).
+
+        * page/Chrome.cpp:
+        (WebCore::isDuringPageDismissal):
+        (WebCore::willRunModalDialog):
+        (WebCore::Chrome::runJavaScriptAlert):
+        (WebCore::Chrome::runJavaScriptConfirm):
+        (WebCore::Chrome::runJavaScriptPrompt):
+        (WebCore::Chrome::willRunModalHTMLDialog):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::willRunModalDialogDuringPageDismissal):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::showModalDialog):
+
+2011-04-08  David Humphrey  <david.humphrey@senecac.on.ca>
+
+        Reviewed by Eric Carlson.
+
+        Fix call order of media element muted and play(), such that setting muted before play() works.
+        https://bugs.webkit.org/show_bug.cgi?id=57673
+        https://code.google.com/p/chromium/issues/detail?id=70777
+
+        Manual test added: manual-tests/media-muted.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::updatePlayState):
+        * manual-tests/media-muted.html: Added.
+
+2011-04-08  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Fix windows assertion on ~CCThread
+        https://bugs.webkit.org/show_bug.cgi?id=58153
+
+        Because ~CCThread uses waitForThreadCompletion,
+        calling detachThread is not necessary.
+
+        * platform/graphics/chromium/cc/CCThread.cpp:
+        (WebCore::CCThread::runLoop):
+
+2011-04-08  Jian Li  <jianli@chromium.org>
+
+        Unreviewed, rolling out r83348.
+        http://trac.webkit.org/changeset/83348
+        https://bugs.webkit.org/show_bug.cgi?id=49508
+
+        Breaks layout tests in QT, Win7 and Chromium.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+
+2011-04-08  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Simon Fraser.
+
+        Negative spread should not make a sharp corner rounded
+        https://bugs.webkit.org/show_bug.cgi?id=58162
+
+        Handled inset shadow path for rounded and non-rounded rect
+        differently as normal shadow path is doing.
+        
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+
+2011-04-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Martin Robinson.
+
+        REGRESSION (r77034-r77220): CSS box-shadow no longer renders on PowerPC
+        https://bugs.webkit.org/show_bug.cgi?id=55180
+
+        The endianness #ifdef in ShadowBlur was unnecessary and harmful. The
+        data we get back from ImageBuffer::getImageData() do not vary in
+        endianness.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::blurLayerImage):
+
+2011-04-08  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        IFrame is getting the focus even though it is hidden
+        https://bugs.webkit.org/show_bug.cgi?id=55861
+
+        Test: fast/dom/hidden-iframe-no-focus.html
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::isKeyboardFocusable):
+        * html/HTMLFrameOwnerElement.h:
+
+2011-04-08  Jeff Timanus  <twiz@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Fall back to software rendering for Canvas2D when requesting a DrawingBuffer larger than supported by the GL environment.
+        https://bugs.webkit.org/show_bug.cgi?id=57768
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::reset):
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        (WebCore::DrawingBuffer::reset):
+        * platform/graphics/gpu/DrawingBuffer.h:
+
+2011-04-08  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        [chromium] Implement image/png support in DataTransferItems
+        https://bugs.webkit.org/show_bug.cgi?id=58106
+
+        This patch implements DataTransferItem::getAsFile() using Blobs. In
+        addition, plumbing for image/png has been added so image paste will be
+        supported as long as the renderer makes that data available.
+
+        Tests: editing/pasteboard/data-transfer-items-image-png.html
+
+        * dom/DataTransferItem.h:
+        * dom/DataTransferItem.idl:
+        * platform/chromium/ClipboardMimeTypes.cpp:
+        * platform/chromium/ClipboardMimeTypes.h:
+        * platform/chromium/DataTransferItemChromium.cpp:
+        (WebCore::DataTransferItemChromium::getAsString):
+        (WebCore::DataTransferItemChromium::getAsFile):
+        * platform/chromium/DataTransferItemChromium.h:
+        * platform/chromium/PlatformBridge.h:
+
+2011-04-08 MORITA Hajime  <morrita@google.com>
+
+        Unreviewed windows build fix.
+        
+        * editing/SpellingCorrectionController.h:
+        (WebCore::SpellingCorrectionController::UNLESS_ENABLED):
+
+2011-04-08  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Improve lifetime management of nodes in ReplaceNodeWithSpanCommand.
+        https://bugs.webkit.org/show_bug.cgi?id=57595
+        <rdar://problem/9222122>
+
+        Test: editing/style/bold-with-dom-changes.html
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+
+2011-04-07  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 58060 - Prepare access to TreeScope from Node, using NodeRareData
+        https://bugs.webkit.org/show_bug.cgi?id=58060
+
+        Add a TreeScope pointer to NodeRareData to allow direct access to the containing tree scope.
+        However, in case the containing scope is the document, this is not set, and the
+        document pointer within Node is used instead.
+
+        In an object derived from TreeScope (currently Document), the tree scope pointer
+        points to itself. Such objects also contain a parent tree scope pointer that
+        points to the containing scope. For Document, this is 0.
+
+        Add new functions setTreeScope[Recursively] that replace setDocument[Recursively]
+        in public usage. setDocument[Recursively] are now only used internally and are
+        thererfore protected.
+
+        No new tests. (no new functionality)
+
+        * dom/ContainerNode.cpp: change DOM manipulation methods to update scope of inserted nodes
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        (WebCore::Document::setDocType): Ditto
+        (WebCore::Document::adoptNode): Ditto
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::treeScope): use NodeRareData to check if a non-Document scope is set
+        (WebCore::Node::setTreeScope): update NodeRareData depending on whether scope is a document
+        (WebCore::Node::setTreeScopeRecursively):
+        (WebCore::Node::setDocumentRecursively):
+        * dom/Node.h:
+        * dom/NodeRareData.h: add scope pointer
+        (WebCore::NodeRareData::NodeRareData):
+        (WebCore::NodeRareData::treeScope):
+        (WebCore::NodeRareData::setTreeScope):
+        * dom/TreeScope.cpp: add parentTreeScope pointer
+        (WebCore::TreeScope::TreeScope):
+        (WebCore::TreeScope::setParentTreeScope):
+        * dom/TreeScope.h:
+        (WebCore::TreeScope::parentTreeScope):
+
+2011-04-08  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Local caret rectangle calculation should be relative to its containing block.
+        https://bugs.webkit.org/show_bug.cgi?id=49508.
+
+        InlineBox and caret rectangle are positioned relative to its containing block.
+        So its left and right edge value should be relative to its containing block as well. 
+
+        Test: fast/forms/cursor-at-editable-content-boundary.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+
+2011-04-08  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+
+2011-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57971
+        
+        Rework visited/unvisited links for before/after content. Propagate the bits earlier so that we don't lose
+        them when we throw away the visited style. Don't throw away the visited link style for pseudo elements
+        either, so that the styles are consistent.
+
+        Added fast/history/visited-generated-content-test.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::pseudoStyleForElement):
+
+2011-04-06  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Refactoring] Auto correction panel should be handled by its own class.
+        https://bugs.webkit.org/show_bug.cgi?id=55571
+
+        Extracted code inside SUPPORT_AUTOCORRECTION_PANEL into
+        SpellingCorrectionController class.
+        This change also remove some SUPPORT_AUTOCORRECTION_PANEL guard if
+        code paths inside the never reached without autocorrection support.
+        Removing guards reduces unintentional build breakage.
+
+        No new tests, no behavior chagne.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/CorrectionPanelInfo.h: Removed.
+        * editing/EditingAllInOne.cpp:
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedSelection):
+        (WebCore::Editor::respondToChangedContents):
+        (WebCore::Editor::appliedEditing):
+        (WebCore::Editor::Editor):
+        (WebCore::Editor::~Editor):
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::insertLineBreak):
+        (WebCore::Editor::insertParagraphSeparator):
+        (WebCore::Editor::cut):
+        (WebCore::Editor::paste):
+        (WebCore::Editor::pasteAsPlainText):
+        (WebCore::Editor::isAutomaticSpellingCorrectionEnabled):
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::changeBackToReplacedString):
+        (WebCore::Editor::unappliedSpellCorrection):
+        (WebCore::Editor::updateMarkersForWordsAffectedByEditing):
+        (WebCore::Editor::startCorrectionPanelTimer):
+        (WebCore::Editor::handleCorrectionPanelResult):
+        (WebCore::Editor::dismissCorrectionPanelAsIgnored):
+        * editing/Editor.h:
+        * editing/SpellingCorrectionCommand.cpp:
+        * editing/SpellingCorrectionController.cpp: Added.
+        (WebCore::markerTypesForAutocorrection):
+        (WebCore::markerTypesForReplacement):
+        (WebCore::markersHaveIdenticalDescription):
+        (WebCore::SpellingCorrectionController::SpellingCorrectionController):
+        (WebCore::SpellingCorrectionController::~SpellingCorrectionController):
+        (WebCore::SpellingCorrectionController::startCorrectionPanelTimer):
+        (WebCore::SpellingCorrectionController::stopCorrectionPanelTimer):
+        (WebCore::SpellingCorrectionController::stopPendingCorrection):
+        (WebCore::SpellingCorrectionController::applyPendingCorrection):
+        (WebCore::SpellingCorrectionController::hasPendingCorrection):
+        (WebCore::SpellingCorrectionController::isSpellingMarkerAllowed):
+        (WebCore::SpellingCorrectionController::show):
+        (WebCore::SpellingCorrectionController::handleCancelOperation):
+        (WebCore::SpellingCorrectionController::dismiss):
+        (WebCore::SpellingCorrectionController::dismissSoon):
+        (WebCore::SpellingCorrectionController::applyCorrectionPanelInfo):
+        (WebCore::SpellingCorrectionController::applyAutocorrectionBeforeTypingIfAppropriate):
+        (WebCore::SpellingCorrectionController::respondToUnappliedSpellCorrection):
+        (WebCore::SpellingCorrectionController::correctionPanelTimerFired):
+        (WebCore::SpellingCorrectionController::handleCorrectionPanelResult):
+        (WebCore::SpellingCorrectionController::isAutomaticSpellingCorrectionEnabled):
+        (WebCore::SpellingCorrectionController::windowRectForRange):
+        (WebCore::SpellingCorrectionController::respondToChangedSelection):
+        (WebCore::SpellingCorrectionController::respondToAppliedEditing):
+        (WebCore::SpellingCorrectionController::client):
+        (WebCore::SpellingCorrectionController::textChecker):
+        (WebCore::SpellingCorrectionController::recordAutocorrectionResponseReversed):
+        (WebCore::SpellingCorrectionController::markReversed):
+        (WebCore::SpellingCorrectionController::markCorrection):
+        (WebCore::SpellingCorrectionController::recordSpellcheckerResponseForModifiedCorrection):
+        * editing/SpellingCorrectionController.h: Added.
+        (WebCore::SpellingCorrectionController::UNLESS_ENABLED):
+        (WebCore::SpellingCorrectionController::shouldStartTimeFor):
+        (WebCore::SpellingCorrectionController::shouldRemoveMarkersUponEditing):        
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::insertText):
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/htmlediting.h:
+        (WebCore::isAmbiguousBoundaryCharacter):
+        * page/EditorClient.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setPageAndTextZoomFactors):
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * features.pri:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLTagNames.in:
+        * html/HTMLTrackElement.cpp: Removed.
+        * html/HTMLTrackElement.h: Removed.
+        * html/HTMLTrackElement.idl: Removed.
+
+2011-04-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58155 and part of <rdar://problem/9251767>
+        BitmapImage::getFirstCGImageRefOfSize fails if the frameCount hasn't been initialized from the image source.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::getFirstCGImageRefOfSize): Call frameCount() instead of accessing m_frames.size() to
+          make sure the frames are properly tallied first.
+
+2011-04-08  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Dragging and dropping an image in edit mode does not work
+        https://bugs.webkit.org/show_bug.cgi?id=19385
+
+        When adding an image to the clipboard, we should also include the HTML code of that image so
+        it can be used for internal drag and drop.
+
+        This HTML is expected by all clients of drop events so a fragment can be moved from one browser to
+        another, or inside the same browser.
+
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define + initial HTMLTrackElement
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        No new tests. No real functionality added just yet.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * features.pri:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLTagNames.in:
+        * html/HTMLTrackElement.cpp: Added.
+        (WebCore::HTMLTrackElement::HTMLTrackElement):
+        (WebCore::HTMLTrackElement::create):
+        (WebCore::HTMLTrackElement::insertedIntoTree):
+        (WebCore::HTMLTrackElement::willRemove):
+        (WebCore::HTMLTrackElement::src):
+        (WebCore::HTMLTrackElement::setSrc):
+        (WebCore::HTMLTrackElement::kind):
+        (WebCore::HTMLTrackElement::setKind):
+        (WebCore::HTMLTrackElement::srclang):
+        (WebCore::HTMLTrackElement::setSrclang):
+        (WebCore::HTMLTrackElement::label):
+        (WebCore::HTMLTrackElement::setLabel):
+        (WebCore::HTMLTrackElement::isDefault):
+        (WebCore::HTMLTrackElement::setIsDefault):
+        (WebCore::HTMLTrackElement::isURLAttribute):
+        * html/HTMLTrackElement.h: Added.
+        * html/HTMLTrackElement.idl: Added.
+
+2011-04-07  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Logic error in HTMLMediaElement::exitFullscreen()
+        https://bugs.webkit.org/show_bug.cgi?id=58085
+
+        The new full screen API case could fall through to the legacy API case
+        unintentionally if a script calls exitFullscreen on an element which is
+        not the current full screen element.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+
+2011-04-08  Mike Reed  <reed@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Replace SKIA_TEXT with isNativeFontRenderingAllowed() for print-preview to work
+        https://bugs.webkit.org/show_bug.cgi?id=57782
+
+        No new tests. This change only affects print-preview and build option SKIA_GPU 
+
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::paintSkiaText):
+
+2011-04-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang, Darin Adler, and Enrica Casucci.
+
+        REGRESSION(r81887): Crash in SplitElement
+        https://bugs.webkit.org/show_bug.cgi?id=57743
+
+        The crash was caused by ReplaceSelectionCommand::doApply's calling splitElement with computeNodeAfterPosition
+        even when the position was after the last node in it container. Since all we are doing here is to splitting tree
+        up until the highest ancestor with isInlineNodeWithStyle, replaced the while loop by calls to splitTreeToNode
+        and highestEnclosingNodeOfType.
+
+        Also fixed a bug in splitTreeToNode not to check the difference in visible position when splitting the ancestor,
+        which would have introduced unnecessary nodes when splitting tree and a bug in highestEnclosingNodeOfType that
+        it incorrectly called deprecatedNode instead of containerNode.
+
+        Test: editing/inserting/insert-images-in-pre-x-crash.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/htmlediting.cpp:
+        (WebCore::highestEnclosingNodeOfType):
+
+2011-04-08  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Tony Gentilcore.
+
+        Incoming source should be preload scanned when the parser is blocked 
+        https://bugs.webkit.org/show_bug.cgi?id=58117
+
+        Scan the appended source if parser is blocked.
+
+        Test: http/tests/loading/preload-append-scan.php
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::append):
+
+2011-04-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix the WebKit2 build for older versions of GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=58095
+
+        No new tests. This is just a build fix.
+
+        * platform/gtk/GtkVersioning.c:
+        (gdk_window_create_similar_surface): Reimplement this method for older versions of GDK.
+        * platform/gtk/GtkVersioning.h: Add the new method to the header.
+
+2011-04-08  Misha Tyutyunik  <michael.tyutyunik@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Plugin is not scrolled together with page content or jumping 
+        when content is rendered using cache (backing store).
+        https://bugs.webkit.org/show_bug.cgi?id=56130
+        
+        This is a Symbian portion of the fix. For Linux it looks like
+        it's enough to call set geometry which should be addressed in
+        https://bugs.webkit.org/show_bug.cgi?id=57179
+
+        No new tests required. This can be tested with manual tests from 
+        WebCore/manual-tests/qt and WebCore/manual-tests/plugins
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2011-04-08  Abhishek Arya  <inferno@chromium.org>
+
+        Unreviewed. Remove accidental printf added in r83306.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendContextMenuEvent):
+
+2011-04-08  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Dragging text in a WebKit2 window results in a copy instead of a move.
+        https://bugs.webkit.org/show_bug.cgi?id=56772
+        <rdar://problem/9165140>
+
+        cleanupAfterSystemDrag cannot call dragEnd in WebKit2, since
+        the call to startDrag is asynchronous.
+        
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::cleanupAfterSystemDrag):
+
+2011-04-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move WheelEvent-dispatching logic into WheelEventDispatchMediator.
+        https://bugs.webkit.org/show_bug.cgi?id=57642
+
+        Covered by existing tests, no functional change.
+
+        * dom/Event.cpp:
+        * dom/Event.h:
+        (WebCore::EventDispatchMediator::EventDispatchMediator): Added default
+            constructor.
+        (WebCore::EventDispatchMediator::event): Inlined.
+        (WebCore::EventDispatchMediator::setEvent): Added.
+        * dom/EventDispatcher.cpp: Removed dispatchWheelEvent.
+        * dom/EventDispatcher.h: Updated decls.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchWheelEvent): Changed to use the mediator and
+            return a bool, like other dispatch event functions.
+        * dom/Node.h: Changed decl.
+        * dom/WheelEvent.cpp:
+        (WebCore::granularity): Moved from EventDispatcher.
+        (WebCore::WheelEventDispatchMediator::WheelEventDisatchMediator): Added.
+        (WebCore::WheelEventDispatchMediator::event): Added.
+        (WebCore::WheelEventDispatchMediator::dispatchEvent): Added.
+        * dom/WheelEvent.h: Updated decls.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent): Changed to receive and react
+            to the return value.
+
+2011-04-08  Jessie Berlin  <jberlin@apple.com>
+
+        Windows build warning fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Since ShadowRoot.cpp is included in the DOMAllInOne.cpp file, it should be excluded from
+        the build.
+
+2011-04-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: update breakpoints according to source frame decorations after live edit.
+        https://bugs.webkit.org/show_bug.cgi?id=58029
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._updateResourceContent.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._updateResourceContent):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype.set content):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleSave.didEditScriptSource):
+        (WebInspector.SourceFrame.prototype._handleSave):
+
+2011-04-08  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: fix scripts concatenation in scripts panel.
+        https://bugs.webkit.org/show_bug.cgi?id=58138
+
+        When there is just one script starting at 0:0 it should not be surrounded by <script> framing.
+
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype._loadResourceContent):
+        (WebInspector.SourceFile.prototype._loadAndConcatenateScriptsContent):
+
+2011-04-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: use "locations" for debugger scripts, "lineNumbers" for the UI elements.
+        https://bugs.webkit.org/show_bug.cgi?id=58118
+
+        This change reuses location for call frames in the protocol + structures script
+        location <-> source lines interaction better. When we need UI columns, we will add
+        them, but we should distinguish between script and UI terms on the type level, not naming.
+
+        * English.lproj/localizedStrings.js:
+        * bindings/v8/DebuggerScript.js:
+        * inspector/InjectedScriptSource.js:
+        * inspector/Inspector.json:
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update.didGetSourceLine):
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.addConsoleMessage.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype.addConsoleMessage):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype._setBreakpointInDebugger.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._setBreakpointInDebugger):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.PresenationCallFrame):
+        (WebInspector.PresenationCallFrame.prototype.sourceLine.didRequestSourceMapping):
+        (WebInspector.PresenationCallFrame.prototype.sourceLine):
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter.locationToPosition):
+        (WebInspector.ScriptFormatter.lineToPosition):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused.else.didGetSourceLocation):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype.showAnchorLocation):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected.didGetSourceLocation):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceMapping.prototype.scriptLocationToSourceLine):
+        (WebInspector.SourceMapping.prototype.sourceLineToScriptLocation):
+        (WebInspector.FormattedSourceMapping.prototype.scriptLocationToSourceLine):
+        (WebInspector.FormattedSourceMapping.prototype.sourceLineToScriptLocation):
+
+2011-04-08  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: distinguish breakpoints set on de-obfuscated sources from breakponts set on original sources.
+        https://bugs.webkit.org/show_bug.cgi?id=58133
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.canEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceFileForScript):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype._createSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+
+2011-04-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: make SourceFrame TextViewer's delegate for editing operations.
+        https://bugs.webkit.org/show_bug.cgi?id=58026
+
+        This is the first step of decoupling TextViewer from SourceFrame.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.show):
+        (WebInspector.SourceFrame.prototype.hide):
+        (WebInspector.SourceFrame.prototype._ensureContentLoaded):
+        (WebInspector.SourceFrame.prototype.contentEditable):
+        (WebInspector.SourceFrame.prototype.startEditing):
+        (WebInspector.SourceFrame.prototype.endEditing):
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._handleRevertEditing):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._enterInternalTextChangeMode):
+        (WebInspector.TextViewer.prototype._exitInternalTextChangeMode):
+        (WebInspector.TextViewer.prototype._syncDecorationsForLine):
+        (WebInspector.TextViewer.prototype._doubleClick):
+        (WebInspector.TextViewerDelegate):
+        (WebInspector.TextViewerDelegate.prototype.contentEditable):
+        (WebInspector.TextViewerDelegate.prototype.startEditing):
+        (WebInspector.TextViewerDelegate.prototype.endEditing):
+        (WebInspector.TextEditorMainPanel.prototype._paintScheduledLines):
+        (WebInspector.TextEditorMainPanel.prototype._handleDOMUpdates):
+        * inspector/front-end/inspector.html:
+
+2011-04-08  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Media Stream API: add the getUserMedia method and the Javascript bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=56586
+
+        Add the getUserMedia method to the navigator and its new Javascript types.
+        Current specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html#video-conferencing-and-peer-to-peer-communication
+
+        Tests: fast/dom/MediaStream/argument-types.html
+               fast/dom/MediaStream/enabled.html
+               fast/dom/MediaStream/no-interface-object.html
+
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.v8bindings.mk:
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::JSNavigator::webkitGetUserMedia):
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Added.
+        (WebCore::V8Navigator::webkitGetUserMediaCallback):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::webkitGetUserMedia):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * page/NavigatorUserMediaError.h: Added.
+        (WebCore::NavigatorUserMediaError::NavigatorUserMediaError):
+        (WebCore::NavigatorUserMediaError::~NavigatorUserMediaError):
+        (WebCore::NavigatorUserMediaError::code):
+        * page/NavigatorUserMediaError.idl: Added.
+        * page/NavigatorUserMediaErrorCallback.h: Added.
+        (WebCore::NavigatorUserMediaErrorCallback::~NavigatorUserMediaErrorCallback):
+        * page/NavigatorUserMediaErrorCallback.idl: Added.
+        * page/NavigatorUserMediaSuccessCallback.h: Added.
+        (WebCore::NavigatorUserMediaSuccessCallback::~NavigatorUserMediaSuccessCallback):
+        * page/NavigatorUserMediaSuccessCallback.idl: Added.
+
+2011-04-08  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Add more tests for detailed heap snapshots UI.
+        https://bugs.webkit.org/show_bug.cgi?id=58010
+        https://bugs.webkit.org/show_bug.cgi?id=58011
+
+        Added tests for "Containment" view. Minor refactorings, bugs fixed.
+        Split one large tests into smaller ones to avoid timing out in debug mode.
+
+        Tests: inspector/profiler/detailed-heapshots-containment-expansion-preserved-when-sorting.html
+               inspector/profiler/detailed-heapshots-containment-show-all.html
+               inspector/profiler/detailed-heapshots-containment-show-next.html
+               inspector/profiler/detailed-heapshots-containment-sorting.html
+               inspector/profiler/detailed-heapshots-summary-expansion-preserved-when-sorting.html
+               inspector/profiler/detailed-heapshots-summary-show-all.html
+               inspector/profiler/detailed-heapshots-summary-show-next.html
+               inspector/profiler/detailed-heapshots-summary-sorting.html
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode):
+        (WebInspector.HeapSnapshotGridNode.prototype.populateChildren):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort.doSort):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort):
+        (WebInspector.HeapSnapshotGenericObjectNode):
+        (WebInspector.HeapSnapshotObjectNode):
+        (WebInspector.HeapSnapshotInstanceNode):
+        (WebInspector.HeapSnapshotConstructorNode):
+        (WebInspector.HeapSnapshotDiffNode):
+        (WebInspector.HeapSnapshotDominatorObjectNode):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotContainmentDataGrid):
+        (WebInspector.HeapSnapshotDominatorsDataGrid):
+
+2011-04-08  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Bugs in some corner cases in the text editor
+        https://bugs.webkit.org/show_bug.cgi?id=58025
+
+        This solves the following bugs:
+        1) The very last _empty_ line would not be deleted if you hit a Backspace on it, or the selection text to be deleted is extended to the very bottom of the editor.
+        2) An odd corner case: delete all source code from the editor, hit backspace on the only empty line, then add a character. In this case the browser will insert a TEXT node instead of a DIV node for a lineRow.
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._selectionToPosition):
+        (WebInspector.TextEditorMainPanel.prototype._enclosingLineRowOrSelf):
+        (WebInspector.TextEditorMainPanel.prototype._handleDOMUpdates):
+        (WebInspector.TextEditorMainPanel.prototype._applyDomUpdates):
+        (WebInspector.TextEditorMainPanel.prototype._collectLinesFromDiv):
+
+2011-04-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: add test for script formatter worker.
+        https://bugs.webkit.org/show_bug.cgi?id=57447
+
+        Test: inspector/debugger/script-formatter.html
+
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * gyp/streamline-inspector-source.sh:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype._formatter):
+        * inspector/front-end/ScriptFormatterWorker.js:
+
+2011-04-08  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Tweak dynamically constants for the async highlighting in text editor
+        https://bugs.webkit.org/show_bug.cgi?id=58035
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._expandChunks):
+        (WebInspector.TextEditorMainPanel.prototype._schedulePaintLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintScheduledLines):
+        (WebInspector.TextEditorMainPanel.prototype._restorePaintLinesOperationsCredit):
+        (WebInspector.TextEditorMainPanel.prototype._adjustPaintLinesOperationsRefreshValue):
+
+2011-04-08  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: HAR compliance fixes
+        https://bugs.webkit.org/show_bug.cgi?id=58124
+
+        - Always provide some values for queryString and cookies, even though arrays may be empty
+        - Always provide an empty cache object
+        - Added entire HARLog to test
+        - Workaround in test to avoid custom expectations (favicon.ico appears in log on certain platforms)
+
+        * inspector/front-end/HAREntry.js:
+        (WebInspector.HAREntry.prototype.build):
+        (WebInspector.HAREntry.prototype._buildRequest):
+        (WebInspector.HAREntry.prototype._buildResponse):
+
+2011-04-08  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Qt build.
+
+        * css/CSSStyleApplyProperty.cpp:
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactor WebCore/GNUMakefile.am to separate list of files
+        https://bugs.webkit.org/show_bug.cgi?id=58116
+
+        This change is similar to the cooresponding to change to
+        JavaScriptCore.  We hope to generate GNUmakefile.list.am automatically
+        using GYP.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am: Added.
+
+2011-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Rolled out some accidentally-committed changes in my last commit.
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        * dom/EventTarget.h:
+
+2011-04-07  Julien Chaffraix  <jchaffraix@codeaurora.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        EventSource should only accept UTF-8 charset
+        https://bugs.webkit.org/show_bug.cgi?id=56942
+
+        Following the discussion on bug 45372, this change implements the recommended
+        way of handling "charset". We only accept UTF-8 but no other encoding. This matches
+        the encoding of the EventSource and also may fix TomCat that automatically send this
+        charset.
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::didReceiveResponse): We now check the charset attribute and if it is
+        not UTF-8, abort the connection and log the error to the console. Also we log if the MIME type
+        is wrong to the console to help debugging (only in the case of an HTTP 200 response though).
+
+2011-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Some Handle<T> cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=58109
+
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue): Updated for new null constructor.
+        (WebCore::ScriptValue::hasNoValue): Updated for removal of isEmpty().
+
+2011-04-07  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Let shadow DOM have a list of nodes at the top level of a shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=57813
+
+        Adds ShadowRoot, a list of nodes, to be a parent for top-level
+        shadow children. Forwards rendering through the root and into the
+        host's renderer.
+
+        Covered by existing tests of elements that use this style of shadow.
+
+        * Android.mk: add ShadowRoot.h/cpp
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::initForStyleResolve): proxy style to host
+        * dom/ContainerNode.cpp: parent nodes that are shadow roots are alive
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::appendChild):
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::DocumentFragment):
+        * dom/DocumentFragment.h:
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): look through ShadowRoots for host's style
+        (WebCore::Element::shadowRoot): should be const
+        (WebCore::Element::ensureShadowRoot): simpler than setShadowRoot
+        * dom/Element.h:
+        * dom/ElementRareData.h:
+        * dom/Node.cpp:
+        (WebCore::Node::parentNodeForRenderingAndStyle): indirection so
+          ShadowRoot can forward to the host's renderer
+        (WebCore::Node::createRendererAndStyle):
+        (WebCore::Node::createRendererIfNeeded):
+        * dom/Node.h:
+        (WebCore::Node::isShadowBoundary): temporary, to differentiate
+          old- and new-style, until all roots are ShadowRoot instances
+        * dom/ShadowRoot.cpp: Added.
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::recalcStyle): forward recalc to children
+        * dom/ShadowRoot.h: Added.
+        (WebCore::ShadowRoot::isShadowBoundary):
+        (WebCore::ShadowRoot::create):
+        * html/HTMLKeygenElement.cpp: use ensureShadowRoot
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        (WebCore::HTMLKeygenElement::parseMappedAttribute):
+        (WebCore::HTMLKeygenElement::appendFormData):
+        (WebCore::HTMLKeygenElement::reset):
+        (WebCore::HTMLKeygenElement::shadowSelect):
+        * html/HTMLKeygenElement.h:
+        * html/HTMLMeterElement.cpp: use ensureShadowRoot
+        (WebCore::HTMLMeterElement::createShadowSubtree):
+        * html/HTMLProgressElement.cpp: use ensureShadowRoot
+        (WebCore::HTMLProgressElement::createShadowSubtree):
+        * html/InputType.cpp: use ensureShadowRoot
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/RangeInputType.cpp: use ensureShadowRoot
+        (WebCore::RangeInputType::handleMouseDownEvent):
+        (WebCore::RangeInputType::createShadowSubtree):
+        (WebCore::RangeInputType::valueChanged):
+        (WebCore::RangeInputType::shadowSliderThumb):
+        * html/RangeInputType.h:
+        * html/ValidationMessage.cpp: use ensureShadowRoot
+        (WebCore::ValidationMessage::buildBubbleTree):
+        (WebCore::ValidationMessage::deleteBubbleTree):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::setPositionFromPoint):
+        (WebCore::SliderThumbElement::hostInput):
+        * html/shadow/SliderThumbElement.h:
+        * rendering/MediaControlElements.cpp: use ensureShadowRoot
+        (WebCore::MediaControlInputElement::attach):
+        (WebCore::MediaControlInputElement::updateStyle):
+        * rendering/RenderSlider.cpp: use ensureShadowRoot
+        (WebCore::RenderSlider::thumbRect):
+        (WebCore::RenderSlider::layout):
+        (WebCore::RenderSlider::shadowSliderThumb):
+        (WebCore::RenderSlider::inDragMode):
+        * rendering/RenderSlider.h:
+
+2011-04-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r80871): Crash when visiting http://broadband.biglobe.ne.jp/
+        https://bugs.webkit.org/show_bug.cgi?id=56297
+        <rdar://problem/9131597>
+
+        Test: fast/css-generated-content/table-row-after-no-crash.html
+
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleDidChange): Factor out generation of before/after
+        content, and only do it if the row already has a parent. For construction of
+        anonymous cells to work correctly, the row needs to already have a parent, so
+        in that case wait a bit.
+        (WebCore::RenderTableRow::updateBeforeAndAfterContent): Factored out to here.
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild): When adding a row, update its
+        before/after content, in case it had any.
+
+2011-04-07  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Probable fix for <rdar://problem/9251443>  Crashing on exception: -
+        [ScrollAnimationHelperDelegate _pixelAlignProposedScrollPosition:]: unrecognized 
+        selector sent to instance ADDRESS.
+
+       Need to implement new delegate method.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollAnimationHelperDelegate _pixelAlignProposedScrollPosition:]):
+
+2011-04-07  Ian Henderson  <ianh@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Optimize filling rounded rects that are actually ellipses
+        https://bugs.webkit.org/show_bug.cgi?id=58098
+
+        In CG, drawing an ellipse directly is faster than constructing and
+        filling a rounded rect path.  Detect when the given rounded rect is
+        actually an ellipse and draw it directly in this case.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+2011-04-07  Ned Holbrook  <nholbrook@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CTLine objects should outlive their CTRuns
+        https://bugs.webkit.org/show_bug.cgi?id=58063
+
+        * platform/graphics/mac/ComplexTextController.h: Add m_coreTextLines, to be destroyed after m_complexTextRuns.
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Moot m_coreTextRun.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText): Append line to m_coreTextLines.
+
+2011-04-07  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Compositor thread infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=56131
+
+        Introduce chrome compositor thread and related
+        infrastructure.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCMainThread.cpp: Added.
+        (WebCore::CCMainThread::performTask):
+        (WebCore::CCMainThread::postTask):
+        * platform/graphics/chromium/cc/CCMainThread.h: Added.
+        (WebCore::CCMainThread::Task::~Task):
+        (WebCore::CCMainThread::Task::instance):
+        (WebCore::CCMainThread::Task::Task):
+        * platform/graphics/chromium/cc/CCMainThreadTask.h: Added.
+        (WebCore::MainThreadTask0::create):
+        (WebCore::MainThreadTask0::MainThreadTask0):
+        (WebCore::MainThreadTask0::performTask):
+        (WebCore::MainThreadTask1::create):
+        (WebCore::MainThreadTask1::MainThreadTask1):
+        (WebCore::MainThreadTask1::performTask):
+        (WebCore::MainThreadTask2::create):
+        (WebCore::MainThreadTask2::MainThreadTask2):
+        (WebCore::MainThreadTask2::performTask):
+        (WebCore::MainThreadTask3::create):
+        (WebCore::MainThreadTask3::MainThreadTask3):
+        (WebCore::MainThreadTask3::performTask):
+        (WebCore::createMainThreadTask):
+        * platform/graphics/chromium/cc/CCThread.cpp: Added.
+        (WebCore::CCThread::create):
+        (WebCore::CCThread::CCThread):
+        (WebCore::CCThread::~CCThread):
+        (WebCore::CCThread::postTask):
+        (WebCore::CCThread::compositorThreadStart):
+        (WebCore::CCThread::runLoop):
+        * platform/graphics/chromium/cc/CCThread.h: Added.
+        (WebCore::CCThread::Task::~Task):
+        (WebCore::CCThread::Task::instance):
+        (WebCore::CCThread::Task::Task):
+        (WebCore::CCThread::threadID):
+        (WebCore::CCCompletionEvent::CCCompletionEvent):
+        (WebCore::CCCompletionEvent::~CCCompletionEvent):
+        (WebCore::CCCompletionEvent::wait):
+        (WebCore::CCCompletionEvent::signal):
+        * platform/graphics/chromium/cc/CCThreadTask.h: Added.
+        (WebCore::CCThreadTask0::create):
+        (WebCore::CCThreadTask0::CCThreadTask0):
+        (WebCore::CCThreadTask0::performTask):
+        (WebCore::CCThreadTask1::create):
+        (WebCore::CCThreadTask1::CCThreadTask1):
+        (WebCore::CCThreadTask1::performTask):
+        (WebCore::CCThreadTask2::create):
+        (WebCore::CCThreadTask2::CCThreadTask2):
+        (WebCore::CCThreadTask2::performTask):
+        (WebCore::CCThreadTask3::create):
+        (WebCore::CCThreadTask3::CCThreadTask3):
+        (WebCore::CCThreadTask3::performTask):
+        (WebCore::createCCThreadTask):
+
+2011-04-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r46914, r48764): When typing in Mail, line wrapping frequently occurs in the middle of words
+        https://bugs.webkit.org/show_bug.cgi?id=57872
+
+        r46914 initially introduced a regression by replacing calls to styleAtPosition by editingStyleAtPosition
+        because editingStyleAtPosition did not avoid tab span to obtain the computed style unlike styleAtPosition.
+
+        r46914 also introduced a regression by cloning hierarchy under new block at the insertion position without
+        avoiding the tab span.
+
+        Fixed the both regressions by avoiding tab spans when computing the editing style and when cloning hierarchy.
+        Also reverted r46914 for the general code path because re-creating node hierarchy duplicates nodes when
+        we're moving nodes after the paragraph separator. Instead, we now split the tree up until the start block
+        before moving the nodes.
+
+        Tests: editing/inserting/insert-paragraph-after-tab-span-and-text.html
+               editing/inserting/insert-paragraph-separator-tab-span.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Since EditingStyle's constructor avoids a tab span,
+        no longer calls positionBeforeTabSpan on the position passed to EditingStyle's constructor.
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::init): Always avoid a tab span when computing the editing style.
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply): Avoid cloning tab spans and inserting a paragraph
+        separator into a paragraph separator.
+        * editing/htmlediting.cpp:
+        (WebCore::positionOutsideTabSpan): Renamed from positionBeforeTabSpan. Also returns the position in the parent
+        node after the tab span if the position was at the end of the tab span.
+        * editing/htmlediting.h:
+
+2011-04-07  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        [Mac] Editor::setComposition() should not trigger correction panel timer.
+        https://bugs.webkit.org/show_bug.cgi?id=58049
+         <rdar://problem/9226305>
+
+        On Mac OS X that supports autocorrection panel, typing unconfirmed composition (i.e. unconfirmed Japanese or Chinese input)
+        should not start autocorrection timer. We added a member variable, m_shouldPreventSpellChecking, to TypingCommand. 
+        When this value is true, markMisspellingsAfterTyping() will not be called in TypingCommand::typingAddedToOpenCommand().
+        m_shouldPreventSpellChecking is set to true in the TypingCommand objects created by Editor::setComposition().
+
+        No new tests. No deterministically reproducible test case. Patch is based on static code analysis. Testing this also requires firing
+        autocorrection panel timer, which can not be easily done in automated fashion.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::deleteWithDirection):
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::confirmComposition):
+        (WebCore::Editor::setComposition):
+        * editing/EditorCommand.cpp:
+        (WebCore::executeDelete):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::deleteSelection):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        (WebCore::TypingCommand::insertText):
+        (WebCore::TypingCommand::insertLineBreak):
+        (WebCore::TypingCommand::insertParagraphSeparator):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        * editing/TypingCommand.h:
+        (WebCore::TypingCommand::create):
+        (WebCore::TypingCommand::setShouldPreventSpellChecking):
+
+2011-04-07  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        clearIfComposited call is really slow
+        https://bugs.webkit.org/show_bug.cgi?id=57999
+
+        Move getContextAttributes call after the if, so it isn't called nearly as often.
+
+        No new tests.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::clearIfComposited):
+
+2011-04-07  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement Backgroun and Mask properties in CSSStyleApplyProperty
+        https://bugs.webkit.org/show_bug.cgi?id=57922
+
+        No tests added as no behavioral changes.
+
+        * css/CSSStyleApplyProperty.cpp:
+        Added ApplyPropertyFillLayer test to handle Background and Mask CSS Properties.
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        Added constructor calls to set up:
+          CSSPropertyBackgroundAttachment
+          CSSPropertyBackgroundClip
+          CSSPropertyWebkitBackgroundClip
+          CSSPropertyWebkitBackgroundComposite
+          CSSPropertyBackgroundOrigin
+          CSSPropertyWebkitBackgroundOrigin
+          CSSPropertyBackgroundSize
+          CSSPropertyWebkitBackgroundSize
+          CSSPropertyWebkitMaskAttachment
+          CSSPropertyWebkitMaskClip
+          CSSPropertyWebkitMaskComposite
+          CSSPropertyWebkitMaskOrigin
+          CSSPropertyWebkitMaskSize
+        * css/CSSStyleApplyProperty.h:
+        (WebCore::CSSStyleApplyProperty::setPropertyValue):
+        Add function to specify an equivalent property value in the lookup table.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Remove sections now implemented by CSSStyleApplyProperty.
+        * css/CSSStyleSelector.h:
+        Make CSSStyleApplyProperty a friend class so that the mapFill* functions are accessible.
+
+2011-04-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Split run storage out from BidiResolver into a new BidiRunList class
+        https://bugs.webkit.org/show_bug.cgi?id=57764
+
+        Part of what makes BidiResolver and InlineIterator so difficult to understand
+        (and bug 50912 so difficult to fix) is that BidiResolver is both a state machine
+        for the Unicode Bidi Algorithm (UBA) as well as storage for the resulting
+        BidiRuns from the algorithm.  This patch breaks the storage aspect off
+        into its own class BidiRunList.
+
+        This patch is only a start.  It does not actually fix the problematic ownership
+        relationship, but it does make it possible to fix such in a second patch.
+
+        The run pointers and addRun/prependRun, etc. were already a tightly coupled
+        logical subset of the BidiResolver class, so moving them into their own class
+        was both obvious and easy.  The only piece of logic I had to move was that
+        deleteRuns() had a side-effect of setting the m_emptyRun bit on the resolver.
+
+        I believe this deleteRuns side-effect was only ever used for one place
+        (right after findNextLineBreak) and that it's only needed because
+        findNextLineBreak can sometimes create bidi runs.  Run creation appears to be
+        an unintentional side-effect of how InlineIterator calls through to BidiResolver
+        as part of bidiNext and not a desired effect of the code.  I have added the call
+        to markCurrentRunEmpty to both places deleteRuns was called (where the resolver
+        could get re-used) as a safety precaution.  We could replace both with ASSERTs
+        in a later patch.
+
+        I suspect there may be a small performance win from further refactoring so that
+        findNextLineBreak does not need to create BidiRuns.
+
+        As I commented in the code, callers should own their own BidiRunList which they
+        pass to BidiResolver::createBidiRunsForLine.  I attempted to implement that in
+        an earlier version of this patch, but it was too complicated with the current
+        twisted dependencies between InlineIterator/bidiNext and InlineBidiResolver.
+        raise/lowerExplicitEmbeddingLevel are called unconditionally
+        from commitExplicitEmbedding (which is called by bidiNext) and expect to have
+        access to a runs list even in cases where we don't want any runs (findNextLineBreak).
+
+        I also cleaned up some of the callers to pass around BidiRunList objects instead
+        of InlineBidiResolvers now that they're separate objects.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawBidiText):
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiResolver::BidiResolver):
+        (WebCore::BidiResolver::runs):
+        (WebCore::BidiResolver::markCurrentRunEmpty):
+        (WebCore::::appendRun):
+        (WebCore::::lowerExplicitEmbeddingLevel):
+        (WebCore::::raiseExplicitEmbeddingLevel):
+        (WebCore::::reorderRunsFromLevels):
+        (WebCore::::createBidiRunsForLine):
+        * rendering/InlineIterator.h:
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::createRun):
+        (WebCore::RenderBlock::appendRunsForObject):
+        (WebCore::reachedEndOfTextRenderer):
+        (WebCore::RenderBlock::handleTrailingSpaces):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2011-04-07  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Fix relocation problem of popup window which introduces autofill popup sometimes moves to screen's top left corner.
+        https://bugs.webkit.org/show_bug.cgi?id=57911
+        http://code.google.com/p/chromium/issues/detail?id=78073
+
+        Manual test added: manual-tests/autofill-popup-location.html
+
+        Originally only height is checked so that it introduces the bug.
+        So I changed it to check both width and height as size.
+
+        * manual-tests/autofill-popup-location.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::refresh): Check window size between original and new before calling setFrameRect().
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement img-src style-src and font-src
+        https://bugs.webkit.org/show_bug.cgi?id=58018
+
+        These are pretty straight forward given the rest of the infrastructure
+        we've built so far.
+
+        Tests: http/tests/security/contentSecurityPolicy/image-allowed.html
+               http/tests/security/contentSecurityPolicy/image-blocked.html
+               http/tests/security/contentSecurityPolicy/style-allowed.html
+               http/tests/security/contentSecurityPolicy/style-blocked.html
+               http/tests/security/contentSecurityPolicy/xsl-allowed.php
+               http/tests/security/contentSecurityPolicy/xsl-blocked.php
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowImageFromSource):
+        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
+        (WebCore::ContentSecurityPolicy::allowFontFromSource):
+        (WebCore::ContentSecurityPolicy::addDirective):
+        * page/ContentSecurityPolicy.h:
+
+2011-04-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make IconSnapshot and PageURLRecord member variables private.
+        https://bugs.webkit.org/show_bug.cgi?id=58080
+
+        No change in functionality so no new tests.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::writeToDatabase): Changed to used the accessor functions.
+        (WebCore::IconDatabase::writeIconSnapshotToSQLDatabase): Ditto.
+        * loader/icon/IconRecord.h:
+        (WebCore::IconSnapshot::IconSnapshot): Changed to use the new member variable names.
+        (WebCore::IconSnapshot::iconURL): Expose the property.
+        (WebCore::IconSnapshot::timestamp): Ditto.
+        (WebCore::IconSnapshot::data): Ditto.
+        * loader/icon/PageURLRecord.h:
+        (WebCore::PageURLSnapshot::PageURLSnapshot): Changed to use the new member variable names.
+        (WebCore::PageURLSnapshot::pageURL): Expose the property.
+        (WebCore::PageURLSnapshot::iconURL): Ditto.
+
+2011-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels):
+
+2011-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add stub support for generating Gtk build system from gyp
+        https://bugs.webkit.org/show_bug.cgi?id=58086
+
+        This does not produce a buildable WebCore, but it
+        does allow running gyp/configure --port=gtk and having
+        it generate a gtk.Makefile which we can use for testing
+        the rest of the plumbing.
+
+        * gyp/gtk.gyp: Added.
+
+2011-04-07  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57736
+        
+        Crash on openstreetmap.org while using the map. Fix a bad interaction between the positioned movement layout
+        optimization and the simplified layout optimization that could lead to blocks remaining marked as dirty when
+        layout finished. This would eventually lead to an inability to properly determine the correct layout root and
+        would cause a deleted root to be used later on.
+
+        Added fast/block/positioning/complex-positioned-movement.html.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayoutOfSubtree):
+        Add asserts to catch cases in the future where a layout root is set that has a dirty containing block.
+    
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::simplifiedLayout):
+        Change simplified layout so that the positioned movement optimization no longer clears the other layout
+        flags. This will ensure that we still lay out our descendants if they need it.
+        
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        Changed to clear our layout flags now if the positioned movement is successful, since tryLayoutDoingPositionedMovementOnly
+        no longer does the clear.
+    
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::tryLayoutDoingPositionedMovementOnly):
+        tryLayoutDoingPositionedMovementOnly now returns a boolean indicating success or failure.  On success it no longer
+        does setNeedsLayout(false), but instead will let the caller take care of it. This way the caller can still look at
+        the other flags in case other kinds of layout are still needed.
+    
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setNeedsPositionedMovementLayout):
+        (WebCore::RenderObject::setNeedsSimplifiedNormalFlowLayout):
+        Changed these methods to only set their respective flags and not to try to be clever about avoiding propagation.
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * features.pri:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLTagNames.in:
+        * html/HTMLTrackElement.cpp: Removed.
+        * html/HTMLTrackElement.h: Removed.
+        * html/HTMLTrackElement.idl: Removed.
+
+2011-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/9018212> Underline thickness is not uniform under non-integral scale factor
+        https://bugs.webkit.org/show_bug.cgi?id=58083
+
+        Test: fast/text/decorations-transformed.html
+
+        * platform/graphics/GraphicsContext.h: Added a RoundingMode enum with two values. RoundAllSides
+        is the existing rounding mode, where each side of the rectangle snaps to the nearest pixel
+        gridline. RoundOriginAndDimensions snaps the origin to the nearest pixel gridpoint and rounds
+        the width and the height. In this new mode, translating a rectangle in user space never changes
+        its dimensions in device pixels.
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Implemented RoundOriginAndDimensions.
+        (WebCore::GraphicsContext::drawLineForText): Use RoundOriginAndDimensions, thus ensuring that
+        all underlines have the same thickness in device pixels.
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Added RoundingMode parameter, but did not implement it.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Ditto.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Ditto.
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Ditto.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Ditto.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintDecoration):
+
+2011-04-06  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        [V8] Remove custom DOMImplementation getter on Document.
+        https://bugs.webkit.org/show_bug.cgi?id=57991
+
+        The custom getter is no longer required because DOMImplementation
+        objects are now created per document.
+
+        Test: fast/dom/DOMImplementation/implementation-identity.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * dom/Document.idl:
+
+2011-04-07  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        setHasID() is only called for styled elements
+        https://bugs.webkit.org/show_bug.cgi?id=57267
+
+        Test: fast/dom/non-styled-element-id-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        (WebCore::Element::idAttributeChanged):
+        * dom/Element.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::parseMappedAttribute):
+
+2011-04-07  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        HTMLVideoElement::webkitEnterFullscreen does not use new Full Screen API when available.
+        https://bugs.webkit.org/show_bug.cgi?id=58070
+
+        Make the HTMLMediaElement full screen functions call into the new Full Screen API when
+        FULLSCREEN_API is enabled.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement CSP's options directive
+        https://bugs.webkit.org/show_bug.cgi?id=58014
+
+        This patch contains the full options parser, but we only have enough of
+        CSP implemented to see the effects of disable-xss-protection.  Will
+        need to do some more work before we can see eval-script in action.
+
+        Tests: http/tests/security/contentSecurityPolicy/inline-script-allowed.html
+               http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPOptions::CSPOptions):
+        (WebCore::CSPOptions::disableXSSProtection):
+        (WebCore::CSPOptions::evalScript):
+        (WebCore::CSPOptions::parse):
+        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
+        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
+        (WebCore::ContentSecurityPolicy::allowInlineScript):
+        (WebCore::ContentSecurityPolicy::addDirective):
+        * page/ContentSecurityPolicy.h:
+
+2011-04-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (WebKit2): Reverse conversion doesn't work in Kotoeri
+        https://bugs.webkit.org/show_bug.cgi?id=58066
+        <rdar://problem/8965302>
+
+        * platform/mac/HTMLConverter.h:
+        * platform/mac/HTMLConverter.mm: (+[WebHTMLConverter editingAttributedStringFromRange:]):
+        Changed editingAttributedStringFromRange: to use WebCore::Range instead of DOMRange, since
+        it's now used in WebKit2.
+
+2011-04-07  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r64712): Microsoft Outlook 2011: original message contents
+        not included when replying to an email.
+        https://bugs.webkit.org/show_bug.cgi?id=57794
+        
+        * WebCore.exp.in:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing): Call Frame::injectUserScripts()
+        before checking if the FrameLoader is parsing the initial empty document.
+        This allows user scripts to be injected at the end of document parsing
+        (if the setting is enabled).
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts): Do not inject scripts if this
+        feature is disabled on the initial empty document.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h: Add a setting for injecting user scripts into the
+        initial empty document (defaults to false).
+        (WebCore::Settings::setInjectUserScriptsInInitialEmptyDocument):
+        (WebCore::Settings::injectUserScriptsInInitialEmptyDocument):
+        * platform/mac/RuntimeApplicationChecks.h:
+        * platform/mac/RuntimeApplicationChecks.mm:
+        (WebCore::applicationIsMicrosoftOutlook): Check if the embedding
+        application is Microsoft Outlook.
+
+2011-04-06  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        AVF: MediaPlayerPrivateAVFoundation never reaches playable state.
+        https://bugs.webkit.org/show_bug.cgi?id=57962
+
+        Add support for a new AVPlayerItem API which will notify clients when their
+        seek completes.  This requires a new Notification type to be passed to the main
+        thread in MediaPlayerPrivateAVFoundation.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted): Added.
+        (WebCore::MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification): Added two new
+            overloaded functions which take a Notification; and a Notification::Type and boolean.
+        (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification): Support new SeekCompleted 
+            Notification type.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        (WebCore::MediaPlayerPrivateAVFoundation::Notification::Notification): Added one new constructor.
+        (WebCore::MediaPlayerPrivateAVFoundation::Notification::finished): Added ivar and accessor.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::seekToTime): Call new AVPlayerItem API.
+        (-[WebCoreAVFMovieObserver seekCompleted:]): Added.
+
+2011-04-07  Nancy Piedra  <nancy.piedra@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Parse quotes from content type parameters
+        https://bugs.webkit.org/show_bug.cgi?id=53275
+
+        This functionality is tested in video-can-play-type.html layout test
+        where I've added codecs parameter with good and bad formatting.
+
+        * platform/ContentType.cpp:
+        (WebCore::ContentType::parameter):
+
+2011-04-07  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: remove "enabled" from the setBreakpoint protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=58047
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        * bindings/v8/DebuggerScript.js:
+        ():
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::buildObjectForBreakpointCookie):
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::setBreakpoint):
+        (WebCore::InspectorDebuggerAgent::continueToLocation):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/ScriptBreakpoint.h:
+        (WebCore::ScriptBreakpoint::ScriptBreakpoint):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._updateBreakpointsAfterLiveEdit):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint.callback):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._setBreakpointInDebugger):
+        (WebInspector.DebuggerPresentationModel.prototype._setBreakpointInDebugger.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._removeBreakpointFromDebugger):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpointEnabled.afterUpdate):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpointEnabled):
+        (WebInspector.DebuggerPresentationModel.prototype.updateBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpointsFromSettings):
+        (WebInspector.DebuggerPresentationModel.prototype._saveBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+        (WebInspector.PresentationBreakpoint):
+
+2011-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Removed a redundant line of code.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::updateAlwaysCreateLineBoxes): No need to compare line gap values, as
+        this is covered by the earlier hasIdenticalAscentDescentAndLineGap() check.
+
+2011-04-07  Liang Qi  <liang.qi@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Enable webkit build with GCCE on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=57841
+
+        * WebCore.pri: Thanks for Norbert Leser  <norbert.leser@nokia.com> who checked RVCT part.
+        --rw-base value in QMAKE_LFLAGS.ARMCC and -Tdata value in QMAKE_LFLAGS.GCCE are updated
+        to 0x1000000 together. They need to be updated in the future when WebKit grows.
+
+2011-04-06  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: get rid of Breakpoint.js.
+        https://bugs.webkit.org/show_bug.cgi?id=57949
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Breakpoint.js: Removed.
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.updateBreakpoint.didLoadSnippet):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.updateBreakpoint):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._compareBreakpoints):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel):
+        (WebInspector.DebuggerModel.prototype._debuggerWasDisabled):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerModel.prototype.reset):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._refreshBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._updateBreakpointsAfterLiveEdit):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpointEnabled):
+        (WebInspector.DebuggerPresentationModel.prototype.updateBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._saveBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+        (WebInspector.PresentationBreakpoint):
+        (WebInspector.PresentationBreakpoint.prototype.get sourceFile):
+        (WebInspector.PresentationBreakpoint.prototype.get url):
+        (WebInspector.PresentationBreakpoint.prototype.get resolved):
+        (WebInspector.PresentationBreakpoint.prototype.loadSnippet):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel):
+        (WebInspector.ResourceTreeModel.prototype._onResourceStarted):
+        (WebInspector.ResourceTreeModel.prototype._addResourceToFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._breakpointUpdated):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-04-07  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: console messages names should adhere to the common naming style
+        https://bugs.webkit.org/show_bug.cgi?id=58042
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole):
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.messageAdded):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.messageRepeatCountUpdated):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.messagesCleared):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher):
+
+2011-04-06  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: migrate Inspector protocol messages format to JSON-RPC.
+        https://bugs.webkit.org/show_bug.cgi?id=57957
+
+        There is not a significant difference between  inspector messages spec and and JSON-RPC 2.0 messages spec.
+        Also JSON-RPC has a pretty clear specification for error descriptions which we haven't.
+        It was decided that we will use it.
+
+        the list of renames:
+        1) type-> /dev/null
+        2) domain + '.' + event => method // for events
+        3) domain + '.' + command => method // for requests
+        4) requestId => id // for responses
+        5) arguments => params // for requests
+        6) data => params // for events
+        7) body => result // for responses
+
+        protocolErrors and error properties will be converted to JSON-RPC error format.
+        The order of properties in messages also will be adjusted.
+        The only thing that looks unnecessary is jsonrpc property.
+
+        * inspector/CodeGeneratorInspector.pm:
+
+2011-04-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add functions to update left and right offsets to LineOffsets
+        https://bugs.webkit.org/show_bug.cgi?id=58028
+
+        Added update() and shrinkWidthForNewFloatIfNeeded(FloatingObject*) to LineOffsets,
+        which are used to update m_left and m_right. Also added m_block and m_isFirstLine
+        member variables to LineOffsets so that users of LineOffsets don't have to pass them around.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::skipLeadingWhitespace): No longer passes firstLine to positionNewFloatOnLine.
+        (WebCore::LineOffsets::LineOffsets): Takes RenderBlock* and isFirstLine instead of left and right offsets.
+        (WebCore::LineOffsets::update): Extracted from findNextLineBreak and positionNewFloatOnLine.
+        (WebCore::LineOffsets::shrinkWidthForNewFloatIfNeeded): Extracted from positionNewFloatOnLine.
+        (WebCore::RenderBlock::findNextLineBreak): Calls skipLeadingWhitespace and positionNewFloatOnLine.
+        (WebCore::RenderBlock::positionNewFloatOnLine): Calls shrinkWidthForNewFloatIfNeeded and update and
+        no longer passes firstLine around.
+
+2011-04-06  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: migrate debugger domain to the unified breakpoint location notion.
+        https://bugs.webkit.org/show_bug.cgi?id=57928
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::buildObjectForBreakpointCookie):
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::setBreakpoint):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.prototype._breakpointResolved):
+
+2011-04-07  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Mask the QStyle::State_Horizontal hint for vertical scrollbars.
+
+        When initializing a QStyleOptionSlider from a widget, the State_Horizontal
+        hint may get set depending on how that widget is laid out in its parent.
+        If this happens when drawing a vertical scrollbar, the hint is never
+        cleared and we end up painting a vertical scrollbar with horizontal arrows.
+
+        Covered by pixel tests which should no longer paint silly scrollbars.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        script-src should block inline script
+        https://bugs.webkit.org/show_bug.cgi?id=58012
+
+        Block inline scripts at the ScriptElement layer.  This should catch
+        exactly the scripts we want to catch.
+
+        Test: http/tests/security/contentSecurityPolicy/inline-script-blocked.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+            - This patch also adds the ability to supply a CSP policy via a
+              <meta> tag.  We'll update the name of the header once we've
+              finished implementing the spec.
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::executeScript):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowInlineScript):
+        * page/ContentSecurityPolicy.h:
+
+2011-04-07  Alice Boxhall  <aboxhall@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Move the MouseEventWithHitTestResults::targetNode() method on to EventHandler.
+        https://bugs.webkit.org/show_bug.cgi?id=57921
+
+        Moves the MouseEventWithHitTestResults::targetNode() method on to EventHandler, so
+        that the same logic can be used for a HitTestResult.
+
+        No visible changes, just cleanup, so no tests.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
+        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
+        (WebCore::EventHandler::handleMousePressEventTripleClick):
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::subframeForHitTestResult):
+        Made public static member, so that it can access targetNode(), and be accessed by
+        webkitwebview in gtk.
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::targetNode):
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        * page/EventHandler.h:
+        * page/MouseEventWithHitTestResults.cpp:
+        (WebCore::MouseEventWithHitTestResults::MouseEventWithHitTestResults):
+        * page/MouseEventWithHitTestResults.h:
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/brew/EventHandlerBrew.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/efl/EventHandlerEfl.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+
+2011-04-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: build mapping for formatted scripts based on keywords positions.
+        https://bugs.webkit.org/show_bug.cgi?id=57936
+
+        Mapping based on [\$\.\w]+ was not accurate because string literals representation
+        may be different in original and formatted scripts.
+
+        * inspector/front-end/ScriptFormatterWorker.js:
+        (buildMapping.regexp.b):
+        (buildMapping):
+
+2011-04-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Spinbuttons become unclickable if right padding is large.
+        https://bugs.webkit.org/show_bug.cgi?id=56298
+
+        An inner-spin-button is put on the right border and ignores right
+        padding in RenderTextControlSingleLine::layout(), but forwardEvent()
+        checks if a point is in an area just right of an internal text block.
+        This inconsistency caused a bug that an inner-spin-button with large
+        padding didn't receive mouse events.
+
+        To fix this bug, we render spin buttons as layers, and remove manual
+        event forwarding code.
+
+        Test: fast/forms/input-number-large-padding.html
+
+        * css/html.css: Add "position:relative" to make a spin-button a layer.
+        (input::-webkit-inner-spin-button):
+        (input::-webkit-outer-spin-button):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+          Remove manual event forwarding code.
+
+2011-04-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CSP object-src should block plugin loads
+        https://bugs.webkit.org/show_bug.cgi?id=57283
+
+        This change is pretty straight-forward.  It's slighly unclear to me
+        whether this patch is correct w.r.t. the code in DocumentWriter.  I've
+        added a FIXME comment, and I'll investigate that case more in the future.
+
+        Test: http/tests/security/contentSecurityPolicy/object-src-none.html
+
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::begin):
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::requestPlugin):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
+        (WebCore::ContentSecurityPolicy::addDirective):
+        * page/ContentSecurityPolicy.h:
+
+2011-04-06  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58009
+        Frame::scalePage() results in visual artifacts with scale factors less than 1
+        -and corresponding-
+        <rdar://problem/8683230>
+
+        Fall into the case where we fill with a background base color when there is a page 
+        scale factor that is less than 1.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paintBoxDecorations):
+
+2011-04-06  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AVF: MediaPlayerPrivateAVFoundationObjC should not use -[AVPlayerItem isPlaybackBufferEmpty]
+        https://bugs.webkit.org/show_bug.cgi?id=57982
+
+        Query our cached loaded time array instead of asking AVPlayerItem if its buffer is empty.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::playerItemStatus):
+
+2011-04-06  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        MediaPlayerPrivateAVFoundation does not change rate due to setRate().
+        https://bugs.webkit.org/show_bug.cgi?id=57919
+
+        Test: media/video-set-rate-from-pause.html
+
+        The base class of MediaPlayerPrivateAVFoundation does not actually change the rate
+        of the media; instead a subclass must do that work.  So when setRate() is called, 
+        inform a subclass through a new pure virtual updateRate() function that there's 
+        work to be done.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::setRate): Call updateRate()
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateRate): Added.  Set the requested rate.
+
+2011-04-06  Dai Mikurube  <dmikurube@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add QUOTA build flag for unified quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57918
+
+        * Configurations/FeatureDefines.xcconfig: Added QUOTA build flag
+        * GNUmakefile.am: Added QUOTA build flag
+        * WebCore.pri: Added QUOTA build flag
+
+2011-04-06  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57997
+        <rdar://problem/9187856> REGRESSION(r75555): ~5-7 MB increase in memory between iBench runs
+        Navigating away from a Scrolled page which queues a scroll event that is never dispatched.
+        Cancel all enqueued events when detaching the Document the events cannot keep the Document
+        alive.
+
+        No change in functionality so no new tests.  
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/EventQueue.cpp:
+        (WebCore::EventQueue::cancelQueuedEvents):
+        * dom/EventQueue.h:
+
+2011-04-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/9084761> REGRESSION (r73993): Default Arabic line spacing has gotten very loose when the specified font is not Arabic
+        https://bugs.webkit.org/show_bug.cgi?id=58002
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit): The version of Geeza Pro in Snow Leopard
+        does not require the vertical metrics tweaks that were needed in Leopard. That the
+        tweaks were being applied went mostly unnoticed until r73993, because until then it
+        only affected cases where Geeza Pro was specified, not when it occurred as a fallback
+        font.
+
+2011-04-06  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 57994 - Move guardRef functionality back to Document
+        https://bugs.webkit.org/show_bug.cgi?id=57994
+
+        Move the relevant code parts from TreeScope back into Document.
+
+        No new tests. (no new functionality)
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+        * dom/Document.h:
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::destroyTreeScopeData):
+        * dom/TreeScope.h:
+
+2011-04-06  Ian Henderson  <ianh@apple.com>
+
+        Reviewed by Simon Fraser, Antti Koivisto.
+
+        Fast path for parsing simple CSS values
+        https://bugs.webkit.org/show_bug.cgi?id=57964
+
+        Add functions to parse simple color or dimension values, skipping the
+        overhead of full CSS parsing.
+
+        Change parseValue to a static method to avoid unnecessary allocation
+        of a CSSParser in the fast case.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::setProperty):
+        Changed to use the new, static parseValue method.
+        * css/CSSParser.cpp:
+        (WebCore::isColorPropertyID):
+        (WebCore::parseColorValue):
+        Parses any color accepted by the existing parseColor() static method.
+        We must handle color identifiers separately, since parseColor() will
+        change 'red' into 'rgb(255, 0, 0)'.
+        (WebCore::isSimpleLengthPropertyID):
+        (WebCore::parseSimpleLengthValue):
+        Parses a value of the form 'NNpx', 'NN%', or 'NN' (when strict is
+        false, or 'NN' is '0').  Returns false to fall back to the slow path.
+        (WebCore::CSSParser::parseValue):
+        * css/CSSParser.h:
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+        Changed to use the new, static parseValue method.
+
+2011-04-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Make sure JS_EXPORT_PRIVATE is an empty define when we aren't using the export macros.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * config.h:
+
+2011-04-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Some minor style resolution optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=57996
+
+        A couple of minor optimizations to style-related code.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::isCSSPropertyName):
+        (WebCore::JSCSSStyleDeclaration::putDelegate):
+        Avoid calling cssPropertyName() twice when setting style on an element.
+        
+        * css/CSSStyleSelector.cpp:
+        (WebCore::useSVGZoomRules):
+        (WebCore::CSSStyleSelector::applyProperty):
+        Avoid calling isSVGElement() for every property, since only a two properties
+        care about it.
+
+2011-04-06  Ian Henderson  <ianh@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Unnecessary string allocation in CSSStyleDeclaration::setProperty
+        https://bugs.webkit.org/show_bug.cgi?id=57995
+
+        Pass the bool representing the property's importance directly instead
+        of constructing a string.
+
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore::CSSStyleDeclaration::setProperty):
+
+2011-04-06  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Make the style of createFunctionOnlyCallback in V8 consistent with the JavaScriptCore version.
+        https://bugs.webkit.org/show_bug.cgi?id=57963
+
+        No new tests. LayoutTests/fast/dom/Geolocation/argument-types.html
+
+        * bindings/v8/V8Utilities.h:
+        (WebCore::createFunctionOnlyCallback):
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        (WebCore::V8Geolocation::getCurrentPositionCallback):
+        (WebCore::V8Geolocation::watchPositionCallback):
+
+2011-04-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Support Windows 7 Gestures
+        https://bugs.webkit.org/show_bug.cgi?id=49824
+        <rdar://problem/8689728>
+        
+        Move WindowTouch.h from WebKit/win, so it can be used in both WebKit and WebKit2.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/WindowsTouch.h: Copied from WebKit/win/WindowsTouch.h.
+
+2011-04-06  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] We should use USE(QT_MULTIMEDIA) rather than ENABLE(QT_MULTIMEDIA).
+        https://bugs.webkit.org/show_bug.cgi?id=57974
+
+        We should use USE(QT_MULTIMEDIA) rather than ENABLE(QT_MULTIMEDIA).
+
+        No new tests needed, just a config flag rename.
+
+        * features.pri:
+
+2011-04-06  Tyler Close  <tjclose@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        run-bindings-tests reference files out of sync with CodeGenerator*.pm
+        https://bugs.webkit.org/show_bug.cgi?id=57967
+
+        * bindings/scripts/test/V8/V8TestCallback.cpp:
+
+2011-04-06  Asanka Herath  <asanka@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add new TargetType: TargetIsFavicon
+
+        https://bugs.webkit.org/show_bug.cgi?id=57659
+
+        No new functionality added, so no additional tests.
+
+        * platform/network/ResourceRequestBase.h:
+
+2011-04-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57981
+        
+        Update the column count and width computation algorithm for CSS3 multi-column layout 
+        to match the revised pseudo-algorithm in the latest draft of the spec.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcColumnWidth):
+
+2011-04-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        borderPaddingMarginStart and borderPaddingMarginEnd should take RenderInline
+        https://bugs.webkit.org/show_bug.cgi?id=57965
+
+        Changed the argument types of borderPaddingMarginStart and borderPaddingMarginEnd
+        from RenderBoxModelObject to RenderInline since they call marginStart and marginEnd
+        instead of marginStartForChild and marginEndForChild respectively.
+
+        Calling these two functions on RenderInline is okay because writing-mode cannot differ
+        from that of the containing block.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::borderPaddingMarginStart):
+        (WebCore::borderPaddingMarginEnd):
+        (WebCore::inlineLogicalWidth):
+
+2011-04-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r83039.
+        http://trac.webkit.org/changeset/83039
+        https://bugs.webkit.org/show_bug.cgi?id=57978
+
+        introduced a new regression in conjunction to
+        ReplaceSelectionCommand (Requested by rniwa on #webkit).
+
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::init):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2011-04-06  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by David Levin.
+
+        Webkit ignores PgUp/PgDown/Home/End in SELECT tag objects
+        https://bugs.webkit.org/show_bug.cgi?id=27658
+
+        Test: fast/events/select-element.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::nextValidIndex): Moved from elsewhere in the file to be used by other routines.
+        (WebCore::nextSelectableListIndexPageAway): Returns a selectable index one page away from the given index.
+        (WebCore::nextSelectableListIndex): Implemented with nextValidIndex.
+        And converted to a normal static function from a private function of SelectElement.
+        (WebCore::previousSelectableListIndex): Implemented with nextValidIndex.
+        And converted to a normal static function from a private function of SelectElement.
+        (WebCore::firstSelectableListIndex): Returns the first selectable index.
+        (WebCore::lastSelectableListIndex): Returns the last selectable index.
+        (WebCore::SelectElement::menuListDefaultEventHandler): Converted from C cast to C++ cast.
+        (WebCore::SelectElement::listBoxDefaultEventHandler): Adds support for PageUp/PageDown/Home/End with both single and multiple selection.
+
+        * dom/SelectElement.h:
+        (WebCore::SelectElement::): Remove nextSelectableListIndex() and previousSelectableListIndex().
+
+        * rendering/RenderListBox.h: Makes RenderListBox::size public so that PageUp/PageDown behavior can use the actual list size rather than that specified in HTML.
+        They can differ due to the minimum size imposed by RenderListBox.
+
+2011-04-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57975
+
+        The "More..." link for line clamping no longer shows up in Safari RSS. Fix the isLink() check
+        to just look at the style, so that it can find the InlineTextBox and not care that it's a child
+        of the link element and not the line box for the link element itself (since that line box got
+        culled).
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::applyLineClamp):
+
+2011-04-06  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57973 and https://bugs.webkit.org/show_bug.cgi?id=57973
+        WK2 icon database should be able to get a CGImage of a specific size
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        (WebCore::Image::getFirstCGImageRefOfSize):
+        
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::getFirstCGImageRefOfSize): Walk the frames of the image until reaching the
+          first frame of the requested size.
+
+2011-04-06  Malcolm MacLeod  <malcolm.macleod@tshwanedje.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Fix cursor handling so that we always call the chrome to set it.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=57972
+
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setCursor):
+
+2011-04-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41445
+        
+        Visited links painting with black background. Make sure that if the visited style has
+        the initial background color (transparent) set that we just use the unvisited color.
+
+        Added fast/history/visited-link-background-color.html
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::visitedDependentColor):
+
+2011-04-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed Qt buildfix after r83079.
+
+        * WebCore.pro:
+
+2011-04-06  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Chris Marrin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56936
+        Crash in ImplicitAnimation::~ImplicitAnimation
+
+        Make sure the style and start time waiting lists
+        are cleared in the CompositeAnimation destructor. This
+        way, no running transitions can be left in a state
+        where they are destroyed as the AnimationControllerPrivate
+        cleans up.
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::~CompositeAnimation):
+
+2011-04-06  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move code duplicated between the WebKit/mac and WebKit2 down to WebCore because Chromium will need it too
+        https://bugs.webkit.org/show_bug.cgi?id=54969
+
+        No change in behavior; no new tests.
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::locationAndLengthFromRange): New method from duplicated code in WebKits
+        * editing/TextIterator.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::rangeForPoint): New method from duplicated code in WebKits
+
+2011-04-06  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Factoring the creation of 'FunctionOnly' callbacks in JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=57770
+
+        Create a template from an existing functionality in JSGeolocationCustom.cpp
+        to be used by the custom bindings of both Geolocation and the Media Stream API.
+        V8 version of this bug: https://bugs.webkit.org/show_bug.cgi?id=57760
+
+        No new tests. LayoutTests/fast/dom/Geolocation/argument-types.html
+
+        * Android.jscbindings.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/CallbackFunction.cpp: Added.
+        (WebCore::checkFunctionOnlyCallback):
+        * bindings/js/CallbackFunction.h: Added.
+        (WebCore::createFunctionOnlyCallback):
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+
+2011-04-06  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Implement fullscreen playback for the GStreamer backend.
+        https://bugs.webkit.org/show_bug.cgi?id=56826
+
+        Implement support for fullscreen playback when building the
+        Qt port with the GStreamer backend (DEFINES+=USE_GSTREAMER=1).
+        The implementation is done in FullScreenVideoQt alongside with
+        the Qt Multimedia support.
+
+        No new tests because layout tests cover it. They are not yet activated
+        but will be any time soon.
+
+        * platform/graphics/gstreamer/PlatformVideoWindowPrivate.h:
+        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
+        (FullScreenVideoWindow::FullScreenVideoWindow):
+        (FullScreenVideoWindow::setVideoElement):
+        (FullScreenVideoWindow::closeEvent):
+        (FullScreenVideoWindow::keyPressEvent):
+        (FullScreenVideoWindow::event):
+        (FullScreenVideoWindow::showFullScreen):
+        (FullScreenVideoWindow::hideCursor):
+        (FullScreenVideoWindow::showCursor):
+
+2011-04-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bundle lineLeftOffset and lineRightOffset as a class
+        https://bugs.webkit.org/show_bug.cgi?id=57851
+
+        Added a new class LineOffsets that encapsulates lineLeftOffset and lineRightOffset.
+        The patch makes clear that lineLeftOffset and lineRightOffset are never read individually
+        and only the difference is used to compute the width.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::skipLeadingWhitespace): Takes LineOffsets instead of two integers.
+        (WebCore::LineOffsets::LineOffsets): Added.
+        (WebCore::LineOffsets::width): Added.
+        (WebCore::LineOffsets::setLeft): Added.
+        (WebCore::LineOffsets::setRight): Added.
+        (WebCore::RenderBlock::findNextLineBreak): Calls skipLeadingWhitespace and positionNewFloatOnLine.
+        (WebCore::RenderBlock::positionNewFloatOnLine): Takes LineOffsets instead of two integers.
+
+2011-04-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57916
+        
+        Implement an optimization to the line box tree to cull out most of the intermediate
+        line boxes that can occur between the root line box and the leaves of the tree (images
+        and text).
+
+        RenderInlines now have a boolean member, m_alwaysCreateLineBoxes,
+        that starts off as false. Only if it gets flipped to true will there be any line boxes
+        created for that RenderInline.
+        
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusDirectionally):
+        Adjust the ordering of updateLayout calls to make sure rects aren't queried unless layout
+        is up to date.
+
+        * page/SpatialNavigation.cpp:
+        (WebCore::hasOffscreenRect):
+        (WebCore::nodeRectInAbsoluteCoordinates):
+        Add asserts in spatial navigation code to catch any future bad queries that might be made
+        for rectangles without layout being up to date.
+
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::uniteIfNonZero):
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/IntRect.cpp:
+        (WebCore::IntRect::uniteIfNonZero):
+        * platform/graphics/IntRect.h:
+        Add a new unite function that is useful for the render tree to FloatRect and IntRect.  This
+        version allows rect unites to happen if either width or height is nonzero.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
+        Make sure rect-based hit testing properly adds in culled inline ancestors to the set of nodes
+        if content inside those inlines is hit.
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::logicalFrameRect):
+        Fix a bug in this function for obtaining the logical frame rect of an inline box.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addToLine):
+        addToLine now also checks line gap in the line box tree optimization checks.
+    
+        (WebCore::InlineFlowBox::addTextBoxVisualOverflow):
+        (WebCore::InlineFlowBox::computeOverflow):
+        * rendering/InlineFlowBox.h:
+        Rewritten to add the text box overflow to the text box itself.
+
+         * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::destroy):
+        Destroy has been changed to call a helper function to remove and destroy the line boxes that
+        is now called from one additional spot.
+
+        (WebCore::InlineTextBox::logicalOverflowRect):
+        (WebCore::InlineTextBox::setLogicalOverflowRect):
+        Text boxes now cache their own overflow in a global hash table.
+
+        (WebCore::InlineTextBox::baselinePosition):
+        (WebCore::InlineTextBox::lineHeight):
+        Changed to not assume that the parent line box's renderer is the RenderText's immediate
+        parent, since intermediate line boxes may have been culled.
+
+        (WebCore::InlineTextBox::paint):
+        Paint now properly checks only the text box overflow instead of the parent line box's overflow.
+
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::logicalTopVisualOverflow):
+        (WebCore::InlineTextBox::logicalBottomVisualOverflow):
+        (WebCore::InlineTextBox::logicalLeftVisualOverflow):
+        (WebCore::InlineTextBox::logicalRightVisualOverflow):
+        New accessors to obtain overflow for inline text boxes.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        updateFirstLetter now removes text boxes from the line box tree before it destroys them, since those
+        text boxes may not have anything in between them and the block that contains the inline first letter
+        container.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        The culling optimization is done here.  Only if the RenderInline says that boxes are allowed will they
+        be created.
+
+        (WebCore::RenderBlock::layoutInlineChildren):
+        The state of the RenderInline is updated here, in case it is discovered that line boxes are now needed.
+        This is done before any lines are built.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        The new m_alwaysCreateLineBoxes flag has been added to the constructor.
+
+        (WebCore::RenderInline::styleDidChange):
+        An initial update of the m_alwaysCreateLineBoxes happens here for things that can be checked immediately
+        (like having a layer, borders, padding, margins or backgrounds).  Some checks that depend on examining
+        the RenderInline's parent (including first line styles) happen later in layoutInlineChildren.
+
+        (WebCore::RenderInline::updateAlwaysCreateLineBoxes):
+        The function called by layoutInlineChildren to check parent and child style differences (e.g., font,
+        vertical alignment, line height, etc.).
+
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::culledInlineAbsoluteRects):
+        absoluteRects calls culledInlineAbsoluteRects when m_alwaysCreateLineBoxes is false.
+
+        (WebCore::RenderInline::absoluteQuads):
+        (WebCore::RenderInline::culledInlineAbsoluteQuads):
+        absoluteQuads calls culledInlineAbsoluteQuads when m_alwaysCreateLineBoxes is false.
+
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        offsetLeft and offsetTop now check descendant renderers when m_alwaysCreateLineBoxes is false.
+
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::culledInlineBoundingBox):
+        lineBoundingBox calls culledInlineBoundingBox when m_alwaysCreateLineBoxes is false.
+
+        (WebCore::RenderInline::culledInlineFirstLineBox):
+        (WebCore::RenderInline::culledInlineLastLineBox):
+        Helpers that return the first and last line box descendants. Used by firstLineBoxIncludingCulling and
+        lastLineBoxIncludingCulling (which are in turn called by offsetLeft and offsetTop).
+
+        (WebCore::RenderInline::culledInlineVisualOverflowBoundingBox):
+        (WebCore::RenderInline::linesVisualOverflowBoundingBox):
+        linesVisualOverflowBoundingBox calls culledInlineVisualOverflowBoundingBox when m_alwaysCreateLineBoxes is false.
+
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        The initial bailout check is now done using firstLineBoxIncludingCulling instead of just firstLineBox.
+
+        (WebCore::RenderInline::dirtyLineBoxes):
+        dirtyLineBoxes now crawls into descendants to figure out which root lines to dirty when
+        m_alwaysCreateLineBoxes is false.
+
+        (WebCore::RenderInline::createAndAppendInlineFlowBox):
+        Clear the m_alwaysCreateLineBoxes if a box gets added anyway. This happens for leaf inline flows and also
+        when line-box-contain is set to an unusual value.
+
+        (WebCore::RenderInline::addFocusRingRects):
+        Used culledInlineAbsoluteRects in place of the line box walk when m_alwaysCreateLineBoxes is false.
+
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::firstLineBoxIncludingCulling):
+        (WebCore::RenderInline::lastLineBoxIncludingCulling):
+        Helpers used in a few places (like offsetLeft and offsetTop), mostly in places where the existence of a box
+        is all that needs checking.
+
+        (WebCore::RenderInline::alwaysCreateLineBoxes):
+        (WebCore::RenderInline::setAlwaysCreateLineBoxes):
+        Functions for getting and setting the m_alwaysCreateLineBoxes flag.
+
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        Modified to use firstLineBoxIncludingCulling and lastLineBoxIncludingCulling to ensure the right set of
+        lines get dirtied.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::removeAndDestroyTextBoxes):
+        New helper invoked by destroy and also from updateFirstLetter.
+
+        (WebCore::RenderText::destroy):
+        Changed to call removeAndDestroyTextBoxes.
+
+        (WebCore::RenderText::absoluteRects):
+        Fixed to be properly physical instead of logical.
+
+        (WebCore::RenderText::linesVisualOverflowBoundingBox):
+        New implementation for RenderText that gives the bounding box of the text boxes including overflow from
+        shadows, glyphs, text-stroke, etc.  Used by RenderInline::culledInlineVisualOverflowBoundingBox.
+
+        * rendering/RenderText.h:
+        * rendering/svg/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::RenderSVGInline):
+        RenderSVGInline always sets m_alwaysCreateLineBoxes to true so that SVG is unaffected by this optimization.
+
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
+        (WebCore::SVGRootInlineBox::layoutChildBoxes):
+        Move the isInlineFlowBox asserts to after the generated content skips, since the generated content boxes are
+        now InlineTextBoxes (the enclosing InlineFlowBoxes got culled).
+
+2011-04-05  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: Drag & Drop Gmail Attachments doesn't work.
+        https://bugs.webkit.org/show_bug.cgi?id=57909
+        <rdar://problem/9103220>
+
+        In WebKit2 we cannot rely on the value returned by platformData() that
+        on Mac returns an NSDraggingInfo object. This is available only in the UI
+        process. Therefore we should use m_pasteboard instead.
+        We cannot change what platformData() returns on Mac, since there are
+        delegate methods that receive a NSDraggingInfo object (only in WebKit).
+        
+        * platform/DragData.h:
+        (WebCore::DragData::pasteboard): Added.
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::Clipboard::create): Changed to use pasteboard() instead of platformData().
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::asColor): Replaced references to m_platformData with m_pasteboard.
+        (WebCore::DragData::asURL): Same as above.
+
+2011-04-06  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ClipboardWin has unused variables "ExceptionCode ec"
+        https://bugs.webkit.org/show_bug.cgi?id=57952
+
+        Remove the unused variable.
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::declareAndWriteDragImage):
+        (WebCore::ClipboardWin::writePlainText):
+
+2011-04-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Split getBorderPaddingMargin into two functions
+        https://bugs.webkit.org/show_bug.cgi?id=57947
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::borderPaddingMarginStart): Extracted from getBorderPaddingMargin.
+        (WebCore::borderPaddingMarginEnd): Ditto.
+        (WebCore::inlineLogicalWidth): Calls borderPaddingMarginStart and borderPaddingMarginEnd.
+        (WebCore::RenderBlock::findNextLineBreak): Ditto.
+
+2011-04-06  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Refactoring] <progress> should not have manual layout code.
+        https://bugs.webkit.org/show_bug.cgi?id=57801
+
+        - Simplified RenderProgress, removing its custom layout code
+        - Introducing ProgressValueElement and ProgressBarElement, replacing
+          ProgressBarValueElement. 
+        
+        Now the structure is almost identical to <meter>, 
+        other than:
+        - RenderProgress has animated painting, thus manages its own timer.
+        - Both ProgressValueElement and ProgressBarElement has pseudo classes
+          which don't changes during its lifetime.
+       
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/html.css:
+        (progress):
+        (progress::-webkit-progress-bar):
+        (progress::-webkit-progress-value):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::~HTMLProgressElement):
+        (WebCore::HTMLProgressElement::create):
+        (WebCore::HTMLProgressElement::attach):
+        (WebCore::HTMLProgressElement::didElementStateChange):
+        (WebCore::HTMLProgressElement::createShadowSubtree):
+        * html/HTMLProgressElement.h:
+        * html/shadow/ProgressShadowElement.cpp: Copied from Source/WebCore/html/shadow/ProgressBarValueElement.h.
+        (WebCore::ProgressShadowElement::ProgressShadowElement):
+        (WebCore::ProgressShadowElement::progressElement):
+        (WebCore::ProgressShadowElement::rendererIsNeeded):
+        (WebCore::ProgressBarElement::shadowPseudoId):
+        (WebCore::ProgressValueElement::shadowPseudoId):
+        (WebCore::ProgressValueElement::setWidthPercentage):
+        * html/shadow/ProgressShadowElement.h: Renamed from Source/WebCore/html/shadow/ProgressBarValueElement.h.
+        (WebCore::ProgressBarElement::ProgressBarElement):
+        (WebCore::ProgressBarElement::create):
+        (WebCore::ProgressValueElement::ProgressValueElement):
+        (WebCore::ProgressValueElement::create):
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::updateFromElement):
+        (WebCore::RenderProgress::animationTimerFired):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgress::requiresForcedStyleRecalcPropagation):
+        (WebCore::RenderProgress::canHaveChildren):
+
+2011-04-06  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [GTK] Do not reference AccessibilityRenderObject from platform dependent code
+        https://bugs.webkit.org/show_bug.cgi?id=57955
+
+        Do not reference AccessibilityRenderObject from platform specific code
+
+        Added new virtual functions to AccessibilityObject.h and removed
+        explicit references to AccessibilityRenderObject from GTK code.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::renderer): New virtual method,
+        returning 0 by default. Overriden by AccessibilityRenderObject.
+        (WebCore::AccessibilityObject::correspondingLabelForControlElement):
+        New virtual method, returning 0 by default. It complements the
+        already present method correspondingControlForLabelElement().
+
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::renderer): Made virtual.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::emitTextChanged): Reference  AccessibilityObject,
+        instead of AccessibilityRenderObject.
+        (WebCore::AXObjectCache::nodeTextChangePlatformNotification):
+        Ditto.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name): Do not reference
+        AccessibilityRenderObject.
+        (webkit_accessible_get_description): Ditto.
+        (setAtkRelationSetFromCoreObject): Ditto.
+        (optionFromList): Ditto.
+        (optionFromSelection): Ditto.
+        (webkit_accessible_selection_clear_selection): Ditto.
+        (webkit_accessible_selection_get_selection_count): Ditto.
+        (webkit_accessible_selection_select_all_selection): Ditto.
+        (textForObject): Ditto.
+        (webkit_accessible_text_get_text): Ditto.
+        (getPangoLayoutForAtk): Ditto.
+        (webkit_accessible_text_get_caret_offset): Ditto.
+        (baselinePositionForRenderObject): Ditto.
+        (getAttributeSetForAccessibilityObject): Ditto.
+        (accessibilityObjectLength): Ditto.
+        (getSelectionOffsetsForObject): Ditto.
+        (webkit_accessible_text_set_selection): Ditto.
+        (webkit_accessible_text_set_caret_offset): Ditto.
+        (webkit_accessible_table_get_caption): Ditto.
+        (getInterfaceMaskFromObject): Ditto.
+
+        * accessibility/gtk/WebKitAccessibleHyperlink.cpp:
+        (getRangeLengthForObject): Ditto.
+
+        Removed unused renderer() method from AccessibilityMenuList.
+
+        * accessibility/AccessibilityMenuList.h: Removed unused method.
+        * accessibility/AccessibilityMenuList.cpp: Removed unused method.
+
+2011-04-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Javascipt warning link expand and overlap with icons in js console
+        https://bugs.webkit.org/show_bug.cgi?id=57939
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyURLAsNode):
+
+2011-04-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Beautify parameter names in Inspector.json (CSS domain)
+        https://bugs.webkit.org/show_bug.cgi?id=57931
+
+        * inspector/Inspector.json:
+
+2011-04-06  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        [Mac] WebCore need to notify AppKit spell checker after user has modified autocorrected text.
+        https://bugs.webkit.org/show_bug.cgi?id=57665
+        <rdar://problem/7350477>
+
+        We need to track how user modified an autocorrected word. If he changed it back to original
+        text, we want to record AutocorrectionReverted response. And if he changed it to something
+        else, we want to record AutocorrectionEdited response.
+
+        To achieve this, we need to distringuish between text replacement caused by autocorrection
+        from that due to other causes, such as reversion, text substitution, etc. So we added a new
+        marker type "Autocorrected". We also need to be able to check for correction, even when we
+        don't intend to actually carry out replacement. For this, we introduced a new TextCheckingOption
+        value, "CheckForCorrection".
+
+        We also added DocumentMarkerController::markersInRange() to retrieve a vector of markers in
+        specified range, and of specified type.
+
+        * dom/DocumentMarker.h:
+        * dom/DocumentMarkerController.cpp:
+        (WebCore::DocumentMarkerController::markersInRange):
+        (WebCore::DocumentMarkerController::hasMarkers):
+        * dom/DocumentMarkerController.h:
+        * editing/Editor.cpp:
+        (WebCore::markerTypesForAutocorrection):
+        (WebCore::markersHaveIdenticalDescription):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::recordSpellcheckerResponseForModifiedCorrection):
+        (WebCore::Editor::changeBackToReplacedString):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        (WebCore::Editor::applyCorrectionPanelInfo):
+        (WebCore::Editor::unappliedSpellCorrection):
+        (WebCore::Editor::textCheckingTypeMaskFor):
+        * editing/Editor.h:
+        * editing/SpellingCorrectionCommand.cpp:
+        (WebCore::SpellingCorrectionCommand::doApply):
+
+2011-04-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r83045.
+        http://trac.webkit.org/changeset/83045
+        https://bugs.webkit.org/show_bug.cgi?id=57953
+
+        Broke win layout tests (Requested by podivilov on #webkit).
+
+        * GNUmakefile.am:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+
+2011-04-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Moved the declaration of positionNewFloatOnLine in RenderBlock.h after r83042.
+
+        * rendering/RenderBlock.h:
+
+2011-03-27  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Re-draw the <input> fields for Qt Mobile Theme to do not override elements already styled.
+        https://bugs.webkit.org/show_bug.cgi?id=57007
+
+        * CodeGenerators.pri:
+        * css/themeQtMobile.css: Removed.
+        * platform/qt/QtMobileWebStyle.cpp:
+        (drawRectangularControlBackground):
+        (QtMobileWebStyle::drawPrimitive):
+        (QtMobileWebStyle::drawComplexControl):
+        * platform/qt/QtMobileWebStyle.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::RenderThemeQt::paintTextField):
+
+2011-04-06  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        [Mac] When autocorrection occurs without showing correction panel, WebCore need to post accessibility notification.
+        https://bugs.webkit.org/show_bug.cgi?id=57800
+        <rdar://problem/9218223>
+
+        Defined a new accessibility notification type, AXAutocorrectionOccured. Editor::markAllMisspellingsAndBadGrammarInRanges()
+        now posts said notification when any autocorrection or text replacement (e.g. replacing "(c)" with copyright mark) takes place.
+
+        * accessibility/AXObjectCache.h:
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+
+2011-04-06  Martin Robinson  <mrobinson@igalia.com>
+
+        Build fix for debug Cairo builds.
+
+        * platform/graphics/cairo/PlatformContextCairo.cpp:
+        (WebCore::PlatformContextCairo::pushImageMask): Update the reference to m_maskInformation.
+
+2011-04-06  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Style fix for QtMobileWebStyle.h
+        https://bugs.webkit.org/show_bug.cgi?id=57708
+
+        * platform/qt/QtMobileWebStyle.h:
+
+2011-04-06  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Invalid color #{predefined colorName} is accepted by the CSS parser.
+        https://bugs.webkit.org/show_bug.cgi?id=15360
+
+        Test: fast/css/invalid-predefined-color.html
+
+        * css/CSSGrammar.y: Remove superfluous hexcolor production.
+        * css/tokenizer.flex: A hexadecimal number should consist of [a-fA-F0-9] values ({h}).
+
+2011-03-30  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: add test for script formatter worker.
+        https://bugs.webkit.org/show_bug.cgi?id=57447
+
+        Test: inspector/debugger/script-formatter.html
+
+        * GNUmakefile.am:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+
+2011-04-06  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Cairo] Hide the details of image masking in PlatformContextCairo
+        https://bugs.webkit.org/show_bug.cgi?id=57878
+
+        No new tests. This is just a refactor.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::savePlatformState): Call into PlatformContextCairo now to
+        do the actual cairo_save. Remove information about image masking.
+        (WebCore::GraphicsContext::restorePlatformState): Call into PlatformContextCairo now to
+        do the actual cairo_restore. Remove information about image masking.
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::clip): Use PlatformContextCairo here now.
+        * platform/graphics/cairo/PlatformContextCairo.cpp:
+        (WebCore::PlatformContextCairo::restore): Added.
+        (WebCore::PlatformContextCairo::save): Added.
+        (WebCore::PlatformContextCairo::pushImageMask): Added.
+        * platform/graphics/cairo/PlatformContextCairo.h:
+        (WebCore::ImageMaskInformation::update): Moved from GraphicsContextPlatformPrivateCairo.h.
+        (WebCore::ImageMaskInformation::isValid): Ditto.
+        (WebCore::ImageMaskInformation::maskSurface): Ditto.
+        (WebCore::ImageMaskInformation::maskRect): Ditto.
+
+2011-04-02  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Radio buttons are showing wrong with mobile theme
+        https://bugs.webkit.org/show_bug.cgi?id=57706
+
+        * platform/qt/QtMobileWebStyle.cpp:
+        (QtMobileWebStyle::drawRadio):
+
+2011-04-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move RenderBlock::positionNewFloatOnLine to RenderBlockLineLayout.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=57943
+
+        * rendering/RenderBlock.cpp: Removed positionNewFloatOnLine.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::positionNewFloatOnLine): Moved from RenderBlock.cpp
+
+2011-04-05  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Buildfix after r82125.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        * platform/qt/QtMobileWebStyle.cpp:
+        (QtMobileWebStyle::findChecker):
+        (QtMobileWebStyle::findRadio):
+        (QtMobileWebStyle::findComboButton):
+
+2011-04-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: inline script imports in ScriptFormatterWorker.js so it works in Safari release.
+        https://bugs.webkit.org/show_bug.cgi?id=57641
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * gyp/streamline-inspector-source.sh:
+        * inspector/combine-javascript-resources.pl: Renamed from Source/WebCore/combine-javascript-resources.
+        * inspector/inline-javascript-imports.py: Added.
+
+2011-04-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r46914, r48764): When typing in Mail, line wrapping frequently occurs in the middle of words
+        https://bugs.webkit.org/show_bug.cgi?id=57872
+
+        r46914 initially introduced a regression by replacing calls to styleAtPosition by editingStyleAtPosition
+        because editingStyleAtPosition did not avoid tab span to obtain the computed style unlike styleAtPosition.
+
+        r46914 also introduced a regression by cloning hierarchy under new block at the insertion position without
+        avoiding the tab span.
+
+        Fixed the both regressions by avoiding tab spans when computing the editing style and when cloning hierarchy.
+
+        Test: editing/inserting/insert-paragraph-separator-tab-span.html
+
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::init): Always avoid a tab span when computing the editing style.
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply): Avoid cloning tab spans and inserting a paragraph
+        separator into a paragraph separator.
+
+2011-04-06  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add member functions for determining line/paragraph separation to InlineIterator
+        https://bugs.webkit.org/show_bug.cgi?id=57938
+
+        Adding atTextParagraphSeparator and atParagraphSeparator inline convenience functions to
+        InlineIterator, where it makes far more sense for them to be. Also moving
+        shouldPreserveNewline to RenderObject and renaming it preservesNewline.
+
+        No new tests as this provides no new functionality.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::atTextParagraphSeparator):
+        (WebCore::InlineIterator::atParagraphSeparator):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::requiresLineBox):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::preservesNewline):
+
+2011-04-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Range insertNode function does not update content in the inspector
+        https://bugs.webkit.org/show_bug.cgi?id=57829
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+
+2011-04-06  Alejandro G. Castro  <alex@igalia.com>
+
+        Fix GTK3 compilation after r82962.
+
+        * platform/gtk/RenderThemeGtk3.cpp:
+        (WebCore::paintToggle):
+        (WebCore::renderButton):
+        (WebCore::RenderThemeGtk::paintMenuList):
+        (WebCore::RenderThemeGtk::paintTextField):
+        (WebCore::RenderThemeGtk::paintSliderTrack):
+        (WebCore::RenderThemeGtk::paintSliderThumb):
+        (WebCore::RenderThemeGtk::paintProgressBar):
+        (WebCore::paintSpinArrowButton):
+        * platform/gtk/ScrollbarThemeGtk3.cpp:
+        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
+        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeGtk::paintThumb):
+        (WebCore::ScrollbarThemeGtk::paintButton):
+
+2011-04-06  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [Extensions API] remove inspectedPage.* events
+        https://bugs.webkit.org/show_bug.cgi?id=57763
+
+        - Removed webInspector.inspectedPage.* events
+        - moved onNavigated to webInspector.resources
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI):
+        (WebInspector.injectedExtensionAPI.InspectedWindow):
+        * inspector/front-end/ExtensionAPISchema.json:
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype.notifyInspectedURLChanged):
+        * inspector/front-end/inspector.js:
+        (WebInspector.domContentEventFired):
+        (WebInspector.loadEventFired):
+        (WebInspector.inspectedURLChanged):
+
+2011-04-06  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Add <head> to the simpleUserAgentStyleSheet
+        https://bugs.webkit.org/show_bug.cgi?id=57915
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::elementCanUseSimpleDefaultStyle): add head to the
+        simple stylesheet, display:none.
+
+2011-04-05  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Add layout test for Summary view of detailed heap snapshots.
+        https://bugs.webkit.org/show_bug.cgi?id=57856
+
+        Test: inspector/profiler/detailed-heapshots-summary.html
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype._populate.doPopulate):
+        (WebInspector.HeapSnapshotGridNode.prototype._populate):
+        (WebInspector.HeapSnapshotGridNode.prototype.populateChildren):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort.doSort):
+        (WebInspector.HeapSnapshotGridNode.prototype.sort):
+        (WebInspector.HeapSnapshotDiffNode.prototype.populateChildren):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype.sortingChanged):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._finishHeapSnapshot.doParse):
+        (WebInspector.ProfilesPanel.prototype._finishHeapSnapshot):
+
+2011-04-06  Anders Bakken  <agbakken@gmail.com>
+
+        Reviewed by David Levin.
+
+        [Qt] SmartReplaceQt.cpp has coding-style errors
+        https://bugs.webkit.org/show_bug.cgi?id=40261
+
+        This patch does not require new test cases.
+
+        * editing/qt/SmartReplaceQt.cpp:
+        (WebCore::isCharacterSmartReplaceExempt):
+
+2011-04-06  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        REGRESSION(r81328): Null pointer crash in canAppendNewLineFeed when selection isn't inside an editable element
+        https://bugs.webkit.org/show_bug.cgi?id=57755
+
+        Test: editing/execCommand/insert-line-break-onload.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::canAppendNewLineFeed): Added null pointer check for rootEditableElement().
+
+2011-04-05  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Avoid calling currentTime() from FrameView::adjustedDeferredRepaintDelay() when repaints are deferred
+        https://bugs.webkit.org/show_bug.cgi?id=57914
+
+        Don't call adjustedDeferredRepaintDelay unnecessarily.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::adjustedDeferredRepaintDelay):
+
+2011-04-05  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by David Levin.
+
+        Update call to SkAdvancedTypefaceMetrics to new API.
+        https://bugs.webkit.org/show_bug.cgi?id=57887
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::emSizeInFontUnits):
+
+2011-04-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Rename event dispatching functions after form event removal
+        https://bugs.webkit.org/show_bug.cgi?id=57908
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchChangeEvent):
+        (WebCore::Node::dispatchInputEvent):
+        (WebCore::Node::defaultEventHandler):
+        * dom/Node.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        (WebCore::HTMLFormControlElement::dispatchFormControlInputEvent):
+        (WebCore::HTMLTextFormControlElement::dispatchFormControlChangeEvent):
+        Renamed "events" to "event", since there is only one event to dispatch now.
+
+2011-04-05  Anders Bakken  <agbakken@gmail.com>
+
+        Reviewed by David Levin.
+
+        [Qt] DragControllerQt.cpp has coding-style errors
+        https://bugs.webkit.org/show_bug.cgi?id=40258
+
+        This patch does not require new test cases.
+
+        * page/qt/DragControllerQt.cpp:
+        (WebCore::DragController::dragOperation):
+
+2011-04-05  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by David Levin.
+
+        Update deprecated include: platform_canvas_win.h to platform_canvas.h.
+        https://bugs.webkit.org/show_bug.cgi?id=57896
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+
+2011-04-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Leopard bots.
+
+        * platform/mac/HTMLConverter.mm: Fix #if back the way Alexey seems
+        to have intended it.
+
+2011-04-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Leopard bots.
+
+        * platform/mac/HTMLConverter.mm: Move declarations of new functions
+        inside the appropriate #if.
+
+2011-04-05  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Tony Chang.
+
+        Correctly set color when using skia's fillRoundedRect.
+        https://bugs.webkit.org/show_bug.cgi?id=57907
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+2011-04-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Move attributedStringFromRange down to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=57905
+
+        No change in behavior, so no new tests.
+
+        Also tweaked HTMLConverter to not use methods defined in WebKit.
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/HTMLConverter.h:
+        * platform/mac/HTMLConverter.mm:
+        (-[WebHTMLConverter _newTabForElement:]):
+        (-[WebHTMLConverter _addAttachmentForElement:URL:needsParagraph:usePlaceholder:]):
+        (+[WebHTMLConverter editingAttributedStringFromRange:]):
+        (fileWrapperForURL):
+        (fileWrapperForElement):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/mac/WebNSAttributedStringExtras.h: Copied from Source/WebKit/mac/Misc/WebNSAttributedStringExtras.h.
+        * platform/mac/WebNSAttributedStringExtras.mm: Copied from Source/WebKit/mac/Misc/WebNSAttributedStringExtras.mm.
+        (WebCore::attributedStringByStrippingAttachmentCharacters):
+
+2011-04-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Rename variables in border drawing code for readability
+        https://bugs.webkit.org/show_bug.cgi?id=57894
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::drawBoxSideFromPath):
+        (WebCore::RenderObject::drawArcForBoxSide):
+
+2011-04-05  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Defer repaints during style recalc
+        https://bugs.webkit.org/show_bug.cgi?id=57886
+
+        This reduces the need to do (often expensive) platform surface invalidation.
+        We already do this during layout but style recalculation may trigger
+        invalidation as well.
+    
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+
+2011-04-05  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        HTML5 Player Has no Fullscreen Mode
+        https://bugs.webkit.org/show_bug.cgi?id=57795
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen): Call the new ChromeClient API
+            supportsFullScreenForElement() before the old supportsFullScreenForNode() API.
+
+2011-04-05  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: fix data url's status and timing the network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=53066
+
+        Added data url support for status of network resources.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkDataGridNode.prototype._refreshStatusCell):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.isDataURL):
+
+2011-04-04  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Keep dirty primitive CSS values alive.
+        https://bugs.webkit.org/show_bug.cgi?id=57810
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+
+2011-04-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add a fast path for simple color backgrounds
+        https://bugs.webkit.org/show_bug.cgi?id=57773
+
+        Add a fast path for drawing simple color backgrounds. It's
+        faster to fill a path or rect than it is to set up a clip,
+        and then paint the rect.
+        
+        No visible behavior change so no new tests.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2011-04-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed EFL build fix for r82962.
+
+        * CMakeListsEfl.txt:
+
+2011-04-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add support for offline audio rendering to AudioContext API
+        https://bugs.webkit.org/show_bug.cgi?id=57676
+
+        No new tests since audio API is not yet implemented.
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAudioContextCustom.cpp:
+        (WebCore::JSAudioContextConstructor::constructJSAudioContext):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/custom/V8AudioContextCustom.cpp:
+        (WebCore::V8AudioContext::constructorCallback):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::toV8):
+        * dom/Event.cpp:
+        (WebCore::Event::isOfflineAudioCompletionEvent):
+        * dom/Event.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toAudioContext):
+        * dom/EventTarget.h:
+        * platform/audio/HRTFDatabaseLoader.cpp:
+        (WebCore::HRTFDatabaseLoader::waitForLoaderThreadCompletion):
+        * platform/audio/HRTFDatabaseLoader.h:
+        (WebCore::HRTFDatabaseLoader::loader):
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::createOfflineContext):
+        (WebCore::AudioContext::AudioContext):
+        (WebCore::AudioContext::constructCommon):
+        (WebCore::AudioContext::document):
+        (WebCore::AudioContext::scriptExecutionContext):
+        (WebCore::AudioContext::toAudioContext):
+        (WebCore::AudioContext::startRendering):
+        (WebCore::AudioContext::fireCompletionEvent):
+        * webaudio/AudioContext.h:
+        (WebCore::AudioContext::isOfflineContext):
+        (WebCore::AudioContext::eventTargetData):
+        (WebCore::AudioContext::ensureEventTargetData):
+        (WebCore::AudioContext::refEventTarget):
+        (WebCore::AudioContext::derefEventTarget):
+        * webaudio/AudioContext.idl:
+        * webaudio/AudioDestinationNode.cpp:
+        (WebCore::AudioDestinationNode::AudioDestinationNode):
+        * webaudio/AudioDestinationNode.h:
+        (WebCore::AudioDestinationNode::reset):
+        (WebCore::AudioDestinationNode::numberOfChannels):
+        * webaudio/ConvolverNode.cpp:
+        (WebCore::ConvolverNode::setBuffer):
+        * webaudio/DefaultAudioDestinationNode.cpp: Added.
+        (WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
+        (WebCore::DefaultAudioDestinationNode::~DefaultAudioDestinationNode):
+        (WebCore::DefaultAudioDestinationNode::initialize):
+        (WebCore::DefaultAudioDestinationNode::uninitialize):
+        (WebCore::DefaultAudioDestinationNode::startRendering):
+        * webaudio/DefaultAudioDestinationNode.h: Added.
+        (WebCore::DefaultAudioDestinationNode::create):
+        (WebCore::DefaultAudioDestinationNode::sampleRate):
+        * webaudio/OfflineAudioCompletionEvent.cpp: Added.
+        (WebCore::OfflineAudioCompletionEvent::create):
+        (WebCore::OfflineAudioCompletionEvent::OfflineAudioCompletionEvent):
+        (WebCore::OfflineAudioCompletionEvent::~OfflineAudioCompletionEvent):
+        (WebCore::OfflineAudioCompletionEvent::isOfflineAudioCompletionEvent):
+        * webaudio/OfflineAudioCompletionEvent.h: Added.
+        (WebCore::OfflineAudioCompletionEvent::renderedBuffer):
+        * webaudio/OfflineAudioCompletionEvent.idl: Added.
+        * webaudio/OfflineAudioDestinationNode.cpp: Added.
+        (WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
+        (WebCore::OfflineAudioDestinationNode::~OfflineAudioDestinationNode):
+        (WebCore::OfflineAudioDestinationNode::initialize):
+        (WebCore::OfflineAudioDestinationNode::uninitialize):
+        (WebCore::OfflineAudioDestinationNode::startRendering):
+        (WebCore::OfflineAudioDestinationNode::renderEntry):
+        (WebCore::OfflineAudioDestinationNode::render):
+        (WebCore::OfflineAudioDestinationNode::notifyCompleteDispatch):
+        (WebCore::OfflineAudioDestinationNode::notifyComplete):
+        * webaudio/OfflineAudioDestinationNode.h: Added.
+        (WebCore::OfflineAudioDestinationNode::create):
+        (WebCore::OfflineAudioDestinationNode::sampleRate):
+
+2011-04-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Cairo] Better separate the concerns of GraphicsContextCairo
+        https://bugs.webkit.org/show_bug.cgi?id=55150
+
+        Add a PlatformContextCairo which right now stores the cairo_t* for a
+        GraphicsContextCairo. Later patches will move logic for tracking ContextShadow
+        and image masking layers into this PlatformContextCairo class.
+
+        No new tests. This patch is only a code cleanup.
+
+        * GNUmakefile.am:
+        * platform/graphics/GraphicsContext.h: The platform context is no longer a
+        cairo_t, but our new class the PlatformContextCairo.
+        * platform/graphics/cairo/ContextShadowCairo.cpp: Updated to reflect new class.j
+        * platform/graphics/cairo/FontCairo.cpp: Ditto.
+        * platform/graphics/cairo/GradientCairo.cpp: Ditto.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp: Mostly mechanical
+        changes which now reference platformContext()->cr() to get the cairo_t.
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h: Now hold the
+        PlatformContextCairo instead of the cairo_t.
+        * platform/graphics/cairo/ImageBufferCairo.cpp: Update to reflect new class.
+        * platform/graphics/cairo/ImageCairo.cpp: Ditto.
+        * platform/graphics/cairo/PathCairo.cpp: Ditto.
+        * platform/graphics/cairo/PlatformContextCairo.cpp: Added.
+        * platform/graphics/cairo/PlatformContextCairo.h: Added.
+        * platform/graphics/gtk/FontGtk.cpp: Update to reflect new class.
+        * platform/graphics/gtk/IconGtk.cpp: Ditto.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Now fill out
+        m_data with a private section containing the platform context instead of
+        just a cairo_t.
+        * platform/gtk/RenderThemeGtk.cpp: Update to reflect new class.
+        * platform/gtk/WidgetRenderingContext.cpp: Ditto.
+        (WebCore::WidgetRenderingContext::~WidgetRenderingContext): Ditto.
+        * plugins/gtk/PluginViewGtk.cpp: Ditto.
+
+2011-04-05  David Dorwin  <ddorwin@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fullscreen code assumes all layers use GPU compositing when USE(ACCELERATED_COMPOSITING)
+        https://bugs.webkit.org/show_bug.cgi?id=57400
+
+        Check whether the full screen renderer layer is being composited by the GPU before assuming that the backing is valid. 
+        Accelerated compositing may be compiled in but disabled at runtime or for some elements.
+
+        Tests: Fullscreen layout tests on Chromium.
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitWillEnterFullScreenForElement):
+        (WebCore::Document::webkitDidEnterFullScreenForElement):
+        (WebCore::Document::webkitWillExitFullScreenForElement):
+
+2011-04-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Regression: Invalid write in SVGTextLayoutEngine
+        https://bugs.webkit.org/show_bug.cgi?id=57721
+
+        Properly stop layout if all metrics object refer to zero-width/height characters,
+        which can happen for instance when using <text font-size="0">.
+
+        Test: svg/text/font-size-null-assertion.svg
+
+        * rendering/svg/SVGTextLayoutEngine.cpp:
+        (WebCore::SVGTextLayoutEngine::currentLogicalCharacterAttributes):
+        (WebCore::SVGTextLayoutEngine::currentLogicalCharacterMetrics):
+
+2011-04-04 MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+        
+        Removed WebCore::SpellCheckingResult and replaced it with TextCheckingResult.
+        This change also added TextCheckerClient::requestCheckingOfString() should have
+        TextCheckingTypeMask as a parameter to control text checking type.
+
+        * WebCore.exp.in:
+        * editing/Editor.cpp:
+        (WebCore::Editor::replaceSelectionWithFragment):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::textCheckingTypeMaskFor): Extracted from markAllMisspellingsAndBadGrammarInRanges()
+        * editing/SpellChecker.cpp:
+        (WebCore::SpellChecker::requestCheckingFor): Added a parameter.
+        (WebCore::SpellChecker::markAt): Extracted from didCheck(), Added a check for the GrammarDetail object.
+        (WebCore::SpellChecker::didCheck):
+        * editing/SpellChecker.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyTextCheckerClient::checkTextOfParagraph):
+        (WebCore::EmptyTextCheckerClient::requestCheckingOfString):
+        * platform/text/TextCheckerClient.h:
+
+2011-04-04  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Print stylesheet on nytimes.com loads too early
+        https://bugs.webkit.org/show_bug.cgi?id=57814
+
+        Don't load resources with Very Low priority until there are no other resources to 
+        load for the host (or until document is complete enough that we stop limiting requests).
+
+        No tests, this is  difficult to observe reliably with our current testing infrastructure.
+        Verified working with Wireshark.
+
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::ResourceLoadScheduler::servePendingRequests):
+        (WebCore::ResourceLoadScheduler::HostInformation::limitRequests):
+        * loader/ResourceLoadScheduler.h:
+
+2011-04-04  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        JavaInstance should be a pure interface
+        https://bugs.webkit.org/show_bug.cgi?id=55383
+
+        This patch fixes JavaInstance for V8 only.
+
+        It factors out a JavaInstance interface which does not use JNI
+        types. This will allow the Java bridge to be used with objects
+        that don't use JNI directly. The existing jobject-backed
+        implementation is moved to a new JavaInstanceJobject class which
+        implements the interface.
+
+        No new tests, refactoring only.
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bridge/jni/JobjectWrapper.h:
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::jvalueToJavaValue):
+        (JSC::Bindings::javaValueToJvalue):
+        * bridge/jni/v8/JavaInstanceJobjectV8.cpp:
+        (JavaInstanceJobject::JavaInstanceJobject):
+        (JavaInstanceJobject::~JavaInstanceJobject):
+        (JavaInstanceJobject::begin):
+        (JavaInstanceJobject::end):
+        (JavaInstanceJobject::getClass):
+        (JavaInstanceJobject::invokeMethod):
+        (JavaInstanceJobject::getField):
+        * bridge/jni/v8/JavaInstanceJobjectV8.h: Copied from Source/WebCore/bridge/jni/v8/JavaInstanceV8.h.
+        (JSC::Bindings::JavaInstanceJobject::javaInstance):
+        * bridge/jni/v8/JavaInstanceV8.h:
+        (JSC::Bindings::JavaInstance::~JavaInstance):
+
+2011-04-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+       Reviewed by Darin Adler.
+
+        Move MouseEvent-dispatching logic into MouseEventDispatchMediator.
+        https://bugs.webkit.org/show_bug.cgi?id=57639
+
+        Refactoring, covered by existing tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchEvent): Moved useful assertion here
+            from dispatchMouseEvent.
+        (WebCore::EventDispatcher::adjustRelatedTarget): Converted into a method.
+        * dom/EventDispatcher.h: Adjusted decls.
+        (WebCore::EventDispatcher::node): Added.
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEvent::create): Moved useful assertion here from
+            dispatchMouseEvent.
+        (WebCore::MouseEventDispatchMediator::MouseEventDispatchMediator): Added.
+        (WebCore::MouseEventDispatchMediator::event): Added.
+        (WebCore::MouseEventDispatchMediator::dispatchEvent): Added.
+        * dom/MouseEvent.h:
+        (WebCore::MouseEvent::setRelatedTarget): Added.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent): Changed to use MouseEventDispatchMediator.
+
+2011-04-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Adam Roben & Dirk Schulze.
+
+        text-tspan-02-b.svg from SVG 1.1 2nd edition fails
+        https://bugs.webkit.org/show_bug.cgi?id=57831
+
+        We were not spanning rotation values correcty accross text children, which resulted in text-span-02-b.svg misrendering.
+        While rewriting the rotation specific code, it came apparent that the LayoutScope concept is flawed in general and
+        should be replaced by a global list of x/y/dx/dy/rotate values for the whole text subtree. This makes it much simpler
+        to implement the demand that the last rotation value spans the whole scope. A follow-up patch will optimize the
+        required memory.
+
+        Example:
+        <text rotate="10,20,999,50">AB<tspan rotate="30">CDE</>FGH</text>
+    
+        text:   A  B  C  D  E  F  G  H
+        rotate="10 20 30 30 30 50 50 50"
+
+        Tests: svg/W3C-SVG-1.1-SE/text-tspan-02-b.svg
+               svg/text/text-midpoint-split-bug.svg
+
+        * rendering/RenderBlockLineLayout.cpp:     Move SVG specific midpoint creation after the non-SVG specific code that may mutate the midpoints. otherwhise we end up in an
+        (WebCore::RenderBlock::findNextLineBreak): inconsistent state. We were intereferring with the ignoreSpaces code resulting in wrong truncations - covered by new testcase.
+        * rendering/svg/SVGTextLayoutAttributes.cpp:
+        (WebCore::SVGTextLayoutAttributes::reserveCapacity): Also reserveCapacity for the text metrics list (minor optimization).
+        (WebCore::SVGTextLayoutAttributes::fillWithEmptyValue): Added helper function for use from SVGTextLayoutAttributesBuilder.
+        (WebCore::SVGTextLayoutAttributes::appendEmptyValue): Ditto.
+        (WebCore::safeValueAtPosition): Ditto. (Inline helper)
+        (WebCore::SVGTextLayoutAttributes::appendSingleValueFromAttribute): Ditto.
+        * rendering/svg/SVGTextLayoutAttributes.h: Ditto.
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp: Rewrite code, see explaination above.
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree):
+        (WebCore::processRenderSVGInlineText):
+        (WebCore::SVGTextLayoutAttributesBuilder::collectTextPositioningElements):
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForAllCharacters):
+        (WebCore::SVGTextLayoutAttributesBuilder::propagateLayoutAttributes):
+        (WebCore::fillListAtPosition):
+        (WebCore::SVGTextLayoutAttributesBuilder::fillAttributesAtPosition):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.h:
+        (WebCore::SVGTextLayoutAttributesBuilder::TextPosition::TextPosition):
+
+2011-04-05  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        DeleteButtonController is given invalid style
+        https://bugs.webkit.org/show_bug.cgi?id=57853
+
+        DeleteButtonController was assigned an invalid style that can lead to assertions
+        in debug builds. This matches up the code with its intent.
+
+        No new tests as this changes nothing on release builds.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+
+2011-04-05  Anders Bakken  <agbakken@gmail.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] EditorQt.cpp has coding-style errors
+        https://bugs.webkit.org/show_bug.cgi?id=40260
+        
+        This patch does not require new test cases.
+
+        * editing/qt/EditorQt.cpp:
+
+2011-04-05  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: go to line dialog highlights wrong line.
+        https://bugs.webkit.org/show_bug.cgi?id=57845
+
+        * inspector/front-end/GoToLineDialog.js:
+        (WebInspector.GoToLineDialog.prototype._highlightSelectedLine):
+
+2011-04-05  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement CSSPropertyDirection in CSSStyleApplyProperty
+        https://bugs.webkit.org/show_bug.cgi?id=57608
+
+        No new tests required as no new functionality introduced.
+
+        * css/CSSStyleApplyProperty.cpp:
+        Add implementation class for CSSPropertyDirection
+        * css/CSSStyleSelector.cpp:
+        Remove existing implementation for CSSPropertyDirection
+        * css/CSSStyleSelector.h:
+        Add getter for element
+
+2011-04-05  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Factoring the creation of 'FunctionOnly' callbacks in V8.
+        https://bugs.webkit.org/show_bug.cgi?id=57760
+
+        This method creates a template from an existing functionality in V8GeolocationCustom.cpp
+        to V8Utilities to be used by the custom bindings of both Geolocation and the Media Stream API.
+
+        No new tests. LayoutTests/fast/dom/Geolocation/argument-types.html
+
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::throwTypeMismatchException):
+        * bindings/v8/V8Utilities.h:
+        (WebCore::createFunctionOnlyCallback):
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        (WebCore::V8Geolocation::getCurrentPositionCallback):
+        (WebCore::V8Geolocation::watchPositionCallback):
+
+2011-04-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        Switch from Vector<UChar> to StringBuilder in bindings/
+        https://bugs.webkit.org/show_bug.cgi?id=57838
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::cssPropertyName):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::cssPropertyInfo):
+
+2011-04-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        Switch from Vector<UChar> to StringBuilder in accessibility/
+        https://bugs.webkit.org/show_bug.cgi?id=57837
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::listMarkerTextForNodeAndPosition):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescriptionForElements):
+
+2011-04-05  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Scripts with syntax errors are cropped in the UI
+        https://bugs.webkit.org/show_bug.cgi?id=57828
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.addMessageToSource):
+
+2011-04-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove onformchange and onforminput events/event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=55755
+        <rdar://problem/9087969>
+
+        Covered by existing tests.
+
+        * dom/Document.h:
+        * dom/Document.idl:
+        * dom/Element.h:
+        * dom/Element.idl:
+        * dom/Event.cpp:
+        (WebCore::Event::fromUserGesture):
+        * dom/EventNames.h:
+        * html/FormAssociatedElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLElement.h:
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isEnumeratable):
+        * html/HTMLFormElement.cpp:
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.idl:
+        * html/HTMLInputElement.h:
+        * html/HTMLKeygenElement.h:
+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement::isEnumeratable):
+        * html/HTMLOutputElement.h:
+        (WebCore::HTMLOutputElement::isEnumeratable):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::isEnumeratable):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::isEnumeratable):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2011-04-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82915.
+        http://trac.webkit.org/changeset/82915
+        https://bugs.webkit.org/show_bug.cgi?id=57825
+
+        Broke 270 chromium tests on win and linux (Requested by
+        podivilov on #webkit).
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+
+2011-04-05  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Stop preload scanning CSS when it&apos;s impossible to have another @import.
+        https://bugs.webkit.org/show_bug.cgi?id=57664
+
+        @import statements are only allowed at the beginning of a CSS file.
+        Only comments or @charset can precede them. After seeing anything else,
+        abort early so that we:
+        - don't have to parse the rest of the CSS.
+        - don't preload something that the regular parser won't load.
+
+        * html/parser/CSSPreloadScanner.cpp:
+        (WebCore::CSSPreloadScanner::scan): Terminate early if we're done with @imports.
+        (WebCore::CSSPreloadScanner::tokenize): Terminate early if we see a {} or any style rule.
+        (WebCore::CSSPreloadScanner::emitRule): Only @charset or @import are allowed to precede @import.
+        * html/parser/CSSPreloadScanner.h: Add DoneParsingImportRules state.
+
+2011-04-05  Takayoshi Kochi <kochi@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Specify 'sans-serif' as a fallback to the default UI font
+        'Arial' for non-latin UI scripts (e.g. CJK).
+        https://bugs.webkit.org/show_bug.cgi?id=55035
+
+        No new tests, because it may still fail if the system is not configured
+        properly to resolve 'sans-serif' to existing real font file, thus even
+        manual test is hard to systematically tell it is working properly.
+
+        * rendering/RenderThemeChromiumSkia.cpp
+
+2011-04-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Setting defaultValue on a textarea with a modified value still clobbers the value
+        https://bugs.webkit.org/show_bug.cgi?id=57636
+
+        If the dirty flag is true, we shouldn't update the value when the
+        defaultValue is updated
+
+        Test: fast/forms/textarea-set-defaultvalue-after-value.html
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::childrenChanged):
+        (WebCore::HTMLTextAreaElement::setDefaultValue):
+
+2011-04-04  Kent Tamura  <tkent@chromium.org>
+
+        Add a case label which was unexpectedly removed in r82899.
+        https://bugs.webkit.org/show_bug.cgi?id=50661
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+
+2011-04-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7709452> Implement Default Ruby Overhang Behavior
+        https://bugs.webkit.org/show_bug.cgi?id=49334
+
+        Tests: fast/ruby/overhang-horizontal.html
+               fast/ruby/overhang-vertical.html
+
+        This is a first cut at ruby overhang. It allows ruby text to hang over other
+        text of equal or smaller size. Two notable omissions are that max preferred
+        width computation was not patched, so it will overshoot, and that overhang
+        ignores the width of the adjoining text runs.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Adjust margins
+        of ruby runs for overhang.
+        (WebCore::RenderBlock::fitBelowFloats): Maintain the increase in line width to
+        compensate for overhang.
+        (WebCore::RenderBlock::findNextLineBreak): When encountering
+        a ruby run, increase the line width to account for the fact that overhang will be
+        collapsed.
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::getOverhang): Added. Allows ruby to overhang if
+        the adjoining renderer is text with equal or smaller font size.
+        * rendering/RenderRubyRun.h:
+        (WebCore::toRenderRubyRun):
+
+2011-04-04  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/57384> CFNetwork and WebCore load priorities should match
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCore.exp.in: Export wkSetHTTPPipeliningMaximumPriority().
+        * platform/mac/WebCoreSystemInterface.h:
+        (wkSetHTTPPipeliningMaximumPriority): Added function pointer
+        declaration.
+        * platform/mac/WebCoreSystemInterface.mm:
+        (wkSetHTTPPipeliningMaximumPriority): Added function pointer.
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Call
+        wkSetHTTPPipeliningMaximumPriority() to set the maximum HTTP
+        pipelining priority.
+        * platform/network/cf/ResourceRequestCFNet.h:
+        (WebCore::toResourceLoadPriority): Renamed from
+        mapHTTPPipeliningPriorityToResourceLoadPriority().  Updated to
+        to handle Unresolved case.
+        (WebCore::toHTTPPipeliningPriority): Renamed from
+        mapResourceLoadPriorityToHTTPPipeliningPriority().  Updated to
+        handle Unresolved case.
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest): Switched to
+        use toResourceLoadPriority().
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Switched to
+        use toHTTPPipeliningPriority().  Moved
+        shouldForceHTTPPipeliningPriorityHigh() check into the argument
+        of toHTTPPipeliningPriority() instead of hard-coding a
+        now-incorrect value.
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Convert <meter> shadow DOM to a DOM-based shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=50661
+        
+        Eliminated a large part of <meter> custom layout code,
+        which is replaced by a shadow tree.
+        Note that the shadow tree is created on construction time and
+        will remain during the host HTMLMeterElement lifecycle.
+        
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::setProperty):
+        * css/CSSMutableStyleDeclaration.h:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/html.css:
+        (meter):
+        (meter::-webkit-meter-bar):
+        (meter::-webkit-meter-optimum-value):
+        (meter::-webkit-meter-suboptimum-value):
+        (meter::-webkit-meter-even-less-good-value):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::~HTMLMeterElement):
+        (WebCore::HTMLMeterElement::parseMappedAttribute):
+        (WebCore::HTMLMeterElement::attach):
+        (WebCore::HTMLMeterElement::valueRatio):
+        (WebCore::HTMLMeterElement::didElementStateChange):
+        (WebCore::HTMLMeterElement::createShadowSubtree):
+        * html/HTMLMeterElement.h:
+        * html/shadow/MeterShadowElement.cpp: Added.
+        (WebCore::MeterShadowElement::MeterShadowElement):        
+        (WebCore::MeterShadowElement::meterElement):
+        (WebCore::MeterShadowElement::rendererIsNeeded):
+        (WebCore::MeterBarElement::shadowPseudoId):
+        (WebCore::MeterValueElement::shadowPseudoId):
+        (WebCore::MeterValueElement::setWidthPercentage):
+        * html/shadow/MeterShadowElement.h: Added.
+        (WebCore::MeterBarElement::MeterBarElement):
+        (WebCore::MeterBarElement::create):
+        (WebCore::MeterValueElement::MeterValueElement):
+        (WebCore::MeterValueElement::create):
+        * rendering/RenderMeter.cpp:
+        (WebCore::RenderMeter::RenderMeter):
+        (WebCore::RenderMeter::~RenderMeter):
+        (WebCore::RenderMeter::valueRatio):
+        * rendering/RenderMeter.h:
+        (WebCore::RenderMeter::renderName):
+        (WebCore::RenderMeter::isMeter):
+        (WebCore::RenderMeter::requiresForcedStyleRecalcPropagation):
+        (WebCore::RenderMeter::canHaveChildren):
+
+2011-04-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Introduce EventDispatchMediator abstraction, which encapsulate all
+        non-trivial logic around firing a specific type of an event.
+        https://bugs.webkit.org/show_bug.cgi?id=57562
+
+        Refactoring, covered by existing tests.
+
+        * dom/Event.cpp:
+        (WebCore::EventDispatchMediator::EventDispatchMediator): Added.
+        (WebCore::EventDispatchMediator::~EventDispatchMediator): Added.
+        (WebCore::EventDispatchMediator::dispatchEvent): Added.
+        (WebCore::EventDispatchMediator::event): Added.
+        * dom/Event.h: Added decl.
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchEvent): Changed to use EventDispatchMediator.
+        * dom/EventDispatcher.h: Updated decls.
+        * dom/KeyboardEvent.cpp:
+        (WebCore::KeyboardEventDispatchMediator::KeyboardEventDispatchMediator): Added.
+        (WebCore::KeyboardEventDispatchMediator::dispatchEvent): Added.
+        * dom/KeyboardEvent.h: Updated decls
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchEvent): Changed to use EventDispatchMediator.
+        (WebCore::Node::dispatchKeyEvent): Changed to use KeyboardEventDispatchMediator.
+
+2011-04-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Cairo] Memory leak in RefPtrCairo
+        https://bugs.webkit.org/show_bug.cgi?id=57758
+
+        No new tests. This just fixes a memory leak.
+
+        * platform/graphics/cairo/RefPtrCairo.cpp:
+        (WTF::derefIfNotNull): Deref should unref the cairo_font_fact_t, not reference it.
+
+2011-04-04  Adrienne Walker  <enne@google.com>
+
+        Unreviewed, rolling out r82880.
+        http://trac.webkit.org/changeset/82880
+        https://bugs.webkit.org/show_bug.cgi?id=50661
+
+        Meter elements not rendered in Chromium Linux layout tests
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSMutableStyleDeclaration.cpp:
+        * css/CSSMutableStyleDeclaration.h:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/html.css:
+        (meter):
+        (meter::-webkit-meter):
+        (meter::-webkit-meter-bar):
+        (meter::-webkit-meter-optimum-value):
+        (meter::-webkit-meter-suboptimal-value):
+        (meter::-webkit-meter-even-less-good-value):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::create):
+        (WebCore::HTMLMeterElement::parseMappedAttribute):
+        (WebCore::HTMLMeterElement::attach):
+        * html/HTMLMeterElement.h:
+        * html/shadow/MeterShadowElement.cpp: Removed.
+        * html/shadow/MeterShadowElement.h: Removed.
+        * rendering/RenderMeter.cpp:
+        (WebCore::RenderMeter::RenderMeter):
+        (WebCore::RenderMeter::~RenderMeter):
+        (WebCore::RenderMeter::createPart):
+        (WebCore::RenderMeter::updateFromElement):
+        (WebCore::RenderMeter::layoutParts):
+        (WebCore::RenderMeter::styleDidChange):
+        (WebCore::RenderMeter::shouldHaveParts):
+        (WebCore::RenderMeter::valueRatio):
+        (WebCore::RenderMeter::barPartRect):
+        (WebCore::RenderMeter::valuePartRect):
+        (WebCore::RenderMeter::valuePseudoId):
+        (WebCore::RenderMeter::barPseudoId):
+        (WebCore::RenderMeter::detachShadows):
+        (WebCore::RenderMeter::updateShadows):
+        * rendering/RenderMeter.h:
+        (WebCore::RenderMeter::renderName):
+        (WebCore::RenderMeter::isMeter):
+        (WebCore::RenderMeter::shadowAttached):
+
+2011-04-04  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        setContentEditable with true/false/inherit string is not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=52058
+
+        Move isContentEditable from HTMLElement to Node. Thus, Node provides two functions for
+        checking editability: rendererIsEditable and isContentEdiable. The former is a fast path,
+        which does NOT trigger layout and only checks the render style of usermodify. The latter
+        updates the layout first to make sure the render style syncs with DOM contenteditable 
+        attribute. Certain call sites that need to call isContentEditable rather than rendererIsEditable
+        are also updated in the patch. But a complete fix will follow up in bug 57244.
+
+        This patch fixes all the failed layout tests related to set contenteditable.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable):
+        (WebCore::Node::shouldUseInputMethod):
+        * dom/Node.h:
+        * html/HTMLElement.cpp:
+        * html/HTMLElement.h:
+
+2011-04-04  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 57689 - Extract scoping functionality from Document
+        https://bugs.webkit.org/show_bug.cgi?id=57689
+
+        Moved selfOnlyRef (renamed to guardRef), element ID, image map
+        and accesss key functionalities from Document to a new base
+        class TreeScope.
+
+        TreeShared: made removedLastRef protected
+
+        No new tests. (refactoring)
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::destroyScope):
+        (WebCore::Document::getElementById):
+        (WebCore::Document::childrenChanged):
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        (WebCore::Node::Node):
+        * dom/DocumentOrderedMap.cpp:
+        (WebCore::DocumentOrderedMap::get):
+        (WebCore::DocumentOrderedMap::getElementById):
+        (WebCore::DocumentOrderedMap::getElementByMapName):
+        (WebCore::DocumentOrderedMap::getElementByLowercasedMapName):
+        * dom/DocumentOrderedMap.h:
+        * dom/DOMAllInOne.cpp:
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::setDocument):
+        * dom/Node.h:
+        * dom/TreeScope.cpp: Added.
+        * dom/TreeScope.h: Added.
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::removedLastRef): made protected
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Convert <meter> shadow DOM to a DOM-based shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=50661
+        
+        Eliminated a large part of <meter> custom layout code,
+        which is replaced by a shadow tree.
+        Note that the shadow tree is created on construction time and
+        will remain during the host HTMLMeterElement lifecycle.
+        
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::setProperty):
+        * css/CSSMutableStyleDeclaration.h:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/html.css:
+        (meter):
+        (meter::-webkit-meter-bar):
+        (meter::-webkit-meter-optimum-value):
+        (meter::-webkit-meter-suboptimum-value):
+        (meter::-webkit-meter-even-less-good-value):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::~HTMLMeterElement):
+        (WebCore::HTMLMeterElement::parseMappedAttribute):
+        (WebCore::HTMLMeterElement::attach):
+        (WebCore::HTMLMeterElement::valueRatio):
+        (WebCore::HTMLMeterElement::didElementStateChange):
+        (WebCore::HTMLMeterElement::createShadowSubtree):
+        * html/HTMLMeterElement.h:
+        * html/shadow/MeterShadowElement.cpp: Added.
+        (WebCore::MeterShadowElement::MeterShadowElement):        
+        (WebCore::MeterShadowElement::meterElement):
+        (WebCore::MeterShadowElement::rendererIsNeeded):
+        (WebCore::MeterBarElement::shadowPseudoId):
+        (WebCore::MeterValueElement::shadowPseudoId):
+        (WebCore::MeterValueElement::setWidthPercentage):
+        * html/shadow/MeterShadowElement.h: Added.
+        (WebCore::MeterBarElement::MeterBarElement):
+        (WebCore::MeterBarElement::create):
+        (WebCore::MeterValueElement::MeterValueElement):
+        (WebCore::MeterValueElement::create):
+        * rendering/RenderMeter.cpp:
+        (WebCore::RenderMeter::RenderMeter):
+        (WebCore::RenderMeter::~RenderMeter):
+        (WebCore::RenderMeter::valueRatio):
+        * rendering/RenderMeter.h:
+        (WebCore::RenderMeter::renderName):
+        (WebCore::RenderMeter::isMeter):
+        (WebCore::RenderMeter::requiresForcedStyleRecalcPropagation):
+        (WebCore::RenderMeter::canHaveChildren):
+
+2011-04-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebGL support
+        https://bugs.webkit.org/show_bug.cgi?id=31517
+
+        Add WebGL support for the GTK+ bits of WebCore.
+
+        No new tests. This will be covered by the existing WebGL tests once
+        the bots are capable of running WebGL tests.
+
+        * GNUmakefile.am: Added new files required for WebGL support.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): Extend #ifdef to cover GTK+ as well, which does not
+        yet support accelerated compositing.
+        * platform/graphics/ANGLEWebKitBridge.h: Update to reflect the fact that ANGLE isn't compiled as
+        a framework for GTK+.
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::platformTexture): Added a declaration of this method for Cairo.
+        (WebCore::GraphicsContext3D::paintsIntoCanvasBuffer): Ditto.
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp: Added.
+        (WebCore::GraphicsContext3D::getImageData): Added.
+        (WebCore::GraphicsContext3D::paintToCanvas): Added.
+        * platform/graphics/cairo/OpenGLShims.cpp: Added. This file controls loading of GL extension
+        functions dynamically. They have different names across the different vendors' GL implementations.
+        (WebCore::lookupOpenGLFunctionAddress): Added
+        (WebCore::openGLFunctionTable): Added
+        (WebCore::initializeOpenGLShims): Added
+        * platform/graphics/cairo/OpenGLShims.h: Added.
+        * platform/graphics/gtk/DrawingBufferGtk.cpp: Added.
+        (WebCore::DrawingBuffer::DrawingBuffer): Very generic implementation for Cairo.
+        (WebCore::DrawingBuffer::~DrawingBuffer): Ditto.
+        (WebCore::DrawingBuffer::didReset): Ditto.
+        (WebCore::DrawingBuffer::platformColorBuffer): Ditto.
+        * platform/graphics/gtk/GraphicsContext3DGtk.cpp: Added.
+        (WebCore::GraphicsContext3D::create): Initial implementation.
+        (WebCore::GraphicsContext3D::GraphicsContext3D): Ditto.
+        (WebCore::GraphicsContext3D::~GraphicsContext3D): Ditto.
+        (WebCore::GraphicsContext3D::makeContextCurrent): Ditto.
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D): Ditto.
+        (WebCore::GraphicsContext3D::isGLES2Compliant): Ditto.
+        * platform/graphics/gtk/GraphicsContext3DInternal.cpp: Added.
+        (sharedDisplay): Added this shared display which is required by some
+        display drivers.
+        (WebCore::activeGraphicsContexts): This method keeps track of all active GraphicsContext3D
+        contexts, in order to clean them up at exit. This prevents crashes on certain OpenGL drivers.
+        (WebCore::GraphicsContext3DInternal::addActiveGraphicsContext): Ditto.
+        (WebCore::GraphicsContext3DInternal::removeActiveGraphicsContext): Ditto.
+        (WebCore::GraphicsContext3DInternal::cleanupActiveContextsAtExit): Ditto.
+        (WebCore::GraphicsContext3DInternal::create): Figure out the best way to create an OpenGL
+        context given the current environment.
+        (WebCore::GraphicsContext3DInternal::createPbufferContext): Pbuffer context initializer.
+        (WebCore::GraphicsContext3DInternal::createPixmapContext): Pixmap context initializer.
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal): Initial implementation.
+        (WebCore::GraphicsContext3DInternal::~GraphicsContext3DInternal): Ditto.
+        (WebCore::GraphicsContext3DInternal::makeContextCurrent): Ditto.
+        * platform/graphics/gtk/GraphicsContext3DInternal.h: Added.
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp: Added generic implementation.
+        (WebCore::Extensions3DOpenGL::ensureEnabled): Ditto.
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::reshape): Test for the context using the public API rather than
+        the private bits that are specific to the Apple port.
+
+2011-04-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (WebKit2): Caps-Lock indicator sometimes doesn't appear in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=51230
+        <rdar://problem/8780989>
+
+        <rdar://problem/9015250> REGRESSION (WebKit2): Key events not fired for modifier keys
+
+        * page/EventHandler.cpp: (WebCore::EventHandler::keyEvent): Moved Caps Lock handling from
+        WebKits to WebCore, because WebKit shouldn't be smart.
+
+2011-04-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix Windows build warning.
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude EventQueue.cpp in Debug_All build.
+
+2011-04-04  Adam Roben  <aroben@apple.com>
+
+        Attempted Mac build fix, part III
+
+        * WebCore.exp.in: Export PlatformCALayer::setGeometryFlipped. Also resorted some symbols.
+
+2011-04-04  Andy Estes  <aestes@apple.com>
+
+        Fix the Mac build.
+
+        * WebCore.exp.in:
+
+2011-04-04  David Dorwin  <ddorwin@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium Mac crashes when entering fullscreen
+        https://bugs.webkit.org/show_bug.cgi?id=57483
+
+        Override extraFullScreenStyleSheet in RenderThemeChromiumMac to avoid hitting the ASSERT_NOT_REACHED in RenderThemeMac.
+
+        * WebCore.gyp/WebCore.gyp:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::extraFullScreenStyleSheet):
+
+2011-04-04  Adam Roben  <aroben@apple.com>
+
+        Attempted Mac build fix, part II
+
+        * WebCore.xcodeproj/project.pbxproj: Marked PlatformCALayerClient.h and
+        PlatformCAAnimation.h as private so that WebKit2 can #include them (transitively).
+
+2011-04-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove unused AnalyzeWithLargeStack code from Windows build files
+        https://bugs.webkit.org/show_bug.cgi?id=57771
+        
+        This was used for us to build with prefast automatically,
+        but it is out-of-date and hasn't been used for some time.
+        Removing completely for now.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCorePreBuild.cmd:
+
+2011-04-01  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        [CG] Do not accelerate small canvases
+        https://bugs.webkit.org/show_bug.cgi?id=57596
+
+        No new tests. No outward behavior changes.
+
+        * platform/graphics/cg/ImageBufferCG.cpp:
+
+2011-04-04  Adam Roben  <aroben@apple.com>
+
+        Attempted Mac build fix
+
+        * WebCore.xcodeproj/project.pbxproj: Marked PlatformCALayer.h and GraphicsLayerCA.h private
+        so that WebKit can #include them.
+
+2011-04-04  Malcolm MacLeod  <mmacleod@webmail.co.za>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Implement support for temporary files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=57772
+
+        * platform/FileSystem.h:
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::getFileModificationTime):
+        (WebCore::openTemporaryFile):
+        (WebCore::closeFile):
+        (WebCore::writeToFile):
+
+2011-04-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make StructureChain GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=56695
+
+        Update for new Structure marking function
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+
+2011-04-04  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add support for the enumerated types in the protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=57761
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptions):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::resourceRetrievedByXMLHttpRequestImpl):
+        (WebCore::InspectorInstrumentation::scriptImportedImpl):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::cachedResourceTypeString):
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::setInitialScriptContent):
+        (WebCore::InspectorResourceAgent::setInitialXHRContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/generate-inspector-idl:
+
+2011-04-04  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: InspectorRuntimeAgent should not depend on Page
+        https://bugs.webkit.org/show_bug.cgi?id=57759
+
+        Descendants of InspectorRuntimeAgent should implement a method providing access to the default
+        inspected state used for console evaluations.
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent): runtime agent is created and deleted along with other agents.
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::create):
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        * inspector/InspectorRuntimeAgent.h:
+        (WebCore::InspectorRuntimeAgent::InspectedStateProvider::~InspectedStateProvider):
+
+2011-04-04  Yong Li  <yoli@rim.com>
+
+        Reviewed by Antonio Gomes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55969
+        Fix the issue that document state is not saved when
+        going backward and ending up with error page.
+
+        Test: platform/qt/fast/history/back-to-unreachable-url-then-forward.html
+
+        (For manual test, load a non-existent html first, then load
+        fast/history/resources/check-scroll-position.html, then go
+        back and go forward. If it doesn't show "SUCCESS" at the bottom
+        of the page, your browser has failed the test)
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::load):
+
+2011-04-04  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix make distcheck for 1.4.0
+        https://bugs.webkit.org/show_bug.cgi?id=57750
+
+        Added a missing header file to the Makefile
+
+        * GNUmakefile.am:
+
+2011-04-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] http/tests/plugins/post-url-file.html fails on GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=55826
+
+        Correct the implementation of handlePostReadFile which uses GIO APIs and
+        actually resizes the buffer to fit the entire size of the file data. This
+        was likely leading to memory corruption until now.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::handlePostReadFile): Fix this method.
+
+2011-04-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [Extensions API] add notifications on panels shown/hidden
+        https://bugs.webkit.org/show_bug.cgi?id=57752
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI.PanelImpl):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype.notifyPanelShown):
+        (WebInspector.ExtensionServer.prototype.notifyPanelHidden):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.show):
+        (WebInspector.Panel.prototype.hide):
+
+2011-04-04  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: search in resources panel is broken.
+        https://bugs.webkit.org/show_bug.cgi?id=57631
+
+        Search in resources panel should trigger source frame content load.
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        * inspector/front-end/ResourcesPanel.js:
+        * inspector/front-end/SearchController.js:
+        (WebInspector.SearchController.prototype.handleShortcut):
+        (WebInspector.SearchController.prototype.focusSearchField):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.show):
+        (WebInspector.SourceFrame.prototype._ensureContentLoaded):
+        (WebInspector.SourceFrame.prototype.performSearch):
+
+2011-04-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Split out UnicodeBidi enum into its own header (to allow use in platform)
+        https://bugs.webkit.org/show_bug.cgi?id=57722
+
+        unicode-bidi is a CSS concept.  However the same concept is really needed throughout
+        the bidi code in platform as well.  So I'm moving the enum to platform.
+        The only part of the enum which doesn't make much sense to platform/ is "normal".
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSPrimitiveValueMappings.h:
+        * platform/text/UnicodeBidi.h: Added.
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-04-04  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Highlighted search tokens would not be shown on long lines in the text viewer
+        https://bugs.webkit.org/show_bug.cgi?id=57749
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype.markAndRevealRange):
+        (WebInspector.TextEditorMainPanel.prototype._paintLine):
+
+2011-04-04  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Incorrectly reports warning on missing/incorrect content-type for 304s
+        https://bugs.webkit.org/show_bug.cgi?id=48525
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._mimeTypeIsConsistentWithType):
+
+2011-04-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: appropriateSelectorForNode() invokes the "localName" getter on DOMNode rather than function
+        https://bugs.webkit.org/show_bug.cgi?id=57632
+
+        Moved the affected method onto the DOMNode.prototype as "appropriateSelectorFor".
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.appropriateSelectorFor):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection):
+        * inspector/front-end/utilities.js:
+
+2011-04-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed. Followup to an incomplete commit in r82806.
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI.PanelWithSidebarImpl.prototype.createSidebarPane):
+        (WebInspector.injectedExtensionAPI.ExtensionSidebarPaneImpl):
+        (WebInspector.injectedExtensionAPI.ExtensionSidebarPaneImpl.prototype.setHeight):
+        (WebInspector.injectedExtensionAPI.ExtensionSidebarPaneImpl.prototype.setExpression):
+        (WebInspector.injectedExtensionAPI):
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionSidebarPane):
+        (WebInspector.ExtensionSidebarPane.prototype.setPage):
+        (WebInspector.ExtensionSidebarPane.prototype._setObject):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer):
+        (WebInspector.ExtensionServer.prototype.notifyExtensionSidebarUpdated):
+        (WebInspector.ExtensionServer.prototype._onCreatePanel):
+        (WebInspector.ExtensionServer.prototype._onCreateSidebarPane):
+        (WebInspector.ExtensionServer.prototype.createClientIframe):
+        (WebInspector.ExtensionServer.prototype._onSetSidebarContent):
+
+2011-04-04  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fix Qt minimal build.
+
+        * inspector/InspectorFrontendChannel.h:
+
+2011-04-01  Sergey Vorobyev  <sergeyvorobyev@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Separate sendMessageToFrontend function
+        from InspectorClient to individual interface.
+        https://bugs.webkit.org/show_bug.cgi?id=57548
+
+        Refactoring - covered with existing inspector tests.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorFrontendChannel.h: Added.
+        (WebCore::InspectorFrontendChannel::~InspectorFrontendChannel):
+
+2011-04-04  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prefer a using directive over qualified names in LocalizedNumberICU.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=57742
+
+        Requested by ap in https://bugs.webkit.org/show_bug.cgi?id=57715
+
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::createFormatterForCurrentLocale):
+        (WebCore::numberFormatter):
+        (WebCore::parseLocalizedNumber):
+        (WebCore::formatLocalizedNumber):
+
+2011-04-04  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Breakpoints in the gutter stay static while editing the text
+        https://bugs.webkit.org/show_bug.cgi?id=57616
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype._saveViewerState):
+        (WebInspector.SourceFrame.prototype._restoreViewerState):
+        (WebInspector.SourceFrame.prototype._endEditing):
+        (WebInspector.SourceFrame.prototype._lineNumberAfterEditing):
+        (WebInspector.SourceFrame.prototype.addBreakpoint):
+        (WebInspector.SourceFrame.prototype.removeBreakpoint):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._syncDecorationsForLine):
+        (WebInspector):
+        (WebInspector.TextEditorChunkedPanel.prototype.removeDecoration):
+        (WebInspector.TextEditorChunkedPanel.prototype.makeLineAChunk):
+        (WebInspector.TextEditorChunkedPanel.prototype._splitChunkOnALine):
+        (WebInspector.TextEditorMainPanel.prototype._splitChunkOnALine):
+
+2011-04-04  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: remove obsolete doc generating code from CodeGenerator.
+        https://bugs.webkit.org/show_bug.cgi?id=57748
+
+        * inspector/CodeGeneratorInspector.pm:
+
+2011-04-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [Extensions API] Merge WatchExpressionSidebarPane into ExtensionSidebarPane
+        https://bugs.webkit.org/show_bug.cgi?id=57622
+
+        Merged WatchExpressionSidebarPane into ExtensionSidebarPane, added setPage(url).
+        Fixed wrong getter in schema (scripts -> elements)
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI.WatchExpressionSidebarPaneImpl.prototype.setObject):
+        (WebInspector.injectedExtensionAPI.WatchExpressionSidebarPaneImpl.prototype.setPage):
+        * inspector/front-end/ExtensionAPISchema.json:
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onSetSidebarPage):
+
+2011-04-04  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: introduce support of 'optional' flag for command arguments.
+        https://bugs.webkit.org/show_bug.cgi?id=57698
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::setBreakpoint):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::reloadPage):
+        * inspector/InspectorPageAgent.h:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::getResourceContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/generate-inspector-idl:
+
+2011-04-04  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: InjectedScriptManager should not try to access inspected window in case of workers
+        https://bugs.webkit.org/show_bug.cgi?id=57637
+
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::createForPage):
+        (WebCore::InjectedScriptManager::createForWorker):
+        (WebCore::InjectedScriptManager::InjectedScriptManager): access check function is passed as a parameter to the constructor
+        and it depends on which type of context we're inspecting(worker or page).
+        (WebCore::InjectedScriptManager::canAccessInspectedWorkerContext):
+        * inspector/InjectedScriptManager.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+
+2011-04-04  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Eric Seidel.
+
+        V8StringCallback.cpp requires V8Binding.h
+        https://bugs.webkit.org/show_bug.cgi?id=57699
+
+        No new tests required because of just adding header file.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2011-04-03  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Eric Seidel.
+
+        [CMAKE] Clean duplicated files in WebCore_Sources
+        https://bugs.webkit.org/show_bug.cgi?id=57741
+
+        No new tests, Only duplicated files were removed.
+
+        * CMakeLists.txt:
+
+2011-04-03  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix 2-space indentation introduced in bug 54706.
+        https://bugs.webkit.org/show_bug.cgi?id=57740
+
+        No new tests - whitespace changes only.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Convert 2-space indentation to 4-space indentation.
+
+2011-04-03  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make CSSStyleApplyProperty non-copyable
+        https://bugs.webkit.org/show_bug.cgi?id=57738
+
+        No new functionality added so no new tests required.
+
+        * css/CSSStyleApplyProperty.h:
+        Added WTF_MAKE_NONCOPYABLE(CSSStyleApplyProperty) to ensure singleton stays single.
+
+2011-04-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        fast/images/extra-image-in-image-document.html crashes when run after embed-image.html
+        https://bugs.webkit.org/show_bug.cgi?id=57733
+
+        The crash happens because resetting the page scale as part of preparing the WebView for the
+        next test triggered layout, which in turn caused a plug-in to make a resource request, and
+        DumpRenderTree's delegate to be dispatched. The delegate doesn’t expect to be called between
+        tests, and it references the layout test controller, which is null.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::scalePage): Avoid an unnecessary layout if the page scale isn’t changing. This
+        is more efficient, and has the side effect of avoiding the crash in DumpRenderTree, although
+        DumpRenderTree could still crash when after a test with disabled plug-ins and a non-1 page scale.
+        I think there are currently no such tests, so I am not fixing DumpRenderTree.
+
+2011-04-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Teach InlineIterator how to work from any root, not just a RenderBlock
+        https://bugs.webkit.org/show_bug.cgi?id=57726
+
+        For implementing bidi-unicode: isolate, we need to be able to run the
+        bidi algorithm over a subtree of inlines, not just from a block root.
+        This is the first step in making this possible.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::InlineIterator::root):
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-04-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Split out handling of trailing spaces from layoutInlineChildren
+        https://bugs.webkit.org/show_bug.cgi?id=57432
+
+        There is much more we could split out from this function, but this is a start.
+
+        I suspect this is very hot code.  Hopefully the compiler will do the right thing.
+        If it doesn't the Chromium PLT bots will tell us.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::handleTrailingSpaces):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2011-03-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        editing commands shouldn't run when there's no body
+        https://bugs.webkit.org/show_bug.cgi?id=56771
+
+        The bug was caused by WebKit's not checking the existence of root editable element
+        in enabled* functions. Although isContentEditable returns true whenever we're in design mode,
+        we should not run editing commands in a document without a body element editable because
+        doing so results in appending a non-body element to the document node.
+
+        Fixed the bug by modifying various enabled* functions to ensure we have a root editable element.
+        New behavior tries to match that of Firefox except StyleWithCSS, which Firefox seems to ignore
+        when there are no body element. Since StyleWithCSS is a document's state or property, we allow
+        execCommand('StyleWithCSS') even in a document without a body element.
+
+        WebKit's and Firefox's behaviors also deviate in insert-image-with-selecting-document.html.
+        Whereas WebKit respects selection set by script and ignores execCommand, Firefox modifies
+        the selection when document.write("x") is ran and successfully inserts image.
+
+        Thus, empty-document-delete.html and empty-document-justify-right.html both pass on Firefox
+        while empty-document-stylewithcss.html and insert-image-with-selecting-document.html both fail.
+
+        Since Internet Explorer does not allow execCommand to run under design mode properly, we could
+        not test its behavior.
+
+        Tests: editing/editability/empty-document-delete.html
+               editing/editability/empty-document-justify-right.html
+               editing/editability/empty-document-stylewithcss.html
+               editing/execCommand/insert-image-with-selecting-document.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::canEdit): Verify that the root editable element exists
+        instead of just checking that selection endpoints are editable because
+        selection endpoints could be document node without a body element in design mode
+        and we don't want to consider such a document editable.
+        (WebCore::Editor::canDelete): Ditto.
+        * editing/EditorCommand.cpp:
+        (WebCore::enabledInEditableText): Ditto.
+        (WebCore::enabledInRichlyEditableText): Ditto.
+        (WebCore::enabledDelete): Call enabledCut and enabledInEditableText instead
+        of duplicating the code in order to fix the same bug.
+
+2011-04-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r82786): Media controls render incorrectly on GTK and Qt
+        https://bugs.webkit.org/show_bug.cgi?id=57719
+
+        r82786 exposed an incorrect assumption inRenderMediaControlTimeDisplay::layout()
+        that the timeline container is the parent of the time display. This is not true
+        with the GTK media style, where the current time display is an inline box, and
+        thus wrapped in an anonymous flexible box. The code was incorrectly considering
+        the width of the anonymous box and deciding to hide the time display. Prior to
+        r82786, this mistake was corrected by the call to computeLogicalWidth() in line layout.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::RenderMediaControlTimeDisplay::layout): Changed to skip past anonymous ancestors.
+
+2011-04-02  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Explicitly use icu namespace for ports building with U_USING_ICU_NAMESPACE=0
+
+        By default, ICU includes |using namespace icu;| in its header files
+        for backwards compatibility. Clients can define
+        U_USING_ICU_NAMESPACE=0 to tell ICU to not do this. Prefixing all ICU
+        classes with |icu::| makes this file compile no matter what
+        U_USING_ICU_NAMESPACE is set to.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57715
+
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::createFormatterForCurrentLocale):
+        (WebCore::numberFormatter):
+        (WebCore::parseLocalizedNumber):
+        (WebCore::formatLocalizedNumber):
+
+2011-04-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Remove an unnecessary extra computeLogicalWidth() from line layout
+        https://bugs.webkit.org/show_bug.cgi?id=57711
+
+        Changes in behavior (MathML progression) covered by existing layout tests.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Removed a
+        call to computeLogicalWidth(). Because of <http://webkit.org/b/57700>, this
+        actually prevents MathML rows from reverting to an incorrect width.
+
+2011-04-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <details> marker loses its margin
+        https://bugs.webkit.org/show_bug.cgi?id=57713
+
+        * rendering/RenderDetails.cpp:
+        (WebCore::RenderDetails::computePreferredLogicalWidths): Override to update
+        the marker location.
+        * rendering/RenderDetails.h:
+        (WebCore::RenderDetails::renderName): Made private.
+        (WebCore::RenderDetails::isDetails): Ditto.
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::computePreferredLogicalWidths): Set the margins
+        in the style, like RenderListMarker does.
+        (WebCore::RenderDetailsMarker::layout): Set the margins from the style.
+
+2011-04-02  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (r69237): Black border around map elements while using an image map on Mac platform
+        https://bugs.webkit.org/show_bug.cgi?id=52518
+
+        Test: fast/images/imagemap-focus-ring-zero-outline-width.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintAreaElementFocusRing): Return early if outlineWidth is 0.
+
+2011-04-02  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57605
+        Frame::pageScaleFactor() should not affect getBoundingClientRect() or 
+        getClientRects()
+        -and corresponding-
+        <rdar://problem/9194541>
+
+        New functions adjust*ForPageScale() are analogous to adjust*ForAbsoluteZoom().
+        * dom/Element.cpp:
+        (WebCore::Element::getClientRects):
+        (WebCore::Element::getBoundingClientRect):
+        * dom/Range.cpp:
+        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoomAndPageScale):
+        (WebCore::Range::getBorderAndTextQuads):
+        * rendering/RenderObject.h:
+        (WebCore::adjustFloatPointForPageScale):
+        (WebCore::adjustFloatQuadForPageScale):
+        (WebCore::adjustFloatRectForPageScale):
+
+2011-04-02  Dan Bernstein  <mitz@apple.com>
+
+        Reverted r82775 due to changes in <details> test results, which are
+        likely progressions.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Removed a
+
+2011-04-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Remove an unnecessary extra computeLogicalWidth() from line layout
+        https://bugs.webkit.org/show_bug.cgi?id=57711
+
+        Changes in behavior (MathML progression) covered by existing layout tests.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Removed a
+        call to computeLogicalWidth(). Because of <http://webkit.org/b/57700>, this
+        actually prevents MathML rows from reverting to an incorrect width.
+
+2011-04-02  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix leaked pointer in FontGtk.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=57307
+
+        Fix a memory leak.
+
+        No new functionality, so no new tests.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::utf16ToUtf8): Rename utf16_to_utf8 and fix indentation.
+        (WebCore::convertUniCharToUTF8):
+
+2011-04-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: we should be able to have in and out arguments of a command with same name.
+        https://bugs.webkit.org/show_bug.cgi?id=57701
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.json:
+
+2011-04-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Not reviewed trivial change.
+
+        Web Inspector: The page agent should be enabled even if JAVASCRIPT_DEBUGGER is off.
+        Followup change for r82281.
+        https://bugs.webkit.org/show_bug.cgi?id=57327
+
+        * inspector/InspectorPageAgent.cpp:
+        * inspector/InspectorPageAgent.h:
+
+2011-04-01  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cached Resource Overhead Space Usage and Accounting Inaccurate
+        https://bugs.webkit.org/show_bug.cgi?id=57488
+
+        Fixed windows test failures.
+        Changed the fixed overhead value for ResourceResponse to 3800 bytes.
+        Modified ResourceResponse::platformLazyInit() to handle "base" level
+        attributes or all attributes.  The base attributes, like URL, status
+        code, mime type and a few header fields (mostly cache related) are
+        suitable for most resources.  This reduces the per resource memory
+        needs by over 1K bytes per resource thus saving memory in the cache.
+        Collectively, these two changes bring the overhead memory calculation
+        in line with reality.
+
+        No new tests added due to existing tests cover areas of change and
+        there is no functional change.  The change is limited to reducing 
+        memory usage along existing paths.
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::canUseCacheValidator):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::isHTTP):
+        (WebCore::ResourceResponseBase::url):
+        (WebCore::ResourceResponseBase::setURL):
+        (WebCore::ResourceResponseBase::mimeType):
+        (WebCore::ResourceResponseBase::setMimeType):
+        (WebCore::ResourceResponseBase::expectedContentLength):
+        (WebCore::ResourceResponseBase::setExpectedContentLength):
+        (WebCore::ResourceResponseBase::textEncodingName):
+        (WebCore::ResourceResponseBase::setTextEncodingName):
+        (WebCore::ResourceResponseBase::suggestedFilename):
+        (WebCore::ResourceResponseBase::setSuggestedFilename):
+        (WebCore::ResourceResponseBase::httpStatusCode):
+        (WebCore::ResourceResponseBase::setHTTPStatusCode):
+        (WebCore::ResourceResponseBase::httpStatusText):
+        (WebCore::ResourceResponseBase::setHTTPStatusText):
+        (WebCore::ResourceResponseBase::httpHeaderField):
+        (WebCore::ResourceResponseBase::setHTTPHeaderField):
+        (WebCore::ResourceResponseBase::httpHeaderFields):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::hasCacheValidatorFields):
+        (WebCore::ResourceResponseBase::date):
+        (WebCore::ResourceResponseBase::age):
+        (WebCore::ResourceResponseBase::expires):
+        (WebCore::ResourceResponseBase::lastModified):
+        (WebCore::ResourceResponseBase::isAttachment):
+        (WebCore::ResourceResponseBase::setLastModifiedDate):
+        (WebCore::ResourceResponseBase::lastModifiedDate):
+        (WebCore::ResourceResponseBase::wasCached):
+        (WebCore::ResourceResponseBase::connectionReused):
+        (WebCore::ResourceResponseBase::setConnectionReused):
+        (WebCore::ResourceResponseBase::connectionID):
+        (WebCore::ResourceResponseBase::setConnectionID):
+        (WebCore::ResourceResponseBase::resourceLoadTiming):
+        (WebCore::ResourceResponseBase::setResourceLoadTiming):
+        (WebCore::ResourceResponseBase::resourceLoadInfo):
+        (WebCore::ResourceResponseBase::setResourceLoadInfo):
+        (WebCore::ResourceResponseBase::lazyInit):
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::platformLazyInit):
+        * platform/network/cf/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::memoryUsage):
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2011-04-01  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45855
+        Windowless plugins added dynamically to the DOM should receive paint events.
+        This is done by ensuring that the plugin widget is marked for painting when
+        it is added.
+
+        Test: plugins/windowless_plugin_paint_test.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidget):
+
+2011-04-01  Mike Reed  <reed@google.com>
+
+        Reviewed by James Robinson.
+
+        always use native font rendering on skia_gpu
+        fixes a crash when SKIA_GPU is enabled, as we can't call getTopPlatformDevice()
+        https://bugs.webkit.org/show_bug.cgi?id=57663
+
+        No new tests. existing rendering tests will exercise this
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::isNativeFontRenderingAllowed):
+
+2011-04-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82712, r82729, and r82746.
+        http://trac.webkit.org/changeset/82712
+        http://trac.webkit.org/changeset/82729
+        http://trac.webkit.org/changeset/82746
+        https://bugs.webkit.org/show_bug.cgi?id=57682
+
+        fast/frames/frame-programmatic-noresize.html is failing on
+        Windows bots. Will look into this offline. (Requested by dydx
+        on #webkit).
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement):
+        (WebCore::HTMLFrameElement::attach):
+        (WebCore::HTMLFrameElement::parseMappedAttribute):
+        * html/HTMLFrameElement.h:
+        (WebCore::HTMLFrameElement::noResize):
+        * rendering/RenderFrame.cpp:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.cpp:
+        * rendering/RenderFrameSet.h:
+
+2011-04-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Valgrind error in _ZN7WebCore8Document11updateTitleERKNS_19StringWithDirectionE
+        https://bugs.webkit.org/show_bug.cgi?id=57656
+
+        We should initialize memory when constructing objects.
+
+        * platform/text/StringWithDirection.h:
+        (WebCore::StringWithDirection::StringWithDirection):
+
+2011-04-01  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: Link from PDF opens in a new tab instead of in the same tab
+        https://bugs.webkit.org/show_bug.cgi?id=57528
+
+        * WebCore.exp.in: Export MouseEvent::create().
+
+2011-04-01  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Avoid decoding images twice in texImage2D
+        https://bugs.webkit.org/show_bug.cgi?id=51498
+
+        Make sure to redecode the image only if it's not opaque and texImage2D
+        wouldn't premultiply it anyway.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2011-04-01  Alexey Proskuryakov  <ap@apple.com>
+
+        32-bit Mac build fix.
+
+        * dom/KeyboardEvent.h: (WebCore::KeypressCommand::KeypressCommand): Use 0U to index a String
+        to avoid ambiguity.
+
+2011-04-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit2 text input handling more like WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=57649
+
+        * dom/KeyboardEvent.h: (WebCore::KeypressCommand::KeypressCommand): Put back the assertions
+        we used to have. It is dangerous to confuse editor commands and selector names - besides the
+        presence of a semicolon, they sometimes have different names, and WebKit2 failed to map those.
+
+2011-04-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82711.
+        http://trac.webkit.org/changeset/82711
+        https://bugs.webkit.org/show_bug.cgi?id=57657
+
+        Made every test crash on XP and Win7 (Requested by
+        abarth|gardening on #webkit).
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::canUseCacheValidator):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::isHTTP):
+        (WebCore::ResourceResponseBase::url):
+        (WebCore::ResourceResponseBase::setURL):
+        (WebCore::ResourceResponseBase::mimeType):
+        (WebCore::ResourceResponseBase::setMimeType):
+        (WebCore::ResourceResponseBase::expectedContentLength):
+        (WebCore::ResourceResponseBase::setExpectedContentLength):
+        (WebCore::ResourceResponseBase::textEncodingName):
+        (WebCore::ResourceResponseBase::setTextEncodingName):
+        (WebCore::ResourceResponseBase::suggestedFilename):
+        (WebCore::ResourceResponseBase::setSuggestedFilename):
+        (WebCore::ResourceResponseBase::httpStatusCode):
+        (WebCore::ResourceResponseBase::setHTTPStatusCode):
+        (WebCore::ResourceResponseBase::httpStatusText):
+        (WebCore::ResourceResponseBase::setHTTPStatusText):
+        (WebCore::ResourceResponseBase::httpHeaderField):
+        (WebCore::ResourceResponseBase::setHTTPHeaderField):
+        (WebCore::ResourceResponseBase::httpHeaderFields):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::date):
+        (WebCore::ResourceResponseBase::age):
+        (WebCore::ResourceResponseBase::expires):
+        (WebCore::ResourceResponseBase::lastModified):
+        (WebCore::ResourceResponseBase::isAttachment):
+        (WebCore::ResourceResponseBase::setLastModifiedDate):
+        (WebCore::ResourceResponseBase::lastModifiedDate):
+        (WebCore::ResourceResponseBase::wasCached):
+        (WebCore::ResourceResponseBase::connectionReused):
+        (WebCore::ResourceResponseBase::setConnectionReused):
+        (WebCore::ResourceResponseBase::connectionID):
+        (WebCore::ResourceResponseBase::setConnectionID):
+        (WebCore::ResourceResponseBase::resourceLoadTiming):
+        (WebCore::ResourceResponseBase::setResourceLoadTiming):
+        (WebCore::ResourceResponseBase::resourceLoadInfo):
+        (WebCore::ResourceResponseBase::setResourceLoadInfo):
+        (WebCore::ResourceResponseBase::lazyInit):
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::platformLazyInit):
+        * platform/network/cf/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::memoryUsage):
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2011-04-01  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Behavior of isAccelerated() for a IOSurface-backed canvas should be consistent with accelerated status of its ImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=57651
+
+        No new tests. This patch does not affect outward behavior.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::isAccelerated):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::isAccelerated):
+
+2011-04-01  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Frame's noResize attribute can not be set by JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=14845
+
+        Tests: fast/frames/frame-inherit-noresize-from-frameset.html
+               fast/frames/frame-programmatic-noresize.html
+               fast/frames/frame-with-noresize-can-be-resized-after-removal-of-noresize.html
+               fast/frames/frame-with-noresize-can-be-resized-after-setting-noResize-to-false.html
+
+        Implements support to programmatically allow and disallow frame resizing.
+
+        Currently, HTMLFrameElement::parseMappedAttribute() is hardcoded to disallow frame resize (i.e.
+        m_noResize = true) when either the noresize DOM attribute is specified (or existed at some
+        point in time) or the value of the noResize attribute is modified. Instead we should allow/disallow
+        frame resize depending on the presence of the noresize DOM attribute/the value of the noResize
+        attribute.
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement):
+        (WebCore::HTMLFrameElement::noResize): Made this a non-inline function since this
+        code path isn't performance critical.
+        (WebCore::HTMLFrameElement::attach): Removed code to inherit noresize attribute from
+        parent <frameset> since this functionality is part of RenderFrameSet::computeEdgeInfo().
+        (WebCore::HTMLFrameElement::parseMappedAttribute):
+        * html/HTMLFrameElement.h:
+        * rendering/RenderFrame.cpp:
+        (WebCore::RenderFrame::updateFromElement): Added.
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::notifyFrameEdgeInfoChanged): Added.
+        * rendering/RenderFrameSet.h:
+
+2011-04-01  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cached Resource Overhead Space Usage and Accounting Inaccurate
+        https://bugs.webkit.org/show_bug.cgi?id=57488
+
+        Changed the fixed overhead value for ResourceResponse to 3800 bytes.
+        Modified ResourceResponse::platformLazyInit() to handle "base" level
+        attributes or all attributes.  The base attributes, like URL, status
+        code, mime type and a few header fields (mostly cache related) are
+        suitable for most resources.  This reduces the per resource memory
+        needs by over 1K bytes per resource thus saving memory in the cache.
+        Collectively, these two changes bring the overhead memory calculation
+        in line with reality.
+
+        No new tests added due to existing tests cover areas of change and
+        there is no functional change.  The change is limited to reducing 
+        memory usage along existing paths.
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::canUseCacheValidator):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::isHTTP):
+        (WebCore::ResourceResponseBase::url):
+        (WebCore::ResourceResponseBase::setURL):
+        (WebCore::ResourceResponseBase::mimeType):
+        (WebCore::ResourceResponseBase::setMimeType):
+        (WebCore::ResourceResponseBase::expectedContentLength):
+        (WebCore::ResourceResponseBase::setExpectedContentLength):
+        (WebCore::ResourceResponseBase::textEncodingName):
+        (WebCore::ResourceResponseBase::setTextEncodingName):
+        (WebCore::ResourceResponseBase::suggestedFilename):
+        (WebCore::ResourceResponseBase::setSuggestedFilename):
+        (WebCore::ResourceResponseBase::httpStatusCode):
+        (WebCore::ResourceResponseBase::setHTTPStatusCode):
+        (WebCore::ResourceResponseBase::httpHeaderField):
+        (WebCore::ResourceResponseBase::setHTTPHeaderField):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::hasCacheValidatorFields):
+        (WebCore::ResourceResponseBase::date):
+        (WebCore::ResourceResponseBase::age):
+        (WebCore::ResourceResponseBase::expires):
+        (WebCore::ResourceResponseBase::lastModified):
+        (WebCore::ResourceResponseBase::lazyInit):
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::platformLazyInit):
+        * platform/network/cf/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::memoryUsage):
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2011-04-01  Timothy Hatcher  <timothy@apple.com>
+
+        Make momentum scroll event latching work in WebKit2 on Mac.
+
+        <rdar://problem/8751861>
+
+        Reviewed by Darin Adler.
+
+        * WebCore.exp.in: Remove _wkIsLatchingWheelEvent, add _wkGetNSEventMomentumPhase.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent): Set m_useLatchedWheelEventNode based on the
+        event's momentumPhase.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent): Remove the setting of m_useLatchedWheelEventNode.
+        It is now done in EventHandler::handleWheelEvent.
+        * platform/mac/WebCoreSystemInterface.h: Remove wkIsLatchingWheelEvent, add wkGetNSEventMomentumPhase.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::momentumPhaseForEvent): Return a phase on older Mac system by using wkGetNSEventMomentumPhase.
+
+2011-04-01  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaClass should be an interface and free of JNI types
+        https://bugs.webkit.org/show_bug.cgi?id=57533
+
+        This patch fixes JavaClass for V8 only.
+
+        It factors out a JavaClass interface which does not use JNI types.
+        This will allow the Java bridge to be used with objects that
+        don't use JNI directly. The existing jobject-backed
+        implementation is moved to a new JavaClassJobject class which
+        implements the interface.
+
+        No new tests, refactoring only.
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bridge/jni/v8/JavaClassJobjectV8.cpp:
+        (JavaClassJobject::JavaClassJobject):
+        (JavaClassJobject::~JavaClassJobject):
+        (JavaClassJobject::methodsNamed):
+        (JavaClassJobject::fieldNamed):
+        * bridge/jni/v8/JavaClassJobjectV8.h: Copied from Source/WebCore/bridge/jni/v8/JavaClassV8.h.
+        * bridge/jni/v8/JavaClassV8.h:
+        (JSC::Bindings::JavaClass::~JavaClass):
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::getClass):
+
+2011-04-01  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Unreviewed build fix.
+
+        Fix build break when font backend is Pango.
+        Pango is missed in changeset 80589.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57609
+
+        * platform/graphics/pango/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+
+2011-04-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82687.
+        http://trac.webkit.org/changeset/82687
+        https://bugs.webkit.org/show_bug.cgi?id=57643
+
+        This patch broke accessibility aria-treegrid test in Mac
+        (Requested by msanchez on #webkit).
+
+        * accessibility/AccessibilityARIAGrid.cpp:
+        * accessibility/AccessibilityARIAGrid.h:
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2011-03-31  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        Whenever a relayout is trigger for SVGPath, make sure
+        to clear its previous marker layout info. This helps
+        to prevent removed markers from being used.
+        https://bugs.webkit.org/show_bug.cgi?id=57492
+
+        Test: svg/dom/path-marker-removed-crash.svg
+
+        * rendering/svg/RenderSVGPath.cpp:
+        (WebCore::RenderSVGPath::layout):
+        * rendering/svg/SVGMarkerLayoutInfo.cpp:
+        (WebCore::SVGMarkerLayoutInfo::clear):
+        * rendering/svg/SVGMarkerLayoutInfo.h:
+
+2011-04-01  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55750
+        SVG <image> referenced by <use> is displayed incorrectly
+
+        Reintroduce old behaviour for valid base URI, for invalid
+        keep using document base URI.
+        Fixes regression of W3C-SVG-1.1/struct-image-07-t.svg.
+
+        Test: svg/custom/image-base-uri.svg
+
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::sourceURI):
+
+2011-04-01  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        ARIA Grid tables should return GridRole in roleValue() method
+        https://bugs.webkit.org/show_bug.cgi?id=57614
+
+        This change does not need any test since it doesn't change anything
+        from the point of view of the consumers (Assistive Technoglogies).
+        It's just an internal change to simplify identifying HTML and ARIA
+        tables by calling to the AccessibilityObject::roleValue method.
+
+        * accessibility/AccessibilityARIAGrid.h:
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::roleValue): Return GridRole.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole): Removed unneeded comment.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm: Map GridRole to
+        NSAccessibilityTableRole, to keep the same behaviour.
+
+2011-04-01  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        <meter> can only support horizontal indicator
+        https://bugs.webkit.org/show_bug.cgi?id=56001
+
+        - Removed code which deals with the direction and
+          left the horizontal path.
+        - Removed "horizontal" from related names which is now
+          redundant.
+        
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/html.css:
+        (meter::-webkit-meter-bar):
+        (meter::-webkit-meter-optimum-value):
+        (meter::-webkit-meter-suboptimal-value):
+        (meter::-webkit-meter-even-less-good-value):
+        * rendering/RenderMeter.cpp:
+        (WebCore::RenderMeter::~RenderMeter):
+        (WebCore::RenderMeter::createPart):
+        (WebCore::RenderMeter::updateFromElement):
+        (WebCore::RenderMeter::layoutParts):
+        (WebCore::RenderMeter::styleDidChange):
+        (WebCore::RenderMeter::shouldHaveParts):
+        (WebCore::RenderMeter::valuePartRect):
+        (WebCore::RenderMeter::valuePseudoId):
+        (WebCore::RenderMeter::barPseudoId):
+        (WebCore::RenderMeter::detachShadows):
+        (WebCore::RenderMeter::updateShadows):
+        * rendering/RenderMeter.h:
+        (WebCore::RenderMeter::shadowAttached):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::supportsMeter):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMeter):
+        (WebCore::RenderThemeMac::supportsMeter):
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-23  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: fix reveal line in formatted script.
+        https://bugs.webkit.org/show_bug.cgi?id=56941
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.JavaScriptBreakpointsSidebarPane):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointClicked):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.sourceFileForScriptURL):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype.canShowAnchorLocation):
+        (WebInspector.NetworkPanel.prototype.showAnchorLocation):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.canShowAnchorLocation):
+        (WebInspector.Panel.prototype.showAnchorLocation):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowAnchorLocation):
+        (WebInspector.ResourcesPanel.prototype.showAnchorLocation):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
+        (WebInspector.ScriptsPanel.prototype.showAnchorLocation):
+        (WebInspector.ScriptsPanel.prototype._showSourceLine):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector._showAnchorLocation):
+
+2011-04-01  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: make editScriptSource a Script's method.
+        https://bugs.webkit.org/show_bug.cgi?id=57615
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.editScriptSource):
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.requestSource):
+        (WebInspector.Script.prototype.editSource):
+
+2011-04-01  Pavel Feldman  <pfeldman@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: event should have "data" attribute, not "body"
+        https://bugs.webkit.org/show_bug.cgi?id=57628
+
+        * inspector/CodeGeneratorInspector.pm:
+
+2011-04-01  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: checkboxes are broken in xhr breakpoints sidebar pane.
+        https://bugs.webkit.org/show_bug.cgi?id=57610
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._checkboxClicked):
+
+2011-04-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: up/down keys are not treating hex numbers properly while editing styles.
+        https://bugs.webkit.org/show_bug.cgi?id=40522
+
+        Drive-by: fix inc/dec for numbers like ".5"
+
+        Test: inspector/styles/up-down-numerics-and-colors.html
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2011-03-30  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove dead code from Script.js.
+        https://bugs.webkit.org/show_bug.cgi?id=57454
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerModel.prototype._failedToParseScriptSource):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script):
+        (WebInspector.Script.prototype.requestSource.didGetScriptSource):
+        (WebInspector.Script.prototype.requestSource):
+
+2011-04-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82667.
+        http://trac.webkit.org/changeset/82667
+        https://bugs.webkit.org/show_bug.cgi?id=57612
+
+        Breaks Leopard layout tests (Requested by podivilov on
+        #webkit).
+
+        * GNUmakefile.am:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+
+2011-03-30  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove unused SourceFrameContent class.
+        https://bugs.webkit.org/show_bug.cgi?id=57453
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.SourceFrameDelegateForResourcesPanel.prototype.requestContent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.requestContent):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        * inspector/front-end/SourceFrameContent.js: Removed.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-03-30  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: add test for script formatter worker.
+        https://bugs.webkit.org/show_bug.cgi?id=57447
+
+        Test: inspector/debugger/script-formatter.html
+
+        * GNUmakefile.am:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+
+2011-03-30  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [chromium] script formatting doesn't work when all scripts are concatenated.
+        https://bugs.webkit.org/show_bug.cgi?id=57446
+
+        * inspector/front-end/ScriptFormatterWorker.js:
+
+2011-04-01  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: allow file access from inspector page so inspector can use workers.
+        https://bugs.webkit.org/show_bug.cgi?id=57339
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::InspectorFrontendClientLocal):
+
+2011-03-31  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: inspected page crashes on attempt to log object with broken .toString
+        https://bugs.webkit.org/show_bug.cgi?id=57557
+
+        If ScriptValue.toString causes a JavaScript exception, the exception is cleared
+        before returning from the toString method.
+
+        Test: inspector/console/console-log-toString-object.html
+
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::toString):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptValue.cpp:
+        (WebCore::ScriptValue::toString):
+
+2011-03-31  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        - removed documentWide parameter to querySelector[All]() (user document node id instead)
+        - factor out document request logic within DOMAgent into separate method
+        - add querySelector() and querySelectorAll() to DOMAgent.js, assure we have document before calling back-end
+        - use the above wrappers for querySelector() and querySelectorAll(), do not call backend directly
+        - minor style fixes in Inspector.json
+        - more error logging
+
+        Web Inspector: provide front-end wrappers for DOMAgent.querySelector[All]() that take care of fetching the document
+        https://bugs.webkit.org/show_bug.cgi?id=57466
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::querySelector):
+        (WebCore::InspectorDOMAgent::querySelectorAll):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.getStyles):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector.callback):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.addRule.callback):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.requestDocument.onDocumentAvailable):
+        (WebInspector.DOMAgent.prototype.requestDocument):
+        (WebInspector.DOMAgent.prototype.pushNodeToFrontend):
+        (WebInspector.DOMAgent.prototype.pushNodeByPathToFrontend):
+        (WebInspector.DOMAgent.prototype._dispatchWhenDocumentAvailable.onDocumentAvailable):
+        (WebInspector.DOMAgent.prototype._dispatchWhenDocumentAvailable):
+        (WebInspector.DOMAgent.prototype.cancelSearch):
+        (WebInspector.DOMAgent.prototype.querySelector):
+        (WebInspector.DOMAgent.prototype.querySelectorAll):
+
+2011-04-01  Kent Tamura  <tkent@chromium.org>
+
+        Apply sort-Xcode-project-file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2011-03-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82652.
+        http://trac.webkit.org/changeset/82652
+        https://bugs.webkit.org/show_bug.cgi?id=57603
+
+        Test still fails (Requested by abarth|gardener on #webkit).
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidget):
+
+2011-03-31  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Kent Tamura.
+
+        REGRESSION (r64712): Safari removes the first blank line in a textarea
+        https://bugs.webkit.org/show_bug.cgi?id=56434
+
+        Test: fast/forms/textarea-newline.html
+
+        A linefeed removal after a textarea tag is originally processed in WebCore::HTMLTextAreaElement::defaultValue().
+        But HTML5 tree builder now removes the linefeed. It means linefeed removal happens twice.
+        And devalutValue() removal is not needed anymore.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setDefaultValue): Remove an extra linefeed insertion at the beginning.
+        (WebCore::HTMLTextAreaElement::defaultValue): Remove linefeed removal check in default value creation function.
+
+2011-03-31  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove refcounting of CSSStyleApplyProperty singleton
+        https://bugs.webkit.org/show_bug.cgi?id=57592
+
+        No new tests required as no functionality changes.
+
+        * css/CSSStyleApplyProperty.h:
+
+2011-03-31  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45855
+        Windowless plugins added dynamically to the DOM should receive paint events.
+        This is done by ensuring that the plugin widget is marked for painting when
+        it is added.
+
+        Test: plugins/windowless_plugin_paint_test.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidget):
+
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Add a new AbstractCACFLayerTreeHost base class
+
+        This class exposes the interface that LayerChangesFlusher and PlatformCALayer rely on.
+        CACFLayerTreeHost now derives from AbstractCACFLayerTreeHost. In the future, WebKit2's
+        LayerTreeHostCA will also derive from it (on Windows).
+
+        This should cause no change in behavior.
+
+        Fixes <http://webkit.org/b/57598> Coupling between CACFLayerTreeHost and other CACF-related
+        code is too high
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.vcproj/WebCore.vcproj: Added AbstractCACFLayerTreeHost, and let VS reorder files.
+
+        * platform/graphics/ca/win/AbstractCACFLayerTreeHost.h: Added.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.h: Changed to derive from
+        AbstractCACFLayerTreeHost, and annotated the overrides of its functions.
+        AbstractCACFLayerTreeHost also allows us to get rid of the friend relationship with
+        PlatformCALayer.
+
+        * platform/graphics/ca/win/LayerChangesFlusher.cpp:
+        (WebCore::LayerChangesFlusher::flushPendingLayerChangesSoon):
+        (WebCore::LayerChangesFlusher::cancelPendingFlush):
+        (WebCore::LayerChangesFlusher::hookFired):
+        * platform/graphics/ca/win/LayerChangesFlusher.h:
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+        (layerTreeHostForLayer):
+        (PlatformCALayer::rootLayer):
+        (PlatformCALayer::setNeedsCommit):
+        (PlatformCALayer::addAnimationForKey):
+        (PlatformCALayer::removeAnimationForKey):
+        Changed to use AbstractCACFLayerTreeHost instead of using CACFLayerTreeHost directly.
+
+2011-03-31  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION: Java applet fails to load when <object> has a classid attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=52703
+        
+        Java applets embedded with the object element sometimes use classid to
+        specify their main resource. When this is done, the classid is prefixed
+        with "java:". Treat these as supported classids in WebKit.
+
+        Test: java/embedding-java-with-object.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::hasValidClassId): If the MIME type is a
+        Java Applet type and the classid starts with "java:", the classid
+        should be considered valid.
+
+2011-03-31  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed Adam Roben.
+
+        [WinCairo] Implement Missing drawWindowsBitmap method.
+        https://bugs.webkit.org/show_bug.cgi?id=57409
+
+        * WebCore.vcproj/WebCore.vcproj: Add new DIBPixelData files.
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::WindowsBitmap::buffer):
+        (WebCore::GraphicsContext::WindowsBitmap::bufferLength):
+        (WebCore::GraphicsContext::WindowsBitmap::size):
+        (WebCore::GraphicsContext::WindowsBitmap::bytesPerRow):
+        (WebCore::GraphicsContext::WindowsBitmap::bitsPerPixel):
+        (WebCore::GraphicsContext::WindowsBitmap::windowsDIB):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::CGContextWithHDC):
+        (WebCore::GraphicsContext::releaseWindowsContext): Modified to use
+        new common routines.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::drawBitmapToContext): New common drawing implementation.
+        (WebCore::GraphicsContext::releaseWindowsContext): Modified to use
+        new common routines.
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap): Modified
+        to use new DIBPixelData data type.
+        * platform/graphics/win/DIBPixelData.cpp: Added.
+        (WebCore::DIBPixelData::DIBPixelData):
+        (WebCore::DIBPixelData::initialize):
+        * platform/graphics/win/DIBPixelData.h: Added.
+        (WebCore::DIBPixelData::DIBPixelData):
+        (WebCore::DIBPixelData::buffer):
+        (WebCore::DIBPixelData::bufferLength):
+        (WebCore::DIBPixelData::size):
+        (WebCore::DIBPixelData::bytesPerRow):
+        (WebCore::DIBPixelData::bitsPerPixel):
+
+2011-03-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81849.
+        http://trac.webkit.org/changeset/81849
+        https://bugs.webkit.org/show_bug.cgi?id=57588
+
+        CSS Parsing broke with -webkit-calc and introduced crashes
+        (Requested by inferno-sec on #webkit).
+
+        * css/CSSGrammar.y:
+        * css/CSSParserValues.cpp:
+        * css/CSSParserValues.h:
+        * css/tokenizer.flex:
+
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Don't ref CACFLayerTreeHosts when telling them to flush layer changes
+
+        LayerChangesFlusher was reffing CACFLayerTreeHosts before calling out to them. This would
+        have protected us if calling out to one CACFLayerTreeHost could cause a different
+        CACFLayerTreeHost to be destroyed. But that isn't possible; each CACFLayerTreeHost is
+        associated with its own page, and flushing layer changes doesn't touch any other page. So it
+        isn't possible for a CACFLayerTreeHost to be deleted while another one is flushing layer
+        changes.
+
+        One benefit of this change is that it will make it easier to make LayerChangesFlusher
+        interact with a forthcoming abstract base class, rather than with CACFLayerTreeHost itself.
+
+        This should cause no change in behavior.
+
+        Fixes <http://webkit.org/b/57590> LayerChangesFlusher unnecessarily refs CACFLayerTreeHost
+        before calling out to it
+
+        Reviewed by Darin Adler.
+
+        * platform/graphics/ca/win/LayerChangesFlusher.cpp:
+        (WebCore::LayerChangesFlusher::hookFired): Just store bare pointers to the
+        CACFLayerTreeHosts.
+
+2011-03-31  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57574
+        Preload scanner fails to pick up resources from document.write() output
+
+        - Scan script inserted source using a separate preload scanner.
+        - Make the main preload scanner correctly process the remaining source if script execution blocked the parser.
+
+        Tests: fast/preloader/document-write-2.html
+               fast/preloader/document-write.html
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::insert):
+        (WebCore::HTMLDocumentParser::appendCurrentInputStreamToPreloadScannerAndScan):
+        * html/parser/HTMLDocumentParser.h:
+        (WebCore::HTMLDocumentParser::hasPreloadScanner):
+        * html/parser/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::execute):
+        * html/parser/HTMLScriptRunnerHost.h:
+
+2011-03-31  Tony Gentilcore  <tonyg@chromium.org>
+
+        Build fix: Add missing include
+        https://bugs.webkit.org/show_bug.cgi?id=57587
+
+        * loader/cache/CachedResourceLoader.cpp:
+
+2011-03-31  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        PreloadScanner doesn&apos;t find image while executing script in head
+        https://bugs.webkit.org/show_bug.cgi?id=45072
+
+        Previously, while parsing the head, no resources in the body would be
+        preloaded. After this patch, we will preload scripts and styles in the
+        body, although we continue to hold off on all images until the page is 
+        first rendered.
+
+        To evaluate this change, I've recorded a sampling of 45 of alexa's top
+        sites and replayed them under simulated bandwidth conditions, loading
+        each 5-15 times until stddev is small enough.
+
+        Time to the load event improved at the overall average by 3%.
+        Most sites are unchanged, but sites with certain blocking patterns had
+        big wins -- ebay 19% (331ms), microsoft 15% (226ms), conduit 15% (277ms)
+        nytimes 7% (182ms).
+
+        Time to DOM content loaded event improved by 6% with some even bigger
+        individual wins.
+
+        First paint time held steady.
+
+        Note that I originally wanted to allow preloading of images while in the
+        head, but that regressed first paint time (even though it was better for
+        overall load time).
+
+        Test: fast/preloader/scan-body-from-head.html
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::preload):
+
+2011-03-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82616.
+        http://trac.webkit.org/changeset/82616
+        https://bugs.webkit.org/show_bug.cgi?id=57585
+
+        New test does not pass on Gtk, chromium-mac, chromium-linux
+        and possibly elsewhere (Requested by abarth|gardener on
+        #webkit).
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidget):
+
+2011-03-31  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Fix ownership semantics for LayerChromium/CCLayerImpl
+        https://bugs.webkit.org/show_bug.cgi?id=57577
+
+        LayerRendererChromium now uses a RefPtr to preserve ownership of all
+        of the CCLayerImpl layers that it is using during the update/draw
+        pass.  Addtionally, when a LayerChromium is destroyed, the weak
+        owner pointer from its CCLayerImpl is correctly unset.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::compareLayerZ):
+        (WebCore::LayerRendererChromium::updateAndDrawLayers):
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::updatePropertiesAndRenderSurfaces):
+        (WebCore::LayerRendererChromium::drawLayer):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::drawsContent):
+        (WebCore::CCLayerImpl::cleanupResources):
+
+2011-03-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Rename WebCore's UI_STRING to WEB_UI_STRING to not overlap with WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=57582
+
+        * platform/DefaultLocalizationStrategy.cpp:
+        * platform/LocalizedStrings.h:
+
+2011-03-31  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename BidiResolver::lastBeforeET to m_lastBeforeET to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57550
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-31  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by James Robinson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45855
+        Windowless plugins added dynamically to the DOM should receive paint events.
+        This is done by ensuring that the plugin widget is marked for painting when
+        it is added.
+
+        Test: plugins/windowless_plugin_paint_test.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidget):
+
+2011-03-31  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Speed up accelerated path drawing.
+        https://bugs.webkit.org/show_bug.cgi?id=57371
+        This CL does three things:  re-uses the same vertex and index buffer
+        for all path draws, converts all vertex layouts from vec3 to vec2, and
+        does a convexity check for polygons before passing them to the
+        tesselator.
+
+        Covered by canvas/philip/tests/2d.path.bezierCurveTo.*, and others.
+
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        Replace the Vector<double> for interpolated curves with a
+        Vector<FloatPoint>.
+        (WebCore::Cubic::evaluate):
+        Inline the evaluation function (as Quadratic does).
+        (WebCore::GLES2Canvas::GLES2Canvas):
+        Initialize the m_pathIndexBuffer.
+        (WebCore::GLES2Canvas::~GLES2Canvas):
+        Delete the path vertex and index buffers on destruction.
+        (WebCore::interpolateQuadratic):
+        (WebCore::interpolateCubic):
+        Interpolate directly to a Vector<FloatPoint>, rather than
+        Vector<double>.
+        (WebCore::PolygonData::PolygonData):
+        (WebCore::combineData):
+        Replace the DoubleVector with a FloatPointVector.
+        (WebCore::GLES2Canvas::tesselateAndFillPath):
+        Move curve drawing into this function, and rename it to reflect the
+        new behaviour.  Re-use the common vertex and index buffers.  If the
+        curve consists of a single convex polygon, draw the curve as a single
+        triangle fan.  Otherwise, convert it to doubles and pass it to the
+        tesselator.
+        (WebCore::GLES2Canvas::fillPathInternal):
+        * platform/graphics/chromium/GLES2Canvas.h:
+        Rename createVertexBufferFromPath() -> tesselateAndFillPath().
+        Add a persistent index buffer for all path draws.
+        * platform/graphics/gpu/BicubicShader.cpp:
+        (WebCore::BicubicShader::create):
+        (WebCore::BicubicShader::use):
+        * platform/graphics/gpu/ConvolutionShader.cpp:
+        (WebCore::ConvolutionShader::create):
+        (WebCore::ConvolutionShader::use):
+        Use vec2s instead of vec3s for all vertex data.
+        * platform/graphics/gpu/LoopBlinnMathUtils.cpp:
+        (WebCore::LoopBlinnMathUtils::convexCompare):
+        (WebCore::LoopBlinnMathUtils::convexCross):
+        (WebCore::LoopBlinnMathUtils::convexCheckTriple):
+        (WebCore::LoopBlinnMathUtils::isConvex):
+        * platform/graphics/gpu/LoopBlinnMathUtils.h:
+        Implement a convexity check, based on the code in Graphics Gems IV.
+        * platform/graphics/gpu/Shader.cpp:
+        (WebCore::Shader::generateVertex):
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::useQuadVertices):
+        * platform/graphics/gpu/SolidFillShader.cpp:
+        (WebCore::SolidFillShader::use):
+        * platform/graphics/gpu/TexShader.cpp:
+        (WebCore::TexShader::use):
+        Use vec2s instead of vec3s for all vertex data.
+
+2011-03-31  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57565
+
+        Optimize overflow computations on lines to avoid allocating RenderOverflows in nearly all cases and to avoid even having
+        to check the line for overflow in the first place.
+        
+        For the purposes of overflow computation, an inline object's default containment box for overflow is now assumed to extend
+        all the way from lineTop to lineBottom instead of snugly fitting the inline object's own block dimensions. This allows
+        replaced objects to be inside spans without triggering overflow allocation.
+        
+        The overflow accessors on InlineFlowBox have been changed to require passing in the lineTop and lineBottom so that the block
+        dimensions can be forced to those values. Because these values are checked during painting and hit testing of lines, the
+        lineTop and lineBottom are now passed as arguments to the painting and hit testing functions to avoid repeatedly crawling
+        back up to the root box to fetch them.
+        
+        Added a new boolean flag to all InlineBoxes, knownToHaveNoOverflow(), and optimized for common cases where no overflow can
+        possibly be present.  When the bit is set, computeOverflow will just immediately return.
+ 
+        This change speeds up line layout by ~10%.
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/EllipsisBox.h:
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::paint):
+        (WebCore::InlineBox::nodeAtPoint):
+        (WebCore::InlineBox::clearKnownToHaveNoOverflow):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::logicalFrameRect):
+        (WebCore::InlineBox::knownToHaveNoOverflow):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::addBoxShadowVisualOverflow):
+        (WebCore::InlineFlowBox::addTextBoxVisualOverflow):
+        (WebCore::InlineFlowBox::addReplacedChildOverflow):
+        (WebCore::InlineFlowBox::computeOverflow):
+        (WebCore::InlineFlowBox::setLayoutOverflow):
+        (WebCore::InlineFlowBox::setVisualOverflow):
+        (WebCore::InlineFlowBox::setOverflowFromLogicalRects):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::layoutOverflowRect):
+        (WebCore::InlineFlowBox::logicalLeftLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalRightLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalTopLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalBottomLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalLayoutOverflowRect):
+        (WebCore::InlineFlowBox::visualOverflowRect):
+        (WebCore::InlineFlowBox::logicalLeftVisualOverflow):
+        (WebCore::InlineFlowBox::logicalRightVisualOverflow):
+        (WebCore::InlineFlowBox::logicalTopVisualOverflow):
+        (WebCore::InlineFlowBox::logicalBottomVisualOverflow):
+        (WebCore::InlineFlowBox::logicalVisualOverflowRect):
+        (WebCore::InlineFlowBox::frameRectIncludingLineHeight):
+        (WebCore::InlineFlowBox::logicalFrameRectIncludingLineHeight):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::nodeAtPoint):
+        (WebCore::InlineTextBox::paint):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
+        (WebCore::RenderBlock::paintEllipsisBoxes):
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasRenderOverflow):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesVisualOverflowBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::anyLineIntersectsRect):
+        (WebCore::RenderLineBoxList::lineIntersectsDirtyRect):
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::paintEllipsisBox):
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::paint):
+        (WebCore::RootInlineBox::nodeAtPoint):
+        (WebCore::RootInlineBox::paddedLayoutOverflowRect):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::logicalTopVisualOverflow):
+        (WebCore::RootInlineBox::logicalBottomVisualOverflow):
+        (WebCore::RootInlineBox::logicalTopLayoutOverflow):
+        (WebCore::RootInlineBox::logicalBottomLayoutOverflow):
+        * rendering/svg/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::paint):
+        * rendering/svg/SVGInlineFlowBox.h:
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paint):
+        * rendering/svg/SVGInlineTextBox.h:
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+        * rendering/svg/SVGRootInlineBox.h:
+
+2011-03-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: disable properties abbreviation.
+        https://bugs.webkit.org/show_bug.cgi?id=57525
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::getProperties):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptSource.js:
+        (.):
+        ():
+        * inspector/Inspector.json:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.evaluated):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.nodePrototypesReady):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.getOwnProperties):
+        (WebInspector.RemoteObject.prototype.getAllProperties):
+        (WebInspector.RemoteObject.prototype._getProperties):
+        (WebInspector.LocalJSONObject.prototype.getOwnProperties):
+        (WebInspector.LocalJSONObject.prototype.getAllProperties):
+        * inspector/front-end/inspector.css:
+        (.console-formatted-string, .console-formatted-regexp):
+
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Update WKCACFViewLayerTreeHost for changes to WKCACFView API
+
+        This should not result in any change in behavior.
+
+        Fixes <http://webkit.org/b/57560> WKCACFViewLayerTreeHost needs to tell WKCACFView where to
+        render
+
+        Reviewed by Darin Adler.
+
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp: Updated API declarations.
+        (WebCore::WKCACFViewLayerTreeHost::WKCACFViewLayerTreeHost): Tell WKCACFView it should
+        render into the window we give it.
+
+2011-03-31  Marius Storm-Olsen  <marius.storm-olsen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Properly detect phonon include, and avoid double qtLibraryTarget() call
+        https://bugs.webkit.org/show_bug.cgi?id=57017
+
+        Build fix. No new tests.
+
+        * WebCore.pri:
+
+2011-03-31  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        XML viewer is not shown when frame has non-null opener
+        https://bugs.webkit.org/show_bug.cgi?id=56384
+
+        Removed opener check in XML viewer
+
+        Test: http/tests/xmlviewer/extensions-api.html
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::hasNoStyleInformation):
+        * xml/XMLViewer.js:
+
+2011-03-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82589.
+        http://trac.webkit.org/changeset/82589
+        https://bugs.webkit.org/show_bug.cgi?id=57564
+
+        This patch requires many more updated results than it contains
+        (Requested by abarth|gardener on #webkit).
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/html.css:
+        (meter::-webkit-meter-horizontal-bar):
+        (meter::-webkit-meter-vertical-bar):
+        (meter::-webkit-meter-horizontal-optimum-value):
+        (meter::-webkit-meter-horizontal-suboptimal-value):
+        (meter::-webkit-meter-horizontal-even-less-good-value):
+        (meter::-webkit-meter-vertical-optimum-value):
+        (meter::-webkit-meter-vertical-suboptimal-value):
+        (meter::-webkit-meter-vertical-even-less-good-value):
+        * rendering/RenderMeter.cpp:
+        (WebCore::MeterPartElement::MeterPartElement):
+        (WebCore::MeterPartElement::createForPart):
+        (WebCore::MeterPartElement::hide):
+        (WebCore::MeterPartElement::restoreVisibility):
+        (WebCore::MeterPartElement::updateStyleForPart):
+        (WebCore::MeterPartElement::saveVisibility):
+        (WebCore::RenderMeter::~RenderMeter):
+        (WebCore::RenderMeter::createPart):
+        (WebCore::RenderMeter::updateFromElement):
+        (WebCore::RenderMeter::layoutParts):
+        (WebCore::RenderMeter::shouldHaveParts):
+        (WebCore::RenderMeter::valuePartRect):
+        (WebCore::RenderMeter::orientation):
+        (WebCore::RenderMeter::valuePseudoId):
+        (WebCore::RenderMeter::barPseudoId):
+        * rendering/RenderMeter.h:
+        (WebCore::RenderMeter::shadowAttached):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::supportsMeter):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMeter):
+        (WebCore::RenderThemeMac::supportsMeter):
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Link explicitly with XRender on Linux/Unix
+        https://bugs.webkit.org/show_bug.cgi?id=57558
+
+        * GNUmakefile.am: add XRender CFLAGS.
+
+2011-03-31  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename BidiResolver::emptyRun to m_emtpyRun to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57549
+
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiResolver::BidiResolver):
+        (WebCore::::appendRun):
+        (WebCore::::lowerExplicitEmbeddingLevel):
+        (WebCore::::raiseExplicitEmbeddingLevel):
+        (WebCore::::deleteRuns):
+        (WebCore::::createBidiRunsForLine):
+        * rendering/InlineIterator.h:
+        (WebCore::InlineBidiResolver::appendRun):
+
+2011-03-31  Tom Sepez  <tsepez@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make ContainerNode::insertIntoDocument() collect all nodes before
+        operating on any of them.  Add small helper function and use it
+        througout the file where this action is already taking place.
+        https://bugs.webkit.org/show_bug.cgi?id=57265
+        
+        Test: svg/dom/range-delete.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::collectNodes):
+        (WebCore::collectTargetNodes):
+        (WebCore::ContainerNode::takeAllChildrenFrom):
+        (WebCore::willRemoveChildren):
+        (WebCore::ContainerNode::insertedIntoDocument):
+
+2011-03-31  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Steve Block.
+
+        While drawing a speech input button, validate that the node is really a speech input button.
+        https://bugs.webkit.org/show_bug.cgi?id=57469
+
+        Test: fast/speech/speech-style-on-non-speech-elements.html
+
+        * dom/Element.h:
+        (WebCore::Element::isInputFieldSpeechButtonElement):
+        * html/shadow/TextControlInnerElements.h:
+        (WebCore::InputFieldSpeechButtonElement::isInputFieldSpeechButtonElement):
+        (WebCore::toInputFieldSpeechButtonElement):
+        * rendering/RenderInputSpeech.cpp:
+        (WebCore::RenderInputSpeech::paintInputFieldSpeechButton):
+
+2011-03-31  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix after r82588. Reverted unintentional change.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyMovingLeft):
+
+2011-03-31  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Warnings happening because of unhandled switch cases in AccessibilityObjectWrapperAtk
+        https://bugs.webkit.org/show_bug.cgi?id=57534
+
+        Fix compilation warnings.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getAttributeSetForAccessibilityObject): Add unhandled cases.
+
+2011-03-30  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove unnecessary newBody output parameter from editScriptSource protocol method.
+        https://bugs.webkit.org/show_bug.cgi?id=57444
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::editScriptSource):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::editScriptSource):
+        * bindings/v8/ScriptDebugServer.h:
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.editScriptSource):
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleSave.didEditScriptSource):
+        (WebInspector.SourceFrame.prototype._handleSave):
+
+2011-03-30  MORITA Hajime <morrita@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        <meter> can only support horizontal indicator
+        https://bugs.webkit.org/show_bug.cgi?id=56001
+
+        - Removed code which deals with the direction and
+          left the horizontal path.
+        - Removed "horizontal" from related names which is now
+          redundant.
+        
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/html.css:
+        (meter::-webkit-meter-bar):
+        (meter::-webkit-meter-optimum-value):
+        (meter::-webkit-meter-suboptimal-value):
+        (meter::-webkit-meter-even-less-good-value):
+        * rendering/RenderMeter.cpp:
+        (WebCore::RenderMeter::~RenderMeter):
+        (WebCore::RenderMeter::createPart):
+        (WebCore::RenderMeter::updateFromElement):
+        (WebCore::RenderMeter::layoutParts):
+        (WebCore::RenderMeter::styleDidChange):
+        (WebCore::RenderMeter::shouldHaveParts):
+        (WebCore::RenderMeter::valuePartRect):
+        (WebCore::RenderMeter::valuePseudoId):
+        (WebCore::RenderMeter::barPseudoId):
+        (WebCore::RenderMeter::detachShadows):
+        (WebCore::RenderMeter::updateShadows):
+        * rendering/RenderMeter.h:
+        (WebCore::RenderMeter::shadowAttached):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::supportsMeter):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMeter):
+        (WebCore::RenderThemeMac::supportsMeter):
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-30  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Experiment with moving caret by word in visual order.
+        https://bugs.webkit.org/show_bug.cgi?id=57336
+
+        Follow Firefox's convention in Windows, 
+        In LTR block, word break visually moves cursor to the left boundary of words,
+        In RTL block, word break visually moves cursor to the right boundary of words.
+
+        This is the 1st version of implementing "move caret by word in visual order".
+        It only works in the following situation:
+        1. For a LTR box in a LTR block or a RTL box in RTL block, 
+        when caret is at the left boundary of the box and we are looking for 
+        the word boundary in right.
+        2. For a LTR or RTL box in a LTR block, when caret is at the left boundary
+        of the box and we are looking for the word boundary in left and 
+        previous box is a LTR box.
+        3. For a LTR or RTL box in a RTL block, when the caret is at the right 
+        boundary of the box and we are looking for the word boundary in right and next box is RTL box.
+
+        An experimental granularity is introduced, as a side effect, functions having switch statements
+        to handle those granularities have to add more one case to handle this new granularity.
+        The experimental granularity is exposed though JS by '-webkit-visual-word".
+
+        The overall algorithm is looping through inline boxes visually and looking
+        for the visually nearest word break position. 
+
+        Test: editing/selection/move-by-word-visually.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingRight):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingLeft):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingLeft):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/TextGranularity.h:
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        * editing/visible_units.cpp:
+        (WebCore::previousWordBreakInBoxInsideBlockWithSameDirectionality):
+        (WebCore::wordBoundaryInBox):
+        (WebCore::wordBoundaryInAdjacentBoxes):
+        (WebCore::leftWordBoundary):
+        (WebCore::rightWordBoundary):
+        (WebCore::leftWordPosition):
+        (WebCore::rightWordPosition):
+        * editing/visible_units.h:
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::modify):
+
+2011-03-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move coordinate-computing logic into MouseRelatedEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=57521
+
+        Refactoring, covered by existing tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchWheelEvent): Yank calculation of
+            coordinates out.
+        (WebCore::EventDispatcher::dispatchMouseEvent): Ditto.
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEvent::create): Add coordinate-computing logic.
+        * dom/MouseEvent.h: Adjust decl to reflect new meaning of params.
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::MouseRelatedEvent): Ditto.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchDragEvent): Ditto.
+
+2011-03-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: document CSS agent.
+        https://bugs.webkit.org/show_bug.cgi?id=57435
+
+        * inspector/Inspector.json:
+
+2011-03-31  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: remove periods at the end of error messages
+        https://bugs.webkit.org/show_bug.cgi?id=57544
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::makeObjectCall):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::elementForId):
+        (WebCore::InspectorCSSAgent::styleSheetForId):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::assertNode):
+        (WebCore::InspectorDOMAgent::assertElement):
+        (WebCore::InspectorDOMAgent::assertHTMLElement):
+        (WebCore::InspectorDOMAgent::querySelector):
+        (WebCore::InspectorDOMAgent::querySelectorAll):
+        (WebCore::InspectorDOMAgent::setAttribute):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::resourceContent):
+        (WebCore::InspectorResourceAgent::resourceContentBase64):
+        (WebCore::InspectorResourceAgent::getResourceContent):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Introduce a new StringWithDirection object that carries a String along
+        with the TextDirection associated with the String.  Use this object for
+        document titles used within WebCore, because in HTML the direction of
+        a title can be set with the 'dir' attribute.
+
+        Put FIXMEs at the WebKit level to expose the new direction information
+        to clients.
+
+        No behavioral change intended, so no new tests.  A follow-up will expose
+        the title direction and hopefully can be accompanied by tests that
+        verify it is correct.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::updateTitle):
+        (WebCore::Document::setTitle):
+        (WebCore::Document::removeTitle):
+        * dom/Document.h:
+        (WebCore::Document::title):
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::HTMLTitleElement):
+        (WebCore::HTMLTitleElement::childrenChanged):
+        (WebCore::HTMLTitleElement::text):
+        (WebCore::HTMLTitleElement::textWithDirection):
+        * html/HTMLTitleElement.h:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::setTitle):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::title):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidReceiveTitle):
+        (WebCore::EmptyFrameLoaderClient::setTitle):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::setTitle):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForBackForwardNavigation):
+        (WebCore::HistoryController::updateForReload):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForClientRedirect):
+        (WebCore::HistoryController::updateForCommit):
+        (WebCore::HistoryController::setCurrentItemTitle):
+        (WebCore::HistoryController::initializeItem):
+        * loader/HistoryController.h:
+        * platform/text/StringWithDirection.h: Added.
+        (WebCore::StringWithDirection::StringWithDirection):
+        (WebCore::StringWithDirection::operator==):
+        (WebCore::StringWithDirection::operator!=):
+        * svg/SVGTitleElement.cpp:
+        (WebCore::SVGTitleElement::insertedIntoDocument):
+        (WebCore::SVGTitleElement::childrenChanged):
+
+2011-03-31  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: CSS domain - make a "range" object, get rid of "properties" object for Style objects
+        https://bugs.webkit.org/show_bug.cgi?id=57538
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::buildSourceRangeObject):
+        (WebCore::InspectorStyle::buildObjectForStyle):
+        (WebCore::InspectorStyle::populateObjectWithStyleProperties):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.selectorsCallback):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleDeclaration):
+
+2011-03-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82565.
+        http://trac.webkit.org/changeset/82565
+        https://bugs.webkit.org/show_bug.cgi?id=57541
+
+        Caused assertion failures. (Requested by bbandix on #webkit).
+
+        * platform/graphics/filters/FEFlood.cpp:
+        (WebCore::FEFlood::setFloodColor):
+        (WebCore::FEFlood::setFloodOpacity):
+        * platform/graphics/filters/FEFlood.h:
+        * platform/graphics/filters/FESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::setLightingColor):
+        * platform/graphics/filters/FESpecularLighting.h:
+        * rendering/svg/RenderSVGResourceFilterPrimitive.cpp:
+        * rendering/svg/RenderSVGResourceFilterPrimitive.h:
+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::clientStyleChanged):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::setFilterEffectAttribute):
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::setFilterEffectAttribute):
+
+2011-03-31  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        CSS related SVG*Element changes doesn't require relayout
+        https://bugs.webkit.org/show_bug.cgi?id=56906
+
+        The changes of some CSS related SVGFilter properties e.g. lighting-color, flood-color, flood-opacity
+        need only repaint. To avoid the default invalidation of filters in SVGResourceCache::clientStyleChange()
+        we need an early return. So RenderSVGResourceFilterPrimitive::styleDidChange() can handle these properties
+        via RenderSVGResourceFilter::primitiveAttributeChanged() the same way like we do it for the other SVGAttributes.
+
+        Tests: svg/dynamic-updates/SVGFEDiffuseLightingElement-inherit-lighting-color-css-prop.html
+               svg/dynamic-updates/SVGFEFloodElement-inherit-flood-color.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-inherit-lighting-color-css-prop.html
+               svg/dynamic-updates/SVGFESpecularLightingElement-lighting-color-css-prop.html
+
+        * platform/graphics/filters/FEFlood.cpp:
+        (WebCore::FEFlood::setFloodColor):
+        (WebCore::FEFlood::setFloodOpacity):
+        * platform/graphics/filters/FEFlood.h:
+        * platform/graphics/filters/FESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::setLightingColor):
+        * platform/graphics/filters/FESpecularLighting.h:
+        * rendering/svg/RenderSVGResourceFilterPrimitive.cpp:
+        (WebCore::RenderSVGResourceFilterPrimitive::styleDidChange):
+        * rendering/svg/RenderSVGResourceFilterPrimitive.h:
+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::clientStyleChanged):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::setFilterEffectAttribute):
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::setFilterEffectAttribute):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::setFilterEffectAttribute):
+
+2011-03-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        XML Viewer: declared namespaces are not rendered.
+        https://bugs.webkit.org/show_bug.cgi?id=56262
+
+        XML viewer rewritten on javascript.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::doEnd):
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+        * xml/XMLViewer.css: Added.
+        * xml/XMLViewer.js: Added.
+        * xml/XMLViewer.xsl: Removed.
+        * xml/XSLStyleSheet.h:
+
+2011-03-31  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Unreviewed build fix.
+
+        Fix build break after rolling out r82496
+        https://bugs.webkit.org/show_bug.cgi?id=57536
+
+        * platform/efl/RenderThemeEfl.cpp:
+
+2011-03-31  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: execution line is displayed incorrectly after source editing.
+        https://bugs.webkit.org/show_bug.cgi?id=57229
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._saveViewerState):
+        (WebInspector.SourceFrame.prototype._restoreViewerState):
+        (WebInspector.SourceFrame.prototype._startEditing):
+        (WebInspector.SourceFrame.prototype._endEditing):
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        (WebInspector.SourceFrame.prototype.setExecutionLine):
+        (WebInspector.SourceFrame.prototype._handleSave.didEditScriptSource):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._handleRevertEditing):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorChunkedPanel.prototype.addDecoration):
+        (WebInspector.TextEditorChunkedPanel.prototype.removeDecoration):
+        (WebInspector.TextEditorMainPanel.prototype.makeLineAChunk):
+        (WebInspector.TextEditorMainPanel.prototype._positionToSelection):
+
+2011-03-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Make the CSStyle "shorthandValues" name-value map an array
+        https://bugs.webkit.org/show_bug.cgi?id=57452
+
+        No new tests, as this is a refactoring.
+
+        * inspector/InspectorCSSAgent.cpp:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::populateObjectWithStyleProperties):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.buildShorthandValueMap):
+
+2011-03-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaField should not expose JavaString in its API
+        https://bugs.webkit.org/show_bug.cgi?id=55766
+
+        This patch fixes JavaField for V8 only.
+        - Factors out a JavaField interface which does not use JNI types.
+          This will allow the Java bridge to be used with objects that
+          don't use JNI directly. The existing jobject-backed
+          implementation is moved to a new JavaFieldJobject class which
+          implements the interface.
+        - Use WTF::String in place of JavaString in the API, as JavaString
+          exposes JNI types in its interface.
+
+        No new tests, refactoring only.
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bridge/jni/JavaMethod.h:
+        (JSC::Bindings::JavaMethod::~JavaMethod):
+        * bridge/jni/JobjectWrapper.h:
+        * bridge/jni/v8/JavaClassV8.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/v8/JavaFieldJobjectV8.cpp:
+        (JavaFieldJobject::JavaFieldJobject):
+        * bridge/jni/v8/JavaFieldJobjectV8.h:
+        (JSC::Bindings::JavaFieldJobject::name):
+        (JSC::Bindings::JavaFieldJobject::typeClassName):
+        (JSC::Bindings::JavaFieldJobject::type):
+        * bridge/jni/v8/JavaFieldV8.h:
+        (JSC::Bindings::JavaField::~JavaField):
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::getField):
+
+2011-03-31  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Clean up from r82447.
+        https://bugs.webkit.org/attachment.cgi?bugid=57532
+
+        No new tests since this doesn't change behavior.
+
+        * rendering/RenderBlock.cpp: Removing unnecessary visible_units.h include.
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::getLogicalStartBoxWithNode): Making const.
+        (WebCore::RootInlineBox::getLogicalEndBoxWithNode): Ditto.
+        * rendering/RootInlineBox.h:
+
+2011-03-31  Benjamin Kalman  <kalman@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        DeleteSelectionCommand::removeNode tries to insert block placeholder in non-editable table cell positions
+        https://bugs.webkit.org/show_bug.cgi?id=57079
+
+        Test: editing/execCommand/delete-table-with-empty-contents.html
+
+        This bug results in an ASSERT fail in CompositeEditCommand::insertNodeAt, so is only observable in debug builds
+        of WebKit.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::firstEditablePositionInNode):
+        (WebCore::DeleteSelectionCommand::removeNode): Use firstEditablePositionInNode rather than firstPositionInNode
+        to find anchor node for the placeholder's position, if any.
+
+2011-03-30  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r82400): Leaks seen beneath CSSParser::createFloatingVectorSelector when parsing UA stylesheet
+        https://bugs.webkit.org/show_bug.cgi?id=57478
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::sinkFloatingSelectorVector):
+        * css/CSSParser.h:
+
+2011-03-30  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds layoutTestController.shadowRoot accessor to Mac DRT.
+        https://bugs.webkit.org/show_bug.cgi?id=57415
+
+        * WebCore.exp.in: DRT needs to link WebCore::Element::shadowRoot
+
+2011-03-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Simplify HTMLFormElement::validateInteractively() for asynchronous scroll event
+        https://bugs.webkit.org/show_bug.cgi?id=57424
+
+        r75555 made 'scroll' event asynchronous. So we don't need to worry about
+        deleting or moving a target node in scrollIntoViewIfNeeded().
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::validateInteractively): Remove unnecessary code.
+
+2011-03-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r74895): Crash if input.type = 'file' twice
+        https://bugs.webkit.org/show_bug.cgi?id=57343
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateType):
+          Don't call setAttribute() if the type is not changed.
+
+2011-03-30  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Autocorrection panel isn't positioned correctly in Safari (mac) when the zooming is not 1x.
+        https://bugs.webkit.org/show_bug.cgi?id=57353
+        <rdar://problem/9163983>
+
+        We use Range::textQuads() instead of Range::boundingRect() to compute the position of correction
+        panel. The latter function compensates for zooming, which we don't need in this case. We also
+        dismiss correction panel when zooming factor is changed. This is done in Frame::setPageAndTextZoomFactors().
+
+        * WebCore.exp.in:
+        * dom/Range.cpp:
+        (WebCore::Range::textQuads):
+        * dom/Range.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::windowRectForRange):
+        * editing/Editor.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setPageAndTextZoomFactors):
+
+2011-03-30  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Render fonts using skia when requested by platform context.
+        https://bugs.webkit.org/show_bug.cgi?id=56441
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::isNativeFontRenderingAllowed):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::skiaDrawText):
+        (WebCore::setupPaintForFont):
+        (WebCore::paintSkiaText):
+
+2011-03-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/9199518> Crash when focusing a styled editable element
+
+        Test: editing/deleting/delete-button-background-image-none.html
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement): Check all background layers for background images.
+        * rendering/style/RenderStyle.h: Removed backgroundImage() as it was only used, incorrectly,
+        in the above function.
+
 2011-03-30  Martin Robinson  <mrobinson@igalia.com>
 
-        Try to fix the EFL build.
+        Try once more to fix the EFL build.
 
         * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::RenderThemeEfl::paintThemePart): Use the new cairo_t accessor on the platform context.
+
+2011-03-30  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Regression: VO cursor doesn't follow KB focus back into HTML view
+        https://bugs.webkit.org/show_bug.cgi?id=57509
+
+        In WK2, because the web area never believes focus leave the area, sending the initial
+        focus change when moving back into the web area, does not trigger a notification.
+
+        That behavior needs to be overridden by explicitly posting a focused UI element change
+        at the appropriate time. This is only used in WK2, hence the absence of a layout test for now.
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setInitialFocus):
+
+2011-03-30  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Simon Fraser.
+
+        box-shadow radii stays the same regardless of any spread set
+        https://bugs.webkit.org/show_bug.cgi?id=49726
+
+        - Removed special shadowSpread handling path
+        - Fixed broken multple inset shadow border computation.
+
+        Test: fast/box-shadow/spread-multiple-inset.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+
+2011-03-29  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Use the Accelerate vImage vectorized (un)premultiplyImageData functions for ImageBufferCG
+
+        https://bugs.webkit.org/show_bug.cgi?id=53134
+
+        Test: fast/canvas/getPutImageDataPairTest.html
+
+        * platform/graphics/cg/ImageBufferCG.cpp:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Share most vsprops between Release and Production builds in releaseproduction.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=57508
+
+        * WebCore.vcproj/QTMovieWinProduction.vsprops:
+        * WebCore.vcproj/QTMovieWinRelease.vsprops:
+        * WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops:
+        * WebCore.vcproj/WebCoreProduction.vsprops:
+        * WebCore.vcproj/WebCoreRelease.vsprops:
+        * WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops:
+
+2011-03-30  Timur Iskhodzhanov  <timurrrr@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add some dynamic annotations to JavaScriptCore/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=53747
+
+        By using these annotations we can improve the precision of finding
+        WebKit errors using dynamic analysis tools like ThreadSanitizer and Valgrind.
+        These annotations don't affect the compiled binaries unless USE(DYNAMIC_ANNOTATIONS) is "1".
+
+        These files don't add new functionality, so don't need extra tests.
+
+        * ForwardingHeaders/wtf/DynamicAnnotations.h: Added.
 
 2011-03-30  Abhishek Arya  <inferno@chromium.org>
 
@@ -98,44 +16579,6 @@
         * html/HTMLAnchorElement.idl:
         * html/HTMLAreaElement.idl:
 
-2011-03-30  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Dirk Schulze.
-
-        [Cairo] Better separate the concerns of GraphicsContextCairo
-        https://bugs.webkit.org/show_bug.cgi?id=55150
-
-        Add a PlatformContextCairo which right now stores the cairo_t* for a
-        GraphicsContextCairo. Later patches will move logic for tracking ContextShadow
-        and image masking layers into this PlatformContextCairo class.
-
-        No new tests. This patch is only a code cleanup.
-
-        * GNUmakefile.am:
-        * platform/graphics/GraphicsContext.h: The platform context is no longer a
-        cairo_t, but our new class the PlatformContextCairo.
-        * platform/graphics/cairo/ContextShadowCairo.cpp: Updated to reflect new class.j
-        * platform/graphics/cairo/FontCairo.cpp: Ditto.
-        * platform/graphics/cairo/GradientCairo.cpp: Ditto.
-        * platform/graphics/cairo/GraphicsContextCairo.cpp: Mostly mechanical
-        changes which now reference platformContext()->cr() to get the cairo_t.
-        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h: Now hold the
-        PlatformContextCairo instead of the cairo_t.
-        * platform/graphics/cairo/ImageBufferCairo.cpp: Update to reflect new class.
-        * platform/graphics/cairo/ImageCairo.cpp: Ditto.
-        * platform/graphics/cairo/PathCairo.cpp: Ditto.
-        * platform/graphics/cairo/PlatformContextCairo.cpp: Added.
-        * platform/graphics/cairo/PlatformContextCairo.h: Added.
-        * platform/graphics/gtk/FontGtk.cpp: Update to reflect new class.
-        * platform/graphics/gtk/IconGtk.cpp: Ditto.
-        * platform/graphics/win/GraphicsContextCairoWin.cpp: Now fill out
-        m_data with a private section containing the platform context instead of
-        just a cairo_t.
-        * platform/gtk/RenderThemeGtk.cpp: Update to reflect new class.
-        * platform/gtk/WidgetRenderingContext.cpp: Ditto.
-        (WebCore::WidgetRenderingContext::~WidgetRenderingContext): Ditto.
-        * plugins/gtk/PluginViewGtk.cpp: Ditto.
-
 2011-03-30  Patrick Gansterer  <paroga@webkit.org>
 
         Unreviewed WinCE build fix for r82465.
diff --git a/Source/WebCore/CodeGenerators.pri b/Source/WebCore/CodeGenerators.pri
index 2f89a5d..3d5d450 100644
--- a/Source/WebCore/CodeGenerators.pri
+++ b/Source/WebCore/CodeGenerators.pri
@@ -38,7 +38,7 @@ WALDOCSSPROPS = $$PWD/css/CSSPropertyNames.in
 
 WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
 
-DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
+contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=1): DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
 
 XPATHBISON = $$PWD/xml/XPathGrammar.y
 
@@ -62,8 +62,7 @@ STYLESHEETS_EMBED = \
     $$PWD/css/mediaControls.css \
     $$PWD/css/mediaControlsQt.css \
     $$PWD/css/mediaControlsQtFullscreen.css \
-    $$PWD/css/themeQtNoListboxes.css \
-    $$PWD/css/themeQtMobile.css
+    $$PWD/css/themeQtNoListboxes.css
 
 v8 {
     IDL_BINDINGS += \
@@ -160,7 +159,6 @@ IDL_BINDINGS += \
     dom/WebKitTransitionEvent.idl \
     dom/WheelEvent.idl \
     fileapi/Blob.idl \
-    fileapi/BlobBuilder.idl \
     fileapi/DirectoryEntry.idl \
     fileapi/DirectoryEntrySync.idl \
     fileapi/DirectoryReader.idl \
@@ -186,9 +184,10 @@ IDL_BINDINGS += \
     fileapi/FileSystemCallback.idl \
     fileapi/FileWriter.idl \
     fileapi/FileWriterCallback.idl \
-    fileapi/Flags.idl \
+    fileapi/WebKitFlags.idl \
     fileapi/Metadata.idl \
     fileapi/MetadataCallback.idl \
+    fileapi/WebKitBlobBuilder.idl \
     html/canvas/ArrayBufferView.idl \
     html/canvas/ArrayBuffer.idl \
     html/canvas/DataView.idl \
@@ -297,6 +296,7 @@ IDL_BINDINGS += \
     html/HTMLTableSectionElement.idl \
     html/HTMLTextAreaElement.idl \
     html/HTMLTitleElement.idl \
+    html/HTMLTrackElement.idl \
     html/HTMLUListElement.idl \
     html/HTMLVideoElement.idl \
     html/ImageData.idl \
@@ -326,6 +326,9 @@ IDL_BINDINGS += \
     page/Location.idl \
     page/MemoryInfo.idl \
     page/Navigator.idl \
+    page/NavigatorUserMediaError.idl \
+    page/NavigatorUserMediaErrorCallback.idl \
+    page/NavigatorUserMediaSuccessCallback.idl \
     page/Performance.idl \
     page/PerformanceNavigation.idl \
     page/PerformanceTiming.idl \
@@ -359,6 +362,9 @@ IDL_BINDINGS += \
     storage/IDBTransaction.idl \
     storage/Storage.idl \
     storage/StorageEvent.idl \
+    storage/StorageInfo.idl \
+    storage/StorageInfoErrorCallback.idl \
+    storage/StorageInfoUsageCallback.idl \
     storage/SQLError.idl \
     storage/SQLException.idl \
     storage/SQLResultSet.idl \
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 0c1d13c..73d3a47 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -23,8 +23,8 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 // The contents of this file must be kept in sync with FeatureDefines.xcconfig in JavaScriptCore,
-// WebCore and WebKit.  Also the default values of the ENABLE_FEATURE_NAME macros in build-webkit
-// should match the values below, but they do not need to be in the same order.
+// WebCore, WebKit and WebKit2.  Also the default values of the ENABLE_FEATURE_NAME macros in
+// build-webkit should match the values below, but they do not need to be in the same order.
 
 // Keep this list of features (not enabled/disabled state) in sync with FeatureDefines.vsprops
 // and FeatureDefinesCairo.vsprops in WebKitLibraries/win/tools/vsprops.
@@ -91,8 +91,11 @@ ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
+ENABLE_PAGE_VISIBILITY_API = ;
 ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 
+ENABLE_QUOTA = ;
+
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
@@ -109,6 +112,7 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
+ENABLE_VIDEO_TRACK = ;
 
 ENABLE_MEDIA_STATISTICS = ;
 
@@ -127,4 +131,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_QUOTA) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index cc13feb..60d36d5 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 27;
+MINOR_VERSION = 30;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/DerivedSources.cpp b/Source/WebCore/DerivedSources.cpp
index 24022f7..3bba78c 100644
--- a/Source/WebCore/DerivedSources.cpp
+++ b/Source/WebCore/DerivedSources.cpp
@@ -34,7 +34,6 @@
 #include "JSBarInfo.cpp"
 #include "JSBeforeLoadEvent.cpp"
 #include "JSBlob.cpp"
-#include "JSBlobBuilder.cpp"
 #include "JSCanvasGradient.cpp"
 #include "JSCanvasPattern.cpp"
 #include "JSCanvasRenderingContext.cpp"
@@ -129,7 +128,7 @@
 #include "JSFileWriter.cpp"
 #include "JSFileWriterCallback.cpp"
 #include "JSFileWriterSync.cpp"
-#include "JSFlags.cpp"
+#include "JSWebKitFlags.cpp"
 #include "JSFloat32Array.cpp"
 #include "JSGeolocation.cpp"
 #include "JSGeoposition.cpp"
@@ -245,6 +244,9 @@
 #include "JSMutationEvent.cpp"
 #include "JSNamedNodeMap.cpp"
 #include "JSNavigator.cpp"
+#include "JSNavigatorUserMediaError.cpp"
+#include "JSNavigatorUserMediaErrorCallback.cpp"
+#include "JSNavigatorUserMediaSuccessCallback.cpp"
 #include "JSNode.cpp"
 #include "JSNodeFilter.cpp"
 #include "JSNodeIterator.cpp"
@@ -283,6 +285,9 @@
 #include "JSSQLTransactionSyncCallback.cpp"
 #include "JSStorage.cpp"
 #include "JSStorageEvent.cpp"
+#include "JSStorageInfo.cpp"
+#include "JSStorageInfoErrorCallback.cpp"
+#include "JSStorageInfoUsageCallback.cpp"
 #include "JSStringCallback.cpp"
 #include "JSStyleMedia.cpp"
 #include "JSStyleSheet.cpp"
@@ -438,6 +443,7 @@
 #include "JSWebKitAnimation.cpp"
 #include "JSWebKitAnimationEvent.cpp"
 #include "JSWebKitAnimationList.cpp"
+#include "JSWebKitBlobBuilder.cpp"
 #include "JSWebKitCSSKeyframeRule.cpp"
 #include "JSWebKitCSSKeyframesRule.cpp"
 #include "JSWebKitCSSTransformValue.cpp"
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index c8fa310..a4c112a 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -73,12 +73,13 @@ DOM_CLASSES = \
     HighPass2FilterNode \
     JavaScriptAudioNode \
     LowPass2FilterNode \
+    OfflineAudioCompletionEvent \
     RealtimeAnalyserNode \
     BarInfo \
     BeforeLoadEvent \
     BeforeProcessEvent \
     Blob \
-    BlobBuilder \
+    WebKitBlobBuilder \
     CDATASection \
     CSSCharsetRule \
     CSSFontFaceRule \
@@ -196,7 +197,7 @@ DOM_CLASSES = \
     FileWriterCallback \
     FileWriterSync \
     FileSystemCallback \
-    Flags \
+    WebKitFlags \
     Geolocation \
     Geoposition \
     HashChangeEvent \
@@ -274,6 +275,7 @@ DOM_CLASSES = \
     HTMLTableSectionElement \
     HTMLTextAreaElement \
     HTMLTitleElement \
+    HTMLTrackElement \
     HTMLUListElement \
     HTMLVideoElement \
     IDBAny \
@@ -307,6 +309,9 @@ DOM_CLASSES = \
     MutationEvent \
     NamedNodeMap \
     Navigator \
+    NavigatorUserMediaError \
+    NavigatorUserMediaErrorCallback \
+    NavigatorUserMediaSuccessCallback \
     Node \
     NodeFilter \
     NodeIterator \
@@ -351,6 +356,9 @@ DOM_CLASSES = \
     SQLTransactionSyncCallback \
     Storage \
     StorageEvent \
+    StorageInfo \
+    StorageInfoErrorCallback \
+    StorageInfoUsageCallback \
     StringCallback \
     SVGAElement \
     SVGAltGlyphElement \
@@ -655,12 +663,21 @@ DocTypeStrings.cpp : html/DocTypeStrings.gperf $(WebCore)/make-hash-tools.pl
 
 # --------
 
-# XMLViewer XSLT
+# XMLViewer CSS
 
-all : XMLViewerXSL.h
+all : XMLViewerCSS.h
 
-XMLViewerXSL.h : xml/XMLViewer.xsl
-	perl $(WebCore)/inspector/xxd.pl XMLViewer_xsl $(WebCore)/xml/XMLViewer.xsl XMLViewerXSL.h
+XMLViewerCSS.h : xml/XMLViewer.css
+	perl $(WebCore)/inspector/xxd.pl XMLViewer_css $(WebCore)/xml/XMLViewer.css XMLViewerCSS.h
+
+# --------
+
+# XMLViewer JS
+
+all : XMLViewerJS.h
+
+XMLViewerJS.h : xml/XMLViewer.js
+	perl $(WebCore)/inspector/xxd.pl XMLViewer_js $(WebCore)/xml/XMLViewer.js XMLViewerJS.h
 
 # --------
 
@@ -763,6 +780,10 @@ ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
     HTML_FLAGS := $(HTML_FLAGS) ENABLE_VIDEO=1
 endif
 
+ifeq ($(findstring ENABLE_VIDEO_TRACK,$(FEATURE_DEFINES)), ENABLE_VIDEO_TRACK)
+    HTML_FLAGS := $(HTML_FLAGS) ENABLE_VIDEO_TRACK=0
+endif
+
 ifdef HTML_FLAGS
 
 HTMLElementFactory.cpp HTMLNames.cpp : dom/make_names.pl html/HTMLTagNames.in html/HTMLAttributeNames.in
diff --git a/Source/WebCore/English.lproj/Localizable.strings b/Source/WebCore/English.lproj/Localizable.strings
index d47f260..ec4d340 100644
--- a/Source/WebCore/English.lproj/Localizable.strings
+++ b/Source/WebCore/English.lproj/Localizable.strings
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index 0acde95..53bea35 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/ForwardingHeaders/collector/handles/Global.h b/Source/WebCore/ForwardingHeaders/collector/handles/Global.h
deleted file mode 100644
index 0ad6d56..0000000
--- a/Source/WebCore/ForwardingHeaders/collector/handles/Global.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Global_h
-#define WebCore_FWD_Global_h
-#include <JavaScriptCore/Global.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/runtime/Heap.h b/Source/WebCore/ForwardingHeaders/heap/Heap.h
index 810fa3c..810fa3c 100644
--- a/Source/WebCore/ForwardingHeaders/runtime/Heap.h
+++ b/Source/WebCore/ForwardingHeaders/heap/Heap.h
diff --git a/Source/WebCore/ForwardingHeaders/heap/Strong.h b/Source/WebCore/ForwardingHeaders/heap/Strong.h
new file mode 100644
index 0000000..31eb46d
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/heap/Strong.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_Strong_h
+#define WebCore_FWD_Strong_h
+#include <JavaScriptCore/Strong.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/heap/Weak.h b/Source/WebCore/ForwardingHeaders/heap/Weak.h
new file mode 100644
index 0000000..182542c
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/heap/Weak.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_Weak_h
+#define WebCore_FWD_Weak_h
+#include <JavaScriptCore/Weak.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/runtime/JSNumberCell.h b/Source/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
deleted file mode 100644
index e8d3227..0000000
--- a/Source/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_JSNumberCell_h
-#define WebCore_FWD_JSNumberCell_h
-#include <JavaScriptCore/JSNumberCell.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h b/Source/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h
deleted file mode 100644
index e87f8f2..0000000
--- a/Source/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_WeakGCPtr_h
-#define WebCore_FWD_WeakGCPtr_h
-#include <JavaScriptCore/WeakGCPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Alignment.h b/Source/WebCore/ForwardingHeaders/wtf/Alignment.h
new file mode 100644
index 0000000..3754945
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/Alignment.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_Alignment_h
+#define WebCore_FWD_Alignment_h
+#include <JavaScriptCore/Alignment.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h b/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h
new file mode 100644
index 0000000..e5a2f2d
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DynamicAnnotations_h
+#define WebCore_FWD_DynamicAnnotations_h
+#include <JavaScriptCore/DynamicAnnotations.h>
+#endif
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index eedbc9a..63575ae 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -1,3 +1,5 @@
+include $(srcdir)/Source/WebCore/GNUmakefile.list.am
+
 SVG_FEATURES :=
 HTML_FEATURES :=
 
@@ -5,6 +7,9 @@ WEBCORE_CSS_PROPERTY_NAMES := $(WebCore)/css/CSSPropertyNames.in
 WEBCORE_CSS_VALUE_KEYWORDS := $(WebCore)/css/CSSValueKeywords.in
 
 webcore_cppflags += \
+	-I$(srcdir)/Source/ThirdParty/ANGLE/src \
+	-I$(srcdir)/Source/ThirdParty/ANGLE/include \
+	-I$(srcdir)/Source/ThirdParty/ANGLE/include/GLSLANG \
 	-I$(srcdir)/Source/WebCore \
 	-I$(srcdir)/Source/WebCore/accessibility \
 	-I$(srcdir)/Source/WebCore/bindings \
@@ -40,6 +45,8 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/audio \
 	-I$(srcdir)/Source/WebCore/platform/graphics \
 	-I$(srcdir)/Source/WebCore/platform/graphics/filters \
+	-I$(srcdir)/Source/WebCore/platform/graphics/gpu \
+	-I$(srcdir)/Source/WebCore/platform/graphics/opengl \
 	-I$(srcdir)/Source/WebCore/platform/graphics/opentype \
 	-I$(srcdir)/Source/WebCore/platform/graphics/transforms \
 	-I$(srcdir)/Source/WebCore/platform/image-decoders \
@@ -49,6 +56,7 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/image-decoders/jpeg \
 	-I$(srcdir)/Source/WebCore/platform/image-decoders/webp \
 	-I$(srcdir)/Source/WebCore/platform/image-decoders/png \
+	-I$(srcdir)/Source/WebCore/platform/leveldb \
 	-I$(srcdir)/Source/WebCore/platform/mock \
 	-I$(srcdir)/Source/WebCore/platform/network \
 	-I$(srcdir)/Source/WebCore/platform/sql \
@@ -89,3846 +97,6 @@ webcoregtk_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/gtk \
 	-I$(srcdir)/Source/WebCore/platform/network/soup
 
-webcore_built_nosources += \
-	DerivedSources/WebCore/tokenizer.cpp
-
-webcore_built_sources += \
-	DerivedSources/WebCore/CSSGrammar.cpp \
-	DerivedSources/WebCore/CSSGrammar.h \
-	DerivedSources/WebCore/CSSPropertyNames.h \
-	DerivedSources/WebCore/CSSPropertyNames.cpp \
-	DerivedSources/WebCore/CSSValueKeywords.h \
-	DerivedSources/WebCore/CSSValueKeywords.cpp \
-	DerivedSources/WebCore/ColorData.cpp \
-	DerivedSources/WebCore/DocTypeStrings.cpp \
-	DerivedSources/WebCore/HashTools.h \
-	DerivedSources/WebCore/HTMLElementFactory.cpp \
-	DerivedSources/WebCore/HTMLElementFactory.h \
-	DerivedSources/WebCore/HTMLEntityTable.cpp \
-	DerivedSources/WebCore/HTMLNames.cpp \
-	DerivedSources/WebCore/HTMLNames.h \
-	DerivedSources/WebCore/InjectedScriptSource.h \
-	DerivedSources/WebCore/InspectorBackendDispatcher.cpp \
-	DerivedSources/WebCore/InspectorBackendDispatcher.h \
-	DerivedSources/WebCore/InspectorFrontend.cpp \
-	DerivedSources/WebCore/InspectorFrontend.h \
-	DerivedSources/WebCore/JSAbstractWorker.cpp \
-	DerivedSources/WebCore/JSAbstractWorker.h \
-	DerivedSources/WebCore/JSArrayBuffer.cpp \
-	DerivedSources/WebCore/JSArrayBuffer.h \
-	DerivedSources/WebCore/JSArrayBufferView.cpp \
-	DerivedSources/WebCore/JSArrayBufferView.h \
-	DerivedSources/WebCore/JSAttr.cpp \
-	DerivedSources/WebCore/JSAttr.h \
-	DerivedSources/WebCore/JSAudioContext.cpp \
-	DerivedSources/WebCore/JSAudioContext.h \
-	DerivedSources/WebCore/JSAudioPannerNode.cpp \
-	DerivedSources/WebCore/JSAudioPannerNode.h \
-	DerivedSources/WebCore/JSBarInfo.cpp \
-	DerivedSources/WebCore/JSBarInfo.h \
-	DerivedSources/WebCore/JSBeforeLoadEvent.cpp \
-	DerivedSources/WebCore/JSBeforeLoadEvent.h \
-	DerivedSources/WebCore/JSBeforeProcessEvent.cpp \
-	DerivedSources/WebCore/JSBeforeProcessEvent.h \
-	DerivedSources/WebCore/JSBlobBuilder.cpp \
-	DerivedSources/WebCore/JSBlobBuilder.h \
-	DerivedSources/WebCore/JSBlob.cpp \
-	DerivedSources/WebCore/JSBlob.h \
-	DerivedSources/WebCore/JSCanvasGradient.cpp \
-	DerivedSources/WebCore/JSCanvasGradient.h \
-	DerivedSources/WebCore/JSCanvasPattern.cpp \
-	DerivedSources/WebCore/JSCanvasPattern.h \
-	DerivedSources/WebCore/JSCanvasRenderingContext2D.cpp \
-	DerivedSources/WebCore/JSCanvasRenderingContext2D.h \
-	DerivedSources/WebCore/JSCanvasRenderingContext.cpp \
-	DerivedSources/WebCore/JSCanvasRenderingContext.h \
-	DerivedSources/WebCore/JSCDATASection.cpp \
-	DerivedSources/WebCore/JSCDATASection.h \
-	DerivedSources/WebCore/JSCharacterData.cpp \
-	DerivedSources/WebCore/JSCharacterData.h \
-	DerivedSources/WebCore/JSClientRect.cpp \
-	DerivedSources/WebCore/JSClientRect.h \
-	DerivedSources/WebCore/JSClientRectList.cpp \
-	DerivedSources/WebCore/JSClientRectList.h \
-	DerivedSources/WebCore/JSClipboard.cpp \
-	DerivedSources/WebCore/JSClipboard.h \
-	DerivedSources/WebCore/JSComment.cpp \
-	DerivedSources/WebCore/JSComment.h \
-	DerivedSources/WebCore/JSCompositionEvent.cpp \
-	DerivedSources/WebCore/JSCompositionEvent.h \
-	DerivedSources/WebCore/JSConsole.cpp \
-	DerivedSources/WebCore/JSConsole.h \
-	DerivedSources/WebCore/JSCoordinates.cpp \
-	DerivedSources/WebCore/JSCoordinates.h \
-	DerivedSources/WebCore/JSCounter.cpp \
-	DerivedSources/WebCore/JSCounter.h \
-	DerivedSources/WebCore/JSCrypto.cpp \
-	DerivedSources/WebCore/JSCrypto.h \
-	DerivedSources/WebCore/JSCSSCharsetRule.cpp \
-	DerivedSources/WebCore/JSCSSCharsetRule.h \
-	DerivedSources/WebCore/JSCSSFontFaceRule.cpp \
-	DerivedSources/WebCore/JSCSSFontFaceRule.h \
-	DerivedSources/WebCore/JSCSSImportRule.cpp \
-	DerivedSources/WebCore/JSCSSImportRule.h \
-	DerivedSources/WebCore/JSCSSMediaRule.cpp \
-	DerivedSources/WebCore/JSCSSMediaRule.h \
-	DerivedSources/WebCore/JSCSSPageRule.cpp \
-	DerivedSources/WebCore/JSCSSPageRule.h \
-	DerivedSources/WebCore/JSCSSPrimitiveValue.cpp \
-	DerivedSources/WebCore/JSCSSPrimitiveValue.h \
-	DerivedSources/WebCore/JSCSSRule.cpp \
-	DerivedSources/WebCore/JSCSSRule.h \
-	DerivedSources/WebCore/JSCSSRuleList.cpp \
-	DerivedSources/WebCore/JSCSSRuleList.h \
-	DerivedSources/WebCore/JSCSSStyleDeclaration.cpp \
-	DerivedSources/WebCore/JSCSSStyleDeclaration.h \
-	DerivedSources/WebCore/JSCSSStyleRule.cpp \
-	DerivedSources/WebCore/JSCSSStyleRule.h \
-	DerivedSources/WebCore/JSCSSStyleSheet.cpp \
-	DerivedSources/WebCore/JSCSSStyleSheet.h \
-	DerivedSources/WebCore/JSCSSValue.cpp \
-	DerivedSources/WebCore/JSCSSValue.h \
-	DerivedSources/WebCore/JSCSSValueList.cpp \
-	DerivedSources/WebCore/JSCSSValueList.h \
-	DerivedSources/WebCore/JSCustomEvent.cpp \
-	DerivedSources/WebCore/JSCustomEvent.h \
-	DerivedSources/WebCore/JSDataGridColumn.cpp \
-	DerivedSources/WebCore/JSDataGridColumn.h \
-	DerivedSources/WebCore/JSDataGridColumnList.cpp \
-	DerivedSources/WebCore/JSDataGridColumnList.h \
-	DerivedSources/WebCore/JSDataTransferItems.h \
-	DerivedSources/WebCore/JSDataTransferItems.cpp \
-	DerivedSources/WebCore/JSDataView.cpp \
-	DerivedSources/WebCore/JSDataView.h \
-	DerivedSources/WebCore/JSDedicatedWorkerContext.cpp \
-	DerivedSources/WebCore/JSDedicatedWorkerContext.h \
-	DerivedSources/WebCore/JSDeviceMotionEvent.cpp \
-	DerivedSources/WebCore/JSDeviceMotionEvent.h \
-	DerivedSources/WebCore/JSDeviceOrientationEvent.cpp \
-	DerivedSources/WebCore/JSDeviceOrientationEvent.h \
-	DerivedSources/WebCore/JSDocument.cpp \
-	DerivedSources/WebCore/JSDocumentFragment.cpp \
-	DerivedSources/WebCore/JSDocumentFragment.h \
-	DerivedSources/WebCore/JSDocument.h \
-	DerivedSources/WebCore/JSDocumentType.cpp \
-	DerivedSources/WebCore/JSDocumentType.h \
-	DerivedSources/WebCore/JSDOMApplicationCache.h \
-	DerivedSources/WebCore/JSDOMCoreException.cpp \
-	DerivedSources/WebCore/JSDOMCoreException.h \
-	DerivedSources/WebCore/JSDOMFormData.cpp \
-	DerivedSources/WebCore/JSDOMFormData.h \
-	DerivedSources/WebCore/JSDOMImplementation.cpp \
-	DerivedSources/WebCore/JSDOMImplementation.h \
-	DerivedSources/WebCore/JSDOMMimeTypeArray.cpp \
-	DerivedSources/WebCore/JSDOMMimeTypeArray.h \
-	DerivedSources/WebCore/JSDOMMimeType.cpp \
-	DerivedSources/WebCore/JSDOMMimeType.h \
-	DerivedSources/WebCore/JSDOMParser.cpp \
-	DerivedSources/WebCore/JSDOMParser.h \
-	DerivedSources/WebCore/JSDOMPluginArray.cpp \
-	DerivedSources/WebCore/JSDOMPluginArray.h \
-	DerivedSources/WebCore/JSDOMPlugin.cpp \
-	DerivedSources/WebCore/JSDOMPlugin.h \
-	DerivedSources/WebCore/JSDOMSelection.cpp \
-	DerivedSources/WebCore/JSDOMSelection.h \
-	DerivedSources/WebCore/JSDOMSettableTokenList.cpp \
-	DerivedSources/WebCore/JSDOMSettableTokenList.h \
-	DerivedSources/WebCore/JSDOMStringList.cpp \
-	DerivedSources/WebCore/JSDOMStringList.h \
-	DerivedSources/WebCore/JSDOMStringMap.cpp \
-	DerivedSources/WebCore/JSDOMStringMap.h \
-	DerivedSources/WebCore/JSDOMTokenList.cpp \
-	DerivedSources/WebCore/JSDOMTokenList.h \
-	DerivedSources/WebCore/JSDOMURL.cpp \
-	DerivedSources/WebCore/JSDOMURL.h \
-	DerivedSources/WebCore/JSDOMWindow.cpp \
-	DerivedSources/WebCore/JSDOMWindow.h \
-	DerivedSources/WebCore/JSElement.cpp \
-	DerivedSources/WebCore/JSElement.h \
-	DerivedSources/WebCore/JSEntity.cpp \
-	DerivedSources/WebCore/JSEntity.h \
-	DerivedSources/WebCore/JSEntityReference.cpp \
-	DerivedSources/WebCore/JSEntityReference.h \
-	DerivedSources/WebCore/JSErrorEvent.cpp \
-	DerivedSources/WebCore/JSErrorEvent.h \
-	DerivedSources/WebCore/JSEvent.cpp \
-	DerivedSources/WebCore/JSEventException.cpp \
-	DerivedSources/WebCore/JSEventException.h \
-	DerivedSources/WebCore/JSEvent.h \
-	DerivedSources/WebCore/JSEventSource.cpp \
-	DerivedSources/WebCore/JSEventSource.h \
-	DerivedSources/WebCore/JSFile.cpp \
-	DerivedSources/WebCore/JSFileError.cpp \
-	DerivedSources/WebCore/JSFileError.h \
-	DerivedSources/WebCore/JSFile.h \
-	DerivedSources/WebCore/JSFileException.cpp \
-	DerivedSources/WebCore/JSFileException.h \
-	DerivedSources/WebCore/JSFileList.cpp \
-	DerivedSources/WebCore/JSFileList.h \
-	DerivedSources/WebCore/JSFileReader.cpp \
-	DerivedSources/WebCore/JSFileReader.h \
-	DerivedSources/WebCore/JSFileReaderSync.cpp \
-	DerivedSources/WebCore/JSFileReaderSync.h \
-	DerivedSources/WebCore/JSFloat32Array.cpp \
-	DerivedSources/WebCore/JSFloat32Array.h \
-	DerivedSources/WebCore/JSGeolocation.cpp \
-	DerivedSources/WebCore/JSGeolocation.h \
-	DerivedSources/WebCore/JSGeoposition.cpp \
-	DerivedSources/WebCore/JSGeoposition.h \
-	DerivedSources/WebCore/JSHashChangeEvent.cpp \
-	DerivedSources/WebCore/JSHashChangeEvent.h \
-	DerivedSources/WebCore/JSHistory.cpp \
-	DerivedSources/WebCore/JSHistory.h \
-	DerivedSources/WebCore/JSHTMLAllCollection.cpp \
-	DerivedSources/WebCore/JSHTMLAllCollection.h \
-	DerivedSources/WebCore/JSHTMLAnchorElement.cpp \
-	DerivedSources/WebCore/JSHTMLAnchorElement.h \
-	DerivedSources/WebCore/JSHTMLAppletElement.cpp \
-	DerivedSources/WebCore/JSHTMLAppletElement.h \
-	DerivedSources/WebCore/JSHTMLAreaElement.cpp \
-	DerivedSources/WebCore/JSHTMLAreaElement.h \
-	DerivedSources/WebCore/JSHTMLAudioElement.cpp \
-	DerivedSources/WebCore/JSHTMLAudioElement.h \
-	DerivedSources/WebCore/JSHTMLBaseElement.cpp \
-	DerivedSources/WebCore/JSHTMLBaseElement.h \
-	DerivedSources/WebCore/JSHTMLBaseFontElement.cpp \
-	DerivedSources/WebCore/JSHTMLBaseFontElement.h \
-	DerivedSources/WebCore/JSHTMLBlockquoteElement.cpp \
-	DerivedSources/WebCore/JSHTMLBlockquoteElement.h \
-	DerivedSources/WebCore/JSHTMLBodyElement.cpp \
-	DerivedSources/WebCore/JSHTMLBodyElement.h \
-	DerivedSources/WebCore/JSHTMLBRElement.cpp \
-	DerivedSources/WebCore/JSHTMLBRElement.h \
-	DerivedSources/WebCore/JSHTMLButtonElement.cpp \
-	DerivedSources/WebCore/JSHTMLButtonElement.h \
-	DerivedSources/WebCore/JSHTMLCanvasElement.cpp \
-	DerivedSources/WebCore/JSHTMLCanvasElement.h \
-	DerivedSources/WebCore/JSHTMLCollection.cpp \
-	DerivedSources/WebCore/JSHTMLCollection.h \
-	DerivedSources/WebCore/JSHTMLDataGridCellElement.cpp \
-	DerivedSources/WebCore/JSHTMLDataGridCellElement.h \
-	DerivedSources/WebCore/JSHTMLDataGridColElement.cpp \
-	DerivedSources/WebCore/JSHTMLDataGridColElement.h \
-	DerivedSources/WebCore/JSHTMLDataGridElement.cpp \
-	DerivedSources/WebCore/JSHTMLDataGridElement.h \
-	DerivedSources/WebCore/JSHTMLDataGridRowElement.cpp \
-	DerivedSources/WebCore/JSHTMLDataGridRowElement.h \
-	DerivedSources/WebCore/JSHTMLDataListElement.cpp \
-	DerivedSources/WebCore/JSHTMLDataListElement.h \
-	DerivedSources/WebCore/JSHTMLDetailsElement.cpp \
-	DerivedSources/WebCore/JSHTMLDetailsElement.h \
-	DerivedSources/WebCore/JSHTMLDirectoryElement.cpp \
-	DerivedSources/WebCore/JSHTMLDirectoryElement.h \
-	DerivedSources/WebCore/JSHTMLDivElement.cpp \
-	DerivedSources/WebCore/JSHTMLDivElement.h \
-	DerivedSources/WebCore/JSHTMLDListElement.cpp \
-	DerivedSources/WebCore/JSHTMLDListElement.h \
-	DerivedSources/WebCore/JSHTMLDocument.cpp \
-	DerivedSources/WebCore/JSHTMLDocument.h \
-	DerivedSources/WebCore/JSHTMLElement.cpp \
-	DerivedSources/WebCore/JSHTMLElement.h \
-	DerivedSources/WebCore/JSHTMLElementWrapperFactory.cpp \
-	DerivedSources/WebCore/JSHTMLEmbedElement.cpp \
-	DerivedSources/WebCore/JSHTMLEmbedElement.h \
-	DerivedSources/WebCore/JSHTMLFieldSetElement.cpp \
-	DerivedSources/WebCore/JSHTMLFieldSetElement.h \
-	DerivedSources/WebCore/JSHTMLFontElement.cpp \
-	DerivedSources/WebCore/JSHTMLFontElement.h \
-	DerivedSources/WebCore/JSHTMLFormElement.cpp \
-	DerivedSources/WebCore/JSHTMLFormElement.h \
-	DerivedSources/WebCore/JSHTMLFrameElement.cpp \
-	DerivedSources/WebCore/JSHTMLFrameElement.h \
-	DerivedSources/WebCore/JSHTMLFrameSetElement.cpp \
-	DerivedSources/WebCore/JSHTMLFrameSetElement.h \
-	DerivedSources/WebCore/JSHTMLHeadElement.cpp \
-	DerivedSources/WebCore/JSHTMLHeadElement.h \
-	DerivedSources/WebCore/JSHTMLHeadingElement.cpp \
-	DerivedSources/WebCore/JSHTMLHeadingElement.h \
-	DerivedSources/WebCore/JSHTMLHRElement.cpp \
-	DerivedSources/WebCore/JSHTMLHRElement.h \
-	DerivedSources/WebCore/JSHTMLHtmlElement.cpp \
-	DerivedSources/WebCore/JSHTMLHtmlElement.h \
-	DerivedSources/WebCore/JSHTMLIFrameElement.cpp \
-	DerivedSources/WebCore/JSHTMLIFrameElement.h \
-	DerivedSources/WebCore/JSHTMLImageElement.cpp \
-	DerivedSources/WebCore/JSHTMLImageElement.h \
-	DerivedSources/WebCore/JSHTMLInputElement.cpp \
-	DerivedSources/WebCore/JSHTMLInputElement.h \
-	DerivedSources/WebCore/JSHTMLIsIndexElement.cpp \
-	DerivedSources/WebCore/JSHTMLIsIndexElement.h \
-	DerivedSources/WebCore/JSHTMLKeygenElement.cpp \
-	DerivedSources/WebCore/JSHTMLKeygenElement.h \
-	DerivedSources/WebCore/JSHTMLLabelElement.cpp \
-	DerivedSources/WebCore/JSHTMLLabelElement.h \
-	DerivedSources/WebCore/JSHTMLLegendElement.cpp \
-	DerivedSources/WebCore/JSHTMLLegendElement.h \
-	DerivedSources/WebCore/JSHTMLLIElement.cpp \
-	DerivedSources/WebCore/JSHTMLLIElement.h \
-	DerivedSources/WebCore/JSHTMLLinkElement.cpp \
-	DerivedSources/WebCore/JSHTMLLinkElement.h \
-	DerivedSources/WebCore/JSHTMLMapElement.cpp \
-	DerivedSources/WebCore/JSHTMLMapElement.h \
-	DerivedSources/WebCore/JSHTMLMarqueeElement.cpp \
-	DerivedSources/WebCore/JSHTMLMarqueeElement.h \
-	DerivedSources/WebCore/JSHTMLMediaElement.cpp \
-	DerivedSources/WebCore/JSHTMLMediaElement.h \
-	DerivedSources/WebCore/JSHTMLMenuElement.cpp \
-	DerivedSources/WebCore/JSHTMLMenuElement.h \
-	DerivedSources/WebCore/JSHTMLMetaElement.cpp \
-	DerivedSources/WebCore/JSHTMLMetaElement.h \
-	DerivedSources/WebCore/JSHTMLMeterElement.cpp \
-	DerivedSources/WebCore/JSHTMLMeterElement.h \
-	DerivedSources/WebCore/JSHTMLModElement.cpp \
-	DerivedSources/WebCore/JSHTMLModElement.h \
-	DerivedSources/WebCore/JSHTMLObjectElement.cpp \
-	DerivedSources/WebCore/JSHTMLObjectElement.h \
-	DerivedSources/WebCore/JSHTMLOListElement.cpp \
-	DerivedSources/WebCore/JSHTMLOListElement.h \
-	DerivedSources/WebCore/JSHTMLOptGroupElement.cpp \
-	DerivedSources/WebCore/JSHTMLOptGroupElement.h \
-	DerivedSources/WebCore/JSHTMLOptionElement.cpp \
-	DerivedSources/WebCore/JSHTMLOptionElement.h \
-	DerivedSources/WebCore/JSHTMLOptionsCollection.cpp \
-	DerivedSources/WebCore/JSHTMLOptionsCollection.h \
-	DerivedSources/WebCore/JSHTMLOutputElement.cpp \
-	DerivedSources/WebCore/JSHTMLOutputElement.h \
-	DerivedSources/WebCore/JSHTMLParagraphElement.cpp \
-	DerivedSources/WebCore/JSHTMLParagraphElement.h \
-	DerivedSources/WebCore/JSHTMLParamElement.cpp \
-	DerivedSources/WebCore/JSHTMLParamElement.h \
-	DerivedSources/WebCore/JSHTMLPreElement.cpp \
-	DerivedSources/WebCore/JSHTMLPreElement.h \
-	DerivedSources/WebCore/JSHTMLProgressElement.cpp \
-	DerivedSources/WebCore/JSHTMLProgressElement.h \
-	DerivedSources/WebCore/JSHTMLQuoteElement.cpp \
-	DerivedSources/WebCore/JSHTMLQuoteElement.h \
-	DerivedSources/WebCore/JSHTMLScriptElement.cpp \
-	DerivedSources/WebCore/JSHTMLScriptElement.h \
-	DerivedSources/WebCore/JSHTMLSelectElement.cpp \
-	DerivedSources/WebCore/JSHTMLSelectElement.h \
-	DerivedSources/WebCore/JSHTMLSourceElement.cpp \
-	DerivedSources/WebCore/JSHTMLSourceElement.h \
-	DerivedSources/WebCore/JSHTMLStyleElement.cpp \
-	DerivedSources/WebCore/JSHTMLStyleElement.h \
-	DerivedSources/WebCore/JSHTMLTableCaptionElement.cpp \
-	DerivedSources/WebCore/JSHTMLTableCaptionElement.h \
-	DerivedSources/WebCore/JSHTMLTableCellElement.cpp \
-	DerivedSources/WebCore/JSHTMLTableCellElement.h \
-	DerivedSources/WebCore/JSHTMLTableColElement.cpp \
-	DerivedSources/WebCore/JSHTMLTableColElement.h \
-	DerivedSources/WebCore/JSHTMLTableElement.cpp \
-	DerivedSources/WebCore/JSHTMLTableElement.h \
-	DerivedSources/WebCore/JSHTMLTableRowElement.cpp \
-	DerivedSources/WebCore/JSHTMLTableRowElement.h \
-	DerivedSources/WebCore/JSHTMLTableSectionElement.cpp \
-	DerivedSources/WebCore/JSHTMLTableSectionElement.h \
-	DerivedSources/WebCore/JSHTMLTextAreaElement.cpp \
-	DerivedSources/WebCore/JSHTMLTextAreaElement.h \
-	DerivedSources/WebCore/JSHTMLTitleElement.cpp \
-	DerivedSources/WebCore/JSHTMLTitleElement.h \
-	DerivedSources/WebCore/JSHTMLUListElement.cpp \
-	DerivedSources/WebCore/JSHTMLUListElement.h \
-	DerivedSources/WebCore/JSHTMLVideoElement.cpp \
-	DerivedSources/WebCore/JSHTMLVideoElement.h \
-	DerivedSources/WebCore/JSImageData.cpp \
-	DerivedSources/WebCore/JSImageData.h \
-	DerivedSources/WebCore/JSInjectedScriptHost.cpp \
-	DerivedSources/WebCore/JSInjectedScriptHost.h \
-	DerivedSources/WebCore/JSInspectorFrontendHost.cpp \
-	DerivedSources/WebCore/JSInspectorFrontendHost.h \
-	DerivedSources/WebCore/JSInt16Array.cpp \
-	DerivedSources/WebCore/JSInt16Array.h \
-	DerivedSources/WebCore/JSInt32Array.cpp \
-	DerivedSources/WebCore/JSInt32Array.h \
-	DerivedSources/WebCore/JSInt8Array.cpp \
-	DerivedSources/WebCore/JSInt8Array.h \
-	DerivedSources/WebCore/JSJavaScriptCallFrame.cpp \
-	DerivedSources/WebCore/JSJavaScriptCallFrame.h \
-	DerivedSources/WebCore/JSKeyboardEvent.cpp \
-	DerivedSources/WebCore/JSKeyboardEvent.h \
-	DerivedSources/WebCore/JSLocation.cpp \
-	DerivedSources/WebCore/JSLocation.h \
-	DerivedSources/WebCore/JSMediaError.cpp \
-	DerivedSources/WebCore/JSMediaError.h \
-	DerivedSources/WebCore/JSMediaList.cpp \
-	DerivedSources/WebCore/JSMediaList.h \
-	DerivedSources/WebCore/JSMediaQueryList.cpp \
-	DerivedSources/WebCore/JSMediaQueryList.h \
-	DerivedSources/WebCore/JSMemoryInfo.cpp \
-	DerivedSources/WebCore/JSMemoryInfo.h \
-	DerivedSources/WebCore/JSMessageChannel.cpp \
-	DerivedSources/WebCore/JSMessageChannel.h \
-	DerivedSources/WebCore/JSMessageEvent.cpp \
-	DerivedSources/WebCore/JSMessageEvent.h \
-	DerivedSources/WebCore/JSMessagePort.cpp \
-	DerivedSources/WebCore/JSMessagePort.h \
-	DerivedSources/WebCore/JSMouseEvent.cpp \
-	DerivedSources/WebCore/JSMouseEvent.h \
-	DerivedSources/WebCore/JSMutationEvent.cpp \
-	DerivedSources/WebCore/JSMutationEvent.h \
-	DerivedSources/WebCore/JSNamedNodeMap.cpp \
-	DerivedSources/WebCore/JSNamedNodeMap.h \
-	DerivedSources/WebCore/JSNavigator.cpp \
-	DerivedSources/WebCore/JSNavigator.h \
-	DerivedSources/WebCore/JSNode.cpp \
-	DerivedSources/WebCore/JSNodeFilter.cpp \
-	DerivedSources/WebCore/JSNodeFilter.h \
-	DerivedSources/WebCore/JSNode.h \
-	DerivedSources/WebCore/JSNodeIterator.cpp \
-	DerivedSources/WebCore/JSNodeIterator.h \
-	DerivedSources/WebCore/JSNodeList.cpp \
-	DerivedSources/WebCore/JSNodeList.h \
-	DerivedSources/WebCore/JSNotation.cpp \
-	DerivedSources/WebCore/JSNotation.h \
-	DerivedSources/WebCore/JSNotificationCenter.cpp \
-	DerivedSources/WebCore/JSNotificationCenter.h \
-	DerivedSources/WebCore/JSNotification.cpp \
-	DerivedSources/WebCore/JSNotification.h \
-	DerivedSources/WebCore/JSOESStandardDerivatives.cpp \
-	DerivedSources/WebCore/JSOESStandardDerivatives.h \
-	DerivedSources/WebCore/JSOESTextureFloat.cpp \
-	DerivedSources/WebCore/JSOESTextureFloat.h \
-	DerivedSources/WebCore/JSOESVertexArrayObject.cpp \
-	DerivedSources/WebCore/JSOESVertexArrayObject.h \
-	DerivedSources/WebCore/JSOverflowEvent.cpp \
-	DerivedSources/WebCore/JSOverflowEvent.h \
-	DerivedSources/WebCore/JSPageTransitionEvent.cpp \
-	DerivedSources/WebCore/JSPageTransitionEvent.h \
-	DerivedSources/WebCore/JSPerformance.cpp \
-	DerivedSources/WebCore/JSPerformance.h \
-	DerivedSources/WebCore/JSPerformanceNavigation.cpp \
-	DerivedSources/WebCore/JSPerformanceNavigation.h \
-	DerivedSources/WebCore/JSPerformanceTiming.cpp \
-	DerivedSources/WebCore/JSPerformanceTiming.h \
-	DerivedSources/WebCore/JSPopStateEvent.cpp \
-	DerivedSources/WebCore/JSPopStateEvent.h \
-	DerivedSources/WebCore/JSPositionError.cpp \
-	DerivedSources/WebCore/JSPositionError.h \
-	DerivedSources/WebCore/JSProcessingInstruction.cpp \
-	DerivedSources/WebCore/JSProcessingInstruction.h \
-	DerivedSources/WebCore/JSProgressEvent.cpp \
-	DerivedSources/WebCore/JSProgressEvent.h \
-	DerivedSources/WebCore/JSRange.cpp \
-	DerivedSources/WebCore/JSRangeException.cpp \
-	DerivedSources/WebCore/JSRangeException.h \
-	DerivedSources/WebCore/JSRange.h \
-	DerivedSources/WebCore/JSRect.cpp \
-	DerivedSources/WebCore/JSRect.h \
-	DerivedSources/WebCore/JSRGBColor.cpp \
-	DerivedSources/WebCore/JSRGBColor.h \
-	DerivedSources/WebCore/JSScreen.cpp \
-	DerivedSources/WebCore/JSScreen.h \
-	DerivedSources/WebCore/JSScriptProfile.cpp \
-	DerivedSources/WebCore/JSScriptProfile.h \
-	DerivedSources/WebCore/JSScriptProfileNode.cpp \
-	DerivedSources/WebCore/JSScriptProfileNode.h \
-	DerivedSources/WebCore/JSSharedWorkerContext.cpp \
-	DerivedSources/WebCore/JSSharedWorkerContext.h \
-	DerivedSources/WebCore/JSSharedWorker.cpp \
-	DerivedSources/WebCore/JSSharedWorker.h \
-	DerivedSources/WebCore/JSSpeechInputEvent.cpp \
-	DerivedSources/WebCore/JSSpeechInputEvent.h \
-	DerivedSources/WebCore/JSSpeechInputResult.cpp \
-	DerivedSources/WebCore/JSSpeechInputResult.h \
-	DerivedSources/WebCore/JSSpeechInputResultList.cpp \
-	DerivedSources/WebCore/JSSpeechInputResultList.h \
-	DerivedSources/WebCore/JSSQLException.h \
-	DerivedSources/WebCore/JSSQLResultSetRowList.h \
-	DerivedSources/WebCore/JSSQLStatementErrorCallback.cpp \
-	DerivedSources/WebCore/JSSQLTransaction.h \
-	DerivedSources/WebCore/JSSQLTransactionSync.h \
-	DerivedSources/WebCore/JSStorage.h \
-	DerivedSources/WebCore/JSStyleMedia.cpp \
-	DerivedSources/WebCore/JSStyleMedia.h \
-	DerivedSources/WebCore/JSStyleSheet.cpp \
-	DerivedSources/WebCore/JSStyleSheet.h \
-	DerivedSources/WebCore/JSStyleSheetList.cpp \
-	DerivedSources/WebCore/JSStyleSheetList.h \
-	DerivedSources/WebCore/JSSVGElementInstance.h \
-	DerivedSources/WebCore/JSSVGElementWrapperFactory.cpp \
-	DerivedSources/WebCore/JSText.cpp \
-	DerivedSources/WebCore/JSTextEvent.cpp \
-	DerivedSources/WebCore/JSTextEvent.h \
-	DerivedSources/WebCore/JSText.h \
-	DerivedSources/WebCore/JSTextMetrics.cpp \
-	DerivedSources/WebCore/JSTextMetrics.h \
-	DerivedSources/WebCore/JSTimeRanges.cpp \
-	DerivedSources/WebCore/JSTimeRanges.h \
-	DerivedSources/WebCore/JSTouch.cpp \
-	DerivedSources/WebCore/JSTouchEvent.cpp \
-	DerivedSources/WebCore/JSTouchEvent.h \
-	DerivedSources/WebCore/JSTouch.h \
-	DerivedSources/WebCore/JSTouchList.cpp \
-	DerivedSources/WebCore/JSTouchList.h \
-	DerivedSources/WebCore/JSTreeWalker.cpp \
-	DerivedSources/WebCore/JSTreeWalker.h \
-	DerivedSources/WebCore/JSUIEvent.cpp \
-	DerivedSources/WebCore/JSUIEvent.h \
-	DerivedSources/WebCore/JSUint16Array.cpp \
-	DerivedSources/WebCore/JSUint16Array.h \
-	DerivedSources/WebCore/JSUint32Array.cpp \
-	DerivedSources/WebCore/JSUint32Array.h \
-	DerivedSources/WebCore/JSUint8Array.cpp \
-	DerivedSources/WebCore/JSUint8Array.h \
-	DerivedSources/WebCore/JSValidityState.cpp \
-	DerivedSources/WebCore/JSValidityState.h \
-	DerivedSources/WebCore/JSVoidCallback.cpp \
-	DerivedSources/WebCore/JSVoidCallback.h \
-	DerivedSources/WebCore/JSWebGLActiveInfo.cpp \
-	DerivedSources/WebCore/JSWebGLActiveInfo.h \
-	DerivedSources/WebCore/JSWebGLBuffer.cpp \
-	DerivedSources/WebCore/JSWebGLBuffer.h \
-	DerivedSources/WebCore/JSWebGLContextAttributes.cpp \
-	DerivedSources/WebCore/JSWebGLContextAttributes.h \
-	DerivedSources/WebCore/JSWebGLContextEvent.cpp \
-	DerivedSources/WebCore/JSWebGLContextEvent.h \
-	DerivedSources/WebCore/JSWebGLFramebuffer.cpp \
-	DerivedSources/WebCore/JSWebGLFramebuffer.h \
-	DerivedSources/WebCore/JSWebGLProgram.cpp \
-	DerivedSources/WebCore/JSWebGLProgram.h \
-	DerivedSources/WebCore/JSWebGLRenderbuffer.cpp \
-	DerivedSources/WebCore/JSWebGLRenderbuffer.h \
-	DerivedSources/WebCore/JSWebGLRenderingContext.cpp \
-	DerivedSources/WebCore/JSWebGLRenderingContext.h \
-	DerivedSources/WebCore/JSWebGLShader.cpp \
-	DerivedSources/WebCore/JSWebGLShader.h \
-	DerivedSources/WebCore/JSWebGLTexture.cpp \
-	DerivedSources/WebCore/JSWebGLTexture.h \
-	DerivedSources/WebCore/JSWebGLUniformLocation.cpp \
-	DerivedSources/WebCore/JSWebGLUniformLocation.h \
-	DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.cpp \
-	DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.h \
-	DerivedSources/WebCore/JSWebKitAnimation.cpp \
-	DerivedSources/WebCore/JSWebKitAnimation.h \
-	DerivedSources/WebCore/JSWebKitAnimationEvent.cpp \
-	DerivedSources/WebCore/JSWebKitAnimationList.h \
-	DerivedSources/WebCore/JSWebKitAnimationList.cpp \
-	DerivedSources/WebCore/JSWebKitAnimationEvent.h \
-	DerivedSources/WebCore/JSWebKitCSSKeyframeRule.cpp \
-	DerivedSources/WebCore/JSWebKitCSSKeyframeRule.h \
-	DerivedSources/WebCore/JSWebKitCSSKeyframesRule.cpp \
-	DerivedSources/WebCore/JSWebKitCSSKeyframesRule.h \
-	DerivedSources/WebCore/JSWebKitCSSMatrix.cpp \
-	DerivedSources/WebCore/JSWebKitCSSMatrix.h \
-	DerivedSources/WebCore/JSWebKitCSSTransformValue.cpp \
-	DerivedSources/WebCore/JSWebKitCSSTransformValue.h \
-	DerivedSources/WebCore/JSWebKitLoseContext.cpp \
-	DerivedSources/WebCore/JSWebKitLoseContext.h \
-	DerivedSources/WebCore/JSWebKitPoint.cpp \
-	DerivedSources/WebCore/JSWebKitPoint.h \
-	DerivedSources/WebCore/JSWebKitTransitionEvent.cpp \
-	DerivedSources/WebCore/JSWebKitTransitionEvent.h \
-	DerivedSources/WebCore/JSWheelEvent.cpp \
-	DerivedSources/WebCore/JSWheelEvent.h \
-	DerivedSources/WebCore/JSWorkerContext.cpp \
-	DerivedSources/WebCore/JSWorkerContext.h \
-	DerivedSources/WebCore/JSWorker.cpp \
-	DerivedSources/WebCore/JSWorker.h \
-	DerivedSources/WebCore/JSWorkerLocation.cpp \
-	DerivedSources/WebCore/JSWorkerLocation.h \
-	DerivedSources/WebCore/JSWorkerNavigator.cpp \
-	DerivedSources/WebCore/JSWorkerNavigator.h \
-	DerivedSources/WebCore/JSXMLHttpRequest.cpp \
-	DerivedSources/WebCore/JSXMLHttpRequestException.cpp \
-	DerivedSources/WebCore/JSXMLHttpRequestException.h \
-	DerivedSources/WebCore/JSXMLHttpRequest.h \
-	DerivedSources/WebCore/JSXMLHttpRequestProgressEvent.cpp \
-	DerivedSources/WebCore/JSXMLHttpRequestProgressEvent.h \
-	DerivedSources/WebCore/JSXMLHttpRequestUpload.cpp \
-	DerivedSources/WebCore/JSXMLHttpRequestUpload.h \
-	DerivedSources/WebCore/JSXMLSerializer.cpp \
-	DerivedSources/WebCore/JSXMLSerializer.h \
-	DerivedSources/WebCore/JSXSLTProcessor.cpp \
-	DerivedSources/WebCore/JSXSLTProcessor.h \
-	DerivedSources/WebCore/MathMLElementFactory.cpp \
-	DerivedSources/WebCore/MathMLElementFactory.h \
-	DerivedSources/WebCore/MathMLNames.cpp \
-	DerivedSources/WebCore/MathMLNames.h \
-	DerivedSources/WebCore/SVGElementFactory.cpp \
-	DerivedSources/WebCore/SVGNames.cpp \
-	DerivedSources/WebCore/UserAgentStyleSheetsData.cpp \
-	DerivedSources/WebCore/UserAgentStyleSheets.h \
-	DerivedSources/WebCore/XLinkNames.cpp \
-	DerivedSources/WebCore/XMLNames.cpp \
-	DerivedSources/WebCore/XMLNames.h \
-	DerivedSources/WebCore/XMLNSNames.cpp \
-	DerivedSources/WebCore/XMLNSNames.h \
-	DerivedSources/WebCore/XMLViewerXSL.h 
-
-webcore_sources += \
-	Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp \
-	Source/WebCore/accessibility/AccessibilityARIAGridCell.h \
-	Source/WebCore/accessibility/AccessibilityARIAGrid.cpp \
-	Source/WebCore/accessibility/AccessibilityARIAGrid.h \
-	Source/WebCore/accessibility/AccessibilityARIAGridRow.cpp \
-	Source/WebCore/accessibility/AccessibilityARIAGridRow.h \
-	Source/WebCore/accessibility/AccessibilityImageMapLink.cpp \
-	Source/WebCore/accessibility/AccessibilityImageMapLink.h \
-	Source/WebCore/accessibility/AccessibilityListBox.cpp \
-	Source/WebCore/accessibility/AccessibilityListBox.h \
-	Source/WebCore/accessibility/AccessibilityListBoxOption.cpp \
-	Source/WebCore/accessibility/AccessibilityListBoxOption.h \
-	Source/WebCore/accessibility/AccessibilityList.cpp \
-	Source/WebCore/accessibility/AccessibilityList.h \
-	Source/WebCore/accessibility/AccessibilityMediaControls.cpp \
-	Source/WebCore/accessibility/AccessibilityMediaControls.h \
-	Source/WebCore/accessibility/AccessibilityMenuList.cpp \
-	Source/WebCore/accessibility/AccessibilityMenuList.h \
-	Source/WebCore/accessibility/AccessibilityMenuListOption.cpp \
-	Source/WebCore/accessibility/AccessibilityMenuListOption.h \
-	Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp \
-	Source/WebCore/accessibility/AccessibilityMenuListPopup.h \
-	Source/WebCore/accessibility/AccessibilityObject.cpp \
-	Source/WebCore/accessibility/AccessibilityObject.h \
-	Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp \
-	Source/WebCore/accessibility/AccessibilityProgressIndicator.h \
-	Source/WebCore/accessibility/AccessibilityRenderObject.cpp \
-	Source/WebCore/accessibility/AccessibilityRenderObject.h \
-	Source/WebCore/accessibility/AccessibilityScrollbar.cpp \
-	Source/WebCore/accessibility/AccessibilityScrollbar.h \
-	Source/WebCore/accessibility/AccessibilityScrollView.cpp \
-	Source/WebCore/accessibility/AccessibilityScrollView.h \
-	Source/WebCore/accessibility/AccessibilitySlider.cpp \
-	Source/WebCore/accessibility/AccessibilitySlider.h \
-	Source/WebCore/accessibility/AccessibilityTableCell.cpp \
-	Source/WebCore/accessibility/AccessibilityTableCell.h \
-	Source/WebCore/accessibility/AccessibilityTableColumn.cpp \
-	Source/WebCore/accessibility/AccessibilityTableColumn.h \
-	Source/WebCore/accessibility/AccessibilityTable.cpp \
-	Source/WebCore/accessibility/AccessibilityTable.h \
-	Source/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp \
-	Source/WebCore/accessibility/AccessibilityTableHeaderContainer.h \
-	Source/WebCore/accessibility/AccessibilityTableRow.cpp \
-	Source/WebCore/accessibility/AccessibilityTableRow.h \
-	Source/WebCore/accessibility/AXObjectCache.cpp \
-	Source/WebCore/accessibility/AXObjectCache.h \
-	Source/WebCore/bindings/generic/ActiveDOMCallback.cpp \
-	Source/WebCore/bindings/generic/ActiveDOMCallback.h \
-	Source/WebCore/bindings/generic/BindingSecurityBase.cpp \
-	Source/WebCore/bindings/generic/BindingSecurityBase.h \
-	Source/WebCore/bindings/generic/BindingSecurity.h \
-	Source/WebCore/bindings/generic/GenericBinding.h \
-	Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp \
-	Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h \
-	Source/WebCore/bindings/js/CachedScriptSourceProvider.h \
-	Source/WebCore/bindings/js/DOMObjectHashTableMap.cpp \
-	Source/WebCore/bindings/js/DOMObjectHashTableMap.h \
-	Source/WebCore/bindings/js/DOMWrapperWorld.cpp \
-	Source/WebCore/bindings/js/DOMWrapperWorld.h \
-	Source/WebCore/bindings/js/GCController.cpp \
-	Source/WebCore/bindings/js/GCController.h \
-	Source/WebCore/bindings/js/IDBBindingUtilities.h \
-	Source/WebCore/bindings/js/JSArrayBufferCustom.cpp \
-	Source/WebCore/bindings/js/JSArrayBufferViewHelper.h \
-	Source/WebCore/bindings/js/JSAttrCustom.cpp \
-	Source/WebCore/bindings/js/JSAudioConstructor.cpp \
-	Source/WebCore/bindings/js/JSAudioConstructor.h \
-	Source/WebCore/bindings/js/JSCDATASectionCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSFontFaceRuleCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSImportRuleCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSMediaRuleCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSPageRuleCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSRuleCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSRuleListCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.h \
-	Source/WebCore/bindings/js/JSCSSStyleRuleCustom.cpp \
-	Source/WebCore/bindings/js/JSCSSValueCustom.cpp \
-	Source/WebCore/bindings/js/JSCallbackData.cpp \
-	Source/WebCore/bindings/js/JSCallbackData.h \
-	Source/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp \
-	Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp \
-	Source/WebCore/bindings/js/JSClipboardCustom.cpp \
-	Source/WebCore/bindings/js/JSConsoleCustom.cpp \
-	Source/WebCore/bindings/js/JSCoordinatesCustom.cpp \
-	Source/WebCore/bindings/js/JSCustomPositionCallback.cpp \
-	Source/WebCore/bindings/js/JSCustomPositionCallback.h \
-	Source/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp \
-	Source/WebCore/bindings/js/JSCustomPositionErrorCallback.h \
-	Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp \
-	Source/WebCore/bindings/js/JSCustomVoidCallback.cpp \
-	Source/WebCore/bindings/js/JSCustomVoidCallback.h \
-	Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp \
-	Source/WebCore/bindings/js/JSCustomXPathNSResolver.h \
-	Source/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp \
-	Source/WebCore/bindings/js/JSDOMBinding.cpp \
-	Source/WebCore/bindings/js/JSDOMBinding.h \
-	Source/WebCore/bindings/js/JSDOMFormDataCustom.cpp \
-	Source/WebCore/bindings/js/JSDOMGlobalObject.cpp \
-	Source/WebCore/bindings/js/JSDOMGlobalObject.h \
-	Source/WebCore/bindings/js/JSDOMImplementationCustom.cpp \
-	Source/WebCore/bindings/js/JSDOMMimeTypeArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSDOMPluginArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSDOMPluginCustom.cpp \
-	Source/WebCore/bindings/js/JSDOMStringMapCustom.cpp \
-	Source/WebCore/bindings/js/JSDOMStringMapCustom.h \
-	Source/WebCore/bindings/js/JSDOMWindowBase.cpp \
-	Source/WebCore/bindings/js/JSDOMWindowBase.h \
-	Source/WebCore/bindings/js/JSDOMWindowCustom.cpp \
-	Source/WebCore/bindings/js/JSDOMWindowCustom.h \
-	Source/WebCore/bindings/js/JSDOMWindowShell.cpp \
-	Source/WebCore/bindings/js/JSDOMWindowShell.h \
-	Source/WebCore/bindings/js/JSDOMWrapper.cpp \
-	Source/WebCore/bindings/js/JSDOMWrapper.h \
-	Source/WebCore/bindings/js/JSDataGridColumnListCustom.cpp \
-	Source/WebCore/bindings/js/JSDataGridDataSource.cpp \
-	Source/WebCore/bindings/js/JSDataGridDataSource.h \
-	Source/WebCore/bindings/js/JSDataViewCustom.cpp \
-	Source/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp \
-	Source/WebCore/bindings/js/JSDeviceMotionEventCustom.cpp \
-	Source/WebCore/bindings/js/JSDeviceOrientationEventCustom.cpp \
-	Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp \
-	Source/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp \
-	Source/WebCore/bindings/js/JSDocumentCustom.cpp \
-	Source/WebCore/bindings/js/JSElementCustom.cpp \
-	Source/WebCore/bindings/js/JSEntryCustom.cpp \
-	Source/WebCore/bindings/js/JSEntrySyncCustom.cpp \
-	Source/WebCore/bindings/js/JSEventCustom.cpp \
-	Source/WebCore/bindings/js/JSEventListener.cpp \
-	Source/WebCore/bindings/js/JSEventListener.h \
-	Source/WebCore/bindings/js/JSEventSourceCustom.cpp \
-	Source/WebCore/bindings/js/JSEventTarget.cpp \
-	Source/WebCore/bindings/js/JSEventTarget.h \
-	Source/WebCore/bindings/js/JSErrorHandler.cpp \
-	Source/WebCore/bindings/js/JSErrorHandler.h \
-	Source/WebCore/bindings/js/JSExceptionBase.cpp \
-	Source/WebCore/bindings/js/JSExceptionBase.h \
-	Source/WebCore/bindings/js/JSFileReaderCustom.cpp \
-	Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSGeolocationCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLAppletElementCustom.h \
-	Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLEmbedElementCustom.h \
-	Source/WebCore/bindings/js/JSHTMLFormElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLInputElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLInputElementCustom.h \
-	Source/WebCore/bindings/js/JSHTMLLinkElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLObjectElementCustom.h \
-	Source/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLOutputElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHTMLSelectElementCustom.h \
-	Source/WebCore/bindings/js/JSHTMLStyleElementCustom.cpp \
-	Source/WebCore/bindings/js/JSHistoryCustom.cpp \
-	Source/WebCore/bindings/js/JSHistoryCustom.h \
-	Source/WebCore/bindings/js/JSImageConstructor.cpp \
-	Source/WebCore/bindings/js/JSImageConstructor.h \
-	Source/WebCore/bindings/js/JSImageDataCustom.cpp \
-	Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp \
-	Source/WebCore/bindings/js/JSInjectedScriptManager.cpp \
-	Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp \
-	Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp \
-	Source/WebCore/bindings/js/JSLazyEventListener.cpp \
-	Source/WebCore/bindings/js/JSLazyEventListener.h \
-	Source/WebCore/bindings/js/JSLocationCustom.cpp \
-	Source/WebCore/bindings/js/JSLocationCustom.h \
-	Source/WebCore/bindings/js/JSMainThreadExecState.cpp \
-	Source/WebCore/bindings/js/JSMainThreadExecState.h \
-	Source/WebCore/bindings/js/JSMemoryInfoCustom.cpp \
-	Source/WebCore/bindings/js/JSMessageChannelCustom.cpp \
-	Source/WebCore/bindings/js/JSMessageEventCustom.cpp \
-	Source/WebCore/bindings/js/JSMessagePortCustom.cpp \
-	Source/WebCore/bindings/js/JSMessagePortCustom.h \
-	Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp \
-	Source/WebCore/bindings/js/JSNavigatorCustom.cpp \
-	Source/WebCore/bindings/js/JSNodeCustom.cpp \
-	Source/WebCore/bindings/js/JSNodeCustom.h \
-	Source/WebCore/bindings/js/JSNodeFilterCondition.cpp \
-	Source/WebCore/bindings/js/JSNodeFilterCondition.h \
-	Source/WebCore/bindings/js/JSNodeFilterCustom.cpp \
-	Source/WebCore/bindings/js/JSNodeIteratorCustom.cpp \
-	Source/WebCore/bindings/js/JSNodeListCustom.cpp \
-	Source/WebCore/bindings/js/JSOptionConstructor.cpp \
-	Source/WebCore/bindings/js/JSOptionConstructor.h \
-	Source/WebCore/bindings/js/JSPluginElementFunctions.cpp \
-	Source/WebCore/bindings/js/JSPluginElementFunctions.h \
-	Source/WebCore/bindings/js/JSProcessingInstructionCustom.cpp \
-	Source/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp \
-	Source/WebCore/bindings/js/JSSQLTransactionCustom.cpp \
-	Source/WebCore/bindings/js/JSSQLTransactionSyncCustom.cpp \
-	Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp \
-	Source/WebCore/bindings/js/JSSVGLengthCustom.cpp \
-	Source/WebCore/bindings/js/JSSVGPathSegCustom.cpp \
-	Source/WebCore/bindings/js/JSScriptProfileNodeCustom.cpp \
-	Source/WebCore/bindings/js/JSSharedWorkerCustom.cpp \
-	Source/WebCore/bindings/js/JSStorageCustom.cpp \
-	Source/WebCore/bindings/js/JSStorageCustom.h \
-	Source/WebCore/bindings/js/JSStyleSheetCustom.cpp \
-	Source/WebCore/bindings/js/JSStyleSheetListCustom.cpp \
-	Source/WebCore/bindings/js/JSTextCustom.cpp \
-	Source/WebCore/bindings/js/JSTouchCustom.cpp \
-	Source/WebCore/bindings/js/JSTouchListCustom.cpp \
-	Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp \
-	Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp \
-	Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp \
-	Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp \
-	Source/WebCore/bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
-	Source/WebCore/bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
-	Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp \
-	Source/WebCore/bindings/js/JSWebKitCSSMatrixCustom.cpp \
-	Source/WebCore/bindings/js/JSWebKitPointCustom.cpp \
-	Source/WebCore/bindings/js/JSWebSocketCustom.cpp \
-	Source/WebCore/bindings/js/JSWorkerContextBase.cpp \
-	Source/WebCore/bindings/js/JSWorkerContextBase.h \
-	Source/WebCore/bindings/js/JSWorkerContextCustom.cpp \
-	Source/WebCore/bindings/js/JSWorkerCustom.cpp \
-	Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp \
-	Source/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp \
-	Source/WebCore/bindings/js/JSXSLTProcessorCustom.cpp \
-	Source/WebCore/bindings/js/JavaScriptCallFrame.cpp \
-	Source/WebCore/bindings/js/JavaScriptCallFrame.h \
-	Source/WebCore/bindings/js/OptionsObject.h \
-	Source/WebCore/bindings/js/PageScriptDebugServer.cpp \
-	Source/WebCore/bindings/js/PageScriptDebugServer.h \
-	Source/WebCore/bindings/js/ScheduledAction.cpp \
-	Source/WebCore/bindings/js/ScheduledAction.h \
-	Source/WebCore/bindings/js/ScriptCachedFrameData.cpp \
-	Source/WebCore/bindings/js/ScriptCachedFrameData.h \
-	Source/WebCore/bindings/js/ScriptCallStackFactory.cpp \
-	Source/WebCore/bindings/js/ScriptCallStackFactory.h \
-	Source/WebCore/bindings/js/ScriptController.cpp \
-	Source/WebCore/bindings/js/ScriptController.h \
-	Source/WebCore/bindings/js/ScriptDebugServer.cpp \
-	Source/WebCore/bindings/js/ScriptDebugServer.h \
-	Source/WebCore/bindings/js/ScriptEventListener.cpp \
-	Source/WebCore/bindings/js/ScriptEventListener.h \
-	Source/WebCore/bindings/js/ScriptFunctionCall.cpp \
-	Source/WebCore/bindings/js/ScriptFunctionCall.h \
-	Source/WebCore/bindings/js/ScriptGCEvent.cpp \
-	Source/WebCore/bindings/js/ScriptGCEvent.h \
-	Source/WebCore/bindings/js/ScriptHeapSnapshot.h \
-	Source/WebCore/bindings/js/ScriptInstance.h \
-	Source/WebCore/bindings/js/ScriptObject.cpp \
-	Source/WebCore/bindings/js/ScriptObject.h \
-	Source/WebCore/bindings/js/ScriptProfile.cpp \
-	Source/WebCore/bindings/js/ScriptProfile.h \
-	Source/WebCore/bindings/js/ScriptProfileNode.h \
-	Source/WebCore/bindings/js/ScriptProfiler.cpp \
-	Source/WebCore/bindings/js/ScriptProfiler.h \
-	Source/WebCore/bindings/js/ScriptSourceCode.h \
-	Source/WebCore/bindings/js/ScriptSourceProvider.h \
-	Source/WebCore/bindings/js/ScriptState.cpp \
-	Source/WebCore/bindings/js/ScriptState.h \
-	Source/WebCore/bindings/js/ScriptValue.cpp \
-	Source/WebCore/bindings/js/ScriptValue.h \
-	Source/WebCore/bindings/js/ScriptWrappable.h \
-	Source/WebCore/bindings/js/SerializedScriptValue.cpp \
-	Source/WebCore/bindings/js/SerializedScriptValue.h \
-	Source/WebCore/bindings/js/StringSourceProvider.h \
-	Source/WebCore/bindings/js/WebCoreJSClientData.h \
-	Source/WebCore/bindings/js/WorkerScriptController.cpp \
-	Source/WebCore/bindings/js/WorkerScriptController.h \
-	Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp \
-	Source/WebCore/bindings/js/WorkerScriptDebugServer.h \
-	Source/WebCore/bindings/ScriptControllerBase.cpp \
-	Source/WebCore/bindings/ScriptControllerBase.h \
-	Source/WebCore/bridge/Bridge.h \
-	Source/WebCore/bridge/c/c_class.cpp \
-	Source/WebCore/bridge/c/c_class.h \
-	Source/WebCore/bridge/c/c_instance.cpp \
-	Source/WebCore/bridge/c/c_instance.h \
-	Source/WebCore/bridge/c/c_runtime.cpp \
-	Source/WebCore/bridge/c/c_runtime.h \
-	Source/WebCore/bridge/c/CRuntimeObject.cpp \
-	Source/WebCore/bridge/c/CRuntimeObject.h \
-	Source/WebCore/bridge/c/c_utility.cpp \
-	Source/WebCore/bridge/c/c_utility.h \
-	Source/WebCore/bridge/IdentifierRep.cpp \
-	Source/WebCore/bridge/IdentifierRep.h \
-	Source/WebCore/bridge/jni/JNIUtility.h \
-	Source/WebCore/bridge/jni/JavaMethod.h \
-	Source/WebCore/bridge/jni/JavaMethodJobject.cpp \
-	Source/WebCore/bridge/jni/JavaMethodJobject.h \
-	Source/WebCore/bridge/jni/JavaString.h \
-	Source/WebCore/bridge/jni/JavaType.h \
-	Source/WebCore/bridge/jni/jni_jsobject.h \
-	Source/WebCore/bridge/jni/jsc/JavaArrayJSC.h \
-	Source/WebCore/bridge/jni/jsc/JavaClassJSC.h \
-	Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h \
-	Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.h \
-	Source/WebCore/bridge/jsc/BridgeJSC.cpp \
-	Source/WebCore/bridge/jsc/BridgeJSC.h \
-	Source/WebCore/bridge/npapi.h \
-	Source/WebCore/bridge/NP_jsobject.cpp \
-	Source/WebCore/bridge/NP_jsobject.h \
-	Source/WebCore/bridge/npruntime.cpp \
-	Source/WebCore/bridge/npruntime.h \
-	Source/WebCore/bridge/npruntime_impl.h \
-	Source/WebCore/bridge/npruntime_internal.h \
-	Source/WebCore/bridge/npruntime_priv.h \
-	Source/WebCore/bridge/nptypes.h \
-	Source/WebCore/bridge/runtime_array.cpp \
-	Source/WebCore/bridge/runtime_array.h \
-	Source/WebCore/bridge/runtime_method.cpp \
-	Source/WebCore/bridge/runtime_method.h \
-	Source/WebCore/bridge/runtime_object.cpp \
-	Source/WebCore/bridge/runtime_object.h \
-	Source/WebCore/bridge/runtime_root.cpp \
-	Source/WebCore/bridge/runtime_root.h \
-	Source/WebCore/config.h \
-	Source/WebCore/css/Counter.h \
-	Source/WebCore/css/CSSBorderImageValue.cpp \
-	Source/WebCore/css/CSSBorderImageValue.h \
-	Source/WebCore/css/CSSCanvasValue.cpp \
-	Source/WebCore/css/CSSCanvasValue.h \
-	Source/WebCore/css/CSSCharsetRule.cpp \
-	Source/WebCore/css/CSSCharsetRule.h \
-	Source/WebCore/css/CSSComputedStyleDeclaration.cpp \
-	Source/WebCore/css/CSSComputedStyleDeclaration.h \
-	Source/WebCore/css/CSSCursorImageValue.cpp \
-	Source/WebCore/css/CSSCursorImageValue.h \
-	Source/WebCore/css/CSSFontFace.cpp \
-	Source/WebCore/css/CSSFontFace.h \
-	Source/WebCore/css/CSSFontFaceRule.cpp \
-	Source/WebCore/css/CSSFontFaceRule.h \
-	Source/WebCore/css/CSSFontFaceSource.cpp \
-	Source/WebCore/css/CSSFontFaceSource.h \
-	Source/WebCore/css/CSSFontFaceSrcValue.cpp \
-	Source/WebCore/css/CSSFontFaceSrcValue.h \
-	Source/WebCore/css/CSSFontSelector.cpp \
-	Source/WebCore/css/CSSFontSelector.h \
-	Source/WebCore/css/CSSFunctionValue.cpp \
-	Source/WebCore/css/CSSFunctionValue.h \
-	Source/WebCore/css/CSSGradientValue.cpp \
-	Source/WebCore/css/CSSGradientValue.h \
-	Source/WebCore/css/CSSHelper.h \
-	Source/WebCore/css/CSSImageGeneratorValue.cpp \
-	Source/WebCore/css/CSSImageGeneratorValue.h \
-	Source/WebCore/css/CSSImageValue.cpp \
-	Source/WebCore/css/CSSImageValue.h \
-	Source/WebCore/css/CSSImportRule.cpp \
-	Source/WebCore/css/CSSImportRule.h \
-	Source/WebCore/css/CSSInheritedValue.cpp \
-	Source/WebCore/css/CSSInheritedValue.h \
-	Source/WebCore/css/CSSInitialValue.cpp \
-	Source/WebCore/css/CSSInitialValue.h \
-        Source/WebCore/css/CSSLineBoxContainValue.cpp \
-	Source/WebCore/css/CSSLineBoxContainValue.h \
-	Source/WebCore/css/CSSMediaRule.cpp \
-	Source/WebCore/css/CSSMediaRule.h \
-	Source/WebCore/css/CSSMutableStyleDeclaration.cpp \
-	Source/WebCore/css/CSSMutableStyleDeclaration.h \
-	Source/WebCore/css/CSSMutableValue.h \
-	Source/WebCore/css/CSSNamespace.h \
-	Source/WebCore/css/CSSOMUtils.cpp \
-	Source/WebCore/css/CSSOMUtils.h \
-	Source/WebCore/css/CSSPageRule.cpp \
-	Source/WebCore/css/CSSPageRule.h \
-	Source/WebCore/css/CSSParser.cpp \
-	Source/WebCore/css/CSSParser.h \
-	Source/WebCore/css/CSSParserValues.cpp \
-	Source/WebCore/css/CSSParserValues.h \
-	Source/WebCore/css/CSSPrimitiveValue.cpp \
-	Source/WebCore/css/CSSPrimitiveValue.h \
-	Source/WebCore/css/CSSPrimitiveValueCache.cpp \
-	Source/WebCore/css/CSSPrimitiveValueCache.h \
-	Source/WebCore/css/CSSPrimitiveValueMappings.h \
-	Source/WebCore/css/CSSProperty.cpp \
-	Source/WebCore/css/CSSProperty.h \
-	Source/WebCore/css/CSSPropertyLonghand.cpp \
-	Source/WebCore/css/CSSPropertyLonghand.h \
-	Source/WebCore/css/CSSPropertySourceData.cpp \
-	Source/WebCore/css/CSSPropertySourceData.h \
-	Source/WebCore/css/CSSQuirkPrimitiveValue.h \
-	Source/WebCore/css/CSSReflectionDirection.h \
-	Source/WebCore/css/CSSReflectValue.cpp \
-	Source/WebCore/css/CSSReflectValue.h \
-	Source/WebCore/css/CSSRule.cpp \
-	Source/WebCore/css/CSSRule.h \
-	Source/WebCore/css/CSSRuleList.cpp \
-	Source/WebCore/css/CSSRuleList.h \
-	Source/WebCore/css/CSSSegmentedFontFace.cpp \
-	Source/WebCore/css/CSSSegmentedFontFace.h \
-	Source/WebCore/css/CSSSelector.cpp \
-	Source/WebCore/css/CSSSelector.h \
-	Source/WebCore/css/CSSSelectorList.cpp \
-	Source/WebCore/css/CSSSelectorList.h \
-	Source/WebCore/css/CSSStyleApplyProperty.cpp \
-	Source/WebCore/css/CSSStyleApplyProperty.h \
-	Source/WebCore/css/CSSStyleDeclaration.cpp \
-	Source/WebCore/css/CSSStyleDeclaration.h \
-	Source/WebCore/css/CSSStyleRule.cpp \
-	Source/WebCore/css/CSSStyleRule.h \
-	Source/WebCore/css/CSSStyleSelector.cpp \
-	Source/WebCore/css/CSSStyleSelector.h \
-	Source/WebCore/css/CSSStyleSheet.cpp \
-	Source/WebCore/css/CSSStyleSheet.h \
-	Source/WebCore/css/CSSTimingFunctionValue.cpp \
-	Source/WebCore/css/CSSTimingFunctionValue.h \
-	Source/WebCore/css/CSSUnicodeRangeValue.cpp \
-	Source/WebCore/css/CSSUnicodeRangeValue.h \
-	Source/WebCore/css/CSSUnknownRule.h \
-	Source/WebCore/css/CSSValue.h \
-	Source/WebCore/css/CSSValueList.cpp \
-	Source/WebCore/css/CSSValueList.h \
-	Source/WebCore/css/DashboardRegion.h \
-	Source/WebCore/css/FontFamilyValue.cpp \
-	Source/WebCore/css/FontFamilyValue.h \
-	Source/WebCore/css/FontValue.cpp \
-	Source/WebCore/css/FontValue.h \
-	Source/WebCore/css/MediaFeatureNames.cpp \
-	Source/WebCore/css/MediaFeatureNames.h \
-	Source/WebCore/css/MediaList.cpp \
-	Source/WebCore/css/MediaList.h \
-	Source/WebCore/css/MediaQuery.cpp \
-	Source/WebCore/css/MediaQuery.h \
-	Source/WebCore/css/MediaQueryEvaluator.cpp \
-	Source/WebCore/css/MediaQueryEvaluator.h \
-	Source/WebCore/css/MediaQueryExp.cpp \
-	Source/WebCore/css/MediaQueryExp.h \
-	Source/WebCore/css/MediaQueryList.cpp \
-	Source/WebCore/css/MediaQueryList.h \
-	Source/WebCore/css/MediaQueryListListener.cpp \
-	Source/WebCore/css/MediaQueryListListener.h \
-	Source/WebCore/css/MediaQueryMatcher.cpp \
-	Source/WebCore/css/MediaQueryMatcher.h \
-	Source/WebCore/css/Pair.h \
-	Source/WebCore/css/Rect.h \
-	Source/WebCore/css/RGBColor.cpp \
-	Source/WebCore/css/RGBColor.h \
-	Source/WebCore/css/ShadowValue.cpp \
-	Source/WebCore/css/ShadowValue.h \
-	Source/WebCore/css/StyleBase.cpp \
-	Source/WebCore/css/StyleBase.h \
-	Source/WebCore/css/StyleList.cpp \
-	Source/WebCore/css/StyleList.h \
-	Source/WebCore/css/StyleMedia.cpp \
-	Source/WebCore/css/StyleMedia.h \
-	Source/WebCore/css/StyleSheet.cpp \
-	Source/WebCore/css/StyleSheet.h \
-	Source/WebCore/css/StyleSheetList.cpp \
-	Source/WebCore/css/StyleSheetList.h \
-	Source/WebCore/css/SVGCSSComputedStyleDeclaration.cpp \
-	Source/WebCore/css/SVGCSSParser.cpp \
-	Source/WebCore/css/SVGCSSStyleSelector.cpp \
-	Source/WebCore/css/WebKitCSSKeyframeRule.cpp \
-	Source/WebCore/css/WebKitCSSKeyframeRule.h \
-	Source/WebCore/css/WebKitCSSKeyframesRule.cpp \
-	Source/WebCore/css/WebKitCSSKeyframesRule.h \
-	Source/WebCore/css/WebKitCSSMatrix.cpp \
-	Source/WebCore/css/WebKitCSSMatrix.h \
-	Source/WebCore/css/WebKitCSSTransformValue.cpp \
-	Source/WebCore/css/WebKitCSSTransformValue.h \
-	Source/WebCore/dom/ActiveDOMObject.cpp \
-	Source/WebCore/dom/ActiveDOMObject.h \
-	Source/WebCore/dom/Attr.cpp \
-	Source/WebCore/dom/Attr.h \
-	Source/WebCore/dom/Attribute.cpp \
-	Source/WebCore/dom/Attribute.h \
-	Source/WebCore/dom/BeforeLoadEvent.h \
-	Source/WebCore/dom/BeforeProcessEvent.cpp \
-	Source/WebCore/dom/BeforeProcessEvent.h \
-	Source/WebCore/dom/BeforeTextInsertedEvent.cpp \
-	Source/WebCore/dom/BeforeTextInsertedEvent.h \
-	Source/WebCore/dom/BeforeUnloadEvent.cpp \
-	Source/WebCore/dom/BeforeUnloadEvent.h \
-	Source/WebCore/dom/CDATASection.cpp \
-	Source/WebCore/dom/CDATASection.h \
-	Source/WebCore/dom/CharacterData.cpp \
-	Source/WebCore/dom/CharacterData.h \
-	Source/WebCore/dom/CheckedRadioButtons.cpp \
-	Source/WebCore/dom/CheckedRadioButtons.h \
-	Source/WebCore/dom/ChildNodeList.cpp \
-	Source/WebCore/dom/ChildNodeList.h \
-	Source/WebCore/dom/ClassNodeList.cpp \
-	Source/WebCore/dom/ClassNodeList.h \
-	Source/WebCore/dom/ClientRect.cpp \
-	Source/WebCore/dom/ClientRect.h \
-	Source/WebCore/dom/ClientRectList.cpp \
-	Source/WebCore/dom/ClientRectList.h \
-	Source/WebCore/dom/ClipboardAccessPolicy.h \
-	Source/WebCore/dom/Clipboard.cpp \
-	Source/WebCore/dom/ClipboardEvent.cpp \
-	Source/WebCore/dom/ClipboardEvent.h \
-	Source/WebCore/dom/Clipboard.h \
-	Source/WebCore/dom/Comment.cpp \
-	Source/WebCore/dom/Comment.h \
-	Source/WebCore/dom/CompositionEvent.cpp \
-	Source/WebCore/dom/CompositionEvent.h \
-	Source/WebCore/dom/ContainerNodeAlgorithms.h \
-	Source/WebCore/dom/ContainerNode.cpp \
-	Source/WebCore/dom/ContainerNode.h \
-	Source/WebCore/dom/CrossThreadTask.h \
-	Source/WebCore/dom/CSSMappedAttributeDeclaration.cpp \
-	Source/WebCore/dom/CSSMappedAttributeDeclaration.h \
-	Source/WebCore/dom/CustomEvent.cpp \
-	Source/WebCore/dom/CustomEvent.h \
-	Source/WebCore/dom/DatasetDOMStringMap.cpp \
-	Source/WebCore/dom/DatasetDOMStringMap.h \
-	Source/WebCore/dom/DecodedDataDocumentParser.cpp \
-	Source/WebCore/dom/DecodedDataDocumentParser.h \
-	Source/WebCore/dom/default/PlatformMessagePortChannel.cpp \
-	Source/WebCore/dom/default/PlatformMessagePortChannel.h \
-	Source/WebCore/dom/DeviceMotionClient.h \
-	Source/WebCore/dom/DeviceMotionController.cpp \
-	Source/WebCore/dom/DeviceMotionController.h \
-	Source/WebCore/dom/DeviceMotionData.cpp \
-	Source/WebCore/dom/DeviceMotionData.h \
-	Source/WebCore/dom/DeviceMotionEvent.cpp \
-	Source/WebCore/dom/DeviceMotionEvent.h \
-	Source/WebCore/dom/DeviceOrientationClient.h \
-	Source/WebCore/dom/DeviceOrientationController.cpp \
-	Source/WebCore/dom/DeviceOrientationController.h \
-	Source/WebCore/dom/DeviceOrientation.cpp \
-	Source/WebCore/dom/DeviceOrientationEvent.cpp \
-	Source/WebCore/dom/DeviceOrientationEvent.h \
-	Source/WebCore/dom/DeviceOrientation.h \
-	Source/WebCore/dom/Document.cpp \
-	Source/WebCore/dom/DocumentFragment.cpp \
-	Source/WebCore/dom/DocumentFragment.h \
-	Source/WebCore/dom/Document.h \
-	Source/WebCore/dom/DocumentMarkerController.cpp \
-	Source/WebCore/dom/DocumentMarkerController.h \
-	Source/WebCore/dom/DocumentMarker.h \
-	Source/WebCore/dom/DocumentOrderedMap.cpp \
-	Source/WebCore/dom/DocumentOrderedMap.h \
-	Source/WebCore/dom/DocumentParser.cpp \
-	Source/WebCore/dom/DocumentParser.h \
-	Source/WebCore/dom/DocumentTiming.h \
-	Source/WebCore/dom/DocumentType.cpp \
-	Source/WebCore/dom/DocumentType.h \
-	Source/WebCore/dom/DOMCoreException.h \
-	Source/WebCore/dom/DOMImplementation.cpp \
-	Source/WebCore/dom/DOMImplementation.h \
-	Source/WebCore/dom/DOMStringList.cpp \
-	Source/WebCore/dom/DOMStringList.h \
-	Source/WebCore/dom/DOMStringMap.cpp \
-	Source/WebCore/dom/DOMStringMap.h \
-	Source/WebCore/dom/DOMTimeStamp.h \
-	Source/WebCore/dom/DynamicNodeList.cpp \
-	Source/WebCore/dom/DynamicNodeList.h \
-	Source/WebCore/dom/EditingText.cpp \
-	Source/WebCore/dom/EditingText.h \
-	Source/WebCore/dom/Element.cpp \
-	Source/WebCore/dom/Element.h \
-	Source/WebCore/dom/ElementRareData.h \
-	Source/WebCore/dom/Entity.h \
-	Source/WebCore/dom/EntityReference.cpp \
-	Source/WebCore/dom/EntityReference.h \
-	Source/WebCore/dom/ErrorEvent.cpp \
-	Source/WebCore/dom/ErrorEvent.h \
-	Source/WebCore/dom/Event.cpp \
-	Source/WebCore/dom/Event.h \
-	Source/WebCore/dom/EventContext.cpp \
-	Source/WebCore/dom/EventContext.h \
-	Source/WebCore/dom/EventDispatcher.cpp \
-	Source/WebCore/dom/EventDispatcher.h \
-	Source/WebCore/dom/EventException.h \
-	Source/WebCore/dom/EventListener.h \
-	Source/WebCore/dom/EventNames.cpp \
-	Source/WebCore/dom/EventNames.h \
-	Source/WebCore/dom/EventTarget.cpp \
-	Source/WebCore/dom/EventTarget.h \
-	Source/WebCore/dom/EventQueue.cpp \
-	Source/WebCore/dom/EventQueue.h \
-	Source/WebCore/dom/ExceptionBase.cpp \
-	Source/WebCore/dom/ExceptionBase.h \
-	Source/WebCore/dom/ExceptionCode.cpp \
-	Source/WebCore/dom/ExceptionCode.h \
-	Source/WebCore/dom/FragmentScriptingPermission.h \
-	Source/WebCore/dom/IgnoreDestructiveWriteCountIncrementer.h \
-	Source/WebCore/dom/InputElement.cpp \
-	Source/WebCore/dom/InputElement.h \
-	Source/WebCore/dom/HashChangeEvent.h \
-	Source/WebCore/dom/KeyboardEvent.cpp \
-	Source/WebCore/dom/KeyboardEvent.h \
-	Source/WebCore/dom/MappedAttributeEntry.h \
-	Source/WebCore/dom/MessageChannel.cpp \
-	Source/WebCore/dom/MessageChannel.h \
-	Source/WebCore/dom/MessageEvent.cpp \
-	Source/WebCore/dom/MessageEvent.h \
-	Source/WebCore/dom/MessagePortChannel.cpp \
-	Source/WebCore/dom/MessagePortChannel.h \
-	Source/WebCore/dom/MessagePort.cpp \
-	Source/WebCore/dom/MessagePort.h \
-	Source/WebCore/dom/MouseEvent.cpp \
-	Source/WebCore/dom/MouseEvent.h \
-	Source/WebCore/dom/MouseRelatedEvent.cpp \
-	Source/WebCore/dom/MouseRelatedEvent.h \
-	Source/WebCore/dom/MutationEvent.cpp \
-	Source/WebCore/dom/MutationEvent.h \
-	Source/WebCore/dom/NamedNodeMap.cpp \
-	Source/WebCore/dom/NamedNodeMap.h \
-	Source/WebCore/dom/NameNodeList.cpp \
-	Source/WebCore/dom/NameNodeList.h \
-	Source/WebCore/dom/Node.cpp \
-	Source/WebCore/dom/NodeFilterCondition.cpp \
-	Source/WebCore/dom/NodeFilterCondition.h \
-	Source/WebCore/dom/NodeFilter.cpp \
-	Source/WebCore/dom/NodeFilter.h \
-	Source/WebCore/dom/Node.h \
-	Source/WebCore/dom/NodeIterator.cpp \
-	Source/WebCore/dom/NodeIterator.h \
-	Source/WebCore/dom/NodeList.h \
-	Source/WebCore/dom/NodeRareData.h \
-	Source/WebCore/dom/NodeRenderStyle.h \
-	Source/WebCore/dom/NodeWithIndex.h \
-	Source/WebCore/dom/Notation.cpp \
-	Source/WebCore/dom/Notation.h \
-	Source/WebCore/dom/OptionElement.cpp \
-	Source/WebCore/dom/OptionElement.h \
-	Source/WebCore/dom/OptionGroupElement.cpp \
-	Source/WebCore/dom/OptionGroupElement.h \
-	Source/WebCore/dom/OverflowEvent.cpp \
-	Source/WebCore/dom/OverflowEvent.h \
-	Source/WebCore/dom/PageTransitionEvent.cpp \
-	Source/WebCore/dom/PageTransitionEvent.h \
-	Source/WebCore/dom/PendingScript.cpp \
-	Source/WebCore/dom/PendingScript.h \
-	Source/WebCore/dom/PopStateEvent.cpp \
-	Source/WebCore/dom/PopStateEvent.h \
-	Source/WebCore/dom/Position.cpp \
-	Source/WebCore/dom/Position.h \
-	Source/WebCore/dom/PositionIterator.cpp \
-	Source/WebCore/dom/PositionIterator.h \
-	Source/WebCore/dom/ProcessingInstruction.cpp \
-	Source/WebCore/dom/ProcessingInstruction.h \
-	Source/WebCore/dom/ProgressEvent.cpp \
-	Source/WebCore/dom/ProgressEvent.h \
-	Source/WebCore/dom/QualifiedName.cpp \
-	Source/WebCore/dom/QualifiedName.h \
-	Source/WebCore/dom/RangeBoundaryPoint.h \
-	Source/WebCore/dom/Range.cpp \
-	Source/WebCore/dom/RangeException.h \
-	Source/WebCore/dom/Range.h \
-	Source/WebCore/dom/RawDataDocumentParser.h \
-	Source/WebCore/dom/RegisteredEventListener.cpp \
-	Source/WebCore/dom/RegisteredEventListener.h \
-	Source/WebCore/dom/ScopedEventQueue.cpp \
-	Source/WebCore/dom/ScopedEventQueue.h \
-	Source/WebCore/dom/ScriptableDocumentParser.cpp \
-	Source/WebCore/dom/ScriptableDocumentParser.h \
-	Source/WebCore/dom/ScriptElement.cpp \
-	Source/WebCore/dom/ScriptElement.h \
-	Source/WebCore/dom/ScriptExecutionContext.cpp \
-	Source/WebCore/dom/ScriptExecutionContext.h \
-	Source/WebCore/dom/ScriptRunner.cpp \
-	Source/WebCore/dom/ScriptRunner.h \
-	Source/WebCore/dom/SelectElement.cpp \
-	Source/WebCore/dom/SelectElement.h \
-	Source/WebCore/dom/SelectorNodeList.cpp \
-	Source/WebCore/dom/SelectorNodeList.h \
-	Source/WebCore/dom/SpaceSplitString.cpp \
-	Source/WebCore/dom/SpaceSplitString.h \
-	Source/WebCore/dom/StaticHashSetNodeList.cpp \
-	Source/WebCore/dom/StaticHashSetNodeList.h \
-	Source/WebCore/dom/StaticNodeList.cpp \
-	Source/WebCore/dom/StaticNodeList.h \
-	Source/WebCore/dom/StyledElement.cpp \
-	Source/WebCore/dom/StyledElement.h \
-	Source/WebCore/dom/StyleElement.cpp \
-	Source/WebCore/dom/StyleElement.h \
-	Source/WebCore/dom/TagNodeList.cpp \
-	Source/WebCore/dom/TagNodeList.h \
-	Source/WebCore/dom/Text.cpp \
-	Source/WebCore/dom/TextEvent.cpp \
-	Source/WebCore/dom/TextEvent.h \
-	Source/WebCore/dom/TextEventInputType.h \
-	Source/WebCore/dom/Text.h \
-	Source/WebCore/dom/TouchList.h \
-	Source/WebCore/dom/TransformSource.h \
-	Source/WebCore/dom/TransformSourceLibxslt.cpp \
-	Source/WebCore/dom/Traversal.cpp \
-	Source/WebCore/dom/Traversal.h \
-	Source/WebCore/dom/TreeDepthLimit.h \
-	Source/WebCore/dom/TreeWalker.cpp \
-	Source/WebCore/dom/TreeWalker.h \
-	Source/WebCore/dom/UIEvent.cpp \
-	Source/WebCore/dom/UIEvent.h \
-	Source/WebCore/dom/UIEventWithKeyState.cpp \
-	Source/WebCore/dom/UIEventWithKeyState.h \
-	Source/WebCore/dom/UserGestureIndicator.cpp \
-	Source/WebCore/dom/UserGestureIndicator.h \
-	Source/WebCore/dom/UserTypingGestureIndicator.cpp \
-	Source/WebCore/dom/UserTypingGestureIndicator.h \
-	Source/WebCore/dom/ViewportArguments.cpp \
-	Source/WebCore/dom/ViewportArguments.h \
-	Source/WebCore/dom/WebKitAnimationEvent.cpp \
-	Source/WebCore/dom/WebKitAnimationEvent.h \
-	Source/WebCore/dom/WebKitTransitionEvent.cpp \
-	Source/WebCore/dom/WebKitTransitionEvent.h \
-	Source/WebCore/dom/WheelEvent.cpp \
-	Source/WebCore/dom/WheelEvent.h \
-	Source/WebCore/dom/WindowEventContext.cpp \
-	Source/WebCore/dom/WindowEventContext.h \
-	Source/WebCore/dom/XMLDocumentParser.cpp \
-	Source/WebCore/dom/XMLDocumentParser.h \
-	Source/WebCore/dom/XMLDocumentParserLibxml2.cpp \
-	Source/WebCore/dom/XMLDocumentParserScope.cpp \
-	Source/WebCore/dom/XMLDocumentParserScope.h \
-	Source/WebCore/editing/AppendNodeCommand.cpp \
-	Source/WebCore/editing/AppendNodeCommand.h \
-	Source/WebCore/editing/ApplyBlockElementCommand.cpp \
-	Source/WebCore/editing/ApplyBlockElementCommand.h \
-	Source/WebCore/editing/ApplyStyleCommand.cpp \
-	Source/WebCore/editing/ApplyStyleCommand.h \
-	Source/WebCore/editing/BreakBlockquoteCommand.cpp \
-	Source/WebCore/editing/BreakBlockquoteCommand.h \
-	Source/WebCore/editing/CompositeEditCommand.cpp \
-	Source/WebCore/editing/CompositeEditCommand.h \
-	Source/WebCore/editing/CreateLinkCommand.cpp \
-	Source/WebCore/editing/CreateLinkCommand.h \
-	Source/WebCore/editing/CorrectionPanelInfo.h \
-	Source/WebCore/editing/DeleteButtonController.cpp \
-	Source/WebCore/editing/DeleteButtonController.h \
-	Source/WebCore/editing/DeleteButton.cpp \
-	Source/WebCore/editing/DeleteButton.h \
-	Source/WebCore/editing/DeleteFromTextNodeCommand.cpp \
-	Source/WebCore/editing/DeleteFromTextNodeCommand.h \
-	Source/WebCore/editing/DeleteSelectionCommand.cpp \
-	Source/WebCore/editing/DeleteSelectionCommand.h \
-	Source/WebCore/editing/EditAction.h \
-	Source/WebCore/editing/EditCommand.cpp \
-	Source/WebCore/editing/EditCommand.h \
-	Source/WebCore/editing/EditingBehavior.h \
-	Source/WebCore/editing/EditingBehaviorTypes.h \
-	Source/WebCore/editing/EditingBoundary.h \
-	Source/WebCore/editing/EditingStyle.cpp \
-	Source/WebCore/editing/EditingStyle.h \
-	Source/WebCore/editing/EditorCommand.cpp \
-	Source/WebCore/editing/Editor.cpp \
-	Source/WebCore/editing/EditorDeleteAction.h \
-	Source/WebCore/editing/Editor.h \
-	Source/WebCore/editing/EditorInsertAction.h \
-	Source/WebCore/editing/FindOptions.h \
-	Source/WebCore/editing/FormatBlockCommand.cpp \
-	Source/WebCore/editing/FormatBlockCommand.h \
-	Source/WebCore/editing/gtk/SelectionControllerGtk.cpp \
-	Source/WebCore/editing/htmlediting.cpp \
-	Source/WebCore/editing/htmlediting.h \
-	Source/WebCore/editing/HTMLInterchange.cpp \
-	Source/WebCore/editing/HTMLInterchange.h \
-	Source/WebCore/editing/IndentOutdentCommand.cpp \
-	Source/WebCore/editing/IndentOutdentCommand.h \
-	Source/WebCore/editing/InsertIntoTextNodeCommand.cpp \
-	Source/WebCore/editing/InsertIntoTextNodeCommand.h \
-	Source/WebCore/editing/InsertLineBreakCommand.cpp \
-	Source/WebCore/editing/InsertLineBreakCommand.h \
-	Source/WebCore/editing/InsertListCommand.cpp \
-	Source/WebCore/editing/InsertListCommand.h \
-	Source/WebCore/editing/InsertNodeBeforeCommand.cpp \
-	Source/WebCore/editing/InsertNodeBeforeCommand.h \
-	Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp \
-	Source/WebCore/editing/InsertParagraphSeparatorCommand.h \
-	Source/WebCore/editing/InsertTextCommand.cpp \
-	Source/WebCore/editing/InsertTextCommand.h \
-	Source/WebCore/editing/JoinTextNodesCommand.cpp \
-	Source/WebCore/editing/JoinTextNodesCommand.h \
-	Source/WebCore/editing/markup.cpp \
-	Source/WebCore/editing/markup.h \
-	Source/WebCore/editing/MarkupAccumulator.cpp \
-	Source/WebCore/editing/MarkupAccumulator.h \
-	Source/WebCore/editing/MergeIdenticalElementsCommand.cpp \
-	Source/WebCore/editing/MergeIdenticalElementsCommand.h \
-	Source/WebCore/editing/ModifySelectionListLevel.cpp \
-	Source/WebCore/editing/ModifySelectionListLevel.h \
-	Source/WebCore/editing/MoveSelectionCommand.cpp \
-	Source/WebCore/editing/MoveSelectionCommand.h \
-	Source/WebCore/editing/RemoveCSSPropertyCommand.cpp \
-	Source/WebCore/editing/RemoveCSSPropertyCommand.h \
-	Source/WebCore/editing/RemoveFormatCommand.cpp \
-	Source/WebCore/editing/RemoveFormatCommand.h \
-	Source/WebCore/editing/RemoveNodeCommand.cpp \
-	Source/WebCore/editing/RemoveNodeCommand.h \
-	Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp \
-	Source/WebCore/editing/RemoveNodePreservingChildrenCommand.h \
-	Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp \
-	Source/WebCore/editing/ReplaceNodeWithSpanCommand.h \
-	Source/WebCore/editing/ReplaceSelectionCommand.cpp \
-	Source/WebCore/editing/ReplaceSelectionCommand.h \
-	Source/WebCore/editing/SelectionController.cpp \
-	Source/WebCore/editing/SelectionController.h \
-	Source/WebCore/editing/SetNodeAttributeCommand.cpp \
-	Source/WebCore/editing/SetNodeAttributeCommand.h \
-	Source/WebCore/editing/SmartReplace.cpp \
-	Source/WebCore/editing/SmartReplace.h \
-	Source/WebCore/editing/SmartReplaceICU.cpp \
-	Source/WebCore/editing/SpellChecker.cpp \
-	Source/WebCore/editing/SpellChecker.h \
-	Source/WebCore/editing/SpellingCorrectionCommand.h \
-	Source/WebCore/editing/SplitElementCommand.cpp \
-	Source/WebCore/editing/SplitElementCommand.h \
-	Source/WebCore/editing/SplitTextNodeCommand.cpp \
-	Source/WebCore/editing/SplitTextNodeCommand.h \
-	Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp \
-	Source/WebCore/editing/SplitTextNodeContainingElementCommand.h \
-	Source/WebCore/editing/TextAffinity.h \
-	Source/WebCore/editing/TextCheckingHelper.cpp \
-	Source/WebCore/editing/TextCheckingHelper.h \
-	Source/WebCore/editing/TextGranularity.h \
-	Source/WebCore/editing/TextIterator.cpp \
-	Source/WebCore/editing/TextIterator.h \
-	Source/WebCore/editing/TypingCommand.cpp \
-	Source/WebCore/editing/TypingCommand.h \
-	Source/WebCore/editing/UnlinkCommand.cpp \
-	Source/WebCore/editing/UnlinkCommand.h \
-	Source/WebCore/editing/VisiblePosition.cpp \
-	Source/WebCore/editing/VisiblePosition.h \
-	Source/WebCore/editing/VisibleSelection.cpp \
-	Source/WebCore/editing/VisibleSelection.h \
-	Source/WebCore/editing/visible_units.cpp \
-	Source/WebCore/editing/visible_units.h \
-	Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp \
-	Source/WebCore/editing/WrapContentsInDummySpanCommand.h \
-	Source/WebCore/editing/WritingDirection.h \
-	Source/WebCore/fileapi/AsyncFileWriter.h \
-	Source/WebCore/fileapi/AsyncFileWriterClient.h \
-	Source/WebCore/fileapi/BlobBuilder.cpp \
-	Source/WebCore/fileapi/BlobBuilder.h \
-	Source/WebCore/fileapi/Blob.cpp \
-	Source/WebCore/fileapi/Blob.h \
-	Source/WebCore/fileapi/BlobURL.cpp \
-	Source/WebCore/fileapi/BlobURL.h \
-	Source/WebCore/fileapi/DirectoryEntry.cpp \
-	Source/WebCore/fileapi/DirectoryEntry.h \
-	Source/WebCore/fileapi/DirectoryEntrySync.cpp \
-	Source/WebCore/fileapi/DirectoryEntrySync.h \
-	Source/WebCore/fileapi/DirectoryReader.cpp \
-	Source/WebCore/fileapi/DirectoryReader.h \
-	Source/WebCore/fileapi/DirectoryReaderSync.cpp \
-	Source/WebCore/fileapi/DirectoryReaderSync.h \
-	Source/WebCore/fileapi/DOMFilePath.cpp \
-	Source/WebCore/fileapi/DOMFilePath.h \
-	Source/WebCore/fileapi/DOMFileSystem.cpp \
-	Source/WebCore/fileapi/DOMFileSystem.h \
-	Source/WebCore/fileapi/DOMFileSystemBase.cpp \
-	Source/WebCore/fileapi/DOMFileSystemBase.h \
-	Source/WebCore/fileapi/DOMFileSystemSync.cpp \
-	Source/WebCore/fileapi/DOMFileSystemSync.h \
-	Source/WebCore/fileapi/EntriesCallback.h \
-	Source/WebCore/fileapi/Entry.cpp \
-	Source/WebCore/fileapi/Entry.h \
-	Source/WebCore/fileapi/EntryArray.cpp \
-	Source/WebCore/fileapi/EntryArray.h \
-	Source/WebCore/fileapi/EntryArraySync.cpp \
-	Source/WebCore/fileapi/EntryArraySync.h \
-	Source/WebCore/fileapi/EntryBase.h \
-	Source/WebCore/fileapi/EntryCallback.h \
-	Source/WebCore/fileapi/EntrySync.cpp \
-	Source/WebCore/fileapi/EntrySync.h \
-	Source/WebCore/fileapi/ErrorCallback.h \
-	Source/WebCore/fileapi/FileCallback.h \
-	Source/WebCore/fileapi/File.cpp \
-	Source/WebCore/fileapi/FileEntry.cpp \
-	Source/WebCore/fileapi/FileEntry.h \
-	Source/WebCore/fileapi/FileEntrySync.cpp \
-	Source/WebCore/fileapi/FileEntrySync.h \
-	Source/WebCore/fileapi/FileError.h \
-	Source/WebCore/fileapi/FileException.h \
-	Source/WebCore/fileapi/File.h \
-	Source/WebCore/fileapi/FileList.cpp \
-	Source/WebCore/fileapi/FileList.h \
-	Source/WebCore/fileapi/FileReader.cpp \
-	Source/WebCore/fileapi/FileReader.h \
-	Source/WebCore/fileapi/FileReaderLoader.cpp \
-	Source/WebCore/fileapi/FileReaderLoader.h \
-	Source/WebCore/fileapi/FileReaderLoaderClient.h \
-	Source/WebCore/fileapi/FileReaderSync.cpp \
-	Source/WebCore/fileapi/FileReaderSync.h \
-	Source/WebCore/fileapi/FileStreamProxy.cpp \
-	Source/WebCore/fileapi/FileStreamProxy.h \
-	Source/WebCore/fileapi/FileSystemCallback.h \
-	Source/WebCore/fileapi/FileSystemCallbacks.cpp \
-	Source/WebCore/fileapi/FileSystemCallbacks.h \
-	Source/WebCore/fileapi/FileThread.cpp \
-	Source/WebCore/fileapi/FileThread.h \
-	Source/WebCore/fileapi/FileThreadTask.h \
-	Source/WebCore/fileapi/FileWriter.cpp \
-	Source/WebCore/fileapi/FileWriter.h \
-	Source/WebCore/fileapi/FileWriterBase.cpp \
-	Source/WebCore/fileapi/FileWriterBase.h \
-	Source/WebCore/fileapi/FileWriterBaseCallback.h \
-	Source/WebCore/fileapi/FileWriterCallback.h \
-	Source/WebCore/fileapi/FileWriterSync.cpp \
-	Source/WebCore/fileapi/FileWriterSync.h \
-	Source/WebCore/fileapi/Flags.h \
-	Source/WebCore/fileapi/LocalFileSystem.cpp \
-	Source/WebCore/fileapi/LocalFileSystem.h \
-	Source/WebCore/fileapi/MetadataCallback.h \
-	Source/WebCore/fileapi/Metadata.h \
-	Source/WebCore/fileapi/ThreadableBlobRegistry.cpp \
-	Source/WebCore/fileapi/ThreadableBlobRegistry.h \
-	Source/WebCore/history/BackForwardController.cpp \
-	Source/WebCore/history/BackForwardController.h \
-	Source/WebCore/history/BackForwardList.h \
-	Source/WebCore/history/BackForwardListImpl.cpp \
-	Source/WebCore/history/BackForwardListImpl.h \
-	Source/WebCore/history/CachedFrame.cpp \
-	Source/WebCore/history/CachedFrame.h \
-	Source/WebCore/history/CachedFramePlatformData.h \
-	Source/WebCore/history/CachedPage.cpp \
-	Source/WebCore/history/CachedPage.h \
-	Source/WebCore/history/HistoryItem.cpp \
-	Source/WebCore/history/HistoryItem.h \
-	Source/WebCore/history/PageCache.cpp \
-	Source/WebCore/history/PageCache.h \
-	Source/WebCore/html/AsyncImageResizer.cpp \
-	Source/WebCore/html/AsyncImageResizer.h \
-	Source/WebCore/html/BaseButtonInputType.cpp \
-	Source/WebCore/html/BaseButtonInputType.h \
-	Source/WebCore/html/BaseCheckableInputType.cpp \
-	Source/WebCore/html/BaseCheckableInputType.h \
-	Source/WebCore/html/BaseDateAndTimeInputType.cpp \
-	Source/WebCore/html/BaseDateAndTimeInputType.h \
-	Source/WebCore/html/BaseTextInputType.cpp \
-	Source/WebCore/html/BaseTextInputType.h \
-	Source/WebCore/html/ButtonInputType.cpp \
-	Source/WebCore/html/ButtonInputType.h \
-	Source/WebCore/html/canvas/ArrayBuffer.cpp \
-	Source/WebCore/html/canvas/ArrayBuffer.h \
-	Source/WebCore/html/canvas/ArrayBufferView.cpp \
-	Source/WebCore/html/canvas/ArrayBufferView.h \
-	Source/WebCore/html/canvas/CanvasContextAttributes.cpp \
-	Source/WebCore/html/canvas/CanvasContextAttributes.h \
-	Source/WebCore/html/canvas/CanvasGradient.cpp \
-	Source/WebCore/html/canvas/CanvasGradient.h \
-	Source/WebCore/html/canvas/CanvasPattern.cpp \
-	Source/WebCore/html/canvas/CanvasPattern.h \
-	Source/WebCore/html/canvas/CanvasPixelArray.cpp \
-	Source/WebCore/html/canvas/CanvasPixelArray.h \
-	Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp \
-	Source/WebCore/html/canvas/CanvasRenderingContext2D.h \
-	Source/WebCore/html/canvas/CanvasRenderingContext.cpp \
-	Source/WebCore/html/canvas/CanvasRenderingContext.h \
-	Source/WebCore/html/canvas/CanvasStyle.cpp \
-	Source/WebCore/html/canvas/CanvasStyle.h \
-	Source/WebCore/html/canvas/CheckedInt.h \
-	Source/WebCore/html/canvas/DataView.cpp \
-	Source/WebCore/html/canvas/DataView.h \
-	Source/WebCore/html/canvas/Float32Array.cpp \
-	Source/WebCore/html/canvas/Float32Array.h \
-	Source/WebCore/html/canvas/Int16Array.cpp \
-	Source/WebCore/html/canvas/Int16Array.h \
-	Source/WebCore/html/canvas/Int32Array.cpp \
-	Source/WebCore/html/canvas/Int32Array.h \
-	Source/WebCore/html/canvas/Int8Array.cpp \
-	Source/WebCore/html/canvas/Int8Array.h \
-	Source/WebCore/html/canvas/IntegralTypedArrayBase.h \
-	Source/WebCore/html/canvas/TypedArrayBase.h \
-	Source/WebCore/html/canvas/Uint16Array.cpp \
-	Source/WebCore/html/canvas/Uint16Array.h \
-	Source/WebCore/html/canvas/Uint32Array.cpp \
-	Source/WebCore/html/canvas/Uint32Array.h \
-	Source/WebCore/html/canvas/Uint8Array.cpp \
-	Source/WebCore/html/canvas/Uint8Array.h \
-	Source/WebCore/html/DOMSettableTokenList.cpp \
-	Source/WebCore/html/DOMSettableTokenList.h \
-	Source/WebCore/html/DOMTokenList.cpp \
-	Source/WebCore/html/DOMTokenList.h \
-	Source/WebCore/html/CheckboxInputType.cpp \
-	Source/WebCore/html/CheckboxInputType.h \
-	Source/WebCore/html/ClassList.cpp \
-	Source/WebCore/html/ClassList.h \
-	Source/WebCore/html/CollectionCache.cpp \
-	Source/WebCore/html/CollectionCache.h \
-	Source/WebCore/html/CollectionType.h \
-	Source/WebCore/html/ColorInputType.cpp \
-	Source/WebCore/html/ColorInputType.h \
-	Source/WebCore/html/DataGridColumn.cpp \
-	Source/WebCore/html/DataGridColumn.h \
-	Source/WebCore/html/DataGridColumnList.cpp \
-	Source/WebCore/html/DataGridColumnList.h \
-	Source/WebCore/html/DataGridDataSource.h \
-	Source/WebCore/html/DateComponents.cpp \
-	Source/WebCore/html/DateComponents.h \
-	Source/WebCore/html/DateInputType.cpp \
-	Source/WebCore/html/DateInputType.h \
-	Source/WebCore/html/DateTimeInputType.cpp \
-	Source/WebCore/html/DateTimeInputType.h \
-	Source/WebCore/html/DateTimeLocalInputType.cpp \
-	Source/WebCore/html/DateTimeLocalInputType.h \
-	Source/WebCore/html/DOMDataGridDataSource.cpp \
-	Source/WebCore/html/DOMDataGridDataSource.h \
-	Source/WebCore/html/DOMFormData.cpp \
-	Source/WebCore/html/DOMFormData.h \
-	Source/WebCore/html/DOMURL.cpp \
-	Source/WebCore/html/DOMURL.h \
-	Source/WebCore/html/EmailInputType.cpp \
-	Source/WebCore/html/EmailInputType.h \
-	Source/WebCore/html/FileInputType.cpp \
-	Source/WebCore/html/FileInputType.h \
-	Source/WebCore/html/FormAssociatedElement.cpp \
-	Source/WebCore/html/FormAssociatedElement.h \
-	Source/WebCore/html/FormDataList.cpp \
-	Source/WebCore/html/FormDataList.h \
-	Source/WebCore/html/FTPDirectoryDocument.cpp \
-	Source/WebCore/html/FTPDirectoryDocument.h \
-	Source/WebCore/html/HTMLAllCollection.cpp \
-	Source/WebCore/html/HTMLAllCollection.h \
-	Source/WebCore/html/HTMLAnchorElement.cpp \
-	Source/WebCore/html/HTMLAnchorElement.h \
-	Source/WebCore/html/HTMLAppletElement.cpp \
-	Source/WebCore/html/HTMLAppletElement.h \
-	Source/WebCore/html/HTMLAreaElement.cpp \
-	Source/WebCore/html/HTMLAreaElement.h \
-	Source/WebCore/html/HTMLAudioElement.cpp \
-	Source/WebCore/html/HTMLAudioElement.h \
-	Source/WebCore/html/HTMLBaseElement.cpp \
-	Source/WebCore/html/HTMLBaseElement.h \
-	Source/WebCore/html/HTMLBaseFontElement.cpp \
-	Source/WebCore/html/HTMLBaseFontElement.h \
-	Source/WebCore/html/HTMLBlockquoteElement.cpp \
-	Source/WebCore/html/HTMLBlockquoteElement.h \
-	Source/WebCore/html/HTMLBodyElement.cpp \
-	Source/WebCore/html/HTMLBodyElement.h \
-	Source/WebCore/html/HTMLBRElement.cpp \
-	Source/WebCore/html/HTMLBRElement.h \
-	Source/WebCore/html/HTMLButtonElement.cpp \
-	Source/WebCore/html/HTMLButtonElement.h \
-	Source/WebCore/html/HTMLCanvasElement.cpp \
-	Source/WebCore/html/HTMLCanvasElement.h \
-	Source/WebCore/html/HTMLCollection.cpp \
-	Source/WebCore/html/HTMLCollection.h \
-	Source/WebCore/html/HTMLDataGridCellElement.cpp \
-	Source/WebCore/html/HTMLDataGridCellElement.h \
-	Source/WebCore/html/HTMLDataGridColElement.cpp \
-	Source/WebCore/html/HTMLDataGridColElement.h \
-	Source/WebCore/html/HTMLDataGridElement.cpp \
-	Source/WebCore/html/HTMLDataGridElement.h \
-	Source/WebCore/html/HTMLDataGridRowElement.cpp \
-	Source/WebCore/html/HTMLDataGridRowElement.h \
-	Source/WebCore/html/HTMLDataListElement.cpp \
-	Source/WebCore/html/HTMLDataListElement.h \
-	Source/WebCore/html/HTMLDetailsElement.cpp \
-	Source/WebCore/html/HTMLDetailsElement.h \
-	Source/WebCore/html/HTMLDirectoryElement.cpp \
-	Source/WebCore/html/HTMLDirectoryElement.h \
-	Source/WebCore/html/HTMLDivElement.cpp \
-	Source/WebCore/html/HTMLDivElement.h \
-	Source/WebCore/html/HTMLDListElement.cpp \
-	Source/WebCore/html/HTMLDListElement.h \
-	Source/WebCore/html/HTMLDocument.cpp \
-	Source/WebCore/html/HTMLDocument.h \
-	Source/WebCore/html/HTMLElement.cpp \
-	Source/WebCore/html/HTMLElement.h \
-	Source/WebCore/html/HTMLEmbedElement.cpp \
-	Source/WebCore/html/HTMLEmbedElement.h \
-	Source/WebCore/html/HTMLFieldSetElement.cpp \
-	Source/WebCore/html/HTMLFieldSetElement.h \
-	Source/WebCore/html/HTMLFontElement.cpp \
-	Source/WebCore/html/HTMLFontElement.h \
-	Source/WebCore/html/HTMLFormCollection.cpp \
-	Source/WebCore/html/HTMLFormCollection.h \
-	Source/WebCore/html/HTMLFormControlElement.cpp \
-	Source/WebCore/html/HTMLFormControlElement.h \
-	Source/WebCore/html/HTMLFormElement.cpp \
-	Source/WebCore/html/HTMLFormElement.h \
-	Source/WebCore/html/HTMLFrameElementBase.cpp \
-	Source/WebCore/html/HTMLFrameElementBase.h \
-	Source/WebCore/html/HTMLFrameElement.cpp \
-	Source/WebCore/html/HTMLFrameElement.h \
-	Source/WebCore/html/HTMLFrameOwnerElement.cpp \
-	Source/WebCore/html/HTMLFrameOwnerElement.h \
-	Source/WebCore/html/HTMLFrameSetElement.cpp \
-	Source/WebCore/html/HTMLFrameSetElement.h \
-	Source/WebCore/html/HTMLHeadElement.cpp \
-	Source/WebCore/html/HTMLHeadElement.h \
-	Source/WebCore/html/HTMLHeadingElement.cpp \
-	Source/WebCore/html/HTMLHeadingElement.h \
-	Source/WebCore/html/HTMLHRElement.cpp \
-	Source/WebCore/html/HTMLHRElement.h \
-	Source/WebCore/html/HTMLHtmlElement.cpp \
-	Source/WebCore/html/HTMLHtmlElement.h \
-	Source/WebCore/html/HTMLIFrameElement.cpp \
-	Source/WebCore/html/HTMLIFrameElement.h \
-	Source/WebCore/html/HTMLImageElement.cpp \
-	Source/WebCore/html/HTMLImageElement.h \
-	Source/WebCore/html/HTMLImageLoader.cpp \
-	Source/WebCore/html/HTMLImageLoader.h \
-	Source/WebCore/html/HTMLInputElement.cpp \
-	Source/WebCore/html/HTMLInputElement.h \
-	Source/WebCore/html/HTMLIsIndexElement.cpp \
-	Source/WebCore/html/HTMLIsIndexElement.h \
-	Source/WebCore/html/HTMLKeygenElement.cpp \
-	Source/WebCore/html/HTMLKeygenElement.h \
-	Source/WebCore/html/HTMLLabelElement.cpp \
-	Source/WebCore/html/HTMLLabelElement.h \
-	Source/WebCore/html/HTMLLegendElement.cpp \
-	Source/WebCore/html/HTMLLegendElement.h \
-	Source/WebCore/html/HTMLLIElement.cpp \
-	Source/WebCore/html/HTMLLIElement.h \
-	Source/WebCore/html/HTMLLinkElement.cpp \
-	Source/WebCore/html/HTMLLinkElement.h \
-	Source/WebCore/html/HTMLMapElement.cpp \
-	Source/WebCore/html/HTMLMapElement.h \
-	Source/WebCore/html/HTMLMarqueeElement.cpp \
-	Source/WebCore/html/HTMLMarqueeElement.h \
-	Source/WebCore/html/HTMLMediaElement.cpp \
-	Source/WebCore/html/HTMLMediaElement.h \
-	Source/WebCore/html/HTMLMenuElement.cpp \
-	Source/WebCore/html/HTMLMenuElement.h \
-	Source/WebCore/html/HTMLMetaElement.cpp \
-	Source/WebCore/html/HTMLMetaElement.h \
-	Source/WebCore/html/HTMLMeterElement.cpp \
-	Source/WebCore/html/HTMLMeterElement.h \
-	Source/WebCore/html/HTMLModElement.cpp \
-	Source/WebCore/html/HTMLModElement.h \
-	Source/WebCore/html/HTMLNameCollection.cpp \
-	Source/WebCore/html/HTMLNameCollection.h \
-	Source/WebCore/html/HTMLNoScriptElement.cpp \
-	Source/WebCore/html/HTMLNoScriptElement.h \
-	Source/WebCore/html/HTMLObjectElement.cpp \
-	Source/WebCore/html/HTMLObjectElement.h \
-	Source/WebCore/html/HTMLOListElement.cpp \
-	Source/WebCore/html/HTMLOListElement.h \
-	Source/WebCore/html/HTMLOptGroupElement.cpp \
-	Source/WebCore/html/HTMLOptGroupElement.h \
-	Source/WebCore/html/HTMLOptionElement.cpp \
-	Source/WebCore/html/HTMLOptionElement.h \
-	Source/WebCore/html/HTMLOptionsCollection.cpp \
-	Source/WebCore/html/HTMLOptionsCollection.h \
-	Source/WebCore/html/HTMLOutputElement.cpp \
-	Source/WebCore/html/HTMLOutputElement.h \
-	Source/WebCore/html/HTMLParagraphElement.cpp \
-	Source/WebCore/html/HTMLParagraphElement.h \
-	Source/WebCore/html/HTMLParamElement.cpp \
-	Source/WebCore/html/HTMLParamElement.h \
-	Source/WebCore/html/HTMLParserErrorCodes.cpp \
-	Source/WebCore/html/HTMLParserErrorCodes.h \
-	Source/WebCore/html/HTMLParserQuirks.h \
-	Source/WebCore/html/HTMLPlugInElement.cpp \
-	Source/WebCore/html/HTMLPlugInElement.h \
-	Source/WebCore/html/HTMLPlugInImageElement.cpp \
-	Source/WebCore/html/HTMLPlugInImageElement.h \
-	Source/WebCore/html/HTMLPreElement.cpp \
-	Source/WebCore/html/HTMLPreElement.h \
-	Source/WebCore/html/HTMLProgressElement.cpp \
-	Source/WebCore/html/HTMLProgressElement.h \
-	Source/WebCore/html/HTMLQuoteElement.cpp \
-	Source/WebCore/html/HTMLQuoteElement.h \
-	Source/WebCore/html/HTMLScriptElement.cpp \
-	Source/WebCore/html/HTMLScriptElement.h \
-	Source/WebCore/html/HTMLSelectElement.cpp \
-	Source/WebCore/html/HTMLSelectElement.h \
-	Source/WebCore/html/HTMLSourceElement.cpp \
-	Source/WebCore/html/HTMLSourceElement.h \
-	Source/WebCore/html/HTMLStyleElement.cpp \
-	Source/WebCore/html/HTMLStyleElement.h \
-	Source/WebCore/html/HTMLSummaryElement.cpp \
-	Source/WebCore/html/HTMLSummaryElement.h \
-	Source/WebCore/html/HTMLTableCaptionElement.cpp \
-	Source/WebCore/html/HTMLTableCaptionElement.h \
-	Source/WebCore/html/HTMLTableCellElement.cpp \
-	Source/WebCore/html/HTMLTableCellElement.h \
-	Source/WebCore/html/HTMLTableColElement.cpp \
-	Source/WebCore/html/HTMLTableColElement.h \
-	Source/WebCore/html/HTMLTableElement.cpp \
-	Source/WebCore/html/HTMLTableElement.h \
-	Source/WebCore/html/HTMLTablePartElement.cpp \
-	Source/WebCore/html/HTMLTablePartElement.h \
-	Source/WebCore/html/HTMLTableRowElement.cpp \
-	Source/WebCore/html/HTMLTableRowElement.h \
-	Source/WebCore/html/HTMLTableRowsCollection.cpp \
-	Source/WebCore/html/HTMLTableRowsCollection.h \
-	Source/WebCore/html/HTMLTableSectionElement.cpp \
-	Source/WebCore/html/HTMLTableSectionElement.h \
-	Source/WebCore/html/HTMLTextAreaElement.cpp \
-	Source/WebCore/html/HTMLTextAreaElement.h \
-	Source/WebCore/html/HTMLTitleElement.cpp \
-	Source/WebCore/html/HTMLTitleElement.h \
-	Source/WebCore/html/HTMLUListElement.cpp \
-	Source/WebCore/html/HTMLUListElement.h \
-	Source/WebCore/html/HTMLVideoElement.cpp \
-	Source/WebCore/html/HTMLVideoElement.h \
-	Source/WebCore/html/HTMLViewSourceDocument.cpp \
-	Source/WebCore/html/HTMLViewSourceDocument.h \
-	Source/WebCore/html/HiddenInputType.cpp \
-	Source/WebCore/html/HiddenInputType.h \
-	Source/WebCore/html/ImageData.cpp \
-	Source/WebCore/html/ImageData.h \
-	Source/WebCore/html/ImageDocument.cpp \
-	Source/WebCore/html/ImageDocument.h \
-	Source/WebCore/html/ImageInputType.cpp \
-	Source/WebCore/html/ImageInputType.h \
-	Source/WebCore/html/ImageResizerThread.cpp \
-	Source/WebCore/html/ImageResizerThread.h \
-	Source/WebCore/html/InputType.cpp \
-	Source/WebCore/html/InputType.h \
-	Source/WebCore/html/IsIndexInputType.cpp \
-	Source/WebCore/html/IsIndexInputType.h \
-	Source/WebCore/html/LabelsNodeList.cpp \
-	Source/WebCore/html/LabelsNodeList.h \
-	Source/WebCore/html/MediaDocument.cpp \
-	Source/WebCore/html/MediaDocument.h \
-	Source/WebCore/html/MediaError.h \
-	Source/WebCore/html/MonthInputType.cpp \
-	Source/WebCore/html/MonthInputType.h \
-	Source/WebCore/html/NumberInputType.cpp \
-	Source/WebCore/html/NumberInputType.h \
-	Source/WebCore/html/parser/CSSPreloadScanner.cpp \
-	Source/WebCore/html/parser/CSSPreloadScanner.h \
-	Source/WebCore/html/parser/HTMLConstructionSite.cpp \
-	Source/WebCore/html/parser/HTMLConstructionSite.h \
-	Source/WebCore/html/parser/HTMLDocumentParser.cpp \
-	Source/WebCore/html/parser/HTMLDocumentParser.h \
-	Source/WebCore/html/parser/HTMLElementStack.cpp \
-	Source/WebCore/html/parser/HTMLElementStack.h \
-	Source/WebCore/html/parser/HTMLEntityParser.cpp \
-	Source/WebCore/html/parser/HTMLEntityParser.h \
-	Source/WebCore/html/parser/HTMLEntitySearch.cpp \
-	Source/WebCore/html/parser/HTMLEntitySearch.h \
-	Source/WebCore/html/parser/HTMLEntityTable.h \
-	Source/WebCore/html/parser/HTMLFormattingElementList.cpp \
-	Source/WebCore/html/parser/HTMLFormattingElementList.h \
-	Source/WebCore/html/parser/HTMLInputStream.h \
-	Source/WebCore/html/parser/HTMLMetaCharsetParser.cpp \
-	Source/WebCore/html/parser/HTMLMetaCharsetParser.h \
-	Source/WebCore/html/parser/HTMLParserIdioms.cpp \
-	Source/WebCore/html/parser/HTMLParserIdioms.h \
-	Source/WebCore/html/parser/HTMLParserScheduler.cpp \
-	Source/WebCore/html/parser/HTMLParserScheduler.h \
-	Source/WebCore/html/parser/HTMLPreloadScanner.cpp \
-	Source/WebCore/html/parser/HTMLPreloadScanner.h \
-	Source/WebCore/html/parser/HTMLScriptRunner.cpp \
-	Source/WebCore/html/parser/HTMLScriptRunner.h \
-	Source/WebCore/html/parser/HTMLScriptRunnerHost.h \
-	Source/WebCore/html/parser/HTMLSourceTracker.cpp \
-	Source/WebCore/html/parser/HTMLSourceTracker.h \
-	Source/WebCore/html/parser/HTMLToken.h \
-	Source/WebCore/html/parser/HTMLTokenizer.cpp \
-	Source/WebCore/html/parser/HTMLTokenizer.h \
-	Source/WebCore/html/parser/HTMLTreeBuilder.cpp \
-	Source/WebCore/html/parser/HTMLTreeBuilder.h \
-	Source/WebCore/html/parser/HTMLViewSourceParser.cpp \
-	Source/WebCore/html/parser/HTMLViewSourceParser.h \
-	Source/WebCore/html/parser/NestingLevelIncrementer.h \
-	Source/WebCore/html/parser/TextDocumentParser.cpp \
-	Source/WebCore/html/parser/TextDocumentParser.h \
-	Source/WebCore/html/parser/TextViewSourceParser.cpp \
-	Source/WebCore/html/parser/TextViewSourceParser.h \
-	Source/WebCore/html/parser/XSSFilter.cpp \
-	Source/WebCore/html/parser/XSSFilter.h \
-	Source/WebCore/html/shadow/MediaControls.cpp \
-	Source/WebCore/html/shadow/MediaControls.h \
-	Source/WebCore/html/shadow/ProgressBarValueElement.h \
-	Source/WebCore/html/shadow/SliderThumbElement.cpp \
-	Source/WebCore/html/shadow/SliderThumbElement.h \
-	Source/WebCore/html/shadow/TextControlInnerElements.cpp \
-	Source/WebCore/html/shadow/TextControlInnerElements.h \
-	Source/WebCore/html/PasswordInputType.cpp \
-	Source/WebCore/html/PasswordInputType.h \
-	Source/WebCore/html/PluginDocument.cpp \
-	Source/WebCore/html/PluginDocument.h \
-	Source/WebCore/html/RadioInputType.cpp \
-	Source/WebCore/html/RadioInputType.h \
-	Source/WebCore/html/RangeInputType.cpp \
-	Source/WebCore/html/RangeInputType.h \
-	Source/WebCore/html/ResetInputType.cpp \
-	Source/WebCore/html/ResetInputType.h \
-	Source/WebCore/html/SearchInputType.cpp \
-	Source/WebCore/html/SearchInputType.h \
-	Source/WebCore/html/StepRange.cpp \
-	Source/WebCore/html/StepRange.h \
-	Source/WebCore/html/SubmitInputType.cpp \
-	Source/WebCore/html/SubmitInputType.h \
-	Source/WebCore/html/TelephoneInputType.cpp \
-	Source/WebCore/html/TelephoneInputType.h \
-	Source/WebCore/html/TextDocument.cpp \
-	Source/WebCore/html/TextDocument.h \
-	Source/WebCore/html/TextFieldInputType.cpp \
-	Source/WebCore/html/TextFieldInputType.h \
-	Source/WebCore/html/TextInputType.cpp \
-	Source/WebCore/html/TextInputType.h \
-	Source/WebCore/html/TextMetrics.h \
-	Source/WebCore/html/TimeInputType.cpp \
-	Source/WebCore/html/TimeInputType.h \
-	Source/WebCore/html/TimeRanges.cpp \
-	Source/WebCore/html/TimeRanges.h \
-	Source/WebCore/html/URLInputType.cpp \
-	Source/WebCore/html/URLInputType.h \
-	Source/WebCore/html/ValidationMessage.cpp \
-	Source/WebCore/html/ValidationMessage.h \
-	Source/WebCore/html/ValidityState.cpp \
-	Source/WebCore/html/ValidityState.h \
-	Source/WebCore/html/VoidCallback.h \
-	Source/WebCore/html/WeekInputType.cpp \
-	Source/WebCore/html/WeekInputType.h \
-	Source/WebCore/icu/unicode/parseerr.h \
-	Source/WebCore/icu/unicode/platform.h \
-	Source/WebCore/icu/unicode/putil.h \
-	Source/WebCore/icu/unicode/ubrk.h \
-	Source/WebCore/icu/unicode/uchar.h \
-	Source/WebCore/icu/unicode/ucnv_cb.h \
-	Source/WebCore/icu/unicode/ucnv_err.h \
-	Source/WebCore/icu/unicode/ucnv.h \
-	Source/WebCore/icu/unicode/ucol.h \
-	Source/WebCore/icu/unicode/uconfig.h \
-	Source/WebCore/icu/unicode/uenum.h \
-	Source/WebCore/icu/unicode/uidna.h \
-	Source/WebCore/icu/unicode/uiter.h \
-	Source/WebCore/icu/unicode/uloc.h \
-	Source/WebCore/icu/unicode/umachine.h \
-	Source/WebCore/icu/unicode/unorm.h \
-	Source/WebCore/icu/unicode/urename.h \
-	Source/WebCore/icu/unicode/uscript.h \
-	Source/WebCore/icu/unicode/uset.h \
-	Source/WebCore/icu/unicode/ushape.h \
-	Source/WebCore/icu/unicode/ustring.h \
-	Source/WebCore/icu/unicode/utf16.h \
-	Source/WebCore/icu/unicode/utf8.h \
-	Source/WebCore/icu/unicode/utf.h \
-	Source/WebCore/icu/unicode/utf_old.h \
-	Source/WebCore/icu/unicode/utypes.h \
-	Source/WebCore/icu/unicode/uversion.h \
-	Source/WebCore/inspector/ConsoleMessage.cpp \
-	Source/WebCore/inspector/ConsoleMessage.h \
-	Source/WebCore/inspector/DOMNodeHighlighter.cpp \
-	Source/WebCore/inspector/DOMNodeHighlighter.h \
-	Source/WebCore/inspector/InjectedScript.cpp \
-	Source/WebCore/inspector/InjectedScript.h \
-	Source/WebCore/inspector/InjectedScriptHost.cpp \
-	Source/WebCore/inspector/InjectedScriptHost.h \
-	Source/WebCore/inspector/InjectedScriptManager.cpp \
-	Source/WebCore/inspector/InjectedScriptManager.h \
-	Source/WebCore/inspector/InspectorAgent.cpp \
-	Source/WebCore/inspector/InspectorAgent.h \
-	Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp \
-	Source/WebCore/inspector/InspectorApplicationCacheAgent.h \
-	Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp \
-	Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h \
-	Source/WebCore/inspector/InspectorClient.cpp \
-	Source/WebCore/inspector/InspectorClient.h \
-	Source/WebCore/inspector/InspectorController.cpp \
-	Source/WebCore/inspector/InspectorController.h \
-	Source/WebCore/inspector/InspectorConsoleAgent.cpp \
-	Source/WebCore/inspector/InspectorConsoleAgent.h \
-	Source/WebCore/inspector/InspectorConsoleInstrumentation.h \
-	Source/WebCore/inspector/InspectorCSSAgent.cpp \
-	Source/WebCore/inspector/InspectorCSSAgent.h \
-	Source/WebCore/inspector/InspectorDatabaseAgent.cpp \
-	Source/WebCore/inspector/InspectorDatabaseAgent.h \
-	Source/WebCore/inspector/InspectorDatabaseInstrumentation.h \
-	Source/WebCore/inspector/InspectorDatabaseResource.cpp \
-	Source/WebCore/inspector/InspectorDatabaseResource.h \
-	Source/WebCore/inspector/InspectorDebuggerAgent.cpp \
-	Source/WebCore/inspector/InspectorDebuggerAgent.h \
-	Source/WebCore/inspector/InspectorDOMAgent.cpp \
-	Source/WebCore/inspector/InspectorDOMAgent.h \
-	Source/WebCore/inspector/InspectorDOMStorageAgent.cpp \
-	Source/WebCore/inspector/InspectorDOMStorageAgent.h \
-	Source/WebCore/inspector/InspectorDOMStorageResource.cpp \
-	Source/WebCore/inspector/InspectorDOMStorageResource.h \
-	Source/WebCore/inspector/InspectorFrontendClient.h \
-	Source/WebCore/inspector/InspectorFrontendClientLocal.cpp \
-	Source/WebCore/inspector/InspectorFrontendClientLocal.h \
-	Source/WebCore/inspector/InspectorFrontendHost.cpp \
-	Source/WebCore/inspector/InspectorFrontendHost.h \
-	Source/WebCore/inspector/InspectorInstrumentation.cpp \
-	Source/WebCore/inspector/InspectorInstrumentation.h \
-	Source/WebCore/inspector/InspectorPageAgent.cpp \
-	Source/WebCore/inspector/InspectorPageAgent.h \
-	Source/WebCore/inspector/InspectorProfilerAgent.cpp \
-	Source/WebCore/inspector/InspectorProfilerAgent.h \
-	Source/WebCore/inspector/InspectorResourceAgent.cpp \
-	Source/WebCore/inspector/InspectorResourceAgent.h \
-	Source/WebCore/inspector/InspectorRuntimeAgent.cpp \
-	Source/WebCore/inspector/InspectorRuntimeAgent.h \
-	Source/WebCore/inspector/InspectorState.cpp \
-	Source/WebCore/inspector/InspectorState.h \
-	Source/WebCore/inspector/InspectorStyleSheet.cpp \
-	Source/WebCore/inspector/InspectorStyleSheet.h \
-	Source/WebCore/inspector/InspectorTimelineAgent.cpp \
-	Source/WebCore/inspector/InspectorTimelineAgent.h \
-	Source/WebCore/inspector/InspectorValues.cpp \
-	Source/WebCore/inspector/InspectorValues.h \
-	Source/WebCore/inspector/InspectorWorkerResource.h \
-	Source/WebCore/inspector/InstrumentingAgents.h \
-	Source/WebCore/inspector/PageDebuggerAgent.cpp \
-	Source/WebCore/inspector/PageDebuggerAgent.h \
-	Source/WebCore/inspector/ScriptArguments.cpp \
-	Source/WebCore/inspector/ScriptArguments.h \
-	Source/WebCore/inspector/ScriptBreakpoint.h \
-	Source/WebCore/inspector/ScriptCallFrame.cpp \
-	Source/WebCore/inspector/ScriptCallFrame.h \
-	Source/WebCore/inspector/ScriptCallStack.cpp \
-	Source/WebCore/inspector/ScriptCallStack.h \
-	Source/WebCore/inspector/ScriptDebugListener.h \
-	Source/WebCore/inspector/ScriptGCEventListener.h \
-	Source/WebCore/inspector/TimelineRecordFactory.cpp \
-	Source/WebCore/inspector/TimelineRecordFactory.h \
-	Source/WebCore/inspector/WorkerDebuggerAgent.cpp \
-	Source/WebCore/inspector/WorkerDebuggerAgent.h \
-	Source/WebCore/loader/appcache/ApplicationCache.cpp \
-	Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp \
-	Source/WebCore/loader/appcache/ApplicationCacheGroup.h \
-	Source/WebCore/loader/appcache/ApplicationCache.h \
-	Source/WebCore/loader/appcache/ApplicationCacheHost.cpp \
-	Source/WebCore/loader/appcache/ApplicationCacheHost.h \
-	Source/WebCore/loader/appcache/ApplicationCacheResource.cpp \
-	Source/WebCore/loader/appcache/ApplicationCacheResource.h \
-	Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp \
-	Source/WebCore/loader/appcache/ApplicationCacheStorage.h \
-	Source/WebCore/loader/appcache/DOMApplicationCache.cpp \
-	Source/WebCore/loader/appcache/DOMApplicationCache.h \
-	Source/WebCore/loader/appcache/ManifestParser.cpp \
-	Source/WebCore/loader/appcache/ManifestParser.h \
-	Source/WebCore/loader/archive/ArchiveFactory.cpp \
-	Source/WebCore/loader/archive/ArchiveFactory.h \
-	Source/WebCore/loader/archive/Archive.h \
-	Source/WebCore/loader/archive/ArchiveResourceCollection.cpp \
-	Source/WebCore/loader/archive/ArchiveResourceCollection.h \
-	Source/WebCore/loader/archive/ArchiveResource.cpp \
-	Source/WebCore/loader/archive/ArchiveResource.h \
-	Source/WebCore/loader/cache/MemoryCache.cpp \
-	Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp \
-	Source/WebCore/loader/cache/CachedCSSStyleSheet.h \
-	Source/WebCore/loader/cache/CachedFont.cpp \
-	Source/WebCore/loader/cache/CachedFont.h \
-	Source/WebCore/loader/cache/CachedImage.cpp \
-	Source/WebCore/loader/cache/CachedImage.h \
-	Source/WebCore/loader/cache/CachedResourceClient.h \
-	Source/WebCore/loader/cache/CachedResourceClientWalker.cpp \
-	Source/WebCore/loader/cache/CachedResourceClientWalker.h \
-	Source/WebCore/loader/cache/CachedResource.cpp \
-	Source/WebCore/loader/cache/CachedResource.h \
-	Source/WebCore/loader/cache/CachedResourceHandle.cpp \
-	Source/WebCore/loader/cache/CachedResourceHandle.h \
-	Source/WebCore/loader/cache/CachedResourceLoader.cpp \
-	Source/WebCore/loader/cache/CachedResourceLoader.h \
-	Source/WebCore/loader/cache/CachedResourceRequest.cpp \
-	Source/WebCore/loader/cache/CachedResourceRequest.h \
-	Source/WebCore/loader/cache/CachedScript.cpp \
-	Source/WebCore/loader/cache/CachedScript.h \
-	Source/WebCore/loader/cache/CachedXSLStyleSheet.cpp \
-	Source/WebCore/loader/cache/CachedXSLStyleSheet.h \
-	Source/WebCore/loader/cache/MemoryCache.h \
-	Source/WebCore/loader/cache/CachePolicy.h \
-	Source/WebCore/loader/CachedMetadata.h \
-	Source/WebCore/loader/CrossOriginAccessControl.cpp \
-	Source/WebCore/loader/CrossOriginAccessControl.h \
-	Source/WebCore/loader/CrossOriginPreflightResultCache.cpp \
-	Source/WebCore/loader/CrossOriginPreflightResultCache.h \
-	Source/WebCore/loader/DocumentLoader.cpp \
-	Source/WebCore/loader/DocumentLoader.h \
-	Source/WebCore/loader/DocumentLoadTiming.h \
-	Source/WebCore/loader/DocumentThreadableLoader.cpp \
-	Source/WebCore/loader/DocumentThreadableLoader.h \
-	Source/WebCore/loader/DocumentThreadableLoaderClient.h \
-	Source/WebCore/loader/DocumentWriter.cpp \
-	Source/WebCore/loader/DocumentWriter.h \
-	Source/WebCore/loader/EmptyClients.h \
-	Source/WebCore/loader/FormState.cpp \
-	Source/WebCore/loader/FormState.h \
-	Source/WebCore/loader/FormSubmission.cpp \
-	Source/WebCore/loader/FormSubmission.h \
-	Source/WebCore/loader/FrameLoaderClient.h \
-	Source/WebCore/loader/FrameLoader.cpp \
-	Source/WebCore/loader/FrameLoader.h \
-	Source/WebCore/loader/FrameLoaderStateMachine.cpp \
-	Source/WebCore/loader/FrameLoaderStateMachine.h \
-	Source/WebCore/loader/FrameLoaderTypes.h \
-	Source/WebCore/loader/FrameNetworkingContext.h \
-	Source/WebCore/loader/FTPDirectoryParser.cpp \
-	Source/WebCore/loader/FTPDirectoryParser.h \
-	Source/WebCore/loader/HistoryController.cpp \
-	Source/WebCore/loader/HistoryController.h \
-	Source/WebCore/loader/icon/IconDatabaseClient.h \
-	Source/WebCore/loader/icon/IconDatabase.cpp \
-	Source/WebCore/loader/icon/IconDatabase.h \
-	Source/WebCore/loader/icon/IconDatabaseBase.cpp \
-	Source/WebCore/loader/icon/IconDatabaseBase.h \
-	Source/WebCore/loader/icon/IconLoader.cpp \
-	Source/WebCore/loader/icon/IconLoader.h \
-	Source/WebCore/loader/icon/IconRecord.cpp \
-	Source/WebCore/loader/icon/IconRecord.h \
-	Source/WebCore/loader/icon/PageURLRecord.cpp \
-	Source/WebCore/loader/icon/PageURLRecord.h \
-	Source/WebCore/loader/ImageLoader.cpp \
-	Source/WebCore/loader/ImageLoader.h \
-	Source/WebCore/loader/MainResourceLoader.cpp \
-	Source/WebCore/loader/MainResourceLoader.h \
-	Source/WebCore/loader/NavigationAction.cpp \
-	Source/WebCore/loader/NavigationAction.h \
-	Source/WebCore/loader/NetscapePlugInStreamLoader.cpp \
-	Source/WebCore/loader/NetscapePlugInStreamLoader.h \
-	Source/WebCore/loader/PingLoader.cpp \
-	Source/WebCore/loader/PingLoader.h \
-	Source/WebCore/loader/PlaceholderDocument.cpp \
-	Source/WebCore/loader/PlaceholderDocument.h \
-	Source/WebCore/loader/PolicyCallback.cpp \
-	Source/WebCore/loader/PolicyCallback.h \
-	Source/WebCore/loader/PolicyChecker.cpp \
-	Source/WebCore/loader/PolicyChecker.h \
-	Source/WebCore/loader/ProgressTracker.cpp \
-	Source/WebCore/loader/ProgressTracker.h \
-	Source/WebCore/loader/NavigationScheduler.cpp \
-	Source/WebCore/loader/NavigationScheduler.h \
-	Source/WebCore/loader/ResourceLoader.cpp \
-	Source/WebCore/loader/ResourceLoader.h \
-	Source/WebCore/loader/ResourceLoadNotifier.cpp \
-	Source/WebCore/loader/ResourceLoadNotifier.h \
-	Source/WebCore/loader/ResourceLoadScheduler.cpp \
-	Source/WebCore/loader/ResourceLoadScheduler.h \
-	Source/WebCore/loader/SinkDocument.cpp \
-	Source/WebCore/loader/SinkDocument.h \
-	Source/WebCore/loader/SubframeLoader.cpp \
-	Source/WebCore/loader/SubframeLoader.h \
-	Source/WebCore/loader/SubresourceLoaderClient.h \
-	Source/WebCore/loader/SubresourceLoader.cpp \
-	Source/WebCore/loader/SubresourceLoader.h \
-	Source/WebCore/loader/SubstituteData.h \
-	Source/WebCore/loader/SubstituteResource.h \
-	Source/WebCore/loader/TextResourceDecoder.cpp \
-	Source/WebCore/loader/TextResourceDecoder.h \
-	Source/WebCore/loader/ThreadableLoaderClient.h \
-	Source/WebCore/loader/ThreadableLoaderClientWrapper.h \
-	Source/WebCore/loader/ThreadableLoader.cpp \
-	Source/WebCore/loader/ThreadableLoader.h \
-	Source/WebCore/loader/WorkerThreadableLoader.cpp \
-	Source/WebCore/loader/WorkerThreadableLoader.h \
-	Source/WebCore/mathml/MathMLElement.cpp \
-	Source/WebCore/mathml/MathMLElement.h \
-	Source/WebCore/mathml/MathMLInlineContainerElement.cpp \
-	Source/WebCore/mathml/MathMLInlineContainerElement.h  \
-	Source/WebCore/mathml/MathMLMathElement.cpp \
-	Source/WebCore/mathml/MathMLMathElement.h \
-	Source/WebCore/mathml/MathMLTextElement.cpp \
-	Source/WebCore/mathml/MathMLTextElement.h \
-	Source/WebCore/notifications/NotificationCenter.cpp \
-	Source/WebCore/notifications/NotificationCenter.h \
-	Source/WebCore/notifications/NotificationContents.h \
-	Source/WebCore/notifications/Notification.cpp \
-	Source/WebCore/notifications/Notification.h \
-	Source/WebCore/notifications/NotificationPresenter.h \
-	Source/WebCore/page/animation/AnimationBase.cpp \
-	Source/WebCore/page/animation/AnimationBase.h \
-	Source/WebCore/page/animation/AnimationController.cpp \
-	Source/WebCore/page/animation/AnimationController.h \
-	Source/WebCore/page/animation/AnimationControllerPrivate.h \
-	Source/WebCore/page/animation/CompositeAnimation.cpp \
-	Source/WebCore/page/animation/CompositeAnimation.h \
-	Source/WebCore/page/animation/ImplicitAnimation.cpp \
-	Source/WebCore/page/animation/ImplicitAnimation.h \
-	Source/WebCore/page/animation/KeyframeAnimation.cpp \
-	Source/WebCore/page/animation/KeyframeAnimation.h \
-	Source/WebCore/page/BarInfo.cpp \
-	Source/WebCore/page/BarInfo.h \
-	Source/WebCore/page/Chrome.cpp \
-	Source/WebCore/page/Chrome.h \
-	Source/WebCore/page/ChromeClient.h \
-	Source/WebCore/page/Console.cpp \
-	Source/WebCore/page/Console.h \
-	Source/WebCore/page/ContentSecurityPolicy.cpp \
-	Source/WebCore/page/ContentSecurityPolicy.h \
-	Source/WebCore/page/ContextMenuClient.h \
-	Source/WebCore/page/ContextMenuController.cpp \
-	Source/WebCore/page/ContextMenuController.h \
-	Source/WebCore/page/ContextMenuProvider.h \
-	Source/WebCore/page/Coordinates.h \
-	Source/WebCore/page/Crypto.cpp \
-	Source/WebCore/page/Crypto.h \
-	Source/WebCore/page/DOMSelection.cpp \
-	Source/WebCore/page/DOMSelection.h \
-	Source/WebCore/page/DOMTimer.cpp \
-	Source/WebCore/page/DOMTimer.h \
-	Source/WebCore/page/DOMWindow.cpp \
-	Source/WebCore/page/DOMWindow.h \
-	Source/WebCore/page/DragActions.h \
-	Source/WebCore/page/DragClient.h \
-	Source/WebCore/page/DragController.cpp \
-	Source/WebCore/page/DragController.h \
-	Source/WebCore/page/EditorClient.h \
-	Source/WebCore/page/EventHandler.cpp \
-	Source/WebCore/page/EventHandler.h \
-	Source/WebCore/page/EventSource.cpp \
-	Source/WebCore/page/EventSource.h \
-	Source/WebCore/page/FocusController.cpp \
-	Source/WebCore/page/FocusController.h \
-	Source/WebCore/page/FocusDirection.h \
-	Source/WebCore/page/Frame.cpp \
-	Source/WebCore/page/Frame.h \
-	Source/WebCore/page/FrameActionScheduler.cpp \
-	Source/WebCore/page/FrameActionScheduler.h \
-	Source/WebCore/page/FrameLoadRequest.h \
-	Source/WebCore/page/FrameTree.cpp \
-	Source/WebCore/page/FrameTree.h \
-	Source/WebCore/page/FrameView.cpp \
-	Source/WebCore/page/FrameView.h \
-	Source/WebCore/page/Geolocation.cpp \
-	Source/WebCore/page/Geolocation.h \
-	Source/WebCore/page/GeolocationClient.h \
-	Source/WebCore/page/GeolocationController.cpp \
-	Source/WebCore/page/GeolocationController.h \
-	Source/WebCore/page/GeolocationError.h \
-	Source/WebCore/page/GeolocationPosition.h \
-	Source/WebCore/page/GeolocationPositionCache.cpp \
-	Source/WebCore/page/GeolocationPositionCache.h \
-	Source/WebCore/page/Geoposition.h \
-	Source/WebCore/page/GroupSettings.cpp \
-	Source/WebCore/page/GroupSettings.h \
-	Source/WebCore/page/HaltablePlugin.h \
-	Source/WebCore/page/History.cpp \
-	Source/WebCore/page/History.h \
-	Source/WebCore/page/Location.cpp \
-	Source/WebCore/page/Location.h \
-	Source/WebCore/page/MediaCanStartListener.h \
-	Source/WebCore/page/MemoryInfo.cpp \
-	Source/WebCore/page/MemoryInfo.h \
-	Source/WebCore/page/MouseEventWithHitTestResults.cpp \
-	Source/WebCore/page/MouseEventWithHitTestResults.h \
-	Source/WebCore/page/Navigator.cpp \
-	Source/WebCore/page/Navigator.h \
-	Source/WebCore/page/NavigatorBase.cpp \
-	Source/WebCore/page/NavigatorBase.h \
-	Source/WebCore/page/OriginAccessEntry.cpp \
-	Source/WebCore/page/OriginAccessEntry.h \
-	Source/WebCore/page/Page.cpp \
-	Source/WebCore/page/Page.h \
-	Source/WebCore/page/PageGroup.cpp \
-	Source/WebCore/page/PageGroup.h \
-	Source/WebCore/page/PageGroupLoadDeferrer.cpp \
-	Source/WebCore/page/PageGroupLoadDeferrer.h \
-	Source/WebCore/page/Performance.cpp \
-	Source/WebCore/page/Performance.h \
-	Source/WebCore/page/PerformanceNavigation.cpp \
-	Source/WebCore/page/PerformanceNavigation.h \
-	Source/WebCore/page/PerformanceTiming.cpp \
-	Source/WebCore/page/PerformanceTiming.h \
-	Source/WebCore/page/PluginHalter.cpp \
-	Source/WebCore/page/PluginHalter.h \
-	Source/WebCore/page/PluginHalterClient.h \
-	Source/WebCore/page/PositionCallback.h \
-	Source/WebCore/page/PositionError.h \
-	Source/WebCore/page/PositionErrorCallback.h \
-	Source/WebCore/page/PositionOptions.h \
-	Source/WebCore/page/PrintContext.cpp \
-	Source/WebCore/page/PrintContext.h \
-	Source/WebCore/page/Screen.cpp \
-	Source/WebCore/page/Screen.h \
-	Source/WebCore/page/SecurityOrigin.cpp \
-	Source/WebCore/page/SecurityOrigin.h \
-	Source/WebCore/page/SecurityOriginHash.h \
-	Source/WebCore/page/Settings.cpp \
-	Source/WebCore/page/Settings.h \
-	Source/WebCore/page/SpatialNavigation.cpp \
-	Source/WebCore/page/SpatialNavigation.h \
-	Source/WebCore/page/SpeechInputClient.h \
-	Source/WebCore/page/SpeechInputEvent.cpp \
-	Source/WebCore/page/SpeechInputEvent.h \
-	Source/WebCore/page/SpeechInput.cpp \
-	Source/WebCore/page/SpeechInput.h \
-	Source/WebCore/page/SpeechInputListener.h \
-	Source/WebCore/page/SpeechInputResult.cpp \
-	Source/WebCore/page/SpeechInputResult.h \
-	Source/WebCore/page/SpeechInputResultList.cpp \
-	Source/WebCore/page/SpeechInputResultList.h \
-	Source/WebCore/page/SuspendableTimer.cpp \
-	Source/WebCore/page/SuspendableTimer.h \
-	Source/WebCore/page/UserContentTypes.h \
-	Source/WebCore/page/UserContentURLPattern.cpp \
-	Source/WebCore/page/UserContentURLPattern.h \
-	Source/WebCore/page/UserScript.h \
-	Source/WebCore/page/UserScriptTypes.h \
-	Source/WebCore/page/UserStyleSheet.h \
-	Source/WebCore/page/UserStyleSheetTypes.h \
-	Source/WebCore/page/WebCoreKeyboardUIMode.h \
-	Source/WebCore/page/WebKitAnimation.h \
-	Source/WebCore/page/WebKitAnimation.cpp \
-	Source/WebCore/page/WebKitAnimationList.h \
-	Source/WebCore/page/WebKitAnimationList.cpp \
-	Source/WebCore/page/WebKitPoint.h \
-	Source/WebCore/page/WindowFeatures.cpp \
-	Source/WebCore/page/WindowFeatures.h \
-	Source/WebCore/page/WorkerNavigator.cpp \
-	Source/WebCore/page/WorkerNavigator.h \
-	Source/WebCore/platform/animation/Animation.cpp \
-	Source/WebCore/platform/animation/Animation.h \
-	Source/WebCore/platform/animation/AnimationList.cpp \
-	Source/WebCore/platform/animation/AnimationList.h \
-	Source/WebCore/platform/animation/TimingFunction.h \
-	Source/WebCore/platform/Arena.cpp \
-	Source/WebCore/platform/Arena.h \
-	Source/WebCore/platform/AsyncFileStream.h \
-	Source/WebCore/platform/AsyncFileSystem.cpp \
-	Source/WebCore/platform/AsyncFileSystem.h \
-	Source/WebCore/platform/AutodrainedPool.h \
-	Source/WebCore/platform/ContentType.cpp \
-	Source/WebCore/platform/ContentType.h \
-	Source/WebCore/platform/ContextMenu.h \
-	Source/WebCore/platform/ContextMenuItem.h \
-	Source/WebCore/platform/Cookie.h \
-	Source/WebCore/platform/CookieJar.h \
-	Source/WebCore/platform/CrossThreadCopier.cpp \
-	Source/WebCore/platform/CrossThreadCopier.h \
-	Source/WebCore/platform/Cursor.cpp \
-	Source/WebCore/platform/Cursor.h \
-	Source/WebCore/platform/DefaultLocalizationStrategy.cpp \
-	Source/WebCore/platform/DefaultLocalizationStrategy.h \
-	Source/WebCore/platform/DragData.cpp \
-	Source/WebCore/platform/DragData.h \
-	Source/WebCore/platform/DragImage.cpp \
-	Source/WebCore/platform/DragImage.h \
-	Source/WebCore/platform/EventLoop.h \
-	Source/WebCore/platform/FileChooser.cpp \
-	Source/WebCore/platform/FileChooser.h \
-	Source/WebCore/platform/FileMetadata.h \
-	Source/WebCore/platform/FileStreamClient.h \
-	Source/WebCore/platform/FileStream.cpp \
-	Source/WebCore/platform/FileStream.h \
-	Source/WebCore/platform/FileSystem.cpp \
-	Source/WebCore/platform/FileSystem.h \
-	Source/WebCore/platform/FloatConversion.h \
-	Source/WebCore/platform/GeolocationService.cpp \
-	Source/WebCore/platform/GeolocationService.h \
-	Source/WebCore/platform/HashTools.h \
-	Source/WebCore/platform/graphics/BitmapImage.cpp \
-	Source/WebCore/platform/graphics/BitmapImage.h \
-	Source/WebCore/platform/graphics/Color.cpp \
-	Source/WebCore/platform/graphics/Color.h \
-	Source/WebCore/platform/graphics/ColorSpace.h \
-	Source/WebCore/platform/graphics/ContextShadow.cpp \
-	Source/WebCore/platform/graphics/ContextShadow.h \
-	Source/WebCore/platform/graphics/DashArray.h \
-	Source/WebCore/platform/graphics/filters/DistantLightSource.cpp \
-	Source/WebCore/platform/graphics/filters/DistantLightSource.h \
-	Source/WebCore/platform/graphics/filters/FEBlend.cpp \
-	Source/WebCore/platform/graphics/filters/FEBlend.h \
-	Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp \
-	Source/WebCore/platform/graphics/filters/FEColorMatrix.h \
-	Source/WebCore/platform/graphics/filters/FEComponentTransfer.cpp \
-	Source/WebCore/platform/graphics/filters/FEComponentTransfer.h \
-	Source/WebCore/platform/graphics/filters/FEComposite.cpp \
-	Source/WebCore/platform/graphics/filters/FEComposite.h \
-	Source/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp \
-	Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h \
-	Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp \
-	Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h \
-	Source/WebCore/platform/graphics/filters/FEDisplacementMap.cpp \
-	Source/WebCore/platform/graphics/filters/FEDisplacementMap.h \
-	Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp \
-	Source/WebCore/platform/graphics/filters/FEGaussianBlur.h \
-	Source/WebCore/platform/graphics/filters/FEFlood.cpp \
-	Source/WebCore/platform/graphics/filters/FEFlood.h \
-	Source/WebCore/platform/graphics/filters/FELighting.cpp \
-	Source/WebCore/platform/graphics/filters/FELighting.h \
-	Source/WebCore/platform/graphics/filters/FEMerge.cpp \
-	Source/WebCore/platform/graphics/filters/FEMerge.h \
-	Source/WebCore/platform/graphics/filters/FEMorphology.cpp \
-	Source/WebCore/platform/graphics/filters/FEMorphology.h \
-	Source/WebCore/platform/graphics/filters/FEOffset.cpp \
-	Source/WebCore/platform/graphics/filters/FEOffset.h \
-	Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp \
-	Source/WebCore/platform/graphics/filters/FESpecularLighting.h \
-	Source/WebCore/platform/graphics/filters/FETile.cpp \
-	Source/WebCore/platform/graphics/filters/FETile.h \
-	Source/WebCore/platform/graphics/filters/FETurbulence.cpp \
-	Source/WebCore/platform/graphics/filters/FETurbulence.h \
-	Source/WebCore/platform/graphics/filters/FilterEffect.cpp \
-	Source/WebCore/platform/graphics/filters/FilterEffect.h \
-	Source/WebCore/platform/graphics/filters/Filter.h \
-	Source/WebCore/platform/graphics/filters/LightSource.cpp \
-	Source/WebCore/platform/graphics/filters/LightSource.h \
-	Source/WebCore/platform/graphics/filters/PointLightSource.cpp \
-	Source/WebCore/platform/graphics/filters/PointLightSource.h \
-	Source/WebCore/platform/graphics/filters/SourceAlpha.cpp \
-	Source/WebCore/platform/graphics/filters/SourceAlpha.h \
-	Source/WebCore/platform/graphics/filters/SourceGraphic.cpp \
-	Source/WebCore/platform/graphics/filters/SourceGraphic.h \
-	Source/WebCore/platform/graphics/filters/SpotLightSource.cpp \
-	Source/WebCore/platform/graphics/filters/SpotLightSource.h \
-	Source/WebCore/platform/graphics/FloatPoint3D.cpp \
-	Source/WebCore/platform/graphics/FloatPoint3D.h \
-	Source/WebCore/platform/graphics/FloatPoint.cpp \
-	Source/WebCore/platform/graphics/FloatPoint.h \
-	Source/WebCore/platform/graphics/FloatQuad.cpp \
-	Source/WebCore/platform/graphics/FloatQuad.h \
-	Source/WebCore/platform/graphics/FloatRect.cpp \
-	Source/WebCore/platform/graphics/FloatRect.h \
-	Source/WebCore/platform/graphics/FloatSize.cpp \
-	Source/WebCore/platform/graphics/FloatSize.h \
-	Source/WebCore/platform/graphics/FontBaseline.h \
-	Source/WebCore/platform/graphics/FontCache.cpp \
-	Source/WebCore/platform/graphics/FontCache.h \
-	Source/WebCore/platform/graphics/Font.cpp \
-	Source/WebCore/platform/graphics/FontData.cpp \
-	Source/WebCore/platform/graphics/FontData.h \
-	Source/WebCore/platform/graphics/FontDescription.cpp \
-	Source/WebCore/platform/graphics/FontDescription.h \
-	Source/WebCore/platform/graphics/FontFallbackList.cpp \
-	Source/WebCore/platform/graphics/FontFallbackList.h \
-	Source/WebCore/platform/graphics/FontFamily.cpp \
-	Source/WebCore/platform/graphics/FontFamily.h \
-	Source/WebCore/platform/graphics/FontFastPath.cpp \
-	Source/WebCore/platform/graphics/Font.h \
-	Source/WebCore/platform/graphics/FontMetrics.h \
-	Source/WebCore/platform/graphics/FontOrientation.h \
-	Source/WebCore/platform/graphics/FontRenderingMode.h \
-	Source/WebCore/platform/graphics/FontSelector.h \
-	Source/WebCore/platform/graphics/FontSmoothingMode.h \
-	Source/WebCore/platform/graphics/FontTraitsMask.h \
-	Source/WebCore/platform/graphics/FontWidthVariant.h \
-	Source/WebCore/platform/graphics/GeneratedImage.cpp \
-	Source/WebCore/platform/graphics/GeneratedImage.h \
-	Source/WebCore/platform/graphics/Generator.h \
-	Source/WebCore/platform/graphics/GlyphBuffer.h \
-	Source/WebCore/platform/graphics/GlyphMetricsMap.h \
-	Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp \
-	Source/WebCore/platform/graphics/GlyphPageTreeNode.h \
-	Source/WebCore/platform/graphics/Gradient.cpp \
-	Source/WebCore/platform/graphics/Gradient.h \
-	Source/WebCore/platform/graphics/GraphicsContext.cpp \
-	Source/WebCore/platform/graphics/GraphicsContext.h \
-	Source/WebCore/platform/graphics/GraphicsLayer.h \
-	Source/WebCore/platform/graphics/GraphicsTypes.cpp \
-	Source/WebCore/platform/graphics/GraphicsTypes.h \
-	Source/WebCore/platform/graphics/GraphicsTypes3D.h \
-	Source/WebCore/platform/graphics/Icon.h \
-	Source/WebCore/platform/graphics/ImageBuffer.cpp \
-	Source/WebCore/platform/graphics/ImageBuffer.h \
-	Source/WebCore/platform/graphics/Image.cpp \
-	Source/WebCore/platform/graphics/Image.h \
-	Source/WebCore/platform/graphics/ImageObserver.h \
-	Source/WebCore/platform/graphics/ImageSource.cpp \
-	Source/WebCore/platform/graphics/ImageSource.h \
-	Source/WebCore/platform/graphics/IntPoint.h \
-	Source/WebCore/platform/graphics/IntPointHash.h \
-	Source/WebCore/platform/graphics/IntRect.cpp \
-	Source/WebCore/platform/graphics/IntRect.h \
-	Source/WebCore/platform/graphics/IntSize.h \
-	Source/WebCore/platform/graphics/IntSizeHash.h \
-	Source/WebCore/platform/graphics/MediaPlayer.cpp \
-	Source/WebCore/platform/graphics/MediaPlayer.h \
-	Source/WebCore/platform/graphics/MediaPlayerPrivate.h \
-	Source/WebCore/platform/graphics/Path.cpp \
-	Source/WebCore/platform/graphics/Path.h \
-	Source/WebCore/platform/graphics/PathTraversalState.cpp \
-	Source/WebCore/platform/graphics/PathTraversalState.h \
-	Source/WebCore/platform/graphics/Pattern.cpp \
-	Source/WebCore/platform/graphics/Pattern.h \
-	Source/WebCore/platform/graphics/RoundedIntRect.cpp \
-	Source/WebCore/platform/graphics/RoundedIntRect.h \
-	Source/WebCore/platform/graphics/SegmentedFontData.cpp \
-	Source/WebCore/platform/graphics/SegmentedFontData.h \
-	Source/WebCore/platform/graphics/SimpleFontData.cpp \
-	Source/WebCore/platform/graphics/SimpleFontData.h \
-	Source/WebCore/platform/graphics/StringTruncator.cpp \
-	Source/WebCore/platform/graphics/StringTruncator.h \
-	Source/WebCore/platform/graphics/StrokeStyleApplier.h \
-	Source/WebCore/platform/graphics/TextRenderingMode.h \
-	Source/WebCore/platform/graphics/TextRun.h \
-	Source/WebCore/platform/graphics/transforms/AffineTransform.cpp \
-	Source/WebCore/platform/graphics/transforms/AffineTransform.h \
-	Source/WebCore/platform/graphics/transforms/IdentityTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/RotateTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/RotateTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/ScaleTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/ScaleTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/SkewTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/SkewTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp \
-	Source/WebCore/platform/graphics/transforms/TransformationMatrix.h \
-	Source/WebCore/platform/graphics/transforms/TransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/TransformOperations.cpp \
-	Source/WebCore/platform/graphics/transforms/TransformOperations.h \
-	Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.h \
-	Source/WebCore/platform/graphics/TypesettingFeatures.h \
-	Source/WebCore/platform/graphics/UnitBezier.h \
-	Source/WebCore/platform/graphics/WidthIterator.cpp \
-	Source/WebCore/platform/graphics/WidthIterator.h \
-	Source/WebCore/platform/graphics/WOFFFileFormat.cpp \
-	Source/WebCore/platform/graphics/WOFFFileFormat.h \
-	Source/WebCore/platform/HostWindow.h \
-	Source/WebCore/platform/KillRing.h \
-	Source/WebCore/platform/KillRingNone.cpp \
-	Source/WebCore/platform/KURL.cpp \
-	Source/WebCore/platform/KURL.h \
-	Source/WebCore/platform/KURLHash.h \
-	Source/WebCore/platform/Language.cpp \
-	Source/WebCore/platform/Language.h \
-	Source/WebCore/platform/LengthBox.h \
-	Source/WebCore/platform/Length.cpp \
-	Source/WebCore/platform/Length.h \
-	Source/WebCore/platform/LengthSize.h \
-	Source/WebCore/platform/LinkHash.cpp \
-	Source/WebCore/platform/LinkHash.h \
-	Source/WebCore/platform/LocalizedStrings.h \
-	Source/WebCore/platform/Logging.cpp \
-	Source/WebCore/platform/Logging.h \
-	Source/WebCore/platform/MIMETypeRegistry.cpp \
-	Source/WebCore/platform/MIMETypeRegistry.h \
-	Source/WebCore/platform/mock/DeviceOrientationClientMock.cpp \
-	Source/WebCore/platform/mock/DeviceOrientationClientMock.h \
-	Source/WebCore/platform/mock/GeolocationClientMock.cpp \
-	Source/WebCore/platform/mock/GeolocationClientMock.h \
-	Source/WebCore/platform/mock/GeolocationServiceMock.cpp \
-	Source/WebCore/platform/mock/GeolocationServiceMock.h \
-	Source/WebCore/platform/mock/SpeechInputClientMock.cpp \
-	Source/WebCore/platform/mock/SpeechInputClientMock.h \
-	Source/WebCore/platform/network/AuthenticationChallengeBase.cpp \
-	Source/WebCore/platform/network/AuthenticationChallengeBase.h \
-	Source/WebCore/platform/network/AuthenticationClient.h \
-	Source/WebCore/platform/network/BlobData.cpp \
-	Source/WebCore/platform/network/BlobData.h \
-	Source/WebCore/platform/network/BlobRegistry.h \
-	Source/WebCore/platform/network/BlobRegistryImpl.cpp \
-	Source/WebCore/platform/network/BlobRegistryImpl.h \
-	Source/WebCore/platform/network/BlobResourceHandle.cpp \
-	Source/WebCore/platform/network/BlobResourceHandle.h \
-	Source/WebCore/platform/network/BlobStorageData.h \
-	Source/WebCore/platform/network/CookieStorage.h \
-	Source/WebCore/platform/network/Credential.cpp \
-	Source/WebCore/platform/network/Credential.h \
-	Source/WebCore/platform/network/DNS.h \
-	Source/WebCore/platform/network/FormDataBuilder.cpp \
-	Source/WebCore/platform/network/FormDataBuilder.h \
-	Source/WebCore/platform/network/FormData.cpp \
-	Source/WebCore/platform/network/FormData.h \
-	Source/WebCore/platform/network/HTTPHeaderMap.cpp \
-	Source/WebCore/platform/network/HTTPHeaderMap.h \
-	Source/WebCore/platform/network/HTTPParsers.cpp \
-	Source/WebCore/platform/network/HTTPParsers.h \
-	Source/WebCore/platform/network/NetworkingContext.h \
-	Source/WebCore/platform/network/ProxyServer.cpp \
-	Source/WebCore/platform/network/ProxyServer.h \
-	Source/WebCore/platform/network/NetworkStateNotifier.cpp \
-	Source/WebCore/platform/network/NetworkStateNotifier.h \
-	Source/WebCore/platform/network/ProtectionSpace.cpp \
-	Source/WebCore/platform/network/ProtectionSpace.h \
-	Source/WebCore/platform/network/ResourceErrorBase.cpp \
-	Source/WebCore/platform/network/ResourceErrorBase.h \
-	Source/WebCore/platform/network/ResourceHandleClient.h \
-	Source/WebCore/platform/network/ResourceHandle.cpp \
-	Source/WebCore/platform/network/ResourceHandle.h \
-	Source/WebCore/platform/network/ResourceHandleInternal.h \
-	Source/WebCore/platform/network/ResourceLoadInfo.h \
-	Source/WebCore/platform/network/ResourceLoadPriority.h \
-	Source/WebCore/platform/network/ResourceLoadTiming.h \
-	Source/WebCore/platform/network/ResourceRequestBase.cpp \
-	Source/WebCore/platform/network/ResourceRequestBase.h \
-	Source/WebCore/platform/network/ResourceResponseBase.cpp \
-	Source/WebCore/platform/network/ResourceResponseBase.h \
-	Source/WebCore/platform/network/SocketStreamErrorBase.cpp \
-	Source/WebCore/platform/network/SocketStreamErrorBase.h \
-	Source/WebCore/platform/network/SocketStreamHandleBase.cpp \
-	Source/WebCore/platform/network/SocketStreamHandleBase.h \
-	Source/WebCore/platform/network/SocketStreamHandleClient.h \
-	Source/WebCore/platform/NotImplemented.h \
-	Source/WebCore/platform/Pasteboard.h \
-	Source/WebCore/platform/PlatformKeyboardEvent.h \
-	Source/WebCore/platform/PlatformMenuDescription.h \
-	Source/WebCore/platform/PlatformMouseEvent.h \
-	Source/WebCore/platform/PlatformScreen.h \
-	Source/WebCore/platform/PlatformWheelEvent.h \
-	Source/WebCore/platform/PopupMenuClient.h \
-	Source/WebCore/platform/PopupMenu.h \
-	Source/WebCore/platform/PopupMenuStyle.h \
-	Source/WebCore/platform/PurgeableBuffer.h \
-	Source/WebCore/platform/PurgePriority.h \
-	Source/WebCore/platform/SchemeRegistry.cpp \
-	Source/WebCore/platform/SchemeRegistry.h \
-	Source/WebCore/platform/ScrollAnimator.cpp \
-	Source/WebCore/platform/ScrollAnimator.h \
-	Source/WebCore/platform/ScrollableArea.cpp \
-	Source/WebCore/platform/ScrollableArea.h \
-	Source/WebCore/platform/Scrollbar.cpp \
-	Source/WebCore/platform/Scrollbar.h \
-	Source/WebCore/platform/ScrollbarThemeComposite.cpp \
-	Source/WebCore/platform/ScrollbarThemeComposite.h \
-	Source/WebCore/platform/ScrollbarTheme.h \
-	Source/WebCore/platform/ScrollTypes.h \
-	Source/WebCore/platform/ScrollView.cpp \
-	Source/WebCore/platform/ScrollView.h \
-	Source/WebCore/platform/SearchPopupMenu.h \
-	Source/WebCore/platform/SecureTextInput.h \
-	Source/WebCore/platform/SharedBuffer.cpp \
-	Source/WebCore/platform/SharedBuffer.h \
-	Source/WebCore/platform/SharedTimer.h \
-	Source/WebCore/platform/Sound.h \
-	Source/WebCore/platform/sql/SQLiteAuthorizer.cpp \
-	Source/WebCore/platform/sql/SQLiteDatabase.cpp \
-	Source/WebCore/platform/sql/SQLiteDatabase.h \
-	Source/WebCore/platform/sql/SQLiteFileSystem.cpp \
-	Source/WebCore/platform/sql/SQLiteFileSystem.h \
-	Source/WebCore/platform/sql/SQLiteStatement.cpp \
-	Source/WebCore/platform/sql/SQLiteStatement.h \
-	Source/WebCore/platform/sql/SQLiteTransaction.cpp \
-	Source/WebCore/platform/sql/SQLiteTransaction.h \
-	Source/WebCore/platform/sql/SQLValue.cpp \
-	Source/WebCore/platform/sql/SQLValue.h \
-	Source/WebCore/platform/SSLKeyGenerator.h \
-	Source/WebCore/platform/SuddenTermination.h \
-	Source/WebCore/platform/SystemTime.h \
-	Source/WebCore/platform/text/Base64.cpp \
-	Source/WebCore/platform/text/Base64.h \
-	Source/WebCore/platform/text/BidiContext.cpp \
-	Source/WebCore/platform/text/BidiContext.h \
-	Source/WebCore/platform/text/BidiResolver.h \
-	Source/WebCore/platform/text/Hyphenation.cpp \
-	Source/WebCore/platform/text/Hyphenation.h \
-	Source/WebCore/platform/text/LineEnding.cpp \
-	Source/WebCore/platform/text/LineEnding.h \
-	Source/WebCore/platform/text/LocalizedNumber.h \
-	Source/WebCore/platform/text/LocalizedNumberNone.cpp \
-	Source/WebCore/platform/text/ParserUtilities.h \
-	Source/WebCore/platform/text/PlatformString.h \
-	Source/WebCore/platform/text/RegularExpression.cpp \
-	Source/WebCore/platform/text/RegularExpression.h \
-	Source/WebCore/platform/text/SegmentedString.cpp \
-	Source/WebCore/platform/text/SegmentedString.h \
-	Source/WebCore/platform/text/String.cpp \
-	Source/WebCore/platform/text/SuffixTree.h \
-	Source/WebCore/platform/text/TextBoundaries.cpp \
-	Source/WebCore/platform/text/TextBoundaries.h \
-	Source/WebCore/platform/text/TextBreakIterator.h \
-	Source/WebCore/platform/text/TextCheckerClient.h \
-	Source/WebCore/platform/text/TextCodec.cpp \
-	Source/WebCore/platform/text/TextCodec.h \
-	Source/WebCore/platform/text/TextCodecASCIIFastPath.h \
-	Source/WebCore/platform/text/TextCodecLatin1.cpp \
-	Source/WebCore/platform/text/TextCodecLatin1.h \
-	Source/WebCore/platform/text/TextCodecUserDefined.cpp \
-	Source/WebCore/platform/text/TextCodecUserDefined.h \
-	Source/WebCore/platform/text/TextCodecUTF16.cpp \
-	Source/WebCore/platform/text/TextCodecUTF16.h \
-	Source/WebCore/platform/text/TextCodecUTF8.cpp \
-	Source/WebCore/platform/text/TextCodecUTF8.h \
-	Source/WebCore/platform/text/TextDirection.h \
-	Source/WebCore/platform/text/TextEncoding.cpp \
-	Source/WebCore/platform/text/TextEncodingDetector.h \
-	Source/WebCore/platform/text/TextEncodingDetectorNone.cpp \
-	Source/WebCore/platform/text/TextEncoding.h \
-	Source/WebCore/platform/text/TextEncodingRegistry.cpp \
-	Source/WebCore/platform/text/TextEncodingRegistry.h \
-	Source/WebCore/platform/text/TextOrientation.h \
-	Source/WebCore/platform/text/TextStream.cpp \
-	Source/WebCore/platform/text/TextStream.h \
-	Source/WebCore/platform/text/transcoder/FontTranscoder.cpp \
-	Source/WebCore/platform/text/transcoder/FontTranscoder.h \
-	Source/WebCore/platform/text/UnicodeRange.cpp \
-	Source/WebCore/platform/text/UnicodeRange.h \
-	Source/WebCore/platform/ThemeTypes.h \
-	Source/WebCore/platform/ThreadCheck.h \
-	Source/WebCore/platform/ThreadGlobalData.cpp \
-	Source/WebCore/platform/ThreadGlobalData.h \
-	Source/WebCore/platform/ThreadTimers.cpp \
-	Source/WebCore/platform/ThreadTimers.h \
-	Source/WebCore/platform/Timer.cpp \
-	Source/WebCore/platform/Timer.h \
-	Source/WebCore/platform/TreeShared.h \
-	Source/WebCore/platform/URLString.h \
-	Source/WebCore/platform/UUID.cpp \
-	Source/WebCore/platform/UUID.h \
-	Source/WebCore/platform/Widget.cpp \
-	Source/WebCore/platform/Widget.h \
-	Source/WebCore/platform/WindowsKeyboardCodes.h \
-	Source/WebCore/plugins/DOMMimeTypeArray.cpp \
-	Source/WebCore/plugins/DOMMimeTypeArray.h \
-	Source/WebCore/plugins/DOMMimeType.cpp \
-	Source/WebCore/plugins/DOMMimeType.h \
-	Source/WebCore/plugins/DOMPluginArray.cpp \
-	Source/WebCore/plugins/DOMPluginArray.h \
-	Source/WebCore/plugins/DOMPlugin.cpp \
-	Source/WebCore/plugins/DOMPlugin.h \
-	Source/WebCore/plugins/npapi.cpp \
-	Source/WebCore/plugins/npfunctions.h \
-	Source/WebCore/plugins/PluginDatabase.cpp \
-	Source/WebCore/plugins/PluginDatabase.h \
-	Source/WebCore/plugins/PluginData.cpp \
-	Source/WebCore/plugins/PluginData.h \
-	Source/WebCore/plugins/PluginDebug.cpp \
-	Source/WebCore/plugins/PluginDebug.h \
-	Source/WebCore/plugins/PluginMainThreadScheduler.cpp \
-	Source/WebCore/plugins/PluginMainThreadScheduler.h \
-	Source/WebCore/plugins/PluginPackage.cpp \
-	Source/WebCore/plugins/PluginPackage.h \
-	Source/WebCore/plugins/PluginQuirkSet.h \
-	Source/WebCore/plugins/PluginStream.cpp \
-	Source/WebCore/plugins/PluginStream.h \
-	Source/WebCore/plugins/PluginViewBase.h \
-	Source/WebCore/plugins/PluginView.cpp \
-	Source/WebCore/plugins/PluginView.h \
-	Source/WebCore/rendering/AutoTableLayout.cpp \
-	Source/WebCore/rendering/AutoTableLayout.h \
-	Source/WebCore/rendering/BidiRun.cpp \
-	Source/WebCore/rendering/BidiRun.h \
-	Source/WebCore/rendering/break_lines.cpp \
-	Source/WebCore/rendering/break_lines.h \
-	Source/WebCore/rendering/ColumnInfo.h \
-	Source/WebCore/rendering/CounterNode.cpp \
-	Source/WebCore/rendering/CounterNode.h \
-	Source/WebCore/rendering/EllipsisBox.cpp \
-	Source/WebCore/rendering/EllipsisBox.h \
-	Source/WebCore/rendering/FixedTableLayout.cpp \
-	Source/WebCore/rendering/FixedTableLayout.h \
-	Source/WebCore/rendering/GapRects.h \
-	Source/WebCore/rendering/HitTestRequest.h \
-	Source/WebCore/rendering/HitTestResult.cpp \
-	Source/WebCore/rendering/HitTestResult.h \
-	Source/WebCore/rendering/InlineBox.cpp \
-	Source/WebCore/rendering/InlineBox.h \
-	Source/WebCore/rendering/InlineFlowBox.cpp \
-	Source/WebCore/rendering/InlineFlowBox.h \
-	Source/WebCore/rendering/InlineIterator.h \
-	Source/WebCore/rendering/InlineTextBox.cpp \
-	Source/WebCore/rendering/InlineTextBox.h \
-	Source/WebCore/rendering/LayoutState.cpp \
-	Source/WebCore/rendering/LayoutState.h \
-	Source/WebCore/rendering/MediaControlElements.cpp \
-	Source/WebCore/rendering/MediaControlElements.h \
-	Source/WebCore/rendering/OverlapTestRequestClient.h \
-	Source/WebCore/rendering/PaintInfo.h \
-	Source/WebCore/rendering/PaintPhase.h \
-	Source/WebCore/rendering/PointerEventsHitRules.cpp \
-	Source/WebCore/rendering/PointerEventsHitRules.h \
-	Source/WebCore/rendering/RenderApplet.cpp \
-	Source/WebCore/rendering/RenderApplet.h \
-	Source/WebCore/rendering/RenderArena.cpp \
-	Source/WebCore/rendering/RenderArena.h \
-	Source/WebCore/rendering/RenderBlock.cpp \
-	Source/WebCore/rendering/RenderBlock.h \
-	Source/WebCore/rendering/RenderBlockLineLayout.cpp \
-	Source/WebCore/rendering/RenderBox.cpp \
-	Source/WebCore/rendering/RenderBox.h \
-	Source/WebCore/rendering/RenderBoxModelObject.cpp \
-	Source/WebCore/rendering/RenderBoxModelObject.h \
-	Source/WebCore/rendering/RenderBR.cpp \
-	Source/WebCore/rendering/RenderBR.h \
-	Source/WebCore/rendering/RenderButton.cpp \
-	Source/WebCore/rendering/RenderButton.h \
-	Source/WebCore/rendering/RenderCombineText.cpp \
-	Source/WebCore/rendering/RenderCombineText.h \
-	Source/WebCore/rendering/RenderCounter.cpp \
-	Source/WebCore/rendering/RenderCounter.h \
-	Source/WebCore/rendering/RenderDataGrid.cpp \
-	Source/WebCore/rendering/RenderDataGrid.h \
-	Source/WebCore/rendering/RenderDetails.cpp \
-	Source/WebCore/rendering/RenderDetails.h \
-	Source/WebCore/rendering/RenderDetailsMarker.cpp \
-	Source/WebCore/rendering/RenderDetailsMarker.h \
-	Source/WebCore/rendering/RenderEmbeddedObject.cpp \
-	Source/WebCore/rendering/RenderEmbeddedObject.h \
-	Source/WebCore/rendering/RenderFieldset.cpp \
-	Source/WebCore/rendering/RenderFieldset.h \
-	Source/WebCore/rendering/RenderFileUploadControl.cpp \
-	Source/WebCore/rendering/RenderFileUploadControl.h \
-	Source/WebCore/rendering/RenderFlexibleBox.cpp \
-	Source/WebCore/rendering/RenderFlexibleBox.h \
-	Source/WebCore/rendering/RenderFrameBase.cpp \
-	Source/WebCore/rendering/RenderFrameBase.h \
-	Source/WebCore/rendering/RenderFrame.cpp \
-	Source/WebCore/rendering/RenderFrame.h \
-	Source/WebCore/rendering/RenderFrameSet.cpp \
-	Source/WebCore/rendering/RenderFrameSet.h \
-	Source/WebCore/rendering/RenderFullScreen.cpp \
-	Source/WebCore/rendering/RenderFullScreen.h \
-	Source/WebCore/rendering/RenderHTMLCanvas.cpp \
-	Source/WebCore/rendering/RenderHTMLCanvas.h \
-	Source/WebCore/rendering/RenderIFrame.cpp \
-	Source/WebCore/rendering/RenderIFrame.h \
-	Source/WebCore/rendering/RenderImage.cpp \
-	Source/WebCore/rendering/RenderImage.h \
-	Source/WebCore/rendering/RenderImageResource.cpp \
-	Source/WebCore/rendering/RenderImageResource.h \
-	Source/WebCore/rendering/RenderImageResourceStyleImage.cpp \
-	Source/WebCore/rendering/RenderImageResourceStyleImage.h \
-	Source/WebCore/rendering/RenderIndicator.cpp \
-	Source/WebCore/rendering/RenderIndicator.h \
-	Source/WebCore/rendering/RenderInline.cpp \
-	Source/WebCore/rendering/RenderInline.h \
-	Source/WebCore/rendering/RenderLayerBacking.h \
-	Source/WebCore/rendering/RenderLayer.cpp \
-	Source/WebCore/rendering/RenderLayer.h \
-	Source/WebCore/rendering/RenderLineBoxList.cpp \
-	Source/WebCore/rendering/RenderLineBoxList.h \
-	Source/WebCore/rendering/RenderListBox.cpp \
-	Source/WebCore/rendering/RenderListBox.h \
-	Source/WebCore/rendering/RenderListItem.cpp \
-	Source/WebCore/rendering/RenderListItem.h \
-	Source/WebCore/rendering/RenderListMarker.cpp \
-	Source/WebCore/rendering/RenderListMarker.h \
-	Source/WebCore/rendering/RenderMarquee.cpp \
-	Source/WebCore/rendering/RenderMarquee.h \
-	Source/WebCore/rendering/RenderMedia.cpp \
-	Source/WebCore/rendering/RenderMedia.h \
-	Source/WebCore/rendering/RenderMenuList.cpp \
-	Source/WebCore/rendering/RenderMenuList.h \
-	Source/WebCore/rendering/RenderMeter.cpp \
-	Source/WebCore/rendering/RenderMeter.h \
-	Source/WebCore/rendering/RenderObjectChildList.cpp \
-	Source/WebCore/rendering/RenderObjectChildList.h \
-	Source/WebCore/rendering/RenderObject.cpp \
-	Source/WebCore/rendering/RenderObject.h \
-	Source/WebCore/rendering/RenderOverflow.h \
-	Source/WebCore/rendering/RenderPart.cpp \
-	Source/WebCore/rendering/RenderPart.h \
-	Source/WebCore/rendering/RenderProgress.cpp \
-	Source/WebCore/rendering/RenderProgress.h \
-	Source/WebCore/rendering/RenderQuote.cpp \
-	Source/WebCore/rendering/RenderQuote.h \
-	Source/WebCore/rendering/RenderReplaced.cpp \
-	Source/WebCore/rendering/RenderReplaced.h \
-	Source/WebCore/rendering/RenderReplica.cpp \
-	Source/WebCore/rendering/RenderReplica.h \
-	Source/WebCore/rendering/RenderRubyBase.cpp \
-	Source/WebCore/rendering/RenderRubyBase.h \
-	Source/WebCore/rendering/RenderRuby.cpp \
-	Source/WebCore/rendering/RenderRuby.h \
-	Source/WebCore/rendering/RenderRubyRun.cpp \
-	Source/WebCore/rendering/RenderRubyRun.h \
-	Source/WebCore/rendering/RenderRubyText.cpp \
-	Source/WebCore/rendering/RenderRubyText.h \
-	Source/WebCore/rendering/RenderScrollbar.cpp \
-	Source/WebCore/rendering/RenderScrollbar.h \
-	Source/WebCore/rendering/RenderScrollbarPart.cpp \
-	Source/WebCore/rendering/RenderScrollbarPart.h \
-	Source/WebCore/rendering/RenderScrollbarTheme.cpp \
-	Source/WebCore/rendering/RenderScrollbarTheme.h \
-	Source/WebCore/rendering/RenderSelectionInfo.h \
-	Source/WebCore/rendering/RenderSlider.cpp \
-	Source/WebCore/rendering/RenderSlider.h \
-	Source/WebCore/rendering/RenderSummary.cpp \
-	Source/WebCore/rendering/RenderSummary.h \
-	Source/WebCore/rendering/RenderTableCell.cpp \
-	Source/WebCore/rendering/RenderTableCell.h \
-	Source/WebCore/rendering/RenderTableCol.cpp \
-	Source/WebCore/rendering/RenderTableCol.h \
-	Source/WebCore/rendering/RenderTable.cpp \
-	Source/WebCore/rendering/RenderTable.h \
-	Source/WebCore/rendering/RenderTableRow.cpp \
-	Source/WebCore/rendering/RenderTableRow.h \
-	Source/WebCore/rendering/RenderTableSection.cpp \
-	Source/WebCore/rendering/RenderTableSection.h \
-	Source/WebCore/rendering/RenderTextControl.cpp \
-	Source/WebCore/rendering/RenderTextControl.h \
-	Source/WebCore/rendering/RenderTextControlMultiLine.cpp \
-	Source/WebCore/rendering/RenderTextControlMultiLine.h \
-	Source/WebCore/rendering/RenderTextControlSingleLine.cpp \
-	Source/WebCore/rendering/RenderTextControlSingleLine.h \
-	Source/WebCore/rendering/RenderText.cpp \
-	Source/WebCore/rendering/RenderTextFragment.cpp \
-	Source/WebCore/rendering/RenderTextFragment.h \
-	Source/WebCore/rendering/RenderText.h \
-	Source/WebCore/rendering/RenderTheme.cpp \
-	Source/WebCore/rendering/RenderTheme.h \
-	Source/WebCore/rendering/RenderTreeAsText.cpp \
-	Source/WebCore/rendering/RenderTreeAsText.h \
-	Source/WebCore/rendering/RenderVideo.cpp \
-	Source/WebCore/rendering/RenderVideo.h \
-	Source/WebCore/rendering/RenderView.cpp \
-	Source/WebCore/rendering/RenderView.h \
-	Source/WebCore/rendering/RenderWidget.cpp \
-	Source/WebCore/rendering/RenderWidget.h \
-	Source/WebCore/rendering/RenderWidgetProtector.h \
-	Source/WebCore/rendering/RenderWordBreak.cpp \
-	Source/WebCore/rendering/RenderWordBreak.h \
-	Source/WebCore/rendering/RootInlineBox.cpp \
-	Source/WebCore/rendering/RootInlineBox.h \
-	Source/WebCore/rendering/ScrollBehavior.cpp \
-	Source/WebCore/rendering/ScrollBehavior.h \
-	Source/WebCore/rendering/ShadowElement.cpp \
-	Source/WebCore/rendering/ShadowElement.h \
-	Source/WebCore/rendering/VerticalPositionCache.h \
-	Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLBlock.h \
-	Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLFenced.h \
-	Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLFraction.h \
-	Source/WebCore/rendering/mathml/RenderMathMLMath.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLMath.h \
-	Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLOperator.h \
-	Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLRoot.h \
-	Source/WebCore/rendering/mathml/RenderMathMLRow.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLRow.h \
-	Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h \
-	Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLSubSup.h \
-	Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp \
-	Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h \
-	Source/WebCore/rendering/style/BorderData.h \
-	Source/WebCore/rendering/style/BorderValue.h \
-	Source/WebCore/rendering/style/CollapsedBorderValue.h \
-	Source/WebCore/rendering/style/ContentData.cpp \
-	Source/WebCore/rendering/style/ContentData.h \
-	Source/WebCore/rendering/style/CounterContent.h \
-	Source/WebCore/rendering/style/CounterDirectives.cpp \
-	Source/WebCore/rendering/style/CounterDirectives.h \
-	Source/WebCore/rendering/style/CursorData.h \
-	Source/WebCore/rendering/style/CursorList.h \
-	Source/WebCore/rendering/style/DataRef.h \
-	Source/WebCore/rendering/style/FillLayer.cpp \
-	Source/WebCore/rendering/style/FillLayer.h \
-	Source/WebCore/rendering/style/KeyframeList.cpp \
-	Source/WebCore/rendering/style/KeyframeList.h \
-	Source/WebCore/rendering/style/LineClampValue.h \
-	Source/WebCore/rendering/style/NinePieceImage.cpp \
-	Source/WebCore/rendering/style/NinePieceImage.h \
-	Source/WebCore/rendering/style/OutlineValue.h \
-	Source/WebCore/rendering/style/QuotesData.cpp \
-	Source/WebCore/rendering/style/QuotesData.h \
-	Source/WebCore/rendering/style/RenderStyleConstants.h \
-	Source/WebCore/rendering/style/RenderStyle.cpp \
-	Source/WebCore/rendering/style/RenderStyle.h \
-	Source/WebCore/rendering/style/ShadowData.cpp \
-	Source/WebCore/rendering/style/ShadowData.h \
-	Source/WebCore/rendering/style/StyleBackgroundData.cpp \
-	Source/WebCore/rendering/style/StyleBackgroundData.h \
-	Source/WebCore/rendering/style/StyleBoxData.cpp \
-	Source/WebCore/rendering/style/StyleBoxData.h \
-	Source/WebCore/rendering/style/StyleCachedImage.cpp \
-	Source/WebCore/rendering/style/StyleCachedImage.h \
-	Source/WebCore/rendering/style/StyleDashboardRegion.h \
-	Source/WebCore/rendering/style/StyleFlexibleBoxData.cpp \
-	Source/WebCore/rendering/style/StyleFlexibleBoxData.h \
-	Source/WebCore/rendering/style/StyleGeneratedImage.cpp \
-	Source/WebCore/rendering/style/StyleGeneratedImage.h \
-	Source/WebCore/rendering/style/StyleImage.h \
-	Source/WebCore/rendering/style/StyleInheritedData.cpp \
-	Source/WebCore/rendering/style/StyleInheritedData.h \
-	Source/WebCore/rendering/style/StyleMarqueeData.cpp \
-	Source/WebCore/rendering/style/StyleMarqueeData.h \
-	Source/WebCore/rendering/style/StyleMultiColData.cpp \
-	Source/WebCore/rendering/style/StyleMultiColData.h \
-	Source/WebCore/rendering/style/StylePendingImage.h \
-	Source/WebCore/rendering/style/StyleRareInheritedData.cpp \
-	Source/WebCore/rendering/style/StyleRareInheritedData.h \
-	Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp \
-	Source/WebCore/rendering/style/StyleRareNonInheritedData.h \
-	Source/WebCore/rendering/style/StyleReflection.h \
-	Source/WebCore/rendering/style/StyleSurroundData.cpp \
-	Source/WebCore/rendering/style/StyleSurroundData.h \
-	Source/WebCore/rendering/style/StyleTransformData.cpp \
-	Source/WebCore/rendering/style/StyleTransformData.h \
-	Source/WebCore/rendering/style/StyleVisualData.cpp \
-	Source/WebCore/rendering/style/StyleVisualData.h \
-	Source/WebCore/rendering/style/SVGRenderStyle.cpp \
-	Source/WebCore/rendering/style/SVGRenderStyleDefs.cpp \
-	Source/WebCore/rendering/style/SVGRenderStyleDefs.h \
-	Source/WebCore/rendering/style/SVGRenderStyle.h \
-	Source/WebCore/rendering/svg/RenderSVGBlock.cpp \
-	Source/WebCore/rendering/svg/RenderSVGBlock.h \
-	Source/WebCore/rendering/svg/RenderSVGContainer.cpp \
-	Source/WebCore/rendering/svg/RenderSVGContainer.h \
-	Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp \
-	Source/WebCore/rendering/svg/RenderSVGForeignObject.h \
-	Source/WebCore/rendering/svg/RenderSVGGradientStop.cpp \
-	Source/WebCore/rendering/svg/RenderSVGGradientStop.h \
-	Source/WebCore/rendering/svg/RenderSVGHiddenContainer.cpp \
-	Source/WebCore/rendering/svg/RenderSVGHiddenContainer.h \
-	Source/WebCore/rendering/svg/RenderSVGImage.cpp \
-	Source/WebCore/rendering/svg/RenderSVGImage.h \
-	Source/WebCore/rendering/svg/RenderSVGInline.cpp \
-	Source/WebCore/rendering/svg/RenderSVGInline.h \
-	Source/WebCore/rendering/svg/RenderSVGInlineText.cpp \
-	Source/WebCore/rendering/svg/RenderSVGInlineText.h \
-	Source/WebCore/rendering/svg/RenderSVGModelObject.cpp \
-	Source/WebCore/rendering/svg/RenderSVGModelObject.h \
-	Source/WebCore/rendering/svg/RenderSVGPath.cpp \
-	Source/WebCore/rendering/svg/RenderSVGPath.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceClipper.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceContainer.h \
-	Source/WebCore/rendering/svg/RenderSVGResource.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceFilter.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceGradient.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceGradient.h \
-	Source/WebCore/rendering/svg/RenderSVGResource.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceLinearGradient.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceLinearGradient.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceMarker.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceMasker.h \
-	Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourcePattern.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceRadialGradient.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceRadialGradient.h \
-	Source/WebCore/rendering/svg/RenderSVGResourceSolidColor.cpp \
-	Source/WebCore/rendering/svg/RenderSVGResourceSolidColor.h \
-	Source/WebCore/rendering/svg/RenderSVGRoot.cpp \
-	Source/WebCore/rendering/svg/RenderSVGRoot.h \
-	Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp \
-	Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h \
-	Source/WebCore/rendering/svg/RenderSVGTSpan.cpp \
-	Source/WebCore/rendering/svg/RenderSVGTSpan.h \
-	Source/WebCore/rendering/svg/RenderSVGText.cpp \
-	Source/WebCore/rendering/svg/RenderSVGText.h \
-	Source/WebCore/rendering/svg/RenderSVGTextPath.cpp \
-	Source/WebCore/rendering/svg/RenderSVGTextPath.h \
-	Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp \
-	Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h \
-	Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp \
-	Source/WebCore/rendering/svg/RenderSVGViewportContainer.h \
-	Source/WebCore/rendering/svg/SVGImageBufferTools.cpp \
-	Source/WebCore/rendering/svg/SVGImageBufferTools.h \
-	Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp \
-	Source/WebCore/rendering/svg/SVGInlineFlowBox.h \
-	Source/WebCore/rendering/svg/SVGInlineTextBox.cpp \
-	Source/WebCore/rendering/svg/SVGInlineTextBox.h \
-	Source/WebCore/rendering/svg/SVGMarkerData.h \
-	Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.cpp \
-	Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.h \
-	Source/WebCore/rendering/svg/SVGRenderSupport.cpp \
-	Source/WebCore/rendering/svg/SVGRenderSupport.h \
-	Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp \
-	Source/WebCore/rendering/svg/SVGRenderTreeAsText.h \
-	Source/WebCore/rendering/svg/SVGResourcesCache.cpp \
-	Source/WebCore/rendering/svg/SVGResourcesCache.h \
-	Source/WebCore/rendering/svg/SVGResources.cpp \
-	Source/WebCore/rendering/svg/SVGResourcesCycleSolver.cpp \
-	Source/WebCore/rendering/svg/SVGResourcesCycleSolver.h \
-	Source/WebCore/rendering/svg/SVGResources.h \
-	Source/WebCore/rendering/svg/SVGRootInlineBox.cpp \
-	Source/WebCore/rendering/svg/SVGRootInlineBox.h \
-	Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp \
-	Source/WebCore/rendering/svg/SVGShadowTreeElements.h \
-	Source/WebCore/rendering/svg/SVGTextChunk.cpp \
-	Source/WebCore/rendering/svg/SVGTextChunk.h \
-	Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp \
-	Source/WebCore/rendering/svg/SVGTextChunkBuilder.h \
-	Source/WebCore/rendering/svg/SVGTextFragment.h \
-	Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp \
-	Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h \
-	Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp \
-	Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h \
-	Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp \
-	Source/WebCore/rendering/svg/SVGTextLayoutEngine.h \
-	Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp \
-	Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.h \
-	Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp \
-	Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.h \
-	Source/WebCore/rendering/svg/SVGTextMetrics.cpp \
-	Source/WebCore/rendering/svg/SVGTextMetrics.h \
-	Source/WebCore/rendering/svg/SVGTextQuery.cpp \
-	Source/WebCore/rendering/svg/SVGTextQuery.h \
-	Source/WebCore/rendering/TableLayout.h \
-	Source/WebCore/rendering/TrailingFloatsRootInlineBox.h \
-	Source/WebCore/rendering/TransformState.cpp \
-	Source/WebCore/rendering/TransformState.h \
-	Source/WebCore/storage/AbstractDatabase.cpp \
-	Source/WebCore/storage/AbstractDatabase.h \
-	Source/WebCore/storage/ChangeVersionWrapper.cpp \
-	Source/WebCore/storage/ChangeVersionWrapper.h \
-	Source/WebCore/storage/DatabaseAuthorizer.cpp \
-	Source/WebCore/storage/DatabaseAuthorizer.h \
-	Source/WebCore/storage/DatabaseCallback.h \
-	Source/WebCore/storage/Database.cpp \
-	Source/WebCore/storage/DatabaseDetails.h \
-	Source/WebCore/storage/Database.h \
-	Source/WebCore/storage/DatabaseSync.cpp \
-	Source/WebCore/storage/DatabaseSync.h \
-	Source/WebCore/storage/DatabaseTask.cpp \
-	Source/WebCore/storage/DatabaseTask.h \
-	Source/WebCore/storage/DatabaseThread.cpp \
-	Source/WebCore/storage/DatabaseThread.h \
-	Source/WebCore/storage/DatabaseTrackerClient.h \
-	Source/WebCore/storage/DatabaseTracker.cpp \
-	Source/WebCore/storage/DatabaseTracker.h \
-	Source/WebCore/storage/IDBAny.cpp \
-	Source/WebCore/storage/IDBAny.h \
-	Source/WebCore/storage/IDBBackingStore.h \
-	Source/WebCore/storage/IDBCallbacks.h \
-	Source/WebCore/storage/IDBCursorBackendImpl.cpp \
-	Source/WebCore/storage/IDBCursorBackendImpl.h \
-	Source/WebCore/storage/IDBCursorBackendInterface.h \
-	Source/WebCore/storage/IDBCursor.cpp \
-	Source/WebCore/storage/IDBCursor.h \
-	Source/WebCore/storage/IDBDatabaseBackendImpl.cpp \
-	Source/WebCore/storage/IDBDatabaseBackendImpl.h \
-	Source/WebCore/storage/IDBDatabaseBackendInterface.h \
-	Source/WebCore/storage/IDBDatabaseCallbacks.h \
-	Source/WebCore/storage/IDBDatabaseCallbacksImpl.h \
-	Source/WebCore/storage/IDBDatabase.cpp \
-	Source/WebCore/storage/IDBDatabaseError.h \
-	Source/WebCore/storage/IDBDatabaseException.h \
-	Source/WebCore/storage/IDBDatabase.h \
-	Source/WebCore/storage/IDBEventDispatcher.cpp \
-	Source/WebCore/storage/IDBEventDispatcher.h \
-	Source/WebCore/storage/IDBFactoryBackendImpl.cpp \
-	Source/WebCore/storage/IDBFactoryBackendImpl.h \
-	Source/WebCore/storage/IDBFactoryBackendInterface.cpp \
-	Source/WebCore/storage/IDBFactoryBackendInterface.h \
-	Source/WebCore/storage/IDBFactory.cpp \
-	Source/WebCore/storage/IDBFactory.h \
-	Source/WebCore/storage/IDBIndexBackendImpl.cpp \
-	Source/WebCore/storage/IDBIndexBackendImpl.h \
-	Source/WebCore/storage/IDBIndexBackendInterface.h \
-	Source/WebCore/storage/IDBIndexBackendInterface.h \
-	Source/WebCore/storage/IDBIndex.cpp \
-	Source/WebCore/storage/IDBIndex.h \
-	Source/WebCore/storage/IDBKey.h \
-	Source/WebCore/storage/IDBKeyPath.h \
-	Source/WebCore/storage/IDBKeyPathBackendImpl.h \
-	Source/WebCore/storage/IDBKeyRange.cpp \
-	Source/WebCore/storage/IDBKeyRange.h \
-	Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp \
-	Source/WebCore/storage/IDBObjectStoreBackendImpl.h \
-	Source/WebCore/storage/IDBObjectStoreBackendInterface.h \
-	Source/WebCore/storage/IDBObjectStoreBackendInterface.h \
-	Source/WebCore/storage/IDBObjectStore.cpp \
-	Source/WebCore/storage/IDBObjectStore.h \
-	Source/WebCore/storage/IDBRequest.cpp \
-	Source/WebCore/storage/IDBRequest.h \
-	Source/WebCore/storage/IDBSQLiteBackingStore.cpp \
-	Source/WebCore/storage/IDBSQLiteBackingStore.h \
-	Source/WebCore/storage/IDBTransactionBackendInterface.h \
-	Source/WebCore/storage/IDBTransactionCoordinator.h \
-	Source/WebCore/storage/IDBTransaction.cpp \
-	Source/WebCore/storage/IDBTransaction.h \
-	Source/WebCore/storage/IDBVersionChangeEvent.h \
-	Source/WebCore/storage/IDBVersionChangeRequest.h \
-	Source/WebCore/storage/LocalStorageTask.cpp \
-	Source/WebCore/storage/LocalStorageTask.h \
-	Source/WebCore/storage/LocalStorageThread.cpp \
-	Source/WebCore/storage/LocalStorageThread.h \
-	Source/WebCore/storage/OriginQuotaManager.cpp \
-	Source/WebCore/storage/OriginQuotaManager.h \
-	Source/WebCore/storage/OriginUsageRecord.cpp \
-	Source/WebCore/storage/OriginUsageRecord.h \
-	Source/WebCore/storage/SQLCallbackWrapper.h \
-	Source/WebCore/storage/SQLError.h \
-	Source/WebCore/storage/SQLException.h \
-	Source/WebCore/storage/SQLResultSet.cpp \
-	Source/WebCore/storage/SQLResultSet.h \
-	Source/WebCore/storage/SQLResultSetRowList.cpp \
-	Source/WebCore/storage/SQLResultSetRowList.h \
-	Source/WebCore/storage/SQLStatementCallback.h \
-	Source/WebCore/storage/SQLStatement.cpp \
-	Source/WebCore/storage/SQLStatementErrorCallback.h \
-	Source/WebCore/storage/SQLStatement.h \
-	Source/WebCore/storage/SQLStatementSync.cpp \
-	Source/WebCore/storage/SQLStatementSync.h \
-	Source/WebCore/storage/SQLTransactionCallback.h \
-	Source/WebCore/storage/SQLTransactionClient.cpp \
-	Source/WebCore/storage/SQLTransactionClient.h \
-	Source/WebCore/storage/SQLTransactionCoordinator.cpp \
-	Source/WebCore/storage/SQLTransactionCoordinator.h \
-	Source/WebCore/storage/SQLTransaction.cpp \
-	Source/WebCore/storage/SQLTransactionErrorCallback.h \
-	Source/WebCore/storage/SQLTransaction.h \
-	Source/WebCore/storage/SQLTransactionSyncCallback.h \
-	Source/WebCore/storage/SQLTransactionSync.cpp \
-	Source/WebCore/storage/SQLTransactionSync.h \
-	Source/WebCore/storage/StorageArea.h \
-	Source/WebCore/storage/StorageAreaImpl.cpp \
-	Source/WebCore/storage/StorageAreaImpl.h \
-	Source/WebCore/storage/StorageAreaSync.cpp \
-	Source/WebCore/storage/StorageAreaSync.h \
-	Source/WebCore/storage/Storage.cpp \
-	Source/WebCore/storage/StorageEvent.cpp \
-	Source/WebCore/storage/StorageEventDispatcher.cpp \
-	Source/WebCore/storage/StorageEventDispatcher.h \
-	Source/WebCore/storage/StorageEvent.h \
-	Source/WebCore/storage/Storage.h \
-	Source/WebCore/storage/StorageMap.cpp \
-	Source/WebCore/storage/StorageMap.h \
-	Source/WebCore/storage/StorageNamespace.cpp \
-	Source/WebCore/storage/StorageNamespace.h \
-	Source/WebCore/storage/StorageNamespaceImpl.cpp \
-	Source/WebCore/storage/StorageNamespaceImpl.h \
-	Source/WebCore/storage/StorageSyncManager.cpp \
-	Source/WebCore/storage/StorageSyncManager.h \
-	Source/WebCore/storage/StorageTracker.cpp \
-	Source/WebCore/storage/StorageTracker.h \
-	Source/WebCore/storage/StorageTrackerClient.h \
-	Source/WebCore/svg/animation/SMILTimeContainer.cpp \
-	Source/WebCore/svg/animation/SMILTimeContainer.h \
-	Source/WebCore/svg/animation/SMILTime.cpp \
-	Source/WebCore/svg/animation/SMILTime.h \
-	Source/WebCore/svg/animation/SVGSMILElement.cpp \
-	Source/WebCore/svg/animation/SVGSMILElement.h \
-	Source/WebCore/svg/ColorDistance.cpp \
-	Source/WebCore/svg/ColorDistance.h \
-	Source/WebCore/svg/ElementTimeControl.h \
-	Source/WebCore/svg/GradientAttributes.h \
-	Source/WebCore/svg/graphics/filters/SVGFEImage.cpp \
-	Source/WebCore/svg/graphics/filters/SVGFEImage.h \
-	Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp \
-	Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h \
-	Source/WebCore/svg/graphics/filters/SVGFilter.cpp \
-	Source/WebCore/svg/graphics/filters/SVGFilter.h \
-	Source/WebCore/svg/graphics/SVGImage.cpp \
-	Source/WebCore/svg/graphics/SVGImage.h \
-	Source/WebCore/svg/LinearGradientAttributes.h \
-	Source/WebCore/svg/PatternAttributes.h \
-	Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGAnimatedProperty.h \
-	Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h \
-	Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h \
-	Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h \
-	Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGAnimatedStaticPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGListProperty.h \
-	Source/WebCore/svg/properties/SVGListPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp \
-	Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGProperty.h \
-	Source/WebCore/svg/properties/SVGPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGPropertyTraits.h \
-	Source/WebCore/svg/properties/SVGStaticListPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGStaticPropertyTearOff.h \
-	Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h \
-	Source/WebCore/svg/properties/SVGTransformListPropertyTearOff.h \
-	Source/WebCore/svg/RadialGradientAttributes.h \
-	Source/WebCore/svg/SVGAElement.cpp \
-	Source/WebCore/svg/SVGAElement.h \
-	Source/WebCore/svg/SVGAltGlyphElement.cpp \
-	Source/WebCore/svg/SVGAltGlyphElement.h \
-	Source/WebCore/svg/SVGAngle.cpp \
-	Source/WebCore/svg/SVGAngle.h \
-	Source/WebCore/svg/SVGAnimateColorElement.cpp \
-	Source/WebCore/svg/SVGAnimateColorElement.h \
-	Source/WebCore/svg/SVGAnimatedAngle.h \
-	Source/WebCore/svg/SVGAnimatedBoolean.h \
-	Source/WebCore/svg/SVGAnimatedEnumeration.h \
-	Source/WebCore/svg/SVGAnimatedInteger.h \
-	Source/WebCore/svg/SVGAnimatedLength.h \
-	Source/WebCore/svg/SVGAnimatedLengthList.h \
-	Source/WebCore/svg/SVGAnimatedNumber.h \
-	Source/WebCore/svg/SVGAnimatedNumberList.h \
-	Source/WebCore/svg/SVGAnimatedPreserveAspectRatio.h \
-	Source/WebCore/svg/SVGAnimatedRect.h \
-	Source/WebCore/svg/SVGAnimatedString.h \
-	Source/WebCore/svg/SVGAnimatedTransformList.h \
-	Source/WebCore/svg/SVGAnimateElement.cpp \
-	Source/WebCore/svg/SVGAnimateElement.h \
-	Source/WebCore/svg/SVGAnimateMotionElement.cpp \
-	Source/WebCore/svg/SVGAnimateMotionElement.h \
-	Source/WebCore/svg/SVGAnimateTransformElement.cpp \
-	Source/WebCore/svg/SVGAnimateTransformElement.h \
-	Source/WebCore/svg/SVGAnimationElement.cpp \
-	Source/WebCore/svg/SVGAnimationElement.h \
-	Source/WebCore/svg/SVGCircleElement.cpp \
-	Source/WebCore/svg/SVGCircleElement.h \
-	Source/WebCore/svg/SVGClipPathElement.cpp \
-	Source/WebCore/svg/SVGClipPathElement.h \
-	Source/WebCore/svg/SVGColor.cpp \
-	Source/WebCore/svg/SVGColor.h \
-	Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp \
-	Source/WebCore/svg/SVGComponentTransferFunctionElement.h \
-	Source/WebCore/svg/SVGCursorElement.cpp \
-	Source/WebCore/svg/SVGCursorElement.h \
-	Source/WebCore/svg/SVGDefsElement.cpp \
-	Source/WebCore/svg/SVGDefsElement.h \
-	Source/WebCore/svg/SVGDescElement.cpp \
-	Source/WebCore/svg/SVGDescElement.h \
-	Source/WebCore/svg/SVGDocument.cpp \
-	Source/WebCore/svg/SVGDocumentExtensions.cpp \
-	Source/WebCore/svg/SVGDocumentExtensions.h \
-	Source/WebCore/svg/SVGDocument.h \
-	Source/WebCore/svg/SVGElement.cpp \
-	Source/WebCore/svg/SVGElement.h \
-	Source/WebCore/svg/SVGElementInstance.cpp \
-	Source/WebCore/svg/SVGElementInstance.h \
-	Source/WebCore/svg/SVGElementInstanceList.cpp \
-	Source/WebCore/svg/SVGElementInstanceList.h \
-	Source/WebCore/svg/SVGElementRareData.h \
-	Source/WebCore/svg/SVGEllipseElement.cpp \
-	Source/WebCore/svg/SVGEllipseElement.h \
-	Source/WebCore/svg/SVGException.h \
-	Source/WebCore/svg/SVGExternalResourcesRequired.cpp \
-	Source/WebCore/svg/SVGExternalResourcesRequired.h \
-	Source/WebCore/svg/SVGFEBlendElement.cpp \
-	Source/WebCore/svg/SVGFEBlendElement.h \
-	Source/WebCore/svg/SVGFEColorMatrixElement.cpp \
-	Source/WebCore/svg/SVGFEColorMatrixElement.h \
-	Source/WebCore/svg/SVGFEComponentTransferElement.cpp \
-	Source/WebCore/svg/SVGFEComponentTransferElement.h \
-	Source/WebCore/svg/SVGFECompositeElement.cpp \
-	Source/WebCore/svg/SVGFECompositeElement.h \
-	Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp \
-	Source/WebCore/svg/SVGFEConvolveMatrixElement.h \
-	Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp \
-	Source/WebCore/svg/SVGFEDiffuseLightingElement.h \
-	Source/WebCore/svg/SVGFEDisplacementMapElement.cpp \
-	Source/WebCore/svg/SVGFEDisplacementMapElement.h \
-	Source/WebCore/svg/SVGFEDistantLightElement.cpp \
-	Source/WebCore/svg/SVGFEDistantLightElement.h \
-	Source/WebCore/svg/SVGFEFloodElement.cpp \
-	Source/WebCore/svg/SVGFEFloodElement.h \
-	Source/WebCore/svg/SVGFEFuncAElement.cpp \
-	Source/WebCore/svg/SVGFEFuncAElement.h \
-	Source/WebCore/svg/SVGFEFuncBElement.cpp \
-	Source/WebCore/svg/SVGFEFuncBElement.h \
-	Source/WebCore/svg/SVGFEFuncGElement.cpp \
-	Source/WebCore/svg/SVGFEFuncGElement.h \
-	Source/WebCore/svg/SVGFEFuncRElement.cpp \
-	Source/WebCore/svg/SVGFEFuncRElement.h \
-	Source/WebCore/svg/SVGFEGaussianBlurElement.cpp \
-	Source/WebCore/svg/SVGFEGaussianBlurElement.h \
-	Source/WebCore/svg/SVGFEImageElement.cpp \
-	Source/WebCore/svg/SVGFEImageElement.h \
-	Source/WebCore/svg/SVGFELightElement.cpp \
-	Source/WebCore/svg/SVGFELightElement.h \
-	Source/WebCore/svg/SVGFEMergeElement.cpp \
-	Source/WebCore/svg/SVGFEMergeElement.h \
-	Source/WebCore/svg/SVGFEMergeNodeElement.cpp \
-	Source/WebCore/svg/SVGFEMergeNodeElement.h \
-	Source/WebCore/svg/SVGFEMorphologyElement.cpp \
-	Source/WebCore/svg/SVGFEMorphologyElement.h \
-	Source/WebCore/svg/SVGFEOffsetElement.cpp \
-	Source/WebCore/svg/SVGFEOffsetElement.h \
-	Source/WebCore/svg/SVGFEPointLightElement.cpp \
-	Source/WebCore/svg/SVGFEPointLightElement.h \
-	Source/WebCore/svg/SVGFESpecularLightingElement.cpp \
-	Source/WebCore/svg/SVGFESpecularLightingElement.h \
-	Source/WebCore/svg/SVGFESpotLightElement.cpp \
-	Source/WebCore/svg/SVGFESpotLightElement.h \
-	Source/WebCore/svg/SVGFETileElement.cpp \
-	Source/WebCore/svg/SVGFETileElement.h \
-	Source/WebCore/svg/SVGFETurbulenceElement.cpp \
-	Source/WebCore/svg/SVGFETurbulenceElement.h \
-	Source/WebCore/svg/SVGFilterElement.cpp \
-	Source/WebCore/svg/SVGFilterElement.h \
-	Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp \
-	Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h \
-	Source/WebCore/svg/SVGFitToViewBox.cpp \
-	Source/WebCore/svg/SVGFitToViewBox.h \
-	Source/WebCore/svg/SVGFont.cpp \
-	Source/WebCore/svg/SVGFontData.cpp \
-	Source/WebCore/svg/SVGFontData.h \
-	Source/WebCore/svg/SVGFontElement.cpp \
-	Source/WebCore/svg/SVGFontElement.h \
-	Source/WebCore/svg/SVGFontFaceElement.cpp \
-	Source/WebCore/svg/SVGFontFaceElement.h \
-	Source/WebCore/svg/SVGFontFaceFormatElement.cpp \
-	Source/WebCore/svg/SVGFontFaceFormatElement.h \
-	Source/WebCore/svg/SVGFontFaceNameElement.cpp \
-	Source/WebCore/svg/SVGFontFaceNameElement.h \
-	Source/WebCore/svg/SVGFontFaceSrcElement.cpp \
-	Source/WebCore/svg/SVGFontFaceSrcElement.h \
-	Source/WebCore/svg/SVGFontFaceUriElement.cpp \
-	Source/WebCore/svg/SVGFontFaceUriElement.h \
-	Source/WebCore/svg/SVGForeignObjectElement.cpp \
-	Source/WebCore/svg/SVGForeignObjectElement.h \
-	Source/WebCore/svg/SVGGElement.cpp \
-	Source/WebCore/svg/SVGGElement.h \
-	Source/WebCore/svg/SVGGlyphElement.cpp \
-	Source/WebCore/svg/SVGGlyphElement.h \
-	Source/WebCore/svg/SVGGlyphMap.h \
-	Source/WebCore/svg/SVGGradientElement.cpp \
-	Source/WebCore/svg/SVGGradientElement.h \
-	Source/WebCore/svg/SVGHKernElement.cpp \
-	Source/WebCore/svg/SVGHKernElement.h \
-	Source/WebCore/svg/SVGImageElement.cpp \
-	Source/WebCore/svg/SVGImageElement.h \
-	Source/WebCore/svg/SVGImageLoader.cpp \
-	Source/WebCore/svg/SVGImageLoader.h \
-	Source/WebCore/svg/SVGLangSpace.cpp \
-	Source/WebCore/svg/SVGLangSpace.h \
-	Source/WebCore/svg/SVGLength.cpp \
-	Source/WebCore/svg/SVGLength.h \
-	Source/WebCore/svg/SVGLengthList.cpp \
-	Source/WebCore/svg/SVGLengthList.h \
-	Source/WebCore/svg/SVGLinearGradientElement.cpp \
-	Source/WebCore/svg/SVGLinearGradientElement.h \
-	Source/WebCore/svg/SVGLineElement.cpp \
-	Source/WebCore/svg/SVGLineElement.h \
-	Source/WebCore/svg/SVGLocatable.cpp \
-	Source/WebCore/svg/SVGLocatable.h \
-	Source/WebCore/svg/SVGMarkerElement.cpp \
-	Source/WebCore/svg/SVGMarkerElement.h \
-	Source/WebCore/svg/SVGMaskElement.cpp \
-	Source/WebCore/svg/SVGMaskElement.h \
-	Source/WebCore/svg/SVGMatrix.h \
-	Source/WebCore/svg/SVGMetadataElement.cpp \
-	Source/WebCore/svg/SVGMetadataElement.h \
-	Source/WebCore/svg/SVGMissingGlyphElement.cpp \
-	Source/WebCore/svg/SVGMissingGlyphElement.h \
-	Source/WebCore/svg/SVGMPathElement.cpp \
-	Source/WebCore/svg/SVGMPathElement.h \
-	Source/WebCore/svg/SVGNumberList.cpp \
-	Source/WebCore/svg/SVGNumberList.h \
-	Source/WebCore/svg/SVGPaint.cpp \
-	Source/WebCore/svg/SVGPaint.h \
-	Source/WebCore/svg/SVGParserUtilities.cpp \
-	Source/WebCore/svg/SVGParserUtilities.h \
-	Source/WebCore/svg/SVGPathBlender.cpp \
-	Source/WebCore/svg/SVGPathBlender.h \
-	Source/WebCore/svg/SVGPathBuilder.cpp \
-	Source/WebCore/svg/SVGPathBuilder.h \
-	Source/WebCore/svg/SVGPathByteStreamBuilder.cpp \
-	Source/WebCore/svg/SVGPathByteStreamBuilder.h \
-	Source/WebCore/svg/SVGPathByteStream.h \
-	Source/WebCore/svg/SVGPathByteStreamSource.cpp \
-	Source/WebCore/svg/SVGPathByteStreamSource.h \
-	Source/WebCore/svg/SVGPathConsumer.h \
-	Source/WebCore/svg/SVGPathElement.cpp \
-	Source/WebCore/svg/SVGPathElement.h \
-	Source/WebCore/svg/SVGPathParser.cpp \
-	Source/WebCore/svg/SVGPathParserFactory.cpp \
-	Source/WebCore/svg/SVGPathParserFactory.h \
-	Source/WebCore/svg/SVGPathParser.h \
-	Source/WebCore/svg/SVGPathSegArc.h \
-	Source/WebCore/svg/SVGPathSegClosePath.h \
-	Source/WebCore/svg/SVGPathSegCurvetoCubic.h \
-	Source/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h \
-	Source/WebCore/svg/SVGPathSegCurvetoQuadratic.h \
-	Source/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h \
-	Source/WebCore/svg/SVGPathSeg.h \
-	Source/WebCore/svg/SVGPathSegLineto.h \
-	Source/WebCore/svg/SVGPathSegLinetoHorizontal.h \
-	Source/WebCore/svg/SVGPathSegLinetoVertical.h \
-	Source/WebCore/svg/SVGPathSegListBuilder.cpp \
-	Source/WebCore/svg/SVGPathSegListBuilder.h \
-	Source/WebCore/svg/SVGPathSegList.cpp \
-	Source/WebCore/svg/SVGPathSegList.h \
-	Source/WebCore/svg/SVGPathSegListSource.cpp \
-	Source/WebCore/svg/SVGPathSegListSource.h \
-	Source/WebCore/svg/SVGPathSegMoveto.h \
-	Source/WebCore/svg/SVGPathSegWithContext.h \
-	Source/WebCore/svg/SVGPathSource.h \
-	Source/WebCore/svg/SVGPathStringBuilder.cpp \
-	Source/WebCore/svg/SVGPathStringBuilder.h \
-	Source/WebCore/svg/SVGPathStringSource.cpp \
-	Source/WebCore/svg/SVGPathStringSource.h \
-	Source/WebCore/svg/SVGPathTraversalStateBuilder.cpp \
-	Source/WebCore/svg/SVGPathTraversalStateBuilder.h \
-	Source/WebCore/svg/SVGPatternElement.cpp \
-	Source/WebCore/svg/SVGPatternElement.h \
-	Source/WebCore/svg/SVGPointList.cpp \
-	Source/WebCore/svg/SVGPointList.h \
-	Source/WebCore/svg/SVGPolyElement.cpp \
-	Source/WebCore/svg/SVGPolyElement.h \
-	Source/WebCore/svg/SVGPolygonElement.cpp \
-	Source/WebCore/svg/SVGPolygonElement.h \
-	Source/WebCore/svg/SVGPolylineElement.cpp \
-	Source/WebCore/svg/SVGPolylineElement.h \
-	Source/WebCore/svg/SVGPreserveAspectRatio.cpp \
-	Source/WebCore/svg/SVGPreserveAspectRatio.h \
-	Source/WebCore/svg/SVGRadialGradientElement.cpp \
-	Source/WebCore/svg/SVGRadialGradientElement.h \
-	Source/WebCore/svg/SVGRect.h \
-	Source/WebCore/svg/SVGRectElement.cpp \
-	Source/WebCore/svg/SVGRectElement.h \
-	Source/WebCore/svg/SVGRenderingIntent.h \
-	Source/WebCore/svg/SVGScriptElement.cpp \
-	Source/WebCore/svg/SVGScriptElement.h \
-	Source/WebCore/svg/SVGSetElement.cpp \
-	Source/WebCore/svg/SVGSetElement.h \
-	Source/WebCore/svg/SVGStopElement.cpp \
-	Source/WebCore/svg/SVGStopElement.h \
-	Source/WebCore/svg/SVGStringList.cpp \
-	Source/WebCore/svg/SVGStringList.h \
-	Source/WebCore/svg/SVGStylable.cpp \
-	Source/WebCore/svg/SVGStylable.h \
-	Source/WebCore/svg/SVGStyledElement.cpp \
-	Source/WebCore/svg/SVGStyledElement.h \
-	Source/WebCore/svg/SVGStyledLocatableElement.cpp \
-	Source/WebCore/svg/SVGStyledLocatableElement.h \
-	Source/WebCore/svg/SVGStyledTransformableElement.cpp \
-	Source/WebCore/svg/SVGStyledTransformableElement.h \
-	Source/WebCore/svg/SVGStyleElement.cpp \
-	Source/WebCore/svg/SVGStyleElement.h \
-	Source/WebCore/svg/SVGSVGElement.cpp \
-	Source/WebCore/svg/SVGSVGElement.h \
-	Source/WebCore/svg/SVGSwitchElement.cpp \
-	Source/WebCore/svg/SVGSwitchElement.h \
-	Source/WebCore/svg/SVGSymbolElement.cpp \
-	Source/WebCore/svg/SVGSymbolElement.h \
-	Source/WebCore/svg/SVGTests.cpp \
-	Source/WebCore/svg/SVGTests.h \
-	Source/WebCore/svg/SVGTextContentElement.cpp \
-	Source/WebCore/svg/SVGTextContentElement.h \
-	Source/WebCore/svg/SVGTextElement.cpp \
-	Source/WebCore/svg/SVGTextElement.h \
-	Source/WebCore/svg/SVGTextPathElement.cpp \
-	Source/WebCore/svg/SVGTextPathElement.h \
-	Source/WebCore/svg/SVGTextPositioningElement.cpp \
-	Source/WebCore/svg/SVGTextPositioningElement.h \
-	Source/WebCore/svg/SVGTitleElement.cpp \
-	Source/WebCore/svg/SVGTitleElement.h \
-	Source/WebCore/svg/SVGTransformable.cpp \
-	Source/WebCore/svg/SVGTransformable.h \
-	Source/WebCore/svg/SVGTransform.cpp \
-	Source/WebCore/svg/SVGTransformDistance.cpp \
-	Source/WebCore/svg/SVGTransformDistance.h \
-	Source/WebCore/svg/SVGTransform.h \
-	Source/WebCore/svg/SVGTransformList.cpp \
-	Source/WebCore/svg/SVGTransformList.h \
-	Source/WebCore/svg/SVGTRefElement.cpp \
-	Source/WebCore/svg/SVGTRefElement.h \
-	Source/WebCore/svg/SVGTSpanElement.cpp \
-	Source/WebCore/svg/SVGTSpanElement.h \
-	Source/WebCore/svg/SVGUnitTypes.h \
-	Source/WebCore/svg/SVGURIReference.cpp \
-	Source/WebCore/svg/SVGURIReference.h \
-	Source/WebCore/svg/SVGUseElement.cpp \
-	Source/WebCore/svg/SVGUseElement.h \
-	Source/WebCore/svg/SVGViewElement.cpp \
-	Source/WebCore/svg/SVGViewElement.h \
-	Source/WebCore/svg/SVGViewSpec.cpp \
-	Source/WebCore/svg/SVGViewSpec.h \
-	Source/WebCore/svg/SVGVKernElement.cpp \
-	Source/WebCore/svg/SVGVKernElement.h \
-	Source/WebCore/svg/SVGZoomAndPan.cpp \
-	Source/WebCore/svg/SVGZoomAndPan.h \
-	Source/WebCore/svg/SVGZoomEvent.cpp \
-	Source/WebCore/svg/SVGZoomEvent.h \
-	Source/WebCore/WebCorePrefix.h \
-	Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h \
-	Source/WebCore/websockets/ThreadableWebSocketChannel.cpp \
-	Source/WebCore/websockets/ThreadableWebSocketChannel.h \
-	Source/WebCore/websockets/WebSocketChannelClient.h \
-	Source/WebCore/websockets/WebSocketChannel.cpp \
-	Source/WebCore/websockets/WebSocketChannel.h \
-	Source/WebCore/websockets/WebSocket.cpp \
-	Source/WebCore/websockets/WebSocket.h \
-	Source/WebCore/websockets/WebSocketHandshake.cpp \
-	Source/WebCore/websockets/WebSocketHandshake.h \
-	Source/WebCore/websockets/WebSocketHandshakeRequest.cpp \
-	Source/WebCore/websockets/WebSocketHandshakeRequest.h \
-	Source/WebCore/websockets/WebSocketHandshakeResponse.cpp \
-	Source/WebCore/websockets/WebSocketHandshakeResponse.h \
-	Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp \
-	Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h \
-	Source/WebCore/wml/WMLAccessElement.cpp \
-	Source/WebCore/wml/WMLAElement.cpp \
-	Source/WebCore/wml/WMLAnchorElement.cpp \
-	Source/WebCore/wml/WMLBRElement.cpp \
-	Source/WebCore/wml/WMLCardElement.cpp \
-	Source/WebCore/wml/WMLDocument.cpp \
-	Source/WebCore/wml/WMLDoElement.cpp \
-	Source/WebCore/wml/WMLElement.cpp \
-	Source/WebCore/wml/WMLErrorHandling.cpp \
-	Source/WebCore/wml/WMLEventHandlingElement.cpp \
-	Source/WebCore/wml/WMLFieldSetElement.cpp \
-	Source/WebCore/wml/WMLFormControlElement.cpp \
-	Source/WebCore/wml/WMLGoElement.cpp \
-	Source/WebCore/wml/WMLImageElement.cpp \
-	Source/WebCore/wml/WMLImageLoader.cpp \
-	Source/WebCore/wml/WMLInputElement.cpp \
-	Source/WebCore/wml/WMLInsertedLegendElement.cpp \
-	Source/WebCore/wml/WMLIntrinsicEvent.cpp \
-	Source/WebCore/wml/WMLIntrinsicEventHandler.cpp \
-	Source/WebCore/wml/WMLMetaElement.cpp \
-	Source/WebCore/wml/WMLNoopElement.cpp \
-	Source/WebCore/wml/WMLOnEventElement.cpp \
-	Source/WebCore/wml/WMLOptGroupElement.cpp \
-	Source/WebCore/wml/WMLOptionElement.cpp \
-	Source/WebCore/wml/WMLPageState.cpp \
-	Source/WebCore/wml/WMLPElement.cpp \
-	Source/WebCore/wml/WMLPostfieldElement.cpp \
-	Source/WebCore/wml/WMLPrevElement.cpp \
-	Source/WebCore/wml/WMLRefreshElement.cpp \
-	Source/WebCore/wml/WMLSelectElement.cpp \
-	Source/WebCore/wml/WMLSetvarElement.cpp \
-	Source/WebCore/wml/WMLTableElement.cpp \
-	Source/WebCore/wml/WMLTaskElement.cpp \
-	Source/WebCore/wml/WMLTemplateElement.cpp \
-	Source/WebCore/wml/WMLTimerElement.cpp \
-	Source/WebCore/wml/WMLVariables.cpp \
-	Source/WebCore/workers/AbstractWorker.cpp \
-	Source/WebCore/workers/AbstractWorker.h \
-	Source/WebCore/workers/DedicatedWorkerContext.cpp \
-	Source/WebCore/workers/DedicatedWorkerContext.h \
-	Source/WebCore/workers/DedicatedWorkerThread.cpp \
-	Source/WebCore/workers/DedicatedWorkerThread.h \
-	Source/WebCore/workers/DefaultSharedWorkerRepository.cpp \
-	Source/WebCore/workers/DefaultSharedWorkerRepository.h \
-	Source/WebCore/workers/SharedWorkerContext.cpp \
-	Source/WebCore/workers/SharedWorkerContext.h \
-	Source/WebCore/workers/SharedWorker.cpp \
-	Source/WebCore/workers/SharedWorker.h \
-	Source/WebCore/workers/SharedWorkerRepository.h \
-	Source/WebCore/workers/SharedWorkerThread.cpp \
-	Source/WebCore/workers/SharedWorkerThread.h \
-	Source/WebCore/workers/WorkerContext.cpp \
-	Source/WebCore/workers/WorkerContext.h \
-	Source/WebCore/workers/WorkerContextProxy.h \
-	Source/WebCore/workers/Worker.cpp \
-	Source/WebCore/workers/Worker.h \
-	Source/WebCore/workers/WorkerLoaderProxy.h \
-	Source/WebCore/workers/WorkerLocation.cpp \
-	Source/WebCore/workers/WorkerLocation.h \
-	Source/WebCore/workers/WorkerMessagingProxy.cpp \
-	Source/WebCore/workers/WorkerMessagingProxy.h \
-	Source/WebCore/workers/WorkerObjectProxy.h \
-	Source/WebCore/workers/WorkerReportingProxy.h \
-	Source/WebCore/workers/WorkerRunLoop.cpp \
-	Source/WebCore/workers/WorkerRunLoop.h \
-	Source/WebCore/workers/WorkerScriptLoaderClient.h \
-	Source/WebCore/workers/WorkerScriptLoader.cpp \
-	Source/WebCore/workers/WorkerScriptLoader.h \
-	Source/WebCore/workers/WorkerThread.cpp \
-	Source/WebCore/workers/WorkerThread.h \
-	Source/WebCore/xml/DOMParser.cpp \
-	Source/WebCore/xml/DOMParser.h \
-	Source/WebCore/xml/NativeXPathNSResolver.cpp \
-	Source/WebCore/xml/NativeXPathNSResolver.h \
-	Source/WebCore/xml/XMLHttpRequest.cpp \
-	Source/WebCore/xml/XMLHttpRequestException.h \
-	Source/WebCore/xml/XMLHttpRequest.h \
-	Source/WebCore/xml/XMLHttpRequestProgressEvent.h \
-	Source/WebCore/xml/XMLHttpRequestProgressEventThrottle.cpp \
-	Source/WebCore/xml/XMLHttpRequestProgressEventThrottle.h \
-	Source/WebCore/xml/XMLHttpRequestUpload.cpp \
-	Source/WebCore/xml/XMLHttpRequestUpload.h \
-	Source/WebCore/xml/XMLTreeViewer.cpp \
-	Source/WebCore/xml/XMLTreeViewer.h \
-	Source/WebCore/xml/XMLSerializer.cpp \
-	Source/WebCore/xml/XMLSerializer.h \
-	Source/WebCore/xml/XPathEvaluator.cpp \
-	Source/WebCore/xml/XPathEvaluator.h \
-	Source/WebCore/xml/XPathException.h \
-	Source/WebCore/xml/XPathExpression.cpp \
-	Source/WebCore/xml/XPathExpression.h \
-	Source/WebCore/xml/XPathExpressionNode.cpp \
-	Source/WebCore/xml/XPathExpressionNode.h \
-	Source/WebCore/xml/XPathFunctions.cpp \
-	Source/WebCore/xml/XPathFunctions.h \
-	Source/WebCore/xml/XPathNamespace.cpp \
-	Source/WebCore/xml/XPathNamespace.h \
-	Source/WebCore/xml/XPathNodeSet.cpp \
-	Source/WebCore/xml/XPathNodeSet.h \
-	Source/WebCore/xml/XPathNSResolver.cpp \
-	Source/WebCore/xml/XPathNSResolver.h \
-	Source/WebCore/xml/XPathParser.cpp \
-	Source/WebCore/xml/XPathParser.h \
-	Source/WebCore/xml/XPathPath.cpp \
-	Source/WebCore/xml/XPathPath.h \
-	Source/WebCore/xml/XPathPredicate.cpp \
-	Source/WebCore/xml/XPathPredicate.h \
-	Source/WebCore/xml/XPathResult.cpp \
-	Source/WebCore/xml/XPathResult.h \
-	Source/WebCore/xml/XPathStep.cpp \
-	Source/WebCore/xml/XPathStep.h \
-	Source/WebCore/xml/XPathUtil.cpp \
-	Source/WebCore/xml/XPathUtil.h \
-	Source/WebCore/xml/XPathValue.cpp \
-	Source/WebCore/xml/XPathValue.h \
-	Source/WebCore/xml/XPathVariableReference.cpp \
-	Source/WebCore/xml/XPathVariableReference.h \
-	Source/WebCore/xml/XSLImportRule.cpp \
-	Source/WebCore/xml/XSLImportRule.h \
-	Source/WebCore/xml/XSLStyleSheet.h \
-	Source/WebCore/xml/XSLStyleSheetLibxslt.cpp \
-	Source/WebCore/xml/XSLTExtensions.cpp \
-	Source/WebCore/xml/XSLTExtensions.h \
-	Source/WebCore/xml/XSLTProcessor.cpp \
-	Source/WebCore/xml/XSLTProcessor.h \
-	Source/WebCore/xml/XSLTProcessorLibxslt.cpp \
-	Source/WebCore/xml/XSLTUnicodeSort.cpp \
-	Source/WebCore/xml/XSLTUnicodeSort.h
-
-webcoregtk_sources += \
-	Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp \
-	Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp \
-	Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.h \
-	Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp \
-	Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.h \
-	Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp \
-	Source/WebCore/bindings/js/ScriptControllerGtk.cpp \
-	Source/WebCore/page/gtk/DragControllerGtk.cpp \
-	Source/WebCore/page/gtk/EventHandlerGtk.cpp \
-	Source/WebCore/page/gtk/FrameGtk.cpp \
-	Source/WebCore/platform/graphics/cairo/CairoPath.h \
-	Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp \
-	Source/WebCore/platform/graphics/cairo/CairoUtilities.h \
-	Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/FloatRectCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/FontCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h \
-	Source/WebCore/platform/graphics/cairo/GradientCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h \
-	Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/ImageBufferData.h \
-	Source/WebCore/platform/graphics/cairo/ImageCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h \
-	Source/WebCore/platform/graphics/cairo/PathCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/PatternCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h \
-	Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/RefPtrCairo.h \
-	Source/WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
-	Source/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.cpp \
-	Source/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.h \
-	Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp \
-	Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.h \
-	Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp \
-	Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h \
-	Source/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp \
-	Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h \
-	Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp \
-	Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h \
-	Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp \
-	Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h \
-	Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp \
-	Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.h \
-	Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp \
-	Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h \
-	Source/WebCore/platform/graphics/gtk/ColorGtk.cpp \
-	Source/WebCore/platform/graphics/gtk/FontGtk.cpp \
-	Source/WebCore/platform/graphics/gtk/GdkCairoUtilities.cpp \
-	Source/WebCore/platform/graphics/gtk/GdkCairoUtilities.h \
-	Source/WebCore/platform/graphics/gtk/IconGtk.cpp \
-	Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp \
-	Source/WebCore/platform/graphics/gtk/ImageGtk.cpp \
-	Source/WebCore/platform/graphics/gtk/IntPointGtk.cpp \
-	Source/WebCore/platform/graphics/gtk/IntRectGtk.cpp \
-	Source/WebCore/platform/gtk/ClipboardGtk.cpp \
-	Source/WebCore/platform/gtk/ClipboardGtk.h \
-	Source/WebCore/platform/gtk/ClipboardUtilitiesGtk.cpp \
-	Source/WebCore/platform/gtk/ClipboardUtilitiesGtk.h \
-	Source/WebCore/platform/gtk/ContextMenuGtk.cpp \
-	Source/WebCore/platform/gtk/ContextMenuItemGtk.cpp \
-	Source/WebCore/platform/gtk/CursorGtk.cpp \
-	Source/WebCore/platform/gtk/CursorGtk.h \
-	Source/WebCore/platform/gtk/DataObjectGtk.cpp \
-	Source/WebCore/platform/gtk/DataObjectGtk.h \
-	Source/WebCore/platform/gtk/DragDataGtk.cpp \
-	Source/WebCore/platform/gtk/DragImageGtk.cpp \
-	Source/WebCore/platform/gtk/EventLoopGtk.cpp \
-	Source/WebCore/platform/gtk/FileChooserGtk.cpp \
-	Source/WebCore/platform/gtk/FileSystemGtk.cpp \
-	Source/WebCore/platform/gtk/GeolocationServiceGtk.cpp \
-	Source/WebCore/platform/gtk/GeolocationServiceGtk.h \
-	Source/WebCore/platform/gtk/GOwnPtrGtk.cpp \
-	Source/WebCore/platform/gtk/GOwnPtrGtk.h \
-	Source/WebCore/platform/gtk/GRefPtrGtk.cpp \
-	Source/WebCore/platform/gtk/GRefPtrGtk.h \
-	Source/WebCore/platform/gtk/GtkPluginWidget.cpp \
-	Source/WebCore/platform/gtk/GtkPluginWidget.h \
-	Source/WebCore/platform/gtk/GtkVersioning.c \
-	Source/WebCore/platform/gtk/GtkVersioning.h \
-	Source/WebCore/platform/gtk/KeyEventGtk.cpp \
-	Source/WebCore/platform/gtk/KURLGtk.cpp \
-	Source/WebCore/platform/gtk/LanguageGtk.cpp \
-	Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp \
-	Source/WebCore/platform/gtk/LoggingGtk.cpp \
-	Source/WebCore/platform/gtk/MainFrameScrollbarGtk.cpp \
-	Source/WebCore/platform/gtk/MainFrameScrollbarGtk.h \
-	Source/WebCore/platform/gtk/MIMETypeRegistryGtk.cpp \
-	Source/WebCore/platform/gtk/MouseEventGtk.cpp \
-	Source/WebCore/platform/gtk/PasteboardGtk.cpp \
-	Source/WebCore/platform/gtk/PasteboardHelper.cpp \
-	Source/WebCore/platform/gtk/PasteboardHelper.h \
-	Source/WebCore/platform/gtk/PlatformScreenGtk.cpp \
-	Source/WebCore/platform/gtk/PopupMenuGtk.cpp \
-	Source/WebCore/platform/gtk/PopupMenuGtk.h \
-	Source/WebCore/platform/gtk/RenderThemeGtk.cpp \
-	Source/WebCore/platform/gtk/RenderThemeGtk.h \
-	Source/WebCore/platform/gtk/RenderThemeGtk2.cpp \
-	Source/WebCore/platform/gtk/RenderThemeGtk3.cpp \
-	Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp \
-	Source/WebCore/platform/gtk/ScrollbarThemeGtk.h \
-	Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp \
-	Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp \
-	Source/WebCore/platform/gtk/ScrollViewGtk.cpp \
-	Source/WebCore/platform/gtk/SearchPopupMenuGtk.cpp \
-	Source/WebCore/platform/gtk/SearchPopupMenuGtk.h \
-	Source/WebCore/platform/gtk/SharedBufferGtk.cpp \
-	Source/WebCore/platform/gtk/SharedTimerGtk.cpp \
-	Source/WebCore/platform/gtk/SoundGtk.cpp \
-	Source/WebCore/platform/gtk/TemporaryLinkStubs.cpp \
-	Source/WebCore/platform/gtk/WheelEventGtk.cpp \
-	Source/WebCore/platform/gtk/WidgetGtk.cpp \
-	Source/WebCore/platform/gtk/WidgetRenderingContext.cpp \
-	Source/WebCore/platform/gtk/WidgetRenderingContext.h \
-	Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.h \
-	Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp \
-	Source/WebCore/platform/image-decoders/bmp/BMPImageReader.h \
-	Source/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp \
-	Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.h \
-	Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp \
-	Source/WebCore/platform/image-decoders/gif/GIFImageReader.h \
-	Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.h \
-	Source/WebCore/platform/image-decoders/ImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/ImageDecoder.h \
-	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h \
-	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h \
-	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h \
-	Source/WebCore/platform/network/soup/AuthenticationChallenge.h \
-	Source/WebCore/platform/network/soup/CookieJarSoup.cpp \
-	Source/WebCore/platform/network/soup/CookieJarSoup.h \
-	Source/WebCore/platform/network/soup/GOwnPtrSoup.cpp \
-	Source/WebCore/platform/network/soup/GOwnPtrSoup.h \
-	Source/WebCore/platform/network/soup/ProxyServerSoup.cpp \
-	Source/WebCore/platform/network/soup/ResourceError.h \
-	Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp \
-	Source/WebCore/platform/network/soup/ResourceRequest.h \
-	Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp \
-	Source/WebCore/platform/network/soup/ResourceResponse.h \
-	Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp \
-	Source/WebCore/platform/network/soup/SocketStreamError.h \
-	Source/WebCore/platform/network/soup/SocketStreamHandle.h \
-	Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp \
-	Source/WebCore/platform/network/soup/SoupURIUtils.cpp \
-	Source/WebCore/platform/network/soup/SoupURIUtils.h \
-	Source/WebCore/plugins/gtk/PluginDataGtk.cpp \
-	Source/WebCore/plugins/gtk/PluginPackageGtk.cpp \
-	Source/WebCore/plugins/gtk/PluginViewGtk.cpp
-
-if TARGET_X11
-webcoregtk_sources += \
-	Source/WebCore/plugins/gtk/gtk2xtbin.c \
-	Source/WebCore/plugins/gtk/gtk2xtbin.h \
-	Source/WebCore/plugins/gtk/xembed.h
-endif
-
-if TARGET_WIN32
-webcore_sources += \
-	Source/WebCore/platform/ScrollAnimatorWin.cpp \
-	Source/WebCore/platform/ScrollAnimatorWin.h \
-	Source/WebCore/platform/win/SystemInfo.cpp \
-	Source/WebCore/platform/win/SystemInfo.h \
-	Source/WebCore/plugins/win/PluginDatabaseWin.cpp \
-	Source/WebCore/plugins/win/PluginMessageThrottlerWin.cpp \
-	Source/WebCore/plugins/win/PluginMessageThrottlerWin.h
-endif
-
-# ----
-# icu unicode backend
-# ----
-if USE_ICU_UNICODE
-webcoregtk_sources += \
-	Source/WebCore/platform/text/TextCodecICU.cpp \
-	Source/WebCore/platform/text/TextCodecICU.h \
-	Source/WebCore/platform/text/TextBreakIteratorICU.cpp \
-	Source/WebCore/platform/text/TextBreakIteratorInternalICU.h \
-	Source/WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
-endif
-
-# ----
-# glib unicode backend
-# ----
-if USE_GLIB_UNICODE
-webcoregtk_sources += \
-	Source/WebCore/platform/text/gtk/TextCodecGtk.cpp \
-	Source/WebCore/platform/text/gtk/TextCodecGtk.h \
-	Source/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
-endif
-
 if !ENABLE_WEBKIT2
 FEATURE_DEFINES += WTF_USE_NATIVE_GTK_MAIN_FRAME_SCROLLBAR=1
 webcore_cppflags += -DWTF_USE_NATIVE_GTK_MAIN_FRAME_SCROLLBAR=1
@@ -3957,14 +125,6 @@ if USE_FREETYPE
 webcoregtk_cppflags += \
 	-DWTF_USE_FREETYPE=1 \
 	-I$(srcdir)/Source/WebCore/platform/graphics/freetype
-
-webcoregtk_sources += \
-	Source/WebCore/platform/graphics/freetype/FontCacheFreeType.cpp \
-	Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp \
-	Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp \
-	Source/WebCore/platform/graphics/freetype/FontPlatformData.h \
-	Source/WebCore/platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp \
-	Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
 endif # END USE_FREETYPE
 
 # ---
@@ -3974,14 +134,6 @@ if USE_PANGO
 webcoregtk_cppflags += \
 	-DWTF_USE_PANGO=1 \
 	-I$(srcdir)/Source/WebCore/platform/graphics/pango
-
-webcoregtk_sources += \
-	Source/WebCore/platform/graphics/pango/FontCachePango.cpp \
-	Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp \
-	Source/WebCore/platform/graphics/pango/FontPlatformDataPango.cpp \
-	Source/WebCore/platform/graphics/pango/FontPlatformData.h \
-	Source/WebCore/platform/graphics/pango/GlyphPageTreeNodePango.cpp \
-	Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp
 endif # END USE_PANGO
 
 # ----
@@ -4024,8 +176,6 @@ endif # END ENABLE_JAVASCRIPT_DEBUGGER
 if ENABLE_OFFLINE_WEB_APPLICATIONS
 FEATURE_DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 webcore_cppflags += -DENABLE_OFFLINE_WEB_APPLICATIONS=1
-webcore_built_sources += \
-	DerivedSources/WebCore/JSDOMApplicationCache.cpp
 endif # END ENABLE_OFFLINE_WEB_APPLICATIONS
 
 # ----
@@ -4034,30 +184,6 @@ endif # END ENABLE_OFFLINE_WEB_APPLICATIONS
 if ENABLE_DATABASE
 FEATURE_DEFINES += ENABLE_DATABASE=1
 webcore_cppflags += -DENABLE_DATABASE=1
-webcore_built_sources += \
-	DerivedSources/WebCore/JSDatabase.cpp \
-	DerivedSources/WebCore/JSDatabase.h \
-	DerivedSources/WebCore/JSDatabaseCallback.cpp \
-	DerivedSources/WebCore/JSDatabaseCallback.h \
-	DerivedSources/WebCore/JSDatabaseSync.cpp \
-	DerivedSources/WebCore/JSDatabaseSync.h \
-	DerivedSources/WebCore/JSSQLError.cpp \
-	DerivedSources/WebCore/JSSQLError.h \
-	DerivedSources/WebCore/JSSQLException.cpp \
-	DerivedSources/WebCore/JSSQLResultSet.cpp \
-	DerivedSources/WebCore/JSSQLResultSet.h \
-	DerivedSources/WebCore/JSSQLResultSetRowList.cpp \
-	DerivedSources/WebCore/JSSQLStatementCallback.cpp \
-	DerivedSources/WebCore/JSSQLStatementCallback.h \
-	DerivedSources/WebCore/JSSQLStatementErrorCallback.h \
-	DerivedSources/WebCore/JSSQLTransaction.cpp \
-	DerivedSources/WebCore/JSSQLTransactionCallback.cpp \
-	DerivedSources/WebCore/JSSQLTransactionCallback.h \
-	DerivedSources/WebCore/JSSQLTransactionErrorCallback.cpp \
-	DerivedSources/WebCore/JSSQLTransactionErrorCallback.h \
-	DerivedSources/WebCore/JSSQLTransactionSync.cpp \
-	DerivedSources/WebCore/JSSQLTransactionSyncCallback.cpp \
-	DerivedSources/WebCore/JSSQLTransactionSyncCallback.h
 else
 webcore_cppflags += -DENABLE_DATABASE=0
 endif # END ENABLE_DATABASE
@@ -4077,19 +203,6 @@ endif # END ENABLE_DATALIST
 if ENABLE_DATA_TRANSFER_ITEMS
 FEATURE_DEFINES += ENABLE_DATA_TRANSFER_ITEMS=1
 webcore_cppflags += -DENABLE_DATA_TRANSFER_ITEMS=1
-webcore_built_sources += \
-        DerivedSources/WebCore/JSDataTransferItem.cpp \
-        DerivedSources/WebCore/JSDataTransferItem.h \
-        DerivedSources/WebCore/JSDataTransferItems.cpp \
-        DerivedSources/WebCore/JSDataTransferItems.h \
-        DerivedSources/WebCore/JSStringCallback.cpp \
-        DerivedSources/WebCore/JSStringCallback.h
-webcore_sources += \
-	Source/WebCore/dom/DataTransferItem.cpp \
-	Source/WebCore/dom/DataTransferItem.h \
-	Source/WebCore/dom/DataTransferItems.h \
-	Source/WebCore/dom/StringCallback.cpp \
-	Source/WebCore/dom/StringCallback.h
 endif # END ENABLE_DATA_TRANSFER_ITEMS
 
 # ----
@@ -4108,27 +221,6 @@ endif # ENABLE_EVENTSOURCE
 if ENABLE_INDEXED_DATABASE
 FEATURE_DEFINES += ENABLE_INDEXED_DATABASE=1
 webcore_cppflags += -DENABLE_INDEXED_DATABASE=1
-webcore_built_sources += \
-	DerivedSources/WebCore/JSIDBAny.cpp \
-	DerivedSources/WebCore/JSIDBAny.h \
-	DerivedSources/WebCore/JSIDBDatabaseError.cpp \
-	DerivedSources/WebCore/JSIDBDatabaseError.h \
-	DerivedSources/WebCore/JSIDBDatabaseException.cpp \
-	DerivedSources/WebCore/JSIDBDatabaseException.h \
-	DerivedSources/WebCore/JSIDBDatabase.cpp \
-	DerivedSources/WebCore/JSIDBDatabase.h \
-	DerivedSources/WebCore/JSIDBFactory.cpp \
-	DerivedSources/WebCore/JSIDBFactory.h \
-	DerivedSources/WebCore/JSIDBIndex.cpp \
-	DerivedSources/WebCore/JSIDBIndex.h \
-	DerivedSources/WebCore/JSIDBKeyRange.cpp \
-	DerivedSources/WebCore/JSIDBKeyRange.h \
-	DerivedSources/WebCore/JSIDBObjectStore.cpp \
-	DerivedSources/WebCore/JSIDBObjectStore.h \
-	DerivedSources/WebCore/JSIDBRequest.cpp \
-	DerivedSources/WebCore/JSIDBRequest.h \
-	DerivedSources/WebCore/JSIDBTransaction.cpp \
-	DerivedSources/WebCore/JSIDBTransaction.h
 endif # END ENABLE_INDEXED_DATABASE
 
 # ----
@@ -4147,10 +239,6 @@ endif # END ENABLE_DIRECTORY_UPLOAD
 if ENABLE_DOM_STORAGE
 FEATURE_DEFINES += ENABLE_DOM_STORAGE=1
 webcore_cppflags += -DENABLE_DOM_STORAGE=1
-webcore_built_sources += \
-	DerivedSources/WebCore/JSStorage.cpp \
-	DerivedSources/WebCore/JSStorageEvent.cpp \
-	DerivedSources/WebCore/JSStorageEvent.h
 endif # END ENABLE_DOM_STORAGE
 
 # ----
@@ -4159,56 +247,24 @@ endif # END ENABLE_DOM_STORAGE
 if ENABLE_FILE_SYSTEM
 FEATURE_DEFINES += ENABLE_FILE_SYSTEM=1
 webcore_cppflags += -DENABLE_FILE_SYSTEM=1
-webcore_built_sources += \
-	DerivedSources/WebCore/JSDirectoryEntry.cpp \
-	DerivedSources/WebCore/JSDirectoryEntry.h \
-	DerivedSources/WebCore/JSDirectoryEntrySync.cpp \
-	DerivedSources/WebCore/JSDirectoryEntrySync.h \
-	DerivedSources/WebCore/JSDirectoryReader.cpp \
-	DerivedSources/WebCore/JSDirectoryReader.h \
-	DerivedSources/WebCore/JSDirectoryReaderSync.cpp \
-	DerivedSources/WebCore/JSDirectoryReaderSync.h \
-	DerivedSources/WebCore/JSDOMFileSystem.cpp \
-	DerivedSources/WebCore/JSDOMFileSystem.h \
-	DerivedSources/WebCore/JSDOMFileSystemSync.cpp \
-	DerivedSources/WebCore/JSDOMFileSystemSync.h \
-	DerivedSources/WebCore/JSEntriesCallback.cpp \
-	DerivedSources/WebCore/JSEntriesCallback.h \
-	DerivedSources/WebCore/JSEntry.cpp \
-	DerivedSources/WebCore/JSEntry.h \
-	DerivedSources/WebCore/JSEntryArray.cpp \
-	DerivedSources/WebCore/JSEntryArray.h \
-	DerivedSources/WebCore/JSEntryArraySync.cpp \
-	DerivedSources/WebCore/JSEntryArraySync.h \
-	DerivedSources/WebCore/JSEntryCallback.cpp \
-	DerivedSources/WebCore/JSEntryCallback.h \
-	DerivedSources/WebCore/JSEntrySync.cpp \
-	DerivedSources/WebCore/JSEntrySync.h \
-	DerivedSources/WebCore/JSErrorCallback.cpp \
-	DerivedSources/WebCore/JSErrorCallback.h \
-	DerivedSources/WebCore/JSFileCallback.cpp \
-	DerivedSources/WebCore/JSFileCallback.h \
-	DerivedSources/WebCore/JSFileEntry.cpp \
-	DerivedSources/WebCore/JSFileEntry.h \
-	DerivedSources/WebCore/JSFileEntrySync.cpp \
-	DerivedSources/WebCore/JSFileEntrySync.h \
-	DerivedSources/WebCore/JSFileSystemCallback.cpp \
-	DerivedSources/WebCore/JSFileSystemCallback.h \
-	DerivedSources/WebCore/JSFileWriter.cpp \
-	DerivedSources/WebCore/JSFileWriter.h \
-	DerivedSources/WebCore/JSFileWriterCallback.cpp \
-	DerivedSources/WebCore/JSFileWriterCallback.h \
-	DerivedSources/WebCore/JSFileWriterSync.cpp \
-	DerivedSources/WebCore/JSFileWriterSync.h \
-	DerivedSources/WebCore/JSFlags.cpp \
-	DerivedSources/WebCore/JSFlags.h \
-	DerivedSources/WebCore/JSMetadata.cpp \
-	DerivedSources/WebCore/JSMetadata.h \
-	DerivedSources/WebCore/JSMetadataCallback.cpp \
-	DerivedSources/WebCore/JSMetadataCallback.h
 endif # END ENABLE_FILE_SYSTEM
 
 # ----
+# Quota support
+# ----
+if ENABLE_QUOTA
+FEATURE_DEFINES += ENABLE_QUOTA=1
+webcore_cppflags += -DENABLE_QUOTA=1
+webcore_built_sources += \
+	DerivedSources/WebCore/JSStorageInfo.cpp \
+	DerivedSources/WebCore/JSStorageInfo.h \
+	DerivedSources/WebCore/JSStorageInfoErrorCallback.cpp \
+	DerivedSources/WebCore/JSStorageInfoErrorCallback.h \
+	DerivedSources/WebCore/JSStorageInfoUsageCallback.cpp \
+	DerivedSources/WebCore/JSStorageInfoUsageCallback.h
+endif # END ENABLE_QUOTA
+
+# ----
 # Speech Input API support
 # ----
 if ENABLE_INPUT_SPEECH
@@ -4284,6 +340,16 @@ webcore_cppflags += -DENABLE_FULLSCREEN_API=1
 endif # END ENABLE_FULLSCREEN_API
 
 # ----
+# Track Support
+# ----
+if ENABLE_VIDEO_TRACK
+FEATURE_DEFINES += ENABLE_VIDEO_TRACK=1
+webcore_cppflags += -DENABLE_VIDEO_TRACK=1
+else
+webcore_cppflags += -DENABLE_VIDEO_TRACK=0
+endif # END ENABLE_VIDEO_TRACK
+
+# ----
 # XHTML-MP Support
 # ----
 if ENABLE_XHTMLMP
@@ -4297,19 +363,6 @@ endif # END ENABLE_XHTMLMP
 if ENABLE_XPATH
 FEATURE_DEFINES += ENABLE_XPATH=1
 webcore_cppflags += -DENABLE_XPATH=1
-webcore_built_sources += \
-	DerivedSources/WebCore/JSXPathEvaluator.cpp \
-	DerivedSources/WebCore/JSXPathEvaluator.h \
-	DerivedSources/WebCore/JSXPathException.cpp \
-	DerivedSources/WebCore/JSXPathException.h \
-	DerivedSources/WebCore/JSXPathExpression.cpp \
-	DerivedSources/WebCore/JSXPathExpression.h \
-	DerivedSources/WebCore/JSXPathNSResolver.cpp \
-	DerivedSources/WebCore/JSXPathNSResolver.h \
-	DerivedSources/WebCore/JSXPathResult.cpp \
-	DerivedSources/WebCore/JSXPathResult.h \
-	DerivedSources/WebCore/XPathGrammar.cpp \
-	DerivedSources/WebCore/XPathGrammar.h
 
 # XPath grammar
 # NOTE: older versions of bison do not inject an inclusion guard, so we do it
@@ -4355,9 +408,6 @@ endif
 if ENABLE_WML
 FEATURE_DEFINES += ENABLE_WML=1
 webcore_cppflags += -DENABLE_WML=1
-webcore_built_sources += \
-	DerivedSources/WebCore/WMLElementFactory.cpp \
-	DerivedSources/WebCore/WMLNames.cpp
 
 # WML tag and attribute names
 DerivedSources/WebCore/WMLNames.cpp: DerivedSources/WebCore/WMLElementFactory.cpp
@@ -4426,288 +476,6 @@ FEATURE_DEFINES += ENABLE_SVG=1
 webcore_cppflags += -DENABLE_SVG=1
 WEBCORE_CSS_PROPERTY_NAMES += $(WebCore)/css/SVGCSSPropertyNames.in 
 WEBCORE_CSS_VALUE_KEYWORDS += $(WebCore)/css/SVGCSSValueKeywords.in
-webcore_built_sources += \
-	DerivedSources/WebCore/JSElementTimeControl.h \
-	DerivedSources/WebCore/JSSVGAElement.cpp \
-	DerivedSources/WebCore/JSSVGAElement.h \
-	DerivedSources/WebCore/JSSVGAltGlyphElement.cpp \
-	DerivedSources/WebCore/JSSVGAltGlyphElement.h \
-	DerivedSources/WebCore/JSSVGAngle.cpp \
-	DerivedSources/WebCore/JSSVGAngle.h \
-	DerivedSources/WebCore/JSSVGAnimateColorElement.cpp \
-	DerivedSources/WebCore/JSSVGAnimateColorElement.h \
-	DerivedSources/WebCore/JSSVGAnimatedAngle.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedAngle.h \
-	DerivedSources/WebCore/JSSVGAnimatedBoolean.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedBoolean.h \
-	DerivedSources/WebCore/JSSVGAnimatedEnumeration.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedEnumeration.h \
-	DerivedSources/WebCore/JSSVGAnimatedInteger.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedInteger.h \
-	DerivedSources/WebCore/JSSVGAnimatedLength.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedLength.h \
-	DerivedSources/WebCore/JSSVGAnimatedLengthList.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedLengthList.h \
-	DerivedSources/WebCore/JSSVGAnimatedNumber.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedNumber.h \
-	DerivedSources/WebCore/JSSVGAnimatedNumberList.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedNumberList.h \
-	DerivedSources/WebCore/JSSVGAnimatedPreserveAspectRatio.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedPreserveAspectRatio.h \
-	DerivedSources/WebCore/JSSVGAnimatedRect.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedRect.h \
-	DerivedSources/WebCore/JSSVGAnimatedString.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedString.h \
-	DerivedSources/WebCore/JSSVGAnimatedTransformList.cpp \
-	DerivedSources/WebCore/JSSVGAnimatedTransformList.h \
-	DerivedSources/WebCore/JSSVGAnimateElement.cpp \
-	DerivedSources/WebCore/JSSVGAnimateElement.h \
-	DerivedSources/WebCore/JSSVGAnimateTransformElement.cpp \
-	DerivedSources/WebCore/JSSVGAnimateTransformElement.h \
-	DerivedSources/WebCore/JSSVGAnimationElement.cpp \
-	DerivedSources/WebCore/JSSVGAnimationElement.h \
-	DerivedSources/WebCore/JSSVGCircleElement.cpp \
-	DerivedSources/WebCore/JSSVGCircleElement.h \
-	DerivedSources/WebCore/JSSVGClipPathElement.cpp \
-	DerivedSources/WebCore/JSSVGClipPathElement.h \
-	DerivedSources/WebCore/JSSVGColor.cpp \
-	DerivedSources/WebCore/JSSVGColor.h \
-	DerivedSources/WebCore/JSSVGComponentTransferFunctionElement.cpp \
-	DerivedSources/WebCore/JSSVGComponentTransferFunctionElement.h \
-	DerivedSources/WebCore/JSSVGCursorElement.cpp \
-	DerivedSources/WebCore/JSSVGCursorElement.h \
-	DerivedSources/WebCore/JSSVGDefsElement.cpp \
-	DerivedSources/WebCore/JSSVGDefsElement.h \
-	DerivedSources/WebCore/JSSVGDescElement.cpp \
-	DerivedSources/WebCore/JSSVGDescElement.h \
-	DerivedSources/WebCore/JSSVGDocument.cpp \
-	DerivedSources/WebCore/JSSVGDocument.h \
-	DerivedSources/WebCore/JSSVGElement.cpp \
-	DerivedSources/WebCore/JSSVGElement.h \
-	DerivedSources/WebCore/JSSVGElementInstance.cpp \
-	DerivedSources/WebCore/JSSVGElementInstanceList.cpp \
-	DerivedSources/WebCore/JSSVGElementInstanceList.h \
-	DerivedSources/WebCore/JSSVGEllipseElement.cpp \
-	DerivedSources/WebCore/JSSVGEllipseElement.h \
-	DerivedSources/WebCore/JSSVGException.cpp \
-	DerivedSources/WebCore/JSSVGException.h \
-	DerivedSources/WebCore/JSSVGExternalResourcesRequired.h \
-	DerivedSources/WebCore/JSSVGFEBlendElement.cpp \
-	DerivedSources/WebCore/JSSVGFEBlendElement.h \
-	DerivedSources/WebCore/JSSVGFEColorMatrixElement.cpp \
-	DerivedSources/WebCore/JSSVGFEColorMatrixElement.h \
-	DerivedSources/WebCore/JSSVGFEComponentTransferElement.cpp \
-	DerivedSources/WebCore/JSSVGFEComponentTransferElement.h \
-	DerivedSources/WebCore/JSSVGFECompositeElement.cpp \
-	DerivedSources/WebCore/JSSVGFECompositeElement.h \
-	DerivedSources/WebCore/JSSVGFEConvolveMatrixElement.cpp \
-	DerivedSources/WebCore/JSSVGFEConvolveMatrixElement.h \
-	DerivedSources/WebCore/JSSVGFEDiffuseLightingElement.cpp \
-	DerivedSources/WebCore/JSSVGFEDiffuseLightingElement.h \
-	DerivedSources/WebCore/JSSVGFEDisplacementMapElement.cpp \
-	DerivedSources/WebCore/JSSVGFEDisplacementMapElement.h \
-	DerivedSources/WebCore/JSSVGFEDistantLightElement.cpp \
-	DerivedSources/WebCore/JSSVGFEDistantLightElement.h \
-	DerivedSources/WebCore/JSSVGFEFloodElement.cpp \
-	DerivedSources/WebCore/JSSVGFEFloodElement.h \
-	DerivedSources/WebCore/JSSVGFEFuncAElement.cpp \
-	DerivedSources/WebCore/JSSVGFEFuncAElement.h \
-	DerivedSources/WebCore/JSSVGFEFuncBElement.cpp \
-	DerivedSources/WebCore/JSSVGFEFuncBElement.h \
-	DerivedSources/WebCore/JSSVGFEFuncGElement.cpp \
-	DerivedSources/WebCore/JSSVGFEFuncGElement.h \
-	DerivedSources/WebCore/JSSVGFEFuncRElement.cpp \
-	DerivedSources/WebCore/JSSVGFEFuncRElement.h \
-	DerivedSources/WebCore/JSSVGFEGaussianBlurElement.cpp \
-	DerivedSources/WebCore/JSSVGFEGaussianBlurElement.h \
-	DerivedSources/WebCore/JSSVGFEImageElement.cpp \
-	DerivedSources/WebCore/JSSVGFEImageElement.h \
-	DerivedSources/WebCore/JSSVGFEMergeElement.cpp \
-	DerivedSources/WebCore/JSSVGFEMergeElement.h \
-	DerivedSources/WebCore/JSSVGFEMergeNodeElement.cpp \
-	DerivedSources/WebCore/JSSVGFEMergeNodeElement.h \
-	DerivedSources/WebCore/JSSVGFEMorphologyElement.cpp \
-	DerivedSources/WebCore/JSSVGFEMorphologyElement.h \
-	DerivedSources/WebCore/JSSVGFEOffsetElement.cpp \
-	DerivedSources/WebCore/JSSVGFEOffsetElement.h \
-	DerivedSources/WebCore/JSSVGFEPointLightElement.cpp \
-	DerivedSources/WebCore/JSSVGFEPointLightElement.h \
-	DerivedSources/WebCore/JSSVGFESpecularLightingElement.cpp \
-	DerivedSources/WebCore/JSSVGFESpecularLightingElement.h \
-	DerivedSources/WebCore/JSSVGFESpotLightElement.cpp \
-	DerivedSources/WebCore/JSSVGFESpotLightElement.h \
-	DerivedSources/WebCore/JSSVGFETileElement.cpp \
-	DerivedSources/WebCore/JSSVGFETileElement.h \
-	DerivedSources/WebCore/JSSVGFETurbulenceElement.cpp \
-	DerivedSources/WebCore/JSSVGFETurbulenceElement.h \
-	DerivedSources/WebCore/JSSVGFilterElement.cpp \
-	DerivedSources/WebCore/JSSVGFilterElement.h \
-	DerivedSources/WebCore/JSSVGFilterPrimitiveStandardAttributes.h \
-	DerivedSources/WebCore/JSSVGFitToViewBox.h \
-	DerivedSources/WebCore/JSSVGFontElement.cpp \
-	DerivedSources/WebCore/JSSVGFontElement.h \
-	DerivedSources/WebCore/JSSVGFontFaceElement.cpp \
-	DerivedSources/WebCore/JSSVGFontFaceElement.h \
-	DerivedSources/WebCore/JSSVGFontFaceFormatElement.cpp \
-	DerivedSources/WebCore/JSSVGFontFaceFormatElement.h \
-	DerivedSources/WebCore/JSSVGFontFaceNameElement.cpp \
-	DerivedSources/WebCore/JSSVGFontFaceNameElement.h \
-	DerivedSources/WebCore/JSSVGFontFaceSrcElement.cpp \
-	DerivedSources/WebCore/JSSVGFontFaceSrcElement.h \
-	DerivedSources/WebCore/JSSVGFontFaceUriElement.cpp \
-	DerivedSources/WebCore/JSSVGFontFaceUriElement.h \
-	DerivedSources/WebCore/JSSVGForeignObjectElement.cpp \
-	DerivedSources/WebCore/JSSVGForeignObjectElement.h \
-	DerivedSources/WebCore/JSSVGGElement.cpp \
-	DerivedSources/WebCore/JSSVGGElement.h \
-	DerivedSources/WebCore/JSSVGGlyphElement.cpp \
-	DerivedSources/WebCore/JSSVGGlyphElement.h \
-	DerivedSources/WebCore/JSSVGGradientElement.cpp \
-	DerivedSources/WebCore/JSSVGGradientElement.h \
-	DerivedSources/WebCore/JSSVGHKernElement.cpp \
-	DerivedSources/WebCore/JSSVGHKernElement.h \
-	DerivedSources/WebCore/JSSVGImageElement.cpp \
-	DerivedSources/WebCore/JSSVGImageElement.h \
-	DerivedSources/WebCore/JSSVGLangSpace.h \
-	DerivedSources/WebCore/JSSVGLength.cpp \
-	DerivedSources/WebCore/JSSVGLength.h \
-	DerivedSources/WebCore/JSSVGLengthList.cpp \
-	DerivedSources/WebCore/JSSVGLengthList.h \
-	DerivedSources/WebCore/JSSVGLinearGradientElement.cpp \
-	DerivedSources/WebCore/JSSVGLinearGradientElement.h \
-	DerivedSources/WebCore/JSSVGLineElement.cpp \
-	DerivedSources/WebCore/JSSVGLineElement.h \
-	DerivedSources/WebCore/JSSVGLocatable.h \
-	DerivedSources/WebCore/JSSVGMarkerElement.cpp \
-	DerivedSources/WebCore/JSSVGMarkerElement.h \
-	DerivedSources/WebCore/JSSVGMaskElement.cpp \
-	DerivedSources/WebCore/JSSVGMaskElement.h \
-	DerivedSources/WebCore/JSSVGMatrix.cpp \
-	DerivedSources/WebCore/JSSVGMatrix.h \
-	DerivedSources/WebCore/JSSVGMetadataElement.cpp \
-	DerivedSources/WebCore/JSSVGMetadataElement.h \
-	DerivedSources/WebCore/JSSVGMissingGlyphElement.cpp \
-	DerivedSources/WebCore/JSSVGMissingGlyphElement.h \
-	DerivedSources/WebCore/JSSVGNumber.cpp \
-	DerivedSources/WebCore/JSSVGNumber.h \
-	DerivedSources/WebCore/JSSVGNumberList.cpp \
-	DerivedSources/WebCore/JSSVGNumberList.h \
-	DerivedSources/WebCore/JSSVGPaint.cpp \
-	DerivedSources/WebCore/JSSVGPaint.h \
-	DerivedSources/WebCore/JSSVGPathElement.cpp \
-	DerivedSources/WebCore/JSSVGPathElement.h \
-	DerivedSources/WebCore/JSSVGPathSegArcAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegArcAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegArcRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegArcRel.h \
-	DerivedSources/WebCore/JSSVGPathSegClosePath.cpp \
-	DerivedSources/WebCore/JSSVGPathSegClosePath.h \
-	DerivedSources/WebCore/JSSVGPathSeg.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicRel.h \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicSmoothAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicSmoothAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicSmoothRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicSmoothRel.h \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticRel.h \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticSmoothAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticSmoothRel.h \
-	DerivedSources/WebCore/JSSVGPathSeg.h \
-	DerivedSources/WebCore/JSSVGPathSegLinetoAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegLinetoAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegLinetoHorizontalAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegLinetoHorizontalAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegLinetoHorizontalRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegLinetoHorizontalRel.h \
-	DerivedSources/WebCore/JSSVGPathSegLinetoRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegLinetoRel.h \
-	DerivedSources/WebCore/JSSVGPathSegLinetoVerticalAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegLinetoVerticalAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegLinetoVerticalRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegLinetoVerticalRel.h \
-	DerivedSources/WebCore/JSSVGPathSegList.cpp \
-	DerivedSources/WebCore/JSSVGPathSegList.h \
-	DerivedSources/WebCore/JSSVGPathSegMovetoAbs.cpp \
-	DerivedSources/WebCore/JSSVGPathSegMovetoAbs.h \
-	DerivedSources/WebCore/JSSVGPathSegMovetoRel.cpp \
-	DerivedSources/WebCore/JSSVGPathSegMovetoRel.h \
-	DerivedSources/WebCore/JSSVGPatternElement.cpp \
-	DerivedSources/WebCore/JSSVGPatternElement.h \
-	DerivedSources/WebCore/JSSVGPoint.cpp \
-	DerivedSources/WebCore/JSSVGPoint.h \
-	DerivedSources/WebCore/JSSVGPointList.cpp \
-	DerivedSources/WebCore/JSSVGPointList.h \
-	DerivedSources/WebCore/JSSVGPolygonElement.cpp \
-	DerivedSources/WebCore/JSSVGPolygonElement.h \
-	DerivedSources/WebCore/JSSVGPolylineElement.cpp \
-	DerivedSources/WebCore/JSSVGPolylineElement.h \
-	DerivedSources/WebCore/JSSVGPreserveAspectRatio.cpp \
-	DerivedSources/WebCore/JSSVGPreserveAspectRatio.h \
-	DerivedSources/WebCore/JSSVGRadialGradientElement.cpp \
-	DerivedSources/WebCore/JSSVGRadialGradientElement.h \
-	DerivedSources/WebCore/JSSVGRect.cpp \
-	DerivedSources/WebCore/JSSVGRectElement.cpp \
-	DerivedSources/WebCore/JSSVGRectElement.h \
-	DerivedSources/WebCore/JSSVGRect.h \
-	DerivedSources/WebCore/JSSVGRenderingIntent.cpp \
-	DerivedSources/WebCore/JSSVGRenderingIntent.h \
-	DerivedSources/WebCore/JSSVGScriptElement.cpp \
-	DerivedSources/WebCore/JSSVGScriptElement.h \
-	DerivedSources/WebCore/JSSVGSetElement.cpp \
-	DerivedSources/WebCore/JSSVGSetElement.h \
-	DerivedSources/WebCore/JSSVGStopElement.cpp \
-	DerivedSources/WebCore/JSSVGStopElement.h \
-	DerivedSources/WebCore/JSSVGStringList.cpp \
-	DerivedSources/WebCore/JSSVGStringList.h \
-	DerivedSources/WebCore/JSSVGStylable.h \
-	DerivedSources/WebCore/JSSVGStyleElement.cpp \
-	DerivedSources/WebCore/JSSVGStyleElement.h \
-	DerivedSources/WebCore/JSSVGSVGElement.cpp \
-	DerivedSources/WebCore/JSSVGSVGElement.h \
-	DerivedSources/WebCore/JSSVGSwitchElement.cpp \
-	DerivedSources/WebCore/JSSVGSwitchElement.h \
-	DerivedSources/WebCore/JSSVGSymbolElement.cpp \
-	DerivedSources/WebCore/JSSVGSymbolElement.h \
-	DerivedSources/WebCore/JSSVGTests.h \
-	DerivedSources/WebCore/JSSVGTextContentElement.cpp \
-	DerivedSources/WebCore/JSSVGTextContentElement.h \
-	DerivedSources/WebCore/JSSVGTextElement.cpp \
-	DerivedSources/WebCore/JSSVGTextElement.h \
-	DerivedSources/WebCore/JSSVGTextPathElement.cpp \
-	DerivedSources/WebCore/JSSVGTextPathElement.h \
-	DerivedSources/WebCore/JSSVGTextPositioningElement.cpp \
-	DerivedSources/WebCore/JSSVGTextPositioningElement.h \
-	DerivedSources/WebCore/JSSVGTitleElement.cpp \
-	DerivedSources/WebCore/JSSVGTitleElement.h \
-	DerivedSources/WebCore/JSSVGTransformable.h \
-	DerivedSources/WebCore/JSSVGTransform.cpp \
-	DerivedSources/WebCore/JSSVGTransform.h \
-	DerivedSources/WebCore/JSSVGTransformList.cpp \
-	DerivedSources/WebCore/JSSVGTransformList.h \
-	DerivedSources/WebCore/JSSVGTRefElement.cpp \
-	DerivedSources/WebCore/JSSVGTRefElement.h \
-	DerivedSources/WebCore/JSSVGTSpanElement.cpp \
-	DerivedSources/WebCore/JSSVGTSpanElement.h \
-	DerivedSources/WebCore/JSSVGUnitTypes.cpp \
-	DerivedSources/WebCore/JSSVGUnitTypes.h \
-	DerivedSources/WebCore/JSSVGURIReference.h \
-	DerivedSources/WebCore/JSSVGUseElement.cpp \
-	DerivedSources/WebCore/JSSVGUseElement.h \
-	DerivedSources/WebCore/JSSVGViewElement.cpp \
-	DerivedSources/WebCore/JSSVGViewElement.h \
-	DerivedSources/WebCore/JSSVGViewSpec.h \
-	DerivedSources/WebCore/JSSVGVKernElement.cpp \
-	DerivedSources/WebCore/JSSVGVKernElement.h \
-	DerivedSources/WebCore/JSSVGZoomAndPan.h \
-	DerivedSources/WebCore/JSSVGZoomEvent.cpp \
-	DerivedSources/WebCore/JSSVGZoomEvent.h
 
 # SVG Features
 if ENABLE_SVG_USE
@@ -4766,102 +534,6 @@ DerivedSources/WebCore/XLinkNames.cpp : $(WebCore)/dom/make_names.pl $(WebCore)/
 if ENABLE_WEB_AUDIO
 FEATURE_DEFINES += ENABLE_WEB_AUDIO=1
 webcore_cppflags += -DENABLE_WEB_AUDIO=1
-webcore_sources += \
-	Source/WebCore/webaudio/AudioBasicProcessorNode.cpp \
-	Source/WebCore/webaudio/AudioBasicProcessorNode.h \
-	Source/WebCore/webaudio/AudioBuffer.cpp \
-	Source/WebCore/webaudio/AudioBuffer.h \
-	Source/WebCore/webaudio/AudioBufferSourceNode.cpp \
-	Source/WebCore/webaudio/AudioBufferSourceNode.h \
-	Source/WebCore/webaudio/AudioChannelMerger.cpp \
-	Source/WebCore/webaudio/AudioChannelMerger.h \
-	Source/WebCore/webaudio/AudioChannelSplitter.cpp \
-	Source/WebCore/webaudio/AudioChannelSplitter.h \
-	Source/WebCore/webaudio/AudioContext.cpp \
-	Source/WebCore/webaudio/AudioContext.h \
-	Source/WebCore/webaudio/AudioDestinationNode.cpp \
-	Source/WebCore/webaudio/AudioDestinationNode.h \
-	Source/WebCore/webaudio/AudioGain.h \
-	Source/WebCore/webaudio/AudioGainNode.cpp \
-	Source/WebCore/webaudio/AudioGainNode.h \
-	Source/WebCore/webaudio/AudioListener.cpp \
-	Source/WebCore/webaudio/AudioListener.h \
-	Source/WebCore/webaudio/AudioNode.cpp \
-	Source/WebCore/webaudio/AudioNode.h \
-	Source/WebCore/webaudio/AudioNodeInput.cpp \
-	Source/WebCore/webaudio/AudioNodeInput.h \
-	Source/WebCore/webaudio/AudioNodeOutput.cpp \
-	Source/WebCore/webaudio/AudioNodeOutput.h \
-	Source/WebCore/webaudio/AudioPannerNode.cpp \
-	Source/WebCore/webaudio/AudioPannerNode.h \
-	Source/WebCore/webaudio/AudioParam.cpp \
-	Source/WebCore/webaudio/AudioParam.h \
-	Source/WebCore/webaudio/AudioProcessingEvent.cpp \
-	Source/WebCore/webaudio/AudioProcessingEvent.h \
-	Source/WebCore/webaudio/AudioSourceNode.h \
-	Source/WebCore/webaudio/BiquadDSPKernel.cpp \
-	Source/WebCore/webaudio/BiquadDSPKernel.h \
-	Source/WebCore/webaudio/BiquadProcessor.cpp \
-	Source/WebCore/webaudio/BiquadProcessor.h \
-	Source/WebCore/webaudio/ConvolverNode.cpp \
-	Source/WebCore/webaudio/ConvolverNode.h \
-	Source/WebCore/webaudio/DelayDSPKernel.cpp \
-	Source/WebCore/webaudio/DelayDSPKernel.h \
-	Source/WebCore/webaudio/DelayNode.cpp \
-	Source/WebCore/webaudio/DelayNode.h \
-	Source/WebCore/webaudio/DelayProcessor.cpp \
-	Source/WebCore/webaudio/DelayProcessor.h \
-	Source/WebCore/webaudio/HighPass2FilterNode.cpp \
-	Source/WebCore/webaudio/HighPass2FilterNode.h \
-	Source/WebCore/webaudio/JavaScriptAudioNode.cpp \
-	Source/WebCore/webaudio/JavaScriptAudioNode.h \
-	Source/WebCore/webaudio/LowPass2FilterNode.cpp \
-	Source/WebCore/webaudio/LowPass2FilterNode.h \
-	Source/WebCore/webaudio/RealtimeAnalyser.cpp \
-	Source/WebCore/webaudio/RealtimeAnalyser.h \
-	Source/WebCore/webaudio/RealtimeAnalyserNode.cpp \
-	Source/WebCore/webaudio/RealtimeAnalyserNode.h
-webcore_built_sources += \
-	DerivedSources/WebCore/JSAudioBuffer.cpp \
-	DerivedSources/WebCore/JSAudioBuffer.h \
-	DerivedSources/WebCore/JSAudioBufferSourceNode.cpp \
-	DerivedSources/WebCore/JSAudioBufferSourceNode.h \
-	DerivedSources/WebCore/JSAudioChannelMerger.cpp \
-	DerivedSources/WebCore/JSAudioChannelMerger.h \
-	DerivedSources/WebCore/JSAudioChannelSplitter.cpp \
-	DerivedSources/WebCore/JSAudioChannelSplitter.h \
-	DerivedSources/WebCore/JSAudioContext.cpp \
-	DerivedSources/WebCore/JSAudioContext.h \
-	DerivedSources/WebCore/JSAudioDestinationNode.cpp \
-	DerivedSources/WebCore/JSAudioDestinationNode.h \
-	DerivedSources/WebCore/JSAudioGain.cpp \
-	DerivedSources/WebCore/JSAudioGain.h \
-	DerivedSources/WebCore/JSAudioGainNode.cpp \
-	DerivedSources/WebCore/JSAudioGainNode.h \
-	DerivedSources/WebCore/JSAudioListener.cpp \
-	DerivedSources/WebCore/JSAudioListener.h \
-	DerivedSources/WebCore/JSAudioNode.cpp \
-	DerivedSources/WebCore/JSAudioNode.h \
-	DerivedSources/WebCore/JSAudioPannerNode.cpp \
-	DerivedSources/WebCore/JSAudioPannerNode.h \
-	DerivedSources/WebCore/JSAudioParam.cpp \
-	DerivedSources/WebCore/JSAudioParam.h \
-	DerivedSources/WebCore/JSAudioProcessingEvent.cpp \
-	DerivedSources/WebCore/JSAudioProcessingEvent.h \
-	DerivedSources/WebCore/JSAudioSourceNode.cpp \
-	DerivedSources/WebCore/JSAudioSourceNode.h \
-	DerivedSources/WebCore/JSConvolverNode.cpp \
-	DerivedSources/WebCore/JSConvolverNode.h \
-	DerivedSources/WebCore/JSDelayNode.cpp \
-	DerivedSources/WebCore/JSDelayNode.h \
-	DerivedSources/WebCore/JSHighPass2FilterNode.cpp \
-	DerivedSources/WebCore/JSHighPass2FilterNode.h \
-	DerivedSources/WebCore/JSJavaScriptAudioNode.cpp \
-	DerivedSources/WebCore/JSJavaScriptAudioNode.h \
-	DerivedSources/WebCore/JSLowPass2FilterNode.cpp \
-	DerivedSources/WebCore/JSLowPass2FilterNode.h \
-	DerivedSources/WebCore/JSRealtimeAnalyserNode.cpp \
-	DerivedSources/WebCore/JSRealtimeAnalyserNode.h
 endif
 
 # ----
@@ -4870,9 +542,6 @@ endif
 if ENABLE_WEB_SOCKETS
 FEATURE_DEFINES += ENABLE_WEB_SOCKETS=1
 webcore_cppflags += -DENABLE_WEB_SOCKETS=1
-webcore_built_sources += \
-	DerivedSources/WebCore/JSWebSocket.cpp \
-	DerivedSources/WebCore/JSWebSocket.h
 else
 webcore_cppflags += -DENABLE_WEB_SOCKETS=0
 endif  # END ENABLE_WEB_SOCKETS
@@ -4891,44 +560,9 @@ endif  # END ENABLE_BLOB
 if ENABLE_WEBGL
 FEATURE_DEFINES += ENABLE_WEBGL=1
 webcore_cppflags += -DENABLE_WEBGL=1
-webcore_sources += \
-	Source/WebCore/html/canvas/WebGLActiveInfo.h \
-	Source/WebCore/html/canvas/WebGLBuffer.cpp \
-	Source/WebCore/html/canvas/WebGLBuffer.h \
-	Source/WebCore/html/canvas/WebGLContextAttributes.cpp \
-	Source/WebCore/html/canvas/WebGLContextAttributes.h \
-	Source/WebCore/html/canvas/WebGLContextEvent.cpp \
-	Source/WebCore/html/canvas/WebGLContextEvent.h \
-	Source/WebCore/html/canvas/WebGLFramebuffer.cpp \
-	Source/WebCore/html/canvas/WebGLFramebuffer.h \
-	Source/WebCore/html/canvas/WebGLGetInfo.cpp \
-	Source/WebCore/html/canvas/WebGLGetInfo.h \
-	Source/WebCore/html/canvas/WebGLObject.cpp \
-	Source/WebCore/html/canvas/WebGLObject.h \
-	Source/WebCore/html/canvas/WebGLProgram.cpp \
-	Source/WebCore/html/canvas/WebGLProgram.h \
-	Source/WebCore/html/canvas/WebGLRenderbuffer.cpp \
-	Source/WebCore/html/canvas/WebGLRenderbuffer.h \
-	Source/WebCore/html/canvas/WebGLRenderingContext.cpp \
-	Source/WebCore/html/canvas/WebGLRenderingContext.h \
-	Source/WebCore/html/canvas/WebGLShader.cpp \
-	Source/WebCore/html/canvas/WebGLShader.h \
-	Source/WebCore/html/canvas/WebGLTexture.cpp \
-	Source/WebCore/html/canvas/WebGLTexture.h \
-	Source/WebCore/html/canvas/WebGLUniformLocation.cpp \
-	Source/WebCore/html/canvas/WebGLUniformLocation.h \
-	Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.cpp \
-	Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.h \
-	Source/WebCore/html/canvas/OESStandardDerivatives.cpp \
-	Source/WebCore/html/canvas/OESStandardDerivatives.h \
-	Source/WebCore/html/canvas/OESTextureFloat.cpp \
-	Source/WebCore/html/canvas/OESTextureFloat.h \
-	Source/WebCore/html/canvas/OESVertexArrayObject.cpp \
-	Source/WebCore/html/canvas/OESVertexArrayObject.h \
-	Source/WebCore/html/canvas/WebKitLoseContext.cpp \
-	Source/WebCore/html/canvas/WebKitLoseContext.h
 endif  # END ENABLE_WEBGL
 
+
 DerivedSources/WebCore/CSSPropertyNames.cpp: DerivedSources/WebCore/CSSPropertyNames.h
 DerivedSources/WebCore/CSSPropertyNames.h: $(WEBCORE_CSS_PROPERTY_NAMES) $(WebCore)/css/makeprop.pl
 	if sort $(WEBCORE_CSS_PROPERTY_NAMES) | uniq -d | grep -E '^[^#]'; then echo 'Duplicate value!'; exit 1; fi
@@ -4949,9 +583,13 @@ DerivedSources/WebCore/HashTools.h: DerivedSources/WebCore/DocTypeStrings.cpp
 DerivedSources/WebCore/DocTypeStrings.cpp: $(WebCore)/html/DocTypeStrings.gperf $(WebCore)/make-hash-tools.pl
 	$(PERL) $(WebCore)/make-hash-tools.pl $(GENSOURCES_WEBCORE) $(WebCore)/html/DocTypeStrings.gperf
 
-# XML Viewer XSL
-DerivedSources/WebCore/XMLViewerXSL.h: $(WebCore)/xml/XMLViewer.xsl
-	$(PERL) $(WebCore)/inspector/xxd.pl XMLViewer_xsl $(WebCore)/xml/XMLViewer.xsl $(GENSOURCES_WEBCORE)/XMLViewerXSL.h
+# XML Viewer CSS
+DerivedSources/WebCore/XMLViewerCSS.h: $(WebCore)/xml/XMLViewer.css
+	$(PERL) $(WebCore)/inspector/xxd.pl XMLViewer_css $(WebCore)/xml/XMLViewer.css $(GENSOURCES_WEBCORE)/XMLViewerCSS.h
+
+# XML Viewer JS
+DerivedSources/WebCore/XMLViewerJS.h: $(WebCore)/xml/XMLViewer.js
+	$(PERL) $(WebCore)/inspector/xxd.pl XMLViewer_js $(WebCore)/xml/XMLViewer.js $(GENSOURCES_WEBCORE)/XMLViewerJS.h
 
 # HTML entity names
 DerivedSources/WebCore/HTMLEntityTable.cpp: $(WebCore)/html/parser/HTMLEntityNames.in $(WebCore)/html/parser/create-html-entity-table
@@ -5036,6 +674,14 @@ DerivedSources/WebCore/InspectorBackendDispatcher.h: DerivedSources/WebCore/Insp
 DerivedSources/WebCore/InjectedScriptSource.h: $(WebCore)/inspector/InjectedScriptSource.js
 	perl $(WebCore)/inspector/xxd.pl InjectedScriptSource_js $(WebCore)/inspector/InjectedScriptSource.js $(GENSOURCES_WEBCORE)/InjectedScriptSource.h
 
+# ANGLE tokenizer & parser
+DerivedSources/ANGLE/glslang.cpp: Source/ThirdParty/ANGLE/src/compiler/glslang.l
+	$(AM_V_GEN)$(FLEX) --noline --nounistd --outfile="$@" "$<"
+
+DerivedSources/ANGLE/glslang_tab.cpp: Source/ThirdParty/ANGLE/src/compiler/glslang.y
+	$(AM_V_GEN)$(BISON) --no-lines --defines="DerivedSources/ANGLE/glslang_tab.h" --skeleton=yacc.c --output="$@" $<
+DerivedSources/ANGLE/glslang_tab.h: DerivedSources/ANGLE/glslang_tab.cpp
+
 IDL_PATH := \
     $(WebCore)/bindings/js \
     $(WebCore)/css \
@@ -5106,6 +752,7 @@ libWebCore_la_CPPFLAGS = \
 	$(LIBXSLT_CFLAGS) \
 	$(SQLITE3_CFLAGS) \
 	$(UNICODE_CFLAGS) \
+	$(XRENDER_CFLAGS) \
 	$(XT_CFLAGS)
 
 EXTRA_DIST += \
@@ -5179,7 +826,8 @@ EXTRA_DIST += \
 	Source/WebCore/svg/xlinkattrs.in \
 	Source/WebCore/xml/xmlattrs.in \
 	Source/WebCore/xml/xmlnsattrs.in \
-	Source/WebCore/xml/XMLViewer.xsl \
+	Source/WebCore/xml/XMLViewer.css \
+	Source/WebCore/xml/XMLViewer.js \
 	Source/WebCore/xml/XPathGrammar.y
 
 # Installing web inspector files
@@ -5191,6 +839,10 @@ dist_webinspector_DATA = \
 	$(shell ls $(WebCore)/inspector/front-end/*.html) \
 	$(shell ls $(WebCore)/inspector/front-end/*.css)
 
+webinspectoruglifyjsdir = ${datadir}/webkitgtk-@WEBKITGTK_API_VERSION@/webinspector/UglifyJS
+dist_webinspectoruglifyjs_DATA = \
+	$(shell ls $(WebCore)/inspector/front-end/UglifyJS/*.js)
+
 webinspectorimagesdir = ${datadir}/webkitgtk-@WEBKITGTK_API_VERSION@/webinspector/Images
 dist_webinspectorimages_DATA = \
 	$(shell ls $(WebCore)/inspector/front-end/Images/*.gif) \
@@ -5201,12 +853,15 @@ dist_webinspectorimages_DATA = \
 noinst_DATA = ${GENSOURCES_INSPECTOR}/inspector.html
 ${GENSOURCES_INSPECTOR}/inspector.html: $(WebCore)/inspector/front-end/*.html \
 		$(WebCore)/inspector/front-end/*.js \
+		$(WebCore)/inspector/front-end/UglifyJS/*.js \
 		$(WebCore)/inspector/front-end/*.css \
 		$(WebCore)/inspector/front-end/Images/* \
 		DerivedSources/WebCore/InspectorBackendStub.js \
 		$(WebCore)/English.lproj/localizedStrings.js
+	$(AM_V_GEN)mkdir -p ${GENSOURCES_INSPECTOR}/UglifyJS
 	$(AM_V_GEN)mkdir -p ${GENSOURCES_INSPECTOR}/images
 	$(AM_V_at)cp ${dist_webinspector_DATA} ${GENSOURCES_INSPECTOR}
+	$(AM_V_at)cp ${dist_webinspectoruglifyjs_DATA} ${GENSOURCES_INSPECTOR}/UglifyJS
 	$(AM_V_at)cp ${dist_webinspectorimages_DATA} ${GENSOURCES_INSPECTOR}/images
 
 webresourcesdir = ${datadir}/webkitgtk-@WEBKITGTK_API_VERSION@/images
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
new file mode 100644
index 0000000..2801232
--- /dev/null
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -0,0 +1,4636 @@
+webcore_built_nosources += \
+	DerivedSources/WebCore/tokenizer.cpp
+
+webcore_built_sources += \
+	DerivedSources/WebCore/CSSGrammar.cpp \
+	DerivedSources/WebCore/CSSGrammar.h \
+	DerivedSources/WebCore/CSSPropertyNames.h \
+	DerivedSources/WebCore/CSSPropertyNames.cpp \
+	DerivedSources/WebCore/CSSValueKeywords.h \
+	DerivedSources/WebCore/CSSValueKeywords.cpp \
+	DerivedSources/WebCore/ColorData.cpp \
+	DerivedSources/WebCore/DocTypeStrings.cpp \
+	DerivedSources/WebCore/HashTools.h \
+	DerivedSources/WebCore/HTMLElementFactory.cpp \
+	DerivedSources/WebCore/HTMLElementFactory.h \
+	DerivedSources/WebCore/HTMLEntityTable.cpp \
+	DerivedSources/WebCore/HTMLNames.cpp \
+	DerivedSources/WebCore/HTMLNames.h \
+	DerivedSources/WebCore/InjectedScriptSource.h \
+	DerivedSources/WebCore/InspectorBackendDispatcher.cpp \
+	DerivedSources/WebCore/InspectorBackendDispatcher.h \
+	DerivedSources/WebCore/InspectorFrontend.cpp \
+	DerivedSources/WebCore/InspectorFrontend.h \
+	DerivedSources/WebCore/JSAbstractWorker.cpp \
+	DerivedSources/WebCore/JSAbstractWorker.h \
+	DerivedSources/WebCore/JSArrayBuffer.cpp \
+	DerivedSources/WebCore/JSArrayBuffer.h \
+	DerivedSources/WebCore/JSArrayBufferView.cpp \
+	DerivedSources/WebCore/JSArrayBufferView.h \
+	DerivedSources/WebCore/JSAttr.cpp \
+	DerivedSources/WebCore/JSAttr.h \
+	DerivedSources/WebCore/JSAudioContext.cpp \
+	DerivedSources/WebCore/JSAudioContext.h \
+	DerivedSources/WebCore/JSAudioPannerNode.cpp \
+	DerivedSources/WebCore/JSAudioPannerNode.h \
+	DerivedSources/WebCore/JSBarInfo.cpp \
+	DerivedSources/WebCore/JSBarInfo.h \
+	DerivedSources/WebCore/JSBeforeLoadEvent.cpp \
+	DerivedSources/WebCore/JSBeforeLoadEvent.h \
+	DerivedSources/WebCore/JSBeforeProcessEvent.cpp \
+	DerivedSources/WebCore/JSBeforeProcessEvent.h \
+	DerivedSources/WebCore/JSBlob.cpp \
+	DerivedSources/WebCore/JSBlob.h \
+	DerivedSources/WebCore/JSCanvasGradient.cpp \
+	DerivedSources/WebCore/JSCanvasGradient.h \
+	DerivedSources/WebCore/JSCanvasPattern.cpp \
+	DerivedSources/WebCore/JSCanvasPattern.h \
+	DerivedSources/WebCore/JSCanvasRenderingContext2D.cpp \
+	DerivedSources/WebCore/JSCanvasRenderingContext2D.h \
+	DerivedSources/WebCore/JSCanvasRenderingContext.cpp \
+	DerivedSources/WebCore/JSCanvasRenderingContext.h \
+	DerivedSources/WebCore/JSCDATASection.cpp \
+	DerivedSources/WebCore/JSCDATASection.h \
+	DerivedSources/WebCore/JSCharacterData.cpp \
+	DerivedSources/WebCore/JSCharacterData.h \
+	DerivedSources/WebCore/JSClientRect.cpp \
+	DerivedSources/WebCore/JSClientRect.h \
+	DerivedSources/WebCore/JSClientRectList.cpp \
+	DerivedSources/WebCore/JSClientRectList.h \
+	DerivedSources/WebCore/JSClipboard.cpp \
+	DerivedSources/WebCore/JSClipboard.h \
+	DerivedSources/WebCore/JSComment.cpp \
+	DerivedSources/WebCore/JSComment.h \
+	DerivedSources/WebCore/JSCompositionEvent.cpp \
+	DerivedSources/WebCore/JSCompositionEvent.h \
+	DerivedSources/WebCore/JSConsole.cpp \
+	DerivedSources/WebCore/JSConsole.h \
+	DerivedSources/WebCore/JSCoordinates.cpp \
+	DerivedSources/WebCore/JSCoordinates.h \
+	DerivedSources/WebCore/JSCounter.cpp \
+	DerivedSources/WebCore/JSCounter.h \
+	DerivedSources/WebCore/JSCrypto.cpp \
+	DerivedSources/WebCore/JSCrypto.h \
+	DerivedSources/WebCore/JSCSSCharsetRule.cpp \
+	DerivedSources/WebCore/JSCSSCharsetRule.h \
+	DerivedSources/WebCore/JSCSSFontFaceRule.cpp \
+	DerivedSources/WebCore/JSCSSFontFaceRule.h \
+	DerivedSources/WebCore/JSCSSImportRule.cpp \
+	DerivedSources/WebCore/JSCSSImportRule.h \
+	DerivedSources/WebCore/JSCSSMediaRule.cpp \
+	DerivedSources/WebCore/JSCSSMediaRule.h \
+	DerivedSources/WebCore/JSCSSPageRule.cpp \
+	DerivedSources/WebCore/JSCSSPageRule.h \
+	DerivedSources/WebCore/JSCSSPrimitiveValue.cpp \
+	DerivedSources/WebCore/JSCSSPrimitiveValue.h \
+	DerivedSources/WebCore/JSCSSRule.cpp \
+	DerivedSources/WebCore/JSCSSRule.h \
+	DerivedSources/WebCore/JSCSSRuleList.cpp \
+	DerivedSources/WebCore/JSCSSRuleList.h \
+	DerivedSources/WebCore/JSCSSStyleDeclaration.cpp \
+	DerivedSources/WebCore/JSCSSStyleDeclaration.h \
+	DerivedSources/WebCore/JSCSSStyleRule.cpp \
+	DerivedSources/WebCore/JSCSSStyleRule.h \
+	DerivedSources/WebCore/JSCSSStyleSheet.cpp \
+	DerivedSources/WebCore/JSCSSStyleSheet.h \
+	DerivedSources/WebCore/JSCSSValue.cpp \
+	DerivedSources/WebCore/JSCSSValue.h \
+	DerivedSources/WebCore/JSCSSValueList.cpp \
+	DerivedSources/WebCore/JSCSSValueList.h \
+	DerivedSources/WebCore/JSCustomEvent.cpp \
+	DerivedSources/WebCore/JSCustomEvent.h \
+	DerivedSources/WebCore/JSDataGridColumn.cpp \
+	DerivedSources/WebCore/JSDataGridColumn.h \
+	DerivedSources/WebCore/JSDataGridColumnList.cpp \
+	DerivedSources/WebCore/JSDataGridColumnList.h \
+	DerivedSources/WebCore/JSDataTransferItems.h \
+	DerivedSources/WebCore/JSDataTransferItems.cpp \
+	DerivedSources/WebCore/JSDataView.cpp \
+	DerivedSources/WebCore/JSDataView.h \
+	DerivedSources/WebCore/JSDedicatedWorkerContext.cpp \
+	DerivedSources/WebCore/JSDedicatedWorkerContext.h \
+	DerivedSources/WebCore/JSDeviceMotionEvent.cpp \
+	DerivedSources/WebCore/JSDeviceMotionEvent.h \
+	DerivedSources/WebCore/JSDeviceOrientationEvent.cpp \
+	DerivedSources/WebCore/JSDeviceOrientationEvent.h \
+	DerivedSources/WebCore/JSDocument.cpp \
+	DerivedSources/WebCore/JSDocumentFragment.cpp \
+	DerivedSources/WebCore/JSDocumentFragment.h \
+	DerivedSources/WebCore/JSDocument.h \
+	DerivedSources/WebCore/JSDocumentType.cpp \
+	DerivedSources/WebCore/JSDocumentType.h \
+	DerivedSources/WebCore/JSDOMApplicationCache.h \
+	DerivedSources/WebCore/JSDOMCoreException.cpp \
+	DerivedSources/WebCore/JSDOMCoreException.h \
+	DerivedSources/WebCore/JSDOMFormData.cpp \
+	DerivedSources/WebCore/JSDOMFormData.h \
+	DerivedSources/WebCore/JSDOMImplementation.cpp \
+	DerivedSources/WebCore/JSDOMImplementation.h \
+	DerivedSources/WebCore/JSDOMMimeTypeArray.cpp \
+	DerivedSources/WebCore/JSDOMMimeTypeArray.h \
+	DerivedSources/WebCore/JSDOMMimeType.cpp \
+	DerivedSources/WebCore/JSDOMMimeType.h \
+	DerivedSources/WebCore/JSDOMParser.cpp \
+	DerivedSources/WebCore/JSDOMParser.h \
+	DerivedSources/WebCore/JSDOMPluginArray.cpp \
+	DerivedSources/WebCore/JSDOMPluginArray.h \
+	DerivedSources/WebCore/JSDOMPlugin.cpp \
+	DerivedSources/WebCore/JSDOMPlugin.h \
+	DerivedSources/WebCore/JSDOMSelection.cpp \
+	DerivedSources/WebCore/JSDOMSelection.h \
+	DerivedSources/WebCore/JSDOMSettableTokenList.cpp \
+	DerivedSources/WebCore/JSDOMSettableTokenList.h \
+	DerivedSources/WebCore/JSDOMStringList.cpp \
+	DerivedSources/WebCore/JSDOMStringList.h \
+	DerivedSources/WebCore/JSDOMStringMap.cpp \
+	DerivedSources/WebCore/JSDOMStringMap.h \
+	DerivedSources/WebCore/JSDOMTokenList.cpp \
+	DerivedSources/WebCore/JSDOMTokenList.h \
+	DerivedSources/WebCore/JSDOMURL.cpp \
+	DerivedSources/WebCore/JSDOMURL.h \
+	DerivedSources/WebCore/JSDOMWindow.cpp \
+	DerivedSources/WebCore/JSDOMWindow.h \
+	DerivedSources/WebCore/JSElement.cpp \
+	DerivedSources/WebCore/JSElement.h \
+	DerivedSources/WebCore/JSEntity.cpp \
+	DerivedSources/WebCore/JSEntity.h \
+	DerivedSources/WebCore/JSEntityReference.cpp \
+	DerivedSources/WebCore/JSEntityReference.h \
+	DerivedSources/WebCore/JSErrorEvent.cpp \
+	DerivedSources/WebCore/JSErrorEvent.h \
+	DerivedSources/WebCore/JSEvent.cpp \
+	DerivedSources/WebCore/JSEventException.cpp \
+	DerivedSources/WebCore/JSEventException.h \
+	DerivedSources/WebCore/JSEvent.h \
+	DerivedSources/WebCore/JSEventSource.cpp \
+	DerivedSources/WebCore/JSEventSource.h \
+	DerivedSources/WebCore/JSFile.cpp \
+	DerivedSources/WebCore/JSFileError.cpp \
+	DerivedSources/WebCore/JSFileError.h \
+	DerivedSources/WebCore/JSFile.h \
+	DerivedSources/WebCore/JSFileException.cpp \
+	DerivedSources/WebCore/JSFileException.h \
+	DerivedSources/WebCore/JSFileList.cpp \
+	DerivedSources/WebCore/JSFileList.h \
+	DerivedSources/WebCore/JSFileReader.cpp \
+	DerivedSources/WebCore/JSFileReader.h \
+	DerivedSources/WebCore/JSFileReaderSync.cpp \
+	DerivedSources/WebCore/JSFileReaderSync.h \
+	DerivedSources/WebCore/JSFloat32Array.cpp \
+	DerivedSources/WebCore/JSFloat32Array.h \
+	DerivedSources/WebCore/JSGeolocation.cpp \
+	DerivedSources/WebCore/JSGeolocation.h \
+	DerivedSources/WebCore/JSGeoposition.cpp \
+	DerivedSources/WebCore/JSGeoposition.h \
+	DerivedSources/WebCore/JSHashChangeEvent.cpp \
+	DerivedSources/WebCore/JSHashChangeEvent.h \
+	DerivedSources/WebCore/JSHistory.cpp \
+	DerivedSources/WebCore/JSHistory.h \
+	DerivedSources/WebCore/JSHTMLAllCollection.cpp \
+	DerivedSources/WebCore/JSHTMLAllCollection.h \
+	DerivedSources/WebCore/JSHTMLAnchorElement.cpp \
+	DerivedSources/WebCore/JSHTMLAnchorElement.h \
+	DerivedSources/WebCore/JSHTMLAppletElement.cpp \
+	DerivedSources/WebCore/JSHTMLAppletElement.h \
+	DerivedSources/WebCore/JSHTMLAreaElement.cpp \
+	DerivedSources/WebCore/JSHTMLAreaElement.h \
+	DerivedSources/WebCore/JSHTMLAudioElement.cpp \
+	DerivedSources/WebCore/JSHTMLAudioElement.h \
+	DerivedSources/WebCore/JSHTMLBaseElement.cpp \
+	DerivedSources/WebCore/JSHTMLBaseElement.h \
+	DerivedSources/WebCore/JSHTMLBaseFontElement.cpp \
+	DerivedSources/WebCore/JSHTMLBaseFontElement.h \
+	DerivedSources/WebCore/JSHTMLBlockquoteElement.cpp \
+	DerivedSources/WebCore/JSHTMLBlockquoteElement.h \
+	DerivedSources/WebCore/JSHTMLBodyElement.cpp \
+	DerivedSources/WebCore/JSHTMLBodyElement.h \
+	DerivedSources/WebCore/JSHTMLBRElement.cpp \
+	DerivedSources/WebCore/JSHTMLBRElement.h \
+	DerivedSources/WebCore/JSHTMLButtonElement.cpp \
+	DerivedSources/WebCore/JSHTMLButtonElement.h \
+	DerivedSources/WebCore/JSHTMLCanvasElement.cpp \
+	DerivedSources/WebCore/JSHTMLCanvasElement.h \
+	DerivedSources/WebCore/JSHTMLCollection.cpp \
+	DerivedSources/WebCore/JSHTMLCollection.h \
+	DerivedSources/WebCore/JSHTMLDataGridCellElement.cpp \
+	DerivedSources/WebCore/JSHTMLDataGridCellElement.h \
+	DerivedSources/WebCore/JSHTMLDataGridColElement.cpp \
+	DerivedSources/WebCore/JSHTMLDataGridColElement.h \
+	DerivedSources/WebCore/JSHTMLDataGridElement.cpp \
+	DerivedSources/WebCore/JSHTMLDataGridElement.h \
+	DerivedSources/WebCore/JSHTMLDataGridRowElement.cpp \
+	DerivedSources/WebCore/JSHTMLDataGridRowElement.h \
+	DerivedSources/WebCore/JSHTMLDataListElement.cpp \
+	DerivedSources/WebCore/JSHTMLDataListElement.h \
+	DerivedSources/WebCore/JSHTMLDetailsElement.cpp \
+	DerivedSources/WebCore/JSHTMLDetailsElement.h \
+	DerivedSources/WebCore/JSHTMLDirectoryElement.cpp \
+	DerivedSources/WebCore/JSHTMLDirectoryElement.h \
+	DerivedSources/WebCore/JSHTMLDivElement.cpp \
+	DerivedSources/WebCore/JSHTMLDivElement.h \
+	DerivedSources/WebCore/JSHTMLDListElement.cpp \
+	DerivedSources/WebCore/JSHTMLDListElement.h \
+	DerivedSources/WebCore/JSHTMLDocument.cpp \
+	DerivedSources/WebCore/JSHTMLDocument.h \
+	DerivedSources/WebCore/JSHTMLElement.cpp \
+	DerivedSources/WebCore/JSHTMLElement.h \
+	DerivedSources/WebCore/JSHTMLElementWrapperFactory.cpp \
+	DerivedSources/WebCore/JSHTMLEmbedElement.cpp \
+	DerivedSources/WebCore/JSHTMLEmbedElement.h \
+	DerivedSources/WebCore/JSHTMLFieldSetElement.cpp \
+	DerivedSources/WebCore/JSHTMLFieldSetElement.h \
+	DerivedSources/WebCore/JSHTMLFontElement.cpp \
+	DerivedSources/WebCore/JSHTMLFontElement.h \
+	DerivedSources/WebCore/JSHTMLFormElement.cpp \
+	DerivedSources/WebCore/JSHTMLFormElement.h \
+	DerivedSources/WebCore/JSHTMLFrameElement.cpp \
+	DerivedSources/WebCore/JSHTMLFrameElement.h \
+	DerivedSources/WebCore/JSHTMLFrameSetElement.cpp \
+	DerivedSources/WebCore/JSHTMLFrameSetElement.h \
+	DerivedSources/WebCore/JSHTMLHeadElement.cpp \
+	DerivedSources/WebCore/JSHTMLHeadElement.h \
+	DerivedSources/WebCore/JSHTMLHeadingElement.cpp \
+	DerivedSources/WebCore/JSHTMLHeadingElement.h \
+	DerivedSources/WebCore/JSHTMLHRElement.cpp \
+	DerivedSources/WebCore/JSHTMLHRElement.h \
+	DerivedSources/WebCore/JSHTMLHtmlElement.cpp \
+	DerivedSources/WebCore/JSHTMLHtmlElement.h \
+	DerivedSources/WebCore/JSHTMLIFrameElement.cpp \
+	DerivedSources/WebCore/JSHTMLIFrameElement.h \
+	DerivedSources/WebCore/JSHTMLImageElement.cpp \
+	DerivedSources/WebCore/JSHTMLImageElement.h \
+	DerivedSources/WebCore/JSHTMLInputElement.cpp \
+	DerivedSources/WebCore/JSHTMLInputElement.h \
+	DerivedSources/WebCore/JSHTMLIsIndexElement.cpp \
+	DerivedSources/WebCore/JSHTMLIsIndexElement.h \
+	DerivedSources/WebCore/JSHTMLKeygenElement.cpp \
+	DerivedSources/WebCore/JSHTMLKeygenElement.h \
+	DerivedSources/WebCore/JSHTMLLabelElement.cpp \
+	DerivedSources/WebCore/JSHTMLLabelElement.h \
+	DerivedSources/WebCore/JSHTMLLegendElement.cpp \
+	DerivedSources/WebCore/JSHTMLLegendElement.h \
+	DerivedSources/WebCore/JSHTMLLIElement.cpp \
+	DerivedSources/WebCore/JSHTMLLIElement.h \
+	DerivedSources/WebCore/JSHTMLLinkElement.cpp \
+	DerivedSources/WebCore/JSHTMLLinkElement.h \
+	DerivedSources/WebCore/JSHTMLMapElement.cpp \
+	DerivedSources/WebCore/JSHTMLMapElement.h \
+	DerivedSources/WebCore/JSHTMLMarqueeElement.cpp \
+	DerivedSources/WebCore/JSHTMLMarqueeElement.h \
+	DerivedSources/WebCore/JSHTMLMediaElement.cpp \
+	DerivedSources/WebCore/JSHTMLMediaElement.h \
+	DerivedSources/WebCore/JSHTMLMenuElement.cpp \
+	DerivedSources/WebCore/JSHTMLMenuElement.h \
+	DerivedSources/WebCore/JSHTMLMetaElement.cpp \
+	DerivedSources/WebCore/JSHTMLMetaElement.h \
+	DerivedSources/WebCore/JSHTMLMeterElement.cpp \
+	DerivedSources/WebCore/JSHTMLMeterElement.h \
+	DerivedSources/WebCore/JSHTMLModElement.cpp \
+	DerivedSources/WebCore/JSHTMLModElement.h \
+	DerivedSources/WebCore/JSHTMLObjectElement.cpp \
+	DerivedSources/WebCore/JSHTMLObjectElement.h \
+	DerivedSources/WebCore/JSHTMLOListElement.cpp \
+	DerivedSources/WebCore/JSHTMLOListElement.h \
+	DerivedSources/WebCore/JSHTMLOptGroupElement.cpp \
+	DerivedSources/WebCore/JSHTMLOptGroupElement.h \
+	DerivedSources/WebCore/JSHTMLOptionElement.cpp \
+	DerivedSources/WebCore/JSHTMLOptionElement.h \
+	DerivedSources/WebCore/JSHTMLOptionsCollection.cpp \
+	DerivedSources/WebCore/JSHTMLOptionsCollection.h \
+	DerivedSources/WebCore/JSHTMLOutputElement.cpp \
+	DerivedSources/WebCore/JSHTMLOutputElement.h \
+	DerivedSources/WebCore/JSHTMLParagraphElement.cpp \
+	DerivedSources/WebCore/JSHTMLParagraphElement.h \
+	DerivedSources/WebCore/JSHTMLParamElement.cpp \
+	DerivedSources/WebCore/JSHTMLParamElement.h \
+	DerivedSources/WebCore/JSHTMLPreElement.cpp \
+	DerivedSources/WebCore/JSHTMLPreElement.h \
+	DerivedSources/WebCore/JSHTMLProgressElement.cpp \
+	DerivedSources/WebCore/JSHTMLProgressElement.h \
+	DerivedSources/WebCore/JSHTMLQuoteElement.cpp \
+	DerivedSources/WebCore/JSHTMLQuoteElement.h \
+	DerivedSources/WebCore/JSHTMLScriptElement.cpp \
+	DerivedSources/WebCore/JSHTMLScriptElement.h \
+	DerivedSources/WebCore/JSHTMLSelectElement.cpp \
+	DerivedSources/WebCore/JSHTMLSelectElement.h \
+	DerivedSources/WebCore/JSHTMLSourceElement.cpp \
+	DerivedSources/WebCore/JSHTMLSourceElement.h \
+	DerivedSources/WebCore/JSHTMLStyleElement.cpp \
+	DerivedSources/WebCore/JSHTMLStyleElement.h \
+	DerivedSources/WebCore/JSHTMLTableCaptionElement.cpp \
+	DerivedSources/WebCore/JSHTMLTableCaptionElement.h \
+	DerivedSources/WebCore/JSHTMLTableCellElement.cpp \
+	DerivedSources/WebCore/JSHTMLTableCellElement.h \
+	DerivedSources/WebCore/JSHTMLTableColElement.cpp \
+	DerivedSources/WebCore/JSHTMLTableColElement.h \
+	DerivedSources/WebCore/JSHTMLTableElement.cpp \
+	DerivedSources/WebCore/JSHTMLTableElement.h \
+	DerivedSources/WebCore/JSHTMLTableRowElement.cpp \
+	DerivedSources/WebCore/JSHTMLTableRowElement.h \
+	DerivedSources/WebCore/JSHTMLTableSectionElement.cpp \
+	DerivedSources/WebCore/JSHTMLTableSectionElement.h \
+	DerivedSources/WebCore/JSHTMLTextAreaElement.cpp \
+	DerivedSources/WebCore/JSHTMLTextAreaElement.h \
+	DerivedSources/WebCore/JSHTMLTitleElement.cpp \
+	DerivedSources/WebCore/JSHTMLTitleElement.h \
+	DerivedSources/WebCore/JSHTMLTrackElement.cpp \
+	DerivedSources/WebCore/JSHTMLTrackElement.h \
+	DerivedSources/WebCore/JSHTMLUListElement.cpp \
+	DerivedSources/WebCore/JSHTMLUListElement.h \
+	DerivedSources/WebCore/JSHTMLVideoElement.cpp \
+	DerivedSources/WebCore/JSHTMLVideoElement.h \
+	DerivedSources/WebCore/JSImageData.cpp \
+	DerivedSources/WebCore/JSImageData.h \
+	DerivedSources/WebCore/JSInjectedScriptHost.cpp \
+	DerivedSources/WebCore/JSInjectedScriptHost.h \
+	DerivedSources/WebCore/JSInspectorFrontendHost.cpp \
+	DerivedSources/WebCore/JSInspectorFrontendHost.h \
+	DerivedSources/WebCore/JSInt16Array.cpp \
+	DerivedSources/WebCore/JSInt16Array.h \
+	DerivedSources/WebCore/JSInt32Array.cpp \
+	DerivedSources/WebCore/JSInt32Array.h \
+	DerivedSources/WebCore/JSInt8Array.cpp \
+	DerivedSources/WebCore/JSInt8Array.h \
+	DerivedSources/WebCore/JSJavaScriptCallFrame.cpp \
+	DerivedSources/WebCore/JSJavaScriptCallFrame.h \
+	DerivedSources/WebCore/JSKeyboardEvent.cpp \
+	DerivedSources/WebCore/JSKeyboardEvent.h \
+	DerivedSources/WebCore/JSLocation.cpp \
+	DerivedSources/WebCore/JSLocation.h \
+	DerivedSources/WebCore/JSMediaError.cpp \
+	DerivedSources/WebCore/JSMediaError.h \
+	DerivedSources/WebCore/JSMediaList.cpp \
+	DerivedSources/WebCore/JSMediaList.h \
+	DerivedSources/WebCore/JSMediaQueryList.cpp \
+	DerivedSources/WebCore/JSMediaQueryList.h \
+	DerivedSources/WebCore/JSMemoryInfo.cpp \
+	DerivedSources/WebCore/JSMemoryInfo.h \
+	DerivedSources/WebCore/JSMessageChannel.cpp \
+	DerivedSources/WebCore/JSMessageChannel.h \
+	DerivedSources/WebCore/JSMessageEvent.cpp \
+	DerivedSources/WebCore/JSMessageEvent.h \
+	DerivedSources/WebCore/JSMessagePort.cpp \
+	DerivedSources/WebCore/JSMessagePort.h \
+	DerivedSources/WebCore/JSMouseEvent.cpp \
+	DerivedSources/WebCore/JSMouseEvent.h \
+	DerivedSources/WebCore/JSMutationEvent.cpp \
+	DerivedSources/WebCore/JSMutationEvent.h \
+	DerivedSources/WebCore/JSNamedNodeMap.cpp \
+	DerivedSources/WebCore/JSNamedNodeMap.h \
+	DerivedSources/WebCore/JSNavigator.cpp \
+	DerivedSources/WebCore/JSNavigator.h \
+	DerivedSources/WebCore/JSNavigatorUserMediaError.cpp \
+	DerivedSources/WebCore/JSNavigatorUserMediaError.h \
+	DerivedSources/WebCore/JSNavigatorUserMediaErrorCallback.cpp \
+	DerivedSources/WebCore/JSNavigatorUserMediaErrorCallback.h \
+	DerivedSources/WebCore/JSNavigatorUserMediaSuccessCallback.cpp \
+	DerivedSources/WebCore/JSNavigatorUserMediaSuccessCallback.h \
+	DerivedSources/WebCore/JSNode.cpp \
+	DerivedSources/WebCore/JSNodeFilter.cpp \
+	DerivedSources/WebCore/JSNodeFilter.h \
+	DerivedSources/WebCore/JSNode.h \
+	DerivedSources/WebCore/JSNodeIterator.cpp \
+	DerivedSources/WebCore/JSNodeIterator.h \
+	DerivedSources/WebCore/JSNodeList.cpp \
+	DerivedSources/WebCore/JSNodeList.h \
+	DerivedSources/WebCore/JSNotation.cpp \
+	DerivedSources/WebCore/JSNotation.h \
+	DerivedSources/WebCore/JSNotificationCenter.cpp \
+	DerivedSources/WebCore/JSNotificationCenter.h \
+	DerivedSources/WebCore/JSNotification.cpp \
+	DerivedSources/WebCore/JSNotification.h \
+	DerivedSources/WebCore/JSOESStandardDerivatives.cpp \
+	DerivedSources/WebCore/JSOESStandardDerivatives.h \
+	DerivedSources/WebCore/JSOESTextureFloat.cpp \
+	DerivedSources/WebCore/JSOESTextureFloat.h \
+	DerivedSources/WebCore/JSOESVertexArrayObject.cpp \
+	DerivedSources/WebCore/JSOESVertexArrayObject.h \
+	DerivedSources/WebCore/JSOverflowEvent.cpp \
+	DerivedSources/WebCore/JSOverflowEvent.h \
+	DerivedSources/WebCore/JSPageTransitionEvent.cpp \
+	DerivedSources/WebCore/JSPageTransitionEvent.h \
+	DerivedSources/WebCore/JSPerformance.cpp \
+	DerivedSources/WebCore/JSPerformance.h \
+	DerivedSources/WebCore/JSPerformanceNavigation.cpp \
+	DerivedSources/WebCore/JSPerformanceNavigation.h \
+	DerivedSources/WebCore/JSPerformanceTiming.cpp \
+	DerivedSources/WebCore/JSPerformanceTiming.h \
+	DerivedSources/WebCore/JSPopStateEvent.cpp \
+	DerivedSources/WebCore/JSPopStateEvent.h \
+	DerivedSources/WebCore/JSPositionError.cpp \
+	DerivedSources/WebCore/JSPositionError.h \
+	DerivedSources/WebCore/JSProcessingInstruction.cpp \
+	DerivedSources/WebCore/JSProcessingInstruction.h \
+	DerivedSources/WebCore/JSProgressEvent.cpp \
+	DerivedSources/WebCore/JSProgressEvent.h \
+	DerivedSources/WebCore/JSRange.cpp \
+	DerivedSources/WebCore/JSRangeException.cpp \
+	DerivedSources/WebCore/JSRangeException.h \
+	DerivedSources/WebCore/JSRange.h \
+	DerivedSources/WebCore/JSRect.cpp \
+	DerivedSources/WebCore/JSRect.h \
+	DerivedSources/WebCore/JSRGBColor.cpp \
+	DerivedSources/WebCore/JSRGBColor.h \
+	DerivedSources/WebCore/JSScreen.cpp \
+	DerivedSources/WebCore/JSScreen.h \
+	DerivedSources/WebCore/JSScriptProfile.cpp \
+	DerivedSources/WebCore/JSScriptProfile.h \
+	DerivedSources/WebCore/JSScriptProfileNode.cpp \
+	DerivedSources/WebCore/JSScriptProfileNode.h \
+	DerivedSources/WebCore/JSSharedWorkerContext.cpp \
+	DerivedSources/WebCore/JSSharedWorkerContext.h \
+	DerivedSources/WebCore/JSSharedWorker.cpp \
+	DerivedSources/WebCore/JSSharedWorker.h \
+	DerivedSources/WebCore/JSSpeechInputEvent.cpp \
+	DerivedSources/WebCore/JSSpeechInputEvent.h \
+	DerivedSources/WebCore/JSSpeechInputResult.cpp \
+	DerivedSources/WebCore/JSSpeechInputResult.h \
+	DerivedSources/WebCore/JSSpeechInputResultList.cpp \
+	DerivedSources/WebCore/JSSpeechInputResultList.h \
+	DerivedSources/WebCore/JSSQLException.h \
+	DerivedSources/WebCore/JSSQLResultSetRowList.h \
+	DerivedSources/WebCore/JSSQLStatementErrorCallback.cpp \
+	DerivedSources/WebCore/JSSQLTransaction.h \
+	DerivedSources/WebCore/JSSQLTransactionSync.h \
+	DerivedSources/WebCore/JSStorage.h \
+	DerivedSources/WebCore/JSStorageInfo.h \
+	DerivedSources/WebCore/JSStorageInfoErrorCallback.h \
+	DerivedSources/WebCore/JSStorageInfoUsageCallback.h \
+	DerivedSources/WebCore/JSStyleMedia.cpp \
+	DerivedSources/WebCore/JSStyleMedia.h \
+	DerivedSources/WebCore/JSStyleSheet.cpp \
+	DerivedSources/WebCore/JSStyleSheet.h \
+	DerivedSources/WebCore/JSStyleSheetList.cpp \
+	DerivedSources/WebCore/JSStyleSheetList.h \
+	DerivedSources/WebCore/JSSVGElementInstance.h \
+	DerivedSources/WebCore/JSSVGElementWrapperFactory.cpp \
+	DerivedSources/WebCore/JSText.cpp \
+	DerivedSources/WebCore/JSTextEvent.cpp \
+	DerivedSources/WebCore/JSTextEvent.h \
+	DerivedSources/WebCore/JSText.h \
+	DerivedSources/WebCore/JSTextMetrics.cpp \
+	DerivedSources/WebCore/JSTextMetrics.h \
+	DerivedSources/WebCore/JSTimeRanges.cpp \
+	DerivedSources/WebCore/JSTimeRanges.h \
+	DerivedSources/WebCore/JSTouch.cpp \
+	DerivedSources/WebCore/JSTouchEvent.cpp \
+	DerivedSources/WebCore/JSTouchEvent.h \
+	DerivedSources/WebCore/JSTouch.h \
+	DerivedSources/WebCore/JSTouchList.cpp \
+	DerivedSources/WebCore/JSTouchList.h \
+	DerivedSources/WebCore/JSTreeWalker.cpp \
+	DerivedSources/WebCore/JSTreeWalker.h \
+	DerivedSources/WebCore/JSUIEvent.cpp \
+	DerivedSources/WebCore/JSUIEvent.h \
+	DerivedSources/WebCore/JSUint16Array.cpp \
+	DerivedSources/WebCore/JSUint16Array.h \
+	DerivedSources/WebCore/JSUint32Array.cpp \
+	DerivedSources/WebCore/JSUint32Array.h \
+	DerivedSources/WebCore/JSUint8Array.cpp \
+	DerivedSources/WebCore/JSUint8Array.h \
+	DerivedSources/WebCore/JSValidityState.cpp \
+	DerivedSources/WebCore/JSValidityState.h \
+	DerivedSources/WebCore/JSVoidCallback.cpp \
+	DerivedSources/WebCore/JSVoidCallback.h \
+	DerivedSources/WebCore/JSWebGLActiveInfo.cpp \
+	DerivedSources/WebCore/JSWebGLActiveInfo.h \
+	DerivedSources/WebCore/JSWebGLBuffer.cpp \
+	DerivedSources/WebCore/JSWebGLBuffer.h \
+	DerivedSources/WebCore/JSWebGLContextAttributes.cpp \
+	DerivedSources/WebCore/JSWebGLContextAttributes.h \
+	DerivedSources/WebCore/JSWebGLContextEvent.cpp \
+	DerivedSources/WebCore/JSWebGLContextEvent.h \
+	DerivedSources/WebCore/JSWebGLFramebuffer.cpp \
+	DerivedSources/WebCore/JSWebGLFramebuffer.h \
+	DerivedSources/WebCore/JSWebGLProgram.cpp \
+	DerivedSources/WebCore/JSWebGLProgram.h \
+	DerivedSources/WebCore/JSWebGLRenderbuffer.cpp \
+	DerivedSources/WebCore/JSWebGLRenderbuffer.h \
+	DerivedSources/WebCore/JSWebGLRenderingContext.cpp \
+	DerivedSources/WebCore/JSWebGLRenderingContext.h \
+	DerivedSources/WebCore/JSWebGLShader.cpp \
+	DerivedSources/WebCore/JSWebGLShader.h \
+	DerivedSources/WebCore/JSWebGLTexture.cpp \
+	DerivedSources/WebCore/JSWebGLTexture.h \
+	DerivedSources/WebCore/JSWebGLUniformLocation.cpp \
+	DerivedSources/WebCore/JSWebGLUniformLocation.h \
+	DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.cpp \
+	DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.h \
+	DerivedSources/WebCore/JSWebKitAnimation.cpp \
+	DerivedSources/WebCore/JSWebKitAnimation.h \
+	DerivedSources/WebCore/JSWebKitAnimationEvent.cpp \
+	DerivedSources/WebCore/JSWebKitAnimationList.h \
+	DerivedSources/WebCore/JSWebKitAnimationList.cpp \
+	DerivedSources/WebCore/JSWebKitAnimationEvent.h \
+	DerivedSources/WebCore/JSWebKitBlobBuilder.cpp \
+	DerivedSources/WebCore/JSWebKitBlobBuilder.h \
+	DerivedSources/WebCore/JSWebKitCSSKeyframeRule.cpp \
+	DerivedSources/WebCore/JSWebKitCSSKeyframeRule.h \
+	DerivedSources/WebCore/JSWebKitCSSKeyframesRule.cpp \
+	DerivedSources/WebCore/JSWebKitCSSKeyframesRule.h \
+	DerivedSources/WebCore/JSWebKitCSSMatrix.cpp \
+	DerivedSources/WebCore/JSWebKitCSSMatrix.h \
+	DerivedSources/WebCore/JSWebKitCSSTransformValue.cpp \
+	DerivedSources/WebCore/JSWebKitCSSTransformValue.h \
+	DerivedSources/WebCore/JSWebKitLoseContext.cpp \
+	DerivedSources/WebCore/JSWebKitLoseContext.h \
+	DerivedSources/WebCore/JSWebKitPoint.cpp \
+	DerivedSources/WebCore/JSWebKitPoint.h \
+	DerivedSources/WebCore/JSWebKitTransitionEvent.cpp \
+	DerivedSources/WebCore/JSWebKitTransitionEvent.h \
+	DerivedSources/WebCore/JSWheelEvent.cpp \
+	DerivedSources/WebCore/JSWheelEvent.h \
+	DerivedSources/WebCore/JSWorkerContext.cpp \
+	DerivedSources/WebCore/JSWorkerContext.h \
+	DerivedSources/WebCore/JSWorker.cpp \
+	DerivedSources/WebCore/JSWorker.h \
+	DerivedSources/WebCore/JSWorkerLocation.cpp \
+	DerivedSources/WebCore/JSWorkerLocation.h \
+	DerivedSources/WebCore/JSWorkerNavigator.cpp \
+	DerivedSources/WebCore/JSWorkerNavigator.h \
+	DerivedSources/WebCore/JSXMLHttpRequest.cpp \
+	DerivedSources/WebCore/JSXMLHttpRequestException.cpp \
+	DerivedSources/WebCore/JSXMLHttpRequestException.h \
+	DerivedSources/WebCore/JSXMLHttpRequest.h \
+	DerivedSources/WebCore/JSXMLHttpRequestProgressEvent.cpp \
+	DerivedSources/WebCore/JSXMLHttpRequestProgressEvent.h \
+	DerivedSources/WebCore/JSXMLHttpRequestUpload.cpp \
+	DerivedSources/WebCore/JSXMLHttpRequestUpload.h \
+	DerivedSources/WebCore/JSXMLSerializer.cpp \
+	DerivedSources/WebCore/JSXMLSerializer.h \
+	DerivedSources/WebCore/JSXSLTProcessor.cpp \
+	DerivedSources/WebCore/JSXSLTProcessor.h \
+	DerivedSources/WebCore/MathMLElementFactory.cpp \
+	DerivedSources/WebCore/MathMLElementFactory.h \
+	DerivedSources/WebCore/MathMLNames.cpp \
+	DerivedSources/WebCore/MathMLNames.h \
+	DerivedSources/WebCore/SVGElementFactory.cpp \
+	DerivedSources/WebCore/SVGNames.cpp \
+	DerivedSources/WebCore/UserAgentStyleSheetsData.cpp \
+	DerivedSources/WebCore/UserAgentStyleSheets.h \
+	DerivedSources/WebCore/XLinkNames.cpp \
+	DerivedSources/WebCore/XMLNames.cpp \
+	DerivedSources/WebCore/XMLNames.h \
+	DerivedSources/WebCore/XMLNSNames.cpp \
+	DerivedSources/WebCore/XMLNSNames.h \
+	DerivedSources/WebCore/XMLViewerCSS.h \
+	DerivedSources/WebCore/XMLViewerJS.h 
+
+webcore_sources += \
+	Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp \
+	Source/WebCore/accessibility/AccessibilityARIAGridCell.h \
+	Source/WebCore/accessibility/AccessibilityARIAGrid.cpp \
+	Source/WebCore/accessibility/AccessibilityARIAGrid.h \
+	Source/WebCore/accessibility/AccessibilityARIAGridRow.cpp \
+	Source/WebCore/accessibility/AccessibilityARIAGridRow.h \
+	Source/WebCore/accessibility/AccessibilityImageMapLink.cpp \
+	Source/WebCore/accessibility/AccessibilityImageMapLink.h \
+	Source/WebCore/accessibility/AccessibilityListBox.cpp \
+	Source/WebCore/accessibility/AccessibilityListBox.h \
+	Source/WebCore/accessibility/AccessibilityListBoxOption.cpp \
+	Source/WebCore/accessibility/AccessibilityListBoxOption.h \
+	Source/WebCore/accessibility/AccessibilityList.cpp \
+	Source/WebCore/accessibility/AccessibilityList.h \
+	Source/WebCore/accessibility/AccessibilityMediaControls.cpp \
+	Source/WebCore/accessibility/AccessibilityMediaControls.h \
+	Source/WebCore/accessibility/AccessibilityMenuList.cpp \
+	Source/WebCore/accessibility/AccessibilityMenuList.h \
+	Source/WebCore/accessibility/AccessibilityMenuListOption.cpp \
+	Source/WebCore/accessibility/AccessibilityMenuListOption.h \
+	Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp \
+	Source/WebCore/accessibility/AccessibilityMenuListPopup.h \
+	Source/WebCore/accessibility/AccessibilityObject.cpp \
+	Source/WebCore/accessibility/AccessibilityObject.h \
+	Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp \
+	Source/WebCore/accessibility/AccessibilityProgressIndicator.h \
+	Source/WebCore/accessibility/AccessibilityRenderObject.cpp \
+	Source/WebCore/accessibility/AccessibilityRenderObject.h \
+	Source/WebCore/accessibility/AccessibilityScrollbar.cpp \
+	Source/WebCore/accessibility/AccessibilityScrollbar.h \
+	Source/WebCore/accessibility/AccessibilityScrollView.cpp \
+	Source/WebCore/accessibility/AccessibilityScrollView.h \
+	Source/WebCore/accessibility/AccessibilitySlider.cpp \
+	Source/WebCore/accessibility/AccessibilitySlider.h \
+	Source/WebCore/accessibility/AccessibilityTableCell.cpp \
+	Source/WebCore/accessibility/AccessibilityTableCell.h \
+	Source/WebCore/accessibility/AccessibilityTableColumn.cpp \
+	Source/WebCore/accessibility/AccessibilityTableColumn.h \
+	Source/WebCore/accessibility/AccessibilityTable.cpp \
+	Source/WebCore/accessibility/AccessibilityTable.h \
+	Source/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp \
+	Source/WebCore/accessibility/AccessibilityTableHeaderContainer.h \
+	Source/WebCore/accessibility/AccessibilityTableRow.cpp \
+	Source/WebCore/accessibility/AccessibilityTableRow.h \
+	Source/WebCore/accessibility/AXObjectCache.cpp \
+	Source/WebCore/accessibility/AXObjectCache.h \
+	Source/WebCore/bindings/generic/ActiveDOMCallback.cpp \
+	Source/WebCore/bindings/generic/ActiveDOMCallback.h \
+	Source/WebCore/bindings/generic/BindingSecurityBase.cpp \
+	Source/WebCore/bindings/generic/BindingSecurityBase.h \
+	Source/WebCore/bindings/generic/BindingSecurity.h \
+	Source/WebCore/bindings/generic/GenericBinding.h \
+	Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp \
+	Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h \
+	Source/WebCore/bindings/js/CachedScriptSourceProvider.h \
+	Source/WebCore/bindings/js/CallbackFunction.cpp \
+	Source/WebCore/bindings/js/CallbackFunction.h \
+	Source/WebCore/bindings/js/DOMObjectHashTableMap.cpp \
+	Source/WebCore/bindings/js/DOMObjectHashTableMap.h \
+	Source/WebCore/bindings/js/DOMWrapperWorld.cpp \
+	Source/WebCore/bindings/js/DOMWrapperWorld.h \
+	Source/WebCore/bindings/js/GCController.cpp \
+	Source/WebCore/bindings/js/GCController.h \
+	Source/WebCore/bindings/js/IDBBindingUtilities.h \
+	Source/WebCore/bindings/js/JSArrayBufferCustom.cpp \
+	Source/WebCore/bindings/js/JSArrayBufferViewHelper.h \
+	Source/WebCore/bindings/js/JSAttrCustom.cpp \
+	Source/WebCore/bindings/js/JSAudioConstructor.cpp \
+	Source/WebCore/bindings/js/JSAudioConstructor.h \
+	Source/WebCore/bindings/js/JSCDATASectionCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSFontFaceRuleCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSImportRuleCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSMediaRuleCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSPageRuleCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSRuleCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSRuleListCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.h \
+	Source/WebCore/bindings/js/JSCSSStyleRuleCustom.cpp \
+	Source/WebCore/bindings/js/JSCSSValueCustom.cpp \
+	Source/WebCore/bindings/js/JSCallbackData.cpp \
+	Source/WebCore/bindings/js/JSCallbackData.h \
+	Source/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp \
+	Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp \
+	Source/WebCore/bindings/js/JSClipboardCustom.cpp \
+	Source/WebCore/bindings/js/JSConsoleCustom.cpp \
+	Source/WebCore/bindings/js/JSCoordinatesCustom.cpp \
+	Source/WebCore/bindings/js/JSCustomPositionCallback.cpp \
+	Source/WebCore/bindings/js/JSCustomPositionCallback.h \
+	Source/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp \
+	Source/WebCore/bindings/js/JSCustomPositionErrorCallback.h \
+	Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp \
+	Source/WebCore/bindings/js/JSCustomVoidCallback.cpp \
+	Source/WebCore/bindings/js/JSCustomVoidCallback.h \
+	Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp \
+	Source/WebCore/bindings/js/JSCustomXPathNSResolver.h \
+	Source/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp \
+	Source/WebCore/bindings/js/JSDOMBinding.cpp \
+	Source/WebCore/bindings/js/JSDOMBinding.h \
+	Source/WebCore/bindings/js/JSDOMFormDataCustom.cpp \
+	Source/WebCore/bindings/js/JSDOMGlobalObject.cpp \
+	Source/WebCore/bindings/js/JSDOMGlobalObject.h \
+	Source/WebCore/bindings/js/JSDOMImplementationCustom.cpp \
+	Source/WebCore/bindings/js/JSDOMMimeTypeArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSDOMPluginArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSDOMPluginCustom.cpp \
+	Source/WebCore/bindings/js/JSDOMStringMapCustom.cpp \
+	Source/WebCore/bindings/js/JSDOMStringMapCustom.h \
+	Source/WebCore/bindings/js/JSDOMWindowBase.cpp \
+	Source/WebCore/bindings/js/JSDOMWindowBase.h \
+	Source/WebCore/bindings/js/JSDOMWindowCustom.cpp \
+	Source/WebCore/bindings/js/JSDOMWindowCustom.h \
+	Source/WebCore/bindings/js/JSDOMWindowShell.cpp \
+	Source/WebCore/bindings/js/JSDOMWindowShell.h \
+	Source/WebCore/bindings/js/JSDOMWrapper.cpp \
+	Source/WebCore/bindings/js/JSDOMWrapper.h \
+	Source/WebCore/bindings/js/JSDataGridColumnListCustom.cpp \
+	Source/WebCore/bindings/js/JSDataGridDataSource.cpp \
+	Source/WebCore/bindings/js/JSDataGridDataSource.h \
+	Source/WebCore/bindings/js/JSDataViewCustom.cpp \
+	Source/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp \
+	Source/WebCore/bindings/js/JSDeviceMotionEventCustom.cpp \
+	Source/WebCore/bindings/js/JSDeviceOrientationEventCustom.cpp \
+	Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp \
+	Source/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp \
+	Source/WebCore/bindings/js/JSDocumentCustom.cpp \
+	Source/WebCore/bindings/js/JSElementCustom.cpp \
+	Source/WebCore/bindings/js/JSEntryCustom.cpp \
+	Source/WebCore/bindings/js/JSEntrySyncCustom.cpp \
+	Source/WebCore/bindings/js/JSEventCustom.cpp \
+	Source/WebCore/bindings/js/JSEventListener.cpp \
+	Source/WebCore/bindings/js/JSEventListener.h \
+	Source/WebCore/bindings/js/JSEventSourceCustom.cpp \
+	Source/WebCore/bindings/js/JSEventTarget.cpp \
+	Source/WebCore/bindings/js/JSEventTarget.h \
+	Source/WebCore/bindings/js/JSErrorHandler.cpp \
+	Source/WebCore/bindings/js/JSErrorHandler.h \
+	Source/WebCore/bindings/js/JSExceptionBase.cpp \
+	Source/WebCore/bindings/js/JSExceptionBase.h \
+	Source/WebCore/bindings/js/JSFileReaderCustom.cpp \
+	Source/WebCore/bindings/js/JSFloat32ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSGeolocationCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLAppletElementCustom.h \
+	Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLEmbedElementCustom.h \
+	Source/WebCore/bindings/js/JSHTMLFormElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLInputElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLInputElementCustom.h \
+	Source/WebCore/bindings/js/JSHTMLLinkElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLObjectElementCustom.h \
+	Source/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLOutputElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHTMLSelectElementCustom.h \
+	Source/WebCore/bindings/js/JSHTMLStyleElementCustom.cpp \
+	Source/WebCore/bindings/js/JSHistoryCustom.cpp \
+	Source/WebCore/bindings/js/JSHistoryCustom.h \
+	Source/WebCore/bindings/js/JSImageConstructor.cpp \
+	Source/WebCore/bindings/js/JSImageConstructor.h \
+	Source/WebCore/bindings/js/JSImageDataCustom.cpp \
+	Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp \
+	Source/WebCore/bindings/js/JSInjectedScriptManager.cpp \
+	Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp \
+	Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSInt8ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp \
+	Source/WebCore/bindings/js/JSLazyEventListener.cpp \
+	Source/WebCore/bindings/js/JSLazyEventListener.h \
+	Source/WebCore/bindings/js/JSLocationCustom.cpp \
+	Source/WebCore/bindings/js/JSLocationCustom.h \
+	Source/WebCore/bindings/js/JSMainThreadExecState.cpp \
+	Source/WebCore/bindings/js/JSMainThreadExecState.h \
+	Source/WebCore/bindings/js/JSMemoryInfoCustom.cpp \
+	Source/WebCore/bindings/js/JSMessageChannelCustom.cpp \
+	Source/WebCore/bindings/js/JSMessageEventCustom.cpp \
+	Source/WebCore/bindings/js/JSMessagePortCustom.cpp \
+	Source/WebCore/bindings/js/JSMessagePortCustom.h \
+	Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp \
+	Source/WebCore/bindings/js/JSNavigatorCustom.cpp \
+	Source/WebCore/bindings/js/JSNodeCustom.cpp \
+	Source/WebCore/bindings/js/JSNodeCustom.h \
+	Source/WebCore/bindings/js/JSNodeFilterCondition.cpp \
+	Source/WebCore/bindings/js/JSNodeFilterCondition.h \
+	Source/WebCore/bindings/js/JSNodeFilterCustom.cpp \
+	Source/WebCore/bindings/js/JSNodeIteratorCustom.cpp \
+	Source/WebCore/bindings/js/JSNodeListCustom.cpp \
+	Source/WebCore/bindings/js/JSOptionConstructor.cpp \
+	Source/WebCore/bindings/js/JSOptionConstructor.h \
+	Source/WebCore/bindings/js/JSPluginElementFunctions.cpp \
+	Source/WebCore/bindings/js/JSPluginElementFunctions.h \
+	Source/WebCore/bindings/js/JSProcessingInstructionCustom.cpp \
+	Source/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp \
+	Source/WebCore/bindings/js/JSSQLTransactionCustom.cpp \
+	Source/WebCore/bindings/js/JSSQLTransactionSyncCustom.cpp \
+	Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp \
+	Source/WebCore/bindings/js/JSSVGLengthCustom.cpp \
+	Source/WebCore/bindings/js/JSSVGPathSegCustom.cpp \
+	Source/WebCore/bindings/js/JSScriptProfileNodeCustom.cpp \
+	Source/WebCore/bindings/js/JSSharedWorkerCustom.cpp \
+	Source/WebCore/bindings/js/JSStorageCustom.cpp \
+	Source/WebCore/bindings/js/JSStorageCustom.h \
+	Source/WebCore/bindings/js/JSStyleSheetCustom.cpp \
+	Source/WebCore/bindings/js/JSStyleSheetListCustom.cpp \
+	Source/WebCore/bindings/js/JSTextCustom.cpp \
+	Source/WebCore/bindings/js/JSTouchCustom.cpp \
+	Source/WebCore/bindings/js/JSTouchListCustom.cpp \
+	Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp \
+	Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
+	Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitCSSMatrixCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitPointCustom.cpp \
+	Source/WebCore/bindings/js/JSWebSocketCustom.cpp \
+	Source/WebCore/bindings/js/JSWorkerContextBase.cpp \
+	Source/WebCore/bindings/js/JSWorkerContextBase.h \
+	Source/WebCore/bindings/js/JSWorkerContextCustom.cpp \
+	Source/WebCore/bindings/js/JSWorkerCustom.cpp \
+	Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp \
+	Source/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp \
+	Source/WebCore/bindings/js/JSXSLTProcessorCustom.cpp \
+	Source/WebCore/bindings/js/JavaScriptCallFrame.cpp \
+	Source/WebCore/bindings/js/JavaScriptCallFrame.h \
+	Source/WebCore/bindings/js/OptionsObject.h \
+	Source/WebCore/bindings/js/PageScriptDebugServer.cpp \
+	Source/WebCore/bindings/js/PageScriptDebugServer.h \
+	Source/WebCore/bindings/js/ScheduledAction.cpp \
+	Source/WebCore/bindings/js/ScheduledAction.h \
+	Source/WebCore/bindings/js/ScriptCachedFrameData.cpp \
+	Source/WebCore/bindings/js/ScriptCachedFrameData.h \
+	Source/WebCore/bindings/js/ScriptCallStackFactory.cpp \
+	Source/WebCore/bindings/js/ScriptCallStackFactory.h \
+	Source/WebCore/bindings/js/ScriptController.cpp \
+	Source/WebCore/bindings/js/ScriptController.h \
+	Source/WebCore/bindings/js/ScriptDebugServer.cpp \
+	Source/WebCore/bindings/js/ScriptDebugServer.h \
+	Source/WebCore/bindings/js/ScriptEventListener.cpp \
+	Source/WebCore/bindings/js/ScriptEventListener.h \
+	Source/WebCore/bindings/js/ScriptFunctionCall.cpp \
+	Source/WebCore/bindings/js/ScriptFunctionCall.h \
+	Source/WebCore/bindings/js/ScriptGCEvent.cpp \
+	Source/WebCore/bindings/js/ScriptGCEvent.h \
+	Source/WebCore/bindings/js/ScriptHeapSnapshot.h \
+	Source/WebCore/bindings/js/ScriptInstance.h \
+	Source/WebCore/bindings/js/ScriptObject.cpp \
+	Source/WebCore/bindings/js/ScriptObject.h \
+	Source/WebCore/bindings/js/ScriptProfile.cpp \
+	Source/WebCore/bindings/js/ScriptProfile.h \
+	Source/WebCore/bindings/js/ScriptProfileNode.h \
+	Source/WebCore/bindings/js/ScriptProfiler.cpp \
+	Source/WebCore/bindings/js/ScriptProfiler.h \
+	Source/WebCore/bindings/js/ScriptSourceCode.h \
+	Source/WebCore/bindings/js/ScriptSourceProvider.h \
+	Source/WebCore/bindings/js/ScriptState.cpp \
+	Source/WebCore/bindings/js/ScriptState.h \
+	Source/WebCore/bindings/js/ScriptValue.cpp \
+	Source/WebCore/bindings/js/ScriptValue.h \
+	Source/WebCore/bindings/js/ScriptWrappable.h \
+	Source/WebCore/bindings/js/SerializedScriptValue.cpp \
+	Source/WebCore/bindings/js/SerializedScriptValue.h \
+	Source/WebCore/bindings/js/StringSourceProvider.h \
+	Source/WebCore/bindings/js/WebCoreJSClientData.h \
+	Source/WebCore/bindings/js/WorkerScriptController.cpp \
+	Source/WebCore/bindings/js/WorkerScriptController.h \
+	Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp \
+	Source/WebCore/bindings/js/WorkerScriptDebugServer.h \
+	Source/WebCore/bindings/ScriptControllerBase.cpp \
+	Source/WebCore/bindings/ScriptControllerBase.h \
+	Source/WebCore/bridge/Bridge.h \
+	Source/WebCore/bridge/c/c_class.cpp \
+	Source/WebCore/bridge/c/c_class.h \
+	Source/WebCore/bridge/c/c_instance.cpp \
+	Source/WebCore/bridge/c/c_instance.h \
+	Source/WebCore/bridge/c/c_runtime.cpp \
+	Source/WebCore/bridge/c/c_runtime.h \
+	Source/WebCore/bridge/c/CRuntimeObject.cpp \
+	Source/WebCore/bridge/c/CRuntimeObject.h \
+	Source/WebCore/bridge/c/c_utility.cpp \
+	Source/WebCore/bridge/c/c_utility.h \
+	Source/WebCore/bridge/IdentifierRep.cpp \
+	Source/WebCore/bridge/IdentifierRep.h \
+	Source/WebCore/bridge/jni/JNIUtility.h \
+	Source/WebCore/bridge/jni/JavaMethod.h \
+	Source/WebCore/bridge/jni/JavaMethodJobject.cpp \
+	Source/WebCore/bridge/jni/JavaMethodJobject.h \
+	Source/WebCore/bridge/jni/JavaString.h \
+	Source/WebCore/bridge/jni/JavaType.h \
+	Source/WebCore/bridge/jni/jni_jsobject.h \
+	Source/WebCore/bridge/jni/jsc/JavaArrayJSC.h \
+	Source/WebCore/bridge/jni/jsc/JavaClassJSC.h \
+	Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h \
+	Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.h \
+	Source/WebCore/bridge/jsc/BridgeJSC.cpp \
+	Source/WebCore/bridge/jsc/BridgeJSC.h \
+	Source/WebCore/bridge/npapi.h \
+	Source/WebCore/bridge/NP_jsobject.cpp \
+	Source/WebCore/bridge/NP_jsobject.h \
+	Source/WebCore/bridge/npruntime.cpp \
+	Source/WebCore/bridge/npruntime.h \
+	Source/WebCore/bridge/npruntime_impl.h \
+	Source/WebCore/bridge/npruntime_internal.h \
+	Source/WebCore/bridge/npruntime_priv.h \
+	Source/WebCore/bridge/nptypes.h \
+	Source/WebCore/bridge/runtime_array.cpp \
+	Source/WebCore/bridge/runtime_array.h \
+	Source/WebCore/bridge/runtime_method.cpp \
+	Source/WebCore/bridge/runtime_method.h \
+	Source/WebCore/bridge/runtime_object.cpp \
+	Source/WebCore/bridge/runtime_object.h \
+	Source/WebCore/bridge/runtime_root.cpp \
+	Source/WebCore/bridge/runtime_root.h \
+	Source/WebCore/config.h \
+	Source/WebCore/css/Counter.h \
+	Source/WebCore/css/CSSBorderImageValue.cpp \
+	Source/WebCore/css/CSSBorderImageValue.h \
+	Source/WebCore/css/CSSCanvasValue.cpp \
+	Source/WebCore/css/CSSCanvasValue.h \
+	Source/WebCore/css/CSSCharsetRule.cpp \
+	Source/WebCore/css/CSSCharsetRule.h \
+	Source/WebCore/css/CSSComputedStyleDeclaration.cpp \
+	Source/WebCore/css/CSSComputedStyleDeclaration.h \
+	Source/WebCore/css/CSSCursorImageValue.cpp \
+	Source/WebCore/css/CSSCursorImageValue.h \
+	Source/WebCore/css/CSSFontFace.cpp \
+	Source/WebCore/css/CSSFontFace.h \
+	Source/WebCore/css/CSSFontFaceRule.cpp \
+	Source/WebCore/css/CSSFontFaceRule.h \
+	Source/WebCore/css/CSSFontFaceSource.cpp \
+	Source/WebCore/css/CSSFontFaceSource.h \
+	Source/WebCore/css/CSSFontFaceSrcValue.cpp \
+	Source/WebCore/css/CSSFontFaceSrcValue.h \
+	Source/WebCore/css/CSSFontSelector.cpp \
+	Source/WebCore/css/CSSFontSelector.h \
+	Source/WebCore/css/CSSFunctionValue.cpp \
+	Source/WebCore/css/CSSFunctionValue.h \
+	Source/WebCore/css/CSSGradientValue.cpp \
+	Source/WebCore/css/CSSGradientValue.h \
+	Source/WebCore/css/CSSHelper.h \
+	Source/WebCore/css/CSSImageGeneratorValue.cpp \
+	Source/WebCore/css/CSSImageGeneratorValue.h \
+	Source/WebCore/css/CSSImageValue.cpp \
+	Source/WebCore/css/CSSImageValue.h \
+	Source/WebCore/css/CSSImportRule.cpp \
+	Source/WebCore/css/CSSImportRule.h \
+	Source/WebCore/css/CSSInheritedValue.cpp \
+	Source/WebCore/css/CSSInheritedValue.h \
+	Source/WebCore/css/CSSInitialValue.cpp \
+	Source/WebCore/css/CSSInitialValue.h \
+	Source/WebCore/css/CSSLineBoxContainValue.cpp \
+	Source/WebCore/css/CSSLineBoxContainValue.h \
+	Source/WebCore/css/CSSMediaRule.cpp \
+	Source/WebCore/css/CSSMediaRule.h \
+	Source/WebCore/css/CSSMutableStyleDeclaration.cpp \
+	Source/WebCore/css/CSSMutableStyleDeclaration.h \
+	Source/WebCore/css/CSSMutableValue.h \
+	Source/WebCore/css/CSSNamespace.h \
+	Source/WebCore/css/CSSOMUtils.cpp \
+	Source/WebCore/css/CSSOMUtils.h \
+	Source/WebCore/css/CSSPageRule.cpp \
+	Source/WebCore/css/CSSPageRule.h \
+	Source/WebCore/css/CSSParser.cpp \
+	Source/WebCore/css/CSSParser.h \
+	Source/WebCore/css/CSSParserValues.cpp \
+	Source/WebCore/css/CSSParserValues.h \
+	Source/WebCore/css/CSSPrimitiveValue.cpp \
+	Source/WebCore/css/CSSPrimitiveValue.h \
+	Source/WebCore/css/CSSPrimitiveValueCache.cpp \
+	Source/WebCore/css/CSSPrimitiveValueCache.h \
+	Source/WebCore/css/CSSPrimitiveValueMappings.h \
+	Source/WebCore/css/CSSProperty.cpp \
+	Source/WebCore/css/CSSProperty.h \
+	Source/WebCore/css/CSSPropertyLonghand.cpp \
+	Source/WebCore/css/CSSPropertyLonghand.h \
+	Source/WebCore/css/CSSPropertySourceData.cpp \
+	Source/WebCore/css/CSSPropertySourceData.h \
+	Source/WebCore/css/CSSQuirkPrimitiveValue.h \
+	Source/WebCore/css/CSSReflectionDirection.h \
+	Source/WebCore/css/CSSReflectValue.cpp \
+	Source/WebCore/css/CSSReflectValue.h \
+	Source/WebCore/css/CSSRule.cpp \
+	Source/WebCore/css/CSSRule.h \
+	Source/WebCore/css/CSSRuleList.cpp \
+	Source/WebCore/css/CSSRuleList.h \
+	Source/WebCore/css/CSSSegmentedFontFace.cpp \
+	Source/WebCore/css/CSSSegmentedFontFace.h \
+	Source/WebCore/css/CSSSelector.cpp \
+	Source/WebCore/css/CSSSelector.h \
+	Source/WebCore/css/CSSSelectorList.cpp \
+	Source/WebCore/css/CSSSelectorList.h \
+	Source/WebCore/css/CSSStyleApplyProperty.cpp \
+	Source/WebCore/css/CSSStyleApplyProperty.h \
+	Source/WebCore/css/CSSStyleDeclaration.cpp \
+	Source/WebCore/css/CSSStyleDeclaration.h \
+	Source/WebCore/css/CSSStyleRule.cpp \
+	Source/WebCore/css/CSSStyleRule.h \
+	Source/WebCore/css/CSSStyleSelector.cpp \
+	Source/WebCore/css/CSSStyleSelector.h \
+	Source/WebCore/css/CSSStyleSheet.cpp \
+	Source/WebCore/css/CSSStyleSheet.h \
+	Source/WebCore/css/CSSTimingFunctionValue.cpp \
+	Source/WebCore/css/CSSTimingFunctionValue.h \
+	Source/WebCore/css/CSSUnicodeRangeValue.cpp \
+	Source/WebCore/css/CSSUnicodeRangeValue.h \
+	Source/WebCore/css/CSSUnknownRule.h \
+	Source/WebCore/css/CSSValue.h \
+	Source/WebCore/css/CSSValueList.cpp \
+	Source/WebCore/css/CSSValueList.h \
+	Source/WebCore/css/DashboardRegion.h \
+	Source/WebCore/css/FontFamilyValue.cpp \
+	Source/WebCore/css/FontFamilyValue.h \
+	Source/WebCore/css/FontValue.cpp \
+	Source/WebCore/css/FontValue.h \
+	Source/WebCore/css/MediaFeatureNames.cpp \
+	Source/WebCore/css/MediaFeatureNames.h \
+	Source/WebCore/css/MediaList.cpp \
+	Source/WebCore/css/MediaList.h \
+	Source/WebCore/css/MediaQuery.cpp \
+	Source/WebCore/css/MediaQuery.h \
+	Source/WebCore/css/MediaQueryEvaluator.cpp \
+	Source/WebCore/css/MediaQueryEvaluator.h \
+	Source/WebCore/css/MediaQueryExp.cpp \
+	Source/WebCore/css/MediaQueryExp.h \
+	Source/WebCore/css/MediaQueryList.cpp \
+	Source/WebCore/css/MediaQueryList.h \
+	Source/WebCore/css/MediaQueryListListener.cpp \
+	Source/WebCore/css/MediaQueryListListener.h \
+	Source/WebCore/css/MediaQueryMatcher.cpp \
+	Source/WebCore/css/MediaQueryMatcher.h \
+	Source/WebCore/css/Pair.h \
+	Source/WebCore/css/Rect.h \
+	Source/WebCore/css/RGBColor.cpp \
+	Source/WebCore/css/RGBColor.h \
+	Source/WebCore/css/ShadowValue.cpp \
+	Source/WebCore/css/ShadowValue.h \
+	Source/WebCore/css/StyleBase.cpp \
+	Source/WebCore/css/StyleBase.h \
+	Source/WebCore/css/StyleList.cpp \
+	Source/WebCore/css/StyleList.h \
+	Source/WebCore/css/StyleMedia.cpp \
+	Source/WebCore/css/StyleMedia.h \
+	Source/WebCore/css/StyleSheet.cpp \
+	Source/WebCore/css/StyleSheet.h \
+	Source/WebCore/css/StyleSheetList.cpp \
+	Source/WebCore/css/StyleSheetList.h \
+	Source/WebCore/css/SVGCSSComputedStyleDeclaration.cpp \
+	Source/WebCore/css/SVGCSSParser.cpp \
+	Source/WebCore/css/SVGCSSStyleSelector.cpp \
+	Source/WebCore/css/WebKitCSSKeyframeRule.cpp \
+	Source/WebCore/css/WebKitCSSKeyframeRule.h \
+	Source/WebCore/css/WebKitCSSKeyframesRule.cpp \
+	Source/WebCore/css/WebKitCSSKeyframesRule.h \
+	Source/WebCore/css/WebKitCSSMatrix.cpp \
+	Source/WebCore/css/WebKitCSSMatrix.h \
+	Source/WebCore/css/WebKitCSSTransformValue.cpp \
+	Source/WebCore/css/WebKitCSSTransformValue.h \
+	Source/WebCore/dom/ActiveDOMObject.cpp \
+	Source/WebCore/dom/ActiveDOMObject.h \
+	Source/WebCore/dom/Attr.cpp \
+	Source/WebCore/dom/Attr.h \
+	Source/WebCore/dom/Attribute.cpp \
+	Source/WebCore/dom/Attribute.h \
+	Source/WebCore/dom/BeforeLoadEvent.h \
+	Source/WebCore/dom/BeforeProcessEvent.cpp \
+	Source/WebCore/dom/BeforeProcessEvent.h \
+	Source/WebCore/dom/BeforeTextInsertedEvent.cpp \
+	Source/WebCore/dom/BeforeTextInsertedEvent.h \
+	Source/WebCore/dom/BeforeUnloadEvent.cpp \
+	Source/WebCore/dom/BeforeUnloadEvent.h \
+	Source/WebCore/dom/CDATASection.cpp \
+	Source/WebCore/dom/CDATASection.h \
+	Source/WebCore/dom/CharacterData.cpp \
+	Source/WebCore/dom/CharacterData.h \
+	Source/WebCore/dom/CheckedRadioButtons.cpp \
+	Source/WebCore/dom/CheckedRadioButtons.h \
+	Source/WebCore/dom/ChildNodeList.cpp \
+	Source/WebCore/dom/ChildNodeList.h \
+	Source/WebCore/dom/ClassNodeList.cpp \
+	Source/WebCore/dom/ClassNodeList.h \
+	Source/WebCore/dom/ClientRect.cpp \
+	Source/WebCore/dom/ClientRect.h \
+	Source/WebCore/dom/ClientRectList.cpp \
+	Source/WebCore/dom/ClientRectList.h \
+	Source/WebCore/dom/ClipboardAccessPolicy.h \
+	Source/WebCore/dom/Clipboard.cpp \
+	Source/WebCore/dom/ClipboardEvent.cpp \
+	Source/WebCore/dom/ClipboardEvent.h \
+	Source/WebCore/dom/Clipboard.h \
+	Source/WebCore/dom/Comment.cpp \
+	Source/WebCore/dom/Comment.h \
+	Source/WebCore/dom/CompositionEvent.cpp \
+	Source/WebCore/dom/CompositionEvent.h \
+	Source/WebCore/dom/ContainerNodeAlgorithms.h \
+	Source/WebCore/dom/ContainerNode.cpp \
+	Source/WebCore/dom/ContainerNode.h \
+	Source/WebCore/dom/CrossThreadTask.h \
+	Source/WebCore/dom/CSSMappedAttributeDeclaration.cpp \
+	Source/WebCore/dom/CSSMappedAttributeDeclaration.h \
+	Source/WebCore/dom/CustomEvent.cpp \
+	Source/WebCore/dom/CustomEvent.h \
+	Source/WebCore/dom/DatasetDOMStringMap.cpp \
+	Source/WebCore/dom/DatasetDOMStringMap.h \
+	Source/WebCore/dom/DecodedDataDocumentParser.cpp \
+	Source/WebCore/dom/DecodedDataDocumentParser.h \
+	Source/WebCore/dom/default/PlatformMessagePortChannel.cpp \
+	Source/WebCore/dom/default/PlatformMessagePortChannel.h \
+	Source/WebCore/dom/DeviceMotionClient.h \
+	Source/WebCore/dom/DeviceMotionController.cpp \
+	Source/WebCore/dom/DeviceMotionController.h \
+	Source/WebCore/dom/DeviceMotionData.cpp \
+	Source/WebCore/dom/DeviceMotionData.h \
+	Source/WebCore/dom/DeviceMotionEvent.cpp \
+	Source/WebCore/dom/DeviceMotionEvent.h \
+	Source/WebCore/dom/DeviceOrientationClient.h \
+	Source/WebCore/dom/DeviceOrientationController.cpp \
+	Source/WebCore/dom/DeviceOrientationController.h \
+	Source/WebCore/dom/DeviceOrientation.cpp \
+	Source/WebCore/dom/DeviceOrientationEvent.cpp \
+	Source/WebCore/dom/DeviceOrientationEvent.h \
+	Source/WebCore/dom/DeviceOrientation.h \
+	Source/WebCore/dom/Document.cpp \
+	Source/WebCore/dom/DocumentFragment.cpp \
+	Source/WebCore/dom/DocumentFragment.h \
+	Source/WebCore/dom/Document.h \
+	Source/WebCore/dom/DocumentMarkerController.cpp \
+	Source/WebCore/dom/DocumentMarkerController.h \
+	Source/WebCore/dom/DocumentMarker.h \
+	Source/WebCore/dom/DocumentOrderedMap.cpp \
+	Source/WebCore/dom/DocumentOrderedMap.h \
+	Source/WebCore/dom/DocumentParser.cpp \
+	Source/WebCore/dom/DocumentParser.h \
+	Source/WebCore/dom/DocumentTiming.h \
+	Source/WebCore/dom/DocumentType.cpp \
+	Source/WebCore/dom/DocumentType.h \
+	Source/WebCore/dom/DOMCoreException.h \
+	Source/WebCore/dom/DOMImplementation.cpp \
+	Source/WebCore/dom/DOMImplementation.h \
+	Source/WebCore/dom/DOMStringList.cpp \
+	Source/WebCore/dom/DOMStringList.h \
+	Source/WebCore/dom/DOMStringMap.cpp \
+	Source/WebCore/dom/DOMStringMap.h \
+	Source/WebCore/dom/DOMTimeStamp.h \
+	Source/WebCore/dom/DynamicNodeList.cpp \
+	Source/WebCore/dom/DynamicNodeList.h \
+	Source/WebCore/dom/EditingText.cpp \
+	Source/WebCore/dom/EditingText.h \
+	Source/WebCore/dom/Element.cpp \
+	Source/WebCore/dom/Element.h \
+	Source/WebCore/dom/ElementRareData.h \
+	Source/WebCore/dom/Entity.h \
+	Source/WebCore/dom/EntityReference.cpp \
+	Source/WebCore/dom/EntityReference.h \
+	Source/WebCore/dom/ErrorEvent.cpp \
+	Source/WebCore/dom/ErrorEvent.h \
+	Source/WebCore/dom/Event.cpp \
+	Source/WebCore/dom/Event.h \
+	Source/WebCore/dom/EventContext.cpp \
+	Source/WebCore/dom/EventContext.h \
+	Source/WebCore/dom/EventDispatcher.cpp \
+	Source/WebCore/dom/EventDispatcher.h \
+	Source/WebCore/dom/EventException.h \
+	Source/WebCore/dom/EventListener.h \
+	Source/WebCore/dom/EventNames.cpp \
+	Source/WebCore/dom/EventNames.h \
+	Source/WebCore/dom/EventTarget.cpp \
+	Source/WebCore/dom/EventTarget.h \
+	Source/WebCore/dom/EventQueue.cpp \
+	Source/WebCore/dom/EventQueue.h \
+	Source/WebCore/dom/ExceptionBase.cpp \
+	Source/WebCore/dom/ExceptionBase.h \
+	Source/WebCore/dom/ExceptionCode.cpp \
+	Source/WebCore/dom/ExceptionCode.h \
+	Source/WebCore/dom/FragmentScriptingPermission.h \
+	Source/WebCore/dom/IgnoreDestructiveWriteCountIncrementer.h \
+	Source/WebCore/dom/InputElement.cpp \
+	Source/WebCore/dom/InputElement.h \
+	Source/WebCore/dom/HashChangeEvent.h \
+	Source/WebCore/dom/KeyboardEvent.cpp \
+	Source/WebCore/dom/KeyboardEvent.h \
+	Source/WebCore/dom/MappedAttributeEntry.h \
+	Source/WebCore/dom/MessageChannel.cpp \
+	Source/WebCore/dom/MessageChannel.h \
+	Source/WebCore/dom/MessageEvent.cpp \
+	Source/WebCore/dom/MessageEvent.h \
+	Source/WebCore/dom/MessagePortChannel.cpp \
+	Source/WebCore/dom/MessagePortChannel.h \
+	Source/WebCore/dom/MessagePort.cpp \
+	Source/WebCore/dom/MessagePort.h \
+	Source/WebCore/dom/MouseEvent.cpp \
+	Source/WebCore/dom/MouseEvent.h \
+	Source/WebCore/dom/MouseRelatedEvent.cpp \
+	Source/WebCore/dom/MouseRelatedEvent.h \
+	Source/WebCore/dom/MutationEvent.cpp \
+	Source/WebCore/dom/MutationEvent.h \
+	Source/WebCore/dom/NamedNodeMap.cpp \
+	Source/WebCore/dom/NamedNodeMap.h \
+	Source/WebCore/dom/NameNodeList.cpp \
+	Source/WebCore/dom/NameNodeList.h \
+	Source/WebCore/dom/Node.cpp \
+	Source/WebCore/dom/NodeFilterCondition.cpp \
+	Source/WebCore/dom/NodeFilterCondition.h \
+	Source/WebCore/dom/NodeFilter.cpp \
+	Source/WebCore/dom/NodeFilter.h \
+	Source/WebCore/dom/Node.h \
+	Source/WebCore/dom/NodeIterator.cpp \
+	Source/WebCore/dom/NodeIterator.h \
+	Source/WebCore/dom/NodeList.h \
+	Source/WebCore/dom/NodeRareData.h \
+	Source/WebCore/dom/NodeRenderStyle.h \
+	Source/WebCore/dom/NodeWithIndex.h \
+	Source/WebCore/dom/Notation.cpp \
+	Source/WebCore/dom/Notation.h \
+	Source/WebCore/dom/OptionElement.cpp \
+	Source/WebCore/dom/OptionElement.h \
+	Source/WebCore/dom/OptionGroupElement.cpp \
+	Source/WebCore/dom/OptionGroupElement.h \
+	Source/WebCore/dom/OverflowEvent.cpp \
+	Source/WebCore/dom/OverflowEvent.h \
+	Source/WebCore/dom/PageTransitionEvent.cpp \
+	Source/WebCore/dom/PageTransitionEvent.h \
+	Source/WebCore/dom/PendingScript.cpp \
+	Source/WebCore/dom/PendingScript.h \
+	Source/WebCore/dom/PopStateEvent.cpp \
+	Source/WebCore/dom/PopStateEvent.h \
+	Source/WebCore/dom/Position.cpp \
+	Source/WebCore/dom/Position.h \
+	Source/WebCore/dom/PositionIterator.cpp \
+	Source/WebCore/dom/PositionIterator.h \
+	Source/WebCore/dom/ProcessingInstruction.cpp \
+	Source/WebCore/dom/ProcessingInstruction.h \
+	Source/WebCore/dom/ProgressEvent.cpp \
+	Source/WebCore/dom/ProgressEvent.h \
+	Source/WebCore/dom/QualifiedName.cpp \
+	Source/WebCore/dom/QualifiedName.h \
+	Source/WebCore/dom/RangeBoundaryPoint.h \
+	Source/WebCore/dom/Range.cpp \
+	Source/WebCore/dom/RangeException.h \
+	Source/WebCore/dom/Range.h \
+	Source/WebCore/dom/RawDataDocumentParser.h \
+	Source/WebCore/dom/RegisteredEventListener.cpp \
+	Source/WebCore/dom/RegisteredEventListener.h \
+	Source/WebCore/dom/ScopedEventQueue.cpp \
+	Source/WebCore/dom/ScopedEventQueue.h \
+	Source/WebCore/dom/ScriptableDocumentParser.cpp \
+	Source/WebCore/dom/ScriptableDocumentParser.h \
+	Source/WebCore/dom/ScriptElement.cpp \
+	Source/WebCore/dom/ScriptElement.h \
+	Source/WebCore/dom/ScriptExecutionContext.cpp \
+	Source/WebCore/dom/ScriptExecutionContext.h \
+	Source/WebCore/dom/ScriptRunner.cpp \
+	Source/WebCore/dom/ScriptRunner.h \
+	Source/WebCore/dom/SelectElement.cpp \
+	Source/WebCore/dom/SelectElement.h \
+	Source/WebCore/dom/SelectorNodeList.cpp \
+	Source/WebCore/dom/SelectorNodeList.h \
+	Source/WebCore/dom/ShadowRoot.cpp \
+	Source/WebCore/dom/ShadowRoot.h \
+	Source/WebCore/dom/SpaceSplitString.cpp \
+	Source/WebCore/dom/SpaceSplitString.h \
+	Source/WebCore/dom/StaticHashSetNodeList.cpp \
+	Source/WebCore/dom/StaticHashSetNodeList.h \
+	Source/WebCore/dom/StaticNodeList.cpp \
+	Source/WebCore/dom/StaticNodeList.h \
+	Source/WebCore/dom/StyledElement.cpp \
+	Source/WebCore/dom/StyledElement.h \
+	Source/WebCore/dom/StyleElement.cpp \
+	Source/WebCore/dom/StyleElement.h \
+	Source/WebCore/dom/TagNodeList.cpp \
+	Source/WebCore/dom/TagNodeList.h \
+	Source/WebCore/dom/Text.cpp \
+	Source/WebCore/dom/TextEvent.cpp \
+	Source/WebCore/dom/TextEvent.h \
+	Source/WebCore/dom/TextEventInputType.h \
+	Source/WebCore/dom/Text.h \
+	Source/WebCore/dom/TouchList.h \
+	Source/WebCore/dom/TransformSource.h \
+	Source/WebCore/dom/TransformSourceLibxslt.cpp \
+	Source/WebCore/dom/Traversal.cpp \
+	Source/WebCore/dom/Traversal.h \
+	Source/WebCore/dom/TreeDepthLimit.h \
+	Source/WebCore/dom/TreeScope.cpp \
+	Source/WebCore/dom/TreeScope.h \
+	Source/WebCore/dom/TreeWalker.cpp \
+	Source/WebCore/dom/TreeWalker.h \
+	Source/WebCore/dom/UIEvent.cpp \
+	Source/WebCore/dom/UIEvent.h \
+	Source/WebCore/dom/UIEventWithKeyState.cpp \
+	Source/WebCore/dom/UIEventWithKeyState.h \
+	Source/WebCore/dom/UserGestureIndicator.cpp \
+	Source/WebCore/dom/UserGestureIndicator.h \
+	Source/WebCore/dom/UserTypingGestureIndicator.cpp \
+	Source/WebCore/dom/UserTypingGestureIndicator.h \
+	Source/WebCore/dom/ViewportArguments.cpp \
+	Source/WebCore/dom/ViewportArguments.h \
+	Source/WebCore/dom/WebKitAnimationEvent.cpp \
+	Source/WebCore/dom/WebKitAnimationEvent.h \
+	Source/WebCore/dom/WebKitTransitionEvent.cpp \
+	Source/WebCore/dom/WebKitTransitionEvent.h \
+	Source/WebCore/dom/WheelEvent.cpp \
+	Source/WebCore/dom/WheelEvent.h \
+	Source/WebCore/dom/WindowEventContext.cpp \
+	Source/WebCore/dom/WindowEventContext.h \
+	Source/WebCore/dom/XMLDocumentParser.cpp \
+	Source/WebCore/dom/XMLDocumentParser.h \
+	Source/WebCore/dom/XMLDocumentParserLibxml2.cpp \
+	Source/WebCore/dom/XMLDocumentParserScope.cpp \
+	Source/WebCore/dom/XMLDocumentParserScope.h \
+	Source/WebCore/editing/AppendNodeCommand.cpp \
+	Source/WebCore/editing/AppendNodeCommand.h \
+	Source/WebCore/editing/ApplyBlockElementCommand.cpp \
+	Source/WebCore/editing/ApplyBlockElementCommand.h \
+	Source/WebCore/editing/ApplyStyleCommand.cpp \
+	Source/WebCore/editing/ApplyStyleCommand.h \
+	Source/WebCore/editing/BreakBlockquoteCommand.cpp \
+	Source/WebCore/editing/BreakBlockquoteCommand.h \
+	Source/WebCore/editing/CompositeEditCommand.cpp \
+	Source/WebCore/editing/CompositeEditCommand.h \
+	Source/WebCore/editing/CreateLinkCommand.cpp \
+	Source/WebCore/editing/CreateLinkCommand.h \
+	Source/WebCore/editing/DeleteButtonController.cpp \
+	Source/WebCore/editing/DeleteButtonController.h \
+	Source/WebCore/editing/DeleteButton.cpp \
+	Source/WebCore/editing/DeleteButton.h \
+	Source/WebCore/editing/DeleteFromTextNodeCommand.cpp \
+	Source/WebCore/editing/DeleteFromTextNodeCommand.h \
+	Source/WebCore/editing/DeleteSelectionCommand.cpp \
+	Source/WebCore/editing/DeleteSelectionCommand.h \
+	Source/WebCore/editing/EditAction.h \
+	Source/WebCore/editing/EditCommand.cpp \
+	Source/WebCore/editing/EditCommand.h \
+	Source/WebCore/editing/EditingBehavior.h \
+	Source/WebCore/editing/EditingBehaviorTypes.h \
+	Source/WebCore/editing/EditingBoundary.h \
+	Source/WebCore/editing/EditingStyle.cpp \
+	Source/WebCore/editing/EditingStyle.h \
+	Source/WebCore/editing/EditorCommand.cpp \
+	Source/WebCore/editing/Editor.cpp \
+	Source/WebCore/editing/EditorDeleteAction.h \
+	Source/WebCore/editing/Editor.h \
+	Source/WebCore/editing/EditorInsertAction.h \
+	Source/WebCore/editing/FindOptions.h \
+	Source/WebCore/editing/FormatBlockCommand.cpp \
+	Source/WebCore/editing/FormatBlockCommand.h \
+	Source/WebCore/editing/gtk/SelectionControllerGtk.cpp \
+	Source/WebCore/editing/htmlediting.cpp \
+	Source/WebCore/editing/htmlediting.h \
+	Source/WebCore/editing/HTMLInterchange.cpp \
+	Source/WebCore/editing/HTMLInterchange.h \
+	Source/WebCore/editing/IndentOutdentCommand.cpp \
+	Source/WebCore/editing/IndentOutdentCommand.h \
+	Source/WebCore/editing/InsertIntoTextNodeCommand.cpp \
+	Source/WebCore/editing/InsertIntoTextNodeCommand.h \
+	Source/WebCore/editing/InsertLineBreakCommand.cpp \
+	Source/WebCore/editing/InsertLineBreakCommand.h \
+	Source/WebCore/editing/InsertListCommand.cpp \
+	Source/WebCore/editing/InsertListCommand.h \
+	Source/WebCore/editing/InsertNodeBeforeCommand.cpp \
+	Source/WebCore/editing/InsertNodeBeforeCommand.h \
+	Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp \
+	Source/WebCore/editing/InsertParagraphSeparatorCommand.h \
+	Source/WebCore/editing/InsertTextCommand.cpp \
+	Source/WebCore/editing/InsertTextCommand.h \
+	Source/WebCore/editing/JoinTextNodesCommand.cpp \
+	Source/WebCore/editing/JoinTextNodesCommand.h \
+	Source/WebCore/editing/markup.cpp \
+	Source/WebCore/editing/markup.h \
+	Source/WebCore/editing/MarkupAccumulator.cpp \
+	Source/WebCore/editing/MarkupAccumulator.h \
+	Source/WebCore/editing/MergeIdenticalElementsCommand.cpp \
+	Source/WebCore/editing/MergeIdenticalElementsCommand.h \
+	Source/WebCore/editing/ModifySelectionListLevel.cpp \
+	Source/WebCore/editing/ModifySelectionListLevel.h \
+	Source/WebCore/editing/MoveSelectionCommand.cpp \
+	Source/WebCore/editing/MoveSelectionCommand.h \
+	Source/WebCore/editing/RemoveCSSPropertyCommand.cpp \
+	Source/WebCore/editing/RemoveCSSPropertyCommand.h \
+	Source/WebCore/editing/RemoveFormatCommand.cpp \
+	Source/WebCore/editing/RemoveFormatCommand.h \
+	Source/WebCore/editing/RemoveNodeCommand.cpp \
+	Source/WebCore/editing/RemoveNodeCommand.h \
+	Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp \
+	Source/WebCore/editing/RemoveNodePreservingChildrenCommand.h \
+	Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp \
+	Source/WebCore/editing/ReplaceNodeWithSpanCommand.h \
+	Source/WebCore/editing/ReplaceSelectionCommand.cpp \
+	Source/WebCore/editing/ReplaceSelectionCommand.h \
+	Source/WebCore/editing/SelectionController.cpp \
+	Source/WebCore/editing/SelectionController.h \
+	Source/WebCore/editing/SetNodeAttributeCommand.cpp \
+	Source/WebCore/editing/SetNodeAttributeCommand.h \
+	Source/WebCore/editing/SmartReplace.cpp \
+	Source/WebCore/editing/SmartReplace.h \
+	Source/WebCore/editing/SmartReplaceICU.cpp \
+	Source/WebCore/editing/SpellChecker.cpp \
+	Source/WebCore/editing/SpellChecker.h \
+	Source/WebCore/editing/SpellingCorrectionController.cpp \
+	Source/WebCore/editing/SpellingCorrectionController.h \
+	Source/WebCore/editing/SpellingCorrectionCommand.h \
+	Source/WebCore/editing/SplitElementCommand.cpp \
+	Source/WebCore/editing/SplitElementCommand.h \
+	Source/WebCore/editing/SplitTextNodeCommand.cpp \
+	Source/WebCore/editing/SplitTextNodeCommand.h \
+	Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp \
+	Source/WebCore/editing/SplitTextNodeContainingElementCommand.h \
+	Source/WebCore/editing/TextAffinity.h \
+	Source/WebCore/editing/TextCheckingHelper.cpp \
+	Source/WebCore/editing/TextCheckingHelper.h \
+	Source/WebCore/editing/TextGranularity.h \
+	Source/WebCore/editing/TextIterator.cpp \
+	Source/WebCore/editing/TextIterator.h \
+	Source/WebCore/editing/TypingCommand.cpp \
+	Source/WebCore/editing/TypingCommand.h \
+	Source/WebCore/editing/UnlinkCommand.cpp \
+	Source/WebCore/editing/UnlinkCommand.h \
+	Source/WebCore/editing/VisiblePosition.cpp \
+	Source/WebCore/editing/VisiblePosition.h \
+	Source/WebCore/editing/VisibleSelection.cpp \
+	Source/WebCore/editing/VisibleSelection.h \
+	Source/WebCore/editing/visible_units.cpp \
+	Source/WebCore/editing/visible_units.h \
+	Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp \
+	Source/WebCore/editing/WrapContentsInDummySpanCommand.h \
+	Source/WebCore/editing/WritingDirection.h \
+	Source/WebCore/fileapi/AsyncFileWriter.h \
+	Source/WebCore/fileapi/AsyncFileWriterClient.h \
+	Source/WebCore/fileapi/Blob.cpp \
+	Source/WebCore/fileapi/Blob.h \
+	Source/WebCore/fileapi/BlobURL.cpp \
+	Source/WebCore/fileapi/BlobURL.h \
+	Source/WebCore/fileapi/DirectoryEntry.cpp \
+	Source/WebCore/fileapi/DirectoryEntry.h \
+	Source/WebCore/fileapi/DirectoryEntrySync.cpp \
+	Source/WebCore/fileapi/DirectoryEntrySync.h \
+	Source/WebCore/fileapi/DirectoryReader.cpp \
+	Source/WebCore/fileapi/DirectoryReader.h \
+	Source/WebCore/fileapi/DirectoryReaderSync.cpp \
+	Source/WebCore/fileapi/DirectoryReaderSync.h \
+	Source/WebCore/fileapi/DOMFilePath.cpp \
+	Source/WebCore/fileapi/DOMFilePath.h \
+	Source/WebCore/fileapi/DOMFileSystem.cpp \
+	Source/WebCore/fileapi/DOMFileSystem.h \
+	Source/WebCore/fileapi/DOMFileSystemBase.cpp \
+	Source/WebCore/fileapi/DOMFileSystemBase.h \
+	Source/WebCore/fileapi/DOMFileSystemSync.cpp \
+	Source/WebCore/fileapi/DOMFileSystemSync.h \
+	Source/WebCore/fileapi/EntriesCallback.h \
+	Source/WebCore/fileapi/Entry.cpp \
+	Source/WebCore/fileapi/Entry.h \
+	Source/WebCore/fileapi/EntryArray.cpp \
+	Source/WebCore/fileapi/EntryArray.h \
+	Source/WebCore/fileapi/EntryArraySync.cpp \
+	Source/WebCore/fileapi/EntryArraySync.h \
+	Source/WebCore/fileapi/EntryBase.h \
+	Source/WebCore/fileapi/EntryCallback.h \
+	Source/WebCore/fileapi/EntrySync.cpp \
+	Source/WebCore/fileapi/EntrySync.h \
+	Source/WebCore/fileapi/ErrorCallback.h \
+	Source/WebCore/fileapi/FileCallback.h \
+	Source/WebCore/fileapi/File.cpp \
+	Source/WebCore/fileapi/FileEntry.cpp \
+	Source/WebCore/fileapi/FileEntry.h \
+	Source/WebCore/fileapi/FileEntrySync.cpp \
+	Source/WebCore/fileapi/FileEntrySync.h \
+	Source/WebCore/fileapi/FileError.h \
+	Source/WebCore/fileapi/FileException.h \
+	Source/WebCore/fileapi/File.h \
+	Source/WebCore/fileapi/FileList.cpp \
+	Source/WebCore/fileapi/FileList.h \
+	Source/WebCore/fileapi/FileReader.cpp \
+	Source/WebCore/fileapi/FileReader.h \
+	Source/WebCore/fileapi/FileReaderLoader.cpp \
+	Source/WebCore/fileapi/FileReaderLoader.h \
+	Source/WebCore/fileapi/FileReaderLoaderClient.h \
+	Source/WebCore/fileapi/FileReaderSync.cpp \
+	Source/WebCore/fileapi/FileReaderSync.h \
+	Source/WebCore/fileapi/FileStreamProxy.cpp \
+	Source/WebCore/fileapi/FileStreamProxy.h \
+	Source/WebCore/fileapi/FileSystemCallback.h \
+	Source/WebCore/fileapi/FileSystemCallbacks.cpp \
+	Source/WebCore/fileapi/FileSystemCallbacks.h \
+	Source/WebCore/fileapi/FileThread.cpp \
+	Source/WebCore/fileapi/FileThread.h \
+	Source/WebCore/fileapi/FileThreadTask.h \
+	Source/WebCore/fileapi/FileWriter.cpp \
+	Source/WebCore/fileapi/FileWriter.h \
+	Source/WebCore/fileapi/FileWriterBase.cpp \
+	Source/WebCore/fileapi/FileWriterBase.h \
+	Source/WebCore/fileapi/FileWriterBaseCallback.h \
+	Source/WebCore/fileapi/FileWriterCallback.h \
+	Source/WebCore/fileapi/FileWriterSync.cpp \
+	Source/WebCore/fileapi/FileWriterSync.h \
+	Source/WebCore/fileapi/WebKitFlags.h \
+	Source/WebCore/fileapi/LocalFileSystem.cpp \
+	Source/WebCore/fileapi/LocalFileSystem.h \
+	Source/WebCore/fileapi/MetadataCallback.h \
+	Source/WebCore/fileapi/Metadata.h \
+	Source/WebCore/fileapi/ThreadableBlobRegistry.cpp \
+	Source/WebCore/fileapi/ThreadableBlobRegistry.h \
+	Source/WebCore/fileapi/WebKitBlobBuilder.cpp \
+	Source/WebCore/fileapi/WebKitBlobBuilder.h \
+	Source/WebCore/history/BackForwardController.cpp \
+	Source/WebCore/history/BackForwardController.h \
+	Source/WebCore/history/BackForwardList.h \
+	Source/WebCore/history/BackForwardListImpl.cpp \
+	Source/WebCore/history/BackForwardListImpl.h \
+	Source/WebCore/history/CachedFrame.cpp \
+	Source/WebCore/history/CachedFrame.h \
+	Source/WebCore/history/CachedFramePlatformData.h \
+	Source/WebCore/history/CachedPage.cpp \
+	Source/WebCore/history/CachedPage.h \
+	Source/WebCore/history/HistoryItem.cpp \
+	Source/WebCore/history/HistoryItem.h \
+	Source/WebCore/history/PageCache.cpp \
+	Source/WebCore/history/PageCache.h \
+	Source/WebCore/html/AsyncImageResizer.cpp \
+	Source/WebCore/html/AsyncImageResizer.h \
+	Source/WebCore/html/BaseButtonInputType.cpp \
+	Source/WebCore/html/BaseButtonInputType.h \
+	Source/WebCore/html/BaseCheckableInputType.cpp \
+	Source/WebCore/html/BaseCheckableInputType.h \
+	Source/WebCore/html/BaseDateAndTimeInputType.cpp \
+	Source/WebCore/html/BaseDateAndTimeInputType.h \
+	Source/WebCore/html/BaseTextInputType.cpp \
+	Source/WebCore/html/BaseTextInputType.h \
+	Source/WebCore/html/ButtonInputType.cpp \
+	Source/WebCore/html/ButtonInputType.h \
+	Source/WebCore/html/canvas/ArrayBuffer.cpp \
+	Source/WebCore/html/canvas/ArrayBuffer.h \
+	Source/WebCore/html/canvas/ArrayBufferView.cpp \
+	Source/WebCore/html/canvas/ArrayBufferView.h \
+	Source/WebCore/html/canvas/CanvasContextAttributes.cpp \
+	Source/WebCore/html/canvas/CanvasContextAttributes.h \
+	Source/WebCore/html/canvas/CanvasGradient.cpp \
+	Source/WebCore/html/canvas/CanvasGradient.h \
+	Source/WebCore/html/canvas/CanvasPattern.cpp \
+	Source/WebCore/html/canvas/CanvasPattern.h \
+	Source/WebCore/html/canvas/CanvasPixelArray.cpp \
+	Source/WebCore/html/canvas/CanvasPixelArray.h \
+	Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp \
+	Source/WebCore/html/canvas/CanvasRenderingContext2D.h \
+	Source/WebCore/html/canvas/CanvasRenderingContext.cpp \
+	Source/WebCore/html/canvas/CanvasRenderingContext.h \
+	Source/WebCore/html/canvas/CanvasStyle.cpp \
+	Source/WebCore/html/canvas/CanvasStyle.h \
+	Source/WebCore/html/canvas/CheckedInt.h \
+	Source/WebCore/html/canvas/DataView.cpp \
+	Source/WebCore/html/canvas/DataView.h \
+	Source/WebCore/html/canvas/Float32Array.cpp \
+	Source/WebCore/html/canvas/Float32Array.h \
+	Source/WebCore/html/canvas/Int16Array.cpp \
+	Source/WebCore/html/canvas/Int16Array.h \
+	Source/WebCore/html/canvas/Int32Array.cpp \
+	Source/WebCore/html/canvas/Int32Array.h \
+	Source/WebCore/html/canvas/Int8Array.cpp \
+	Source/WebCore/html/canvas/Int8Array.h \
+	Source/WebCore/html/canvas/IntegralTypedArrayBase.h \
+	Source/WebCore/html/canvas/TypedArrayBase.h \
+	Source/WebCore/html/canvas/Uint16Array.cpp \
+	Source/WebCore/html/canvas/Uint16Array.h \
+	Source/WebCore/html/canvas/Uint32Array.cpp \
+	Source/WebCore/html/canvas/Uint32Array.h \
+	Source/WebCore/html/canvas/Uint8Array.cpp \
+	Source/WebCore/html/canvas/Uint8Array.h \
+	Source/WebCore/html/DOMSettableTokenList.cpp \
+	Source/WebCore/html/DOMSettableTokenList.h \
+	Source/WebCore/html/DOMTokenList.cpp \
+	Source/WebCore/html/DOMTokenList.h \
+	Source/WebCore/html/CheckboxInputType.cpp \
+	Source/WebCore/html/CheckboxInputType.h \
+	Source/WebCore/html/ClassList.cpp \
+	Source/WebCore/html/ClassList.h \
+	Source/WebCore/html/CollectionCache.cpp \
+	Source/WebCore/html/CollectionCache.h \
+	Source/WebCore/html/CollectionType.h \
+	Source/WebCore/html/ColorInputType.cpp \
+	Source/WebCore/html/ColorInputType.h \
+	Source/WebCore/html/DataGridColumn.cpp \
+	Source/WebCore/html/DataGridColumn.h \
+	Source/WebCore/html/DataGridColumnList.cpp \
+	Source/WebCore/html/DataGridColumnList.h \
+	Source/WebCore/html/DataGridDataSource.h \
+	Source/WebCore/html/DateComponents.cpp \
+	Source/WebCore/html/DateComponents.h \
+	Source/WebCore/html/DateInputType.cpp \
+	Source/WebCore/html/DateInputType.h \
+	Source/WebCore/html/DateTimeInputType.cpp \
+	Source/WebCore/html/DateTimeInputType.h \
+	Source/WebCore/html/DateTimeLocalInputType.cpp \
+	Source/WebCore/html/DateTimeLocalInputType.h \
+	Source/WebCore/html/DOMDataGridDataSource.cpp \
+	Source/WebCore/html/DOMDataGridDataSource.h \
+	Source/WebCore/html/DOMFormData.cpp \
+	Source/WebCore/html/DOMFormData.h \
+	Source/WebCore/html/DOMURL.cpp \
+	Source/WebCore/html/DOMURL.h \
+	Source/WebCore/html/EmailInputType.cpp \
+	Source/WebCore/html/EmailInputType.h \
+	Source/WebCore/html/FileInputType.cpp \
+	Source/WebCore/html/FileInputType.h \
+	Source/WebCore/html/FormAssociatedElement.cpp \
+	Source/WebCore/html/FormAssociatedElement.h \
+	Source/WebCore/html/FormDataList.cpp \
+	Source/WebCore/html/FormDataList.h \
+	Source/WebCore/html/FTPDirectoryDocument.cpp \
+	Source/WebCore/html/FTPDirectoryDocument.h \
+	Source/WebCore/html/HTMLAllCollection.cpp \
+	Source/WebCore/html/HTMLAllCollection.h \
+	Source/WebCore/html/HTMLAnchorElement.cpp \
+	Source/WebCore/html/HTMLAnchorElement.h \
+	Source/WebCore/html/HTMLAppletElement.cpp \
+	Source/WebCore/html/HTMLAppletElement.h \
+	Source/WebCore/html/HTMLAreaElement.cpp \
+	Source/WebCore/html/HTMLAreaElement.h \
+	Source/WebCore/html/HTMLAudioElement.cpp \
+	Source/WebCore/html/HTMLAudioElement.h \
+	Source/WebCore/html/HTMLBaseElement.cpp \
+	Source/WebCore/html/HTMLBaseElement.h \
+	Source/WebCore/html/HTMLBaseFontElement.cpp \
+	Source/WebCore/html/HTMLBaseFontElement.h \
+	Source/WebCore/html/HTMLBlockquoteElement.cpp \
+	Source/WebCore/html/HTMLBlockquoteElement.h \
+	Source/WebCore/html/HTMLBodyElement.cpp \
+	Source/WebCore/html/HTMLBodyElement.h \
+	Source/WebCore/html/HTMLBRElement.cpp \
+	Source/WebCore/html/HTMLBRElement.h \
+	Source/WebCore/html/HTMLButtonElement.cpp \
+	Source/WebCore/html/HTMLButtonElement.h \
+	Source/WebCore/html/HTMLCanvasElement.cpp \
+	Source/WebCore/html/HTMLCanvasElement.h \
+	Source/WebCore/html/HTMLCollection.cpp \
+	Source/WebCore/html/HTMLCollection.h \
+	Source/WebCore/html/HTMLDataGridCellElement.cpp \
+	Source/WebCore/html/HTMLDataGridCellElement.h \
+	Source/WebCore/html/HTMLDataGridColElement.cpp \
+	Source/WebCore/html/HTMLDataGridColElement.h \
+	Source/WebCore/html/HTMLDataGridElement.cpp \
+	Source/WebCore/html/HTMLDataGridElement.h \
+	Source/WebCore/html/HTMLDataGridRowElement.cpp \
+	Source/WebCore/html/HTMLDataGridRowElement.h \
+	Source/WebCore/html/HTMLDataListElement.cpp \
+	Source/WebCore/html/HTMLDataListElement.h \
+	Source/WebCore/html/HTMLDetailsElement.cpp \
+	Source/WebCore/html/HTMLDetailsElement.h \
+	Source/WebCore/html/HTMLDirectoryElement.cpp \
+	Source/WebCore/html/HTMLDirectoryElement.h \
+	Source/WebCore/html/HTMLDivElement.cpp \
+	Source/WebCore/html/HTMLDivElement.h \
+	Source/WebCore/html/HTMLDListElement.cpp \
+	Source/WebCore/html/HTMLDListElement.h \
+	Source/WebCore/html/HTMLDocument.cpp \
+	Source/WebCore/html/HTMLDocument.h \
+	Source/WebCore/html/HTMLElement.cpp \
+	Source/WebCore/html/HTMLElement.h \
+	Source/WebCore/html/HTMLEmbedElement.cpp \
+	Source/WebCore/html/HTMLEmbedElement.h \
+	Source/WebCore/html/HTMLFieldSetElement.cpp \
+	Source/WebCore/html/HTMLFieldSetElement.h \
+	Source/WebCore/html/HTMLFontElement.cpp \
+	Source/WebCore/html/HTMLFontElement.h \
+	Source/WebCore/html/HTMLFormCollection.cpp \
+	Source/WebCore/html/HTMLFormCollection.h \
+	Source/WebCore/html/HTMLFormControlElement.cpp \
+	Source/WebCore/html/HTMLFormControlElement.h \
+	Source/WebCore/html/HTMLFormElement.cpp \
+	Source/WebCore/html/HTMLFormElement.h \
+	Source/WebCore/html/HTMLFrameElementBase.cpp \
+	Source/WebCore/html/HTMLFrameElementBase.h \
+	Source/WebCore/html/HTMLFrameElement.cpp \
+	Source/WebCore/html/HTMLFrameElement.h \
+	Source/WebCore/html/HTMLFrameOwnerElement.cpp \
+	Source/WebCore/html/HTMLFrameOwnerElement.h \
+	Source/WebCore/html/HTMLFrameSetElement.cpp \
+	Source/WebCore/html/HTMLFrameSetElement.h \
+	Source/WebCore/html/HTMLHeadElement.cpp \
+	Source/WebCore/html/HTMLHeadElement.h \
+	Source/WebCore/html/HTMLHeadingElement.cpp \
+	Source/WebCore/html/HTMLHeadingElement.h \
+	Source/WebCore/html/HTMLHRElement.cpp \
+	Source/WebCore/html/HTMLHRElement.h \
+	Source/WebCore/html/HTMLHtmlElement.cpp \
+	Source/WebCore/html/HTMLHtmlElement.h \
+	Source/WebCore/html/HTMLIFrameElement.cpp \
+	Source/WebCore/html/HTMLIFrameElement.h \
+	Source/WebCore/html/HTMLImageElement.cpp \
+	Source/WebCore/html/HTMLImageElement.h \
+	Source/WebCore/html/HTMLImageLoader.cpp \
+	Source/WebCore/html/HTMLImageLoader.h \
+	Source/WebCore/html/HTMLInputElement.cpp \
+	Source/WebCore/html/HTMLInputElement.h \
+	Source/WebCore/html/HTMLIsIndexElement.cpp \
+	Source/WebCore/html/HTMLIsIndexElement.h \
+	Source/WebCore/html/HTMLKeygenElement.cpp \
+	Source/WebCore/html/HTMLKeygenElement.h \
+	Source/WebCore/html/HTMLLabelElement.cpp \
+	Source/WebCore/html/HTMLLabelElement.h \
+	Source/WebCore/html/HTMLLegendElement.cpp \
+	Source/WebCore/html/HTMLLegendElement.h \
+	Source/WebCore/html/HTMLLIElement.cpp \
+	Source/WebCore/html/HTMLLIElement.h \
+	Source/WebCore/html/HTMLLinkElement.cpp \
+	Source/WebCore/html/HTMLLinkElement.h \
+	Source/WebCore/html/HTMLMapElement.cpp \
+	Source/WebCore/html/HTMLMapElement.h \
+	Source/WebCore/html/HTMLMarqueeElement.cpp \
+	Source/WebCore/html/HTMLMarqueeElement.h \
+	Source/WebCore/html/HTMLMediaElement.cpp \
+	Source/WebCore/html/HTMLMediaElement.h \
+	Source/WebCore/html/HTMLMenuElement.cpp \
+	Source/WebCore/html/HTMLMenuElement.h \
+	Source/WebCore/html/HTMLMetaElement.cpp \
+	Source/WebCore/html/HTMLMetaElement.h \
+	Source/WebCore/html/HTMLMeterElement.cpp \
+	Source/WebCore/html/HTMLMeterElement.h \
+	Source/WebCore/html/HTMLModElement.cpp \
+	Source/WebCore/html/HTMLModElement.h \
+	Source/WebCore/html/HTMLNameCollection.cpp \
+	Source/WebCore/html/HTMLNameCollection.h \
+	Source/WebCore/html/HTMLNoScriptElement.cpp \
+	Source/WebCore/html/HTMLNoScriptElement.h \
+	Source/WebCore/html/HTMLObjectElement.cpp \
+	Source/WebCore/html/HTMLObjectElement.h \
+	Source/WebCore/html/HTMLOListElement.cpp \
+	Source/WebCore/html/HTMLOListElement.h \
+	Source/WebCore/html/HTMLOptGroupElement.cpp \
+	Source/WebCore/html/HTMLOptGroupElement.h \
+	Source/WebCore/html/HTMLOptionElement.cpp \
+	Source/WebCore/html/HTMLOptionElement.h \
+	Source/WebCore/html/HTMLOptionsCollection.cpp \
+	Source/WebCore/html/HTMLOptionsCollection.h \
+	Source/WebCore/html/HTMLOutputElement.cpp \
+	Source/WebCore/html/HTMLOutputElement.h \
+	Source/WebCore/html/HTMLParagraphElement.cpp \
+	Source/WebCore/html/HTMLParagraphElement.h \
+	Source/WebCore/html/HTMLParamElement.cpp \
+	Source/WebCore/html/HTMLParamElement.h \
+	Source/WebCore/html/HTMLParserErrorCodes.cpp \
+	Source/WebCore/html/HTMLParserErrorCodes.h \
+	Source/WebCore/html/HTMLParserQuirks.h \
+	Source/WebCore/html/HTMLPlugInElement.cpp \
+	Source/WebCore/html/HTMLPlugInElement.h \
+	Source/WebCore/html/HTMLPlugInImageElement.cpp \
+	Source/WebCore/html/HTMLPlugInImageElement.h \
+	Source/WebCore/html/HTMLPreElement.cpp \
+	Source/WebCore/html/HTMLPreElement.h \
+	Source/WebCore/html/HTMLProgressElement.cpp \
+	Source/WebCore/html/HTMLProgressElement.h \
+	Source/WebCore/html/HTMLQuoteElement.cpp \
+	Source/WebCore/html/HTMLQuoteElement.h \
+	Source/WebCore/html/HTMLScriptElement.cpp \
+	Source/WebCore/html/HTMLScriptElement.h \
+	Source/WebCore/html/HTMLSelectElement.cpp \
+	Source/WebCore/html/HTMLSelectElement.h \
+	Source/WebCore/html/HTMLSourceElement.cpp \
+	Source/WebCore/html/HTMLSourceElement.h \
+	Source/WebCore/html/HTMLStyleElement.cpp \
+	Source/WebCore/html/HTMLStyleElement.h \
+	Source/WebCore/html/HTMLSummaryElement.cpp \
+	Source/WebCore/html/HTMLSummaryElement.h \
+	Source/WebCore/html/HTMLTableCaptionElement.cpp \
+	Source/WebCore/html/HTMLTableCaptionElement.h \
+	Source/WebCore/html/HTMLTableCellElement.cpp \
+	Source/WebCore/html/HTMLTableCellElement.h \
+	Source/WebCore/html/HTMLTableColElement.cpp \
+	Source/WebCore/html/HTMLTableColElement.h \
+	Source/WebCore/html/HTMLTableElement.cpp \
+	Source/WebCore/html/HTMLTableElement.h \
+	Source/WebCore/html/HTMLTablePartElement.cpp \
+	Source/WebCore/html/HTMLTablePartElement.h \
+	Source/WebCore/html/HTMLTableRowElement.cpp \
+	Source/WebCore/html/HTMLTableRowElement.h \
+	Source/WebCore/html/HTMLTableRowsCollection.cpp \
+	Source/WebCore/html/HTMLTableRowsCollection.h \
+	Source/WebCore/html/HTMLTableSectionElement.cpp \
+	Source/WebCore/html/HTMLTableSectionElement.h \
+	Source/WebCore/html/HTMLTextAreaElement.cpp \
+	Source/WebCore/html/HTMLTextAreaElement.h \
+	Source/WebCore/html/HTMLTitleElement.cpp \
+	Source/WebCore/html/HTMLTitleElement.h \
+	Source/WebCore/html/HTMLTrackElement.cpp \
+	Source/WebCore/html/HTMLTrackElement.h \
+	Source/WebCore/html/HTMLUListElement.cpp \
+	Source/WebCore/html/HTMLUListElement.h \
+	Source/WebCore/html/HTMLVideoElement.cpp \
+	Source/WebCore/html/HTMLVideoElement.h \
+	Source/WebCore/html/HTMLViewSourceDocument.cpp \
+	Source/WebCore/html/HTMLViewSourceDocument.h \
+	Source/WebCore/html/HiddenInputType.cpp \
+	Source/WebCore/html/HiddenInputType.h \
+	Source/WebCore/html/ImageData.cpp \
+	Source/WebCore/html/ImageData.h \
+	Source/WebCore/html/ImageDocument.cpp \
+	Source/WebCore/html/ImageDocument.h \
+	Source/WebCore/html/ImageInputType.cpp \
+	Source/WebCore/html/ImageInputType.h \
+	Source/WebCore/html/ImageResizerThread.cpp \
+	Source/WebCore/html/ImageResizerThread.h \
+	Source/WebCore/html/InputType.cpp \
+	Source/WebCore/html/InputType.h \
+	Source/WebCore/html/IsIndexInputType.cpp \
+	Source/WebCore/html/IsIndexInputType.h \
+	Source/WebCore/html/LabelsNodeList.cpp \
+	Source/WebCore/html/LabelsNodeList.h \
+	Source/WebCore/html/MediaDocument.cpp \
+	Source/WebCore/html/MediaDocument.h \
+	Source/WebCore/html/MediaError.h \
+	Source/WebCore/html/MonthInputType.cpp \
+	Source/WebCore/html/MonthInputType.h \
+	Source/WebCore/html/NumberInputType.cpp \
+	Source/WebCore/html/NumberInputType.h \
+	Source/WebCore/html/parser/CSSPreloadScanner.cpp \
+	Source/WebCore/html/parser/CSSPreloadScanner.h \
+	Source/WebCore/html/parser/HTMLConstructionSite.cpp \
+	Source/WebCore/html/parser/HTMLConstructionSite.h \
+	Source/WebCore/html/parser/HTMLDocumentParser.cpp \
+	Source/WebCore/html/parser/HTMLDocumentParser.h \
+	Source/WebCore/html/parser/HTMLElementStack.cpp \
+	Source/WebCore/html/parser/HTMLElementStack.h \
+	Source/WebCore/html/parser/HTMLEntityParser.cpp \
+	Source/WebCore/html/parser/HTMLEntityParser.h \
+	Source/WebCore/html/parser/HTMLEntitySearch.cpp \
+	Source/WebCore/html/parser/HTMLEntitySearch.h \
+	Source/WebCore/html/parser/HTMLEntityTable.h \
+	Source/WebCore/html/parser/HTMLFormattingElementList.cpp \
+	Source/WebCore/html/parser/HTMLFormattingElementList.h \
+	Source/WebCore/html/parser/HTMLInputStream.h \
+	Source/WebCore/html/parser/HTMLMetaCharsetParser.cpp \
+	Source/WebCore/html/parser/HTMLMetaCharsetParser.h \
+	Source/WebCore/html/parser/HTMLParserIdioms.cpp \
+	Source/WebCore/html/parser/HTMLParserIdioms.h \
+	Source/WebCore/html/parser/HTMLParserScheduler.cpp \
+	Source/WebCore/html/parser/HTMLParserScheduler.h \
+	Source/WebCore/html/parser/HTMLPreloadScanner.cpp \
+	Source/WebCore/html/parser/HTMLPreloadScanner.h \
+	Source/WebCore/html/parser/HTMLScriptRunner.cpp \
+	Source/WebCore/html/parser/HTMLScriptRunner.h \
+	Source/WebCore/html/parser/HTMLScriptRunnerHost.h \
+	Source/WebCore/html/parser/HTMLSourceTracker.cpp \
+	Source/WebCore/html/parser/HTMLSourceTracker.h \
+	Source/WebCore/html/parser/HTMLToken.h \
+	Source/WebCore/html/parser/HTMLTokenizer.cpp \
+	Source/WebCore/html/parser/HTMLTokenizer.h \
+	Source/WebCore/html/parser/HTMLTreeBuilder.cpp \
+	Source/WebCore/html/parser/HTMLTreeBuilder.h \
+	Source/WebCore/html/parser/HTMLViewSourceParser.cpp \
+	Source/WebCore/html/parser/HTMLViewSourceParser.h \
+	Source/WebCore/html/parser/NestingLevelIncrementer.h \
+	Source/WebCore/html/parser/TextDocumentParser.cpp \
+	Source/WebCore/html/parser/TextDocumentParser.h \
+	Source/WebCore/html/parser/TextViewSourceParser.cpp \
+	Source/WebCore/html/parser/TextViewSourceParser.h \
+	Source/WebCore/html/parser/XSSFilter.cpp \
+	Source/WebCore/html/parser/XSSFilter.h \
+	Source/WebCore/html/shadow/DetailsMarkerControl.cpp \
+	Source/WebCore/html/shadow/DetailsMarkerControl.h \
+	Source/WebCore/html/shadow/MediaControls.cpp \
+	Source/WebCore/html/shadow/MediaControls.h \
+	Source/WebCore/html/shadow/MediaControlElements.cpp \
+	Source/WebCore/html/shadow/MediaControlElements.h \
+	Source/WebCore/html/shadow/MediaControlRootElement.cpp \
+	Source/WebCore/html/shadow/MediaControlRootElement.h \
+	Source/WebCore/html/shadow/MeterShadowElement.cpp \
+	Source/WebCore/html/shadow/MeterShadowElement.h \
+	Source/WebCore/html/shadow/ProgressShadowElement.cpp \
+	Source/WebCore/html/shadow/ProgressShadowElement.h \
+	Source/WebCore/html/shadow/SliderThumbElement.cpp \
+	Source/WebCore/html/shadow/SliderThumbElement.h \
+	Source/WebCore/html/shadow/TextControlInnerElements.cpp \
+	Source/WebCore/html/shadow/TextControlInnerElements.h \
+	Source/WebCore/html/PasswordInputType.cpp \
+	Source/WebCore/html/PasswordInputType.h \
+	Source/WebCore/html/PluginDocument.cpp \
+	Source/WebCore/html/PluginDocument.h \
+	Source/WebCore/html/RadioInputType.cpp \
+	Source/WebCore/html/RadioInputType.h \
+	Source/WebCore/html/RangeInputType.cpp \
+	Source/WebCore/html/RangeInputType.h \
+	Source/WebCore/html/ResetInputType.cpp \
+	Source/WebCore/html/ResetInputType.h \
+	Source/WebCore/html/SearchInputType.cpp \
+	Source/WebCore/html/SearchInputType.h \
+	Source/WebCore/html/StepRange.cpp \
+	Source/WebCore/html/StepRange.h \
+	Source/WebCore/html/SubmitInputType.cpp \
+	Source/WebCore/html/SubmitInputType.h \
+	Source/WebCore/html/TelephoneInputType.cpp \
+	Source/WebCore/html/TelephoneInputType.h \
+	Source/WebCore/html/TextDocument.cpp \
+	Source/WebCore/html/TextDocument.h \
+	Source/WebCore/html/TextFieldInputType.cpp \
+	Source/WebCore/html/TextFieldInputType.h \
+	Source/WebCore/html/TextInputType.cpp \
+	Source/WebCore/html/TextInputType.h \
+	Source/WebCore/html/TextMetrics.h \
+	Source/WebCore/html/TimeInputType.cpp \
+	Source/WebCore/html/TimeInputType.h \
+	Source/WebCore/html/TimeRanges.cpp \
+	Source/WebCore/html/TimeRanges.h \
+	Source/WebCore/html/URLInputType.cpp \
+	Source/WebCore/html/URLInputType.h \
+	Source/WebCore/html/ValidationMessage.cpp \
+	Source/WebCore/html/ValidationMessage.h \
+	Source/WebCore/html/ValidityState.cpp \
+	Source/WebCore/html/ValidityState.h \
+	Source/WebCore/html/VoidCallback.h \
+	Source/WebCore/html/WeekInputType.cpp \
+	Source/WebCore/html/WeekInputType.h \
+	Source/WebCore/icu/unicode/parseerr.h \
+	Source/WebCore/icu/unicode/platform.h \
+	Source/WebCore/icu/unicode/putil.h \
+	Source/WebCore/icu/unicode/ubrk.h \
+	Source/WebCore/icu/unicode/uchar.h \
+	Source/WebCore/icu/unicode/ucnv_cb.h \
+	Source/WebCore/icu/unicode/ucnv_err.h \
+	Source/WebCore/icu/unicode/ucnv.h \
+	Source/WebCore/icu/unicode/ucol.h \
+	Source/WebCore/icu/unicode/uconfig.h \
+	Source/WebCore/icu/unicode/uenum.h \
+	Source/WebCore/icu/unicode/uidna.h \
+	Source/WebCore/icu/unicode/uiter.h \
+	Source/WebCore/icu/unicode/uloc.h \
+	Source/WebCore/icu/unicode/umachine.h \
+	Source/WebCore/icu/unicode/unorm.h \
+	Source/WebCore/icu/unicode/urename.h \
+	Source/WebCore/icu/unicode/uscript.h \
+	Source/WebCore/icu/unicode/uset.h \
+	Source/WebCore/icu/unicode/ushape.h \
+	Source/WebCore/icu/unicode/ustring.h \
+	Source/WebCore/icu/unicode/utf16.h \
+	Source/WebCore/icu/unicode/utf8.h \
+	Source/WebCore/icu/unicode/utf.h \
+	Source/WebCore/icu/unicode/utf_old.h \
+	Source/WebCore/icu/unicode/utypes.h \
+	Source/WebCore/icu/unicode/uversion.h \
+	Source/WebCore/inspector/ConsoleMessage.cpp \
+	Source/WebCore/inspector/ConsoleMessage.h \
+	Source/WebCore/inspector/DOMNodeHighlighter.cpp \
+	Source/WebCore/inspector/DOMNodeHighlighter.h \
+	Source/WebCore/inspector/EventsCollector.cpp \
+	Source/WebCore/inspector/EventsCollector.h \
+	Source/WebCore/inspector/InjectedScript.cpp \
+	Source/WebCore/inspector/InjectedScript.h \
+	Source/WebCore/inspector/InjectedScriptHost.cpp \
+	Source/WebCore/inspector/InjectedScriptHost.h \
+	Source/WebCore/inspector/InjectedScriptManager.cpp \
+	Source/WebCore/inspector/InjectedScriptManager.h \
+	Source/WebCore/inspector/InspectorAgent.cpp \
+	Source/WebCore/inspector/InspectorAgent.h \
+	Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp \
+	Source/WebCore/inspector/InspectorApplicationCacheAgent.h \
+	Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp \
+	Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h \
+	Source/WebCore/inspector/InspectorClient.cpp \
+	Source/WebCore/inspector/InspectorClient.h \
+	Source/WebCore/inspector/InspectorController.cpp \
+	Source/WebCore/inspector/InspectorController.h \
+	Source/WebCore/inspector/InspectorConsoleAgent.cpp \
+	Source/WebCore/inspector/InspectorConsoleAgent.h \
+	Source/WebCore/inspector/InspectorConsoleInstrumentation.h \
+	Source/WebCore/inspector/InspectorCSSAgent.cpp \
+	Source/WebCore/inspector/InspectorCSSAgent.h \
+	Source/WebCore/inspector/InspectorDatabaseAgent.cpp \
+	Source/WebCore/inspector/InspectorDatabaseAgent.h \
+	Source/WebCore/inspector/InspectorDatabaseInstrumentation.h \
+	Source/WebCore/inspector/InspectorDatabaseResource.cpp \
+	Source/WebCore/inspector/InspectorDatabaseResource.h \
+	Source/WebCore/inspector/InspectorDebuggerAgent.cpp \
+	Source/WebCore/inspector/InspectorDebuggerAgent.h \
+	Source/WebCore/inspector/InspectorDOMAgent.cpp \
+	Source/WebCore/inspector/InspectorDOMAgent.h \
+	Source/WebCore/inspector/InspectorDOMStorageAgent.cpp \
+	Source/WebCore/inspector/InspectorDOMStorageAgent.h \
+	Source/WebCore/inspector/InspectorDOMStorageResource.cpp \
+	Source/WebCore/inspector/InspectorDOMStorageResource.h \
+	Source/WebCore/inspector/InspectorFrontendChannel.h \
+	Source/WebCore/inspector/InspectorFrontendClient.h \
+	Source/WebCore/inspector/InspectorFrontendClientLocal.cpp \
+	Source/WebCore/inspector/InspectorFrontendClientLocal.h \
+	Source/WebCore/inspector/InspectorFrontendHost.cpp \
+	Source/WebCore/inspector/InspectorFrontendHost.h \
+	Source/WebCore/inspector/InspectorFrontendProxy.cpp \
+	Source/WebCore/inspector/InspectorFrontendProxy.h \
+	Source/WebCore/inspector/InspectorInstrumentation.cpp \
+	Source/WebCore/inspector/InspectorInstrumentation.h \
+	Source/WebCore/inspector/InspectorPageAgent.cpp \
+	Source/WebCore/inspector/InspectorPageAgent.h \
+	Source/WebCore/inspector/InspectorProfilerAgent.cpp \
+	Source/WebCore/inspector/InspectorProfilerAgent.h \
+	Source/WebCore/inspector/InspectorResourceAgent.cpp \
+	Source/WebCore/inspector/InspectorResourceAgent.h \
+	Source/WebCore/inspector/InspectorRuntimeAgent.cpp \
+	Source/WebCore/inspector/InspectorRuntimeAgent.h \
+	Source/WebCore/inspector/InspectorState.cpp \
+	Source/WebCore/inspector/InspectorState.h \
+	Source/WebCore/inspector/InspectorStyleSheet.cpp \
+	Source/WebCore/inspector/InspectorStyleSheet.h \
+	Source/WebCore/inspector/InspectorTimelineAgent.cpp \
+	Source/WebCore/inspector/InspectorTimelineAgent.h \
+	Source/WebCore/inspector/InspectorValues.cpp \
+	Source/WebCore/inspector/InspectorValues.h \
+	Source/WebCore/inspector/InspectorWorkerResource.h \
+	Source/WebCore/inspector/InstrumentingAgents.h \
+	Source/WebCore/inspector/PageDebuggerAgent.cpp \
+	Source/WebCore/inspector/PageDebuggerAgent.h \
+	Source/WebCore/inspector/ScriptArguments.cpp \
+	Source/WebCore/inspector/ScriptArguments.h \
+	Source/WebCore/inspector/ScriptBreakpoint.h \
+	Source/WebCore/inspector/ScriptCallFrame.cpp \
+	Source/WebCore/inspector/ScriptCallFrame.h \
+	Source/WebCore/inspector/ScriptCallStack.cpp \
+	Source/WebCore/inspector/ScriptCallStack.h \
+	Source/WebCore/inspector/ScriptDebugListener.h \
+	Source/WebCore/inspector/ScriptGCEventListener.h \
+	Source/WebCore/inspector/TimelineRecordFactory.cpp \
+	Source/WebCore/inspector/TimelineRecordFactory.h \
+	Source/WebCore/inspector/WorkerDebuggerAgent.cpp \
+	Source/WebCore/inspector/WorkerDebuggerAgent.h \
+	Source/WebCore/inspector/WorkerInspectorController.cpp \
+	Source/WebCore/inspector/WorkerInspectorController.h \
+	Source/WebCore/loader/appcache/ApplicationCache.cpp \
+	Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp \
+	Source/WebCore/loader/appcache/ApplicationCacheGroup.h \
+	Source/WebCore/loader/appcache/ApplicationCache.h \
+	Source/WebCore/loader/appcache/ApplicationCacheHost.cpp \
+	Source/WebCore/loader/appcache/ApplicationCacheHost.h \
+	Source/WebCore/loader/appcache/ApplicationCacheResource.cpp \
+	Source/WebCore/loader/appcache/ApplicationCacheResource.h \
+	Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp \
+	Source/WebCore/loader/appcache/ApplicationCacheStorage.h \
+	Source/WebCore/loader/appcache/DOMApplicationCache.cpp \
+	Source/WebCore/loader/appcache/DOMApplicationCache.h \
+	Source/WebCore/loader/appcache/ManifestParser.cpp \
+	Source/WebCore/loader/appcache/ManifestParser.h \
+	Source/WebCore/loader/archive/ArchiveFactory.cpp \
+	Source/WebCore/loader/archive/ArchiveFactory.h \
+	Source/WebCore/loader/archive/Archive.h \
+	Source/WebCore/loader/archive/ArchiveResourceCollection.cpp \
+	Source/WebCore/loader/archive/ArchiveResourceCollection.h \
+	Source/WebCore/loader/archive/ArchiveResource.cpp \
+	Source/WebCore/loader/archive/ArchiveResource.h \
+	Source/WebCore/loader/cache/MemoryCache.cpp \
+	Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp \
+	Source/WebCore/loader/cache/CachedCSSStyleSheet.h \
+	Source/WebCore/loader/cache/CachedFont.cpp \
+	Source/WebCore/loader/cache/CachedFont.h \
+	Source/WebCore/loader/cache/CachedImage.cpp \
+	Source/WebCore/loader/cache/CachedImage.h \
+	Source/WebCore/loader/cache/CachedResourceClient.h \
+	Source/WebCore/loader/cache/CachedResourceClientWalker.cpp \
+	Source/WebCore/loader/cache/CachedResourceClientWalker.h \
+	Source/WebCore/loader/cache/CachedResource.cpp \
+	Source/WebCore/loader/cache/CachedResource.h \
+	Source/WebCore/loader/cache/CachedResourceHandle.cpp \
+	Source/WebCore/loader/cache/CachedResourceHandle.h \
+	Source/WebCore/loader/cache/CachedResourceLoader.cpp \
+	Source/WebCore/loader/cache/CachedResourceLoader.h \
+	Source/WebCore/loader/cache/CachedResourceRequest.cpp \
+	Source/WebCore/loader/cache/CachedResourceRequest.h \
+	Source/WebCore/loader/cache/CachedScript.cpp \
+	Source/WebCore/loader/cache/CachedScript.h \
+	Source/WebCore/loader/cache/CachedXSLStyleSheet.cpp \
+	Source/WebCore/loader/cache/CachedXSLStyleSheet.h \
+	Source/WebCore/loader/cache/MemoryCache.h \
+	Source/WebCore/loader/cache/CachePolicy.h \
+	Source/WebCore/loader/CachedMetadata.h \
+	Source/WebCore/loader/CrossOriginAccessControl.cpp \
+	Source/WebCore/loader/CrossOriginAccessControl.h \
+	Source/WebCore/loader/CrossOriginPreflightResultCache.cpp \
+	Source/WebCore/loader/CrossOriginPreflightResultCache.h \
+	Source/WebCore/loader/DocumentLoader.cpp \
+	Source/WebCore/loader/DocumentLoader.h \
+	Source/WebCore/loader/DocumentLoadTiming.h \
+	Source/WebCore/loader/DocumentThreadableLoader.cpp \
+	Source/WebCore/loader/DocumentThreadableLoader.h \
+	Source/WebCore/loader/DocumentThreadableLoaderClient.h \
+	Source/WebCore/loader/DocumentWriter.cpp \
+	Source/WebCore/loader/DocumentWriter.h \
+	Source/WebCore/loader/EmptyClients.h \
+	Source/WebCore/loader/FormState.cpp \
+	Source/WebCore/loader/FormState.h \
+	Source/WebCore/loader/FormSubmission.cpp \
+	Source/WebCore/loader/FormSubmission.h \
+	Source/WebCore/loader/FrameLoaderClient.h \
+	Source/WebCore/loader/FrameLoader.cpp \
+	Source/WebCore/loader/FrameLoader.h \
+	Source/WebCore/loader/FrameLoaderStateMachine.cpp \
+	Source/WebCore/loader/FrameLoaderStateMachine.h \
+	Source/WebCore/loader/FrameLoaderTypes.h \
+	Source/WebCore/loader/FrameNetworkingContext.h \
+	Source/WebCore/loader/FTPDirectoryParser.cpp \
+	Source/WebCore/loader/FTPDirectoryParser.h \
+	Source/WebCore/loader/HistoryController.cpp \
+	Source/WebCore/loader/HistoryController.h \
+	Source/WebCore/loader/icon/IconDatabaseClient.h \
+	Source/WebCore/loader/icon/IconDatabase.cpp \
+	Source/WebCore/loader/icon/IconDatabase.h \
+	Source/WebCore/loader/icon/IconDatabaseBase.cpp \
+	Source/WebCore/loader/icon/IconDatabaseBase.h \
+	Source/WebCore/loader/icon/IconLoader.cpp \
+	Source/WebCore/loader/icon/IconLoader.h \
+	Source/WebCore/loader/icon/IconRecord.cpp \
+	Source/WebCore/loader/icon/IconRecord.h \
+	Source/WebCore/loader/icon/PageURLRecord.cpp \
+	Source/WebCore/loader/icon/PageURLRecord.h \
+	Source/WebCore/loader/ImageLoader.cpp \
+	Source/WebCore/loader/ImageLoader.h \
+	Source/WebCore/loader/MainResourceLoader.cpp \
+	Source/WebCore/loader/MainResourceLoader.h \
+	Source/WebCore/loader/NavigationAction.cpp \
+	Source/WebCore/loader/NavigationAction.h \
+	Source/WebCore/loader/NetscapePlugInStreamLoader.cpp \
+	Source/WebCore/loader/NetscapePlugInStreamLoader.h \
+	Source/WebCore/loader/PingLoader.cpp \
+	Source/WebCore/loader/PingLoader.h \
+	Source/WebCore/loader/PlaceholderDocument.cpp \
+	Source/WebCore/loader/PlaceholderDocument.h \
+	Source/WebCore/loader/PolicyCallback.cpp \
+	Source/WebCore/loader/PolicyCallback.h \
+	Source/WebCore/loader/PolicyChecker.cpp \
+	Source/WebCore/loader/PolicyChecker.h \
+	Source/WebCore/loader/ProgressTracker.cpp \
+	Source/WebCore/loader/ProgressTracker.h \
+	Source/WebCore/loader/NavigationScheduler.cpp \
+	Source/WebCore/loader/NavigationScheduler.h \
+	Source/WebCore/loader/ResourceLoader.cpp \
+	Source/WebCore/loader/ResourceLoader.h \
+	Source/WebCore/loader/ResourceLoadNotifier.cpp \
+	Source/WebCore/loader/ResourceLoadNotifier.h \
+	Source/WebCore/loader/ResourceLoadScheduler.cpp \
+	Source/WebCore/loader/ResourceLoadScheduler.h \
+	Source/WebCore/loader/SinkDocument.cpp \
+	Source/WebCore/loader/SinkDocument.h \
+	Source/WebCore/loader/SubframeLoader.cpp \
+	Source/WebCore/loader/SubframeLoader.h \
+	Source/WebCore/loader/SubresourceLoaderClient.h \
+	Source/WebCore/loader/SubresourceLoader.cpp \
+	Source/WebCore/loader/SubresourceLoader.h \
+	Source/WebCore/loader/SubstituteData.h \
+	Source/WebCore/loader/SubstituteResource.h \
+	Source/WebCore/loader/TextResourceDecoder.cpp \
+	Source/WebCore/loader/TextResourceDecoder.h \
+	Source/WebCore/loader/ThreadableLoaderClient.h \
+	Source/WebCore/loader/ThreadableLoaderClientWrapper.h \
+	Source/WebCore/loader/ThreadableLoader.cpp \
+	Source/WebCore/loader/ThreadableLoader.h \
+	Source/WebCore/loader/WorkerThreadableLoader.cpp \
+	Source/WebCore/loader/WorkerThreadableLoader.h \
+	Source/WebCore/mathml/MathMLElement.cpp \
+	Source/WebCore/mathml/MathMLElement.h \
+	Source/WebCore/mathml/MathMLInlineContainerElement.cpp \
+	Source/WebCore/mathml/MathMLInlineContainerElement.h  \
+	Source/WebCore/mathml/MathMLMathElement.cpp \
+	Source/WebCore/mathml/MathMLMathElement.h \
+	Source/WebCore/mathml/MathMLTextElement.cpp \
+	Source/WebCore/mathml/MathMLTextElement.h \
+	Source/WebCore/notifications/NotificationCenter.cpp \
+	Source/WebCore/notifications/NotificationCenter.h \
+	Source/WebCore/notifications/NotificationContents.h \
+	Source/WebCore/notifications/Notification.cpp \
+	Source/WebCore/notifications/Notification.h \
+	Source/WebCore/notifications/NotificationPresenter.h \
+	Source/WebCore/page/animation/AnimationBase.cpp \
+	Source/WebCore/page/animation/AnimationBase.h \
+	Source/WebCore/page/animation/AnimationController.cpp \
+	Source/WebCore/page/animation/AnimationController.h \
+	Source/WebCore/page/animation/AnimationControllerPrivate.h \
+	Source/WebCore/page/animation/CompositeAnimation.cpp \
+	Source/WebCore/page/animation/CompositeAnimation.h \
+	Source/WebCore/page/animation/ImplicitAnimation.cpp \
+	Source/WebCore/page/animation/ImplicitAnimation.h \
+	Source/WebCore/page/animation/KeyframeAnimation.cpp \
+	Source/WebCore/page/animation/KeyframeAnimation.h \
+	Source/WebCore/page/BarInfo.cpp \
+	Source/WebCore/page/BarInfo.h \
+	Source/WebCore/page/Chrome.cpp \
+	Source/WebCore/page/Chrome.h \
+	Source/WebCore/page/ChromeClient.h \
+	Source/WebCore/page/Console.cpp \
+	Source/WebCore/page/Console.h \
+	Source/WebCore/page/ContentSecurityPolicy.cpp \
+	Source/WebCore/page/ContentSecurityPolicy.h \
+	Source/WebCore/page/ContextMenuClient.h \
+	Source/WebCore/page/ContextMenuController.cpp \
+	Source/WebCore/page/ContextMenuController.h \
+	Source/WebCore/page/ContextMenuProvider.h \
+	Source/WebCore/page/Coordinates.h \
+	Source/WebCore/page/Crypto.cpp \
+	Source/WebCore/page/Crypto.h \
+	Source/WebCore/page/DOMSelection.cpp \
+	Source/WebCore/page/DOMSelection.h \
+	Source/WebCore/page/DOMTimer.cpp \
+	Source/WebCore/page/DOMTimer.h \
+	Source/WebCore/page/DOMWindow.cpp \
+	Source/WebCore/page/DOMWindow.h \
+	Source/WebCore/page/DragActions.h \
+	Source/WebCore/page/DragClient.h \
+	Source/WebCore/page/DragController.cpp \
+	Source/WebCore/page/DragController.h \
+	Source/WebCore/page/EditorClient.h \
+	Source/WebCore/page/EventHandler.cpp \
+	Source/WebCore/page/EventHandler.h \
+	Source/WebCore/page/EventSource.cpp \
+	Source/WebCore/page/EventSource.h \
+	Source/WebCore/page/FocusController.cpp \
+	Source/WebCore/page/FocusController.h \
+	Source/WebCore/page/FocusDirection.h \
+	Source/WebCore/page/Frame.cpp \
+	Source/WebCore/page/Frame.h \
+	Source/WebCore/page/FrameActionScheduler.cpp \
+	Source/WebCore/page/FrameActionScheduler.h \
+	Source/WebCore/page/FrameLoadRequest.h \
+	Source/WebCore/page/FrameTree.cpp \
+	Source/WebCore/page/FrameTree.h \
+	Source/WebCore/page/FrameView.cpp \
+	Source/WebCore/page/FrameView.h \
+	Source/WebCore/page/Geolocation.cpp \
+	Source/WebCore/page/Geolocation.h \
+	Source/WebCore/page/GeolocationClient.h \
+	Source/WebCore/page/GeolocationController.cpp \
+	Source/WebCore/page/GeolocationController.h \
+	Source/WebCore/page/GeolocationError.h \
+	Source/WebCore/page/GeolocationPosition.h \
+	Source/WebCore/page/GeolocationPositionCache.cpp \
+	Source/WebCore/page/GeolocationPositionCache.h \
+	Source/WebCore/page/Geoposition.h \
+	Source/WebCore/page/GroupSettings.cpp \
+	Source/WebCore/page/GroupSettings.h \
+	Source/WebCore/page/HaltablePlugin.h \
+	Source/WebCore/page/History.cpp \
+	Source/WebCore/page/History.h \
+	Source/WebCore/page/Location.cpp \
+	Source/WebCore/page/Location.h \
+	Source/WebCore/page/MediaCanStartListener.h \
+	Source/WebCore/page/MemoryInfo.cpp \
+	Source/WebCore/page/MemoryInfo.h \
+	Source/WebCore/page/MouseEventWithHitTestResults.cpp \
+	Source/WebCore/page/MouseEventWithHitTestResults.h \
+	Source/WebCore/page/Navigator.cpp \
+	Source/WebCore/page/Navigator.h \
+	Source/WebCore/page/NavigatorBase.cpp \
+	Source/WebCore/page/NavigatorBase.h \
+	Source/WebCore/page/NavigatorUserMediaError.h \
+	Source/WebCore/page/NavigatorUserMediaErrorCallback.h \
+	Source/WebCore/page/NavigatorUserMediaSuccessCallback.h \
+	Source/WebCore/page/OriginAccessEntry.cpp \
+	Source/WebCore/page/OriginAccessEntry.h \
+	Source/WebCore/page/Page.cpp \
+	Source/WebCore/page/Page.h \
+	Source/WebCore/page/PageGroup.cpp \
+	Source/WebCore/page/PageGroup.h \
+	Source/WebCore/page/PageGroupLoadDeferrer.cpp \
+	Source/WebCore/page/PageGroupLoadDeferrer.h \
+	Source/WebCore/page/Performance.cpp \
+	Source/WebCore/page/Performance.h \
+	Source/WebCore/page/PerformanceNavigation.cpp \
+	Source/WebCore/page/PerformanceNavigation.h \
+	Source/WebCore/page/PerformanceTiming.cpp \
+	Source/WebCore/page/PerformanceTiming.h \
+	Source/WebCore/page/PluginHalter.cpp \
+	Source/WebCore/page/PluginHalter.h \
+	Source/WebCore/page/PluginHalterClient.h \
+	Source/WebCore/page/PositionCallback.h \
+	Source/WebCore/page/PositionError.h \
+	Source/WebCore/page/PositionErrorCallback.h \
+	Source/WebCore/page/PositionOptions.h \
+	Source/WebCore/page/PrintContext.cpp \
+	Source/WebCore/page/PrintContext.h \
+	Source/WebCore/page/Screen.cpp \
+	Source/WebCore/page/Screen.h \
+	Source/WebCore/page/SecurityOrigin.cpp \
+	Source/WebCore/page/SecurityOrigin.h \
+	Source/WebCore/page/SecurityOriginHash.h \
+	Source/WebCore/page/Settings.cpp \
+	Source/WebCore/page/Settings.h \
+	Source/WebCore/page/SpatialNavigation.cpp \
+	Source/WebCore/page/SpatialNavigation.h \
+	Source/WebCore/page/SpeechInputClient.h \
+	Source/WebCore/page/SpeechInputEvent.cpp \
+	Source/WebCore/page/SpeechInputEvent.h \
+	Source/WebCore/page/SpeechInput.cpp \
+	Source/WebCore/page/SpeechInput.h \
+	Source/WebCore/page/SpeechInputListener.h \
+	Source/WebCore/page/SpeechInputResult.cpp \
+	Source/WebCore/page/SpeechInputResult.h \
+	Source/WebCore/page/SpeechInputResultList.cpp \
+	Source/WebCore/page/SpeechInputResultList.h \
+	Source/WebCore/page/SuspendableTimer.cpp \
+	Source/WebCore/page/SuspendableTimer.h \
+	Source/WebCore/page/UserContentTypes.h \
+	Source/WebCore/page/UserContentURLPattern.cpp \
+	Source/WebCore/page/UserContentURLPattern.h \
+	Source/WebCore/page/UserScript.h \
+	Source/WebCore/page/UserScriptTypes.h \
+	Source/WebCore/page/UserStyleSheet.h \
+	Source/WebCore/page/UserStyleSheetTypes.h \
+	Source/WebCore/page/WebCoreKeyboardUIMode.h \
+	Source/WebCore/page/WebKitAnimation.h \
+	Source/WebCore/page/WebKitAnimation.cpp \
+	Source/WebCore/page/WebKitAnimationList.h \
+	Source/WebCore/page/WebKitAnimationList.cpp \
+	Source/WebCore/page/WebKitPoint.h \
+	Source/WebCore/page/WindowFeatures.cpp \
+	Source/WebCore/page/WindowFeatures.h \
+	Source/WebCore/page/WorkerNavigator.cpp \
+	Source/WebCore/page/WorkerNavigator.h \
+	Source/WebCore/platform/animation/Animation.cpp \
+	Source/WebCore/platform/animation/Animation.h \
+	Source/WebCore/platform/animation/AnimationList.cpp \
+	Source/WebCore/platform/animation/AnimationList.h \
+	Source/WebCore/platform/animation/TimingFunction.h \
+	Source/WebCore/platform/Arena.cpp \
+	Source/WebCore/platform/Arena.h \
+	Source/WebCore/platform/AsyncFileStream.h \
+	Source/WebCore/platform/AsyncFileSystem.cpp \
+	Source/WebCore/platform/AsyncFileSystem.h \
+	Source/WebCore/platform/AutodrainedPool.h \
+	Source/WebCore/platform/ContentType.cpp \
+	Source/WebCore/platform/ContentType.h \
+	Source/WebCore/platform/ContextMenu.h \
+	Source/WebCore/platform/ContextMenuItem.h \
+	Source/WebCore/platform/Cookie.h \
+	Source/WebCore/platform/CookieJar.h \
+	Source/WebCore/platform/CrossThreadCopier.cpp \
+	Source/WebCore/platform/CrossThreadCopier.h \
+	Source/WebCore/platform/Cursor.cpp \
+	Source/WebCore/platform/Cursor.h \
+	Source/WebCore/platform/DefaultLocalizationStrategy.cpp \
+	Source/WebCore/platform/DefaultLocalizationStrategy.h \
+	Source/WebCore/platform/DragData.cpp \
+	Source/WebCore/platform/DragData.h \
+	Source/WebCore/platform/DragImage.cpp \
+	Source/WebCore/platform/DragImage.h \
+	Source/WebCore/platform/EventLoop.h \
+	Source/WebCore/platform/FileChooser.cpp \
+	Source/WebCore/platform/FileChooser.h \
+	Source/WebCore/platform/FileMetadata.h \
+	Source/WebCore/platform/FileStreamClient.h \
+	Source/WebCore/platform/FileStream.cpp \
+	Source/WebCore/platform/FileStream.h \
+	Source/WebCore/platform/FileSystem.cpp \
+	Source/WebCore/platform/FileSystem.h \
+	Source/WebCore/platform/FloatConversion.h \
+	Source/WebCore/platform/GeolocationService.cpp \
+	Source/WebCore/platform/GeolocationService.h \
+	Source/WebCore/platform/HashTools.h \
+	Source/WebCore/platform/graphics/BitmapImage.cpp \
+	Source/WebCore/platform/graphics/BitmapImage.h \
+	Source/WebCore/platform/graphics/Color.cpp \
+	Source/WebCore/platform/graphics/Color.h \
+	Source/WebCore/platform/graphics/ColorSpace.h \
+	Source/WebCore/platform/graphics/ContextShadow.cpp \
+	Source/WebCore/platform/graphics/ContextShadow.h \
+	Source/WebCore/platform/graphics/DashArray.h \
+	Source/WebCore/platform/graphics/filters/DistantLightSource.cpp \
+	Source/WebCore/platform/graphics/filters/DistantLightSource.h \
+	Source/WebCore/platform/graphics/filters/FEBlend.cpp \
+	Source/WebCore/platform/graphics/filters/FEBlend.h \
+	Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp \
+	Source/WebCore/platform/graphics/filters/FEColorMatrix.h \
+	Source/WebCore/platform/graphics/filters/FEComponentTransfer.cpp \
+	Source/WebCore/platform/graphics/filters/FEComponentTransfer.h \
+	Source/WebCore/platform/graphics/filters/FEComposite.cpp \
+	Source/WebCore/platform/graphics/filters/FEComposite.h \
+	Source/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp \
+	Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h \
+	Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp \
+	Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h \
+	Source/WebCore/platform/graphics/filters/FEDisplacementMap.cpp \
+	Source/WebCore/platform/graphics/filters/FEDisplacementMap.h \
+	Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp \
+	Source/WebCore/platform/graphics/filters/FEGaussianBlur.h \
+	Source/WebCore/platform/graphics/filters/FEFlood.cpp \
+	Source/WebCore/platform/graphics/filters/FEFlood.h \
+	Source/WebCore/platform/graphics/filters/FELighting.cpp \
+	Source/WebCore/platform/graphics/filters/FELighting.h \
+	Source/WebCore/platform/graphics/filters/FEMerge.cpp \
+	Source/WebCore/platform/graphics/filters/FEMerge.h \
+	Source/WebCore/platform/graphics/filters/FEMorphology.cpp \
+	Source/WebCore/platform/graphics/filters/FEMorphology.h \
+	Source/WebCore/platform/graphics/filters/FEOffset.cpp \
+	Source/WebCore/platform/graphics/filters/FEOffset.h \
+	Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp \
+	Source/WebCore/platform/graphics/filters/FESpecularLighting.h \
+	Source/WebCore/platform/graphics/filters/FETile.cpp \
+	Source/WebCore/platform/graphics/filters/FETile.h \
+	Source/WebCore/platform/graphics/filters/FETurbulence.cpp \
+	Source/WebCore/platform/graphics/filters/FETurbulence.h \
+	Source/WebCore/platform/graphics/filters/FilterEffect.cpp \
+	Source/WebCore/platform/graphics/filters/FilterEffect.h \
+	Source/WebCore/platform/graphics/filters/Filter.h \
+	Source/WebCore/platform/graphics/filters/LightSource.cpp \
+	Source/WebCore/platform/graphics/filters/LightSource.h \
+	Source/WebCore/platform/graphics/filters/PointLightSource.cpp \
+	Source/WebCore/platform/graphics/filters/PointLightSource.h \
+	Source/WebCore/platform/graphics/filters/SourceAlpha.cpp \
+	Source/WebCore/platform/graphics/filters/SourceAlpha.h \
+	Source/WebCore/platform/graphics/filters/SourceGraphic.cpp \
+	Source/WebCore/platform/graphics/filters/SourceGraphic.h \
+	Source/WebCore/platform/graphics/filters/SpotLightSource.cpp \
+	Source/WebCore/platform/graphics/filters/SpotLightSource.h \
+	Source/WebCore/platform/graphics/FloatPoint3D.cpp \
+	Source/WebCore/platform/graphics/FloatPoint3D.h \
+	Source/WebCore/platform/graphics/FloatPoint.cpp \
+	Source/WebCore/platform/graphics/FloatPoint.h \
+	Source/WebCore/platform/graphics/FloatQuad.cpp \
+	Source/WebCore/platform/graphics/FloatQuad.h \
+	Source/WebCore/platform/graphics/FloatRect.cpp \
+	Source/WebCore/platform/graphics/FloatRect.h \
+	Source/WebCore/platform/graphics/FloatSize.cpp \
+	Source/WebCore/platform/graphics/FloatSize.h \
+	Source/WebCore/platform/graphics/FontBaseline.h \
+	Source/WebCore/platform/graphics/FontCache.cpp \
+	Source/WebCore/platform/graphics/FontCache.h \
+	Source/WebCore/platform/graphics/Font.cpp \
+	Source/WebCore/platform/graphics/FontData.cpp \
+	Source/WebCore/platform/graphics/FontData.h \
+	Source/WebCore/platform/graphics/FontDescription.cpp \
+	Source/WebCore/platform/graphics/FontDescription.h \
+	Source/WebCore/platform/graphics/FontFallbackList.cpp \
+	Source/WebCore/platform/graphics/FontFallbackList.h \
+	Source/WebCore/platform/graphics/FontFamily.cpp \
+	Source/WebCore/platform/graphics/FontFamily.h \
+	Source/WebCore/platform/graphics/FontFastPath.cpp \
+	Source/WebCore/platform/graphics/Font.h \
+	Source/WebCore/platform/graphics/FontMetrics.h \
+	Source/WebCore/platform/graphics/FontOrientation.h \
+	Source/WebCore/platform/graphics/FontRenderingMode.h \
+	Source/WebCore/platform/graphics/FontSelector.h \
+	Source/WebCore/platform/graphics/FontSmoothingMode.h \
+	Source/WebCore/platform/graphics/FontTraitsMask.h \
+	Source/WebCore/platform/graphics/FontWidthVariant.h \
+	Source/WebCore/platform/graphics/GeneratedImage.cpp \
+	Source/WebCore/platform/graphics/GeneratedImage.h \
+	Source/WebCore/platform/graphics/Generator.h \
+	Source/WebCore/platform/graphics/GlyphBuffer.h \
+	Source/WebCore/platform/graphics/GlyphMetricsMap.h \
+	Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp \
+	Source/WebCore/platform/graphics/GlyphPageTreeNode.h \
+	Source/WebCore/platform/graphics/Gradient.cpp \
+	Source/WebCore/platform/graphics/Gradient.h \
+	Source/WebCore/platform/graphics/GraphicsContext.cpp \
+	Source/WebCore/platform/graphics/GraphicsContext.h \
+	Source/WebCore/platform/graphics/GraphicsLayer.h \
+	Source/WebCore/platform/graphics/GraphicsTypes.cpp \
+	Source/WebCore/platform/graphics/GraphicsTypes.h \
+	Source/WebCore/platform/graphics/GraphicsTypes3D.h \
+	Source/WebCore/platform/graphics/Icon.h \
+	Source/WebCore/platform/graphics/ImageBuffer.cpp \
+	Source/WebCore/platform/graphics/ImageBuffer.h \
+	Source/WebCore/platform/graphics/Image.cpp \
+	Source/WebCore/platform/graphics/Image.h \
+	Source/WebCore/platform/graphics/ImageObserver.h \
+	Source/WebCore/platform/graphics/ImageSource.cpp \
+	Source/WebCore/platform/graphics/ImageSource.h \
+	Source/WebCore/platform/graphics/IntPoint.h \
+	Source/WebCore/platform/graphics/IntPointHash.h \
+	Source/WebCore/platform/graphics/IntRect.cpp \
+	Source/WebCore/platform/graphics/IntRect.h \
+	Source/WebCore/platform/graphics/IntSize.h \
+	Source/WebCore/platform/graphics/IntSizeHash.h \
+	Source/WebCore/platform/graphics/MediaPlayer.cpp \
+	Source/WebCore/platform/graphics/MediaPlayer.h \
+	Source/WebCore/platform/graphics/MediaPlayerPrivate.h \
+	Source/WebCore/platform/graphics/Path.cpp \
+	Source/WebCore/platform/graphics/Path.h \
+	Source/WebCore/platform/graphics/PathTraversalState.cpp \
+	Source/WebCore/platform/graphics/PathTraversalState.h \
+	Source/WebCore/platform/graphics/Pattern.cpp \
+	Source/WebCore/platform/graphics/Pattern.h \
+	Source/WebCore/platform/graphics/RoundedIntRect.cpp \
+	Source/WebCore/platform/graphics/RoundedIntRect.h \
+	Source/WebCore/platform/graphics/SegmentedFontData.cpp \
+	Source/WebCore/platform/graphics/SegmentedFontData.h \
+	Source/WebCore/platform/graphics/SimpleFontData.cpp \
+	Source/WebCore/platform/graphics/SimpleFontData.h \
+	Source/WebCore/platform/graphics/StringTruncator.cpp \
+	Source/WebCore/platform/graphics/StringTruncator.h \
+	Source/WebCore/platform/graphics/StrokeStyleApplier.h \
+	Source/WebCore/platform/graphics/TextRenderingMode.h \
+	Source/WebCore/platform/graphics/TextRun.h \
+	Source/WebCore/platform/graphics/transforms/AffineTransform.cpp \
+	Source/WebCore/platform/graphics/transforms/AffineTransform.h \
+	Source/WebCore/platform/graphics/transforms/IdentityTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/RotateTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/RotateTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/ScaleTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/ScaleTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/SkewTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/SkewTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp \
+	Source/WebCore/platform/graphics/transforms/TransformationMatrix.h \
+	Source/WebCore/platform/graphics/transforms/TransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/TransformOperations.cpp \
+	Source/WebCore/platform/graphics/transforms/TransformOperations.h \
+	Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.h \
+	Source/WebCore/platform/graphics/TypesettingFeatures.h \
+	Source/WebCore/platform/graphics/UnitBezier.h \
+	Source/WebCore/platform/graphics/WidthIterator.cpp \
+	Source/WebCore/platform/graphics/WidthIterator.h \
+	Source/WebCore/platform/graphics/WOFFFileFormat.cpp \
+	Source/WebCore/platform/graphics/WOFFFileFormat.h \
+	Source/WebCore/platform/HostWindow.h \
+	Source/WebCore/platform/KillRing.h \
+	Source/WebCore/platform/KillRingNone.cpp \
+	Source/WebCore/platform/KURL.cpp \
+	Source/WebCore/platform/KURL.h \
+	Source/WebCore/platform/KURLHash.h \
+	Source/WebCore/platform/Language.cpp \
+	Source/WebCore/platform/Language.h \
+	Source/WebCore/platform/LengthBox.h \
+	Source/WebCore/platform/Length.cpp \
+	Source/WebCore/platform/Length.h \
+	Source/WebCore/platform/LengthSize.h \
+	Source/WebCore/platform/leveldb/LevelDBComparator.h \
+	Source/WebCore/platform/leveldb/LevelDBDatabase.cpp \
+	Source/WebCore/platform/leveldb/LevelDBDatabase.h \
+	Source/WebCore/platform/leveldb/LevelDBIterator.cpp \
+	Source/WebCore/platform/leveldb/LevelDBIterator.h \
+	Source/WebCore/platform/leveldb/LevelDBSlice.h \
+	Source/WebCore/platform/LinkHash.cpp \
+	Source/WebCore/platform/LinkHash.h \
+	Source/WebCore/platform/LocalizedStrings.h \
+	Source/WebCore/platform/Logging.cpp \
+	Source/WebCore/platform/Logging.h \
+	Source/WebCore/platform/MIMETypeRegistry.cpp \
+	Source/WebCore/platform/MIMETypeRegistry.h \
+	Source/WebCore/platform/mock/DeviceOrientationClientMock.cpp \
+	Source/WebCore/platform/mock/DeviceOrientationClientMock.h \
+	Source/WebCore/platform/mock/GeolocationClientMock.cpp \
+	Source/WebCore/platform/mock/GeolocationClientMock.h \
+	Source/WebCore/platform/mock/GeolocationServiceMock.cpp \
+	Source/WebCore/platform/mock/GeolocationServiceMock.h \
+	Source/WebCore/platform/mock/SpeechInputClientMock.cpp \
+	Source/WebCore/platform/mock/SpeechInputClientMock.h \
+	Source/WebCore/platform/network/AuthenticationChallengeBase.cpp \
+	Source/WebCore/platform/network/AuthenticationChallengeBase.h \
+	Source/WebCore/platform/network/AuthenticationClient.h \
+	Source/WebCore/platform/network/BlobData.cpp \
+	Source/WebCore/platform/network/BlobData.h \
+	Source/WebCore/platform/network/BlobRegistry.h \
+	Source/WebCore/platform/network/BlobRegistryImpl.cpp \
+	Source/WebCore/platform/network/BlobRegistryImpl.h \
+	Source/WebCore/platform/network/BlobResourceHandle.cpp \
+	Source/WebCore/platform/network/BlobResourceHandle.h \
+	Source/WebCore/platform/network/BlobStorageData.h \
+	Source/WebCore/platform/network/CookieStorage.h \
+	Source/WebCore/platform/network/Credential.cpp \
+	Source/WebCore/platform/network/Credential.h \
+	Source/WebCore/platform/network/DNS.h \
+	Source/WebCore/platform/network/FormDataBuilder.cpp \
+	Source/WebCore/platform/network/FormDataBuilder.h \
+	Source/WebCore/platform/network/FormData.cpp \
+	Source/WebCore/platform/network/FormData.h \
+	Source/WebCore/platform/network/HTTPHeaderMap.cpp \
+	Source/WebCore/platform/network/HTTPHeaderMap.h \
+	Source/WebCore/platform/network/HTTPParsers.cpp \
+	Source/WebCore/platform/network/HTTPParsers.h \
+	Source/WebCore/platform/network/NetworkingContext.h \
+	Source/WebCore/platform/network/ProxyServer.cpp \
+	Source/WebCore/platform/network/ProxyServer.h \
+	Source/WebCore/platform/network/NetworkStateNotifier.cpp \
+	Source/WebCore/platform/network/NetworkStateNotifier.h \
+	Source/WebCore/platform/network/ProtectionSpace.cpp \
+	Source/WebCore/platform/network/ProtectionSpace.h \
+	Source/WebCore/platform/network/ResourceErrorBase.cpp \
+	Source/WebCore/platform/network/ResourceErrorBase.h \
+	Source/WebCore/platform/network/ResourceHandleClient.h \
+	Source/WebCore/platform/network/ResourceHandle.cpp \
+	Source/WebCore/platform/network/ResourceHandle.h \
+	Source/WebCore/platform/network/ResourceHandleInternal.h \
+	Source/WebCore/platform/network/ResourceLoadInfo.h \
+	Source/WebCore/platform/network/ResourceLoadPriority.h \
+	Source/WebCore/platform/network/ResourceLoadTiming.h \
+	Source/WebCore/platform/network/ResourceRequestBase.cpp \
+	Source/WebCore/platform/network/ResourceRequestBase.h \
+	Source/WebCore/platform/network/ResourceResponseBase.cpp \
+	Source/WebCore/platform/network/ResourceResponseBase.h \
+	Source/WebCore/platform/network/SocketStreamErrorBase.cpp \
+	Source/WebCore/platform/network/SocketStreamErrorBase.h \
+	Source/WebCore/platform/network/SocketStreamHandleBase.cpp \
+	Source/WebCore/platform/network/SocketStreamHandleBase.h \
+	Source/WebCore/platform/network/SocketStreamHandleClient.h \
+	Source/WebCore/platform/NotImplemented.h \
+	Source/WebCore/platform/Pasteboard.h \
+	Source/WebCore/platform/PlatformKeyboardEvent.h \
+	Source/WebCore/platform/PlatformMenuDescription.h \
+	Source/WebCore/platform/PlatformMouseEvent.h \
+	Source/WebCore/platform/PlatformScreen.h \
+	Source/WebCore/platform/PlatformWheelEvent.h \
+	Source/WebCore/platform/PopupMenuClient.h \
+	Source/WebCore/platform/PopupMenu.h \
+	Source/WebCore/platform/PopupMenuStyle.h \
+	Source/WebCore/platform/PurgeableBuffer.h \
+	Source/WebCore/platform/PurgePriority.h \
+	Source/WebCore/platform/RuntimeApplicationChecks.cpp \
+	Source/WebCore/platform/RuntimeApplicationChecks.h \
+	Source/WebCore/platform/SchemeRegistry.cpp \
+	Source/WebCore/platform/SchemeRegistry.h \
+	Source/WebCore/platform/ScrollAnimator.cpp \
+	Source/WebCore/platform/ScrollAnimator.h \
+	Source/WebCore/platform/ScrollableArea.cpp \
+	Source/WebCore/platform/ScrollableArea.h \
+	Source/WebCore/platform/Scrollbar.cpp \
+	Source/WebCore/platform/Scrollbar.h \
+	Source/WebCore/platform/ScrollbarThemeComposite.cpp \
+	Source/WebCore/platform/ScrollbarThemeComposite.h \
+	Source/WebCore/platform/ScrollbarTheme.h \
+	Source/WebCore/platform/ScrollTypes.h \
+	Source/WebCore/platform/ScrollView.cpp \
+	Source/WebCore/platform/ScrollView.h \
+	Source/WebCore/platform/SearchPopupMenu.h \
+	Source/WebCore/platform/SecureTextInput.h \
+	Source/WebCore/platform/SharedBuffer.cpp \
+	Source/WebCore/platform/SharedBuffer.h \
+	Source/WebCore/platform/SharedTimer.h \
+	Source/WebCore/platform/Sound.h \
+	Source/WebCore/platform/sql/SQLiteAuthorizer.cpp \
+	Source/WebCore/platform/sql/SQLiteDatabase.cpp \
+	Source/WebCore/platform/sql/SQLiteDatabase.h \
+	Source/WebCore/platform/sql/SQLiteFileSystem.cpp \
+	Source/WebCore/platform/sql/SQLiteFileSystem.h \
+	Source/WebCore/platform/sql/SQLiteStatement.cpp \
+	Source/WebCore/platform/sql/SQLiteStatement.h \
+	Source/WebCore/platform/sql/SQLiteTransaction.cpp \
+	Source/WebCore/platform/sql/SQLiteTransaction.h \
+	Source/WebCore/platform/sql/SQLValue.cpp \
+	Source/WebCore/platform/sql/SQLValue.h \
+	Source/WebCore/platform/SSLKeyGenerator.h \
+	Source/WebCore/platform/SuddenTermination.h \
+	Source/WebCore/platform/SystemTime.h \
+	Source/WebCore/platform/text/Base64.cpp \
+	Source/WebCore/platform/text/Base64.h \
+	Source/WebCore/platform/text/BidiContext.cpp \
+	Source/WebCore/platform/text/BidiContext.h \
+	Source/WebCore/platform/text/BidiResolver.h \
+	Source/WebCore/platform/text/BidiRunList.h \
+	Source/WebCore/platform/text/Hyphenation.cpp \
+	Source/WebCore/platform/text/Hyphenation.h \
+	Source/WebCore/platform/text/LineEnding.cpp \
+	Source/WebCore/platform/text/LineEnding.h \
+	Source/WebCore/platform/text/LocalizedNumber.h \
+	Source/WebCore/platform/text/LocalizedNumberNone.cpp \
+	Source/WebCore/platform/text/ParserUtilities.h \
+	Source/WebCore/platform/text/PlatformString.h \
+	Source/WebCore/platform/text/RegularExpression.cpp \
+	Source/WebCore/platform/text/RegularExpression.h \
+	Source/WebCore/platform/text/SegmentedString.cpp \
+	Source/WebCore/platform/text/SegmentedString.h \
+	Source/WebCore/platform/text/String.cpp \
+	Source/WebCore/platform/text/StringWithDirection.h \
+	Source/WebCore/platform/text/SuffixTree.h \
+	Source/WebCore/platform/text/TextBoundaries.cpp \
+	Source/WebCore/platform/text/TextBoundaries.h \
+	Source/WebCore/platform/text/TextBreakIterator.h \
+	Source/WebCore/platform/text/TextCheckerClient.h \
+	Source/WebCore/platform/text/TextChecking.h \
+	Source/WebCore/platform/text/TextCodec.cpp \
+	Source/WebCore/platform/text/TextCodec.h \
+	Source/WebCore/platform/text/TextCodecASCIIFastPath.h \
+	Source/WebCore/platform/text/TextCodecLatin1.cpp \
+	Source/WebCore/platform/text/TextCodecLatin1.h \
+	Source/WebCore/platform/text/TextCodecUserDefined.cpp \
+	Source/WebCore/platform/text/TextCodecUserDefined.h \
+	Source/WebCore/platform/text/TextCodecUTF16.cpp \
+	Source/WebCore/platform/text/TextCodecUTF16.h \
+	Source/WebCore/platform/text/TextCodecUTF8.cpp \
+	Source/WebCore/platform/text/TextCodecUTF8.h \
+	Source/WebCore/platform/text/TextDirection.h \
+	Source/WebCore/platform/text/TextEncoding.cpp \
+	Source/WebCore/platform/text/TextEncodingDetector.h \
+	Source/WebCore/platform/text/TextEncodingDetectorNone.cpp \
+	Source/WebCore/platform/text/TextEncoding.h \
+	Source/WebCore/platform/text/TextEncodingRegistry.cpp \
+	Source/WebCore/platform/text/TextEncodingRegistry.h \
+	Source/WebCore/platform/text/TextOrientation.h \
+	Source/WebCore/platform/text/TextStream.cpp \
+	Source/WebCore/platform/text/TextStream.h \
+	Source/WebCore/platform/text/transcoder/FontTranscoder.cpp \
+	Source/WebCore/platform/text/transcoder/FontTranscoder.h \
+	Source/WebCore/platform/text/UnicodeBidi.h \
+	Source/WebCore/platform/text/UnicodeRange.cpp \
+	Source/WebCore/platform/text/UnicodeRange.h \
+	Source/WebCore/platform/ThemeTypes.h \
+	Source/WebCore/platform/ThreadCheck.h \
+	Source/WebCore/platform/ThreadGlobalData.cpp \
+	Source/WebCore/platform/ThreadGlobalData.h \
+	Source/WebCore/platform/ThreadTimers.cpp \
+	Source/WebCore/platform/ThreadTimers.h \
+	Source/WebCore/platform/Timer.cpp \
+	Source/WebCore/platform/Timer.h \
+	Source/WebCore/platform/TreeShared.h \
+	Source/WebCore/platform/URLString.h \
+	Source/WebCore/platform/UUID.cpp \
+	Source/WebCore/platform/UUID.h \
+	Source/WebCore/platform/Widget.cpp \
+	Source/WebCore/platform/Widget.h \
+	Source/WebCore/platform/WindowsKeyboardCodes.h \
+	Source/WebCore/plugins/DOMMimeTypeArray.cpp \
+	Source/WebCore/plugins/DOMMimeTypeArray.h \
+	Source/WebCore/plugins/DOMMimeType.cpp \
+	Source/WebCore/plugins/DOMMimeType.h \
+	Source/WebCore/plugins/DOMPluginArray.cpp \
+	Source/WebCore/plugins/DOMPluginArray.h \
+	Source/WebCore/plugins/DOMPlugin.cpp \
+	Source/WebCore/plugins/DOMPlugin.h \
+	Source/WebCore/plugins/npapi.cpp \
+	Source/WebCore/plugins/npfunctions.h \
+	Source/WebCore/plugins/PluginDatabase.cpp \
+	Source/WebCore/plugins/PluginDatabase.h \
+	Source/WebCore/plugins/PluginData.cpp \
+	Source/WebCore/plugins/PluginData.h \
+	Source/WebCore/plugins/PluginDebug.cpp \
+	Source/WebCore/plugins/PluginDebug.h \
+	Source/WebCore/plugins/PluginMainThreadScheduler.cpp \
+	Source/WebCore/plugins/PluginMainThreadScheduler.h \
+	Source/WebCore/plugins/PluginPackage.cpp \
+	Source/WebCore/plugins/PluginPackage.h \
+	Source/WebCore/plugins/PluginQuirkSet.h \
+	Source/WebCore/plugins/PluginStream.cpp \
+	Source/WebCore/plugins/PluginStream.h \
+	Source/WebCore/plugins/PluginViewBase.h \
+	Source/WebCore/plugins/PluginView.cpp \
+	Source/WebCore/plugins/PluginView.h \
+	Source/WebCore/rendering/AutoTableLayout.cpp \
+	Source/WebCore/rendering/AutoTableLayout.h \
+	Source/WebCore/rendering/BidiRun.cpp \
+	Source/WebCore/rendering/BidiRun.h \
+	Source/WebCore/rendering/break_lines.cpp \
+	Source/WebCore/rendering/break_lines.h \
+	Source/WebCore/rendering/ColumnInfo.h \
+	Source/WebCore/rendering/CounterNode.cpp \
+	Source/WebCore/rendering/CounterNode.h \
+	Source/WebCore/rendering/EllipsisBox.cpp \
+	Source/WebCore/rendering/EllipsisBox.h \
+	Source/WebCore/rendering/FixedTableLayout.cpp \
+	Source/WebCore/rendering/FixedTableLayout.h \
+	Source/WebCore/rendering/GapRects.h \
+	Source/WebCore/rendering/HitTestRequest.h \
+	Source/WebCore/rendering/HitTestResult.cpp \
+	Source/WebCore/rendering/HitTestResult.h \
+	Source/WebCore/rendering/InlineBox.cpp \
+	Source/WebCore/rendering/InlineBox.h \
+	Source/WebCore/rendering/InlineFlowBox.cpp \
+	Source/WebCore/rendering/InlineFlowBox.h \
+	Source/WebCore/rendering/InlineIterator.h \
+	Source/WebCore/rendering/InlineTextBox.cpp \
+	Source/WebCore/rendering/InlineTextBox.h \
+	Source/WebCore/rendering/LayoutState.cpp \
+	Source/WebCore/rendering/LayoutState.h \
+	Source/WebCore/rendering/OverlapTestRequestClient.h \
+	Source/WebCore/rendering/PaintInfo.h \
+	Source/WebCore/rendering/PaintPhase.h \
+	Source/WebCore/rendering/PointerEventsHitRules.cpp \
+	Source/WebCore/rendering/PointerEventsHitRules.h \
+	Source/WebCore/rendering/RenderApplet.cpp \
+	Source/WebCore/rendering/RenderApplet.h \
+	Source/WebCore/rendering/RenderArena.cpp \
+	Source/WebCore/rendering/RenderArena.h \
+	Source/WebCore/rendering/RenderBlock.cpp \
+	Source/WebCore/rendering/RenderBlock.h \
+	Source/WebCore/rendering/RenderBlockLineLayout.cpp \
+	Source/WebCore/rendering/RenderBox.cpp \
+	Source/WebCore/rendering/RenderBox.h \
+	Source/WebCore/rendering/RenderBoxModelObject.cpp \
+	Source/WebCore/rendering/RenderBoxModelObject.h \
+	Source/WebCore/rendering/RenderBR.cpp \
+	Source/WebCore/rendering/RenderBR.h \
+	Source/WebCore/rendering/RenderButton.cpp \
+	Source/WebCore/rendering/RenderButton.h \
+	Source/WebCore/rendering/RenderCombineText.cpp \
+	Source/WebCore/rendering/RenderCombineText.h \
+	Source/WebCore/rendering/RenderCounter.cpp \
+	Source/WebCore/rendering/RenderCounter.h \
+	Source/WebCore/rendering/RenderDataGrid.cpp \
+	Source/WebCore/rendering/RenderDataGrid.h \
+	Source/WebCore/rendering/RenderDetails.cpp \
+	Source/WebCore/rendering/RenderDetails.h \
+	Source/WebCore/rendering/RenderDetailsMarker.cpp \
+	Source/WebCore/rendering/RenderDetailsMarker.h \
+	Source/WebCore/rendering/RenderEmbeddedObject.cpp \
+	Source/WebCore/rendering/RenderEmbeddedObject.h \
+	Source/WebCore/rendering/RenderFieldset.cpp \
+	Source/WebCore/rendering/RenderFieldset.h \
+	Source/WebCore/rendering/RenderFileUploadControl.cpp \
+	Source/WebCore/rendering/RenderFileUploadControl.h \
+	Source/WebCore/rendering/RenderFlexibleBox.cpp \
+	Source/WebCore/rendering/RenderFlexibleBox.h \
+	Source/WebCore/rendering/RenderFrameBase.cpp \
+	Source/WebCore/rendering/RenderFrameBase.h \
+	Source/WebCore/rendering/RenderFrame.cpp \
+	Source/WebCore/rendering/RenderFrame.h \
+	Source/WebCore/rendering/RenderFrameSet.cpp \
+	Source/WebCore/rendering/RenderFrameSet.h \
+	Source/WebCore/rendering/RenderFullScreen.cpp \
+	Source/WebCore/rendering/RenderFullScreen.h \
+	Source/WebCore/rendering/RenderHTMLCanvas.cpp \
+	Source/WebCore/rendering/RenderHTMLCanvas.h \
+	Source/WebCore/rendering/RenderIFrame.cpp \
+	Source/WebCore/rendering/RenderIFrame.h \
+	Source/WebCore/rendering/RenderImage.cpp \
+	Source/WebCore/rendering/RenderImage.h \
+	Source/WebCore/rendering/RenderImageResource.cpp \
+	Source/WebCore/rendering/RenderImageResource.h \
+	Source/WebCore/rendering/RenderImageResourceStyleImage.cpp \
+	Source/WebCore/rendering/RenderImageResourceStyleImage.h \
+	Source/WebCore/rendering/RenderInline.cpp \
+	Source/WebCore/rendering/RenderInline.h \
+	Source/WebCore/rendering/RenderLayerBacking.h \
+	Source/WebCore/rendering/RenderLayer.cpp \
+	Source/WebCore/rendering/RenderLayer.h \
+	Source/WebCore/rendering/RenderLineBoxList.cpp \
+	Source/WebCore/rendering/RenderLineBoxList.h \
+	Source/WebCore/rendering/RenderListBox.cpp \
+	Source/WebCore/rendering/RenderListBox.h \
+	Source/WebCore/rendering/RenderListItem.cpp \
+	Source/WebCore/rendering/RenderListItem.h \
+	Source/WebCore/rendering/RenderListMarker.cpp \
+	Source/WebCore/rendering/RenderListMarker.h \
+	Source/WebCore/rendering/RenderMarquee.cpp \
+	Source/WebCore/rendering/RenderMarquee.h \
+	Source/WebCore/rendering/RenderMedia.cpp \
+	Source/WebCore/rendering/RenderMedia.h \
+	Source/WebCore/rendering/RenderMenuList.cpp \
+	Source/WebCore/rendering/RenderMenuList.h \
+	Source/WebCore/rendering/RenderMeter.cpp \
+	Source/WebCore/rendering/RenderMeter.h \
+	Source/WebCore/rendering/RenderObjectChildList.cpp \
+	Source/WebCore/rendering/RenderObjectChildList.h \
+	Source/WebCore/rendering/RenderObject.cpp \
+	Source/WebCore/rendering/RenderObject.h \
+	Source/WebCore/rendering/RenderOverflow.h \
+	Source/WebCore/rendering/RenderPart.cpp \
+	Source/WebCore/rendering/RenderPart.h \
+	Source/WebCore/rendering/RenderProgress.cpp \
+	Source/WebCore/rendering/RenderProgress.h \
+	Source/WebCore/rendering/RenderQuote.cpp \
+	Source/WebCore/rendering/RenderQuote.h \
+	Source/WebCore/rendering/RenderReplaced.cpp \
+	Source/WebCore/rendering/RenderReplaced.h \
+	Source/WebCore/rendering/RenderReplica.cpp \
+	Source/WebCore/rendering/RenderReplica.h \
+	Source/WebCore/rendering/RenderRubyBase.cpp \
+	Source/WebCore/rendering/RenderRubyBase.h \
+	Source/WebCore/rendering/RenderRuby.cpp \
+	Source/WebCore/rendering/RenderRuby.h \
+	Source/WebCore/rendering/RenderRubyRun.cpp \
+	Source/WebCore/rendering/RenderRubyRun.h \
+	Source/WebCore/rendering/RenderRubyText.cpp \
+	Source/WebCore/rendering/RenderRubyText.h \
+	Source/WebCore/rendering/RenderScrollbar.cpp \
+	Source/WebCore/rendering/RenderScrollbar.h \
+	Source/WebCore/rendering/RenderScrollbarPart.cpp \
+	Source/WebCore/rendering/RenderScrollbarPart.h \
+	Source/WebCore/rendering/RenderScrollbarTheme.cpp \
+	Source/WebCore/rendering/RenderScrollbarTheme.h \
+	Source/WebCore/rendering/RenderSelectionInfo.h \
+	Source/WebCore/rendering/RenderSlider.cpp \
+	Source/WebCore/rendering/RenderSlider.h \
+	Source/WebCore/rendering/RenderSummary.cpp \
+	Source/WebCore/rendering/RenderSummary.h \
+	Source/WebCore/rendering/RenderTableCell.cpp \
+	Source/WebCore/rendering/RenderTableCell.h \
+	Source/WebCore/rendering/RenderTableCol.cpp \
+	Source/WebCore/rendering/RenderTableCol.h \
+	Source/WebCore/rendering/RenderTable.cpp \
+	Source/WebCore/rendering/RenderTable.h \
+	Source/WebCore/rendering/RenderTableRow.cpp \
+	Source/WebCore/rendering/RenderTableRow.h \
+	Source/WebCore/rendering/RenderTableSection.cpp \
+	Source/WebCore/rendering/RenderTableSection.h \
+	Source/WebCore/rendering/RenderTextControl.cpp \
+	Source/WebCore/rendering/RenderTextControl.h \
+	Source/WebCore/rendering/RenderTextControlMultiLine.cpp \
+	Source/WebCore/rendering/RenderTextControlMultiLine.h \
+	Source/WebCore/rendering/RenderTextControlSingleLine.cpp \
+	Source/WebCore/rendering/RenderTextControlSingleLine.h \
+	Source/WebCore/rendering/RenderText.cpp \
+	Source/WebCore/rendering/RenderTextFragment.cpp \
+	Source/WebCore/rendering/RenderTextFragment.h \
+	Source/WebCore/rendering/RenderText.h \
+	Source/WebCore/rendering/RenderTheme.cpp \
+	Source/WebCore/rendering/RenderTheme.h \
+	Source/WebCore/rendering/RenderTreeAsText.cpp \
+	Source/WebCore/rendering/RenderTreeAsText.h \
+	Source/WebCore/rendering/RenderVideo.cpp \
+	Source/WebCore/rendering/RenderVideo.h \
+	Source/WebCore/rendering/RenderView.cpp \
+	Source/WebCore/rendering/RenderView.h \
+	Source/WebCore/rendering/RenderWidget.cpp \
+	Source/WebCore/rendering/RenderWidget.h \
+	Source/WebCore/rendering/RenderWidgetProtector.h \
+	Source/WebCore/rendering/RenderWordBreak.cpp \
+	Source/WebCore/rendering/RenderWordBreak.h \
+	Source/WebCore/rendering/RootInlineBox.cpp \
+	Source/WebCore/rendering/RootInlineBox.h \
+	Source/WebCore/rendering/ScrollBehavior.cpp \
+	Source/WebCore/rendering/ScrollBehavior.h \
+	Source/WebCore/rendering/ShadowElement.cpp \
+	Source/WebCore/rendering/ShadowElement.h \
+	Source/WebCore/rendering/VerticalPositionCache.h \
+	Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLBlock.h \
+	Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLFenced.h \
+	Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLFraction.h \
+	Source/WebCore/rendering/mathml/RenderMathMLMath.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLMath.h \
+	Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLOperator.h \
+	Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLRoot.h \
+	Source/WebCore/rendering/mathml/RenderMathMLRow.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLRow.h \
+	Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h \
+	Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLSubSup.h \
+	Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp \
+	Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h \
+	Source/WebCore/rendering/style/BorderData.h \
+	Source/WebCore/rendering/style/BorderValue.h \
+	Source/WebCore/rendering/style/CollapsedBorderValue.h \
+	Source/WebCore/rendering/style/ContentData.cpp \
+	Source/WebCore/rendering/style/ContentData.h \
+	Source/WebCore/rendering/style/CounterContent.h \
+	Source/WebCore/rendering/style/CounterDirectives.cpp \
+	Source/WebCore/rendering/style/CounterDirectives.h \
+	Source/WebCore/rendering/style/CursorData.h \
+	Source/WebCore/rendering/style/CursorList.h \
+	Source/WebCore/rendering/style/DataRef.h \
+	Source/WebCore/rendering/style/FillLayer.cpp \
+	Source/WebCore/rendering/style/FillLayer.h \
+	Source/WebCore/rendering/style/KeyframeList.cpp \
+	Source/WebCore/rendering/style/KeyframeList.h \
+	Source/WebCore/rendering/style/LineClampValue.h \
+	Source/WebCore/rendering/style/NinePieceImage.cpp \
+	Source/WebCore/rendering/style/NinePieceImage.h \
+	Source/WebCore/rendering/style/OutlineValue.h \
+	Source/WebCore/rendering/style/QuotesData.cpp \
+	Source/WebCore/rendering/style/QuotesData.h \
+	Source/WebCore/rendering/style/RenderStyleConstants.h \
+	Source/WebCore/rendering/style/RenderStyle.cpp \
+	Source/WebCore/rendering/style/RenderStyle.h \
+	Source/WebCore/rendering/style/ShadowData.cpp \
+	Source/WebCore/rendering/style/ShadowData.h \
+	Source/WebCore/rendering/style/StyleBackgroundData.cpp \
+	Source/WebCore/rendering/style/StyleBackgroundData.h \
+	Source/WebCore/rendering/style/StyleBoxData.cpp \
+	Source/WebCore/rendering/style/StyleBoxData.h \
+	Source/WebCore/rendering/style/StyleCachedImage.cpp \
+	Source/WebCore/rendering/style/StyleCachedImage.h \
+	Source/WebCore/rendering/style/StyleDashboardRegion.h \
+	Source/WebCore/rendering/style/StyleFlexibleBoxData.cpp \
+	Source/WebCore/rendering/style/StyleFlexibleBoxData.h \
+	Source/WebCore/rendering/style/StyleGeneratedImage.cpp \
+	Source/WebCore/rendering/style/StyleGeneratedImage.h \
+	Source/WebCore/rendering/style/StyleImage.h \
+	Source/WebCore/rendering/style/StyleInheritedData.cpp \
+	Source/WebCore/rendering/style/StyleInheritedData.h \
+	Source/WebCore/rendering/style/StyleMarqueeData.cpp \
+	Source/WebCore/rendering/style/StyleMarqueeData.h \
+	Source/WebCore/rendering/style/StyleMultiColData.cpp \
+	Source/WebCore/rendering/style/StyleMultiColData.h \
+	Source/WebCore/rendering/style/StylePendingImage.h \
+	Source/WebCore/rendering/style/StyleRareInheritedData.cpp \
+	Source/WebCore/rendering/style/StyleRareInheritedData.h \
+	Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp \
+	Source/WebCore/rendering/style/StyleRareNonInheritedData.h \
+	Source/WebCore/rendering/style/StyleReflection.h \
+	Source/WebCore/rendering/style/StyleSurroundData.cpp \
+	Source/WebCore/rendering/style/StyleSurroundData.h \
+	Source/WebCore/rendering/style/StyleTransformData.cpp \
+	Source/WebCore/rendering/style/StyleTransformData.h \
+	Source/WebCore/rendering/style/StyleVisualData.cpp \
+	Source/WebCore/rendering/style/StyleVisualData.h \
+	Source/WebCore/rendering/style/SVGRenderStyle.cpp \
+	Source/WebCore/rendering/style/SVGRenderStyleDefs.cpp \
+	Source/WebCore/rendering/style/SVGRenderStyleDefs.h \
+	Source/WebCore/rendering/style/SVGRenderStyle.h \
+	Source/WebCore/rendering/svg/RenderSVGBlock.cpp \
+	Source/WebCore/rendering/svg/RenderSVGBlock.h \
+	Source/WebCore/rendering/svg/RenderSVGContainer.cpp \
+	Source/WebCore/rendering/svg/RenderSVGContainer.h \
+	Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp \
+	Source/WebCore/rendering/svg/RenderSVGForeignObject.h \
+	Source/WebCore/rendering/svg/RenderSVGGradientStop.cpp \
+	Source/WebCore/rendering/svg/RenderSVGGradientStop.h \
+	Source/WebCore/rendering/svg/RenderSVGHiddenContainer.cpp \
+	Source/WebCore/rendering/svg/RenderSVGHiddenContainer.h \
+	Source/WebCore/rendering/svg/RenderSVGImage.cpp \
+	Source/WebCore/rendering/svg/RenderSVGImage.h \
+	Source/WebCore/rendering/svg/RenderSVGInline.cpp \
+	Source/WebCore/rendering/svg/RenderSVGInline.h \
+	Source/WebCore/rendering/svg/RenderSVGInlineText.cpp \
+	Source/WebCore/rendering/svg/RenderSVGInlineText.h \
+	Source/WebCore/rendering/svg/RenderSVGModelObject.cpp \
+	Source/WebCore/rendering/svg/RenderSVGModelObject.h \
+	Source/WebCore/rendering/svg/RenderSVGPath.cpp \
+	Source/WebCore/rendering/svg/RenderSVGPath.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceClipper.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceContainer.h \
+	Source/WebCore/rendering/svg/RenderSVGResource.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceFilter.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceGradient.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceGradient.h \
+	Source/WebCore/rendering/svg/RenderSVGResource.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceLinearGradient.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceLinearGradient.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceMarker.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceMasker.h \
+	Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourcePattern.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceRadialGradient.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceRadialGradient.h \
+	Source/WebCore/rendering/svg/RenderSVGResourceSolidColor.cpp \
+	Source/WebCore/rendering/svg/RenderSVGResourceSolidColor.h \
+	Source/WebCore/rendering/svg/RenderSVGRoot.cpp \
+	Source/WebCore/rendering/svg/RenderSVGRoot.h \
+	Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp \
+	Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h \
+	Source/WebCore/rendering/svg/RenderSVGTSpan.cpp \
+	Source/WebCore/rendering/svg/RenderSVGTSpan.h \
+	Source/WebCore/rendering/svg/RenderSVGText.cpp \
+	Source/WebCore/rendering/svg/RenderSVGText.h \
+	Source/WebCore/rendering/svg/RenderSVGTextPath.cpp \
+	Source/WebCore/rendering/svg/RenderSVGTextPath.h \
+	Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp \
+	Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h \
+	Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp \
+	Source/WebCore/rendering/svg/RenderSVGViewportContainer.h \
+	Source/WebCore/rendering/svg/SVGImageBufferTools.cpp \
+	Source/WebCore/rendering/svg/SVGImageBufferTools.h \
+	Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp \
+	Source/WebCore/rendering/svg/SVGInlineFlowBox.h \
+	Source/WebCore/rendering/svg/SVGInlineTextBox.cpp \
+	Source/WebCore/rendering/svg/SVGInlineTextBox.h \
+	Source/WebCore/rendering/svg/SVGMarkerData.h \
+	Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.cpp \
+	Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.h \
+	Source/WebCore/rendering/svg/SVGRenderSupport.cpp \
+	Source/WebCore/rendering/svg/SVGRenderSupport.h \
+	Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp \
+	Source/WebCore/rendering/svg/SVGRenderTreeAsText.h \
+	Source/WebCore/rendering/svg/SVGResourcesCache.cpp \
+	Source/WebCore/rendering/svg/SVGResourcesCache.h \
+	Source/WebCore/rendering/svg/SVGResources.cpp \
+	Source/WebCore/rendering/svg/SVGResourcesCycleSolver.cpp \
+	Source/WebCore/rendering/svg/SVGResourcesCycleSolver.h \
+	Source/WebCore/rendering/svg/SVGResources.h \
+	Source/WebCore/rendering/svg/SVGRootInlineBox.cpp \
+	Source/WebCore/rendering/svg/SVGRootInlineBox.h \
+	Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp \
+	Source/WebCore/rendering/svg/SVGShadowTreeElements.h \
+	Source/WebCore/rendering/svg/SVGTextChunk.cpp \
+	Source/WebCore/rendering/svg/SVGTextChunk.h \
+	Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp \
+	Source/WebCore/rendering/svg/SVGTextChunkBuilder.h \
+	Source/WebCore/rendering/svg/SVGTextFragment.h \
+	Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp \
+	Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h \
+	Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp \
+	Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h \
+	Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp \
+	Source/WebCore/rendering/svg/SVGTextLayoutEngine.h \
+	Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp \
+	Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.h \
+	Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp \
+	Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.h \
+	Source/WebCore/rendering/svg/SVGTextMetrics.cpp \
+	Source/WebCore/rendering/svg/SVGTextMetrics.h \
+	Source/WebCore/rendering/svg/SVGTextQuery.cpp \
+	Source/WebCore/rendering/svg/SVGTextQuery.h \
+	Source/WebCore/rendering/TableLayout.h \
+	Source/WebCore/rendering/TrailingFloatsRootInlineBox.h \
+	Source/WebCore/rendering/TransformState.cpp \
+	Source/WebCore/rendering/TransformState.h \
+	Source/WebCore/storage/AbstractDatabase.cpp \
+	Source/WebCore/storage/AbstractDatabase.h \
+	Source/WebCore/storage/ChangeVersionWrapper.cpp \
+	Source/WebCore/storage/ChangeVersionWrapper.h \
+	Source/WebCore/storage/DatabaseAuthorizer.cpp \
+	Source/WebCore/storage/DatabaseAuthorizer.h \
+	Source/WebCore/storage/DatabaseCallback.h \
+	Source/WebCore/storage/Database.cpp \
+	Source/WebCore/storage/DatabaseDetails.h \
+	Source/WebCore/storage/Database.h \
+	Source/WebCore/storage/DatabaseSync.cpp \
+	Source/WebCore/storage/DatabaseSync.h \
+	Source/WebCore/storage/DatabaseTask.cpp \
+	Source/WebCore/storage/DatabaseTask.h \
+	Source/WebCore/storage/DatabaseThread.cpp \
+	Source/WebCore/storage/DatabaseThread.h \
+	Source/WebCore/storage/DatabaseTrackerClient.h \
+	Source/WebCore/storage/DatabaseTracker.cpp \
+	Source/WebCore/storage/DatabaseTracker.h \
+	Source/WebCore/storage/IDBAny.cpp \
+	Source/WebCore/storage/IDBAny.h \
+	Source/WebCore/storage/IDBBackingStore.h \
+	Source/WebCore/storage/IDBCallbacks.h \
+	Source/WebCore/storage/IDBCursorBackendImpl.cpp \
+	Source/WebCore/storage/IDBCursorBackendImpl.h \
+	Source/WebCore/storage/IDBCursorBackendInterface.h \
+	Source/WebCore/storage/IDBCursor.cpp \
+	Source/WebCore/storage/IDBCursor.h \
+	Source/WebCore/storage/IDBDatabaseBackendImpl.cpp \
+	Source/WebCore/storage/IDBDatabaseBackendImpl.h \
+	Source/WebCore/storage/IDBDatabaseBackendInterface.h \
+	Source/WebCore/storage/IDBDatabaseCallbacks.h \
+	Source/WebCore/storage/IDBDatabaseCallbacksImpl.h \
+	Source/WebCore/storage/IDBDatabase.cpp \
+	Source/WebCore/storage/IDBDatabaseError.h \
+	Source/WebCore/storage/IDBDatabaseException.h \
+	Source/WebCore/storage/IDBDatabase.h \
+	Source/WebCore/storage/IDBEventDispatcher.cpp \
+	Source/WebCore/storage/IDBEventDispatcher.h \
+	Source/WebCore/storage/IDBFactoryBackendImpl.cpp \
+	Source/WebCore/storage/IDBFactoryBackendImpl.h \
+	Source/WebCore/storage/IDBFactoryBackendInterface.cpp \
+	Source/WebCore/storage/IDBFactoryBackendInterface.h \
+	Source/WebCore/storage/IDBFactory.cpp \
+	Source/WebCore/storage/IDBFactory.h \
+	Source/WebCore/storage/IDBIndexBackendImpl.cpp \
+	Source/WebCore/storage/IDBIndexBackendImpl.h \
+	Source/WebCore/storage/IDBIndexBackendInterface.h \
+	Source/WebCore/storage/IDBIndexBackendInterface.h \
+	Source/WebCore/storage/IDBIndex.cpp \
+	Source/WebCore/storage/IDBIndex.h \
+	Source/WebCore/storage/IDBKey.h \
+	Source/WebCore/storage/IDBKeyPath.h \
+	Source/WebCore/storage/IDBKeyPathBackendImpl.h \
+	Source/WebCore/storage/IDBKeyRange.cpp \
+	Source/WebCore/storage/IDBKeyRange.h \
+	Source/WebCore/storage/IDBLevelDBBackingStore.cpp \
+	Source/WebCore/storage/IDBLevelDBBackingStore.h \
+	Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp \
+	Source/WebCore/storage/IDBObjectStoreBackendImpl.h \
+	Source/WebCore/storage/IDBObjectStoreBackendInterface.h \
+	Source/WebCore/storage/IDBObjectStoreBackendInterface.h \
+	Source/WebCore/storage/IDBObjectStore.cpp \
+	Source/WebCore/storage/IDBObjectStore.h \
+	Source/WebCore/storage/IDBRequest.cpp \
+	Source/WebCore/storage/IDBRequest.h \
+	Source/WebCore/storage/IDBSQLiteBackingStore.cpp \
+	Source/WebCore/storage/IDBSQLiteBackingStore.h \
+	Source/WebCore/storage/IDBTransactionBackendInterface.h \
+	Source/WebCore/storage/IDBTransactionCoordinator.h \
+	Source/WebCore/storage/IDBTransaction.cpp \
+	Source/WebCore/storage/IDBTransaction.h \
+	Source/WebCore/storage/IDBVersionChangeEvent.h \
+	Source/WebCore/storage/IDBVersionChangeRequest.h \
+	Source/WebCore/storage/LocalStorageTask.cpp \
+	Source/WebCore/storage/LocalStorageTask.h \
+	Source/WebCore/storage/LocalStorageThread.cpp \
+	Source/WebCore/storage/LocalStorageThread.h \
+	Source/WebCore/storage/OriginQuotaManager.cpp \
+	Source/WebCore/storage/OriginQuotaManager.h \
+	Source/WebCore/storage/OriginUsageRecord.cpp \
+	Source/WebCore/storage/OriginUsageRecord.h \
+	Source/WebCore/storage/SQLCallbackWrapper.h \
+	Source/WebCore/storage/SQLError.h \
+	Source/WebCore/storage/SQLException.h \
+	Source/WebCore/storage/SQLResultSet.cpp \
+	Source/WebCore/storage/SQLResultSet.h \
+	Source/WebCore/storage/SQLResultSetRowList.cpp \
+	Source/WebCore/storage/SQLResultSetRowList.h \
+	Source/WebCore/storage/SQLStatementCallback.h \
+	Source/WebCore/storage/SQLStatement.cpp \
+	Source/WebCore/storage/SQLStatementErrorCallback.h \
+	Source/WebCore/storage/SQLStatement.h \
+	Source/WebCore/storage/SQLStatementSync.cpp \
+	Source/WebCore/storage/SQLStatementSync.h \
+	Source/WebCore/storage/SQLTransactionCallback.h \
+	Source/WebCore/storage/SQLTransactionClient.cpp \
+	Source/WebCore/storage/SQLTransactionClient.h \
+	Source/WebCore/storage/SQLTransactionCoordinator.cpp \
+	Source/WebCore/storage/SQLTransactionCoordinator.h \
+	Source/WebCore/storage/SQLTransaction.cpp \
+	Source/WebCore/storage/SQLTransactionErrorCallback.h \
+	Source/WebCore/storage/SQLTransaction.h \
+	Source/WebCore/storage/SQLTransactionSyncCallback.h \
+	Source/WebCore/storage/SQLTransactionSync.cpp \
+	Source/WebCore/storage/SQLTransactionSync.h \
+	Source/WebCore/storage/StorageArea.h \
+	Source/WebCore/storage/StorageAreaImpl.cpp \
+	Source/WebCore/storage/StorageAreaImpl.h \
+	Source/WebCore/storage/StorageAreaSync.cpp \
+	Source/WebCore/storage/StorageAreaSync.h \
+	Source/WebCore/storage/Storage.cpp \
+	Source/WebCore/storage/Storage.h \
+	Source/WebCore/storage/StorageEvent.cpp \
+	Source/WebCore/storage/StorageEvent.h \
+	Source/WebCore/storage/StorageEventDispatcher.cpp \
+	Source/WebCore/storage/StorageEventDispatcher.h \
+	Source/WebCore/storage/StorageInfo.cpp \
+	Source/WebCore/storage/StorageInfo.h \
+	Source/WebCore/storage/StorageInfoErrorCallback.h \
+	Source/WebCore/storage/StorageInfoUsageCallback.h \
+	Source/WebCore/storage/StorageMap.cpp \
+	Source/WebCore/storage/StorageMap.h \
+	Source/WebCore/storage/StorageNamespace.cpp \
+	Source/WebCore/storage/StorageNamespace.h \
+	Source/WebCore/storage/StorageNamespaceImpl.cpp \
+	Source/WebCore/storage/StorageNamespaceImpl.h \
+	Source/WebCore/storage/StorageSyncManager.cpp \
+	Source/WebCore/storage/StorageSyncManager.h \
+	Source/WebCore/storage/StorageTracker.cpp \
+	Source/WebCore/storage/StorageTracker.h \
+	Source/WebCore/storage/StorageTrackerClient.h \
+	Source/WebCore/svg/animation/SMILTimeContainer.cpp \
+	Source/WebCore/svg/animation/SMILTimeContainer.h \
+	Source/WebCore/svg/animation/SMILTime.cpp \
+	Source/WebCore/svg/animation/SMILTime.h \
+	Source/WebCore/svg/animation/SVGSMILElement.cpp \
+	Source/WebCore/svg/animation/SVGSMILElement.h \
+	Source/WebCore/svg/ColorDistance.cpp \
+	Source/WebCore/svg/ColorDistance.h \
+	Source/WebCore/svg/ElementTimeControl.h \
+	Source/WebCore/svg/GradientAttributes.h \
+	Source/WebCore/svg/graphics/filters/SVGFEImage.cpp \
+	Source/WebCore/svg/graphics/filters/SVGFEImage.h \
+	Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp \
+	Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h \
+	Source/WebCore/svg/graphics/filters/SVGFilter.cpp \
+	Source/WebCore/svg/graphics/filters/SVGFilter.h \
+	Source/WebCore/svg/graphics/SVGImage.cpp \
+	Source/WebCore/svg/graphics/SVGImage.h \
+	Source/WebCore/svg/LinearGradientAttributes.h \
+	Source/WebCore/svg/PatternAttributes.h \
+	Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGAnimatedProperty.h \
+	Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h \
+	Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h \
+	Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h \
+	Source/WebCore/svg/properties/SVGAnimatedPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGAnimatedStaticPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGListProperty.h \
+	Source/WebCore/svg/properties/SVGListPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp \
+	Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGProperty.h \
+	Source/WebCore/svg/properties/SVGPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGPropertyTraits.h \
+	Source/WebCore/svg/properties/SVGStaticListPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGStaticPropertyTearOff.h \
+	Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h \
+	Source/WebCore/svg/properties/SVGTransformListPropertyTearOff.h \
+	Source/WebCore/svg/RadialGradientAttributes.h \
+	Source/WebCore/svg/SVGAElement.cpp \
+	Source/WebCore/svg/SVGAElement.h \
+	Source/WebCore/svg/SVGAltGlyphElement.cpp \
+	Source/WebCore/svg/SVGAltGlyphElement.h \
+	Source/WebCore/svg/SVGAngle.cpp \
+	Source/WebCore/svg/SVGAngle.h \
+	Source/WebCore/svg/SVGAnimateColorElement.cpp \
+	Source/WebCore/svg/SVGAnimateColorElement.h \
+	Source/WebCore/svg/SVGAnimatedAngle.h \
+	Source/WebCore/svg/SVGAnimatedBoolean.h \
+	Source/WebCore/svg/SVGAnimatedEnumeration.h \
+	Source/WebCore/svg/SVGAnimatedInteger.h \
+	Source/WebCore/svg/SVGAnimatedLength.h \
+	Source/WebCore/svg/SVGAnimatedLengthList.h \
+	Source/WebCore/svg/SVGAnimatedNumber.h \
+	Source/WebCore/svg/SVGAnimatedNumberList.h \
+	Source/WebCore/svg/SVGAnimatedPreserveAspectRatio.h \
+	Source/WebCore/svg/SVGAnimatedRect.h \
+	Source/WebCore/svg/SVGAnimatedString.h \
+	Source/WebCore/svg/SVGAnimatedTransformList.h \
+	Source/WebCore/svg/SVGAnimateElement.cpp \
+	Source/WebCore/svg/SVGAnimateElement.h \
+	Source/WebCore/svg/SVGAnimateMotionElement.cpp \
+	Source/WebCore/svg/SVGAnimateMotionElement.h \
+	Source/WebCore/svg/SVGAnimateTransformElement.cpp \
+	Source/WebCore/svg/SVGAnimateTransformElement.h \
+	Source/WebCore/svg/SVGAnimationElement.cpp \
+	Source/WebCore/svg/SVGAnimationElement.h \
+	Source/WebCore/svg/SVGCircleElement.cpp \
+	Source/WebCore/svg/SVGCircleElement.h \
+	Source/WebCore/svg/SVGClipPathElement.cpp \
+	Source/WebCore/svg/SVGClipPathElement.h \
+	Source/WebCore/svg/SVGColor.cpp \
+	Source/WebCore/svg/SVGColor.h \
+	Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp \
+	Source/WebCore/svg/SVGComponentTransferFunctionElement.h \
+	Source/WebCore/svg/SVGCursorElement.cpp \
+	Source/WebCore/svg/SVGCursorElement.h \
+	Source/WebCore/svg/SVGDefsElement.cpp \
+	Source/WebCore/svg/SVGDefsElement.h \
+	Source/WebCore/svg/SVGDescElement.cpp \
+	Source/WebCore/svg/SVGDescElement.h \
+	Source/WebCore/svg/SVGDocument.cpp \
+	Source/WebCore/svg/SVGDocumentExtensions.cpp \
+	Source/WebCore/svg/SVGDocumentExtensions.h \
+	Source/WebCore/svg/SVGDocument.h \
+	Source/WebCore/svg/SVGElement.cpp \
+	Source/WebCore/svg/SVGElement.h \
+	Source/WebCore/svg/SVGElementInstance.cpp \
+	Source/WebCore/svg/SVGElementInstance.h \
+	Source/WebCore/svg/SVGElementInstanceList.cpp \
+	Source/WebCore/svg/SVGElementInstanceList.h \
+	Source/WebCore/svg/SVGElementRareData.h \
+	Source/WebCore/svg/SVGEllipseElement.cpp \
+	Source/WebCore/svg/SVGEllipseElement.h \
+	Source/WebCore/svg/SVGException.h \
+	Source/WebCore/svg/SVGExternalResourcesRequired.cpp \
+	Source/WebCore/svg/SVGExternalResourcesRequired.h \
+	Source/WebCore/svg/SVGFEBlendElement.cpp \
+	Source/WebCore/svg/SVGFEBlendElement.h \
+	Source/WebCore/svg/SVGFEColorMatrixElement.cpp \
+	Source/WebCore/svg/SVGFEColorMatrixElement.h \
+	Source/WebCore/svg/SVGFEComponentTransferElement.cpp \
+	Source/WebCore/svg/SVGFEComponentTransferElement.h \
+	Source/WebCore/svg/SVGFECompositeElement.cpp \
+	Source/WebCore/svg/SVGFECompositeElement.h \
+	Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp \
+	Source/WebCore/svg/SVGFEConvolveMatrixElement.h \
+	Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp \
+	Source/WebCore/svg/SVGFEDiffuseLightingElement.h \
+	Source/WebCore/svg/SVGFEDisplacementMapElement.cpp \
+	Source/WebCore/svg/SVGFEDisplacementMapElement.h \
+	Source/WebCore/svg/SVGFEDistantLightElement.cpp \
+	Source/WebCore/svg/SVGFEDistantLightElement.h \
+	Source/WebCore/svg/SVGFEFloodElement.cpp \
+	Source/WebCore/svg/SVGFEFloodElement.h \
+	Source/WebCore/svg/SVGFEFuncAElement.cpp \
+	Source/WebCore/svg/SVGFEFuncAElement.h \
+	Source/WebCore/svg/SVGFEFuncBElement.cpp \
+	Source/WebCore/svg/SVGFEFuncBElement.h \
+	Source/WebCore/svg/SVGFEFuncGElement.cpp \
+	Source/WebCore/svg/SVGFEFuncGElement.h \
+	Source/WebCore/svg/SVGFEFuncRElement.cpp \
+	Source/WebCore/svg/SVGFEFuncRElement.h \
+	Source/WebCore/svg/SVGFEGaussianBlurElement.cpp \
+	Source/WebCore/svg/SVGFEGaussianBlurElement.h \
+	Source/WebCore/svg/SVGFEImageElement.cpp \
+	Source/WebCore/svg/SVGFEImageElement.h \
+	Source/WebCore/svg/SVGFELightElement.cpp \
+	Source/WebCore/svg/SVGFELightElement.h \
+	Source/WebCore/svg/SVGFEMergeElement.cpp \
+	Source/WebCore/svg/SVGFEMergeElement.h \
+	Source/WebCore/svg/SVGFEMergeNodeElement.cpp \
+	Source/WebCore/svg/SVGFEMergeNodeElement.h \
+	Source/WebCore/svg/SVGFEMorphologyElement.cpp \
+	Source/WebCore/svg/SVGFEMorphologyElement.h \
+	Source/WebCore/svg/SVGFEOffsetElement.cpp \
+	Source/WebCore/svg/SVGFEOffsetElement.h \
+	Source/WebCore/svg/SVGFEPointLightElement.cpp \
+	Source/WebCore/svg/SVGFEPointLightElement.h \
+	Source/WebCore/svg/SVGFESpecularLightingElement.cpp \
+	Source/WebCore/svg/SVGFESpecularLightingElement.h \
+	Source/WebCore/svg/SVGFESpotLightElement.cpp \
+	Source/WebCore/svg/SVGFESpotLightElement.h \
+	Source/WebCore/svg/SVGFETileElement.cpp \
+	Source/WebCore/svg/SVGFETileElement.h \
+	Source/WebCore/svg/SVGFETurbulenceElement.cpp \
+	Source/WebCore/svg/SVGFETurbulenceElement.h \
+	Source/WebCore/svg/SVGFilterElement.cpp \
+	Source/WebCore/svg/SVGFilterElement.h \
+	Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp \
+	Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h \
+	Source/WebCore/svg/SVGFitToViewBox.cpp \
+	Source/WebCore/svg/SVGFitToViewBox.h \
+	Source/WebCore/svg/SVGFont.cpp \
+	Source/WebCore/svg/SVGFontData.cpp \
+	Source/WebCore/svg/SVGFontData.h \
+	Source/WebCore/svg/SVGFontElement.cpp \
+	Source/WebCore/svg/SVGFontElement.h \
+	Source/WebCore/svg/SVGFontFaceElement.cpp \
+	Source/WebCore/svg/SVGFontFaceElement.h \
+	Source/WebCore/svg/SVGFontFaceFormatElement.cpp \
+	Source/WebCore/svg/SVGFontFaceFormatElement.h \
+	Source/WebCore/svg/SVGFontFaceNameElement.cpp \
+	Source/WebCore/svg/SVGFontFaceNameElement.h \
+	Source/WebCore/svg/SVGFontFaceSrcElement.cpp \
+	Source/WebCore/svg/SVGFontFaceSrcElement.h \
+	Source/WebCore/svg/SVGFontFaceUriElement.cpp \
+	Source/WebCore/svg/SVGFontFaceUriElement.h \
+	Source/WebCore/svg/SVGForeignObjectElement.cpp \
+	Source/WebCore/svg/SVGForeignObjectElement.h \
+	Source/WebCore/svg/SVGGElement.cpp \
+	Source/WebCore/svg/SVGGElement.h \
+	Source/WebCore/svg/SVGGlyphElement.cpp \
+	Source/WebCore/svg/SVGGlyphElement.h \
+	Source/WebCore/svg/SVGGlyphMap.h \
+	Source/WebCore/svg/SVGGradientElement.cpp \
+	Source/WebCore/svg/SVGGradientElement.h \
+	Source/WebCore/svg/SVGHKernElement.cpp \
+	Source/WebCore/svg/SVGHKernElement.h \
+	Source/WebCore/svg/SVGImageElement.cpp \
+	Source/WebCore/svg/SVGImageElement.h \
+	Source/WebCore/svg/SVGImageLoader.cpp \
+	Source/WebCore/svg/SVGImageLoader.h \
+	Source/WebCore/svg/SVGLangSpace.cpp \
+	Source/WebCore/svg/SVGLangSpace.h \
+	Source/WebCore/svg/SVGLength.cpp \
+	Source/WebCore/svg/SVGLength.h \
+	Source/WebCore/svg/SVGLengthList.cpp \
+	Source/WebCore/svg/SVGLengthList.h \
+	Source/WebCore/svg/SVGLinearGradientElement.cpp \
+	Source/WebCore/svg/SVGLinearGradientElement.h \
+	Source/WebCore/svg/SVGLineElement.cpp \
+	Source/WebCore/svg/SVGLineElement.h \
+	Source/WebCore/svg/SVGLocatable.cpp \
+	Source/WebCore/svg/SVGLocatable.h \
+	Source/WebCore/svg/SVGMarkerElement.cpp \
+	Source/WebCore/svg/SVGMarkerElement.h \
+	Source/WebCore/svg/SVGMaskElement.cpp \
+	Source/WebCore/svg/SVGMaskElement.h \
+	Source/WebCore/svg/SVGMatrix.h \
+	Source/WebCore/svg/SVGMetadataElement.cpp \
+	Source/WebCore/svg/SVGMetadataElement.h \
+	Source/WebCore/svg/SVGMissingGlyphElement.cpp \
+	Source/WebCore/svg/SVGMissingGlyphElement.h \
+	Source/WebCore/svg/SVGMPathElement.cpp \
+	Source/WebCore/svg/SVGMPathElement.h \
+	Source/WebCore/svg/SVGNumberList.cpp \
+	Source/WebCore/svg/SVGNumberList.h \
+	Source/WebCore/svg/SVGPaint.cpp \
+	Source/WebCore/svg/SVGPaint.h \
+	Source/WebCore/svg/SVGParserUtilities.cpp \
+	Source/WebCore/svg/SVGParserUtilities.h \
+	Source/WebCore/svg/SVGPathBlender.cpp \
+	Source/WebCore/svg/SVGPathBlender.h \
+	Source/WebCore/svg/SVGPathBuilder.cpp \
+	Source/WebCore/svg/SVGPathBuilder.h \
+	Source/WebCore/svg/SVGPathByteStreamBuilder.cpp \
+	Source/WebCore/svg/SVGPathByteStreamBuilder.h \
+	Source/WebCore/svg/SVGPathByteStream.h \
+	Source/WebCore/svg/SVGPathByteStreamSource.cpp \
+	Source/WebCore/svg/SVGPathByteStreamSource.h \
+	Source/WebCore/svg/SVGPathConsumer.h \
+	Source/WebCore/svg/SVGPathElement.cpp \
+	Source/WebCore/svg/SVGPathElement.h \
+	Source/WebCore/svg/SVGPathParser.cpp \
+	Source/WebCore/svg/SVGPathParserFactory.cpp \
+	Source/WebCore/svg/SVGPathParserFactory.h \
+	Source/WebCore/svg/SVGPathParser.h \
+	Source/WebCore/svg/SVGPathSegArc.h \
+	Source/WebCore/svg/SVGPathSegClosePath.h \
+	Source/WebCore/svg/SVGPathSegCurvetoCubic.h \
+	Source/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h \
+	Source/WebCore/svg/SVGPathSegCurvetoQuadratic.h \
+	Source/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h \
+	Source/WebCore/svg/SVGPathSeg.h \
+	Source/WebCore/svg/SVGPathSegLineto.h \
+	Source/WebCore/svg/SVGPathSegLinetoHorizontal.h \
+	Source/WebCore/svg/SVGPathSegLinetoVertical.h \
+	Source/WebCore/svg/SVGPathSegListBuilder.cpp \
+	Source/WebCore/svg/SVGPathSegListBuilder.h \
+	Source/WebCore/svg/SVGPathSegList.cpp \
+	Source/WebCore/svg/SVGPathSegList.h \
+	Source/WebCore/svg/SVGPathSegListSource.cpp \
+	Source/WebCore/svg/SVGPathSegListSource.h \
+	Source/WebCore/svg/SVGPathSegMoveto.h \
+	Source/WebCore/svg/SVGPathSegWithContext.h \
+	Source/WebCore/svg/SVGPathSource.h \
+	Source/WebCore/svg/SVGPathStringBuilder.cpp \
+	Source/WebCore/svg/SVGPathStringBuilder.h \
+	Source/WebCore/svg/SVGPathStringSource.cpp \
+	Source/WebCore/svg/SVGPathStringSource.h \
+	Source/WebCore/svg/SVGPathTraversalStateBuilder.cpp \
+	Source/WebCore/svg/SVGPathTraversalStateBuilder.h \
+	Source/WebCore/svg/SVGPatternElement.cpp \
+	Source/WebCore/svg/SVGPatternElement.h \
+	Source/WebCore/svg/SVGPointList.cpp \
+	Source/WebCore/svg/SVGPointList.h \
+	Source/WebCore/svg/SVGPolyElement.cpp \
+	Source/WebCore/svg/SVGPolyElement.h \
+	Source/WebCore/svg/SVGPolygonElement.cpp \
+	Source/WebCore/svg/SVGPolygonElement.h \
+	Source/WebCore/svg/SVGPolylineElement.cpp \
+	Source/WebCore/svg/SVGPolylineElement.h \
+	Source/WebCore/svg/SVGPreserveAspectRatio.cpp \
+	Source/WebCore/svg/SVGPreserveAspectRatio.h \
+	Source/WebCore/svg/SVGRadialGradientElement.cpp \
+	Source/WebCore/svg/SVGRadialGradientElement.h \
+	Source/WebCore/svg/SVGRect.h \
+	Source/WebCore/svg/SVGRectElement.cpp \
+	Source/WebCore/svg/SVGRectElement.h \
+	Source/WebCore/svg/SVGRenderingIntent.h \
+	Source/WebCore/svg/SVGScriptElement.cpp \
+	Source/WebCore/svg/SVGScriptElement.h \
+	Source/WebCore/svg/SVGSetElement.cpp \
+	Source/WebCore/svg/SVGSetElement.h \
+	Source/WebCore/svg/SVGStopElement.cpp \
+	Source/WebCore/svg/SVGStopElement.h \
+	Source/WebCore/svg/SVGStringList.cpp \
+	Source/WebCore/svg/SVGStringList.h \
+	Source/WebCore/svg/SVGStylable.cpp \
+	Source/WebCore/svg/SVGStylable.h \
+	Source/WebCore/svg/SVGStyledElement.cpp \
+	Source/WebCore/svg/SVGStyledElement.h \
+	Source/WebCore/svg/SVGStyledLocatableElement.cpp \
+	Source/WebCore/svg/SVGStyledLocatableElement.h \
+	Source/WebCore/svg/SVGStyledTransformableElement.cpp \
+	Source/WebCore/svg/SVGStyledTransformableElement.h \
+	Source/WebCore/svg/SVGStyleElement.cpp \
+	Source/WebCore/svg/SVGStyleElement.h \
+	Source/WebCore/svg/SVGSVGElement.cpp \
+	Source/WebCore/svg/SVGSVGElement.h \
+	Source/WebCore/svg/SVGSwitchElement.cpp \
+	Source/WebCore/svg/SVGSwitchElement.h \
+	Source/WebCore/svg/SVGSymbolElement.cpp \
+	Source/WebCore/svg/SVGSymbolElement.h \
+	Source/WebCore/svg/SVGTests.cpp \
+	Source/WebCore/svg/SVGTests.h \
+	Source/WebCore/svg/SVGTextContentElement.cpp \
+	Source/WebCore/svg/SVGTextContentElement.h \
+	Source/WebCore/svg/SVGTextElement.cpp \
+	Source/WebCore/svg/SVGTextElement.h \
+	Source/WebCore/svg/SVGTextPathElement.cpp \
+	Source/WebCore/svg/SVGTextPathElement.h \
+	Source/WebCore/svg/SVGTextPositioningElement.cpp \
+	Source/WebCore/svg/SVGTextPositioningElement.h \
+	Source/WebCore/svg/SVGTitleElement.cpp \
+	Source/WebCore/svg/SVGTitleElement.h \
+	Source/WebCore/svg/SVGTransformable.cpp \
+	Source/WebCore/svg/SVGTransformable.h \
+	Source/WebCore/svg/SVGTransform.cpp \
+	Source/WebCore/svg/SVGTransformDistance.cpp \
+	Source/WebCore/svg/SVGTransformDistance.h \
+	Source/WebCore/svg/SVGTransform.h \
+	Source/WebCore/svg/SVGTransformList.cpp \
+	Source/WebCore/svg/SVGTransformList.h \
+	Source/WebCore/svg/SVGTRefElement.cpp \
+	Source/WebCore/svg/SVGTRefElement.h \
+	Source/WebCore/svg/SVGTSpanElement.cpp \
+	Source/WebCore/svg/SVGTSpanElement.h \
+	Source/WebCore/svg/SVGUnitTypes.h \
+	Source/WebCore/svg/SVGURIReference.cpp \
+	Source/WebCore/svg/SVGURIReference.h \
+	Source/WebCore/svg/SVGUseElement.cpp \
+	Source/WebCore/svg/SVGUseElement.h \
+	Source/WebCore/svg/SVGViewElement.cpp \
+	Source/WebCore/svg/SVGViewElement.h \
+	Source/WebCore/svg/SVGViewSpec.cpp \
+	Source/WebCore/svg/SVGViewSpec.h \
+	Source/WebCore/svg/SVGVKernElement.cpp \
+	Source/WebCore/svg/SVGVKernElement.h \
+	Source/WebCore/svg/SVGZoomAndPan.cpp \
+	Source/WebCore/svg/SVGZoomAndPan.h \
+	Source/WebCore/svg/SVGZoomEvent.cpp \
+	Source/WebCore/svg/SVGZoomEvent.h \
+	Source/WebCore/WebCorePrefix.h \
+	Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h \
+	Source/WebCore/websockets/ThreadableWebSocketChannel.cpp \
+	Source/WebCore/websockets/ThreadableWebSocketChannel.h \
+	Source/WebCore/websockets/WebSocketChannelClient.h \
+	Source/WebCore/websockets/WebSocketChannel.cpp \
+	Source/WebCore/websockets/WebSocketChannel.h \
+	Source/WebCore/websockets/WebSocket.cpp \
+	Source/WebCore/websockets/WebSocket.h \
+	Source/WebCore/websockets/WebSocketHandshake.cpp \
+	Source/WebCore/websockets/WebSocketHandshake.h \
+	Source/WebCore/websockets/WebSocketHandshakeRequest.cpp \
+	Source/WebCore/websockets/WebSocketHandshakeRequest.h \
+	Source/WebCore/websockets/WebSocketHandshakeResponse.cpp \
+	Source/WebCore/websockets/WebSocketHandshakeResponse.h \
+	Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp \
+	Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h \
+	Source/WebCore/wml/WMLAccessElement.cpp \
+	Source/WebCore/wml/WMLAElement.cpp \
+	Source/WebCore/wml/WMLAnchorElement.cpp \
+	Source/WebCore/wml/WMLBRElement.cpp \
+	Source/WebCore/wml/WMLCardElement.cpp \
+	Source/WebCore/wml/WMLDocument.cpp \
+	Source/WebCore/wml/WMLDoElement.cpp \
+	Source/WebCore/wml/WMLElement.cpp \
+	Source/WebCore/wml/WMLErrorHandling.cpp \
+	Source/WebCore/wml/WMLEventHandlingElement.cpp \
+	Source/WebCore/wml/WMLFieldSetElement.cpp \
+	Source/WebCore/wml/WMLFormControlElement.cpp \
+	Source/WebCore/wml/WMLGoElement.cpp \
+	Source/WebCore/wml/WMLImageElement.cpp \
+	Source/WebCore/wml/WMLImageLoader.cpp \
+	Source/WebCore/wml/WMLInputElement.cpp \
+	Source/WebCore/wml/WMLInsertedLegendElement.cpp \
+	Source/WebCore/wml/WMLIntrinsicEvent.cpp \
+	Source/WebCore/wml/WMLIntrinsicEventHandler.cpp \
+	Source/WebCore/wml/WMLMetaElement.cpp \
+	Source/WebCore/wml/WMLNoopElement.cpp \
+	Source/WebCore/wml/WMLOnEventElement.cpp \
+	Source/WebCore/wml/WMLOptGroupElement.cpp \
+	Source/WebCore/wml/WMLOptionElement.cpp \
+	Source/WebCore/wml/WMLPageState.cpp \
+	Source/WebCore/wml/WMLPElement.cpp \
+	Source/WebCore/wml/WMLPostfieldElement.cpp \
+	Source/WebCore/wml/WMLPrevElement.cpp \
+	Source/WebCore/wml/WMLRefreshElement.cpp \
+	Source/WebCore/wml/WMLSelectElement.cpp \
+	Source/WebCore/wml/WMLSetvarElement.cpp \
+	Source/WebCore/wml/WMLTableElement.cpp \
+	Source/WebCore/wml/WMLTaskElement.cpp \
+	Source/WebCore/wml/WMLTemplateElement.cpp \
+	Source/WebCore/wml/WMLTimerElement.cpp \
+	Source/WebCore/wml/WMLVariables.cpp \
+	Source/WebCore/workers/AbstractWorker.cpp \
+	Source/WebCore/workers/AbstractWorker.h \
+	Source/WebCore/workers/DedicatedWorkerContext.cpp \
+	Source/WebCore/workers/DedicatedWorkerContext.h \
+	Source/WebCore/workers/DedicatedWorkerThread.cpp \
+	Source/WebCore/workers/DedicatedWorkerThread.h \
+	Source/WebCore/workers/DefaultSharedWorkerRepository.cpp \
+	Source/WebCore/workers/DefaultSharedWorkerRepository.h \
+	Source/WebCore/workers/SharedWorkerContext.cpp \
+	Source/WebCore/workers/SharedWorkerContext.h \
+	Source/WebCore/workers/SharedWorker.cpp \
+	Source/WebCore/workers/SharedWorker.h \
+	Source/WebCore/workers/SharedWorkerRepository.h \
+	Source/WebCore/workers/SharedWorkerThread.cpp \
+	Source/WebCore/workers/SharedWorkerThread.h \
+	Source/WebCore/workers/WorkerContext.cpp \
+	Source/WebCore/workers/WorkerContext.h \
+	Source/WebCore/workers/WorkerContextProxy.h \
+	Source/WebCore/workers/Worker.cpp \
+	Source/WebCore/workers/Worker.h \
+	Source/WebCore/workers/WorkerLoaderProxy.h \
+	Source/WebCore/workers/WorkerLocation.cpp \
+	Source/WebCore/workers/WorkerLocation.h \
+	Source/WebCore/workers/WorkerMessagingProxy.cpp \
+	Source/WebCore/workers/WorkerMessagingProxy.h \
+	Source/WebCore/workers/WorkerObjectProxy.h \
+	Source/WebCore/workers/WorkerReportingProxy.h \
+	Source/WebCore/workers/WorkerRunLoop.cpp \
+	Source/WebCore/workers/WorkerRunLoop.h \
+	Source/WebCore/workers/WorkerScriptLoaderClient.h \
+	Source/WebCore/workers/WorkerScriptLoader.cpp \
+	Source/WebCore/workers/WorkerScriptLoader.h \
+	Source/WebCore/workers/WorkerThread.cpp \
+	Source/WebCore/workers/WorkerThread.h \
+	Source/WebCore/xml/DOMParser.cpp \
+	Source/WebCore/xml/DOMParser.h \
+	Source/WebCore/xml/NativeXPathNSResolver.cpp \
+	Source/WebCore/xml/NativeXPathNSResolver.h \
+	Source/WebCore/xml/XMLHttpRequest.cpp \
+	Source/WebCore/xml/XMLHttpRequestException.h \
+	Source/WebCore/xml/XMLHttpRequest.h \
+	Source/WebCore/xml/XMLHttpRequestProgressEvent.h \
+	Source/WebCore/xml/XMLHttpRequestProgressEventThrottle.cpp \
+	Source/WebCore/xml/XMLHttpRequestProgressEventThrottle.h \
+	Source/WebCore/xml/XMLHttpRequestUpload.cpp \
+	Source/WebCore/xml/XMLHttpRequestUpload.h \
+	Source/WebCore/xml/XMLTreeViewer.cpp \
+	Source/WebCore/xml/XMLTreeViewer.h \
+	Source/WebCore/xml/XMLSerializer.cpp \
+	Source/WebCore/xml/XMLSerializer.h \
+	Source/WebCore/xml/XPathEvaluator.cpp \
+	Source/WebCore/xml/XPathEvaluator.h \
+	Source/WebCore/xml/XPathException.h \
+	Source/WebCore/xml/XPathExpression.cpp \
+	Source/WebCore/xml/XPathExpression.h \
+	Source/WebCore/xml/XPathExpressionNode.cpp \
+	Source/WebCore/xml/XPathExpressionNode.h \
+	Source/WebCore/xml/XPathFunctions.cpp \
+	Source/WebCore/xml/XPathFunctions.h \
+	Source/WebCore/xml/XPathNamespace.cpp \
+	Source/WebCore/xml/XPathNamespace.h \
+	Source/WebCore/xml/XPathNodeSet.cpp \
+	Source/WebCore/xml/XPathNodeSet.h \
+	Source/WebCore/xml/XPathNSResolver.cpp \
+	Source/WebCore/xml/XPathNSResolver.h \
+	Source/WebCore/xml/XPathParser.cpp \
+	Source/WebCore/xml/XPathParser.h \
+	Source/WebCore/xml/XPathPath.cpp \
+	Source/WebCore/xml/XPathPath.h \
+	Source/WebCore/xml/XPathPredicate.cpp \
+	Source/WebCore/xml/XPathPredicate.h \
+	Source/WebCore/xml/XPathResult.cpp \
+	Source/WebCore/xml/XPathResult.h \
+	Source/WebCore/xml/XPathStep.cpp \
+	Source/WebCore/xml/XPathStep.h \
+	Source/WebCore/xml/XPathUtil.cpp \
+	Source/WebCore/xml/XPathUtil.h \
+	Source/WebCore/xml/XPathValue.cpp \
+	Source/WebCore/xml/XPathValue.h \
+	Source/WebCore/xml/XPathVariableReference.cpp \
+	Source/WebCore/xml/XPathVariableReference.h \
+	Source/WebCore/xml/XSLImportRule.cpp \
+	Source/WebCore/xml/XSLImportRule.h \
+	Source/WebCore/xml/XSLStyleSheet.h \
+	Source/WebCore/xml/XSLStyleSheetLibxslt.cpp \
+	Source/WebCore/xml/XSLTExtensions.cpp \
+	Source/WebCore/xml/XSLTExtensions.h \
+	Source/WebCore/xml/XSLTProcessor.cpp \
+	Source/WebCore/xml/XSLTProcessor.h \
+	Source/WebCore/xml/XSLTProcessorLibxslt.cpp \
+	Source/WebCore/xml/XSLTUnicodeSort.cpp \
+	Source/WebCore/xml/XSLTUnicodeSort.h
+
+webcoregtk_sources += \
+	Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp \
+	Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp \
+	Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.h \
+	Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp \
+	Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.h \
+	Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp \
+	Source/WebCore/bindings/js/ScriptControllerGtk.cpp \
+	Source/WebCore/page/gtk/DragControllerGtk.cpp \
+	Source/WebCore/page/gtk/EventHandlerGtk.cpp \
+	Source/WebCore/page/gtk/FrameGtk.cpp \
+	Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp \
+	Source/WebCore/platform/graphics/cairo/CairoUtilities.h \
+	Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/FloatRectCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/FontCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h \
+	Source/WebCore/platform/graphics/cairo/GradientCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h \
+	Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/ImageBufferData.h \
+	Source/WebCore/platform/graphics/cairo/ImageCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h \
+	Source/WebCore/platform/graphics/cairo/PathCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PatternCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h \
+	Source/WebCore/platform/graphics/cairo/PlatformPathCairo.h \
+	Source/WebCore/platform/graphics/cairo/PlatformPathCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/RefPtrCairo.h \
+	Source/WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
+	Source/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.cpp \
+	Source/WebCore/platform/graphics/gstreamer/GOwnPtrGStreamer.h \
+	Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp \
+	Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.h \
+	Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp \
+	Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h \
+	Source/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp \
+	Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h \
+	Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp \
+	Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h \
+	Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp \
+	Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h \
+	Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp \
+	Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.h \
+	Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp \
+	Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h \
+	Source/WebCore/platform/graphics/gtk/ColorGtk.cpp \
+	Source/WebCore/platform/graphics/gtk/FontGtk.cpp \
+	Source/WebCore/platform/graphics/gtk/GdkCairoUtilities.cpp \
+	Source/WebCore/platform/graphics/gtk/GdkCairoUtilities.h \
+	Source/WebCore/platform/graphics/gtk/IconGtk.cpp \
+	Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp \
+	Source/WebCore/platform/graphics/gtk/ImageGtk.cpp \
+	Source/WebCore/platform/graphics/gtk/IntPointGtk.cpp \
+	Source/WebCore/platform/graphics/gtk/IntRectGtk.cpp \
+	Source/WebCore/platform/gtk/ClipboardGtk.cpp \
+	Source/WebCore/platform/gtk/ClipboardGtk.h \
+	Source/WebCore/platform/gtk/ClipboardUtilitiesGtk.cpp \
+	Source/WebCore/platform/gtk/ClipboardUtilitiesGtk.h \
+	Source/WebCore/platform/gtk/ContextMenuGtk.cpp \
+	Source/WebCore/platform/gtk/ContextMenuItemGtk.cpp \
+	Source/WebCore/platform/gtk/CursorGtk.cpp \
+	Source/WebCore/platform/gtk/CursorGtk.h \
+	Source/WebCore/platform/gtk/DataObjectGtk.cpp \
+	Source/WebCore/platform/gtk/DataObjectGtk.h \
+	Source/WebCore/platform/gtk/DragDataGtk.cpp \
+	Source/WebCore/platform/gtk/DragImageGtk.cpp \
+	Source/WebCore/platform/gtk/EventLoopGtk.cpp \
+	Source/WebCore/platform/gtk/FileChooserGtk.cpp \
+	Source/WebCore/platform/gtk/FileSystemGtk.cpp \
+	Source/WebCore/platform/gtk/GeolocationServiceGtk.cpp \
+	Source/WebCore/platform/gtk/GeolocationServiceGtk.h \
+	Source/WebCore/platform/gtk/GOwnPtrGtk.cpp \
+	Source/WebCore/platform/gtk/GOwnPtrGtk.h \
+	Source/WebCore/platform/gtk/GRefPtrGtk.cpp \
+	Source/WebCore/platform/gtk/GRefPtrGtk.h \
+	Source/WebCore/platform/gtk/GtkPluginWidget.cpp \
+	Source/WebCore/platform/gtk/GtkPluginWidget.h \
+	Source/WebCore/platform/gtk/GtkVersioning.c \
+	Source/WebCore/platform/gtk/GtkVersioning.h \
+	Source/WebCore/platform/gtk/KURLGtk.cpp \
+	Source/WebCore/platform/gtk/LanguageGtk.cpp \
+	Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp \
+	Source/WebCore/platform/gtk/LoggingGtk.cpp \
+	Source/WebCore/platform/gtk/MainFrameScrollbarGtk.cpp \
+	Source/WebCore/platform/gtk/MainFrameScrollbarGtk.h \
+	Source/WebCore/platform/gtk/MIMETypeRegistryGtk.cpp \
+	Source/WebCore/platform/gtk/PasteboardGtk.cpp \
+	Source/WebCore/platform/gtk/PasteboardHelper.cpp \
+	Source/WebCore/platform/gtk/PasteboardHelper.h \
+	Source/WebCore/platform/gtk/PlatformKeyboardEventGtk.cpp \
+	Source/WebCore/platform/gtk/PlatformMouseEventGtk.cpp \
+	Source/WebCore/platform/gtk/PlatformScreenGtk.cpp \
+	Source/WebCore/platform/gtk/PlatformWheelEventGtk.cpp \
+	Source/WebCore/platform/gtk/PopupMenuGtk.cpp \
+	Source/WebCore/platform/gtk/PopupMenuGtk.h \
+	Source/WebCore/platform/gtk/RenderThemeGtk.cpp \
+	Source/WebCore/platform/gtk/RenderThemeGtk.h \
+	Source/WebCore/platform/gtk/RenderThemeGtk2.cpp \
+	Source/WebCore/platform/gtk/RenderThemeGtk3.cpp \
+	Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp \
+	Source/WebCore/platform/gtk/ScrollbarThemeGtk.h \
+	Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp \
+	Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp \
+	Source/WebCore/platform/gtk/ScrollViewGtk.cpp \
+	Source/WebCore/platform/gtk/SearchPopupMenuGtk.cpp \
+	Source/WebCore/platform/gtk/SearchPopupMenuGtk.h \
+	Source/WebCore/platform/gtk/SharedBufferGtk.cpp \
+	Source/WebCore/platform/gtk/SharedTimerGtk.cpp \
+	Source/WebCore/platform/gtk/SoundGtk.cpp \
+	Source/WebCore/platform/gtk/TemporaryLinkStubs.cpp \
+	Source/WebCore/platform/gtk/WidgetGtk.cpp \
+	Source/WebCore/platform/gtk/WidgetRenderingContext.cpp \
+	Source/WebCore/platform/gtk/WidgetRenderingContext.h \
+	Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.h \
+	Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp \
+	Source/WebCore/platform/image-decoders/bmp/BMPImageReader.h \
+	Source/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp \
+	Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.h \
+	Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp \
+	Source/WebCore/platform/image-decoders/gif/GIFImageReader.h \
+	Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.h \
+	Source/WebCore/platform/image-decoders/ImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/ImageDecoder.h \
+	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h \
+	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h \
+	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h \
+	Source/WebCore/platform/network/soup/AuthenticationChallenge.h \
+	Source/WebCore/platform/network/soup/CookieJarSoup.cpp \
+	Source/WebCore/platform/network/soup/CookieJarSoup.h \
+	Source/WebCore/platform/network/soup/GOwnPtrSoup.cpp \
+	Source/WebCore/platform/network/soup/GOwnPtrSoup.h \
+	Source/WebCore/platform/network/soup/ProxyServerSoup.cpp \
+	Source/WebCore/platform/network/soup/ResourceError.h \
+	Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp \
+	Source/WebCore/platform/network/soup/ResourceRequest.h \
+	Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp \
+	Source/WebCore/platform/network/soup/ResourceResponse.h \
+	Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp \
+	Source/WebCore/platform/network/soup/SocketStreamError.h \
+	Source/WebCore/platform/network/soup/SocketStreamHandle.h \
+	Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp \
+	Source/WebCore/platform/network/soup/SoupURIUtils.cpp \
+	Source/WebCore/platform/network/soup/SoupURIUtils.h \
+	Source/WebCore/plugins/gtk/PluginDataGtk.cpp \
+	Source/WebCore/plugins/gtk/PluginPackageGtk.cpp \
+	Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+
+if TARGET_X11
+webcoregtk_sources += \
+	Source/WebCore/plugins/gtk/gtk2xtbin.c \
+	Source/WebCore/plugins/gtk/gtk2xtbin.h \
+	Source/WebCore/plugins/gtk/xembed.h
+endif
+
+if TARGET_WIN32
+webcore_sources += \
+	Source/WebCore/platform/ScrollAnimatorWin.cpp \
+	Source/WebCore/platform/ScrollAnimatorWin.h \
+	Source/WebCore/platform/win/SystemInfo.cpp \
+	Source/WebCore/platform/win/SystemInfo.h \
+	Source/WebCore/plugins/win/PluginDatabaseWin.cpp \
+	Source/WebCore/plugins/win/PluginMessageThrottlerWin.cpp \
+	Source/WebCore/plugins/win/PluginMessageThrottlerWin.h
+endif
+
+# ----
+# icu unicode backend
+# ----
+if USE_ICU_UNICODE
+webcoregtk_sources += \
+	Source/WebCore/platform/text/TextCodecICU.cpp \
+	Source/WebCore/platform/text/TextCodecICU.h \
+	Source/WebCore/platform/text/TextBreakIteratorICU.cpp \
+	Source/WebCore/platform/text/TextBreakIteratorInternalICU.h \
+	Source/WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
+endif
+
+# ----
+# glib unicode backend
+# ----
+if USE_GLIB_UNICODE
+webcoregtk_sources += \
+	Source/WebCore/platform/text/gtk/TextCodecGtk.cpp \
+	Source/WebCore/platform/text/gtk/TextCodecGtk.h \
+	Source/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
+endif
+
+# ---
+# FreeType font backend
+# ---
+if USE_FREETYPE
+webcoregtk_sources += \
+	Source/WebCore/platform/graphics/freetype/FontCacheFreeType.cpp \
+	Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp \
+	Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp \
+	Source/WebCore/platform/graphics/freetype/FontPlatformData.h \
+	Source/WebCore/platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp \
+	Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
+endif # END USE_FREETYPE
+
+# ---
+# Pango font backend
+# ---
+if USE_PANGO
+webcoregtk_sources += \
+	Source/WebCore/platform/graphics/pango/FontCachePango.cpp \
+	Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp \
+	Source/WebCore/platform/graphics/pango/FontPlatformDataPango.cpp \
+	Source/WebCore/platform/graphics/pango/FontPlatformData.h \
+	Source/WebCore/platform/graphics/pango/GlyphPageTreeNodePango.cpp \
+	Source/WebCore/platform/graphics/pango/SimpleFontDataPango.cpp
+endif # END USE_PANGO
+
+# ----
+# Offline Web Applications
+# ----
+if ENABLE_OFFLINE_WEB_APPLICATIONS
+webcore_built_sources += \
+	DerivedSources/WebCore/JSDOMApplicationCache.cpp
+endif # END ENABLE_OFFLINE_WEB_APPLICATIONS
+
+# ----
+# Database Support
+# ----
+if ENABLE_DATABASE
+webcore_built_sources += \
+	DerivedSources/WebCore/JSDatabase.cpp \
+	DerivedSources/WebCore/JSDatabase.h \
+	DerivedSources/WebCore/JSDatabaseCallback.cpp \
+	DerivedSources/WebCore/JSDatabaseCallback.h \
+	DerivedSources/WebCore/JSDatabaseSync.cpp \
+	DerivedSources/WebCore/JSDatabaseSync.h \
+	DerivedSources/WebCore/JSSQLError.cpp \
+	DerivedSources/WebCore/JSSQLError.h \
+	DerivedSources/WebCore/JSSQLException.cpp \
+	DerivedSources/WebCore/JSSQLResultSet.cpp \
+	DerivedSources/WebCore/JSSQLResultSet.h \
+	DerivedSources/WebCore/JSSQLResultSetRowList.cpp \
+	DerivedSources/WebCore/JSSQLStatementCallback.cpp \
+	DerivedSources/WebCore/JSSQLStatementCallback.h \
+	DerivedSources/WebCore/JSSQLStatementErrorCallback.h \
+	DerivedSources/WebCore/JSSQLTransaction.cpp \
+	DerivedSources/WebCore/JSSQLTransactionCallback.cpp \
+	DerivedSources/WebCore/JSSQLTransactionCallback.h \
+	DerivedSources/WebCore/JSSQLTransactionErrorCallback.cpp \
+	DerivedSources/WebCore/JSSQLTransactionErrorCallback.h \
+	DerivedSources/WebCore/JSSQLTransactionSync.cpp \
+	DerivedSources/WebCore/JSSQLTransactionSyncCallback.cpp \
+	DerivedSources/WebCore/JSSQLTransactionSyncCallback.h
+endif # END ENABLE_DATABASE
+
+# ----
+# HTML5 data transfer items support
+# ----
+if ENABLE_DATA_TRANSFER_ITEMS
+webcore_built_sources += \
+	DerivedSources/WebCore/JSDataTransferItem.cpp \
+	DerivedSources/WebCore/JSDataTransferItem.h \
+	DerivedSources/WebCore/JSDataTransferItems.cpp \
+	DerivedSources/WebCore/JSDataTransferItems.h \
+	DerivedSources/WebCore/JSStringCallback.cpp \
+	DerivedSources/WebCore/JSStringCallback.h
+webcore_sources += \
+	Source/WebCore/dom/DataTransferItem.cpp \
+	Source/WebCore/dom/DataTransferItem.h \
+	Source/WebCore/dom/DataTransferItems.h \
+	Source/WebCore/dom/StringCallback.cpp \
+	Source/WebCore/dom/StringCallback.h
+endif # END ENABLE_DATA_TRANSFER_ITEMS
+
+# ----
+# Indexed Database API support
+# ----
+if ENABLE_INDEXED_DATABASE
+webcore_built_sources += \
+	DerivedSources/WebCore/JSIDBAny.cpp \
+	DerivedSources/WebCore/JSIDBAny.h \
+	DerivedSources/WebCore/JSIDBDatabaseError.cpp \
+	DerivedSources/WebCore/JSIDBDatabaseError.h \
+	DerivedSources/WebCore/JSIDBDatabaseException.cpp \
+	DerivedSources/WebCore/JSIDBDatabaseException.h \
+	DerivedSources/WebCore/JSIDBDatabase.cpp \
+	DerivedSources/WebCore/JSIDBDatabase.h \
+	DerivedSources/WebCore/JSIDBFactory.cpp \
+	DerivedSources/WebCore/JSIDBFactory.h \
+	DerivedSources/WebCore/JSIDBIndex.cpp \
+	DerivedSources/WebCore/JSIDBIndex.h \
+	DerivedSources/WebCore/JSIDBKeyRange.cpp \
+	DerivedSources/WebCore/JSIDBKeyRange.h \
+	DerivedSources/WebCore/JSIDBObjectStore.cpp \
+	DerivedSources/WebCore/JSIDBObjectStore.h \
+	DerivedSources/WebCore/JSIDBRequest.cpp \
+	DerivedSources/WebCore/JSIDBRequest.h \
+	DerivedSources/WebCore/JSIDBTransaction.cpp \
+	DerivedSources/WebCore/JSIDBTransaction.h
+endif # END ENABLE_INDEXED_DATABASE
+
+# ----
+# HTML5 client-side session and persistent storage
+# ----
+if ENABLE_DOM_STORAGE
+webcore_built_sources += \
+	DerivedSources/WebCore/JSStorage.cpp \
+	DerivedSources/WebCore/JSStorageEvent.cpp \
+	DerivedSources/WebCore/JSStorageEvent.h
+endif # END ENABLE_DOM_STORAGE
+
+# ----
+# FileSystem API support
+# ----
+if ENABLE_FILE_SYSTEM
+webcore_built_sources += \
+	DerivedSources/WebCore/JSDirectoryEntry.cpp \
+	DerivedSources/WebCore/JSDirectoryEntry.h \
+	DerivedSources/WebCore/JSDirectoryEntrySync.cpp \
+	DerivedSources/WebCore/JSDirectoryEntrySync.h \
+	DerivedSources/WebCore/JSDirectoryReader.cpp \
+	DerivedSources/WebCore/JSDirectoryReader.h \
+	DerivedSources/WebCore/JSDirectoryReaderSync.cpp \
+	DerivedSources/WebCore/JSDirectoryReaderSync.h \
+	DerivedSources/WebCore/JSDOMFileSystem.cpp \
+	DerivedSources/WebCore/JSDOMFileSystem.h \
+	DerivedSources/WebCore/JSDOMFileSystemSync.cpp \
+	DerivedSources/WebCore/JSDOMFileSystemSync.h \
+	DerivedSources/WebCore/JSEntriesCallback.cpp \
+	DerivedSources/WebCore/JSEntriesCallback.h \
+	DerivedSources/WebCore/JSEntry.cpp \
+	DerivedSources/WebCore/JSEntry.h \
+	DerivedSources/WebCore/JSEntryArray.cpp \
+	DerivedSources/WebCore/JSEntryArray.h \
+	DerivedSources/WebCore/JSEntryArraySync.cpp \
+	DerivedSources/WebCore/JSEntryArraySync.h \
+	DerivedSources/WebCore/JSEntryCallback.cpp \
+	DerivedSources/WebCore/JSEntryCallback.h \
+	DerivedSources/WebCore/JSEntrySync.cpp \
+	DerivedSources/WebCore/JSEntrySync.h \
+	DerivedSources/WebCore/JSErrorCallback.cpp \
+	DerivedSources/WebCore/JSErrorCallback.h \
+	DerivedSources/WebCore/JSFileCallback.cpp \
+	DerivedSources/WebCore/JSFileCallback.h \
+	DerivedSources/WebCore/JSFileEntry.cpp \
+	DerivedSources/WebCore/JSFileEntry.h \
+	DerivedSources/WebCore/JSFileEntrySync.cpp \
+	DerivedSources/WebCore/JSFileEntrySync.h \
+	DerivedSources/WebCore/JSFileSystemCallback.cpp \
+	DerivedSources/WebCore/JSFileSystemCallback.h \
+	DerivedSources/WebCore/JSFileWriter.cpp \
+	DerivedSources/WebCore/JSFileWriter.h \
+	DerivedSources/WebCore/JSFileWriterCallback.cpp \
+	DerivedSources/WebCore/JSFileWriterCallback.h \
+	DerivedSources/WebCore/JSFileWriterSync.cpp \
+	DerivedSources/WebCore/JSFileWriterSync.h \
+	DerivedSources/WebCore/JSWebKitFlags.cpp \
+	DerivedSources/WebCore/JSWebKitFlags.h \
+	DerivedSources/WebCore/JSMetadata.cpp \
+	DerivedSources/WebCore/JSMetadata.h \
+	DerivedSources/WebCore/JSMetadataCallback.cpp \
+	DerivedSources/WebCore/JSMetadataCallback.h
+endif # END ENABLE_FILE_SYSTEM
+
+# ----
+# XPath Support
+# ----
+if ENABLE_XPATH
+webcore_built_sources += \
+	DerivedSources/WebCore/JSXPathEvaluator.cpp \
+	DerivedSources/WebCore/JSXPathEvaluator.h \
+	DerivedSources/WebCore/JSXPathException.cpp \
+	DerivedSources/WebCore/JSXPathException.h \
+	DerivedSources/WebCore/JSXPathExpression.cpp \
+	DerivedSources/WebCore/JSXPathExpression.h \
+	DerivedSources/WebCore/JSXPathNSResolver.cpp \
+	DerivedSources/WebCore/JSXPathNSResolver.h \
+	DerivedSources/WebCore/JSXPathResult.cpp \
+	DerivedSources/WebCore/JSXPathResult.h \
+	DerivedSources/WebCore/XPathGrammar.cpp \
+	DerivedSources/WebCore/XPathGrammar.h
+endif # END ENABLE_XPATH
+
+# ----
+# WML Support
+# ----
+if ENABLE_WML
+webcore_built_sources += \
+	DerivedSources/WebCore/WMLElementFactory.cpp \
+	DerivedSources/WebCore/WMLNames.cpp
+endif # END ENABLE_WML
+
+# ----
+# SVG Support
+#
+# FIXME: allow a more fine-grained inclusion/generation of sources per SVG feature
+# ----
+if ENABLE_SVG
+webcore_built_sources += \
+	DerivedSources/WebCore/JSElementTimeControl.h \
+	DerivedSources/WebCore/JSSVGAElement.cpp \
+	DerivedSources/WebCore/JSSVGAElement.h \
+	DerivedSources/WebCore/JSSVGAltGlyphElement.cpp \
+	DerivedSources/WebCore/JSSVGAltGlyphElement.h \
+	DerivedSources/WebCore/JSSVGAngle.cpp \
+	DerivedSources/WebCore/JSSVGAngle.h \
+	DerivedSources/WebCore/JSSVGAnimateColorElement.cpp \
+	DerivedSources/WebCore/JSSVGAnimateColorElement.h \
+	DerivedSources/WebCore/JSSVGAnimatedAngle.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedAngle.h \
+	DerivedSources/WebCore/JSSVGAnimatedBoolean.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedBoolean.h \
+	DerivedSources/WebCore/JSSVGAnimatedEnumeration.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedEnumeration.h \
+	DerivedSources/WebCore/JSSVGAnimatedInteger.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedInteger.h \
+	DerivedSources/WebCore/JSSVGAnimatedLength.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedLength.h \
+	DerivedSources/WebCore/JSSVGAnimatedLengthList.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedLengthList.h \
+	DerivedSources/WebCore/JSSVGAnimatedNumber.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedNumber.h \
+	DerivedSources/WebCore/JSSVGAnimatedNumberList.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedNumberList.h \
+	DerivedSources/WebCore/JSSVGAnimatedPreserveAspectRatio.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedPreserveAspectRatio.h \
+	DerivedSources/WebCore/JSSVGAnimatedRect.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedRect.h \
+	DerivedSources/WebCore/JSSVGAnimatedString.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedString.h \
+	DerivedSources/WebCore/JSSVGAnimatedTransformList.cpp \
+	DerivedSources/WebCore/JSSVGAnimatedTransformList.h \
+	DerivedSources/WebCore/JSSVGAnimateElement.cpp \
+	DerivedSources/WebCore/JSSVGAnimateElement.h \
+	DerivedSources/WebCore/JSSVGAnimateTransformElement.cpp \
+	DerivedSources/WebCore/JSSVGAnimateTransformElement.h \
+	DerivedSources/WebCore/JSSVGAnimationElement.cpp \
+	DerivedSources/WebCore/JSSVGAnimationElement.h \
+	DerivedSources/WebCore/JSSVGCircleElement.cpp \
+	DerivedSources/WebCore/JSSVGCircleElement.h \
+	DerivedSources/WebCore/JSSVGClipPathElement.cpp \
+	DerivedSources/WebCore/JSSVGClipPathElement.h \
+	DerivedSources/WebCore/JSSVGColor.cpp \
+	DerivedSources/WebCore/JSSVGColor.h \
+	DerivedSources/WebCore/JSSVGComponentTransferFunctionElement.cpp \
+	DerivedSources/WebCore/JSSVGComponentTransferFunctionElement.h \
+	DerivedSources/WebCore/JSSVGCursorElement.cpp \
+	DerivedSources/WebCore/JSSVGCursorElement.h \
+	DerivedSources/WebCore/JSSVGDefsElement.cpp \
+	DerivedSources/WebCore/JSSVGDefsElement.h \
+	DerivedSources/WebCore/JSSVGDescElement.cpp \
+	DerivedSources/WebCore/JSSVGDescElement.h \
+	DerivedSources/WebCore/JSSVGDocument.cpp \
+	DerivedSources/WebCore/JSSVGDocument.h \
+	DerivedSources/WebCore/JSSVGElement.cpp \
+	DerivedSources/WebCore/JSSVGElement.h \
+	DerivedSources/WebCore/JSSVGElementInstance.cpp \
+	DerivedSources/WebCore/JSSVGElementInstanceList.cpp \
+	DerivedSources/WebCore/JSSVGElementInstanceList.h \
+	DerivedSources/WebCore/JSSVGEllipseElement.cpp \
+	DerivedSources/WebCore/JSSVGEllipseElement.h \
+	DerivedSources/WebCore/JSSVGException.cpp \
+	DerivedSources/WebCore/JSSVGException.h \
+	DerivedSources/WebCore/JSSVGExternalResourcesRequired.h \
+	DerivedSources/WebCore/JSSVGFEBlendElement.cpp \
+	DerivedSources/WebCore/JSSVGFEBlendElement.h \
+	DerivedSources/WebCore/JSSVGFEColorMatrixElement.cpp \
+	DerivedSources/WebCore/JSSVGFEColorMatrixElement.h \
+	DerivedSources/WebCore/JSSVGFEComponentTransferElement.cpp \
+	DerivedSources/WebCore/JSSVGFEComponentTransferElement.h \
+	DerivedSources/WebCore/JSSVGFECompositeElement.cpp \
+	DerivedSources/WebCore/JSSVGFECompositeElement.h \
+	DerivedSources/WebCore/JSSVGFEConvolveMatrixElement.cpp \
+	DerivedSources/WebCore/JSSVGFEConvolveMatrixElement.h \
+	DerivedSources/WebCore/JSSVGFEDiffuseLightingElement.cpp \
+	DerivedSources/WebCore/JSSVGFEDiffuseLightingElement.h \
+	DerivedSources/WebCore/JSSVGFEDisplacementMapElement.cpp \
+	DerivedSources/WebCore/JSSVGFEDisplacementMapElement.h \
+	DerivedSources/WebCore/JSSVGFEDistantLightElement.cpp \
+	DerivedSources/WebCore/JSSVGFEDistantLightElement.h \
+	DerivedSources/WebCore/JSSVGFEFloodElement.cpp \
+	DerivedSources/WebCore/JSSVGFEFloodElement.h \
+	DerivedSources/WebCore/JSSVGFEFuncAElement.cpp \
+	DerivedSources/WebCore/JSSVGFEFuncAElement.h \
+	DerivedSources/WebCore/JSSVGFEFuncBElement.cpp \
+	DerivedSources/WebCore/JSSVGFEFuncBElement.h \
+	DerivedSources/WebCore/JSSVGFEFuncGElement.cpp \
+	DerivedSources/WebCore/JSSVGFEFuncGElement.h \
+	DerivedSources/WebCore/JSSVGFEFuncRElement.cpp \
+	DerivedSources/WebCore/JSSVGFEFuncRElement.h \
+	DerivedSources/WebCore/JSSVGFEGaussianBlurElement.cpp \
+	DerivedSources/WebCore/JSSVGFEGaussianBlurElement.h \
+	DerivedSources/WebCore/JSSVGFEImageElement.cpp \
+	DerivedSources/WebCore/JSSVGFEImageElement.h \
+	DerivedSources/WebCore/JSSVGFEMergeElement.cpp \
+	DerivedSources/WebCore/JSSVGFEMergeElement.h \
+	DerivedSources/WebCore/JSSVGFEMergeNodeElement.cpp \
+	DerivedSources/WebCore/JSSVGFEMergeNodeElement.h \
+	DerivedSources/WebCore/JSSVGFEMorphologyElement.cpp \
+	DerivedSources/WebCore/JSSVGFEMorphologyElement.h \
+	DerivedSources/WebCore/JSSVGFEOffsetElement.cpp \
+	DerivedSources/WebCore/JSSVGFEOffsetElement.h \
+	DerivedSources/WebCore/JSSVGFEPointLightElement.cpp \
+	DerivedSources/WebCore/JSSVGFEPointLightElement.h \
+	DerivedSources/WebCore/JSSVGFESpecularLightingElement.cpp \
+	DerivedSources/WebCore/JSSVGFESpecularLightingElement.h \
+	DerivedSources/WebCore/JSSVGFESpotLightElement.cpp \
+	DerivedSources/WebCore/JSSVGFESpotLightElement.h \
+	DerivedSources/WebCore/JSSVGFETileElement.cpp \
+	DerivedSources/WebCore/JSSVGFETileElement.h \
+	DerivedSources/WebCore/JSSVGFETurbulenceElement.cpp \
+	DerivedSources/WebCore/JSSVGFETurbulenceElement.h \
+	DerivedSources/WebCore/JSSVGFilterElement.cpp \
+	DerivedSources/WebCore/JSSVGFilterElement.h \
+	DerivedSources/WebCore/JSSVGFilterPrimitiveStandardAttributes.h \
+	DerivedSources/WebCore/JSSVGFitToViewBox.h \
+	DerivedSources/WebCore/JSSVGFontElement.cpp \
+	DerivedSources/WebCore/JSSVGFontElement.h \
+	DerivedSources/WebCore/JSSVGFontFaceElement.cpp \
+	DerivedSources/WebCore/JSSVGFontFaceElement.h \
+	DerivedSources/WebCore/JSSVGFontFaceFormatElement.cpp \
+	DerivedSources/WebCore/JSSVGFontFaceFormatElement.h \
+	DerivedSources/WebCore/JSSVGFontFaceNameElement.cpp \
+	DerivedSources/WebCore/JSSVGFontFaceNameElement.h \
+	DerivedSources/WebCore/JSSVGFontFaceSrcElement.cpp \
+	DerivedSources/WebCore/JSSVGFontFaceSrcElement.h \
+	DerivedSources/WebCore/JSSVGFontFaceUriElement.cpp \
+	DerivedSources/WebCore/JSSVGFontFaceUriElement.h \
+	DerivedSources/WebCore/JSSVGForeignObjectElement.cpp \
+	DerivedSources/WebCore/JSSVGForeignObjectElement.h \
+	DerivedSources/WebCore/JSSVGGElement.cpp \
+	DerivedSources/WebCore/JSSVGGElement.h \
+	DerivedSources/WebCore/JSSVGGlyphElement.cpp \
+	DerivedSources/WebCore/JSSVGGlyphElement.h \
+	DerivedSources/WebCore/JSSVGGradientElement.cpp \
+	DerivedSources/WebCore/JSSVGGradientElement.h \
+	DerivedSources/WebCore/JSSVGHKernElement.cpp \
+	DerivedSources/WebCore/JSSVGHKernElement.h \
+	DerivedSources/WebCore/JSSVGImageElement.cpp \
+	DerivedSources/WebCore/JSSVGImageElement.h \
+	DerivedSources/WebCore/JSSVGLangSpace.h \
+	DerivedSources/WebCore/JSSVGLength.cpp \
+	DerivedSources/WebCore/JSSVGLength.h \
+	DerivedSources/WebCore/JSSVGLengthList.cpp \
+	DerivedSources/WebCore/JSSVGLengthList.h \
+	DerivedSources/WebCore/JSSVGLinearGradientElement.cpp \
+	DerivedSources/WebCore/JSSVGLinearGradientElement.h \
+	DerivedSources/WebCore/JSSVGLineElement.cpp \
+	DerivedSources/WebCore/JSSVGLineElement.h \
+	DerivedSources/WebCore/JSSVGLocatable.h \
+	DerivedSources/WebCore/JSSVGMarkerElement.cpp \
+	DerivedSources/WebCore/JSSVGMarkerElement.h \
+	DerivedSources/WebCore/JSSVGMaskElement.cpp \
+	DerivedSources/WebCore/JSSVGMaskElement.h \
+	DerivedSources/WebCore/JSSVGMatrix.cpp \
+	DerivedSources/WebCore/JSSVGMatrix.h \
+	DerivedSources/WebCore/JSSVGMetadataElement.cpp \
+	DerivedSources/WebCore/JSSVGMetadataElement.h \
+	DerivedSources/WebCore/JSSVGMissingGlyphElement.cpp \
+	DerivedSources/WebCore/JSSVGMissingGlyphElement.h \
+	DerivedSources/WebCore/JSSVGNumber.cpp \
+	DerivedSources/WebCore/JSSVGNumber.h \
+	DerivedSources/WebCore/JSSVGNumberList.cpp \
+	DerivedSources/WebCore/JSSVGNumberList.h \
+	DerivedSources/WebCore/JSSVGPaint.cpp \
+	DerivedSources/WebCore/JSSVGPaint.h \
+	DerivedSources/WebCore/JSSVGPathElement.cpp \
+	DerivedSources/WebCore/JSSVGPathElement.h \
+	DerivedSources/WebCore/JSSVGPathSegArcAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegArcAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegArcRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegArcRel.h \
+	DerivedSources/WebCore/JSSVGPathSegClosePath.cpp \
+	DerivedSources/WebCore/JSSVGPathSegClosePath.h \
+	DerivedSources/WebCore/JSSVGPathSeg.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicRel.h \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicSmoothAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicSmoothAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicSmoothRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoCubicSmoothRel.h \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticRel.h \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticSmoothAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegCurvetoQuadraticSmoothRel.h \
+	DerivedSources/WebCore/JSSVGPathSeg.h \
+	DerivedSources/WebCore/JSSVGPathSegLinetoAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegLinetoAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegLinetoHorizontalAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegLinetoHorizontalAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegLinetoHorizontalRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegLinetoHorizontalRel.h \
+	DerivedSources/WebCore/JSSVGPathSegLinetoRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegLinetoRel.h \
+	DerivedSources/WebCore/JSSVGPathSegLinetoVerticalAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegLinetoVerticalAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegLinetoVerticalRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegLinetoVerticalRel.h \
+	DerivedSources/WebCore/JSSVGPathSegList.cpp \
+	DerivedSources/WebCore/JSSVGPathSegList.h \
+	DerivedSources/WebCore/JSSVGPathSegMovetoAbs.cpp \
+	DerivedSources/WebCore/JSSVGPathSegMovetoAbs.h \
+	DerivedSources/WebCore/JSSVGPathSegMovetoRel.cpp \
+	DerivedSources/WebCore/JSSVGPathSegMovetoRel.h \
+	DerivedSources/WebCore/JSSVGPatternElement.cpp \
+	DerivedSources/WebCore/JSSVGPatternElement.h \
+	DerivedSources/WebCore/JSSVGPoint.cpp \
+	DerivedSources/WebCore/JSSVGPoint.h \
+	DerivedSources/WebCore/JSSVGPointList.cpp \
+	DerivedSources/WebCore/JSSVGPointList.h \
+	DerivedSources/WebCore/JSSVGPolygonElement.cpp \
+	DerivedSources/WebCore/JSSVGPolygonElement.h \
+	DerivedSources/WebCore/JSSVGPolylineElement.cpp \
+	DerivedSources/WebCore/JSSVGPolylineElement.h \
+	DerivedSources/WebCore/JSSVGPreserveAspectRatio.cpp \
+	DerivedSources/WebCore/JSSVGPreserveAspectRatio.h \
+	DerivedSources/WebCore/JSSVGRadialGradientElement.cpp \
+	DerivedSources/WebCore/JSSVGRadialGradientElement.h \
+	DerivedSources/WebCore/JSSVGRect.cpp \
+	DerivedSources/WebCore/JSSVGRectElement.cpp \
+	DerivedSources/WebCore/JSSVGRectElement.h \
+	DerivedSources/WebCore/JSSVGRect.h \
+	DerivedSources/WebCore/JSSVGRenderingIntent.cpp \
+	DerivedSources/WebCore/JSSVGRenderingIntent.h \
+	DerivedSources/WebCore/JSSVGScriptElement.cpp \
+	DerivedSources/WebCore/JSSVGScriptElement.h \
+	DerivedSources/WebCore/JSSVGSetElement.cpp \
+	DerivedSources/WebCore/JSSVGSetElement.h \
+	DerivedSources/WebCore/JSSVGStopElement.cpp \
+	DerivedSources/WebCore/JSSVGStopElement.h \
+	DerivedSources/WebCore/JSSVGStringList.cpp \
+	DerivedSources/WebCore/JSSVGStringList.h \
+	DerivedSources/WebCore/JSSVGStylable.h \
+	DerivedSources/WebCore/JSSVGStyleElement.cpp \
+	DerivedSources/WebCore/JSSVGStyleElement.h \
+	DerivedSources/WebCore/JSSVGSVGElement.cpp \
+	DerivedSources/WebCore/JSSVGSVGElement.h \
+	DerivedSources/WebCore/JSSVGSwitchElement.cpp \
+	DerivedSources/WebCore/JSSVGSwitchElement.h \
+	DerivedSources/WebCore/JSSVGSymbolElement.cpp \
+	DerivedSources/WebCore/JSSVGSymbolElement.h \
+	DerivedSources/WebCore/JSSVGTests.h \
+	DerivedSources/WebCore/JSSVGTextContentElement.cpp \
+	DerivedSources/WebCore/JSSVGTextContentElement.h \
+	DerivedSources/WebCore/JSSVGTextElement.cpp \
+	DerivedSources/WebCore/JSSVGTextElement.h \
+	DerivedSources/WebCore/JSSVGTextPathElement.cpp \
+	DerivedSources/WebCore/JSSVGTextPathElement.h \
+	DerivedSources/WebCore/JSSVGTextPositioningElement.cpp \
+	DerivedSources/WebCore/JSSVGTextPositioningElement.h \
+	DerivedSources/WebCore/JSSVGTitleElement.cpp \
+	DerivedSources/WebCore/JSSVGTitleElement.h \
+	DerivedSources/WebCore/JSSVGTransformable.h \
+	DerivedSources/WebCore/JSSVGTransform.cpp \
+	DerivedSources/WebCore/JSSVGTransform.h \
+	DerivedSources/WebCore/JSSVGTransformList.cpp \
+	DerivedSources/WebCore/JSSVGTransformList.h \
+	DerivedSources/WebCore/JSSVGTRefElement.cpp \
+	DerivedSources/WebCore/JSSVGTRefElement.h \
+	DerivedSources/WebCore/JSSVGTSpanElement.cpp \
+	DerivedSources/WebCore/JSSVGTSpanElement.h \
+	DerivedSources/WebCore/JSSVGUnitTypes.cpp \
+	DerivedSources/WebCore/JSSVGUnitTypes.h \
+	DerivedSources/WebCore/JSSVGURIReference.h \
+	DerivedSources/WebCore/JSSVGUseElement.cpp \
+	DerivedSources/WebCore/JSSVGUseElement.h \
+	DerivedSources/WebCore/JSSVGViewElement.cpp \
+	DerivedSources/WebCore/JSSVGViewElement.h \
+	DerivedSources/WebCore/JSSVGViewSpec.h \
+	DerivedSources/WebCore/JSSVGVKernElement.cpp \
+	DerivedSources/WebCore/JSSVGVKernElement.h \
+	DerivedSources/WebCore/JSSVGZoomAndPan.h \
+	DerivedSources/WebCore/JSSVGZoomEvent.cpp \
+	DerivedSources/WebCore/JSSVGZoomEvent.h
+endif # END ENABLE_SVG
+
+# ----
+# Web Audio Support
+# ----
+if ENABLE_WEB_AUDIO
+webcore_sources += \
+	Source/WebCore/webaudio/AudioBasicProcessorNode.cpp \
+	Source/WebCore/webaudio/AudioBasicProcessorNode.h \
+	Source/WebCore/webaudio/AudioBuffer.cpp \
+	Source/WebCore/webaudio/AudioBuffer.h \
+	Source/WebCore/webaudio/AudioBufferSourceNode.cpp \
+	Source/WebCore/webaudio/AudioBufferSourceNode.h \
+	Source/WebCore/webaudio/AudioChannelMerger.cpp \
+	Source/WebCore/webaudio/AudioChannelMerger.h \
+	Source/WebCore/webaudio/AudioChannelSplitter.cpp \
+	Source/WebCore/webaudio/AudioChannelSplitter.h \
+	Source/WebCore/webaudio/AudioContext.cpp \
+	Source/WebCore/webaudio/AudioContext.h \
+	Source/WebCore/webaudio/AudioDestinationNode.cpp \
+	Source/WebCore/webaudio/AudioDestinationNode.h \
+	Source/WebCore/webaudio/AudioGain.h \
+	Source/WebCore/webaudio/AudioGainNode.cpp \
+	Source/WebCore/webaudio/AudioGainNode.h \
+	Source/WebCore/webaudio/AudioListener.cpp \
+	Source/WebCore/webaudio/AudioListener.h \
+	Source/WebCore/webaudio/AudioNode.cpp \
+	Source/WebCore/webaudio/AudioNode.h \
+	Source/WebCore/webaudio/AudioNodeInput.cpp \
+	Source/WebCore/webaudio/AudioNodeInput.h \
+	Source/WebCore/webaudio/AudioNodeOutput.cpp \
+	Source/WebCore/webaudio/AudioNodeOutput.h \
+	Source/WebCore/webaudio/AudioPannerNode.cpp \
+	Source/WebCore/webaudio/AudioPannerNode.h \
+	Source/WebCore/webaudio/AudioParam.cpp \
+	Source/WebCore/webaudio/AudioParam.h \
+	Source/WebCore/webaudio/AudioProcessingEvent.cpp \
+	Source/WebCore/webaudio/AudioProcessingEvent.h \
+	Source/WebCore/webaudio/AudioSourceNode.h \
+	Source/WebCore/webaudio/BiquadDSPKernel.cpp \
+	Source/WebCore/webaudio/BiquadDSPKernel.h \
+	Source/WebCore/webaudio/BiquadProcessor.cpp \
+	Source/WebCore/webaudio/BiquadProcessor.h \
+	Source/WebCore/webaudio/ConvolverNode.cpp \
+	Source/WebCore/webaudio/ConvolverNode.h \
+	Source/WebCore/webaudio/DelayDSPKernel.cpp \
+	Source/WebCore/webaudio/DelayDSPKernel.h \
+	Source/WebCore/webaudio/DelayNode.cpp \
+	Source/WebCore/webaudio/DelayNode.h \
+	Source/WebCore/webaudio/DelayProcessor.cpp \
+	Source/WebCore/webaudio/DelayProcessor.h \
+	Source/WebCore/webaudio/HighPass2FilterNode.cpp \
+	Source/WebCore/webaudio/HighPass2FilterNode.h \
+	Source/WebCore/webaudio/JavaScriptAudioNode.cpp \
+	Source/WebCore/webaudio/JavaScriptAudioNode.h \
+	Source/WebCore/webaudio/LowPass2FilterNode.cpp \
+	Source/WebCore/webaudio/LowPass2FilterNode.h \
+	Source/WebCore/webaudio/RealtimeAnalyser.cpp \
+	Source/WebCore/webaudio/RealtimeAnalyser.h \
+	Source/WebCore/webaudio/RealtimeAnalyserNode.cpp \
+	Source/WebCore/webaudio/RealtimeAnalyserNode.h
+webcore_built_sources += \
+	DerivedSources/WebCore/JSAudioBuffer.cpp \
+	DerivedSources/WebCore/JSAudioBuffer.h \
+	DerivedSources/WebCore/JSAudioBufferSourceNode.cpp \
+	DerivedSources/WebCore/JSAudioBufferSourceNode.h \
+	DerivedSources/WebCore/JSAudioChannelMerger.cpp \
+	DerivedSources/WebCore/JSAudioChannelMerger.h \
+	DerivedSources/WebCore/JSAudioChannelSplitter.cpp \
+	DerivedSources/WebCore/JSAudioChannelSplitter.h \
+	DerivedSources/WebCore/JSAudioContext.cpp \
+	DerivedSources/WebCore/JSAudioContext.h \
+	DerivedSources/WebCore/JSAudioDestinationNode.cpp \
+	DerivedSources/WebCore/JSAudioDestinationNode.h \
+	DerivedSources/WebCore/JSAudioGain.cpp \
+	DerivedSources/WebCore/JSAudioGain.h \
+	DerivedSources/WebCore/JSAudioGainNode.cpp \
+	DerivedSources/WebCore/JSAudioGainNode.h \
+	DerivedSources/WebCore/JSAudioListener.cpp \
+	DerivedSources/WebCore/JSAudioListener.h \
+	DerivedSources/WebCore/JSAudioNode.cpp \
+	DerivedSources/WebCore/JSAudioNode.h \
+	DerivedSources/WebCore/JSAudioPannerNode.cpp \
+	DerivedSources/WebCore/JSAudioPannerNode.h \
+	DerivedSources/WebCore/JSAudioParam.cpp \
+	DerivedSources/WebCore/JSAudioParam.h \
+	DerivedSources/WebCore/JSAudioProcessingEvent.cpp \
+	DerivedSources/WebCore/JSAudioProcessingEvent.h \
+	DerivedSources/WebCore/JSAudioSourceNode.cpp \
+	DerivedSources/WebCore/JSAudioSourceNode.h \
+	DerivedSources/WebCore/JSConvolverNode.cpp \
+	DerivedSources/WebCore/JSConvolverNode.h \
+	DerivedSources/WebCore/JSDelayNode.cpp \
+	DerivedSources/WebCore/JSDelayNode.h \
+	DerivedSources/WebCore/JSHighPass2FilterNode.cpp \
+	DerivedSources/WebCore/JSHighPass2FilterNode.h \
+	DerivedSources/WebCore/JSJavaScriptAudioNode.cpp \
+	DerivedSources/WebCore/JSJavaScriptAudioNode.h \
+	DerivedSources/WebCore/JSLowPass2FilterNode.cpp \
+	DerivedSources/WebCore/JSLowPass2FilterNode.h \
+	DerivedSources/WebCore/JSRealtimeAnalyserNode.cpp \
+	DerivedSources/WebCore/JSRealtimeAnalyserNode.h
+endif
+
+# ----
+# Web Sockets Support
+# ----
+if ENABLE_WEB_SOCKETS
+webcore_built_sources += \
+	DerivedSources/WebCore/JSWebSocket.cpp \
+	DerivedSources/WebCore/JSWebSocket.h
+endif  # END ENABLE_WEB_SOCKETS
+
+# ---
+# 3D canvas (WebGL) support
+# ---
+if ENABLE_WEBGL
+webcore_built_sources += \
+	DerivedSources/ANGLE/glslang.cpp \
+	DerivedSources/ANGLE/glslang_tab.cpp \
+	DerivedSources/ANGLE/glslang_tab.h
+webcore_sources += \
+	Source/ThirdParty/ANGLE/include/GLSLANG/ShaderLang.h \
+	Source/ThirdParty/ANGLE/src/compiler/BaseTypes.h \
+	Source/ThirdParty/ANGLE/src/compiler/CodeGenGLSL.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/Common.h \
+	Source/ThirdParty/ANGLE/src/compiler/Compiler.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/ConstantUnion.h \
+	Source/ThirdParty/ANGLE/src/compiler/debug.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/debug.h \
+	Source/ThirdParty/ANGLE/src/compiler/InfoSink.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/InfoSink.h \
+	Source/ThirdParty/ANGLE/src/compiler/Initialize.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/InitializeDll.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/InitializeDll.h \
+	Source/ThirdParty/ANGLE/src/compiler/InitializeGlobals.h \
+	Source/ThirdParty/ANGLE/src/compiler/Initialize.h \
+	Source/ThirdParty/ANGLE/src/compiler/InitializeParseContext.h \
+	Source/ThirdParty/ANGLE/src/compiler/Intermediate.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/intermediate.h \
+	Source/ThirdParty/ANGLE/src/compiler/intermOut.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/IntermTraverse.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/localintermediate.h \
+	Source/ThirdParty/ANGLE/src/compiler/MMap.h \
+	Source/ThirdParty/ANGLE/src/compiler/osinclude.h \
+	Source/ThirdParty/ANGLE/src/compiler/ossource_posix.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/OutputGLSL.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/OutputGLSL.h \
+	Source/ThirdParty/ANGLE/src/compiler/OutputHLSL.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/OutputHLSL.h \
+	Source/ThirdParty/ANGLE/src/compiler/parseConst.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/ParseHelper.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/ParseHelper.h \
+	Source/ThirdParty/ANGLE/src/compiler/PoolAlloc.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/PoolAlloc.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/atom.c \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/atom.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/compile.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/cpp.c \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/cpp.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/cppstruct.c \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/memory.c \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/memory.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/parser.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/preprocess.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/scanner.c \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/scanner.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/slglobals.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/symbols.c \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/symbols.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/tokens.c \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/tokens.h \
+	Source/ThirdParty/ANGLE/src/compiler/QualifierAlive.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/QualifierAlive.h \
+	Source/ThirdParty/ANGLE/src/compiler/RemoveTree.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/RemoveTree.h \
+	Source/ThirdParty/ANGLE/src/compiler/SearchSymbol.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/SearchSymbol.h \
+	Source/ThirdParty/ANGLE/src/compiler/ShaderLang.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/ShHandle.h \
+	Source/ThirdParty/ANGLE/src/compiler/SymbolTable.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/SymbolTable.h \
+	Source/ThirdParty/ANGLE/src/compiler/VersionGLSL.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/VersionGLSL.h \
+	Source/ThirdParty/ANGLE/src/compiler/TranslatorGLSL.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/TranslatorGLSL.h \
+	Source/ThirdParty/ANGLE/src/compiler/TranslatorHLSL.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/TranslatorHLSL.h \
+	Source/ThirdParty/ANGLE/src/compiler/Types.h \
+	Source/ThirdParty/ANGLE/src/compiler/UnfoldSelect.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/UnfoldSelect.h \
+	Source/ThirdParty/ANGLE/src/compiler/util.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/util.h \
+	Source/ThirdParty/ANGLE/src/compiler/ValidateLimitations.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/ValidateLimitations.h \
+	Source/ThirdParty/ANGLE/src/compiler/VariableInfo.cpp \
+	Source/ThirdParty/ANGLE/src/compiler/VariableInfo.h \
+	Source/WebCore/html/canvas/WebGLActiveInfo.h \
+	Source/WebCore/html/canvas/WebGLBuffer.cpp \
+	Source/WebCore/html/canvas/WebGLBuffer.h \
+	Source/WebCore/html/canvas/WebGLContextAttributes.cpp \
+	Source/WebCore/html/canvas/WebGLContextAttributes.h \
+	Source/WebCore/html/canvas/WebGLContextEvent.cpp \
+	Source/WebCore/html/canvas/WebGLContextEvent.h \
+	Source/WebCore/html/canvas/WebGLFramebuffer.cpp \
+	Source/WebCore/html/canvas/WebGLFramebuffer.h \
+	Source/WebCore/html/canvas/WebGLGetInfo.cpp \
+	Source/WebCore/html/canvas/WebGLGetInfo.h \
+	Source/WebCore/html/canvas/WebGLObject.cpp \
+	Source/WebCore/html/canvas/WebGLObject.h \
+	Source/WebCore/html/canvas/WebGLProgram.cpp \
+	Source/WebCore/html/canvas/WebGLProgram.h \
+	Source/WebCore/html/canvas/WebGLRenderbuffer.cpp \
+	Source/WebCore/html/canvas/WebGLRenderbuffer.h \
+	Source/WebCore/html/canvas/WebGLRenderingContext.cpp \
+	Source/WebCore/html/canvas/WebGLRenderingContext.h \
+	Source/WebCore/html/canvas/WebGLShader.cpp \
+	Source/WebCore/html/canvas/WebGLShader.h \
+	Source/WebCore/html/canvas/WebGLTexture.cpp \
+	Source/WebCore/html/canvas/WebGLTexture.h \
+	Source/WebCore/html/canvas/WebGLUniformLocation.cpp \
+	Source/WebCore/html/canvas/WebGLUniformLocation.h \
+	Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.cpp \
+	Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.h \
+	Source/WebCore/html/canvas/WebGLExtension.cpp \
+	Source/WebCore/html/canvas/WebGLExtension.h \
+	Source/WebCore/html/canvas/OESStandardDerivatives.cpp \
+	Source/WebCore/html/canvas/OESStandardDerivatives.h \
+	Source/WebCore/html/canvas/OESTextureFloat.cpp \
+	Source/WebCore/html/canvas/OESTextureFloat.h \
+	Source/WebCore/html/canvas/OESVertexArrayObject.cpp \
+	Source/WebCore/html/canvas/OESVertexArrayObject.h \
+	Source/WebCore/html/canvas/WebKitLoseContext.cpp \
+	Source/WebCore/html/canvas/WebKitLoseContext.h \
+	Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp \
+	Source/WebCore/platform/graphics/ANGLEWebKitBridge.h \
+	Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp \
+	Source/WebCore/platform/graphics/cairo/OpenGLShims.h \
+	Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp \
+	Source/WebCore/platform/graphics/gpu/DrawingBuffer.h \
+	Source/WebCore/platform/graphics/GraphicsContext3D.cpp \
+	Source/WebCore/platform/graphics/GraphicsContext3D.h \
+	Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp \
+	Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp \
+	Source/WebCore/platform/graphics/gtk/GraphicsContext3DInternal.cpp \
+	Source/WebCore/platform/graphics/gtk/GraphicsContext3DInternal.h \
+	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp \
+	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h \
+	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+endif  # END ENABLE_WEBGL
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index f6d9c90..06ef5f8 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -194,10 +194,10 @@ ENDFOREACH ()
 FOREACH (_file ${WebCore_IDL_FILES})
     GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
     ADD_CUSTOM_COMMAND(
-        OUTPUT  ${DERIVED_SOURCES_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_DIR}/JS${_name}.h
+        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.h
         MAIN_DEPENDENCY ${_file}
         DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${_file}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/${_file}
+        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/${_file}
         VERBATIM)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/JS${_name}.cpp)
+    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp)
 ENDFOREACH ()
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index c3de299..d8ee526 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -107,6 +107,7 @@
 .objc_class_name_DOMWheelEvent
 .objc_class_name_WebCoreViewFactory
 .objc_class_name_WebFontCache
+.objc_class_name_WebHTMLConverter
 .objc_class_name_WebScriptObject
 .objc_class_name_WebScriptObjectPrivate
 .objc_class_name_WebUndefined
@@ -140,6 +141,7 @@ __ZN7WebCore10CredentialC1ERKN3WTF6StringES4_NS_21CredentialPersistenceE
 __ZN7WebCore10CredentialC1Ev
 __ZN7WebCore10FloatPointC1ERKNS_8IntPointE
 __ZN7WebCore10JSDocument6s_infoE
+__ZN7WebCore10MouseEvent6createERKN3WTF12AtomicStringENS1_10PassRefPtrINS_9DOMWindowEEERKNS_18PlatformMouseEventEiNS5_INS_4NodeEEE
 __ZN7WebCore10MouseEventC1ERKN3WTF12AtomicStringEbbNS1_10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9ClipboardEEEb
 __ZN7WebCore10ScrollView17setUseFixedLayoutEb
 __ZN7WebCore10ScrollView18setFixedLayoutSizeERKNS_7IntSizeE
@@ -292,9 +294,10 @@ __ZN7WebCore12SharedBufferC1EPKci
 __ZN7WebCore12SharedBufferC1EPKhi
 __ZN7WebCore12SharedBufferC1Ev
 __ZN7WebCore12SharedBufferD1Ev
-__ZN7WebCore12SpellChecker8didCheckEiRKN3WTF6VectorINS_19SpellCheckingResultELm0EEE
+__ZN7WebCore12SpellChecker8didCheckEiRKN3WTF6VectorINS_18TextCheckingResultELm0EEE
 __ZN7WebCore12TextEncodingC1ERKN3WTF6StringE
 __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
+__ZN7WebCore12TextIterator26locationAndLengthFromRangeEPKNS_5RangeERmS4_
 __ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
 __ZN7WebCore12TextIterator7advanceEv
 __ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
@@ -341,7 +344,7 @@ __ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
 __ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
 __ZN7WebCore14DocumentLoader7requestEv
 __ZN7WebCore14DocumentLoader8setFrameEPNS_5FrameE
-__ZN7WebCore14DocumentLoader8setTitleERKN3WTF6StringE
+__ZN7WebCore14DocumentLoader8setTitleERKNS_19StringWithDirectionE
 __ZN7WebCore14DocumentLoaderC1ERKNS_15ResourceRequestERKNS_14SubstituteDataE
 __ZN7WebCore14DocumentLoaderC2ERKNS_15ResourceRequestERKNS_14SubstituteDataE
 __ZN7WebCore14DocumentLoaderD2Ev
@@ -410,8 +413,11 @@ __ZN7WebCore15GraphicsContext9translateEff
 __ZN7WebCore15GraphicsContextC1EP9CGContext
 __ZN7WebCore15GraphicsContextD1Ev
 __ZN7WebCore15JSDOMWindowBase18commonJSGlobalDataEv
+__ZN7WebCore15PlatformCALayer18setGeometryFlippedEb
 __ZN7WebCore15ProtectionSpaceC1ERKN3WTF6StringEiNS_25ProtectionSpaceServerTypeES4_NS_35ProtectionSpaceAuthenticationSchemeE
 __ZN7WebCore15ProtectionSpaceC1Ev
+__ZN7WebCore15ResourceRequest21httpPipeliningEnabledEv
+__ZN7WebCore15ResourceRequest24setHTTPPipeliningEnabledEb
 __ZN7WebCore15ScrollAlignment17alignCenterAlwaysE
 __ZN7WebCore15ScrollAlignment19alignToEdgeIfNeededE
 __ZN7WebCore15StringTruncator13rightTruncateERKN3WTF6StringEfRKNS_4FontE
@@ -534,6 +540,7 @@ __ZN7WebCore20ResourceResponseBaseC2Ev
 __ZN7WebCore20SpaceSplitStringData12createVectorEv
 __ZN7WebCore20UserGestureIndicatorC1ENS_26ProcessingUserGestureStateE
 __ZN7WebCore20UserGestureIndicatorD1Ev
+__ZN7WebCore20makeRGBA32FromFloatsEffff
 __ZN7WebCore20protocolIsJavaScriptERKN3WTF6StringE
 __ZN7WebCore21BackForwardController11itemAtIndexEi
 __ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
@@ -543,7 +550,6 @@ __ZN7WebCore21ResourceLoadScheduler24schedulePluginStreamLoadEPNS_5FrameEPNS_32N
 __ZN7WebCore21SVGDocumentExtensions21sampleAnimationAtTimeERKN3WTF6StringEPNS_14SVGSMILElementEd
 __ZN7WebCore21SerializedScriptValue11deserializeEPK15OpaqueJSContextPPK13OpaqueJSValue
 __ZN7WebCore21SerializedScriptValue6createEPK15OpaqueJSContextPK13OpaqueJSValuePS6_
-__ZN7WebCore21SerializedScriptValue6createEPN3JSC9ExecStateENS1_7JSValueE
 __ZN7WebCore21SerializedScriptValueC1ERN3WTF6VectorIhLm0EEE
 __ZN7WebCore21SerializedScriptValueD1Ev
 __ZN7WebCore21UserContentURLPattern5parseERKN3WTF6StringE
@@ -569,7 +575,7 @@ __ZN7WebCore23getHostnamesWithCookiesERN3WTF7HashSetINS0_6StringENS0_10StringHas
 __ZN7WebCore23overrideDefaultLanguageERKN3WTF6StringE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
 __ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
-__ZN7WebCore24DocumentMarkerController13removeMarkersEj
+__ZN7WebCore24DocumentMarkerController13removeMarkersENS_14DocumentMarker11MarkerTypesE
 __ZN7WebCore24DocumentMarkerController14markersForNodeEPNS_4NodeE
 __ZN7WebCore24DocumentMarkerController14markersForNodeEPNS_4NodeE
 __ZN7WebCore24DocumentMarkerController23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
@@ -613,6 +619,7 @@ __ZN7WebCore28contextMenuItemTagSmartLinksEv
 __ZN7WebCore28contextMenuItemTagSpeechMenuEv
 __ZN7WebCore28encodeWithURLEscapeSequencesERKN3WTF6StringE
 __ZN7WebCore28removeLanguageChangeObserverEPv
+__ZN7WebCore29applicationIsMicrosoftOutlookEv
 __ZN7WebCore29contextMenuItemTagLeftToRightEv
 __ZN7WebCore29contextMenuItemTagRightToLeftEv
 __ZN7WebCore29contextMenuItemTagSmartDashesEv
@@ -648,6 +655,7 @@ __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
 __ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
 __ZN7WebCore46contextMenuItemTagCorrectSpellingAutomaticallyEv
+__ZN7WebCore47attributedStringByStrippingAttachmentCharactersEP18NSAttributedString
 __ZN7WebCore4Font11setCodePathENS0_8CodePathE
 __ZN7WebCore4Font18shouldUseSmoothingEv
 __ZN7WebCore4Font21setShouldUseSmoothingEb
@@ -705,6 +713,7 @@ __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_8NodeListE
 __ZN7WebCore5Color11transparentE
 __ZN7WebCore5Color5whiteE
 __ZN7WebCore5Frame10createViewERKNS_7IntSizeERKNS_5ColorEbS3_bNS_13ScrollbarModeEbS7_b
+__ZN7WebCore5Frame13rangeForPointERKNS_8IntPointE
 __ZN7WebCore5Frame14frameForWidgetEPKNS_6WidgetE
 __ZN7WebCore5Frame17setPageZoomFactorEf
 __ZN7WebCore5Frame17setTextZoomFactorEf
@@ -724,7 +733,6 @@ __ZN7WebCore5Range14isPointInRangeEPNS_4NodeEiRi
 __ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEENS2_INS_4NodeEEEiS6_i
 __ZN7WebCore5Range6setEndEN3WTF10PassRefPtrINS_4NodeEEEiRi
 __ZN7WebCore5Range8setStartEN3WTF10PassRefPtrINS_4NodeEEEiRi
-__ZN7WebCore5Range9textQuadsERN3WTF6VectorINS_9FloatQuadELm0EEEb
 __ZN7WebCore5Range9textRectsERN3WTF6VectorINS_7IntRectELm0EEEb
 __ZN7WebCore5RangeD1Ev
 __ZN7WebCore6Chrome16setStatusbarTextEPNS_5FrameERKN3WTF6StringE
@@ -807,7 +815,6 @@ __ZN7WebCore8Document13svgExtensionsEv
 __ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore8Document16isPageBoxVisibleEi
 __ZN7WebCore8Document17getFocusableNodesERN3WTF6VectorINS1_6RefPtrINS_4NodeEEELm0EEE
-__ZN7WebCore8Document18createWrapperCacheEPNS_15DOMWrapperWorldE
 __ZN7WebCore8Document19accessSVGExtensionsEv
 __ZN7WebCore8Document20styleSelectorChangedENS_23StyleSelectorUpdateFlagE
 __ZN7WebCore8Document22createDocumentFragmentEv
@@ -894,6 +901,7 @@ __ZN7WebCore8Settings36setOfflineWebApplicationCacheEnabledEb
 __ZN7WebCore8Settings40setJavaScriptCanOpenWindowsAutomaticallyEb
 __ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirectionSubmenuInclusionBehaviorE
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
+__ZN7WebCore8Settings44setLoadsSiteIconsIgnoringImageLoadingSettingEb
 __ZN7WebCore8blankURLEv
 __ZN7WebCore8makeRGBAEiiii
 __ZN7WebCore8openFileERKN3WTF6StringENS_12FileOpenModeE
@@ -971,6 +979,7 @@ __ZN7WebCore9HTMLNames9scriptTagE
 __ZN7WebCore9JSElement6s_infoE
 __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
+__ZN7WebCore9PageCache33markPagesForVistedLinkStyleRecalcEv
 __ZN7WebCore9PageGroup13isLinkVisitedEy
 __ZN7WebCore9PageGroup14addVisitedLinkEPKtm
 __ZN7WebCore9PageGroup17closeLocalStorageEv
@@ -1210,6 +1219,7 @@ __ZNK7WebCore5Range21compareBoundaryPointsENS0_10CompareHowEPKS0_Ri
 __ZNK7WebCore5Range4textEv
 __ZNK7WebCore5Range9endOffsetERi
 __ZNK7WebCore5Range9firstNodeEv
+__ZNK7WebCore5Range9textQuadsERN3WTF6VectorINS_9FloatQuadELm0EEEb
 __ZNK7WebCore6Chrome12createWindowEPNS_5FrameERKNS_16FrameLoadRequestERKNS_14WindowFeaturesERKNS_16NavigationActionE
 __ZNK7WebCore6Cursor14platformCursorEv
 __ZNK7WebCore6Editor12selectedTextEv
@@ -1233,6 +1243,7 @@ __ZNK7WebCore6Editor7Command7executeERKN3WTF6StringEPNS_5EventE
 __ZNK7WebCore6Editor7Command9isEnabledEPNS_5EventE
 __ZNK7WebCore6Editor7canCopyEv
 __ZNK7WebCore6Editor7canEditEv
+__ZNK7WebCore6Editor8behaviorEv
 __ZNK7WebCore6Editor8canPasteEv
 __ZNK7WebCore6Editor9canDeleteEv
 __ZNK7WebCore6Widget14platformWidgetEv
@@ -1244,6 +1255,7 @@ __ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
 __ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
 __ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore7Element10screenRectEv
+__ZNK7WebCore7Element10shadowRootEv
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
 __ZNK7WebCore7Element19boundsInWindowSpaceEv
 __ZNK7WebCore7Element9innerTextEv
@@ -1342,7 +1354,6 @@ _wkGetWheelEventDeltas
 _wkHTTPCookiesForURL
 _wkHitTestMediaUIPart
 _wkInitializeMaximumHTTPConnectionCountPerHost
-_wkIsLatchingWheelEvent
 _wkMeasureMediaUIPart
 _wkMediaControllerThemeAvailable
 _wkPopupMenu
@@ -1364,6 +1375,8 @@ _wkSetCONNECTProxyForStream
 _wkSetCookieStoragePrivateBrowsingEnabled
 _wkSetDragImage
 _wkSetHTTPCookiesForURL
+_wkSetHTTPPipeliningMaximumPriority
+_wkSetHTTPPipeliningMinimumFastLanePriority
 _wkSetHTTPPipeliningPriority
 _wkSetNSURLConnectionDefersCallbacks
 _wkSetNSURLRequestShouldContentSniff
@@ -1397,6 +1410,8 @@ _wkContentAreaResized
 _wkContentAreaScrolled
 _wkContentAreaWillPaint
 _wkCreateCTTypesetterWithUniCharProviderAndOptions
+_wkDidBeginScrollGesture
+_wkDidEndScrollGesture
 _wkHorizontalScrollbarPainterForController
 _wkIOSurfaceContextCreate
 _wkIOSurfaceContextCreateImage
@@ -1408,10 +1423,10 @@ _wkMouseExitedContentArea
 _wkMouseMovedInContentArea
 _wkScrollbarMinimumThumbLength
 _wkScrollbarMinimumTotalLengthNeededForThumb
+_wkScrollbarPainterForceFlashScrollers
 _wkScrollbarPainterIsHorizontal
 _wkScrollbarPainterKnobAlpha
 _wkScrollbarPainterPaint
-_wkScrollbarPainterForceFlashScrollers
 _wkScrollbarPainterSetDelegate
 _wkScrollbarPainterSetOverlayState
 _wkScrollbarPainterTrackAlpha
@@ -1424,6 +1439,8 @@ _wkSetScrollbarPainterTrackAlpha
 _wkVerticalScrollbarPainterForController
 _wkWillEndLiveResize
 _wkWillStartLiveResize
+#else
+_wkGetNSEventMomentumPhase
 #endif
 
 _wkUnregisterUniqueIdForElement
@@ -1479,6 +1496,7 @@ __ZN7WebCore8Settings41setUsesDashboardBackwardCompatibilityModeEb
 #if ENABLE(DRAG_SUPPORT)
 __ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
 __ZN7WebCore12EventHandler17eventMayStartDragEP7NSEvent
+__ZNK7WebCore12EventHandler17eventMayStartDragERKNS_18PlatformMouseEventE
 __ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
 __ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
 __ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
@@ -1571,7 +1589,7 @@ __NPN_SetProperty
 __NPN_UTF8FromIdentifier
 __ZN7WebCore16ScriptController20windowScriptNPObjectEv
 __ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
-__ZN7WebCore16jsStringSlowCaseEPN3JSC9ExecStateERNS0_9WeakGCMapIPN3WTF10StringImplENS0_8JSStringEEES6_
+__ZN7WebCore16jsStringSlowCaseEPN3JSC9ExecStateERNS0_9WeakGCMapIPN3WTF10StringImplENS0_8JSStringENS0_33DefaultWeakGCMapFinalizerCallbackIS6_S7_EENS4_10StringHashENS4_10HashTraitsIS6_EEEES6_
 __ZN7WebCore17HTMLPlugInElement11getNPObjectEv
 __ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
 __ZNK7WebCore4KURL10protocolIsEPKc
@@ -1588,7 +1606,7 @@ __ZN3JSC13RuntimeMethod11getCallDataERNS_8CallDataE
 __ZN3JSC13RuntimeMethod18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC13RuntimeMethod24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC13RuntimeMethod6s_infoE
-__ZN3JSC13RuntimeMethodC2EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_10IdentifierERNS5_6VectorIPNS_8Bindings6MethodELm0EEE
+__ZN3JSC13RuntimeMethodC2EPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
 __ZN3JSC8Bindings10RootObjectD1Ev
 __ZN3JSC8Bindings13RuntimeObject11getCallDataERNS_8CallDataE
 __ZN3JSC8Bindings13RuntimeObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
@@ -1598,14 +1616,14 @@ __ZN3JSC8Bindings13RuntimeObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17Prope
 __ZN3JSC8Bindings13RuntimeObject24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC8Bindings13RuntimeObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC8Bindings13RuntimeObject6s_infoE
-__ZN3JSC8Bindings13RuntimeObjectC2EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEENS6_10PassRefPtrINS0_8InstanceEEE
+__ZN3JSC8Bindings13RuntimeObjectC2EPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureEN3WTF10PassRefPtrINS0_8InstanceEEE
 __ZN3JSC8Bindings13RuntimeObjectD2Ev
 __ZN3JSC8Bindings8Instance19createRuntimeObjectEPNS_9ExecStateE
 __ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
 __ZN3JSC8Bindings8InstanceD2Ev
 __ZN7WebCore13IdentifierRep7isValidEPS0_
 __ZN7WebCore16ScriptController16createRootObjectEPv
-__ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEN3WTF17NonNullPassRefPtrIN3JSC9StructureEEEPKNS4_9ClassInfoE
+__ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
 __ZN7WebCore21getCachedDOMStructureEPNS_17JSDOMGlobalObjectEPKN3JSC9ClassInfoE
 __ZNK3JSC8Bindings13RuntimeObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZTVN3JSC13RuntimeMethodE
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index e692f54..bd7059a 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -130,6 +130,7 @@
 
     'webcore_include_dirs': [
       '../',
+      '../..',
       '../accessibility',
       '../accessibility/chromium',
       '../bindings',
@@ -183,6 +184,7 @@
       '../platform/image-decoders/xbm',
       '../platform/image-decoders/webp',
       '../platform/image-encoders/skia',
+      '../platform/leveldb',
       '../platform/mock',
       '../platform/network',
       '../platform/network/chromium',
@@ -201,7 +203,7 @@
       '../svg/graphics',
       '../svg/graphics/filters',
       '../svg/properties',
-      '../thirdparty/glu',
+      '../../ThirdParty/glu',
       '../webaudio',
       '../websockets',
       '../workers',
@@ -445,17 +447,33 @@
       'actions': [
         # Actions to build derived sources.
         {
-          'action_name': 'generateXMLViewerXSL',
+          'action_name': 'generateXMLViewerCSS',
           'inputs': [
-            '../xml/XMLViewer.xsl',
+            '../xml/XMLViewer.css',
           ],
           'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/webkit/XMLViewerXSL.h',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/XMLViewerCSS.h',
           ],
           'action': [
             'perl',
             '../inspector/xxd.pl',
-            'XMLViewer_xsl',
+            'XMLViewer_css',
+            '<@(_inputs)',
+            '<@(_outputs)'
+          ],
+        },
+        {
+          'action_name': 'generateXMLViewerJS',
+          'inputs': [
+            '../xml/XMLViewer.js',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/XMLViewerJS.h',
+          ],
+          'action': [
+            'perl',
+            '../inspector/xxd.pl',
+            'XMLViewer_js',
             '<@(_inputs)',
             '<@(_outputs)'
           ],
@@ -623,6 +641,7 @@
             '../css/mediaControls.css',
             '../css/mediaControlsChromium.css',
             '../css/fullscreen.css',
+            # Skip fullscreenQuickTime.
           ],
           'outputs': [
             '<(SHARED_INTERMEDIATE_DIR)/webkit/UserAgentStyleSheets.h',
@@ -941,13 +960,6 @@
             'include_dirs+++': ['../dom'],
           },
         }],
-        # FIXME: (kbr) ideally this target should just depend on webcore_prerequisites
-        # to pick up these include directories, but I'm nervous about making that change.
-        ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_MKL=1" in feature_defines', {
-          'include_dirs': [
-            '<(chromium_src_dir)/third_party/mkl/include',
-          ],
-        }],
         ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_FFTW=1" in feature_defines', {
           'include_dirs': [
             '<(chromium_src_dir)/third_party/fftw/api',
@@ -962,6 +974,7 @@
       'type': 'none',
       'dependencies': [
         'webcore_bindings',
+        '../../ThirdParty/glu/glu.gyp:libtess',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:yarr',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
@@ -1151,13 +1164,10 @@
             'include_dirs++': ['../dom'],
           },
         }],
-        ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_MKL=1" in feature_defines', {
-          # This directory needs to be on the include path for multiple sub-targets of webcore.
-          'direct_dependent_settings': {
-            'include_dirs': [
-              '<(chromium_src_dir)/third_party/mkl/include',
-            ],
-          },
+        ['(OS=="linux" or OS=="win") and branding=="Chrome"', {
+          'dependencies': [
+            '<(chromium_src_dir)/third_party/mkl/google/mkl.gyp:mkl_libs',
+          ],
         }],
         ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_FFTW=1" in feature_defines', {
           # This directory needs to be on the include path for multiple sub-targets of webcore.
@@ -1167,6 +1177,14 @@
             ],
           },
         }],
+        ['"ENABLE_LEVELDB=1" in feature_defines', {
+          'dependencies': [
+            '<(chromium_src_dir)/third_party/leveldb/leveldb.gyp:leveldb',
+          ],
+          'export_dependent_settings': [
+            '<(chromium_src_dir)/third_party/leveldb/leveldb.gyp:leveldb',
+          ],
+        }],
       ],
     },
     {
@@ -1232,7 +1250,7 @@
         ['include', 'platform/'],
 
         # FIXME: Figure out how to store these patterns in a variable.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|gstreamer|gtk|haiku|linux|mac|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
         ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
 
         ['include', 'platform/graphics/opentype/OpenTypeSanitizer\\.cpp$'],
@@ -1247,8 +1265,6 @@
         ['exclude', 'platform/sql/SQLiteFileSystem\\.cpp$'],
         ['exclude', 'platform/text/LocalizedNumberNone\\.cpp$'],
         ['exclude', 'platform/text/TextEncodingDetectorNone\\.cpp$'],
-
-        ['include', 'thirdparty/glu/libtess/'],
       ],
       'conditions': [
         ['OS=="linux" or OS=="freebsd"', {
@@ -1398,16 +1414,6 @@
             ['include', 'platform/win/SystemInfo\\.cpp$'],
           ],
         }],
-        ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_MKL=1" in feature_defines', {
-          'sources/': [
-            ['include', 'platform/audio/mkl/FFTFrameMKL\\.cpp$'],
-          ],
-        }],
-        ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_FFTW=1" in feature_defines', {
-          'sources/': [
-            ['include', 'platform/audio/fftw/FFTFrameFFTW\\.cpp$'],
-          ],
-        }],
       ],
     },
     {
@@ -1425,7 +1431,7 @@
         ['include', 'rendering/'],
 
         # FIXME: Figure out how to store these patterns in a variable.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|gstreamer|gtk|haiku|linux|mac|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
         ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
 
         ['exclude', 'AllInOne\\.cpp$'],
@@ -1499,7 +1505,7 @@
         ['exclude', 'bridge/jni/jsc/'],
 
         # FIXME: Figure out how to store these patterns in a variable.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|gstreamer|gtk|haiku|linux|mac|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
         ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
 
         ['exclude', 'AllInOne\\.cpp$'],
@@ -1666,29 +1672,6 @@
             'include_dirs+++': ['../dom'],
           },
         }],
-        ['OS=="win" and "WTF_USE_WEBAUDIO_MKL=1" in feature_defines', {
-          # FIXME: (kbr) figure out how to make these dependencies
-          # work in a cross-platform way. Attempts to use
-          # "link_settings" and "libraries" in conjunction with the
-          # msvs-specific settings didn't work so far.
-          'all_dependent_settings': {
-            'msvs_settings': {
-              'VCLinkerTool': {
-                'AdditionalLibraryDirectories': [
-                  # This is a hack to make this directory correct
-                  # relative to targets like chrome_dll. Should use
-                  # <(chromium_src_dir).
-                  '../third_party/mkl/lib/win/ia32',
-                ],
-                'AdditionalDependencies': [
-                  'mkl_intel_c.lib',
-                  'mkl_sequential.lib',
-                  'mkl_core.lib',
-                ],
-              },
-            },
-          },
-        }],
         ['OS=="linux" and "WTF_USE_WEBAUDIO_FFTW=1" in feature_defines', {
           # FIXME: (kbr) figure out how to make these dependencies
           # work in a cross-platform way. Attempts to use
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index 290b93a..3a5cea5 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -545,6 +545,7 @@
             'dom/RegisteredEventListener.h',
             'dom/ScriptExecutionContext.h',
             'dom/ScriptRunner.h',
+            'dom/ShadowRoot.h',
             'dom/SpaceSplitString.h',
             'dom/StyledElement.h',
             'dom/Text.h',
@@ -769,6 +770,7 @@
             'platform/PopupMenuClient.h',
             'platform/PopupMenuStyle.h',
             'platform/PurgePriority.h',
+            'platform/RuntimeApplicationChecks.h',
             'platform/SchemeRegistry.h',
             'platform/ScrollTypes.h',
             'platform/ScrollView.h',
@@ -830,6 +832,7 @@
             'platform/graphics/Icon.h',
             'platform/graphics/Image.h',
             'platform/graphics/ImageBuffer.h',
+            'platform/graphics/ImageBufferData.h',
             'platform/graphics/ImageObserver.h',
             'platform/graphics/ImageSource.h',
             'platform/graphics/IntPoint.h',
@@ -847,7 +850,7 @@
             'platform/graphics/TextRenderingMode.h',
             'platform/graphics/TextRun.h',
             'platform/graphics/TypesettingFeatures.h',
-            'platform/graphics/cg/ImageBufferData.h',
+            'platform/graphics/cg/ImageBufferDataCG.h',
             'platform/graphics/mac/ColorMac.h',
             'platform/graphics/mac/MediaPlayerProxy.h',
             'platform/graphics/transforms/AffineTransform.h',
@@ -855,6 +858,12 @@
             'platform/graphics/transforms/TransformOperations.h',
             'platform/graphics/transforms/TransformationMatrix.h',
             'platform/gtk/PasteboardHelper.h',
+            'platform/leveldb/LevelDBComparator.h',
+            'platform/leveldb/LevelDBDatabase.cpp',
+            'platform/leveldb/LevelDBDatabase.h',
+            'platform/leveldb/LevelDBIterator.cpp',
+            'platform/leveldb/LevelDBIterator.h',
+            'platform/leveldb/LevelDBSlice.h',
             'platform/mac/BlockExceptions.h',
             'platform/mac/ClipboardMac.h',
             'platform/mac/EmptyProtocolDefinitions.h',
@@ -900,6 +909,7 @@
             'platform/sql/SQLiteDatabase.h',
             'platform/sql/SQLiteTransaction.h',
             'platform/text/Base64.h',
+            'platform/text/BidiRunList.h',
             'platform/text/BidiContext.h',
             'platform/text/BidiResolver.h',
             'platform/text/LineEnding.h',
@@ -921,6 +931,7 @@
             'platform/text/TextEncodingRegistry.h',
             'platform/text/TextOrientation.h',
             'platform/text/TextStream.h',
+            'platform/text/UnicodeBidi.h',
             'platform/text/UnicodeRange.h',
             'platform/text/mac/CharsetData.h',
             'plugins/PluginData.h',
@@ -1151,7 +1162,6 @@
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
             'fileapi/Blob.idl',
-            'fileapi/BlobBuilder.idl',
             'fileapi/DirectoryEntry.idl',
             'fileapi/DirectoryEntrySync.idl',
             'fileapi/DirectoryReader.idl',
@@ -1178,9 +1188,10 @@
             'fileapi/FileWriter.idl',
             'fileapi/FileWriterCallback.idl',
             'fileapi/FileWriterSync.idl',
-            'fileapi/Flags.idl',
+            'fileapi/WebKitFlags.idl',
             'fileapi/Metadata.idl',
             'fileapi/MetadataCallback.idl',
+            'fileapi/WebKitBlobBuilder.idl',
             'html/DOMFormData.idl',
             'html/DOMSettableTokenList.idl',
             'html/DOMTokenList.idl',
@@ -1260,6 +1271,7 @@
             'html/HTMLTableSectionElement.idl',
             'html/HTMLTextAreaElement.idl',
             'html/HTMLTitleElement.idl',
+            'html/HTMLTrackElement.idl',
             'html/HTMLUListElement.idl',
             'html/HTMLVideoElement.idl',
             'html/ImageData.idl',
@@ -1321,6 +1333,9 @@
             'page/Location.idl',
             'page/MemoryInfo.idl',
             'page/Navigator.idl',
+            'page/NavigatorUserMediaError.idl',
+            'page/NavigatorUserMediaErrorCallback.idl',
+            'page/NavigatorUserMediaSuccessCallback.idl',
             'page/Performance.idl',
             'page/PerformanceNavigation.idl',
             'page/PerformanceTiming.idl',
@@ -1368,6 +1383,9 @@
             'storage/SQLTransactionSyncCallback.idl',
             'storage/Storage.idl',
             'storage/StorageEvent.idl',
+            'storage/StorageInfo.idl',
+            'storage/StorageInfoErrorCallback.idl',
+            'storage/StorageInfoUsageCallback.idl',
             'webaudio/AudioBuffer.idl',
             'webaudio/AudioBufferSourceNode.idl',
             'webaudio/AudioChannelMerger.idl',
@@ -1387,6 +1405,7 @@
             'webaudio/HighPass2FilterNode.idl',
             'webaudio/JavaScriptAudioNode.idl',
             'webaudio/LowPass2FilterNode.idl',
+            'webaudio/OfflineAudioCompletionEvent.idl',
             'webaudio/RealtimeAnalyserNode.idl',
             'websockets/WebSocket.idl',
             'workers/AbstractWorker.idl',
@@ -1669,6 +1688,8 @@
             'bindings/gobject/WebKitHTMLElementWrapperFactory.cpp',
             'bindings/gobject/WebKitHTMLElementWrapperFactory.h',
             'bindings/js/CachedScriptSourceProvider.h',
+            'bindings/js/CallbackFunction.cpp',
+            'bindings/js/CallbackFunction.h',
             'bindings/js/DOMObjectHashTableMap.cpp',
             'bindings/js/DOMWrapperWorld.cpp',
             'bindings/js/GCController.cpp',
@@ -2119,6 +2140,7 @@
             'bindings/v8/custom/V8NamedNodeMapCustom.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.h',
+            'bindings/v8/custom/V8NavigatorCustom.cpp',
             'bindings/v8/custom/V8NodeCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
             'bindings/v8/custom/V8NotificationCenterCustom.cpp',
@@ -2192,11 +2214,14 @@
             'bridge/jni/jsc/JavaStringJSC.h',
             'bridge/jni/v8/JNIUtilityPrivate.cpp',
             'bridge/jni/v8/JNIUtilityPrivate.h',
-            'bridge/jni/v8/JavaClassV8.cpp',
+            'bridge/jni/v8/JavaClassJobjectV8.cpp',
+            'bridge/jni/v8/JavaClassJobjectV8.h',
             'bridge/jni/v8/JavaClassV8.h',
-            'bridge/jni/v8/JavaFieldV8.cpp',
+            'bridge/jni/v8/JavaFieldJobjectV8.cpp',
+            'bridge/jni/v8/JavaFieldJobjectV8.h',
             'bridge/jni/v8/JavaFieldV8.h',
-            'bridge/jni/v8/JavaInstanceV8.cpp',
+            'bridge/jni/v8/JavaInstanceJobjectV8.cpp',
+            'bridge/jni/v8/JavaInstanceJobjectV8.h',
             'bridge/jni/v8/JavaInstanceV8.h',
             'bridge/jni/v8/JavaNPObjectV8.cpp',
             'bridge/jni/v8/JavaNPObjectV8.h',
@@ -2515,6 +2540,8 @@
             'dom/SelectElement.h',
             'dom/SelectorNodeList.cpp',
             'dom/SelectorNodeList.h',
+            'dom/ShadowRoot.cpp',
+            'dom/ShadowRoot.h',
             'dom/SpaceSplitString.cpp',
             'dom/StaticHashSetNodeList.cpp',
             'dom/StaticHashSetNodeList.h',
@@ -2542,6 +2569,8 @@
             'dom/Traversal.cpp',
             'dom/Traversal.h',
             'dom/TreeDepthLimit.h',
+            'dom/TreeScope.cpp',
+            'dom/TreeScope.h',
             'dom/TreeWalker.cpp',
             'dom/TreeWalker.h',
             'dom/UIEvent.cpp',
@@ -2632,6 +2661,9 @@
             'editing/SmartReplaceCF.cpp',
             'editing/SmartReplaceICU.cpp',
             'editing/SpellChecker.cpp',
+            'editing/SpellChecker.h',
+            'editing/SpellingCorrectionController.cpp',
+            'editing/SpellingCorrectionController.h',
             'editing/SpellingCorrectionCommand.cpp',
             'editing/SpellingCorrectionCommand.h',
             'editing/SplitElementCommand.cpp',
@@ -2668,8 +2700,6 @@
             'fileapi/AsyncFileWriterClient.h',
             'fileapi/Blob.cpp',
             'fileapi/Blob.h',
-            'fileapi/BlobBuilder.cpp',
-            'fileapi/BlobBuilder.h',
             'fileapi/BlobURL.cpp',
             'fileapi/BlobURL.h',
             'fileapi/DOMFilePath.cpp',
@@ -2736,7 +2766,7 @@
             'fileapi/FileWriterCallback.h',
             'fileapi/FileWriterSync.cpp',
             'fileapi/FileWriterSync.h',
-            'fileapi/Flags.h',
+            'fileapi/WebKitFlags.h',
             'fileapi/LocalFileSystem.cpp',
             'fileapi/LocalFileSystem.h',
             'fileapi/Metadata.h',
@@ -2744,6 +2774,8 @@
             'fileapi/SyncCallbackHelper.h',
             'fileapi/ThreadableBlobRegistry.cpp',
             'fileapi/ThreadableBlobRegistry.h',
+            'fileapi/WebKitBlobBuilder.cpp',
+            'fileapi/WebKitBlobBuilder.h',
             'history/BackForwardController.cpp',
             'history/BackForwardListImpl.cpp',
             'history/CachedFrame.cpp',
@@ -2959,6 +2991,8 @@
             'html/HTMLTextAreaElement.cpp',
             'html/HTMLTitleElement.cpp',
             'html/HTMLTitleElement.h',
+            'html/HTMLTrackElement.cpp',
+            'html/HTMLTrackElement.h',
             'html/HTMLUListElement.cpp',
             'html/HTMLUListElement.h',
             'html/HTMLVideoElement.cpp',
@@ -3140,9 +3174,18 @@
             'html/parser/TextViewSourceParser.h',
             'html/parser/XSSFilter.cpp',
             'html/parser/XSSFilter.h',
+            'html/shadow/DetailsMarkerControl.cpp',
+            'html/shadow/DetailsMarkerControl.h',
             'html/shadow/MediaControls.cpp',
             'html/shadow/MediaControls.h',
-            'html/shadow/ProgressBarValueElement.h',
+            'html/shadow/MediaControlElements.cpp',
+            'html/shadow/MediaControlElements.h',
+            'html/shadow/MediaControlRootElement.cpp',
+            'html/shadow/MediaControlRootElement.h',
+            'html/shadow/MeterShadowElement.cpp',
+            'html/shadow/MeterShadowElement.h',
+            'html/shadow/ProgressShadowElement.cpp',
+            'html/shadow/ProgressShadowElement.h',
             'html/shadow/SliderThumbElement.cpp',
             'html/shadow/SliderThumbElement.h',
             'html/shadow/TextControlInnerElements.cpp',
@@ -3181,6 +3224,8 @@
             'inspector/ConsoleMessage.h',
             'inspector/DOMNodeHighlighter.cpp',
             'inspector/DOMNodeHighlighter.h',
+            'inspector/EventsCollector.cpp',
+            'inspector/EventsCollector.h',
             'inspector/InjectedScript.cpp',
             'inspector/InjectedScript.h',
             'inspector/InjectedScriptHost.cpp',
@@ -3211,9 +3256,12 @@
             'inspector/InspectorDatabaseResource.h',
             'inspector/InspectorDebuggerAgent.cpp',
             'inspector/InspectorDebuggerAgent.h',
+            'inspector/InspectorFrontendChannel.h',
             'inspector/InspectorFrontendClientLocal.cpp',
             'inspector/InspectorFrontendHost.cpp',
             'inspector/InspectorFrontendHost.h',
+            'inspector/InspectorFrontendProxy.cpp',
+            'inspector/InspectorFrontendProxy.h',
             'inspector/InspectorInstrumentation.cpp',
             'inspector/InspectorInstrumentation.h',
             'inspector/InspectorPageAgent.cpp',
@@ -3246,6 +3294,8 @@
             'inspector/TimelineRecordFactory.h',
             'inspector/WorkerDebuggerAgent.cpp',
             'inspector/WorkerDebuggerAgent.h',
+            'inspector/WorkerInspectorController.cpp',
+            'inspector/WorkerInspectorController.h',
             'loader/CachedMetadata.h',
             'loader/CrossOriginAccessControl.cpp',
             'loader/CrossOriginAccessControl.h',
@@ -3392,6 +3442,9 @@
             'page/Navigator.h',
             'page/NavigatorBase.cpp',
             'page/NavigatorBase.h',
+            'page/NavigatorUserMediaError.h',
+            'page/NavigatorUserMediaErrorCallback.h',
+            'page/NavigatorUserMediaSuccessCallback.h',
             'page/OriginAccessEntry.cpp',
             'page/OriginAccessEntry.h',
             'page/Page.cpp',
@@ -3523,6 +3576,8 @@
             'platform/PlatformTouchPoint.h',
             'platform/PurgeableBuffer.h',
             'platform/RunLoopTimer.h',
+            'platform/RuntimeApplicationChecks.cpp',
+            'platform/RuntimeApplicationChecks.h',
             'platform/SSLKeyGenerator.h',
             'platform/SchemeRegistry.cpp',
             'platform/ScrollAnimator.cpp',
@@ -3899,7 +3954,7 @@
             'platform/graphics/cairo/GraphicsContextCairo.cpp',
             'platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h',
             'platform/graphics/cairo/ImageBufferCairo.cpp',
-            'platform/graphics/cairo/ImageBufferData.h',
+            'platform/graphics/cairo/ImageBufferDataCairo.h',
             'platform/graphics/cairo/ImageCairo.cpp',
             'platform/graphics/cairo/OwnPtrCairo.cpp',
             'platform/graphics/cairo/OwnPtrCairo.h',
@@ -3918,6 +3973,7 @@
             'platform/graphics/cg/GraphicsContextCG.h',
             'platform/graphics/cg/GraphicsContextPlatformPrivateCG.h',
             'platform/graphics/cg/ImageBufferCG.cpp',
+            'platform/graphics/cg/ImageBufferDataCG.cpp',
             'platform/graphics/cg/ImageCG.cpp',
             'platform/graphics/cg/ImageSourceCG.cpp',
             'platform/graphics/cg/ImageSourceCG.h',
@@ -3965,7 +4021,7 @@
             'platform/graphics/chromium/HarfbuzzSkia.cpp',
             'platform/graphics/chromium/HarfbuzzSkia.h',
             'platform/graphics/chromium/IconChromium.cpp',
-            'platform/graphics/chromium/ImageBufferData.h',
+            'platform/graphics/chromium/ImageBufferDataSkia.h',
             'platform/graphics/chromium/ImageChromium.cpp',
             'platform/graphics/chromium/ImageChromiumMac.mm',
             'platform/graphics/chromium/ImageLayerChromium.cpp',
@@ -4017,8 +4073,14 @@
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
             'platform/graphics/chromium/cc/CCLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.h',
+            'platform/graphics/chromium/cc/CCMainThread.cpp',
+            'platform/graphics/chromium/cc/CCMainThread.h',
+            'platform/graphics/chromium/cc/CCMainThreadTask.h',
             'platform/graphics/chromium/cc/CCPluginLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCPluginLayerImpl.h',
+            'platform/graphics/chromium/cc/CCThread.cpp',
+            'platform/graphics/chromium/cc/CCThread.h',
+            'platform/graphics/chromium/cc/CCThreadTask.h',
             'platform/graphics/chromium/cc/CCVideoLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCVideoLayerImpl.h',
             'platform/graphics/cocoa/FontPlatformDataCocoa.mm',
@@ -4074,6 +4136,8 @@
             'platform/graphics/filters/SourceGraphic.h',
             'platform/graphics/filters/SpotLightSource.cpp',
             'platform/graphics/filters/SpotLightSource.h',
+            'platform/graphics/filters/arm/FELightingNEON.cpp',
+            'platform/graphics/filters/arm/FELightingNEON.h',
             'platform/graphics/freetype/FontCacheFreeType.cpp',
             'platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp',
             'platform/graphics/freetype/FontPlatformData.h',
@@ -4164,7 +4228,7 @@
             'platform/graphics/haiku/GradientHaiku.cpp',
             'platform/graphics/haiku/GraphicsContextHaiku.cpp',
             'platform/graphics/haiku/IconHaiku.cpp',
-            'platform/graphics/haiku/ImageBufferData.h',
+            'platform/graphics/haiku/ImageBufferDataHaiku.h',
             'platform/graphics/haiku/ImageBufferHaiku.cpp',
             'platform/graphics/haiku/ImageHaiku.cpp',
             'platform/graphics/haiku/IntPointHaiku.cpp',
@@ -4257,7 +4321,7 @@
             'platform/graphics/qt/GraphicsLayerQt.cpp',
             'platform/graphics/qt/GraphicsLayerQt.h',
             'platform/graphics/qt/IconQt.cpp',
-            'platform/graphics/qt/ImageBufferData.h',
+            'platform/graphics/qt/ImageBufferDataQt.h',
             'platform/graphics/qt/ImageBufferQt.cpp',
             'platform/graphics/qt/ImageDecoderQt.cpp',
             'platform/graphics/qt/ImageDecoderQt.h',
@@ -4405,7 +4469,7 @@
             'platform/graphics/wince/GlyphPageTreeNodeWinCE.cpp',
             'platform/graphics/wince/GradientWinCE.cpp',
             'platform/graphics/wince/GraphicsContextWinCE.cpp',
-            'platform/graphics/wince/ImageBufferData.h',
+            'platform/graphics/wince/ImageBufferDataWince.h',
             'platform/graphics/wince/ImageBufferWinCE.cpp',
             'platform/graphics/wince/ImageWinCE.cpp',
             'platform/graphics/wince/MediaPlayerPrivateWinCE.h',
@@ -4431,7 +4495,7 @@
             'platform/graphics/wx/GradientWx.cpp',
             'platform/graphics/wx/GraphicsContextWx.cpp',
             'platform/graphics/wx/IconWx.cpp',
-            'platform/graphics/wx/ImageBufferData.h',
+            'platform/graphics/wx/ImageBufferDataWx.h',
             'platform/graphics/wx/ImageBufferWx.cpp',
             'platform/graphics/wx/ImageWx.cpp',
             'platform/graphics/wx/IntPointWx.cpp',
@@ -4843,6 +4907,7 @@
             'platform/text/RegularExpression.cpp',
             'platform/text/SegmentedString.cpp',
             'platform/text/String.cpp',
+            'platform/text/StringWithDirection.h',
             'platform/text/SuffixTree.h',
             'platform/text/TextBoundaries.cpp',
             'platform/text/TextBreakIteratorICU.cpp',
@@ -5081,8 +5146,6 @@
             'rendering/InlineIterator.h',
             'rendering/InlineTextBox.cpp',
             'rendering/LayoutState.cpp',
-            'rendering/MediaControlElements.cpp',
-            'rendering/MediaControlElements.h',
             'rendering/PointerEventsHitRules.cpp',
             'rendering/PointerEventsHitRules.h',
             'rendering/RenderApplet.cpp',
@@ -5128,8 +5191,6 @@
             'rendering/RenderImage.cpp',
             'rendering/RenderImageResource.cpp',
             'rendering/RenderImageResourceStyleImage.cpp',
-            'rendering/RenderIndicator.cpp',
-            'rendering/RenderIndicator.h',
             'rendering/RenderInline.cpp',
             'rendering/RenderInline.h',
             'rendering/RenderInputSpeech.cpp',
@@ -5446,6 +5507,8 @@
             'storage/IDBKeyPathBackendImpl.h',
             'storage/IDBKeyRange.cpp',
             'storage/IDBKeyRange.h',
+            'storage/IDBLevelDBBackingStore.cpp',
+            'storage/IDBLevelDBBackingStore.h',
             'storage/IDBObjectStore.cpp',
             'storage/IDBObjectStore.h',
             'storage/IDBObjectStoreBackendImpl.cpp',
@@ -5503,6 +5566,11 @@
             'storage/StorageEvent.h',
             'storage/StorageEventDispatcher.cpp',
             'storage/StorageEventDispatcher.h',
+            'storage/StorageInfo.cpp',
+            'storage/StorageInfo.h',
+            'storage/StorageInfoErrorCallback.h',
+            'storage/StorageInfoQuotaCallback.h',
+            'storage/StorageInfoUsageCallback.h',
             'storage/StorageMap.cpp',
             'storage/StorageMap.h',
             'storage/StorageNamespace.cpp',
@@ -5815,31 +5883,6 @@
             'svg/graphics/filters/SVGFilterBuilder.h',
             'svg/properties/SVGAnimatedPathSegListPropertyTearOff.h',
             'svg/properties/SVGPathSegListPropertyTearOff.cpp',
-            'thirdparty/glu/gluos.h',
-            'thirdparty/glu/internal_glu.h',
-            'thirdparty/glu/libtess/dict-list.h',
-            'thirdparty/glu/libtess/dict.c',
-            'thirdparty/glu/libtess/dict.h',
-            'thirdparty/glu/libtess/geom.c',
-            'thirdparty/glu/libtess/geom.h',
-            'thirdparty/glu/libtess/memalloc.c',
-            'thirdparty/glu/libtess/memalloc.h',
-            'thirdparty/glu/libtess/mesh.c',
-            'thirdparty/glu/libtess/mesh.h',
-            'thirdparty/glu/libtess/normal.c',
-            'thirdparty/glu/libtess/normal.h',
-            'thirdparty/glu/libtess/priorityq-heap.h',
-            'thirdparty/glu/libtess/priorityq-sort.h',
-            'thirdparty/glu/libtess/priorityq.c',
-            'thirdparty/glu/libtess/priorityq.h',
-            'thirdparty/glu/libtess/render.c',
-            'thirdparty/glu/libtess/render.h',
-            'thirdparty/glu/libtess/sweep.c',
-            'thirdparty/glu/libtess/sweep.h',
-            'thirdparty/glu/libtess/tess.c',
-            'thirdparty/glu/libtess/tess.h',
-            'thirdparty/glu/libtess/tessmono.c',
-            'thirdparty/glu/libtess/tessmono.h',
             'webaudio/AudioBasicProcessorNode.cpp',
             'webaudio/AudioBasicProcessorNode.h',
             'webaudio/AudioBuffer.cpp',
@@ -5878,6 +5921,8 @@
             'webaudio/BiquadProcessor.h',
             'webaudio/ConvolverNode.cpp',
             'webaudio/ConvolverNode.h',
+            'webaudio/DefaultAudioDestinationNode.cpp',
+            'webaudio/DefaultAudioDestinationNode.h',
             'webaudio/DelayDSPKernel.cpp',
             'webaudio/DelayDSPKernel.h',
             'webaudio/DelayNode.cpp',
@@ -5890,6 +5935,10 @@
             'webaudio/JavaScriptAudioNode.h',
             'webaudio/LowPass2FilterNode.cpp',
             'webaudio/LowPass2FilterNode.h',
+            'webaudio/OfflineAudioCompletionEvent.cpp',
+            'webaudio/OfflineAudioCompletionEvent.h',
+            'webaudio/OfflineAudioDestinationNode.cpp',
+            'webaudio/OfflineAudioDestinationNode.h',
             'webaudio/RealtimeAnalyser.cpp',
             'webaudio/RealtimeAnalyser.h',
             'webaudio/RealtimeAnalyserNode.cpp',
@@ -6124,8 +6173,6 @@
             'inspector/front-end/AuditRules.js',
             'inspector/front-end/AuditsPanel.js',
             'inspector/front-end/BottomUpProfileDataGridTree.js',
-            'inspector/front-end/Breakpoint.js',
-            'inspector/front-end/BreakpointManager.js',
             'inspector/front-end/BreakpointsSidebarPane.js',
             'inspector/front-end/CallStackSidebarPane.js',
             'inspector/front-end/Checkbox.js',
@@ -6148,6 +6195,7 @@
             'inspector/front-end/DetailedHeapshotGridNodes.js',
             'inspector/front-end/DetailedHeapshotView.js',
             'inspector/front-end/DOMAgent.js',
+            'inspector/front-end/DOMBreakpointsSidebarPane.js',
             'inspector/front-end/DOMStorage.js',
             'inspector/front-end/DOMStorageItemsView.js',
             'inspector/front-end/DOMSyntaxHighlighter.js',
@@ -6165,6 +6213,7 @@
             'inspector/front-end/GoToLineDialog.js',
             'inspector/front-end/HAREntry.js',
             'inspector/front-end/HeapSnapshot.js',
+            'inspector/front-end/HeapSnapshotProxy.js',
             'inspector/front-end/HeapSnapshotView.js',
             'inspector/front-end/HelpScreen.js',
             'inspector/front-end/ImageView.js',
@@ -6213,7 +6262,6 @@
             'inspector/front-end/SourceCSSTokenizer.js',
             'inspector/front-end/SourceFile.js',
             'inspector/front-end/SourceFrame.js',
-            'inspector/front-end/SourceFrameContent.js',
             'inspector/front-end/SourceHTMLTokenizer.js',
             'inspector/front-end/SourceJavaScriptTokenizer.js',
             'inspector/front-end/SourceTokenizer.js',
@@ -6238,8 +6286,6 @@
             'inspector/front-end/WatchExpressionsSidebarPane.js',
             'inspector/front-end/WelcomeView.js',
             'inspector/front-end/WorkersSidebarPane.js',
-            'inspector/front-end/UglifyJS/parse-js.js',
-            'inspector/front-end/UglifyJS/process.js',
             'inspector/front-end/audits.css',
             'inspector/front-end/goToLineDialog.css',
             'inspector/front-end/heapProfiler.css',
@@ -6250,6 +6296,10 @@
             'inspector/front-end/popover.css',
             'inspector/front-end/textViewer.css',
         ],
+        'webinspector_uglifyjs_files': [
+            'inspector/front-end/UglifyJS/parse-js.js',
+            'inspector/front-end/UglifyJS/process.js',
+        ],
         'webinspector_image_files': [
             'inspector/front-end/Images/applicationCache.png',
             'inspector/front-end/Images/auditsIcon.png',
@@ -6966,8 +7016,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSBeforeProcessEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSBlob.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSBlob.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSBlobBuilder.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSBlobBuilder.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCDATASection.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCDATASection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSCharsetRule.cpp',
@@ -7152,8 +7200,8 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSFileWriterCallback.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSFileWriterSync.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSFileWriterSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSFlags.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSFlags.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitFlags.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitFlags.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSFloat32Array.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSFloat32Array.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSGeolocation.cpp',
@@ -7821,6 +7869,12 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorage.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorageEvent.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorageEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorageInfo.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorageInfo.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorageInfoErrorCallback.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorageInfoErrorCallback.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorageInfoUsageCallback.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStorageInfoUsageCallback.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStyleMedia.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStyleMedia.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSStyleSheet.cpp',
@@ -7881,6 +7935,8 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationList.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitBlobBuilder.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitBlobBuilder.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframeRule.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframeRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframesRule.cpp',
@@ -7946,7 +8002,8 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/XMLNSNames.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/XMLNames.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/XMLNames.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/XMLViewerXSL.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/XMLViewerCSS.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/XMLViewerJS.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/XPathGrammar.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/XPathGrammar.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/tokenizer.cpp',
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index 3644184..3017570 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -10,6 +10,8 @@ QT *= network
 
 SOURCE_DIR = $$replace(PWD, /WebCore, "")
 
+contains(QT_CONFIG, qpa):CONFIG += embedded
+
 # Use a config-specific target to prevent parallel builds file clashes on Mac
 mac: CONFIG(debug, debug|release): WEBCORE_TARGET = webcored
 else: WEBCORE_TARGET = webcore
@@ -91,9 +93,11 @@ WEBCORE_INCLUDEPATH = \
     $$SOURCE_DIR/WebCore/platform/audio \
     $$SOURCE_DIR/WebCore/platform/graphics \
     $$SOURCE_DIR/WebCore/platform/graphics/filters \
+    $$SOURCE_DIR/WebCore/platform/graphics/filters/arm \
     $$SOURCE_DIR/WebCore/platform/graphics/texmap \
     $$SOURCE_DIR/WebCore/platform/graphics/transforms \
     $$SOURCE_DIR/WebCore/platform/image-decoders \
+    $$SOURCE_DIR/WebCore/platform/leveldb \
     $$SOURCE_DIR/WebCore/platform/mock \
     $$SOURCE_DIR/WebCore/platform/network \
     $$SOURCE_DIR/WebCore/platform/sql \
@@ -142,15 +146,12 @@ symbian {
         LIBS += -llibpthread
     }
 
-    symbian-abld|symbian-sbsv2 {
-        # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
-        # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
-        QMAKE_LFLAGS.ARMCC += --rw-base 0xE00000
-        MMP_RULES += ALWAYS_BUILD_AS_ARM
-    }  else {
-        QMAKE_CFLAGS -= --thumb
-        QMAKE_CXXFLAGS -= --thumb
-    }
+    # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
+    # Move RW-section base address to start from 0x1000000 instead of the toolchain default 0x400000.
+    QMAKE_LFLAGS.ARMCC += --rw-base 0x1000000
+    QMAKE_LFLAGS.GCCE += -Tdata 0x1000000
+
+    CONFIG += do_not_build_as_thumb
 
     CONFIG(release, debug|release): QMAKE_CXXFLAGS.ARMCC += -OTime -O3
     # Symbian plugin support
@@ -285,8 +286,6 @@ contains(DEFINES, ENABLE_SYMBIAN_DIALOG_PROVIDERS) {
     }
 }
 
-contains(QT_CONFIG, qpa):CONFIG += embedded
-
 !CONFIG(webkit-debug):CONFIG(QTDIR_build) {
     # Remove the following 2 lines if you want debug information in WebCore
     CONFIG -= separate_debug_info
@@ -300,7 +299,7 @@ contains (CONFIG, text_breaking_with_icu) {
 !CONFIG(QTDIR_build) {
     win32-*|wince* {
         DLLDESTDIR = $$OUTPUT_DIR/bin
-        build_pass: TARGET = $$qtLibraryTarget($$TARGET)
+        isEmpty(QT_SOURCE_TREE):build_pass: TARGET = $$qtLibraryTarget($$TARGET)
 
         dlltarget.commands = $(COPY_FILE) $(DESTDIR_TARGET) $$[QT_INSTALL_BINS]
         dlltarget.CONFIG = no_path
diff --git a/Source/WebCore/WebCore.pro b/Source/WebCore/WebCore.pro
index 2ac917a..d805809 100644
--- a/Source/WebCore/WebCore.pro
+++ b/Source/WebCore/WebCore.pro
@@ -229,6 +229,7 @@ v8 {
 } else {
     SOURCES += \
         bindings/ScriptControllerBase.cpp \
+        bindings/js/CallbackFunction.cpp \
         bindings/js/DOMObjectHashTableMap.cpp \
         bindings/js/DOMWrapperWorld.cpp \
         bindings/js/GCController.cpp \
@@ -533,6 +534,7 @@ SOURCES += \
     dom/ScriptRunner.cpp \
     dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
+    dom/ShadowRoot.cpp \
     dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
@@ -544,6 +546,7 @@ SOURCES += \
     dom/TouchEvent.cpp \
     dom/TouchList.cpp \
     dom/Traversal.cpp \
+    dom/TreeScope.cpp \
     dom/TreeWalker.cpp \
     dom/UIEvent.cpp \
     dom/UIEventWithKeyState.cpp \
@@ -597,6 +600,7 @@ SOURCES += \
     editing/SetNodeAttributeCommand.cpp \
     editing/SmartReplaceICU.cpp \
     editing/SpellChecker.cpp \
+    editing/SpellingCorrectionController.cpp \
     editing/SplitElementCommand.cpp \
     editing/SplitTextNodeCommand.cpp \
     editing/SplitTextNodeContainingElementCommand.cpp \
@@ -609,7 +613,6 @@ SOURCES += \
     editing/visible_units.cpp \
     editing/WrapContentsInDummySpanCommand.cpp \
     fileapi/Blob.cpp \
-    fileapi/BlobBuilder.cpp \
     fileapi/BlobURL.cpp \
     fileapi/File.cpp \
     fileapi/FileList.cpp \
@@ -619,6 +622,7 @@ SOURCES += \
     fileapi/FileStreamProxy.cpp \
     fileapi/FileThread.cpp \
     fileapi/ThreadableBlobRegistry.cpp \
+    fileapi/WebKitBlobBuilder.cpp \
     history/BackForwardController.cpp \
     history/BackForwardListImpl.cpp \
     history/CachedFrame.cpp \
@@ -799,11 +803,16 @@ SOURCES += \
     html/parser/TextDocumentParser.cpp \
     html/parser/TextViewSourceParser.cpp \
     html/parser/XSSFilter.cpp \
+    html/shadow/DetailsMarkerControl.cpp \
     html/shadow/MediaControls.cpp \
+    html/shadow/MediaControlRootElement.cpp \
+    html/shadow/MeterShadowElement.cpp \
+    html/shadow/ProgressShadowElement.cpp \
     html/shadow/SliderThumbElement.cpp \
     html/shadow/TextControlInnerElements.cpp \
     inspector/ConsoleMessage.cpp \
     inspector/DOMNodeHighlighter.cpp \
+    inspector/EventsCollector.cpp \
     inspector/InjectedScript.cpp \
     inspector/InjectedScriptHost.cpp \
     inspector/InjectedScriptManager.cpp \
@@ -822,6 +831,7 @@ SOURCES += \
     inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorFrontendClientLocal.cpp \
     inspector/InspectorFrontendHost.cpp \
+    inspector/InspectorFrontendProxy.cpp \
     inspector/InspectorInstrumentation.cpp \
     inspector/InspectorPageAgent.cpp \
     inspector/InspectorProfilerAgent.cpp \
@@ -837,6 +847,7 @@ SOURCES += \
     inspector/ScriptCallStack.cpp \
     inspector/TimelineRecordFactory.cpp \
     inspector/WorkerDebuggerAgent.cpp \
+    inspector/WorkerInspectorController.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
     loader/cache/MemoryCache.cpp \
@@ -1001,6 +1012,12 @@ SOURCES += \
     platform/Language.cpp \
     platform/Length.cpp \
     platform/text/LineEnding.cpp \
+    platform/leveldb/LevelDBComparator.h \
+    platform/leveldb/LevelDBDatabase.cpp \
+    platform/leveldb/LevelDBDatabase.h \
+    platform/leveldb/LevelDBIterator.cpp \
+    platform/leveldb/LevelDBIterator.h \
+    platform/leveldb/LevelDBSlice.h \
     platform/LinkHash.cpp \
     platform/Logging.cpp \
     platform/MIMETypeRegistry.cpp \
@@ -1025,6 +1042,7 @@ SOURCES += \
     platform/network/ResourceRequestBase.cpp \
     platform/network/ResourceResponseBase.cpp \
     platform/text/RegularExpression.cpp \
+    platform/RuntimeApplicationChecks.cpp \
     platform/SchemeRegistry.cpp \
     platform/ScrollableArea.cpp \
     platform/ScrollAnimator.cpp \
@@ -1095,7 +1113,6 @@ SOURCES += \
     rendering/RenderImage.cpp \
     rendering/RenderImageResource.cpp \
     rendering/RenderImageResourceStyleImage.cpp \
-    rendering/RenderIndicator.cpp \
     rendering/RenderInline.cpp \
     rendering/RenderLayer.cpp \
     rendering/RenderLayerBacking.cpp \
@@ -1266,6 +1283,7 @@ v8 {
 } else {
     HEADERS += \
         bindings/js/CachedScriptSourceProvider.h \
+        bindings/js/CallbackFunction.h \
         bindings/js/GCController.h \
         bindings/js/DOMObjectHashTableMap.h \
         bindings/js/DOMWrapperWorld.h \
@@ -1492,6 +1510,7 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectElement.h \
     dom/SelectorNodeList.h \
+    dom/ShadowRoot.h \
     dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
@@ -1506,6 +1525,7 @@ HEADERS += \
     dom/TransformSource.h \
     dom/Traversal.h \
     dom/TreeDepthLimit.h \
+    dom/TreeScope.h \
     dom/TreeWalker.h \
     dom/UIEvent.h \
     dom/UIEventWithKeyState.h \
@@ -1520,7 +1540,6 @@ HEADERS += \
     editing/ApplyStyleCommand.h \
     editing/BreakBlockquoteCommand.h \
     editing/CompositeEditCommand.h \
-    editing/CorrectionPanelInfo.h \
     editing/CreateLinkCommand.h \
     editing/DeleteButtonController.h \
     editing/DeleteButton.h \
@@ -1556,6 +1575,7 @@ HEADERS += \
     editing/SelectionController.h \
     editing/SetNodeAttributeCommand.h \
     editing/SmartReplace.h \
+    editing/SpellingCorrectionController.h \
     editing/SplitElementCommand.h \
     editing/SplitTextNodeCommand.h \
     editing/SplitTextNodeContainingElementCommand.h \
@@ -1567,7 +1587,6 @@ HEADERS += \
     editing/visible_units.h \
     editing/WrapContentsInDummySpanCommand.h \
     fileapi/Blob.h \
-    fileapi/BlobBuilder.h \
     fileapi/BlobURL.h \
     fileapi/File.h \
     fileapi/FileError.h \
@@ -1580,6 +1599,7 @@ HEADERS += \
     fileapi/FileStreamProxy.h \
     fileapi/FileThread.h \
     fileapi/FileThreadTask.h \
+    fileapi/WebKitBlobBuilder.h \
     history/BackForwardController.h \
     history/BackForwardListImpl.h \
     history/BackForwardList.h \
@@ -1732,8 +1752,11 @@ HEADERS += \
     html/parser/HTMLTreeBuilder.h \
     html/parser/HTMLViewSourceParser.h \
     html/parser/XSSFilter.h \
+    html/shadow/MediaControlElements.h \
+    html/shadow/DetailsMarkerControl.h \
     inspector/ConsoleMessage.h \
     inspector/DOMNodeHighlighter.h \
+    inspector/EventsCollector.h \
     inspector/InjectedScript.h \
     inspector/InjectedScriptHost.h \
     inspector/InjectedScriptManager.h \
@@ -1750,9 +1773,11 @@ HEADERS += \
     inspector/InspectorDebuggerAgent.h \
     inspector/InspectorDOMStorageAgent.h \
     inspector/InspectorDOMStorageResource.h \
+    inspector/InspectorFrontendChannel.h \
     inspector/InspectorFrontendClient.h \
     inspector/InspectorFrontendClientLocal.h \
     inspector/InspectorFrontendHost.h \
+    inspector/InspectorFrontendProxy.h \
     inspector/InspectorInstrumentation.h \
     inspector/InspectorPageAgent.h \
     inspector/InspectorProfilerAgent.h \
@@ -1913,6 +1938,7 @@ HEADERS += \
     platform/graphics/filters/LightSource.h \
     platform/graphics/filters/SourceAlpha.h \
     platform/graphics/filters/SourceGraphic.h \
+    platform/graphics/filters/arm/FELightingNEON.h \
     platform/graphics/FloatPoint3D.h \
     platform/graphics/FloatPoint.h \
     platform/graphics/FloatQuad.h \
@@ -1961,9 +1987,11 @@ HEADERS += \
     platform/KillRing.h \
     platform/KURL.h \
     platform/Length.h \
+    platform/text/BidiRunList.h \
     platform/text/LineEnding.h \
     platform/text/TextCheckerClient.h \
     platform/text/TextChecking.h \
+    platform/text/UnicodeBidi.h \
     platform/LinkHash.h \
     platform/Logging.h \
     platform/Language.h \
@@ -1981,10 +2009,12 @@ HEADERS += \
     platform/network/FormData.h \
     platform/network/HTTPHeaderMap.h \
     platform/network/HTTPParsers.h \
+    platform/network/MIMESniffing.h \
     platform/network/NetworkingContext.h \
     platform/network/NetworkStateNotifier.h \
     platform/network/ProtectionSpace.h \
     platform/network/ProxyServer.h \
+    platform/network/qt/QtMIMETypeSniffer.h \
     platform/network/qt/QNetworkReplyHandler.h \
     platform/network/ResourceErrorBase.h \
     platform/network/ResourceHandle.h \
@@ -2071,7 +2101,6 @@ HEADERS += \
     rendering/mathml/RenderMathMLSquareRoot.h \
     rendering/mathml/RenderMathMLSubSup.h \
     rendering/mathml/RenderMathMLUnderOver.h \
-    rendering/MediaControlElements.h \
     rendering/PaintInfo.h \
     rendering/PaintPhase.h \
     rendering/PointerEventsHitRules.h \
@@ -2099,7 +2128,6 @@ HEADERS += \
     rendering/RenderImageResource.h \
     rendering/RenderImageResourceStyleImage.h \
     rendering/RenderImage.h \
-    rendering/RenderIndicator.h \
     rendering/RenderInline.h \
     rendering/RenderInputSpeech.h \
     rendering/RenderLayer.h \
@@ -2498,11 +2526,13 @@ SOURCES += \
     platform/graphics/qt/PathQt.cpp \
     platform/graphics/qt/PatternQt.cpp \
     platform/graphics/qt/StillImageQt.cpp \
+    platform/network/MIMESniffing.cpp \
     platform/network/qt/CredentialStorageQt.cpp \
     platform/network/qt/ResourceHandleQt.cpp \
     platform/network/qt/ResourceRequestQt.cpp \
     platform/network/qt/DnsPrefetchHelper.cpp \
     platform/network/qt/ProxyServerQt.cpp \
+    platform/network/qt/QtMIMETypeSniffer.cpp \
     platform/network/qt/QNetworkReplyHandler.cpp \
     editing/qt/EditorQt.cpp \
     editing/qt/SmartReplaceQt.cpp \
@@ -2829,7 +2859,7 @@ contains(DEFINES, ENABLE_FILE_SYSTEM=1) {
         fileapi/FileWriterCallback.h \
         fileapi/FileWriterClient.h \
         fileapi/FileWriterSync.h \
-        fileapi/Flags.h \
+        fileapi/WebKitFlags.h \
         fileapi/LocalFileSystem.h \
         fileapi/Metadata.h \
         fileapi/MetadataCallback.h \
@@ -2917,15 +2947,26 @@ contains(DEFINES, ENABLE_INPUT_SPEECH=1) {
         rendering/RenderInputSpeech.cpp
 }
 
+contains(DEFINES, ENABLE_QUOTA=1) {
+    HEADERS += \
+        storage/StorageInfo.h \
+        storage/StorageInfoErrorCallback.h \
+        storage/StorageInfoQuotaCallback.h \
+        storage/StorageInfoUsageCallback.h
+
+    SOURCES += \
+        storage/StorageInfo.cpp
+}
+
 contains(DEFINES, ENABLE_VIDEO=1) {
     SOURCES += \
         html/HTMLAudioElement.cpp \
         html/HTMLMediaElement.cpp \
         html/HTMLSourceElement.cpp \
         html/HTMLVideoElement.cpp \
+        html/shadow/MediaControlElements.cpp \
         html/TimeRanges.cpp \
         platform/graphics/MediaPlayer.cpp \
-        rendering/MediaControlElements.cpp \
         rendering/RenderVideo.cpp \
         rendering/RenderMedia.cpp
 
@@ -3029,7 +3070,8 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/PointLightSource.cpp \
         platform/graphics/filters/SpotLightSource.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
-        platform/graphics/filters/SourceGraphic.cpp
+        platform/graphics/filters/SourceGraphic.cpp \
+        platform/graphics/filters/arm/FELightingNEON.cpp
 }
 
 contains(DEFINES, ENABLE_MATHML=1) {
@@ -3112,6 +3154,19 @@ contains(DEFINES, ENABLE_GEOLOCATION=1) {
     }
 }
 
+contains(DEFINES, ENABLE_MEDIA_STREAM=1) {
+    HEADERS += \
+        page/NavigatorUserMediaError.h \
+        page/NavigatorUserMediaErrorCallback.h \
+        page/NavigatorUserMediaSuccessCallback.h
+
+    v8 {
+        SOURCES += \
+            bindings/v8/custom/V8NavigatorCustom.cpp
+
+    }
+}
+
 contains(DEFINES, ENABLE_SVG=1) {
     !v8 {
         SOURCES += \
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops
index 5001f2b..023eae9 100644
--- a/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\QTMovieWinCommon.vsprops"
 	>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops
index aab50d9..7e7f87f 100644
--- a/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\QTMovieWinCommon.vsprops"
 	>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops
index df313d2..d0c85a3 100644
--- a/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\QTMovieWinCommon.vsprops"
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index f00a591..676949c 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -914,62 +914,6 @@
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSBlobBuilder.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSBlobBuilder.h"
-				>
-			</File>
-			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSCanvasGradient.cpp"
 				>
 				<FileConfiguration
@@ -5486,7 +5430,7 @@
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSFlags.cpp"
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitFlags.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -5538,7 +5482,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSFlags.h"
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitFlags.h"
 				>
 			</File>
 			<File
@@ -11878,6 +11822,174 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSNavigatorUserMediaError.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSNavigatorUserMediaError.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSNavigatorUserMediaErrorCallback.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSNavigatorUserMediaErrorCallback.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSNavigatorUserMediaSuccessCallback.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSNavigatorUserMediaSuccessCallback.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSNode.cpp"
 				>
 				<FileConfiguration
@@ -13558,6 +13670,30 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStorageInfo.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStorageInfo.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStorageInfoErrorCallback.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStorageInfoErrorCallback.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStorageInfoUsageCallback.cpp"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStorageInfoUsageCallback.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStringCallback.cpp"
 				>
 				<FileConfiguration
@@ -21854,6 +21990,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitBlobBuilder.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitBlobBuilder.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.cpp"
 				>
 				<FileConfiguration
@@ -23318,7 +23510,11 @@
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\XMLViewerXSL.h"
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\XMLViewerCSS.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\XMLViewerJS.h"
 				>
 			</File>
 			<File
@@ -24878,6 +25074,18 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\NavigatorUserMediaError.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\NavigatorUserMediaErrorCallback.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\NavigatorUserMediaSuccessCallback.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\OriginAccessEntry.cpp"
 				>
 			</File>
@@ -25062,6 +25270,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\fileapi\WebKitBlobBuilder.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\fileapi\WebKitBlobBuilder.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\WebKitPoint.h"
 				>
 			</File>
@@ -25782,19 +25998,19 @@
 				>
 			</File>
 			<File
-				RelativePath="..\platform\DragData.cpp"
+				RelativePath="..\platform\DefaultLocalizationStrategy.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\platform\DragData.h"
+				RelativePath="..\platform\DefaultLocalizationStrategy.h"
 				>
 			</File>
 			<File
-				RelativePath="..\platform\DefaultLocalizationStrategy.cpp"
+				RelativePath="..\platform\DragData.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\platform\DefaultLocalizationStrategy.h"
+				RelativePath="..\platform\DragData.h"
 				>
 			</File>
 			<File
@@ -25994,6 +26210,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\RuntimeApplicationChecks.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\platform\RuntimeApplicationChecks.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\SchemeRegistry.cpp"
 				>
 			</File>
@@ -26564,6 +26788,10 @@
 					RelativePath="..\platform\win\WindowMessageListener.h"
 					>
 				</File>
+				<File
+					RelativePath="..\platform\win\WindowsTouch.h"
+					>
+				</File>
 			</Filter>
 			<Filter
 				Name="cf"
@@ -26739,54 +26967,6 @@
 				<File
 					RelativePath="..\platform\graphics\Font.cpp"
 					>
-					<FileConfiguration
-						Name="Debug|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Release|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Debug_Cairo_CFLite|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Release_Cairo_CFLite|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Debug_All|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Production|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\graphics\Font.h"
@@ -26953,6 +27133,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\ImageBufferData.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\ImageObserver.h"
 					>
 				</File>
@@ -27100,6 +27284,14 @@
 					Name="win"
 					>
 					<File
+						RelativePath="..\platform\graphics\win\DIBPixelData.cpp"
+						>
+					</File>
+					<File
+						RelativePath="..\platform\graphics\win\DIBPixelData.h"
+						>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\win\FontCacheWin.cpp"
 						>
 					</File>
@@ -27246,54 +27438,6 @@
 					<File
 						RelativePath="..\platform\graphics\win\FontWin.cpp"
 						>
-						<FileConfiguration
-							Name="Debug|Win32"
-							>
-							<Tool
-								Name="VCCLCompilerTool"
-								AdditionalOptions="$(AnalyzeWithLargeStack)"
-							/>
-						</FileConfiguration>
-						<FileConfiguration
-							Name="Release|Win32"
-							>
-							<Tool
-								Name="VCCLCompilerTool"
-								AdditionalOptions="$(AnalyzeWithLargeStack)"
-							/>
-						</FileConfiguration>
-						<FileConfiguration
-							Name="Debug_Cairo_CFLite|Win32"
-							>
-							<Tool
-								Name="VCCLCompilerTool"
-								AdditionalOptions="$(AnalyzeWithLargeStack)"
-							/>
-						</FileConfiguration>
-						<FileConfiguration
-							Name="Release_Cairo_CFLite|Win32"
-							>
-							<Tool
-								Name="VCCLCompilerTool"
-								AdditionalOptions="$(AnalyzeWithLargeStack)"
-							/>
-						</FileConfiguration>
-						<FileConfiguration
-							Name="Debug_All|Win32"
-							>
-							<Tool
-								Name="VCCLCompilerTool"
-								AdditionalOptions="$(AnalyzeWithLargeStack)"
-							/>
-						</FileConfiguration>
-						<FileConfiguration
-							Name="Production|Win32"
-							>
-							<Tool
-								Name="VCCLCompilerTool"
-								AdditionalOptions="$(AnalyzeWithLargeStack)"
-							/>
-						</FileConfiguration>
 					</File>
 					<File
 						RelativePath="..\platform\graphics\win\GlyphPageTreeNodeCairoWin.cpp"
@@ -27928,6 +28072,26 @@
 						</FileConfiguration>
 					</File>
 					<File
+						RelativePath="..\platform\graphics\cg\ImageBufferDataCG.cpp"
+						>
+						<FileConfiguration
+							Name="Debug_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release_Cairo_CFLite|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\cg\ImageCG.cpp"
 						>
 						<FileConfiguration
@@ -28712,6 +28876,114 @@
 						</FileConfiguration>
 					</File>
 					<File
+						RelativePath="..\platform\graphics\cairo\PlatformContextCairo.cpp"
+						>
+						<FileConfiguration
+							Name="Debug|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Debug_All|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Production|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
+						RelativePath="..\platform\graphics\cairo\PlatformPathCairo.cpp"
+						>
+						<FileConfiguration
+							Name="Debug|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Debug_All|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Production|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCLCompilerTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
+						RelativePath="..\platform\graphics\cairo\PlatformPathCairo.h"
+						>
+						<FileConfiguration
+							Name="Debug|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCustomBuildTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Release|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCustomBuildTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Debug_All|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCustomBuildTool"
+							/>
+						</FileConfiguration>
+						<FileConfiguration
+							Name="Production|Win32"
+							ExcludedFromBuild="true"
+							>
+							<Tool
+								Name="VCCustomBuildTool"
+							/>
+						</FileConfiguration>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\cairo\RefPtrCairo.cpp"
 						>
 						<FileConfiguration
@@ -29135,6 +29407,10 @@
 						Name="win"
 						>
 						<File
+							RelativePath="..\platform\graphics\ca\win\AbstractCACFLayerTreeHost.h"
+							>
+						</File>
+						<File
 							RelativePath="..\platform\graphics\ca\win\CACFLayerTreeHost.cpp"
 							>
 							<FileConfiguration
@@ -30465,6 +30741,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\BidiRunList.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\text\Hyphenation.h"
 					>
 				</File>
@@ -30529,6 +30809,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\StringWithDirection.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\text\SuffixTree.h"
 					>
 				</File>
@@ -30575,54 +30859,6 @@
 				<File
 					RelativePath="..\platform\text\TextCodecICU.cpp"
 					>
-					<FileConfiguration
-						Name="Debug|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Release|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Debug_Cairo_CFLite|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Release_Cairo_CFLite|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Debug_All|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
-					<FileConfiguration
-						Name="Production|Win32"
-						>
-						<Tool
-							Name="VCCLCompilerTool"
-							AdditionalOptions="$(AnalyzeWithLargeStack)"
-						/>
-					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecICU.h"
@@ -30697,6 +30933,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\UnicodeBidi.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\text\UnicodeRange.cpp"
 					>
 				</File>
@@ -32818,62 +33058,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\MediaControlElements.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\rendering\MediaControlElements.h"
-				>
-			</File>
-			<File
 				RelativePath="..\rendering\PaintInfo.h"
 				>
 			</File>
@@ -34390,62 +34574,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\RenderIndicator.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\rendering\RenderIndicator.h"
-				>
-			</File>
-			<File
 				RelativePath="..\rendering\RenderingAllInOne.cpp"
 				>
 			</File>
@@ -44409,6 +44537,14 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
 					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
@@ -46514,6 +46650,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\ShadowRoot.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\ShadowRoot.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\SpaceSplitString.cpp"
 				>
 				<FileConfiguration
@@ -47190,6 +47382,62 @@
 				</FileConfiguration>
 			</File>
 			<File
+				RelativePath="..\dom\TreeScope.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\TreeScope.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\TreeWalker.h"
 				>
 			</File>
@@ -50250,6 +50498,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\editing\SpellingCorrectionController.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_LTCG|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\editing\SpellingCorrectionController.h"
+				>
+			</File>
+			<File
 				RelativePath="..\editing\SplitElementCommand.cpp"
 				>
 				<FileConfiguration
@@ -50950,14 +51254,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\fileapi\BlobBuilder.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\fileapi\BlobBuilder.h"
-				>
-			</File>
-			<File
 				RelativePath="..\fileapi\BlobURL.cpp"
 				>
 			</File>
@@ -51426,7 +51722,7 @@
 				>
 			</File>
 			<File
-				RelativePath="..\fileapi\Flags.h"
+				RelativePath="..\fileapi\WebKitFlags.h"
 				>
 			</File>
 			<File
@@ -56405,6 +56701,14 @@
 				Name="shadow"
 				>
 				<File
+					RelativePath="..\html\shadow\DetailsMarkerControl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\DetailsMarkerControl.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\MediaControls.cpp"
 					>
 				</File>
@@ -56413,10 +56717,42 @@
 					>
 				</File>
 				<File
+					RelativePath="..\html\shadow\MediaControlElements.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\MediaControlElements.h"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\MediaControlRootElement.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\MediaControlRootElement.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\ProgressBarValueElement.h"
 					>
 				</File>
 				<File
+					RelativePath="..\html\shadow\MeterShadowElement.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\MeterShadowElement.h"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\ProgressShadowElement.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\ProgressShadowElement.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\SliderThumbElement.cpp"
 					>
 				</File>
@@ -56493,6 +56829,62 @@
 					>
 				</File>
 				<File
+					RelativePath="..\bindings\js\CallbackFunction.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\CallbackFunction.h"
+					>
+				</File>
+				<File
 					RelativePath="..\bindings\js\DOMObjectHashTableMap.cpp"
 					>
 					<FileConfiguration
@@ -63185,6 +63577,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\bindings\js\PageScriptDebugServer.h"
+					>
+				</File>
+				<File
 					RelativePath="..\bindings\js\ScheduledAction.cpp"
 					>
 					<FileConfiguration
@@ -64016,10 +64412,6 @@
 						/>
 					</FileConfiguration>
 				</File>
-				<File
-					RelativePath="..\bindings\js\PageScriptDebugServer.h"
-					>
-				</File>
 			</Filter>
 			<Filter
 				Name="scripts"
@@ -65622,16 +66014,12 @@
 				</File>
 			</Filter>
 			<Filter
-				Name="collector"
+				Name="heap"
 				>
-				<Filter
-					Name="handles"
-					>
-					<File
-						RelativePath="..\ForwardingHeaders\collector\handles\Global.h"
-						>
-					</File>
-				</Filter>
+                                    <File
+                                            RelativePath="..\ForwardingHeaders\heap\Strong.h"
+                                            >
+                                    </File>
 			</Filter>
 		</Filter>
 		<Filter
@@ -66106,6 +66494,26 @@
 				>
 			</File>
 			<File
+				RelativePath="..\storage\StorageInfo.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageInfo.h"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageInfoErrorCallback.h"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageInfoQuotaCallback.h"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageInfoUsageCallback.h"
+				>
+			</File>
+			<File
 				RelativePath="..\storage\StorageMap.cpp"
 				>
 			</File>
@@ -66306,6 +66714,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\EventsCollector.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\EventsCollector.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\DOMNodeHighlighter.cpp"
 				>
 			</File>
@@ -66450,6 +66866,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorFrontendChannel.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorFrontendClient.h"
 				>
 			</File>
@@ -66470,15 +66890,19 @@
 				>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorInstrumentation.cpp"
+				RelativePath="..\inspector\InspectorFrontendProxy.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorInstrumentation.h"
+				RelativePath="..\inspector\InspectorFrontendProxy.h"
 				>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorProfilerAgent.cpp"
+				RelativePath="..\inspector\InspectorInstrumentation.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InspectorInstrumentation.h"
 				>
 			</File>
 			<File
@@ -66490,6 +66914,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorProfilerAgent.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorProfilerAgent.h"
 				>
 			</File>
@@ -66605,6 +67033,14 @@
 				RelativePath="..\inspector\WorkerDebuggerAgent.h"
 				>
 			</File>
+			<File
+				RelativePath="..\inspector\WorkerInspectorController.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\WorkerInspectorController.h"
+				>
+			</File>
 			<Filter
 				Name="front-end"
 				>
@@ -66645,14 +67081,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\Breakpoint.js"
-					>
-				</File>
-				<File
-					RelativePath="..\inspector\front-end\BreakpointManager.js"
-					>
-				</File>
-				<File
 					RelativePath="..\inspector\front-end\BreakpointsSidebarPane.js"
 					>
 				</File>
@@ -66745,6 +67173,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\DOMBreakpointsSidebarPane.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\DOMStorage.js"
 					>
 				</File>
@@ -66821,6 +67253,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\HeapSnapshotProxy.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\HeapSnapshotView.js"
 					>
 				</File>
@@ -67037,10 +67473,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\SourceFrameContent.js"
-					>
-				</File>
-				<File
 					RelativePath="..\inspector\front-end\SourceHTMLTokenizer.js"
 					>
 				</File>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj b/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
index 23bedfb..a07eccd 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
@@ -81,7 +81,7 @@
 			>
 		</File>
 		<File
-			RelativePath=".\copyInspectorFiles.cmd"
+			RelativePath=".\copyWebCoreResourceFiles.cmd"
 			>
 		</File>
 		<File
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreGeneratedCairo.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreGeneratedCairo.vsprops
index 544b179..a4eb98c 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreGeneratedCairo.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreGeneratedCairo.vsprops
@@ -7,8 +7,8 @@
 	>
 	<Tool
 		Name="VCNMakeTool"
-		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(ConfigurationBuildDir)&#x0D;&#x0A;bash build-generated-files.sh &quot;$(ConfigurationBuildDir)&quot; &quot;$(WebKitLibrariesDir)&quot; &quot;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win&quot; cairo&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(ConfigurationBuildDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cairo curl&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
-		ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(ConfigurationBuildDir)&#x0D;&#x0A;bash build-generated-files.sh &quot;$(ConfigurationBuildDir)&quot; &quot;$(WebKitLibrariesDir)&quot; &quot;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win&quot; cairo&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(ConfigurationBuildDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cairo curl&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
+		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(ConfigurationBuildDir)&#x0D;&#x0A;bash build-generated-files.sh &quot;$(ConfigurationBuildDir)&quot; &quot;$(WebKitLibrariesDir)&quot; &quot;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win&quot; cairo&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(ConfigurationBuildDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cairo curl&#x0D;&#x0A;cmd /C copyWebCoreResourceFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
+		ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(ConfigurationBuildDir)&#x0D;&#x0A;bash build-generated-files.sh &quot;$(ConfigurationBuildDir)&quot; &quot;$(WebKitLibrariesDir)&quot; &quot;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win&quot; cairo&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(ConfigurationBuildDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cairo curl&#x0D;&#x0A;cmd /C copyWebCoreResourceFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
 		CleanCommandLine="del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
 	/>
 </VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreGeneratedCommon.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreGeneratedCommon.vsprops
index 4bd0f6a..5f12834 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreGeneratedCommon.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreGeneratedCommon.vsprops
@@ -8,8 +8,8 @@
 	>
 	<Tool
 		Name="VCNMakeTool"
-		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(ConfigurationBuildDir)&quot; &quot;$(WebKitLibrariesDir)&quot; &quot;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win&quot; windows&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(ConfigurationBuildDir)&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/$(ConfigurationName)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
-		ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(ConfigurationBuildDir)&quot; &quot;$(WebKitLibrariesDir)&quot; &quot;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win&quot; windows&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(ConfigurationBuildDir)&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/$(ConfigurationName)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
+		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(ConfigurationBuildDir)&quot; &quot;$(WebKitLibrariesDir)&quot; &quot;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win&quot; windows&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(ConfigurationBuildDir)&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/$(ConfigurationName)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyWebCoreResourceFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
+		ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(ConfigurationBuildDir)&quot; &quot;$(WebKitLibrariesDir)&quot; &quot;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win&quot; windows&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(ConfigurationBuildDir)&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/$(ConfigurationName)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyWebCoreResourceFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
 		CleanCommandLine="del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(ConfigurationBuildDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;if exist &quot;$(ConfigurationBuildDir)\buildfailed&quot; del &quot;$(ConfigurationBuildDir)\buildfailed&quot;&#x0D;&#x0A;"
 	/>
 </VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCorePreBuild.cmd b/Source/WebCore/WebCore.vcproj/WebCorePreBuild.cmd
index 15f5324..7401678 100644
--- a/Source/WebCore/WebCore.vcproj/WebCorePreBuild.cmd
+++ b/Source/WebCore/WebCore.vcproj/WebCorePreBuild.cmd
@@ -5,8 +5,4 @@ if exist "%CONFIGURATIONBUILDDIR%\buildfailed" grep XX%PROJECTNAME%XX "%CONFIGUR
 if errorlevel 1 exit 1
 echo XX%PROJECTNAME%XX > "%CONFIGURATIONBUILDDIR%\buildfailed"
 
-touch "%CONFIGURATIONBUILDDIR%\tmp.cpp"
-cl /analyze /nologo /c "%CONFIGURATIONBUILDDIR%\tmp.cpp" /Fo"%INTDIR%\tmp.obj" 2>&1 | findstr D9040
-if ERRORLEVEL 1 (set EnablePREfast="true") else (set EnablePREfast="false")
-if ERRORLEVEL 1 (set AnalyzeWithLargeStack="/analyze:65536") else (set AnalyzeWithLargeStack="")
 exit /b
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops
index af07ec2..ce5c610 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WebCoreCommon.vsprops;
       .\WebCoreCG.vsprops;
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops
index f1c9d03..a9d222c 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WebCoreCommon.vsprops;
       .\WebCoreCG.vsprops;
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops
index 613c9b1..fb5a292 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\WebCoreCommon.vsprops;
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index 98d2452..2149a86 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -8,8 +8,7 @@ mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\parser"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\runtime"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\masm"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\profiler"
-mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\collector"
-mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\collector\handles"
+mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\heap"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\text"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\unicode"
@@ -78,7 +77,7 @@ xcopy /y /d "%ProjectDir%..\ForwardingHeaders\parser\*.h" "%CONFIGURATIONBUILDDI
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\runtime\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\runtime"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\masm\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\masm"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\profiler\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\profiler"
-xcopy /y /d "%ProjectDir%..\ForwardingHeaders\collector\handles\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\collector\handles"
+xcopy /y /d "%ProjectDir%..\ForwardingHeaders\heap\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\heap"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\wtf\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\wtf\text\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\text"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\wtf\unicode\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\wtf\unicode"
diff --git a/Source/WebCore/WebCore.vcproj/copyInspectorFiles.cmd b/Source/WebCore/WebCore.vcproj/copyWebCoreResourceFiles.cmd
index 4a7f67a..62d1ffc 100755
--- a/Source/WebCore/WebCore.vcproj/copyInspectorFiles.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyWebCoreResourceFiles.cmd
@@ -3,3 +3,4 @@ xcopy /y /d /s /exclude:xcopy.excludes "%ProjectDir%..\inspector\front-end\*" "%
 xcopy /y /d /s /exclude:xcopy.excludes "%CONFIGURATIONBUILDDIR%\obj\WebCore\DerivedSources\InspectorBackendStub.js" "%CONFIGURATIONBUILDDIR%\bin\WebKit.resources\inspector"
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\bin\WebKit.resources\en.lproj"
 xcopy /y /d /s /exclude:xcopy.excludes "%ProjectDir%..\English.lproj\localizedStrings.js" "%CONFIGURATIONBUILDDIR%\bin\WebKit.resources\en.lproj"
+xcopy /y /d /s /exclude:xcopy.excludes "%ProjectDir%..\English.lproj\Localizable.strings" "%CONFIGURATIONBUILDDIR%\bin\WebKit.resources\en.lproj"
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 45ea664..8475a91 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -316,6 +316,8 @@
 		14CF78A609F58CD800EB3665 /* JSCSSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 14CF78A509F58CD800EB3665 /* JSCSSValue.h */; };
 		14CF7B3309F6ECD700EB3665 /* JSCSSRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14CF7B3109F6ECD700EB3665 /* JSCSSRule.cpp */; };
 		14CF7B3409F6ECD700EB3665 /* JSCSSRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 14CF7B3209F6ECD700EB3665 /* JSCSSRule.h */; };
+		14D64B5C134A5B6B00E58FDA /* TreeScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14D64B5A134A5B6B00E58FDA /* TreeScope.cpp */; };
+		14D64B5D134A5B6B00E58FDA /* TreeScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D64B5B134A5B6B00E58FDA /* TreeScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14D823520AF92A790004F057 /* Chrome.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D823500AF92A790004F057 /* Chrome.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14D8238B0AF92DF60004F057 /* Chrome.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14D8238A0AF92DF60004F057 /* Chrome.cpp */; };
 		14D824080AF93AEB0004F057 /* ChromeClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D824060AF93AEB0004F057 /* ChromeClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -641,16 +643,28 @@
 		1CF6BE140E9BB4670025E1CD /* ObjCNodeFilterCondition.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1CF6BE120E9BB4670025E1CD /* ObjCNodeFilterCondition.mm */; };
 		1CF6BE150E9BB4670025E1CD /* ObjCNodeFilterCondition.h in Headers */ = {isa = PBXBuildFile; fileRef = 1CF6BE130E9BB4670025E1CD /* ObjCNodeFilterCondition.h */; };
 		1CFAE3230A6D6A3F0032593D /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 1CFAE3220A6D6A3F0032593D /* libobjc.dylib */; };
+		1F3C3BEA135CAF3C00B8C1AC /* MediaControls.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1F3C3BE8135CAF3C00B8C1AC /* MediaControls.cpp */; };
+		1F3C3BEB135CAF3C00B8C1AC /* MediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 1F3C3BE9135CAF3C00B8C1AC /* MediaControls.h */; };
 		20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 20D629241253690B00081543 /* InspectorInstrumentation.cpp */; };
 		20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 20D629251253690B00081543 /* InspectorInstrumentation.h */; };
+		227777601345DEA9008EA455 /* InspectorFrontendChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 2277775F1345DEA9008EA455 /* InspectorFrontendChannel.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		22777B4A134A018C008EA455 /* EventsCollector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 22777B48134A018C008EA455 /* EventsCollector.cpp */; };
+		22777B4B134A018C008EA455 /* EventsCollector.h in Headers */ = {isa = PBXBuildFile; fileRef = 22777B49134A018C008EA455 /* EventsCollector.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		22777B4E134A01A8008EA455 /* InspectorFrontendProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 22777B4C134A01A8008EA455 /* InspectorFrontendProxy.cpp */; };
+		22777B4F134A01A8008EA455 /* InspectorFrontendProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 22777B4D134A01A8008EA455 /* InspectorFrontendProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		22885E641301AE4C00526E68 /* JSDOMImplementationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */; };
 		228C284510D82500009D0D0E /* ScriptWrappable.h in Headers */ = {isa = PBXBuildFile; fileRef = 228C284410D82500009D0D0E /* ScriptWrappable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2292B27C1356669400CF11EF /* ImageBufferDataCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2292B27B1356669400CF11EF /* ImageBufferDataCG.cpp */; };
+		22BD9F7F1353625C009BD102 /* ImageBufferData.h in Headers */ = {isa = PBXBuildFile; fileRef = 22BD9F7D1353625C009BD102 /* ImageBufferData.h */; };
+		22BD9F81135364FE009BD102 /* ImageBufferDataCG.h in Headers */ = {isa = PBXBuildFile; fileRef = 22BD9F80135364FE009BD102 /* ImageBufferDataCG.h */; };
 		245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 245D80A213280E40003492A6 /* SQLCallbackWrapper.h */; };
 		24F54EAC101FE914000AE741 /* ApplicationCacheHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */; };
 		24F54EAD101FE914000AE741 /* ApplicationCacheHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */; settings = {ATTRIBUTES = (); }; };
 		2542F4DA1166C25A00E89A86 /* UserGestureIndicator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */; };
 		2542F4DB1166C25A00E89A86 /* UserGestureIndicator.h in Headers */ = {isa = PBXBuildFile; fileRef = 2542F4D91166C25A00E89A86 /* UserGestureIndicator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		26E98A10130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 26E98A0F130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h */; };
+		293EAE1F1356B2FE0067ACF9 /* RuntimeApplicationChecks.h in Headers */ = {isa = PBXBuildFile; fileRef = 293EAE1E1356B2FE0067ACF9 /* RuntimeApplicationChecks.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		293EAE211356B32E0067ACF9 /* RuntimeApplicationChecks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 293EAE201356B32E0067ACF9 /* RuntimeApplicationChecks.cpp */; };
 		29489FC712C00F0300D83F0F /* AccessibilityScrollView.h in Headers */ = {isa = PBXBuildFile; fileRef = 29489FC512C00F0300D83F0F /* AccessibilityScrollView.h */; };
 		29A8122B0FBB9C1D00510293 /* AccessibilityTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8120D0FBB9C1D00510293 /* AccessibilityTable.h */; };
 		29A8122C0FBB9C1D00510293 /* AccessibilityList.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A8120E0FBB9C1D00510293 /* AccessibilityList.h */; };
@@ -886,8 +900,8 @@
 		4138D3361244054800323D33 /* EventContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4138D3341244054800323D33 /* EventContext.cpp */; };
 		4150F9F112B6E0E70008C860 /* SliderThumbElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */; };
 		4150F9F212B6E0E70008C860 /* SliderThumbElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */; };
-		4157AF8012F1FB0400A8C6F5 /* MediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 4157AF7E12F1FB0400A8C6F5 /* MediaControls.h */; };
-		4157AF8112F1FB0400A8C6F5 /* MediaControls.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4157AF7F12F1FB0400A8C6F5 /* MediaControls.cpp */; };
+		4157AF8012F1FB0400A8C6F5 /* MediaControlRootElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4157AF7E12F1FB0400A8C6F5 /* MediaControlRootElement.h */; };
+		4157AF8112F1FB0400A8C6F5 /* MediaControlRootElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4157AF7F12F1FB0400A8C6F5 /* MediaControlRootElement.cpp */; };
 		4162A450101145AE00DFF3ED /* DedicatedWorkerContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4162A44D101145AE00DFF3ED /* DedicatedWorkerContext.cpp */; };
 		4162A451101145AE00DFF3ED /* DedicatedWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 4162A44E101145AE00DFF3ED /* DedicatedWorkerContext.h */; };
 		4162A454101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4162A453101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp */; };
@@ -900,6 +914,8 @@
 		416E75BF0EDF8FD700360E1D /* ScriptCallStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */; };
 		416E75CB0EDF90C700360E1D /* ScriptCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E75C90EDF90C700360E1D /* ScriptCallFrame.h */; };
 		416E75CC0EDF90C700360E1D /* ScriptCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */; };
+		417253AA1354BBBC00360F2A /* MediaControlElements.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 417253A81354BBBC00360F2A /* MediaControlElements.cpp */; };
+		417253AB1354BBBC00360F2A /* MediaControlElements.h in Headers */ = {isa = PBXBuildFile; fileRef = 417253A91354BBBC00360F2A /* MediaControlElements.h */; };
 		41885B9311B6FDA6003383BB /* FormSubmission.h in Headers */ = {isa = PBXBuildFile; fileRef = 41885B9111B6FDA6003383BB /* FormSubmission.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41885B9411B6FDA6003383BB /* FormSubmission.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41885B9211B6FDA6003383BB /* FormSubmission.cpp */; };
 		418A06D0133C04D500CD379C /* EventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 418A06CE133C04D500CD379C /* EventDispatcher.h */; };
@@ -1003,8 +1019,6 @@
 		44311CD812E4E24B000A8D19 /* DOMDocumentPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 44311CD512E4E22D000A8D19 /* DOMDocumentPrivate.h */; };
 		44311CD912E4E257000A8D19 /* DOMDocumentFragmentPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 44311CD412E4E22D000A8D19 /* DOMDocumentFragmentPrivate.h */; };
 		44311F8212E4E66C000A8D19 /* DOMDocumentFragmentInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 85E711450AC5D5340053270F /* DOMDocumentFragmentInternal.h */; };
-		447D69030FA626810015CCB1 /* RuntimeApplicationChecks.h in Headers */ = {isa = PBXBuildFile; fileRef = 447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		447D69040FA626810015CCB1 /* RuntimeApplicationChecks.mm in Sources */ = {isa = PBXBuildFile; fileRef = 447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */; };
 		448A29BF0A46D9CB0030759F /* JSHTMLOptionsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 448A29BD0A46D9CB0030759F /* JSHTMLOptionsCollection.h */; };
 		448A29C00A46D9CB0030759F /* JSHTMLOptionsCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 448A29BE0A46D9CB0030759F /* JSHTMLOptionsCollection.cpp */; };
 		448AD27C0A48137A0023D179 /* JSHTMLOptionsCollectionCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 448AD27A0A4813790023D179 /* JSHTMLOptionsCollectionCustom.cpp */; };
@@ -1032,7 +1046,7 @@
 		490707E61219C04300D90E51 /* ANGLEWebKitBridge.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 490707E41219C04300D90E51 /* ANGLEWebKitBridge.cpp */; };
 		490707E71219C04300D90E51 /* ANGLEWebKitBridge.h in Headers */ = {isa = PBXBuildFile; fileRef = 490707E51219C04300D90E51 /* ANGLEWebKitBridge.h */; };
 		492863991253B8FC00F792D6 /* ResourceLoadInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 492863981253B8FC00F792D6 /* ResourceLoadInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		493E5E0912D6420500020081 /* PlatformCALayerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 493E5E0812D6420500020081 /* PlatformCALayerClient.h */; };
+		493E5E0912D6420500020081 /* PlatformCALayerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 493E5E0812D6420500020081 /* PlatformCALayerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */; };
 		49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB4102CF23C00187DD3 /* CanvasGradient.h */; };
 		49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */; };
@@ -1075,10 +1089,10 @@
 		498770F21242C535002226BA /* TilingData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498770D91242C535002226BA /* TilingData.cpp */; };
 		498770F31242C535002226BA /* TilingData.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770DA1242C535002226BA /* TilingData.h */; };
 		498771531243F9FA002226BA /* DrawingBufferMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 498771521243F9FA002226BA /* DrawingBufferMac.mm */; };
-		499B3EC5128CCC4700E726C2 /* PlatformCALayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 499B3EC3128CCC4700E726C2 /* PlatformCALayer.h */; };
+		499B3EC5128CCC4700E726C2 /* PlatformCALayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 499B3EC3128CCC4700E726C2 /* PlatformCALayer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		499B3ED6128CD31400E726C2 /* GraphicsLayerCA.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 499B3ED4128CD31400E726C2 /* GraphicsLayerCA.cpp */; };
-		499B3ED7128CD31400E726C2 /* GraphicsLayerCA.h in Headers */ = {isa = PBXBuildFile; fileRef = 499B3ED5128CD31400E726C2 /* GraphicsLayerCA.h */; };
-		499B3EDD128DB50200E726C2 /* PlatformCAAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 499B3EDC128DB50100E726C2 /* PlatformCAAnimation.h */; };
+		499B3ED7128CD31400E726C2 /* GraphicsLayerCA.h in Headers */ = {isa = PBXBuildFile; fileRef = 499B3ED5128CD31400E726C2 /* GraphicsLayerCA.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		499B3EDD128DB50200E726C2 /* PlatformCAAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 499B3EDC128DB50100E726C2 /* PlatformCAAnimation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49B69E5E1254FEED007D57EB /* LoopBlinnClassifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49B69E551254FEED007D57EB /* LoopBlinnClassifier.cpp */; };
 		49B69E5F1254FEED007D57EB /* LoopBlinnClassifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 49B69E561254FEED007D57EB /* LoopBlinnClassifier.h */; };
 		49B69E601254FEED007D57EB /* LoopBlinnConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = 49B69E571254FEED007D57EB /* LoopBlinnConstants.h */; };
@@ -2646,6 +2660,17 @@
 		86243D0111BC31F700CC006A /* JSArrayBufferViewHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = 86243D0011BC31F700CC006A /* JSArrayBufferViewHelper.h */; };
 		86D982F7125C154000AD9E3D /* DocumentTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D982F6125C154000AD9E3D /* DocumentTiming.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		890AE0E11256A07900F5968C /* DirectoryReaderBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 890AE0E01256A07900F5968C /* DirectoryReaderBase.h */; };
+		892CF192134C620D00AAEDA1 /* StorageInfoErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 892CF18D134C620D00AAEDA1 /* StorageInfoErrorCallback.h */; };
+		892CF193134C620D00AAEDA1 /* StorageInfoQuotaCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 892CF18E134C620D00AAEDA1 /* StorageInfoQuotaCallback.h */; };
+		892CF194134C620D00AAEDA1 /* StorageInfoUsageCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 892CF18F134C620D00AAEDA1 /* StorageInfoUsageCallback.h */; };
+		892CF1EC134C655500AAEDA1 /* StorageInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 892CF1EA134C655500AAEDA1 /* StorageInfo.cpp */; };
+		892CF1ED134C655500AAEDA1 /* StorageInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 892CF1EB134C655500AAEDA1 /* StorageInfo.h */; };
+		892CF20B134C8BB300AAEDA1 /* JSStorageInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 892CF203134C8BB300AAEDA1 /* JSStorageInfo.cpp */; };
+		892CF20C134C8BB300AAEDA1 /* JSStorageInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 892CF204134C8BB300AAEDA1 /* JSStorageInfo.h */; };
+		892CF20D134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 892CF205134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.cpp */; };
+		892CF20E134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 892CF206134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.h */; };
+		892CF211134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 892CF209134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.cpp */; };
+		892CF212134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 892CF20A134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.h */; };
 		893C47A71238908B002B3D86 /* FileCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47A51238908B002B3D86 /* FileCallback.h */; };
 		893C47A81238908B002B3D86 /* FileWriterCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47A61238908B002B3D86 /* FileWriterCallback.h */; };
 		893C47B71238A099002B3D86 /* JSFileCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47B51238A099002B3D86 /* JSFileCallback.cpp */; };
@@ -2703,7 +2728,7 @@
 		89878563122CA064003AABDA /* FileSystemCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987854A122CA064003AABDA /* FileSystemCallback.h */; };
 		89878564122CA064003AABDA /* FileSystemCallbacks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8987854B122CA064003AABDA /* FileSystemCallbacks.cpp */; };
 		89878565122CA064003AABDA /* FileSystemCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987854C122CA064003AABDA /* FileSystemCallbacks.h */; };
-		89878566122CA064003AABDA /* Flags.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987854D122CA064003AABDA /* Flags.h */; };
+		89878566122CA064003AABDA /* WebKitFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987854D122CA064003AABDA /* WebKitFlags.h */; };
 		89878567122CA064003AABDA /* LocalFileSystem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8987854E122CA064003AABDA /* LocalFileSystem.cpp */; };
 		89878568122CA064003AABDA /* LocalFileSystem.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987854F122CA064003AABDA /* LocalFileSystem.h */; };
 		89878569122CA064003AABDA /* Metadata.h in Headers */ = {isa = PBXBuildFile; fileRef = 89878550122CA064003AABDA /* Metadata.h */; };
@@ -2728,8 +2753,8 @@
 		898785B1122CA2A7003AABDA /* JSFileEntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987859B122CA2A7003AABDA /* JSFileEntry.h */; };
 		898785B2122CA2A7003AABDA /* JSFileSystemCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8987859C122CA2A7003AABDA /* JSFileSystemCallback.cpp */; };
 		898785B3122CA2A7003AABDA /* JSFileSystemCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987859D122CA2A7003AABDA /* JSFileSystemCallback.h */; };
-		898785B4122CA2A7003AABDA /* JSFlags.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8987859E122CA2A7003AABDA /* JSFlags.cpp */; };
-		898785B5122CA2A7003AABDA /* JSFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987859F122CA2A7003AABDA /* JSFlags.h */; };
+		898785B4122CA2A7003AABDA /* JSWebKitFlags.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8987859E122CA2A7003AABDA /* JSWebKitFlags.cpp */; };
+		898785B5122CA2A7003AABDA /* JSWebKitFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987859F122CA2A7003AABDA /* JSWebKitFlags.h */; };
 		898785B6122CA2A7003AABDA /* JSMetadata.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 898785A0122CA2A7003AABDA /* JSMetadata.cpp */; };
 		898785B7122CA2A7003AABDA /* JSMetadata.h in Headers */ = {isa = PBXBuildFile; fileRef = 898785A1122CA2A7003AABDA /* JSMetadata.h */; };
 		898785B8122CA2A7003AABDA /* JSMetadataCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 898785A2122CA2A7003AABDA /* JSMetadataCallback.cpp */; };
@@ -2740,8 +2765,8 @@
 		898785F5122E1EAC003AABDA /* JSFileReaderSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 898785F3122E1EAC003AABDA /* JSFileReaderSync.h */; };
 		89B5EAA111E8003D00F2367E /* LineEnding.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 89B5EA9F11E8003D00F2367E /* LineEnding.cpp */; };
 		89B5EAA211E8003D00F2367E /* LineEnding.h in Headers */ = {isa = PBXBuildFile; fileRef = 89B5EAA011E8003D00F2367E /* LineEnding.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		89CD029311C85B870070B791 /* JSBlobBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 89CD029111C85B870070B791 /* JSBlobBuilder.cpp */; };
-		89CD029411C85B870070B791 /* JSBlobBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 89CD029211C85B870070B791 /* JSBlobBuilder.h */; };
+		89CD029311C85B870070B791 /* JSWebKitBlobBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 89CD029111C85B870070B791 /* JSWebKitBlobBuilder.cpp */; };
+		89CD029411C85B870070B791 /* JSWebKitBlobBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 89CD029211C85B870070B791 /* JSWebKitBlobBuilder.h */; };
 		89D08D9F12228451001241DF /* AsyncFileSystem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 89D08D9C12228451001241DF /* AsyncFileSystem.cpp */; };
 		89D08DA012228451001241DF /* AsyncFileSystem.h in Headers */ = {isa = PBXBuildFile; fileRef = 89D08D9D12228451001241DF /* AsyncFileSystem.h */; };
 		89D08DA112228451001241DF /* AsyncFileSystemCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 89D08D9E12228451001241DF /* AsyncFileSystemCallbacks.h */; };
@@ -2767,6 +2792,12 @@
 		8AF4E55C11DC5A63000ED3DE /* PerformanceTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AF4E55911DC5A63000ED3DE /* PerformanceTiming.h */; };
 		8C6EA61911EF7E0400FD8EE3 /* RuntimeEnabledFeatures.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8C6EA61711EF7E0400FD8EE3 /* RuntimeEnabledFeatures.cpp */; };
 		8C6EA61A11EF7E0400FD8EE3 /* RuntimeEnabledFeatures.h in Headers */ = {isa = PBXBuildFile; fileRef = 8C6EA61811EF7E0400FD8EE3 /* RuntimeEnabledFeatures.h */; };
+		8CADF2A9135C7B36009EF43F /* LevelDBComparator.h in Headers */ = {isa = PBXBuildFile; fileRef = 8CADF2A3135C7B36009EF43F /* LevelDBComparator.h */; };
+		8CADF2AA135C7B36009EF43F /* LevelDBDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8CADF2A4135C7B36009EF43F /* LevelDBDatabase.cpp */; };
+		8CADF2AB135C7B36009EF43F /* LevelDBDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 8CADF2A5135C7B36009EF43F /* LevelDBDatabase.h */; };
+		8CADF2AC135C7B36009EF43F /* LevelDBIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8CADF2A6135C7B36009EF43F /* LevelDBIterator.cpp */; };
+		8CADF2AD135C7B36009EF43F /* LevelDBIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 8CADF2A7135C7B36009EF43F /* LevelDBIterator.h */; };
+		8CADF2AE135C7B36009EF43F /* LevelDBSlice.h in Headers */ = {isa = PBXBuildFile; fileRef = 8CADF2A8135C7B36009EF43F /* LevelDBSlice.h */; };
 		8F67561B1288B17B0047ACA3 /* EventQueue.h in Headers */ = {isa = PBXBuildFile; fileRef = 8F6756191288B17B0047ACA3 /* EventQueue.h */; };
 		8F67561C1288B17B0047ACA3 /* EventQueue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8F67561A1288B17B0047ACA3 /* EventQueue.cpp */; };
 		8FAC774D119872CB0015AE94 /* JSMainThreadExecState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8F934D841189F1EE00508D5D /* JSMainThreadExecState.cpp */; };
@@ -3057,8 +3088,8 @@
 		976D6C77122B8A3D001FD1F7 /* AsyncFileWriter.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C58122B8A3D001FD1F7 /* AsyncFileWriter.h */; };
 		976D6C78122B8A3D001FD1F7 /* Blob.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C59122B8A3D001FD1F7 /* Blob.cpp */; };
 		976D6C79122B8A3D001FD1F7 /* Blob.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C5A122B8A3D001FD1F7 /* Blob.h */; };
-		976D6C7B122B8A3D001FD1F7 /* BlobBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C5C122B8A3D001FD1F7 /* BlobBuilder.cpp */; };
-		976D6C7C122B8A3D001FD1F7 /* BlobBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C5D122B8A3D001FD1F7 /* BlobBuilder.h */; };
+		976D6C7B122B8A3D001FD1F7 /* WebKitBlobBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C5C122B8A3D001FD1F7 /* WebKitBlobBuilder.cpp */; };
+		976D6C7C122B8A3D001FD1F7 /* WebKitBlobBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C5D122B8A3D001FD1F7 /* WebKitBlobBuilder.h */; };
 		976D6C7E122B8A3D001FD1F7 /* BlobURL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C5F122B8A3D001FD1F7 /* BlobURL.cpp */; };
 		976D6C7F122B8A3D001FD1F7 /* BlobURL.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C60122B8A3D001FD1F7 /* BlobURL.h */; };
 		976D6C80122B8A3D001FD1F7 /* File.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C61122B8A3D001FD1F7 /* File.cpp */; };
@@ -3128,6 +3159,7 @@
 		98EB1F951313FE0500D0E1EA /* NotImplemented.h in Headers */ = {isa = PBXBuildFile; fileRef = 98EB1F941313FE0500D0E1EA /* NotImplemented.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9B417064125662B3006B28FC /* ApplyBlockElementCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B417062125662B3006B28FC /* ApplyBlockElementCommand.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9B417065125662B3006B28FC /* ApplyBlockElementCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B417063125662B3006B28FC /* ApplyBlockElementCommand.cpp */; };
+		9B6C41531344949000085B62 /* StringWithDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B6C41521344949000085B62 /* StringWithDirection.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9BAB6C6C12550631001626D4 /* EditingStyle.h in Headers */ = {isa = PBXBuildFile; fileRef = 9BAB6C6A12550631001626D4 /* EditingStyle.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9BAB6C6D12550631001626D4 /* EditingStyle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9BAB6C6B12550631001626D4 /* EditingStyle.cpp */; };
 		9BAF3B2412C1A39800014BF1 /* WritingDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 9BAF3B2312C1A39800014BF1 /* WritingDirection.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3192,7 +3224,13 @@
 		A622A8FC122C44A600A785B3 /* BindingSecurityBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A622A8F6122C44A600A785B3 /* BindingSecurityBase.cpp */; };
 		A622A8FD122C44A600A785B3 /* BindingSecurityBase.h in Headers */ = {isa = PBXBuildFile; fileRef = A622A8F7122C44A600A785B3 /* BindingSecurityBase.h */; };
 		A622A8FF122C44A600A785B3 /* GenericBinding.h in Headers */ = {isa = PBXBuildFile; fileRef = A622A8F9122C44A600A785B3 /* GenericBinding.h */; };
+		A6D169621346B49B000EB770 /* ShadowRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A6D169611346B49B000EB770 /* ShadowRoot.cpp */; };
+		A6D169641346B4C1000EB770 /* ShadowRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = A6D169631346B4C1000EB770 /* ShadowRoot.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7005CCC1330C4BA000CC0BA /* SpellingCorrectionController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7005CCA1330C4BA000CC0BA /* SpellingCorrectionController.cpp */; };
+		A7005CCD1330C4BA000CC0BA /* SpellingCorrectionController.h in Headers */ = {isa = PBXBuildFile; fileRef = A7005CCB1330C4BA000CC0BA /* SpellingCorrectionController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7151BD812F1558F005A0F64 /* TextCheckerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = A7151BD712F1558F005A0F64 /* TextCheckerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A715E652134BBBEC00D8E713 /* ProgressShadowElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A715E650134BBBEC00D8E713 /* ProgressShadowElement.cpp */; };
+		A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */; };
 		A718760E0B2A120100A16ECE /* DragActions.h in Headers */ = {isa = PBXBuildFile; fileRef = A718760D0B2A120100A16ECE /* DragActions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A71878900B2D04AC00A16ECE /* DragControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */; };
 		A73F95FE12C97BFE0031AAF9 /* RoundedIntRect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73F95FC12C97BFE0031AAF9 /* RoundedIntRect.cpp */; };
@@ -3214,12 +3252,12 @@
 		A77B41A012E675A90054343D /* TextEventInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = A77B419F12E675A90054343D /* TextEventInputType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A77D0012133B0AEB00D6658C /* TextChecking.h in Headers */ = {isa = PBXBuildFile; fileRef = A77D0011133B0AEB00D6658C /* TextChecking.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A784941B0B5FE507001E237A /* Clipboard.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A784941A0B5FE507001E237A /* Clipboard.cpp */; };
+		A78E526F1346BD1700AD9C31 /* MeterShadowElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78E526D1346BD1700AD9C31 /* MeterShadowElement.cpp */; };
+		A78E52701346BD1700AD9C31 /* MeterShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A78E526E1346BD1700AD9C31 /* MeterShadowElement.h */; };
 		A78FE13B12366B1000ACE8D0 /* SpellChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78FE13912366B1000ACE8D0 /* SpellChecker.cpp */; };
 		A78FE13C12366B1000ACE8D0 /* SpellChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = A78FE13A12366B1000ACE8D0 /* SpellChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A795463E0B5C4C80007B438F /* DragDataMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A795463D0B5C4C80007B438F /* DragDataMac.mm */; };
 		A79546430B5C4CB4007B438F /* DragData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A79546420B5C4CB4007B438F /* DragData.cpp */; };
-		A7AA66D611C5ED6A001D8C8C /* RenderIndicator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7AA66D411C5ED6A001D8C8C /* RenderIndicator.cpp */; };
-		A7AA66D711C5ED6A001D8C8C /* RenderIndicator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7AA66D511C5ED6A001D8C8C /* RenderIndicator.h */; };
 		A7AD2F870EC89D07008AB002 /* LinkHash.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7AD2F850EC89D07008AB002 /* LinkHash.cpp */; };
 		A7AD2F880EC89D07008AB002 /* LinkHash.h in Headers */ = {isa = PBXBuildFile; fileRef = A7AD2F860EC89D07008AB002 /* LinkHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7B070D2130A409C00A3763C /* FrameActionScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B070D0130A409C00A3763C /* FrameActionScheduler.cpp */; };
@@ -3227,6 +3265,8 @@
 		A7B6E69F0B291A9600D0529F /* DragData.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B6E69D0B291A9600D0529F /* DragData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7BBE26611AFB3F20005EA03 /* JSHTMLMeterElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7BBE26411AFB3F20005EA03 /* JSHTMLMeterElement.cpp */; };
 		A7BBE26711AFB3F20005EA03 /* JSHTMLMeterElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A7BBE26511AFB3F20005EA03 /* JSHTMLMeterElement.h */; };
+		A7C9ABF81357A3BF00F5503F /* DetailsMarkerControl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C9ABF61357A3BF00F5503F /* DetailsMarkerControl.cpp */; };
+		A7C9ABF91357A3BF00F5503F /* DetailsMarkerControl.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C9ABF71357A3BF00F5503F /* DetailsMarkerControl.h */; };
 		A7CA595D0B27BD9E00FA021D /* DragController.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CA595B0B27BD9E00FA021D /* DragController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7CA595E0B27BD9E00FA021D /* DragController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7CA595C0B27BD9E00FA021D /* DragController.cpp */; };
 		A7CA59630B27C1F200FA021D /* DragClient.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CA59620B27C1F200FA021D /* DragClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3244,7 +3284,6 @@
 		A7DBF8DE1276919C006B6008 /* TextCheckingHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DBF8DC1276919C006B6008 /* TextCheckingHelper.h */; };
 		A7F338A311C0EFCA00A320A7 /* ShadowElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F338A111C0EFCA00A320A7 /* ShadowElement.cpp */; };
 		A7F338A411C0EFCA00A320A7 /* ShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F338A211C0EFCA00A320A7 /* ShadowElement.h */; };
-		A7FE819C12FA677700850C1E /* ProgressBarValueElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FE819B12FA677700850C1E /* ProgressBarValueElement.h */; };
 		A80A38FE0E50CC8200A25EBC /* PatternCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80A38FD0E50CC8200A25EBC /* PatternCG.cpp */; };
 		A80D67080E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h in Headers */ = {isa = PBXBuildFile; fileRef = A80D67070E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h */; };
 		A80E6CE40A1989CA007FB8C5 /* CSSValueList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CBA0A1989CA007FB8C5 /* CSSValueList.cpp */; };
@@ -3553,6 +3592,7 @@
 		A84EBD830CB8C97700079609 /* JSStyleSheetList.h in Headers */ = {isa = PBXBuildFile; fileRef = A84EBD810CB8C97700079609 /* JSStyleSheetList.h */; };
 		A84EBD840CB8C97700079609 /* JSStyleSheetList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A84EBD820CB8C97700079609 /* JSStyleSheetList.cpp */; };
 		A853123D11D0471B00D4D077 /* FragmentScriptingPermission.h in Headers */ = {isa = PBXBuildFile; fileRef = A853123C11D0471B00D4D077 /* FragmentScriptingPermission.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A863E2011343412000274926 /* UnicodeBidi.h in Headers */ = {isa = PBXBuildFile; fileRef = A863E2001343412000274926 /* UnicodeBidi.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A86629CF09DA2B47009633A5 /* JSUIEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = A86629C909DA2B47009633A5 /* JSUIEvent.h */; };
 		A86629D009DA2B48009633A5 /* JSUIEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A86629CA09DA2B47009633A5 /* JSUIEvent.cpp */; };
 		A86629D109DA2B48009633A5 /* JSMouseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = A86629CB09DA2B47009633A5 /* JSMouseEvent.h */; };
@@ -3631,6 +3671,7 @@
 		A8C2280E11D4A59700D5A7D3 /* DocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */; };
 		A8C228A111D5722E00D5A7D3 /* DecodedDataDocumentParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */; };
 		A8C228A211D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8C228A011D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp */; };
+		A8C402931348B2220063F1E5 /* BidiRunList.h in Headers */ = {isa = PBXBuildFile; fileRef = A8C402921348B2220063F1E5 /* BidiRunList.h */; };
 		A8C4A7FD09D563270003AC8D /* StyledElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A8C4A7EB09D563270003AC8D /* StyledElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A8C4A7FE09D563270003AC8D /* StyledElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8C4A7EC09D563270003AC8D /* StyledElement.cpp */; };
 		A8C4A80009D563270003AC8D /* Node.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8C4A7EE09D563270003AC8D /* Node.cpp */; };
@@ -4081,13 +4122,22 @@
 		ABC128770B33AA6D00C693D5 /* PopupMenuClient.h in Headers */ = {isa = PBXBuildFile; fileRef = ABC128760B33AA6D00C693D5 /* PopupMenuClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		ABDDFE790A5C6E7000A3E11D /* RenderMenuList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ABDDFE730A5C6E6F00A3E11D /* RenderMenuList.cpp */; };
 		ABDDFE7A0A5C6E7000A3E11D /* RenderMenuList.h in Headers */ = {isa = PBXBuildFile; fileRef = ABDDFE740A5C6E7000A3E11D /* RenderMenuList.h */; };
-		ABFE7E120D32FAF60066F4D2 /* MediaControlElements.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */; };
-		ABFE7E130D32FAF60066F4D2 /* MediaControlElements.h in Headers */ = {isa = PBXBuildFile; fileRef = ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */; };
 		ADDF1AD71257CD9A0003A759 /* RenderSVGPath.h in Headers */ = {isa = PBXBuildFile; fileRef = ADDF1AD51257CD9A0003A759 /* RenderSVGPath.h */; };
 		B0149E7D11A4B21500196A7B /* AsyncImageResizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B0149E7911A4B21500196A7B /* AsyncImageResizer.cpp */; };
 		B0149E7E11A4B21500196A7B /* AsyncImageResizer.h in Headers */ = {isa = PBXBuildFile; fileRef = B0149E7A11A4B21500196A7B /* AsyncImageResizer.h */; };
 		B0149E7F11A4B21500196A7B /* ImageResizerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B0149E7B11A4B21500196A7B /* ImageResizerThread.cpp */; };
 		B0149E8011A4B21500196A7B /* ImageResizerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = B0149E7C11A4B21500196A7B /* ImageResizerThread.h */; };
+		B1827493134CA4C100B98C2D /* CallbackFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1827492134CA4C100B98C2D /* CallbackFunction.cpp */; };
+		B1D5ECB5134B58DA0087C78F /* CallbackFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = B1D5ECB4134B58DA0087C78F /* CallbackFunction.h */; };
+		B1E54599134629C10092A545 /* NavigatorUserMediaError.h in Headers */ = {isa = PBXBuildFile; fileRef = B1E5458D134629C10092A545 /* NavigatorUserMediaError.h */; };
+		B1E5459B134629C10092A545 /* NavigatorUserMediaErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B1E5458F134629C10092A545 /* NavigatorUserMediaErrorCallback.h */; };
+		B1E5459D134629C10092A545 /* NavigatorUserMediaSuccessCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B1E54591134629C10092A545 /* NavigatorUserMediaSuccessCallback.h */; };
+		B1E545DF13462B0B0092A545 /* JSNavigatorUserMediaError.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1E545D113462B0B0092A545 /* JSNavigatorUserMediaError.cpp */; };
+		B1E545E013462B0B0092A545 /* JSNavigatorUserMediaError.h in Headers */ = {isa = PBXBuildFile; fileRef = B1E545D213462B0B0092A545 /* JSNavigatorUserMediaError.h */; };
+		B1E545E113462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1E545D313462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.cpp */; };
+		B1E545E213462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B1E545D413462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.h */; };
+		B1E545E313462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1E545D513462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.cpp */; };
+		B1E545E413462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B1E545D613462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.h */; };
 		B20111070AB7740500DB0E68 /* JSSVGAElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B20111050AB7740500DB0E68 /* JSSVGAElement.cpp */; };
 		B20111080AB7740500DB0E68 /* JSSVGAElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B20111060AB7740500DB0E68 /* JSSVGAElement.h */; };
 		B22279620D00BF220071B782 /* ColorDistance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277CB0D00BF1F0071B782 /* ColorDistance.cpp */; };
@@ -4786,7 +4836,6 @@
 		B776D43D1104527500BEB0EC /* PrintContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B776D43C1104527500BEB0EC /* PrintContext.cpp */; };
 		B885E8D411E06DD2009FFBF4 /* InspectorApplicationCacheAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B885E8D211E06DD2009FFBF4 /* InspectorApplicationCacheAgent.cpp */; };
 		B885E8D511E06DD2009FFBF4 /* InspectorApplicationCacheAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = B885E8D311E06DD2009FFBF4 /* InspectorApplicationCacheAgent.h */; settings = {ATTRIBUTES = (); }; };
-		B8A6A6D5127B338D008673BA /* CorrectionPanelInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = B8A6A6D4127B338D008673BA /* CorrectionPanelInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B8DBDB4B130B0F8A00F5CDB1 /* SetSelectionCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B8DBDB47130B0F8A00F5CDB1 /* SetSelectionCommand.cpp */; };
 		B8DBDB4C130B0F8A00F5CDB1 /* SetSelectionCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = B8DBDB48130B0F8A00F5CDB1 /* SetSelectionCommand.h */; };
 		B8DBDB4D130B0F8A00F5CDB1 /* SpellingCorrectionCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B8DBDB49130B0F8A00F5CDB1 /* SpellingCorrectionCommand.cpp */; };
@@ -5136,7 +5185,6 @@
 		BCA8C81F11E3D36900812FB7 /* BackForwardController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA8C81D11E3D36900812FB7 /* BackForwardController.cpp */; };
 		BCA8CA5F11E4E6D100812FB7 /* BackForwardListImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA8CA5D11E4E6D100812FB7 /* BackForwardListImpl.cpp */; };
 		BCA8CA6011E4E6D100812FB7 /* BackForwardListImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA8CA5E11E4E6D100812FB7 /* BackForwardListImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BCA979171215D055005C485C /* ImageBufferData.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA979161215D055005C485C /* ImageBufferData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCAA90C30A7EBA60008B1229 /* Scrollbar.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCAA90C20A7EBA60008B1229 /* Scrollbar.cpp */; };
 		BCACF3BC1072921A00C0C8A3 /* UserContentURLPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */; };
 		BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5516,6 +5564,9 @@
 		E18258AC0EF3CD7000933242 /* JSWorkerContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18258AB0EF3CD7000933242 /* JSWorkerContextCustom.cpp */; };
 		E18772F1126E2629003DD586 /* Language.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18772F0126E2629003DD586 /* Language.cpp */; };
 		E1A1470811102B1500EEC0F3 /* ContainerNodeAlgorithms.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A1470711102B1500EEC0F3 /* ContainerNodeAlgorithms.h */; };
+		E1A3162D134BC32D007C9A4F /* WebNSAttributedStringExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A3162B134BC32D007C9A4F /* WebNSAttributedStringExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E1A3162E134BC32D007C9A4F /* WebNSAttributedStringExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1A3162C134BC32D007C9A4F /* WebNSAttributedStringExtras.mm */; };
+		E1A31663134BCAE8007C9A4F /* HTMLConverter.h in Headers */ = {isa = PBXBuildFile; fileRef = C5392D331326AD0100043D35 /* HTMLConverter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E1A5F99B0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */; };
 		E1A643F20EC0972500779668 /* WorkerScriptController.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A643F10EC0972500779668 /* WorkerScriptController.h */; };
 		E1A643FD0EC097A000779668 /* WorkerScriptController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */; };
@@ -5657,6 +5708,8 @@
 		F34742E91343635000531BC2 /* WorkerScriptDebugServer.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */; };
 		F3644AFF1119805900E0D537 /* InjectedScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3644AFD1119805900E0D537 /* InjectedScript.cpp */; };
 		F3644B001119805900E0D537 /* InjectedScript.h in Headers */ = {isa = PBXBuildFile; fileRef = F3644AFE1119805900E0D537 /* InjectedScript.h */; };
+		F36E07A41358A8BE00AACBC9 /* WorkerInspectorController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F36E07A21358A8BE00AACBC9 /* WorkerInspectorController.cpp */; };
+		F36E07A51358A8BE00AACBC9 /* WorkerInspectorController.h in Headers */ = {isa = PBXBuildFile; fileRef = F36E07A31358A8BE00AACBC9 /* WorkerInspectorController.h */; };
 		F375CC071150D300008DDB81 /* InspectorWorkerResource.h in Headers */ = {isa = PBXBuildFile; fileRef = F375CC061150D300008DDB81 /* InspectorWorkerResource.h */; };
 		F392249C126F11AE00A926D9 /* ScriptCallStackFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F392249A126F11AE00A926D9 /* ScriptCallStackFactory.cpp */; };
 		F392249D126F11AE00A926D9 /* ScriptCallStackFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = F392249B126F11AE00A926D9 /* ScriptCallStackFactory.h */; };
@@ -5755,6 +5808,8 @@
 		FABE72FD1059C21100D999DD /* MathMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72FB1059C21100D999DD /* MathMLElementFactory.cpp */; };
 		FABE72FE1059C21100D999DD /* MathMLNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72FC1059C21100D999DD /* MathMLNames.cpp */; };
 		FBC220DF1237FBEB00BCF788 /* GraphicsContext3DOpenGL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FBC220DE1237FBEB00BCF788 /* GraphicsContext3DOpenGL.cpp */; };
+		FD06DFA5134A4DEF006F5D7D /* DefaultAudioDestinationNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FD06DFA3134A4DEF006F5D7D /* DefaultAudioDestinationNode.cpp */; };
+		FD06DFA6134A4DEF006F5D7D /* DefaultAudioDestinationNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FD06DFA4134A4DEF006F5D7D /* DefaultAudioDestinationNode.h */; };
 		FD2DBF1212B048A300ED98C6 /* Accelerate.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = FD2DBF0E12B048A300ED98C6 /* Accelerate.framework */; };
 		FD2DBF1312B048A300ED98C6 /* AudioToolbox.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = FD2DBF0F12B048A300ED98C6 /* AudioToolbox.framework */; };
 		FD2DBF1412B048A300ED98C6 /* AudioUnit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = FD2DBF1012B048A300ED98C6 /* AudioUnit.framework */; };
@@ -5913,11 +5968,17 @@
 		FDA15ECE12B03F61003A583A /* JSJavaScriptAudioNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FDA15ECC12B03F61003A583A /* JSJavaScriptAudioNode.h */; };
 		FDA15ED112B03F94003A583A /* JSDelayNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDA15ECF12B03F94003A583A /* JSDelayNode.cpp */; };
 		FDA15ED212B03F94003A583A /* JSDelayNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FDA15ED012B03F94003A583A /* JSDelayNode.h */; };
+		FDA3E959134A49EF008D4B5A /* OfflineAudioCompletionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDA3E955134A49EF008D4B5A /* OfflineAudioCompletionEvent.cpp */; };
+		FDA3E95A134A49EF008D4B5A /* OfflineAudioCompletionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = FDA3E956134A49EF008D4B5A /* OfflineAudioCompletionEvent.h */; };
+		FDA3E95B134A49EF008D4B5A /* OfflineAudioDestinationNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDA3E957134A49EF008D4B5A /* OfflineAudioDestinationNode.cpp */; };
+		FDA3E95C134A49EF008D4B5A /* OfflineAudioDestinationNode.h in Headers */ = {isa = PBXBuildFile; fileRef = FDA3E958134A49EF008D4B5A /* OfflineAudioDestinationNode.h */; };
 		FDEAAAF312B02EE400DCF33B /* JSAudioBufferSourceNodeCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDEAAAEF12B02EE400DCF33B /* JSAudioBufferSourceNodeCustom.cpp */; };
 		FDEAAAF412B02EE400DCF33B /* JSAudioContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDEAAAF012B02EE400DCF33B /* JSAudioContextCustom.cpp */; };
 		FDEAAAF512B02EE400DCF33B /* JSAudioNodeCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDEAAAF112B02EE400DCF33B /* JSAudioNodeCustom.cpp */; };
 		FDEAAAF612B02EE400DCF33B /* JSConvolverNodeCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDEAAAF212B02EE400DCF33B /* JSConvolverNodeCustom.cpp */; };
 		FDEAAAFE12B02F4900DCF33B /* JSJavaScriptAudioNodeCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDEAAAFD12B02F4900DCF33B /* JSJavaScriptAudioNodeCustom.cpp */; };
+		FDF6BAF8134A4C9800822920 /* JSOfflineAudioCompletionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FDF6BAF6134A4C9800822920 /* JSOfflineAudioCompletionEvent.cpp */; };
+		FDF6BAF9134A4C9800822920 /* JSOfflineAudioCompletionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = FDF6BAF7134A4C9800822920 /* JSOfflineAudioCompletionEvent.h */; };
 		FE6FD4880F676E5700092873 /* Coordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD4850F676E5700092873 /* Coordinates.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE6FD48D0F676E9300092873 /* JSCoordinates.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE6FD48B0F676E9300092873 /* JSCoordinates.cpp */; };
 		FE6FD48E0F676E9300092873 /* JSCoordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD48C0F676E9300092873 /* JSCoordinates.h */; };
@@ -6690,6 +6751,8 @@
 		14CF7B3109F6ECD700EB3665 /* JSCSSRule.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSRule.cpp; sourceTree = "<group>"; };
 		14CF7B3209F6ECD700EB3665 /* JSCSSRule.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCSSRule.h; sourceTree = "<group>"; };
 		14CF7C2009F7110600EB3665 /* KeyboardEvent.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = KeyboardEvent.idl; sourceTree = "<group>"; };
+		14D64B5A134A5B6B00E58FDA /* TreeScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TreeScope.cpp; sourceTree = "<group>"; };
+		14D64B5B134A5B6B00E58FDA /* TreeScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TreeScope.h; sourceTree = "<group>"; };
 		14D823500AF92A790004F057 /* Chrome.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Chrome.h; sourceTree = "<group>"; };
 		14D8238A0AF92DF60004F057 /* Chrome.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Chrome.cpp; sourceTree = "<group>"; };
 		14D824060AF93AEB0004F057 /* ChromeClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ChromeClient.h; sourceTree = "<group>"; };
@@ -7040,10 +7103,20 @@
 		1CF6BE120E9BB4670025E1CD /* ObjCNodeFilterCondition.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ObjCNodeFilterCondition.mm; sourceTree = "<group>"; };
 		1CF6BE130E9BB4670025E1CD /* ObjCNodeFilterCondition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjCNodeFilterCondition.h; sourceTree = "<group>"; };
 		1CFAE3220A6D6A3F0032593D /* libobjc.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libobjc.dylib; path = /usr/lib/libobjc.dylib; sourceTree = "<absolute>"; };
+		1F3C3BE8135CAF3C00B8C1AC /* MediaControls.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaControls.cpp; sourceTree = "<group>"; };
+		1F3C3BE9135CAF3C00B8C1AC /* MediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaControls.h; sourceTree = "<group>"; };
 		20D629241253690B00081543 /* InspectorInstrumentation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorInstrumentation.cpp; sourceTree = "<group>"; };
 		20D629251253690B00081543 /* InspectorInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorInstrumentation.h; sourceTree = "<group>"; };
+		2277775F1345DEA9008EA455 /* InspectorFrontendChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendChannel.h; sourceTree = "<group>"; };
+		22777B48134A018C008EA455 /* EventsCollector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventsCollector.cpp; sourceTree = "<group>"; };
+		22777B49134A018C008EA455 /* EventsCollector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventsCollector.h; sourceTree = "<group>"; };
+		22777B4C134A01A8008EA455 /* InspectorFrontendProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontendProxy.cpp; sourceTree = "<group>"; };
+		22777B4D134A01A8008EA455 /* InspectorFrontendProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendProxy.h; sourceTree = "<group>"; };
 		22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMImplementationCustom.cpp; sourceTree = "<group>"; };
 		228C284410D82500009D0D0E /* ScriptWrappable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptWrappable.h; sourceTree = "<group>"; };
+		2292B27B1356669400CF11EF /* ImageBufferDataCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageBufferDataCG.cpp; sourceTree = "<group>"; };
+		22BD9F7D1353625C009BD102 /* ImageBufferData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferData.h; sourceTree = "<group>"; };
+		22BD9F80135364FE009BD102 /* ImageBufferDataCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferDataCG.h; sourceTree = "<group>"; };
 		2442BBF81194C9D300D49469 /* HashChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashChangeEvent.h; sourceTree = "<group>"; };
 		245D80A213280E40003492A6 /* SQLCallbackWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLCallbackWrapper.h; sourceTree = "<group>"; };
 		24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplicationCacheHost.cpp; sourceTree = "<group>"; };
@@ -7051,6 +7124,8 @@
 		2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserGestureIndicator.cpp; sourceTree = "<group>"; };
 		2542F4D91166C25A00E89A86 /* UserGestureIndicator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserGestureIndicator.h; sourceTree = "<group>"; };
 		26E98A0F130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextCodecASCIIFastPath.h; sourceTree = "<group>"; };
+		293EAE1E1356B2FE0067ACF9 /* RuntimeApplicationChecks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeApplicationChecks.h; sourceTree = "<group>"; };
+		293EAE201356B32E0067ACF9 /* RuntimeApplicationChecks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RuntimeApplicationChecks.cpp; sourceTree = "<group>"; };
 		29489FC512C00F0300D83F0F /* AccessibilityScrollView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityScrollView.h; sourceTree = "<group>"; };
 		2981CA9D131822EC00D12F2A /* AccessibilityARIAGrid.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityARIAGrid.cpp; sourceTree = "<group>"; };
 		2981CA9E131822EC00D12F2A /* AccessibilityARIAGridCell.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityARIAGridCell.cpp; sourceTree = "<group>"; };
@@ -7324,8 +7399,8 @@
 		4138D3341244054800323D33 /* EventContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventContext.cpp; sourceTree = "<group>"; };
 		4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SliderThumbElement.h; sourceTree = "<group>"; };
 		4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SliderThumbElement.cpp; sourceTree = "<group>"; };
-		4157AF7E12F1FB0400A8C6F5 /* MediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaControls.h; sourceTree = "<group>"; };
-		4157AF7F12F1FB0400A8C6F5 /* MediaControls.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaControls.cpp; sourceTree = "<group>"; };
+		4157AF7E12F1FB0400A8C6F5 /* MediaControlRootElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaControlRootElement.h; sourceTree = "<group>"; };
+		4157AF7F12F1FB0400A8C6F5 /* MediaControlRootElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaControlRootElement.cpp; sourceTree = "<group>"; };
 		4162A44D101145AE00DFF3ED /* DedicatedWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DedicatedWorkerContext.cpp; path = workers/DedicatedWorkerContext.cpp; sourceTree = "<group>"; };
 		4162A44E101145AE00DFF3ED /* DedicatedWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DedicatedWorkerContext.h; path = workers/DedicatedWorkerContext.h; sourceTree = "<group>"; };
 		4162A44F101145AE00DFF3ED /* DedicatedWorkerContext.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DedicatedWorkerContext.idl; path = workers/DedicatedWorkerContext.idl; sourceTree = "<group>"; };
@@ -7339,6 +7414,8 @@
 		416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallStack.cpp; sourceTree = "<group>"; };
 		416E75C90EDF90C700360E1D /* ScriptCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallFrame.h; sourceTree = "<group>"; };
 		416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallFrame.cpp; sourceTree = "<group>"; };
+		417253A81354BBBC00360F2A /* MediaControlElements.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaControlElements.cpp; sourceTree = "<group>"; };
+		417253A91354BBBC00360F2A /* MediaControlElements.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaControlElements.h; sourceTree = "<group>"; };
 		41885B9111B6FDA6003383BB /* FormSubmission.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FormSubmission.h; sourceTree = "<group>"; };
 		41885B9211B6FDA6003383BB /* FormSubmission.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FormSubmission.cpp; sourceTree = "<group>"; };
 		418A06CE133C04D500CD379C /* EventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventDispatcher.h; sourceTree = "<group>"; };
@@ -7474,8 +7551,6 @@
 		4429AB070CB84F81007647C5 /* DOMTextEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMTextEventInternal.h; sourceTree = "<group>"; };
 		44311CD412E4E22D000A8D19 /* DOMDocumentFragmentPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDocumentFragmentPrivate.h; sourceTree = "<group>"; };
 		44311CD512E4E22D000A8D19 /* DOMDocumentPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDocumentPrivate.h; sourceTree = "<group>"; };
-		447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeApplicationChecks.h; sourceTree = "<group>"; };
-		447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RuntimeApplicationChecks.mm; sourceTree = "<group>"; };
 		448A29BD0A46D9CB0030759F /* JSHTMLOptionsCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLOptionsCollection.h; sourceTree = "<group>"; };
 		448A29BE0A46D9CB0030759F /* JSHTMLOptionsCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLOptionsCollection.cpp; sourceTree = "<group>"; };
 		448AD27A0A4813790023D179 /* JSHTMLOptionsCollectionCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLOptionsCollectionCustom.cpp; sourceTree = "<group>"; };
@@ -7935,11 +8010,12 @@
 		59309A1211F4AE6A00250603 /* DeviceOrientationClientMock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DeviceOrientationClientMock.h; path = mock/DeviceOrientationClientMock.h; sourceTree = "<group>"; };
 		593D3EAE1325328C0057E7EE /* JavaMethod.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaMethod.h; sourceTree = "<group>"; };
 		593D3EB0132532950057E7EE /* JavaString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaString.h; sourceTree = "<group>"; };
+		5958F1CB1343917C0080B31F /* XMLViewer.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = XMLViewer.css; sourceTree = "<group>"; };
+		5958F1CC1343917C0080B31F /* XMLViewer.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = XMLViewer.js; sourceTree = "<group>"; };
 		596229771133EFD700DC4CBB /* GeolocationPositionCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeolocationPositionCache.cpp; sourceTree = "<group>"; };
 		596229791133EFE200DC4CBB /* GeolocationPositionCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationPositionCache.h; sourceTree = "<group>"; };
 		596950811321059900C3ED18 /* JobjectWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JobjectWrapper.h; sourceTree = "<group>"; };
 		59695083132105A500C3ED18 /* JobjectWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JobjectWrapper.cpp; sourceTree = "<group>"; };
-		5980B03312EF3D8400DF5F85 /* XMLViewer.xsl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xml; path = XMLViewer.xsl; sourceTree = "<group>"; };
 		598D77DC132541EE00761B22 /* JavaArrayJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JavaArrayJSC.cpp; path = jsc/JavaArrayJSC.cpp; sourceTree = "<group>"; };
 		598D77DE132541FA00761B22 /* JavaArrayJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaArrayJSC.h; path = jsc/JavaArrayJSC.h; sourceTree = "<group>"; };
 		598D77E01325420400761B22 /* JavaFieldJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JavaFieldJSC.cpp; path = jsc/JavaFieldJSC.cpp; sourceTree = "<group>"; };
@@ -9148,6 +9224,17 @@
 		86243D0011BC31F700CC006A /* JSArrayBufferViewHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferViewHelper.h; sourceTree = "<group>"; };
 		86D982F6125C154000AD9E3D /* DocumentTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentTiming.h; sourceTree = "<group>"; };
 		890AE0E01256A07900F5968C /* DirectoryReaderBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DirectoryReaderBase.h; path = fileapi/DirectoryReaderBase.h; sourceTree = "<group>"; };
+		892CF18D134C620D00AAEDA1 /* StorageInfoErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageInfoErrorCallback.h; sourceTree = "<group>"; };
+		892CF18E134C620D00AAEDA1 /* StorageInfoQuotaCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageInfoQuotaCallback.h; sourceTree = "<group>"; };
+		892CF18F134C620D00AAEDA1 /* StorageInfoUsageCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageInfoUsageCallback.h; sourceTree = "<group>"; };
+		892CF1EA134C655500AAEDA1 /* StorageInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageInfo.cpp; sourceTree = "<group>"; };
+		892CF1EB134C655500AAEDA1 /* StorageInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageInfo.h; sourceTree = "<group>"; };
+		892CF203134C8BB300AAEDA1 /* JSStorageInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStorageInfo.cpp; sourceTree = "<group>"; };
+		892CF204134C8BB300AAEDA1 /* JSStorageInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStorageInfo.h; sourceTree = "<group>"; };
+		892CF205134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStorageInfoErrorCallback.cpp; sourceTree = "<group>"; };
+		892CF206134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStorageInfoErrorCallback.h; sourceTree = "<group>"; };
+		892CF209134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStorageInfoUsageCallback.cpp; sourceTree = "<group>"; };
+		892CF20A134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStorageInfoUsageCallback.h; sourceTree = "<group>"; };
 		893C47A51238908B002B3D86 /* FileCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileCallback.h; path = fileapi/FileCallback.h; sourceTree = "<group>"; };
 		893C47A61238908B002B3D86 /* FileWriterCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileWriterCallback.h; path = fileapi/FileWriterCallback.h; sourceTree = "<group>"; };
 		893C47B51238A099002B3D86 /* JSFileCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFileCallback.cpp; sourceTree = "<group>"; };
@@ -9205,7 +9292,7 @@
 		8987854A122CA064003AABDA /* FileSystemCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileSystemCallback.h; path = fileapi/FileSystemCallback.h; sourceTree = "<group>"; };
 		8987854B122CA064003AABDA /* FileSystemCallbacks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileSystemCallbacks.cpp; path = fileapi/FileSystemCallbacks.cpp; sourceTree = "<group>"; };
 		8987854C122CA064003AABDA /* FileSystemCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileSystemCallbacks.h; path = fileapi/FileSystemCallbacks.h; sourceTree = "<group>"; };
-		8987854D122CA064003AABDA /* Flags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Flags.h; path = fileapi/Flags.h; sourceTree = "<group>"; };
+		8987854D122CA064003AABDA /* WebKitFlags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebKitFlags.h; path = fileapi/WebKitFlags.h; sourceTree = "<group>"; };
 		8987854E122CA064003AABDA /* LocalFileSystem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LocalFileSystem.cpp; path = fileapi/LocalFileSystem.cpp; sourceTree = "<group>"; };
 		8987854F122CA064003AABDA /* LocalFileSystem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LocalFileSystem.h; path = fileapi/LocalFileSystem.h; sourceTree = "<group>"; };
 		89878550122CA064003AABDA /* Metadata.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Metadata.h; path = fileapi/Metadata.h; sourceTree = "<group>"; };
@@ -9230,8 +9317,8 @@
 		8987859B122CA2A7003AABDA /* JSFileEntry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFileEntry.h; sourceTree = "<group>"; };
 		8987859C122CA2A7003AABDA /* JSFileSystemCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFileSystemCallback.cpp; sourceTree = "<group>"; };
 		8987859D122CA2A7003AABDA /* JSFileSystemCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFileSystemCallback.h; sourceTree = "<group>"; };
-		8987859E122CA2A7003AABDA /* JSFlags.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFlags.cpp; sourceTree = "<group>"; };
-		8987859F122CA2A7003AABDA /* JSFlags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFlags.h; sourceTree = "<group>"; };
+		8987859E122CA2A7003AABDA /* JSWebKitFlags.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitFlags.cpp; sourceTree = "<group>"; };
+		8987859F122CA2A7003AABDA /* JSWebKitFlags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitFlags.h; sourceTree = "<group>"; };
 		898785A0122CA2A7003AABDA /* JSMetadata.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMetadata.cpp; sourceTree = "<group>"; };
 		898785A1122CA2A7003AABDA /* JSMetadata.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMetadata.h; sourceTree = "<group>"; };
 		898785A2122CA2A7003AABDA /* JSMetadataCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMetadataCallback.cpp; sourceTree = "<group>"; };
@@ -9242,8 +9329,8 @@
 		898785F3122E1EAC003AABDA /* JSFileReaderSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFileReaderSync.h; sourceTree = "<group>"; };
 		89B5EA9F11E8003D00F2367E /* LineEnding.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LineEnding.cpp; sourceTree = "<group>"; };
 		89B5EAA011E8003D00F2367E /* LineEnding.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LineEnding.h; sourceTree = "<group>"; };
-		89CD029111C85B870070B791 /* JSBlobBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBlobBuilder.cpp; sourceTree = "<group>"; };
-		89CD029211C85B870070B791 /* JSBlobBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBlobBuilder.h; sourceTree = "<group>"; };
+		89CD029111C85B870070B791 /* JSWebKitBlobBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitBlobBuilder.cpp; sourceTree = "<group>"; };
+		89CD029211C85B870070B791 /* JSWebKitBlobBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitBlobBuilder.h; sourceTree = "<group>"; };
 		89D08D9C12228451001241DF /* AsyncFileSystem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncFileSystem.cpp; sourceTree = "<group>"; };
 		89D08D9D12228451001241DF /* AsyncFileSystem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncFileSystem.h; sourceTree = "<group>"; };
 		89D08D9E12228451001241DF /* AsyncFileSystemCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncFileSystemCallbacks.h; sourceTree = "<group>"; };
@@ -9272,6 +9359,12 @@
 		8AF4E55A11DC5A63000ED3DE /* PerformanceTiming.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PerformanceTiming.idl; sourceTree = "<group>"; };
 		8C6EA61711EF7E0400FD8EE3 /* RuntimeEnabledFeatures.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RuntimeEnabledFeatures.cpp; path = generic/RuntimeEnabledFeatures.cpp; sourceTree = "<group>"; };
 		8C6EA61811EF7E0400FD8EE3 /* RuntimeEnabledFeatures.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RuntimeEnabledFeatures.h; path = generic/RuntimeEnabledFeatures.h; sourceTree = "<group>"; };
+		8CADF2A3135C7B36009EF43F /* LevelDBComparator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LevelDBComparator.h; sourceTree = "<group>"; };
+		8CADF2A4135C7B36009EF43F /* LevelDBDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LevelDBDatabase.cpp; sourceTree = "<group>"; };
+		8CADF2A5135C7B36009EF43F /* LevelDBDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LevelDBDatabase.h; sourceTree = "<group>"; };
+		8CADF2A6135C7B36009EF43F /* LevelDBIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LevelDBIterator.cpp; sourceTree = "<group>"; };
+		8CADF2A7135C7B36009EF43F /* LevelDBIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LevelDBIterator.h; sourceTree = "<group>"; };
+		8CADF2A8135C7B36009EF43F /* LevelDBSlice.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LevelDBSlice.h; sourceTree = "<group>"; };
 		8F6756191288B17B0047ACA3 /* EventQueue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventQueue.h; sourceTree = "<group>"; };
 		8F67561A1288B17B0047ACA3 /* EventQueue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventQueue.cpp; sourceTree = "<group>"; };
 		8F934D831189F1EE00508D5D /* JSMainThreadExecState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMainThreadExecState.h; sourceTree = "<group>"; };
@@ -9556,8 +9649,8 @@
 		976D6C58122B8A3D001FD1F7 /* AsyncFileWriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AsyncFileWriter.h; path = fileapi/AsyncFileWriter.h; sourceTree = "<group>"; };
 		976D6C59122B8A3D001FD1F7 /* Blob.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Blob.cpp; path = fileapi/Blob.cpp; sourceTree = "<group>"; };
 		976D6C5A122B8A3D001FD1F7 /* Blob.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Blob.h; path = fileapi/Blob.h; sourceTree = "<group>"; };
-		976D6C5C122B8A3D001FD1F7 /* BlobBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BlobBuilder.cpp; path = fileapi/BlobBuilder.cpp; sourceTree = "<group>"; };
-		976D6C5D122B8A3D001FD1F7 /* BlobBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BlobBuilder.h; path = fileapi/BlobBuilder.h; sourceTree = "<group>"; };
+		976D6C5C122B8A3D001FD1F7 /* WebKitBlobBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebKitBlobBuilder.cpp; path = fileapi/WebKitBlobBuilder.cpp; sourceTree = "<group>"; };
+		976D6C5D122B8A3D001FD1F7 /* WebKitBlobBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebKitBlobBuilder.h; path = fileapi/WebKitBlobBuilder.h; sourceTree = "<group>"; };
 		976D6C5F122B8A3D001FD1F7 /* BlobURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BlobURL.cpp; path = fileapi/BlobURL.cpp; sourceTree = "<group>"; };
 		976D6C60122B8A3D001FD1F7 /* BlobURL.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BlobURL.h; path = fileapi/BlobURL.h; sourceTree = "<group>"; };
 		976D6C61122B8A3D001FD1F7 /* File.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = File.cpp; path = fileapi/File.cpp; sourceTree = "<group>"; };
@@ -9629,6 +9722,7 @@
 		98EB1F941313FE0500D0E1EA /* NotImplemented.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NotImplemented.h; sourceTree = "<group>"; };
 		9B417062125662B3006B28FC /* ApplyBlockElementCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplyBlockElementCommand.h; sourceTree = "<group>"; };
 		9B417063125662B3006B28FC /* ApplyBlockElementCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplyBlockElementCommand.cpp; sourceTree = "<group>"; };
+		9B6C41521344949000085B62 /* StringWithDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringWithDirection.h; sourceTree = "<group>"; };
 		9BAB6C6A12550631001626D4 /* EditingStyle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingStyle.h; sourceTree = "<group>"; };
 		9BAB6C6B12550631001626D4 /* EditingStyle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EditingStyle.cpp; sourceTree = "<group>"; };
 		9BAF3B2312C1A39800014BF1 /* WritingDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WritingDirection.h; sourceTree = "<group>"; };
@@ -9698,7 +9792,13 @@
 		A622A8F6122C44A600A785B3 /* BindingSecurityBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BindingSecurityBase.cpp; path = generic/BindingSecurityBase.cpp; sourceTree = "<group>"; };
 		A622A8F7122C44A600A785B3 /* BindingSecurityBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BindingSecurityBase.h; path = generic/BindingSecurityBase.h; sourceTree = "<group>"; };
 		A622A8F9122C44A600A785B3 /* GenericBinding.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GenericBinding.h; path = generic/GenericBinding.h; sourceTree = "<group>"; };
+		A6D169611346B49B000EB770 /* ShadowRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowRoot.cpp; sourceTree = "<group>"; };
+		A6D169631346B4C1000EB770 /* ShadowRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowRoot.h; sourceTree = "<group>"; };
+		A7005CCA1330C4BA000CC0BA /* SpellingCorrectionController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpellingCorrectionController.cpp; sourceTree = "<group>"; };
+		A7005CCB1330C4BA000CC0BA /* SpellingCorrectionController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpellingCorrectionController.h; sourceTree = "<group>"; };
 		A7151BD712F1558F005A0F64 /* TextCheckerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextCheckerClient.h; sourceTree = "<group>"; };
+		A715E650134BBBEC00D8E713 /* ProgressShadowElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProgressShadowElement.cpp; sourceTree = "<group>"; };
+		A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProgressShadowElement.h; sourceTree = "<group>"; };
 		A718760D0B2A120100A16ECE /* DragActions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragActions.h; sourceTree = "<group>"; };
 		A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DragControllerMac.mm; sourceTree = "<group>"; };
 		A71A70C911AFB02000989D6D /* HTMLMeterElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLMeterElement.idl; sourceTree = "<group>"; };
@@ -9722,12 +9822,12 @@
 		A77B419F12E675A90054343D /* TextEventInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextEventInputType.h; sourceTree = "<group>"; };
 		A77D0011133B0AEB00D6658C /* TextChecking.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextChecking.h; sourceTree = "<group>"; };
 		A784941A0B5FE507001E237A /* Clipboard.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Clipboard.cpp; sourceTree = "<group>"; };
+		A78E526D1346BD1700AD9C31 /* MeterShadowElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MeterShadowElement.cpp; sourceTree = "<group>"; };
+		A78E526E1346BD1700AD9C31 /* MeterShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MeterShadowElement.h; sourceTree = "<group>"; };
 		A78FE13912366B1000ACE8D0 /* SpellChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpellChecker.cpp; sourceTree = "<group>"; };
 		A78FE13A12366B1000ACE8D0 /* SpellChecker.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; path = SpellChecker.h; sourceTree = "<group>"; };
 		A795463D0B5C4C80007B438F /* DragDataMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DragDataMac.mm; sourceTree = "<group>"; };
 		A79546420B5C4CB4007B438F /* DragData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DragData.cpp; sourceTree = "<group>"; };
-		A7AA66D411C5ED6A001D8C8C /* RenderIndicator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderIndicator.cpp; sourceTree = "<group>"; };
-		A7AA66D511C5ED6A001D8C8C /* RenderIndicator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderIndicator.h; sourceTree = "<group>"; };
 		A7AD2F850EC89D07008AB002 /* LinkHash.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LinkHash.cpp; sourceTree = "<group>"; };
 		A7AD2F860EC89D07008AB002 /* LinkHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LinkHash.h; sourceTree = "<group>"; };
 		A7B070D0130A409C00A3763C /* FrameActionScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameActionScheduler.cpp; sourceTree = "<group>"; };
@@ -9735,6 +9835,8 @@
 		A7B6E69D0B291A9600D0529F /* DragData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragData.h; sourceTree = "<group>"; };
 		A7BBE26411AFB3F20005EA03 /* JSHTMLMeterElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLMeterElement.cpp; sourceTree = "<group>"; };
 		A7BBE26511AFB3F20005EA03 /* JSHTMLMeterElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLMeterElement.h; sourceTree = "<group>"; };
+		A7C9ABF61357A3BF00F5503F /* DetailsMarkerControl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DetailsMarkerControl.cpp; sourceTree = "<group>"; };
+		A7C9ABF71357A3BF00F5503F /* DetailsMarkerControl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DetailsMarkerControl.h; sourceTree = "<group>"; };
 		A7CA595B0B27BD9E00FA021D /* DragController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragController.h; sourceTree = "<group>"; };
 		A7CA595C0B27BD9E00FA021D /* DragController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DragController.cpp; sourceTree = "<group>"; };
 		A7CA59620B27C1F200FA021D /* DragClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragClient.h; sourceTree = "<group>"; };
@@ -9753,7 +9855,6 @@
 		A7DBF8DC1276919C006B6008 /* TextCheckingHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextCheckingHelper.h; sourceTree = "<group>"; };
 		A7F338A111C0EFCA00A320A7 /* ShadowElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowElement.cpp; sourceTree = "<group>"; };
 		A7F338A211C0EFCA00A320A7 /* ShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowElement.h; sourceTree = "<group>"; };
-		A7FE819B12FA677700850C1E /* ProgressBarValueElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProgressBarValueElement.h; sourceTree = "<group>"; };
 		A80A38FD0E50CC8200A25EBC /* PatternCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PatternCG.cpp; sourceTree = "<group>"; };
 		A80D67070E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContextPlatformPrivateCG.h; sourceTree = "<group>"; };
 		A80E6CBA0A1989CA007FB8C5 /* CSSValueList.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSValueList.cpp; sourceTree = "<group>"; };
@@ -9929,6 +10030,7 @@
 		A84EBD820CB8C97700079609 /* JSStyleSheetList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStyleSheetList.cpp; sourceTree = "<group>"; };
 		A853123C11D0471B00D4D077 /* FragmentScriptingPermission.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FragmentScriptingPermission.h; sourceTree = "<group>"; };
 		A85D7A2F0879EBA9006A9172 /* QuartzCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = QuartzCore.framework; path = /System/Library/Frameworks/QuartzCore.framework; sourceTree = "<absolute>"; };
+		A863E2001343412000274926 /* UnicodeBidi.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnicodeBidi.h; sourceTree = "<group>"; };
 		A86629C909DA2B47009633A5 /* JSUIEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSUIEvent.h; sourceTree = "<group>"; };
 		A86629CA09DA2B47009633A5 /* JSUIEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSUIEvent.cpp; sourceTree = "<group>"; };
 		A86629CB09DA2B47009633A5 /* JSMouseEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSMouseEvent.h; sourceTree = "<group>"; };
@@ -10006,6 +10108,7 @@
 		A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentParser.cpp; sourceTree = "<group>"; };
 		A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodedDataDocumentParser.h; sourceTree = "<group>"; };
 		A8C228A011D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DecodedDataDocumentParser.cpp; sourceTree = "<group>"; };
+		A8C402921348B2220063F1E5 /* BidiRunList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BidiRunList.h; sourceTree = "<group>"; };
 		A8C4A7EB09D563270003AC8D /* StyledElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = StyledElement.h; sourceTree = "<group>"; };
 		A8C4A7EC09D563270003AC8D /* StyledElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = StyledElement.cpp; sourceTree = "<group>"; };
 		A8C4A7EE09D563270003AC8D /* Node.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Node.cpp; sourceTree = "<group>"; };
@@ -10337,14 +10440,26 @@
 		ABC128760B33AA6D00C693D5 /* PopupMenuClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PopupMenuClient.h; sourceTree = "<group>"; };
 		ABDDFE730A5C6E6F00A3E11D /* RenderMenuList.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderMenuList.cpp; sourceTree = "<group>"; };
 		ABDDFE740A5C6E7000A3E11D /* RenderMenuList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderMenuList.h; sourceTree = "<group>"; };
-		ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaControlElements.cpp; sourceTree = "<group>"; };
-		ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaControlElements.h; sourceTree = "<group>"; };
 		ADDF1AD41257CD9A0003A759 /* RenderSVGPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGPath.cpp; sourceTree = "<group>"; };
 		ADDF1AD51257CD9A0003A759 /* RenderSVGPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGPath.h; sourceTree = "<group>"; };
 		B0149E7911A4B21500196A7B /* AsyncImageResizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncImageResizer.cpp; sourceTree = "<group>"; };
 		B0149E7A11A4B21500196A7B /* AsyncImageResizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncImageResizer.h; sourceTree = "<group>"; };
 		B0149E7B11A4B21500196A7B /* ImageResizerThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageResizerThread.cpp; sourceTree = "<group>"; };
 		B0149E7C11A4B21500196A7B /* ImageResizerThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageResizerThread.h; sourceTree = "<group>"; };
+		B1827492134CA4C100B98C2D /* CallbackFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallbackFunction.cpp; sourceTree = "<group>"; };
+		B1D5ECB4134B58DA0087C78F /* CallbackFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallbackFunction.h; sourceTree = "<group>"; };
+		B1E5458D134629C10092A545 /* NavigatorUserMediaError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorUserMediaError.h; sourceTree = "<group>"; };
+		B1E5458E134629C10092A545 /* NavigatorUserMediaError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = NavigatorUserMediaError.idl; sourceTree = "<group>"; };
+		B1E5458F134629C10092A545 /* NavigatorUserMediaErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorUserMediaErrorCallback.h; sourceTree = "<group>"; };
+		B1E54590134629C10092A545 /* NavigatorUserMediaErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = NavigatorUserMediaErrorCallback.idl; sourceTree = "<group>"; };
+		B1E54591134629C10092A545 /* NavigatorUserMediaSuccessCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorUserMediaSuccessCallback.h; sourceTree = "<group>"; };
+		B1E54592134629C10092A545 /* NavigatorUserMediaSuccessCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = NavigatorUserMediaSuccessCallback.idl; sourceTree = "<group>"; };
+		B1E545D113462B0B0092A545 /* JSNavigatorUserMediaError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNavigatorUserMediaError.cpp; sourceTree = "<group>"; };
+		B1E545D213462B0B0092A545 /* JSNavigatorUserMediaError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNavigatorUserMediaError.h; sourceTree = "<group>"; };
+		B1E545D313462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNavigatorUserMediaErrorCallback.cpp; sourceTree = "<group>"; };
+		B1E545D413462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNavigatorUserMediaErrorCallback.h; sourceTree = "<group>"; };
+		B1E545D513462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNavigatorUserMediaSuccessCallback.cpp; sourceTree = "<group>"; };
+		B1E545D613462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNavigatorUserMediaSuccessCallback.h; sourceTree = "<group>"; };
 		B20111050AB7740500DB0E68 /* JSSVGAElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGAElement.cpp; sourceTree = "<group>"; };
 		B20111060AB7740500DB0E68 /* JSSVGAElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGAElement.h; sourceTree = "<group>"; };
 		B22277CB0D00BF1F0071B782 /* ColorDistance.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = ColorDistance.cpp; sourceTree = "<group>"; };
@@ -11199,7 +11314,6 @@
 		B776D43C1104527500BEB0EC /* PrintContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PrintContext.cpp; sourceTree = "<group>"; };
 		B885E8D211E06DD2009FFBF4 /* InspectorApplicationCacheAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorApplicationCacheAgent.cpp; sourceTree = "<group>"; };
 		B885E8D311E06DD2009FFBF4 /* InspectorApplicationCacheAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorApplicationCacheAgent.h; sourceTree = "<group>"; };
-		B8A6A6D4127B338D008673BA /* CorrectionPanelInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CorrectionPanelInfo.h; sourceTree = "<group>"; };
 		B8DBDB47130B0F8A00F5CDB1 /* SetSelectionCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SetSelectionCommand.cpp; sourceTree = "<group>"; };
 		B8DBDB48130B0F8A00F5CDB1 /* SetSelectionCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SetSelectionCommand.h; sourceTree = "<group>"; };
 		B8DBDB49130B0F8A00F5CDB1 /* SpellingCorrectionCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpellingCorrectionCommand.cpp; sourceTree = "<group>"; };
@@ -11572,7 +11686,6 @@
 		BCA8C81D11E3D36900812FB7 /* BackForwardController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BackForwardController.cpp; sourceTree = "<group>"; };
 		BCA8CA5D11E4E6D100812FB7 /* BackForwardListImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BackForwardListImpl.cpp; sourceTree = "<group>"; };
 		BCA8CA5E11E4E6D100812FB7 /* BackForwardListImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BackForwardListImpl.h; sourceTree = "<group>"; };
-		BCA979161215D055005C485C /* ImageBufferData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferData.h; sourceTree = "<group>"; };
 		BCAA90C20A7EBA60008B1229 /* Scrollbar.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Scrollbar.cpp; sourceTree = "<group>"; };
 		BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserContentURLPattern.cpp; sourceTree = "<group>"; };
 		BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserContentURLPattern.h; sourceTree = "<group>"; };
@@ -11983,6 +12096,8 @@
 		E18258AB0EF3CD7000933242 /* JSWorkerContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerContextCustom.cpp; sourceTree = "<group>"; };
 		E18772F0126E2629003DD586 /* Language.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Language.cpp; sourceTree = "<group>"; };
 		E1A1470711102B1500EEC0F3 /* ContainerNodeAlgorithms.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContainerNodeAlgorithms.h; sourceTree = "<group>"; };
+		E1A3162B134BC32D007C9A4F /* WebNSAttributedStringExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNSAttributedStringExtras.h; sourceTree = "<group>"; };
+		E1A3162C134BC32D007C9A4F /* WebNSAttributedStringExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNSAttributedStringExtras.mm; sourceTree = "<group>"; };
 		E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannelCustom.cpp; sourceTree = "<group>"; };
 		E1A643F10EC0972500779668 /* WorkerScriptController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerScriptController.h; sourceTree = "<group>"; };
 		E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerScriptController.cpp; sourceTree = "<group>"; };
@@ -12139,6 +12254,8 @@
 		F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerScriptDebugServer.h; sourceTree = "<group>"; };
 		F3644AFD1119805900E0D537 /* InjectedScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScript.cpp; sourceTree = "<group>"; };
 		F3644AFE1119805900E0D537 /* InjectedScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScript.h; sourceTree = "<group>"; };
+		F36E07A21358A8BE00AACBC9 /* WorkerInspectorController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerInspectorController.cpp; sourceTree = "<group>"; };
+		F36E07A31358A8BE00AACBC9 /* WorkerInspectorController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerInspectorController.h; sourceTree = "<group>"; };
 		F375CC061150D300008DDB81 /* InspectorWorkerResource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorWorkerResource.h; sourceTree = "<group>"; };
 		F392249A126F11AE00A926D9 /* ScriptCallStackFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallStackFactory.cpp; sourceTree = "<group>"; };
 		F392249B126F11AE00A926D9 /* ScriptCallStackFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallStackFactory.h; sourceTree = "<group>"; };
@@ -12264,6 +12381,8 @@
 		FABE72FB1059C21100D999DD /* MathMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLElementFactory.cpp; sourceTree = "<group>"; };
 		FABE72FC1059C21100D999DD /* MathMLNames.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLNames.cpp; sourceTree = "<group>"; };
 		FBC220DE1237FBEB00BCF788 /* GraphicsContext3DOpenGL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GraphicsContext3DOpenGL.cpp; sourceTree = "<group>"; };
+		FD06DFA3134A4DEF006F5D7D /* DefaultAudioDestinationNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DefaultAudioDestinationNode.cpp; sourceTree = "<group>"; };
+		FD06DFA4134A4DEF006F5D7D /* DefaultAudioDestinationNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DefaultAudioDestinationNode.h; sourceTree = "<group>"; };
 		FD2DBF0E12B048A300ED98C6 /* Accelerate.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Accelerate.framework; path = /System/Library/Frameworks/Accelerate.framework; sourceTree = "<absolute>"; };
 		FD2DBF0F12B048A300ED98C6 /* AudioToolbox.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = AudioToolbox.framework; path = /System/Library/Frameworks/AudioToolbox.framework; sourceTree = "<absolute>"; };
 		FD2DBF1012B048A300ED98C6 /* AudioUnit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = AudioUnit.framework; path = /System/Library/Frameworks/AudioUnit.framework; sourceTree = "<absolute>"; };
@@ -12442,11 +12561,18 @@
 		FDA15ECC12B03F61003A583A /* JSJavaScriptAudioNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSJavaScriptAudioNode.h; sourceTree = "<group>"; };
 		FDA15ECF12B03F94003A583A /* JSDelayNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDelayNode.cpp; sourceTree = "<group>"; };
 		FDA15ED012B03F94003A583A /* JSDelayNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDelayNode.h; sourceTree = "<group>"; };
+		FDA3E955134A49EF008D4B5A /* OfflineAudioCompletionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OfflineAudioCompletionEvent.cpp; sourceTree = "<group>"; };
+		FDA3E956134A49EF008D4B5A /* OfflineAudioCompletionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OfflineAudioCompletionEvent.h; sourceTree = "<group>"; };
+		FDA3E957134A49EF008D4B5A /* OfflineAudioDestinationNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OfflineAudioDestinationNode.cpp; sourceTree = "<group>"; };
+		FDA3E958134A49EF008D4B5A /* OfflineAudioDestinationNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OfflineAudioDestinationNode.h; sourceTree = "<group>"; };
+		FDA3E95D134A49FF008D4B5A /* OfflineAudioCompletionEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = OfflineAudioCompletionEvent.idl; sourceTree = "<group>"; };
 		FDEAAAEF12B02EE400DCF33B /* JSAudioBufferSourceNodeCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAudioBufferSourceNodeCustom.cpp; sourceTree = "<group>"; };
 		FDEAAAF012B02EE400DCF33B /* JSAudioContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAudioContextCustom.cpp; sourceTree = "<group>"; };
 		FDEAAAF112B02EE400DCF33B /* JSAudioNodeCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAudioNodeCustom.cpp; sourceTree = "<group>"; };
 		FDEAAAF212B02EE400DCF33B /* JSConvolverNodeCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSConvolverNodeCustom.cpp; sourceTree = "<group>"; };
 		FDEAAAFD12B02F4900DCF33B /* JSJavaScriptAudioNodeCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSJavaScriptAudioNodeCustom.cpp; sourceTree = "<group>"; };
+		FDF6BAF6134A4C9800822920 /* JSOfflineAudioCompletionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSOfflineAudioCompletionEvent.cpp; sourceTree = "<group>"; };
+		FDF6BAF7134A4C9800822920 /* JSOfflineAudioCompletionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSOfflineAudioCompletionEvent.h; sourceTree = "<group>"; };
 		FE49EF970DC51462004266E1 /* DashboardSupportCSSPropertyNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DashboardSupportCSSPropertyNames.in; sourceTree = "<group>"; };
 		FE6FD4850F676E5700092873 /* Coordinates.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Coordinates.h; sourceTree = "<group>"; };
 		FE6FD4860F676E5700092873 /* Coordinates.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Coordinates.idl; sourceTree = "<group>"; };
@@ -12873,9 +12999,9 @@
 		1A569CCE0D7E2B82007C3983 /* jni */ = {
 			isa = PBXGroup;
 			children = (
-				599C671D1343439400C3423C /* JavaMethodJobject.h */,
-				599C671B1343438900C3423C /* JavaMethodJobject.cpp */,
 				593D3EAE1325328C0057E7EE /* JavaMethod.h */,
+				599C671B1343438900C3423C /* JavaMethodJobject.cpp */,
+				599C671D1343439400C3423C /* JavaMethodJobject.h */,
 				593D3EB0132532950057E7EE /* JavaString.h */,
 				59B0EEA6132A6F2A004331C7 /* JavaType.h */,
 				1A569CD40D7E2B82007C3983 /* jni_jsobject.h */,
@@ -13090,6 +13216,11 @@
 				51E0BABD0DA5548400A9E417 /* StorageEvent.idl */,
 				C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */,
 				C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */,
+				892CF1EA134C655500AAEDA1 /* StorageInfo.cpp */,
+				892CF1EB134C655500AAEDA1 /* StorageInfo.h */,
+				892CF18D134C620D00AAEDA1 /* StorageInfoErrorCallback.h */,
+				892CF18E134C620D00AAEDA1 /* StorageInfoQuotaCallback.h */,
+				892CF18F134C620D00AAEDA1 /* StorageInfoUsageCallback.h */,
 				51E0BB370DA5ACB600A9E417 /* StorageMap.cpp */,
 				51E0BB360DA5ACB600A9E417 /* StorageMap.h */,
 				C50D0E800FF4272900AC2644 /* StorageNamespace.cpp */,
@@ -13138,6 +13269,8 @@
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
 				4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */,
 				4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */,
+				22777B48134A018C008EA455 /* EventsCollector.cpp */,
+				22777B49134A018C008EA455 /* EventsCollector.h */,
 				F3644AFD1119805900E0D537 /* InjectedScript.cpp */,
 				F3644AFE1119805900E0D537 /* InjectedScript.h */,
 				7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */,
@@ -13174,12 +13307,15 @@
 				7A74ECB9101839A600BF939E /* InspectorDOMStorageAgent.h */,
 				41F061730F5F00AC00A07EAC /* InspectorDOMStorageResource.cpp */,
 				41F061720F5F00AC00A07EAC /* InspectorDOMStorageResource.h */,
+				2277775F1345DEA9008EA455 /* InspectorFrontendChannel.h */,
 				F344C7121125B82C00F26EEE /* InspectorFrontendClient.h */,
 				F344C75711294FF600F26EEE /* InspectorFrontendClientLocal.cpp */,
 				F344C75211294D9D00F26EEE /* InspectorFrontendClientLocal.h */,
 				7A0E770B10C00A8800A0276E /* InspectorFrontendHost.cpp */,
 				7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */,
 				7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */,
+				22777B4C134A01A8008EA455 /* InspectorFrontendProxy.cpp */,
+				22777B4D134A01A8008EA455 /* InspectorFrontendProxy.h */,
 				20D629241253690B00081543 /* InspectorInstrumentation.cpp */,
 				20D629251253690B00081543 /* InspectorInstrumentation.h */,
 				4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */,
@@ -13218,6 +13354,8 @@
 				7553CFE6108F473F00EA281E /* TimelineRecordFactory.h */,
 				F34742DE1343631F00531BC2 /* WorkerDebuggerAgent.cpp */,
 				F34742DF1343631F00531BC2 /* WorkerDebuggerAgent.h */,
+				F36E07A21358A8BE00AACBC9 /* WorkerInspectorController.cpp */,
+				F36E07A31358A8BE00AACBC9 /* WorkerInspectorController.h */,
 			);
 			path = inspector;
 			sourceTree = "<group>";
@@ -13399,9 +13537,18 @@
 		4150F9ED12B6E0990008C860 /* shadow */ = {
 			isa = PBXGroup;
 			children = (
-				4157AF7F12F1FB0400A8C6F5 /* MediaControls.cpp */,
-				4157AF7E12F1FB0400A8C6F5 /* MediaControls.h */,
-				A7FE819B12FA677700850C1E /* ProgressBarValueElement.h */,
+				A7C9ABF61357A3BF00F5503F /* DetailsMarkerControl.cpp */,
+				A7C9ABF71357A3BF00F5503F /* DetailsMarkerControl.h */,
+				417253A81354BBBC00360F2A /* MediaControlElements.cpp */,
+				417253A91354BBBC00360F2A /* MediaControlElements.h */,
+				4157AF7F12F1FB0400A8C6F5 /* MediaControlRootElement.cpp */,
+				4157AF7E12F1FB0400A8C6F5 /* MediaControlRootElement.h */,
+				1F3C3BE8135CAF3C00B8C1AC /* MediaControls.cpp */,
+				1F3C3BE9135CAF3C00B8C1AC /* MediaControls.h */,
+				A78E526D1346BD1700AD9C31 /* MeterShadowElement.cpp */,
+				A78E526E1346BD1700AD9C31 /* MeterShadowElement.h */,
+				A715E650134BBBEC00D8E713 /* ProgressShadowElement.cpp */,
+				A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */,
 				4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */,
 				4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */,
 				142B97C713138943008BEF4B /* TextControlInnerElements.cpp */,
@@ -14101,8 +14248,6 @@
 				D39D006C11F8E308006041F2 /* PopupMenuMac.h */,
 				0668E18E0ADD9640004128E0 /* PopupMenuMac.mm */,
 				E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */,
-				447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */,
-				447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */,
 				1CE24F960D7CAF0E007E04C2 /* SchedulePairMac.mm */,
 				BCAE1FA512939DB7004CB026 /* ScrollAnimatorMac.h */,
 				BC51156D12B1749C00C96754 /* ScrollAnimatorMac.mm */,
@@ -14131,6 +14276,8 @@
 				BE8560510701F91100239769 /* WebCoreView.m */,
 				BC6DADEE0A195FDF00E5CD14 /* WebFontCache.h */,
 				BC6DADF90A19602B00E5CD14 /* WebFontCache.mm */,
+				E1A3162B134BC32D007C9A4F /* WebNSAttributedStringExtras.h */,
+				E1A3162C134BC32D007C9A4F /* WebNSAttributedStringExtras.mm */,
 				935C477209AC4D7700A6AAB4 /* WheelEventMac.mm */,
 				9380F47709A11ACC001FDB34 /* WidgetMac.mm */,
 			);
@@ -14225,6 +14372,12 @@
 				A9C6E65D0D746694006442E9 /* Navigator.idl */,
 				E12719C90EEEC21300F61213 /* NavigatorBase.cpp */,
 				E12719C60EEEC16800F61213 /* NavigatorBase.h */,
+				B1E5458D134629C10092A545 /* NavigatorUserMediaError.h */,
+				B1E5458E134629C10092A545 /* NavigatorUserMediaError.idl */,
+				B1E5458F134629C10092A545 /* NavigatorUserMediaErrorCallback.h */,
+				B1E54590134629C10092A545 /* NavigatorUserMediaErrorCallback.idl */,
+				B1E54591134629C10092A545 /* NavigatorUserMediaSuccessCallback.h */,
+				B1E54592134629C10092A545 /* NavigatorUserMediaSuccessCallback.idl */,
 				00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */,
 				00146289103CD1DE000B20DB /* OriginAccessEntry.h */,
 				65FEA86809833ADE00BED4AB /* Page.cpp */,
@@ -15416,8 +15569,6 @@
 			children = (
 				2E2D99CB10E2BBDA00496337 /* JSBlob.cpp */,
 				2E2D99CC10E2BBDA00496337 /* JSBlob.h */,
-				89CD029111C85B870070B791 /* JSBlobBuilder.cpp */,
-				89CD029211C85B870070B791 /* JSBlobBuilder.h */,
 				89878586122CA26A003AABDA /* JSDirectoryEntry.cpp */,
 				89878587122CA26A003AABDA /* JSDirectoryEntry.h */,
 				893C482612495472002B3D86 /* JSDirectoryEntrySync.cpp */,
@@ -15468,16 +15619,31 @@
 				46DA844C1224A0710060D006 /* JSFileWriter.h */,
 				893C47B91238A0A9002B3D86 /* JSFileWriterCallback.cpp */,
 				893C47BA1238A0A9002B3D86 /* JSFileWriterCallback.h */,
-				8987859E122CA2A7003AABDA /* JSFlags.cpp */,
-				8987859F122CA2A7003AABDA /* JSFlags.h */,
+				8987859E122CA2A7003AABDA /* JSWebKitFlags.cpp */,
+				8987859F122CA2A7003AABDA /* JSWebKitFlags.h */,
 				898785A0122CA2A7003AABDA /* JSMetadata.cpp */,
 				898785A1122CA2A7003AABDA /* JSMetadata.h */,
 				898785A2122CA2A7003AABDA /* JSMetadataCallback.cpp */,
 				898785A3122CA2A7003AABDA /* JSMetadataCallback.h */,
+				89CD029111C85B870070B791 /* JSWebKitBlobBuilder.cpp */,
+				89CD029211C85B870070B791 /* JSWebKitBlobBuilder.h */,
 			);
 			name = FileAPI;
 			sourceTree = "<group>";
 		};
+		8CADF2A2135C7B36009EF43F /* leveldb */ = {
+			isa = PBXGroup;
+			children = (
+				8CADF2A3135C7B36009EF43F /* LevelDBComparator.h */,
+				8CADF2A4135C7B36009EF43F /* LevelDBDatabase.cpp */,
+				8CADF2A5135C7B36009EF43F /* LevelDBDatabase.h */,
+				8CADF2A6135C7B36009EF43F /* LevelDBIterator.cpp */,
+				8CADF2A7135C7B36009EF43F /* LevelDBIterator.h */,
+				8CADF2A8135C7B36009EF43F /* LevelDBSlice.h */,
+			);
+			path = leveldb;
+			sourceTree = "<group>";
+		};
 		93309D86099E64910056E581 /* editing */ = {
 			isa = PBXGroup;
 			children = (
@@ -15492,7 +15658,6 @@
 				93309D8C099E64910056E581 /* BreakBlockquoteCommand.h */,
 				93309D8D099E64910056E581 /* CompositeEditCommand.cpp */,
 				93309D8E099E64910056E581 /* CompositeEditCommand.h */,
-				B8A6A6D4127B338D008673BA /* CorrectionPanelInfo.h */,
 				D0B0556709C6700100307E43 /* CreateLinkCommand.cpp */,
 				D0B0556609C6700100307E43 /* CreateLinkCommand.h */,
 				1C4C8F630AD8655D009475CE /* DeleteButton.cpp */,
@@ -15574,6 +15739,8 @@
 				A78FE13A12366B1000ACE8D0 /* SpellChecker.h */,
 				B8DBDB49130B0F8A00F5CDB1 /* SpellingCorrectionCommand.cpp */,
 				B8DBDB4A130B0F8A00F5CDB1 /* SpellingCorrectionCommand.h */,
+				A7005CCA1330C4BA000CC0BA /* SpellingCorrectionController.cpp */,
+				A7005CCB1330C4BA000CC0BA /* SpellingCorrectionController.h */,
 				93309DC2099E64910056E581 /* SplitElementCommand.cpp */,
 				93309DC3099E64910056E581 /* SplitElementCommand.h */,
 				93309DC4099E64910056E581 /* SplitTextNodeCommand.cpp */,
@@ -16042,8 +16209,6 @@
 				976D6C74122B8A3D001FD1F7 /* AsyncFileWriterClient.h */,
 				976D6C59122B8A3D001FD1F7 /* Blob.cpp */,
 				976D6C5A122B8A3D001FD1F7 /* Blob.h */,
-				976D6C5C122B8A3D001FD1F7 /* BlobBuilder.cpp */,
-				976D6C5D122B8A3D001FD1F7 /* BlobBuilder.h */,
 				976D6C5F122B8A3D001FD1F7 /* BlobURL.cpp */,
 				976D6C60122B8A3D001FD1F7 /* BlobURL.h */,
 				89878539122CA064003AABDA /* DirectoryEntry.cpp */,
@@ -16111,13 +16276,15 @@
 				893C47A61238908B002B3D86 /* FileWriterCallback.h */,
 				46700ECE127B96CB00F5D5D6 /* FileWriterSync.cpp */,
 				46700ECF127B96CB00F5D5D6 /* FileWriterSync.h */,
-				8987854D122CA064003AABDA /* Flags.h */,
+				8987854D122CA064003AABDA /* WebKitFlags.h */,
 				8987854E122CA064003AABDA /* LocalFileSystem.cpp */,
 				8987854F122CA064003AABDA /* LocalFileSystem.h */,
 				89878550122CA064003AABDA /* Metadata.h */,
 				89878551122CA064003AABDA /* MetadataCallback.h */,
 				976D6C75122B8A3D001FD1F7 /* ThreadableBlobRegistry.cpp */,
 				976D6C76122B8A3D001FD1F7 /* ThreadableBlobRegistry.h */,
+				976D6C5C122B8A3D001FD1F7 /* WebKitBlobBuilder.cpp */,
+				976D6C5D122B8A3D001FD1F7 /* WebKitBlobBuilder.h */,
 			);
 			name = fileapi;
 			sourceTree = "<group>";
@@ -17020,6 +17187,12 @@
 				51E3F9D50DA05E1D00250911 /* JSStorage.h */,
 				51E0BAE80DA55D4A00A9E417 /* JSStorageEvent.cpp */,
 				51E0BAE90DA55D4A00A9E417 /* JSStorageEvent.h */,
+				892CF203134C8BB300AAEDA1 /* JSStorageInfo.cpp */,
+				892CF204134C8BB300AAEDA1 /* JSStorageInfo.h */,
+				892CF205134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.cpp */,
+				892CF206134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.h */,
+				892CF209134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.cpp */,
+				892CF20A134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.h */,
 			);
 			name = Storage;
 			sourceTree = "<group>";
@@ -17589,7 +17762,8 @@
 				934907E3125BBBC8007F23A0 /* GraphicsContextCG.h */,
 				A80D67070E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h */,
 				B2A10B930B3818D700099AA4 /* ImageBufferCG.cpp */,
-				BCA979161215D055005C485C /* ImageBufferData.h */,
+				2292B27B1356669400CF11EF /* ImageBufferDataCG.cpp */,
+				22BD9F80135364FE009BD102 /* ImageBufferDataCG.h */,
 				B27535300B053814002CE64F /* ImageCG.cpp */,
 				B27535310B053814002CE64F /* ImageSourceCG.cpp */,
 				4B3480920EEF50D400AC1B41 /* ImageSourceCG.h */,
@@ -17725,6 +17899,7 @@
 				B27535410B053814002CE64F /* Image.cpp */,
 				B27535420B053814002CE64F /* Image.h */,
 				B2A10B910B3818BD00099AA4 /* ImageBuffer.h */,
+				22BD9F7D1353625C009BD102 /* ImageBufferData.h */,
 				BC7F44A70B9E324E00A9D081 /* ImageObserver.h */,
 				B27535430B053814002CE64F /* ImageSource.h */,
 				B27535440B053814002CE64F /* IntPoint.h */,
@@ -17787,6 +17962,7 @@
 				B2C3D9F20D006C1D00EF6F26 /* BidiContext.cpp */,
 				B2C3D9F30D006C1D00EF6F26 /* BidiContext.h */,
 				B2C3D9F40D006C1D00EF6F26 /* BidiResolver.h */,
+				A8C402921348B2220063F1E5 /* BidiRunList.h */,
 				375CD231119D43C800A2A859 /* Hyphenation.h */,
 				89B5EA9F11E8003D00F2367E /* LineEnding.cpp */,
 				89B5EAA011E8003D00F2367E /* LineEnding.h */,
@@ -17798,6 +17974,7 @@
 				B2C3D9FE0D006C1D00EF6F26 /* SegmentedString.cpp */,
 				B2C3D9FF0D006C1D00EF6F26 /* SegmentedString.h */,
 				B2C3DA000D006C1D00EF6F26 /* String.cpp */,
+				9B6C41521344949000085B62 /* StringWithDirection.h */,
 				97C0784F1165D5BE003A32EF /* SuffixTree.h */,
 				372C00C3129611F1005C9575 /* TextBoundaries.cpp */,
 				B2C3DA040D006C1D00EF6F26 /* TextBoundaries.h */,
@@ -17829,6 +18006,7 @@
 				BCD3F9821326C93700098A60 /* TextOrientation.h */,
 				B2C3DA1A0D006C1D00EF6F26 /* TextStream.cpp */,
 				B2C3DA1B0D006C1D00EF6F26 /* TextStream.h */,
+				A863E2001343412000274926 /* UnicodeBidi.h */,
 				B2C3DA1C0D006C1D00EF6F26 /* UnicodeRange.cpp */,
 				B2C3DA1D0D006C1D00EF6F26 /* UnicodeRange.h */,
 			);
@@ -17945,6 +18123,8 @@
 				BC4EDEF70C08F414007EDD49 /* Custom */,
 				14DFB33F0A7DF7630018F769 /* Derived Sources */,
 				BCD533630ED6848900887468 /* CachedScriptSourceProvider.h */,
+				B1827492134CA4C100B98C2D /* CallbackFunction.cpp */,
+				B1D5ECB4134B58DA0087C78F /* CallbackFunction.h */,
 				93F8B3060A300FEA00F61AB8 /* CodeGeneratorJS.pm */,
 				BC53DA61114314BD000D817E /* DOMObjectHashTableMap.cpp */,
 				BC53DA5F1143141A000D817E /* DOMObjectHashTableMap.h */,
@@ -18293,6 +18473,12 @@
 				9FFE3EA411B5A4390037874E /* JSMemoryInfo.h */,
 				A9D247F50D757E3300FDF959 /* JSNavigator.cpp */,
 				A9D247F60D757E3300FDF959 /* JSNavigator.h */,
+				B1E545D113462B0B0092A545 /* JSNavigatorUserMediaError.cpp */,
+				B1E545D213462B0B0092A545 /* JSNavigatorUserMediaError.h */,
+				B1E545D313462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.cpp */,
+				B1E545D413462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.h */,
+				B1E545D513462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.cpp */,
+				B1E545D613462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.h */,
 				8A9A587211E84C81008ACFD1 /* JSPerformance.cpp */,
 				8A9A587311E84C81008ACFD1 /* JSPerformance.h */,
 				8A9A586E11E84C35008ACFD1 /* JSPerformanceNavigation.cpp */,
@@ -18472,6 +18658,7 @@
 				A5C974CE11485FDA0066F2AB /* cocoa */,
 				B2A015910AF6CD53006BCE0E /* graphics */,
 				A59E3C1B11580F340072928E /* iphone */,
+				8CADF2A2135C7B36009EF43F /* leveldb */,
 				6582A14809999D6C00BEEB6D /* mac */,
 				59C77F101054591C00506104 /* mock */,
 				656B84D70AEA1CE900A095B4 /* network */,
@@ -18549,6 +18736,8 @@
 				E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */,
 				7E33CD00127F340D00BE8F17 /* PurgePriority.h */,
 				1C63A2460F71646600C09D5A /* RunLoopTimer.h */,
+				293EAE201356B32E0067ACF9 /* RuntimeApplicationChecks.cpp */,
+				293EAE1E1356B2FE0067ACF9 /* RuntimeApplicationChecks.h */,
 				5162C7F211F77EFA00612EFE /* SchemeRegistry.cpp */,
 				5162C7F311F77EFB00612EFE /* SchemeRegistry.h */,
 				BC8AE34C12EA096A00EB3AE6 /* ScrollableArea.cpp */,
@@ -18646,7 +18835,8 @@
 				1ACE53E60A8D18E70022947D /* XMLSerializer.idl */,
 				5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */,
 				5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */,
-				5980B03312EF3D8400DF5F85 /* XMLViewer.xsl */,
+				5958F1CB1343917C0080B31F /* XMLViewer.css */,
+				5958F1CC1343917C0080B31F /* XMLViewer.js */,
 				1AB7FC470A8B92EC00D9D37B /* XPathEvaluator.cpp */,
 				1AB7FC480A8B92EC00D9D37B /* XPathEvaluator.h */,
 				1AB7FC490A8B92EC00D9D37B /* XPathEvaluator.idl */,
@@ -18965,8 +19155,6 @@
 				BCEA481B097D93020094C9E4 /* InlineTextBox.h */,
 				2D9066040BE141D400956998 /* LayoutState.cpp */,
 				2D9066050BE141D400956998 /* LayoutState.h */,
-				ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */,
-				ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */,
 				3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */,
 				0885067D11DA045B00182B98 /* PaintInfo.h */,
 				0885067E11DA045B00182B98 /* PaintPhase.h */,
@@ -19023,8 +19211,6 @@
 				08F2F0081213E61700DCEC48 /* RenderImageResource.h */,
 				08641D4512142F7D008DE9F6 /* RenderImageResourceStyleImage.cpp */,
 				08641D4612142F7D008DE9F6 /* RenderImageResourceStyleImage.h */,
-				A7AA66D411C5ED6A001D8C8C /* RenderIndicator.cpp */,
-				A7AA66D511C5ED6A001D8C8C /* RenderIndicator.h */,
 				BCEA4838097D93020094C9E4 /* RenderInline.cpp */,
 				BCEA4839097D93020094C9E4 /* RenderInline.h */,
 				750D029111D0E7F300BD1B27 /* RenderInputSpeech.cpp */,
@@ -19393,6 +19579,8 @@
 				084AEBE30FB505FA0038483E /* SelectElement.h */,
 				BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */,
 				BC7FA67F0D1F167900DB22A9 /* SelectorNodeList.h */,
+				A6D169611346B49B000EB770 /* ShadowRoot.cpp */,
+				A6D169631346B4C1000EB770 /* ShadowRoot.h */,
 				D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */,
 				D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */,
 				CEA3949A11D45CDA003094CF /* StaticHashSetNodeList.cpp */,
@@ -19420,6 +19608,8 @@
 				854FE72C0A2297BE0058D7AD /* Traversal.cpp */,
 				854FE72D0A2297BE0058D7AD /* Traversal.h */,
 				37FD4297118368460093C029 /* TreeDepthLimit.h */,
+				14D64B5A134A5B6B00E58FDA /* TreeScope.cpp */,
+				14D64B5B134A5B6B00E58FDA /* TreeScope.h */,
 				854FE72E0A2297BE0058D7AD /* TreeWalker.cpp */,
 				854FE72F0A2297BE0058D7AD /* TreeWalker.h */,
 				1A750D3C0A90DE35000FF215 /* TreeWalker.idl */,
@@ -19539,6 +19729,8 @@
 				FD315FDE12B0267600C1A359 /* ConvolverNode.cpp */,
 				FD315FDF12B0267600C1A359 /* ConvolverNode.h */,
 				FD315FE012B0267600C1A359 /* ConvolverNode.idl */,
+				FD06DFA3134A4DEF006F5D7D /* DefaultAudioDestinationNode.cpp */,
+				FD06DFA4134A4DEF006F5D7D /* DefaultAudioDestinationNode.h */,
 				FD315FE112B0267600C1A359 /* DelayDSPKernel.cpp */,
 				FD315FE212B0267600C1A359 /* DelayDSPKernel.h */,
 				FD315FE312B0267600C1A359 /* DelayNode.cpp */,
@@ -19555,6 +19747,11 @@
 				FD315FEE12B0267600C1A359 /* LowPass2FilterNode.cpp */,
 				FD315FEF12B0267600C1A359 /* LowPass2FilterNode.h */,
 				FD315FF012B0267600C1A359 /* LowPass2FilterNode.idl */,
+				FDA3E955134A49EF008D4B5A /* OfflineAudioCompletionEvent.cpp */,
+				FDA3E956134A49EF008D4B5A /* OfflineAudioCompletionEvent.h */,
+				FDA3E95D134A49FF008D4B5A /* OfflineAudioCompletionEvent.idl */,
+				FDA3E957134A49EF008D4B5A /* OfflineAudioDestinationNode.cpp */,
+				FDA3E958134A49EF008D4B5A /* OfflineAudioDestinationNode.h */,
 				FD315FF112B0267600C1A359 /* RealtimeAnalyser.cpp */,
 				FD315FF212B0267600C1A359 /* RealtimeAnalyser.h */,
 				FD315FF312B0267600C1A359 /* RealtimeAnalyserNode.cpp */,
@@ -19680,6 +19877,8 @@
 				FDA15ECC12B03F61003A583A /* JSJavaScriptAudioNode.h */,
 				FDA15EC312B03F3B003A583A /* JSLowPass2FilterNode.cpp */,
 				FDA15EC412B03F3B003A583A /* JSLowPass2FilterNode.h */,
+				FDF6BAF6134A4C9800822920 /* JSOfflineAudioCompletionEvent.cpp */,
+				FDF6BAF7134A4C9800822920 /* JSOfflineAudioCompletionEvent.h */,
 				FDA15EC712B03F50003A583A /* JSRealtimeAnalyserNode.cpp */,
 				FDA15EC812B03F50003A583A /* JSRealtimeAnalyserNode.h */,
 			);
@@ -19805,6 +20004,7 @@
 				B2C3DA240D006C1D00EF6F26 /* BidiContext.h in Headers */,
 				B2C3DA250D006C1D00EF6F26 /* BidiResolver.h in Headers */,
 				BCE789861120E7A60060ECE5 /* BidiRun.h in Headers */,
+				A8C402931348B2220063F1E5 /* BidiRunList.h in Headers */,
 				938192050F87E1EC00D5352A /* BinaryPropertyList.h in Headers */,
 				A622A8FB122C44A600A785B3 /* BindingSecurity.h in Headers */,
 				A622A8FD122C44A600A785B3 /* BindingSecurityBase.h in Headers */,
@@ -19813,7 +20013,6 @@
 				FD31602712B0267600C1A359 /* BiquadProcessor.h in Headers */,
 				A89943280B42338800D7C802 /* BitmapImage.h in Headers */,
 				976D6C79122B8A3D001FD1F7 /* Blob.h in Headers */,
-				976D6C7C122B8A3D001FD1F7 /* BlobBuilder.h in Headers */,
 				2EDEF1F4121B0EFC00726DB2 /* BlobData.h in Headers */,
 				2EDEF1F5121B0EFC00726DB2 /* BlobRegistry.h in Headers */,
 				2EDEF1F7121B0EFC00726DB2 /* BlobRegistryImpl.h in Headers */,
@@ -19848,6 +20047,7 @@
 				BCD533640ED6848900887468 /* CachedScriptSourceProvider.h in Headers */,
 				BCB16C280979C3BD00467741 /* CachedXSLStyleSheet.h in Headers */,
 				93F1995008245E59001E9ABC /* CachePolicy.h in Headers */,
+				B1D5ECB5134B58DA0087C78F /* CallbackFunction.h in Headers */,
 				6E4E91AD10F7FB3100A2779C /* CanvasContextAttributes.h in Headers */,
 				49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */,
 				49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */,
@@ -19909,7 +20109,6 @@
 				33D0212D131DB37B004091A8 /* CookieStorage.h in Headers */,
 				7EE6846412D26E3800E79415 /* CookieStorageCFNet.h in Headers */,
 				FE6FD4880F676E5700092873 /* Coordinates.h in Headers */,
-				B8A6A6D5127B338D008673BA /* CorrectionPanelInfo.h in Headers */,
 				A80E6D040A1989CA007FB8C5 /* Counter.h in Headers */,
 				BC5EB9790E82069200B25965 /* CounterContent.h in Headers */,
 				BC5EB9510E82056B00B25965 /* CounterDirectives.h in Headers */,
@@ -20009,6 +20208,9 @@
 				A8C228A111D5722E00D5A7D3 /* DecodedDataDocumentParser.h in Headers */,
 				4162A451101145AE00DFF3ED /* DedicatedWorkerContext.h in Headers */,
 				41A3D58F101C152D00316D07 /* DedicatedWorkerThread.h in Headers */,
+				FD06DFA6134A4DEF006F5D7D /* DefaultAudioDestinationNode.h in Headers */,
+				FD06DFA6134A4DEF006F5D7D /* DefaultAudioDestinationNode.h in Headers */,
+				BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */,
 				4167EBF6102962BA003D252A /* DefaultSharedWorkerRepository.h in Headers */,
 				FD31602C12B0267600C1A359 /* DelayDSPKernel.h in Headers */,
 				FD31602E12B0267600C1A359 /* DelayNode.h in Headers */,
@@ -20017,6 +20219,7 @@
 				1C4C8F020AD85D87009475CE /* DeleteButtonController.h in Headers */,
 				93309DDF099E64920056E581 /* DeleteFromTextNodeCommand.h in Headers */,
 				93309DE1099E64920056E581 /* DeleteSelectionCommand.h in Headers */,
+				A7C9ABF91357A3BF00F5503F /* DetailsMarkerControl.h in Headers */,
 				31FB1A57120A5D0600DC02A0 /* DeviceMotionClient.h in Headers */,
 				31FB1A59120A5D0600DC02A0 /* DeviceMotionController.h in Headers */,
 				31FB1A5B120A5D0600DC02A0 /* DeviceMotionData.h in Headers */,
@@ -20854,6 +21057,7 @@
 				1CA19E160DC255CA0065A994 /* EventLoop.h in Headers */,
 				939885C408B7E3D100E707C4 /* EventNames.h in Headers */,
 				8F67561B1288B17B0047ACA3 /* EventQueue.h in Headers */,
+				22777B4B134A018C008EA455 /* EventsCollector.h in Headers */,
 				E0FEF372B17C53EAC1C1FBEE /* EventSource.h in Headers */,
 				E12EDB7B0B308A78002704B6 /* EventTarget.h in Headers */,
 				BC60D8F30D2A11E000B9918F /* ExceptionBase.h in Headers */,
@@ -20911,7 +21115,7 @@
 				08C9251A0FCC7C4A00480DEC /* FilterEffect.h in Headers */,
 				372C00D9129619F8005C9575 /* FindOptions.h in Headers */,
 				A8CFF04F0A154F09000A4234 /* FixedTableLayout.h in Headers */,
-				89878566122CA064003AABDA /* Flags.h in Headers */,
+				89878566122CA064003AABDA /* WebKitFlags.h in Headers */,
 				49EECDE610503C2400099FAB /* Float32Array.h in Headers */,
 				BC073BAA0C399B1F000F5979 /* FloatConversion.h in Headers */,
 				B27535690B053814002CE64F /* FloatPoint.h in Headers */,
@@ -21023,6 +21227,7 @@
 				93F199E508245E59001E9ABC /* HTMLCanvasElement.h in Headers */,
 				A8DF3FD0097FA0FC0052981B /* HTMLCollection.h in Headers */,
 				977B3865122883E900B81FF8 /* HTMLConstructionSite.h in Headers */,
+				E1A31663134BCAE8007C9A4F /* HTMLConverter.h in Headers */,
 				BC77CDBC0FEFF1420070887B /* HTMLDataGridCellElement.h in Headers */,
 				BC77CB870FEBF5AF0070887B /* HTMLDataGridColElement.h in Headers */,
 				BC212A1F0FE8333200EC3708 /* HTMLDataGridElement.h in Headers */,
@@ -21160,7 +21365,8 @@
 				8AB4BC77126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h in Headers */,
 				B27535700B053814002CE64F /* Image.h in Headers */,
 				B2A10B920B3818BD00099AA4 /* ImageBuffer.h in Headers */,
-				BCA979171215D055005C485C /* ImageBufferData.h in Headers */,
+				22BD9F7F1353625C009BD102 /* ImageBufferData.h in Headers */,
+				22BD9F81135364FE009BD102 /* ImageBufferDataCG.h in Headers */,
 				A779791A0D6B9D0C003851B9 /* ImageData.h in Headers */,
 				97205AB61239291000B17380 /* ImageDocument.h in Headers */,
 				F55B3DC21251F12D003EF269 /* ImageInputType.h in Headers */,
@@ -21202,9 +21408,11 @@
 				7A24587C1021EAF4000A00AA /* InspectorDOMAgent.h in Headers */,
 				7A74ECBB101839A600BF939E /* InspectorDOMStorageAgent.h in Headers */,
 				41F061740F5F00AC00A07EAC /* InspectorDOMStorageResource.h in Headers */,
+				227777601345DEA9008EA455 /* InspectorFrontendChannel.h in Headers */,
 				F344C7141125B82C00F26EEE /* InspectorFrontendClient.h in Headers */,
 				F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */,
 				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
+				22777B4F134A01A8008EA455 /* InspectorFrontendProxy.h in Headers */,
 				20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */,
 				4F6FDD651341DEDD001F8EE3 /* InspectorPageAgent.h in Headers */,
 				9F0D6B2F121BFEBA006C0288 /* InspectorProfilerAgent.h in Headers */,
@@ -21232,6 +21440,7 @@
 				598D77E31325420E00761B22 /* JavaFieldJSC.h in Headers */,
 				59A9E7B21104759400DFB4C1 /* JavaInstanceJSC.h in Headers */,
 				593D3EAF1325328C0057E7EE /* JavaMethod.h in Headers */,
+				599C671E1343439400C3423C /* JavaMethodJobject.h in Headers */,
 				E16982681134680700894115 /* JavaRuntimeObject.h in Headers */,
 				FD31603612B0267600C1A359 /* JavaScriptAudioNode.h in Headers */,
 				1C81BA0A0E97348300266E07 /* JavaScriptCallFrame.h in Headers */,
@@ -21267,7 +21476,6 @@
 				BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */,
 				51721FD311D27EF200638B42 /* JSBeforeProcessEvent.h in Headers */,
 				2E2D99CE10E2BBDA00496337 /* JSBlob.h in Headers */,
-				89CD029411C85B870070B791 /* JSBlobBuilder.h in Headers */,
 				1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */,
 				65DF323A09D1DE65000BE325 /* JSCanvasGradient.h in Headers */,
 				65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */,
@@ -21374,7 +21582,7 @@
 				898785B3122CA2A7003AABDA /* JSFileSystemCallback.h in Headers */,
 				46DA844E1224A0710060D006 /* JSFileWriter.h in Headers */,
 				893C47BC1238A0A9002B3D86 /* JSFileWriterCallback.h in Headers */,
-				898785B5122CA2A7003AABDA /* JSFlags.h in Headers */,
+				898785B5122CA2A7003AABDA /* JSWebKitFlags.h in Headers */,
 				49EECF03105070C400099FAB /* JSFloat32Array.h in Headers */,
 				FE80DA640E9C4703000D6F75 /* JSGeolocation.h in Headers */,
 				FE80DA660E9C4703000D6F75 /* JSGeoposition.h in Headers */,
@@ -21501,6 +21709,9 @@
 				65DF31FC09D1CC60000BE325 /* JSMutationEvent.h in Headers */,
 				BCD9C2C10C17B69E005C90A2 /* JSNamedNodeMap.h in Headers */,
 				A9D247F80D757E3400FDF959 /* JSNavigator.h in Headers */,
+				B1E545E013462B0B0092A545 /* JSNavigatorUserMediaError.h in Headers */,
+				B1E545E213462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.h in Headers */,
+				B1E545E413462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.h in Headers */,
 				BC9439C3116CF4940048C750 /* JSNodeCustom.h in Headers */,
 				14115B7309F84CD600CA4FC1 /* JSNodeFilter.h in Headers */,
 				BCB773620C17853D00132BA4 /* JSNodeFilterCondition.h in Headers */,
@@ -21512,6 +21723,8 @@
 				9001788112E0370700648462 /* JSOESStandardDerivatives.h in Headers */,
 				6EBF0E7712A9868800DB1709 /* JSOESTextureFloat.h in Headers */,
 				77A17AA712F28B2A004E02F6 /* JSOESVertexArrayObject.h in Headers */,
+				FDF6BAF9134A4C9800822920 /* JSOfflineAudioCompletionEvent.h in Headers */,
+				FDF6BAF9134A4C9800822920 /* JSOfflineAudioCompletionEvent.h in Headers */,
 				A826E8AE0A1A8F2300CD1BB6 /* JSOptionConstructor.h in Headers */,
 				1A0D57410A5C7867007EDD4C /* JSOverflowEvent.h in Headers */,
 				E1284BB110449FFA00EAEB52 /* JSPageTransitionEvent.h in Headers */,
@@ -21548,6 +21761,9 @@
 				B58CEB6D1191361C002A6790 /* JSSQLTransactionSync.h in Headers */,
 				B55D5AA4119131FC00BCC315 /* JSSQLTransactionSyncCallback.h in Headers */,
 				51E0BAEB0DA55D4A00A9E417 /* JSStorageEvent.h in Headers */,
+				892CF20C134C8BB300AAEDA1 /* JSStorageInfo.h in Headers */,
+				892CF20E134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.h in Headers */,
+				892CF212134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.h in Headers */,
 				0FF5026A102BA9430066F39A /* JSStyleMedia.h in Headers */,
 				BCE0139B0C0BEF180043860A /* JSStyleSheet.h in Headers */,
 				A84EBD830CB8C97700079609 /* JSStyleSheetList.h in Headers */,
@@ -21711,6 +21927,7 @@
 				3194616313020B20004BB3F8 /* JSWebKitAnimation.h in Headers */,
 				31C0FF3E0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.h in Headers */,
 				319461FF13022BB8004BB3F8 /* JSWebKitAnimationList.h in Headers */,
+				89CD029411C85B870070B791 /* JSWebKitBlobBuilder.h in Headers */,
 				316FE0720E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.h in Headers */,
 				316FE0740E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.h in Headers */,
 				498391400F1E767500C23782 /* JSWebKitCSSMatrix.h in Headers */,
@@ -21751,6 +21968,10 @@
 				BCE65BEB0EACDF16007E4533 /* Length.h in Headers */,
 				BCFF64910EAD15C200C1D6F7 /* LengthBox.h in Headers */,
 				BCFF64920EAD15C200C1D6F7 /* LengthSize.h in Headers */,
+				8CADF2A9135C7B36009EF43F /* LevelDBComparator.h in Headers */,
+				8CADF2AB135C7B36009EF43F /* LevelDBDatabase.h in Headers */,
+				8CADF2AD135C7B36009EF43F /* LevelDBIterator.h in Headers */,
+				8CADF2AE135C7B36009EF43F /* LevelDBSlice.h in Headers */,
 				84730D911248F0B300D3A9C9 /* LightSource.h in Headers */,
 				B22279650D00BF220071B782 /* LinearGradientAttributes.h in Headers */,
 				AB31C91E10AE1B8E000C7B92 /* LineClampValue.h in Headers */,
@@ -21786,8 +22007,9 @@
 				49D5DC2C0F423A73008F20FD /* Matrix3DTransformOperation.h in Headers */,
 				49E911C70EF86D47009D0CAF /* MatrixTransformOperation.h in Headers */,
 				931BCC611124DFCB00BE70DD /* MediaCanStartListener.h in Headers */,
-				ABFE7E130D32FAF60066F4D2 /* MediaControlElements.h in Headers */,
-				4157AF8012F1FB0400A8C6F5 /* MediaControls.h in Headers */,
+				417253AB1354BBBC00360F2A /* MediaControlElements.h in Headers */,
+				4157AF8012F1FB0400A8C6F5 /* MediaControlRootElement.h in Headers */,
+				1F3C3BEB135CAF3C00B8C1AC /* MediaControls.h in Headers */,
 				97205AB81239291000B17380 /* MediaDocument.h in Headers */,
 				E44613AD0CD6331000FADA75 /* MediaError.h in Headers */,
 				4E1959220A39DABA00220FE5 /* MediaFeatureNames.h in Headers */,
@@ -21812,6 +22034,7 @@
 				41BF700C0FE86F49005E8DEC /* MessagePortChannel.h in Headers */,
 				89878569122CA064003AABDA /* Metadata.h in Headers */,
 				8987856A122CA064003AABDA /* MetadataCallback.h in Headers */,
+				A78E52701346BD1700AD9C31 /* MeterShadowElement.h in Headers */,
 				BC772C4F0C4EB3040083285F /* MIMETypeRegistry.h in Headers */,
 				C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */,
 				F55B3DC61251F12D003EF269 /* MonthInputType.h in Headers */,
@@ -21827,6 +22050,9 @@
 				979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */,
 				A9C6E5A60D746458006442E9 /* Navigator.h in Headers */,
 				E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */,
+				B1E54599134629C10092A545 /* NavigatorUserMediaError.h in Headers */,
+				B1E5459B134629C10092A545 /* NavigatorUserMediaErrorCallback.h in Headers */,
+				B1E5459D134629C10092A545 /* NavigatorUserMediaSuccessCallback.h in Headers */,
 				8A309C9F123950BE00CB9204 /* NestingLevelIncrementer.h in Headers */,
 				656D37430ADBA5DE00A4554D /* NetscapePlugInStreamLoader.h in Headers */,
 				628D214C12131ED10055DCFC /* NetworkingContext.h in Headers */,
@@ -21865,6 +22091,10 @@
 				9001774112E0347800648462 /* OESStandardDerivatives.h in Headers */,
 				6EBF0E4912A8926100DB1709 /* OESTextureFloat.h in Headers */,
 				77A17A7212F28182004E02F6 /* OESVertexArrayObject.h in Headers */,
+				FDA3E95A134A49EF008D4B5A /* OfflineAudioCompletionEvent.h in Headers */,
+				FDA3E95A134A49EF008D4B5A /* OfflineAudioCompletionEvent.h in Headers */,
+				FDA3E95C134A49EF008D4B5A /* OfflineAudioDestinationNode.h in Headers */,
+				FDA3E95C134A49EF008D4B5A /* OfflineAudioDestinationNode.h in Headers */,
 				F4EAF4AF10C742B1009100D3 /* OpenTypeSanitizer.h in Headers */,
 				087281560F26B9B600AFC596 /* OptionElement.h in Headers */,
 				087281580F26B9B600AFC596 /* OptionGroupElement.h in Headers */,
@@ -21876,8 +22106,10 @@
 				3774ABA50FA21EB400AD7DE9 /* OverlapTestRequestClient.h in Headers */,
 				65A21468097A329100B9050A /* Page.h in Headers */,
 				1477E7770BF4134A00152872 /* PageCache.h in Headers */,
+				F34742DD134362F000531BC2 /* PageDebuggerAgent.h in Headers */,
 				9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */,
 				7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */,
+				F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */,
 				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
 				51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */,
 				0885067F11DA045B00182B98 /* PaintInfo.h in Headers */,
@@ -21940,8 +22172,8 @@
 				FE80D7D10E9C1F25000D6F75 /* PositionOptions.h in Headers */,
 				B71FE6DF11091CB300DAEF77 /* PrintContext.h in Headers */,
 				A8EA7EBC0A1945D000A8EF5F /* ProcessingInstruction.h in Headers */,
-				A7FE819C12FA677700850C1E /* ProgressBarValueElement.h in Headers */,
 				E44613EC0CD681B500FADA75 /* ProgressEvent.h in Headers */,
+				A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */,
 				1A2A68240B5BEDE70002A480 /* ProgressTracker.h in Headers */,
 				514C76750CE923A1007EF3CD /* ProtectionSpace.h in Headers */,
 				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
@@ -21991,7 +22223,6 @@
 				BCEA4876097D93020094C9E4 /* RenderImage.h in Headers */,
 				08F2F00A1213E61700DCEC48 /* RenderImageResource.h in Headers */,
 				08641D4812142F7D008DE9F6 /* RenderImageResourceStyleImage.h in Headers */,
-				A7AA66D711C5ED6A001D8C8C /* RenderIndicator.h in Headers */,
 				BCEA4878097D93020094C9E4 /* RenderInline.h in Headers */,
 				750D029411D0E7F300BD1B27 /* RenderInputSpeech.h in Headers */,
 				BCEA487A097D93020094C9E4 /* RenderLayer.h in Headers */,
@@ -22115,7 +22346,7 @@
 				1A569D210D7E2B82007C3983 /* runtime_method.h in Headers */,
 				1A569D230D7E2B82007C3983 /* runtime_object.h in Headers */,
 				1A569D250D7E2B82007C3983 /* runtime_root.h in Headers */,
-				447D69030FA626810015CCB1 /* RuntimeApplicationChecks.h in Headers */,
+				293EAE1F1356B2FE0067ACF9 /* RuntimeApplicationChecks.h in Headers */,
 				8C6EA61A11EF7E0400FD8EE3 /* RuntimeEnabledFeatures.h in Headers */,
 				49E911CB0EF86D47009D0CAF /* ScaleTransformOperation.h in Headers */,
 				5DFE8F570D16477C0076E937 /* ScheduledAction.h in Headers */,
@@ -22180,6 +22411,7 @@
 				0F3DD45012F5EA1B000D9190 /* ShadowBlur.h in Headers */,
 				BC5EB8C40E82031B00B25965 /* ShadowData.h in Headers */,
 				A7F338A411C0EFCA00A320A7 /* ShadowElement.h in Headers */,
+				A6D169641346B4C1000EB770 /* ShadowRoot.h in Headers */,
 				A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */,
 				B2AFFC940D00A5DF0030074D /* ShapeArabic.h in Headers */,
 				1A4A954E0B4EDCCB002D8C3C /* SharedBuffer.h in Headers */,
@@ -22216,6 +22448,7 @@
 				75415B0012958D5E003AD669 /* SpeechInputResultList.h in Headers */,
 				A78FE13C12366B1000ACE8D0 /* SpellChecker.h in Headers */,
 				B8DBDB4E130B0F8A00F5CDB1 /* SpellingCorrectionCommand.h in Headers */,
+				A7005CCD1330C4BA000CC0BA /* SpellingCorrectionController.h in Headers */,
 				93309E12099E64920056E581 /* SplitElementCommand.h in Headers */,
 				93309E14099E64920056E581 /* SplitTextNodeCommand.h in Headers */,
 				93309E16099E64920056E581 /* SplitTextNodeContainingElementCommand.h in Headers */,
@@ -22250,6 +22483,14 @@
 				C5102ECF0FD9EF8C00FAFF04 /* StorageAreaSync.h in Headers */,
 				51E0BABB0DA5547100A9E417 /* StorageEvent.h in Headers */,
 				C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */,
+				892CF1ED134C655500AAEDA1 /* StorageInfo.h in Headers */,
+				892CF1ED134C655500AAEDA1 /* StorageInfo.h in Headers */,
+				892CF192134C620D00AAEDA1 /* StorageInfoErrorCallback.h in Headers */,
+				892CF192134C620D00AAEDA1 /* StorageInfoErrorCallback.h in Headers */,
+				892CF193134C620D00AAEDA1 /* StorageInfoQuotaCallback.h in Headers */,
+				892CF193134C620D00AAEDA1 /* StorageInfoQuotaCallback.h in Headers */,
+				892CF194134C620D00AAEDA1 /* StorageInfoUsageCallback.h in Headers */,
+				892CF194134C620D00AAEDA1 /* StorageInfoUsageCallback.h in Headers */,
 				51E0BB380DA5ACB600A9E417 /* StorageMap.h in Headers */,
 				C50D0E830FF4272900AC2644 /* StorageNamespace.h in Headers */,
 				C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */,
@@ -22259,6 +22500,7 @@
 				81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */,
 				65488D6B0DD5A83D009D83B2 /* StringSourceProvider.h in Headers */,
 				B23540F30D00782E002382FA /* StringTruncator.h in Headers */,
+				9B6C41531344949000085B62 /* StringWithDirection.h in Headers */,
 				849F77760EFEC6200090849D /* StrokeStyleApplier.h in Headers */,
 				BC5EB6A30E81DC4F00B25965 /* StyleBackgroundData.h in Headers */,
 				A80E73500A199C77007FB8C5 /* StyleBase.h in Headers */,
@@ -22572,6 +22814,7 @@
 				49E911D20EF86D47009D0CAF /* TranslateTransformOperation.h in Headers */,
 				854FE7370A2297BE0058D7AD /* Traversal.h in Headers */,
 				37FD4298118368460093C029 /* TreeDepthLimit.h in Headers */,
+				14D64B5D134A5B6B00E58FDA /* TreeScope.h in Headers */,
 				1419D2C50CEA6F6100FF507A /* TreeShared.h in Headers */,
 				854FE7390A2297BE0058D7AD /* TreeWalker.h in Headers */,
 				6E96BB1D11986EE2007D94CD /* TypedArrayBase.h in Headers */,
@@ -22582,6 +22825,7 @@
 				49EECDF510503C2400099FAB /* Uint16Array.h in Headers */,
 				49EECDF210503C2400099FAB /* Uint32Array.h in Headers */,
 				49EECDEF10503C2400099FAB /* Uint8Array.h in Headers */,
+				A863E2011343412000274926 /* UnicodeBidi.h in Headers */,
 				B2C3DA4D0D006C1D00EF6F26 /* UnicodeRange.h in Headers */,
 				E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */,
 				D086FE9809D53AAB005BC74D /* UnlinkCommand.h in Headers */,
@@ -22637,6 +22881,7 @@
 				319E69B313299BBD004AC91A /* WebKitAnimation.h in Headers */,
 				31C0FF220E4CEB6E007D6FE5 /* WebKitAnimationEvent.h in Headers */,
 				319E69B613299BBD004AC91A /* WebKitAnimationList.h in Headers */,
+				976D6C7C122B8A3D001FD1F7 /* WebKitBlobBuilder.h in Headers */,
 				31288E730E3005D6003619AE /* WebKitCSSKeyframeRule.h in Headers */,
 				31288E750E3005D6003619AE /* WebKitCSSKeyframesRule.h in Headers */,
 				498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */,
@@ -22645,6 +22890,7 @@
 				494BD7950F55C8EE00747828 /* WebKitPoint.h in Headers */,
 				31C0FF250E4CEB6E007D6FE5 /* WebKitTransitionEvent.h in Headers */,
 				0FCF332F0F2B9A25004B6795 /* WebLayer.h in Headers */,
+				E1A3162D134BC32D007C9A4F /* WebNSAttributedStringExtras.h in Headers */,
 				1CAF34810A6C405200ABE06E /* WebScriptObject.h in Headers */,
 				1A569D1B0D7E2B82007C3983 /* WebScriptObject.h in Headers */,
 				1CAF34830A6C405200ABE06E /* WebScriptObjectPrivate.h in Headers */,
@@ -22704,6 +22950,8 @@
 				2E4346460F546A8200B0F1BA /* Worker.h in Headers */,
 				2E4346490F546A8200B0F1BA /* WorkerContext.h in Headers */,
 				2E43464B0F546A8200B0F1BA /* WorkerContextProxy.h in Headers */,
+				F34742E11343631F00531BC2 /* WorkerDebuggerAgent.h in Headers */,
+				F36E07A51358A8BE00AACBC9 /* WorkerInspectorController.h in Headers */,
 				18F831B80FD48C7800D8C56B /* WorkerLoaderProxy.h in Headers */,
 				2E43464D0F546A8200B0F1BA /* WorkerLocation.h in Headers */,
 				2E4346500F546A8200B0F1BA /* WorkerMessagingProxy.h in Headers */,
@@ -22712,6 +22960,7 @@
 				416E29A6102FA962007FC14E /* WorkerReportingProxy.h in Headers */,
 				2E4346530F546A8200B0F1BA /* WorkerRunLoop.h in Headers */,
 				E1A643F20EC0972500779668 /* WorkerScriptController.h in Headers */,
+				F34742E91343635000531BC2 /* WorkerScriptDebugServer.h in Headers */,
 				A7D6B3490F61104500B79FD1 /* WorkerScriptLoader.h in Headers */,
 				2EA768040FE7126400AB9C8A /* WorkerScriptLoaderClient.h in Headers */,
 				2E4346550F546A8200B0F1BA /* WorkerThread.h in Headers */,
@@ -22754,12 +23003,6 @@
 				93F199ED08245E59001E9ABC /* XSLTProcessor.h in Headers */,
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSFilter.h in Headers */,
-				BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */,
-				599C671E1343439400C3423C /* JavaMethodJobject.h in Headers */,
-				F34742DD134362F000531BC2 /* PageDebuggerAgent.h in Headers */,
-				F34742E11343631F00531BC2 /* WorkerDebuggerAgent.h in Headers */,
-				F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */,
-				F34742E91343635000531BC2 /* WorkerScriptDebugServer.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -22896,16 +23139,18 @@
 			);
 			inputPaths = (
 				"$(TARGET_BUILD_DIR)/$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/inspector",
-				"$(SRCROOT)/combine-javascript-resources",
+				"$(SRCROOT)/inspector/combine-javascript-resources.pl",
+				"$(SRCROOT)/inspector/inline-javascript-imports.py",
 			);
 			name = "Streamline Inspector Source";
 			outputPaths = (
 				"$(DERIVED_FILE_DIR)/WebCore/inspector.html",
 				"$(DERIVED_FILE_DIR)/WebCore/inspector.js",
+				"$(DERIVED_FILE_DIR)/WebCore/scriptFormatterWorker.js",
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "# Don't do anything for Debug builds, so the Inspector is easier to debug.\nif [[ ${CONFIGURATION:=Debug} == \"Debug\" ]]; then\n    exit\nfi\n\n# Combine all script resources in the inspector.html file.\n\"$SRCROOT/combine-javascript-resources\" --input-html \"${SRCROOT}/inspector/front-end/inspector.html\" --generated-scripts-dir ${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore --output-dir \"${DERIVED_FILE_DIR}/WebCore\" --output-script-name inspector.js\n\nif [ -d \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector\" ]; then\n    # Remove any JavaScript files, since they will be replaced with the combined file.\n    cd \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector\"\n    rm *.js\n\n    # Copy the modified HTML file and the combined script.\n    cp \"${DERIVED_FILE_DIR}/WebCore/inspector.html\" inspector.html\n    cp \"${DERIVED_FILE_DIR}/WebCore/inspector.js\" inspector.js\nfi\n";
+			shellScript = "# Don't do anything for Debug builds, so the Inspector is easier to debug.\nif [[ ${CONFIGURATION:=Debug} == \"Debug\" ]]; then\n    exit\nfi\n\n# Combine all script resources in the inspector.html file.\n\"$SRCROOT/inspector/combine-javascript-resources.pl\" --input-html \"${SRCROOT}/inspector/front-end/inspector.html\" --generated-scripts-dir ${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore --output-dir \"${DERIVED_FILE_DIR}/WebCore\" --output-script-name inspector.js\n\n# Inline script imports in ScriptFormatterWorker.js file.\n\"$SRCROOT/inspector/inline-javascript-imports.py\" \"${SRCROOT}/inspector/front-end/ScriptFormatterWorker.js\" \"${SRCROOT}/inspector/front-end\" \"${DERIVED_FILE_DIR}/WebCore/scriptFormatterWorker.js\"\n\nif [ -d \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector\" ]; then\n    # Remove any JavaScript files, since they will be replaced with the combined file.\n    cd \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector\"\n    rm *.js\n\n    # Copy the modified HTML file and the combined scripts.\n    cp \"${DERIVED_FILE_DIR}/WebCore/inspector.html\" inspector.html\n    cp \"${DERIVED_FILE_DIR}/WebCore/inspector.js\" inspector.js\n    cp \"${DERIVED_FILE_DIR}/WebCore/scriptFormatterWorker.js\" scriptFormatterWorker.js\nfi\n";
 		};
 		1C81BA330E97357C00266E07 /* Copy Inspector Resources */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -23144,7 +23389,6 @@
 				FD31602612B0267600C1A359 /* BiquadProcessor.cpp in Sources */,
 				A89943290B42338800D7C802 /* BitmapImage.cpp in Sources */,
 				976D6C78122B8A3D001FD1F7 /* Blob.cpp in Sources */,
-				976D6C7B122B8A3D001FD1F7 /* BlobBuilder.cpp in Sources */,
 				2EDEF1F3121B0EFC00726DB2 /* BlobData.cpp in Sources */,
 				2EDEF1F6121B0EFC00726DB2 /* BlobRegistryImpl.cpp in Sources */,
 				2EB4BCD2121F03E300EC4885 /* BlobResourceHandle.cpp in Sources */,
@@ -23170,6 +23414,7 @@
 				D0D141B212B2BF5200E39620 /* CachedResourceRequest.cpp in Sources */,
 				BCB16C230979C3BD00467741 /* CachedScript.cpp in Sources */,
 				BCB16C270979C3BD00467741 /* CachedXSLStyleSheet.cpp in Sources */,
+				B1827493134CA4C100B98C2D /* CallbackFunction.cpp in Sources */,
 				6E4E91AC10F7FB3100A2779C /* CanvasContextAttributes.cpp in Sources */,
 				49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */,
 				49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */,
@@ -23303,6 +23548,9 @@
 				A8C228A211D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp in Sources */,
 				4162A450101145AE00DFF3ED /* DedicatedWorkerContext.cpp in Sources */,
 				41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */,
+				FD06DFA5134A4DEF006F5D7D /* DefaultAudioDestinationNode.cpp in Sources */,
+				FD06DFA5134A4DEF006F5D7D /* DefaultAudioDestinationNode.cpp in Sources */,
+				BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */,
 				4167EBF5102962BA003D252A /* DefaultSharedWorkerRepository.cpp in Sources */,
 				FD31602B12B0267600C1A359 /* DelayDSPKernel.cpp in Sources */,
 				FD31602D12B0267600C1A359 /* DelayNode.cpp in Sources */,
@@ -23311,6 +23559,7 @@
 				1CE83AC30ADAFFD7009354F6 /* DeleteButtonController.cpp in Sources */,
 				93309DDE099E64920056E581 /* DeleteFromTextNodeCommand.cpp in Sources */,
 				93309DE0099E64920056E581 /* DeleteSelectionCommand.cpp in Sources */,
+				A7C9ABF81357A3BF00F5503F /* DetailsMarkerControl.cpp in Sources */,
 				31FB1A58120A5D0600DC02A0 /* DeviceMotionController.cpp in Sources */,
 				31FB1A5A120A5D0600DC02A0 /* DeviceMotionData.cpp in Sources */,
 				31FB1A5C120A5D0600DC02A0 /* DeviceMotionEvent.cpp in Sources */,
@@ -23673,6 +23922,7 @@
 				1CA19E050DC255950065A994 /* EventLoopMac.mm in Sources */,
 				939885C308B7E3D100E707C4 /* EventNames.cpp in Sources */,
 				8F67561C1288B17B0047ACA3 /* EventQueue.cpp in Sources */,
+				22777B4A134A018C008EA455 /* EventsCollector.cpp in Sources */,
 				E0FEF372B27C53EAC1C1FBEE /* EventSource.cpp in Sources */,
 				E12EDBEA0B308E0B002704B6 /* EventTarget.cpp in Sources */,
 				BC60D8F20D2A11E000B9918F /* ExceptionBase.cpp in Sources */,
@@ -23942,6 +24192,7 @@
 				1A71D57B0F33819000F9CE4E /* IdentifierRep.cpp in Sources */,
 				B275356F0B053814002CE64F /* Image.cpp in Sources */,
 				B2A10B940B3818D700099AA4 /* ImageBufferCG.cpp in Sources */,
+				2292B27C1356669400CF11EF /* ImageBufferDataCG.cpp in Sources */,
 				B275355E0B053814002CE64F /* ImageCG.cpp in Sources */,
 				A77979190D6B9D0C003851B9 /* ImageData.cpp in Sources */,
 				97205AB51239291000B17380 /* ImageDocument.cpp in Sources */,
@@ -23984,6 +24235,7 @@
 				4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */,
 				F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */,
 				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
+				22777B4E134A01A8008EA455 /* InspectorFrontendProxy.cpp in Sources */,
 				20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */,
 				4F6FDD641341DEDD001F8EE3 /* InspectorPageAgent.cpp in Sources */,
 				9F0D6B2E121BFEBA006C0288 /* InspectorProfilerAgent.cpp in Sources */,
@@ -24008,6 +24260,7 @@
 				59E560A91105336F00AA1258 /* JavaClassJSC.cpp in Sources */,
 				598D77E11325420400761B22 /* JavaFieldJSC.cpp in Sources */,
 				59A9E7B01104758800DFB4C1 /* JavaInstanceJSC.cpp in Sources */,
+				599C671C1343438900C3423C /* JavaMethodJobject.cpp in Sources */,
 				E1698264113467F300894115 /* JavaRuntimeObject.cpp in Sources */,
 				FD31603512B0267600C1A359 /* JavaScriptAudioNode.cpp in Sources */,
 				1C81BA090E97348300266E07 /* JavaScriptCallFrame.cpp in Sources */,
@@ -24045,7 +24298,6 @@
 				BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */,
 				51721FD211D27EF200638B42 /* JSBeforeProcessEvent.cpp in Sources */,
 				2E2D99CD10E2BBDA00496337 /* JSBlob.cpp in Sources */,
-				89CD029311C85B870070B791 /* JSBlobBuilder.cpp in Sources */,
 				1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */,
 				65DF323909D1DE65000BE325 /* JSCanvasGradient.cpp in Sources */,
 				65DF323B09D1DE65000BE325 /* JSCanvasPattern.cpp in Sources */,
@@ -24192,7 +24444,7 @@
 				898785B2122CA2A7003AABDA /* JSFileSystemCallback.cpp in Sources */,
 				46DA844D1224A0710060D006 /* JSFileWriter.cpp in Sources */,
 				893C47BB1238A0A9002B3D86 /* JSFileWriterCallback.cpp in Sources */,
-				898785B4122CA2A7003AABDA /* JSFlags.cpp in Sources */,
+				898785B4122CA2A7003AABDA /* JSWebKitFlags.cpp in Sources */,
 				49EECF02105070C400099FAB /* JSFloat32Array.cpp in Sources */,
 				49EECF7910508D9C00099FAB /* JSFloat32ArrayCustom.cpp in Sources */,
 				FE80DA630E9C4703000D6F75 /* JSGeolocation.cpp in Sources */,
@@ -24353,6 +24605,9 @@
 				BCD9C2630C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp in Sources */,
 				A9D247F70D757E3400FDF959 /* JSNavigator.cpp in Sources */,
 				A9C6E6490D7465D8006442E9 /* JSNavigatorCustom.cpp in Sources */,
+				B1E545DF13462B0B0092A545 /* JSNavigatorUserMediaError.cpp in Sources */,
+				B1E545E113462B0B0092A545 /* JSNavigatorUserMediaErrorCallback.cpp in Sources */,
+				B1E545E313462B0B0092A545 /* JSNavigatorUserMediaSuccessCallback.cpp in Sources */,
 				14DC0D3709FED073007B0235 /* JSNode.cpp in Sources */,
 				BCD9C2640C17AA67005C90A2 /* JSNodeCustom.cpp in Sources */,
 				14115B7209F84CD600CA4FC1 /* JSNodeFilter.cpp in Sources */,
@@ -24368,6 +24623,8 @@
 				9001788012E0370700648462 /* JSOESStandardDerivatives.cpp in Sources */,
 				6EBF0E7612A9868800DB1709 /* JSOESTextureFloat.cpp in Sources */,
 				77A17AA612F28B2A004E02F6 /* JSOESVertexArrayObject.cpp in Sources */,
+				FDF6BAF8134A4C9800822920 /* JSOfflineAudioCompletionEvent.cpp in Sources */,
+				FDF6BAF8134A4C9800822920 /* JSOfflineAudioCompletionEvent.cpp in Sources */,
 				A826EC480A1B0CBE00CD1BB6 /* JSOptionConstructor.cpp in Sources */,
 				1A0D57400A5C7867007EDD4C /* JSOverflowEvent.cpp in Sources */,
 				E1284BB210449FFA00EAEB52 /* JSPageTransitionEvent.cpp in Sources */,
@@ -24412,6 +24669,9 @@
 				51E3F9D60DA05E1D00250911 /* JSStorage.cpp in Sources */,
 				51D0C5160DAA90B7003B3831 /* JSStorageCustom.cpp in Sources */,
 				51E0BAEA0DA55D4A00A9E417 /* JSStorageEvent.cpp in Sources */,
+				892CF20B134C8BB300AAEDA1 /* JSStorageInfo.cpp in Sources */,
+				892CF20D134C8BB300AAEDA1 /* JSStorageInfoErrorCallback.cpp in Sources */,
+				892CF211134C8BB300AAEDA1 /* JSStorageInfoUsageCallback.cpp in Sources */,
 				0FF50269102BA9430066F39A /* JSStyleMedia.cpp in Sources */,
 				BCE0139A0C0BEF180043860A /* JSStyleSheet.cpp in Sources */,
 				BC98A27D0C0C9950004BEBF7 /* JSStyleSheetCustom.cpp in Sources */,
@@ -24588,6 +24848,7 @@
 				31C0FF3D0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.cpp in Sources */,
 				319461FE13022BB8004BB3F8 /* JSWebKitAnimationList.cpp in Sources */,
 				3194623213022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp in Sources */,
+				89CD029311C85B870070B791 /* JSWebKitBlobBuilder.cpp in Sources */,
 				316FE0710E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.cpp in Sources */,
 				E1AD14C51297354900ACA989 /* JSWebKitCSSKeyframeRuleCustom.cpp in Sources */,
 				316FE0730E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.cpp in Sources */,
@@ -24640,6 +24901,8 @@
 				512DD8F40D91E6AF000F89EE /* LegacyWebArchive.cpp in Sources */,
 				51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */,
 				BCE65BEA0EACDF16007E4533 /* Length.cpp in Sources */,
+				8CADF2AA135C7B36009EF43F /* LevelDBDatabase.cpp in Sources */,
+				8CADF2AC135C7B36009EF43F /* LevelDBIterator.cpp in Sources */,
 				84730D901248F0B300D3A9C9 /* LightSource.cpp in Sources */,
 				89B5EAA111E8003D00F2367E /* LineEnding.cpp in Sources */,
 				A7AD2F870EC89D07008AB002 /* LinkHash.cpp in Sources */,
@@ -24671,8 +24934,9 @@
 				FA654A6B1108ABED002615E0 /* MathMLTextElement.cpp in Sources */,
 				49D5DC2B0F423A73008F20FD /* Matrix3DTransformOperation.cpp in Sources */,
 				49E911C60EF86D47009D0CAF /* MatrixTransformOperation.cpp in Sources */,
-				ABFE7E120D32FAF60066F4D2 /* MediaControlElements.cpp in Sources */,
-				4157AF8112F1FB0400A8C6F5 /* MediaControls.cpp in Sources */,
+				417253AA1354BBBC00360F2A /* MediaControlElements.cpp in Sources */,
+				4157AF8112F1FB0400A8C6F5 /* MediaControlRootElement.cpp in Sources */,
+				1F3C3BEA135CAF3C00B8C1AC /* MediaControls.cpp in Sources */,
 				97205AB71239291000B17380 /* MediaDocument.cpp in Sources */,
 				4E1959210A39DABA00220FE5 /* MediaFeatureNames.cpp in Sources */,
 				A8EA80090A19516E00A8EF5F /* MediaList.cpp in Sources */,
@@ -24693,6 +24957,7 @@
 				75793E830D0CE0B3007FC0AC /* MessageEvent.cpp in Sources */,
 				E1ADECC00E76ACF1004A1A5E /* MessagePort.cpp in Sources */,
 				41BF700B0FE86F49005E8DEC /* MessagePortChannel.cpp in Sources */,
+				A78E526F1346BD1700AD9C31 /* MeterShadowElement.cpp in Sources */,
 				BC772C4E0C4EB3040083285F /* MIMETypeRegistry.cpp in Sources */,
 				BC772C5E0C4EB3440083285F /* MIMETypeRegistryMac.mm in Sources */,
 				C6D74AE409AA290A000B0A52 /* ModifySelectionListLevel.cpp in Sources */,
@@ -24733,6 +24998,10 @@
 				9001774012E0347800648462 /* OESStandardDerivatives.cpp in Sources */,
 				6EBF0E4812A8926100DB1709 /* OESTextureFloat.cpp in Sources */,
 				77A17A7112F28182004E02F6 /* OESVertexArrayObject.cpp in Sources */,
+				FDA3E959134A49EF008D4B5A /* OfflineAudioCompletionEvent.cpp in Sources */,
+				FDA3E959134A49EF008D4B5A /* OfflineAudioCompletionEvent.cpp in Sources */,
+				FDA3E95B134A49EF008D4B5A /* OfflineAudioDestinationNode.cpp in Sources */,
+				FDA3E95B134A49EF008D4B5A /* OfflineAudioDestinationNode.cpp in Sources */,
 				F4EAF4AE10C742B1009100D3 /* OpenTypeSanitizer.cpp in Sources */,
 				087281550F26B9B600AFC596 /* OptionElement.cpp in Sources */,
 				087281570F26B9B600AFC596 /* OptionGroupElement.cpp in Sources */,
@@ -24742,9 +25011,11 @@
 				1A0D57360A5C77FE007EDD4C /* OverflowEvent.cpp in Sources */,
 				65FEA86909833ADE00BED4AB /* Page.cpp in Sources */,
 				1477E7760BF4134A00152872 /* PageCache.cpp in Sources */,
+				F34742DC134362F000531BC2 /* PageDebuggerAgent.cpp in Sources */,
 				9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */,
 				7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */,
 				1C26497C0D7E24EC00BD10F2 /* PageMac.cpp in Sources */,
+				F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */,
 				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
 				51E1ECC20C91C90400DC255B /* PageURLRecord.cpp in Sources */,
 				FD3160A212B026F700C1A359 /* Panner.cpp in Sources */,
@@ -24785,6 +25056,7 @@
 				B776D43D1104527500BEB0EC /* PrintContext.cpp in Sources */,
 				A8EA7EBD0A1945D000A8EF5F /* ProcessingInstruction.cpp in Sources */,
 				E44613EB0CD681B400FADA75 /* ProgressEvent.cpp in Sources */,
+				A715E652134BBBEC00D8E713 /* ProgressShadowElement.cpp in Sources */,
 				1A2A68230B5BEDE70002A480 /* ProgressTracker.cpp in Sources */,
 				514C76740CE923A1007EF3CD /* ProtectionSpace.cpp in Sources */,
 				1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */,
@@ -24829,7 +25101,6 @@
 				BCEA4875097D93020094C9E4 /* RenderImage.cpp in Sources */,
 				08F2F0091213E61700DCEC48 /* RenderImageResource.cpp in Sources */,
 				08641D4712142F7D008DE9F6 /* RenderImageResourceStyleImage.cpp in Sources */,
-				A7AA66D611C5ED6A001D8C8C /* RenderIndicator.cpp in Sources */,
 				BCEA4877097D93020094C9E4 /* RenderInline.cpp in Sources */,
 				750D029311D0E7F300BD1B27 /* RenderInputSpeech.cpp in Sources */,
 				BCEA4879097D93020094C9E4 /* RenderLayer.cpp in Sources */,
@@ -24923,7 +25194,7 @@
 				1A569D200D7E2B82007C3983 /* runtime_method.cpp in Sources */,
 				1A569D220D7E2B82007C3983 /* runtime_object.cpp in Sources */,
 				1A569D240D7E2B82007C3983 /* runtime_root.cpp in Sources */,
-				447D69040FA626810015CCB1 /* RuntimeApplicationChecks.mm in Sources */,
+				293EAE211356B32E0067ACF9 /* RuntimeApplicationChecks.cpp in Sources */,
 				8C6EA61911EF7E0400FD8EE3 /* RuntimeEnabledFeatures.cpp in Sources */,
 				49E911CA0EF86D47009D0CAF /* ScaleTransformOperation.cpp in Sources */,
 				5DFE8F560D16477B0076E937 /* ScheduledAction.cpp in Sources */,
@@ -24980,6 +25251,7 @@
 				0F3DD44F12F5EA1B000D9190 /* ShadowBlur.cpp in Sources */,
 				BC5EB8C30E82031B00B25965 /* ShadowData.cpp in Sources */,
 				A7F338A311C0EFCA00A320A7 /* ShadowElement.cpp in Sources */,
+				A6D169621346B49B000EB770 /* ShadowRoot.cpp in Sources */,
 				A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */,
 				B2AFFC930D00A5DF0030074D /* ShapeArabic.c in Sources */,
 				1A4A954D0B4EDCCB002D8C3C /* SharedBuffer.cpp in Sources */,
@@ -25017,6 +25289,7 @@
 				75415C29129A9920003AD669 /* SpeechInputResultList.cpp in Sources */,
 				A78FE13B12366B1000ACE8D0 /* SpellChecker.cpp in Sources */,
 				B8DBDB4D130B0F8A00F5CDB1 /* SpellingCorrectionCommand.cpp in Sources */,
+				A7005CCC1330C4BA000CC0BA /* SpellingCorrectionController.cpp in Sources */,
 				93309E11099E64920056E581 /* SplitElementCommand.cpp in Sources */,
 				93309E13099E64920056E581 /* SplitTextNodeCommand.cpp in Sources */,
 				93309E15099E64920056E581 /* SplitTextNodeContainingElementCommand.cpp in Sources */,
@@ -25044,6 +25317,7 @@
 				C5102ED00FD9EF8C00FAFF04 /* StorageAreaSync.cpp in Sources */,
 				51E0BABC0DA5547100A9E417 /* StorageEvent.cpp in Sources */,
 				C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */,
+				892CF1EC134C655500AAEDA1 /* StorageInfo.cpp in Sources */,
 				51E0BB390DA5ACB600A9E417 /* StorageMap.cpp in Sources */,
 				C50D0E820FF4272900AC2644 /* StorageNamespace.cpp in Sources */,
 				C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */,
@@ -25278,6 +25552,7 @@
 				0F500AB10F54DB3100EEF928 /* TransformState.cpp in Sources */,
 				49E911D10EF86D47009D0CAF /* TranslateTransformOperation.cpp in Sources */,
 				854FE7360A2297BE0058D7AD /* Traversal.cpp in Sources */,
+				14D64B5C134A5B6B00E58FDA /* TreeScope.cpp in Sources */,
 				854FE7380A2297BE0058D7AD /* TreeWalker.cpp in Sources */,
 				93309E19099E64920056E581 /* TypingCommand.cpp in Sources */,
 				85031B4D0A44EFC700F992E0 /* UIEvent.cpp in Sources */,
@@ -25325,6 +25600,7 @@
 				319E69B213299BBD004AC91A /* WebKitAnimation.cpp in Sources */,
 				31C0FF210E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp in Sources */,
 				319E69B513299BBD004AC91A /* WebKitAnimationList.cpp in Sources */,
+				976D6C7B122B8A3D001FD1F7 /* WebKitBlobBuilder.cpp in Sources */,
 				31288E720E3005D6003619AE /* WebKitCSSKeyframeRule.cpp in Sources */,
 				31288E740E3005D6003619AE /* WebKitCSSKeyframesRule.cpp in Sources */,
 				498391580F1E776900C23782 /* WebKitCSSMatrix.cpp in Sources */,
@@ -25332,6 +25608,7 @@
 				93F1D5BA12D532C400832BEC /* WebKitLoseContext.cpp in Sources */,
 				31C0FF240E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp in Sources */,
 				0FCF332E0F2B9A25004B6795 /* WebLayer.mm in Sources */,
+				E1A3162E134BC32D007C9A4F /* WebNSAttributedStringExtras.mm in Sources */,
 				1CAF34820A6C405200ABE06E /* WebScriptObject.mm in Sources */,
 				518A34C11026C831001B6896 /* WebSocket.cpp in Sources */,
 				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
@@ -25388,11 +25665,14 @@
 				379919961200DDF400EA041C /* WOFFFileFormat.cpp in Sources */,
 				2E4346450F546A8200B0F1BA /* Worker.cpp in Sources */,
 				2E4346480F546A8200B0F1BA /* WorkerContext.cpp in Sources */,
+				F34742E01343631F00531BC2 /* WorkerDebuggerAgent.cpp in Sources */,
+				F36E07A41358A8BE00AACBC9 /* WorkerInspectorController.cpp in Sources */,
 				2E43464C0F546A8200B0F1BA /* WorkerLocation.cpp in Sources */,
 				2E43464F0F546A8200B0F1BA /* WorkerMessagingProxy.cpp in Sources */,
 				E1271A140EEEC80400F61213 /* WorkerNavigator.cpp in Sources */,
 				2E4346520F546A8200B0F1BA /* WorkerRunLoop.cpp in Sources */,
 				E1A643FD0EC097A000779668 /* WorkerScriptController.cpp in Sources */,
+				F34742E81343635000531BC2 /* WorkerScriptDebugServer.cpp in Sources */,
 				A7D6B34A0F61104500B79FD1 /* WorkerScriptLoader.cpp in Sources */,
 				2E4346540F546A8200B0F1BA /* WorkerThread.cpp in Sources */,
 				0B9056F80F2685F30095FF6A /* WorkerThreadableLoader.cpp in Sources */,
@@ -25432,12 +25712,6 @@
 				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSFilter.cpp in Sources */,
-				BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */,
-				599C671C1343438900C3423C /* JavaMethodJobject.cpp in Sources */,
-				F34742DC134362F000531BC2 /* PageDebuggerAgent.cpp in Sources */,
-				F34742E01343631F00531BC2 /* WorkerDebuggerAgent.cpp in Sources */,
-				F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */,
-				F34742E81343635000531BC2 /* WorkerScriptDebugServer.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/accessibility/AXObjectCache.h b/Source/WebCore/accessibility/AXObjectCache.h
index 4805a7f..95cc7f3 100644
--- a/Source/WebCore/accessibility/AXObjectCache.h
+++ b/Source/WebCore/accessibility/AXObjectCache.h
@@ -118,6 +118,7 @@ public:
 
     enum AXNotification {
         AXActiveDescendantChanged,
+        AXAutocorrectionOccured,
         AXCheckedStateChanged,
         AXChildrenChanged,
         AXFocusedUIElementChanged,
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp b/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
index d51750a..5f9444a 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -75,7 +75,14 @@ void AccessibilityARIAGrid::addChild(AccessibilityObject* child, HashSet<Accessi
     
     row->setRowIndex((int)m_rows.size());        
     m_rows.append(row);
-    m_children.append(row);
+
+    // Try adding the row if it's not ignoring accessibility,
+    // otherwise add its children (the cells) as the grid's children.
+    if (!row->accessibilityIsIgnored())
+        m_children.append(row);
+    else
+        m_children.append(row->children());
+
     appendedRows.add(row);
 }
     
@@ -99,17 +106,21 @@ void AccessibilityARIAGrid::addChildren()
     unsigned columnCount = 0;
     for (RefPtr<AccessibilityObject> child = firstChild(); child; child = child->nextSibling()) {
 
-        // in case the render tree doesn't match the expected ARIA hierarchy, look at the children
-        if (child->accessibilityIsIgnored()) {
+        if (child->isTableRow() || child->ariaRoleAttribute() == RowRole)
+            addChild(child.get(), appendedRows, columnCount);
+        else {
+            // in case the render tree doesn't match the expected ARIA hierarchy, look at the children
             if (!child->hasChildren())
                 child->addChildren();
-            
-            AccessibilityChildrenVector children = child->children();
-            unsigned length = children.size();
-            for (unsigned i = 0; i < length; ++i)
-                addChild(children[i].get(), appendedRows, columnCount);
-        } else
-            addChild(child.get(), appendedRows, columnCount);            
+
+            // Do not navigate children through the Accessibility
+            // children vector to let addChild() check the result
+            // of accessibilityIsIgnored() and make the proper
+            // decision (add the objects or their children).
+            AccessibilityObject* grandChild = 0;
+            for (grandChild = child->firstChild(); grandChild; grandChild = grandChild->nextSibling())
+                addChild(grandChild, appendedRows, columnCount);
+        }
     }
     
     // make the columns based on the number of columns in the first body
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp b/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp
index c8157f5..55d09ad 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp
+++ b/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp
@@ -30,6 +30,7 @@
 #include "AccessibilityARIAGridCell.h"
 
 #include "AccessibilityObject.h"
+#include "AccessibilityTable.h"
 #include "AccessibilityTableRow.h"
 
 using namespace std;
@@ -53,9 +54,15 @@ PassRefPtr<AccessibilityARIAGridCell> AccessibilityARIAGridCell::create(RenderOb
 AccessibilityObject* AccessibilityARIAGridCell::parentTable() const
 {
     AccessibilityObject* parent = parentObjectUnignored();
-    if (!parent || !parent->isTableRow())
+    if (!parent)
         return 0;
     
+    if (parent->isAccessibilityTable())
+        return parent;
+
+    // It could happen that we hadn't reached the parent table yet (in
+    // case objects for rows were not ignoring accessibility) so for
+    // that reason we need to run parentObjectUnignored once again.
     parent = parent->parentObjectUnignored();
     if (!parent || !parent->isAccessibilityTable())
         return 0;
@@ -66,20 +73,42 @@ AccessibilityObject* AccessibilityARIAGridCell::parentTable() const
 void AccessibilityARIAGridCell::rowIndexRange(pair<int, int>& rowRange)
 {
     AccessibilityObject* parent = parentObjectUnignored();
-    if (!parent || !parent->isTableRow())
+    if (!parent)
         return;
 
+    if (parent->isTableRow()) {
+        // We already got a table row, use its API.
+        rowRange.first = static_cast<AccessibilityTableRow*>(parent)->rowIndex();
+    } else if (parent->isAccessibilityTable()) {
+        // We reached the parent table, so we need to inspect its
+        // children to determine the row index for the cell in it.
+        unsigned columnCount = static_cast<AccessibilityTable*>(parent)->columnCount();
+        if (!columnCount)
+            return;
+
+        AccessibilityChildrenVector siblings = parent->children();
+        unsigned childrenSize = siblings.size();
+        for (unsigned k = 0; k < childrenSize; ++k) {
+            if (siblings[k].get() == this) {
+                rowRange.first = k / columnCount;
+                break;
+            }
+        }
+    }
+
     // as far as I can tell, grid cells cannot span rows
-    rowRange.first = static_cast<AccessibilityTableRow*>(parent)->rowIndex();
-    rowRange.second = 1;    
+    rowRange.second = 1;
 }
 
 void AccessibilityARIAGridCell::columnIndexRange(pair<int, int>& columnRange)
 {
     AccessibilityObject* parent = parentObjectUnignored();
-    if (!parent || !parent->isTableRow())
+    if (!parent)
         return;
-    
+
+    if (!parent->isTableRow() && !parent->isAccessibilityTable())
+        return;
+
     AccessibilityChildrenVector siblings = parent->children();
     unsigned childrenSize = siblings.size();
     for (unsigned k = 0; k < childrenSize; ++k) {
diff --git a/Source/WebCore/accessibility/AccessibilityMenuList.cpp b/Source/WebCore/accessibility/AccessibilityMenuList.cpp
index bde4cd4..e0c03c3 100644
--- a/Source/WebCore/accessibility/AccessibilityMenuList.cpp
+++ b/Source/WebCore/accessibility/AccessibilityMenuList.cpp
@@ -37,11 +37,6 @@ AccessibilityMenuList::AccessibilityMenuList(RenderMenuList* renderer)
 {
 }
 
-RenderMenuList* AccessibilityMenuList::renderer() const
-{
-    return toRenderMenuList(AccessibilityRenderObject::renderer());
-}
-
 bool AccessibilityMenuList::press() const
 {
     RenderMenuList* menuList = static_cast<RenderMenuList*>(m_renderer);
diff --git a/Source/WebCore/accessibility/AccessibilityMenuList.h b/Source/WebCore/accessibility/AccessibilityMenuList.h
index 4082f0a..cdb3ac2 100644
--- a/Source/WebCore/accessibility/AccessibilityMenuList.h
+++ b/Source/WebCore/accessibility/AccessibilityMenuList.h
@@ -42,8 +42,6 @@ public:
     virtual bool isCollapsed() const;
     virtual bool press() const;
 
-    RenderMenuList* renderer() const;
-
 private:
     AccessibilityMenuList(RenderMenuList*);
 
diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
index 10b5094..df95f6f 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
@@ -52,6 +52,8 @@
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
@@ -430,12 +432,7 @@ String AccessibilityObject::listMarkerTextForNodeAndPosition(Node* node, const V
     // Append text, plus the period that follows the text.
     // FIXME: Not all list marker styles are followed by a period, but this
     // sounds much better when there is a synthesized pause because of a period.
-    Vector<UChar> resultVector;
-    resultVector.append(markerText.characters(), markerText.length());
-    resultVector.append('.');
-    resultVector.append(' ');
-    
-    return String::adopt(resultVector);
+    return makeString(markerText, ". ");
 }
     
 String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange) const
@@ -443,7 +440,7 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     if (visiblePositionRange.isNull())
         return String();
 
-    Vector<UChar> resultVector;
+    StringBuilder builder;
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
@@ -451,9 +448,9 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
             // Add a textual representation for list marker text
             String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
             if (!listMarkerText.isEmpty())
-                resultVector.append(listMarkerText.characters(), listMarkerText.length());
-                
-            resultVector.append(it.characters(), it.length());
+                builder.append(listMarkerText);
+
+            builder.append(it.characters(), it.length());
         } else {
             // locate the node and starting offset for this replaced range
             int exception = 0;
@@ -462,11 +459,11 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
             int offset = it.range()->startOffset(exception);
 
             if (replacedNodeNeedsCharacter(node->childNode(offset)))
-                resultVector.append(objectReplacementCharacter);
+                builder.append(objectReplacementCharacter);
         }
     }
 
-    return String::adopt(resultVector);
+    return builder.toString();
 }
 
 int AccessibilityObject::lengthForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange) const
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 2d27e39..953863f 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -353,6 +353,7 @@ public:
     virtual void setAccessibleName(String&) { }
     
     virtual Node* node() const { return 0; }
+    virtual RenderObject* renderer() const { return 0; }
     virtual bool accessibilityIsIgnored() const  { return true; }
 
     virtual int headingLevel() const { return 0; }
@@ -404,6 +405,7 @@ public:
     virtual void linkedUIElements(AccessibilityChildrenVector&) const { }
     virtual AccessibilityObject* titleUIElement() const { return 0; }
     virtual bool exposesTitleUIElement() const { return true; }
+    virtual AccessibilityObject* correspondingLabelForControlElement() const { return 0; }
     virtual AccessibilityObject* correspondingControlForLabelElement() const { return 0; }
     virtual AccessibilityObject* scrollBar(AccessibilityOrientation) const { return 0; }
     
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index 9b54a69..2236f83 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -77,6 +77,7 @@
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/unicode/CharacterNames.h>
 
 using namespace std;
@@ -661,7 +662,7 @@ bool AccessibilityRenderObject::isReadOnly() const
             return true;
         
         HTMLElement* body = document->body();
-        if (body && body->rendererIsEditable())
+        if (body && body->isContentEditable())
             return false;
 
         return !document->rendererIsEditable();
@@ -1010,6 +1011,19 @@ unsigned AccessibilityRenderObject::hierarchicalLevel() const
     return level;
 }
 
+static TextIteratorBehavior textIteratorBehaviorForTextRange()
+{
+    TextIteratorBehavior behavior = TextIteratorIgnoresStyleVisibility;
+
+#if PLATFORM(GTK)
+    // We need to emit replaced elements for GTK, and present
+    // them with the 'object replacement character' (0xFFFC).
+    behavior = static_cast<TextIteratorBehavior>(behavior | TextIteratorEmitsObjectReplacementCharacters);
+#endif
+
+    return behavior;
+}
+
 String AccessibilityRenderObject::textUnderElement() const
 {
     if (!m_renderer)
@@ -1024,7 +1038,8 @@ String AccessibilityRenderObject::textUnderElement() const
             // catch stale WebCoreAXObject (see <rdar://problem/3960196>)
             if (frame->document() != node->document())
                 return String();
-            return plainText(rangeOfContents(node).get(), TextIteratorIgnoresStyleVisibility);
+
+            return plainText(rangeOfContents(node).get(), textIteratorBehaviorForTextRange());
         }
     }
     
@@ -1138,8 +1153,9 @@ String AccessibilityRenderObject::stringValue() const
         VisiblePosition endVisiblePosition = m_renderer->positionForCoordinates(INT_MAX, INT_MAX);
         if (startVisiblePosition.isNull() || endVisiblePosition.isNull())
             return String();
-        
-        return plainText(makeRange(startVisiblePosition, endVisiblePosition).get(), TextIteratorIgnoresStyleVisibility);
+
+        return plainText(makeRange(startVisiblePosition, endVisiblePosition).get(),
+                         textIteratorBehaviorForTextRange());
     }
     
     if (isTextControl())
@@ -1176,25 +1192,21 @@ static String accessibleNameForNode(Node* node)
 
 String AccessibilityRenderObject::accessibilityDescriptionForElements(Vector<Element*> &elements) const
 {
-    Vector<UChar> ariaLabel;
+    StringBuilder builder;
     unsigned size = elements.size();
     for (unsigned i = 0; i < size; ++i) {
         Element* idElement = elements[i];
-        
-        String nameFragment = accessibleNameForNode(idElement);
-        ariaLabel.append(nameFragment.characters(), nameFragment.length());
-        for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
-            nameFragment = accessibleNameForNode(n);
-            ariaLabel.append(nameFragment.characters(), nameFragment.length());
-        }
-            
+
+        builder.append(accessibleNameForNode(idElement));
+        for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement))
+            builder.append(accessibleNameForNode(n));
+
         if (i != size - 1)
-            ariaLabel.append(' ');
+            builder.append(' ');
     }
-    return String::adopt(ariaLabel);
+    return builder.toString();
 }
 
-    
 void AccessibilityRenderObject::elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& attribute) const
 {
     Node* node = m_renderer->node();
@@ -2495,7 +2507,14 @@ int AccessibilityRenderObject::indexForVisiblePosition(const VisiblePosition& po
     RefPtr<Range> range = Range::create(m_renderer->document());
     range->setStart(node, 0, ec);
     range->setEnd(indexPosition.anchorNode(), indexPosition.deprecatedEditingOffset(), ec);
+
+#if PLATFORM(GTK)
+    // We need to consider replaced elements for GTK, as they will be
+    // presented with the 'object replacement character' (0xFFFC).
+    return TextIterator::rangeLength(range.get(), true);
+#else
     return TextIterator::rangeLength(range.get());
+#endif
 }
 
 IntRect AccessibilityRenderObject::boundsForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange) const
@@ -2955,18 +2974,25 @@ AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
     
     if (role)
         return role;
+
+    AccessibilityObject* parentObject = parentObjectUnignored();
+    if (!parentObject)
+        return UnknownRole;
+
+    AccessibilityRole parentAriaRole = parentObject->ariaRoleAttribute();
+
     // selects and listboxes both have options as child roles, but they map to different roles within WebCore
     if (equalIgnoringCase(ariaRole, "option")) {
-        if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
+        if (parentAriaRole == MenuRole)
             return MenuItemRole;
-        if (parentObjectUnignored()->ariaRoleAttribute() == ListBoxRole)
+        if (parentAriaRole == ListBoxRole)
             return ListBoxOptionRole;
     }
     // an aria "menuitem" may map to MenuButton or MenuItem depending on its parent
     if (equalIgnoringCase(ariaRole, "menuitem")) {
-        if (parentObjectUnignored()->ariaRoleAttribute() == GroupRole)
+        if (parentAriaRole == GroupRole)
             return MenuButtonRole;
-        if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
+        if (parentAriaRole == MenuRole || parentAriaRole == MenuBarRole)
             return MenuItemRole;
     }
     
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.h b/Source/WebCore/accessibility/AccessibilityRenderObject.h
index 3a29fe9..ccd33d5 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.h
@@ -161,7 +161,7 @@ public:
     virtual IntPoint clickPoint() const;
     
     void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
-    RenderObject* renderer() const { return m_renderer; }
+    virtual RenderObject* renderer() const { return m_renderer; }
     RenderBoxModelObject* renderBoxModelObject() const;
     virtual Node* node() const;
 
diff --git a/Source/WebCore/accessibility/AccessibilitySlider.cpp b/Source/WebCore/accessibility/AccessibilitySlider.cpp
index d4433a2..01d185d 100644
--- a/Source/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/Source/WebCore/accessibility/AccessibilitySlider.cpp
@@ -89,9 +89,17 @@ void AccessibilitySlider::addChildren()
     
     m_haveChildren = true;
 
-    AccessibilitySliderThumb* thumb = static_cast<AccessibilitySliderThumb*>(m_renderer->document()->axObjectCache()->getOrCreate(SliderThumbRole));
+    AXObjectCache* cache = m_renderer->document()->axObjectCache();
+
+    AccessibilitySliderThumb* thumb = static_cast<AccessibilitySliderThumb*>(cache->getOrCreate(SliderThumbRole));
     thumb->setParentObject(this);
-    m_children.append(thumb);
+
+    // Before actually adding the value indicator to the hierarchy,
+    // allow the platform to make a final decision about it.
+    if (thumb->accessibilityIsIgnored())
+        cache->remove(thumb->axObjectID());
+    else
+        m_children.append(thumb);
 }
 
 const AtomicString& AccessibilitySlider::getAttribute(const QualifiedName& attribute) const
@@ -181,4 +189,15 @@ IntSize AccessibilitySliderThumb::size() const
     return elementRect().size();
 }
 
+bool AccessibilitySliderThumb::accessibilityIsIgnored() const
+{
+    AccessibilityObjectInclusion decision = accessibilityPlatformIncludesObject();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+
+    return false;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/accessibility/AccessibilitySlider.h b/Source/WebCore/accessibility/AccessibilitySlider.h
index 406c3ab..80a988b 100644
--- a/Source/WebCore/accessibility/AccessibilitySlider.h
+++ b/Source/WebCore/accessibility/AccessibilitySlider.h
@@ -80,9 +80,10 @@ public:
     virtual IntSize size() const;
     virtual IntRect elementRect() const;
 
+    virtual bool accessibilityIsIgnored() const;
+
 private:
     AccessibilitySliderThumb();
-    virtual bool accessibilityIsIgnored() const { return false; }
 
     AccessibilitySlider* m_parentSlider;
 };
diff --git a/Source/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp b/Source/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
index 0dddc17..b79fd0c 100644
--- a/Source/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
+++ b/Source/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
@@ -76,6 +76,7 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
         // descendant and send the AXFocusedUIElementChanged notification.
         handleFocusedUIElementChanged(0, obj->document()->focusedNode()->renderer());
         break;
+    case AXAutocorrectionOccured:
     case AXCheckedStateChanged:
     case AXChildrenChanged:
     case AXFocusedUIElementChanged:
diff --git a/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp b/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index f910ca6..0e720c2 100644
--- a/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -22,7 +22,6 @@
 
 #include "AccessibilityObject.h"
 #include "AccessibilityObjectWrapperAtk.h"
-#include "AccessibilityRenderObject.h"
 #include "GOwnPtr.h"
 #include "Range.h"
 #include "SelectElement.h"
@@ -157,7 +156,7 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, AX
     }
 }
 
-static void emitTextChanged(AccessibilityRenderObject* object, AXObjectCache::AXTextChange textChange, unsigned offset, unsigned count)
+static void emitTextChanged(AccessibilityObject* object, AXObjectCache::AXTextChange textChange, unsigned offset, unsigned count)
 {
     // Get the axObject for the parent object
     AtkObject* wrapper = object->parentObjectUnignored()->wrapper();
@@ -187,7 +186,7 @@ void AXObjectCache::nodeTextChangePlatformNotification(AccessibilityObject* obje
 
     Node* node = object->node();
     RefPtr<Range> range = Range::create(node->document(),  Position(node->parentNode(), 0), Position(node, 0));
-    emitTextChanged(toAccessibilityRenderObject(object), textChange, offset + TextIterator::rangeLength(range.get()), count);
+    emitTextChanged(object, textChange, offset + TextIterator::rangeLength(range.get()), count);
 }
 
 void AXObjectCache::handleFocusedUIElementChanged(RenderObject* oldFocusedRender, RenderObject* newFocusedRender)
diff --git a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
index 850bcbe..a9fd54b 100644
--- a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
@@ -40,9 +40,14 @@ AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesO
     if (!parent)
         return DefaultBehavior;
 
-    if (roleValue() == SplitterRole)
+    AccessibilityRole role = roleValue();
+    if (role == SplitterRole)
         return IncludeObject;
 
+    // We expose the slider as a whole but not its value indicator.
+    if (role == SliderThumbRole)
+        return IgnoreObject;
+
     // When a list item is made up entirely of children (e.g. paragraphs)
     // the list item gets ignored. We need it.
     if (isGroup() && parent->isList())
@@ -52,8 +57,6 @@ AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesO
     if (parent->isPasswordField() || parent->isTextControl())
         return IgnoreObject;
 
-    AccessibilityRole role = roleValue();
-
     // Include all tables, even layout tables. The AT can decide what to do with each.
     if (role == CellRole || role == TableRole)
         return IncludeObject;
diff --git a/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 7dff2e3..566356c 100644
--- a/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -37,11 +37,11 @@
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
-#include "AccessibilityRenderObject.h"
 #include "AccessibilityTable.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableRow.h"
+#include "CharacterNames.h"
 #include "Document.h"
 #include "DocumentType.h"
 #include "Editor.h"
@@ -63,6 +63,7 @@
 #include "TextEncoding.h"
 #include "TextIterator.h"
 #include "WebKitAccessibleHyperlink.h"
+#include "htmlediting.h"
 #include "visible_units.h"
 
 #include <atk/atk.h>
@@ -171,9 +172,8 @@ static const gchar* webkit_accessible_get_name(AtkObject* object)
     if (!coreObject->isAccessibilityRenderObject())
         return returnString(coreObject->stringValue());
 
-    AccessibilityRenderObject* renderObject = static_cast<AccessibilityRenderObject*>(coreObject);
     if (coreObject->isControl()) {
-        AccessibilityObject* label = renderObject->correspondingLabelForControlElement();
+        AccessibilityObject* label = coreObject->correspondingLabelForControlElement();
         if (label) {
             AtkObject* atkObject = label->wrapper();
             if (ATK_IS_TEXT(atkObject))
@@ -181,13 +181,13 @@ static const gchar* webkit_accessible_get_name(AtkObject* object)
         }
 
         // Try text under the node.
-        String textUnder = renderObject->textUnderElement();
+        String textUnder = coreObject->textUnderElement();
         if (textUnder.length())
             return returnString(textUnder);
     }
 
-    if (renderObject->isImage() || renderObject->isInputImage()) {
-        Node* node = renderObject->renderer()->node();
+    if (coreObject->isImage() || coreObject->isInputImage()) {
+        Node* node = coreObject->node();
         if (node && node->isHTMLElement()) {
             // Get the attribute rather than altText String so as not to fall back on title.
             String alt = toHTMLElement(node)->getAttribute(HTMLNames::altAttr);
@@ -197,7 +197,7 @@ static const gchar* webkit_accessible_get_name(AtkObject* object)
     }
 
     // Fallback for the webArea object: just return the document's title.
-    if (renderObject->isWebArea()) {
+    if (coreObject->isWebArea()) {
         Document* document = coreObject->document();
         if (document)
             return returnString(document->title());
@@ -211,7 +211,7 @@ static const gchar* webkit_accessible_get_description(AtkObject* object)
     AccessibilityObject* coreObject = core(object);
     Node* node = 0;
     if (coreObject->isAccessibilityRenderObject())
-        node = static_cast<AccessibilityRenderObject*>(coreObject)->renderer()->node();
+        node = coreObject->node();
     if (!node || !node->isHTMLElement() || coreObject->ariaRoleAttribute() != UnknownRole)
         return returnString(coreObject->accessibilityDescription());
 
@@ -233,13 +233,12 @@ static const gchar* webkit_accessible_get_description(AtkObject* object)
 
 static void setAtkRelationSetFromCoreObject(AccessibilityObject* coreObject, AtkRelationSet* relationSet)
 {
-    AccessibilityRenderObject* accObject = static_cast<AccessibilityRenderObject*>(coreObject);
-    if (accObject->isControl()) {
-        AccessibilityObject* label = accObject->correspondingLabelForControlElement();
+    if (coreObject->isControl()) {
+        AccessibilityObject* label = coreObject->correspondingLabelForControlElement();
         if (label)
             atk_relation_set_add_relation_by_type(relationSet, ATK_RELATION_LABELLED_BY, label->wrapper());
     } else {
-        AccessibilityObject* control = accObject->correspondingControlForLabelElement();
+        AccessibilityObject* control = coreObject->correspondingControlForLabelElement();
         if (control)
             atk_relation_set_add_relation_by_type(relationSet, ATK_RELATION_LABEL_FOR, control->wrapper());
     }
@@ -270,7 +269,11 @@ static AtkObject* atkParentOfRootObject(AtkObject* object)
     // impossible for assistive technologies to ascend the accessible
     // hierarchy all the way to the application. (Bug 30489)
     if (!coreParent && isRootObject(coreObject)) {
-        HostWindow* hostWindow = coreObject->document()->view()->hostWindow();
+        Document* document = coreObject->document();
+        if (!document)
+            return 0;
+
+        HostWindow* hostWindow = document->view()->hostWindow();
         if (hostWindow) {
             PlatformPageClient scrollView = hostWindow->platformPageClient();
             if (scrollView) {
@@ -455,6 +458,8 @@ static AtkRole atkRole(AccessibilityRole role)
     case GroupRole:
     case RadioGroupRole:
         return ATK_ROLE_PANEL;
+    case RowHeaderRole: // Row headers are cells after all.
+    case ColumnHeaderRole: // Column headers are cells after all.
     case CellRole:
         return ATK_ROLE_TABLE_CELL;
     case LinkRole:
@@ -823,7 +828,7 @@ static AccessibilityObject* optionFromList(AtkSelection* selection, gint i)
     if (!listObject)
         return 0;
 
-    AccessibilityRenderObject::AccessibilityChildrenVector options = listObject->children();
+    AccessibilityObject::AccessibilityChildrenVector options = listObject->children();
     if (i < static_cast<gint>(options.size()))
         return options.at(i).get();
 
@@ -838,11 +843,11 @@ static AccessibilityObject* optionFromSelection(AtkSelection* selection, gint i)
     if (!coreSelection || !coreSelection->isAccessibilityRenderObject() || i < 0)
         return 0;
 
-    AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+    AccessibilityObject::AccessibilityChildrenVector selectedItems;
     if (coreSelection->isListBox())
         coreSelection->selectedChildren(selectedItems);
     else if (coreSelection->isMenuList()) {
-        RenderObject* renderer = toAccessibilityRenderObject(coreSelection)->renderer();
+        RenderObject* renderer = coreSelection->renderer();
         if (!renderer)
             return 0;
 
@@ -883,7 +888,7 @@ static gboolean webkit_accessible_selection_clear_selection(AtkSelection* select
     if (!coreSelection)
         return false;
 
-    AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+    AccessibilityObject::AccessibilityChildrenVector selectedItems;
     if (coreSelection->isListBox() || coreSelection->isMenuList()) {
         // Set the list of selected items to an empty list; then verify that it worked.
         AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(coreSelection);
@@ -913,13 +918,13 @@ static gint webkit_accessible_selection_get_selection_count(AtkSelection* select
         return 0;
 
     if (coreSelection->isListBox()) {
-        AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+        AccessibilityObject::AccessibilityChildrenVector selectedItems;
         coreSelection->selectedChildren(selectedItems);
         return static_cast<gint>(selectedItems.size());
     }
 
     if (coreSelection->isMenuList()) {
-        RenderObject* renderer = toAccessibilityRenderObject(coreSelection)->renderer();
+        RenderObject* renderer = coreSelection->renderer();
         if (!renderer)
             return 0;
 
@@ -968,11 +973,11 @@ static gboolean webkit_accessible_selection_select_all_selection(AtkSelection* s
     if (!coreSelection || !coreSelection->isMultiSelectable())
         return false;
 
-    AccessibilityRenderObject::AccessibilityChildrenVector children = coreSelection->children();
+    AccessibilityObject::AccessibilityChildrenVector children = coreSelection->children();
     if (coreSelection->isListBox()) {
         AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(coreSelection);
         listBox->setSelectedChildren(children);
-        AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+        AccessibilityObject::AccessibilityChildrenVector selectedItems;
         listBox->selectedChildren(selectedItems);
         return selectedItems.size() == children.size();
     }
@@ -1054,6 +1059,9 @@ gchar* textForRenderer(RenderObject* renderer)
         if (object->isText())
             renderText = toRenderText(object);
         else {
+            if (object->isReplaced())
+                g_string_append_unichar(resultText, objectReplacementCharacter);
+
             // We need to check children, if any, to consider when
             // current object is not a text object but some of its
             // children are, in order not to miss those portions of
@@ -1064,7 +1072,7 @@ gchar* textForRenderer(RenderObject* renderer)
             continue;
         }
 
-        InlineTextBox* box = renderText->firstTextBox();
+        InlineTextBox* box = renderText ? renderText->firstTextBox() : 0;
         while (box) {
             gchar* text = convertUniCharToUTF8(renderText->characters(), renderText->textLength(), box->start(), box->end());
             g_string_append(resultText, text);
@@ -1089,26 +1097,26 @@ gchar* textForRenderer(RenderObject* renderer)
     return g_string_free(resultText, FALSE);
 }
 
-gchar* textForObject(AccessibilityRenderObject* accObject)
+gchar* textForObject(AccessibilityObject* coreObject)
 {
     GString* str = g_string_new(0);
 
     // For text controls, we can get the text line by line.
-    if (accObject->isTextControl()) {
-        unsigned textLength = accObject->textLength();
+    if (coreObject->isTextControl()) {
+        unsigned textLength = coreObject->textLength();
         int lineNumber = 0;
-        PlainTextRange range = accObject->doAXRangeForLine(lineNumber);
+        PlainTextRange range = coreObject->doAXRangeForLine(lineNumber);
         while (range.length) {
             // When a line of text wraps in a text area, the final space is removed.
             if (range.start + range.length < textLength)
                 range.length -= 1;
-            String lineText = accObject->doAXStringForRange(range);
+            String lineText = coreObject->doAXStringForRange(range);
             g_string_append(str, lineText.utf8().data());
             g_string_append(str, "\n");
-            range = accObject->doAXRangeForLine(++lineNumber);
+            range = coreObject->doAXRangeForLine(++lineNumber);
         }
-    } else if (accObject->isAccessibilityRenderObject()) {
-        GOwnPtr<gchar> rendererText(textForRenderer(accObject->renderer()));
+    } else if (coreObject->isAccessibilityRenderObject()) {
+        GOwnPtr<gchar> rendererText(textForRenderer(coreObject->renderer()));
         g_string_append(str, rendererText.get());
     }
 
@@ -1137,14 +1145,14 @@ static gchar* webkit_accessible_text_get_text(AtkText* text, gint startOffset, g
 
     if (!ret.length()) {
         // This can happen at least with anonymous RenderBlocks (e.g. body text amongst paragraphs)
-        ret = String(textForObject(toAccessibilityRenderObject(coreObject)));
+        ret = String(textForObject(coreObject));
         if (!end)
             end = ret.length();
     }
 
     // Prefix a item number/bullet if needed
     if (coreObject->roleValue() == ListItemRole) {
-        RenderObject* objRenderer = static_cast<AccessibilityRenderObject*>(coreObject)->renderer();
+        RenderObject* objRenderer = coreObject->renderer();
         if (objRenderer && objRenderer->isListItem()) {
             String markerText = toRenderListItem(objRenderer)->markerTextWithSuffix();
             ret = objRenderer->style()->direction() == LTR ? markerText + ret : ret + markerText;
@@ -1173,19 +1181,19 @@ static PangoLayout* getPangoLayoutForAtk(AtkText* textObject)
 {
     AccessibilityObject* coreObject = core(textObject);
 
-    HostWindow* hostWindow = coreObject->document()->view()->hostWindow();
+    Document* document = coreObject->document();
+    if (!document)
+        return 0;
+
+    HostWindow* hostWindow = document->view()->hostWindow();
     if (!hostWindow)
         return 0;
     PlatformPageClient webView = hostWindow->platformPageClient();
     if (!webView)
         return 0;
 
-    AccessibilityRenderObject* accObject = static_cast<AccessibilityRenderObject*>(coreObject);
-    if (!accObject)
-        return 0;
-
     // Create a string with the layout as it appears on the screen
-    PangoLayout* layout = gtk_widget_create_pango_layout(static_cast<GtkWidget*>(webView), textForObject(accObject));
+    PangoLayout* layout = gtk_widget_create_pango_layout(static_cast<GtkWidget*>(webView), textForObject(coreObject));
     g_object_set_data_full(G_OBJECT(textObject), "webkit-accessible-pango-layout", layout, g_object_unref);
     return layout;
 }
@@ -1219,19 +1227,23 @@ static gint webkit_accessible_text_get_caret_offset(AtkText* text)
     if (!coreObject->isAccessibilityRenderObject())
         return 0;
 
+    Document* document = coreObject->document();
+    if (!document)
+        return 0;
+
     Node* focusedNode = coreObject->selection().end().deprecatedNode();
     if (!focusedNode)
         return 0;
 
     RenderObject* focusedRenderer = focusedNode->renderer();
-    AccessibilityObject* focusedObject = coreObject->document()->axObjectCache()->getOrCreate(focusedRenderer);
+    AccessibilityObject* focusedObject = document->axObjectCache()->getOrCreate(focusedRenderer);
 
     int offset;
     // Don't ignore links if the offset is being requested for a link.
     if (!objectAndOffsetUnignored(focusedObject, offset, !coreObject->isLink()))
         return 0;
 
-    RenderObject* renderer = toAccessibilityRenderObject(coreObject)->renderer();
+    RenderObject* renderer = coreObject->renderer();
     if (renderer && renderer->isListItem()) {
         String markerText = toRenderListItem(renderer)->markerTextWithSuffix();
 
@@ -1243,7 +1255,7 @@ static gint webkit_accessible_text_get_caret_offset(AtkText* text)
     return offset;
 }
 
-static int baselinePositionForAccessibilityRenderObject(RenderObject* renderObject)
+static int baselinePositionForRenderObject(RenderObject* renderObject)
 {
     // FIXME: This implementation of baselinePosition originates from RenderObject.cpp and was
     // removed in r70072. The implementation looks incorrect though, because this is not the
@@ -1257,7 +1269,7 @@ static AtkAttributeSet* getAttributeSetForAccessibilityObject(const Accessibilit
     if (!object->isAccessibilityRenderObject())
         return 0;
 
-    RenderObject* renderer = static_cast<const AccessibilityRenderObject*>(object)->renderer();
+    RenderObject* renderer = object->renderer();
     RenderStyle* style = renderer->style();
 
     AtkAttributeSet* result = 0;
@@ -1282,10 +1294,10 @@ static AtkAttributeSet* getAttributeSetForAccessibilityObject(const Accessibilit
     bool includeRise = true;
     switch (style->verticalAlign()) {
     case SUB:
-        baselinePosition = -1 * baselinePositionForAccessibilityRenderObject(renderer);
+        baselinePosition = -1 * baselinePositionForRenderObject(renderer);
         break;
     case SUPER:
-        baselinePosition = baselinePositionForAccessibilityRenderObject(renderer);
+        baselinePosition = baselinePositionForRenderObject(renderer);
         break;
     case BASELINE:
         baselinePosition = 0;
@@ -1348,6 +1360,8 @@ static AtkAttributeSet* getAttributeSetForAccessibilityObject(const Accessibilit
 
     switch (style->textAlign()) {
     case TAAUTO:
+    case TASTART:
+    case TAEND:
         break;
     case LEFT:
     case WEBKIT_LEFT:
@@ -1429,7 +1443,7 @@ static guint accessibilityObjectLength(const AccessibilityObject* object)
     // Technologies, we need to have a way to measure their length
     // for those cases when it's needed to take it into account
     // separately (as in getAccessibilityObjectForOffset)
-    RenderObject* renderer = static_cast<const AccessibilityRenderObject*>(object)->renderer();
+    RenderObject* renderer = object->renderer();
     if (renderer && renderer->isListMarker()) {
         RenderListMarker* marker = toRenderListMarker(renderer);
         return marker->text().length() + marker->suffix().length();
@@ -1540,7 +1554,8 @@ static IntRect textExtents(AtkText* text, gint startOffset, gint length, AtkCoor
     IntRect extents = coreObject->doAXBoundsForRange(PlainTextRange(startOffset, rangeLength));
     switch(coords) {
     case ATK_XY_SCREEN:
-        extents = coreObject->document()->view()->contentsToScreen(extents);
+        if (Document* document = coreObject->document())
+            extents = document->view()->contentsToScreen(extents);
         break;
     case ATK_XY_WINDOW:
         // No-op
@@ -1606,7 +1621,7 @@ static void getSelectionOffsetsForObject(AccessibilityObject* coreObject, Visibl
     // start position (it would belong to the node anyway).
     Node* firstLeafNode = node->firstDescendant();
     if (selRange->isPointInRange(firstLeafNode, 0, ec))
-        nodeRangeStart = firstPositionInNode(firstLeafNode);
+        nodeRangeStart = firstPositionInOrBeforeNode(firstLeafNode);
     else
         nodeRangeStart = selRange->startPosition();
 
@@ -1616,26 +1631,26 @@ static void getSelectionOffsetsForObject(AccessibilityObject* coreObject, Visibl
     // end position (it would belong to the node anyway).
     Node* lastLeafNode = node->lastDescendant();
     if (selRange->isPointInRange(lastLeafNode, lastOffsetInNode(lastLeafNode), ec))
-        nodeRangeEnd = lastPositionInNode(lastLeafNode);
+        nodeRangeEnd = lastPositionInOrAfterNode(lastLeafNode);
     else
         nodeRangeEnd = selRange->endPosition();
 
     // Calculate position of the selected range inside the object.
-    Position parentFirstPosition = firstPositionInNode(node);
+    Position parentFirstPosition = firstPositionInOrBeforeNode(node);
     RefPtr<Range> rangeInParent = Range::create(node->document(), parentFirstPosition, nodeRangeStart);
 
     // Set values for start and end offsets.
-    startOffset = TextIterator::rangeLength(rangeInParent.get());
+    startOffset = TextIterator::rangeLength(rangeInParent.get(), true);
 
     // We need to adjust the offsets for the list item marker.
-    RenderObject* renderer = toAccessibilityRenderObject(coreObject)->renderer();
+    RenderObject* renderer = coreObject->renderer();
     if (renderer && renderer->isListItem()) {
         String markerText = toRenderListItem(renderer)->markerTextWithSuffix();
         startOffset += markerText.length();
     }
 
     RefPtr<Range> nodeRange = Range::create(node->document(), nodeRangeStart, nodeRangeEnd);
-    endOffset = startOffset + TextIterator::rangeLength(nodeRange.get());
+    endOffset = startOffset + TextIterator::rangeLength(nodeRange.get(), true);
 }
 
 static gint webkit_accessible_text_get_n_selections(AtkText* text)
@@ -1702,7 +1717,7 @@ static gboolean webkit_accessible_text_set_selection(AtkText* text, gint selecti
         endOffset = textCount;
 
     // We need to adjust the offsets for the list item marker.
-    RenderObject* renderer = toAccessibilityRenderObject(coreObject)->renderer();
+    RenderObject* renderer = coreObject->renderer();
     if (renderer && renderer->isListItem()) {
         String markerText = toRenderListItem(renderer)->markerTextWithSuffix();
         int markerLength = markerText.length();
@@ -1745,7 +1760,7 @@ static gboolean webkit_accessible_text_set_caret_offset(AtkText* text, gint offs
     if (!coreObject->isAccessibilityRenderObject())
         return FALSE;
 
-    RenderObject* renderer = toAccessibilityRenderObject(coreObject)->renderer();
+    RenderObject* renderer = coreObject->renderer();
     if (renderer && renderer->isListItem()) {
         String markerText = toRenderListItem(renderer)->markerTextWithSuffix();
         int markerLength = markerText.length();
@@ -1812,12 +1827,14 @@ static void webkit_accessible_editable_text_insert_text(AtkEditableText* text, c
     //coreObject->setSelectedTextRange(PlainTextRange(*position, 0));
     //coreObject->setSelectedText(String::fromUTF8(string));
 
-    if (!coreObject->document() || !coreObject->document()->frame())
+    Document* document = coreObject->document();
+    if (!document || !document->frame())
         return;
+
     coreObject->setSelectedVisiblePositionRange(coreObject->visiblePositionRangeForRange(PlainTextRange(*position, 0)));
     coreObject->setFocused(true);
     // FIXME: We should set position to the actual inserted text length, which may be less than that requested.
-    if (coreObject->document()->frame()->editor()->insertTextWithoutSendingTextEvent(String::fromUTF8(string), false, 0))
+    if (document->frame()->editor()->insertTextWithoutSendingTextEvent(String::fromUTF8(string), false, 0))
         *position += length;
 }
 
@@ -1838,11 +1855,13 @@ static void webkit_accessible_editable_text_delete_text(AtkEditableText* text, g
     //coreObject->setSelectedTextRange(PlainTextRange(start_pos, end_pos - start_pos));
     //coreObject->setSelectedText(String());
 
-    if (!coreObject->document() || !coreObject->document()->frame())
+    Document* document = coreObject->document();
+    if (!document || !document->frame())
         return;
+
     coreObject->setSelectedVisiblePositionRange(coreObject->visiblePositionRangeForRange(PlainTextRange(start_pos, end_pos - start_pos)));
     coreObject->setFocused(true);
-    coreObject->document()->frame()->editor()->performDelete();
+    document->frame()->editor()->performDelete();
 }
 
 static void webkit_accessible_editable_text_paste_text(AtkEditableText* text, gint position)
@@ -2115,7 +2134,7 @@ static AtkObject* webkit_accessible_table_get_caption(AtkTable* table)
 {
     AccessibilityObject* accTable = core(table);
     if (accTable->isAccessibilityRenderObject()) {
-        Node* node = static_cast<AccessibilityRenderObject*>(accTable)->renderer()->node();
+        Node* node = accTable->node();
         if (node && node->hasTagName(HTMLNames::tableTag)) {
             HTMLTableCaptionElement* caption = static_cast<HTMLTableElement*>(node)->caption();
             if (caption)
@@ -2169,15 +2188,15 @@ static AtkHyperlink* webkitAccessibleHypertextGetLink(AtkHypertext* hypertext, g
     gint currentLink = -1;
     for (unsigned i = 0; i < children.size(); i++) {
         AccessibilityObject* coreChild = children.at(i).get();
-        if (!coreChild->accessibilityIsIgnored() && coreChild->isLink()) {
+        if (!coreChild->accessibilityIsIgnored()) {
+            AtkObject* axObject = coreChild->wrapper();
+            if (!axObject || !ATK_IS_HYPERLINK_IMPL(axObject))
+                continue;
+
             currentLink++;
             if (index != currentLink)
                 continue;
 
-            AtkObject* axObject = coreChild->wrapper();
-            if (!axObject || !ATK_IS_HYPERLINK_IMPL(axObject))
-                return 0;
-
             return atk_hyperlink_impl_get_hyperlink(ATK_HYPERLINK_IMPL(axObject));
         }
     }
@@ -2194,8 +2213,11 @@ static gint webkitAccessibleHypertextGetNLinks(AtkHypertext* hypertext)
     gint linksFound = 0;
     for (size_t i = 0; i < children.size(); i++) {
         AccessibilityObject* coreChild = children.at(i).get();
-        if (!coreChild->accessibilityIsIgnored() && coreChild->isLink())
-            linksFound++;
+        if (!coreChild->accessibilityIsIgnored()) {
+            AtkObject* axObject = coreChild->wrapper();
+            if (axObject && ATK_IS_HYPERLINK_IMPL(axObject))
+                linksFound++;
+        }
     }
 
     return linksFound;
@@ -2442,25 +2464,28 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
     // the WebKitAccessible class and let WebCore decide what to do.
     interfaceMask |= 1 << WAI_ACTION;
 
-    // Hyperlink
-    if (coreObject->isLink())
-        interfaceMask |= 1 << WAI_HYPERLINK;
-
     // Selection
     if (coreObject->isListBox() || coreObject->isMenuList())
         interfaceMask |= 1 << WAI_SELECTION;
 
+    // Get renderer if available.
+    RenderObject* renderer = 0;
+    if (coreObject->isAccessibilityRenderObject())
+        renderer = coreObject->renderer();
+
+    // Hyperlink (links and embedded objects).
+    if (coreObject->isLink() || (renderer && renderer->isReplaced()))
+        interfaceMask |= 1 << WAI_HYPERLINK;
+
     // Text & Editable Text
     if (role == StaticTextRole || coreObject->isMenuListOption())
         interfaceMask |= 1 << WAI_TEXT;
-    else if (coreObject->isAccessibilityRenderObject()) {
+    else {
         if (coreObject->isTextControl()) {
             interfaceMask |= 1 << WAI_TEXT;
             if (!coreObject->isReadOnly())
                 interfaceMask |= 1 << WAI_EDITABLE_TEXT;
         } else {
-            AccessibilityRenderObject* axRenderObject = static_cast<AccessibilityRenderObject*>(coreObject);
-            RenderObject* renderer = axRenderObject->renderer();
             if (role != TableRole) {
                 interfaceMask |= 1 << WAI_HYPERTEXT;
                 if (renderer && renderer->childrenInline())
@@ -2470,7 +2495,7 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
             // Add the TEXT interface for list items whose
             // first accessible child has a text renderer
             if (role == ListItemRole) {
-                AccessibilityObject::AccessibilityChildrenVector children = axRenderObject->children();
+                AccessibilityObject::AccessibilityChildrenVector children = coreObject->children();
                 if (children.size()) {
                     AccessibilityObject* axRenderChild = children.at(0).get();
                     interfaceMask |= getInterfaceMaskFromObject(axRenderChild);
@@ -2608,10 +2633,10 @@ AccessibilityObject* objectAndOffsetUnignored(AccessibilityObject* coreObject, i
             offset = 0;
         else if (!isStartOfLine(endPosition)) {
             RefPtr<Range> range = makeRange(startPosition, endPosition.previous());
-            offset = TextIterator::rangeLength(range.get()) + 1;
+            offset = TextIterator::rangeLength(range.get(), true) + 1;
         } else {
             RefPtr<Range> range = makeRange(startPosition, endPosition);
-            offset = TextIterator::rangeLength(range.get());
+            offset = TextIterator::rangeLength(range.get(), true);
         }
 
     }
diff --git a/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp b/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
index b9e483c..26e7d4a 100644
--- a/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
+++ b/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
@@ -25,7 +25,6 @@
 #include "AXObjectCache.h"
 #include "AccessibilityObject.h"
 #include "AccessibilityObjectWrapperAtk.h"
-#include "AccessibilityRenderObject.h"
 #include "NotImplemented.h"
 #include "Position.h"
 #include "Range.h"
@@ -199,7 +198,7 @@ static AtkObject* webkitAccessibleHyperlinkGetObject(AtkHyperlink* link, gint in
 static gint getRangeLengthForObject(AccessibilityObject* obj, Range* range)
 {
     // This is going to be the actual length in most of the cases
-    int baseLength = TextIterator::rangeLength(range);
+    int baseLength = TextIterator::rangeLength(range, true);
 
     // Check whether the current hyperlink belongs to a list item.
     // If so, we need to consider the length of the item's marker
@@ -215,7 +214,7 @@ static gint getRangeLengthForObject(AccessibilityObject* obj, Range* range)
     if (!markerObj)
         return baseLength;
 
-    RenderObject* renderer = static_cast<const AccessibilityRenderObject*>(markerObj)->renderer();
+    RenderObject* renderer = markerObj->renderer();
     if (!renderer || !renderer->isListMarker())
         return baseLength;
 
diff --git a/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm b/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
index e223bf4..27c4e93 100644
--- a/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
+++ b/Source/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -70,6 +70,13 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
             else
                 macNotification = NSAccessibilityFocusedUIElementChangedNotification;                
             break;
+        case AXAutocorrectionOccured:
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+            macNotification = @"AXAutocorrectionOccurred";
+            break;
+#else
+            return;
+#endif
         case AXFocusedUIElementChanged:
             macNotification = NSAccessibilityFocusedUIElementChangedNotification;
             break;
diff --git a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index c0dd795..ed3eba8 100644
--- a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -480,12 +480,26 @@ static void AXAttributeStringSetBlockquoteLevel(NSMutableAttributedString* attrS
 
 static void AXAttributeStringSetSpelling(NSMutableAttributedString* attrString, Node* node, const UChar* chars, int charLength, NSRange range)
 {
+#if USE(UNIFIED_TEXT_CHECKING)
     // Check the spelling directly since document->markersForNode() does not store the misspelled marking when the cursor is in a word.
+    TextCheckerClient* checker = node->document()->frame()->editor()->textChecker();
+
+    // checkTextOfParagraph is the only spelling/grammar checker implemented in WK1 and WK2
+    Vector<TextCheckingResult> results;
+    checker->checkTextOfParagraph(chars, charLength, TextCheckingTypeSpelling, results);
+    
+    size_t size = results.size();
+    NSNumber* trueValue = [NSNumber numberWithBool:YES];
+    for (unsigned i = 0; i < size; i++) {
+        const TextCheckingResult& result = results[i];
+        AXAttributeStringSetNumber(attrString, NSAccessibilityMisspelledTextAttribute, trueValue, NSMakeRange(result.location + range.location, result.length));
+    }    
+#else
     int currentPosition = 0;
     while (charLength > 0) {
         const UChar* charData = chars + currentPosition;
         TextCheckerClient* checker = node->document()->frame()->editor()->textChecker();
-
+        
         int misspellingLocation = -1;
         int misspellingLength = 0;
         checker->checkSpellingOfString(charData, charLength, &misspellingLocation, &misspellingLength);
@@ -497,6 +511,7 @@ static void AXAttributeStringSetSpelling(NSMutableAttributedString* attrString,
         charLength -= (misspellingLocation + misspellingLength);
         currentPosition += (misspellingLocation + misspellingLength);
     }
+#endif    
 }
 
 static void AXAttributeStringSetHeadingLevel(NSMutableAttributedString* attrString, RenderObject* renderer, NSRange range)
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index e9591fd..dd47184 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -142,4 +142,8 @@ bool RuntimeEnabledFeatures::openDatabaseSyncEnabled()
 }
 #endif
 
+#if ENABLE(QUOTA)
+bool RuntimeEnabledFeatures::isQuotaEnabled = false;
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 1004ea4..3432d74 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -150,6 +150,11 @@ public:
     static bool webkitGetUserMediaEnabled() { return isMediaStreamEnabled; }
 #endif
 
+#if ENABLE(QUOTA)
+    static bool quotaEnabled() { return isQuotaEnabled; }
+    static void setQuotaEnabled(bool isEnabled) { isQuotaEnabled = isEnabled; }
+#endif
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -182,6 +187,10 @@ private:
 #if ENABLE(MEDIA_STREAM)
     static bool isMediaStreamEnabled;
 #endif
+
+#if ENABLE(QUOTA)
+    static bool isQuotaEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/CallbackFunction.cpp b/Source/WebCore/bindings/js/CallbackFunction.cpp
new file mode 100644
index 0000000..145d055
--- /dev/null
+++ b/Source/WebCore/bindings/js/CallbackFunction.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CallbackFunction.h"
+
+#include "ExceptionCode.h"
+#include "JSDOMBinding.h"
+#include <runtime/CallData.h>
+
+namespace WebCore {
+
+bool checkFunctionOnlyCallback(JSC::ExecState* exec, JSC::JSValue value, CallbackAllowedValueFlags acceptedValues)
+{
+    if (value.isUndefined() && (acceptedValues & CallbackAllowUndefined))
+        return false;
+
+    if (value.isNull() && (acceptedValues & CallbackAllowNull))
+        return false;
+
+    JSC::CallData callData;
+    if (getCallData(value, callData) == JSC::CallTypeNone) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return false;
+    }
+
+    return true;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/js/CallbackFunction.h b/Source/WebCore/bindings/js/CallbackFunction.h
new file mode 100644
index 0000000..2562ce9
--- /dev/null
+++ b/Source/WebCore/bindings/js/CallbackFunction.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CallbackFunction_h
+#define CallbackFunction_h
+
+#include <runtime/JSObject.h>
+
+namespace JSC {
+class ExecState;
+}
+
+namespace WebCore {
+
+class JSDOMGlobalObject;
+
+enum CallbackAllowedValueFlag {
+    CallbackAllowUndefined = 1,
+    CallbackAllowNull = 1 << 1
+};
+
+typedef unsigned CallbackAllowedValueFlags;
+
+bool checkFunctionOnlyCallback(JSC::ExecState*, JSC::JSValue, CallbackAllowedValueFlags);
+
+// Creates callback objects for callbacks marked as FunctionOnly in WebIDL.
+template <typename JSCallbackType>
+PassRefPtr<JSCallbackType> createFunctionOnlyCallback(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSC::JSValue value, CallbackAllowedValueFlags acceptedValues = 0)
+{
+    if (checkFunctionOnlyCallback(exec, value, acceptedValues))
+        return JSCallbackType::create(asObject(value), globalObject);
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif // CallbackFunction_h
diff --git a/Source/WebCore/bindings/js/DOMWrapperWorld.cpp b/Source/WebCore/bindings/js/DOMWrapperWorld.cpp
index 13ee37a..b78211e 100644
--- a/Source/WebCore/bindings/js/DOMWrapperWorld.cpp
+++ b/Source/WebCore/bindings/js/DOMWrapperWorld.cpp
@@ -29,9 +29,17 @@ using namespace JSC;
 
 namespace WebCore {
 
+void JSDOMWrapperOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
+{
+    JSDOMWrapper* wrapper = static_cast<JSDOMWrapper*>(handle.get().asCell());
+    void* domObject = context;
+    uncacheWrapper(m_world, domObject, wrapper);
+}
+
 DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData, bool isNormal)
     : m_globalData(globalData)
     , m_isNormal(isNormal)
+    , m_defaultWrapperOwner(this)
 {
     JSGlobalData::ClientData* clientData = m_globalData->clientData;
     ASSERT(clientData);
@@ -45,9 +53,6 @@ DOMWrapperWorld::~DOMWrapperWorld()
     static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
 
     // These items are created lazily.
-    while (!m_documentsWithWrapperCaches.isEmpty())
-        (*m_documentsWithWrapperCaches.begin())->destroyWrapperCache(this);
-
     while (!m_scriptControllersWithWindowShells.isEmpty())
         (*m_scriptControllersWithWindowShells.begin())->destroyWindowShell(this);
 }
@@ -58,9 +63,6 @@ void DOMWrapperWorld::clearWrappers()
     m_stringCache.clear();
 
     // These items are created lazily.
-    while (!m_documentsWithWrapperCaches.isEmpty())
-        (*m_documentsWithWrapperCaches.begin())->destroyWrapperCache(this);
-
     while (!m_scriptControllersWithWindowShells.isEmpty())
         (*m_scriptControllersWithWindowShells.begin())->destroyWindowShell(this);
 }
diff --git a/Source/WebCore/bindings/js/DOMWrapperWorld.h b/Source/WebCore/bindings/js/DOMWrapperWorld.h
index 9825a08..cd7c59f 100644
--- a/Source/WebCore/bindings/js/DOMWrapperWorld.h
+++ b/Source/WebCore/bindings/js/DOMWrapperWorld.h
@@ -22,18 +22,32 @@
 #ifndef DOMWrapperWorld_h
 #define DOMWrapperWorld_h
 
-#include "Document.h"
 #include "JSDOMGlobalObject.h"
-#include "JSDOMWrapper.h"
+#include <heap/Weak.h>
 #include <runtime/WeakGCMap.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
+class JSDOMWrapper;
 class ScriptController;
 
-typedef JSC::WeakGCMap<void*, DOMObject> DOMObjectWrapperMap;
-typedef JSC::WeakGCMap<StringImpl*, JSC::JSString> JSStringCache; 
+typedef HashMap<void*, JSC::Weak<JSDOMWrapper> > DOMObjectWrapperMap;
+typedef JSC::WeakGCMap<StringImpl*, JSC::JSString> JSStringCache;
+
+class JSDOMWrapperOwner : public JSC::WeakHandleOwner {
+public:
+    JSDOMWrapperOwner(DOMWrapperWorld*);
+    virtual void finalize(JSC::Handle<JSC::Unknown>, void* context);
+
+private:
+    DOMWrapperWorld* m_world;
+};
+
+inline JSDOMWrapperOwner::JSDOMWrapperOwner(DOMWrapperWorld* world)
+    : m_world(world)
+{
+}
 
 class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
 public:
@@ -46,9 +60,6 @@ public:
     // Free as much memory held onto by this world as possible.
     void clearWrappers();
 
-    void didCreateWrapperCache(Document* document) { m_documentsWithWrapperCaches.add(document); }
-    void didDestroyWrapperCache(Document* document) { m_documentsWithWrapperCaches.remove(document); }
-
     void didCreateWindowShell(ScriptController* scriptController) { m_scriptControllersWithWindowShells.add(scriptController); }
     void didDestroyWindowShell(ScriptController* scriptController) { m_scriptControllersWithWindowShells.remove(scriptController); }
 
@@ -59,15 +70,16 @@ public:
     bool isNormal() const { return m_isNormal; }
 
     JSC::JSGlobalData* globalData() const { return m_globalData; }
+    JSDOMWrapperOwner* defaultWrapperOwner() { return &m_defaultWrapperOwner; }
 
 protected:
     DOMWrapperWorld(JSC::JSGlobalData*, bool isNormal);
 
 private:
     JSC::JSGlobalData* m_globalData;
-    HashSet<Document*> m_documentsWithWrapperCaches;
     HashSet<ScriptController*> m_scriptControllersWithWindowShells;
     bool m_isNormal;
+    JSDOMWrapperOwner m_defaultWrapperOwner;
 };
 
 DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
@@ -80,19 +92,6 @@ inline DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
     return static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->world();
 }
 
-// From Document.h
-
-inline Document::JSWrapperCache* Document::getWrapperCache(DOMWrapperWorld* world)
-{
-    if (world->isNormal()) {
-        if (Document::JSWrapperCache* wrapperCache = m_normalWorldWrapperCache)
-            return wrapperCache;
-        ASSERT(!m_wrapperCacheMap.contains(world));
-    } else if (Document::JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
-        return wrapperCache;
-    return createWrapperCache(world);
-}
-
 } // namespace WebCore
 
 #endif // DOMWrapperWorld_h
diff --git a/Source/WebCore/bindings/js/GCController.cpp b/Source/WebCore/bindings/js/GCController.cpp
index fe0e36f..765e363 100644
--- a/Source/WebCore/bindings/js/GCController.cpp
+++ b/Source/WebCore/bindings/js/GCController.cpp
@@ -29,13 +29,9 @@
 #include "JSDOMWindow.h"
 #include <runtime/JSGlobalData.h>
 #include <runtime/JSLock.h>
-#include <runtime/Heap.h>
+#include <heap/Heap.h>
 #include <wtf/StdLibExtras.h>
 
-#if USE(PTHREADS)
-#include <pthread.h>
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -78,13 +74,14 @@ void GCController::garbageCollectNow()
 
 void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDone)
 {
-#if USE(PTHREADS)
-    pthread_t thread;
-    pthread_create(&thread, NULL, collect, NULL);
+    ThreadIdentifier threadID = createThread(collect, 0, "WebCore: GCController");
+
+    if (waitUntilDone) {
+        waitForThreadCompletion(threadID, 0);
+        return;
+    }
 
-    if (waitUntilDone)
-        pthread_join(thread, NULL);
-#endif
+    detachThread(threadID);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h b/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
index cb9981d..58aaf19 100644
--- a/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
+++ b/Source/WebCore/bindings/js/JSArrayBufferViewHelper.h
@@ -163,11 +163,11 @@ static JSC::JSValue toJSArrayBufferView(JSC::ExecState* exec, JSDOMGlobalObject*
     if (!object)
         return JSC::jsNull();
 
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
+    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), object))
         return wrapper;
 
     exec->heap()->reportExtraMemoryCost(object->byteLength());
-    return createDOMObjectWrapper<JSType>(exec, globalObject, object);
+    return createWrapper<JSType>(exec, globalObject, object);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSAttrCustom.cpp b/Source/WebCore/bindings/js/JSAttrCustom.cpp
index 227582d..305dc81 100644
--- a/Source/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/Source/WebCore/bindings/js/JSAttrCustom.cpp
@@ -43,10 +43,10 @@ void JSAttr::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    // Mark the element so that this will work to access the attribute even if the last
-    // other reference goes away.
-    if (Element* element = impl()->ownerElement())
-        markDOMNodeWrapper(markStack, element->document(), element);
+    Element* element = impl()->ownerElement();
+    if (!element)
+        return;
+    markStack.addOpaqueRoot(root(element));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSAudioConstructor.h b/Source/WebCore/bindings/js/JSAudioConstructor.h
index be0b800..1440355 100644
--- a/Source/WebCore/bindings/js/JSAudioConstructor.h
+++ b/Source/WebCore/bindings/js/JSAudioConstructor.h
@@ -38,7 +38,7 @@ namespace WebCore {
     public:
         JSAudioConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/WebCore/bindings/js/JSAudioContextCustom.cpp b/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
index 382d0cb..9ebf6b7 100644
--- a/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
@@ -54,8 +54,28 @@ EncodedJSValue JSC_HOST_CALL JSAudioContextConstructor::constructJSAudioContext(
 
     Document* document = static_cast<Document*>(scriptExecutionContext);
 
-    RefPtr<AudioContext> context = AudioContext::create(document);
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), context.get())));
+    RefPtr<AudioContext> audioContext;
+    
+    if (!exec->argumentCount()) {
+        // Constructor for default AudioContext which talks to audio hardware.
+        audioContext = AudioContext::create(document);
+    } else {
+        // Constructor for offline (render-target) AudioContext which renders into an AudioBuffer.
+        // new AudioContext(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
+        if (exec->argumentCount() < 3)
+            return throwError(exec, createSyntaxError(exec, "Not enough arguments"));
+
+        unsigned numberOfChannels = exec->argument(0).toInt32(exec);
+        unsigned numberOfFrames = exec->argument(1).toInt32(exec);
+        float sampleRate = exec->argument(2).toFloat(exec);
+
+        audioContext = AudioContext::createOfflineContext(document, numberOfChannels, numberOfFrames, sampleRate);
+    }
+
+    if (!audioContext.get())
+        return throwError(exec, createReferenceError(exec, "Error creating AudioContext"));
+
+    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), audioContext.get())));
 }
 
 JSValue JSAudioContext::createBuffer(ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index d5c9135..a457ce8 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -25,6 +25,7 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include "CallbackFunction.cpp"
 #include "DOMObjectHashTableMap.cpp"
 #include "DOMWrapperWorld.cpp"
 #include "GCController.cpp"
diff --git a/Source/WebCore/bindings/js/JSCSSRuleCustom.cpp b/Source/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 4d226d0..935ec1a 100644
--- a/Source/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -63,7 +63,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSRule* rule)
     if (!rule)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, rule);
+    JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), rule);
     if (wrapper)
         return wrapper;
 
diff --git a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 1e750e5..c41c15b 100644
--- a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -34,6 +34,8 @@
 #include <runtime/StringPrototype.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/text/AtomicString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringConcatenate.h>
 
 using namespace JSC;
 using namespace WTF;
@@ -94,8 +96,8 @@ static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPo
     if (!length)
         return String();
 
-    Vector<UChar> name;
-    name.reserveInitialCapacity(length);
+    StringBuilder builder;
+    builder.reserveCapacity(length);
 
     unsigned i = 0;
 
@@ -112,32 +114,30 @@ static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPo
     } else if (hasCSSPropertyNamePrefix(propertyName, "webkit")
             || hasCSSPropertyNamePrefix(propertyName, "khtml")
             || hasCSSPropertyNamePrefix(propertyName, "apple"))
-        name.append('-');
+        builder.append('-');
     else {
         if (isASCIIUpper(propertyName.characters()[0]))
             return String();
     }
 
-    name.append(toASCIILower(propertyName.characters()[i++]));
+    builder.append(toASCIILower(propertyName.characters()[i++]));
 
     for (; i < length; ++i) {
         UChar c = propertyName.characters()[i];
         if (!isASCIIUpper(c))
-            name.append(c);
-        else {
-            name.append('-');
-            name.append(toASCIILower(c));
-        }
+            builder.append(c);
+        else
+            builder.append(makeString('-', toASCIILower(c)));
     }
 
-    return String::adopt(name);
+    return builder.toString();
 }
 
-static bool isCSSPropertyName(const Identifier& propertyName)
+static bool isCSSPropertyName(const Identifier& propertyIdentifier)
 {
     // FIXME: This mallocs a string for the property name and then throws it
     // away.  This shows up on peacekeeper's domDynamicCreationCreateElement.
-    return CSSStyleDeclaration::isPropertyName(cssPropertyName(propertyName));
+    return CSSStyleDeclaration::isPropertyName(cssPropertyName(propertyIdentifier));
 }
 
 bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*, const Identifier& propertyName)
@@ -178,11 +178,11 @@ JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, con
 
 bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
-    if (!isCSSPropertyName(propertyName))
-        return false;
-
     bool pixelOrPos;
     String prop = cssPropertyName(propertyName, &pixelOrPos);
+    if (!CSSStyleDeclaration::isPropertyName(prop))
+        return false;
+
     String propValue = valueToStringWithNullCheck(exec, value);
     if (pixelOrPos)
         propValue += "px";
diff --git a/Source/WebCore/bindings/js/JSCSSValueCustom.cpp b/Source/WebCore/bindings/js/JSCSSValueCustom.cpp
index 83c1d3a..b1f8404 100644
--- a/Source/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -49,7 +49,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSValue* value)
     if (!value)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, value);
+    JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), value);
 
     if (wrapper)
         return wrapper;
diff --git a/Source/WebCore/bindings/js/JSCallbackData.h b/Source/WebCore/bindings/js/JSCallbackData.h
index 942cd9c..94ca48d 100644
--- a/Source/WebCore/bindings/js/JSCallbackData.h
+++ b/Source/WebCore/bindings/js/JSCallbackData.h
@@ -32,7 +32,7 @@
 #include "JSDOMBinding.h"
 #include "JSDOMGlobalObject.h"
 #include "ScriptExecutionContext.h"
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <runtime/JSObject.h>
 #include <wtf/Threading.h>
 
@@ -66,8 +66,8 @@ public:
     JSC::JSValue invokeCallback(JSC::MarkedArgumentBuffer&, bool* raisedException = 0);
 
 private:
-    JSC::Global<JSC::JSObject> m_callback;
-    JSC::Global<JSDOMGlobalObject> m_globalObject;
+    JSC::Strong<JSC::JSObject> m_callback;
+    JSC::Strong<JSDOMGlobalObject> m_globalObject;
 #ifndef NDEBUG
     ThreadIdentifier m_thread;
 #endif
diff --git a/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
index cab7ba3..cd20dc9 100644
--- a/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -44,10 +44,10 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasR
 
 #if ENABLE(WEBGL)
     if (object->is3d())
-        return getDOMObjectWrapper<JSWebGLRenderingContext>(exec, globalObject, static_cast<WebGLRenderingContext*>(object));
+        return wrap<JSWebGLRenderingContext>(exec, globalObject, static_cast<WebGLRenderingContext*>(object));
 #endif
     ASSERT(object->is2d());
-    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+    return wrap<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSCustomVoidCallback.h b/Source/WebCore/bindings/js/JSCustomVoidCallback.h
index 922e380..f342b8b 100644
--- a/Source/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/Source/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -31,7 +31,7 @@
 
 #include "JSDOMGlobalObject.h"
 #include "VoidCallback.h"
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 8501eb9..5ac07a7 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -44,7 +44,6 @@
 #include "JSEventException.h"
 #include "JSExceptionBase.h"
 #include "JSMainThreadExecState.h"
-#include "JSNode.h"
 #include "JSRangeException.h"
 #include "JSXMLHttpRequestException.h"
 #include "KURL.h"
@@ -94,9 +93,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-typedef Document::JSWrapperCache JSWrapperCache;
-typedef Document::JSWrapperCacheMap JSWrapperCacheMap;
-
 class JSGlobalDataWorldIterator {
 public:
     JSGlobalDataWorldIterator(JSGlobalData* globalData)
@@ -138,163 +134,6 @@ const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const
     return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
 }
 
-bool hasCachedDOMObjectWrapperUnchecked(JSGlobalData* globalData, void* objectHandle)
-{
-    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
-        if (worldIter->m_wrappers.get(objectHandle))
-            return true;
-    }
-    return false;
-}
-
-bool hasCachedDOMObjectWrapper(JSGlobalData* globalData, void* objectHandle)
-{
-    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
-        if (worldIter->m_wrappers.get(objectHandle))
-            return true;
-    }
-    return false;
-}
-
-DOMObject* getCachedDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle) 
-{
-    return domObjectWrapperMapFor(exec).get(objectHandle);
-}
-
-void cacheDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle, DOMObject* wrapper) 
-{
-    domObjectWrapperMapFor(exec).set(exec->globalData(), objectHandle, wrapper);
-}
-
-bool hasCachedDOMNodeWrapperUnchecked(Document* document, Node* node)
-{
-    if (!document)
-        return hasCachedDOMObjectWrapperUnchecked(JSDOMWindow::commonJSGlobalData(), node);
-
-    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
-    for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
-        if (iter->second->get(node))
-            return true;
-    }
-    return false;
-}
-
-void cacheDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node, JSNode* wrapper)
-{
-    if (!document)
-        domObjectWrapperMapFor(exec).set(exec->globalData(), node, wrapper);
-    else
-        document->getWrapperCache(currentWorld(exec))->set(exec->globalData(), node, wrapper);
-
-    if (currentWorld(exec)->isNormal())
-        node->setWrapper(exec->globalData(), wrapper);
-}
-
-static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world)
-{
-    // Certain conditions implicitly make existence of a JS DOM node wrapper observable
-    // through the DOM, even if no explicit reference to it remains.
-
-    Node* node = jsNode->impl();
-
-    if (node->inDocument()) {
-        // If a node is in the document, and its wrapper has custom properties,
-        // the wrapper is observable because future access to the node through the
-        // DOM must reflect those properties.
-        if (jsNode->hasCustomProperties())
-            return true;
-
-        // If a node is in the document, and has event listeners, its wrapper is
-        // observable because its wrapper is responsible for marking those event listeners.
-        if (node->hasEventListeners())
-            return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
-
-        // If a node owns another object with a wrapper with custom properties,
-        // the wrapper must be treated as observable, because future access to
-        // those objects through the DOM must reflect those properties.
-        // FIXME: It would be better if this logic could be in the node next to
-        // the custom markChildren functions rather than here.
-        // Note that for some compound objects like stylesheets and CSSStyleDeclarations,
-        // we don't descend to check children for custom properties, and just conservatively
-        // keep the node wrappers protecting them alive.
-        if (node->isElementNode()) {
-            if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
-                if (DOMObject* wrapper = world->m_wrappers.get(attributes)) {
-                    // FIXME: This check seems insufficient, because NamedNodeMap items can have custom properties themselves.
-                    // Maybe it would be OK to just keep the wrapper alive, as it is done for CSSOM objects below.
-                    if (wrapper->hasCustomProperties())
-                        return true;
-                }
-            }
-            if (node->isStyledElement()) {
-                if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
-                    if (world->m_wrappers.get(style))
-                        return true;
-                }
-            }
-            if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
-                if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
-                    if (DOMObject* wrapper = world->m_wrappers.get(context)) {
-                        if (wrapper->hasCustomProperties())
-                            return true;
-                    }
-                }
-            } else if (static_cast<Element*>(node)->hasTagName(linkTag)) {
-                if (StyleSheet* sheet = static_cast<HTMLLinkElement*>(node)->sheet()) {
-                    if (world->m_wrappers.get(sheet))
-                        return true;
-                }
-            } else if (static_cast<Element*>(node)->hasTagName(styleTag)) {
-                if (StyleSheet* sheet = static_cast<HTMLStyleElement*>(node)->sheet()) {
-                    if (world->m_wrappers.get(sheet))
-                        return true;
-                }
-            }
-        } else if (node->nodeType() == Node::PROCESSING_INSTRUCTION_NODE) {
-            if (StyleSheet* sheet = static_cast<ProcessingInstruction*>(node)->sheet()) {
-                if (world->m_wrappers.get(sheet))
-                    return true;
-            }
-        }
-    } else {
-        // If a wrapper is the last reference to an image or script element
-        // that is loading but not in the document, the wrapper is observable
-        // because it is the only thing keeping the image element alive, and if
-        // the image element is destroyed, its load event will not fire.
-        // FIXME: The DOM should manage this issue without the help of JavaScript wrappers.
-        if (node->hasTagName(imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
-            return true;
-        if (node->hasTagName(scriptTag) && !static_cast<HTMLScriptElement*>(node)->haveFiredLoadEvent())
-            return true;
-#if ENABLE(VIDEO)
-        if (node->hasTagName(audioTag) && !static_cast<HTMLAudioElement*>(node)->paused())
-            return true;
-#endif
-    }
-
-    // If a node is firing event listeners, its wrapper is observable because
-    // its wrapper is responsible for marking those event listeners.
-    if (node->isFiringEventListeners())
-        return true;
-
-    return false;
-}
-
-void markDOMNodesForDocument(MarkStack& markStack, Document* document)
-{
-    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
-    for (JSWrapperCacheMap::iterator wrappersIter = wrapperCacheMap.begin(); wrappersIter != wrapperCacheMap.end(); ++wrappersIter) {
-        DOMWrapperWorld* world = wrappersIter->first;
-        JSWrapperCache* nodeDict = wrappersIter->second;
-
-        JSWrapperCache::iterator nodeEnd = nodeDict->end();
-        for (JSWrapperCache::iterator nodeIt = nodeDict->begin(); nodeIt != nodeEnd; ++nodeIt) {
-            if (isObservableThroughDOM(nodeIt.get().second, world))
-                markStack.deprecatedAppend(nodeIt.getSlot().second);
-        }
-    }
-}
-
 void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData, ScriptExecutionContext* scriptExecutionContext)
 {
     // If an element has pending activity that may result in event listeners being called
@@ -319,42 +158,6 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
     }
 }
 
-typedef std::pair<JSNode*, DOMWrapperWorld*> WrapperAndWorld;
-typedef WTF::Vector<WrapperAndWorld, 8> WrapperSet;
-
-static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrapperSet)
-{
-    if (document) {
-        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
-        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
-            if (JSNode* wrapper = iter->second->take(node))
-                wrapperSet.append(WrapperAndWorld(wrapper, iter->first));
-        }
-    } else {
-        for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
-            DOMWrapperWorld* world = *worldIter;
-            if (JSNode* wrapper = static_cast<JSNode*>(world->m_wrappers.take(node)))
-                wrapperSet.append(WrapperAndWorld(wrapper, world));
-        }
-    }
-}
-
-void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocument)
-{
-    ASSERT(oldDocument != newDocument);
-
-    WrapperSet wrapperSet;
-    takeWrappers(node, oldDocument, wrapperSet);
-
-    for (unsigned i = 0; i < wrapperSet.size(); ++i) {
-        JSNode* wrapper = wrapperSet[i].first;
-        if (newDocument)
-            newDocument->getWrapperCache(wrapperSet[i].second)->set(*wrapperSet[i].second->globalData(), node, wrapper);
-        else
-            wrapperSet[i].second->m_wrappers.set(*wrapperSet[i].second->globalData(), node, wrapper);
-    }
-}
-
 void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void* object)
 {
     // FIXME: This could be changed to only mark wrappers that are "observable"
@@ -364,25 +167,8 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
         return;
 
     for (JSGlobalDataWorldIterator worldIter(&globalData); worldIter; ++worldIter) {
-        if (HandleSlot wrapperSlot = worldIter->m_wrappers.getSlot(object))
-            markStack.deprecatedAppend(wrapperSlot);
-    }
-}
-
-void markDOMNodeWrapper(MarkStack& markStack, Document* document, Node* node)
-{
-    if (document) {
-        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
-        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
-            if (HandleSlot wrapperSlot = iter->second->getSlot(node))
-                markStack.deprecatedAppend(wrapperSlot);
-        }
-        return;
-    }
-
-    for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
-        if (HandleSlot wrapperSlot = worldIter->m_wrappers.getSlot(node))
-            markStack.deprecatedAppend(wrapperSlot);
+        if (JSDOMWrapper* wrapper = worldIter->m_wrappers.get(object).get())
+            markStack.deprecatedAppend(reinterpret_cast<JSCell**>(&wrapper));
     }
 }
 
@@ -646,11 +432,11 @@ Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInf
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, Structure* structure, const ClassInfo* classInfo)
 {
     JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
-    return structures.set(classInfo, structure).first->second.get();
+    return structures.set(classInfo, WriteBarrier<Structure>(globalObject->globalData(), globalObject, structure)).first->second.get();
 }
 
 JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index 934d9b3..803429f 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -26,9 +26,9 @@
 #include "JSDOMWrapper.h"
 #include "DOMWrapperWorld.h"
 #include "Document.h"
+#include <heap/Weak.h>
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
-#include <runtime/WeakGCMap.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -49,13 +49,13 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
-    // FIXME: This class should collapse into DOMObject once all DOMObjects are
+    // FIXME: This class should collapse into JSDOMWrapper once all JSDOMWrappers are
     // updated to store a globalObject pointer.
-    class DOMObjectWithGlobalPointer : public DOMObject {
+    class JSDOMWrapperWithGlobalPointer : public JSDOMWrapper {
     public:
         JSDOMGlobalObject* globalObject() const
         {
-            return static_cast<JSDOMGlobalObject*>(DOMObject::globalObject());
+            return static_cast<JSDOMGlobalObject*>(JSDOMWrapper::globalObject());
         }
 
         ScriptExecutionContext* scriptExecutionContext() const
@@ -64,14 +64,14 @@ namespace WebCore {
             return globalObject()->scriptExecutionContext();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
-            : DOMObject(globalObject, structure)
+        JSDOMWrapperWithGlobalPointer(JSC::Structure* structure, JSDOMGlobalObject* globalObject)
+            : JSDOMWrapper(globalObject, structure)
         {
             // FIXME: This ASSERT is valid, but fires in fast/dom/gc-6.html when trying to create
             // new JavaScript objects on detached windows due to DOMWindow::document()
@@ -81,17 +81,17 @@ namespace WebCore {
     };
 
     // Base class for all constructor objects in the JSC bindings.
-    class DOMConstructorObject : public DOMObjectWithGlobalPointer {
+    class DOMConstructorObject : public JSDOMWrapperWithGlobalPointer {
     public:
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        static const unsigned StructureFlags = JSC::ImplementsHasInstance | JSC::OverridesMarkChildren | DOMObjectWithGlobalPointer::StructureFlags;
-        DOMConstructorObject(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
-            : DOMObjectWithGlobalPointer(structure, globalObject)
+        static const unsigned StructureFlags = JSC::ImplementsHasInstance | JSC::OverridesMarkChildren | JSDOMWrapperWithGlobalPointer::StructureFlags;
+        DOMConstructorObject(JSC::Structure* structure, JSDOMGlobalObject* globalObject)
+            : JSDOMWrapperWithGlobalPointer(structure, globalObject)
         {
         }
     };
@@ -106,30 +106,18 @@ namespace WebCore {
         }
 
     protected:
-        DOMConstructorWithDocument(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMConstructorWithDocument(JSC::Structure* structure, JSDOMGlobalObject* globalObject)
             : DOMConstructorObject(structure, globalObject)
         {
             ASSERT(globalObject->scriptExecutionContext()->isDocument());
         }
     };
-
-    DOMObject* getCachedDOMObjectWrapper(JSC::ExecState*, void* objectHandle);
-    bool hasCachedDOMObjectWrapper(JSC::JSGlobalData*, void* objectHandle);
-    void cacheDOMObjectWrapper(JSC::ExecState*, void* objectHandle, DOMObject* wrapper);
-
-    JSNode* getCachedDOMNodeWrapper(JSC::ExecState*, Document*, Node*);
-    void cacheDOMNodeWrapper(JSC::ExecState*, Document*, Node*, JSNode* wrapper);
-    void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
-
-    void markDOMNodesForDocument(JSC::MarkStack&, Document*);
+    
     void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
-    void markDOMNodeWrapper(JSC::MarkStack& markStack, Document* document, Node* node);
-    bool hasCachedDOMObjectWrapperUnchecked(JSC::JSGlobalData*, void* objectHandle);
-    bool hasCachedDOMNodeWrapperUnchecked(Document*, Node*);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
-    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, JSC::Structure*, const JSC::ClassInfo*);
 
     inline JSDOMGlobalObject* deprecatedGlobalObjectForPrototype(JSC::ExecState* exec)
     {
@@ -145,52 +133,70 @@ namespace WebCore {
             return structure;
         return cacheDOMStructure(globalObject, WrapperClass::createStructure(exec->globalData(), WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
     }
+
     template<class WrapperClass> inline JSC::Structure* deprecatedGetDOMStructure(JSC::ExecState* exec)
     {
         // FIXME: This function is wrong.  It uses the wrong global object for creating the prototype structure.
         return getDOMStructure<WrapperClass>(exec, deprecatedGlobalObjectForPrototype(exec));
     }
+
     template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
     {
         return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(globalObject))->storedPrototype()));
     }
-    #define CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, className, object) createDOMObjectWrapper<JS##className>(exec, globalObject, static_cast<className*>(object))
-    template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
+
+    // Overload these functions to provide a fast path for wrapper access.
+    inline JSDOMWrapper* getInlineCachedWrapper(DOMWrapperWorld*, void*) { return 0; }
+    inline bool setInlineCachedWrapper(DOMWrapperWorld*, void*, JSDOMWrapper*) { return false; }
+    inline bool clearInlineCachedWrapper(DOMWrapperWorld*, void*, JSDOMWrapper*) { return false; }
+
+    // Overload these functions to provide a custom WeakHandleOwner.
+    inline JSC::WeakHandleOwner* wrapperOwner(DOMWrapperWorld* world, void*) { return world->defaultWrapperOwner(); }
+    inline void* wrapperContext(DOMWrapperWorld*, void* domObject) { return domObject; }
+
+    template <typename DOMClass> inline JSDOMWrapper* getCachedWrapper(DOMWrapperWorld* world, DOMClass* domObject)
     {
-        ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec, object));
-        // FIXME: new (exec) could use a different globalData than the globalData this wrapper is cached on.
-        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object);
-        cacheDOMObjectWrapper(exec, object, wrapper);
-        return wrapper;
+        if (JSDOMWrapper* wrapper = getInlineCachedWrapper(world, domObject))
+            return wrapper;
+        return world->m_wrappers.get(domObject).get();
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
+
+    template <typename DOMClass> inline void cacheWrapper(DOMWrapperWorld* world, DOMClass* domObject, JSDOMWrapper* wrapper)
     {
-        if (!object)
-            return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
-            return wrapper;
-        return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object);
+        if (setInlineCachedWrapper(world, domObject, wrapper))
+            return;
+        ASSERT(!world->m_wrappers.contains(domObject));
+        world->m_wrappers.set(domObject, JSC::Weak<JSDOMWrapper>(*world->globalData(), wrapper, wrapperOwner(world, domObject), wrapperContext(world, domObject)));
     }
 
-    #define CREATE_DOM_NODE_WRAPPER(exec, globalObject, className, object) createDOMNodeWrapper<JS##className>(exec, globalObject, static_cast<className*>(object))
-    template<class WrapperClass, class DOMClass> inline JSNode* createDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
+    template <typename DOMClass> inline void uncacheWrapper(DOMWrapperWorld* world, DOMClass* domObject, JSDOMWrapper* wrapper)
+    {
+        if (clearInlineCachedWrapper(world, domObject, wrapper))
+            return;
+        ASSERT(world->m_wrappers.find(domObject)->second.get() == wrapper);
+        world->m_wrappers.remove(domObject);
+    }
+    
+    #define CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, className, object) createWrapper<JS##className>(exec, globalObject, static_cast<className*>(object))
+    #define CREATE_DOM_NODE_WRAPPER(exec, globalObject, className, object) static_cast<JSNode*>(createWrapper<JS##className>(exec, globalObject, static_cast<className*>(object)))
+    template<class WrapperClass, class DOMClass> inline JSDOMWrapper* createWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         ASSERT(node);
-        ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
+        ASSERT(!getCachedWrapper(currentWorld(exec), node));
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, node);
         // FIXME: The entire function can be removed, once we fix caching.
         // This function is a one-off hack to make Nodes cache in the right global object.
-        cacheDOMNodeWrapper(exec, node->document(), node, wrapper);
+        cacheWrapper(currentWorld(exec), node, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
+
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue wrap(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* domObject)
     {
-        if (!node)
+        if (!domObject)
             return JSC::jsNull();
-        if (JSC::JSCell* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node))
+        if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), domObject))
             return wrapper;
-        return createDOMNodeWrapper<WrapperClass>(exec, globalObject, node);
+        return createWrapper<WrapperClass>(exec, globalObject, domObject);
     }
 
     const JSC::HashTable* getHashTableForGlobalData(JSC::JSGlobalData&, const JSC::HashTable* staticTable);
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 8183b6e..3e3d037 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -42,8 +42,8 @@ namespace WebCore {
 
 const ClassInfo JSDOMGlobalObject::s_info = { "DOMGlobalObject", &JSGlobalObject::s_info, 0, 0 };
 
-JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWrapperWorld> world, JSObject* thisValue)
-    : JSGlobalObject(structure, thisValue)
+JSDOMGlobalObject::JSDOMGlobalObject(JSGlobalData& globalData, Structure* structure, PassRefPtr<DOMWrapperWorld> world, JSObject* thisValue)
+    : JSGlobalObject(globalData, structure, thisValue)
     , m_currentEvent(0)
     , m_world(world)
 {
@@ -56,7 +56,7 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 
     JSDOMStructureMap::iterator end = structures().end();
     for (JSDOMStructureMap::iterator it = structures().begin(); it != end; ++it)
-        markStack.append(it->second->storedPrototypeSlot());
+        markStack.append(&it->second);
 
     JSDOMConstructorMap::iterator end2 = constructors().end();
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.h b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
index 1e992c5..9190e01 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -38,7 +38,7 @@ namespace WebCore {
     class JSEventListener;
     class ScriptExecutionContext;
 
-    typedef HashMap<const JSC::ClassInfo*, RefPtr<JSC::Structure> > JSDOMStructureMap;
+    typedef HashMap<const JSC::ClassInfo*, JSC::WriteBarrier<JSC::Structure> > JSDOMStructureMap;
     typedef HashMap<const JSC::ClassInfo*, JSC::WriteBarrier<JSC::JSObject> > JSDOMConstructorMap;
 
     class JSDOMGlobalObject : public JSC::JSGlobalObject {
@@ -46,7 +46,7 @@ namespace WebCore {
     protected:
         struct JSDOMGlobalObjectData;
 
-        JSDOMGlobalObject(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWrapperWorld>, JSC::JSObject* thisValue);
+        JSDOMGlobalObject(JSC::JSGlobalData&, JSC::Structure*, PassRefPtr<DOMWrapperWorld>, JSC::JSObject* thisValue);
 
     public:
         JSDOMStructureMap& structures() { return m_structures; }
@@ -69,7 +69,7 @@ namespace WebCore {
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/WebCore/bindings/js/JSDOMImplementationCustom.cpp b/Source/WebCore/bindings/js/JSDOMImplementationCustom.cpp
index ac83c69..aa3a607 100644
--- a/Source/WebCore/bindings/js/JSDOMImplementationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMImplementationCustom.cpp
@@ -33,10 +33,10 @@ void JSDOMImplementation::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    DOMImplementation* domImplementation = impl();
-    Document* ownerDocument = domImplementation->ownerDocument();
-    if (ownerDocument)
-        markDOMNodeWrapper(markStack, ownerDocument, ownerDocument);
+    Document* ownerDocument = impl()->ownerDocument();
+    if (!ownerDocument)
+        return;
+    markStack.addOpaqueRoot(ownerDocument);
 }
 
 }
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
index 584f610..10f7cd9 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -45,8 +45,8 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", &JSDOMGlobalObject::s_info, 0, 0 };
 
-JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : JSDOMGlobalObject(structure, shell->world(), shell)
+JSDOMWindowBase::JSDOMWindowBase(JSGlobalData& globalData, Structure* structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+    : JSDOMGlobalObject(globalData, structure, shell->world(), shell)
     , m_impl(window)
     , m_shell(shell)
 {
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.h b/Source/WebCore/bindings/js/JSDOMWindowBase.h
index bfec31c..946f95c 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.h
@@ -22,7 +22,7 @@
 
 #include "PlatformString.h"
 #include "JSDOMBinding.h"
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
@@ -44,7 +44,7 @@ namespace WebCore {
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     protected:
-        JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+        JSDOMWindowBase(JSC::JSGlobalData&, JSC::Structure*, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
         void updateDocument();
@@ -57,7 +57,7 @@ namespace WebCore {
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 03f9d68..4bde9e5 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -441,24 +441,24 @@ JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyNam
 JSValue JSDOMWindow::history(ExecState* exec) const
 {
     History* history = impl()->history();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, history))
+    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), history))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, window), window, history);
-    cacheDOMObjectWrapper(exec, history, jsHistory);
+    cacheWrapper(currentWorld(exec), history, jsHistory);
     return jsHistory;
 }
 
 JSValue JSDOMWindow::location(ExecState* exec) const
 {
     Location* location = impl()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
+    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), location))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), window, location);
-    cacheDOMObjectWrapper(exec, location, jsLocation);
+    cacheWrapper(currentWorld(exec), location, jsLocation);
     return jsLocation;
 }
 
@@ -732,9 +732,14 @@ JSValue JSDOMWindow::postMessage(ExecState* exec)
 
 JSValue JSDOMWindow::setTimeout(ExecState* exec)
 {
-    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, currentWorld(exec));
+    ContentSecurityPolicy* contentSecurityPolicy = impl()->document() ? impl()->document()->contentSecurityPolicy() : 0;
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, currentWorld(exec), contentSecurityPolicy);
     if (exec->hadException())
         return jsUndefined();
+
+    if (!action)
+        return jsNumber(0);
+
     int delay = exec->argument(1).toInt32(exec);
 
     ExceptionCode ec = 0;
@@ -746,11 +751,15 @@ JSValue JSDOMWindow::setTimeout(ExecState* exec)
 
 JSValue JSDOMWindow::setInterval(ExecState* exec)
 {
-    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, currentWorld(exec));
+    ContentSecurityPolicy* contentSecurityPolicy = impl()->document() ? impl()->document()->contentSecurityPolicy() : 0;
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, currentWorld(exec), contentSecurityPolicy);
     if (exec->hadException())
         return jsUndefined();
     int delay = exec->argument(1).toInt32(exec);
 
+    if (!action)
+        return jsNumber(0);
+
     ExceptionCode ec = 0;
     int result = impl()->setInterval(action.release(), delay, ec);
     setDOMException(exec, ec);
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
index 817e9c0..0aec968 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -44,7 +44,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", &Base::s_info, 0, 0 };
 
 JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
-    : Base(JSDOMWindowShell::createStructure(*world->globalData(), jsNull()))
+    : Base(*world->globalData(), JSDOMWindowShell::createStructure(*world->globalData(), jsNull()))
     , m_world(world)
 {
     ASSERT(inherits(&s_info));
@@ -60,11 +60,11 @@ void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
     // Explicitly protect the global object's prototype so it isn't collected
     // when we allocate the global object. (Once the global object is fully
     // constructed, it can mark its own prototype.)
-    RefPtr<Structure> prototypeStructure = JSDOMWindowPrototype::createStructure(*JSDOMWindow::commonJSGlobalData(), jsNull());
-    Global<JSDOMWindowPrototype> prototype(*JSDOMWindow::commonJSGlobalData(), new JSDOMWindowPrototype(0, prototypeStructure.release()));
+    Structure* prototypeStructure = JSDOMWindowPrototype::createStructure(*JSDOMWindow::commonJSGlobalData(), jsNull());
+    Strong<JSDOMWindowPrototype> prototype(*JSDOMWindow::commonJSGlobalData(), new JSDOMWindowPrototype(*JSDOMWindow::commonJSGlobalData(), 0, prototypeStructure));
 
-    RefPtr<Structure> structure = JSDOMWindow::createStructure(*JSDOMWindow::commonJSGlobalData(), prototype.get());
-    JSDOMWindow* jsDOMWindow = new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), domWindow, this);
+    Structure* structure = JSDOMWindow::createStructure(*JSDOMWindow::commonJSGlobalData(), prototype.get());
+    JSDOMWindow* jsDOMWindow = new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(*JSDOMWindow::commonJSGlobalData(), structure, domWindow, this);
     prototype->putAnonymousValue(*JSDOMWindow::commonJSGlobalData(), 0, jsDOMWindow);
     setWindow(*JSDOMWindow::commonJSGlobalData(), jsDOMWindow);
 }
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.h b/Source/WebCore/bindings/js/JSDOMWindowShell.h
index 4307c1c..c2c5336 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.h
@@ -48,7 +48,7 @@ namespace WebCore {
         {
             ASSERT_ARG(window, window);
             m_window.set(globalData, this, window);
-            setPrototype(window->prototype());
+            setPrototype(globalData, window->prototype());
         }
         void setWindow(PassRefPtr<DOMWindow>);
 
@@ -58,7 +58,7 @@ namespace WebCore {
 
         void* operator new(size_t);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype) 
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype) 
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
diff --git a/Source/WebCore/bindings/js/JSDOMWrapper.cpp b/Source/WebCore/bindings/js/JSDOMWrapper.cpp
index c91230b..60c0ed1 100644
--- a/Source/WebCore/bindings/js/JSDOMWrapper.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWrapper.cpp
@@ -34,7 +34,7 @@ namespace WebCore {
 
 #ifndef NDEBUG
 
-DOMObject::~DOMObject()
+JSDOMWrapper::~JSDOMWrapper()
 {
 }
 
diff --git a/Source/WebCore/bindings/js/JSDOMWrapper.h b/Source/WebCore/bindings/js/JSDOMWrapper.h
index 0f8031c..1484dc6 100644
--- a/Source/WebCore/bindings/js/JSDOMWrapper.h
+++ b/Source/WebCore/bindings/js/JSDOMWrapper.h
@@ -26,16 +26,15 @@
 
 namespace WebCore {
 
-// FIXME: Rename to JSDOMWrapper.
-class DOMObject : public JSC::JSObjectWithGlobalObject {
+class JSDOMWrapper : public JSC::JSObjectWithGlobalObject {
 protected:
-    explicit DOMObject(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) 
+    explicit JSDOMWrapper(JSC::JSGlobalObject* globalObject, JSC::Structure* structure) 
         : JSObjectWithGlobalObject(globalObject, structure)
     {
     }
 
 #ifndef NDEBUG
-    virtual ~DOMObject();
+    virtual ~JSDOMWrapper();
 #endif
 };
 
diff --git a/Source/WebCore/bindings/js/JSDataGridDataSource.h b/Source/WebCore/bindings/js/JSDataGridDataSource.h
index 684a663..f82ff63 100644
--- a/Source/WebCore/bindings/js/JSDataGridDataSource.h
+++ b/Source/WebCore/bindings/js/JSDataGridDataSource.h
@@ -29,7 +29,7 @@
 #if ENABLE(DATAGRID)
 
 #include "DataGridDataSource.h"
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <runtime/JSValue.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
diff --git a/Source/WebCore/bindings/js/JSDataViewCustom.cpp b/Source/WebCore/bindings/js/JSDataViewCustom.cpp
index eaf57bd..48d56d8 100644
--- a/Source/WebCore/bindings/js/JSDataViewCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDataViewCustom.cpp
@@ -44,7 +44,7 @@ enum DataViewAccessType {
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, DataView* object)
 {
-    return getDOMObjectWrapper<JSDataView>(exec, globalObject, object);
+    return wrap<JSDataView>(exec, globalObject, object);
 }
 
 EncodedJSValue JSC_HOST_CALL JSDataViewConstructor::constructJSDataView(ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp b/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
index ceb3ccb..82d7c1f 100644
--- a/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
@@ -38,7 +38,7 @@
 #include "JSDOMBinding.h"
 #include "JSEntryCallback.h"
 #include "JSErrorCallback.h"
-#include "JSFlags.h"
+#include "JSWebKitFlags.h"
 #include <wtf/Assertions.h>
 
 using namespace JSC;
@@ -58,16 +58,16 @@ JSValue JSDirectoryEntry::getFile(ExecState* exec)
         return jsUndefined();
     }
 
-    RefPtr<Flags> flags;
-    if (!exec->argument(1).isNull() && !exec->argument(1).isUndefined() && exec->argument(1).isObject() && !exec->argument(1).inherits(&JSFlags::s_info)) {
+    RefPtr<WebKitFlags> flags;
+    if (!exec->argument(1).isNull() && !exec->argument(1).isUndefined() && exec->argument(1).isObject() && !exec->argument(1).inherits(&JSWebKitFlags::s_info)) {
         JSObject* object = exec->argument(1).getObject();
-        flags = Flags::create();
+        flags = WebKitFlags::create();
         JSValue jsCreate = object->get(exec, Identifier(exec, "create"));
         flags->setCreate(jsCreate.toBoolean(exec));
         JSValue jsExclusive = object->get(exec, Identifier(exec, "exclusive"));
         flags->setExclusive(jsExclusive.toBoolean(exec));
     } else
-        flags = toFlags(exec->argument(1));
+        flags = toWebKitFlags(exec->argument(1));
     if (exec->hadException())
         return jsUndefined();
     RefPtr<EntryCallback> successCallback;
@@ -104,16 +104,16 @@ JSValue JSDirectoryEntry::getDirectory(ExecState* exec)
         return jsUndefined();
     }
 
-    RefPtr<Flags> flags;
-    if (!exec->argument(1).isNull() && !exec->argument(1).isUndefined() && exec->argument(1).isObject() && !exec->argument(1).inherits(&JSFlags::s_info)) {
+    RefPtr<WebKitFlags> flags;
+    if (!exec->argument(1).isNull() && !exec->argument(1).isUndefined() && exec->argument(1).isObject() && !exec->argument(1).inherits(&JSWebKitFlags::s_info)) {
         JSObject* object = exec->argument(1).getObject();
-        flags = Flags::create();
+        flags = WebKitFlags::create();
         JSValue jsCreate = object->get(exec, Identifier(exec, "create"));
         flags->setCreate(jsCreate.toBoolean(exec));
         JSValue jsExclusive = object->get(exec, Identifier(exec, "exclusive"));
         flags->setExclusive(jsExclusive.toBoolean(exec));
     } else
-        flags = toFlags(exec->argument(1));
+        flags = toWebKitFlags(exec->argument(1));
     if (exec->hadException())
         return jsUndefined();
     RefPtr<EntryCallback> successCallback;
diff --git a/Source/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp b/Source/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp
index ef14b79..21006ab 100644
--- a/Source/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp
@@ -38,23 +38,23 @@
 #include "JSEntryCallback.h"
 #include "JSErrorCallback.h"
 #include "JSFileEntrySync.h"
-#include "JSFlags.h"
+#include "JSWebKitFlags.h"
 #include <wtf/Assertions.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-static PassRefPtr<Flags> getFlags(ExecState* exec, const JSValue& argument)
+static PassRefPtr<WebKitFlags> getFlags(ExecState* exec, const JSValue& argument)
 {
     if (argument.isNull() || argument.isUndefined() || !argument.isObject())
         return 0;
-    if (argument.inherits(&JSFlags::s_info))
+    if (argument.inherits(&JSWebKitFlags::s_info))
         return toFlags(argument);
 
-    RefPtr<Flags> flags;
+    RefPtr<WebKitFlags> flags;
     JSObject* object = argument.getObject();
-    flags = Flags::create();
+    flags = WebKitFlags::create();
     JSValue jsCreate = object->get(exec, Identifier(exec, "create"));
     flags->setCreate(jsCreate.toBoolean(exec));
     JSValue jsExclusive = object->get(exec, Identifier(exec, "exclusive"));
@@ -69,7 +69,7 @@ JSValue JSDirectoryEntrySync::getFile(ExecState* exec)
     if (exec->hadException())
         return jsUndefined();
 
-    RefPtr<Flags> flags = getFlags(exec, exec->argument(1));
+    RefPtr<WebKitFlags> flags = getFlags(exec, exec->argument(1));
     if (exec->hadException())
         return jsUndefined();
 
@@ -86,7 +86,7 @@ JSValue JSDirectoryEntrySync::getDirectory(ExecState* exec)
     if (exec->hadException())
         return jsUndefined();
 
-    RefPtr<Flags> flags = getFlags(exec, exec->argument(1));
+    RefPtr<WebKitFlags> flags = getFlags(exec, exec->argument(1));
     if (exec->hadException())
         return jsUndefined();
 
diff --git a/Source/WebCore/bindings/js/JSDocumentCustom.cpp b/Source/WebCore/bindings/js/JSDocumentCustom.cpp
index fa2b93c..65641cc 100644
--- a/Source/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -55,11 +55,9 @@ void JSDocument::markChildren(MarkStack& markStack)
     Document* document = impl();
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
-    markDOMNodesForDocument(markStack, document);
     markActiveObjectsForContext(markStack, globalData, document);
     markDOMObjectWrapper(markStack, globalData, document->implementation());
     markDOMObjectWrapper(markStack, globalData, document->styleSheets());
-    document->markCachedNodeLists(markStack, globalData);
 }
 
 JSValue JSDocument::location(ExecState* exec) const
@@ -69,11 +67,11 @@ JSValue JSDocument::location(ExecState* exec) const
         return jsNull();
 
     Location* location = frame->domWindow()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
+    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), location))
         return wrapper;
 
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, globalObject()), globalObject(), location);
-    cacheDOMObjectWrapper(exec, location, jsLocation);
+    cacheWrapper(currentWorld(exec), location, jsLocation);
     return jsLocation;
 }
 
@@ -101,7 +99,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* documen
     if (!document)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMNodeWrapper(exec, document, document);
+    JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), document);
     if (wrapper)
         return wrapper;
 
diff --git a/Source/WebCore/bindings/js/JSElementCustom.cpp b/Source/WebCore/bindings/js/JSElementCustom.cpp
index 9ed3739..4bedf3a 100644
--- a/Source/WebCore/bindings/js/JSElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSElementCustom.cpp
@@ -71,7 +71,7 @@ JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Eleme
     if (!element)
         return jsNull();
 
-    ASSERT(!getCachedDOMNodeWrapper(exec, element->document(), element));
+    ASSERT(!getCachedWrapper(currentWorld(exec), element));
 
     JSNode* wrapper;        
     if (element->isHTMLElement())
diff --git a/Source/WebCore/bindings/js/JSEventCustom.cpp b/Source/WebCore/bindings/js/JSEventCustom.cpp
index 9e95e74..9763b4b 100644
--- a/Source/WebCore/bindings/js/JSEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSEventCustom.cpp
@@ -101,6 +101,8 @@
 #if ENABLE(WEB_AUDIO)
 #include "AudioProcessingEvent.h"
 #include "JSAudioProcessingEvent.h"
+#include "JSOfflineAudioCompletionEvent.h"
+#include "OfflineAudioCompletionEvent.h"
 #endif
 
 using namespace JSC;
@@ -119,7 +121,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     if (!event)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, event);
+    JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), event);
     if (wrapper)
         return wrapper;
 
@@ -190,6 +192,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
 #if ENABLE(WEB_AUDIO)
     else if (event->isAudioProcessingEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, AudioProcessingEvent, event);
+    else if (event->isOfflineAudioCompletionEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, OfflineAudioCompletionEvent, event);
 #endif
 #if ENABLE(INPUT_SPEECH)
     else if (event->isSpeechInputEvent())
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index e444d88..436251e 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -25,6 +25,7 @@
 #include "JSEvent.h"
 #include "JSEventTarget.h"
 #include "JSMainThreadExecState.h"
+#include "WorkerContext.h"
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -38,7 +39,11 @@ JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isA
     , m_isAttribute(isAttribute)
     , m_isolatedWorld(isolatedWorld)
 {
-    m_jsFunction.set(*m_isolatedWorld->globalData(), wrapper, function);
+    if (wrapper)
+        m_jsFunction.set(*m_isolatedWorld->globalData(), wrapper, function);
+    else
+        ASSERT(!function);
+
 }
 
 JSEventListener::~JSEventListener()
@@ -60,7 +65,7 @@ void JSEventListener::markJSFunction(MarkStack& markStack)
 void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext, Event* event)
 {
     ASSERT(scriptExecutionContext);
-    if (!scriptExecutionContext || scriptExecutionContext->isJSExecutionTerminated())
+    if (!scriptExecutionContext || scriptExecutionContext->isJSExecutionForbidden())
         return;
 
     JSLock lock(SilenceAssertionsOnly);
@@ -126,6 +131,14 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
         globalObject->setCurrentEvent(savedEvent);
 
+#if ENABLE(WORKERS)
+        if (scriptExecutionContext->isWorkerContext()) {
+            bool terminatorCausedException = (exec->hadException() && exec->exception().isObject() && asObject(exec->exception())->exceptionType() == Terminated);
+            if (terminatorCausedException || globalData.terminator.shouldTerminate())
+                static_cast<WorkerContext*>(scriptExecutionContext)->script()->forbidExecution();
+        }
+#endif
+
         if (exec->hadException()) {
             event->target()->uncaughtExceptionInEventHandler();
             reportCurrentException(exec);
diff --git a/Source/WebCore/bindings/js/JSEventListener.h b/Source/WebCore/bindings/js/JSEventListener.h
index 0af0f86..a599be7 100644
--- a/Source/WebCore/bindings/js/JSEventListener.h
+++ b/Source/WebCore/bindings/js/JSEventListener.h
@@ -22,7 +22,7 @@
 
 #include "EventListener.h"
 #include "JSDOMWindow.h"
-#include <runtime/WeakGCPtr.h>
+#include <heap/Weak.h>
 
 namespace WebCore {
 
@@ -66,7 +66,7 @@ namespace WebCore {
 
     private:
         mutable JSC::WriteBarrier<JSC::JSObject> m_jsFunction;
-        mutable JSC::WeakGCPtr<JSC::JSObject> m_wrapper;
+        mutable JSC::Weak<JSC::JSObject> m_wrapper;
 
         bool m_isAttribute;
         RefPtr<DOMWrapperWorld> m_isolatedWorld;
diff --git a/Source/WebCore/bindings/js/JSEventTarget.cpp b/Source/WebCore/bindings/js/JSEventTarget.cpp
index e4d6724..3ccdd6f 100644
--- a/Source/WebCore/bindings/js/JSEventTarget.cpp
+++ b/Source/WebCore/bindings/js/JSEventTarget.cpp
@@ -84,6 +84,8 @@
 #endif
 
 #if ENABLE(WEB_AUDIO)
+#include "AudioContext.h"
+#include "JSAudioContext.h"
 #include "JSJavaScriptAudioNode.h"
 #include "JavaScriptAudioNode.h"
 #endif
@@ -173,6 +175,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 #if ENABLE(WEB_AUDIO)
     if (JavaScriptAudioNode* jsAudioNode = target->toJavaScriptAudioNode())
         return toJS(exec, globalObject, jsAudioNode);
+    if (AudioContext* audioContext = target->toAudioContext())
+        return toJS(exec, globalObject, audioContext);
 #endif
 
 #if ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/bindings/js/JSGeolocationCustom.cpp b/Source/WebCore/bindings/js/JSGeolocationCustom.cpp
index 248adcf..b93c4ce 100644
--- a/Source/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -28,14 +28,13 @@
 
 #if ENABLE(GEOLOCATION)
 
+#include "CallbackFunction.h"
 #include "DOMWindow.h"
-#include "ExceptionCode.h"
 #include "Geolocation.h"
 #include "JSCustomPositionCallback.h"
 #include "JSCustomPositionErrorCallback.h"
 #include "JSDOMWindow.h"
 #include "PositionOptions.h"
-#include <runtime/JSFunction.h>
 
 #if !ENABLE(CLIENT_BASED_GEOLOCATION)
 #include "GeolocationService.h"
@@ -46,36 +45,6 @@ using namespace std;
 
 namespace WebCore {
 
-static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
-{
-    // The spec specifies 'FunctionOnly' for this object.
-    // FIXME: This check disallows callable objects created via JSC API. It's not clear what exactly the specification intends to allow.
-    if (!value.inherits(&JSFunction::s_info)) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return 0;
-    }
-
-    JSObject* object = asObject(value);
-    return JSCustomPositionCallback::create(object, globalObject);
-}
-
-static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
-{
-    // Argument is optional (hence undefined is allowed), and null is allowed.
-    if (value.isUndefinedOrNull())
-        return 0;
-
-    // The spec specifies 'FunctionOnly' for this object.
-    // FIXME: This check disallows callable objects created via JSC API. It's not clear what exactly the specification intends to allow.
-    if (!value.inherits(&JSFunction::s_info)) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return 0;
-    }
-
-    JSObject* object = asObject(value);
-    return JSCustomPositionErrorCallback::create(object, globalObject);
-}
-
 static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
 {
     // Create default options.
@@ -144,12 +113,12 @@ JSValue JSGeolocation::getCurrentPosition(ExecState* exec)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
 
-    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(0));
+    RefPtr<PositionCallback> positionCallback = createFunctionOnlyCallback<JSCustomPositionCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(0));
     if (exec->hadException())
         return jsUndefined();
     ASSERT(positionCallback);
 
-    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(1));
+    RefPtr<PositionErrorCallback> positionErrorCallback = createFunctionOnlyCallback<JSCustomPositionErrorCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(1), CallbackAllowUndefined | CallbackAllowNull);
     if (exec->hadException())
         return jsUndefined();
 
@@ -166,12 +135,12 @@ JSValue JSGeolocation::watchPosition(ExecState* exec)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
 
-    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(0));
+    RefPtr<PositionCallback> positionCallback = createFunctionOnlyCallback<JSCustomPositionCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(0));
     if (exec->hadException())
         return jsUndefined();
     ASSERT(positionCallback);
 
-    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(1));
+    RefPtr<PositionErrorCallback> positionErrorCallback = createFunctionOnlyCallback<JSCustomPositionErrorCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(1), CallbackAllowUndefined | CallbackAllowNull);
     if (exec->hadException())
         return jsUndefined();
 
diff --git a/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index 6b2f350..622a15a 100644
--- a/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -134,7 +134,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, HTMLCollection* c
     if (!collection)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, collection);
+    JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), collection);
 
     if (wrapper)
         return wrapper;
diff --git a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index 192ef5d..c33f859 100644
--- a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -86,7 +86,7 @@ JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, const Iden
 JSValue JSHTMLDocument::all(ExecState* exec) const
 {
     // If "all" has been overwritten, return the overwritten value
-    JSValue v = getDirect(Identifier(exec, "all"));
+    JSValue v = getDirect(exec->globalData(), Identifier(exec, "all"));
     if (v)
         return v;
 
diff --git a/Source/WebCore/bindings/js/JSImageConstructor.h b/Source/WebCore/bindings/js/JSImageConstructor.h
index 654e223..4ef405d 100644
--- a/Source/WebCore/bindings/js/JSImageConstructor.h
+++ b/Source/WebCore/bindings/js/JSImageConstructor.h
@@ -29,7 +29,7 @@ namespace WebCore {
     public:
         JSImageConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/WebCore/bindings/js/JSImageDataCustom.cpp b/Source/WebCore/bindings/js/JSImageDataCustom.cpp
index a92ed47..fb955b1 100644
--- a/Source/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/Source/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -41,15 +41,15 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     if (!imageData)
         return jsNull();
     
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, imageData);
+    JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), imageData);
     if (wrapper)
         return wrapper;
     
     wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ImageData, imageData);
     Identifier dataName(exec, "data");
     static const ClassInfo cpaClassInfo = { "CanvasPixelArray", &JSByteArray::Base::s_info, 0, 0 };
-    DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(exec->globalData(), jsNull(), &cpaClassInfo)));
-    wrapper->putDirect(exec->globalData(), dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data()), DontDelete | ReadOnly);
+    DEFINE_STATIC_LOCAL(Strong<Structure>, cpaStructure, (exec->globalData(), JSByteArray::createStructure(exec->globalData(), jsNull(), &cpaClassInfo)));
+    wrapper->putDirect(exec->globalData(), dataName, new (exec) JSByteArray(exec, cpaStructure.get(), imageData->data()->data()), DontDelete | ReadOnly);
     exec->heap()->reportExtraMemoryCost(imageData->data()->length());
     
     return wrapper;
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index d56251f..2453215 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -70,6 +70,7 @@ Node* InjectedScriptHost::scriptValueAsNode(ScriptValue value)
 
 ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node)
 {
+    JSLock lock(SilenceAssertionsOnly);
     return ScriptValue(state->globalData(), toJS(state, node));
 }
 
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
index 1843cd2..b784e6a 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
@@ -85,14 +85,14 @@ InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState* scriptState
     JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
     JSObject* injectedScript = globalObject->injectedScript();
     if (injectedScript)
-        return InjectedScript(ScriptObject(scriptState, injectedScript));
+        return InjectedScript(ScriptObject(scriptState, injectedScript), m_inspectedStateAccessCheck);
 
-    if (!canAccessInspectedWindow(scriptState))
+    if (!m_inspectedStateAccessCheck(scriptState))
         return InjectedScript();
 
     pair<long, ScriptObject> injectedScriptObject = injectScript(injectedScriptSource(), scriptState);
     globalObject->setInjectedScript(injectedScriptObject.second.jsObject());
-    InjectedScript result(injectedScriptObject.second);
+    InjectedScript result(injectedScriptObject.second, m_inspectedStateAccessCheck);
     m_idToInjectedScript.set(injectedScriptObject.first, result);
     return result;
 }
diff --git a/Source/WebCore/bindings/js/JSMessageEventCustom.cpp b/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
index b3dabae..9dfc70a 100644
--- a/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -60,6 +60,8 @@ JSC::JSValue JSMessageEvent::initMessageEvent(JSC::ExecState* exec)
     bool canBubbleArg = exec->argument(1).toBoolean(exec);
     bool cancelableArg = exec->argument(2).toBoolean(exec);
     PassRefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(exec, exec->argument(3));
+    if (exec->hadException())
+        return jsUndefined();
     const UString& originArg = exec->argument(4).toString(exec);
     const UString& lastEventIdArg = exec->argument(5).toString(exec);
     DOMWindow* sourceArg = toDOMWindow(exec->argument(6));
diff --git a/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 8df9304..9b06767 100644
--- a/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -27,7 +27,6 @@
 #include "JSNamedNodeMap.h"
 
 #include "JSNode.h"
-
 #include "Element.h"
 #include "NamedNodeMap.h"
 
@@ -35,6 +34,40 @@ using namespace JSC;
 
 namespace WebCore {
 
+class JSNamedNodeMapOwner : public JSC::WeakHandleOwner {
+    virtual bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::MarkStack&);
+    virtual void finalize(JSC::Handle<JSC::Unknown>, void* context);
+};
+
+bool JSNamedNodeMapOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handle, void*, MarkStack& markStack)
+{
+    JSNamedNodeMap* jsNamedNodeMap = static_cast<JSNamedNodeMap*>(handle.get().asCell());
+    if (!jsNamedNodeMap->hasCustomProperties())
+        return false;
+    Element* element = jsNamedNodeMap->impl()->element();
+    if (!element)
+        return false;
+    return markStack.containsOpaqueRoot(root(element));
+}
+
+void JSNamedNodeMapOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
+{
+    JSNamedNodeMap* jsNamedNodeMap = static_cast<JSNamedNodeMap*>(handle.get().asCell());
+    DOMWrapperWorld* world = static_cast<DOMWrapperWorld*>(context);
+    uncacheWrapper(world, jsNamedNodeMap->impl(), jsNamedNodeMap);
+}
+
+inline JSC::WeakHandleOwner* wrapperOwner(DOMWrapperWorld*, NamedNodeMap*)
+{
+    DEFINE_STATIC_LOCAL(JSNamedNodeMapOwner, jsNamedNodeMapOwner, ());
+    return &jsNamedNodeMapOwner;
+}
+
+inline void* wrapperContext(DOMWrapperWorld* world, NamedNodeMap*)
+{
+    return world;
+}
+
 bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Identifier& propertyName)
 {
     return impl->getNamedItem(identifierToString(propertyName));
@@ -50,10 +83,19 @@ void JSNamedNodeMap::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    // Mark the element so that this will work to access the attribute even if the last
-    // other reference goes away.
-    if (Element* element = impl()->element())
-        markDOMNodeWrapper(markStack, element->document(), element);
+    // We need to keep the wrapper for our underlying NamedNodeMap's element
+    // alive because NamedNodeMap and Attr rely on the element for data, and
+    // don't know how to keep it alive correctly.
+    // FIXME: Fix this lifetime issue in the DOM, and remove this.
+    Element* element = impl()->element();
+    if (!element)
+        return;
+    markStack.addOpaqueRoot(root(element));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, NamedNodeMap* impl)
+{
+    return wrap<JSNamedNodeMap>(exec, globalObject, impl);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSNavigatorCustom.cpp b/Source/WebCore/bindings/js/JSNavigatorCustom.cpp
index c8429ed..26e93e3 100644
--- a/Source/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNavigatorCustom.cpp
@@ -23,7 +23,13 @@
 #include "config.h"
 #include "JSNavigator.h"
 
+<<<<<<< HEAD
 #include "ExceptionCode.h"
+=======
+#include "CallbackFunction.h"
+#include "JSNavigatorUserMediaErrorCallback.h"
+#include "JSNavigatorUserMediaSuccessCallback.h"
+>>>>>>> WebKit.org at r84325
 #include "Navigator.h"
 #include <runtime/InternalFunction.h>
 
@@ -44,6 +50,7 @@ void JSNavigator::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalGeolocation());
 }
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID) && ENABLE(APPLICATION_INSTALLED)
 
 JSC::JSValue  WebCore::JSNavigator::isApplicationInstalled(JSC::ExecState* exec)
@@ -75,5 +82,28 @@ JSC::JSValue  WebCore::JSNavigator::isApplicationInstalled(JSC::ExecState* exec)
 }
 
 #endif
+=======
+#if ENABLE(MEDIA_STREAM)
+JSValue JSNavigator::webkitGetUserMedia(ExecState* exec)
+{
+    // Arguments: Options, successCallback, (optional)errorCallback
+
+    String options = ustringToString(exec->argument(0).toString(exec));
+    if (exec->hadException())
+        return jsUndefined();
+
+    RefPtr<NavigatorUserMediaSuccessCallback> successCallback = createFunctionOnlyCallback<JSNavigatorUserMediaSuccessCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(1));
+    if (exec->hadException())
+        return jsUndefined();
+
+    RefPtr<NavigatorUserMediaErrorCallback> errorCallback = createFunctionOnlyCallback<JSNavigatorUserMediaErrorCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(2), CallbackAllowUndefined);
+    if (exec->hadException())
+        return jsUndefined();
+
+    m_impl->webkitGetUserMedia(options, successCallback.release(), errorCallback.release());
+    return jsUndefined();
+}
+#endif // ENABLE(MEDIA_STREAM)
+>>>>>>> WebKit.org at r84325
 
 }
diff --git a/Source/WebCore/bindings/js/JSNodeCustom.cpp b/Source/WebCore/bindings/js/JSNodeCustom.cpp
index 17f57f4..d305be7 100644
--- a/Source/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeCustom.cpp
@@ -35,7 +35,15 @@
 #include "Entity.h"
 #include "EntityReference.h"
 #include "ExceptionCode.h"
+#include "HTMLAudioElement.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLElement.h"
+#include "HTMLFrameElementBase.h"
+#include "HTMLImageElement.h"
+#include "HTMLLinkElement.h"
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
+#include "HTMLStyleElement.h"
 #include "JSAttr.h"
 #include "JSCDATASection.h"
 #include "JSComment.h"
@@ -55,6 +63,8 @@
 #include "Notation.h"
 #include "ProcessingInstruction.h"
 #include "RegisteredEventListener.h"
+#include "StyleSheet.h"
+#include "StyledElement.h"
 #include "Text.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -68,6 +78,114 @@ using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static bool isObservable(JSNode* jsNode, Node* node, DOMWrapperWorld* world)
+{
+    // Certain conditions implicitly make existence of a JS DOM node wrapper observable
+    // through the DOM, even if no explicit reference to it remains.
+    
+    // The DOM doesn't know how to keep a tree of nodes alive without the root
+    // being explicitly referenced. So, we artificially treat the root of
+    // every tree as observable.
+    // FIXME: Resolve this lifetime issue in the DOM, and remove this inefficiency.
+    if (!node->parentNode())
+        return true;
+
+    // If a node is in the document, and its wrapper has custom properties,
+    // the wrapper is observable because future access to the node through the
+    // DOM must reflect those properties.
+    if (jsNode->hasCustomProperties())
+        return true;
+
+    // If a node is in the document, and has event listeners, its wrapper is
+    // observable because its wrapper is responsible for marking those event listeners.
+    if (node->hasEventListeners())
+        return true;
+
+    // If a node owns another object with a wrapper with custom properties,
+    // the wrapper must be treated as observable, because future access to
+    // those objects through the DOM must reflect those properties.
+    // FIXME: It would be better if this logic could be in the node next to
+    // the custom markChildren functions rather than here.
+    // Note that for some compound objects like stylesheets and CSSStyleDeclarations,
+    // we don't descend to check children for custom properties, and just conservatively
+    // keep the node wrappers protecting them alive.
+    if (node->isElementNode()) {
+        if (node->isStyledElement()) {
+            if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
+                if (world->m_wrappers.get(style))
+                    return true;
+            }
+        }
+        if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
+            if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
+                if (JSDOMWrapper* wrapper = world->m_wrappers.get(context).get()) {
+                    if (wrapper->hasCustomProperties())
+                        return true;
+                }
+            }
+        } else if (static_cast<Element*>(node)->hasTagName(linkTag)) {
+            if (StyleSheet* sheet = static_cast<HTMLLinkElement*>(node)->sheet()) {
+                if (world->m_wrappers.get(sheet))
+                    return true;
+            }
+        } else if (static_cast<Element*>(node)->hasTagName(styleTag)) {
+            if (StyleSheet* sheet = static_cast<HTMLStyleElement*>(node)->sheet()) {
+                if (world->m_wrappers.get(sheet))
+                    return true;
+            }
+        }
+    } else if (node->nodeType() == Node::PROCESSING_INSTRUCTION_NODE) {
+        if (StyleSheet* sheet = static_cast<ProcessingInstruction*>(node)->sheet()) {
+            if (world->m_wrappers.get(sheet))
+                return true;
+        }
+    }
+
+    return false;
+}
+
+static inline bool isReachableFromDOM(JSNode* jsNode, Node* node, DOMWrapperWorld* world, MarkStack& markStack)
+{
+    if (!node->inDocument()) {
+        // If a wrapper is the last reference to an image or script element
+        // that is loading but not in the document, the wrapper is observable
+        // because it is the only thing keeping the image element alive, and if
+        // the image element is destroyed, its load event will not fire.
+        // FIXME: The DOM should manage this issue without the help of JavaScript wrappers.
+        if (node->hasTagName(imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
+            return true;
+        if (node->hasTagName(scriptTag) && !static_cast<HTMLScriptElement*>(node)->haveFiredLoadEvent())
+            return true;
+    #if ENABLE(VIDEO)
+        if (node->hasTagName(audioTag) && !static_cast<HTMLAudioElement*>(node)->paused())
+            return true;
+    #endif
+
+        // If a node is firing event listeners, its wrapper is observable because
+        // its wrapper is responsible for marking those event listeners.
+        if (node->isFiringEventListeners())
+            return true;
+    }
+
+    return isObservable(jsNode, node, world) && markStack.containsOpaqueRoot(root(node));
+}
+
+bool JSNodeOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handle, void* context, MarkStack& markStack)
+{
+    JSNode* jsNode = static_cast<JSNode*>(handle.get().asCell());
+    DOMWrapperWorld* world = static_cast<DOMWrapperWorld*>(context);
+    return isReachableFromDOM(jsNode, jsNode->impl(), world, markStack);
+}
+
+void JSNodeOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
+{
+    JSNode* jsNode = static_cast<JSNode*>(handle.get().asCell());
+    DOMWrapperWorld* world = static_cast<DOMWrapperWorld*>(context);
+    uncacheWrapper(world, jsNode->impl(), jsNode);
+}
+
 JSValue JSNode::insertBefore(ExecState* exec)
 {
     Node* imp = static_cast<Node*>(impl());
@@ -124,47 +242,13 @@ void JSNode::markChildren(MarkStack& markStack)
     Node* node = m_impl.get();
     node->markJSEventListeners(markStack);
 
-    // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
-    // the document, we need to mark the document, but we don't need to explicitly
-    // mark any other nodes.
-    if (node->inDocument()) {
-        // FIXME: Do we really want to call a virtual function, ownerDocument here,
-        // when the non-virtual inline function, document, is so much faster?!
-        if (Document* doc = node->ownerDocument())
-            markDOMNodeWrapper(markStack, doc, doc);
-        return;
-    }
-
-    // This is a node outside the document.
-    // Find the the root, and the highest ancestor with a wrapper.
-    Node* root = node;
-    Node* outermostNodeWithWrapper = node;
-    for (Node* current = m_impl.get(); current; current = current->parentNode()) {
-        root = current;
-        if (hasCachedDOMNodeWrapperUnchecked(current->document(), current))
-            outermostNodeWithWrapper = current;
-    }
-
-    // Only nodes that have no ancestors with wrappers mark the subtree. In the common
-    // case, the root of the detached subtree has a wrapper, so the tree will only
-    // get marked once. Nodes that aren't outermost need to mark the outermost
-    // in case it is otherwise unreachable.
-    // FIXME: In the non-common case of root not having a wrapper, this is still an O(n^2) algorithm,
-    // as we will traverse the whole tree as many times as there are nodes with wrappers in it.
-    if (node != outermostNodeWithWrapper) {
-        markDOMNodeWrapper(markStack, m_impl->document(), outermostNodeWithWrapper);
-        return;
-    }
-
-    // Mark the whole tree subtree.
-    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode())
-        markDOMNodeWrapper(markStack, m_impl->document(), nodeToMark);
+    markStack.addOpaqueRoot(root(node));
 }
 
 static ALWAYS_INLINE JSValue createWrapperInline(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     ASSERT(node);
-    ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
+    ASSERT(!getCachedWrapper(currentWorld(exec), node));
     
     JSNode* wrapper;    
     switch (node->nodeType()) {
diff --git a/Source/WebCore/bindings/js/JSNodeCustom.h b/Source/WebCore/bindings/js/JSNodeCustom.h
index 9d06ae6..cefa3e3 100644
--- a/Source/WebCore/bindings/js/JSNodeCustom.h
+++ b/Source/WebCore/bindings/js/JSNodeCustom.h
@@ -31,16 +31,45 @@
 
 namespace WebCore {
 
-inline JSNode* getCachedDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node)
+class JSNodeOwner : public JSC::WeakHandleOwner {
+    virtual bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::MarkStack&);
+    virtual void finalize(JSC::Handle<JSC::Unknown>, void* context);
+};
+
+inline JSC::WeakHandleOwner* wrapperOwner(DOMWrapperWorld*, Node*)
+{
+    DEFINE_STATIC_LOCAL(JSNodeOwner, jsNodeOwner, ());
+    return &jsNodeOwner;
+}
+
+inline void* wrapperContext(DOMWrapperWorld* world, Node*)
+{
+    return world;
+}
+
+inline JSDOMWrapper* getInlineCachedWrapper(DOMWrapperWorld* world, Node* node)
+{
+    if (!world->isNormal())
+        return 0;
+    return node->wrapper();
+}
+
+inline bool setInlineCachedWrapper(DOMWrapperWorld* world, Node* node, JSDOMWrapper* wrapper)
 {
-    if (currentWorld(exec)->isNormal()) {
-        ASSERT(node->wrapper() == (document ? document->getWrapperCache(currentWorld(exec))->get(node) : domObjectWrapperMapFor(exec).get(node)));
-        return static_cast<JSNode*>(node->wrapper());
-    }
+    if (!world->isNormal())
+        return false;
+    ASSERT(!node->wrapper());
+    node->setWrapper(*world->globalData(), wrapper, wrapperOwner(world, node), wrapperContext(world, node));
+    return true;
+}
 
-    if (document)
-        return document->getWrapperCache(currentWorld(exec))->get(node);
-    return static_cast<JSNode*>(domObjectWrapperMapFor(exec).get(node));
+inline bool clearInlineCachedWrapper(DOMWrapperWorld* world, Node* node, JSDOMWrapper* wrapper)
+{
+    if (!world->isNormal())
+        return false;
+    ASSERT_UNUSED(wrapper, node->wrapper() == wrapper);
+    node->clearWrapper();
+    return true;
 }
 
 JSC::JSValue createWrapper(JSC::ExecState*, JSDOMGlobalObject*, Node*);
@@ -50,13 +79,23 @@ inline JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject,
     if (!node)
         return JSC::jsNull();
 
-    JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node);
+    JSNode* wrapper = static_cast<JSNode*>(getCachedWrapper(currentWorld(exec), node));
     if (wrapper)
         return wrapper;
 
     return createWrapper(exec, globalObject, node);
 }
 
+static inline Node* root(Node* node)
+{
+    if (node->inDocument())
+        return node->document();
+
+    while (node->parentNode())
+        node = node->parentNode();
+    return node;
+}
+
 }
 
 #endif // JSDOMNodeCustom_h
diff --git a/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp b/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 1cf72a5..927b1a3 100644
--- a/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -32,21 +32,16 @@ using namespace JSC;
 
 ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition);
 
-JSNodeFilterCondition::JSNodeFilterCondition(JSValue filter)
-    : m_filter(filter)
+JSNodeFilterCondition::JSNodeFilterCondition(JSGlobalData& globalData, NodeFilter* owner, JSValue filter)
+    : m_filter(globalData, filter, &m_weakOwner, owner)
 {
 }
 
-void JSNodeFilterCondition::markAggregate(MarkStack& markStack)
-{
-    markStack.append(&m_filter);
-}
-
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    if (!m_filter->isObject())
+    if (!m_filter.isObject())
         return NodeFilter::FILTER_ACCEPT;
 
    // The exec argument here should only be null if this was called from a
@@ -62,7 +57,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     CallData callData;
     CallType callType = getCallData(function, callData);
     if (callType == CallTypeNone) {
-        function = m_filter->get(exec, Identifier(exec, "acceptNode"));
+        function = m_filter.get().get(exec, Identifier(exec, "acceptNode"));
         callType = getCallData(function, callData);
         if (callType == CallTypeNone) {
             throwError(exec, createTypeError(exec, "NodeFilter object does not have an acceptNode function"));
@@ -88,4 +83,9 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     return intResult;
 }
 
+bool JSNodeFilterCondition::WeakOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, MarkStack& markStack)
+{
+    return markStack.containsOpaqueRoot(context);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSNodeFilterCondition.h b/Source/WebCore/bindings/js/JSNodeFilterCondition.h
index 14b0c1d..80148f1 100644
--- a/Source/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/Source/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -21,27 +21,32 @@
 #define JSNodeFilterCondition_h
 
 #include "NodeFilterCondition.h"
+#include <heap/Weak.h>
 #include <runtime/JSValue.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
     class Node;
+    class NodeFilter;
 
     class JSNodeFilterCondition : public NodeFilterCondition {
     public:
-        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValue filter)
+        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSGlobalData& globalData, NodeFilter* owner, JSC::JSValue filter)
         {
-            return adoptRef(new JSNodeFilterCondition(filter));
+            return adoptRef(new JSNodeFilterCondition(globalData, owner, filter));
         }
 
     private:
-        JSNodeFilterCondition(JSC::JSValue filter);
+        JSNodeFilterCondition(JSC::JSGlobalData&, NodeFilter* owner, JSC::JSValue filter);
 
         virtual short acceptNode(ScriptState*, Node*) const;
-        virtual void markAggregate(JSC::MarkStack&);
 
-        mutable JSC::DeprecatedPtr<JSC::Unknown> m_filter;
+        class WeakOwner : public JSC::WeakHandleOwner {
+            virtual bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::MarkStack&);
+        };
+        WeakOwner m_weakOwner;
+        mutable JSC::Weak<JSC::Unknown> m_filter;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp b/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp
index bc79e99..ad4aa7e 100644
--- a/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -39,15 +39,17 @@ namespace WebCore {
 void JSNodeFilter::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    impl()->markAggregate(markStack);
+    markStack.addOpaqueRoot(impl());
 }
 
-PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
+PassRefPtr<NodeFilter> toNodeFilter(JSGlobalData& globalData, JSValue value)
 {
     if (value.inherits(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
-    return NodeFilter::create(JSNodeFilterCondition::create(value));
+    RefPtr<NodeFilter> result = NodeFilter::create();
+    result->setCondition(JSNodeFilterCondition::create(globalData, result.get(), value));
+    return result.release();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSNodeIteratorCustom.cpp b/Source/WebCore/bindings/js/JSNodeIteratorCustom.cpp
index 7c858e5..77f2dc3 100644
--- a/Source/WebCore/bindings/js/JSNodeIteratorCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeIteratorCustom.cpp
@@ -34,7 +34,7 @@ void JSNodeIterator::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     if (NodeFilter* filter = m_impl->filter())
-        filter->markAggregate(markStack);
+        markStack.addOpaqueRoot(filter);
 }
 
 }
diff --git a/Source/WebCore/bindings/js/JSNodeListCustom.cpp b/Source/WebCore/bindings/js/JSNodeListCustom.cpp
index c81914c..a52ac64 100644
--- a/Source/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSNodeList.h"
 
+#include "DynamicNodeList.h"
 #include "JSNode.h"
 #include "Node.h"
 #include "NodeList.h"
@@ -35,6 +36,44 @@ using namespace JSC;
 
 namespace WebCore {
 
+class JSNodeListOwner : public JSC::WeakHandleOwner {
+    virtual bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::MarkStack&);
+    virtual void finalize(JSC::Handle<JSC::Unknown>, void* context);
+};
+
+bool JSNodeListOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handle, void*, MarkStack& markStack)
+{
+    JSNodeList* jsNodeList = static_cast<JSNodeList*>(handle.get().asCell());
+    if (!jsNodeList->hasCustomProperties())
+        return false;
+    if (!jsNodeList->impl()->isDynamicNodeList())
+        return false;
+    return markStack.containsOpaqueRoot(root(static_cast<DynamicNodeList*>(jsNodeList->impl())->rootNode()));
+}
+
+void JSNodeListOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
+{
+    JSNodeList* jsNodeList = static_cast<JSNodeList*>(handle.get().asCell());
+    DOMWrapperWorld* world = static_cast<DOMWrapperWorld*>(context);
+    uncacheWrapper(world, jsNodeList->impl(), jsNodeList);
+}
+
+inline JSC::WeakHandleOwner* wrapperOwner(DOMWrapperWorld*, NodeList*)
+{
+    DEFINE_STATIC_LOCAL(JSNodeListOwner, jsNodeListOwner, ());
+    return &jsNodeListOwner;
+}
+
+inline void* wrapperContext(DOMWrapperWorld* world, NodeList*)
+{
+    return world;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, NodeList* impl)
+{
+    return wrap<JSNodeList>(exec, globalObject, impl);
+}
+
 // Need to support call so that list(0) works.
 static EncodedJSValue JSC_HOST_CALL callNodeList(ExecState* exec)
 {
diff --git a/Source/WebCore/bindings/js/JSOptionConstructor.h b/Source/WebCore/bindings/js/JSOptionConstructor.h
index 8a18007..3317978 100644
--- a/Source/WebCore/bindings/js/JSOptionConstructor.h
+++ b/Source/WebCore/bindings/js/JSOptionConstructor.h
@@ -30,7 +30,7 @@ namespace WebCore {
     public:
         JSOptionConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index dec4be0..defbd5f 100644
--- a/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -28,6 +28,7 @@
 #include "JSSVGElementInstance.h"
 
 #if ENABLE(SVG)
+#include "JSNode.h"
 #include "SVGElementInstance.h"
 
 namespace WebCore {
@@ -35,9 +36,7 @@ namespace WebCore {
 void JSSVGElementInstance::markChildren(JSC::MarkStack& markStack)
 {
     Base::markChildren(markStack);
-
-    // Mark the wrapper for our corresponding element, so it can mark its event handlers.
-    markDOMNodeWrapper(markStack, impl()->correspondingElement()->document(), impl()->correspondingElement());
+    markStack.addOpaqueRoot(root(impl()->correspondingElement()));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/Source/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index f0aa86b..dc5eadd 100644
--- a/Source/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/Source/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -63,7 +63,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
     if (!object)
         return jsNull();
 
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
+    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), object))
         return wrapper;
 
     switch (object->pathSegType()) {
diff --git a/Source/WebCore/bindings/js/JSStyleSheetCustom.cpp b/Source/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 04c6561..66e5244 100644
--- a/Source/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/Source/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -40,7 +40,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheet* style
     if (!styleSheet)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, styleSheet);
+    JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), styleSheet);
     if (wrapper)
         return wrapper;
 
diff --git a/Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp b/Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp
index 0c1947f..fc64900 100644
--- a/Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp
+++ b/Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp
@@ -34,7 +34,7 @@ void JSTreeWalker::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     if (NodeFilter* filter = m_impl->filter())
-        filter->markAggregate(markStack);
+        markStack.addOpaqueRoot(filter);
 }
 
 }
diff --git a/Source/WebCore/bindings/js/JSWorkerContextBase.cpp b/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
index c6f86b5..cbf01b7 100644
--- a/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -31,6 +31,7 @@
 
 #include "JSWorkerContextBase.h"
 
+#include "DOMWrapperWorld.h"
 #include "JSDedicatedWorkerContext.h"
 #include "JSSharedWorkerContext.h"
 #include "JSWorkerContext.h"
@@ -44,8 +45,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 
 const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", &JSDOMGlobalObject::s_info, 0, 0 };
 
-JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
-    : JSDOMGlobalObject(structure, normalWorld(*impl->script()->globalData()), this)
+JSWorkerContextBase::JSWorkerContextBase(JSC::JSGlobalData& globalData, JSC::Structure* structure, PassRefPtr<WorkerContext> impl)
+    : JSDOMGlobalObject(globalData, structure, normalWorld(globalData), this)
     , m_impl(impl)
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/WebCore/bindings/js/JSWorkerContextBase.h b/Source/WebCore/bindings/js/JSWorkerContextBase.h
index b9c234a..af68b58 100644
--- a/Source/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/Source/WebCore/bindings/js/JSWorkerContextBase.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class JSWorkerContextBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     public:
-        JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
+        JSWorkerContextBase(JSC::JSGlobalData&, JSC::Structure*, PassRefPtr<WorkerContext>);
         virtual ~JSWorkerContextBase();
 
         static const JSC::ClassInfo s_info;
@@ -49,7 +49,7 @@ namespace WebCore {
         WorkerContext* impl() const { return m_impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+        static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
             return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
diff --git a/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp b/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 8c1caef..1103d0b 100644
--- a/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -122,7 +122,8 @@ JSValue JSWorkerContext::importScripts(ExecState* exec)
 
 JSValue JSWorkerContext::setTimeout(ExecState* exec)
 {
-    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, currentWorld(exec));
+    // FIXME: Should we enforce a Content-Security-Policy on workers?
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, currentWorld(exec), 0);
     if (exec->hadException())
         return jsUndefined();
     int delay = exec->argument(1).toInt32(exec);
@@ -131,7 +132,8 @@ JSValue JSWorkerContext::setTimeout(ExecState* exec)
 
 JSValue JSWorkerContext::setInterval(ExecState* exec)
 {
-    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, currentWorld(exec));
+    // FIXME: Should we enforce a Content-Security-Policy on workers?
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, currentWorld(exec), 0);
     if (exec->hadException())
         return jsUndefined();
     int delay = exec->argument(1).toInt32(exec);
diff --git a/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 1d6f1cb..eba5db7 100644
--- a/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -64,10 +64,8 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
     if (Document* responseDocument = m_impl->optionalResponseXML())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), responseDocument);
 
-#if ENABLE(WEBGL) || ENABLE(BLOB)
     if (ArrayBuffer* responseArrayBuffer = m_impl->optionalResponseArrayBuffer())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), responseArrayBuffer);
-#endif
 
 #if ENABLE(XHR_RESPONSE_BLOB)
     if (Blob* responseBlob = m_impl->optionalResponseBlob())
@@ -124,10 +122,8 @@ JSValue JSXMLHttpRequest::send(ExecState* exec)
             impl()->send(toBlob(val), ec);
         else if (val.inherits(&JSDOMFormData::s_info))
             impl()->send(toDOMFormData(val), ec);
-#if ENABLE(WEBGL) || ENABLE(BLOB)
         else if (val.inherits(&JSArrayBuffer::s_info))
             impl()->send(toArrayBuffer(val), ec);
-#endif
         else
             impl()->send(ustringToString(val.toString(exec)), ec);
     }
@@ -189,7 +185,6 @@ JSValue JSXMLHttpRequest::response(ExecState* exec) const
 #endif
 
     case XMLHttpRequest::ResponseTypeArrayBuffer:
-#if ENABLE(WEBGL) || ENABLE(BLOB)
         {
             ExceptionCode ec = 0;
             ArrayBuffer* arrayBuffer = impl()->responseArrayBuffer(ec);
@@ -199,9 +194,6 @@ JSValue JSXMLHttpRequest::response(ExecState* exec) const
             }
             return toJS(exec, globalObject(), arrayBuffer);
         }
-#else
-        return jsUndefined();
-#endif
     }
 
     return jsUndefined();
diff --git a/Source/WebCore/bindings/js/ScheduledAction.cpp b/Source/WebCore/bindings/js/ScheduledAction.cpp
index f623017..b8a623b 100644
--- a/Source/WebCore/bindings/js/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/js/ScheduledAction.cpp
@@ -24,6 +24,7 @@
 #include "config.h"
 #include "ScheduledAction.h"
 
+#include "ContentSecurityPolicy.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Frame.h"
@@ -46,11 +47,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-PassOwnPtr<ScheduledAction> ScheduledAction::create(ExecState* exec, DOMWrapperWorld* isolatedWorld)
+PassOwnPtr<ScheduledAction> ScheduledAction::create(ExecState* exec, DOMWrapperWorld* isolatedWorld, ContentSecurityPolicy* policy)
 {
     JSValue v = exec->argument(0);
     CallData callData;
     if (getCallData(v, callData) == CallTypeNone) {
+        if (policy && !policy->allowEval())
+            return 0;
         UString string = v.toString(exec);
         if (exec->hadException())
             return 0;
@@ -67,7 +70,7 @@ ScheduledAction::ScheduledAction(ExecState* exec, JSValue function, DOMWrapperWo
     // setTimeout(function, interval, arg0, arg1...).
     // Start at 2 to skip function and interval.
     for (size_t i = 2; i < exec->argumentCount(); ++i)
-        m_args.append(Global<JSC::Unknown>(exec->globalData(), exec->argument(i)));
+        m_args.append(Strong<JSC::Unknown>(exec->globalData(), exec->argument(i)));
 }
 
 void ScheduledAction::execute(ScriptExecutionContext* context)
diff --git a/Source/WebCore/bindings/js/ScheduledAction.h b/Source/WebCore/bindings/js/ScheduledAction.h
index 3adc185..1595758 100644
--- a/Source/WebCore/bindings/js/ScheduledAction.h
+++ b/Source/WebCore/bindings/js/ScheduledAction.h
@@ -22,7 +22,7 @@
 
 #include "JSDOMBinding.h"
 #include "PlatformString.h"
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <runtime/JSCell.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
@@ -34,6 +34,7 @@ namespace JSC {
 namespace WebCore {
 
     class Document;
+    class ContentSecurityPolicy;
     class ScriptExecutionContext;
     class WorkerContext;
 
@@ -44,7 +45,7 @@ namespace WebCore {
     class ScheduledAction {
         WTF_MAKE_NONCOPYABLE(ScheduledAction); WTF_MAKE_FAST_ALLOCATED;
     public:
-        static PassOwnPtr<ScheduledAction> create(JSC::ExecState*, DOMWrapperWorld* isolatedWorld);
+        static PassOwnPtr<ScheduledAction> create(JSC::ExecState*, DOMWrapperWorld* isolatedWorld, ContentSecurityPolicy*);
 
         void execute(ScriptExecutionContext*);
 
@@ -63,8 +64,8 @@ namespace WebCore {
         void execute(WorkerContext*);
 #endif
 
-        JSC::Global<JSC::Unknown> m_function;
-        Vector<JSC::Global<JSC::Unknown> > m_args;
+        JSC::Strong<JSC::Unknown> m_function;
+        Vector<JSC::Strong<JSC::Unknown> > m_args;
         String m_code;
         RefPtr<DOMWrapperWorld> m_isolatedWorld;
     };
diff --git a/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp b/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 5a467f2..1f0953b 100644
--- a/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -54,7 +54,7 @@ ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
     ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
     for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
         JSDOMWindow* window = iter->second->window();
-        m_windows.add(iter->first.get(), Global<JSDOMWindow>(window->globalData(), window));
+        m_windows.add(iter->first.get(), Strong<JSDOMWindow>(window->globalData(), window));
         m_domWindow = window->impl();
     }
 
diff --git a/Source/WebCore/bindings/js/ScriptCachedFrameData.h b/Source/WebCore/bindings/js/ScriptCachedFrameData.h
index 08874d5..a85e16f 100644
--- a/Source/WebCore/bindings/js/ScriptCachedFrameData.h
+++ b/Source/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -32,7 +32,8 @@
 #ifndef ScriptCachedFrameData_h
 #define ScriptCachedFrameData_h
 
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
+#include <wtf/HashMap.h>
 
 namespace WebCore {
     class Frame;
@@ -42,7 +43,7 @@ namespace WebCore {
 
     class ScriptCachedFrameData {
         WTF_MAKE_NONCOPYABLE(ScriptCachedFrameData); WTF_MAKE_FAST_ALLOCATED;
-        typedef HashMap< RefPtr<DOMWrapperWorld>, JSC::Global<JSDOMWindow> > JSDOMWindowSet;
+        typedef HashMap< RefPtr<DOMWrapperWorld>, JSC::Strong<JSDOMWindow> > JSDOMWindowSet;
 
     public:
         ScriptCachedFrameData(Frame*);
diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
index 4b0f44f..45c4faa 100644
--- a/Source/WebCore/bindings/js/ScriptController.cpp
+++ b/Source/WebCore/bindings/js/ScriptController.cpp
@@ -108,8 +108,8 @@ void ScriptController::destroyWindowShell(DOMWrapperWorld* world)
 JSDOMWindowShell* ScriptController::createWindowShell(DOMWrapperWorld* world)
 {
     ASSERT(!m_windowShells.contains(world));
-    Global<JSDOMWindowShell> windowShell(*world->globalData(), new JSDOMWindowShell(m_frame->domWindow(), world));
-    Global<JSDOMWindowShell> windowShell2(windowShell);
+    Strong<JSDOMWindowShell> windowShell(*world->globalData(), new JSDOMWindowShell(m_frame->domWindow(), world));
+    Strong<JSDOMWindowShell> windowShell2(windowShell);
     m_windowShells.add(world, windowShell);
     world->didCreateWindowShell(this);
     return windowShell.get();
diff --git a/Source/WebCore/bindings/js/ScriptController.h b/Source/WebCore/bindings/js/ScriptController.h
index 2ec3872..7a132b3 100644
--- a/Source/WebCore/bindings/js/ScriptController.h
+++ b/Source/WebCore/bindings/js/ScriptController.h
@@ -25,7 +25,7 @@
 #include "JSDOMWindowShell.h"
 #include "ScriptControllerBase.h"
 #include "ScriptInstance.h"
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 
@@ -64,7 +64,7 @@ typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
 class ScriptController {
     friend class ScriptCachedFrameData;
-    typedef WTF::HashMap< RefPtr<DOMWrapperWorld>, JSC::Global<JSDOMWindowShell> > ShellMap;
+    typedef WTF::HashMap< RefPtr<DOMWrapperWorld>, JSC::Strong<JSDOMWindowShell> > ShellMap;
 
 public:
     ScriptController(Frame*);
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index 05c0f2c..88e685f 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -112,7 +112,7 @@ bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, const TextPosition0& po
     if (lineNumber <= 0)
         return false;
     LineToBreakpointMap::const_iterator breakIt = it->second.find(lineNumber);
-    if (breakIt == it->second.end() || !breakIt->second.enabled)
+    if (breakIt == it->second.end())
         return false;
 
     // An empty condition counts as no condition which is equivalent to "true".
@@ -189,7 +189,7 @@ void ScriptDebugServer::stepOutOfFunction()
     m_doneProcessingDebuggerEvents = true;
 }
 
-bool ScriptDebugServer::editScriptSource(const String&, const String&, String&)
+bool ScriptDebugServer::editScriptSource(const String&, const String&, String*)
 {
     // FIXME(40300): implement this.
     return false;
@@ -214,7 +214,7 @@ void ScriptDebugServer::dispatchDidContinue(ScriptDebugListener* listener)
     listener->didContinue();
 }
 
-void ScriptDebugServer::dispatchDidParseSource(const ListenerSet& listeners, SourceProvider* sourceProvider, ScriptWorldType worldType)
+void ScriptDebugServer::dispatchDidParseSource(const ListenerSet& listeners, SourceProvider* sourceProvider, bool isContentScript)
 {
     String sourceID = ustringToString(JSC::UString::number(sourceProvider->asID()));
     String url = ustringToString(sourceProvider->url());
@@ -225,7 +225,7 @@ void ScriptDebugServer::dispatchDidParseSource(const ListenerSet& listeners, Sou
     Vector<ScriptDebugListener*> copy;
     copyToVector(listeners, copy);
     for (size_t i = 0; i < copy.size(); ++i)
-        copy[i]->didParseSource(sourceID, url, data, lineOffset, columnOffset, worldType);
+        copy[i]->didParseSource(sourceID, url, data, lineOffset, columnOffset, isContentScript);
 }
 
 void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners, SourceProvider* sourceProvider, int errorLine, const String& errorMessage)
@@ -240,11 +240,9 @@ void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners
         copy[i]->failedToParseSource(url, data, firstLine, errorLine, errorMessage);
 }
 
-static ScriptWorldType currentWorldType(ExecState* exec)
+static bool isContentScript(ExecState* exec)
 {
-    if (currentWorld(exec) == mainThreadNormalWorld())
-        return MAIN_WORLD;
-    return EXTENSIONS_WORLD;
+    return currentWorld(exec) != mainThreadNormalWorld();
 }
 
 void ScriptDebugServer::detach(JSGlobalObject* globalObject)
@@ -275,10 +273,8 @@ void ScriptDebugServer::sourceParsed(ExecState* exec, SourceProvider* sourceProv
     bool isError = errorLine != -1;
     if (isError)
         dispatchFailedToParseSource(*listeners, sourceProvider, errorLine, ustringToString(errorMessage));
-    else {
-        ScriptWorldType worldType = currentWorldType(exec);
-        dispatchDidParseSource(*listeners, sourceProvider, worldType);
-    }
+    else
+        dispatchDidParseSource(*listeners, sourceProvider, isContentScript(exec));
 
     m_callingListeners = false;
 }
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index e53cb4d..f6ac9a1 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -78,7 +78,7 @@ public:
     void stepOverStatement();
     void stepOutOfFunction();
 
-    bool editScriptSource(const String& sourceID, const String& newContent, String& newSourceOrErrorMessage);
+    bool editScriptSource(const String& sourceID, const String& newContent, String* error);
 
     void recompileAllJSFunctionsSoon();
     virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) = 0;
@@ -102,7 +102,7 @@ protected:
     void dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback);
     void dispatchDidPause(ScriptDebugListener*);
     void dispatchDidContinue(ScriptDebugListener*);
-    void dispatchDidParseSource(const ListenerSet& listeners, JSC::SourceProvider*, enum ScriptWorldType);
+    void dispatchDidParseSource(const ListenerSet& listeners, JSC::SourceProvider*, bool isContentScript);
     void dispatchFailedToParseSource(const ListenerSet& listeners, JSC::SourceProvider*, int errorLine, const String& errorMessage);
 
     void createCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
diff --git a/Source/WebCore/bindings/js/ScriptGCEvent.cpp b/Source/WebCore/bindings/js/ScriptGCEvent.cpp
index dd027b4..b694c7c 100644
--- a/Source/WebCore/bindings/js/ScriptGCEvent.cpp
+++ b/Source/WebCore/bindings/js/ScriptGCEvent.cpp
@@ -34,7 +34,7 @@
 #if ENABLE(INSPECTOR)
 
 #include "JSDOMWindow.h"
-#include <runtime/Heap.h>
+#include <heap/Heap.h>
 #include <runtime/JSGlobalData.h>
 #include <wtf/CurrentTime.h>
 
diff --git a/Source/WebCore/bindings/js/ScriptObject.h b/Source/WebCore/bindings/js/ScriptObject.h
index c10bf18..eb02e9b 100644
--- a/Source/WebCore/bindings/js/ScriptObject.h
+++ b/Source/WebCore/bindings/js/ScriptObject.h
@@ -34,7 +34,7 @@
 #include "ScriptState.h"
 #include "ScriptValue.h"
 
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <runtime/JSObject.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/js/ScriptState.cpp b/Source/WebCore/bindings/js/ScriptState.cpp
index 8a7c9a5..a4b9793 100644
--- a/Source/WebCore/bindings/js/ScriptState.cpp
+++ b/Source/WebCore/bindings/js/ScriptState.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,8 +33,11 @@
 
 #include "Frame.h"
 #include "JSDOMWindowBase.h"
+#include "JSWorkerContext.h"
 #include "Node.h"
 #include "Page.h"
+#include "WorkerContext.h"
+#include "WorkerScriptController.h"
 #include <interpreter/CallFrame.h>
 #include <runtime/JSGlobalObject.h>
 
@@ -83,4 +86,11 @@ ScriptState* scriptStateFromPage(DOMWrapperWorld* world, Page* page)
     return page->mainFrame()->script()->globalObject(world)->globalExec();
 }
 
+#if ENABLE(WORKERS)
+ScriptState* scriptStateFromWorkerContext(WorkerContext* workerContext)
+{
+    return workerContext->script()->workerContextWrapper()->globalExec();
+}
+#endif
+
 }
diff --git a/Source/WebCore/bindings/js/ScriptState.h b/Source/WebCore/bindings/js/ScriptState.h
index f27b306..cdc3fbf 100644
--- a/Source/WebCore/bindings/js/ScriptState.h
+++ b/Source/WebCore/bindings/js/ScriptState.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc.
+ * Copyright (c) 2008, 2011 Google Inc.
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -32,7 +32,7 @@
 #ifndef ScriptState_h
 #define ScriptState_h
 
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -45,6 +45,7 @@ class DOMWrapperWorld;
 class Frame;
 class Node;
 class Page;
+class WorkerContext;
 
 // The idea is to expose "state-like" methods (hadException, and any other
 // methods where ExecState just dips into globalData) of JSC::ExecState as a
@@ -59,7 +60,7 @@ public:
     ~ScriptStateProtectedPtr();
     ScriptState* get() const;
 private:
-    JSC::Global<JSC::JSGlobalObject> m_globalObject;
+    JSC::Strong<JSC::JSGlobalObject> m_globalObject;
 };
 
 ScriptState* mainWorldScriptState(Frame*);
@@ -67,6 +68,10 @@ ScriptState* mainWorldScriptState(Frame*);
 ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
 ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
 
+#if ENABLE(WORKERS)
+ScriptState* scriptStateFromWorkerContext(WorkerContext*);
+#endif
+
 } // namespace WebCore
 
 #endif // ScriptState_h
diff --git a/Source/WebCore/bindings/js/ScriptValue.cpp b/Source/WebCore/bindings/js/ScriptValue.cpp
index 6fe6ea3..4f51ddb 100644
--- a/Source/WebCore/bindings/js/ScriptValue.cpp
+++ b/Source/WebCore/bindings/js/ScriptValue.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (c) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +36,7 @@
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSValueRef.h>
 
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <runtime/JSLock.h>
 #include <runtime/UString.h>
 
@@ -55,6 +56,15 @@ bool ScriptValue::getString(ScriptState* scriptState, String& result) const
     return true;
 }
 
+String ScriptValue::toString(ScriptState* scriptState) const
+{
+    String result = ustringToString(m_value.get().toString(scriptState));
+    // Handle the case where an exception is thrown as part of invoking toString on the object.
+    if (scriptState->hadException())
+        scriptState->clearException();
+    return result;
+}
+
 bool ScriptValue::isEqual(ScriptState* scriptState, const ScriptValue& anotherValue) const
 {
     if (hasNoValue())
@@ -90,14 +100,14 @@ bool ScriptValue::isFunction() const
     return getCallData(m_value.get(), callData) != CallTypeNone;
 }
 
-PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState)
+PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState, SerializationErrorMode throwExceptions)
 {
-    return SerializedScriptValue::create(scriptState, jsValue());
+    return SerializedScriptValue::create(scriptState, jsValue(), throwExceptions);
 }
 
-ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value)
+ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value, SerializationErrorMode throwExceptions)
 {
-    return ScriptValue(scriptState->globalData(), value->deserialize(scriptState, scriptState->lexicalGlobalObject()));
+    return ScriptValue(scriptState->globalData(), value->deserialize(scriptState, scriptState->lexicalGlobalObject(), throwExceptions));
 }
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/ScriptValue.h b/Source/WebCore/bindings/js/ScriptValue.h
index 37cf243..fade830 100644
--- a/Source/WebCore/bindings/js/ScriptValue.h
+++ b/Source/WebCore/bindings/js/ScriptValue.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (c) 2008, 2011 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,8 +33,9 @@
 
 #include "JSDOMBinding.h"
 #include "PlatformString.h"
+#include "SerializedScriptValue.h"
 #include "ScriptState.h"
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <runtime/JSValue.h>
 #include <wtf/PassRefPtr.h>
 
@@ -45,24 +46,24 @@ class SerializedScriptValue;
 
 class ScriptValue {
 public:
-    ScriptValue() : m_value(JSC::Global<JSC::Unknown>::EmptyValue) { }
+    ScriptValue() { }
     ScriptValue(JSC::JSGlobalData& globalData, JSC::JSValue value) : m_value(globalData, value) {}
     virtual ~ScriptValue() {}
 
     JSC::JSValue jsValue() const { return m_value.get(); }
     bool getString(ScriptState*, String& result) const;
-    String toString(ScriptState* scriptState) const { return ustringToString(m_value.get().toString(scriptState)); }
+    String toString(ScriptState*) const;
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
     bool isObject() const;
     bool isFunction() const;
-    bool hasNoValue() const { return m_value.isEmpty(); }
+    bool hasNoValue() const { return !m_value; }
 
     bool operator==(const ScriptValue& other) const { return m_value == other.m_value; }
 
-    PassRefPtr<SerializedScriptValue> serialize(ScriptState*);
-    static ScriptValue deserialize(ScriptState*, SerializedScriptValue*);
+    PassRefPtr<SerializedScriptValue> serialize(ScriptState*, SerializationErrorMode = Throwing);
+    static ScriptValue deserialize(ScriptState*, SerializedScriptValue*, SerializationErrorMode = Throwing);
 
     static ScriptValue undefined();
 
@@ -71,7 +72,7 @@ public:
 #endif
 
 private:
-    JSC::Global<JSC::Unknown> m_value;
+    JSC::Strong<JSC::Unknown> m_value;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/ScriptWrappable.h b/Source/WebCore/bindings/js/ScriptWrappable.h
index 0fbe9e4..4fef506 100644
--- a/Source/WebCore/bindings/js/ScriptWrappable.h
+++ b/Source/WebCore/bindings/js/ScriptWrappable.h
@@ -32,28 +32,29 @@
 #define ScriptWrappable_h
 
 #include "JSDOMWrapper.h"
-#include <runtime/WeakGCPtr.h>
+#include <heap/Weak.h>
 
 namespace WebCore {
 
 class ScriptWrappable {
 public:
-    ScriptWrappable()
+    JSDOMWrapper* wrapper() const
     {
+        return m_wrapper.get();
     }
 
-    DOMObject* wrapper() const
+    void setWrapper(JSC::JSGlobalData& globalData, JSDOMWrapper* wrapper, JSC::WeakHandleOwner* wrapperOwner, void* context)
     {
-        return m_wrapper.get();
+        m_wrapper.set(globalData, wrapper, wrapperOwner, context);
     }
 
-    void setWrapper(JSC::JSGlobalData& globalData, DOMObject* wrapper)
+    void clearWrapper()
     {
-        m_wrapper.set(globalData, wrapper, 0);
+        m_wrapper.clear();
     }
 
 private:
-    JSC::WeakGCPtr<DOMObject> m_wrapper;
+    JSC::Weak<JSDOMWrapper> m_wrapper;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index a9c1b24..bbe0ca4 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -36,6 +36,7 @@
 #include "JSFile.h"
 #include "JSFileList.h"
 #include "JSImageData.h"
+#include "JSNavigator.h"
 #include "SharedBuffer.h"
 #include <limits>
 #include <JavaScriptCore/APICast.h>
@@ -160,6 +161,8 @@ static const unsigned int StringPoolTag = 0xFFFFFFFE;
  *    RegExpTag <pattern:StringData><flags:StringData>
  */
 
+typedef pair<JSC::JSValue, SerializationReturnCode> DeserializationResult;
+
 class CloneBase {
 protected:
     CloneBase(ExecState* exec)
@@ -247,7 +250,7 @@ template <typename T> static bool writeLittleEndian(Vector<uint8_t>& buffer, con
 
 class CloneSerializer : CloneBase {
 public:
-    static bool serialize(ExecState* exec, JSValue value, Vector<uint8_t>& out)
+    static SerializationReturnCode serialize(ExecState* exec, JSValue value, Vector<uint8_t>& out)
     {
         CloneSerializer serializer(exec, out);
         return serializer.serialize(value);
@@ -274,7 +277,7 @@ private:
         write(CurrentVersion);
     }
 
-    bool serialize(JSValue in);
+    SerializationReturnCode serialize(JSValue in);
 
     bool isArray(JSValue value)
     {
@@ -414,6 +417,13 @@ private:
 
         if (isArray(value))
             return false;
+           
+        // Object cannot be serialized because the act of walking the object creates new objects
+        if (value.isObject() && asObject(value)->inherits(&JSNavigator::s_info)) {
+            fail();
+            write(NullTag);
+            return true; 
+        }
 
         if (value.isObject()) {
             JSObject* obj = asObject(value);
@@ -598,7 +608,7 @@ private:
     Identifier m_emptyIdentifier;
 };
 
-bool CloneSerializer::serialize(JSValue in)
+SerializationReturnCode CloneSerializer::serialize(JSValue in)
 {
     Vector<uint32_t, 16> indexStack;
     Vector<uint32_t, 16> lengthStack;
@@ -614,10 +624,8 @@ bool CloneSerializer::serialize(JSValue in)
             arrayStartState:
             case ArrayStartState: {
                 ASSERT(isArray(inValue));
-                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
-                    throwStackOverflow();
-                    return false;
-                }
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion)
+                    return StackOverflowError;
 
                 JSArray* inArray = asArray(inValue);
                 unsigned length = inArray->length();
@@ -631,10 +639,8 @@ bool CloneSerializer::serialize(JSValue in)
             arrayStartVisitMember:
             case ArrayStartVisitMember: {
                 if (!--tickCount) {
-                    if (didTimeOut()) {
-                        throwInterruptedException();
-                        return false;
-                    }
+                    if (didTimeOut())
+                        return InterruptedExecutionError;
                     tickCount = ticksUntilNextCheck();
                 }
 
@@ -673,10 +679,8 @@ bool CloneSerializer::serialize(JSValue in)
             objectStartState:
             case ObjectStartState: {
                 ASSERT(inValue.isObject());
-                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
-                    throwStackOverflow();
-                    return false;
-                }
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion)
+                    return StackOverflowError;
                 JSObject* inObject = asObject(inValue);
                 if (!startObject(inObject))
                     break;
@@ -689,10 +693,8 @@ bool CloneSerializer::serialize(JSValue in)
             objectStartVisitMember:
             case ObjectStartVisitMember: {
                 if (!--tickCount) {
-                    if (didTimeOut()) {
-                        throwInterruptedException();
-                        return false;
-                    }
+                    if (didTimeOut())
+                        return InterruptedExecutionError;
                     tickCount = ticksUntilNextCheck();
                 }
 
@@ -708,7 +710,7 @@ bool CloneSerializer::serialize(JSValue in)
                 }
                 inValue = getProperty(object, properties[index]);
                 if (shouldTerminate())
-                    return false;
+                    return ExistingExceptionError;
 
                 if (!inValue) {
                     // Property was removed during serialisation
@@ -718,7 +720,7 @@ bool CloneSerializer::serialize(JSValue in)
                 write(properties[index]);
 
                 if (shouldTerminate())
-                    return false;
+                    return ExistingExceptionError;
 
                 if (!dumpIfTerminal(inValue)) {
                     stateStack.append(ObjectEndVisitMember);
@@ -728,7 +730,7 @@ bool CloneSerializer::serialize(JSValue in)
             }
             case ObjectEndVisitMember: {
                 if (shouldTerminate())
-                    return false;
+                    return ExistingExceptionError;
 
                 indexStack.last()++;
                 goto objectStartVisitMember;
@@ -749,17 +751,15 @@ bool CloneSerializer::serialize(JSValue in)
         stateStack.removeLast();
 
         if (!--tickCount) {
-            if (didTimeOut()) {
-                throwInterruptedException();
-                return false;
-            }
+            if (didTimeOut())
+                return InterruptedExecutionError;
             tickCount = ticksUntilNextCheck();
         }
     }
     if (m_failed)
-        return false;
+        return UnspecifiedError;
 
-    return true;
+    return SuccessfullyCompleted;
 }
 
 class CloneDeserializer : CloneBase {
@@ -783,15 +783,13 @@ public:
         return String(str.impl());
     }
 
-    static JSValue deserialize(ExecState* exec, JSGlobalObject* globalObject, const Vector<uint8_t>& buffer)
+    static DeserializationResult deserialize(ExecState* exec, JSGlobalObject* globalObject, const Vector<uint8_t>& buffer)
     {
         if (!buffer.size())
-            return jsNull();
+            return make_pair(jsNull(), UnspecifiedError);
         CloneDeserializer deserializer(exec, globalObject, buffer);
-        if (!deserializer.isValid()) {
-            deserializer.throwValidationError();
-            return JSValue();
-        }
+        if (!deserializer.isValid())
+            return make_pair(JSValue(), ValidationError);
         return deserializer.deserialize();
     }
 
@@ -846,7 +844,7 @@ private:
             m_version = 0xFFFFFFFF;
     }
 
-    JSValue deserialize();
+    DeserializationResult deserialize();
 
     void throwValidationError()
     {
@@ -1193,7 +1191,7 @@ private:
     Vector<CachedString> m_constantPool;
 };
 
-JSValue CloneDeserializer::deserialize()
+DeserializationResult CloneDeserializer::deserialize()
 {
     Vector<uint32_t, 16> indexStack;
     Vector<Identifier, 16> propertyNameStack;
@@ -1222,10 +1220,8 @@ JSValue CloneDeserializer::deserialize()
         arrayStartVisitMember:
         case ArrayStartVisitMember: {
             if (!--tickCount) {
-                if (didTimeOut()) {
-                    throwInterruptedException();
-                    return JSValue();
-                }
+                if (didTimeOut())
+                    return make_pair(JSValue(), InterruptedExecutionError);
                 tickCount = ticksUntilNextCheck();
             }
 
@@ -1259,10 +1255,8 @@ JSValue CloneDeserializer::deserialize()
         }
         objectStartState:
         case ObjectStartState: {
-            if (outputObjectStack.size() + outputArrayStack.size() > maximumFilterRecursion) {
-                throwStackOverflow();
-                return JSValue();
-            }
+            if (outputObjectStack.size() + outputArrayStack.size() > maximumFilterRecursion)
+                return make_pair(JSValue(), StackOverflowError);
             JSObject* outObject = constructEmptyObject(m_exec, m_globalObject);
             m_gcBuffer.append(outObject);
             outputObjectStack.append(outObject);
@@ -1271,10 +1265,8 @@ JSValue CloneDeserializer::deserialize()
         objectStartVisitMember:
         case ObjectStartVisitMember: {
             if (!--tickCount) {
-                if (didTimeOut()) {
-                    throwInterruptedException();
-                    return JSValue();
-                }
+                if (didTimeOut())
+                    return make_pair(JSValue(), InterruptedExecutionError);
                 tickCount = ticksUntilNextCheck();
             }
 
@@ -1322,20 +1314,17 @@ JSValue CloneDeserializer::deserialize()
         stateStack.removeLast();
 
         if (!--tickCount) {
-            if (didTimeOut()) {
-                throwInterruptedException();
-                return JSValue();
-            }
+            if (didTimeOut())
+                return make_pair(JSValue(), InterruptedExecutionError);
             tickCount = ticksUntilNextCheck();
         }
     }
     ASSERT(outValue);
     ASSERT(!m_failed);
-    return outValue;
+    return make_pair(outValue, SuccessfullyCompleted);
 error:
     fail();
-    throwValidationError();
-    return JSValue();
+    return make_pair(JSValue(), ValidationError);
 }
 
 
@@ -1349,11 +1338,16 @@ SerializedScriptValue::SerializedScriptValue(Vector<uint8_t>& buffer)
     m_data.swap(buffer);
 }
 
-PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(ExecState* exec, JSValue value)
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(ExecState* exec, JSValue value, SerializationErrorMode throwExceptions)
 {
     Vector<uint8_t> buffer;
-    if (!CloneSerializer::serialize(exec, value, buffer))
+    SerializationReturnCode code = CloneSerializer::serialize(exec, value, buffer);
+    if (throwExceptions == Throwing)
+        maybeThrowExceptionIfSerializationFailed(exec, code);
+
+    if (!serializationDidCompleteSuccessfully(code))
         return 0;
+        
     return adoptRef(new SerializedScriptValue(buffer));
 }
 
@@ -1392,9 +1386,12 @@ String SerializedScriptValue::toString()
     return CloneDeserializer::deserializeString(m_data);
 }
 
-JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* globalObject)
+JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* globalObject, SerializationErrorMode throwExceptions)
 {
-    return CloneDeserializer::deserialize(exec, globalObject, m_data);
+    DeserializationResult result = CloneDeserializer::deserialize(exec, globalObject, m_data);
+    if (throwExceptions == Throwing)
+        maybeThrowExceptionIfSerializationFailed(exec, result.second);
+    return result.first;
 }
 
 JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception)
@@ -1418,4 +1415,33 @@ SerializedScriptValue* SerializedScriptValue::nullValue()
     return emptyValue.get();
 }
 
+void SerializedScriptValue::maybeThrowExceptionIfSerializationFailed(ExecState* exec, SerializationReturnCode code)
+{
+    if (code == SuccessfullyCompleted)
+        return;
+    
+    switch (code) {
+    case StackOverflowError:
+        throwError(exec, createStackOverflowError(exec));
+        break;
+    case InterruptedExecutionError:
+        throwError(exec, createInterruptedExecutionException(&exec->globalData()));
+        break;
+    case ValidationError:
+        throwError(exec, createTypeError(exec, "Unable to deserialize data."));
+        break;
+    case ExistingExceptionError:
+        break;
+    case UnspecifiedError:
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
+
+bool SerializedScriptValue::serializationDidCompleteSuccessfully(SerializationReturnCode code)
+{
+    return (code == SuccessfullyCompleted);
+}
+
 }
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.h b/Source/WebCore/bindings/js/SerializedScriptValue.h
index 94bc477..0e7fed0 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.h
@@ -27,19 +27,34 @@
 #ifndef SerializedScriptValue_h
 #define SerializedScriptValue_h
 
-#include "ScriptValue.h"
+#include <heap/Strong.h>
+#include <runtime/JSValue.h>
 #include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 typedef const struct OpaqueJSContext* JSContextRef;
 typedef const struct OpaqueJSValue* JSValueRef;
 
 namespace WebCore {
 
+ 
+enum SerializationReturnCode {
+    SuccessfullyCompleted,
+    StackOverflowError,
+    InterruptedExecutionError,
+    ValidationError,
+    ExistingExceptionError,
+    UnspecifiedError
+};
+    
+enum SerializationErrorMode { NonThrowing, Throwing };
+
 class SharedBuffer;
 
 class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
 public:
-    static PassRefPtr<SerializedScriptValue> create(JSC::ExecState* exec, JSC::JSValue value);
+    static PassRefPtr<SerializedScriptValue> create(JSC::ExecState*, JSC::JSValue, SerializationErrorMode = Throwing);
     static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef value, JSValueRef* exception);
     static PassRefPtr<SerializedScriptValue> create(String string);
     static PassRefPtr<SerializedScriptValue> adopt(Vector<uint8_t>& buffer)
@@ -50,14 +65,19 @@ public:
     static PassRefPtr<SerializedScriptValue> create();
     static SerializedScriptValue* nullValue();
 
-    JSC::JSValue deserialize(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject);
     String toString();
+    
+    JSC::JSValue deserialize(JSC::ExecState*, JSC::JSGlobalObject*, SerializationErrorMode = Throwing);
     JSValueRef deserialize(JSContextRef, JSValueRef* exception);
+
     const Vector<uint8_t>& data() { return m_data; }
 
     ~SerializedScriptValue();
 
 private:
+    static void maybeThrowExceptionIfSerializationFailed(JSC::ExecState*, SerializationReturnCode);
+    static bool serializationDidCompleteSuccessfully(SerializationReturnCode);
+    
     SerializedScriptValue(Vector<unsigned char>&);
     Vector<unsigned char> m_data;
 };
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index 67b0441..1f29dfc 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -61,6 +61,7 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
 WorkerScriptController::~WorkerScriptController()
 {
     m_workerContextWrapper.clear(); // Unprotect the global object.
+    m_globalData->clearBuiltinStructures();
     m_globalData->heap.destroy();
 }
 
@@ -73,25 +74,25 @@ void WorkerScriptController::initScript()
     // Explicitly protect the global object's prototype so it isn't collected
     // when we allocate the global object. (Once the global object is fully
     // constructed, it can mark its own prototype.)
-    RefPtr<Structure> workerContextPrototypeStructure = JSWorkerContextPrototype::createStructure(*m_globalData, jsNull());
-    Global<JSWorkerContextPrototype> workerContextPrototype(*m_globalData, new (m_globalData.get()) JSWorkerContextPrototype(0, workerContextPrototypeStructure.release()));
+    Structure* workerContextPrototypeStructure = JSWorkerContextPrototype::createStructure(*m_globalData, jsNull());
+    Strong<JSWorkerContextPrototype> workerContextPrototype(*m_globalData, new (m_globalData.get()) JSWorkerContextPrototype(*m_globalData, 0, workerContextPrototypeStructure));
 
     if (m_workerContext->isDedicatedWorkerContext()) {
-        RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(*m_globalData, workerContextPrototype.get());
-        Global<JSDedicatedWorkerContextPrototype> dedicatedContextPrototype(*m_globalData, new (m_globalData.get()) JSDedicatedWorkerContextPrototype(0, dedicatedContextPrototypeStructure.release()));
-        RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(*m_globalData, dedicatedContextPrototype.get());
+        Structure* dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(*m_globalData, workerContextPrototype.get());
+        Strong<JSDedicatedWorkerContextPrototype> dedicatedContextPrototype(*m_globalData, new (m_globalData.get()) JSDedicatedWorkerContextPrototype(*m_globalData, 0, dedicatedContextPrototypeStructure));
+        Structure* structure = JSDedicatedWorkerContext::createStructure(*m_globalData, dedicatedContextPrototype.get());
 
-        m_workerContextWrapper.set(*m_globalData, new (m_globalData.get()) JSDedicatedWorkerContext(structure.release(), m_workerContext->toDedicatedWorkerContext()));
+        m_workerContextWrapper.set(*m_globalData, new (m_globalData.get()) JSDedicatedWorkerContext(*m_globalData, structure, m_workerContext->toDedicatedWorkerContext()));
         workerContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper.get());
         dedicatedContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper.get());
 #if ENABLE(SHARED_WORKERS)
     } else {
         ASSERT(m_workerContext->isSharedWorkerContext());
-        RefPtr<Structure> sharedContextPrototypeStructure = JSSharedWorkerContextPrototype::createStructure(*m_globalData, workerContextPrototype.get());
-        Global<JSSharedWorkerContextPrototype> sharedContextPrototype(*m_globalData, new (m_globalData.get()) JSSharedWorkerContextPrototype(0, sharedContextPrototypeStructure.release()));
-        RefPtr<Structure> structure = JSSharedWorkerContext::createStructure(*m_globalData, sharedContextPrototype.get());
+        Structure* sharedContextPrototypeStructure = JSSharedWorkerContextPrototype::createStructure(*m_globalData, workerContextPrototype.get());
+        Strong<JSSharedWorkerContextPrototype> sharedContextPrototype(*m_globalData, new (m_globalData.get()) JSSharedWorkerContextPrototype(*m_globalData, 0, sharedContextPrototypeStructure));
+        Structure* structure = JSSharedWorkerContext::createStructure(*m_globalData, sharedContextPrototype.get());
 
-        m_workerContextWrapper.set(*m_globalData, new (m_globalData.get()) JSSharedWorkerContext(structure.release(), m_workerContext->toSharedWorkerContext()));
+        m_workerContextWrapper.set(*m_globalData, new (m_globalData.get()) JSSharedWorkerContext(*m_globalData, structure, m_workerContext->toSharedWorkerContext()));
         workerContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper.get());
         sharedContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper.get());
 #endif
@@ -100,11 +101,9 @@ void WorkerScriptController::initScript()
 
 ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
 {
-    {
-        MutexLocker lock(m_sharedDataMutex);
-        if (m_executionForbidden)
-            return ScriptValue();
-    }
+    if (isExecutionForbidden())
+        return ScriptValue();
+
     ScriptValue exception;
     ScriptValue result(evaluate(sourceCode, &exception));
     if (exception.jsValue()) {
@@ -116,11 +115,8 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
 ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, ScriptValue* exception)
 {
-    {
-        MutexLocker lock(m_sharedDataMutex);
-        if (m_executionForbidden)
-            return ScriptValue();
-    }
+    if (isExecutionForbidden())
+        return ScriptValue();
 
     initScriptIfNeeded();
     JSLock lock(SilenceAssertionsOnly);
@@ -130,10 +126,18 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper.get());
     m_workerContextWrapper->globalData().timeoutChecker.stop();
 
-    if (comp.complType() == Normal || comp.complType() == ReturnValue)
+
+    ComplType completionType = comp.complType();
+
+    if (completionType == Terminated || m_workerContextWrapper->globalData().terminator.shouldTerminate()) {
+        forbidExecution();
+        return ScriptValue();
+    }
+
+    if (completionType == Normal || completionType == ReturnValue)
         return ScriptValue(*m_globalData, comp.value());
 
-    if (comp.complType() == Throw) {
+    if (completionType == Throw) {
         String errorMessage;
         int lineNumber = 0;
         String sourceURL = sourceCode.url().string();
@@ -150,16 +154,21 @@ void WorkerScriptController::setException(ScriptValue exception)
     throwError(m_workerContextWrapper->globalExec(), exception.jsValue());
 }
 
-void WorkerScriptController::forbidExecution(ForbidExecutionOption option)
+void WorkerScriptController::scheduleExecutionTermination()
 {
-    // This function may be called from another thread.
-    // Mutex protection for m_executionForbidden is needed to guarantee that the value is synchronized between processors, because
-    // if it were not, the worker could re-enter JSC::evaluate(), but with timeout already reset.
-    // It is not critical for Terminator::m_shouldTerminate to be synchronized, we just rely on it reaching the worker thread's processor sooner or later.
-    MutexLocker lock(m_sharedDataMutex);
+    m_globalData->terminator.terminateSoon();
+}
+
+void WorkerScriptController::forbidExecution()
+{
+    ASSERT(m_workerContext->isContextThread());
     m_executionForbidden = true;
-    if (option == TerminateRunningScript)
-        m_globalData->terminator.terminateSoon();
+}
+
+bool WorkerScriptController::isExecutionForbidden() const
+{
+    ASSERT(m_workerContext->isContextThread());
+    return m_executionForbidden;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.h b/Source/WebCore/bindings/js/WorkerScriptController.h
index c3b8215..0e52988 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.h
+++ b/Source/WebCore/bindings/js/WorkerScriptController.h
@@ -29,7 +29,7 @@
 
 #if ENABLE(WORKERS)
 
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <wtf/Forward.h>
 #include <wtf/Threading.h>
 
@@ -61,9 +61,17 @@ namespace WebCore {
 
         void setException(ScriptValue);
 
-        enum ForbidExecutionOption { TerminateRunningScript, LetRunningScriptFinish };
-        void forbidExecution(ForbidExecutionOption);
-        bool isExecutionForbidden() const { return m_executionForbidden; }
+        // Async request to terminate a JS run execution. Eventually causes termination
+        // exception raised during JS execution, if the worker thread happens to run JS.
+        // After JS execution was terminated in this way, the Worker thread has to use
+        // forbidExecution()/isExecutionForbidden() to guard against reentry into JS.
+        // Can be called from any thread.
+        void scheduleExecutionTermination();
+
+        // Called on Worker thread when JS exits with termination exception caused by forbidExecution() request,
+        // or by Worker thread termination code to prevent future entry into JS.
+        void forbidExecution();
+        bool isExecutionForbidden() const;
 
         JSC::JSGlobalData* globalData() { return m_globalData.get(); }
 
@@ -77,9 +85,7 @@ namespace WebCore {
 
         RefPtr<JSC::JSGlobalData> m_globalData;
         WorkerContext* m_workerContext;
-        JSC::Global<JSWorkerContext> m_workerContextWrapper;
-
-        Mutex m_sharedDataMutex;
+        JSC::Strong<JSWorkerContext> m_workerContextWrapper;
         bool m_executionForbidden;
     };
 
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 12b477b..181fd24 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -200,7 +200,7 @@ sub GetParentClassName
     my $dataNode = shift;
 
     return $dataNode->extendedAttributes->{"LegacyParent"} if $dataNode->extendedAttributes->{"LegacyParent"};
-    return "DOMObjectWithGlobalPointer" if (@{$dataNode->parents} eq 0);
+    return "JSDOMWrapperWithGlobalPointer" if (@{$dataNode->parents} eq 0);
     return "JS" . $codeGenerator->StripModule($dataNode->parents(0));
 }
 
@@ -682,11 +682,11 @@ sub GenerateHeader
 
     # Constructor
     if ($interfaceName eq "DOMWindow") {
-        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>, JSDOMWindowShell*);\n");
+        push(@headerContent, "    $className(JSC::JSGlobalData&, JSC::Structure*, PassRefPtr<$implType>, JSDOMWindowShell*);\n");
     } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
-        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>);\n");
+        push(@headerContent, "    $className(JSC::JSGlobalData&, JSC::Structure*, PassRefPtr<$implType>);\n");
     } else {
-        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>);\n");
+        push(@headerContent, "    $className(JSC::Structure*, JSDOMGlobalObject*, PassRefPtr<$implType>);\n");
     }
 
     # Prototype
@@ -746,7 +746,7 @@ sub GenerateHeader
         $structureFlags{"JSC::NeedsThisConversion"} = 1;
     }
     push(@headerContent,
-        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n" .
+        "    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n" .
         "    {\n" .
         "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
         "    }\n\n");
@@ -923,7 +923,7 @@ sub GenerateHeader
     }
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateNativeConverter"}) {
         if ($interfaceName eq "NodeFilter") {
-            push(@headerContent, "PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValue);\n");
+            push(@headerContent, "PassRefPtr<NodeFilter> toNodeFilter(JSC::JSGlobalData&, JSC::JSValue);\n");
         } else {
             push(@headerContent, "$implType* to${interfaceName}(JSC::JSValue);\n");
         }
@@ -958,7 +958,7 @@ sub GenerateHeader
         $structureFlags{"JSC::OverridesMarkChildren"} = 1;
     }
     push(@headerContent,
-        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n" .
+        "    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n" .
         "    {\n" .
         "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
         "    }\n");
@@ -970,7 +970,7 @@ sub GenerateHeader
     # Custom defineGetter function
     push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
 
-    push(@headerContent, "    ${className}Prototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }\n");
+    push(@headerContent, "    ${className}Prototype(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::Structure* structure) : JSC::JSObjectWithGlobalObject(globalData, globalObject, structure) { }\n");
 
     # structure flags
     push(@headerContent, "protected:\n");
@@ -1304,7 +1304,7 @@ sub GenerateImplementation
         push(@implContent, "static const HashTable* get${className}PrototypeTable(ExecState* exec)\n");
         push(@implContent, "{\n");
         push(@implContent, "    return getHashTableForGlobalData(exec->globalData(), &${className}PrototypeTable);\n");
-        push(@implContent, "}\n");
+        push(@implContent, "}\n\n");
         push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleClassName}Prototype\", &JSC::JSObjectWithGlobalObject::s_info, 0, get${className}PrototypeTable };\n\n");
     } else {
         push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleClassName}Prototype\", &JSC::JSObjectWithGlobalObject::s_info, &${className}PrototypeTable, 0 };\n\n");
@@ -1379,7 +1379,7 @@ sub GenerateImplementation
         push(@implContent, "static const HashTable* get${className}Table(ExecState* exec)\n");
         push(@implContent, "{\n");
         push(@implContent, "    return getHashTableForGlobalData(exec->globalData(), &${className}Table);\n");
-        push(@implContent, "}\n");
+        push(@implContent, "}\n\n");
     }
 
     push(@implContent, "const ClassInfo $className" . "::s_info = { \"${visibleClassName}\", &" . $parentClassName . "::s_info, ");
@@ -1407,14 +1407,14 @@ sub GenerateImplementation
     # Constructor
     if ($interfaceName eq "DOMWindow") {
         AddIncludesForType("JSDOMWindowShell");
-        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, PassRefPtr<$implType> impl, JSDOMWindowShell* shell)\n");
-        push(@implContent, "    : $parentClassName(structure, impl, shell)\n");
+        push(@implContent, "${className}::$className(JSGlobalData& globalData, Structure* structure, PassRefPtr<$implType> impl, JSDOMWindowShell* shell)\n");
+        push(@implContent, "    : $parentClassName(globalData, structure, impl, shell)\n");
     } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
         AddIncludesForType($interfaceName);
-        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, PassRefPtr<$implType> impl)\n");
-        push(@implContent, "    : $parentClassName(structure, impl)\n");
+        push(@implContent, "${className}::$className(JSGlobalData& globalData, Structure* structure, PassRefPtr<$implType> impl)\n");
+        push(@implContent, "    : $parentClassName(globalData, structure, impl)\n");
     } else {
-        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl)\n");
+        push(@implContent, "${className}::$className(Structure* structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl)\n");
         if ($hasParent) {
             push(@implContent, "    : $parentClassName(structure, globalObject, impl)\n");
         } else {
@@ -1442,9 +1442,9 @@ sub GenerateImplementation
         push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
         if ($hasParent && $parentClassName ne "JSC::DOMNodeFilter") {
-            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(exec->globalData(), ${parentClassName}Prototype::self(exec, globalObject)));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(exec->globalData(), globalObject, ${className}Prototype::createStructure(exec->globalData(), ${parentClassName}Prototype::self(exec, globalObject)));\n");
         } else {
-            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(exec->globalData(), globalObject, ${className}Prototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));\n");
         }
         push(@implContent, "}\n\n");
     }
@@ -1540,7 +1540,7 @@ sub GenerateImplementation
                     my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
                     $constructorType =~ s/Constructor$//;
                     # Constructor attribute is only used by DOMWindow.idl, so it's correct to pass castedThis as the global object
-                    # Once DOMObjects have a back-pointer to the globalObject we can pass castedThis->globalObject()
+                    # Once JSDOMWrappers have a back-pointer to the globalObject we can pass castedThis->globalObject()
                     push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec, castedThis);\n");
                 } elsif (!@{$attribute->getterExceptions}) {
                     push(@implContent, "    UNUSED_PARAM(exec);\n");
@@ -1590,7 +1590,7 @@ sub GenerateImplementation
                     push(@implContent, "    return result;\n");
                 }
 
-                push(@implContent, "}\n");
+                push(@implContent, "}\n\n");
 
                 push(@implContent, "#endif\n") if $attributeConditionalString;
 
@@ -1610,8 +1610,7 @@ sub GenerateImplementation
                 }
 
                 push(@implContent, "    return ${className}::getConstructor(exec, domObject->globalObject());\n");
-                push(@implContent, "}\n");
-                push(@implContent, "\n");
+                push(@implContent, "}\n\n");
             }
         }
 
@@ -1769,7 +1768,7 @@ sub GenerateImplementation
                             }
                         }
                         
-                        push(@implContent, "}\n");
+                        push(@implContent, "}\n\n");
 
                         push(@implContent, "#endif\n") if $attributeConditionalString;
 
@@ -1799,8 +1798,7 @@ sub GenerateImplementation
                 } else {
                     push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(exec->globalData(), Identifier(exec, \"$name\"), value);\n");
                 }
-                push(@implContent, "}\n");
-                push(@implContent, "\n");
+                push(@implContent, "}\n\n");
             }        
         }
     }
@@ -2095,7 +2093,7 @@ sub GenerateImplementation
         } else {
             push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->item(index));\n");
         }
-        push(@implContent, "}\n");
+        push(@implContent, "}\n\n");
         if ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
             $implIncludes{"JSNode.h"} = 1;
             $implIncludes{"Node.h"} = 1;
@@ -2106,7 +2104,7 @@ sub GenerateImplementation
         push(@implContent, "\nJSValue ${className}::getByIndex(ExecState*, unsigned index)\n");
         push(@implContent, "{\n");
         push(@implContent, "    return jsNumber(static_cast<$implClassName*>(impl())->item(index));\n");
-        push(@implContent, "}\n");
+        push(@implContent, "}\n\n");
         if ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
             $implIncludes{"JSNode.h"} = 1;
             $implIncludes{"Node.h"} = 1;
@@ -2115,17 +2113,17 @@ sub GenerateImplementation
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateToJS"}) and !$dataNode->extendedAttributes->{"CustomToJS"}) {
         if ($svgPropertyType) {
-            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* object)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* impl)\n");
         } else {
-            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* object)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* impl)\n");
         }
         push(@implContent, "{\n");
         if ($svgPropertyType) {
-            push(@implContent, "    return getDOMObjectWrapper<$className, $implType>(exec, globalObject, object);\n");
+            push(@implContent, "    return wrap<$className, $implType>(exec, globalObject, impl);\n");
         } else {
-            push(@implContent, "    return getDOMObjectWrapper<$className>(exec, globalObject, object);\n");
+            push(@implContent, "    return wrap<$className>(exec, globalObject, impl);\n");
         }
-        push(@implContent, "}\n");
+        push(@implContent, "}\n\n");
     }
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateNativeConverter"}) and !$dataNode->extendedAttributes->{"CustomNativeConverter"}) {
@@ -2466,6 +2464,11 @@ sub JSValueToNative
         return "exec->globalData(), $value";
     }
 
+    if ($type eq "NodeFilter") {
+        $implIncludes{"JS$type.h"} = 1;
+        return "to$type(exec->globalData(), $value)";
+    }
+
     if ($type eq "MediaQueryListListener") {
         $implIncludes{"MediaQueryListListener.h"} = 1;
         return "MediaQueryListListener::create(ScriptValue(exec->globalData(), " . $value ."))";
@@ -2514,7 +2517,6 @@ sub NativeToJSValue
     }
 
     if ($codeGenerator->IsPrimitiveType($type) or $type eq "DOMTimeStamp") {
-        $implIncludes{"<runtime/JSNumberCell.h>"} = 1;
         return "jsNumber($value)";
     }
 
@@ -2873,7 +2875,7 @@ sub GenerateConstructorDeclaration
     push(@$outputArray, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
     push(@$outputArray, "    static const JSC::ClassInfo s_info;\n");
 
-    push(@$outputArray, "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n");
+    push(@$outputArray, "    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n");
     push(@$outputArray, "    {\n");
     push(@$outputArray, "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n");
     push(@$outputArray, "    }\n");
@@ -2920,12 +2922,12 @@ sub GenerateConstructorDefinition
 
     push(@$outputArray, "bool ${constructorClassName}::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
     push(@$outputArray, "{\n");
-    push(@$outputArray, "    return getStaticValueSlot<${constructorClassName}, DOMObject>(exec, &${constructorClassName}Table, this, propertyName, slot);\n");
+    push(@$outputArray, "    return getStaticValueSlot<${constructorClassName}, JSDOMWrapper>(exec, &${constructorClassName}Table, this, propertyName, slot);\n");
     push(@$outputArray, "}\n\n");
 
     push(@$outputArray, "bool ${constructorClassName}::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
     push(@$outputArray, "{\n");
-    push(@$outputArray, "    return getStaticValueDescriptor<${constructorClassName}, DOMObject>(exec, &${constructorClassName}Table, this, propertyName, descriptor);\n");
+    push(@$outputArray, "    return getStaticValueDescriptor<${constructorClassName}, JSDOMWrapper>(exec, &${constructorClassName}Table, this, propertyName, descriptor);\n");
     push(@$outputArray, "}\n\n");
 
     if ($canConstruct) {
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 6fc0b9a..22051bf 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -448,9 +448,7 @@ sub GetInternalFields
         push(@customInternalFields, "eventListenerCacheIndex");
     }
 
-    if (IsSubType($dataNode, "Document")) {
-        push(@customInternalFields, "implementationIndex");
-    } elsif ($name eq "DOMWindow") {
+    if ($name eq "DOMWindow") {
         push(@customInternalFields, "enteredIsolatedWorldIndex");
     }
     return @customInternalFields;
@@ -2348,6 +2346,7 @@ sub GenerateCallbackImplementation
     push(@implFixedHeader, GenerateImplementationContentHeader($dataNode));
          
     $implIncludes{"ScriptExecutionContext.h"} = 1;
+    $implIncludes{"V8Binding.h"} = 1;
     $implIncludes{"V8CustomVoidCallback.h"} = 1;
     $implIncludes{"V8Proxy.h"} = 1;
 
@@ -2553,6 +2552,7 @@ sub HasCustomToV8Implementation {
     return 0 if $interfaceName eq "AbstractWorker";
     return 0 if $interfaceName eq "CanvasRenderingContext";
     return 0 if $interfaceName eq "SVGElementInstance";
+    return 0 if $interfaceName eq "NodeList";
 
     # For everything else, do what JSC does.
     return $dataNode->extendedAttributes->{"CustomToJS"};
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
index c17f73d..b0a4f69 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
@@ -24,6 +24,7 @@
 #if ENABLE(DATABASE)
 
 #include "ScriptExecutionContext.h"
+#include "V8Binding.h"
 #include "V8Class1.h"
 #include "V8Class2.h"
 #include "V8CustomVoidCallback.h"
diff --git a/Source/WebCore/bindings/v8/DebuggerScript.js b/Source/WebCore/bindings/v8/DebuggerScript.js
index fe6e8ab..c6540d7 100644
--- a/Source/WebCore/bindings/v8/DebuggerScript.js
+++ b/Source/WebCore/bindings/v8/DebuggerScript.js
@@ -38,11 +38,6 @@ DebuggerScript.PauseOnExceptionsState = {
     PauseOnUncaughtExceptions: 2
 };
 
-DebuggerScript.ScriptWorldType = {
-    MainWorld : 0,
-    ExtensionsWorld : 1
-};
-
 DebuggerScript._pauseOnExceptionsState = DebuggerScript.PauseOnExceptionsState.DontPauseOnExceptions;
 Debug.clearBreakOnException();
 Debug.clearBreakOnUncaughtException();
@@ -52,6 +47,21 @@ DebuggerScript.getAfterCompileScript = function(eventData)
     return DebuggerScript._formatScript(eventData.script_.script_);
 }
 
+DebuggerScript.getWorkerScripts = function()
+{
+    var result = [];
+    var scripts = Debug.scripts();
+    for (var i = 0; i < scripts.length; ++i) {
+        var script = scripts[i];
+        // Workers don't share same V8 heap now so there is no need to complicate stuff with
+        // the context id like we do to discriminate between scripts from different pages.
+        // However we need to filter out v8 native scripts.
+        if (script.context_data && script.context_data === "worker")
+            result.push(DebuggerScript._formatScript(script));
+    }
+    return result;
+}
+
 DebuggerScript.getScripts = function(contextData)
 {
     var result = [];
@@ -76,24 +86,19 @@ DebuggerScript.getScripts = function(contextData)
 
 DebuggerScript._formatScript = function(script)
 {
-    var scriptWorldType = DebuggerScript.ScriptWorldType.MainWorld;
-    if (script.context_data && script.context_data.indexOf("injected") == 0)
-        scriptWorldType = DebuggerScript.ScriptWorldType.ExtensionsWorld;
     return {
         id: script.id,
         name: script.nameOrSourceURL(),
         source: script.source,
         lineOffset: script.line_offset,
         columnOffset: script.column_offset,
-        scriptWorldType: scriptWorldType
+        isContentScript: !!script.context_data && script.context_data.indexOf("injected") == 0
     };
 }
 
 DebuggerScript.setBreakpoint = function(execState, args)
 {
-    var breakId = Debug.setScriptBreakPointById(args.scriptId, args.lineNumber, args.columnNumber, args.condition);
-    if (!args.enabled)
-        Debug.disableScriptBreakPoint(breakId);
+    var breakId = Debug.setScriptBreakPointById(args.sourceID, args.lineNumber, args.columnNumber, args.condition);
 
     var locations = Debug.findBreakPointActualLocations(breakId);
     if (!locations.length)
@@ -252,7 +257,6 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
         "line": location.line,
         "column": location.column,
         "functionName": functionName,
-        "type": "function",
         "thisObject": thisObject,
         "scopeChain": scopeChain,
         "scopeType": scopeType,
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index 5758639..a0e14f3 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -67,11 +67,10 @@ String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBrea
     v8::Context::Scope contextScope(debuggerContext);
 
     v8::Local<v8::Object> args = v8::Object::New();
-    args->Set(v8::String::New("scriptId"), v8String(sourceID));
+    args->Set(v8::String::New("sourceID"), v8String(sourceID));
     args->Set(v8::String::New("lineNumber"), v8::Integer::New(scriptBreakpoint.lineNumber));
     args->Set(v8::String::New("columnNumber"), v8::Integer::New(scriptBreakpoint.columnNumber));
     args->Set(v8::String::New("condition"), v8String(scriptBreakpoint.condition));
-    args->Set(v8::String::New("enabled"), v8::Boolean::New(scriptBreakpoint.enabled));
 
     v8::Handle<v8::Function> setBreakpointFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("setBreakpoint")));
     v8::Handle<v8::Value> breakpointId = v8::Debug::Call(setBreakpointFunction, args);
@@ -212,7 +211,7 @@ void ScriptDebugServer::stepOutOfFunction()
     continueProgram();
 }
 
-bool ScriptDebugServer::editScriptSource(const String& sourceID, const String& newContent, String& newSourceOrErrorMessage)
+bool ScriptDebugServer::editScriptSource(const String& sourceID, const String& newContent, String* error)
 {
     ensureDebuggerScriptCompiled();
     v8::HandleScope scope;
@@ -230,11 +229,12 @@ bool ScriptDebugServer::editScriptSource(const String& sourceID, const String& n
     if (tryCatch.HasCaught()) {
         v8::Local<v8::Message> message = tryCatch.Message();
         if (!message.IsEmpty())
-            newSourceOrErrorMessage = toWebCoreStringWithNullOrUndefinedCheck(message->Get());
+            *error = toWebCoreStringWithNullOrUndefinedCheck(message->Get());
+        else
+            *error = "Unknown error.";
         return false;
     }
     ASSERT(!result.IsEmpty());
-    newSourceOrErrorMessage = toWebCoreStringWithNullOrUndefinedCheck(result);
 
     // Call stack may have changed after if the edited function was on the stack.
     if (m_currentCallFrame)
@@ -351,7 +351,7 @@ void ScriptDebugServer::dispatchDidParseSource(ScriptDebugListener* listener, v8
         toWebCoreStringWithNullOrUndefinedCheck(object->Get(v8::String::New("source"))),
         object->Get(v8::String::New("lineOffset"))->ToInteger()->Value(),
         object->Get(v8::String::New("columnOffset"))->ToInteger()->Value(),
-        static_cast<ScriptWorldType>(object->Get(v8::String::New("scriptWorldType"))->Int32Value()));
+        object->Get(v8::String::New("isContentScript"))->ToBoolean()->Value());
 }
 
 void ScriptDebugServer::ensureDebuggerScriptCompiled()
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.h b/Source/WebCore/bindings/v8/ScriptDebugServer.h
index 15004ea..93d897c 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.h
@@ -72,7 +72,7 @@ public:
     void stepOverStatement();
     void stepOutOfFunction();
 
-    bool editScriptSource(const String& sourceID, const String& newContent, String& newSourceOrErrorMessage);
+    bool editScriptSource(const String& sourceID, const String& newContent, String* error);
 
     void recompileAllJSFunctionsSoon() { }
     void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) { }
diff --git a/Source/WebCore/bindings/v8/ScriptState.cpp b/Source/WebCore/bindings/v8/ScriptState.cpp
index fac1d26..600a92a 100644
--- a/Source/WebCore/bindings/v8/ScriptState.cpp
+++ b/Source/WebCore/bindings/v8/ScriptState.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -37,6 +37,10 @@
 #include "ScriptController.h"
 #include "V8HiddenPropertyName.h"
 
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+#include "WorkerScriptController.h"
+
 #include <v8.h>
 #include <wtf/Assertions.h>
 
@@ -111,4 +115,17 @@ ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page* page)
     return mainWorldScriptState(page->mainFrame());
 }
 
+#if ENABLE(WORKERS)
+ScriptState* scriptStateFromWorkerContext(WorkerContext* workerContext)
+{
+    WorkerContextExecutionProxy* proxy = workerContext->script()->proxy();
+    if (!proxy)
+        return 0;
+
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = proxy->context();
+    return ScriptState::forContext(context);
+}
+#endif
+
 }
diff --git a/Source/WebCore/bindings/v8/ScriptState.h b/Source/WebCore/bindings/v8/ScriptState.h
index 0fecee8..c7dbbb2 100644
--- a/Source/WebCore/bindings/v8/ScriptState.h
+++ b/Source/WebCore/bindings/v8/ScriptState.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -41,6 +41,7 @@ class DOMWrapperWorld;
 class Frame;
 class Node;
 class Page;
+class WorkerContext;
 
 class ScriptState {
     WTF_MAKE_NONCOPYABLE(ScriptState);
@@ -108,6 +109,10 @@ ScriptState* mainWorldScriptState(Frame*);
 ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
 ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
 
+#if ENABLE(WORKERS)
+ScriptState* scriptStateFromWorkerContext(WorkerContext*);
+#endif
+
 inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
 inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
 
diff --git a/Source/WebCore/bindings/v8/ScriptValue.cpp b/Source/WebCore/bindings/v8/ScriptValue.cpp
index ebe9ccc..3487d39 100644
--- a/Source/WebCore/bindings/v8/ScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/ScriptValue.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -64,7 +64,12 @@ bool ScriptValue::getString(String& result) const
 
 String ScriptValue::toString(ScriptState*) const
 {
-    return toWebCoreString(m_value);
+    v8::TryCatch block;
+    v8::Handle<v8::String> s = m_value->ToString();
+    // Handle the case where an exception is thrown as part of invoking toString on the object.
+    if (block.HasCaught())
+        return String();
+    return v8StringToWebCoreString<String>(s, DoNotExternalize);
 }
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 6dc49fa..f1102c2 100644
--- a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -72,6 +72,10 @@ V8AbstractEventListener::~V8AbstractEventListener()
 
 void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
 {
+    // Don't reenter V8 if execution was terminated in this instance of V8.
+    if (context->isJSExecutionForbidden())
+        return;
+
     ASSERT(event);
 
     // The callback function on XMLHttpRequest can clear the event listener and destroys 'this' object. Keep a local reference to it.
@@ -150,8 +154,12 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         returnValue = callListenerFunction(context, jsEvent, event);
         if (tryCatch.HasCaught())
             event->target()->uncaughtExceptionInEventHandler();
-        if (!tryCatch.CanContinue())
+
+        if (!tryCatch.CanContinue()) { // Result of TerminateExecution().
+            if (context->isWorkerContext())
+                static_cast<WorkerContext*>(context)->script()->forbidExecution();
             return;
+        }
         tryCatch.Reset();
 
         // Restore the old event. This must be done for all exit paths through this method.
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index b439274..bef28a2 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -84,6 +84,7 @@
 #endif
 
 #if ENABLE(WEB_AUDIO)
+#include "V8AudioContext.h"
 #include "V8JavaScriptAudioNode.h"
 #endif
 
@@ -444,6 +445,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
 #if ENABLE(WEB_AUDIO)
     if (JavaScriptAudioNode* jsAudioNode = target->toJavaScriptAudioNode())
         return toV8(jsAudioNode);
+    if (AudioContext* audioContext = target->toAudioContext())
+        return toV8(audioContext);
 #endif    
 
     ASSERT(0);
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index 82c9ca4..c9e9dfd 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -359,6 +359,24 @@ public:
             GroupId groupId = calculateGroupId(cssStyleDeclaration);
             m_grouper.append(GrouperItem(groupId, wrapper));
 
+            // Keep alive "dirty" primitive values (i.e. the ones that
+            // have user-added properties) by creating implicit
+            // references between the style declaration and the values
+            // in it.
+            if (cssStyleDeclaration->isMutableStyleDeclaration()) {
+                CSSMutableStyleDeclaration* cssMutableStyleDeclaration = static_cast<CSSMutableStyleDeclaration*>(cssStyleDeclaration);
+                Vector<v8::Persistent<v8::Value> > values;
+                values.reserveCapacity(cssMutableStyleDeclaration->length());
+                CSSMutableStyleDeclaration::const_iterator end = cssMutableStyleDeclaration->end();
+                for (CSSMutableStyleDeclaration::const_iterator it = cssMutableStyleDeclaration->begin(); it != end; ++it) {
+                    v8::Persistent<v8::Object> value = store->domObjectMap().get(it->value());
+                    if (!value.IsEmpty() && value->IsDirty())
+                        values.append(value);
+                }
+                if (!values.isEmpty())
+                    v8::V8::AddImplicitReferences(wrapper, values.data(), values.size());
+            }
+
         } else if (typeInfo->isSubclass(&V8CSSRuleList::info)) {
             CSSRuleList* cssRuleList = static_cast<CSSRuleList*>(object);
             GroupId groupId(cssRuleList);
diff --git a/Source/WebCore/bindings/v8/V8Utilities.cpp b/Source/WebCore/bindings/v8/V8Utilities.cpp
index eebe6b5..b631359 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.cpp
+++ b/Source/WebCore/bindings/v8/V8Utilities.cpp
@@ -127,4 +127,9 @@ ScriptExecutionContext* getScriptExecutionContext()
     return 0;
 }
 
+void throwTypeMismatchException()
+{
+    V8Proxy::throwError(V8Proxy::GeneralError, "TYPE_MISMATCH_ERR: DOM Exception 17");
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8Utilities.h b/Source/WebCore/bindings/v8/V8Utilities.h
index 1892bb7..4a44f3c 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.h
+++ b/Source/WebCore/bindings/v8/V8Utilities.h
@@ -55,6 +55,36 @@ namespace WebCore {
 
     ScriptExecutionContext* getScriptExecutionContext();
 
+    void throwTypeMismatchException();
+
+    enum CallbackAllowedValueFlag {
+        CallbackAllowUndefined = 1,
+        CallbackAllowNull = 1 << 1
+    };
+
+    typedef unsigned CallbackAllowedValueFlags;
+
+    // 'FunctionOnly' is assumed for the created callback.
+    template <typename V8CallbackType>
+    PassRefPtr<V8CallbackType> createFunctionOnlyCallback(v8::Local<v8::Value> value, bool& succeeded, CallbackAllowedValueFlags acceptedValues = 0)
+    {
+        succeeded = true;
+
+        if (value->IsUndefined() && (acceptedValues & CallbackAllowUndefined))
+            return 0;
+
+        if (value->IsNull() && (acceptedValues & CallbackAllowNull))
+            return 0;
+
+        if (!value->IsFunction()) {
+            succeeded = false;
+            throwTypeMismatchException();
+            return 0;
+        }
+
+        return V8CallbackType::create(value, getScriptExecutionContext());
+    }
+
     class AllowAllocation {
     public:
         inline AllowAllocation()
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index eb7252b..42259d5 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -150,6 +150,9 @@ bool WorkerContextExecutionProxy::initContextIfNeeded()
 
     v8::Context::Scope scope(context);
 
+    // Set DebugId for the new context.
+    context->SetData(v8::String::New("worker"));
+
     // Create a new JS object and use it as the prototype for the shadow global object.
     WrapperTypeInfo* contextType = &V8DedicatedWorkerContext::info;
 #if ENABLE(SHARED_WORKERS)
@@ -200,8 +203,10 @@ ScriptValue WorkerContextExecutionProxy::evaluate(const String& script, const St
     v8::Handle<v8::Script> compiledScript = V8Proxy::compileScript(scriptString, fileName, scriptStartPosition);
     v8::Local<v8::Value> result = runScript(compiledScript);
 
-    if (!exceptionCatcher.CanContinue())
+    if (!exceptionCatcher.CanContinue()) {
+        m_workerContext->script()->forbidExecution();
         return ScriptValue();
+    }
 
     if (exceptionCatcher.HasCaught()) {
         v8::Local<v8::Message> message = exceptionCatcher.Message();
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.cpp b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
index 42e02e6..214da4e 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -68,11 +68,8 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
 ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, ScriptValue* exception)
 {
-    {
-        MutexLocker lock(m_sharedDataMutex);
-        if (m_executionForbidden)
-            return ScriptValue();
-    }
+    if (isExecutionForbidden())
+        return ScriptValue();
 
     WorkerContextExecutionState state;
     ScriptValue result = m_proxy->evaluate(sourceCode.source(), sourceCode.url().string(), WTF::toZeroBasedTextPosition(sourceCode.startPosition()), &state);
@@ -86,13 +83,21 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
     return result;
 }
 
-void WorkerScriptController::forbidExecution(ForbidExecutionOption option)
+void WorkerScriptController::scheduleExecutionTermination()
+{
+    v8::V8::TerminateExecution();
+}
+
+void WorkerScriptController::forbidExecution()
 {
-    // This function may be called from another thread.
-    MutexLocker lock(m_sharedDataMutex);
+    ASSERT(m_workerContext->isContextThread());
     m_executionForbidden = true;
-    if (option == TerminateRunningScript)
-        v8::V8::TerminateExecution();
+}
+
+bool WorkerScriptController::isExecutionForbidden() const
+{
+    ASSERT(m_workerContext->isContextThread());
+    return m_executionForbidden;
 }
 
 void WorkerScriptController::setException(ScriptValue exception)
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.h b/Source/WebCore/bindings/v8/WorkerScriptController.h
index 5e3159f..cc4b7c4 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.h
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.h
@@ -48,7 +48,7 @@ namespace WebCore {
         WorkerScriptController(WorkerContext*);
         ~WorkerScriptController();
 
-        WorkerContextExecutionProxy* proxy() { return m_executionForbidden ? 0 : m_proxy.get(); }
+        WorkerContextExecutionProxy* proxy() { return m_proxy.get(); }
         WorkerContext* workerContext() { return m_workerContext; }
 
         ScriptValue evaluate(const ScriptSourceCode&);
@@ -56,9 +56,17 @@ namespace WebCore {
 
         void setException(ScriptValue);
 
-        enum ForbidExecutionOption { TerminateRunningScript, LetRunningScriptFinish };
-        void forbidExecution(ForbidExecutionOption);
-        bool isExecutionForbidden() const { return m_executionForbidden; }
+        // Async request to terminate a future JS execution. Eventually causes termination
+        // exception raised during JS execution, if the worker thread happens to run JS.
+        // After JS execution was terminated in this way, the Worker thread has to use
+        // forbidExecution()/isExecutionForbidden() to guard against reentry into JS.
+        // Can be called from any thread.
+        void scheduleExecutionTermination();
+
+        // Called on Worker thread when JS exits with termination exception caused by forbidExecution() request,
+        // or by Worker thread termination code to prevent future entry into JS.
+        void forbidExecution();
+        bool isExecutionForbidden() const;
 
         // Returns WorkerScriptController for the currently executing context. 0 will be returned if the current executing context is not the worker context.
         static WorkerScriptController* controllerForContext();
@@ -66,8 +74,6 @@ namespace WebCore {
     private:
         WorkerContext* m_workerContext;
         OwnPtr<WorkerContextExecutionProxy> m_proxy;
-
-        Mutex m_sharedDataMutex;
         bool m_executionForbidden;
     };
 
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
index 5e2acd2..1887cea 100755
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
@@ -33,21 +33,118 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
 
+#include "ScriptDebugListener.h"
+#include "V8DOMWrapper.h"
+#include "V8DedicatedWorkerContext.h"
+#include "V8SharedWorkerContext.h"
 #include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+#include "WorkerThread.h"
+#include <v8.h>
+#include <wtf/MessageQueue.h>
 
 namespace WebCore {
 
+static WorkerContext* retrieveWorkerContext(v8::Handle<v8::Context> context)
+{
+    v8::Handle<v8::Object> global = context->Global();
+    ASSERT(!global.IsEmpty());
+
+    v8::Handle<v8::Object> prototype = v8::Handle<v8::Object>::Cast(global->GetPrototype());
+    ASSERT(!prototype.IsEmpty());
+
+    prototype = v8::Handle<v8::Object>::Cast(prototype->GetPrototype());
+    ASSERT(!prototype.IsEmpty());
+
+    WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(prototype);
+    if (&V8DedicatedWorkerContext::info == typeInfo)
+        return V8DedicatedWorkerContext::toNative(prototype);
+    if (&V8SharedWorkerContext::info == typeInfo)
+        return V8SharedWorkerContext::toNative(prototype);
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 WorkerScriptDebugServer::WorkerScriptDebugServer()
     : ScriptDebugServer()
+    , m_pausedWorkerContext(0)
+{
+}
+
+void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener, WorkerContext* workerContext)
+{
+    v8::HandleScope scope;
+    v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
+    v8::Context::Scope contextScope(debuggerContext);
+
+    if (!m_listenersMap.size()) {
+        // FIXME: synchronize access to this code.
+        ensureDebuggerScriptCompiled();
+        ASSERT(!m_debuggerScript.get()->IsUndefined());
+        v8::Debug::SetDebugEventListener2(&WorkerScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
+    }
+    m_listenersMap.set(workerContext, listener);
+    
+    WorkerContextExecutionProxy* proxy = workerContext->script()->proxy();
+    if (!proxy)
+        return;
+    v8::Handle<v8::Context> context = proxy->context();
+
+    v8::Handle<v8::Function> getScriptsFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getWorkerScripts")));
+    v8::Handle<v8::Value> argv[] = { v8::Handle<v8::Value>() };
+    v8::Handle<v8::Value> value = getScriptsFunction->Call(m_debuggerScript.get(), 0, argv);
+    if (value.IsEmpty())
+        return;
+    ASSERT(!value->IsUndefined() && value->IsArray());
+    v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
+    for (unsigned i = 0; i < scriptsArray->Length(); ++i)
+        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
+}
+
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener* listener, WorkerContext* workerContext)
 {
+    if (!m_listenersMap.contains(workerContext))
+        return;
+
+    if (m_pausedWorkerContext == workerContext)
+        continueProgram();
+
+    m_listenersMap.remove(workerContext);
+
+    if (m_listenersMap.isEmpty())
+        v8::Debug::SetDebugEventListener2(0);
 }
 
-void WorkerScriptDebugServer::addListener(ScriptDebugListener*, WorkerContext*)
+ScriptDebugListener* WorkerScriptDebugServer::getDebugListenerForContext(v8::Handle<v8::Context> context)
 {
+    WorkerContext* workerContext = retrieveWorkerContext(context);
+    if (!workerContext)
+        return 0;
+    return m_listenersMap.get(workerContext);
+}
+
+void WorkerScriptDebugServer::runMessageLoopOnPause(v8::Handle<v8::Context> context)
+{
+    WorkerContext* workerContext = retrieveWorkerContext(context);
+    WorkerThread* workerThread = workerContext->thread();
+
+    m_pausedWorkerContext = workerContext;
+
+    MessageQueueWaitResult result;
+    do {
+        result = workerThread->runLoop().runInMode(workerContext, "debugger");
+    // Keep waiting until execution is resumed.
+    } while (result == MessageQueueMessageReceived && isPaused());
+    m_pausedWorkerContext = 0;
+    
+    // The listener may have been removed in the nested loop.
+    if (ScriptDebugListener* listener = m_listenersMap.get(workerContext))
+        listener->didContinue();
 }
 
-void WorkerScriptDebugServer::removeListener(ScriptDebugListener*, WorkerContext*)
+void WorkerScriptDebugServer::quitMessageLoopOnPause()
 {
+    // FIXME: do exit nested loop when listener is removed on pause.
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
index fdc47ac..6264c68 100755
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
@@ -49,9 +49,13 @@ public:
     void removeListener(ScriptDebugListener*, WorkerContext*);
 
 private:
-    virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>) { return 0; }
-    virtual void runMessageLoopOnPause(v8::Handle<v8::Context>) { }
-    virtual void quitMessageLoopOnPause() { }
+    virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>);
+    virtual void runMessageLoopOnPause(v8::Handle<v8::Context>);
+    virtual void quitMessageLoopOnPause();
+
+    typedef HashMap<WorkerContext*, ScriptDebugListener*> ListenersMap;
+    ListenersMap m_listenersMap;
+    WorkerContext* m_pausedWorkerContext;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
index 419cd60..f2f8dc0 100644
--- a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
@@ -51,7 +51,34 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
     if (!document)
         return throwError("AudioContext constructor associated document is unavailable", V8Proxy::ReferenceError);
 
-    RefPtr<AudioContext> audioContext = AudioContext::create(document);
+    RefPtr<AudioContext> audioContext;
+    
+    if (!args.Length()) {
+        // Constructor for default AudioContext which talks to audio hardware.
+        audioContext = AudioContext::create(document);
+    } else {
+        // Constructor for offline (render-target) AudioContext which renders into an AudioBuffer.
+        // new AudioContext(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
+        if (args.Length() < 3)
+            return throwError("Not enough arguments", V8Proxy::SyntaxError);
+
+        bool ok = false;
+
+        unsigned numberOfChannels = toInt32(args[0], ok);
+        if (!ok)
+            return throwError("Invalid number of channels", V8Proxy::SyntaxError);
+
+        unsigned numberOfFrames = toInt32(args[1], ok);
+        if (!ok)
+            return throwError("Invalid number of frames", V8Proxy::SyntaxError);
+
+        float sampleRate = toFloat(args[2]);
+
+        audioContext = AudioContext::createOfflineContext(document, numberOfChannels, numberOfFrames, sampleRate);
+    }
+
+    if (!audioContext.get())
+        return throwError("Error creating AudioContext", V8Proxy::SyntaxError);
     
     // Transform the holder into a wrapper object for the audio context.
     V8DOMWrapper::setDOMWrapper(args.Holder(), &info, audioContext.get());
diff --git a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
index 850ae14..097924b 100644
--- a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
@@ -40,6 +40,8 @@
 #include "V8Binding.h"
 #include "V8Proxy.h"
 
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -107,8 +109,8 @@ static CSSPropertyInfo* cssPropertyInfo(v8::Handle<v8::String>v8PropertyName)
         if (!length)
             return 0;
 
-        Vector<UChar> name;
-        name.reserveCapacity(length);
+        StringBuilder builder;
+        builder.reserveCapacity(length);
 
         unsigned i = 0;
 
@@ -123,23 +125,21 @@ static CSSPropertyInfo* cssPropertyInfo(v8::Handle<v8::String>v8PropertyName)
         } else if (hasCSSPropertyNamePrefix(propertyName, "webkit")
                 || hasCSSPropertyNamePrefix(propertyName, "khtml")
                 || hasCSSPropertyNamePrefix(propertyName, "apple"))
-            name.append('-');
+            builder.append('-');
         else if (WTF::isASCIIUpper(propertyName[0]))
             return 0;
 
-        name.append(WTF::toASCIILower(propertyName[i++]));
+        builder.append(WTF::toASCIILower(propertyName[i++]));
 
         for (; i < length; ++i) {
             UChar c = propertyName[i];
             if (!WTF::isASCIIUpper(c))
-                name.append(c);
-            else {
-                name.append('-');
-                name.append(WTF::toASCIILower(c));
-            }
+                builder.append(c);
+            else
+                builder.append(makeString('-', toASCIILower(c)));
         }
 
-        String propName = String::adopt(name);
+        String propName = builder.toString();
         int propertyID = cssPropertyID(propName);
         if (propertyID) {
             propInfo = new CSSPropertyInfo();
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 85ae322..43d5a15 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -32,6 +32,7 @@
 #include "V8DOMWindow.h"
 
 #include "Chrome.h"
+#include "ContentSecurityPolicy.h"
 #include "DOMTimer.h"
 #include "DOMWindow.h"
 #include "ExceptionCode.h"
@@ -131,6 +132,8 @@ v8::Handle<v8::Value> WindowSetTimeoutImpl(const v8::Arguments& args, bool singl
 
         id = DOMTimer::install(scriptContext, action, timeout, singleShot);
     } else {
+        if (imp->document() && !imp->document()->contentSecurityPolicy()->allowEval())
+            return v8::Integer::New(0);
         id = DOMTimer::install(scriptContext, new ScheduledAction(V8Proxy::context(imp->frame()), functionString), timeout, singleShot);
     }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
index a44131a..0889451 100644
--- a/Source/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
@@ -39,7 +39,7 @@
 #include "V8BindingMacros.h"
 #include "V8EntryCallback.h"
 #include "V8ErrorCallback.h"
-#include "V8Flags.h"
+#include "V8WebKitFlags.h"
 #include "V8Proxy.h"
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -55,10 +55,10 @@ v8::Handle<v8::Value> V8DirectoryEntry::getDirectoryCallback(const v8::Arguments
         imp->getDirectory(path);
         return v8::Handle<v8::Value>();
     }
-    RefPtr<Flags> flags;
-    if (!isUndefinedOrNull(args[1]) && args[1]->IsObject() && !V8Flags::HasInstance(args[1])) {
+    RefPtr<WebKitFlags> flags;
+    if (!isUndefinedOrNull(args[1]) && args[1]->IsObject() && !V8WebKitFlags::HasInstance(args[1])) {
         EXCEPTION_BLOCK(v8::Handle<v8::Object>, object, v8::Handle<v8::Object>::Cast(args[1]));
-        flags = Flags::create();
+        flags = WebKitFlags::create();
         v8::Local<v8::Value> v8Create = object->Get(v8::String::New("create"));
         if (!v8Create.IsEmpty() && !isUndefinedOrNull(v8Create)) {
             EXCEPTION_BLOCK(bool, isCreate, v8Create->BooleanValue());
@@ -70,7 +70,7 @@ v8::Handle<v8::Value> V8DirectoryEntry::getDirectoryCallback(const v8::Arguments
             flags->setExclusive(isExclusive);
         }
     } else {
-        EXCEPTION_BLOCK(Flags*, tmp_flags, V8Flags::HasInstance(args[1]) ? V8Flags::toNative(v8::Handle<v8::Object>::Cast(args[1])) : 0);
+        EXCEPTION_BLOCK(WebKitFlags*, tmp_flags, V8WebKitFlags::HasInstance(args[1]) ? V8WebKitFlags::toNative(v8::Handle<v8::Object>::Cast(args[1])) : 0);
         flags = tmp_flags;
     }
     RefPtr<EntryCallback> successCallback;
@@ -98,10 +98,10 @@ v8::Handle<v8::Value> V8DirectoryEntry::getFileCallback(const v8::Arguments& arg
         imp->getFile(path);
         return v8::Handle<v8::Value>();
     }
-    RefPtr<Flags> flags;
-    if (!isUndefinedOrNull(args[1]) && args[1]->IsObject() && !V8Flags::HasInstance(args[1])) {
+    RefPtr<WebKitFlags> flags;
+    if (!isUndefinedOrNull(args[1]) && args[1]->IsObject() && !V8WebKitFlags::HasInstance(args[1])) {
         EXCEPTION_BLOCK(v8::Handle<v8::Object>, object, v8::Handle<v8::Object>::Cast(args[1]));
-        flags = Flags::create();
+        flags = WebKitFlags::create();
         v8::Local<v8::Value> v8Create = object->Get(v8::String::New("create"));
         if (!v8Create.IsEmpty() && !isUndefinedOrNull(v8Create)) {
             EXCEPTION_BLOCK(bool, isCreate, v8Create->BooleanValue());
@@ -113,7 +113,7 @@ v8::Handle<v8::Value> V8DirectoryEntry::getFileCallback(const v8::Arguments& arg
             flags->setExclusive(isExclusive);
         }
     } else {
-       EXCEPTION_BLOCK(Flags*, tmp_flags, V8Flags::HasInstance(args[1]) ? V8Flags::toNative(v8::Handle<v8::Object>::Cast(args[1])) : 0);
+       EXCEPTION_BLOCK(WebKitFlags*, tmp_flags, V8WebKitFlags::HasInstance(args[1]) ? V8WebKitFlags::toNative(v8::Handle<v8::Object>::Cast(args[1])) : 0);
        flags = tmp_flags;
     }
     RefPtr<EntryCallback> successCallback;
diff --git a/Source/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
index 90b3d13..cd38ca4 100644
--- a/Source/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
@@ -40,7 +40,7 @@
 #include "V8EntryCallback.h"
 #include "V8ErrorCallback.h"
 #include "V8FileEntrySync.h"
-#include "V8Flags.h"
+#include "V8WebKitFlags.h"
 #include "V8Proxy.h"
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -62,13 +62,13 @@ static bool extractBooleanValue(const v8::Handle<v8::Object>& object, const char
     return false;
 }
 
-static PassRefPtr<Flags> getFlags(const v8::Local<v8::Value>& arg, ExceptionCode& ec)
+static PassRefPtr<WebKitFlags> getFlags(const v8::Local<v8::Value>& arg, ExceptionCode& ec)
 {
     ec = 0;
     if (isUndefinedOrNull(arg) || !arg->IsObject())
         return 0;
-    if (V8Flags::HasInstance(arg))
-        return V8Flags::toNative(v8::Handle<v8::Object>::Cast(arg));
+    if (V8WebKitFlags::HasInstance(arg))
+        return V8WebKitFlags::toNative(v8::Handle<v8::Object>::Cast(arg));
 
     v8::Handle<v8::Object> object;
     {
@@ -87,7 +87,7 @@ static PassRefPtr<Flags> getFlags(const v8::Local<v8::Value>& arg, ExceptionCode
     if (ec)
         return 0;
 
-    RefPtr<Flags> flags = Flags::create();
+    RefPtr<WebKitFlags> flags = WebKitFlags::create();
     flags->setCreate(isCreate);
     flags->setExclusive(isExclusive);
 
@@ -100,7 +100,7 @@ v8::Handle<v8::Value> V8DirectoryEntrySync::getDirectoryCallback(const v8::Argum
     DirectoryEntrySync* imp = V8DirectoryEntrySync::toNative(args.Holder());
     ExceptionCode ec = 0;
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, path, args[0]);
-    RefPtr<Flags> flags = getFlags(args[1], ec);
+    RefPtr<WebKitFlags> flags = getFlags(args[1], ec);
     if (UNLIKELY(ec)) {
         V8Proxy::setDOMException(ec);
         return v8::Handle<v8::Value>();
@@ -119,7 +119,7 @@ v8::Handle<v8::Value> V8DirectoryEntrySync::getFileCallback(const v8::Arguments&
     DirectoryEntrySync* imp = V8DirectoryEntrySync::toNative(args.Holder());
     ExceptionCode ec = 0;
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, path, args[0]);
-    RefPtr<Flags> flags = getFlags(args[1], ec);
+    RefPtr<WebKitFlags> flags = getFlags(args[1], ec);
     if (UNLIKELY(ec)) {
         V8Proxy::setDOMException(ec);
         return v8::Handle<v8::Value>();
diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index c435863..7cad58e 100644
--- a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -118,34 +118,6 @@ v8::Handle<v8::Value> V8Document::getCSSCanvasContextCallback(const v8::Argument
     return v8::Undefined();
 }
 
-
-// DOMImplementation is a singleton in WebCore. If we use our normal
-// mapping from DOM objects to V8 wrappers, the same wrapper will be
-// shared for all frames in the same process. This is a major
-// security problem. Therefore, we generate a DOMImplementation
-// wrapper per document and store it in an internal field of the
-// document. Since the DOMImplementation object is a singleton, we do
-// not have to do anything to keep the DOMImplementation object alive
-// for the lifetime of the wrapper.
-v8::Handle<v8::Value> V8Document::implementationAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
-{
-    ASSERT(info.Holder()->InternalFieldCount() >= internalFieldCount);
-
-    // Check if the internal field already contains a wrapper.
-    v8::Local<v8::Value> implementation = info.Holder()->GetInternalField(V8Document::implementationIndex);
-    if (!implementation->IsUndefined())
-        return implementation;
-
-    // Generate a wrapper.
-    Document* document = V8Document::toNative(info.Holder());
-    v8::Handle<v8::Value> wrapper = toV8(document->implementation());
-
-    // Store the wrapper in the internal field.
-    info.Holder()->SetInternalField(implementationIndex, wrapper);
-
-    return wrapper;
-}
-
 v8::Handle<v8::Value> toV8(Document* impl, bool forceNewObject)
 {
     if (!impl)
diff --git a/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
index abb7d4c..7e12034 100644
--- a/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
@@ -70,6 +70,7 @@
 
 #if ENABLE(WEB_AUDIO)
 #include "V8AudioProcessingEvent.h"
+#include "V8OfflineAudioCompletionEvent.h"
 #endif
 
 namespace WebCore {
@@ -169,6 +170,8 @@ v8::Handle<v8::Value> toV8(Event* impl)
 #if ENABLE(WEB_AUDIO)
     if (impl->isAudioProcessingEvent())
         return toV8(static_cast<AudioProcessingEvent*>(impl));
+    if (impl->isOfflineAudioCompletionEvent())
+        return toV8(static_cast<OfflineAudioCompletionEvent*>(impl));
 #endif
 #if ENABLE(INPUT_SPEECH)
     if (impl->isSpeechInputEvent())
diff --git a/Source/WebCore/bindings/v8/custom/V8GeolocationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8GeolocationCustom.cpp
index 54bd11c..91389d8 100644
--- a/Source/WebCore/bindings/v8/custom/V8GeolocationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8GeolocationCustom.cpp
@@ -33,52 +33,13 @@
 #include "V8Binding.h"
 #include "V8CustomPositionCallback.h"
 #include "V8CustomPositionErrorCallback.h"
-#include "V8Proxy.h"
+#include "V8Utilities.h"
 
 using namespace std;
 using namespace WTF;
 
 namespace WebCore {
 
-static const char typeMismatchError[] = "TYPE_MISMATCH_ERR: DOM Exception 17";
-
-static void throwTypeMismatchException()
-{
-    V8Proxy::throwError(V8Proxy::GeneralError, typeMismatchError);
-}
-
-static PassRefPtr<PositionCallback> createPositionCallback(v8::Local<v8::Value> value, bool& succeeded)
-{
-    succeeded = true;
-
-    // The spec specifies 'FunctionOnly' for this object.
-    if (!value->IsFunction()) {
-        succeeded = false;
-        throwTypeMismatchException();
-        return 0;
-    }
-
-    return V8CustomPositionCallback::create(value, getScriptExecutionContext());
-}
-
-static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(v8::Local<v8::Value> value, bool& succeeded)
-{
-    succeeded = true;
-
-    // Argument is optional (hence undefined is allowed), and null is allowed.
-    if (isUndefinedOrNull(value))
-        return 0;
-
-    // The spec specifies 'FunctionOnly' for this object.
-    if (!value->IsFunction()) {
-        succeeded = false;
-        throwTypeMismatchException();
-        return 0;
-    }
-
-    return V8CustomPositionErrorCallback::create(value, getScriptExecutionContext());
-}
-
 static PassRefPtr<PositionOptions> createPositionOptions(v8::Local<v8::Value> value, bool& succeeded)
 {
     succeeded = true;
@@ -172,12 +133,13 @@ v8::Handle<v8::Value> V8Geolocation::getCurrentPositionCallback(const v8::Argume
 
     bool succeeded = false;
 
-    RefPtr<PositionCallback> positionCallback = createPositionCallback(args[0], succeeded);
+    RefPtr<PositionCallback> positionCallback = createFunctionOnlyCallback<V8CustomPositionCallback>(args[0], succeeded);
     if (!succeeded)
         return v8::Undefined();
     ASSERT(positionCallback);
 
-    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(args[1], succeeded);
+    // Argument is optional (hence undefined is allowed), and null is allowed.
+    RefPtr<PositionErrorCallback> positionErrorCallback = createFunctionOnlyCallback<V8CustomPositionErrorCallback>(args[1], succeeded, CallbackAllowUndefined | CallbackAllowNull);
     if (!succeeded)
         return v8::Undefined();
 
@@ -197,12 +159,13 @@ v8::Handle<v8::Value> V8Geolocation::watchPositionCallback(const v8::Arguments&
 
     bool succeeded = false;
 
-    RefPtr<PositionCallback> positionCallback = createPositionCallback(args[0], succeeded);
+    RefPtr<PositionCallback> positionCallback = createFunctionOnlyCallback<V8CustomPositionCallback>(args[0], succeeded);
     if (!succeeded)
         return v8::Undefined();
     ASSERT(positionCallback);
 
-    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(args[1], succeeded);
+    // Argument is optional (hence undefined is allowed), and null is allowed.
+    RefPtr<PositionErrorCallback> positionErrorCallback = createFunctionOnlyCallback<V8CustomPositionErrorCallback>(args[1], succeeded, CallbackAllowUndefined | CallbackAllowNull);
     if (!succeeded)
         return v8::Undefined();
 
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
index f4006b8..8bb4281 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
@@ -139,13 +139,13 @@ InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState* inspectedSc
     v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
     v8::Local<v8::Value> val = global->GetHiddenValue(key);
     if (!val.IsEmpty() && val->IsObject())
-        return InjectedScript(ScriptObject(inspectedScriptState, v8::Local<v8::Object>::Cast(val)));
+        return InjectedScript(ScriptObject(inspectedScriptState, v8::Local<v8::Object>::Cast(val)), m_inspectedStateAccessCheck);
 
-    if (!canAccessInspectedWindow(inspectedScriptState))
+    if (!m_inspectedStateAccessCheck(inspectedScriptState))
         return InjectedScript();
 
     pair<long, ScriptObject> injectedScript = injectScript(injectedScriptSource(), inspectedScriptState);
-    InjectedScript result(injectedScript.second);
+    InjectedScript result(injectedScript.second, m_inspectedStateAccessCheck);
     m_idToInjectedScript.set(injectedScript.first, result);
     global->SetHiddenValue(key, injectedScript.second.v8Object());
     return result;
diff --git a/Source/WebCore/bindings/v8/custom/V8NavigatorCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NavigatorCustom.cpp
index e5a6909..16e8cfe 100644
--- a/Source/WebCore/bindings/v8/custom/V8NavigatorCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NavigatorCustom.cpp
@@ -1,4 +1,5 @@
 /*
+<<<<<<< HEAD
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,11 +27,35 @@
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+=======
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+>>>>>>> WebKit.org at r84325
  */
 
 #include "config.h"
 #include "V8Navigator.h"
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID) && ENABLE(APPLICATION_INSTALLED)
 
 #include "ExceptionCode.h"
@@ -77,9 +102,49 @@ v8::Handle<v8::Value> V8Navigator::isApplicationInstalledCallback(const v8::Argu
     if (!navigator->isApplicationInstalled(toWebCoreString(args[0]), callback.release()))
         return throwError(INVALID_STATE_ERR);
 
+=======
+#if ENABLE(MEDIA_STREAM)
+
+#include "Navigator.h"
+#include "V8Binding.h"
+#include "V8NavigatorUserMediaErrorCallback.h"
+#include "V8NavigatorUserMediaSuccessCallback.h"
+#include "V8Utilities.h"
+
+using namespace WTF;
+
+namespace WebCore {
+
+v8::Handle<v8::Value> V8Navigator::webkitGetUserMediaCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.Navigator.webkitGetUserMedia()");
+
+    v8::TryCatch exceptionCatcher;
+    String options = toWebCoreString(args[0]);
+    if (exceptionCatcher.HasCaught())
+        return throwError(exceptionCatcher.Exception());
+
+    bool succeeded = false;
+
+    RefPtr<NavigatorUserMediaSuccessCallback> successCallback = createFunctionOnlyCallback<V8NavigatorUserMediaSuccessCallback>(args[1], succeeded);
+    if (!succeeded)
+        return v8::Undefined();
+
+    // Argument is optional, hence undefined is allowed.
+    RefPtr<NavigatorUserMediaErrorCallback> errorCallback = createFunctionOnlyCallback<V8NavigatorUserMediaErrorCallback>(args[2], succeeded, CallbackAllowUndefined);
+    if (!succeeded)
+        return v8::Undefined();
+
+    Navigator* navigator = V8Navigator::toNative(args.Holder());
+    navigator->webkitGetUserMedia(options, successCallback.release(), errorCallback.release());
+>>>>>>> WebKit.org at r84325
     return v8::Undefined();
 }
 
 } // namespace WebCore
 
+<<<<<<< HEAD
 #endif // PLATFORM(ANDROID) && ENABLE(APPLICATION_INSTALLED)
+=======
+#endif // ENABLE(MEDIA_STREAM)
+>>>>>>> WebKit.org at r84325
diff --git a/Source/WebCore/bridge/c/CRuntimeObject.h b/Source/WebCore/bridge/c/CRuntimeObject.h
index 85815fb..c96887a 100644
--- a/Source/WebCore/bridge/c/CRuntimeObject.h
+++ b/Source/WebCore/bridge/c/CRuntimeObject.h
@@ -44,7 +44,7 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/c/c_instance.cpp b/Source/WebCore/bridge/c/c_instance.cpp
index 21fae4f..d0fa3cf 100644
--- a/Source/WebCore/bridge/c/c_instance.cpp
+++ b/Source/WebCore/bridge/c/c_instance.cpp
@@ -43,7 +43,6 @@
 #include <runtime/Error.h>
 #include <runtime/FunctionPrototype.h>
 #include <runtime/JSLock.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/PropertyNameArray.h>
 #include <wtf/Assertions.h>
 #include <wtf/StdLibExtras.h>
@@ -120,7 +119,7 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/jni/JavaMethod.h b/Source/WebCore/bridge/jni/JavaMethod.h
index f15b653..5068693 100644
--- a/Source/WebCore/bridge/jni/JavaMethod.h
+++ b/Source/WebCore/bridge/jni/JavaMethod.h
@@ -42,6 +42,8 @@ typedef const char* RuntimeType;
 
 class JavaMethod : public Method {
 public:
+    virtual ~JavaMethod() {}
+
     virtual String name() const = 0;
     virtual RuntimeType returnTypeClassName() const = 0;
     virtual String parameterAt(int) const = 0;
diff --git a/Source/WebCore/bridge/jni/JobjectWrapper.h b/Source/WebCore/bridge/jni/JobjectWrapper.h
index 28ce56e..9cc4b27 100644
--- a/Source/WebCore/bridge/jni/JobjectWrapper.h
+++ b/Source/WebCore/bridge/jni/JobjectWrapper.h
@@ -38,7 +38,9 @@ namespace Bindings {
 class JobjectWrapper {
 friend class JavaArray;
 friend class JavaField;
+friend class JavaFieldJobject;
 friend class JavaInstance;
+friend class JavaInstanceJobject;
 
 public:
     jobject instance() const { return m_instance; }
diff --git a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
index 806efa6..ab64132 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
@@ -124,7 +124,7 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h b/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
index 03f116f..8a3612f 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
@@ -42,7 +42,7 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
index e2ef2ce..4c9e240 100644
--- a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
+++ b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
@@ -28,7 +28,7 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JavaInstanceV8.h"
+#include "JavaInstanceJobjectV8.h"
 #include "JavaNPObjectV8.h"
 #if PLATFORM(ANDROID)
 #include "npruntime_impl.h"
@@ -424,7 +424,7 @@ JavaValue jvalueToJavaValue(const jvalue& value, const JavaType& type)
     case JavaTypeVoid:
         break;
     case JavaTypeObject:
-        result.m_objectValue = new JavaInstance(value.l);
+        result.m_objectValue = new JavaInstanceJobject(value.l);
         break;
     case JavaTypeString:
         {
@@ -476,8 +476,11 @@ jvalue javaValueToJvalue(const JavaValue& value)
     case JavaTypeArray:
 #endif
     case JavaTypeObject:
-        if (value.m_objectValue)
-            result.l = value.m_objectValue->javaInstance();
+        if (value.m_objectValue) {
+            // This method is used only by JavaInstanceJobject, so we know the
+            // derived type of the object.
+            result.l = static_cast<JavaInstanceJobject*>(value.m_objectValue.get())->javaInstance();
+        }
         break;
     case JavaTypeString:
         // This creates a local reference to a new String object, which will
diff --git a/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp b/Source/WebCore/bridge/jni/v8/JavaClassJobjectV8.cpp
index 24d05f3..40bfd63 100644
--- a/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaClassJobjectV8.cpp
@@ -24,16 +24,16 @@
  */
 
 #include "config.h"
-#include "JavaClassV8.h"
+#include "JavaClassJobjectV8.h"
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JavaFieldV8.h"
+#include "JavaFieldJobjectV8.h"
 #include "JavaMethodJobject.h"
 
 using namespace JSC::Bindings;
 
-JavaClass::JavaClass(jobject anInstance)
+JavaClassJobject::JavaClassJobject(jobject anInstance)
 {
     jobject aClass = callJNIMethod<jobject>(anInstance, "getClass", "()Ljava/lang/Class;");
 
@@ -42,34 +42,28 @@ JavaClass::JavaClass(jobject anInstance)
         return;
     }
 
-    int i;
     JNIEnv* env = getJNIEnv();
 
     // Get the fields
     jarray fields = static_cast<jarray>(callJNIMethod<jobject>(aClass, "getFields", "()[Ljava/lang/reflect/Field;"));
     int numFields = env->GetArrayLength(fields);
-    for (i = 0; i < numFields; i++) {
+    for (int i = 0; i < numFields; i++) {
         jobject aJField = env->GetObjectArrayElement(static_cast<jobjectArray>(fields), i);
-        JavaField* aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
-        {
-            m_fields.set(aField->name().utf8(), aField);
-        }
+        JavaField* aField = new JavaFieldJobject(env, aJField); // deleted in the JavaClass destructor
+        m_fields.set(aField->name(), aField);
         env->DeleteLocalRef(aJField);
     }
 
     // Get the methods
     jarray methods = static_cast<jarray>(callJNIMethod<jobject>(aClass, "getMethods", "()[Ljava/lang/reflect/Method;"));
     int numMethods = env->GetArrayLength(methods);
-    for (i = 0; i < numMethods; i++) {
+    for (int i = 0; i < numMethods; i++) {
         jobject aJMethod = env->GetObjectArrayElement(static_cast<jobjectArray>(methods), i);
         JavaMethod* aMethod = new JavaMethodJobject(env, aJMethod); // deleted in the JavaClass destructor
-        MethodList* methodList;
-        {
-            methodList = m_methods.get(aMethod->name());
-            if (!methodList) {
-                methodList = new MethodList();
-                m_methods.set(aMethod->name(), methodList);
-            }
+        MethodList* methodList = m_methods.get(aMethod->name());
+        if (!methodList) {
+            methodList = new MethodList();
+            m_methods.set(aMethod->name(), methodList);
         }
         methodList->append(aMethod);
         env->DeleteLocalRef(aJMethod);
@@ -79,7 +73,7 @@ JavaClass::JavaClass(jobject anInstance)
     env->DeleteLocalRef(aClass);
 }
 
-JavaClass::~JavaClass()
+JavaClassJobject::~JavaClassJobject()
 {
     deleteAllValues(m_fields);
     m_fields.clear();
@@ -93,7 +87,7 @@ JavaClass::~JavaClass()
     m_methods.clear();
 }
 
-MethodList JavaClass::methodsNamed(const char* name) const
+MethodList JavaClassJobject::methodsNamed(const char* name) const
 {
     MethodList* methodList = m_methods.get(name);
 
@@ -102,7 +96,7 @@ MethodList JavaClass::methodsNamed(const char* name) const
     return MethodList();
 }
 
-JavaField* JavaClass::fieldNamed(const char* name) const
+JavaField* JavaClassJobject::fieldNamed(const char* name) const
 {
     return m_fields.get(name);
 }
diff --git a/Source/WebCore/bridge/jni/v8/JavaClassJobjectV8.h b/Source/WebCore/bridge/jni/v8/JavaClassJobjectV8.h
new file mode 100644
index 0000000..d27ca97
--- /dev/null
+++ b/Source/WebCore/bridge/jni/v8/JavaClassJobjectV8.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaClassJobjectV8_h
+#define JavaClassJobjectV8_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+#include "JNIUtility.h"
+#include "JavaClassV8.h"
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaClassJobject : public JavaClass {
+public:
+    JavaClassJobject(jobject);
+    virtual ~JavaClassJobject();
+
+    // JavaClass implementation
+    virtual MethodList methodsNamed(const char* name) const;
+    virtual JavaField* fieldNamed(const char* name) const;
+
+private:
+    typedef HashMap<WTF::String, MethodList*> MethodListMap;
+    MethodListMap m_methods;
+    FieldMap m_fields;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaClassJobjectV8_h
diff --git a/Source/WebCore/bridge/jni/v8/JavaClassV8.h b/Source/WebCore/bridge/jni/v8/JavaClassV8.h
index 6b03b2d..e60ca2d 100644
--- a/Source/WebCore/bridge/jni/v8/JavaClassV8.h
+++ b/Source/WebCore/bridge/jni/v8/JavaClassV8.h
@@ -28,11 +28,10 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JNIUtility.h"
-#include "PlatformString.h"
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
@@ -42,20 +41,14 @@ class JavaField;
 class JavaMethod;
 
 typedef Vector<JavaMethod*> MethodList;
-typedef HashMap<WTF::String, MethodList*> MethodListMap;
 typedef HashMap<WTF::String, JavaField*> FieldMap;
 
 class JavaClass {
 public:
-    JavaClass(jobject);
-    ~JavaClass();
+    virtual ~JavaClass() {}
 
-    MethodList methodsNamed(const char* name) const;
-    JavaField* fieldNamed(const char* name) const;
-
-private:
-    MethodListMap m_methods;
-    FieldMap m_fields;
+    virtual MethodList methodsNamed(const char* name) const = 0;
+    virtual JavaField* fieldNamed(const char* name) const = 0;
 };
 
 } // namespace Bindings
diff --git a/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp b/Source/WebCore/bridge/jni/v8/JavaFieldJobjectV8.cpp
index 2a6dd0b..0fe5837 100644
--- a/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaFieldJobjectV8.cpp
@@ -24,13 +24,13 @@
  */
 
 #include "config.h"
-#include "JavaFieldV8.h"
+#include "JavaFieldJobjectV8.h"
 
 #if ENABLE(JAVA_BRIDGE)
 
 using namespace JSC::Bindings;
 
-JavaField::JavaField(JNIEnv* env, jobject aField)
+JavaFieldJobject::JavaFieldJobject(JNIEnv* env, jobject aField)
 {
     // Get field type
     jobject fieldType = callJNIMethod<jobject>(aField, "getType", "()Ljava/lang/Class;");
diff --git a/Source/WebCore/bridge/jni/v8/JavaFieldJobjectV8.h b/Source/WebCore/bridge/jni/v8/JavaFieldJobjectV8.h
new file mode 100644
index 0000000..32c7857
--- /dev/null
+++ b/Source/WebCore/bridge/jni/v8/JavaFieldJobjectV8.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaFieldJobjectV8_h
+#define JavaFieldJobjectV8_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+#include "JavaFieldV8.h"
+#include "JavaString.h"
+#include "JobjectWrapper.h"
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaFieldJobject : public JavaField {
+public:
+    JavaFieldJobject(JNIEnv*, jobject);
+
+    // JavaField implementation
+    virtual String name() const { return m_name.impl(); }
+    virtual const char* typeClassName() const { return m_typeClassName.utf8(); }
+    virtual JavaType type() const { return m_type; }
+
+private:
+    JavaString m_name;
+    JavaString m_typeClassName;
+    JavaType m_type;
+    RefPtr<JobjectWrapper> m_field;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaFieldJobjectV8_h
diff --git a/Source/WebCore/bridge/jni/v8/JavaFieldV8.h b/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
index defed60..3c24cf5 100644
--- a/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
+++ b/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
@@ -28,8 +28,8 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JavaString.h"
-#include "JobjectWrapper.h"
+#include "JNIUtility.h"
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
@@ -37,17 +37,11 @@ namespace Bindings {
 
 class JavaField {
 public:
-    JavaField(JNIEnv*, jobject aField);
+    virtual ~JavaField() {}
 
-    const JavaString& name() const { return m_name; }
-    const char* typeClassName() const { return m_typeClassName.utf8(); }
-    JavaType type() const { return m_type; }
-
-private:
-    JavaString m_name;
-    JavaString m_typeClassName;
-    JavaType m_type;
-    RefPtr<JobjectWrapper> m_field;
+    virtual String name() const = 0;
+    virtual const char* typeClassName() const = 0;
+    virtual JavaType type() const = 0;
 };
 
 } // namespace Bindings
diff --git a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp b/Source/WebCore/bridge/jni/v8/JavaInstanceJobjectV8.cpp
index d1075ae..8221eff 100644
--- a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaInstanceJobjectV8.cpp
@@ -25,52 +25,46 @@
  */
 
 #include "config.h"
-#include "JavaInstanceV8.h"
+#include "JavaInstanceJobjectV8.h"
 
 #if ENABLE(JAVA_BRIDGE)
 
 #include "JNIUtilityPrivate.h"
-#include "JavaClassV8.h"
+#include "JavaClassJobjectV8.h"
 #include "JavaFieldV8.h"
 #include "JavaMethod.h"
 
 #include <wtf/OwnArrayPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/text/CString.h>
 
 using namespace JSC::Bindings;
 
-JavaInstance::JavaInstance(jobject instance)
+JavaInstanceJobject::JavaInstanceJobject(jobject instance)
+    : m_instance(new JobjectWrapper(instance))
 {
-    m_instance = new JobjectWrapper(instance);
-    m_class = 0;
-}
-
-JavaInstance::~JavaInstance()
-{
-    m_instance = 0;
-    delete m_class;
 }
 
 #define NUM_LOCAL_REFS 64
 
-void JavaInstance::virtualBegin()
+void JavaInstanceJobject::begin()
 {
     getJNIEnv()->PushLocalFrame(NUM_LOCAL_REFS);
 }
 
-void JavaInstance::virtualEnd()
+void JavaInstanceJobject::end()
 {
     getJNIEnv()->PopLocalFrame(0);
 }
 
-JavaClass* JavaInstance::getClass() const
+JavaClass* JavaInstanceJobject::getClass() const
 {
     if (!m_class)
-        m_class = new JavaClass(javaInstance());
-    return m_class;
+        m_class = adoptPtr(new JavaClassJobject(javaInstance()));
+    return m_class.get();
 }
 
-JavaValue JavaInstance::invokeMethod(const JavaMethod* method, JavaValue* args)
+JavaValue JavaInstanceJobject::invokeMethod(const JavaMethod* method, JavaValue* args)
 {
     ASSERT(getClass()->methodsNamed(method->name().utf8().data()).find(method) != notFound);
     unsigned int numParams = method->numParameters();
@@ -81,10 +75,10 @@ JavaValue JavaInstance::invokeMethod(const JavaMethod* method, JavaValue* args)
     return jvalueToJavaValue(result, method->returnType());
 }
 
-JavaValue JavaInstance::getField(const JavaField* field)
+JavaValue JavaInstanceJobject::getField(const JavaField* field)
 {
-    ASSERT(getClass()->fieldNamed(field->name().utf8()) == field);
-    return jvalueToJavaValue(getJNIField(javaInstance(), field->type(), field->name().utf8(), field->typeClassName()), field->type());
+    ASSERT(getClass()->fieldNamed(field->name().utf8().data()) == field);
+    return jvalueToJavaValue(getJNIField(javaInstance(), field->type(), field->name().utf8().data(), field->typeClassName()), field->type());
 }
 
 #endif // ENABLE(JAVA_BRIDGE)
diff --git a/Source/WebCore/bridge/jni/v8/JavaInstanceJobjectV8.h b/Source/WebCore/bridge/jni/v8/JavaInstanceJobjectV8.h
new file mode 100644
index 0000000..9f86037
--- /dev/null
+++ b/Source/WebCore/bridge/jni/v8/JavaInstanceJobjectV8.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2003, 2008, 2010 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaInstanceJobjectV8_h
+#define JavaInstanceJobjectV8_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+#include "JNIUtility.h"
+#include "JavaInstanceV8.h"
+#include "JobjectWrapper.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/RefPtr.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaInstanceJobject : public JavaInstance {
+public:
+    JavaInstanceJobject(jobject instance);
+
+    // JavaInstance implementation
+    virtual JavaClass* getClass() const;
+    virtual JavaValue invokeMethod(const JavaMethod*, JavaValue* args);
+    virtual JavaValue getField(const JavaField*);
+    virtual void begin();
+    virtual void end();
+
+    jobject javaInstance() const { return m_instance->m_instance; }
+
+protected:
+    RefPtr<JobjectWrapper> m_instance;
+    mutable OwnPtr<JavaClass> m_class;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaInstanceJobjectV8_h
diff --git a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
index b1150f8..7436de7 100644
--- a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
+++ b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
@@ -29,13 +29,8 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JNIUtility.h"
 #include "JavaValueV8.h"
-#include "JobjectWrapper.h"
-#include "npruntime.h"
-
 #include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
 
 using namespace WTF;
 
@@ -49,28 +44,19 @@ class JavaMethod;
 
 class JavaInstance : public RefCounted<JavaInstance> {
 public:
-    JavaInstance(jobject instance);
-    virtual ~JavaInstance();
+    virtual ~JavaInstance() {}
 
-    JavaClass* getClass() const;
+    virtual JavaClass* getClass() const = 0;
     // args must be an array of length greater than or equal to the number of
     // arguments expected by the method.
-    JavaValue invokeMethod(const JavaMethod*, JavaValue* args);
-    JavaValue getField(const JavaField*);
-    jobject javaInstance() const { return m_instance->m_instance; }
+    virtual JavaValue invokeMethod(const JavaMethod*, JavaValue* args) = 0;
+    virtual JavaValue getField(const JavaField*) = 0;
 
     // These functions are called before and after the main entry points into
     // the native implementations.  They can be used to establish and cleanup
     // any needed state.
-    void begin() { virtualBegin(); }
-    void end() { virtualEnd(); }
-
-protected:
-    RefPtr<JobjectWrapper> m_instance;
-    mutable JavaClass* m_class;
-
-    virtual void virtualBegin();
-    virtual void virtualEnd();
+    virtual void begin() = 0;
+    virtual void end() = 0;
 };
 
 } // namespace Bindings
diff --git a/Source/WebCore/bridge/jsc/BridgeJSC.h b/Source/WebCore/bridge/jsc/BridgeJSC.h
index c44faf1..95a3973 100644
--- a/Source/WebCore/bridge/jsc/BridgeJSC.h
+++ b/Source/WebCore/bridge/jsc/BridgeJSC.h
@@ -124,7 +124,7 @@ protected:
     RefPtr<RootObject> m_rootObject;
 
 private:
-    WeakGCPtr<RuntimeObject> m_runtimeObject;
+    Weak<RuntimeObject> m_runtimeObject;
 };
 
 class Array {
diff --git a/Source/WebCore/bridge/objc/ObjCRuntimeObject.h b/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
index b29a333..f8eada7 100644
--- a/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
+++ b/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
@@ -42,7 +42,7 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/objc/objc_instance.mm b/Source/WebCore/bridge/objc/objc_instance.mm
index 4f93cfa..61c67cb 100644
--- a/Source/WebCore/bridge/objc/objc_instance.mm
+++ b/Source/WebCore/bridge/objc/objc_instance.mm
@@ -184,7 +184,7 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/objc/objc_runtime.h b/Source/WebCore/bridge/objc/objc_runtime.h
index 4ef0afd..eded2fe 100644
--- a/Source/WebCore/bridge/objc/objc_runtime.h
+++ b/Source/WebCore/bridge/objc/objc_runtime.h
@@ -103,7 +103,7 @@ public:
         return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/qt/qt_class.cpp b/Source/WebCore/bridge/qt/qt_class.cpp
index 3c1836a..c3d8b27 100644
--- a/Source/WebCore/bridge/qt/qt_class.cpp
+++ b/Source/WebCore/bridge/qt/qt_class.cpp
@@ -87,7 +87,7 @@ JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifie
         QMetaMethod m = m_metaObject->method(index);
         if (m.access() != QMetaMethod::Private) {
             QtRuntimeMetaMethod* val = new (exec) QtRuntimeMetaMethod(exec, identifier, static_cast<QtInstance*>(inst), index, normal, false);
-            qtinst->m_methods.insert(name, val);
+            qtinst->m_methods.insert(name, WriteBarrier<JSObject>(exec->globalData(), qtinst->createRuntimeObject(exec), val));
             return val;
         }
     }
@@ -106,7 +106,7 @@ JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifie
 
         if (normal == QByteArray::fromRawData(signature, iter)) {
             QtRuntimeMetaMethod* val = new (exec) QtRuntimeMetaMethod(exec, identifier, static_cast<QtInstance*>(inst), index, normal, false);
-            qtinst->m_methods.insert(name, val);
+            qtinst->m_methods.insert(name, WriteBarrier<JSObject>(exec->globalData(), qtinst->createRuntimeObject(exec), val));
             return val;
         }
     }
diff --git a/Source/WebCore/bridge/qt/qt_instance.cpp b/Source/WebCore/bridge/qt/qt_instance.cpp
index 91ae40f..2d29e01 100644
--- a/Source/WebCore/bridge/qt/qt_instance.cpp
+++ b/Source/WebCore/bridge/qt/qt_instance.cpp
@@ -59,7 +59,7 @@ public:
             instance->markAggregate(markStack);
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
@@ -151,12 +151,12 @@ void QtInstance::removeCachedMethod(JSObject* method)
     if (m_defaultMethod.get() == method)
         m_defaultMethod.clear();
 
-    for (QHash<QByteArray, DeprecatedPtr<JSObject> >::Iterator it = m_methods.begin(),
-        end = m_methods.end(); it != end; ++it)
+    for (QHash<QByteArray, WriteBarrier<JSObject> >::Iterator it = m_methods.begin(), end = m_methods.end(); it != end; ++it) {
         if (it.value().get() == method) {
             m_methods.erase(it);
             return;
         }
+    }
 }
 
 QtInstance* QtInstance::getInstance(JSObject* object)
@@ -189,10 +189,8 @@ void QtInstance::markAggregate(MarkStack& markStack)
 {
     if (m_defaultMethod)
         markStack.append(&m_defaultMethod);
-    foreach (DeprecatedPtr<JSObject> val, m_methods.values()) {
-        if (val)
-            markStack.append(&val);
-    }
+    for (QHash<QByteArray, WriteBarrier<JSObject> >::Iterator it = m_methods.begin(), end = m_methods.end(); it != end; ++it)
+        markStack.append(&it.value());
 }
 
 void QtInstance::begin()
diff --git a/Source/WebCore/bridge/qt/qt_instance.h b/Source/WebCore/bridge/qt/qt_instance.h
index 003c801..b802500 100644
--- a/Source/WebCore/bridge/qt/qt_instance.h
+++ b/Source/WebCore/bridge/qt/qt_instance.h
@@ -83,7 +83,7 @@ private:
     mutable QtClass* m_class;
     QPointer<QObject> m_object;
     QObject* m_hashkey;
-    mutable QHash<QByteArray, DeprecatedPtr<JSObject> > m_methods;
+    mutable QHash<QByteArray, WriteBarrier<JSObject> > m_methods;
     mutable QHash<QString, QtField*> m_fields;
     mutable WriteBarrier<QtRuntimeMetaMethod> m_defaultMethod;
     QScriptEngine::ValueOwnership m_ownership;
diff --git a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
index da3e383..c498637 100644
--- a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
+++ b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -150,7 +150,7 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/qt/qt_runtime.h b/Source/WebCore/bridge/qt/qt_runtime.h
index 85b34b8..fa5ce62 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.h
+++ b/Source/WebCore/bridge/qt/qt_runtime.h
@@ -22,7 +22,7 @@
 
 #include "BridgeJSC.h"
 #include "Completion.h"
-#include "Global.h"
+#include "Strong.h"
 #include "runtime_method.h"
 
 #include <qbytearray.h>
@@ -153,7 +153,7 @@ public:
         return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
@@ -229,8 +229,8 @@ private:
     RefPtr<QtInstance> m_instance;
     int m_signalIndex;
     QObject* m_originalObject; // only used as a key, not dereferenced
-    Global<JSObject> m_thisObject;
-    Global<JSObject> m_funcObject;
+    Strong<JSObject> m_thisObject;
+    Strong<JSObject> m_funcObject;
 };
 
 QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance);
diff --git a/Source/WebCore/bridge/runtime_array.cpp b/Source/WebCore/bridge/runtime_array.cpp
index a138660..e3c8f57 100644
--- a/Source/WebCore/bridge/runtime_array.cpp
+++ b/Source/WebCore/bridge/runtime_array.cpp
@@ -40,7 +40,7 @@ const ClassInfo RuntimeArray::s_info = { "RuntimeArray", &JSArray::s_info, 0, 0
 RuntimeArray::RuntimeArray(ExecState* exec, Bindings::Array* array)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "array".
-    : JSArray(deprecatedGetDOMStructure<RuntimeArray>(exec))
+    : JSArray(exec->globalData(), deprecatedGetDOMStructure<RuntimeArray>(exec))
 {
     ASSERT(inherits(&s_info));
     setSubclassData(array);
diff --git a/Source/WebCore/bridge/runtime_array.h b/Source/WebCore/bridge/runtime_array.h
index 9555545..8fd3052 100644
--- a/Source/WebCore/bridge/runtime_array.h
+++ b/Source/WebCore/bridge/runtime_array.h
@@ -58,7 +58,7 @@ public:
         return globalObject->arrayPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/runtime_method.cpp b/Source/WebCore/bridge/runtime_method.cpp
index 4b5ecff..297fb6b 100644
--- a/Source/WebCore/bridge/runtime_method.cpp
+++ b/Source/WebCore/bridge/runtime_method.cpp
@@ -43,7 +43,7 @@ ASSERT_CLASS_FITS_IN_CELL(RuntimeMethod);
 
 const ClassInfo RuntimeMethod::s_info = { "RuntimeMethod", &InternalFunction::s_info, 0, 0 };
 
-RuntimeMethod::RuntimeMethod(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const Identifier& ident, Bindings::MethodList& m)
+RuntimeMethod::RuntimeMethod(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const Identifier& ident, Bindings::MethodList& m)
     // Callers will need to pass in the right global object corresponding to this native object "m".
     : InternalFunction(&exec->globalData(), globalObject, structure, ident)
     , _methodList(new MethodList(m))
diff --git a/Source/WebCore/bridge/runtime_method.h b/Source/WebCore/bridge/runtime_method.h
index 9df796e..712a305 100644
--- a/Source/WebCore/bridge/runtime_method.h
+++ b/Source/WebCore/bridge/runtime_method.h
@@ -35,7 +35,7 @@ namespace JSC {
 
 class RuntimeMethod : public InternalFunction {
 public:
-    RuntimeMethod(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, const Identifier& name, Bindings::MethodList&);
+    RuntimeMethod(ExecState*, JSGlobalObject*, Structure*, const Identifier& name, Bindings::MethodList&);
     Bindings::MethodList* methods() const { return _methodList.get(); }
 
     static const ClassInfo s_info;
@@ -45,7 +45,7 @@ public:
         return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/runtime_object.cpp b/Source/WebCore/bridge/runtime_object.cpp
index de1964a..79bcbce 100644
--- a/Source/WebCore/bridge/runtime_object.cpp
+++ b/Source/WebCore/bridge/runtime_object.cpp
@@ -38,7 +38,7 @@ namespace Bindings {
 
 const ClassInfo RuntimeObject::s_info = { "RuntimeObject", &JSObjectWithGlobalObject::s_info, 0, 0 };
 
-RuntimeObject::RuntimeObject(ExecState*, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
+RuntimeObject::RuntimeObject(ExecState*, JSGlobalObject* globalObject, Structure* structure, PassRefPtr<Instance> instance)
     : JSObjectWithGlobalObject(globalObject, structure)
     , m_instance(instance)
 {
diff --git a/Source/WebCore/bridge/runtime_object.h b/Source/WebCore/bridge/runtime_object.h
index bb6d051..8998102 100644
--- a/Source/WebCore/bridge/runtime_object.h
+++ b/Source/WebCore/bridge/runtime_object.h
@@ -35,7 +35,7 @@ namespace Bindings {
 
 class RuntimeObject : public JSObjectWithGlobalObject {
 public:
-    RuntimeObject(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, PassRefPtr<Instance>);
+    RuntimeObject(ExecState*, JSGlobalObject*, Structure*, PassRefPtr<Instance>);
     virtual ~RuntimeObject();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
@@ -61,7 +61,7 @@ public:
         return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebCore/bridge/runtime_root.h b/Source/WebCore/bridge/runtime_root.h
index feade45..f1ea671 100644
--- a/Source/WebCore/bridge/runtime_root.h
+++ b/Source/WebCore/bridge/runtime_root.h
@@ -29,7 +29,7 @@
 #if PLATFORM(MAC)
 #include "jni_jsobject.h"
 #endif
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 
 #include <runtime/WeakGCMap.h>
 #include <wtf/Forward.h>
@@ -86,7 +86,7 @@ private:
     bool m_isValid;
     
     const void* m_nativeHandle;
-    Global<JSGlobalObject> m_globalObject;
+    Strong<JSGlobalObject> m_globalObject;
 
     ProtectCountSet m_protectCountSet;
     WeakGCMap<RuntimeObject*, RuntimeObject> m_runtimeObjects; // Really need a WeakGCSet, but this will do.
diff --git a/Source/WebCore/config.h b/Source/WebCore/config.h
index 13cf56d..513a6c6 100644
--- a/Source/WebCore/config.h
+++ b/Source/WebCore/config.h
@@ -64,8 +64,8 @@
 #else
 #define WEBKIT_EXPORTDATA __declspec(dllimport)
 #endif
-#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
-#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
 #define JS_EXPORTCLASS JS_EXPORTDATA
 #else
 #define JS_EXPORTDATA
@@ -272,15 +272,15 @@
 
 #if PLATFORM(WIN)
 #if defined(WIN_CAIRO)
-#undef WTF_PLATFORM_CG
-#define WTF_PLATFORM_CAIRO 1
+#undef WTF_USE_CG
+#define WTF_USE_CAIRO 1
 #define WTF_USE_CURL 1
 #ifndef _WINSOCKAPI_
 #define _WINSOCKAPI_ // Prevent inclusion of winsock.h in windows.h
 #endif
 #elif !OS(WINCE)
-#define WTF_PLATFORM_CG 1
-#undef WTF_PLATFORM_CAIRO
+#define WTF_USE_CG 1
+#undef WTF_USE_CAIRO
 #undef WTF_USE_CURL
 #endif
 #endif
@@ -322,7 +322,7 @@
 #define WTF_USE_JSC !WTF_USE_V8
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG)
 #ifndef CGFLOAT_DEFINED
 #ifdef __LP64__
 typedef double CGFloat;
@@ -331,20 +331,20 @@ typedef float CGFloat;
 #endif
 #define CGFLOAT_DEFINED 1
 #endif
-#endif /* PLATFORM(CG) */
+#endif /* USE(CG) */
 
 #ifdef BUILDING_ON_TIGER
 #undef ENABLE_FTPDIR
 #define ENABLE_FTPDIR 0
 #endif
 
-#if PLATFORM(WIN) && PLATFORM(CG)
+#if PLATFORM(WIN) && USE(CG)
 #define WTF_USE_SAFARI_THEME 1
 #endif
 
 // CoreAnimation is available to IOS, Mac and Windows if using CG
-#if PLATFORM(MAC) || PLATFORM(IOS) || (PLATFORM(WIN) && PLATFORM(CG))
-#define WTF_PLATFORM_CA 1
+#if PLATFORM(MAC) || PLATFORM(IOS) || (PLATFORM(WIN) && USE(CG))
+#define WTF_USE_CA 1
 #endif
 
 #if PLATFORM(QT) && USE(V8) && defined(Q_WS_X11)
diff --git a/Source/WebCore/css/CSSFontFaceSource.cpp b/Source/WebCore/css/CSSFontFaceSource.cpp
index d32684e..eeb90a4 100644
--- a/Source/WebCore/css/CSSFontFaceSource.cpp
+++ b/Source/WebCore/css/CSSFontFaceSource.cpp
@@ -51,7 +51,7 @@ CSSFontFaceSource::CSSFontFaceSource(const String& str, CachedFont* font)
     , m_font(font)
     , m_face(0)
 #if ENABLE(SVG_FONTS)
-    , m_svgFontFaceElement(0)
+    , m_hasExternalSVGFont(false)
 #endif
 {
     if (m_font)
@@ -126,7 +126,7 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
     if (isLoaded()) {
         if (m_font) {
 #if ENABLE(SVG_FONTS)
-            if (m_font->isSVGFont()) {
+            if (m_hasExternalSVGFont) {
                 // For SVG fonts parse the external SVG document, and extract the <font> element.
                 if (!m_font->ensureSVGFontData())
                     return 0;
@@ -204,7 +204,7 @@ void CSSFontFaceSource::setSVGFontFaceElement(PassRefPtr<SVGFontFaceElement> ele
 
 bool CSSFontFaceSource::isSVGFontFaceSource() const
 {
-    return m_svgFontFaceElement || (m_font && m_font->isSVGFont());
+    return m_svgFontFaceElement || m_hasExternalSVGFont;
 }
 #endif
 
diff --git a/Source/WebCore/css/CSSFontFaceSource.h b/Source/WebCore/css/CSSFontFaceSource.h
index a5c3e61..e87fbfc 100644
--- a/Source/WebCore/css/CSSFontFaceSource.h
+++ b/Source/WebCore/css/CSSFontFaceSource.h
@@ -66,6 +66,7 @@ public:
     SVGFontFaceElement* svgFontFaceElement() const;
     void setSVGFontFaceElement(PassRefPtr<SVGFontFaceElement>);
     bool isSVGFontFaceSource() const;
+    void setHasExternalSVGFont(bool value) { m_hasExternalSVGFont = value; }
 #endif
 
 private:
@@ -77,6 +78,7 @@ private:
 #if ENABLE(SVG_FONTS)
     RefPtr<SVGFontFaceElement> m_svgFontFaceElement;
     RefPtr<SVGFontElement> m_externalSVGFontElement;
+    bool m_hasExternalSVGFont;
 #endif
 };
 
diff --git a/Source/WebCore/css/CSSFontSelector.cpp b/Source/WebCore/css/CSSFontSelector.cpp
index 9c9a844..8024afa 100644
--- a/Source/WebCore/css/CSSFontSelector.cpp
+++ b/Source/WebCore/css/CSSFontSelector.cpp
@@ -247,11 +247,11 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
             if (allowDownloading && item->isSupportedFormat() && m_document) {
                 CachedFont* cachedFont = m_document->cachedResourceLoader()->requestFont(item->resource());
                 if (cachedFont) {
+                    source = new CSSFontFaceSource(item->resource(), cachedFont);
 #if ENABLE(SVG_FONTS)
                     if (foundSVGFont)
-                        cachedFont->setSVGFont(true);
+                        source->setHasExternalSVGFont(true);
 #endif
-                    source = new CSSFontFaceSource(item->resource(), cachedFont);
                 }
             }
         } else {
@@ -345,18 +345,37 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
     }
 }
 
-void CSSFontSelector::fontLoaded()
+void CSSFontSelector::registerForInvalidationCallbacks(FontSelectorClient* client)
+{
+    m_clients.add(client);
+}
+
+void CSSFontSelector::unregisterForInvalidationCallbacks(FontSelectorClient* client)
+{
+    m_clients.remove(client);
+}
+
+void CSSFontSelector::dispatchInvalidationCallbacks()
 {
+    Vector<FontSelectorClient*> clients;
+    copyToVector(m_clients, clients);
+    for (size_t i = 0; i < clients.size(); ++i)
+        clients[i]->fontsNeedUpdate(this);
+
+    // FIXME: Make Document a FontSelectorClient so that it can simply register for invalidation callbacks.
     if (!m_document || m_document->inPageCache() || !m_document->renderer())
         return;
     m_document->scheduleForcedStyleRecalc();
 }
 
+void CSSFontSelector::fontLoaded()
+{
+    dispatchInvalidationCallbacks();
+}
+
 void CSSFontSelector::fontCacheInvalidated()
 {
-    if (!m_document || m_document->inPageCache() || !m_document->renderer())
-        return;
-    m_document->scheduleForcedStyleRecalc();
+    dispatchInvalidationCallbacks();
 }
 
 static FontData* fontDataForGenericFamily(Document* document, const FontDescription& fontDescription, const AtomicString& familyName)
diff --git a/Source/WebCore/css/CSSFontSelector.h b/Source/WebCore/css/CSSFontSelector.h
index 93ee274..f50ea42 100644
--- a/Source/WebCore/css/CSSFontSelector.h
+++ b/Source/WebCore/css/CSSFontSelector.h
@@ -29,6 +29,7 @@
 #include "FontSelector.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
 #include <wtf/text/StringHash.h>
 
@@ -62,13 +63,19 @@ public:
 
     CachedResourceLoader* cachedResourceLoader() const;
 
+    virtual void registerForInvalidationCallbacks(FontSelectorClient*);
+    virtual void unregisterForInvalidationCallbacks(FontSelectorClient*);
+
 private:
     CSSFontSelector(Document*);
 
+    void dispatchInvalidationCallbacks();
+
     Document* m_document;
     HashMap<String, Vector<RefPtr<CSSFontFace> >*, CaseFoldingHash> m_fontFaces;
     HashMap<String, Vector<RefPtr<CSSFontFace> >*, CaseFoldingHash> m_locallyInstalledFontFaces;
     HashMap<String, HashMap<unsigned, RefPtr<CSSSegmentedFontFace> >*, CaseFoldingHash> m_fonts;
+    HashSet<FontSelectorClient*> m_clients;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index 246a449..269eaf0 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -99,7 +99,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 55
+%expect 54
 
 %nonassoc LOWEST_PREC
 
@@ -226,7 +226,6 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %type <string> string_or_uri
 %type <string> ident_or_string
 %type <string> medium
-%type <string> hexcolor
 %type <marginBox> margin_sym
 
 %type <string> media_feature
@@ -1414,7 +1413,7 @@ term:
   | unary_operator DIMEN maybe_space { $$.id = 0; $$.string = $2; $$.unit = CSSPrimitiveValue::CSS_DIMENSION; }
   | URI maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_URI; }
   | UNICODERANGE maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_UNICODE_RANGE; }
-  | hexcolor { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; }
+  | HEX maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; }
   | '#' maybe_space { $$.id = 0; $$.string = CSSParserString(); $$.unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; } /* Handle error case: "color: #;" */
   /* FIXME: according to the specs a function can have a unary_operator in front. I know no case where this makes sense */
   | function {
@@ -1520,7 +1519,8 @@ calc_func_paren_expr:
             $$->insertValueAt(0, v);
             v.iValue = ')';
             $$->addValue(v);
-        }
+        } else
+            $$ = 0;
     }
 
 calc_func_expr:
@@ -1619,17 +1619,6 @@ min_or_max_function:
     }
     ;
 
-/*
- * There is a constraint on the color that it must
- * have either 3 or 6 hex-digits (i.e., [0-9a-fA-F])
- * after the "#"; e.g., "#000" is OK, but "#abcd" is not.
- */
-hexcolor:
-  HEX maybe_space { $$ = $1; }
-  | IDSEL maybe_space { $$ = $1; }
-  ;
-
-
 /* error handling rules */
 
 save_block:
diff --git a/Source/WebCore/css/CSSMutableStyleDeclaration.cpp b/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
index 6485e5b..8c8d5ba 100644
--- a/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -585,8 +585,7 @@ bool CSSMutableStyleDeclaration::setProperty(int propertyID, const String& value
 
     // When replacing an existing property value, this moves the property to the end of the list.
     // Firefox preserves the position, and MSIE moves the property to the beginning.
-    CSSParser parser(useStrictParsing());
-    bool success = parser.parseValue(this, propertyID, value, important);
+    bool success = CSSParser::parseValue(this, propertyID, value, important, useStrictParsing());
     if (!success) {
         // CSS DOM requires raising SYNTAX_ERR here, but this is too dangerous for compatibility,
         // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
@@ -619,6 +618,15 @@ bool CSSMutableStyleDeclaration::setProperty(int propertyID, int value, bool imp
     return true;
 }
 
+bool CSSMutableStyleDeclaration::setProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes unit, bool important, bool notifyChanged)
+{
+    CSSProperty property(propertyID, CSSPrimitiveValue::create(value, unit), important);
+    setPropertyInternal(property);
+    if (notifyChanged)
+        setNeedsStyleRecalc();
+    return true;
+}
+
 void CSSMutableStyleDeclaration::setStringProperty(int propertyId, const String &value, CSSPrimitiveValue::UnitTypes type, bool important)
 {
     ASSERT(!m_iteratorCount);
diff --git a/Source/WebCore/css/CSSMutableStyleDeclaration.h b/Source/WebCore/css/CSSMutableStyleDeclaration.h
index ca17f11..ea8ab3f 100644
--- a/Source/WebCore/css/CSSMutableStyleDeclaration.h
+++ b/Source/WebCore/css/CSSMutableStyleDeclaration.h
@@ -109,6 +109,7 @@ public:
     virtual PassRefPtr<CSSMutableStyleDeclaration> copy() const;
 
     bool setProperty(int propertyID, int value, bool important = false, bool notifyChanged = true);
+    bool setProperty(int propertyId, double value, CSSPrimitiveValue::UnitTypes, bool important = false, bool notifyChanged = true);
     bool setProperty(int propertyID, const String& value, bool important = false, bool notifyChanged = true);
 
     String removeProperty(int propertyID, bool notifyChanged = true, bool returnText = false);
@@ -117,7 +118,7 @@ public:
     void setLengthProperty(int propertyId, const String& value, bool important, bool multiLength = false);
     void setStringProperty(int propertyId, const String& value, CSSPrimitiveValue::UnitTypes, bool important = false); // parsed string value
     void setImageProperty(int propertyId, const String& url, bool important = false);
- 
+
     // The following parses an entire new style declaration.
     void parseDeclaration(const String& styleDeclaration);
 
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index a941600..b7030b2 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -281,7 +281,164 @@ PassRefPtr<CSSRule> CSSParser::parseKeyframeRule(CSSStyleSheet *sheet, const Str
     return m_keyframe.release();
 }
 
-bool CSSParser::parseValue(CSSMutableStyleDeclaration* declaration, int id, const String& string, bool important)
+static inline bool isColorPropertyID(int propertyId)
+{
+    switch (propertyId) {
+    case CSSPropertyColor:
+    case CSSPropertyBackgroundColor:
+    case CSSPropertyBorderBottomColor:
+    case CSSPropertyBorderLeftColor:
+    case CSSPropertyBorderRightColor:
+    case CSSPropertyBorderTopColor:
+    case CSSPropertyOutlineColor:
+    case CSSPropertyTextLineThroughColor:
+    case CSSPropertyTextOverlineColor:
+    case CSSPropertyTextUnderlineColor:
+    case CSSPropertyWebkitBorderAfterColor:
+    case CSSPropertyWebkitBorderBeforeColor:
+    case CSSPropertyWebkitBorderEndColor:
+    case CSSPropertyWebkitBorderStartColor:
+    case CSSPropertyWebkitColumnRuleColor:
+    case CSSPropertyWebkitTextEmphasisColor:
+    case CSSPropertyWebkitTextFillColor:
+    case CSSPropertyWebkitTextStrokeColor:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static bool parseColorValue(CSSMutableStyleDeclaration* declaration, int propertyId, const String& string, bool important, bool strict)
+{
+    if (!string.length())
+        return false;
+    if (!isColorPropertyID(propertyId))
+        return false;
+    CSSParserString cssString;
+    cssString.characters = const_cast<UChar*>(string.characters());
+    cssString.length = string.length();
+    int valueID = cssValueKeywordID(cssString);
+    bool validPrimitive = false;
+    if (valueID == CSSValueWebkitText)
+        validPrimitive = true;
+    else if (valueID == CSSValueCurrentcolor)
+        validPrimitive = true;
+    else if ((valueID >= CSSValueAqua && valueID <= CSSValueWindowtext) || valueID == CSSValueMenu
+             || (valueID >= CSSValueWebkitFocusRingColor && valueID < CSSValueWebkitText && !strict)) {
+        validPrimitive = true;
+    }
+
+    CSSStyleSheet* stylesheet = static_cast<CSSStyleSheet*>(declaration->stylesheet());
+    if (!stylesheet || !stylesheet->document())
+        return false;
+    if (validPrimitive) {
+        CSSProperty property(propertyId, stylesheet->document()->cssPrimitiveValueCache()->createIdentifierValue(valueID), important);
+        declaration->addParsedProperty(property);
+        return true;
+    }
+    RGBA32 color;
+    if (!CSSParser::parseColor(string, color, strict && string[0] != '#'))
+        return false;
+    CSSProperty property(propertyId, stylesheet->document()->cssPrimitiveValueCache()->createColorValue(color), important);
+    declaration->addParsedProperty(property);
+    return true;
+}
+
+static inline bool isSimpleLengthPropertyID(int propertyId, bool& acceptsNegativeNumbers)
+{
+    switch (propertyId) {
+    case CSSPropertyFontSize:
+    case CSSPropertyHeight:
+    case CSSPropertyWidth:
+    case CSSPropertyMinHeight:
+    case CSSPropertyMinWidth:
+    case CSSPropertyPaddingBottom:
+    case CSSPropertyPaddingLeft:
+    case CSSPropertyPaddingRight: 
+    case CSSPropertyPaddingTop:
+    case CSSPropertyWebkitLogicalWidth:
+    case CSSPropertyWebkitLogicalHeight:
+    case CSSPropertyWebkitMinLogicalWidth:
+    case CSSPropertyWebkitMinLogicalHeight:
+    case CSSPropertyWebkitPaddingAfter:
+    case CSSPropertyWebkitPaddingBefore:
+    case CSSPropertyWebkitPaddingEnd:
+    case CSSPropertyWebkitPaddingStart:
+        acceptsNegativeNumbers = false;
+        return true;
+    case CSSPropertyBottom:
+    case CSSPropertyLeft:
+    case CSSPropertyMarginBottom:
+    case CSSPropertyMarginLeft: 
+    case CSSPropertyMarginRight: 
+    case CSSPropertyMarginTop:
+    case CSSPropertyRight:
+    case CSSPropertyTextIndent:
+    case CSSPropertyTop:
+    case CSSPropertyWebkitMarginAfter:
+    case CSSPropertyWebkitMarginBefore:
+    case CSSPropertyWebkitMarginEnd:
+    case CSSPropertyWebkitMarginStart:
+        acceptsNegativeNumbers = true;
+        return true;
+    default:
+        return false;
+    }
+}
+
+static bool parseSimpleLengthValue(CSSMutableStyleDeclaration* declaration, int propertyId, const String& string, bool important, bool strict)
+{
+    const UChar* characters = string.characters();
+    unsigned length = string.length();
+    if (!characters || !length)
+        return false;
+    bool acceptsNegativeNumbers;
+    if (!isSimpleLengthPropertyID(propertyId, acceptsNegativeNumbers))
+        return false;
+
+    CSSPrimitiveValue::UnitTypes unit = CSSPrimitiveValue::CSS_NUMBER;
+    if (length > 2 && characters[length - 2] == 'p' && characters[length - 1] == 'x') {
+        length -= 2;
+        unit = CSSPrimitiveValue::CSS_PX;
+    } else if (length > 1 && characters[length - 1] == '%') {
+        length -= 1;
+        unit = CSSPrimitiveValue::CSS_PERCENTAGE;
+    }
+
+    // We rely on charactersToDouble for validation as well. The function
+    // will set "ok" to "false" if the entire passed-in character range does
+    // not represent a double.
+    bool ok;
+    double number = charactersToDouble(characters, length, &ok);
+    if (!ok)
+        return false;
+    if (unit == CSSPrimitiveValue::CSS_NUMBER) {
+        if (number && strict)
+            return false;
+        unit = CSSPrimitiveValue::CSS_PX;
+    }
+    if (number < 0 && !acceptsNegativeNumbers)
+        return false;
+
+    CSSStyleSheet* stylesheet = static_cast<CSSStyleSheet*>(declaration->stylesheet());
+    if (!stylesheet || !stylesheet->document())
+        return false;
+    CSSProperty property(propertyId, stylesheet->document()->cssPrimitiveValueCache()->createValue(number, unit), important);
+    declaration->addParsedProperty(property);
+    return true;
+}
+
+bool CSSParser::parseValue(CSSMutableStyleDeclaration* declaration, int propertyId, const String& string, bool important, bool strict)
+{
+    if (parseSimpleLengthValue(declaration, propertyId, string, important, strict))
+        return true;
+    if (parseColorValue(declaration, propertyId, string, important, strict))
+        return true;
+    CSSParser parser(strict);
+    return parser.parseValue(declaration, propertyId, string, important);
+}
+
+bool CSSParser::parseValue(CSSMutableStyleDeclaration* declaration, int propertyId, const String& string, bool important)
 {
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
@@ -291,7 +448,7 @@ bool CSSParser::parseValue(CSSMutableStyleDeclaration* declaration, int id, cons
 
     setupParser("@-webkit-value{", string, "} ");
 
-    m_id = id;
+    m_id = propertyId;
     m_important = important;
 
     cssyyparse(this);
@@ -6086,13 +6243,13 @@ Vector<OwnPtr<CSSParserSelector> >* CSSParser::createFloatingSelectorVector()
     return selectorVector;
 }
 
-Vector<OwnPtr<CSSParserSelector> >* CSSParser::sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >* selectorVector)
+PassOwnPtr<Vector<OwnPtr<CSSParserSelector> > > CSSParser::sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >* selectorVector)
 {
     if (selectorVector) {
         ASSERT(m_floatingSelectorVectors.contains(selectorVector));
         m_floatingSelectorVectors.remove(selectorVector);
     }
-    return selectorVector;
+    return adoptPtr(selectorVector);
 }
 
 CSSParserValueList* CSSParser::createFloatingValueList()
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index c03afd9..4b1fad6 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -63,7 +63,7 @@ namespace WebCore {
         void parseSheet(CSSStyleSheet*, const String&, int startLineNumber = 0, StyleRuleRangeMap* ruleRangeMap = 0);
         PassRefPtr<CSSRule> parseRule(CSSStyleSheet*, const String&);
         PassRefPtr<CSSRule> parseKeyframeRule(CSSStyleSheet*, const String&);
-        bool parseValue(CSSMutableStyleDeclaration*, int propId, const String&, bool important);
+        static bool parseValue(CSSMutableStyleDeclaration*, int propId, const String&, bool important, bool strict);
         static bool parseColor(RGBA32& color, const String&, bool strict = false);
         static bool parseSystemColor(RGBA32& color, const String&, Document*);
         bool parseColor(CSSMutableStyleDeclaration*, const String&);
@@ -186,7 +186,7 @@ namespace WebCore {
         PassOwnPtr<CSSParserSelector> sinkFloatingSelector(CSSParserSelector*);
 
         Vector<OwnPtr<CSSParserSelector> >* createFloatingSelectorVector();
-        Vector<OwnPtr<CSSParserSelector> >* sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >*);
+        PassOwnPtr<Vector<OwnPtr<CSSParserSelector> > > sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >*);
 
         CSSParserValueList* createFloatingValueList();
         CSSParserValueList* sinkFloatingValueList(CSSParserValueList*);
@@ -291,6 +291,8 @@ namespace WebCore {
         bool isGeneratedImageValue(CSSParserValue*) const;
         bool parseGeneratedImage(RefPtr<CSSValue>&);
 
+        bool parseValue(CSSMutableStyleDeclaration*, int propId, const String&, bool important);
+
         enum SizeParameterType {
             None,
             Auto,
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index 16412ad..b1f9aec 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -42,6 +42,7 @@
 #include "TextOrientation.h"
 #include "TextRenderingMode.h"
 #include "ThemeTypes.h"
+#include "UnicodeBidi.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index a87d4f3..9cf8c99 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -160,36 +160,6 @@ PseudoId CSSSelector::pseudoId(PseudoType type)
         return INNER_SPIN_BUTTON;
     case PseudoOuterSpinButton:
         return OUTER_SPIN_BUTTON;
-#if ENABLE(METER_TAG)
-    case PseudoMeterHorizontalBar:
-        return METER_HORIZONTAL_BAR;
-    case PseudoMeterHorizontalOptimum:
-        return METER_HORIZONTAL_OPTIMUM;
-    case PseudoMeterHorizontalSuboptimal:
-        return METER_HORIZONTAL_SUBOPTIMAL;
-    case PseudoMeterHorizontalEvenLessGood:
-        return METER_HORIZONTAL_EVEN_LESS_GOOD;
-    case PseudoMeterVerticalBar:
-        return METER_VERTICAL_BAR;
-    case PseudoMeterVerticalOptimum:
-        return METER_VERTICAL_OPTIMUM;
-    case PseudoMeterVerticalSuboptimal:
-        return METER_VERTICAL_SUBOPTIMAL;
-    case PseudoMeterVerticalEvenLessGood:
-        return METER_VERTICAL_EVEN_LESS_GOOD;
-#else
-    case PseudoMeterHorizontalBar:
-    case PseudoMeterHorizontalOptimum:
-    case PseudoMeterHorizontalSuboptimal:
-    case PseudoMeterHorizontalEvenLessGood:
-    case PseudoMeterVerticalBar:
-    case PseudoMeterVerticalOptimum:
-    case PseudoMeterVerticalSuboptimal:
-    case PseudoMeterVerticalEvenLessGood:
-        ASSERT_NOT_REACHED();
-        return NOPSEUDO;
-#endif
-
 #if ENABLE(FULLSCREEN_API)
     case PseudoFullScreen:
         return FULL_SCREEN;
@@ -315,17 +285,6 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
     DEFINE_STATIC_LOCAL(AtomicString, onlyOfType, ("only-of-type"));
     DEFINE_STATIC_LOCAL(AtomicString, optional, ("optional"));
     DEFINE_STATIC_LOCAL(AtomicString, outerSpinButton, ("-webkit-outer-spin-button"));
-#if ENABLE(METER_TAG)
-    DEFINE_STATIC_LOCAL(AtomicString, meterHorizontalBar, ("-webkit-meter-horizontal-bar"));
-    DEFINE_STATIC_LOCAL(AtomicString, meterHorizontalOptimumValue, ("-webkit-meter-horizontal-optimum-value"));
-    DEFINE_STATIC_LOCAL(AtomicString, meterHorizontalSuboptimalValue, ("-webkit-meter-horizontal-suboptimal-value"));
-    DEFINE_STATIC_LOCAL(AtomicString, meterHorizontalEvenLessGoodValue, ("-webkit-meter-horizontal-even-less-good-value"));
-    DEFINE_STATIC_LOCAL(AtomicString, meterVerticalBar, ("-webkit-meter-vertical-bar"));
-    DEFINE_STATIC_LOCAL(AtomicString, meterVerticalOptimumValue, ("-webkit-meter-vertical-optimum-value"));
-    DEFINE_STATIC_LOCAL(AtomicString, meterVerticalSuboptimalValue, ("-webkit-meter-vertical-suboptimal-value"));
-    DEFINE_STATIC_LOCAL(AtomicString, meterVerticalEvenLessGoodValue, ("-webkit-meter-vertical-even-less-good-value"));
-#endif
-
     DEFINE_STATIC_LOCAL(AtomicString, required, ("required"));
     DEFINE_STATIC_LOCAL(AtomicString, resizer, ("-webkit-resizer"));
     DEFINE_STATIC_LOCAL(AtomicString, root, ("root"));
@@ -413,16 +372,6 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
         nameToPseudoType->set(nthLastChild.impl(), CSSSelector::PseudoNthLastChild);
         nameToPseudoType->set(nthLastOfType.impl(), CSSSelector::PseudoNthLastOfType);
         nameToPseudoType->set(outerSpinButton.impl(), CSSSelector::PseudoOuterSpinButton);
-#if ENABLE(METER_TAG)
-        nameToPseudoType->set(meterHorizontalBar.impl(), CSSSelector::PseudoMeterHorizontalBar);
-        nameToPseudoType->set(meterHorizontalOptimumValue.impl(), CSSSelector::PseudoMeterHorizontalOptimum);
-        nameToPseudoType->set(meterHorizontalSuboptimalValue.impl(), CSSSelector::PseudoMeterHorizontalSuboptimal);
-        nameToPseudoType->set(meterHorizontalEvenLessGoodValue.impl(), CSSSelector::PseudoMeterHorizontalEvenLessGood);
-        nameToPseudoType->set(meterVerticalBar.impl(), CSSSelector::PseudoMeterVerticalBar);
-        nameToPseudoType->set(meterVerticalOptimumValue.impl(), CSSSelector::PseudoMeterVerticalOptimum);
-        nameToPseudoType->set(meterVerticalSuboptimalValue.impl(), CSSSelector::PseudoMeterVerticalSuboptimal);
-        nameToPseudoType->set(meterVerticalEvenLessGoodValue.impl(), CSSSelector::PseudoMeterVerticalEvenLessGood);
-#endif
         nameToPseudoType->set(root.impl(), CSSSelector::PseudoRoot);
         nameToPseudoType->set(windowInactive.impl(), CSSSelector::PseudoWindowInactive);
         nameToPseudoType->set(decrement.impl(), CSSSelector::PseudoDecrement);
@@ -497,15 +446,7 @@ void CSSSelector::extractPseudoType() const
     case PseudoInputSpeechButton:
 #endif
     case PseudoInnerSpinButton:
-    case PseudoMeterHorizontalBar:
-    case PseudoMeterHorizontalOptimum:
-    case PseudoMeterHorizontalSuboptimal:
-    case PseudoMeterHorizontalEvenLessGood:
-    case PseudoMeterVerticalBar:
-    case PseudoMeterVerticalOptimum:
-    case PseudoMeterVerticalSuboptimal:
-    case PseudoMeterVerticalEvenLessGood:
-    case PseudoOuterSpinButton:
+    case PseudoOuterSpinButton: 
     case PseudoResizer:
     case PseudoScrollbar:
     case PseudoScrollbarCorner:
diff --git a/Source/WebCore/css/CSSSelector.h b/Source/WebCore/css/CSSSelector.h
index fdadafa..43e6d80 100644
--- a/Source/WebCore/css/CSSSelector.h
+++ b/Source/WebCore/css/CSSSelector.h
@@ -182,14 +182,6 @@ namespace WebCore {
             PseudoSearchDecoration,
             PseudoSearchResultsDecoration,
             PseudoSearchResultsButton,
-            PseudoMeterHorizontalBar,
-            PseudoMeterVerticalBar,
-            PseudoMeterHorizontalOptimum,
-            PseudoMeterHorizontalSuboptimal,
-            PseudoMeterHorizontalEvenLessGood,
-            PseudoMeterVerticalOptimum,
-            PseudoMeterVerticalSuboptimal,
-            PseudoMeterVerticalEvenLessGood,
             PseudoInputListButton,
 #if ENABLE(INPUT_SPEECH)
             PseudoInputSpeechButton,
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.cpp b/Source/WebCore/css/CSSStyleApplyProperty.cpp
index e075615..6051334 100644
--- a/Source/WebCore/css/CSSStyleApplyProperty.cpp
+++ b/Source/WebCore/css/CSSStyleApplyProperty.cpp
@@ -27,6 +27,9 @@
 
 #include "CSSPrimitiveValueMappings.h"
 #include "CSSStyleSelector.h"
+#include "CSSValueList.h"
+#include "Document.h"
+#include "Element.h"
 #include "RenderStyle.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/UnusedParam.h>
@@ -35,11 +38,47 @@ using namespace std;
 
 namespace WebCore {
 
-class ApplyPropertyNull : public ApplyPropertyBase {
+class ApplyPropertyExpanding : public ApplyPropertyBase {
 public:
-    virtual void inherit(CSSStyleSelector*) const {}
-    virtual void initial(CSSStyleSelector*) const {}
-    virtual void value(CSSStyleSelector*, CSSValue*) const {}
+    ApplyPropertyExpanding(ApplyPropertyBase* one = 0, ApplyPropertyBase* two = 0, ApplyPropertyBase *three = 0, ApplyPropertyBase* four = 0)
+    {
+        m_propertyMap[0] = one;
+        m_propertyMap[1] = two;
+        m_propertyMap[2] = three;
+        m_propertyMap[3] = four;
+        m_propertyMap[4] = 0; // always null terminated
+    }
+
+    virtual void applyInheritValue(CSSStyleSelector* selector) const
+    {
+        for (ApplyPropertyBase* const* e = m_propertyMap; *e; e++)
+            (*e)->applyInheritValue(selector);
+    }
+
+    virtual void applyInitialValue(CSSStyleSelector* selector) const
+    {
+        for (ApplyPropertyBase* const* e = m_propertyMap; *e; e++)
+            (*e)->applyInitialValue(selector);
+    }
+
+    virtual void applyValue(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        for (ApplyPropertyBase* const* e = m_propertyMap; *e; e++)
+            (*e)->applyValue(selector, value);
+    }
+private:
+    ApplyPropertyBase* m_propertyMap[5];
+};
+
+class ApplyPropertyExpandingSuppressValue : public ApplyPropertyExpanding {
+public:
+    ApplyPropertyExpandingSuppressValue(ApplyPropertyBase* one = 0, ApplyPropertyBase* two = 0, ApplyPropertyBase *three = 0, ApplyPropertyBase* four = 0)
+        : ApplyPropertyExpanding(one, two, three, four) {}
+
+    virtual void applyValue(CSSStyleSelector*, CSSValue*) const
+    {
+        ASSERT_NOT_REACHED();
+    }
 };
 
 template <typename T>
@@ -52,17 +91,17 @@ public:
     {
     }
 
-    virtual void inherit(CSSStyleSelector* selector) const
+    virtual void applyInheritValue(CSSStyleSelector* selector) const
     {
         (selector->style()->*m_setter)((selector->parentStyle()->*m_getter)());
     }
 
-    virtual void initial(CSSStyleSelector* selector) const
+    virtual void applyInitialValue(CSSStyleSelector* selector) const
     {
         (selector->style()->*m_setter)((*m_initial)());
     }
 
-    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    virtual void applyValue(CSSStyleSelector* selector, CSSValue* value) const
     {
         if (value->isPrimitiveValue())
             (selector->style()->*m_setter)(*(static_cast<CSSPrimitiveValue*>(value)));
@@ -83,7 +122,7 @@ public:
         , m_setter(setter)
     {
     }
-    virtual void inherit(CSSStyleSelector* selector) const
+    virtual void applyInheritValue(CSSStyleSelector* selector) const
     {
         const Color& color = (selector->parentStyle()->*m_getter)();
         if (m_defaultValue && !color.isValid())
@@ -91,12 +130,12 @@ public:
         else
             (selector->style()->*m_setter)(color);
     }
-    virtual void initial(CSSStyleSelector* selector) const
+    virtual void applyInitialValue(CSSStyleSelector* selector) const
     {
         Color color;
         (selector->style()->*m_setter)(color);
     }
-    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    virtual void applyValue(CSSStyleSelector* selector, CSSValue* value) const
     {
         if (value->isPrimitiveValue())
             (selector->style()->*m_setter)(selector->getColorFromPrimitiveValue(static_cast<CSSPrimitiveValue*>(value)));
@@ -115,44 +154,227 @@ public:
     {
     }
 
-    virtual void initial(CSSStyleSelector* selector) const
+    virtual void applyInitialValue(CSSStyleSelector* selector) const
     {
         (selector->style()->*m_setter)(m_initialValue());
     }
 
-    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    virtual void applyValue(CSSStyleSelector* selector, CSSValue* value) const
     {
         if (!value->isPrimitiveValue())
             return;
 
         if ((static_cast<CSSPrimitiveValue*>(value))->getIdent() == CSSValueCurrentcolor)
-            inherit(selector);
+            applyInheritValue(selector);
         else
-            ApplyPropertyColorBase::value(selector, value);
+            ApplyPropertyColorBase::applyValue(selector, value);
     }
 protected:
     Color (*m_initialValue)();
 };
 
+// CSSPropertyDirection
+class ApplyPropertyDirection : public ApplyPropertyDefault<TextDirection> {
+public:
+    ApplyPropertyDirection(TextDirection (RenderStyle::*getter)() const, void (RenderStyle::*setter)(TextDirection), TextDirection (*initial)())
+        : ApplyPropertyDefault<TextDirection>(getter, setter, initial)
+    {
+    }
+
+    virtual void applyValue(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        ApplyPropertyDefault<TextDirection>::applyValue(selector, value);
+        Element* element = selector->element();
+        if (element && selector->element() == element->document()->documentElement())
+            element->document()->setDirectionSetOnDocumentElement(true);
+    }
+};
+
+template <typename T>
+class ApplyPropertyFillLayer : public ApplyPropertyBase {
+public:
+    ApplyPropertyFillLayer(CSSPropertyID propertyId, EFillLayerType fillLayerType, FillLayer* (RenderStyle::*accessLayers)(),
+                           const FillLayer* (RenderStyle::*layers)() const, bool (FillLayer::*test)() const, T (FillLayer::*get)() const,
+                           void (FillLayer::*set)(T), void (FillLayer::*clear)(), T (*initial)(EFillLayerType),
+                           void (CSSStyleSelector::*mapFill)(CSSPropertyID, FillLayer*, CSSValue*))
+        : m_propertyId(propertyId)
+        , m_fillLayerType(fillLayerType)
+        , m_accessLayers(accessLayers)
+        , m_layers(layers)
+        , m_test(test)
+        , m_get(get)
+        , m_set(set)
+        , m_clear(clear)
+        , m_initial(initial)
+        , m_mapFill(mapFill)
+    {
+    }
+
+    virtual void applyInheritValue(CSSStyleSelector* selector) const
+    {
+        FillLayer* currChild = (selector->style()->*m_accessLayers)();
+        FillLayer* prevChild = 0;
+        const FillLayer* currParent = (selector->parentStyle()->*m_layers)();
+        while (currParent && (currParent->*m_test)()) {
+            if (!currChild) {
+                /* Need to make a new layer.*/
+                currChild = new FillLayer(m_fillLayerType);
+                prevChild->setNext(currChild);
+            }
+            (currChild->*m_set)((currParent->*m_get)());
+            prevChild = currChild;
+            currChild = prevChild->next();
+            currParent = currParent->next();
+        }
+
+        while (currChild) {
+            /* Reset any remaining layers to not have the property set. */
+            (currChild->*m_clear)();
+            currChild = currChild->next();
+        }
+    }
+
+    virtual void applyInitialValue(CSSStyleSelector* selector) const
+    {
+        FillLayer* currChild = (selector->style()->*m_accessLayers)();
+        (currChild->*m_set)((*m_initial)(m_fillLayerType));
+        for (currChild = currChild->next(); currChild; currChild = currChild->next())
+            (currChild->*m_clear)();
+    }
+
+    virtual void applyValue(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        FillLayer* currChild = (selector->style()->*m_accessLayers)();
+        FillLayer* prevChild = 0;
+        if (value->isValueList()) {
+            /* Walk each value and put it into a layer, creating new layers as needed. */
+            CSSValueList* valueList = static_cast<CSSValueList*>(value);
+            for (unsigned int i = 0; i < valueList->length(); i++) {
+                if (!currChild) {
+                    /* Need to make a new layer to hold this value */
+                    currChild = new FillLayer(m_fillLayerType);
+                    prevChild->setNext(currChild);
+                }
+                (selector->*m_mapFill)(m_propertyId, currChild, valueList->itemWithoutBoundsCheck(i));
+                prevChild = currChild;
+                currChild = currChild->next();
+            }
+        } else {
+            (selector->*m_mapFill)(m_propertyId, currChild, value);
+            currChild = currChild->next();
+        }
+        while (currChild) {
+            /* Reset all remaining layers to not have the property set. */
+            (currChild->*m_clear)();
+            currChild = currChild->next();
+        }
+    }
+
+protected:
+    CSSPropertyID m_propertyId;
+    EFillLayerType m_fillLayerType;
+    FillLayer* (RenderStyle::*m_accessLayers)();
+    const FillLayer* (RenderStyle::*m_layers)() const;
+    bool (FillLayer::*m_test)() const;
+    T (FillLayer::*m_get)() const;
+    void (FillLayer::*m_set)(T);
+    void (FillLayer::*m_clear)();
+    T (*m_initial)(EFillLayerType);
+    void (CSSStyleSelector::*m_mapFill)(CSSPropertyID, FillLayer*, CSSValue*);
+};
+
 const CSSStyleApplyProperty& CSSStyleApplyProperty::sharedCSSStyleApplyProperty()
 {
     DEFINE_STATIC_LOCAL(CSSStyleApplyProperty, cssStyleApplyPropertyInstance, ());
     return cssStyleApplyPropertyInstance;
 }
 
-
 CSSStyleApplyProperty::CSSStyleApplyProperty()
 {
     for (int i = 0; i < numCSSProperties; ++i)
        m_propertyMap[i] = 0;
 
     setPropertyValue(CSSPropertyColor, new ApplyPropertyColor(&RenderStyle::color, &RenderStyle::setColor, RenderStyle::initialColor));
+    setPropertyValue(CSSPropertyDirection, new ApplyPropertyDirection(&RenderStyle::direction, &RenderStyle::setDirection, RenderStyle::initialDirection));
+
+    setPropertyValue(CSSPropertyBackgroundAttachment, new ApplyPropertyFillLayer<EFillAttachment>(CSSPropertyBackgroundAttachment, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+            &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment));
+    setPropertyValue(CSSPropertyBackgroundClip, new ApplyPropertyFillLayer<EFillBox>(CSSPropertyBackgroundClip, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+            &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip));
+    setPropertyValue(CSSPropertyWebkitBackgroundClip, CSSPropertyBackgroundClip);
+    setPropertyValue(CSSPropertyWebkitBackgroundComposite, new ApplyPropertyFillLayer<CompositeOperator>(CSSPropertyWebkitBackgroundComposite, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+            &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite));
+
+    setPropertyValue(CSSPropertyBackgroundImage, new ApplyPropertyFillLayer<StyleImage*>(CSSPropertyBackgroundImage, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+                &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage));
+
+    setPropertyValue(CSSPropertyBackgroundOrigin, new ApplyPropertyFillLayer<EFillBox>(CSSPropertyBackgroundOrigin, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+            &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin));
+    setPropertyValue(CSSPropertyWebkitBackgroundOrigin, CSSPropertyBackgroundOrigin);
+
+    setPropertyValue(CSSPropertyBackgroundPositionX, new ApplyPropertyFillLayer<Length>(CSSPropertyBackgroundPositionX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+                &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition));
+    setPropertyValue(CSSPropertyBackgroundPositionY, new ApplyPropertyFillLayer<Length>(CSSPropertyBackgroundPositionY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+                    &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition));
+    setPropertyValue(CSSPropertyBackgroundPosition, new ApplyPropertyExpandingSuppressValue(propertyValue(CSSPropertyBackgroundPositionX), propertyValue(CSSPropertyBackgroundPositionY)));
+
+    setPropertyValue(CSSPropertyBackgroundRepeatX, new ApplyPropertyFillLayer<EFillRepeat>(CSSPropertyBackgroundRepeatX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+                &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX));
+    setPropertyValue(CSSPropertyBackgroundRepeatY, new ApplyPropertyFillLayer<EFillRepeat>(CSSPropertyBackgroundRepeatY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+                    &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY));
+    setPropertyValue(CSSPropertyBackgroundRepeat, new ApplyPropertyExpandingSuppressValue(propertyValue(CSSPropertyBackgroundRepeatX), propertyValue(CSSPropertyBackgroundRepeatY)));
+
+    setPropertyValue(CSSPropertyBackgroundSize, new ApplyPropertyFillLayer<FillSize>(CSSPropertyBackgroundSize, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
+            &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize));
+    setPropertyValue(CSSPropertyWebkitBackgroundSize, CSSPropertyBackgroundSize);
+
+    setPropertyValue(CSSPropertyWebkitMaskAttachment, new ApplyPropertyFillLayer<EFillAttachment>(CSSPropertyWebkitMaskAttachment, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+            &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment));
+    setPropertyValue(CSSPropertyWebkitMaskClip, new ApplyPropertyFillLayer<EFillBox>(CSSPropertyWebkitMaskClip, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+            &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip));
+    setPropertyValue(CSSPropertyWebkitMaskComposite, new ApplyPropertyFillLayer<CompositeOperator>(CSSPropertyWebkitMaskComposite, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+            &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite));
+
+    setPropertyValue(CSSPropertyWebkitMaskImage, new ApplyPropertyFillLayer<StyleImage*>(CSSPropertyWebkitMaskImage, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+                &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage));
+
+    setPropertyValue(CSSPropertyWebkitMaskOrigin, new ApplyPropertyFillLayer<EFillBox>(CSSPropertyWebkitMaskOrigin, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+            &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin));
+    setPropertyValue(CSSPropertyWebkitMaskSize, new ApplyPropertyFillLayer<FillSize>(CSSPropertyWebkitMaskSize, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+            &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize));
+
+    setPropertyValue(CSSPropertyWebkitMaskPositionX, new ApplyPropertyFillLayer<Length>(CSSPropertyWebkitMaskPositionX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+                &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition));
+    setPropertyValue(CSSPropertyWebkitMaskPositionY, new ApplyPropertyFillLayer<Length>(CSSPropertyWebkitMaskPositionY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+                    &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition));
+    setPropertyValue(CSSPropertyWebkitMaskPosition, new ApplyPropertyExpandingSuppressValue(propertyValue(CSSPropertyWebkitMaskPositionX), propertyValue(CSSPropertyWebkitMaskPositionY)));
+
+    setPropertyValue(CSSPropertyWebkitMaskRepeatX, new ApplyPropertyFillLayer<EFillRepeat>(CSSPropertyWebkitMaskRepeatX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+                &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX));
+    setPropertyValue(CSSPropertyWebkitMaskRepeatY, new ApplyPropertyFillLayer<EFillRepeat>(CSSPropertyWebkitMaskRepeatY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+                    &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY));
+    setPropertyValue(CSSPropertyWebkitMaskRepeat, new ApplyPropertyExpandingSuppressValue(propertyValue(CSSPropertyBackgroundRepeatX), propertyValue(CSSPropertyBackgroundRepeatY)));
+
+    setPropertyValue(CSSPropertyWebkitMaskSize, new ApplyPropertyFillLayer<FillSize>(CSSPropertyWebkitMaskSize, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
+            &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize));
+
     setPropertyValue(CSSPropertyBackgroundColor, new ApplyPropertyColorBase(&RenderStyle::backgroundColor, 0, &RenderStyle::setBackgroundColor));
     setPropertyValue(CSSPropertyBorderBottomColor, new ApplyPropertyColorBase(&RenderStyle::borderBottomColor, &RenderStyle::color, &RenderStyle::setBorderBottomColor));
     setPropertyValue(CSSPropertyBorderLeftColor, new ApplyPropertyColorBase(&RenderStyle::borderLeftColor, &RenderStyle::color, &RenderStyle::setBorderLeftColor));
     setPropertyValue(CSSPropertyBorderRightColor, new ApplyPropertyColorBase(&RenderStyle::borderRightColor, &RenderStyle::color, &RenderStyle::setBorderRightColor));
     setPropertyValue(CSSPropertyBorderTopColor, new ApplyPropertyColorBase(&RenderStyle::borderTopColor, &RenderStyle::color, &RenderStyle::setBorderTopColor));
+
+    setPropertyValue(CSSPropertyBorderTopStyle, new ApplyPropertyDefault<EBorderStyle>(&RenderStyle::borderTopStyle, &RenderStyle::setBorderTopStyle, &RenderStyle::initialBorderStyle));
+    setPropertyValue(CSSPropertyBorderRightStyle, new ApplyPropertyDefault<EBorderStyle>(&RenderStyle::borderRightStyle, &RenderStyle::setBorderRightStyle, &RenderStyle::initialBorderStyle));
+    setPropertyValue(CSSPropertyBorderBottomStyle, new ApplyPropertyDefault<EBorderStyle>(&RenderStyle::borderBottomStyle, &RenderStyle::setBorderBottomStyle, &RenderStyle::initialBorderStyle));
+    setPropertyValue(CSSPropertyBorderLeftStyle, new ApplyPropertyDefault<EBorderStyle>(&RenderStyle::borderLeftStyle, &RenderStyle::setBorderLeftStyle, &RenderStyle::initialBorderStyle));
+
     setPropertyValue(CSSPropertyOutlineColor, new ApplyPropertyColorBase(&RenderStyle::outlineColor, &RenderStyle::color, &RenderStyle::setOutlineColor));
+
+    setPropertyValue(CSSPropertyOverflowX, new ApplyPropertyDefault<EOverflow>(&RenderStyle::overflowX, &RenderStyle::setOverflowX, &RenderStyle::initialOverflowX));
+    setPropertyValue(CSSPropertyOverflowY, new ApplyPropertyDefault<EOverflow>(&RenderStyle::overflowY, &RenderStyle::setOverflowY, &RenderStyle::initialOverflowY));
+    setPropertyValue(CSSPropertyOverflow, new ApplyPropertyExpanding(propertyValue(CSSPropertyOverflowX), propertyValue(CSSPropertyOverflowY)));
+
     setPropertyValue(CSSPropertyWebkitColumnRuleColor, new ApplyPropertyColorBase(&RenderStyle::columnRuleColor, &RenderStyle::color, &RenderStyle::setColumnRuleColor));
     setPropertyValue(CSSPropertyWebkitTextEmphasisColor, new ApplyPropertyColorBase(&RenderStyle::textEmphasisColor, &RenderStyle::color, &RenderStyle::setTextEmphasisColor));
     setPropertyValue(CSSPropertyWebkitTextFillColor, new ApplyPropertyColorBase(&RenderStyle::textFillColor, &RenderStyle::color, &RenderStyle::setTextFillColor));
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.h b/Source/WebCore/css/CSSStyleApplyProperty.h
index 48e08da..860a4f8 100644
--- a/Source/WebCore/css/CSSStyleApplyProperty.h
+++ b/Source/WebCore/css/CSSStyleApplyProperty.h
@@ -39,31 +39,32 @@ class ApplyPropertyBase {
 public:
     ApplyPropertyBase() { }
     virtual ~ApplyPropertyBase() { }
-    virtual void inherit(CSSStyleSelector*) const = 0;
-    virtual void initial(CSSStyleSelector*) const = 0;
-    virtual void value(CSSStyleSelector*, CSSValue*) const = 0;
+    virtual void applyInheritValue(CSSStyleSelector*) const = 0;
+    virtual void applyInitialValue(CSSStyleSelector*) const = 0;
+    virtual void applyValue(CSSStyleSelector*, CSSValue*) const = 0;
 };
 
-class CSSStyleApplyProperty : public RefCounted<CSSStyleApplyProperty> {
+class CSSStyleApplyProperty {
+    WTF_MAKE_NONCOPYABLE(CSSStyleApplyProperty);
 public:
     static const CSSStyleApplyProperty& sharedCSSStyleApplyProperty();
 
-    void inherit(CSSPropertyID property, CSSStyleSelector* selector) const
+    void applyInheritValue(CSSPropertyID property, CSSStyleSelector* selector) const
     {
         ASSERT(implements(property));
-        propertyValue(property)->inherit(selector);
+        propertyValue(property)->applyInheritValue(selector);
     }
 
-    void initial(CSSPropertyID property, CSSStyleSelector* selector) const
+    void applyInitialValue(CSSPropertyID property, CSSStyleSelector* selector) const
     {
         ASSERT(implements(property));
-        propertyValue(property)->initial(selector);
+        propertyValue(property)->applyInitialValue(selector);
     }
 
-    void value(CSSPropertyID property, CSSStyleSelector* selector, CSSValue* value) const
+    void applyValue(CSSPropertyID property, CSSStyleSelector* selector, CSSValue* value) const
     {
         ASSERT(implements(property));
-        propertyValue(property)->value(selector, value);
+        propertyValue(property)->applyValue(selector, value);
     }
 
     bool implements(CSSPropertyID property) const
@@ -90,6 +91,13 @@ private:
         m_propertyMap[index(property)] = value;
     }
 
+    void setPropertyValue(CSSPropertyID newProperty, CSSPropertyID equivalentProperty)
+    {
+        ASSERT(valid(newProperty));
+        ASSERT(valid(equivalentProperty));
+        m_propertyMap[index(newProperty)] = m_propertyMap[index(equivalentProperty)];
+    }
+
     ApplyPropertyBase* propertyValue(CSSPropertyID property) const
     {
         ASSERT(valid(property));
diff --git a/Source/WebCore/css/CSSStyleDeclaration.cpp b/Source/WebCore/css/CSSStyleDeclaration.cpp
index 0a7aa1c..67dc6e0 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSStyleDeclaration.cpp
@@ -107,10 +107,13 @@ bool CSSStyleDeclaration::isPropertyImplicit(const String& propertyName)
 void CSSStyleDeclaration::setProperty(const String& propertyName, const String& value, ExceptionCode& ec)
 {
     size_t important = value.find("!important", 0, false);
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return;
     if (important == notFound)
-        setProperty(propertyName, value, "", ec);
+        setProperty(propertyID, value, false, ec);
     else
-        setProperty(propertyName, value.left(important - 1), "important", ec);
+        setProperty(propertyID, value.left(important - 1), true, ec);
 }
 
 void CSSStyleDeclaration::setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode& ec)
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index 7387089..cbcdc0f 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -159,76 +159,6 @@ HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(prop, Prop, Value) \
 if (primitiveValue) \
     m_style->set##Prop(*primitiveValue);
 
-#define HANDLE_FILL_LAYER_INHERIT_AND_INITIAL(layerType, LayerType, prop, Prop) \
-if (isInherit) { \
-    FillLayer* currChild = m_style->access##LayerType##Layers(); \
-    FillLayer* prevChild = 0; \
-    const FillLayer* currParent = m_parentStyle->layerType##Layers(); \
-    while (currParent && currParent->is##Prop##Set()) { \
-        if (!currChild) { \
-            /* Need to make a new layer.*/ \
-            currChild = new FillLayer(LayerType##FillLayer); \
-            prevChild->setNext(currChild); \
-        } \
-        currChild->set##Prop(currParent->prop()); \
-        prevChild = currChild; \
-        currChild = prevChild->next(); \
-        currParent = currParent->next(); \
-    } \
-    \
-    while (currChild) { \
-        /* Reset any remaining layers to not have the property set. */ \
-        currChild->clear##Prop(); \
-        currChild = currChild->next(); \
-    } \
-} else if (isInitial) { \
-    FillLayer* currChild = m_style->access##LayerType##Layers(); \
-    currChild->set##Prop(FillLayer::initialFill##Prop(LayerType##FillLayer)); \
-    for (currChild = currChild->next(); currChild; currChild = currChild->next()) \
-        currChild->clear##Prop(); \
-}
-
-#define HANDLE_FILL_LAYER_VALUE(layerType, LayerType, prop, Prop, value) { \
-HANDLE_FILL_LAYER_INHERIT_AND_INITIAL(layerType, LayerType, prop, Prop) \
-if (isInherit || isInitial) \
-    return; \
-FillLayer* currChild = m_style->access##LayerType##Layers(); \
-FillLayer* prevChild = 0; \
-if (value->isValueList()) { \
-    /* Walk each value and put it into a layer, creating new layers as needed. */ \
-    CSSValueList* valueList = static_cast<CSSValueList*>(value); \
-    for (unsigned int i = 0; i < valueList->length(); i++) { \
-        if (!currChild) { \
-            /* Need to make a new layer to hold this value */ \
-            currChild = new FillLayer(LayerType##FillLayer); \
-            prevChild->setNext(currChild); \
-        } \
-        mapFill##Prop(property, currChild, valueList->itemWithoutBoundsCheck(i)); \
-        prevChild = currChild; \
-        currChild = currChild->next(); \
-    } \
-} else { \
-    mapFill##Prop(property, currChild, value); \
-    currChild = currChild->next(); \
-} \
-while (currChild) { \
-    /* Reset all remaining layers to not have the property set. */ \
-    currChild->clear##Prop(); \
-    currChild = currChild->next(); \
-} }
-
-#define HANDLE_BACKGROUND_INHERIT_AND_INITIAL(prop, Prop) \
-HANDLE_FILL_LAYER_INHERIT_AND_INITIAL(background, Background, prop, Prop)
-
-#define HANDLE_BACKGROUND_VALUE(prop, Prop, value) \
-HANDLE_FILL_LAYER_VALUE(background, Background, prop, Prop, value)
-
-#define HANDLE_MASK_INHERIT_AND_INITIAL(prop, Prop) \
-HANDLE_FILL_LAYER_INHERIT_AND_INITIAL(mask, Mask, prop, Prop)
-
-#define HANDLE_MASK_VALUE(prop, Prop, value) \
-HANDLE_FILL_LAYER_VALUE(mask, Mask, prop, Prop, value)
-
 #define HANDLE_ANIMATION_INHERIT_AND_INITIAL(prop, Prop) \
 if (isInherit) { \
     AnimationList* list = m_style->accessAnimations(); \
@@ -439,11 +369,11 @@ RenderStyle* CSSStyleSelector::s_styleNotYetAvailable;
 static void loadFullDefaultStyle();
 static void loadSimpleDefaultStyle();
 // FIXME: It would be nice to use some mechanism that guarantees this is in sync with the real UA stylesheet.
-static const char* simpleUserAgentStyleSheet = "html,body,div{display:block}body{margin:8px}div:focus,span:focus{outline:auto 5px -webkit-focus-ring-color}a:-webkit-any-link{color:-webkit-link;text-decoration:underline}a:-webkit-any-link:active{color:-webkit-activelink}";
+static const char* simpleUserAgentStyleSheet = "html,body,div{display:block}head{display:none}body{margin:8px}div:focus,span:focus{outline:auto 5px -webkit-focus-ring-color}a:-webkit-any-link{color:-webkit-link;text-decoration:underline}a:-webkit-any-link:active{color:-webkit-activelink}";
 
 static inline bool elementCanUseSimpleDefaultStyle(Element* e)
 {
-    return e->hasTagName(htmlTag) || e->hasTagName(bodyTag) || e->hasTagName(divTag) || e->hasTagName(spanTag) || e->hasTagName(brTag) || e->hasTagName(aTag);
+    return e->hasTagName(htmlTag) || e->hasTagName(headTag) || e->hasTagName(bodyTag) || e->hasTagName(divTag) || e->hasTagName(spanTag) || e->hasTagName(brTag) || e->hasTagName(aTag);
 }
 
 static inline void collectSiblingRulesInDefaultStyle()
@@ -893,7 +823,7 @@ inline void CSSStyleSelector::initForStyleResolve(Element* e, RenderStyle* paren
 {
     m_checker.m_pseudoStyle = pseudoID;
 
-    m_parentNode = e ? e->parentOrHostNode() : 0;
+    m_parentNode = e ? e->parentNodeForRenderingAndStyle() : 0;
 
     if (parentStyle)
         m_parentStyle = parentStyle;
@@ -1158,7 +1088,7 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* node) const
 #if USE(ACCELERATED_COMPOSITING)
     // Turn off style sharing for elements that can gain layers for reasons outside of the style system.
     // See comments in RenderObject::setStyle().
-    if (element->hasTagName(iframeTag) || element->hasTagName(embedTag) || element->hasTagName(objectTag) || element->hasTagName(appletTag))
+    if (element->hasTagName(iframeTag) || element->hasTagName(frameTag) || element->hasTagName(embedTag) || element->hasTagName(objectTag) || element->hasTagName(appletTag))
         return false;
 #endif
 
@@ -1345,12 +1275,6 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
                 parentStyle = parentVisitedStyle;
         }
         visitedStyle = styleForElement(e, parentStyle, false, false, true);
-        if (visitedStyle) {
-            if (m_elementLinkState == InsideUnvisitedLink)
-                visitedStyle = 0;  // We made the style to avoid timing attacks. Just throw it away now that we did that, since we don't need it.
-            else
-                visitedStyle->setStyleType(VISITED_LINK);
-        }
         initForStyleResolve(e, defaultParent);
     }
 
@@ -1368,6 +1292,20 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
         m_style->setInsideLink(m_elementLinkState);
     }
     
+    if (visitedStyle) {
+        // Copy any pseudo bits that the visited style has to the primary style so that
+        // pseudo element styles will continue to work for pseudo elements inside :visited
+        // links.
+        for (unsigned pseudo = FIRST_PUBLIC_PSEUDOID; pseudo < FIRST_INTERNAL_PSEUDOID; ++pseudo) {
+            if (visitedStyle->hasPseudoStyle(static_cast<PseudoId>(pseudo)))
+                m_style->setHasPseudoStyle(static_cast<PseudoId>(pseudo));
+        }
+        if (m_elementLinkState == InsideUnvisitedLink)
+            visitedStyle = 0;  // We made the style to avoid timing attacks. Just throw it away now that we did that, since we don't need it.
+        else
+            visitedStyle->setStyleType(VISITED_LINK);
+    }
+
     if (simpleDefaultStyleSheet && !elementCanUseSimpleDefaultStyle(e)) {
         loadFullDefaultStyle();
         assertNoSiblingRulesInDefaultStyle();
@@ -1554,14 +1492,6 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
         m_style->setUnique();
 
     if (visitedStyle) {
-        // Copy any pseudo bits that the visited style has to the primary style so that
-        // pseudo element styles will continue to work for pseudo elements inside :visited
-        // links.
-        for (unsigned pseudo = FIRST_PUBLIC_PSEUDOID; pseudo < FIRST_INTERNAL_PSEUDOID; ++pseudo) {
-            if (visitedStyle->hasPseudoStyle(static_cast<PseudoId>(pseudo)))
-                m_style->setHasPseudoStyle(static_cast<PseudoId>(pseudo));
-        }
-        
         // Add the visited style off the main style.
         m_style->addCachedPseudoStyle(visitedStyle.release());
     }
@@ -1694,12 +1624,8 @@ PassRefPtr<RenderStyle> CSSStyleSelector::pseudoStyleForElement(PseudoId pseudo,
         // Fetch our parent style with :visited in effect.
         RenderStyle* parentVisitedStyle = parentStyle->getCachedPseudoStyle(VISITED_LINK);
         visitedStyle = pseudoStyleForElement(pseudo, e, parentVisitedStyle ? parentVisitedStyle : parentStyle, true);
-        if (visitedStyle) {
-            if (m_elementLinkState == InsideUnvisitedLink)
-                visitedStyle = 0;  // We made the style to avoid timing attacks. Just throw it away now that we did that.
-            else
-                visitedStyle->setStyleType(VISITED_LINK);
-        }
+        if (visitedStyle)
+            visitedStyle->setStyleType(VISITED_LINK);
     }
 
     initForStyleResolve(e, parentStyle, pseudo);
@@ -1846,6 +1772,15 @@ static void addIntrinsicMargins(RenderStyle* style)
     }
 }
 
+static inline bool isAtShadowBoundary(Element* element)
+{
+    if (!element)
+        return false;
+
+    ContainerNode* parentNode = element->parentNode();
+    return parentNode && parentNode->isShadowBoundary();
+}
+
 void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parentStyle, Element *e)
 {
     // Cache our original display.
@@ -1970,7 +1905,7 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
     // Finally update our text decorations in effect, but don't allow text-decoration to percolate through
     // tables, inline blocks, inline tables, run-ins, or shadow DOM.
     if (style->display() == TABLE || style->display() == INLINE_TABLE || style->display() == RUN_IN
-        || style->display() == INLINE_BLOCK || style->display() == INLINE_BOX || (e && e->isShadowRoot()))
+        || style->display() == INLINE_BLOCK || style->display() == INLINE_BOX || isAtShadowBoundary(e))
         style->setTextDecorationsInEffect(style->textDecoration());
     else
         style->addToTextDecorationsInEffect(style->textDecoration());
@@ -3086,7 +3021,7 @@ bool CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass(CSSSelector* s
             return false;
         }
         case CSSSelector::PseudoCornerPresent:
-            return scrollbar->scrollableArea()->scrollbarCornerPresent();
+            return scrollbar->scrollableArea()->isScrollCornerVisible();
         default:
             return false;
     }
@@ -3596,6 +3531,19 @@ inline bool isValidVisitedLinkProperty(int id)
     return false;
 }
 
+// SVG handles zooming in a different way compared to CSS. The whole document is scaled instead
+// of each individual length value in the render style / tree. CSSPrimitiveValue::computeLength*()
+// multiplies each resolved length with the zoom multiplier - so for SVG we need to disable that.
+// Though all CSS values that can be applied to outermost <svg> elements (width/height/border/padding...)
+// need to respect the scaling. RenderBox (the parent class of RenderSVGRoot) grabs values like
+// width/height/border/padding/... from the RenderStyle -> for SVG these values would never scale,
+// if we'd pass a 1.0 zoom factor everyhwere. So we only pass a zoom factor of 1.0 for specific
+// properties that are NOT allowed to scale within a zoomed SVG document (letter/word-spacing/font-size).
+static inline bool useSVGZoomRules(const Element* e)
+{
+    return e && e->isSVGElement();
+}
+
 void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 {
     CSSPrimitiveValue* primitiveValue = 0;
@@ -3604,16 +3552,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
     float zoomFactor = m_style->effectiveZoom();
 
-    // SVG handles zooming in a different way compared to CSS. The whole document is scaled instead
-    // of each individual length value in the render style / tree. CSSPrimitiveValue::computeLength*()
-    // multiplies each resolved length with the zoom multiplier - so for SVG we need to disable that.
-    // Though all CSS values that can be applied to outermost <svg> elements (width/height/border/padding...)
-    // need to respect the scaling. RenderBox (the parent class of RenderSVGRoot) grabs values like
-    // width/height/border/padding/... from the RenderStyle -> for SVG these values would never scale,
-    // if we'd pass a 1.0 zoom factor everyhwere. So we only pass a zoom factor of 1.0 for specific
-    // properties that are NOT allowed to scale within a zoomed SVG document (letter/word-spacing/font-size).
-    bool useSVGZoomRules = m_element && m_element->isSVGElement();
-
     Length l;
     bool apply = false;
 
@@ -3633,13 +3571,13 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
     // check lookup table for implementations and use when available
     if (m_applyProperty.implements(property)) {
-      if (isInherit)
-          m_applyProperty.inherit(property, this);
-      else if (isInitial)
-          m_applyProperty.initial(property, this);
-      else
-          m_applyProperty.value(property, this, value);
-      return;
+        if (isInherit)
+            m_applyProperty.applyInheritValue(property, this);
+        else if (isInitial)
+            m_applyProperty.applyInitialValue(property, this);
+        else
+            m_applyProperty.applyValue(property, this, value);
+        return;
     }
 
     // What follows is a list that maps the CSS properties into their corresponding front-end
@@ -3647,39 +3585,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     // are only hit when mapping "inherit" or "initial" into front-end values.
     switch (property) {
 // ident only properties
-    case CSSPropertyBackgroundAttachment:
-        HANDLE_BACKGROUND_VALUE(attachment, Attachment, value)
-        return;
-    case CSSPropertyBackgroundClip:
-    case CSSPropertyWebkitBackgroundClip:
-        HANDLE_BACKGROUND_VALUE(clip, Clip, value)
-        return;
-    case CSSPropertyWebkitBackgroundComposite:
-        HANDLE_BACKGROUND_VALUE(composite, Composite, value)
-        return;
-    case CSSPropertyBackgroundOrigin:
-    case CSSPropertyWebkitBackgroundOrigin:
-        HANDLE_BACKGROUND_VALUE(origin, Origin, value)
-        return;
-    case CSSPropertyBackgroundSize:
-    case CSSPropertyWebkitBackgroundSize:
-        HANDLE_BACKGROUND_VALUE(size, Size, value)
-        return;
-    case CSSPropertyWebkitMaskAttachment:
-        HANDLE_MASK_VALUE(attachment, Attachment, value)
-        return;
-    case CSSPropertyWebkitMaskClip:
-        HANDLE_MASK_VALUE(clip, Clip, value)
-        return;
-    case CSSPropertyWebkitMaskComposite:
-        HANDLE_MASK_VALUE(composite, Composite, value)
-        return;
-    case CSSPropertyWebkitMaskOrigin:
-        HANDLE_MASK_VALUE(origin, Origin, value)
-        return;
-    case CSSPropertyWebkitMaskSize:
-        HANDLE_MASK_VALUE(size, Size, value)
-        return;
     case CSSPropertyBorderCollapse:
         HANDLE_INHERIT_AND_INITIAL(borderCollapse, BorderCollapse)
         if (!primitiveValue)
@@ -3695,18 +3600,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 return;
         }
         return;
-    case CSSPropertyBorderTopStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderTopStyle, BorderTopStyle, BorderStyle)
-        return;
-    case CSSPropertyBorderRightStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderRightStyle, BorderRightStyle, BorderStyle)
-        return;
-    case CSSPropertyBorderBottomStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderBottomStyle, BorderBottomStyle, BorderStyle)
-        return;
-    case CSSPropertyBorderLeftStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderLeftStyle, BorderLeftStyle, BorderStyle)
-        return;
     case CSSPropertyOutlineStyle:
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(outlineStyle, OutlineStyle, BorderStyle)
         if (primitiveValue) {
@@ -3722,11 +3615,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyClear:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(clear, Clear)
         return;
-    case CSSPropertyDirection:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(direction, Direction)
-        if (!isInherit && !isInitial && m_element && m_element == m_element->document()->documentElement())
-            m_element->document()->setDirectionSetOnDocumentElement(true);
-        return;
     case CSSPropertyDisplay:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(display, Display)
 #if ENABLE(WCSS)
@@ -3871,33 +3759,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyListStyleType:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(listStyleType, ListStyleType)
         return;
-    case CSSPropertyOverflow:
-    {
-        if (isInherit) {
-            m_style->setOverflowX(m_parentStyle->overflowX());
-            m_style->setOverflowY(m_parentStyle->overflowY());
-            return;
-        }
-        
-        if (isInitial) {
-            m_style->setOverflowX(RenderStyle::initialOverflowX());
-            m_style->setOverflowY(RenderStyle::initialOverflowY());
-            return;
-        }
-            
-        EOverflow o = *primitiveValue;
-
-        m_style->setOverflowX(o);
-        m_style->setOverflowY(o);
-        return;
-    }
-
-    case CSSPropertyOverflowX:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(overflowX, OverflowX)
-        return;
-    case CSSPropertyOverflowY:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(overflowY, OverflowY)
-        return;
     case CSSPropertyPageBreakBefore:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
         return;
@@ -3940,51 +3801,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWhiteSpace:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(whiteSpace, WhiteSpace)
         return;
-
-    case CSSPropertyBackgroundPosition:
-        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(xPosition, XPosition);
-        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(yPosition, YPosition);
-        return;
-    case CSSPropertyBackgroundPositionX: {
-        HANDLE_BACKGROUND_VALUE(xPosition, XPosition, value)
-        return;
-    }
-    case CSSPropertyBackgroundPositionY: {
-        HANDLE_BACKGROUND_VALUE(yPosition, YPosition, value)
-        return;
-    }
-    case CSSPropertyWebkitMaskPosition:
-        HANDLE_MASK_INHERIT_AND_INITIAL(xPosition, XPosition);
-        HANDLE_MASK_INHERIT_AND_INITIAL(yPosition, YPosition);
-        return;
-    case CSSPropertyWebkitMaskPositionX: {
-        HANDLE_MASK_VALUE(xPosition, XPosition, value)
-        return;
-    }
-    case CSSPropertyWebkitMaskPositionY: {
-        HANDLE_MASK_VALUE(yPosition, YPosition, value)
-        return;
-    }
-    case CSSPropertyBackgroundRepeat:
-        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(repeatX, RepeatX);
-        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(repeatY, RepeatY);
-        return;
-    case CSSPropertyBackgroundRepeatX:
-        HANDLE_BACKGROUND_VALUE(repeatX, RepeatX, value)
-        return;
-    case CSSPropertyBackgroundRepeatY:
-        HANDLE_BACKGROUND_VALUE(repeatY, RepeatY, value)
-        return;
-    case CSSPropertyWebkitMaskRepeat:
-        HANDLE_MASK_INHERIT_AND_INITIAL(repeatX, RepeatX);
-        HANDLE_MASK_INHERIT_AND_INITIAL(repeatY, RepeatY);
-        return;
-    case CSSPropertyWebkitMaskRepeatX:
-        HANDLE_MASK_VALUE(repeatX, RepeatX, value)
-        return;
-    case CSSPropertyWebkitMaskRepeatY:
-        HANDLE_MASK_VALUE(repeatY, RepeatY, value)
-        return;
     case CSSPropertyBorderSpacing: {
         if (isInherit) {
             m_style->setHorizontalBorderSpacing(m_parentStyle->horizontalBorderSpacing());
@@ -4051,12 +3867,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     
 // uri || inherit
-    case CSSPropertyBackgroundImage:
-        HANDLE_BACKGROUND_VALUE(image, Image, value)
-        return;
-    case CSSPropertyWebkitMaskImage:
-        HANDLE_MASK_VALUE(image, Image, value)
-        return;
     case CSSPropertyListStyleImage:
     {
         HANDLE_INHERIT_AND_INITIAL(listStyleImage, ListStyleImage)
@@ -4175,7 +3985,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyLetterSpacing:
     case CSSPropertyWordSpacing:
     {
-        
         if (isInherit) {
             HANDLE_INHERIT_COND(CSSPropertyLetterSpacing, letterSpacing, LetterSpacing)
             HANDLE_INHERIT_COND(CSSPropertyWordSpacing, wordSpacing, WordSpacing)
@@ -4193,7 +4002,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         } else {
             if (!primitiveValue)
                 return;
-            width = primitiveValue->computeLengthInt(style(), m_rootElementStyle, useSVGZoomRules ? 1.0f : zoomFactor);
+            width = primitiveValue->computeLengthInt(style(), m_rootElementStyle, useSVGZoomRules(m_element) ? 1.0f : zoomFactor);
         }
         switch (id) {
         case CSSPropertyLetterSpacing:
@@ -5145,7 +4954,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 fontDescription.setUsePrinterFont(m_checker.m_document->printing());
            
                 // Handle the zoom factor.
-                fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(m_checker.m_document, m_style.get(), fontDescription.isAbsoluteSize(), fontDescription.specifiedSize(), useSVGZoomRules));
+                fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(m_checker.m_document, m_style.get(), fontDescription.isAbsoluteSize(), fontDescription.specifiedSize(), useSVGZoomRules(m_element)));
                 if (m_style->setFontDescription(fontDescription))
                     m_fontDirty = true;
             }
@@ -6197,18 +6006,54 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
     // These properties are implemented in the CSSStyleApplyProperty lookup table.
     case CSSPropertyColor:
+    case CSSPropertyDirection:
+    case CSSPropertyBackgroundAttachment:
+    case CSSPropertyBackgroundClip:
+    case CSSPropertyWebkitBackgroundClip:
+    case CSSPropertyWebkitBackgroundComposite:
+    case CSSPropertyBackgroundOrigin:
+    case CSSPropertyWebkitBackgroundOrigin:
+    case CSSPropertyBackgroundImage:
+    case CSSPropertyBackgroundSize:
+    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyWebkitMaskAttachment:
+    case CSSPropertyWebkitMaskClip:
+    case CSSPropertyWebkitMaskComposite:
+    case CSSPropertyWebkitMaskOrigin:
+    case CSSPropertyWebkitMaskImage:
+    case CSSPropertyWebkitMaskSize:
     case CSSPropertyBackgroundColor:
     case CSSPropertyBorderBottomColor:
     case CSSPropertyBorderLeftColor:
     case CSSPropertyBorderRightColor:
     case CSSPropertyBorderTopColor:
+    case CSSPropertyBorderTopStyle:
+    case CSSPropertyBorderRightStyle:
+    case CSSPropertyBorderBottomStyle:
+    case CSSPropertyBorderLeftStyle:
     case CSSPropertyOutlineColor:
     case CSSPropertyWebkitColumnRuleColor:
     case CSSPropertyWebkitTextEmphasisColor:
     case CSSPropertyWebkitTextFillColor:
     case CSSPropertyWebkitTextStrokeColor:
+    case CSSPropertyBackgroundPosition:
+    case CSSPropertyBackgroundPositionX:
+    case CSSPropertyBackgroundPositionY:
+    case CSSPropertyWebkitMaskPosition:
+    case CSSPropertyWebkitMaskPositionX:
+    case CSSPropertyWebkitMaskPositionY:
+    case CSSPropertyBackgroundRepeat:
+    case CSSPropertyBackgroundRepeatX:
+    case CSSPropertyBackgroundRepeatY:
+    case CSSPropertyWebkitMaskRepeat:
+    case CSSPropertyWebkitMaskRepeatX:
+    case CSSPropertyWebkitMaskRepeatY:
+    case CSSPropertyOverflow:
+    case CSSPropertyOverflowX:
+    case CSSPropertyOverflowY:
         ASSERT_NOT_REACHED();
         return;
+<<<<<<< HEAD
 
 #ifdef ANDROID_CSS_RING
     case CSSPropertyWebkitRing:
@@ -6354,6 +6199,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
 #endif
 
+=======
+>>>>>>> WebKit.org at r84325
 #if ENABLE(SVG)
     default:
         // Try the SVG properties
@@ -7069,6 +6916,13 @@ void CSSStyleSelector::setFontSize(FontDescription& fontDescription, float size)
 
 float CSSStyleSelector::getComputedSizeFromSpecifiedSize(Document* document, RenderStyle* style, bool isAbsoluteSize, float specifiedSize, bool useSVGZoomRules)
 {
+    // Text with a 0px font size should not be visible and therefore needs to be
+    // exempt from minimum font size rules. Acid3 relies on this for pixel-perfect
+    // rendering. This is also compatible with other browsers that have minimum
+    // font size settings (e.g. Firefox).
+    if (fabsf(specifiedSize) < std::numeric_limits<float>::epsilon())
+        return 0.0f;
+
     float zoomFactor = 1.0f;
     if (!useSVGZoomRules) {
         zoomFactor = style->effectiveZoom();
diff --git a/Source/WebCore/css/CSSStyleSelector.h b/Source/WebCore/css/CSSStyleSelector.h
index 756c5bf..ca512fd 100644
--- a/Source/WebCore/css/CSSStyleSelector.h
+++ b/Source/WebCore/css/CSSStyleSelector.h
@@ -85,6 +85,7 @@ public:
 
     // This class selects a RenderStyle for a given element based on a collection of stylesheets.
     class CSSStyleSelector {
+        friend class CSSStyleApplyProperty;
         WTF_MAKE_NONCOPYABLE(CSSStyleSelector); WTF_MAKE_FAST_ALLOCATED;
     public:
         CSSStyleSelector(Document*, StyleSheetList* authorSheets, CSSStyleSheet* mappedElementSheet,
@@ -115,6 +116,7 @@ public:
 
         RenderStyle* style() const { return m_style.get(); }
         RenderStyle* parentStyle() const { return m_parentStyle; }
+        Element* element() const { return m_element; }
 
     private:
         void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, PseudoId = NOPSEUDO);
diff --git a/Source/WebCore/css/WebKitCSSMatrix.cpp b/Source/WebCore/css/WebKitCSSMatrix.cpp
index 163eac8..26fe286 100644
--- a/Source/WebCore/css/WebKitCSSMatrix.cpp
+++ b/Source/WebCore/css/WebKitCSSMatrix.cpp
@@ -52,9 +52,8 @@ WebKitCSSMatrix::~WebKitCSSMatrix()
 
 void WebKitCSSMatrix::setMatrixValue(const String& string, ExceptionCode& ec)
 {
-    CSSParser p(true);
     RefPtr<CSSMutableStyleDeclaration> styleDeclaration = CSSMutableStyleDeclaration::create();
-    if (p.parseValue(styleDeclaration.get(), CSSPropertyWebkitTransform, string, true)) {
+    if (CSSParser::parseValue(styleDeclaration.get(), CSSPropertyWebkitTransform, string, true, true)) {
         // Convert to TransformOperations. This can fail if a property 
         // requires style (i.e., param uses 'ems' or 'exs')
         RefPtr<CSSValue> value = styleDeclaration->getPropertyCSSValue(CSSPropertyWebkitTransform);
diff --git a/Source/WebCore/css/fullscreen.css b/Source/WebCore/css/fullscreen.css
index 2e38c95..537024c 100644
--- a/Source/WebCore/css/fullscreen.css
+++ b/Source/WebCore/css/fullscreen.css
@@ -7,10 +7,13 @@
 }
 
 video:-webkit-full-screen {
-    background-color: black;
-    width: auto;   
-    height: 100%;
-    max-width: 100%;
+    background-color: black !important;
+    position: static !important;
+    margin: 0 !important;
+    height: 100% !important;
+    width: 100% !important;
+    -webkit-box-flex: 1 !important;
+    display: block !important;
 }
 
 img:-webkit-full-screen {
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index bd3bde0..ecbaef9 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -446,12 +446,16 @@ input::-webkit-input-list-button {
 input::-webkit-inner-spin-button {
     -webkit-appearance: inner-spin-button;
     display: inline-block;
+    position: relative;
+    cursor: default;
     -webkit-user-select: none;
 }
 
 input::-webkit-outer-spin-button {
     -webkit-appearance: outer-spin-button;
     display: inline-block;
+    position: relative;
+    cursor: default;
     margin-left: 2px;
     -webkit-user-select: none;
 }
@@ -673,70 +677,59 @@ output {
 
 meter {
     -webkit-appearance: meter;
-    display: inline-block;
+    -webkit-box-sizing: border-box;
+    display: inline-box;
     height: 1em;
     width: 5em;
     vertical-align: -0.2em;
 }
 
-meter::-webkit-meter {
-    -webkit-appearance: meter;
-}
-
-meter::-webkit-meter-horizontal-bar {
-    -webkit-appearance: meter;
+meter::-webkit-meter-bar {
     background: -webkit-gradient(linear, left top, left bottom, from(#ddd), to(#ddd), color-stop(0.20, #eee), color-stop(0.45, #ccc), color-stop(0.55, #ccc));
+    height: 100%;
+    -webkit-box-sizing: border-box;
 }
 
-meter::-webkit-meter-vertical-bar {
-    -webkit-appearance: meter;
-    background: -webkit-gradient(linear, left top, right top, from(#ddd), to(#ddd), color-stop(0.20, #eee), color-stop(0.45, #ccc), color-stop(0.55, #ccc));
-}
-
-meter::-webkit-meter-horizontal-optimum-value {
-    -webkit-appearance: meter;
+meter::-webkit-meter-optimum-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#ad7), to(#ad7), color-stop(0.20, #cea), color-stop(0.45, #7a3), color-stop(0.55, #7a3));
+    height: 100%;
+    -webkit-box-sizing: border-box;
 }
 
-meter::-webkit-meter-horizontal-suboptimal-value {
-    -webkit-appearance: meter;
+meter::-webkit-meter-suboptimum-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#fe7), to(#fe7), color-stop(0.20, #ffc), color-stop(0.45, #db3), color-stop(0.55, #db3));
+    height: 100%;
+    -webkit-box-sizing: border-box;
 }
 
-meter::-webkit-meter-horizontal-even-less-good-value {
-    -webkit-appearance: meter;
+meter::-webkit-meter-even-less-good-value {
     background: -webkit-gradient(linear, left top, left bottom, from(#f77), to(#f77), color-stop(0.20, #fcc), color-stop(0.45, #d44), color-stop(0.55, #d44));
-}
-
-meter::-webkit-meter-vertical-optimum-value {
-    -webkit-appearance: meter;
-    background: -webkit-gradient(linear, left top, right top, from(#ad7), to(#ad7), color-stop(0.20, #cea), color-stop(0.45, #7a3), color-stop(0.55, #7a3));
-}
-
-meter::-webkit-meter-vertical-suboptimal-value {
-    -webkit-appearance: meter;
-    background: -webkit-gradient(linear, left top, right top, from(#fe7), to(#fe7), color-stop(0.20, #ffc), color-stop(0.45, #db3), color-stop(0.55, #db3));
-}
- 
-meter::-webkit-meter-vertical-even-less-good-value {
-    -webkit-appearance: meter;
-    background: -webkit-gradient(linear, left top, right top, from(#f77), to(#f77), color-stop(0.20, #fcc), color-stop(0.45, #d44), color-stop(0.55, #d44));
+    height: 100%;
+    -webkit-box-sizing: border-box;
 }
 
 /* progress */
 
 progress {
     -webkit-appearance: progress-bar;
+    -webkit-box-sizing: border-box;
     display: inline-block;
     height: 1em;
     width: 10em;
     vertical-align: -0.2em;
+}
+
+progress::-webkit-progress-bar {
     background-color: gray;
+    height: 100%;
+    -webkit-box-sizing: border-box;
 }
 
-progress::-webkit-progress-bar-value {
-    -webkit-appearance: progress-bar;
+progress::-webkit-progress-value {
     background-color: green;
+    height: 100%;
+    width: 50%; /* should be removed later */
+    -webkit-box-sizing: border-box;
 }
 
 /* datagrid */
@@ -894,6 +887,13 @@ summary {
     display: block
 }
 
+summary::-webkit-details-marker {
+    display: inline-block;
+    width: 0.66em;
+    height: 0.66em;
+    margin-right: 0.4em;
+}
+
 /* page */
 
 @page {
diff --git a/Source/WebCore/css/mediaControls.css b/Source/WebCore/css/mediaControls.css
index 874cb13..da61460 100644
--- a/Source/WebCore/css/mediaControls.css
+++ b/Source/WebCore/css/mediaControls.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009, 2010, 2011 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,6 +29,13 @@ audio {
     height: 16px;
 }
 
+::-webkit-media-controls {
+    width: inherit;
+    height: inherit;
+    position: relative;
+    display: block;
+}
+
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     display: -webkit-box;
     -webkit-box-orient: horizontal;
@@ -44,7 +51,7 @@ audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
-    bottom: -16px;
+    bottom: 0px;
 }
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
@@ -98,12 +105,7 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     margin: initial;
 }
 
-audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
-    display: none;
-}
-
 audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
-    display: none;
     background-color: initial;
     border: initial;
     color: inherit;
diff --git a/Source/WebCore/css/mediaControlsEfl.css b/Source/WebCore/css/mediaControlsEfl.css
index 938d7e8..43d2698 100644
--- a/Source/WebCore/css/mediaControlsEfl.css
+++ b/Source/WebCore/css/mediaControlsEfl.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009, 2010, 2011 Apple Inc.  All rights reserved.
  * Copyright (C) 2011 Samsung Electronics
  *
  * Redistribution and use in source and binary forms, with or without
@@ -45,7 +45,7 @@ audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
-    bottom: -25px;
+    bottom: 0px;
 }
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
diff --git a/Source/WebCore/css/mediaControlsQt.css b/Source/WebCore/css/mediaControlsQt.css
index 9ca3313..e32fcd5 100644
--- a/Source/WebCore/css/mediaControlsQt.css
+++ b/Source/WebCore/css/mediaControlsQt.css
@@ -69,6 +69,7 @@ audio::-webkit-media-controls-mute-button {
     height: 12px;
     padding: 6px;
     margin: 5px 5px 5px 3px;
+    border: none !important;
 }
 
 video::-webkit-media-controls-mute-button {
@@ -76,6 +77,7 @@ video::-webkit-media-controls-mute-button {
     height: 12px;
     padding: 6px;
     margin: 5px 5px 5px 3px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-play-button {
@@ -83,6 +85,7 @@ audio::-webkit-media-controls-play-button {
     height: 12px;
     padding: 6px 12px 6px 11px;
     margin: 5px 3px 5px 5px;
+    border: none !important;
 }
 
 video::-webkit-media-controls-play-button {
@@ -90,6 +93,7 @@ video::-webkit-media-controls-play-button {
     height: 12px;
     padding: 6px 12px 6px 11px;
     margin: 5px 3px 5px 5px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-timeline-container {
@@ -219,6 +223,7 @@ video::-webkit-media-controls-fullscreen-button {
     height: 12px;
     padding: 6px;
     margin: 5px 5px 5px 3px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-rewind-button {
diff --git a/Source/WebCore/css/mediaControlsQuickTime.css b/Source/WebCore/css/mediaControlsQuickTime.css
index 06f31ae..5866a91 100644
--- a/Source/WebCore/css/mediaControlsQuickTime.css
+++ b/Source/WebCore/css/mediaControlsQuickTime.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009, 2010, 2011 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,7 +37,7 @@ audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
-    bottom: -25px;
+    bottom: 0px;
 }
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
@@ -47,6 +47,7 @@ audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-bu
     height: 12px;
     margin-left: 2px;
     margin-right: 9px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
@@ -54,6 +55,7 @@ audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-bu
     height: 16px;
     margin-left: 6px;
     margin-right: 1px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
@@ -122,11 +124,13 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     display: none;
     width: 0px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
     display: none;
     width: 0px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
@@ -135,6 +139,7 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     margin-left: 7px;
     margin-right: 7px;
     -webkit-box-ordinal-group: 4; /* At the very end */
+    border: none !important;
 }
 
 audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
@@ -145,6 +150,7 @@ audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewin
     margin-bottom: 1px;
     margin-left: 6px;
     margin-right: 2px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
@@ -154,6 +160,7 @@ audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-co
     height: 11px;
     margin-left: 6px;
     margin-right: 2px;
+    border: none !important;
 }
 
 audio::-webkit-media-controls-status-display, video::-webkit-media-controls-status-display {
@@ -186,6 +193,7 @@ audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-medi
     margin-left: 7px;
     margin-right: 7px;
     -webkit-box-ordinal-group: 3; /* between mute and fullscreen */
+    border: none !important;
 }
 
 audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
@@ -221,4 +229,5 @@ audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-co
 
     width: 14px;
     height: 12px;
+    border: none !important;
 } 
diff --git a/Source/WebCore/css/themeQtMobile.css b/Source/WebCore/css/themeQtMobile.css
deleted file mode 100644
index 27be523..0000000
--- a/Source/WebCore/css/themeQtMobile.css
+++ /dev/null
@@ -1,134 +0,0 @@
-/*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-input[type="button"],
-input[type="submit"],
-input[type="reset"],
-input[type="file"]::-webkit-file-upload-button, button,
-select {
-    padding: 2px 18px 3px 18px;
-    border: 1px solid gray;
-    -webkit-border-radius:5px;
-    background: -webkit-gradient(linear, left bottom, left top, color-stop(0.0, rgba(0, 0, 0, 0.35)), color-stop(0.4, rgba(0, 0, 0, 0.0)));
-    background-color: #ffffff;
-    color: #3e3e3e;
-}
-
-input[type="button"]:disabled,
-input[type="submit"]:disabled,
-input[type="reset"]:disabled,
-input[type="file"]:disabled::-webkit-file-upload-button,
-button:disabled,
-select:disabled {
-    border: 1px solid gray;
-}
-
-input[type="button"]:active,
-input[type="submit"]:active,
-input[type="reset"]:active,
-input[type="file"]:active::-webkit-file-upload-button,
-button:active,
-select:active {
-    background: ButtonShadow;
-}
-
-input[type="button"]:active:disabled,
-input[type="submit"]:active:disabled,
-input[type="reset"]:active:disabled,
-input[type="file"]:active:disabled::-webkit-file-upload-button,
-button:active:disabled,
-select:active:disabled {
-    border: 1px solid gray;
-}
-
-input:not([type]),
-input[type="text"],
-input[type="password"],
-input[type="email"],
-input[type="tel"],
-input[type="color"],
-input[type="search"],
-input[type="date"],
-input[type="datetime"],
-input[type="datetime-local"],
-input[type="month"],
-input[type="week"],
-input[type="time"],
-input[type="number"],
-input[type="url"],
-textarea {
-    border: 1px solid gray;
-    background: -webkit-gradient(linear, left top, left 30, color-stop(0.0, rgba(0, 0, 0, 0.35)), color-stop(0.2, rgba(0, 0, 0, 0.0)));
-    background-color: #ffffff;
-    color: #3e3e3e;
-    -webkit-border-radius:5px;
-}
-
-input:not([type]):disabled,
-input[type="text"]:disabled,
-input[type="password"]:disabled,
-input[type="email"]:disabled,
-input[type="tel"]:disabled,
-input[type="color"]:disabled,
-input[type="search"]:disabled,
-input[type="date"]:disabled,
-input[type="datetime"]:disabled,
-input[type="datetime-local"]:disabled,
-input[type="month"]:disabled,
-input[type="week"]:disabled,
-input[type="time"]:disabled,
-input[type="number"]:disabled,
-input[type="url"]:disabled,
-textarea:disabled {
-    border: 1px solid gray;
-    background: -webkit-gradient(linear, left top, left 30, color-stop(0.0, rgba(0, 0, 0, 0.3)), color-stop(0.2, rgba(0, 0, 0, 0.0)));
-    background-color: #ffffff;
-    color: #e5e5e5;
-}
-
-input:not([type]):active,
-input[type="text"]:active,
-input[type="password"]:active,
-input[type="email"]:active,
-input[type="tel"]:active,
-input[type="color"]:active,
-input[type="search"]:active,
-input[type="date"]:active,
-input[type="datetime"]:active,
-input[type="datetime-local"]:active,
-input[type="month"]:active,
-input[type="week"]:active,
-input[type="time"]:active,
-input[type="number"]:active,
-input[type="url"]:active,
-textarea:active {
-    background: ButtonShadow;
-}
-
-video {
-    background-color: #000000;
-}
diff --git a/Source/WebCore/css/tokenizer.flex b/Source/WebCore/css/tokenizer.flex
index 88a92a2..3285d2f 100644
--- a/Source/WebCore/css/tokenizer.flex
+++ b/Source/WebCore/css/tokenizer.flex
@@ -15,7 +15,6 @@ string1         \"([\t !#$%&(-~]|\\{nl}|\'|{nonascii}|{escape})*\"
 string2         \'([\t !#$%&(-~]|\\{nl}|\"|{nonascii}|{escape})*\'
 
 ident           -?{nmstart}{nmchar}*
-name            {nmchar}+
 num             [0-9]+|[0-9]*"."[0-9]+
 intnum          [0-9]+
 string          {string1}|{string2}
@@ -46,8 +45,8 @@ nth             [\+-]?{intnum}*n([\t\r\n ]*[\+-][\t\r\n ]*{intnum})?
 {ident}                 {yyTok = IDENT; return yyTok;}
 {nth}                   {yyTok = NTH; return yyTok;}
 
+"#"{h}+                 {yyTok = HEX; return yyTok;}
 "#"{ident}              {yyTok = IDSEL; return yyTok;}
-"#"{name}               {yyTok = HEX; return yyTok;}
 
 "@import"               {BEGIN(mediaquery); yyTok = IMPORT_SYM; return yyTok;}
 "@page"                 {yyTok = PAGE_SYM; return yyTok;}
diff --git a/Source/WebCore/dom/Attr.cpp b/Source/WebCore/dom/Attr.cpp
index 6500a97..e3ae348 100644
--- a/Source/WebCore/dom/Attr.cpp
+++ b/Source/WebCore/dom/Attr.cpp
@@ -152,7 +152,7 @@ PassRefPtr<Node> Attr::cloneNode(bool /*deep*/)
 }
 
 // DOM Section 1.1.1
-bool Attr::childTypeAllowed(NodeType type)
+bool Attr::childTypeAllowed(NodeType type) const
 {
     switch (type) {
         case TEXT_NODE:
diff --git a/Source/WebCore/dom/Attr.h b/Source/WebCore/dom/Attr.h
index e76d2fa..217a0c3 100644
--- a/Source/WebCore/dom/Attr.h
+++ b/Source/WebCore/dom/Attr.h
@@ -79,7 +79,7 @@ private:
     virtual PassRefPtr<Node> cloneNode(bool deep);
 
     virtual bool isAttributeNode() const { return true; }
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
diff --git a/Source/WebCore/dom/CDATASection.cpp b/Source/WebCore/dom/CDATASection.cpp
index d73054e..33a3acc 100644
--- a/Source/WebCore/dom/CDATASection.cpp
+++ b/Source/WebCore/dom/CDATASection.cpp
@@ -51,7 +51,7 @@ PassRefPtr<Node> CDATASection::cloneNode(bool /*deep*/)
     return create(document(), data());
 }
 
-bool CDATASection::childTypeAllowed(NodeType)
+bool CDATASection::childTypeAllowed(NodeType) const
 {
     return false;
 }
diff --git a/Source/WebCore/dom/CDATASection.h b/Source/WebCore/dom/CDATASection.h
index 5cf07e1..d7aca9d 100644
--- a/Source/WebCore/dom/CDATASection.h
+++ b/Source/WebCore/dom/CDATASection.h
@@ -37,7 +37,7 @@ private:
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
     virtual PassRefPtr<Text> virtualCreate(const String&);
 };
 
diff --git a/Source/WebCore/dom/Comment.cpp b/Source/WebCore/dom/Comment.cpp
index 00f1724..92cffed 100644
--- a/Source/WebCore/dom/Comment.cpp
+++ b/Source/WebCore/dom/Comment.cpp
@@ -51,7 +51,7 @@ PassRefPtr<Node> Comment::cloneNode(bool /*deep*/)
     return create(document(), data());
 }
 
-bool Comment::childTypeAllowed(NodeType)
+bool Comment::childTypeAllowed(NodeType) const
 {
     return false;
 }
diff --git a/Source/WebCore/dom/Comment.h b/Source/WebCore/dom/Comment.h
index a0210c4..9db1f31 100644
--- a/Source/WebCore/dom/Comment.h
+++ b/Source/WebCore/dom/Comment.h
@@ -37,7 +37,7 @@ private:
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 4014cca..276df56 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -56,15 +56,19 @@ static NodeCallbackQueue* s_postAttachCallbackQueue;
 static size_t s_attachDepth;
 static bool s_shouldReEnableMemoryCacheCallsAfterAttach;
 
+static inline void collectNodes(Node* node, NodeVector& nodes)
+{
+    for (Node* child = node->firstChild(); child; child = child->nextSibling())
+        nodes.append(child);
+}
+
 static void collectTargetNodes(Node* node, NodeVector& nodes)
 {
     if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
         nodes.append(node);
         return;
     }
-
-    for (Node* child = node->firstChild(); child; child = child->nextSibling())
-        nodes.append(child);
+    collectNodes(node, nodes);
 }
 
 void ContainerNode::removeAllChildren()
@@ -75,8 +79,7 @@ void ContainerNode::removeAllChildren()
 void ContainerNode::takeAllChildrenFrom(ContainerNode* oldParent)
 {
     NodeVector children;
-    for (Node* child = oldParent->firstChild(); child; child = child->nextSibling())
-        children.append(child);
+    collectNodes(oldParent, children);
     oldParent->removeAllChildren();
 
     for (unsigned i = 0; i < children.size(); ++i) {
@@ -101,7 +104,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
 {
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
-    ASSERT(refCount() || parentNode());
+    ASSERT(refCount() || parentOrHostNode());
 
     ec = 0;
 
@@ -158,7 +161,8 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         InspectorInstrumentation::willInsertDOMNode(document(), child, this);
 #endif
 
-        child->setDocumentRecursively(document());
+        child->setTreeScopeRecursively(treeScope());
+
         insertBeforeCommon(next.get(), child);
 
         // Send notification about the children change.
@@ -241,7 +245,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
 {
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
-    ASSERT(refCount() || parentNode());
+    ASSERT(refCount() || parentOrHostNode());
 
     ec = 0;
 
@@ -307,7 +311,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         InspectorInstrumentation::willInsertDOMNode(document(), child.get(), this);
 #endif
 
-        child->setDocumentRecursively(document());
+        child->setTreeScopeRecursively(treeScope());
 
         // Add child after "prev".
         forbidEventDispatch();
@@ -384,8 +388,7 @@ static void willRemoveChildren(ContainerNode* container)
     container->document()->incDOMTreeVersion();
 
     NodeVector children;
-    for (Node* n = container->firstChild(); n; n = n->nextSibling())
-        children.append(n);
+    collectNodes(container, children);
 
     for (NodeVector::const_iterator it = children.begin(); it != children.end(); it++) {
         Node* child = it->get();
@@ -399,7 +402,7 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
 {
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
-    ASSERT(refCount() || parentNode());
+    ASSERT(refCount() || parentOrHostNode());
 
     ec = 0;
 
@@ -559,7 +562,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
 {
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
-    ASSERT(refCount() || parentNode());
+    ASSERT(refCount() || parentOrHostNode());
 
     ec = 0;
 
@@ -597,7 +600,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         InspectorInstrumentation::willInsertDOMNode(document(), child, this);
 #endif
 
-        child->setDocumentRecursively(document());
+        child->setTreeScopeRecursively(treeScope());
 
         // Append child to the end of the list
         forbidEventDispatch();
@@ -735,8 +738,16 @@ void ContainerNode::insertedIntoDocument()
 {
     Node::insertedIntoDocument();
     insertedIntoTree(false);
-    for (Node* child = m_firstChild; child && inDocument(); child = child->nextSibling())
+
+    // Determine set of children before operating on any of them.
+    NodeVector children;
+    collectNodes(this, children);
+
+    NodeVector::iterator it;
+    for (it = children.begin(); it != children.end() && inDocument(); ++it) {
+        Node* child = it->get();
         child->insertedIntoDocument();
+    }
 }
 
 void ContainerNode::removedFromDocument()
@@ -778,9 +789,16 @@ void ContainerNode::childrenChanged(bool changedByParser, Node* beforeChange, No
 void ContainerNode::cloneChildNodes(ContainerNode *clone)
 {
     // disable the delete button so it's elements are not serialized into the markup
-    bool isEditorEnabled = document()->frame() && document()->frame()->editor()->canEdit();
-    if (isEditorEnabled)
-        document()->frame()->editor()->deleteButtonController()->disable();
+    bool isEditorEnabled = false;
+    if (document()->frame() && document()->frame()->editor()->canEdit()) {
+        SelectionController* selection = document()->frame()->selection();
+        Element* root = selection ? selection->rootEditableElement() : 0;
+        isEditorEnabled = root && isDescendantOf(root);
+
+        if (isEditorEnabled)
+            document()->frame()->editor()->deleteButtonController()->disable();
+    }
+    
     ExceptionCode ec = 0;
     for (Node* n = firstChild(); n && !ec; n = n->nextSibling())
         clone->appendChild(n->cloneNode(true), ec);
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index cc4888f..4a51d90 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -108,6 +108,7 @@
 #include "ScriptableDocumentParser.cpp"
 #include "SelectElement.cpp"
 #include "SelectorNodeList.cpp"
+#include "ShadowRoot.cpp"
 #include "SpaceSplitString.cpp"
 #include "StaticHashSetNodeList.cpp"
 #include "StaticNodeList.cpp"
@@ -121,6 +122,7 @@
 #include "TouchList.cpp"
 #include "TransformSourceLibxslt.cpp"
 #include "Traversal.cpp"
+#include "TreeScope.cpp"
 #include "TreeWalker.cpp"
 #include "UIEvent.cpp"
 #include "UIEventWithKeyState.cpp"
diff --git a/Source/WebCore/dom/DataTransferItem.h b/Source/WebCore/dom/DataTransferItem.h
index 7b5886a..d648c56 100644
--- a/Source/WebCore/dom/DataTransferItem.h
+++ b/Source/WebCore/dom/DataTransferItem.h
@@ -38,6 +38,7 @@
 
 namespace WebCore {
 
+class Blob;
 class StringCallback;
 
 class DataTransferItem : public RefCounted<DataTransferItem> {
@@ -51,6 +52,7 @@ public:
     virtual String type() const = 0;
 
     virtual void getAsString(PassRefPtr<StringCallback>) = 0;
+    virtual PassRefPtr<Blob> getAsFile() = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DataTransferItem.idl b/Source/WebCore/dom/DataTransferItem.idl
index a2c9942..accaf50 100644
--- a/Source/WebCore/dom/DataTransferItem.idl
+++ b/Source/WebCore/dom/DataTransferItem.idl
@@ -37,6 +37,7 @@ module core {
         readonly attribute DOMString type;
 
         void getAsString(in [Callback] StringCallback callback);
+        Blob getAsFile();
     };
 
 }
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index a0ddede..b85bdfb 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -123,7 +123,7 @@
 #include "RenderTextControl.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
-#include "ScopedEventQueue.h" 
+#include "ScopedEventQueue.h"
 #include "ScriptCallStack.h"
 #include "ScriptController.h"
 #include "ScriptElement.h"
@@ -391,7 +391,8 @@ private:
 uint64_t Document::s_globalTreeVersion = 0;
 
 Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
-    : ContainerNode(0)
+    : TreeScope(this)
+    , m_guardRefCount(0)
     , m_compatibilityMode(NoQuirksMode)
     , m_compatibilityModeLocked(false)
     , m_domTreeVersion(++s_globalTreeVersion)
@@ -406,8 +407,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_containsValidityStyleRules(false)
     , m_updateFocusAppearanceRestoresSelection(false)
     , m_ignoreDestructiveWriteCount(0)
-    , m_title("")
-    , m_rawTitle("")
     , m_titleSetExplicitly(false)
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
     , m_startTime(currentTime())
@@ -418,7 +417,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_xmlStandalone(false)
     , m_savedRenderer(0)
     , m_designMode(inherit)
-    , m_selfOnlyRefCount(0)
 #if ENABLE(SVG)
     , m_svgExtensions(0)
 #endif
@@ -426,7 +424,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_hasDashboardRegions(false)
     , m_dashboardRegionsDirty(false)
 #endif
-    , m_accessKeyMapValid(false)
     , m_createRenderers(true)
     , m_inPageCache(false)
     , m_useSecureKeyboardEntryWhenActive(false)
@@ -434,10 +431,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_isHTML(isHTML)
     , m_usesViewSourceStyles(false)
     , m_sawElementsInKnownNamespaces(false)
-    , m_numNodeListCaches(0)
-#if USE(JSC)
-    , m_normalWorldWrapperCache(0)
-#endif
     , m_usingGeolocation(false)
     , m_eventQueue(EventQueue::create(this))
 #if ENABLE(WML)
@@ -446,7 +439,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_weakReference(DocumentWeakReference::create(this))
     , m_idAttributeName(idAttr)
 #if ENABLE(FULLSCREEN_API)
-    , m_isFullScreen(0)
     , m_areKeysEnabledInFullScreen(0)
     , m_fullScreenRenderer(0)
     , m_fullScreenChangeDelayTimer(this, &Document::fullScreenChangeDelayTimerFired)
@@ -506,7 +498,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     m_usesLinkRules = false;
 
     m_gotoAnchorNeededAfterStylesheetsLoad = false;
- 
+
     m_didCalculateStyleSelector = false;
     m_hasDirtyStyleSelector = false;
     m_pendingStylesheets = 0;
@@ -532,57 +524,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
 #endif
 }
 
-void Document::removedLastRef()
-{
-    ASSERT(!m_deletionHasBegun);
-    if (m_selfOnlyRefCount) {
-        // If removing a child removes the last self-only ref, we don't
-        // want the document to be destructed until after
-        // removeAllChildren returns, so we guard ourselves with an
-        // extra self-only ref.
-        selfOnlyRef();
-
-        // We must make sure not to be retaining any of our children through
-        // these extra pointers or we will create a reference cycle.
-        m_docType = 0;
-        m_focusedNode = 0;
-        m_hoverNode = 0;
-        m_activeNode = 0;
-        m_titleElement = 0;
-        m_documentElement = 0;
-#if ENABLE(FULLSCREEN_API)
-        m_fullScreenElement = 0;
-#endif
-
-        // removeAllChildren() doesn't always unregister IDs, do it upfront to avoid having stale references in the map.
-        m_elementsById.clear();
-
-        removeAllChildren();
-
-        m_markers->detach();
-
-        detachParser();
-
-        m_cssCanvasElements.clear();
-
-#if ENABLE(REQUEST_ANIMATION_FRAME)
-        // FIXME: consider using ActiveDOMObject.
-        m_scriptedAnimationController = 0;
-#endif
-
-#ifndef NDEBUG
-        m_inRemovedLastRefFunction = false;
-#endif
-
-        selfOnlyDeref();
-    } else {
-#ifndef NDEBUG
-        m_deletionHasBegun = true;
-#endif
-        delete this;
-    }
-}
-
 Document::~Document()
 {
     ASSERT(!renderer());
@@ -590,15 +531,12 @@ Document::~Document()
     ASSERT(!m_savedRenderer);
     ASSERT(m_ranges.isEmpty());
     ASSERT(!m_styleRecalcTimer.isActive());
+    ASSERT(!m_parentTreeScope);
 
     m_scriptRunner.clear();
 
     removeAllEventListeners();
 
-#if USE(JSC)
-    destroyAllWrapperCaches();
-#endif
-
     // Currently we believe that Document can never outlive the parser.
     // Although the Document may be replaced synchronously, DocumentParsers
     // generally keep at least one reference to an Element which would in turn
@@ -642,41 +580,74 @@ Document::~Document()
         m_implementation->ownerDocumentDestroyed();
 }
 
-MediaQueryMatcher* Document::mediaQueryMatcher()
+void Document::removedLastRef()
 {
-    if (!m_mediaQueryMatcher)
-        m_mediaQueryMatcher = MediaQueryMatcher::create(this);
-    return m_mediaQueryMatcher.get();
-}
+    ASSERT(!m_deletionHasBegun);
+    if (m_guardRefCount) {
+        // If removing a child removes the last self-only ref, we don't
+        // want the scope to be destructed until after
+        // removeAllChildren returns, so we guard ourselves with an
+        // extra self-only ref.
+        guardRef();
 
-#if USE(JSC)
-Document::JSWrapperCache* Document::createWrapperCache(DOMWrapperWorld* world)
-{
-    JSWrapperCache* wrapperCache = new JSWrapperCache;
-    m_wrapperCacheMap.set(world, wrapperCache);
-    if (world->isNormal()) {
-        ASSERT(!m_normalWorldWrapperCache);
-        m_normalWorldWrapperCache = wrapperCache;
+        // We must make sure not to be retaining any of our children through
+        // these extra pointers or we will create a reference cycle.
+        m_docType = 0;
+        m_focusedNode = 0;
+        m_hoverNode = 0;
+        m_activeNode = 0;
+        m_titleElement = 0;
+        m_documentElement = 0;
+#if ENABLE(FULLSCREEN_API)
+        m_fullScreenElement = 0;
+#endif
+        m_styleSelector.clear();
+        m_styleSheets.clear();
+        m_elemSheet.clear();
+        m_mappedElementSheet.clear();
+        m_pageUserSheet.clear();
+        m_pageGroupUserSheets.clear();
+
+        // removeAllChildren() doesn't always unregister IDs,
+        // so tear down scope information upfront to avoid having stale references in the map.
+        destroyTreeScopeData();
+        removeAllChildren();
+
+        m_markers->detach();
+
+        detachParser();
+
+        m_cssCanvasElements.clear();
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+        // FIXME: consider using ActiveDOMObject.
+        m_scriptedAnimationController = 0;
+#endif
+
+#ifndef NDEBUG
+        m_inRemovedLastRefFunction = false;
+#endif
+
+        guardDeref();
+    } else {
+#ifndef NDEBUG
+        m_deletionHasBegun = true;
+#endif
+        delete this;
     }
-    world->didCreateWrapperCache(this);
-    return wrapperCache;
 }
 
-void Document::destroyWrapperCache(DOMWrapperWorld* world)
+Element* Document::getElementById(const AtomicString& id) const
 {
-    Document::JSWrapperCache* wrappers = wrapperCacheMap().take(world);
-    ASSERT(wrappers);
-    delete wrappers;
-    world->didDestroyWrapperCache(this);
+    return TreeScope::getElementById(id);
 }
 
-void Document::destroyAllWrapperCaches()
+MediaQueryMatcher* Document::mediaQueryMatcher()
 {
-    JSWrapperCacheMap& wrapperCacheMap = this->wrapperCacheMap();
-    while (!wrapperCacheMap.isEmpty())
-        destroyWrapperCache(wrapperCacheMap.begin()->first);
+    if (!m_mediaQueryMatcher)
+        m_mediaQueryMatcher = MediaQueryMatcher::create(this);
+    return m_mediaQueryMatcher.get();
 }
-#endif
 
 void Document::setCompatibilityMode(CompatibilityMode mode)
 {
@@ -718,6 +689,7 @@ void Document::setDocType(PassRefPtr<DocumentType> docType)
     ASSERT(!m_docType || !docType);
     m_docType = docType;
     if (m_docType)
+<<<<<<< HEAD
         m_docType->setDocument(this);
 #ifdef ANDROID_META_SUPPORT
     if (m_docType && !ownerElement()
@@ -729,6 +701,9 @@ void Document::setDocType(PassRefPtr<DocumentType> docType)
             PlatformBridge::updateViewport(frameView);
     }
 #endif
+=======
+        m_docType->setTreeScope(this);
+>>>>>>> WebKit.org at r84325
 }
 
 DOMImplementation* Document::implementation()
@@ -740,7 +715,7 @@ DOMImplementation* Document::implementation()
 
 void Document::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    ContainerNode::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    TreeScope::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     
     // Invalidate the document element we have cached in case it was replaced.
     m_documentElement = 0;
@@ -958,7 +933,7 @@ PassRefPtr<Node> Document::adoptNode(PassRefPtr<Node> source, ExceptionCode& ec)
             source->parentNode()->removeChild(source.get(), ec);
     }
 
-    source->setDocumentRecursively(this);
+    source->setTreeScopeRecursively(this);
 
     return source;
 }
@@ -1033,13 +1008,6 @@ PassRefPtr<Element> Document::createElementNS(const String& namespaceURI, const
     return createElement(qName, false);
 }
 
-Element* Document::getElementById(const AtomicString& elementId) const
-{
-    if (elementId.isEmpty())
-        return 0;
-    return m_elementsById.getElementById(elementId.impl(), this);
-}
-
 String Document::readyState() const
 {
     DEFINE_STATIC_LOCAL(const String, loading, ("loading"));
@@ -1266,42 +1234,15 @@ PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
     return Range::create(this, rangeCompliantPosition, rangeCompliantPosition);
 }
 
-void Document::addElementById(const AtomicString& elementId, Element* element)
-{
-    m_elementsById.add(elementId.impl(), element);
-}
-
-void Document::removeElementById(const AtomicString& elementId, Element* element)
-{
-    m_elementsById.remove(elementId.impl(), element);
-}
-
-Element* Document::getElementByAccessKey(const String& key) const
-{
-    if (key.isEmpty())
-        return 0;
-    if (!m_accessKeyMapValid) {
-        for (Node* n = firstChild(); n; n = n->traverseNextNode()) {
-            if (!n->isElementNode())
-                continue;
-            Element* element = static_cast<Element*>(n);
-            const AtomicString& accessKey = element->getAttribute(accesskeyAttr);
-            if (!accessKey.isEmpty())
-                m_elementsByAccessKey.set(accessKey.impl(), element);
-        }
-        m_accessKeyMapValid = true;
-    }
-    return m_elementsByAccessKey.get(key.impl());
-}
-
 /*
  * Performs three operations:
  *  1. Convert control characters to spaces
  *  2. Trim leading and trailing spaces
  *  3. Collapse internal whitespace.
  */
-static inline String canonicalizedTitle(Document* document, const String& title)
+static inline StringWithDirection canonicalizedTitle(Document* document, const StringWithDirection& titleWithDirection)
 {
+    const String& title = titleWithDirection.string();
     const UChar* characters = title.characters();
     unsigned length = title.length();
     unsigned i;
@@ -1317,7 +1258,7 @@ static inline String canonicalizedTitle(Document* document, const String& title)
     }
 
     if (i == length)
-        return "";
+        return StringWithDirection();
 
     // Replace control characters with spaces, and backslashes with currency symbols, and collapse whitespace.
     bool previousCharWasWS = false;
@@ -1342,17 +1283,17 @@ static inline String canonicalizedTitle(Document* document, const String& title)
     }
 
     if (!builderIndex && buffer[builderIndex] == ' ')
-        return "";
+        return StringWithDirection();
 
     buffer.shrink(builderIndex + 1);
 
     // Replace the backslashes with currency symbols if the encoding requires it.
     document->displayBufferModifiedByEncoding(buffer.characters(), buffer.length());
     
-    return String::adopt(buffer);
+    return StringWithDirection(String::adopt(buffer), titleWithDirection.direction());
 }
 
-void Document::updateTitle(const String& title)
+void Document::updateTitle(const StringWithDirection& title)
 {
     if (m_rawTitle == title)
         return;
@@ -1378,16 +1319,17 @@ void Document::setTitle(const String& title)
         }
     }
 
-    updateTitle(title);
+    // The DOM API has no method of specifying direction, so assume LTR.
+    updateTitle(StringWithDirection(title, LTR));
 
     if (m_titleElement) {
         ASSERT(m_titleElement->hasTagName(titleTag));
         if (m_titleElement->hasTagName(titleTag))
-            static_cast<HTMLTitleElement*>(m_titleElement.get())->setText(m_title);
+            static_cast<HTMLTitleElement*>(m_titleElement.get())->setText(title);
     }
 }
 
-void Document::setTitleElement(const String& title, Element* titleElement)
+void Document::setTitleElement(const StringWithDirection& title, Element* titleElement)
 {
     if (titleElement != m_titleElement) {
         if (m_titleElement || m_titleSetExplicitly)
@@ -1412,13 +1354,13 @@ void Document::removeTitle(Element* titleElement)
         for (Node* e = headElement->firstChild(); e; e = e->nextSibling())
             if (e->hasTagName(titleTag)) {
                 HTMLTitleElement* titleElement = static_cast<HTMLTitleElement*>(e);
-                setTitleElement(titleElement->text(), titleElement);
+                setTitleElement(titleElement->textWithDirection(), titleElement);
                 break;
             }
     }
 
     if (!m_titleElement)
-        updateTitle("");
+        updateTitle(StringWithDirection());
 }
 
 String Document::nodeName() const
@@ -1489,10 +1431,7 @@ void Document::scheduleStyleRecalc()
     documentsThatNeedStyleRecalc->add(this);
     
     // FIXME: Why on earth is this here? This is clearly misplaced.
-    if (m_accessKeyMapValid) {
-        m_accessKeyMapValid = false;
-        m_elementsByAccessKey.clear();
-    }
+    invalidateAccessKeyMap();
     
     m_styleRecalcTimer.startOneShot(0);
 }
@@ -1542,17 +1481,24 @@ void Document::recalcStyle(StyleChange change)
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
     RenderWidget::suspendWidgetHierarchyUpdates();
-    if (view())
-        view()->pauseScheduledEvents();
     
+<<<<<<< HEAD
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::CalculateStyleTimeCounter);
 #endif
     
+=======
+    RefPtr<FrameView> frameView = view();
+    if (frameView) {
+        frameView->pauseScheduledEvents();
+        frameView->beginDeferredRepaints();
+    }
+
+>>>>>>> WebKit.org at r84325
     ASSERT(!renderer() || renderArena());
     if (!renderer() || !renderArena())
         goto bail_out;
-    
+
     if (m_pendingStyleRecalcShouldForce)
         change = Force;
 
@@ -1596,8 +1542,10 @@ bail_out:
         m_usesLinkRules = m_styleSelector->usesLinkRules();
     }
 
-    if (view())
-        view()->resumeScheduledEvents();
+    if (frameView) {
+        frameView->resumeScheduledEvents();
+        frameView->endDeferredRepaints();
+    }
     RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
     m_inStyleRecalc = false;
@@ -1794,7 +1742,7 @@ void Document::attach()
     RenderObject* render = renderer();
     setRenderer(0);
 
-    ContainerNode::attach();
+    TreeScope::attach();
 
     setRenderer(render);
 }
@@ -1806,6 +1754,7 @@ void Document::detach()
 
     clearAXObjectCache();
     stopActiveDOMObjects();
+    m_eventQueue->cancelQueuedEvents();
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     // FIXME: consider using ActiveDOMObject.
@@ -1840,7 +1789,7 @@ void Document::detach()
     m_focusedNode = 0;
     m_activeNode = 0;
 
-    ContainerNode::detach();
+    TreeScope::detach();
 
     unscheduleStyleRecalc();
 
@@ -2725,7 +2674,8 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
                 frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
             }
         }
-    }
+    } else if (equalIgnoringCase(equiv, "x-webkit-csp"))
+        contentSecurityPolicy()->didReceiveHeader(content);
 }
 
 // Though isspace() considers \t and \v to be whitespace, Win IE doesn't.
@@ -2821,7 +2771,7 @@ MouseEventWithHitTestResults Document::prepareMouseEvent(const HitTestRequest& r
 }
 
 // DOM Section 1.1.1
-bool Document::childTypeAllowed(NodeType type)
+bool Document::childTypeAllowed(NodeType type) const
 {
     switch (type) {
     case ATTRIBUTE_NODE:
@@ -3957,33 +3907,6 @@ bool Document::parseQualifiedName(const String& qualifiedName, String& prefix, S
     return true;
 }
 
-void Document::addImageMap(HTMLMapElement* imageMap)
-{
-    AtomicStringImpl* name = imageMap->getName().impl();
-    if (!name)
-        return;
-    m_imageMapsByName.add(name, imageMap);
-}
-
-void Document::removeImageMap(HTMLMapElement* imageMap)
-{
-    AtomicStringImpl* name = imageMap->getName().impl();
-    if (!name)
-        return;
-    m_imageMapsByName.remove(name, imageMap);
-}
-
-HTMLMapElement* Document::getImageMap(const String& url) const
-{
-    if (url.isNull())
-        return 0;
-    size_t hashPos = url.find('#');
-    String name = (hashPos == notFound ? url : url.substring(hashPos + 1)).impl();
-    if (isHTMLDocument())
-        return static_cast<HTMLMapElement*>(m_imageMapsByName.getElementByLowercasedMapName(AtomicString(name.lower()).impl(), this));
-    return static_cast<HTMLMapElement*>(m_imageMapsByName.getElementByMapName(AtomicString(name).impl(), this));
-}
-
 void Document::setDecoder(PassRefPtr<TextResourceDecoder> decoder)
 {
     m_decoder = decoder;
@@ -4832,29 +4755,6 @@ void Document::resumeScriptedAnimationControllerCallbacks()
 #endif
 }
 
-Element* Document::findAnchor(const String& name)
-{
-    if (name.isEmpty())
-        return 0;
-    if (Element* element = getElementById(name))
-        return element;
-    for (Node* node = this; node; node = node->traverseNextNode()) {
-        if (node->hasTagName(aTag)) {
-            HTMLAnchorElement* anchor = static_cast<HTMLAnchorElement*>(node);
-            if (inQuirksMode()) {
-                // Quirks mode, case insensitive comparison of names.
-                if (equalIgnoringCase(anchor->name(), name))
-                    return anchor;
-            } else {
-                // Strict mode, names need to match exactly.
-                if (anchor->name() == name)
-                    return anchor;
-            }
-        }
-    }
-    return 0;
-}
-
 String Document::displayStringModifiedByEncoding(const String& str) const
 {
     if (m_decoder)
@@ -4977,7 +4877,6 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
     ASSERT(page() && page()->settings()->fullScreenEnabled());
 
     m_fullScreenElement = element;
-    m_isFullScreen = true;
     
     if (m_fullScreenElement != documentElement())
         m_fullScreenElement->detach();
@@ -4988,8 +4887,8 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
         m_fullScreenRenderer->setAnimating(true);
 #if USE(ACCELERATED_COMPOSITING)
         view()->updateCompositingLayers();
-        ASSERT(m_fullScreenRenderer->layer()->backing());
-        page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
+        if (m_fullScreenRenderer->layer()->isComposited())
+            page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
 #endif
     }
 }
@@ -5000,7 +4899,6 @@ void Document::webkitDidEnterFullScreenForElement(Element*)
         m_fullScreenRenderer->setAnimating(false);
 #if USE(ACCELERATED_COMPOSITING)
         view()->updateCompositingLayers();
-        ASSERT(!m_fullScreenRenderer->layer()->backing());
         page()->chrome()->client()->setRootFullScreenLayer(0);
 #endif
     }
@@ -5011,18 +4909,16 @@ void Document::webkitWillExitFullScreenForElement(Element*)
 {
     if (m_fullScreenRenderer) {
         m_fullScreenRenderer->setAnimating(true);
-        m_fullScreenRenderer->setAnimating(true);
 #if USE(ACCELERATED_COMPOSITING)
         view()->updateCompositingLayers();
-        ASSERT(m_fullScreenRenderer->layer()->backing());
-        page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
+        if (m_fullScreenRenderer->layer()->isComposited())
+            page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
 #endif
     }
 }
 
 void Document::webkitDidExitFullScreenForElement(Element*)
 {
-    m_isFullScreen = false;
     m_areKeysEnabledInFullScreen = false;
 
     if (m_fullScreenRenderer)
@@ -5030,7 +4926,8 @@ void Document::webkitDidExitFullScreenForElement(Element*)
     
     if (m_fullScreenElement != documentElement())
         m_fullScreenElement->detach();
-    
+
+    m_fullScreenElement = 0;
     setFullScreenRenderer(0);
 #if USE(ACCELERATED_COMPOSITING)
     page()->chrome()->client()->setRootFullScreenLayer(0);
@@ -5149,34 +5046,4 @@ PassRefPtr<TouchList> Document::createTouchList(ExceptionCode&) const
 }
 #endif
 
-static bool hasHeadSibling(const Document* document)
-{
-    Node* de = document->documentElement();
-    if (!de)
-        return false;
-
-    for (Node* i = de->firstChild(); i; i = i->nextSibling()) {
-        // A child of the document element which is rather than <head> is
-        // typically visible and FOUC safe. So we return true here.
-        if (!i->hasTagName(headTag))
-            return true;
-    }
-
-    return false;
-}
-
-bool Document::mayCauseFlashOfUnstyledContent() const
-{
-    // Some kind of FOUC is caused by a repaint request before page's <body> arrival
-    // because page authors often give background styles to <body>, not to <html>.
-    // (And these styles are unavailable before <style> or <link> is given.)
-    // This functions is used for checking such possibility of FOUCs.
-    // Note that the implementation considers only empty or <head> only contents as a FOUC cause
-    // rather than missing <body>, because non-HTML document like SVG and arbitrary XML from foreign namespace 
-    // should be painted even if there is no <body>.
-    if (didLayoutWithPendingStylesheets())
-        return true;
-    return !hasHeadSibling(this);
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 11c595a..5ab6d77 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -31,23 +31,19 @@
 #include "CollectionCache.h"
 #include "CollectionType.h"
 #include "Color.h"
-#include "ContainerNode.h"
 #include "DOMTimeStamp.h"
-#include "DocumentOrderedMap.h"
 #include "DocumentTiming.h"
 #include "QualifiedName.h"
 #include "ScriptExecutionContext.h"
+#include "StringWithDirection.h"
 #include "Timer.h"
+#include "TreeScope.h"
 #include "ViewportArguments.h"
 #include <wtf/FixedArray.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 
-#if USE(JSC)
-#include <runtime/WeakGCMap.h>
-#endif
-
 namespace WebCore {
 
 class AXObjectCache;
@@ -205,7 +201,7 @@ enum PageshowEventPersistence {
 
 enum StyleSelectorUpdateFlag { RecalcStyleImmediately, DeferRecalcStyle };
 
-class Document : public ContainerNode, public ScriptExecutionContext {
+class Document : public TreeScope, public ScriptExecutionContext {
 public:
     static PassRefPtr<Document> create(Frame* frame, const KURL& url)
     {
@@ -219,25 +215,25 @@ public:
 
     MediaQueryMatcher* mediaQueryMatcher();
 
-    using ContainerNode::ref;
-    using ContainerNode::deref;
+    using TreeScope::ref;
+    using TreeScope::deref;
 
-    // Nodes belonging to this document hold "self-only" references -
+    // Nodes belonging to this document hold guard references -
     // these are enough to keep the document from being destroyed, but
     // not enough to keep it from removing its children. This allows a
     // node that outlives its document to still have a valid document
-    // pointer without introducing reference cycles
-
-    void selfOnlyRef()
+    // pointer without introducing reference cycles.
+    void guardRef()
     {
         ASSERT(!m_deletionHasBegun);
-        ++m_selfOnlyRefCount;
+        ++m_guardRefCount;
     }
-    void selfOnlyDeref()
+
+    void guardDeref()
     {
         ASSERT(!m_deletionHasBegun);
-        --m_selfOnlyRefCount;
-        if (!m_selfOnlyRefCount && !refCount()) {
+        --m_guardRefCount;
+        if (!m_guardRefCount && !refCount()) {
 #ifndef NDEBUG
             m_deletionHasBegun = true;
 #endif
@@ -245,6 +241,10 @@ public:
         }
     }
 
+    virtual void removedLastRef();
+
+    Element* getElementById(const AtomicString& id) const;
+
     // DOM methods & attributes for Document
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
@@ -259,8 +259,6 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
-    DEFINE_ATTRIBUTE_EVENT_LISTENER(formchange);
-    DEFINE_ATTRIBUTE_EVENT_LISTENER(forminput);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
@@ -328,9 +326,6 @@ public:
     PassRefPtr<Node> importNode(Node* importedNode, bool deep, ExceptionCode&);
     virtual PassRefPtr<Element> createElementNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode&);
     PassRefPtr<Element> createElement(const QualifiedName&, bool createdByParser);
-    Element* getElementById(const AtomicString&) const;
-    bool hasElementWithId(AtomicStringImpl* id) const;
-    bool containsMultipleElementsWithId(const AtomicString& id) const;
 
     /**
      * Retrieve all nodes that intersect a rect in the window's document, until it is fully enclosed by
@@ -394,13 +389,6 @@ public:
 
     PassRefPtr<HTMLAllCollection> all();
 
-    // Find first anchor with the given name.
-    // First searches for an element with the given ID, but if that fails, then looks
-    // for an anchor with the given name. ID matching is always case sensitive, but
-    // Anchor name matching is case sensitive in strict mode and not case sensitive in
-    // quirks mode for historical compatibility reasons.
-    Element* findAnchor(const String& name);
-
     CollectionCache* collectionInfo(CollectionType type)
     {
         ASSERT(type >= FirstUnnamedDocumentCachedType);
@@ -451,8 +439,6 @@ public:
         return m_styleSelector.get();
     }
 
-    Element* getElementByAccessKey(const String& key) const;
-    
     /**
      * Updates the pending sheet count and then calls updateStyleSelector.
      */
@@ -819,9 +805,11 @@ public:
     // Returns 0 if this is the top level document.
     HTMLFrameOwnerElement* ownerElement() const;
 
-    String title() const { return m_title; }
+    // Used by DOM bindings; no direction known.
+    String title() const { return m_title.string(); }
     void setTitle(const String&);
-    void setTitleElement(const String& title, Element* titleElement);
+
+    void setTitleElement(const StringWithDirection&, Element* titleElement);
     void removeTitle(Element* titleElement);
 
     String cookie(ExceptionCode&) const;
@@ -872,13 +860,6 @@ public:
     // Checks to make sure prefix and namespace do not conflict (per DOM Core 3)
     static bool hasPrefixNamespaceMismatch(const QualifiedName&);
     
-    void addElementById(const AtomicString& elementId, Element *element);
-    void removeElementById(const AtomicString& elementId, Element *element);
-
-    void addImageMap(HTMLMapElement*);
-    void removeImageMap(HTMLMapElement*);
-    HTMLMapElement* getImageMap(const String& url) const;
-
     HTMLElement* body() const;
     void setBody(PassRefPtr<HTMLElement>, ExceptionCode&);
 
@@ -956,10 +937,6 @@ public:
     void setUseSecureKeyboardEntryWhenActive(bool);
     bool useSecureKeyboardEntryWhenActive() const;
 
-    void addNodeListCache() { ++m_numNodeListCaches; }
-    void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
-    bool hasNodeListCaches() const { return m_numNodeListCaches; }
-
     void updateFocusAppearanceSoon(bool restorePreviousSelection);
     void cancelFocusAppearanceUpdate();
         
@@ -979,16 +956,6 @@ public:
     virtual void suspendScriptedAnimationControllerCallbacks();
     virtual void resumeScriptedAnimationControllerCallbacks();
 
-#if USE(JSC)
-    typedef JSC::WeakGCMap<WebCore::Node*, JSNode> JSWrapperCache;
-    typedef HashMap<DOMWrapperWorld*, JSWrapperCache*> JSWrapperCacheMap;
-    JSWrapperCacheMap& wrapperCacheMap() { return m_wrapperCacheMap; }
-    JSWrapperCache* getWrapperCache(DOMWrapperWorld* world);
-    JSWrapperCache* createWrapperCache(DOMWrapperWorld*);
-    void destroyWrapperCache(DOMWrapperWorld*);
-    void destroyAllWrapperCaches();
-#endif
-
     virtual void finishedParsing();
 
     bool inPageCache() const { return m_inPageCache; }
@@ -1059,7 +1026,7 @@ public:
 #endif
 
     virtual bool isContextThread() const;
-    virtual bool isJSExecutionTerminated() const { return false; }
+    virtual bool isJSExecutionForbidden() const { return false; }
 
     void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
     bool usingGeolocation() const { return m_usingGeolocation; };
@@ -1089,8 +1056,8 @@ public:
     const QualifiedName& idAttributeName() const { return m_idAttributeName; }
     
 #if ENABLE(FULLSCREEN_API)
-    bool webkitIsFullScreen() const { return m_isFullScreen; }
-    bool webkitFullScreenKeyboardInputAllowed() const { return m_isFullScreen && m_areKeysEnabledInFullScreen; }
+    bool webkitIsFullScreen() const { return m_fullScreenElement.get(); }
+    bool webkitFullScreenKeyboardInputAllowed() const { return m_fullScreenElement.get() && m_areKeysEnabledInFullScreen; }
     Element* webkitCurrentFullScreenElement() const { return m_fullScreenElement.get(); }
     void webkitRequestFullScreenForElement(Element*, unsigned short flags);
     void webkitCancelFullScreen();
@@ -1128,8 +1095,6 @@ public:
     void serviceScriptedAnimations(DOMTimeStamp);
 #endif
 
-    bool mayCauseFlashOfUnstyledContent() const;
-
     virtual EventTarget* errorEventTarget();
     virtual void logExceptionToConsole(const String& errorMessage, int lineNumber, const String& sourceURL, PassRefPtr<ScriptCallStack>);
 
@@ -1152,13 +1117,12 @@ private:
     void processArguments(const String& features, void* data, ArgumentsCallback);
 
     virtual bool isDocument() const { return true; }
-    virtual void removedLastRef();
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool canReplaceChild(Node* newChild, Node* oldChild);
 
@@ -1172,7 +1136,7 @@ private:
 
     String encoding() const;
 
-    void updateTitle(const String& title);
+    void updateTitle(const StringWithDirection&);
     void updateFocusAppearanceTimerFired(Timer<Document>*);
     void updateBaseURL();
 
@@ -1184,6 +1148,8 @@ private:
 
     void loadEventDelayTimerFired(Timer<Document>*);
 
+    int m_guardRefCount;
+
     OwnPtr<CSSStyleSelector> m_styleSelector;
     bool m_didCalculateStyleSelector;
     bool m_hasDirtyStyleSelector;
@@ -1312,8 +1278,8 @@ private:
     // http://www.whatwg.org/specs/web-apps/current-work/#ignore-destructive-writes-counter
     unsigned m_ignoreDestructiveWriteCount;
 
-    String m_title;
-    String m_rawTitle;
+    StringWithDirection m_title;
+    StringWithDirection m_rawTitle;
     bool m_titleSetExplicitly;
     RefPtr<Element> m_titleElement;
 
@@ -1344,8 +1310,6 @@ private:
     RefPtr<Document> m_transformSourceDocument;
 #endif
 
-    DocumentOrderedMap m_imageMapsByName;
-
     int m_docID; // A unique document identifier used for things like document-specific mapped attributes.
 
     String m_xmlEncoding;
@@ -1362,14 +1326,8 @@ private:
     
     RefPtr<TextResourceDecoder> m_decoder;
 
-    DocumentOrderedMap m_elementsById;
-    
-    mutable HashMap<StringImpl*, Element*, CaseFoldingHash> m_elementsByAccessKey;
-    
     InheritedBool m_designMode;
     
-    int m_selfOnlyRefCount;
-
     CheckedRadioButtons m_checkedRadioButtons;
 
     typedef HashMap<AtomicStringImpl*, CollectionCache*> NamedCollectionMap;
@@ -1392,7 +1350,6 @@ private:
 
     HashMap<String, RefPtr<HTMLCanvasElement> > m_cssCanvasElements;
 
-    mutable bool m_accessKeyMapValid;
     bool m_createRenderers;
     bool m_inPageCache;
     String m_iconURL;
@@ -1409,13 +1366,6 @@ private:
     bool m_usesViewSourceStyles;
     bool m_sawElementsInKnownNamespaces;
 
-    unsigned m_numNodeListCaches;
-
-#if USE(JSC)
-    JSWrapperCacheMap m_wrapperCacheMap;
-    JSWrapperCache* m_normalWorldWrapperCache;
-#endif
-
     bool m_usingGeolocation;
     
     RefPtr<EventQueue> m_eventQueue;
@@ -1431,7 +1381,6 @@ private:
     QualifiedName m_idAttributeName;
     
 #if ENABLE(FULLSCREEN_API)
-    bool m_isFullScreen;
     bool m_areKeysEnabledInFullScreen;
     RefPtr<Element> m_fullScreenElement;
     RenderFullScreen* m_fullScreenRenderer;
@@ -1458,23 +1407,13 @@ private:
     RefPtr<ContentSecurityPolicy> m_contentSecurityPolicy;
 };
 
-inline bool Document::hasElementWithId(AtomicStringImpl* id) const
-{
-    ASSERT(id);
-    return m_elementsById.contains(id);
-}
+// Put these methods here, because they require the Document definition, but we really want to inline them.
 
-inline bool Document::containsMultipleElementsWithId(const AtomicString& id) const
-{
-    return m_elementsById.containsMultiple(id.impl());
-}
-    
 inline bool Node::isDocumentNode() const
 {
     return this == m_document;
 }
 
-// here because it uses a Document method but we really want to inline it
 inline Node::Node(Document* document, ConstructionType type)
     : m_document(document)
     , m_previous(0)
@@ -1483,7 +1422,7 @@ inline Node::Node(Document* document, ConstructionType type)
     , m_nodeFlags(type)
 {
     if (m_document)
-        m_document->selfOnlyRef();
+        m_document->guardRef();
 #if !defined(NDEBUG) || (defined(DUMP_NODE_STATISTICS) && DUMP_NODE_STATISTICS)
     trackForDebugging();
 #endif
diff --git a/Source/WebCore/dom/Document.idl b/Source/WebCore/dom/Document.idl
index 11d6678..cf820ba 100644
--- a/Source/WebCore/dom/Document.idl
+++ b/Source/WebCore/dom/Document.idl
@@ -29,7 +29,7 @@ module core {
 
         // DOM Level 1 Core
         readonly attribute DocumentType doctype;
-        readonly attribute [V8Custom] DOMImplementation implementation;
+        readonly attribute DOMImplementation implementation;
         readonly attribute Element documentElement;
 
         [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
@@ -266,8 +266,6 @@ module core {
         attribute [DontEnum] EventListener ondrop;
         attribute [DontEnum] EventListener onerror;
         attribute [DontEnum] EventListener onfocus;
-        attribute [DontEnum] EventListener onformchange;
-        attribute [DontEnum] EventListener onforminput;
         attribute [DontEnum] EventListener oninput;
         attribute [DontEnum] EventListener oninvalid;
         attribute [DontEnum] EventListener onkeydown;
diff --git a/Source/WebCore/dom/DocumentFragment.cpp b/Source/WebCore/dom/DocumentFragment.cpp
index c9c3020..3882c4d 100644
--- a/Source/WebCore/dom/DocumentFragment.cpp
+++ b/Source/WebCore/dom/DocumentFragment.cpp
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-inline DocumentFragment::DocumentFragment(Document* document)
+DocumentFragment::DocumentFragment(Document* document)
     : ContainerNode(document)
 {
     ASSERT(document);
@@ -52,7 +52,7 @@ Node::NodeType DocumentFragment::nodeType() const
     return DOCUMENT_FRAGMENT_NODE;
 }
 
-bool DocumentFragment::childTypeAllowed(NodeType type)
+bool DocumentFragment::childTypeAllowed(NodeType type) const
 {
     switch (type) {
         case ELEMENT_NODE:
diff --git a/Source/WebCore/dom/DocumentFragment.h b/Source/WebCore/dom/DocumentFragment.h
index d588b4e..b035a64 100644
--- a/Source/WebCore/dom/DocumentFragment.h
+++ b/Source/WebCore/dom/DocumentFragment.h
@@ -36,13 +36,14 @@ public:
     void parseHTML(const String&, Element* contextElement, FragmentScriptingPermission = FragmentScriptingAllowed);
     bool parseXML(const String&, Element* contextElement, FragmentScriptingPermission = FragmentScriptingAllowed);
 
-private:
+protected:
     DocumentFragment(Document*);
-
     virtual String nodeName() const;
+
+private:
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
 };
 
 } //namespace
diff --git a/Source/WebCore/dom/DocumentMarker.h b/Source/WebCore/dom/DocumentMarker.h
index 81112bf..1711a96 100644
--- a/Source/WebCore/dom/DocumentMarker.h
+++ b/Source/WebCore/dom/DocumentMarker.h
@@ -37,9 +37,9 @@ struct DocumentMarker {
         Spelling = 1 << 0,
         Grammar = 1 << 1,
         TextMatch = 1 << 2,
-        // Text has been modified by spell correction. On some platforms, this prevents the text
-        // to be autocorrected again. On post Snow Leopard Mac OS X, if a Replacement marker contains
-        // non-empty description, a reversion UI will be shown.
+        // Text has been modified by spell correction, reversion of spell correction or other type of substitution. 
+        // On some platforms, this prevents the text from being autocorrected again. On post Snow Leopard Mac OS X, 
+        // if a Replacement marker contains non-empty description, a reversion UI will be shown.
         Replacement = 1 << 3,
         // Renderer needs to add underline indicating that the text has been modified by spell
         // correction. Text with Replacement marker doesn't necessarily has CorrectionIndicator
@@ -49,12 +49,37 @@ struct DocumentMarker {
         CorrectionIndicator = 1 << 4,
         // Correction suggestion has been offered, but got rejected by user.
         RejectedCorrection = 1 << 5,
-        // On some platforms, this prevents the text to be spellchecked again.
-        SpellCheckingExemption = 1 << 6,
-        AllMarkers = Spelling | Grammar | TextMatch | Replacement | CorrectionIndicator | RejectedCorrection | SpellCheckingExemption
+        // Text has been modified by autocorrection. The description of this marker is the original text before autocorrection.
+        Autocorrected = 1 << 6,
+        // On some platforms, this prevents the text from being spellchecked again.
+        SpellCheckingExemption = 1 << 7,
     };
+
+    class MarkerTypes {
+    public:
+        // The constructor is intentionally implicit to allow conversion from the bit-wise sum of above types
+        MarkerTypes(unsigned mask) : m_mask(mask) { }
+
+        bool contains(MarkerType type) const { return m_mask & type; }
+        bool intersects(const MarkerTypes& types) const { return (m_mask & types.m_mask); }
+        bool operator==(const MarkerTypes& other) const { return m_mask == other.m_mask; }
+
+        void add(const MarkerTypes& types) { m_mask |= types.m_mask; }
+        void remove(const MarkerTypes& types) { m_mask &= ~types.m_mask; }
+
+    private:
+        unsigned m_mask;
+    };
+
+    class AllMarkers : public MarkerTypes {
+    public:
+        AllMarkers()
+            : MarkerTypes(Spelling | Grammar | TextMatch | Replacement | CorrectionIndicator | RejectedCorrection | Autocorrected | SpellCheckingExemption)
+        {
+        }
+    };
+    
     MarkerType type;
-    typedef unsigned MarkerTypes;
     unsigned startOffset;
     unsigned endOffset;
     String description;
diff --git a/Source/WebCore/dom/DocumentMarkerController.cpp b/Source/WebCore/dom/DocumentMarkerController.cpp
index f646f3c..d97f2af 100644
--- a/Source/WebCore/dom/DocumentMarkerController.cpp
+++ b/Source/WebCore/dom/DocumentMarkerController.cpp
@@ -40,7 +40,7 @@ static IntRect placeholderRectForMarker()
 
 inline bool DocumentMarkerController::possiblyHasMarkers(DocumentMarker::MarkerTypes types)
 {
-    return m_possiblyExistingMarkerTypes & types;
+    return m_possiblyExistingMarkerTypes.intersects(types);
 }
 
 DocumentMarkerController::DocumentMarkerController()
@@ -91,7 +91,7 @@ void DocumentMarkerController::addMarker(Node* node, DocumentMarker newMarker)
     if (newMarker.endOffset == newMarker.startOffset)
         return;
 
-    m_possiblyExistingMarkerTypes |= newMarker.type;
+    m_possiblyExistingMarkerTypes.add(newMarker.type);
 
     MarkerMapVectorPair* vectorPair = m_markers.get(node);
 
@@ -152,12 +152,12 @@ void DocumentMarkerController::addMarker(Node* node, DocumentMarker newMarker)
 
 // copies markers from srcNode to dstNode, applying the specified shift delta to the copies.  The shift is
 // useful if, e.g., the caller has created the dstNode from a non-prefix substring of the srcNode.
-void DocumentMarkerController::copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta, DocumentMarker::MarkerType markerType)
+void DocumentMarkerController::copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta)
 {
     if (length <= 0)
         return;
 
-    if (!possiblyHasMarkers(markerType))
+    if (!possiblyHasMarkers(DocumentMarker::AllMarkers()))
         return;
     ASSERT(!m_markers.isEmpty());
 
@@ -178,7 +178,7 @@ void DocumentMarkerController::copyMarkers(Node* srcNode, unsigned startOffset,
             break;
 
         // skip marker that is before the specified range or is the wrong type
-        if (marker.endOffset < startOffset || (marker.type != markerType && markerType != DocumentMarker::AllMarkers))
+        if (marker.endOffset < startOffset)
             continue;
 
         // pin the marker to the specified range and apply the shift delta
@@ -224,7 +224,7 @@ void DocumentMarkerController::removeMarkers(Node* node, unsigned startOffset, i
             break;
 
         // skip marker that is wrong type or before target
-        if (marker.endOffset <= startOffset || !(marker.type & markerTypes)) {
+        if (marker.endOffset <= startOffset || !markerTypes.contains(marker.type)) {
             i++;
             continue;
         }
@@ -292,7 +292,7 @@ DocumentMarker* DocumentMarkerController::markerContainingPoint(const IntPoint&
             DocumentMarker& marker = markers[markerIndex];
 
             // skip marker that is wrong type
-            if (marker.type != markerType && markerType != DocumentMarker::AllMarkers)
+            if (marker.type != markerType)
                 continue;
 
             IntRect& r = rects[markerIndex];
@@ -317,6 +317,35 @@ Vector<DocumentMarker> DocumentMarkerController::markersForNode(Node* node)
     return Vector<DocumentMarker>();
 }
 
+Vector<DocumentMarker> DocumentMarkerController::markersInRange(Range* range, DocumentMarker::MarkerType markerType)
+{
+    if (!possiblyHasMarkers(markerType))
+        return Vector<DocumentMarker>();
+
+    Vector<DocumentMarker> foundMarkers;
+
+    Node* startContainer = range->startContainer();
+    ASSERT(startContainer);
+    Node* endContainer = range->endContainer();
+    ASSERT(endContainer);
+
+    Node* pastLastNode = range->pastLastNode();
+    for (Node* node = range->firstNode(); node != pastLastNode; node = node->traverseNextNode()) {
+        Vector<DocumentMarker> markers = markersForNode(node);
+        Vector<DocumentMarker>::const_iterator end = markers.end();
+        for (Vector<DocumentMarker>::const_iterator it = markers.begin(); it != end; ++it) {
+            if (markerType != it->type)
+                continue;
+            if (node == startContainer && it->endOffset <= static_cast<unsigned>(range->startOffset()))
+                continue;
+            if (node == endContainer && it->startOffset >= static_cast<unsigned>(range->endOffset()))
+                continue;
+            foundMarkers.append(*it);
+        }
+    }
+    return foundMarkers;
+}
+
 Vector<IntRect> DocumentMarkerController::renderedRectsForMarkers(DocumentMarker::MarkerType markerType)
 {
     Vector<IntRect> result;
@@ -338,7 +367,7 @@ Vector<IntRect> DocumentMarkerController::renderedRectsForMarkers(DocumentMarker
             DocumentMarker marker = markers[markerIndex];
 
             // skip marker that is wrong type
-            if (marker.type != markerType && markerType != DocumentMarker::AllMarkers)
+            if (marker.type != markerType)
                 continue;
 
             IntRect r = rects[markerIndex];
@@ -379,13 +408,13 @@ void DocumentMarkerController::removeMarkers(DocumentMarker::MarkerTypes markerT
         removeMarkersFromMarkerMapVectorPair(node, vectorPair, markerTypes);
     }
 
-    m_possiblyExistingMarkerTypes &= ~markerTypes;
+    m_possiblyExistingMarkerTypes.remove(markerTypes);
 }
 
 // This function may release node and vectorPair.
 void DocumentMarkerController::removeMarkersFromMarkerMapVectorPair(Node* node, MarkerMapVectorPair* vectorPair, DocumentMarker::MarkerTypes markerTypes)
 {
-    if (!~(markerTypes & DocumentMarker::AllMarkers)) {
+    if (markerTypes == DocumentMarker::AllMarkers()) {
         delete vectorPair;
         m_markers.remove(node);
         if (RenderObject* renderer = node->renderer())
@@ -399,7 +428,7 @@ void DocumentMarkerController::removeMarkersFromMarkerMapVectorPair(Node* node,
             DocumentMarker marker = markers[i];
 
             // skip nodes that are not of the specified type
-            if (!(marker.type & markerTypes)) {
+            if (!markerTypes.contains(marker.type)) {
                 ++i;
                 continue;
             }
@@ -430,9 +459,9 @@ void DocumentMarkerController::removeMarkersFromMarkerMapVectorPair(Node* node,
         m_possiblyExistingMarkerTypes = 0;
 }
 
-void DocumentMarkerController::repaintMarkers(DocumentMarker::MarkerType markerType)
+void DocumentMarkerController::repaintMarkers(DocumentMarker::MarkerTypes markerTypes)
 {
-    if (!possiblyHasMarkers(markerType))
+    if (!possiblyHasMarkers(markerTypes))
         return;
     ASSERT(!m_markers.isEmpty());
 
@@ -449,7 +478,7 @@ void DocumentMarkerController::repaintMarkers(DocumentMarker::MarkerType markerT
             DocumentMarker marker = markers[i];
 
             // skip nodes that are not of the specified type
-            if (marker.type == markerType || markerType == DocumentMarker::AllMarkers) {
+            if (markerTypes.contains(marker.type)) {
                 nodeNeedsRepaint = true;
                 break;
             }
@@ -503,9 +532,9 @@ void DocumentMarkerController::invalidateRenderedRectsForMarkersInRect(const Int
     }
 }
 
-void DocumentMarkerController::shiftMarkers(Node* node, unsigned startOffset, int delta, DocumentMarker::MarkerType markerType)
+void DocumentMarkerController::shiftMarkers(Node* node, unsigned startOffset, int delta)
 {
-    if (!possiblyHasMarkers(markerType))
+    if (!possiblyHasMarkers(DocumentMarker::AllMarkers()))
         return;
     ASSERT(!m_markers.isEmpty());
 
@@ -520,7 +549,7 @@ void DocumentMarkerController::shiftMarkers(Node* node, unsigned startOffset, in
     bool docDirty = false;
     for (size_t i = 0; i != markers.size(); ++i) {
         DocumentMarker& marker = markers[i];
-        if (marker.startOffset >= startOffset && (markerType == DocumentMarker::AllMarkers || marker.type == markerType)) {
+        if (marker.startOffset >= startOffset) {
             ASSERT((int)marker.startOffset + delta >= 0);
             marker.startOffset += delta;
             marker.endOffset += delta;
@@ -538,7 +567,7 @@ void DocumentMarkerController::shiftMarkers(Node* node, unsigned startOffset, in
 
 void DocumentMarkerController::setMarkersActive(Range* range, bool active)
 {
-    if (!possiblyHasMarkers(DocumentMarker::AllMarkers))
+    if (!possiblyHasMarkers(DocumentMarker::AllMarkers()))
         return;
     ASSERT(!m_markers.isEmpty());
 
@@ -600,22 +629,13 @@ bool DocumentMarkerController::hasMarkers(Range* range, DocumentMarker::MarkerTy
         Vector<DocumentMarker> markers = markersForNode(node);
         Vector<DocumentMarker>::const_iterator end = markers.end();
         for (Vector<DocumentMarker>::const_iterator it = markers.begin(); it != end; ++it) {
-            if (!(markerTypes & it->type))
+            if (!markerTypes.contains(it->type))
                 continue;
-            if (node == startContainer && node == endContainer) {
-                // The range spans only one node.
-                if (it->endOffset > static_cast<unsigned>(range->startOffset()) && it->startOffset < static_cast<unsigned>(range->endOffset()))
-                    return true;
-            } else {
-                if (node == startContainer) {
-                    if (it->endOffset > static_cast<unsigned>(range->startOffset()))
-                        return true;
-                } else if (node == endContainer) {
-                    if (it->startOffset < static_cast<unsigned>(range->endOffset()))
-                        return true;
-                } else
-                    return true;
-            }
+            if (node == startContainer && it->endOffset <= static_cast<unsigned>(range->startOffset()))
+                continue;
+            if (node == endContainer && it->startOffset >= static_cast<unsigned>(range->endOffset()))
+                continue;
+            return true;
         }
     }
     return false;
@@ -647,7 +667,7 @@ void DocumentMarkerController::clearDescriptionOnMarkersIntersectingRange(Range*
                 break;
 
             // skip marker that is wrong type or before target
-            if (marker.endOffset <= startOffset || !(marker.type & markerTypes)) {
+            if (marker.endOffset <= startOffset || !markerTypes.contains(marker.type)) {
                 i++;
                 continue;
             }
diff --git a/Source/WebCore/dom/DocumentMarkerController.h b/Source/WebCore/dom/DocumentMarkerController.h
index 6fa060a..0f34c9f 100644
--- a/Source/WebCore/dom/DocumentMarkerController.h
+++ b/Source/WebCore/dom/DocumentMarkerController.h
@@ -47,28 +47,29 @@ public:
     void detach();
     void addMarker(Range*, DocumentMarker::MarkerType, String description = String());
     void addMarker(Node*, DocumentMarker);
-    void copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    bool hasMarkers(Range*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers);
+    void copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta);
+    bool hasMarkers(Range*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers());
 
     // When a marker partially overlaps with range, if removePartiallyOverlappingMarkers is true, we completely
     // remove the marker. If the argument is false, we will adjust the span of the marker so that it retains
     // the portion that is outside of the range.
     enum RemovePartiallyOverlappingMarkerOrNot { DoNotRemovePartiallyOverlappingMarker, RemovePartiallyOverlappingMarker };
-    void removeMarkers(Range*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers, RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
-    void removeMarkers(Node*, unsigned startOffset, int length, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers,  RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
+    void removeMarkers(Range*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers(), RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
+    void removeMarkers(Node*, unsigned startOffset, int length, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers(),  RemovePartiallyOverlappingMarkerOrNot = DoNotRemovePartiallyOverlappingMarker);
 
-    void removeMarkers(DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers);
-    void removeMarkers(Node*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers);
-    void repaintMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+    void removeMarkers(DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers());
+    void removeMarkers(Node*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers());
+    void repaintMarkers(DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers());
     void setRenderedRectForMarker(Node*, const DocumentMarker&, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
-    void shiftMarkers(Node*, unsigned startOffset, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+    void shiftMarkers(Node*, unsigned startOffset, int delta);
     void setMarkersActive(Range*, bool);
     void setMarkersActive(Node*, unsigned startOffset, unsigned endOffset, bool);
 
-    DocumentMarker* markerContainingPoint(const IntPoint&, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+    DocumentMarker* markerContainingPoint(const IntPoint&, DocumentMarker::MarkerType);
     Vector<DocumentMarker> markersForNode(Node*);
-    Vector<IntRect> renderedRectsForMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+    Vector<DocumentMarker> markersInRange(Range*, DocumentMarker::MarkerType);
+    Vector<IntRect> renderedRectsForMarkers(DocumentMarker::MarkerType);
     void clearDescriptionOnMarkersIntersectingRange(Range*, DocumentMarker::MarkerTypes);
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/dom/DocumentOrderedMap.cpp b/Source/WebCore/dom/DocumentOrderedMap.cpp
index 787fcf4..47268c4 100644
--- a/Source/WebCore/dom/DocumentOrderedMap.cpp
+++ b/Source/WebCore/dom/DocumentOrderedMap.cpp
@@ -34,6 +34,7 @@
 #include "Element.h"
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
+#include "TreeScope.h"
 
 namespace WebCore {
 
@@ -104,7 +105,7 @@ void DocumentOrderedMap::remove(AtomicStringImpl* key, Element* element)
 }
 
 template<bool keyMatches(AtomicStringImpl*, Element*)>
-inline Element* DocumentOrderedMap::get(AtomicStringImpl* key, const Document* document) const
+inline Element* DocumentOrderedMap::get(AtomicStringImpl* key, const TreeScope* scope) const
 {
     ASSERT(key);
 
@@ -116,7 +117,7 @@ inline Element* DocumentOrderedMap::get(AtomicStringImpl* key, const Document* d
 
     if (m_duplicateCounts.contains(key)) {
         // We know there's at least one node that matches; iterate to find the first one.
-        for (Node* node = document->firstChild(); node; node = node->traverseNextNode()) {
+        for (Node* node = scope->firstChild(); node; node = node->traverseNextNode()) {
             if (!node->isElementNode())
                 continue;
             element = static_cast<Element*>(node);
@@ -132,19 +133,19 @@ inline Element* DocumentOrderedMap::get(AtomicStringImpl* key, const Document* d
     return 0;
 }
 
-Element* DocumentOrderedMap::getElementById(AtomicStringImpl* key, const Document* document) const
+Element* DocumentOrderedMap::getElementById(AtomicStringImpl* key, const TreeScope* scope) const
 {
-    return get<keyMatchesId>(key, document);
+    return get<keyMatchesId>(key, scope);
 }
 
-Element* DocumentOrderedMap::getElementByMapName(AtomicStringImpl* key, const Document* document) const
+Element* DocumentOrderedMap::getElementByMapName(AtomicStringImpl* key, const TreeScope* scope) const
 {
-    return get<keyMatchesMapName>(key, document);
+    return get<keyMatchesMapName>(key, scope);
 }
 
-Element* DocumentOrderedMap::getElementByLowercasedMapName(AtomicStringImpl* key, const Document* document) const
+Element* DocumentOrderedMap::getElementByLowercasedMapName(AtomicStringImpl* key, const TreeScope* scope) const
 {
-    return get<keyMatchesLowercasedMapName>(key, document);
+    return get<keyMatchesLowercasedMapName>(key, scope);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DocumentOrderedMap.h b/Source/WebCore/dom/DocumentOrderedMap.h
index 58767c6..7d12686 100644
--- a/Source/WebCore/dom/DocumentOrderedMap.h
+++ b/Source/WebCore/dom/DocumentOrderedMap.h
@@ -37,8 +37,8 @@
 
 namespace WebCore {
 
-class Document;
 class Element;
+class TreeScope;
 
 class DocumentOrderedMap {
 public:
@@ -49,14 +49,14 @@ public:
     bool contains(AtomicStringImpl*) const;
     bool containsMultiple(AtomicStringImpl*) const;
     // concrete instantiations of the get<>() method template
-    Element* getElementById(AtomicStringImpl*, const Document*) const;
-    Element* getElementByMapName(AtomicStringImpl*, const Document*) const;
-    Element* getElementByLowercasedMapName(AtomicStringImpl*, const Document*) const;
+    Element* getElementById(AtomicStringImpl*, const TreeScope*) const;
+    Element* getElementByMapName(AtomicStringImpl*, const TreeScope*) const;
+    Element* getElementByLowercasedMapName(AtomicStringImpl*, const TreeScope*) const;
 
     void checkConsistency() const;
 
 private:
-    template<bool keyMatches(AtomicStringImpl*, Element*)> Element* get(AtomicStringImpl*, const Document*) const;
+    template<bool keyMatches(AtomicStringImpl*, Element*)> Element* get(AtomicStringImpl*, const TreeScope*) const;
 
     typedef HashMap<AtomicStringImpl*, Element*> Map;
 
diff --git a/Source/WebCore/dom/DynamicNodeList.cpp b/Source/WebCore/dom/DynamicNodeList.cpp
index 3538b60..23664e8 100644
--- a/Source/WebCore/dom/DynamicNodeList.cpp
+++ b/Source/WebCore/dom/DynamicNodeList.cpp
@@ -145,6 +145,11 @@ Node* DynamicNodeList::itemWithName(const AtomicString& elementId) const
     return 0;
 }
 
+bool DynamicNodeList::isDynamicNodeList() const
+{
+    return true;
+}
+
 void DynamicNodeList::invalidateCache()
 {
     // This should only be called for node lists that own their own caches.
diff --git a/Source/WebCore/dom/DynamicNodeList.h b/Source/WebCore/dom/DynamicNodeList.h
index db133b7..9c8f3cc 100644
--- a/Source/WebCore/dom/DynamicNodeList.h
+++ b/Source/WebCore/dom/DynamicNodeList.h
@@ -60,6 +60,7 @@ namespace WebCore {
 
         // Other methods (not part of DOM)
         void invalidateCache();
+        Node* rootNode() const { return m_rootNode.get(); }
 
     protected:
         DynamicNodeList(PassRefPtr<Node> rootNode);
@@ -72,6 +73,7 @@ namespace WebCore {
         bool m_ownsCaches;
 
     private:
+        virtual bool isDynamicNodeList() const;
         Node* itemForwardsFromCurrent(Node* start, unsigned offset, int remainingOffset) const;
         Node* itemBackwardsFromCurrent(Node* start, unsigned offset, int remainingOffset) const;
     };
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 81668cf..50431aa 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -54,6 +54,7 @@
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "Settings.h"
+#include "ShadowRoot.h"
 #include "TextIterator.h"
 #include "WebKitAnimationList.h"
 #include "XMLNames.h"
@@ -543,11 +544,19 @@ PassRefPtr<ClientRectList> Element::getClientRects() const
     Vector<FloatQuad> quads;
     renderBoxModelObject->absoluteQuads(quads);
 
+    float pageScale = 1;
+    if (Page* page = document()->page()) {
+        if (Frame* frame = page->mainFrame())
+            pageScale = frame->pageScaleFactor();
+    }
+
     if (FrameView* view = document()->view()) {
         IntRect visibleContentRect = view->visibleContentRect();
         for (size_t i = 0; i < quads.size(); ++i) {
             quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
             adjustFloatQuadForAbsoluteZoom(quads[i], renderBoxModelObject);
+            if (pageScale != 1)
+                adjustFloatQuadForPageScale(quads[i], pageScale);
         }
     }
 
@@ -587,6 +596,11 @@ PassRefPtr<ClientRect> Element::getBoundingClientRect() const
     }
 
     adjustFloatRectForAbsoluteZoom(result, renderer());
+    if (Page* page = document()->page()) {
+        if (Frame* frame = page->mainFrame())
+            adjustFloatRectForPageScale(result, frame->pageScaleFactor());
+    }
+
     return ClientRect::create(result);
 }
     
@@ -643,22 +657,20 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
 #endif
 
     const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-
+    QualifiedName attributeName(nullAtom, localName, nullAtom);
+    
     // Allocate attribute map if necessary.
     Attribute* old = attributes(false)->getAttributeItem(localName, false);
 
     document()->incDOMTreeVersion();
 
-    // FIXME: This check is probably not correct for the case where the document has an id attribute
-    // with a non-null namespace, because it will return true if the local name happens to match
-    // but the namespace does not.
-    if (localName == document()->idAttributeName().localName())
+    if (isIdAttributeName(old ? old->name() : attributeName))
         updateId(old ? old->value() : nullAtom, value);
 
     if (old && value.isNull())
         m_attributeMap->removeAttribute(old->name());
     else if (!old && !value.isNull())
-        m_attributeMap->addAttribute(createAttribute(QualifiedName(nullAtom, localName, nullAtom), value));
+        m_attributeMap->addAttribute(createAttribute(attributeName, value));
     else if (old && !value.isNull()) {
         if (Attr* attrNode = old->attr())
             attrNode->setValue(value);
@@ -713,6 +725,8 @@ PassRefPtr<Attribute> Element::createAttribute(const QualifiedName& name, const
 
 void Element::attributeChanged(Attribute* attr, bool)
 {
+    if (isIdAttributeName(attr->name()))
+        idAttributeChanged(attr);
     recalcStyleIfNeededAfterAttributeChanged(attr);
     updateAfterAttributeChanged(attr);
 }
@@ -751,6 +765,20 @@ void Element::recalcStyleIfNeededAfterAttributeChanged(Attribute* attr)
         setNeedsStyleRecalc();
 }
 
+void Element::idAttributeChanged(Attribute* attr)
+{
+    setHasID(!attr->isNull());
+    if (attributeMap()) {
+        if (attr->isNull())
+            attributeMap()->setIdForStyleResolution(nullAtom);
+        else if (document()->inQuirksMode())
+            attributeMap()->setIdForStyleResolution(attr->value().lower());
+        else
+            attributeMap()->setIdForStyleResolution(attr->value());
+    }
+    setNeedsStyleRecalc();
+}
+    
 // Returns true is the given attribute is an event handler.
 // We consider an event handler any attribute that begins with "on".
 // It is a simple solution that has the advantage of not requiring any
@@ -957,13 +985,16 @@ void Element::attach()
     createRendererIfNeeded();
     
     StyleSelectorParentPusher parentPusher(this);
-    if (firstChild())
-        parentPusher.push();
-    ContainerNode::attach();
+
     if (Node* shadow = shadowRoot()) {
         parentPusher.push();
         shadow->attach();
     }
+
+    if (firstChild())
+        parentPusher.push();
+    ContainerNode::attach();
+
     if (hasRareData()) {   
         ElementRareData* data = rareData();
         if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
@@ -1047,7 +1078,7 @@ void Element::recalcStyle(StyleChange change)
 {
     // Ref currentStyle in case it would otherwise be deleted when setRenderStyle() is called.
     RefPtr<RenderStyle> currentStyle(renderStyle());
-    bool hasParentStyle = parentOrHostNode() ? parentOrHostNode()->renderStyle() : false;
+    bool hasParentStyle = parentNodeForRenderingAndStyle() ? parentNodeForRenderingAndStyle()->renderStyle() : false;
     bool hasDirectAdjacentRules = currentStyle && currentStyle->childrenAffectedByDirectAdjacentRules();
 
     if ((change > NoChange || needsStyleRecalc())) {
@@ -1134,7 +1165,7 @@ void Element::recalcStyle(StyleChange change)
     }
     // FIXME: This does not care about sibling combinators. Will be necessary in XBL2 world.
     if (Node* shadow = shadowRoot()) {
-        if (change >= Inherit || shadow->isTextNode() || shadow->childNeedsStyleRecalc() || shadow->needsStyleRecalc()) {
+        if (change >= Inherit || shadow->childNeedsStyleRecalc() || shadow->needsStyleRecalc()) {
             parentPusher.push();
             shadow->recalcStyle(change);
         }
@@ -1144,28 +1175,24 @@ void Element::recalcStyle(StyleChange change)
     clearChildNeedsStyleRecalc();
 }
 
-Node* Element::shadowRoot()
+ContainerNode* Element::shadowRoot() const
 {
     return hasRareData() ? rareData()->m_shadowRoot : 0;
 }
 
-void Element::setShadowRoot(PassRefPtr<Node> node)
+ContainerNode* Element::ensureShadowRoot()
 {
-    // FIXME: Because today this is never called from script directly, we don't have to worry
-    // about compromising DOM tree integrity (eg. node being a parent of this). However,
-    // once we implement XBL2, we will have to add integrity checks here.
-    removeShadowRoot();
-
-    RefPtr<Node> newRoot = node;
-    if (!newRoot)
-        return;
+    if (ContainerNode* existingRoot = shadowRoot())
+        return existingRoot;
 
+    RefPtr<ShadowRoot> newRoot = ShadowRoot::create(document());
     ensureRareData()->m_shadowRoot = newRoot.get();
     newRoot->setShadowHost(this);
     if (inDocument())
         newRoot->insertedIntoDocument();
-    if (attached() && !newRoot->attached())
+    if (attached())
         newRoot->lazyAttach();
+    return newRoot.get();
 }
 
 void Element::removeShadowRoot()
@@ -1185,7 +1212,7 @@ void Element::removeShadowRoot()
     }
 }
 
-bool Element::childTypeAllowed(NodeType type)
+bool Element::childTypeAllowed(NodeType type) const
 {
     switch (type) {
     case ELEMENT_NODE:
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index ba0870c..d269dbe 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -64,8 +64,6 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
-    DEFINE_ATTRIBUTE_EVENT_LISTENER(formchange);
-    DEFINE_ATTRIBUTE_EVENT_LISTENER(forminput);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
@@ -231,8 +229,10 @@ public:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void recalcStyle(StyleChange = NoChange);
 
-    Node* shadowRoot();
-    void setShadowRoot(PassRefPtr<Node>);
+    ContainerNode* shadowRoot() const;
+    ContainerNode* ensureShadowRoot();
+    void removeShadowRoot();
+
     virtual const AtomicString& shadowPseudoId() const;
 
     RenderStyle* computedStyle(PseudoId = NOPSEUDO);
@@ -303,6 +303,10 @@ public:
     static bool isMathMLElement() { return false; }
 #endif
 
+#if ENABLE(INPUT_SPEECH)
+    virtual bool isInputFieldSpeechButtonElement() const { return false; }
+#endif
+
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
@@ -364,13 +368,15 @@ protected:
     // They are separated to allow a different flow of control in StyledElement::attributeChanged().
     void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
     void updateAfterAttributeChanged(Attribute*);
+    
+    void idAttributeChanged(Attribute*);
 
 private:
     void scrollByUnits(int units, ScrollGranularity);
 
     virtual void setPrefix(const AtomicString&, ExceptionCode&);
     virtual NodeType nodeType() const;
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
 
     virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
     
@@ -407,7 +413,6 @@ private:
     ElementRareData* ensureRareData();
 
     SpellcheckAttributeState spellcheckAttributeState() const;
-    void removeShadowRoot();
 
 private:
     mutable RefPtr<NamedNodeMap> m_attributeMap;
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index fc28642..0e91811 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -155,8 +155,6 @@ module core {
         attribute [DontEnum] EventListener ondrop;
         attribute [DontEnum] EventListener onerror;
         attribute [DontEnum] EventListener onfocus;
-        attribute [DontEnum] EventListener onformchange;
-        attribute [DontEnum] EventListener onforminput;
         attribute [DontEnum] EventListener oninput;
         attribute [DontEnum] EventListener oninvalid;
         attribute [DontEnum] EventListener onkeydown;
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index 818a2c2..14ceef2 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -30,6 +30,8 @@
 
 namespace WebCore {
 
+class ShadowRoot;
+
 class ElementRareData : public NodeRareData {
 public:
     ElementRareData();
@@ -42,7 +44,7 @@ public:
 
     IntSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
-    Node* m_shadowRoot;
+    ShadowRoot* m_shadowRoot;
 
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
     OwnPtr<ClassList> m_classList;
diff --git a/Source/WebCore/dom/Event.cpp b/Source/WebCore/dom/Event.cpp
index a1352dc..9cb2778 100644
--- a/Source/WebCore/dom/Event.cpp
+++ b/Source/WebCore/dom/Event.cpp
@@ -229,6 +229,11 @@ bool Event::isAudioProcessingEvent() const
 {
     return false;
 }
+
+bool Event::isOfflineAudioCompletionEvent() const
+{
+    return false;
+}
 #endif
 
 #if ENABLE(INPUT_SPEECH)
@@ -259,7 +264,7 @@ bool Event::fromUserGesture()
         // other accepted events
         || type == eventNames().selectEvent || type == eventNames().changeEvent
         || type == eventNames().focusEvent || type == eventNames().blurEvent
-        || type == eventNames().submitEvent || type == eventNames().formchangeEvent;
+        || type == eventNames().submitEvent;
 }
 
 bool Event::storesResultAsString() const
@@ -271,11 +276,6 @@ void Event::storeResult(const String&)
 {
 }
 
-bool Event::dispatch(EventDispatcher* dispatcher)
-{
-    return dispatcher->dispatchEvent(this);
-}
-
 void Event::setTarget(PassRefPtr<EventTarget> target)
 {
     if (m_target == target)
@@ -299,4 +299,18 @@ void Event::setUnderlyingEvent(PassRefPtr<Event> ue)
     m_underlyingEvent = ue;
 }
 
+EventDispatchMediator::EventDispatchMediator(PassRefPtr<Event> event)
+    : m_event(event)
+{
+}
+
+EventDispatchMediator::~EventDispatchMediator()
+{
+}
+
+bool EventDispatchMediator::dispatchEvent(EventDispatcher* dispatcher) const
+{
+    return dispatcher->dispatchEvent(m_event.get());
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Event.h b/Source/WebCore/dom/Event.h
index d4d7e06..f6e5586 100644
--- a/Source/WebCore/dom/Event.h
+++ b/Source/WebCore/dom/Event.h
@@ -131,6 +131,7 @@ namespace WebCore {
 #endif
 #if ENABLE(WEB_AUDIO)
         virtual bool isAudioProcessingEvent() const;
+        virtual bool isOfflineAudioCompletionEvent() const;
 #endif
         virtual bool isErrorEvent() const;
 #if ENABLE(TOUCH_EVENTS)
@@ -166,7 +167,6 @@ namespace WebCore {
 
         virtual Clipboard* clipboard() const { return 0; }
 
-        virtual bool dispatch(EventDispatcher*);
 
     protected:
         Event();
@@ -194,6 +194,37 @@ namespace WebCore {
         RefPtr<Event> m_underlyingEvent;
     };
 
+class EventDispatchMediator {
+public:
+    explicit EventDispatchMediator(PassRefPtr<Event>);
+    virtual ~EventDispatchMediator();
+
+    virtual bool dispatchEvent(EventDispatcher*) const;
+
+protected:
+    EventDispatchMediator();
+
+    Event* event() const;
+    void setEvent(PassRefPtr<Event>);
+
+private:
+    RefPtr<Event> m_event;
+};
+
+inline EventDispatchMediator::EventDispatchMediator()
+{
+}
+
+inline Event* EventDispatchMediator::event() const
+{
+    return m_event.get();
+}
+
+inline void EventDispatchMediator::setEvent(PassRefPtr<Event> event)
+{
+    m_event = event;
+}
+
 } // namespace WebCore
 
 #endif // Event_h
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index c8b330d..ca2ed30 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -33,7 +33,6 @@
 #include "InspectorInstrumentation.h"
 #include "MouseEvent.h"
 #include "Node.h"
-#include "PlatformWheelEvent.h"
 #include "ScopedEventQueue.h"
 
 #if ENABLE(SVG)
@@ -44,7 +43,6 @@
 
 #include "UIEvent.h"
 #include "UIEventWithKeyState.h"
-#include "WheelEvent.h"
 #include "WindowEventContext.h"
 
 #include <wtf/RefPtr.h>
@@ -53,12 +51,12 @@ namespace WebCore {
 
 static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
 
-bool EventDispatcher::dispatchEvent(Node* node, PassRefPtr<Event> prpEvent)
+bool EventDispatcher::dispatchEvent(Node* node, const EventDispatchMediator& mediator)
 {
-    RefPtr<Event> event = prpEvent;
+    ASSERT(!eventDispatchForbidden());
 
     EventDispatcher dispatcher(node);
-    return event->dispatch(&dispatcher);
+    return mediator.dispatchEvent(&dispatcher);
 }
 
 static EventTarget* findElementInstance(Node* referenceNode)
@@ -67,10 +65,10 @@ static EventTarget* findElementInstance(Node* referenceNode)
     // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
     // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
     for (Node* n = referenceNode; n; n = n->parentNode()) {
-        if (!n->isShadowRoot() || !n->isSVGElement())
+        if (!n->isSVGShadowRoot() || !n->isSVGElement())
             continue;
 
-        Element* shadowTreeParentElement = n->shadowHost();
+        Element* shadowTreeParentElement = n->svgShadowHost();
         ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
 
         if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
@@ -124,80 +122,138 @@ void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> under
     gNodesDispatchingSimulatedClicks->remove(node);
 }
 
-inline static WheelEvent::Granularity granularity(const PlatformWheelEvent& event)
+static inline bool isShadowRootOrSVGShadowRoot(const Node* node)
 {
-    return event.granularity() == ScrollByPageWheelEvent ? WheelEvent::Page : WheelEvent::Pixel;
+    return node->isShadowRoot() || node->isSVGShadowRoot();
 }
 
-void EventDispatcher::dispatchWheelEvent(Node* node, PlatformWheelEvent& event)
+PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Node> relatedTarget, const Vector<Node*> relatedTargetAncestors)
 {
-    ASSERT(!eventDispatchForbidden());
-    if (!(event.deltaX() || event.deltaY()))
-        return;
+    Vector<EventContext>::const_iterator lowestCommonBoundary = m_ancestors.end();
+    // Assume divergent boundary is the relatedTarget itself (in other words, related target ancestor chain does not cross any shadow DOM boundaries).
+    Vector<Node*>::const_iterator firstDivergentBoundary = relatedTargetAncestors.begin();
+
+    Vector<EventContext>::const_iterator targetAncestor = m_ancestors.end();
+    // Walk down from the top, looking for lowest common ancestor, also monitoring shadow DOM boundaries.
+    bool diverged = false;
+    for (Vector<Node*>::const_iterator i = relatedTargetAncestors.end() - 1; i >= relatedTargetAncestors.begin(); --i) {
+        if (diverged) {
+            if (isShadowRootOrSVGShadowRoot(*i)) {
+                firstDivergentBoundary = i + 1;
+                break;
+            }
+            continue;
+        }
 
-    EventDispatcher dispatcher(node);
+        if (targetAncestor == m_ancestors.begin()) {
+            diverged = true;
+            continue;
+        }
 
-    if (!dispatcher.m_view)
-        return;
+        targetAncestor--;
 
-    IntPoint position = dispatcher.m_view->windowToContents(event.pos());
+        if (isShadowRootOrSVGShadowRoot(*i))
+            lowestCommonBoundary = targetAncestor;
 
-    int adjustedPageX = position.x();
-    int adjustedPageY = position.y();
-    if (Frame* frame = node->document()->frame()) {
-        float pageZoom = frame->pageZoomFactor();
-        if (pageZoom != 1.0f) {
-            adjustedPageX = lroundf(position.x() / pageZoom);
-            adjustedPageY = lroundf(position.y() / pageZoom);
-        }
+        if ((*i) != (*targetAncestor).node())
+            diverged = true;
     }
 
-    RefPtr<WheelEvent> wheelEvent = WheelEvent::create(event.wheelTicksX(), event.wheelTicksY(), event.deltaX(), event.deltaY(), granularity(event),
-        node->document()->defaultView(), event.globalX(), event.globalY(), adjustedPageX, adjustedPageY,
-        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey());
-
-    wheelEvent->setAbsoluteLocation(position);
+    if (!diverged) {
+        // The relatedTarget is a parent or shadowHost of the target.
+        if (isShadowRootOrSVGShadowRoot(m_node.get()))
+            lowestCommonBoundary = m_ancestors.begin();
+    } else if ((*firstDivergentBoundary) == m_node.get()) {
+        // Since ancestors does not contain target itself, we must account
+        // for the possibility that target is a shadowHost of relatedTarget
+        // and thus serves as the lowestCommonBoundary.
+        // Luckily, in this case the firstDivergentBoundary is target.
+        lowestCommonBoundary = m_ancestors.begin();
+    }
 
-    if (!dispatcher.dispatchEvent(wheelEvent) || wheelEvent->defaultHandled())
-        event.accept();
+    // Trim ancestors to lowestCommonBoundary to keep events inside of the common shadow DOM subtree.
+    if (lowestCommonBoundary != m_ancestors.end())
+        m_ancestors.shrink(lowestCommonBoundary - m_ancestors.begin());
+    // Set event's related target to the first encountered shadow DOM boundary in the divergent subtree.
+    return firstDivergentBoundary != relatedTargetAncestors.begin() ? *firstDivergentBoundary : relatedTarget;
+}
 
+inline static bool ancestorsCrossShadowBoundaries(const Vector<EventContext>& ancestors)
+{
+    return ancestors.isEmpty() || ancestors.first().node() == ancestors.last().node();
 }
 
 // FIXME: Once https://bugs.webkit.org/show_bug.cgi?id=52963 lands, this should
 // be greatly improved. See https://bugs.webkit.org/show_bug.cgi?id=54025.
-static Node* pullOutOfShadow(Node* node)
+PassRefPtr<EventTarget> EventDispatcher::adjustRelatedTarget(Event* event, PassRefPtr<EventTarget> prpRelatedTarget)
 {
-    Node* outermostShadowBoundary = node;
-    for (Node* n = node; n; n = n->parentOrHostNode()) {
-        if (n->isShadowRoot())
+    if (!prpRelatedTarget)
+        return 0;
+
+    RefPtr<Node> relatedTarget = prpRelatedTarget->toNode();
+    if (!relatedTarget)
+        return 0;
+
+    Node* target = m_node.get();
+    if (!target)
+        return prpRelatedTarget;
+
+    ensureEventAncestors(event);
+
+    // Calculate early if the common boundary is even possible by looking at
+    // ancestors size and if the retargeting has occured (indicating the presence of shadow DOM boundaries).
+    // If there are no boundaries detected, the target and related target can't have a common boundary.
+    bool noCommonBoundary = ancestorsCrossShadowBoundaries(m_ancestors);
+
+    Vector<Node*> relatedTargetAncestors;
+    Node* outermostShadowBoundary = relatedTarget.get();
+    for (Node* n = outermostShadowBoundary; n; n = n->parentOrHostNode()) {
+        if (isShadowRootOrSVGShadowRoot(n))
             outermostShadowBoundary = n->parentOrHostNode();
+        if (!noCommonBoundary)
+            relatedTargetAncestors.append(n);
     }
-    return outermostShadowBoundary;
+
+    // Short-circuit the fast case when we know there is no need to calculate a common boundary.
+    if (noCommonBoundary)
+        return outermostShadowBoundary;
+
+    return adjustToShadowBoundaries(relatedTarget.release(), relatedTargetAncestors);
 }
 
 EventDispatcher::EventDispatcher(Node* node)
     : m_node(node)
+    , m_ancestorsInitialized(false)
 {
     ASSERT(node);
     m_view = node->document()->view();
 }
 
-void EventDispatcher::getEventAncestors(EventTarget* originalTarget, EventDispatchBehavior behavior)
+void EventDispatcher::ensureEventAncestors(Event* event)
 {
+    EventDispatchBehavior behavior = determineDispatchBehavior(event);
+
     if (!m_node->inDocument())
         return;
 
-    if (ancestorsInitialized())
+    if (m_ancestorsInitialized)
         return;
 
-    EventTarget* target = originalTarget;
+    m_ancestorsInitialized = true;
+
     Node* ancestor = m_node.get();
+    EventTarget* target = eventTargetRespectingSVGTargetRules(ancestor);
     bool shouldSkipNextAncestor = false;
     while (true) {
-        if (ancestor->isShadowRoot()) {
+        bool isSVGShadowRoot = ancestor->isSVGShadowRoot();
+        if (isSVGShadowRoot || ancestor->isShadowRoot()) {
             if (behavior == StayInsideShadowDOM)
                 return;
+#if ENABLE(SVG)
+            ancestor = isSVGShadowRoot ? ancestor->svgShadowHost() : ancestor->shadowHost();
+#else
             ancestor = ancestor->shadowHost();
+#endif
             if (!shouldSkipNextAncestor)
                 target = ancestor;
         } else
@@ -208,7 +264,7 @@ void EventDispatcher::getEventAncestors(EventTarget* originalTarget, EventDispat
 
 #if ENABLE(SVG)
         // Skip SVGShadowTreeRootElement.
-        shouldSkipNextAncestor = ancestor->isSVGElement() && ancestor->isShadowRoot();
+        shouldSkipNextAncestor = ancestor->isSVGShadowRoot();
         if (shouldSkipNextAncestor)
             continue;
 #endif
@@ -226,7 +282,7 @@ bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
 
     RefPtr<EventTarget> originalTarget = event->target();
-    getEventAncestors(originalTarget.get(), determineDispatchBehavior(event.get()));
+    ensureEventAncestors(event.get());
 
     WindowEventContext windowContext(event.get(), m_node.get(), topEventContext());
 
@@ -309,73 +365,12 @@ doneWithDefault:
 
     return !event->defaultPrevented();
 }
-bool EventDispatcher::dispatchMouseEvent(Node* node, const PlatformMouseEvent& event, const AtomicString& eventType,
-    int detail, Node* relatedTargetArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ASSERT(event.eventType() == MouseEventMoved || event.button() != NoButton);
-
-    if (node->disabled()) // Don't even send DOM events for disabled controls..
-        return true;
-
-    if (eventType.isEmpty())
-        return false; // Shouldn't happen.
-
-    EventDispatcher dispatcher(node);
-
-    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
-    RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg);
-
-    IntPoint contentsPosition;
-    if (FrameView* view = node->document()->view())
-        contentsPosition = view->windowToContents(event.pos());
-
-    IntPoint adjustedPagePosition = contentsPosition;
-    if (Frame* frame = node->document()->frame()) {
-        float pageZoom = frame->pageZoomFactor();
-        if (pageZoom != 1.0f) {
-            // Adjust our pageX and pageY to account for the page zoom.
-            adjustedPagePosition.setX(lroundf(contentsPosition.x() / pageZoom));
-            adjustedPagePosition.setY(lroundf(contentsPosition.y() / pageZoom));
-        }
-    }
-
-    RefPtr<MouseEvent> mouseEvent = MouseEvent::create(eventType, node->document()->defaultView(), event, adjustedPagePosition, detail, relatedTarget);
-    mouseEvent->setAbsoluteLocation(contentsPosition);
-
-    bool swallowEvent = false;
-
-    dispatcher.dispatchEvent(mouseEvent);
-    bool defaultHandled = mouseEvent->defaultHandled();
-    bool defaultPrevented = mouseEvent->defaultPrevented();
-    if (defaultHandled || defaultPrevented)
-        swallowEvent = true;
-
-    // Special case: If it's a double click event, we also send the dblclick event. This is not part
-    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute. This is treated
-    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
-    if (eventType == eventNames().clickEvent && detail == 2) {
-        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent, node->document()->defaultView(), event, adjustedPagePosition, detail, relatedTarget);
-        if (defaultHandled)
-            doubleClickEvent->setDefaultHandled();
-        dispatcher.dispatchEvent(doubleClickEvent);
-        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
-            swallowEvent = true;
-    }
-
-    return swallowEvent;
-}
 
 const EventContext* EventDispatcher::topEventContext()
 {
     return m_ancestors.isEmpty() ? 0 : &m_ancestors.last();
 }
 
-bool EventDispatcher::ancestorsInitialized() const
-{
-    return m_ancestors.size();
-}
-
 EventDispatchBehavior EventDispatcher::determineDispatchBehavior(Event* event)
 {
     // Per XBL 2.0 spec, mutation events should never cross shadow DOM boundary:
diff --git a/Source/WebCore/dom/EventDispatcher.h b/Source/WebCore/dom/EventDispatcher.h
index d43127f..88e9756 100644
--- a/Source/WebCore/dom/EventDispatcher.h
+++ b/Source/WebCore/dom/EventDispatcher.h
@@ -33,6 +33,7 @@ namespace WebCore {
 
 class Event;
 class EventContext;
+class EventDispatchMediator;
 class EventTarget;
 class FrameView;
 class Node;
@@ -47,32 +48,35 @@ enum EventDispatchBehavior {
 
 class EventDispatcher {
 public:
-    static bool dispatchEvent(Node*, PassRefPtr<Event>);
+    static bool dispatchEvent(Node*, const EventDispatchMediator&);
     static void dispatchScopedEvent(Node*, PassRefPtr<Event>);
 
-    static bool dispatchMouseEvent(Node*, const PlatformMouseEvent&, const AtomicString& eventType, int clickCount = 0, Node* relatedTarget = 0);
     static void dispatchSimulatedClick(Node*, PassRefPtr<Event> underlyingEvent, bool sendMouseEvents, bool showPressedLook);
-    static void dispatchWheelEvent(Node*, PlatformWheelEvent&);
 
     bool dispatchEvent(PassRefPtr<Event>);
+    PassRefPtr<EventTarget> adjustRelatedTarget(Event*, PassRefPtr<EventTarget>);
+    Node* node() const;
+
 private:
     EventDispatcher(Node*);
 
+    PassRefPtr<EventTarget> adjustToShadowBoundaries(PassRefPtr<Node> relatedTarget, const Vector<Node*> relatedTargetAncestors);
     EventDispatchBehavior determineDispatchBehavior(Event*);
-    void getEventAncestors(EventTarget* originalTarget, EventDispatchBehavior);
+    void ensureEventAncestors(Event*);
     const EventContext* topEventContext();
-    bool ancestorsInitialized() const;
-
-    bool dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
-        int pageX, int pageY, int screenX, int screenY, bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-        bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent);
 
     Vector<EventContext> m_ancestors;
     RefPtr<Node> m_node;
     RefPtr<EventTarget> m_originalTarget;
     RefPtr<FrameView> m_view;
+    bool m_ancestorsInitialized;
 };
 
+inline Node* EventDispatcher::node() const
+{
+    return m_node.get();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/dom/EventNames.h b/Source/WebCore/dom/EventNames.h
index 12afbc4..c445a7d 100644
--- a/Source/WebCore/dom/EventNames.h
+++ b/Source/WebCore/dom/EventNames.h
@@ -67,8 +67,6 @@ namespace WebCore {
     macro(focus) \
     macro(focusin) \
     macro(focusout) \
-    macro(formchange) \
-    macro(forminput) \
     macro(hashchange) \
     macro(input) \
     macro(invalid) \
diff --git a/Source/WebCore/dom/EventQueue.cpp b/Source/WebCore/dom/EventQueue.cpp
index 8e544c1..90f3e5d 100644
--- a/Source/WebCore/dom/EventQueue.cpp
+++ b/Source/WebCore/dom/EventQueue.cpp
@@ -28,12 +28,20 @@
 #include "EventQueue.h"
 
 #include "DOMWindow.h"
+#include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
+#include "RuntimeApplicationChecks.h"
 #include "ScriptExecutionContext.h"
 #include "SuspendableTimer.h"
 
 namespace WebCore {
+    
+static inline bool shouldDispatchScrollEventSynchronously(Document* document)
+{
+    ASSERT_ARG(document, document);
+    return applicationIsSafari() && (document->url().protocolIs("feed") || document->url().protocolIs("feeds"));
+}
 
 class EventQueueTimer : public SuspendableTimer {
     WTF_MAKE_NONCOPYABLE(EventQueueTimer);
@@ -71,14 +79,20 @@ void EventQueue::enqueueEvent(PassRefPtr<Event> event)
         m_pendingEventTimer->startOneShot(0);
 }
 
-void EventQueue::enqueueScrollEvent(PassRefPtr<Node> target, ScrollEventTargetType targetType)
+void EventQueue::enqueueOrDispatchScrollEvent(PassRefPtr<Node> target, ScrollEventTargetType targetType)
 {
-    if (!m_nodesWithQueuedScrollEvents.add(target.get()).second)
-        return;
-
     // Per the W3C CSSOM View Module, scroll events fired at the document should bubble, others should not.
     bool canBubble = targetType == ScrollEventDocumentTarget;
     RefPtr<Event> scrollEvent = Event::create(eventNames().scrollEvent, canBubble, false /* non cancelleable */);
+     
+    if (shouldDispatchScrollEventSynchronously(target->document())) {
+        target->dispatchEvent(scrollEvent.release());
+        return;
+    }
+
+    if (!m_nodesWithQueuedScrollEvents.add(target.get()).second)
+        return;
+
     scrollEvent->setTarget(target);
     enqueueEvent(scrollEvent.release());
 }
@@ -92,6 +106,12 @@ bool EventQueue::cancelEvent(Event* event)
     return found;
 }
 
+void EventQueue::cancelQueuedEvents()
+{
+    m_pendingEventTimer->stop();
+    m_queuedEvents.clear();
+}
+
 void EventQueue::pendingEventTimerFired()
 {
     ASSERT(!m_pendingEventTimer->isActive());
diff --git a/Source/WebCore/dom/EventQueue.h b/Source/WebCore/dom/EventQueue.h
index 94b6eaf..2cb38f4 100644
--- a/Source/WebCore/dom/EventQueue.h
+++ b/Source/WebCore/dom/EventQueue.h
@@ -51,8 +51,9 @@ public:
     ~EventQueue();
 
     void enqueueEvent(PassRefPtr<Event>);
-    void enqueueScrollEvent(PassRefPtr<Node>, ScrollEventTargetType);
+    void enqueueOrDispatchScrollEvent(PassRefPtr<Node>, ScrollEventTargetType);
     bool cancelEvent(Event*);
+    void cancelQueuedEvents();
 
 private:
     explicit EventQueue(ScriptExecutionContext*);
diff --git a/Source/WebCore/dom/EventTarget.cpp b/Source/WebCore/dom/EventTarget.cpp
index 7bd5cd6..d84d66b 100644
--- a/Source/WebCore/dom/EventTarget.cpp
+++ b/Source/WebCore/dom/EventTarget.cpp
@@ -119,6 +119,11 @@ SVGElementInstance* EventTarget::toSVGElementInstance()
 #endif
 
 #if ENABLE(WEB_AUDIO)
+AudioContext* EventTarget::toAudioContext()
+{
+    return 0;
+}
+
 JavaScriptAudioNode* EventTarget::toJavaScriptAudioNode()
 {
     return 0;
diff --git a/Source/WebCore/dom/EventTarget.h b/Source/WebCore/dom/EventTarget.h
index 31644b7..3544ce6 100644
--- a/Source/WebCore/dom/EventTarget.h
+++ b/Source/WebCore/dom/EventTarget.h
@@ -40,6 +40,7 @@
 
 namespace WebCore {
 
+    class AudioContext;
     class AbstractWorker;
     class DedicatedWorkerContext;
     class DOMApplicationCache;
@@ -122,6 +123,7 @@ namespace WebCore {
 #endif
 
 #if ENABLE(WEB_AUDIO)
+        virtual AudioContext* toAudioContext();
         virtual JavaScriptAudioNode* toJavaScriptAudioNode();
 #endif
 
diff --git a/Source/WebCore/dom/InputElement.cpp b/Source/WebCore/dom/InputElement.cpp
index b467df3..bbdf2f4 100644
--- a/Source/WebCore/dom/InputElement.cpp
+++ b/Source/WebCore/dom/InputElement.cpp
@@ -131,7 +131,7 @@ void InputElement::setValueFromRenderer(InputElementData& data, InputElement* in
 
     // Input event is fired by the Node::defaultEventHandler for editable controls.
     if (!inputElement->isTextField())
-        element->dispatchInputEvents();
+        element->dispatchInputEvent();
     notifyFormStateChanged(element);
 }
 
diff --git a/Source/WebCore/dom/KeyboardEvent.cpp b/Source/WebCore/dom/KeyboardEvent.cpp
index 109135d..e244fd2 100644
--- a/Source/WebCore/dom/KeyboardEvent.cpp
+++ b/Source/WebCore/dom/KeyboardEvent.cpp
@@ -161,10 +161,15 @@ KeyboardEvent* findKeyboardEvent(Event* event)
     return 0;
 }
 
-bool KeyboardEvent::dispatch(EventDispatcher* dispatcher)
+KeyboardEventDispatchMediator::KeyboardEventDispatchMediator(PassRefPtr<KeyboardEvent> event)
+    : EventDispatchMediator(event)
+{
+}
+
+bool KeyboardEventDispatchMediator::dispatchEvent(EventDispatcher* dispatcher) const
 {
     // Make sure not to return true if we already took default action while handling the event.
-    return dispatcher->dispatchEvent(this) && !defaultHandled();
+    return EventDispatchMediator::dispatchEvent(dispatcher) && !event()->defaultHandled();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/KeyboardEvent.h b/Source/WebCore/dom/KeyboardEvent.h
index ebdb9c8..68910b5 100644
--- a/Source/WebCore/dom/KeyboardEvent.h
+++ b/Source/WebCore/dom/KeyboardEvent.h
@@ -36,10 +36,10 @@ namespace WebCore {
 #if PLATFORM(MAC)
     struct KeypressCommand {
         KeypressCommand() { }
-        KeypressCommand(const String& commandName) : commandName(commandName) { }
-        KeypressCommand(const String& commandName, const String& text) : commandName(commandName), text(text) { }
+        KeypressCommand(const String& commandName) : commandName(commandName) { ASSERT(isASCIILower(commandName[0U])); }
+        KeypressCommand(const String& commandName, const String& text) : commandName(commandName), text(text) { ASSERT(commandName == "insertText:"); }
 
-        String commandName;
+        String commandName; // Actually, a selector name - it may have a trailing colon, and a name that can be different from an editor command name.
         String text;
     };
 #endif
@@ -101,20 +101,28 @@ namespace WebCore {
         KeyboardEvent(const AtomicString& type, bool canBubble, bool cancelable, AbstractView*,
                       const String& keyIdentifier, unsigned keyLocation,
                       bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, bool altGraphKey);
-        virtual bool dispatch(EventDispatcher*);
 
         OwnPtr<PlatformKeyboardEvent> m_keyEvent;
         String m_keyIdentifier;
         unsigned m_keyLocation;
         bool m_altGraphKey : 1;
 
-#if PLATFORM(MAC)        
+#if PLATFORM(MAC)
+        // Commands that were sent by AppKit when interpreting the event. Doesn't include input method commands.
         Vector<KeypressCommand> m_keypressCommands;
 #endif
     };
 
     KeyboardEvent* findKeyboardEvent(Event*);
 
+class KeyboardEventDispatchMediator : public EventDispatchMediator {
+public:
+    explicit KeyboardEventDispatchMediator(PassRefPtr<KeyboardEvent>);
+
+private:
+    virtual bool dispatchEvent(EventDispatcher*) const;
+};
+
 } // namespace WebCore
 
 #endif // KeyboardEvent_h
diff --git a/Source/WebCore/dom/MessagePort.cpp b/Source/WebCore/dom/MessagePort.cpp
index 1b7aea7..5edc36c 100644
--- a/Source/WebCore/dom/MessagePort.cpp
+++ b/Source/WebCore/dom/MessagePort.cpp
@@ -34,6 +34,7 @@
 #include "MessageEvent.h"
 #include "SecurityOrigin.h"
 #include "Timer.h"
+#include "WorkerContext.h"
 #include <wtf/text/AtomicString.h>
 
 namespace WebCore {
@@ -171,6 +172,13 @@ void MessagePort::dispatchMessages()
 
     OwnPtr<MessagePortChannel::EventData> eventData;
     while (m_entangledChannel && m_entangledChannel->tryGetMessageFromRemote(eventData)) {
+
+#if ENABLE(WORKERS)
+        // close() in Worker onmessage handler should prevent next message from dispatching.
+        if (m_scriptExecutionContext->isWorkerContext() && static_cast<WorkerContext*>(m_scriptExecutionContext)->isClosing())
+            return;
+#endif
+
         OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*m_scriptExecutionContext, eventData->channels());
         RefPtr<Event> evt = MessageEvent::create(ports.release(), eventData->message());
 
diff --git a/Source/WebCore/dom/MouseEvent.cpp b/Source/WebCore/dom/MouseEvent.cpp
index 0acbd74..134e5f6 100644
--- a/Source/WebCore/dom/MouseEvent.cpp
+++ b/Source/WebCore/dom/MouseEvent.cpp
@@ -23,19 +23,22 @@
 #include "config.h"
 #include "MouseEvent.h"
 
+#include "EventDispatcher.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "FrameView.h"
-#include "EventNames.h"
 #include "PlatformMouseEvent.h"
 
 namespace WebCore {
 
-PassRefPtr<MouseEvent> MouseEvent::create(const AtomicString& eventType, PassRefPtr<AbstractView> view, const PlatformMouseEvent& event, const IntPoint& position, int detail, PassRefPtr<Node> relatedTarget)
+PassRefPtr<MouseEvent> MouseEvent::create(const AtomicString& eventType, PassRefPtr<AbstractView> view, const PlatformMouseEvent& event, int detail, PassRefPtr<Node> relatedTarget)
 {
+    ASSERT(event.eventType() == MouseEventMoved || event.button() != NoButton);
+
     bool isCancelable = eventType != eventNames().mousemoveEvent;
 
     return MouseEvent::create(eventType, true, isCancelable, view,
-        detail, event.globalX(), event.globalY(), position.x(), position.y(),
+        detail, event.globalX(), event.globalY(), event.x(), event.y(),
         event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(), event.button(),
         relatedTarget, 0, false);
 }
@@ -149,4 +152,47 @@ SimulatedMouseEvent::SimulatedMouseEvent(const AtomicString& eventType, PassRefP
     setUnderlyingEvent(underlyingEvent);
 }
 
+MouseEventDispatchMediator::MouseEventDispatchMediator(PassRefPtr<MouseEvent> mouseEvent)
+    : EventDispatchMediator(mouseEvent)
+{
+}
+
+MouseEvent* MouseEventDispatchMediator::event() const
+{
+    return static_cast<MouseEvent*>(EventDispatchMediator::event());
+}
+
+bool MouseEventDispatchMediator::dispatchEvent(EventDispatcher* dispatcher) const
+{
+    if (dispatcher->node()->disabled()) // Don't even send DOM events for disabled controls..
+        return true;
+
+    if (event()->type().isEmpty())
+        return false; // Shouldn't happen.
+
+    RefPtr<EventTarget> relatedTarget = dispatcher->adjustRelatedTarget(event(), event()->relatedTarget());
+    event()->setRelatedTarget(relatedTarget);
+
+    dispatcher->dispatchEvent(event());
+    bool swallowEvent = event()->defaultHandled() || event()->defaultPrevented();
+
+    // Special case: If it's a double click event, we also send the dblclick event. This is not part
+    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute. This is treated
+    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
+    if (event()->type() == eventNames().clickEvent && event()->detail() == 2) {
+        RefPtr<MouseEvent> doubleClickEvent = MouseEvent::create();
+        doubleClickEvent->initMouseEvent(eventNames().dblclickEvent, event()->bubbles(), event()->cancelable(), event()->view(),
+                event()->detail(), event()->screenX(), event()->screenY(), event()->clientX(), event()->clientY(),
+                event()->ctrlKey(), event()->altKey(), event()->shiftKey(), event()->metaKey(),
+                event()->button(), relatedTarget);
+        if (event()->defaultHandled())
+            doubleClickEvent->setDefaultHandled();
+        dispatcher->dispatchEvent(doubleClickEvent);
+        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
+            swallowEvent = true;
+    }
+
+    return swallowEvent;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/MouseEvent.h b/Source/WebCore/dom/MouseEvent.h
index 06e6218..bab2b42 100644
--- a/Source/WebCore/dom/MouseEvent.h
+++ b/Source/WebCore/dom/MouseEvent.h
@@ -29,6 +29,7 @@
 
 namespace WebCore {
 
+class EventDispatcher;
 class PlatformMouseEvent;
 
     // Introduced in DOM Level 2
@@ -46,7 +47,7 @@ class PlatformMouseEvent;
             return adoptRef(new MouseEvent(type, canBubble, cancelable, view, detail, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey, button, relatedTarget, clipboard, isSimulated));
         }
-        static PassRefPtr<MouseEvent> create(const AtomicString& eventType, PassRefPtr<AbstractView>, const PlatformMouseEvent&, const IntPoint&, int detail, PassRefPtr<Node> relatedTarget);
+        static PassRefPtr<MouseEvent> create(const AtomicString& eventType, PassRefPtr<AbstractView>, const PlatformMouseEvent&, int detail, PassRefPtr<Node> relatedTarget);
 
         virtual ~MouseEvent();
 
@@ -60,6 +61,7 @@ class PlatformMouseEvent;
         unsigned short button() const { return m_button; }
         bool buttonDown() const { return m_buttonDown; }
         EventTarget* relatedTarget() const { return m_relatedTarget.get(); }
+        void setRelatedTarget(PassRefPtr<EventTarget> relatedTarget) { m_relatedTarget = relatedTarget; }
 
         Clipboard* clipboard() const { return m_clipboard.get(); }
 
@@ -96,6 +98,16 @@ private:
     SimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<AbstractView>, PassRefPtr<Event> underlyingEvent);
 };
 
+class MouseEventDispatchMediator : public EventDispatchMediator {
+public:
+    explicit MouseEventDispatchMediator(PassRefPtr<MouseEvent>);
+
+private:
+    MouseEvent* event() const;
+
+    virtual bool dispatchEvent(EventDispatcher*) const;
+};
+
 } // namespace WebCore
 
 #endif // MouseEvent_h
diff --git a/Source/WebCore/dom/MouseRelatedEvent.cpp b/Source/WebCore/dom/MouseRelatedEvent.cpp
index f752670..01e2d19 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.cpp
+++ b/Source/WebCore/dom/MouseRelatedEvent.cpp
@@ -74,18 +74,43 @@ static int contentsY(AbstractView* abstractView)
     return frameView->scrollY() / frame->pageZoomFactor();
 }
 
-MouseRelatedEvent::MouseRelatedEvent(const AtomicString& eventType, bool canBubble, bool cancelable, PassRefPtr<AbstractView> viewArg,
-                                     int detail, int screenX, int screenY, int pageX, int pageY,
+MouseRelatedEvent::MouseRelatedEvent(const AtomicString& eventType, bool canBubble, bool cancelable, PassRefPtr<AbstractView> abstractView,
+                                     int detail, int screenX, int screenY, int windowX, int windowY,
                                      bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, bool isSimulated)
-    : UIEventWithKeyState(eventType, canBubble, cancelable, viewArg, detail, ctrlKey, altKey, shiftKey, metaKey)
+    : UIEventWithKeyState(eventType, canBubble, cancelable, abstractView, detail, ctrlKey, altKey, shiftKey, metaKey)
     , m_screenX(screenX)
     , m_screenY(screenY)
-    , m_clientX(pageX - contentsX(view()))
-    , m_clientY(pageY - contentsY(view()))
-    , m_pageX(pageX)
-    , m_pageY(pageY)
+    , m_clientX(0)
+    , m_clientY(0)
+    , m_pageX(0)
+    , m_pageY(0)
     , m_isSimulated(isSimulated)
 {
+    IntPoint adjustedPageLocation;
+    IntPoint scrollPosition;
+
+    Frame* frame = view() ? view()->frame() : 0;
+    if (frame && !isSimulated) {
+        if (FrameView* frameView = frame->view()) {
+            scrollPosition = frameView->scrollPosition();
+            adjustedPageLocation = frameView->windowToContents(IntPoint(windowX, windowY));
+            float pageZoom = frame->pageZoomFactor();
+            if (pageZoom != 1.0f) {
+                // Adjust our pageX and pageY to account for the page zoom.
+                adjustedPageLocation.setX(lroundf(adjustedPageLocation.x() / pageZoom));
+                adjustedPageLocation.setY(lroundf(adjustedPageLocation.y() / pageZoom));
+                scrollPosition.setX(scrollPosition.x() / pageZoom);
+                scrollPosition.setY(scrollPosition.y() / pageZoom);
+            }
+        }
+    }
+
+    IntPoint clientLocation(adjustedPageLocation - scrollPosition);
+    m_clientX = clientLocation.x();
+    m_clientY = clientLocation.y();
+    m_pageX = adjustedPageLocation.x();
+    m_pageY = adjustedPageLocation.y();
+
     initCoordinates();
 }
 
diff --git a/Source/WebCore/dom/NamedNodeMap.idl b/Source/WebCore/dom/NamedNodeMap.idl
index 4d36577..3350d2f 100644
--- a/Source/WebCore/dom/NamedNodeMap.idl
+++ b/Source/WebCore/dom/NamedNodeMap.idl
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomToJS,
         CustomMarkFunction,
         HasIndexGetter,
         HasNameGetter
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 4def034..1fd4b92 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -411,7 +411,7 @@ Node::~Node()
         m_next->setPreviousSibling(0);
 
     if (m_document)
-        m_document->selfOnlyDeref();
+        m_document->guardDeref();
 }
 
 #ifdef NDEBUG
@@ -447,16 +447,12 @@ void Node::setDocument(Document* document)
     if (inDocument() || m_document == document)
         return;
 
-    document->selfOnlyRef();
+    document->guardRef();
 
     setWillMoveToNewOwnerDocumentWasCalled(false);
     willMoveToNewOwnerDocument();
     ASSERT(willMoveToNewOwnerDocumentWasCalled);
 
-#if USE(JSC)
-    updateDOMNodeDocument(this, m_document, document);
-#endif
-
     if (hasRareData() && rareData()->nodeLists()) {
         if (m_document)
             m_document->removeNodeListCache();
@@ -465,7 +461,7 @@ void Node::setDocument(Document* document)
 
     if (m_document) {
         m_document->moveNodeIteratorsToNewDocument(this, document);
-        m_document->selfOnlyDeref();
+        m_document->guardDeref();
     }
 
     m_document = document;
@@ -475,6 +471,58 @@ void Node::setDocument(Document* document)
     ASSERT(didMoveToNewOwnerDocumentWasCalled);
 }
 
+TreeScope* Node::treeScope() const
+{
+    if (!hasRareData())
+        return document();
+    TreeScope* scope = rareData()->treeScope();
+    // FIXME: Until we land shadow scopes, there should be no non-document scopes.
+    ASSERT(!scope);
+    return scope ? scope : document();
+}
+
+void Node::setTreeScope(TreeScope* newTreeScope)
+{
+    ASSERT(!isDocumentNode());
+    ASSERT(newTreeScope);
+    ASSERT(!inDocument() || treeScope() == newTreeScope);
+
+    if (newTreeScope->isDocumentNode()) {
+        if (hasRareData())
+            rareData()->setTreeScope(0);
+        // Setting the new document scope will be handled implicitly
+        // by setDocument() below.
+    } else {
+        // FIXME: Until we land shadow scopes, this branch should be inert.
+        ASSERT_NOT_REACHED();
+        ensureRareData()->setTreeScope(newTreeScope);
+    }
+
+    setDocument(newTreeScope->document());
+}
+
+void Node::setTreeScopeRecursively(TreeScope* newTreeScope)
+{
+    ASSERT(!isDocumentNode());
+    ASSERT(newTreeScope);
+    if (treeScope() == newTreeScope)
+        return;
+
+    Document* currentDocument = document();
+    Document* newDocument = newTreeScope->document();
+    // If an element is moved from a document and then eventually back again the collection cache for
+    // that element may contain stale data as changes made to it will have updated the DOMTreeVersion
+    // of the document it was moved to. By increasing the DOMTreeVersion of the donating document here
+    // we ensure that the collection cache will be invalidated as needed when the element is moved back.
+    if (currentDocument && currentDocument != newDocument)
+        currentDocument->incDOMTreeVersion();
+
+    for (Node* node = this; node; node = node->traverseNextNode(this)) {
+        node->setTreeScope(newTreeScope);
+        // FIXME: Once shadow scopes are landed, update parent scope, etc.
+    }
+}
+
 NodeRareData* Node::rareData() const
 {
     ASSERT(hasRareData());
@@ -505,7 +553,7 @@ Element* Node::shadowHost() const
 
 void Node::setShadowHost(Element* host)
 {
-    ASSERT(!parentNode());
+    ASSERT(!parentNode() && !isSVGShadowRoot());
     if (host)
         setFlag(IsShadowRootFlag);
     else
@@ -714,6 +762,12 @@ void Node::deprecatedParserAddChild(PassRefPtr<Node>)
 {
 }
 
+bool Node::isContentEditable() const
+{
+    document()->updateLayoutIgnorePendingStylesheets();
+    return rendererIsEditable(Editable);
+}
+
 bool Node::rendererIsEditable(EditableLevel editableLevel) const
 {
     if (document()->inDesignMode() || (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable()))
@@ -743,7 +797,7 @@ bool Node::rendererIsEditable(EditableLevel editableLevel) const
 
 bool Node::shouldUseInputMethod() const
 {
-    return rendererIsEditable();
+    return isContentEditable();
 }
 
 RenderBox* Node::renderBox() const
@@ -799,24 +853,21 @@ bool Node::hasNonEmptyBoundingBox() const
     return false;
 }
 
-void Node::setDocumentRecursively(Document* document)
+inline static ContainerNode* shadowRoot(Node* node)
 {
-    if (this->document() == document)
-        return;
+    return node->isElementNode() ? toElement(node)->shadowRoot() : 0;
+}
 
-    // If an element is moved from a document and then eventually back again the collection cache for
-    // that element may contain stale data as changes made to it will have updated the DOMTreeVersion
-    // of the document it was moved to. By increasing the DOMTreeVersion of the donating document here
-    // we ensure that the collection cache will be invalidated as needed when the element is moved back.
-    if (this->document())
-        this->document()->incDOMTreeVersion();
+void Node::setDocumentRecursively(Document* newDocument)
+{
+    ASSERT(document() != newDocument);
 
     for (Node* node = this; node; node = node->traverseNextNode(this)) {
-        node->setDocument(document);
+        node->setDocument(newDocument);
         if (!node->isElementNode())
             continue;
-        if (Node* shadow = toElement(node)->shadowRoot())
-            shadow->setDocumentRecursively(document);
+        if (Node* shadow = shadowRoot(node))
+            shadow->setDocumentRecursively(newDocument);
     }
 }
 
@@ -1401,18 +1452,44 @@ Node *Node::nextLeafNode() const
     return 0;
 }
 
+ContainerNode* Node::parentNodeForRenderingAndStyle() const
+{
+    ContainerNode* parent = parentOrHostNode();
+    return parent && parent->isShadowBoundary() ? parent->shadowHost() : parent;
+}
+
+static bool shouldCreateRendererFor(Node* node, ContainerNode* parentForRenderingAndStyle)
+{
+    RenderObject* parentRenderer = parentForRenderingAndStyle->renderer();
+    if (!parentRenderer)
+        return false;
+
+    bool atShadowBoundary = node->parentOrHostNode()->isShadowBoundary();
+
+    // FIXME: Ignoring canHaveChildren() in a case of isShadowRoot() might be wrong.
+    // See https://bugs.webkit.org/show_bug.cgi?id=52423
+    if (!parentRenderer->canHaveChildren() && !(node->isShadowRoot() || atShadowBoundary))
+        return false;
+
+    if (shadowRoot(parentForRenderingAndStyle) && !atShadowBoundary 
+        && !parentForRenderingAndStyle->canHaveLightChildRendererWithShadow())
+        return false;
+
+    if (!parentForRenderingAndStyle->childShouldCreateRenderer(node))
+        return false;
+
+    return true;
+}
+
 RenderObject* Node::createRendererAndStyle()
 {
     ASSERT(!renderer());
     ASSERT(document()->shouldCreateRenderers());
 
-    ContainerNode* parent = parentOrHostNode();
+    ContainerNode* parent = parentNodeForRenderingAndStyle();
     ASSERT(parent);
-    RenderObject* parentRenderer = parent->renderer();
 
-    // FIXME: Ignoring canHaveChildren() in a case of isShadowRoot() might be wrong.
-    // See https://bugs.webkit.org/show_bug.cgi?id=52423
-    if (!parentRenderer || (!parentRenderer->canHaveChildren() && !isShadowRoot()) || !parent->childShouldCreateRenderer(this))
+    if (!shouldCreateRendererFor(this, parent))
         return 0;
 
     RefPtr<RenderStyle> style = styleForRenderer();
@@ -1423,7 +1500,7 @@ RenderObject* Node::createRendererAndStyle()
     if (!newRenderer)
         return 0;
 
-    if (!parentRenderer->isChildAllowed(newRenderer, style.get())) {
+    if (!parent->renderer()->isChildAllowed(newRenderer, style.get())) {
         newRenderer->destroy();
         return 0;
     }
@@ -1464,7 +1541,7 @@ void Node::createRendererIfNeeded()
         return;
 
     // Note: Adding newRenderer instead of renderer(). renderer() may be a child of newRenderer.
-    parentOrHostNode()->renderer()->addChild(newRenderer, nextRenderer());
+    parentNodeForRenderingAndStyle()->renderer()->addChild(newRenderer, nextRenderer());
 }
 
 PassRefPtr<RenderStyle> Node::styleForRenderer()
@@ -1530,6 +1607,13 @@ bool Node::canStartSelection() const
     return parentOrHostNode() ? parentOrHostNode()->canStartSelection() : true;
 }
 
+#if ENABLE(SVG)
+SVGUseElement* Node::svgShadowHost() const
+{
+    return isSVGShadowRoot() ? static_cast<SVGUseElement*>(parent()) : 0;
+}
+#endif
+
 Node* Node::shadowAncestorNode()
 {
 #if ENABLE(SVG)
@@ -1551,7 +1635,7 @@ Node* Node::shadowTreeRootNode()
 {
     Node* root = this;
     while (root) {
-        if (root->isShadowRoot())
+        if (root->isShadowRoot() || root->isSVGShadowRoot())
             return root;
         root = root->parentNodeGuaranteedHostFree();
     }
@@ -2641,28 +2725,6 @@ EventTargetData* Node::ensureEventTargetData()
     return ensureRareData()->ensureEventTargetData();
 }
 
-#if USE(JSC)
-
-template <class NodeListMap>
-void markNodeLists(const NodeListMap& map, JSC::MarkStack& markStack, JSC::JSGlobalData& globalData)
-{
-    for (typename NodeListMap::const_iterator it = map.begin(); it != map.end(); ++it)
-        markDOMObjectWrapper(markStack, globalData, it->second);
-}
-
-void Node::markCachedNodeListsSlow(JSC::MarkStack& markStack, JSC::JSGlobalData& globalData)
-{
-    NodeListsNodeData* nodeLists = rareData()->nodeLists();
-    if (!nodeLists)
-        return;
-
-    markNodeLists(nodeLists->m_classNodeListCache, markStack, globalData);
-    markNodeLists(nodeLists->m_nameNodeListCache, markStack, globalData);
-    markNodeLists(nodeLists->m_tagNodeListCache, markStack, globalData);
-}
-
-#endif
-
 void Node::handleLocalEvents(Event* event)
 {
     if (!hasRareData() || !rareData()->eventTargetData())
@@ -2681,7 +2743,7 @@ void Node::dispatchScopedEvent(PassRefPtr<Event> event)
 
 bool Node::dispatchEvent(PassRefPtr<Event> event)
 {
-    return EventDispatcher::dispatchEvent(this, event);
+    return EventDispatcher::dispatchEvent(this, EventDispatchMediator(event));
 }
 
 void Node::dispatchSubtreeModifiedEvent()
@@ -2713,13 +2775,13 @@ void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr
 
 bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& event)
 {
-    return EventDispatcher::dispatchEvent(this, KeyboardEvent::create(event, document()->defaultView()));
+    return EventDispatcher::dispatchEvent(this, KeyboardEventDispatchMediator(KeyboardEvent::create(event, document()->defaultView())));
 }
 
 bool Node::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicString& eventType,
     int detail, Node* relatedTarget)
 {
-    return EventDispatcher::dispatchMouseEvent(this, event, eventType, detail, relatedTarget);
+    return EventDispatcher::dispatchEvent(this, MouseEventDispatchMediator(MouseEvent::create(eventType, document()->defaultView(), event, detail, relatedTarget)));
 }
 
 void Node::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents, bool showPressedLook)
@@ -2727,9 +2789,9 @@ void Node::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents,
     EventDispatcher::dispatchSimulatedClick(this, event, sendMouseEvents, showPressedLook);
 }
 
-void Node::dispatchWheelEvent(PlatformWheelEvent& e)
+bool Node::dispatchWheelEvent(const PlatformWheelEvent& event)
 {
-    EventDispatcher::dispatchWheelEvent(this, e);
+    return EventDispatcher::dispatchEvent(this, WheelEventDispatchMediator(event, document()->defaultView()));
 }
 
 void Node::dispatchFocusEvent()
@@ -2742,12 +2804,12 @@ void Node::dispatchBlurEvent()
     dispatchEvent(Event::create(eventNames().blurEvent, false, false));
 }
 
-void Node::dispatchChangeEvents()
+void Node::dispatchChangeEvent()
 {
     dispatchEvent(Event::create(eventNames().changeEvent, true, false));
 }
 
-void Node::dispatchInputEvents()
+void Node::dispatchInputEvent()
 {
     dispatchEvent(Event::create(eventNames().inputEvent, true, false));
 }
@@ -2809,7 +2871,7 @@ void Node::defaultEventHandler(Event* event)
             if (Frame* frame = document()->frame())
                 frame->eventHandler()->defaultWheelEventHandler(startNode, wheelEvent);
     } else if (event->type() == eventNames().webkitEditableContentChangedEvent) {
-        dispatchInputEvents();
+        dispatchInputEvent();
     }
 }
 
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 31f6ae8..c7bf90d 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -71,7 +71,11 @@ class RenderBox;
 class RenderBoxModelObject;
 class RenderObject;
 class RenderStyle;
+#if ENABLE(SVG)
+class SVGUseElement;
+#endif
 class TagNodeList;
+class TreeScope;
 
 typedef int ExceptionCode;
 
@@ -89,6 +93,8 @@ enum StyleChangeType {
 
 class Node : public EventTarget, public TreeShared<ContainerNode>, public ScriptWrappable {
     friend class Document;
+    friend class TreeScope;
+
 public:
     enum NodeType {
         ELEMENT_NODE = 1,
@@ -188,6 +194,10 @@ public:
     bool isHTMLElement() const { return getFlag(IsHTMLFlag); }
 
     bool isSVGElement() const { return getFlag(IsSVGFlag); }
+    virtual bool isSVGShadowRoot() const { return false; }
+#if ENABLE(SVG)
+    SVGUseElement* svgShadowHost() const;
+#endif
 
 #if ENABLE(WML)
     virtual bool isWMLElement() const { return false; }
@@ -203,12 +213,16 @@ public:
     virtual bool isCharacterDataNode() const { return false; }
     bool isDocumentNode() const;
     bool isShadowRoot() const { return getFlag(IsShadowRootFlag); }
+    // FIXME: Remove this when all shadow roots are ShadowRoots.
+    virtual bool isShadowBoundary() const { return false; }
+    virtual bool canHaveLightChildRendererWithShadow() const { return false; }
+
     Node* shadowAncestorNode();
     Node* shadowTreeRootNode();
     bool isInShadowTree();
-    // Node's parent or shadow tree host.
+    // Node's parent, shadow tree host, or SVG use.
     ContainerNode* parentOrHostNode() const;
-    // Use when it's guaranteed to that shadowHost is 0.
+    // Use when it's guaranteed to that shadowHost is 0 and svgShadowHost is 0.
     ContainerNode* parentNodeGuaranteedHostFree() const;
 
     Element* shadowHost() const;
@@ -319,10 +333,8 @@ public:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
 
-#if PLATFORM(MAC)
-    // Objective-C extensions
-    bool isContentEditable() const { return rendererIsEditable(Editable); }
-#endif
+    bool isContentEditable() const;
+
     bool rendererIsEditable() const { return rendererIsEditable(Editable); }
     bool rendererIsRichlyEditable() const { return rendererIsEditable(RichlyEditable); }
     virtual bool shouldUseInputMethod() const;
@@ -351,12 +363,14 @@ public:
         return m_document;
     }
 
-    // Do not use this method to change the document of a node until after the node has been
-    // removed from its previous document.
-    void setDocument(Document*);
+    TreeScope* treeScope() const;
+
+    // Do not use this method to change the scope of a node until after the node has been
+    // removed from its previous scope. Do not use to change documents.
+    void setTreeScope(TreeScope*);
 
     // Used by the basic DOM methods (e.g., appendChild()).
-    void setDocumentRecursively(Document*);
+    void setTreeScopeRecursively(TreeScope*);
 
     // Returns true if this node is associated with a document and is in its associated document's
     // node tree, false otherwise.
@@ -367,7 +381,7 @@ public:
     }
 
     bool isReadOnlyNode() const { return nodeType() == ENTITY_REFERENCE_NODE; }
-    virtual bool childTypeAllowed(NodeType) { return false; }
+    virtual bool childTypeAllowed(NodeType) const { return false; }
     unsigned childNodeCount() const;
     Node* childNode(unsigned index) const;
 
@@ -446,6 +460,7 @@ public:
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual bool childShouldCreateRenderer(Node*) const { return true; }
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    ContainerNode* parentNodeForRenderingAndStyle() const;
     
     // Wrapper for nodes that don't have a renderer, but still cache the style (like HTMLOptionElement).
     RenderStyle* renderStyle() const;
@@ -547,14 +562,14 @@ public:
     void dispatchSubtreeModifiedEvent();
     void dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent);
     bool dispatchKeyEvent(const PlatformKeyboardEvent&);
-    void dispatchWheelEvent(PlatformWheelEvent&);
+    bool dispatchWheelEvent(const PlatformWheelEvent&);
     bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType, int clickCount = 0, Node* relatedTarget = 0);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
 
     virtual void dispatchFocusEvent();
     virtual void dispatchBlurEvent();
-    virtual void dispatchChangeEvents();
-    virtual void dispatchInputEvents();
+    virtual void dispatchChangeEvent();
+    virtual void dispatchInputEvent();
 
     // Perform the default action for an event.
     virtual void defaultEventHandler(Event*);
@@ -569,17 +584,6 @@ public:
     virtual EventTargetData* eventTargetData();
     virtual EventTargetData* ensureEventTargetData();
 
-#if USE(JSC)
-    void markCachedNodeLists(JSC::MarkStack& markStack, JSC::JSGlobalData& globalData)
-    {
-        // NodeLists may be present.  If so, they need to be marked.
-        if (!hasRareData())
-            return;
-
-        markCachedNodeListsSlow(markStack, globalData);
-    }
-#endif
-
 private:
     enum NodeFlags {
         IsTextFlag = 1,
@@ -644,6 +648,11 @@ protected:
     };
     Node(Document*, ConstructionType);
 
+    // Do not use this method to change the document of a node until after the node has been
+    // removed from its previous document.
+    void setDocument(Document*);
+    void setDocumentRecursively(Document*);
+
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
     
@@ -657,10 +666,6 @@ protected:
     NodeRareData* ensureRareData();
 
 private:
-#if USE(JSC)
-    void markCachedNodeListsSlow(JSC::MarkStack&, JSC::JSGlobalData&);
-#endif
-
     enum EditableLevel { Editable, RichlyEditable };
     bool rendererIsEditable(EditableLevel) const;
 
@@ -734,7 +739,7 @@ inline void addSubresourceURL(ListHashSet<KURL>& urls, const KURL& url)
 
 inline ContainerNode* Node::parentNode() const
 {
-    return getFlag(IsShadowRootFlag) ? 0 : parent();
+    return getFlag(IsShadowRootFlag) || isSVGShadowRoot() ? 0 : parent();
 }
 
 inline ContainerNode* Node::parentOrHostNode() const
@@ -744,7 +749,7 @@ inline ContainerNode* Node::parentOrHostNode() const
 
 inline ContainerNode* Node::parentNodeGuaranteedHostFree() const
 {
-    ASSERT(!getFlag(IsShadowRootFlag));
+    ASSERT(!getFlag(IsShadowRootFlag) && !isSVGShadowRoot());
     return parentOrHostNode();
 }
 
diff --git a/Source/WebCore/dom/NodeFilter.h b/Source/WebCore/dom/NodeFilter.h
index 5ce2866..d6e47fb 100644
--- a/Source/WebCore/dom/NodeFilter.h
+++ b/Source/WebCore/dom/NodeFilter.h
@@ -70,15 +70,22 @@ namespace WebCore {
             return adoptRef(new NodeFilter(condition));
         }
 
+        static PassRefPtr<NodeFilter> create()
+        {
+            return adoptRef(new NodeFilter());
+        }
+
         short acceptNode(ScriptState*, Node*) const;
-        void markAggregate(JSC::MarkStack& markStack) { m_condition->markAggregate(markStack); };
 
         // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
         // They operate in the main thread normal world, and they swallow JS exceptions.
         short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(mainThreadNormalWorld(), node), node); }
+        
+        void setCondition(PassRefPtr<NodeFilterCondition> condition) { ASSERT(!m_condition); m_condition = condition; }
 
     private:
         NodeFilter(PassRefPtr<NodeFilterCondition> condition) : m_condition(condition) { }
+        NodeFilter() {}
 
         RefPtr<NodeFilterCondition> m_condition;
     };
diff --git a/Source/WebCore/dom/NodeList.h b/Source/WebCore/dom/NodeList.h
index d4e18aa..7639d37 100644
--- a/Source/WebCore/dom/NodeList.h
+++ b/Source/WebCore/dom/NodeList.h
@@ -39,6 +39,9 @@ namespace WebCore {
         virtual unsigned length() const = 0;
         virtual Node* item(unsigned index) const = 0;
         virtual Node* itemWithName(const AtomicString&) const = 0;
+        
+        // Other methods (not part of DOM)
+        virtual bool isDynamicNodeList() const { return false; }
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NodeList.idl b/Source/WebCore/dom/NodeList.idl
index edb2dc7..b751f66 100644
--- a/Source/WebCore/dom/NodeList.idl
+++ b/Source/WebCore/dom/NodeList.idl
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomToJS,
         HasIndexGetter,
         HasNameGetter,
         CustomCall
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index badc4e1..ac05d3e 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -34,6 +34,8 @@
 
 namespace WebCore {
 
+class TreeScope;
+
 struct NodeListsNodeData {
     WTF_MAKE_NONCOPYABLE(NodeListsNodeData); WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -73,7 +75,8 @@ class NodeRareData {
     WTF_MAKE_NONCOPYABLE(NodeRareData); WTF_MAKE_FAST_ALLOCATED;
 public:    
     NodeRareData()
-        : m_tabIndex(0)
+        : m_treeScope(0)
+        , m_tabIndex(0)
         , m_tabIndexWasSetExplicitly(false)
         , m_isFocused(false)
         , m_needsFocusAppearanceUpdateSoonAfterAttach(false)
@@ -96,11 +99,14 @@ public:
     {
         return rareDataMap().get(node);
     }
+
+    TreeScope* treeScope() const { return m_treeScope; }
+    void setTreeScope(TreeScope* treeScope) { m_treeScope = treeScope; }
     
     void clearNodeLists() { m_nodeLists.clear(); }
     void setNodeLists(PassOwnPtr<NodeListsNodeData> lists) { m_nodeLists = lists; }
     NodeListsNodeData* nodeLists() const { return m_nodeLists.get(); }
-    
+
     short tabIndex() const { return m_tabIndex; }
     void setTabIndexExplicitly(short index) { m_tabIndex = index; m_tabIndexWasSetExplicitly = true; }
     bool tabIndexSetExplicitly() const { return m_tabIndexWasSetExplicitly; }
@@ -123,6 +129,7 @@ protected:
     void setNeedsFocusAppearanceUpdateSoonAfterAttach(bool needs) { m_needsFocusAppearanceUpdateSoonAfterAttach = needs; }
 
 private:
+    TreeScope* m_treeScope;
     OwnPtr<NodeListsNodeData> m_nodeLists;
     OwnPtr<EventTargetData> m_eventTargetData;
     short m_tabIndex;
diff --git a/Source/WebCore/dom/NodeRenderStyle.h b/Source/WebCore/dom/NodeRenderStyle.h
index 3a67e02..1a2d2c3 100644
--- a/Source/WebCore/dom/NodeRenderStyle.h
+++ b/Source/WebCore/dom/NodeRenderStyle.h
@@ -33,7 +33,11 @@ namespace WebCore {
 
 inline RenderStyle* Node::renderStyle() const
 {
-    return m_renderer ? m_renderer->style() : nonRendererRenderStyle();
+    // Using a ternary here confuses the Solaris Studio 12/12.1/12.2 compilers:
+    // Bug is CR 6569194, "Problem with question operator binding in inline function"
+    if (m_renderer) 
+        return m_renderer->style();
+    return nonRendererRenderStyle();
 }
 
 }
diff --git a/Source/WebCore/dom/Notation.cpp b/Source/WebCore/dom/Notation.cpp
index 4b3ab28..f62e630 100644
--- a/Source/WebCore/dom/Notation.cpp
+++ b/Source/WebCore/dom/Notation.cpp
@@ -49,7 +49,7 @@ PassRefPtr<Node> Notation::cloneNode(bool /*deep*/)
     return 0;
 }
 
-bool Notation::childTypeAllowed(NodeType)
+bool Notation::childTypeAllowed(NodeType) const
 {
     return false;
 }
diff --git a/Source/WebCore/dom/Notation.h b/Source/WebCore/dom/Notation.h
index 547c9e7..b2155ba 100644
--- a/Source/WebCore/dom/Notation.h
+++ b/Source/WebCore/dom/Notation.h
@@ -39,7 +39,7 @@ private:
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
 
     String m_name;
     String m_publicId;
diff --git a/Source/WebCore/dom/ProcessingInstruction.cpp b/Source/WebCore/dom/ProcessingInstruction.cpp
index ae0e40d..7135644 100644
--- a/Source/WebCore/dom/ProcessingInstruction.cpp
+++ b/Source/WebCore/dom/ProcessingInstruction.cpp
@@ -101,7 +101,7 @@ PassRefPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/)
 }
 
 // DOM Section 1.1.1
-bool ProcessingInstruction::childTypeAllowed(NodeType)
+bool ProcessingInstruction::childTypeAllowed(NodeType) const
 {
     return false;
 }
diff --git a/Source/WebCore/dom/ProcessingInstruction.h b/Source/WebCore/dom/ProcessingInstruction.h
index 8619070..fd98566 100644
--- a/Source/WebCore/dom/ProcessingInstruction.h
+++ b/Source/WebCore/dom/ProcessingInstruction.h
@@ -69,7 +69,7 @@ private:
     virtual String nodeValue() const;
     virtual void setNodeValue(const String&, ExceptionCode&);
     virtual PassRefPtr<Node> cloneNode(bool deep);
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
     virtual bool offsetInCharacters() const;
     virtual int maxCharacterOffset() const;
 
diff --git a/Source/WebCore/dom/QualifiedName.h b/Source/WebCore/dom/QualifiedName.h
index 192e7bc..01eaebb 100644
--- a/Source/WebCore/dom/QualifiedName.h
+++ b/Source/WebCore/dom/QualifiedName.h
@@ -141,11 +141,9 @@ namespace WTF {
         typedef WebCore::QualifiedNameHash Hash;
     };
     
-    template<> struct HashTraits<WebCore::QualifiedName> : GenericHashTraits<WebCore::QualifiedName> {
+    template<> struct HashTraits<WebCore::QualifiedName> : SimpleClassHashTraits<WebCore::QualifiedName> {
         static const bool emptyValueIsZero = false;
         static WebCore::QualifiedName emptyValue() { return WebCore::QualifiedName(nullAtom, nullAtom, nullAtom); }
-        static void constructDeletedValue(WebCore::QualifiedName& slot) { new (&slot) WebCore::QualifiedName(WTF::HashTableDeletedValue); }
-        static bool isDeletedValue(const WebCore::QualifiedName& slot) { return slot.isHashTableDeletedValue(); }
     };
 }
 
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index 423d43f..469a94a 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -224,8 +224,10 @@ void Range::setStart(PassRefPtr<Node> refNode, int offset, ExceptionCode& ec)
     if (startRootContainer != endRootContainer)
         collapse(true, ec);
     // check if new start after end
-    else if (compareBoundaryPoints(m_start, m_end) > 0)
+    else if (compareBoundaryPoints(m_start, m_end, ec) > 0) {
+        ASSERT(!ec);
         collapse(true, ec);
+    }
 }
 
 void Range::setEnd(PassRefPtr<Node> refNode, int offset, ExceptionCode& ec)
@@ -262,8 +264,10 @@ void Range::setEnd(PassRefPtr<Node> refNode, int offset, ExceptionCode& ec)
     if (startRootContainer != endRootContainer)
         collapse(false, ec);
     // check if new end before start
-    if (compareBoundaryPoints(m_start, m_end) > 0)
+    if (compareBoundaryPoints(m_start, m_end, ec) > 0) {
+        ASSERT(!ec);
         collapse(false, ec);
+    }
 }
 
 void Range::collapse(bool toStart, ExceptionCode& ec)
@@ -306,8 +310,8 @@ bool Range::isPointInRange(Node* refNode, int offset, ExceptionCode& ec)
     if (ec)
         return false;
 
-    return compareBoundaryPoints(refNode, offset, m_start.container(), m_start.offset()) >= 0
-        && compareBoundaryPoints(refNode, offset, m_end.container(), m_end.offset()) <= 0;
+    return compareBoundaryPoints(refNode, offset, m_start.container(), m_start.offset(), ec) >= 0 && !ec
+        && compareBoundaryPoints(refNode, offset, m_end.container(), m_end.offset(), ec) <= 0 && !ec;
 }
 
 short Range::comparePoint(Node* refNode, int offset, ExceptionCode& ec) const
@@ -337,11 +341,14 @@ short Range::comparePoint(Node* refNode, int offset, ExceptionCode& ec) const
         return 0;
 
     // compare to start, and point comes before
-    if (compareBoundaryPoints(refNode, offset, m_start.container(), m_start.offset()) < 0)
+    if (compareBoundaryPoints(refNode, offset, m_start.container(), m_start.offset(), ec) < 0)
         return -1;
 
+    if (ec)
+        return 0;
+
     // compare to end, and point comes after
-    if (compareBoundaryPoints(refNode, offset, m_end.container(), m_end.offset()) > 0)
+    if (compareBoundaryPoints(refNode, offset, m_end.container(), m_end.offset(), ec) > 0 && !ec)
         return 1;
 
     // point is in the middle of this range, or on the boundary points
@@ -433,20 +440,20 @@ short Range::compareBoundaryPoints(CompareHow how, const Range* sourceRange, Exc
 
     switch (how) {
         case START_TO_START:
-            return compareBoundaryPoints(m_start, sourceRange->m_start);
+            return compareBoundaryPoints(m_start, sourceRange->m_start, ec);
         case START_TO_END:
-            return compareBoundaryPoints(m_end, sourceRange->m_start);
+            return compareBoundaryPoints(m_end, sourceRange->m_start, ec);
         case END_TO_END:
-            return compareBoundaryPoints(m_end, sourceRange->m_end);
+            return compareBoundaryPoints(m_end, sourceRange->m_end, ec);
         case END_TO_START:
-            return compareBoundaryPoints(m_start, sourceRange->m_end);
+            return compareBoundaryPoints(m_start, sourceRange->m_end, ec);
     }
 
     ec = SYNTAX_ERR;
     return 0;
 }
 
-short Range::compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB)
+short Range::compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB, ExceptionCode& ec)
 {
     ASSERT(containerA);
     ASSERT(containerB);
@@ -507,8 +514,10 @@ short Range::compareBoundaryPoints(Node* containerA, int offsetA, Node* containe
     // case 4: containers A & B are siblings, or children of siblings
     // ### we need to do a traversal here instead
     Node* commonAncestor = commonAncestorContainer(containerA, containerB);
-    if (!commonAncestor)
+    if (!commonAncestor) {
+        ec = WRONG_DOCUMENT_ERR;
         return 0;
+    }
     Node* childA = containerA;
     while (childA && childA->parentNode() != commonAncestor)
         childA = childA->parentNode();
@@ -537,14 +546,15 @@ short Range::compareBoundaryPoints(Node* containerA, int offsetA, Node* containe
     return 0;
 }
 
-short Range::compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB)
+short Range::compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB, ExceptionCode& ec)
 {
-    return compareBoundaryPoints(boundaryA.container(), boundaryA.offset(), boundaryB.container(), boundaryB.offset());
+    return compareBoundaryPoints(boundaryA.container(), boundaryA.offset(), boundaryB.container(), boundaryB.offset(), ec);
 }
 
 bool Range::boundaryPointsValid() const
 {
-    return m_start.container() && compareBoundaryPoints(m_start, m_end) <= 0;
+    ExceptionCode ec = 0;
+    return m_start.container() && compareBoundaryPoints(m_start, m_end, ec) <= 0 && !ec;
 }
 
 void Range::deleteContents(ExceptionCode& ec)
@@ -1620,7 +1630,7 @@ void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
     }
 }
 
-void Range::textQuads(Vector<FloatQuad>& quads, bool useSelectionHeight)
+void Range::textQuads(Vector<FloatQuad>& quads, bool useSelectionHeight) const
 {
     Node* startContainer = m_start.container();
     Node* endContainer = m_end.container();
@@ -1893,16 +1903,24 @@ PassRefPtr<ClientRect> Range::getBoundingClientRect() const
     return rect.isEmpty() ? 0 : ClientRect::create(rect);
 }
 
-static void adjustFloatQuadsForScrollAndAbsoluteZoom(Vector<FloatQuad>& quads, Document* document, RenderObject* renderer)
+static void adjustFloatQuadsForScrollAndAbsoluteZoomAndPageScale(Vector<FloatQuad>& quads, Document* document, RenderObject* renderer)
 {
     FrameView* view = document->view();
     if (!view)
         return;
 
+    float pageScale = 1;
+    if (Page* page = document->page()) {
+        if (Frame* frame = page->mainFrame())
+            pageScale = frame->pageScaleFactor();
+    }
+
     IntRect visibleContentRect = view->visibleContentRect();
     for (size_t i = 0; i < quads.size(); ++i) {
         quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
         adjustFloatQuadForAbsoluteZoom(quads[i], renderer);
+        if (pageScale != 1)
+            adjustFloatQuadForPageScale(quads[i], pageScale);
     }
 }
 
@@ -1924,7 +1942,7 @@ void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
                 if (RenderBoxModelObject* renderBoxModelObject = static_cast<Element*>(node)->renderBoxModelObject()) {
                     Vector<FloatQuad> elementQuads;
                     renderBoxModelObject->absoluteQuads(elementQuads);
-                    adjustFloatQuadsForScrollAndAbsoluteZoom(elementQuads, m_ownerDocument.get(), renderBoxModelObject);
+                    adjustFloatQuadsForScrollAndAbsoluteZoomAndPageScale(elementQuads, m_ownerDocument.get(), renderBoxModelObject);
 
                     quads.append(elementQuads);
                 }
@@ -1937,7 +1955,7 @@ void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
                 
                 Vector<FloatQuad> textQuads;
                 renderText->absoluteQuadsForRange(textQuads, startOffset, endOffset);
-                adjustFloatQuadsForScrollAndAbsoluteZoom(textQuads, m_ownerDocument.get(), renderText);
+                adjustFloatQuadsForScrollAndAbsoluteZoomAndPageScale(textQuads, m_ownerDocument.get(), renderText);
 
                 quads.append(textQuads);
             }
diff --git a/Source/WebCore/dom/Range.h b/Source/WebCore/dom/Range.h
index 5637b77..062ad67 100644
--- a/Source/WebCore/dom/Range.h
+++ b/Source/WebCore/dom/Range.h
@@ -69,8 +69,8 @@ public:
     CompareResults compareNode(Node* refNode, ExceptionCode&) const;
     enum CompareHow { START_TO_START, START_TO_END, END_TO_END, END_TO_START };
     short compareBoundaryPoints(CompareHow, const Range* sourceRange, ExceptionCode&) const;
-    static short compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB);
-    static short compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB);
+    static short compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB, ExceptionCode&);
+    static short compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB, ExceptionCode&);
     bool boundaryPointsValid() const;
     bool intersectsNode(Node* refNode, ExceptionCode&);
     void deleteContents(ExceptionCode&);
@@ -109,7 +109,7 @@ public:
     // Not transform-friendly
     void textRects(Vector<IntRect>&, bool useSelectionHeight = false);
     // Transform-friendly
-    void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false);
+    void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false) const;
     void getBorderAndTextQuads(Vector<FloatQuad>&) const;
     FloatRect boundingRect() const;
 
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 9a07bb8..5dd6b7d 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -257,6 +257,9 @@ void ScriptElement::executeScript(const ScriptSourceCode& sourceCode)
     if (sourceCode.isEmpty())
         return;
 
+    if (!m_isExternalScript && !m_element->document()->contentSecurityPolicy()->allowInlineScript())
+        return;
+
     RefPtr<Document> document = m_element->document();
     ASSERT(document);
     if (Frame* frame = document->frame()) {
diff --git a/Source/WebCore/dom/ScriptExecutionContext.h b/Source/WebCore/dom/ScriptExecutionContext.h
index 3b37f0c..8407699 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.h
+++ b/Source/WebCore/dom/ScriptExecutionContext.h
@@ -82,7 +82,7 @@ namespace WebCore {
         void stopDatabases(DatabaseTaskSynchronizer*);
 #endif
         virtual bool isContextThread() const = 0;
-        virtual bool isJSExecutionTerminated() const = 0;
+        virtual bool isJSExecutionForbidden() const = 0;
 
         const KURL& url() const { return virtualURL(); }
         KURL completeURL(const String& url) const { return virtualCompleteURL(url); }
diff --git a/Source/WebCore/dom/SelectElement.cpp b/Source/WebCore/dom/SelectElement.cpp
index 15c69ad..545f271 100644
--- a/Source/WebCore/dom/SelectElement.cpp
+++ b/Source/WebCore/dom/SelectElement.cpp
@@ -70,6 +70,74 @@ namespace WebCore {
 
 static const DOMTimeStamp typeAheadTimeout = 1000;
 
+enum SkipDirection {
+    SkipBackwards = -1,
+    SkipForwards = 1
+};
+
+// Returns the 1st valid item |skip| items from |listIndex| in direction |direction| if there is one.
+// Otherwise, it returns the valid item closest to that boundary which is past |listIndex| if there is one.
+// Otherwise, it returns |listIndex|.
+// Valid means that it is enabled and an option element.
+static int nextValidIndex(const Vector<Element*>& listItems, int listIndex, SkipDirection direction, int skip)
+{
+    ASSERT(direction == -1 || direction == 1);
+    int lastGoodIndex = listIndex;
+    int size = listItems.size();
+    for (listIndex += direction; listIndex >= 0 && listIndex < size; listIndex += direction) {
+        --skip;
+        if (!listItems[listIndex]->disabled() && isOptionElement(listItems[listIndex])) {
+            lastGoodIndex = listIndex;
+            if (skip <= 0)
+                break;
+        }
+    }
+    return lastGoodIndex;
+}
+
+static int nextSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
+{
+    return nextValidIndex(data.listItems(element), startIndex, SkipForwards, 1);
+}
+
+static int previousSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
+{
+    if (startIndex == -1)
+        startIndex = data.listItems(element).size();
+    return nextValidIndex(data.listItems(element), startIndex, SkipBackwards, 1);
+}
+
+static int firstSelectableListIndex(SelectElementData& data, Element* element)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int index = nextValidIndex(items, items.size(), SkipBackwards, INT_MAX);
+    if (static_cast<unsigned>(index) == items.size())
+        return -1;
+    return index;
+}
+
+static int lastSelectableListIndex(SelectElementData& data, Element* element)
+{
+    return nextValidIndex(data.listItems(element), -1, SkipForwards, INT_MAX);
+}
+
+// Returns the index of the next valid item one page away from |startIndex| in direction |direction|.
+static int nextSelectableListIndexPageAway(SelectElementData& data, Element* element, int startIndex, SkipDirection direction)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    // Can't use data->size() because renderer forces a minimum size.
+    int pageSize = 0;
+    if (element->renderer()->isListBox())
+        pageSize = toRenderListBox(element->renderer())->size() - 1; // -1 so we still show context
+
+    // One page away, but not outside valid bounds.
+    // If there is a valid option item one page away, the index is chosen.
+    // If there is no exact one page away valid option, returns startIndex or the most far index.
+    int edgeIndex = (direction == SkipForwards) ? 0 : (items.size() - 1);
+    int skipAmount = pageSize + ((direction == SkipForwards) ? startIndex : (edgeIndex - startIndex));
+    return nextValidIndex(items, edgeIndex, direction, skipAmount);
+}
+
 void SelectElement::selectAll(SelectElementData& data, Element* element)
 {
     ASSERT(!data.usesMenuList());
@@ -104,30 +172,6 @@ void SelectElement::saveLastSelection(SelectElementData& data, Element* element)
     }
 }
 
-int SelectElement::nextSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
-{
-    const Vector<Element*>& items = data.listItems(element);
-    int index = startIndex + 1;
-    while (index >= 0 && (unsigned) index < items.size() && (!isOptionElement(items[index]) || items[index]->disabled()))
-        ++index;
-    if ((unsigned) index == items.size())
-        return startIndex;
-    return index;
-}
-
-int SelectElement::previousSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
-{
-    const Vector<Element*>& items = data.listItems(element);
-    if (startIndex == -1)
-        startIndex = items.size();
-    int index = startIndex - 1;
-    while (index >= 0 && (unsigned) index < items.size() && (!isOptionElement(items[index]) || items[index]->disabled()))
-        --index;
-    if (index == -1)
-        return startIndex;
-    return index;
-}
-
 void SelectElement::setActiveSelectionAnchorIndex(SelectElementData& data, Element* element, int index)
 {
     data.setActiveSelectionAnchorIndex(index);
@@ -515,27 +559,6 @@ void SelectElement::reset(SelectElementData& data, Element* element)
     setOptionsChangedOnRenderer(data, element);
     element->setNeedsStyleRecalc();
 }
-    
-enum SkipDirection {
-    SkipBackwards = -1,
-    SkipForwards = 1
-};
-
-// Returns the index of the next valid list item |skip| items past |listIndex| in direction |direction|.
-static int nextValidIndex(const Vector<Element*>& listItems, int listIndex, SkipDirection direction, int skip)
-{
-    int lastGoodIndex = listIndex;
-    int size = listItems.size();
-    for (listIndex += direction; listIndex >= 0 && listIndex < size; listIndex += direction) {
-        --skip;
-        if (!listItems[listIndex]->disabled() && isOptionElement(listItems[listIndex])) {
-            lastGoodIndex = listIndex;
-            if (skip <= 0)
-                break;
-        }
-    }
-    return lastGoodIndex;
-}
 
 void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
 {
@@ -594,8 +617,8 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
             listIndex = nextValidIndex(listItems, listItems.size(), SkipBackwards, 1);
             handled = true;
         }
-        
-        if (handled && listIndex >= 0 && (unsigned)listIndex < listItems.size())
+
+        if (handled && listIndex >= 0 && static_cast<unsigned>(listIndex) < listItems.size())
             setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
 
         if (handled)
@@ -760,19 +783,47 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             return;
         const String& keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
 
-        int endIndex = 0;        
+        bool handled = false;
+        int endIndex = 0;
         if (data.activeSelectionEndIndex() < 0) {
             // Initialize the end index
-            if (keyIdentifier == "Down")
-                endIndex = nextSelectableListIndex(data, element, lastSelectedListIndex(data, element));
-            else if (keyIdentifier == "Up")
-                endIndex = previousSelectableListIndex(data, element, optionToListIndex(data, element, selectedIndex(data, element)));
+            if (keyIdentifier == "Down" || keyIdentifier == "PageDown") {
+                int startIndex = lastSelectedListIndex(data, element);
+                handled = true;
+                if (keyIdentifier == "Down")
+                    endIndex = nextSelectableListIndex(data, element, startIndex);
+                else
+                    endIndex = nextSelectableListIndexPageAway(data, element, startIndex, SkipForwards);
+            } else if (keyIdentifier == "Up" || keyIdentifier == "PageUp") {
+                int startIndex = optionToListIndex(data, element, selectedIndex(data, element));
+                handled = true;
+                if (keyIdentifier == "Up")
+                    endIndex = previousSelectableListIndex(data, element, startIndex);
+                else
+                    endIndex = nextSelectableListIndexPageAway(data, element, startIndex, SkipBackwards);
+            }
         } else {
             // Set the end index based on the current end index
-            if (keyIdentifier == "Down")
+            if (keyIdentifier == "Down") {
                 endIndex = nextSelectableListIndex(data, element, data.activeSelectionEndIndex());
-            else if (keyIdentifier == "Up")
-                endIndex = previousSelectableListIndex(data, element, data.activeSelectionEndIndex());    
+                handled = true;
+            } else if (keyIdentifier == "Up") {
+                endIndex = previousSelectableListIndex(data, element, data.activeSelectionEndIndex());
+                handled = true;
+            } else if (keyIdentifier == "PageDown") {
+                endIndex = nextSelectableListIndexPageAway(data, element, data.activeSelectionEndIndex(), SkipForwards);
+                handled = true;
+            } else if (keyIdentifier == "PageUp") {
+                endIndex = nextSelectableListIndexPageAway(data, element, data.activeSelectionEndIndex(), SkipBackwards);
+                handled = true;
+            }
+        }
+        if (keyIdentifier == "Home") {
+            endIndex = firstSelectableListIndex(data, element);
+            handled = true;
+        } else if (keyIdentifier == "End") {
+            endIndex = lastSelectableListIndex(data, element);
+            handled = true;
         }
 
         if (isSpatialNavigationEnabled(element->document()->frame()))
@@ -780,13 +831,13 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             if (keyIdentifier == "Left" || keyIdentifier == "Right" || ((keyIdentifier == "Down" || keyIdentifier == "Up") && endIndex == data.activeSelectionEndIndex()))
                 return;
 
-        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
+        if (endIndex >= 0 && handled) {
             // Save the selection so it can be compared to the new selection when dispatching change events immediately after making the new selection.
             saveLastSelection(data, element);
 
-            ASSERT_UNUSED(listItems, !listItems.size() || (endIndex >= 0 && (unsigned) endIndex < listItems.size()));
+            ASSERT_UNUSED(listItems, !listItems.size() || (endIndex >= 0 && static_cast<unsigned>(endIndex) < listItems.size()));
             setActiveSelectionEndIndex(data, endIndex);
-            
+
             bool selectNewItem = !data.multiple() || static_cast<KeyboardEvent*>(event)->shiftKey() || !isSpatialNavigationEnabled(element->document()->frame());
             if (selectNewItem)
                 data.setActiveSelectionState(true);
diff --git a/Source/WebCore/dom/SelectElement.h b/Source/WebCore/dom/SelectElement.h
index 222a1bb..dd073a2 100644
--- a/Source/WebCore/dom/SelectElement.h
+++ b/Source/WebCore/dom/SelectElement.h
@@ -72,8 +72,6 @@ protected:
 
     static void selectAll(SelectElementData&, Element*);
     static void saveLastSelection(SelectElementData&, Element*);
-    static int nextSelectableListIndex(SelectElementData&, Element*, int startIndex);
-    static int previousSelectableListIndex(SelectElementData&, Element*, int startIndex);
     static void setActiveSelectionAnchorIndex(SelectElementData&, Element*, int index);
     static void setActiveSelectionEndIndex(SelectElementData&, int index);
     static void updateListBoxSelection(SelectElementData&, Element*, bool deselectOtherOptions);
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
new file mode 100644
index 0000000..8fe56b5
--- /dev/null
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ShadowRoot.h"
+
+namespace WebCore {
+
+ShadowRoot::ShadowRoot(Document* document)
+    : DocumentFragment(document)
+{
+    ASSERT(document);
+}
+
+String ShadowRoot::nodeName() const
+{
+    return "#shadow-root";
+}
+
+void ShadowRoot::recalcStyle(StyleChange change)
+{
+    for (Node* n = firstChild(); n; n = n->nextSibling())
+        n->recalcStyle(change);
+
+    clearNeedsStyleRecalc();
+    clearChildNeedsStyleRecalc();
+}
+
+}
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
new file mode 100644
index 0000000..aeccd8a
--- /dev/null
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ShadowRoot_h
+#define ShadowRoot_h
+
+#include "DocumentFragment.h"
+
+namespace WebCore {
+
+class Document;
+
+class ShadowRoot : public DocumentFragment {
+public:
+    static PassRefPtr<ShadowRoot> create(Document*);
+
+    virtual bool isShadowBoundary() const { return true; }
+    virtual void recalcStyle(StyleChange = NoChange);
+
+private:
+    ShadowRoot(Document*);
+    virtual String nodeName() const;
+};
+
+inline PassRefPtr<ShadowRoot> ShadowRoot::create(Document* document)
+{
+    return adoptRef(new ShadowRoot(document));
+}
+
+} // namespace
+
+#endif
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index 3c55591..6781ed5 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -233,18 +233,9 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
 
 void StyledElement::parseMappedAttribute(Attribute* attr)
 {
-    if (isIdAttributeName(attr->name())) {
-        setHasID(!attr->isNull());
-        if (attributeMap()) {
-            if (attr->isNull())
-                attributeMap()->setIdForStyleResolution(nullAtom);
-            else if (document()->inQuirksMode())
-                attributeMap()->setIdForStyleResolution(attr->value().lower());
-            else
-                attributeMap()->setIdForStyleResolution(attr->value());
-        }
-        setNeedsStyleRecalc();
-    } else if (attr->name() == classAttr)
+    if (isIdAttributeName(attr->name()))
+        idAttributeChanged(attr);
+    else if (attr->name() == classAttr)
         classAttributeChanged(attr->value());
     else if (attr->name() == styleAttr) {
         if (attr->isNull())
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 5a28e37..906e421 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -292,7 +292,7 @@ void Text::recalcStyle(StyleChange change)
     clearNeedsStyleRecalc();
 }
 
-bool Text::childTypeAllowed(NodeType)
+bool Text::childTypeAllowed(NodeType) const
 {
     return false;
 }
diff --git a/Source/WebCore/dom/Text.h b/Source/WebCore/dom/Text.h
index f693f3b..5995f1f 100644
--- a/Source/WebCore/dom/Text.h
+++ b/Source/WebCore/dom/Text.h
@@ -56,7 +56,7 @@ private:
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void recalcStyle(StyleChange = NoChange);
-    virtual bool childTypeAllowed(NodeType);
+    virtual bool childTypeAllowed(NodeType) const;
 
     virtual PassRefPtr<Text> virtualCreate(const String&);
 
diff --git a/Source/WebCore/dom/TreeScope.cpp b/Source/WebCore/dom/TreeScope.cpp
new file mode 100644
index 0000000..a995a2d
--- /dev/null
+++ b/Source/WebCore/dom/TreeScope.cpp
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2011 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TreeScope.h"
+
+#include "Element.h"
+#include "HTMLAnchorElement.h"
+#include "HTMLMapElement.h"
+#include "HTMLNames.h"
+#include "NodeRareData.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+TreeScope::TreeScope(Document* document, ConstructionType constructionType)
+    : ContainerNode(0, constructionType)
+    , m_parentTreeScope(0)
+    , m_accessKeyMapValid(false)
+    , m_numNodeListCaches(0)
+{
+    m_document = document;
+    if (document != this) {
+        // Assume document as parent scope
+        m_parentTreeScope = document;
+        // FIXME: This branch should be inert until shadow scopes are landed.
+        ASSERT_NOT_REACHED();
+    }
+}
+
+TreeScope::~TreeScope()
+{
+    if (hasRareData())
+        rareData()->setTreeScope(0);
+}
+
+void TreeScope::destroyTreeScopeData()
+{
+    m_elementsById.clear();
+    m_imageMapsByName.clear();
+    m_elementsByAccessKey.clear();
+}
+
+void TreeScope::setParentTreeScope(TreeScope* newParentScope)
+{
+    // A document node cannot be re-parented.
+    ASSERT(!isDocumentNode());
+    // Every scope other than document needs a parent scope.
+    ASSERT(m_parentTreeScope);
+    ASSERT(newParentScope);
+
+    m_parentTreeScope = newParentScope;
+}
+
+Element* TreeScope::getElementById(const AtomicString& elementId) const
+{
+    if (elementId.isEmpty())
+        return 0;
+    return m_elementsById.getElementById(elementId.impl(), this);
+}
+
+void TreeScope::addElementById(const AtomicString& elementId, Element* element)
+{
+    m_elementsById.add(elementId.impl(), element);
+}
+
+void TreeScope::removeElementById(const AtomicString& elementId, Element* element)
+{
+    m_elementsById.remove(elementId.impl(), element);
+}
+
+Element* TreeScope::getElementByAccessKey(const String& key) const
+{
+    if (key.isEmpty())
+        return 0;
+    if (!m_accessKeyMapValid) {
+        for (Node* n = firstChild(); n; n = n->traverseNextNode()) {
+            if (!n->isElementNode())
+                continue;
+            Element* element = static_cast<Element*>(n);
+            const AtomicString& accessKey = element->getAttribute(accesskeyAttr);
+            if (!accessKey.isEmpty())
+                m_elementsByAccessKey.set(accessKey.impl(), element);
+        }
+        m_accessKeyMapValid = true;
+    }
+    return m_elementsByAccessKey.get(key.impl());
+}
+
+void TreeScope::invalidateAccessKeyMap()
+{
+    m_accessKeyMapValid = false;
+    m_elementsByAccessKey.clear();
+}
+
+void TreeScope::addImageMap(HTMLMapElement* imageMap)
+{
+    AtomicStringImpl* name = imageMap->getName().impl();
+    if (!name)
+        return;
+    m_imageMapsByName.add(name, imageMap);
+}
+
+void TreeScope::removeImageMap(HTMLMapElement* imageMap)
+{
+    AtomicStringImpl* name = imageMap->getName().impl();
+    if (!name)
+        return;
+    m_imageMapsByName.remove(name, imageMap);
+}
+
+HTMLMapElement* TreeScope::getImageMap(const String& url) const
+{
+    if (url.isNull())
+        return 0;
+    size_t hashPos = url.find('#');
+    String name = (hashPos == notFound ? url : url.substring(hashPos + 1)).impl();
+    if (document()->isHTMLDocument())
+        return static_cast<HTMLMapElement*>(m_imageMapsByName.getElementByLowercasedMapName(AtomicString(name.lower()).impl(), this));
+    return static_cast<HTMLMapElement*>(m_imageMapsByName.getElementByMapName(AtomicString(name).impl(), this));
+}
+
+Element* TreeScope::findAnchor(const String& name)
+{
+    if (name.isEmpty())
+        return 0;
+    if (Element* element = getElementById(name))
+        return element;
+    for (Node* node = this; node; node = node->traverseNextNode()) {
+        if (node->hasTagName(aTag)) {
+            HTMLAnchorElement* anchor = static_cast<HTMLAnchorElement*>(node);
+            if (document()->inQuirksMode()) {
+                // Quirks mode, case insensitive comparison of names.
+                if (equalIgnoringCase(anchor->name(), name))
+                    return anchor;
+            } else {
+                // Strict mode, names need to match exactly.
+                if (anchor->name() == name)
+                    return anchor;
+            }
+        }
+    }
+    return 0;
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/dom/TreeScope.h b/Source/WebCore/dom/TreeScope.h
new file mode 100644
index 0000000..6271541
--- /dev/null
+++ b/Source/WebCore/dom/TreeScope.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2011 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TreeScope_h
+#define TreeScope_h
+
+#include "ContainerNode.h"
+#include "DocumentOrderedMap.h"
+
+namespace WebCore {
+
+class Element;
+class HTMLMapElement;
+
+class TreeScope : public ContainerNode {
+    friend class Document;
+
+public:
+    TreeScope* parentTreeScope() const { return m_parentTreeScope; }
+
+    Element* getElementById(const AtomicString&) const;
+    bool hasElementWithId(AtomicStringImpl* id) const;
+    bool containsMultipleElementsWithId(const AtomicString& id) const;
+    void addElementById(const AtomicString& elementId, Element*);
+    void removeElementById(const AtomicString& elementId, Element*);
+
+    void addImageMap(HTMLMapElement*);
+    void removeImageMap(HTMLMapElement*);
+    HTMLMapElement* getImageMap(const String& url) const;
+
+    Element* getElementByAccessKey(const String& key) const;
+    void invalidateAccessKeyMap();
+
+    void addNodeListCache() { ++m_numNodeListCaches; }
+    void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
+    bool hasNodeListCaches() const { return m_numNodeListCaches; }
+
+    // Find first anchor with the given name.
+    // First searches for an element with the given ID, but if that fails, then looks
+    // for an anchor with the given name. ID matching is always case sensitive, but
+    // Anchor name matching is case sensitive in strict mode and not case sensitive in
+    // quirks mode for historical compatibility reasons.
+    Element* findAnchor(const String& name);
+
+protected:
+    TreeScope(Document*, ConstructionType = CreateContainer);
+
+    virtual ~TreeScope();
+
+    void destroyTreeScopeData();
+
+    void setParentTreeScope(TreeScope*);
+
+private:
+    TreeScope* m_parentTreeScope;
+
+    DocumentOrderedMap m_elementsById;
+    DocumentOrderedMap m_imageMapsByName;
+
+    mutable HashMap<StringImpl*, Element*, CaseFoldingHash> m_elementsByAccessKey;    
+    mutable bool m_accessKeyMapValid;
+
+    unsigned m_numNodeListCaches;
+};
+
+inline bool TreeScope::hasElementWithId(AtomicStringImpl* id) const
+{
+    ASSERT(id);
+    return m_elementsById.contains(id);
+}
+
+inline bool TreeScope::containsMultipleElementsWithId(const AtomicString& id) const
+{
+    return m_elementsById.containsMultiple(id.impl());
+}
+
+} // namespace WebCore
+
+#endif // TreeScope_h
+
diff --git a/Source/WebCore/dom/WheelEvent.cpp b/Source/WebCore/dom/WheelEvent.cpp
index 0981a57..a673c93 100644
--- a/Source/WebCore/dom/WheelEvent.cpp
+++ b/Source/WebCore/dom/WheelEvent.cpp
@@ -23,7 +23,10 @@
 #include "config.h"
 #include "WheelEvent.h"
 
+#include "EventDispatcher.h"
 #include "EventNames.h"
+#include "PlatformWheelEvent.h"
+
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
@@ -92,4 +95,32 @@ bool WheelEvent::isWheelEvent() const
     return true;
 }
 
+inline static WheelEvent::Granularity granularity(const PlatformWheelEvent& event)
+{
+    return event.granularity() == ScrollByPageWheelEvent ? WheelEvent::Page : WheelEvent::Pixel;
+}
+
+WheelEventDispatchMediator::WheelEventDispatchMediator(const PlatformWheelEvent& event, PassRefPtr<AbstractView> view)
+{
+    if (!(event.deltaX() || event.deltaY()))
+        return;
+
+    setEvent(WheelEvent::create(event.wheelTicksX(), event.wheelTicksY(), event.deltaX(), event.deltaY(), granularity(event),
+        view, event.globalX(), event.globalY(), event.x(), event.y(), event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey()));
+
+}
+
+WheelEvent* WheelEventDispatchMediator::event() const
+{
+    return static_cast<WheelEvent*>(EventDispatchMediator::event());
+}
+
+bool WheelEventDispatchMediator::dispatchEvent(EventDispatcher* dispatcher) const
+{
+    if (!event())
+        return true;
+
+    return EventDispatchMediator::dispatchEvent(dispatcher) && !event()->defaultHandled();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/WheelEvent.h b/Source/WebCore/dom/WheelEvent.h
index b085e86..5f0d569 100644
--- a/Source/WebCore/dom/WheelEvent.h
+++ b/Source/WebCore/dom/WheelEvent.h
@@ -82,6 +82,15 @@ namespace WebCore {
         Granularity m_granularity;
     };
 
+class WheelEventDispatchMediator : public EventDispatchMediator {
+public:
+    WheelEventDispatchMediator(const PlatformWheelEvent&, PassRefPtr<AbstractView>);
+
+private:
+    WheelEvent* event() const;
+    virtual bool dispatchEvent(EventDispatcher*) const;
+};
+
 } // namespace WebCore
 
 #endif // WheelEvent_h
diff --git a/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp b/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
index 9214391..85cf285 100644
--- a/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
+++ b/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
@@ -1341,25 +1341,21 @@ void XMLDocumentParser::doEnd()
 
 #if ENABLE(XSLT)
     XMLTreeViewer xmlTreeViewer(document());
-
     bool xmlViewerMode = !m_sawError && !m_sawCSS && !m_sawXSLTransform && xmlTreeViewer.hasNoStyleInformation();
+    if (xmlViewerMode)
+        xmlTreeViewer.transformDocumentToTreeView();
 
-    if (xmlViewerMode || m_sawXSLTransform) {
+    if (m_sawXSLTransform) {
         void* doc = xmlDocPtrForString(document()->cachedResourceLoader(), m_originalSourceForTransform, document()->url().string());
         document()->setTransformSource(new TransformSource(doc));
 
-        if (xmlViewerMode)
-            xmlTreeViewer.transformDocumentToTreeView();
-        else {
-            document()->setParsing(false); // Make the document think it's done, so it will apply XSL stylesheets.
-            document()->styleSelectorChanged(RecalcStyleImmediately);
-            document()->setParsing(true);
-        }
+        document()->setParsing(false); // Make the document think it's done, so it will apply XSL stylesheets.
+        document()->styleSelectorChanged(RecalcStyleImmediately);
+        document()->setParsing(true);
 
         DocumentParser::stopParsing();
     }
 #endif
-
 }
 
 #if ENABLE(XSLT)
diff --git a/Source/WebCore/dom/make_names.pl b/Source/WebCore/dom/make_names.pl
index 836137e..674831c 100755
--- a/Source/WebCore/dom/make_names.pl
+++ b/Source/WebCore/dom/make_names.pl
@@ -3,6 +3,7 @@
 # Copyright (C) 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
 # Copyright (C) 2009, Julien Chaffraix <jchaffraix@webkit.org>
 # Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+# Copyright (C) 2011 Ericsson AB. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -65,7 +66,7 @@ if ($ENV{CC}) {
 } else {
     $gccLocation = "/usr/bin/gcc";
 }
-my $preprocessor = $gccLocation . " -E -P -x c++";
+my $preprocessor = $gccLocation . " -E -x c++";
 
 GetOptions(
     'tags=s' => \$tagsFile, 
@@ -596,6 +597,10 @@ sub printJSElementIncludes
     for my $tagName (sort keys %enabledTags) {
         my $JSInterfaceName = $enabledTags{$tagName}{JSInterfaceName};
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
+        if ($enabledTags{$tagName}{conditional}) {
+            # We skip feature-define-specific #includes here since we handle them separately.
+            next;
+        }
         $tagsSeen{$JSInterfaceName} = 1;
 
         print F "#include \"${wrapperFactoryType}${JSInterfaceName}.h\"\n";
@@ -610,12 +615,54 @@ sub printElementIncludes
     for my $tagName (sort keys %enabledTags) {
         my $interfaceName = $enabledTags{$tagName}{interfaceName};
         next if defined($tagsSeen{$interfaceName});
+        if ($enabledTags{$tagName}{conditional}) {
+            # We skip feature-define-specific #includes here since we handle them separately.
+            next;
+        }
         $tagsSeen{$interfaceName} = 1;
 
         print F "#include \"${interfaceName}.h\"\n";
     }
 }
 
+sub printConditionalElementIncludes
+{
+    my ($F, $wrapperFactoryType) = @_;
+
+    my %conditionals;
+    my %unconditionalElementIncludes;
+    my %unconditionalJSElementIncludes;
+
+    for my $tagName (keys %enabledTags) {
+        my $conditional = $enabledTags{$tagName}{conditional};
+        my $interfaceName = $enabledTags{$tagName}{interfaceName};
+        my $JSInterfaceName = $enabledTags{$tagName}{JSInterfaceName};
+
+        if ($conditional) {
+            $conditionals{$conditional}{interfaceNames}{$interfaceName} = 1;
+            $conditionals{$conditional}{JSInterfaceNames}{$JSInterfaceName} = 1;
+        } else {
+            $unconditionalElementIncludes{$interfaceName} = 1;
+            $unconditionalJSElementIncludes{$JSInterfaceName} = 1;
+        }
+    }
+
+    for my $conditional (sort keys %conditionals) {
+        print F "\n#if ENABLE($conditional)\n";
+        for my $interfaceName (sort keys %{$conditionals{$conditional}{interfaceNames}}) {
+            next if $unconditionalElementIncludes{$interfaceName};
+            print F "#include \"$interfaceName.h\"\n";
+        }
+        if ($wrapperFactoryType) {
+            for my $JSInterfaceName (sort keys %{$conditionals{$conditional}{JSInterfaceNames}}) {
+                next if $unconditionalJSElementIncludes{$JSInterfaceName};
+                print F "#include \"$wrapperFactoryType$JSInterfaceName.h\"\n";
+            }
+        }
+        print F "#endif\n";
+    }
+}
+
 sub printDefinitions
 {
     my ($F, $namesRef, $type, $namespaceURI) = @_;
@@ -661,8 +708,11 @@ END
 
 printElementIncludes($F);
 
+print F "\n#include <wtf/HashMap.h>\n";
+
+printConditionalElementIncludes($F);
+
 print F <<END
-#include <wtf/HashMap.h>
 
 #if ENABLE(DASHBOARD_SUPPORT) || ENABLE(VIDEO)
 #include "Document.h"
@@ -922,8 +972,11 @@ sub printWrapperFactoryCppFile
 
     printElementIncludes($F);
 
+    print F "\n#include <wtf/StdLibExtras.h>\n";
+
+    printConditionalElementIncludes($F, $wrapperFactoryType);
+
     print F <<END
-#include <wtf/StdLibExtras.h>
 
 #if ENABLE(VIDEO)
 #include "Document.h"
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index 59540ec..c9649d0 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -54,242 +54,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static RGBA32 getRGBAFontColor(CSSStyleDeclaration* style)
-{
-    RefPtr<CSSValue> colorValue = style->getPropertyCSSValue(CSSPropertyColor);
-    if (!colorValue || !colorValue->isPrimitiveValue())
-        return Color::transparent;
-
-    CSSPrimitiveValue* primitiveColor = static_cast<CSSPrimitiveValue*>(colorValue.get());
-    RGBA32 rgba = 0;
-    if (primitiveColor->primitiveType() != CSSPrimitiveValue::CSS_RGBCOLOR) {
-        CSSParser::parseColor(rgba, colorValue->cssText());
-        // Need to take care of named color such as green and black
-        // This code should be removed after https://bugs.webkit.org/show_bug.cgi?id=28282 is fixed.
-    } else
-        rgba = primitiveColor->getRGBA32Value();
-
-    return rgba;
-}
-
-class StyleChange {
-public:
-    StyleChange(EditingStyle*, const Position&);
-
-    String cssStyle() const { return m_cssStyle; }
-    bool applyBold() const { return m_applyBold; }
-    bool applyItalic() const { return m_applyItalic; }
-    bool applyUnderline() const { return m_applyUnderline; }
-    bool applyLineThrough() const { return m_applyLineThrough; }
-    bool applySubscript() const { return m_applySubscript; }
-    bool applySuperscript() const { return m_applySuperscript; }
-    bool applyFontColor() const { return m_applyFontColor.length() > 0; }
-    bool applyFontFace() const { return m_applyFontFace.length() > 0; }
-    bool applyFontSize() const { return m_applyFontSize.length() > 0; }
-
-    String fontColor() { return m_applyFontColor; }
-    String fontFace() { return m_applyFontFace; }
-    String fontSize() { return m_applyFontSize; }
-
-    bool operator==(const StyleChange& other)
-    {
-        return m_cssStyle == other.m_cssStyle
-            && m_applyBold == other.m_applyBold
-            && m_applyItalic == other.m_applyItalic
-            && m_applyUnderline == other.m_applyUnderline
-            && m_applyLineThrough == other.m_applyLineThrough
-            && m_applySubscript == other.m_applySubscript
-            && m_applySuperscript == other.m_applySuperscript
-            && m_applyFontColor == other.m_applyFontColor
-            && m_applyFontFace == other.m_applyFontFace
-            && m_applyFontSize == other.m_applyFontSize;
-    }
-    bool operator!=(const StyleChange& other)
-    {
-        return !(*this == other);
-    }
-private:
-    void init(EditingStyle*, const Position&);
-    void reconcileTextDecorationProperties(CSSMutableStyleDeclaration*);
-    void extractTextStyles(Document*, CSSMutableStyleDeclaration*, bool shouldUseFixedFontDefaultSize);
-
-    String m_cssStyle;
-    bool m_applyBold;
-    bool m_applyItalic;
-    bool m_applyUnderline;
-    bool m_applyLineThrough;
-    bool m_applySubscript;
-    bool m_applySuperscript;
-    String m_applyFontColor;
-    String m_applyFontFace;
-    String m_applyFontSize;
-};
-
-
-StyleChange::StyleChange(EditingStyle* style, const Position& position)
-    : m_applyBold(false)
-    , m_applyItalic(false)
-    , m_applyUnderline(false)
-    , m_applyLineThrough(false)
-    , m_applySubscript(false)
-    , m_applySuperscript(false)
-{
-    init(style, position);
-}
-
-void StyleChange::init(EditingStyle* style, const Position& position)
-{
-    Document* document = position.anchorNode() ? position.anchorNode()->document() : 0;
-    if (!style || !style->style() || !document || !document->frame())
-        return;
-
-    RefPtr<CSSComputedStyleDeclaration> computedStyle = position.computedStyle();
-    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotIn(style->style(), computedStyle.get());
-
-    reconcileTextDecorationProperties(mutableStyle.get());
-    if (!document->frame()->editor()->shouldStyleWithCSS())
-        extractTextStyles(document, mutableStyle.get(), computedStyle->useFixedFontDefaultSize());
-
-    // Changing the whitespace style in a tab span would collapse the tab into a space.
-    if (isTabSpanTextNode(position.deprecatedNode()) || isTabSpanNode((position.deprecatedNode())))
-        mutableStyle->removeProperty(CSSPropertyWhiteSpace);
-
-    // If unicode-bidi is present in mutableStyle and direction is not, then add direction to mutableStyle.
-    // FIXME: Shouldn't this be done in getPropertiesNotIn?
-    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->style()->getPropertyCSSValue(CSSPropertyDirection))
-        mutableStyle->setProperty(CSSPropertyDirection, style->style()->getPropertyValue(CSSPropertyDirection));
-
-    // Save the result for later
-    m_cssStyle = mutableStyle->cssText().stripWhiteSpace();
-}
-
-void StyleChange::reconcileTextDecorationProperties(CSSMutableStyleDeclaration* style)
-{    
-    RefPtr<CSSValue> textDecorationsInEffect = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
-    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration);
-    // We shouldn't have both text-decoration and -webkit-text-decorations-in-effect because that wouldn't make sense.
-    ASSERT(!textDecorationsInEffect || !textDecoration);
-    if (textDecorationsInEffect) {
-        style->setProperty(CSSPropertyTextDecoration, textDecorationsInEffect->cssText());
-        style->removeProperty(CSSPropertyWebkitTextDecorationsInEffect);
-        textDecoration = textDecorationsInEffect;
-    }
-
-    // If text-decoration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
-    if (textDecoration && !textDecoration->isValueList())
-        style->removeProperty(CSSPropertyTextDecoration);
-}
-
-static int getIdentifierValue(CSSStyleDeclaration* style, int propertyID)
-{
-    if (!style)
-        return 0;
-
-    RefPtr<CSSValue> value = style->getPropertyCSSValue(propertyID);
-    if (!value || !value->isPrimitiveValue())
-        return 0;
-
-    return static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
-}
-
-static void setTextDecorationProperty(CSSMutableStyleDeclaration* style, const CSSValueList* newTextDecoration, int propertyID)
-{
-    if (newTextDecoration->length())
-        style->setProperty(propertyID, newTextDecoration->cssText(), style->getPropertyPriority(propertyID));
-    else {
-        // text-decoration: none is redundant since it does not remove any text decorations.
-        ASSERT(!style->getPropertyPriority(propertyID));
-        style->removeProperty(propertyID);
-    }
-}
-
-static bool isCSSValueLength(CSSPrimitiveValue* value)
-{
-    return value->primitiveType() >= CSSPrimitiveValue::CSS_PX && value->primitiveType() <= CSSPrimitiveValue::CSS_PC;
-}
-
-int legacyFontSizeFromCSSValue(Document* document, CSSPrimitiveValue* value, bool shouldUseFixedFontDefaultSize, LegacyFontSizeMode mode)
-{
-    if (isCSSValueLength(value)) {
-        int pixelFontSize = value->getIntValue(CSSPrimitiveValue::CSS_PX);
-        int legacyFontSize = CSSStyleSelector::legacyFontSize(document, pixelFontSize, shouldUseFixedFontDefaultSize);
-        // Use legacy font size only if pixel value matches exactly to that of legacy font size.
-        int cssPrimitiveEquivalent = legacyFontSize - 1 + CSSValueXSmall;
-        if (mode == AlwaysUseLegacyFontSize || CSSStyleSelector::fontSizeForKeyword(document, cssPrimitiveEquivalent, shouldUseFixedFontDefaultSize) == pixelFontSize)
-            return legacyFontSize;
-
-        return 0;
-    }
-
-    if (CSSValueXSmall <= value->getIdent() && value->getIdent() <= CSSValueWebkitXxxLarge)
-        return value->getIdent() - CSSValueXSmall + 1;
-
-    return 0;
-}
-
-void StyleChange::extractTextStyles(Document* document, CSSMutableStyleDeclaration* style, bool shouldUseFixedFontDefaultSize)
-{
-    ASSERT(style);
-
-    if (getIdentifierValue(style, CSSPropertyFontWeight) == CSSValueBold) {
-        style->removeProperty(CSSPropertyFontWeight);
-        m_applyBold = true;
-    }
-
-    int fontStyle = getIdentifierValue(style, CSSPropertyFontStyle);
-    if (fontStyle == CSSValueItalic || fontStyle == CSSValueOblique) {
-        style->removeProperty(CSSPropertyFontStyle);
-        m_applyItalic = true;
-    }
-
-    // Assuming reconcileTextDecorationProperties has been called, there should not be -webkit-text-decorations-in-effect
-    // Furthermore, text-decoration: none has been trimmed so that text-decoration property is always a CSSValueList.
-    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration);
-    if (textDecoration && textDecoration->isValueList()) {
-        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, underline, (CSSPrimitiveValue::createIdentifier(CSSValueUnderline)));
-        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, lineThrough, (CSSPrimitiveValue::createIdentifier(CSSValueLineThrough)));
-
-        RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
-        if (newTextDecoration->removeAll(underline.get()))
-            m_applyUnderline = true;
-        if (newTextDecoration->removeAll(lineThrough.get()))
-            m_applyLineThrough = true;
-
-        // If trimTextDecorations, delete underline and line-through
-        setTextDecorationProperty(style, newTextDecoration.get(), CSSPropertyTextDecoration);
-    }
-
-    int verticalAlign = getIdentifierValue(style, CSSPropertyVerticalAlign);
-    switch (verticalAlign) {
-    case CSSValueSub:
-        style->removeProperty(CSSPropertyVerticalAlign);
-        m_applySubscript = true;
-        break;
-    case CSSValueSuper:
-        style->removeProperty(CSSPropertyVerticalAlign);
-        m_applySuperscript = true;
-        break;
-    }
-
-    if (style->getPropertyCSSValue(CSSPropertyColor)) {
-        m_applyFontColor = Color(getRGBAFontColor(style)).serialized();
-        style->removeProperty(CSSPropertyColor);
-    }
-
-    m_applyFontFace = style->getPropertyValue(CSSPropertyFontFamily);
-    style->removeProperty(CSSPropertyFontFamily);
-
-    if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
-        if (!fontSize->isPrimitiveValue())
-            style->removeProperty(CSSPropertyFontSize); // Can't make sense of the number. Put no font size.
-        else if (int legacyFontSize = legacyFontSizeFromCSSValue(document, static_cast<CSSPrimitiveValue*>(fontSize.get()),
-                shouldUseFixedFontDefaultSize, UseLegacyFontSizeOnlyIfPixelValuesMatch)) {
-            m_applyFontSize = String::number(legacyFontSize);
-            style->removeProperty(CSSPropertyFontSize);
-        }
-    }
-}
-
 static String& styleSpanClassString()
 {
     DEFINE_STATIC_LOCAL(String, styleSpanClassString, ((AppleStyleSpanClass)));
@@ -354,95 +118,6 @@ PassRefPtr<HTMLElement> createStyleSpanElement(Document* document)
     return styleElement.release();
 }
 
-static void diffTextDecorations(CSSMutableStyleDeclaration* style, int propertID, CSSValue* refTextDecoration)
-{
-    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(propertID);
-    if (!textDecoration || !textDecoration->isValueList() || !refTextDecoration || !refTextDecoration->isValueList())
-        return;
-
-    RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
-    CSSValueList* valuesInRefTextDecoration = static_cast<CSSValueList*>(refTextDecoration);
-
-    for (size_t i = 0; i < valuesInRefTextDecoration->length(); i++)
-        newTextDecoration->removeAll(valuesInRefTextDecoration->item(i));
-
-    setTextDecorationProperty(style, newTextDecoration.get(), propertID);
-}
-
-static bool fontWeightIsBold(CSSStyleDeclaration* style)
-{
-    ASSERT(style);
-    RefPtr<CSSValue> fontWeight = style->getPropertyCSSValue(CSSPropertyFontWeight);
-
-    if (!fontWeight)
-        return false;
-    if (!fontWeight->isPrimitiveValue())
-        return false;
-
-    // Because b tag can only bold text, there are only two states in plain html: bold and not bold.
-    // Collapse all other values to either one of these two states for editing purposes.
-    switch (static_cast<CSSPrimitiveValue*>(fontWeight.get())->getIdent()) {
-        case CSSValue100:
-        case CSSValue200:
-        case CSSValue300:
-        case CSSValue400:
-        case CSSValue500:
-        case CSSValueNormal:
-            return false;
-        case CSSValueBold:
-        case CSSValue600:
-        case CSSValue700:
-        case CSSValue800:
-        case CSSValue900:
-            return true;
-    }
-
-    ASSERT_NOT_REACHED(); // For CSSValueBolder and CSSValueLighter
-    return false; // Make compiler happy
-}
-
-static int getTextAlignment(CSSStyleDeclaration* style)
-{
-    int textAlign = getIdentifierValue(style, CSSPropertyTextAlign);
-    switch (textAlign) {
-    case CSSValueCenter:
-    case CSSValueWebkitCenter:
-        return CSSValueCenter;
-    case CSSValueJustify:
-        return CSSValueJustify;
-    case CSSValueLeft:
-    case CSSValueWebkitLeft:
-        return CSSValueLeft;
-    case CSSValueRight:
-    case CSSValueWebkitRight:
-        return CSSValueRight;
-    }
-    return CSSValueInvalid;
-}
-
-RefPtr<CSSMutableStyleDeclaration> getPropertiesNotIn(CSSStyleDeclaration* styleWithRedundantProperties, CSSStyleDeclaration* baseStyle)
-{
-    ASSERT(styleWithRedundantProperties);
-    ASSERT(baseStyle);
-    RefPtr<CSSMutableStyleDeclaration> result = styleWithRedundantProperties->copy();
-    baseStyle->diff(result.get());
-
-    RefPtr<CSSValue> baseTextDecorationsInEffect = baseStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
-    diffTextDecorations(result.get(), CSSPropertyTextDecoration, baseTextDecorationsInEffect.get());
-    diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, baseTextDecorationsInEffect.get());
-
-    if (fontWeightIsBold(result.get()) == fontWeightIsBold(baseStyle))
-        result->removeProperty(CSSPropertyFontWeight);
-
-    if (getRGBAFontColor(result.get()) == getRGBAFontColor(baseStyle))
-        result->removeProperty(CSSPropertyColor);
-
-    if (getTextAlignment(result.get()) == getTextAlignment(baseStyle))
-        result->removeProperty(CSSPropertyTextAlign);        
-
-    return result;
-}
-
 ApplyStyleCommand::ApplyStyleCommand(Document* document, const EditingStyle* style, EditAction editingAction, EPropertyLevel propertyLevel)
     : CompositeEditCommand(document)
     , m_style(style->copy())
diff --git a/Source/WebCore/editing/ApplyStyleCommand.h b/Source/WebCore/editing/ApplyStyleCommand.h
index dc2217e..6953456 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.h
+++ b/Source/WebCore/editing/ApplyStyleCommand.h
@@ -34,7 +34,6 @@ namespace WebCore {
 
 class CSSPrimitiveValue;
 class EditingStyle;
-class HTMLElement;
 class StyleChange;
 
 enum ShouldIncludeTypingStyle {
@@ -130,11 +129,8 @@ private:
     IsInlineElementToRemoveFunction m_isInlineElementToRemoveFunction;
 };
 
-enum LegacyFontSizeMode { AlwaysUseLegacyFontSize, UseLegacyFontSizeOnlyIfPixelValuesMatch };
-int legacyFontSizeFromCSSValue(Document*, CSSPrimitiveValue*, bool shouldUseFixedFontDefaultSize, LegacyFontSizeMode);
 bool isStyleSpan(const Node*);
 PassRefPtr<HTMLElement> createStyleSpanElement(Document*);
-RefPtr<CSSMutableStyleDeclaration> getPropertiesNotIn(CSSStyleDeclaration* styleWithRedundantProperties, CSSStyleDeclaration* baseStyle);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index 2a69fb7..cf2959a 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -1217,23 +1217,27 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
 
 // Splits the tree parent by parent until we reach the specified ancestor. We use VisiblePositions
 // to determine if the split is necessary. Returns the last split node.
-PassRefPtr<Node> CompositeEditCommand::splitTreeToNode(Node* start, Node* end, bool splitAncestor)
+PassRefPtr<Node> CompositeEditCommand::splitTreeToNode(Node* start, Node* end, bool shouldSplitAncestor)
 {
+    ASSERT(start);
+    ASSERT(end);
     ASSERT(start != end);
 
     RefPtr<Node> node;
-    for (node = start; node && node->parentNode() != end; node = node->parentNode()) {
+    if (shouldSplitAncestor && end->parentNode())
+        end = end->parentNode();
+
+    RefPtr<Node> endNode = end;
+    for (node = start; node && node->parentNode() != endNode; node = node->parentNode()) {
         if (!node->parentNode()->isElementNode())
             break;
-        VisiblePosition positionInParent(firstPositionInNode(node->parentNode()), DOWNSTREAM);
-        VisiblePosition positionInNode(firstPositionInOrBeforeNode(node.get()), DOWNSTREAM);
+        // Do not split a node when doing so introduces an empty node.
+        VisiblePosition positionInParent = firstPositionInNode(node->parentNode());
+        VisiblePosition positionInNode = firstPositionInOrBeforeNode(node.get());
         if (positionInParent != positionInNode)
-            applyCommandToComposite(SplitElementCommand::create(static_cast<Element*>(node->parentNode()), node));
-    }
-    if (splitAncestor) {
-        splitElement(static_cast<Element*>(end), node);
-        return node->parentNode();
+            splitElement(static_cast<Element*>(node->parentNode()), node);
     }
+
     return node.release();
 }
 
diff --git a/Source/WebCore/editing/CorrectionPanelInfo.h b/Source/WebCore/editing/CorrectionPanelInfo.h
deleted file mode 100644
index 76099e1..0000000
--- a/Source/WebCore/editing/CorrectionPanelInfo.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef CorrectionPanelInfo_h
-#define CorrectionPanelInfo_h
-
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-// Some platforms provide UI for suggesting autocorrection.
-#define SUPPORT_AUTOCORRECTION_PANEL 1
-// Some platforms use spelling and autocorrection markers to provide visual cue.
-// On such platform, if word with marker is edited, we need to remove the marker.
-#define REMOVE_MARKERS_UPON_EDITING 1
-#else
-#define SUPPORT_AUTOCORRECTION_PANEL 0
-#define REMOVE_MARKERS_UPON_EDITING 0
-#endif // #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-
-#include "Range.h"
-
-namespace WebCore {
-
-struct CorrectionPanelInfo {
-    enum PanelType {
-        PanelTypeCorrection = 0,
-        PanelTypeReversion,
-        PanelTypeSpellingSuggestions
-    };
-
-    RefPtr<Range> rangeToBeReplaced;
-    String replacedString;
-    String replacementString;
-    PanelType panelType;
-    bool isActive;
-};
-
-enum ReasonForDismissingCorrectionPanel {
-    ReasonForDismissingCorrectionPanelCancelled = 0,
-    ReasonForDismissingCorrectionPanelIgnored,
-    ReasonForDismissingCorrectionPanelAccepted
-};
-} // namespace WebCore
-
-#endif // CorrectionPanelInfo_h
diff --git a/Source/WebCore/editing/DeleteButtonController.cpp b/Source/WebCore/editing/DeleteButtonController.cpp
index 332e68f..5e76c08 100644
--- a/Source/WebCore/editing/DeleteButtonController.cpp
+++ b/Source/WebCore/editing/DeleteButtonController.cpp
@@ -112,8 +112,12 @@ static bool isDeletableElement(const Node* node)
             return false;
 
         // Allow blocks that have background images
-        if (style->hasBackgroundImage() && style->backgroundImage()->canRender(1.0f))
-            return true;
+        if (style->hasBackgroundImage()) {
+            for (const FillLayer* background = style->backgroundLayers(); background; background = background->next()) {
+                if (background->image() && background->image()->canRender(1))
+                    return true;
+            }
+        }
 
         // Allow blocks with a minimum number of non-transparent borders
         unsigned visibleBorders = style->borderTop().isVisible() + style->borderBottom().isVisible() + style->borderLeft().isVisible() + style->borderRight().isVisible();
@@ -188,7 +192,7 @@ void DeleteButtonController::createDeletionUI()
     CSSMutableStyleDeclaration* style = container->getInlineStyleDecl();
     style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
     style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserModify, CSSValueNone);
+    style->setProperty(CSSPropertyWebkitUserModify, CSSValueReadOnly);
     style->setProperty(CSSPropertyVisibility, CSSValueHidden);
     style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
     style->setProperty(CSSPropertyCursor, CSSValueDefault);
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index cbebe54..529c71d 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -281,7 +281,7 @@ void DeleteSelectionCommand::saveTypingStyleState()
         return;
 
     // Figure out the typing style in effect before the delete is done.
-    m_typingStyle = EditingStyle::create(positionBeforeTabSpan(m_selectionToDelete.start()));
+    m_typingStyle = EditingStyle::create(m_selectionToDelete.start());
     m_typingStyle->removeStyleAddedByNode(enclosingAnchorElement(m_selectionToDelete.start()));
 
     // If we're deleting into a Mail blockquote, save the style at end() instead of start()
@@ -335,6 +335,15 @@ static void updatePositionForNodeRemoval(Node* node, Position& position)
     }
 }
 
+static Position firstEditablePositionInNode(Node* node)
+{
+    ASSERT(node);
+    Node* next = node;
+    while (next && !next->rendererIsEditable())
+        next = next->traverseNextNode(node);
+    return next ? firstPositionInOrBeforeNode(next) : Position();
+}
+
 void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
 {
     if (!node)
@@ -372,11 +381,14 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
             removeNode(remove);
         }
         
-        // make sure empty cell has some height
+        // Make sure empty cell has some height, if a placeholder can be inserted.
         updateLayout();
         RenderObject *r = node->renderer();
-        if (r && r->isTableCell() && toRenderTableCell(r)->contentHeight() <= 0)
-            insertBlockPlaceholder(firstPositionInNode(node.get()));
+        if (r && r->isTableCell() && toRenderTableCell(r)->contentHeight() <= 0) {
+            Position firstEditablePosition = firstEditablePositionInNode(node.get());
+            if (firstEditablePosition.isNotNull())
+                insertBlockPlaceholder(firstEditablePosition);
+        }
         return;
     }
     
diff --git a/Source/WebCore/editing/EditingAllInOne.cpp b/Source/WebCore/editing/EditingAllInOne.cpp
index e4e0bbb..f38cbe6 100644
--- a/Source/WebCore/editing/EditingAllInOne.cpp
+++ b/Source/WebCore/editing/EditingAllInOne.cpp
@@ -63,6 +63,7 @@
 #include <SetNodeAttributeCommand.cpp>
 #include <SmartReplace.cpp>
 #include <SmartReplaceCF.cpp>
+#include <SpellingCorrectionController.cpp>
 #include <SpellChecker.cpp>
 #include <SplitElementCommand.cpp>
 #include <SplitTextNodeCommand.cpp>
diff --git a/Source/WebCore/editing/EditingBehavior.h b/Source/WebCore/editing/EditingBehavior.h
index a367c52..4ee85f3 100644
--- a/Source/WebCore/editing/EditingBehavior.h
+++ b/Source/WebCore/editing/EditingBehavior.h
@@ -59,6 +59,10 @@ public:
 
     // On Mac, when processing a contextual click, the object being clicked upon should be selected.
     bool shouldSelectOnContextualMenuClick() const { return m_type == EditingMacBehavior; }
+    
+    // On Mac, when the web view loses focus, any active selection clears. On Windows, the selection
+    // should remain highlighted, just in an inactive state.
+    bool shouldClearSelectionWhenLosingWebPageFocus() const { return m_type == EditingMacBehavior; }
 
 private:
     EditingBehaviorType m_type;
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index 668c943..9509ead 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -30,6 +30,8 @@
 #include "ApplyStyleCommand.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
+#include "CSSParser.h"
+#include "CSSStyleSelector.h"
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
 #include "Frame.h"
@@ -87,6 +89,8 @@ static PassRefPtr<CSSMutableStyleDeclaration> editingStyleFromComputedStyle(Pass
     return copyEditingProperties(style.get());
 }
 
+static RefPtr<CSSMutableStyleDeclaration> getPropertiesNotIn(CSSStyleDeclaration* styleWithRedundantProperties, CSSStyleDeclaration* baseStyle);
+
 class HTMLElementEquivalent {
 public:
     static PassOwnPtr<HTMLElementEquivalent> create(CSSPropertyID propertyID, int primitiveValue, const QualifiedName& tagName)
@@ -300,6 +304,11 @@ EditingStyle::~EditingStyle()
 
 void EditingStyle::init(Node* node, PropertiesToInclude propertiesToInclude)
 {
+    if (isTabSpanTextNode(node))
+        node = tabSpanNode(node)->parentNode();
+    else if (isTabSpanNode(node))
+        node = node->parentNode();
+
     RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = computedStyle(node);
     m_mutableStyle = propertiesToInclude == AllProperties && computedStyleAtPosition ? computedStyleAtPosition->copy() : editingStyleFromComputedStyle(computedStyleAtPosition);
 
@@ -768,4 +777,270 @@ void EditingStyle::mergeStyle(CSSMutableStyleDeclaration* style)
     }
 }
 
+static void reconcileTextDecorationProperties(CSSMutableStyleDeclaration* style)
+{    
+    RefPtr<CSSValue> textDecorationsInEffect = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration);
+    // We shouldn't have both text-decoration and -webkit-text-decorations-in-effect because that wouldn't make sense.
+    ASSERT(!textDecorationsInEffect || !textDecoration);
+    if (textDecorationsInEffect) {
+        style->setProperty(CSSPropertyTextDecoration, textDecorationsInEffect->cssText());
+        style->removeProperty(CSSPropertyWebkitTextDecorationsInEffect);
+        textDecoration = textDecorationsInEffect;
+    }
+
+    // If text-decoration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
+    if (textDecoration && !textDecoration->isValueList())
+        style->removeProperty(CSSPropertyTextDecoration);
+}
+
+StyleChange::StyleChange(EditingStyle* style, const Position& position)
+    : m_applyBold(false)
+    , m_applyItalic(false)
+    , m_applyUnderline(false)
+    , m_applyLineThrough(false)
+    , m_applySubscript(false)
+    , m_applySuperscript(false)
+{
+    Document* document = position.anchorNode() ? position.anchorNode()->document() : 0;
+    if (!style || !style->style() || !document || !document->frame())
+        return;
+
+    RefPtr<CSSComputedStyleDeclaration> computedStyle = position.computedStyle();
+    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotIn(style->style(), computedStyle.get());
+
+    reconcileTextDecorationProperties(mutableStyle.get());
+    if (!document->frame()->editor()->shouldStyleWithCSS())
+        extractTextStyles(document, mutableStyle.get(), computedStyle->useFixedFontDefaultSize());
+
+    // Changing the whitespace style in a tab span would collapse the tab into a space.
+    if (isTabSpanTextNode(position.deprecatedNode()) || isTabSpanNode((position.deprecatedNode())))
+        mutableStyle->removeProperty(CSSPropertyWhiteSpace);
+
+    // If unicode-bidi is present in mutableStyle and direction is not, then add direction to mutableStyle.
+    // FIXME: Shouldn't this be done in getPropertiesNotIn?
+    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->style()->getPropertyCSSValue(CSSPropertyDirection))
+        mutableStyle->setProperty(CSSPropertyDirection, style->style()->getPropertyValue(CSSPropertyDirection));
+
+    // Save the result for later
+    m_cssStyle = mutableStyle->cssText().stripWhiteSpace();
+}
+
+static void setTextDecorationProperty(CSSMutableStyleDeclaration* style, const CSSValueList* newTextDecoration, int propertyID)
+{
+    if (newTextDecoration->length())
+        style->setProperty(propertyID, newTextDecoration->cssText(), style->getPropertyPriority(propertyID));
+    else {
+        // text-decoration: none is redundant since it does not remove any text decorations.
+        ASSERT(!style->getPropertyPriority(propertyID));
+        style->removeProperty(propertyID);
+    }
+}
+
+static RGBA32 getRGBAFontColor(CSSStyleDeclaration* style)
+{
+    RefPtr<CSSValue> colorValue = style->getPropertyCSSValue(CSSPropertyColor);
+    if (!colorValue || !colorValue->isPrimitiveValue())
+        return Color::transparent;
+
+    CSSPrimitiveValue* primitiveColor = static_cast<CSSPrimitiveValue*>(colorValue.get());
+    if (primitiveColor->primitiveType() == CSSPrimitiveValue::CSS_RGBCOLOR)
+        return primitiveColor->getRGBA32Value();
+
+    // Need to take care of named color such as green and black
+    // This code should be removed after https://bugs.webkit.org/show_bug.cgi?id=28282 is fixed.
+    RGBA32 rgba = 0;
+    CSSParser::parseColor(rgba, colorValue->cssText());
+    return rgba;
+}
+
+void StyleChange::extractTextStyles(Document* document, CSSMutableStyleDeclaration* style, bool shouldUseFixedFontDefaultSize)
+{
+    ASSERT(style);
+
+    if (getIdentifierValue(style, CSSPropertyFontWeight) == CSSValueBold) {
+        style->removeProperty(CSSPropertyFontWeight);
+        m_applyBold = true;
+    }
+
+    int fontStyle = getIdentifierValue(style, CSSPropertyFontStyle);
+    if (fontStyle == CSSValueItalic || fontStyle == CSSValueOblique) {
+        style->removeProperty(CSSPropertyFontStyle);
+        m_applyItalic = true;
+    }
+
+    // Assuming reconcileTextDecorationProperties has been called, there should not be -webkit-text-decorations-in-effect
+    // Furthermore, text-decoration: none has been trimmed so that text-decoration property is always a CSSValueList.
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration);
+    if (textDecoration && textDecoration->isValueList()) {
+        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, underline, (CSSPrimitiveValue::createIdentifier(CSSValueUnderline)));
+        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, lineThrough, (CSSPrimitiveValue::createIdentifier(CSSValueLineThrough)));
+
+        RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
+        if (newTextDecoration->removeAll(underline.get()))
+            m_applyUnderline = true;
+        if (newTextDecoration->removeAll(lineThrough.get()))
+            m_applyLineThrough = true;
+
+        // If trimTextDecorations, delete underline and line-through
+        setTextDecorationProperty(style, newTextDecoration.get(), CSSPropertyTextDecoration);
+    }
+
+    int verticalAlign = getIdentifierValue(style, CSSPropertyVerticalAlign);
+    switch (verticalAlign) {
+    case CSSValueSub:
+        style->removeProperty(CSSPropertyVerticalAlign);
+        m_applySubscript = true;
+        break;
+    case CSSValueSuper:
+        style->removeProperty(CSSPropertyVerticalAlign);
+        m_applySuperscript = true;
+        break;
+    }
+
+    if (style->getPropertyCSSValue(CSSPropertyColor)) {
+        m_applyFontColor = Color(getRGBAFontColor(style)).serialized();
+        style->removeProperty(CSSPropertyColor);
+    }
+
+    m_applyFontFace = style->getPropertyValue(CSSPropertyFontFamily);
+    style->removeProperty(CSSPropertyFontFamily);
+
+    if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
+        if (!fontSize->isPrimitiveValue())
+            style->removeProperty(CSSPropertyFontSize); // Can't make sense of the number. Put no font size.
+        else if (int legacyFontSize = legacyFontSizeFromCSSValue(document, static_cast<CSSPrimitiveValue*>(fontSize.get()),
+                shouldUseFixedFontDefaultSize, UseLegacyFontSizeOnlyIfPixelValuesMatch)) {
+            m_applyFontSize = String::number(legacyFontSize);
+            style->removeProperty(CSSPropertyFontSize);
+        }
+    }
+}
+
+static void diffTextDecorations(CSSMutableStyleDeclaration* style, int propertID, CSSValue* refTextDecoration)
+{
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(propertID);
+    if (!textDecoration || !textDecoration->isValueList() || !refTextDecoration || !refTextDecoration->isValueList())
+        return;
+
+    RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
+    CSSValueList* valuesInRefTextDecoration = static_cast<CSSValueList*>(refTextDecoration);
+
+    for (size_t i = 0; i < valuesInRefTextDecoration->length(); i++)
+        newTextDecoration->removeAll(valuesInRefTextDecoration->item(i));
+
+    setTextDecorationProperty(style, newTextDecoration.get(), propertID);
+}
+
+static bool fontWeightIsBold(CSSStyleDeclaration* style)
+{
+    ASSERT(style);
+    RefPtr<CSSValue> fontWeight = style->getPropertyCSSValue(CSSPropertyFontWeight);
+
+    if (!fontWeight)
+        return false;
+    if (!fontWeight->isPrimitiveValue())
+        return false;
+
+    // Because b tag can only bold text, there are only two states in plain html: bold and not bold.
+    // Collapse all other values to either one of these two states for editing purposes.
+    switch (static_cast<CSSPrimitiveValue*>(fontWeight.get())->getIdent()) {
+        case CSSValue100:
+        case CSSValue200:
+        case CSSValue300:
+        case CSSValue400:
+        case CSSValue500:
+        case CSSValueNormal:
+            return false;
+        case CSSValueBold:
+        case CSSValue600:
+        case CSSValue700:
+        case CSSValue800:
+        case CSSValue900:
+            return true;
+    }
+
+    ASSERT_NOT_REACHED(); // For CSSValueBolder and CSSValueLighter
+    return false; // Make compiler happy
+}
+
+static int getTextAlignment(CSSStyleDeclaration* style)
+{
+    int textAlign = getIdentifierValue(style, CSSPropertyTextAlign);
+    switch (textAlign) {
+    case CSSValueCenter:
+    case CSSValueWebkitCenter:
+        return CSSValueCenter;
+    case CSSValueJustify:
+        return CSSValueJustify;
+    case CSSValueLeft:
+    case CSSValueWebkitLeft:
+        return CSSValueLeft;
+    case CSSValueRight:
+    case CSSValueWebkitRight:
+        return CSSValueRight;
+    }
+    return CSSValueInvalid;
+}
+
+RefPtr<CSSMutableStyleDeclaration> getPropertiesNotIn(CSSStyleDeclaration* styleWithRedundantProperties, CSSStyleDeclaration* baseStyle)
+{
+    ASSERT(styleWithRedundantProperties);
+    ASSERT(baseStyle);
+    RefPtr<CSSMutableStyleDeclaration> result = styleWithRedundantProperties->copy();
+    baseStyle->diff(result.get());
+
+    RefPtr<CSSValue> baseTextDecorationsInEffect = baseStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    diffTextDecorations(result.get(), CSSPropertyTextDecoration, baseTextDecorationsInEffect.get());
+    diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, baseTextDecorationsInEffect.get());
+
+    if (fontWeightIsBold(result.get()) == fontWeightIsBold(baseStyle))
+        result->removeProperty(CSSPropertyFontWeight);
+
+    if (getRGBAFontColor(result.get()) == getRGBAFontColor(baseStyle))
+        result->removeProperty(CSSPropertyColor);
+
+    if (getTextAlignment(result.get()) == getTextAlignment(baseStyle))
+        result->removeProperty(CSSPropertyTextAlign);        
+
+    return result;
+}
+
+
+int getIdentifierValue(CSSStyleDeclaration* style, int propertyID)
+{
+    if (!style)
+        return 0;
+
+    RefPtr<CSSValue> value = style->getPropertyCSSValue(propertyID);
+    if (!value || !value->isPrimitiveValue())
+        return 0;
+
+    return static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
+}
+
+static bool isCSSValueLength(CSSPrimitiveValue* value)
+{
+    return value->primitiveType() >= CSSPrimitiveValue::CSS_PX && value->primitiveType() <= CSSPrimitiveValue::CSS_PC;
+}
+
+int legacyFontSizeFromCSSValue(Document* document, CSSPrimitiveValue* value, bool shouldUseFixedFontDefaultSize, LegacyFontSizeMode mode)
+{
+    if (isCSSValueLength(value)) {
+        int pixelFontSize = value->getIntValue(CSSPrimitiveValue::CSS_PX);
+        int legacyFontSize = CSSStyleSelector::legacyFontSize(document, pixelFontSize, shouldUseFixedFontDefaultSize);
+        // Use legacy font size only if pixel value matches exactly to that of legacy font size.
+        int cssPrimitiveEquivalent = legacyFontSize - 1 + CSSValueXSmall;
+        if (mode == AlwaysUseLegacyFontSize || CSSStyleSelector::fontSizeForKeyword(document, cssPrimitiveEquivalent, shouldUseFixedFontDefaultSize) == pixelFontSize)
+            return legacyFontSize;
+
+        return 0;
+    }
+
+    if (CSSValueXSmall <= value->getIdent() && value->getIdent() <= CSSValueWebkitXxxLarge)
+        return value->getIdent() - CSSValueXSmall + 1;
+
+    return 0;
+}
+
 }
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index 37bfea7..257a2f9 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -32,6 +32,7 @@
 #define EditingStyle_h
 
 #include "CSSPropertyNames.h"
+#include "PlatformString.h"
 #include "WritingDirection.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
@@ -43,6 +44,7 @@ namespace WebCore {
 class CSSStyleDeclaration;
 class CSSComputedStyleDeclaration;
 class CSSMutableStyleDeclaration;
+class CSSPrimitiveValue;
 class Document;
 class HTMLElement;
 class Node;
@@ -144,6 +146,62 @@ private:
     friend class HTMLAttributeEquivalent;
 };
 
+class StyleChange {
+public:
+    StyleChange(EditingStyle*, const Position&);
+
+    String cssStyle() const { return m_cssStyle; }
+    bool applyBold() const { return m_applyBold; }
+    bool applyItalic() const { return m_applyItalic; }
+    bool applyUnderline() const { return m_applyUnderline; }
+    bool applyLineThrough() const { return m_applyLineThrough; }
+    bool applySubscript() const { return m_applySubscript; }
+    bool applySuperscript() const { return m_applySuperscript; }
+    bool applyFontColor() const { return m_applyFontColor.length() > 0; }
+    bool applyFontFace() const { return m_applyFontFace.length() > 0; }
+    bool applyFontSize() const { return m_applyFontSize.length() > 0; }
+
+    String fontColor() { return m_applyFontColor; }
+    String fontFace() { return m_applyFontFace; }
+    String fontSize() { return m_applyFontSize; }
+
+    bool operator==(const StyleChange& other)
+    {
+        return m_cssStyle == other.m_cssStyle
+            && m_applyBold == other.m_applyBold
+            && m_applyItalic == other.m_applyItalic
+            && m_applyUnderline == other.m_applyUnderline
+            && m_applyLineThrough == other.m_applyLineThrough
+            && m_applySubscript == other.m_applySubscript
+            && m_applySuperscript == other.m_applySuperscript
+            && m_applyFontColor == other.m_applyFontColor
+            && m_applyFontFace == other.m_applyFontFace
+            && m_applyFontSize == other.m_applyFontSize;
+    }
+    bool operator!=(const StyleChange& other)
+    {
+        return !(*this == other);
+    }
+private:
+    void extractTextStyles(Document*, CSSMutableStyleDeclaration*, bool shouldUseFixedFontDefaultSize);
+
+    String m_cssStyle;
+    bool m_applyBold;
+    bool m_applyItalic;
+    bool m_applyUnderline;
+    bool m_applyLineThrough;
+    bool m_applySubscript;
+    bool m_applySuperscript;
+    String m_applyFontColor;
+    String m_applyFontFace;
+    String m_applyFontSize;
+};
+
+// FIXME: Remove these functions or make them non-global to discourage using CSSStyleDeclaration directly.
+int getIdentifierValue(CSSStyleDeclaration*, int propertyID);
+enum LegacyFontSizeMode { AlwaysUseLegacyFontSize, UseLegacyFontSizeOnlyIfPixelValuesMatch };
+int legacyFontSizeFromCSSValue(Document*, CSSPrimitiveValue*, bool shouldUseFixedFontDefaultSize, LegacyFontSizeMode);
+
 } // namespace WebCore
 
 #endif // EditingStyle_h
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index a793e0b..e7c5c1d 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -38,6 +38,7 @@
 #include "CachedResourceLoader.h"
 #include "ClipboardEvent.h"
 #include "CompositionEvent.h"
+#include "SpellingCorrectionController.h"
 #include "CreateLinkCommand.h"
 #include "DeleteButtonController.h"
 #include "DeleteSelectionCommand.h"
@@ -64,7 +65,6 @@
 #include "NodeList.h"
 #include "Page.h"
 #include "Pasteboard.h"
-#include "TextCheckerClient.h"
 #include "TextCheckingHelper.h"
 #include "RemoveFormatCommand.h"
 #include "RenderBlock.h"
@@ -94,35 +94,6 @@ using namespace HTMLNames;
 using namespace WTF;
 using namespace Unicode;
 
-static inline bool isAmbiguousBoundaryCharacter(UChar character)
-{
-    // These are characters that can behave as word boundaries, but can appear within words.
-    // If they are just typed, i.e. if they are immediately followed by a caret, we want to delay text checking until the next character has been typed.
-    // FIXME: this is required until 6853027 is fixed and text checking can do this for us.
-    return character == '\'' || character == rightSingleQuotationMark || character == hebrewPunctuationGershayim;
-}
-
-static const Vector<DocumentMarker::MarkerType>& markerTypesForAutocorrection()
-{
-    DEFINE_STATIC_LOCAL(Vector<DocumentMarker::MarkerType>, markerTypesForAutoCorrection, ());
-    if (markerTypesForAutoCorrection.isEmpty()) {
-        markerTypesForAutoCorrection.append(DocumentMarker::Replacement);
-        markerTypesForAutoCorrection.append(DocumentMarker::CorrectionIndicator);
-        markerTypesForAutoCorrection.append(DocumentMarker::SpellCheckingExemption);
-    }
-    return markerTypesForAutoCorrection;
-}
-
-static const Vector<DocumentMarker::MarkerType>& markerTypesForReplacement()
-{
-    DEFINE_STATIC_LOCAL(Vector<DocumentMarker::MarkerType>, markerTypesForReplacement, ());
-    if (markerTypesForReplacement.isEmpty()) {
-        markerTypesForReplacement.append(DocumentMarker::Replacement);
-        markerTypesForReplacement.append(DocumentMarker::SpellCheckingExemption);
-    }
-    return markerTypesForReplacement;
-}
-
 // When an event handler has moved the selection outside of a text control
 // we should use the target control's selection for this editing operation.
 VisibleSelection Editor::selectionForCommand(Event* event)
@@ -210,7 +181,7 @@ bool Editor::handleTextEvent(TextEvent* event)
 
 bool Editor::canEdit() const
 {
-    return m_frame->selection()->isContentEditable();
+    return m_frame->selection()->rootEditableElement();
 }
 
 bool Editor::canEditRichly() const
@@ -278,7 +249,7 @@ bool Editor::canPaste() const
 bool Editor::canDelete() const
 {
     SelectionController* selection = m_frame->selection();
-    return selection->isRange() && selection->isContentEditable();
+    return selection->isRange() && selection->rootEditableElement();
 }
 
 bool Editor::canDeleteRange(Range* range) const
@@ -324,7 +295,7 @@ bool Editor::deleteWithDirection(SelectionDirection direction, TextGranularity g
 
     if (m_frame->selection()->isRange()) {
         if (isTypingAction) {
-            TypingCommand::deleteKeyPressed(m_frame->document(), canSmartCopyOrDelete(), granularity);
+            TypingCommand::deleteKeyPressed(m_frame->document(), canSmartCopyOrDelete() ? TypingCommand::SmartDelete : 0, granularity);
             revealSelectionAfterEditingOperation();
         } else {
             if (killRing)
@@ -333,14 +304,19 @@ bool Editor::deleteWithDirection(SelectionDirection direction, TextGranularity g
             // Implicitly calls revealSelectionAfterEditingOperation().
         }
     } else {
+        TypingCommand::Options options = 0;
+        if (canSmartCopyOrDelete())
+            options |= TypingCommand::SmartDelete;
+        if (killRing)
+            options |= TypingCommand::KillRing;
         switch (direction) {
         case DirectionForward:
         case DirectionRight:
-            TypingCommand::forwardDeleteKeyPressed(m_frame->document(), canSmartCopyOrDelete(), granularity, killRing);
+            TypingCommand::forwardDeleteKeyPressed(m_frame->document(), options, granularity);
             break;
         case DirectionBackward:
         case DirectionLeft:
-            TypingCommand::deleteKeyPressed(m_frame->document(), canSmartCopyOrDelete(), granularity, killRing);
+            TypingCommand::deleteKeyPressed(m_frame->document(), options, granularity);
             break;
         }
         revealSelectionAfterEditingOperation();
@@ -440,7 +416,7 @@ void Editor::replaceSelectionWithFragment(PassRefPtr<DocumentFragment> fragment,
 
     Node* nodeToCheck = m_frame->selection()->rootEditableElement();
     if (m_spellChecker->canCheckAsynchronously(nodeToCheck))
-        m_spellChecker->requestCheckingFor(nodeToCheck);
+        m_spellChecker->requestCheckingFor(textCheckingTypeMaskFor(MarkSpelling | MarkGrammar), nodeToCheck);
 }
 
 void Editor::replaceSelectionWithText(const String& text, bool selectReplacement, bool smartReplace)
@@ -518,48 +494,7 @@ void Editor::respondToChangedSelection(const VisibleSelection& oldSelection)
     if (client())
         client()->respondToChangedSelection();
     m_deleteButtonController->respondToChangedSelection(oldSelection);
-
-#if SUPPORT_AUTOCORRECTION_PANEL
-    VisibleSelection currentSelection(frame()->selection()->selection());
-    // When user moves caret to the end of autocorrected word and pauses, we show the panel
-    // containing the original pre-correction word so that user can quickly revert the
-    // undesired autocorrection. Here, we start correction panel timer once we confirm that
-    // the new caret position is at the end of a word.
-    if (!currentSelection.isCaret() || currentSelection == oldSelection)
-        return;
-
-    VisiblePosition selectionPosition = currentSelection.start();
-    VisiblePosition endPositionOfWord = endOfWord(selectionPosition, LeftWordIfOnBoundary);
-    if (selectionPosition != endPositionOfWord)
-        return;
-
-    Position position = endPositionOfWord.deepEquivalent();
-    if (position.anchorType() != Position::PositionIsOffsetInAnchor)
-        return;
-
-    Node* node = position.containerNode();
-    int endOffset = position.offsetInContainerNode();
-    Vector<DocumentMarker> markers = node->document()->markers()->markersForNode(node);
-    size_t markerCount = markers.size();
-    for (size_t i = 0; i < markerCount; ++i) {
-        const DocumentMarker& marker = markers[i];
-        if (((marker.type == DocumentMarker::Replacement && !marker.description.isNull()) || marker.type == DocumentMarker::Spelling) && static_cast<int>(marker.endOffset) == endOffset) {
-            RefPtr<Range> wordRange = Range::create(frame()->document(), node, marker.startOffset, node, marker.endOffset);
-            String currentWord = plainText(wordRange.get());
-            if (currentWord.length()) {
-                m_correctionPanelInfo.rangeToBeReplaced = wordRange;
-                m_correctionPanelInfo.replacedString = currentWord;
-                if (marker.type == DocumentMarker::Spelling)
-                    startCorrectionPanelTimer(CorrectionPanelInfo::PanelTypeSpellingSuggestions);
-                else {
-                    m_correctionPanelInfo.replacementString = marker.description;
-                    startCorrectionPanelTimer(CorrectionPanelInfo::PanelTypeReversion);
-                }
-            }
-            break;
-        }
-    }
-#endif // SUPPORT_AUTOCORRECTION_PANEL
+    m_spellingCorrector->respondToChangedSelection(oldSelection);
 }
 
 void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
@@ -570,9 +505,7 @@ void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
             m_frame->document()->axObjectCache()->postNotification(node->renderer(), AXObjectCache::AXValueChanged, false);
     }
 
-#if REMOVE_MARKERS_UPON_EDITING
-    removeSpellAndCorrectionMarkersFromWordsToBeEdited(true);
-#endif
+    updateMarkersForWordsAffectedByEditing(true);
 
     if (client())
         client()->respondToChangedContents();
@@ -983,7 +916,7 @@ TriState Editor::selectionHasStyle(int propertyID, const String& value) const
     return state;
 }
 
-static bool hasTransparentBackgroundColor(CSSStyleDeclaration* style)
+bool Editor::hasTransparentBackgroundColor(CSSStyleDeclaration* style)
 {
     RefPtr<CSSValue> cssValue = style->getPropertyCSSValue(CSSPropertyBackgroundColor);
     if (!cssValue)
@@ -1059,10 +992,7 @@ void Editor::appliedEditing(PassRefPtr<EditCommand> cmd)
     dispatchEditableContentChangedEvents(*cmd);
     VisibleSelection newSelection(cmd->endingSelection());
 
-#if SUPPORT_AUTOCORRECTION_PANEL
-    if (cmd->isTopLevelCommand() && !cmd->shouldRetainAutocorrectionIndicator())
-        m_frame->document()->markers()->removeMarkers(DocumentMarker::CorrectionIndicator);
-#endif
+    m_spellingCorrector->respondToAppliedEditing(cmd.get());
 
     // Don't clear the typing style with this selection change.  We do those things elsewhere if necessary.
     changeSelectionAfterCommand(newSelection, false, false);
@@ -1121,17 +1051,14 @@ Editor::Editor(Frame* frame)
     // This is off by default, since most editors want this behavior (this matches IE but not FF).
     , m_shouldStyleWithCSS(false)
     , m_killRing(adoptPtr(new KillRing))
-    , m_spellChecker(new SpellChecker(frame, frame->page() ? frame->page()->editorClient()->textChecker() : 0))
-    , m_correctionPanelTimer(this, &Editor::correctionPanelTimerFired)
+    , m_spellChecker(adoptPtr(new SpellChecker(frame, frame->page() ? frame->page()->editorClient()->textChecker() : 0)))
+    , m_spellingCorrector(adoptPtr(new SpellingCorrectionController(frame)))
     , m_areMarkedTextMatchesHighlighted(false)
 {
 }
 
 Editor::~Editor()
 {
-#if SUPPORT_AUTOCORRECTION_PANEL
-    dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
-#endif
 }
 
 void Editor::clear()
@@ -1164,10 +1091,8 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
     if (!shouldInsertText(text, range.get(), EditorInsertActionTyped))
         return true;
 
-#if REMOVE_MARKERS_UPON_EDITING
     if (!text.isEmpty())
-        removeSpellAndCorrectionMarkersFromWordsToBeEdited(isSpaceOrNewline(text[0]));
-#endif
+        updateMarkersForWordsAffectedByEditing(text[0]);
 
     bool shouldConsiderApplyingAutocorrection = false;
     if (text == " " || text == "\t")
@@ -1176,7 +1101,7 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
     if (text.length() == 1 && isPunct(text[0]) && !isAmbiguousBoundaryCharacter(text[0]))
         shouldConsiderApplyingAutocorrection = true;
 
-    bool autocorrectionWasApplied = shouldConsiderApplyingAutocorrection && applyAutocorrectionBeforeTypingIfAppropriate();
+    bool autocorrectionWasApplied = shouldConsiderApplyingAutocorrection && m_spellingCorrector->applyAutocorrectionBeforeTypingIfAppropriate();
 
     // Get the selection to use for the event that triggered this insertText.
     // If the event handler changed the selection, we may want to use a different selection
@@ -1187,7 +1112,7 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
             RefPtr<Document> document = selectionStart->document();
 
             // Insert the text
-            TypingCommand::TypingCommandOptions options = 0;
+            TypingCommand::Options options = 0;
             if (selectInsertedText)
                 options |= TypingCommand::SelectInsertedText;
             if (autocorrectionWasApplied)
@@ -1212,7 +1137,7 @@ bool Editor::insertLineBreak()
     if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
-    bool autocorrectionIsApplied = applyAutocorrectionBeforeTypingIfAppropriate();
+    bool autocorrectionIsApplied = m_spellingCorrector->applyAutocorrectionBeforeTypingIfAppropriate();
     TypingCommand::insertLineBreak(m_frame->document(), autocorrectionIsApplied ? TypingCommand::RetainAutocorrectionIndicator : 0);
     revealSelectionAfterEditingOperation();
 
@@ -1230,7 +1155,7 @@ bool Editor::insertParagraphSeparator()
     if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
-    bool autocorrectionIsApplied = applyAutocorrectionBeforeTypingIfAppropriate();
+    bool autocorrectionIsApplied = m_spellingCorrector->applyAutocorrectionBeforeTypingIfAppropriate();
     TypingCommand::insertParagraphSeparator(m_frame->document(), autocorrectionIsApplied ? TypingCommand::RetainAutocorrectionIndicator : 0);
     revealSelectionAfterEditingOperation();
 
@@ -1247,9 +1172,7 @@ void Editor::cut()
     }
     RefPtr<Range> selection = selectedRange();
     if (shouldDeleteRange(selection.get())) {
-#if REMOVE_MARKERS_UPON_EDITING
-        removeSpellAndCorrectionMarkersFromWordsToBeEdited(true);
-#endif
+        updateMarkersForWordsAffectedByEditing(true);
         if (isNodeInTextFormControl(m_frame->selection()->start().deprecatedNode()))
             Pasteboard::generalPasteboard()->writePlainText(selectedText());
         else
@@ -1288,9 +1211,7 @@ void Editor::paste()
         return; // DHTML did the whole operation
     if (!canPaste())
         return;
-#if REMOVE_MARKERS_UPON_EDITING
-    removeSpellAndCorrectionMarkersFromWordsToBeEdited(false);
-#endif
+    updateMarkersForWordsAffectedByEditing(false);
     CachedResourceLoader* loader = m_frame->document()->cachedResourceLoader();
     loader->setAllowStaleResources(true);
     if (m_frame->selection()->isContentRichlyEditable())
@@ -1306,9 +1227,7 @@ void Editor::pasteAsPlainText()
         return;
     if (!canPaste())
         return;
-#if REMOVE_MARKERS_UPON_EDITING
-    removeSpellAndCorrectionMarkersFromWordsToBeEdited(false);
-#endif
+    updateMarkersForWordsAffectedByEditing(false);
     pasteAsPlainTextWithPasteboard(Pasteboard::generalPasteboard());
 }
 
@@ -1461,7 +1380,7 @@ void Editor::toggleAutomaticTextReplacement()
 
 bool Editor::isAutomaticSpellingCorrectionEnabled()
 {
-    return client() && client()->isAutomaticSpellingCorrectionEnabled();
+    return m_spellingCorrector->isAutomaticSpellingCorrectionEnabled();
 }
 
 void Editor::toggleAutomaticSpellingCorrection()
@@ -1614,7 +1533,7 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
-        TypingCommand::deleteSelection(m_frame->document(), false);
+        TypingCommand::deleteSelection(m_frame->document(), 0);
 
     m_compositionNode = 0;
     m_customCompositionUnderlines.clear();
@@ -1682,13 +1601,13 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
-        TypingCommand::deleteSelection(m_frame->document(), false);
+        TypingCommand::deleteSelection(m_frame->document(), TypingCommand::PreventSpellChecking);
 
     m_compositionNode = 0;
     m_customCompositionUnderlines.clear();
 
     if (!text.isEmpty()) {
-        TypingCommand::insertText(m_frame->document(), text, true, TypingCommand::TextCompositionUpdate);
+        TypingCommand::insertText(m_frame->document(), text, TypingCommand::SelectInsertedText | TypingCommand::PreventSpellChecking, TypingCommand::TextCompositionUpdate);
 
         // Find out what node has the composition now.
         Position base = m_frame->selection()->base().downstream();
@@ -2050,39 +1969,24 @@ void Editor::markMisspellingsAndBadGrammar(const VisibleSelection &movingSelecti
         markBadGrammar(movingSelection);
 }
 
-void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping)
+void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping, bool doReplacement)
 {
 #if USE(UNIFIED_TEXT_CHECKING)
-#if SUPPORT_AUTOCORRECTION_PANEL
-    // Apply pending autocorrection before next round of spell checking.
-    bool doApplyCorrection = true;
-    VisiblePosition startOfSelection = selectionAfterTyping.visibleStart();
-    VisibleSelection currentWord = VisibleSelection(startOfWord(startOfSelection, LeftWordIfOnBoundary), endOfWord(startOfSelection, RightWordIfOnBoundary));
-    if (currentWord.visibleEnd() == startOfSelection) {
-        String wordText = plainText(currentWord.toNormalizedRange().get());
-        if (wordText.length() > 0 && isAmbiguousBoundaryCharacter(wordText[wordText.length() - 1]))
-            doApplyCorrection = false;
-    }
-    if (doApplyCorrection)
-        handleCorrectionPanelResult(dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanelAccepted));
-    else
-        m_correctionPanelInfo.rangeToBeReplaced.clear();
-#else
-    UNUSED_PARAM(selectionAfterTyping);
-#endif
+    m_spellingCorrector->applyPendingCorrection(selectionAfterTyping);
+
     TextCheckingOptions textCheckingOptions = 0;
     if (isContinuousSpellCheckingEnabled())
         textCheckingOptions |= MarkSpelling;
 
 #if USE(AUTOMATIC_TEXT_REPLACEMENT)
-    if (isAutomaticQuoteSubstitutionEnabled()
-        || isAutomaticLinkDetectionEnabled()
-        || isAutomaticDashSubstitutionEnabled()
-        || isAutomaticTextReplacementEnabled()
-        || ((textCheckingOptions & MarkSpelling) && isAutomaticSpellingCorrectionEnabled()))
+    if (doReplacement 
+        && (isAutomaticQuoteSubstitutionEnabled()
+            || isAutomaticLinkDetectionEnabled()
+            || isAutomaticDashSubstitutionEnabled()
+            || isAutomaticTextReplacementEnabled()
+            || ((textCheckingOptions & MarkSpelling) && isAutomaticSpellingCorrectionEnabled())))
         textCheckingOptions |= PerformReplacement;
 #endif
-
     if (!textCheckingOptions & (MarkSpelling | PerformReplacement))
         return;
 
@@ -2099,6 +2003,8 @@ void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart,
 
 #else
     UNUSED_PARAM(selectionAfterTyping);
+    UNUSED_PARAM(doReplacement);
+
     if (!isContinuousSpellCheckingEnabled())
         return;
 
@@ -2207,12 +2113,13 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 {
 #if USE(UNIFIED_TEXT_CHECKING)
     // There shouldn't be pending autocorrection at this moment.
-    ASSERT(!m_correctionPanelInfo.rangeToBeReplaced);
+    ASSERT(!m_spellingCorrector->hasPendingCorrection());
 
     bool shouldMarkSpelling = textCheckingOptions & MarkSpelling;
     bool shouldMarkGrammar = textCheckingOptions & MarkGrammar;
     bool shouldPerformReplacement = textCheckingOptions & PerformReplacement;
     bool shouldShowCorrectionPanel = textCheckingOptions & ShowCorrectionPanel;
+    bool shouldCheckForCorrection = shouldShowCorrectionPanel || (textCheckingOptions & CheckForCorrection);
 
     // This function is called with selections already expanded to word boundaries.
     ExceptionCode ec = 0;
@@ -2240,7 +2147,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
     if (shouldMarkGrammar ? (spellingParagraph.isRangeEmpty() && grammarParagraph.isEmpty()) : spellingParagraph.isEmpty())
         return;
 
-    if (shouldPerformReplacement || shouldMarkSpelling) {
+    if (shouldPerformReplacement || shouldMarkSpelling || shouldCheckForCorrection) {
         if (m_frame->selection()->selectionType() == VisibleSelection::CaretSelection) {
             // Attempt to save the caret position so we can restore it later if needed
             Position caretPosition = m_frame->selection()->end();
@@ -2257,38 +2164,17 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
     }
 
     Vector<TextCheckingResult> results;
-    uint64_t checkingTypes = 0;
-    if (shouldMarkSpelling)
-        checkingTypes |= TextCheckingTypeSpelling;
-    if (shouldMarkGrammar)
-        checkingTypes |= TextCheckingTypeGrammar;
-    if (shouldShowCorrectionPanel)
-        checkingTypes |= TextCheckingTypeCorrection;
-    if (shouldPerformReplacement) {
-#if USE(AUTOMATIC_TEXT_REPLACEMENT)
-        if (isAutomaticLinkDetectionEnabled())
-            checkingTypes |= TextCheckingTypeLink;
-        if (isAutomaticQuoteSubstitutionEnabled())
-            checkingTypes |= TextCheckingTypeQuote;
-        if (isAutomaticDashSubstitutionEnabled())
-            checkingTypes |= TextCheckingTypeDash;
-        if (isAutomaticTextReplacementEnabled())
-            checkingTypes |= TextCheckingTypeReplacement;
-        if (shouldMarkSpelling && isAutomaticSpellingCorrectionEnabled())
-            checkingTypes |= TextCheckingTypeCorrection;
-#endif
-    }
     if (shouldMarkGrammar)
-        textChecker()->checkTextOfParagraph(grammarParagraph.textCharacters(), grammarParagraph.textLength(), checkingTypes, results);
+        textChecker()->checkTextOfParagraph(grammarParagraph.textCharacters(), grammarParagraph.textLength(), 
+                                            textCheckingTypeMaskFor(textCheckingOptions), results);
     else
-        textChecker()->checkTextOfParagraph(spellingParagraph.textCharacters(), spellingParagraph.textLength(), checkingTypes, results);
+        textChecker()->checkTextOfParagraph(spellingParagraph.textCharacters(), spellingParagraph.textLength(), 
+                                            textCheckingTypeMaskFor(textCheckingOptions), results);
         
 
-#if SUPPORT_AUTOCORRECTION_PANEL
     // If this checking is only for showing correction panel, we shouldn't bother to mark misspellings.
     if (shouldShowCorrectionPanel)
         shouldMarkSpelling = false;
-#endif
 
     int offsetDueToReplacement = 0;
 
@@ -2307,10 +2193,8 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
         if (shouldMarkSpelling && result->type == TextCheckingTypeSpelling && resultLocation >= spellingParagraph.checkingStart() && resultLocation + resultLength <= spellingRangeEndOffset && !resultEndsAtAmbiguousBoundary) {
             ASSERT(resultLength > 0 && resultLocation >= 0);
             RefPtr<Range> misspellingRange = spellingParagraph.subrange(resultLocation, resultLength);
-#if SUPPORT_AUTOCORRECTION_PANEL
-            if (m_frame->document()->markers()->hasMarkers(misspellingRange.get(), DocumentMarker::SpellCheckingExemption))
+            if (!m_spellingCorrector->isSpellingMarkerAllowed(misspellingRange))
                 continue;
-#endif // SUPPORT_AUTOCORRECTION_PANEL
             misspellingRange->startContainer(ec)->document()->markers()->addMarker(misspellingRange.get(), DocumentMarker::Spelling);
         } else if (shouldMarkGrammar && result->type == TextCheckingTypeGrammar && grammarParagraph.checkingRangeCovers(resultLocation, resultLength)) {
             ASSERT(resultLength > 0 && resultLocation >= 0);
@@ -2322,7 +2206,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
                     grammarRange->startContainer(ec)->document()->markers()->addMarker(badGrammarRange.get(), DocumentMarker::Grammar, detail->userDescription);
                 }
             }
-        } else if ((shouldPerformReplacement || shouldShowCorrectionPanel) && resultLocation + resultLength <= spellingRangeEndOffset && resultLocation + resultLength >= spellingParagraph.checkingStart()
+        } else if (resultLocation + resultLength <= spellingRangeEndOffset && resultLocation + resultLength >= spellingParagraph.checkingStart()
                     && (result->type == TextCheckingTypeLink
                     || result->type == TextCheckingTypeQuote
                     || result->type == TextCheckingTypeDash
@@ -2348,45 +2232,33 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
             if (result->type == TextCheckingTypeLink && selectionOffset > resultLocation + resultLength + 1)
                 continue;
 
+            String replacedString;
+
             // Don't correct spelling in an already-corrected word.
             if (result->type == TextCheckingTypeCorrection) {
-                Node* node = rangeToReplace->startContainer();
-                int startOffset = rangeToReplace->startOffset();
-                int endOffset = startOffset + replacementLength;
-                Vector<DocumentMarker> markers = node->document()->markers()->markersForNode(node);
-                size_t markerCount = markers.size();
-                for (size_t i = 0; i < markerCount; ++i) {
-                    const DocumentMarker& marker = markers[i];
-                    if ((marker.type == DocumentMarker::Replacement || marker.type == DocumentMarker::RejectedCorrection) && static_cast<int>(marker.startOffset) < endOffset && static_cast<int>(marker.endOffset) > startOffset) {
-                        doReplacement = false;
-                        break;
-                    }
-                    if (static_cast<int>(marker.startOffset) >= endOffset)
-                        break;
-                }
+                replacedString = plainText(rangeToReplace.get());
+                DocumentMarkerController* markers = m_frame->document()->markers();
+                if (markers->hasMarkers(rangeToReplace.get(), DocumentMarker::Replacement)) {
+                    doReplacement = false;
+                    m_spellingCorrector->recordSpellcheckerResponseForModifiedCorrection(rangeToReplace.get(), replacedString, result->replacement);
+                } else if (markers->hasMarkers(rangeToReplace.get(), DocumentMarker::RejectedCorrection))
+                    doReplacement = false;
             }
 
-            if (!doReplacement)
+            if (!(shouldPerformReplacement || shouldShowCorrectionPanel) || !doReplacement)
                 continue;
 
-#if SUPPORT_AUTOCORRECTION_PANEL
             if (shouldShowCorrectionPanel) {
+                ASSERT(SUPPORT_AUTOCORRECTION_PANEL);
+                // shouldShowCorrectionPanel can be true only when the panel is available.
                 if (resultLocation + resultLength == spellingRangeEndOffset) {
                     // We only show the correction panel on the last word.
-                    FloatRect boundingBox = windowRectForRange(rangeToReplace.get());
-                    if (boundingBox.isEmpty())
-                        break;
-                    m_correctionPanelInfo.rangeToBeReplaced = rangeToReplace;
-                    m_correctionPanelInfo.replacedString = plainText(rangeToReplace.get());
-                    m_correctionPanelInfo.replacementString = result->replacement;
-                    m_correctionPanelInfo.isActive = true;
-                    client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, result->replacement, Vector<String>());
+                    m_spellingCorrector->show(rangeToReplace, result->replacement);
                     break;
                 }
                 // If this function is called for showing correction panel, we ignore other correction or replacement.
                 continue;
             }
-#endif
 
             if (selectionToReplace != m_frame->selection()->selection()) {
                 if (!m_frame->selection()->shouldChangeSelection(selectionToReplace))
@@ -2400,22 +2272,18 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
                 if (canEditRichly())
                     applyCommand(CreateLinkCommand::create(m_frame->document(), result->replacement));
             } else if (canEdit() && shouldInsertText(result->replacement, rangeToReplace.get(), EditorInsertActionTyped)) {
-                String replacedString;
                 if (result->type == TextCheckingTypeCorrection)
-                    replacedString = plainText(rangeToReplace.get());
-
-                bool useSpellingCorrectionCommand = false;
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-                if (result->type == TextCheckingTypeCorrection)
-                    useSpellingCorrectionCommand = true;
-#endif
-                if (useSpellingCorrectionCommand)
                     applyCommand(SpellingCorrectionCommand::create(rangeToReplace, result->replacement));
                 else {
                     m_frame->selection()->setSelection(selectionToReplace);
                     replaceSelectionWithText(result->replacement, false, false);
                 }
 
+                if (AXObjectCache::accessibilityEnabled()) {
+                    if (Element* root = m_frame->selection()->selection().rootEditableElement())
+                        m_frame->document()->axObjectCache()->postNotification(root->renderer(), AXObjectCache::AXAutocorrectionOccured, true);
+                }
+
                 selectionChanged = true;
                 offsetDueToReplacement += replacementLength - resultLength;
                 if (resultLocation < selectionOffset) {
@@ -2424,13 +2292,9 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
                         ambiguousBoundaryOffset = selectionOffset - 1;
                 }
 
-                if (result->type == TextCheckingTypeCorrection) {
-                    // Add a marker so that corrections can easily be undone and won't be re-corrected.
-                    RefPtr<Range> replacedRange = spellingParagraph.subrange(resultLocation, replacementLength);
-                    replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::Replacement, replacedString);
-                    replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::CorrectionIndicator);
-                    replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::SpellCheckingExemption);
-                }
+                // Add a marker so that corrections can easily be undone and won't be re-corrected.
+                if (result->type == TextCheckingTypeCorrection)
+                    m_spellingCorrector->markCorrection(spellingParagraph.subrange(resultLocation, replacementLength), replacedString);
             }
         }
     }
@@ -2467,17 +2331,12 @@ void Editor::changeBackToReplacedString(const String& replacedString)
     if (!shouldInsertText(replacedString, selection.get(), EditorInsertActionPasted))
         return;
     
-#if SUPPORT_AUTOCORRECTION_PANEL
-    String replacement = plainText(selection.get());
-    client()->recordAutocorrectionResponse(EditorClient::AutocorrectionReverted, replacedString, replacement);
-#endif
+    m_spellingCorrector->recordAutocorrectionResponseReversed(replacedString, selection);
     TextCheckingParagraph paragraph(selection);
     replaceSelectionWithText(replacedString, false, false);
     RefPtr<Range> changedRange = paragraph.subrange(paragraph.checkingStart(), replacedString.length());
     changedRange->startContainer()->document()->markers()->addMarker(changedRange.get(), DocumentMarker::Replacement, String());
-#if SUPPORT_AUTOCORRECTION_PANEL
-    changedRange->startContainer()->document()->markers()->addMarker(changedRange.get(), DocumentMarker::SpellCheckingExemption);
-#endif
+    m_spellingCorrector->markReversed(changedRange.get());
 #else
     ASSERT_NOT_REACHED();
     UNUSED_PARAM(replacedString);
@@ -2490,7 +2349,7 @@ void Editor::markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelec
 #if USE(UNIFIED_TEXT_CHECKING)
     if (!isContinuousSpellCheckingEnabled())
         return;
-    TextCheckingOptions textCheckingOptions = MarkSpelling;
+    TextCheckingOptions textCheckingOptions = MarkSpelling | CheckForCorrection;
     if (markGrammar && isGrammarCheckingEnabled())
         textCheckingOptions |= MarkGrammar;
     markAllMisspellingsAndBadGrammarInRanges(textCheckingOptions, spellingSelection.toNormalizedRange().get(), grammarSelection.toNormalizedRange().get());
@@ -2502,140 +2361,16 @@ void Editor::markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelec
 #endif
 }
 
-void Editor::correctionPanelTimerFired(Timer<Editor>*)
-{
-#if SUPPORT_AUTOCORRECTION_PANEL
-    m_correctionPanelIsDismissedByEditor = false;
-    switch (m_correctionPanelInfo.panelType) {
-    case CorrectionPanelInfo::PanelTypeCorrection: {
-        VisibleSelection selection(frame()->selection()->selection());
-        VisiblePosition start(selection.start(), selection.affinity());
-        VisiblePosition p = startOfWord(start, LeftWordIfOnBoundary);
-        VisibleSelection adjacentWords = VisibleSelection(p, start);
-        markAllMisspellingsAndBadGrammarInRanges(MarkSpelling | ShowCorrectionPanel, adjacentWords.toNormalizedRange().get(), 0);
-    }
-        break;
-    case CorrectionPanelInfo::PanelTypeReversion: {
-        m_correctionPanelInfo.isActive = true;
-        m_correctionPanelInfo.replacedString = plainText(m_correctionPanelInfo.rangeToBeReplaced.get());
-        FloatRect boundingBox = windowRectForRange(m_correctionPanelInfo.rangeToBeReplaced.get());
-        if (!boundingBox.isEmpty())
-            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, m_correctionPanelInfo.replacementString, Vector<String>());
-    }
-        break;
-    case CorrectionPanelInfo::PanelTypeSpellingSuggestions: {
-        if (plainText(m_correctionPanelInfo.rangeToBeReplaced.get()) != m_correctionPanelInfo.replacedString)
-            break;
-        String paragraphText = plainText(TextCheckingParagraph(m_correctionPanelInfo.rangeToBeReplaced).paragraphRange().get());
-        Vector<String> suggestions;
-        textChecker()->getGuessesForWord(m_correctionPanelInfo.replacedString, paragraphText, suggestions);
-        if (suggestions.isEmpty()) {
-            m_correctionPanelInfo.rangeToBeReplaced.clear();
-            break;
-        }
-        String topSuggestion = suggestions.first();
-        suggestions.remove(0);
-        m_correctionPanelInfo.isActive = true;
-        FloatRect boundingBox = windowRectForRange(m_correctionPanelInfo.rangeToBeReplaced.get());
-        if (!boundingBox.isEmpty())
-            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, topSuggestion, suggestions);
-    }
-        break;
-    }
-#endif
-}
-
-void Editor::handleCorrectionPanelResult(const String& correction)
-{
-    Range* replacedRange = m_correctionPanelInfo.rangeToBeReplaced.get();
-    if (!replacedRange || m_frame->document() != replacedRange->ownerDocument())
-        return;
-
-    String currentWord = plainText(m_correctionPanelInfo.rangeToBeReplaced.get());
-    // Check to see if the word we are about to correct has been changed between timer firing and callback being triggered.
-    if (currentWord != m_correctionPanelInfo.replacedString)
-        return;
-
-    m_correctionPanelInfo.isActive = false;
-
-    switch (m_correctionPanelInfo.panelType) {
-    case CorrectionPanelInfo::PanelTypeCorrection:
-        if (correction.length()) {
-            m_correctionPanelInfo.replacementString = correction;
-            applyCorrectionPanelInfo(markerTypesForAutocorrection());
-        } else {
-            if (!m_correctionPanelIsDismissedByEditor)
-                replacedRange->startContainer()->document()->markers()->addMarker(replacedRange, DocumentMarker::RejectedCorrection, m_correctionPanelInfo.replacedString);
-        }
-        break;
-    case CorrectionPanelInfo::PanelTypeReversion:
-    case CorrectionPanelInfo::PanelTypeSpellingSuggestions:
-        if (correction.length()) {
-            m_correctionPanelInfo.replacementString = correction;
-            applyCorrectionPanelInfo(markerTypesForReplacement());
-        }
-        break;
-    }
-
-    m_correctionPanelInfo.rangeToBeReplaced.clear();
-}
-
-void Editor::startCorrectionPanelTimer(CorrectionPanelInfo::PanelType type)
-{
-#if SUPPORT_AUTOCORRECTION_PANEL
-    const double correctionPanelTimerInterval = 0.3;
-    if (isAutomaticSpellingCorrectionEnabled()) {
-        if (type == CorrectionPanelInfo::PanelTypeCorrection)
-            // If type is PanelTypeReversion, then the new range has been set. So we shouldn't clear it.
-            m_correctionPanelInfo.rangeToBeReplaced.clear();
-        m_correctionPanelInfo.panelType = type;
-        m_correctionPanelTimer.startOneShot(correctionPanelTimerInterval);
-    }
-#else
-    UNUSED_PARAM(type);
-#endif
-}
-
-void Editor::stopCorrectionPanelTimer()
+void Editor::unappliedSpellCorrection(const VisibleSelection& selectionOfCorrected, const String& corrected, const String& correction)
 {
-#if SUPPORT_AUTOCORRECTION_PANEL
-    m_correctionPanelTimer.stop();
-    m_correctionPanelInfo.rangeToBeReplaced.clear();
-#endif
+    m_spellingCorrector->respondToUnappliedSpellCorrection(selectionOfCorrected, corrected, correction);
 }
 
-void Editor::dismissCorrectionPanel(ReasonForDismissingCorrectionPanel reasonForDismissing)
+void Editor::updateMarkersForWordsAffectedByEditing(bool doNotRemoveIfSelectionAtWordBoundary)
 {
-#if SUPPORT_AUTOCORRECTION_PANEL
-    if (!m_correctionPanelInfo.isActive)
+    if (!m_spellingCorrector->shouldRemoveMarkersUponEditing())
         return;
-    m_correctionPanelInfo.isActive = false;
-    m_correctionPanelIsDismissedByEditor = true;
-    if (client())
-        client()->dismissCorrectionPanel(reasonForDismissing);
-#else
-    UNUSED_PARAM(reasonForDismissing);
-#endif
-}
 
-String Editor::dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel reasonForDismissing)
-{
-#if SUPPORT_AUTOCORRECTION_PANEL
-    if (!m_correctionPanelInfo.isActive)
-        return String();
-    m_correctionPanelInfo.isActive = false;
-    m_correctionPanelIsDismissedByEditor = true;
-    if (!client())
-        return String();
-    return client()->dismissCorrectionPanelSoon(reasonForDismissing);
-#else
-    UNUSED_PARAM(reasonForDismissing);
-    return String();
-#endif
-}
-
-void Editor::removeSpellAndCorrectionMarkersFromWordsToBeEdited(bool doNotRemoveIfSelectionAtWordBoundary)
-{
     // We want to remove the markers from a word if an editing command will change the word. This can happen in one of
     // several scenarios:
     // 1. Insert in the middle of a word.
@@ -2701,102 +2436,6 @@ void Editor::removeSpellAndCorrectionMarkersFromWordsToBeEdited(bool doNotRemove
     document->markers()->clearDescriptionOnMarkersIntersectingRange(wordRange.get(), DocumentMarker::Replacement);
 }
 
-void Editor::applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>& markerTypesToAdd)
-{
-#if SUPPORT_AUTOCORRECTION_PANEL
-    if (!m_correctionPanelInfo.rangeToBeReplaced)
-        return;
-
-    ExceptionCode ec = 0;
-    RefPtr<Range> paragraphRangeContainingCorrection = m_correctionPanelInfo.rangeToBeReplaced->cloneRange(ec);
-    if (ec)
-        return;
-
-    setStart(paragraphRangeContainingCorrection.get(), startOfParagraph(m_correctionPanelInfo.rangeToBeReplaced->startPosition()));
-    setEnd(paragraphRangeContainingCorrection.get(), endOfParagraph(m_correctionPanelInfo.rangeToBeReplaced->endPosition()));
-
-    // After we replace the word at range rangeToBeReplaced, we need to add markers to that range.
-    // However, once the replacement took place, the value of rangeToBeReplaced is not valid anymore.
-    // So before we carry out the replacement, we need to store the start position of rangeToBeReplaced
-    // relative to the start position of the containing paragraph. We use correctionStartOffsetInParagraph
-    // to store this value. In order to obtain this offset, we need to first create a range
-    // which spans from the start of paragraph to the start position of rangeToBeReplaced.
-    RefPtr<Range> correctionStartOffsetInParagraphAsRange = Range::create(paragraphRangeContainingCorrection->startContainer(ec)->document(), paragraphRangeContainingCorrection->startPosition(), paragraphRangeContainingCorrection->startPosition());
-    if (ec)
-        return;
-
-    Position startPositionOfRangeToBeReplaced = m_correctionPanelInfo.rangeToBeReplaced->startPosition();
-    correctionStartOffsetInParagraphAsRange->setEnd(startPositionOfRangeToBeReplaced.containerNode(), startPositionOfRangeToBeReplaced.computeOffsetInContainerNode(), ec);
-    if (ec)
-        return;
-
-    // Take note of the location of autocorrection so that we can add marker after the replacement took place.
-    int correctionStartOffsetInParagraph = TextIterator::rangeLength(correctionStartOffsetInParagraphAsRange.get());
-
-    // Clone the range, since the caller of this method may want to keep the original range around.
-    RefPtr<Range> rangeToBeReplaced = m_correctionPanelInfo.rangeToBeReplaced->cloneRange(ec);
-    applyCommand(SpellingCorrectionCommand::create(rangeToBeReplaced, m_correctionPanelInfo.replacementString));
-    setEnd(paragraphRangeContainingCorrection.get(), m_frame->selection()->selection().start());
-    RefPtr<Range> replacementRange = TextIterator::subrange(paragraphRangeContainingCorrection.get(), correctionStartOffsetInParagraph,  m_correctionPanelInfo.replacementString.length());
-    String newText = plainText(replacementRange.get());
-
-    // Check to see if replacement succeeded.
-    if (newText != m_correctionPanelInfo.replacementString)
-        return;
-
-    DocumentMarkerController* markers = replacementRange->startContainer()->document()->markers();
-    size_t size = markerTypesToAdd.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_correctionPanelInfo.panelType == CorrectionPanelInfo::PanelTypeReversion)
-            markers->addMarker(replacementRange.get(), markerTypesToAdd[i]);
-        else
-            markers->addMarker(replacementRange.get(), markerTypesToAdd[i], m_correctionPanelInfo.replacedString);
-    }
-#else // SUPPORT_AUTOCORRECTION_PANEL
-    UNUSED_PARAM(markerTypesToAdd);
-#endif // SUPPORT_AUTOCORRECTION_PANEL
-}
-
-bool Editor::applyAutocorrectionBeforeTypingIfAppropriate()
-{
-    if (!m_correctionPanelInfo.rangeToBeReplaced || !m_correctionPanelInfo.isActive)
-        return false;
-
-    if (m_correctionPanelInfo.panelType != CorrectionPanelInfo::PanelTypeCorrection)
-        return false;
-
-    Position caretPosition = m_frame->selection()->selection().start();
-
-    if (m_correctionPanelInfo.rangeToBeReplaced->endPosition() == caretPosition) {
-        handleCorrectionPanelResult(dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanelAccepted));
-        return true;
-    } 
-    
-    // Pending correction should always be where caret is. But in case this is not always true, we still want to dismiss the panel without accepting the correction.
-    ASSERT(m_correctionPanelInfo.rangeToBeReplaced->endPosition() == caretPosition);
-    dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
-    return false;
-}
-
-void Editor::unappliedSpellCorrection(const VisibleSelection& selectionOfCorrected, const String& corrected, const String& correction)
-{
-#if SUPPORT_AUTOCORRECTION_PANEL
-    client()->recordAutocorrectionResponse(EditorClient::AutocorrectionReverted, corrected, correction);
-    m_frame->document()->updateLayout();
-    m_frame->selection()->setSelection(selectionOfCorrected, SelectionController::CloseTyping | SelectionController::ClearTypingStyle | SelectionController::SpellCorrectionTriggered);
-    RefPtr<Range> range = Range::create(m_frame->document(), m_frame->selection()->selection().start(), m_frame->selection()->selection().end());
-
-    DocumentMarkerController* markers = m_frame->document()->markers();
-    markers->removeMarkers(range.get(), DocumentMarker::Spelling);
-    markers->addMarker(range.get(), DocumentMarker::Replacement);
-    markers->addMarker(range.get(), DocumentMarker::SpellCheckingExemption);
-#else // SUPPORT_AUTOCORRECTION_PANEL
-    UNUSED_PARAM(selectionOfCorrected);
-    UNUSED_PARAM(corrected);
-    UNUSED_PARAM(correction);
-#endif // SUPPORT_AUTOCORRECTION_PANEL
-}
-
 PassRefPtr<Range> Editor::rangeForPoint(const IntPoint& windowPoint)
 {
     Document* document = m_frame->documentAtPoint(windowPoint);
@@ -2919,6 +2558,22 @@ void Editor::addToKillRing(Range* range, bool prepend)
     m_shouldStartNewKillRingSequence = false;
 }
 
+void Editor::startCorrectionPanelTimer()
+{
+    m_spellingCorrector->startCorrectionPanelTimer(CorrectionPanelInfo::PanelTypeCorrection);
+}
+
+void Editor::handleCorrectionPanelResult(const String& correction)
+{
+    m_spellingCorrector->handleCorrectionPanelResult(correction);
+}
+
+
+void Editor::dismissCorrectionPanelAsIgnored()
+{
+    m_spellingCorrector->dismiss(ReasonForDismissingCorrectionPanelIgnored);
+}
+
 bool Editor::insideVisibleArea(const IntPoint& point) const
 {
     if (m_frame->excludeFromTextSearch())
@@ -3491,14 +3146,7 @@ void Editor::setMarkedTextMatchesAreHighlighted(bool flag)
 
 void Editor::respondToChangedSelection(const VisibleSelection& oldSelection, SelectionController::SetSelectionOptions options)
 {
-#if SUPPORT_AUTOCORRECTION_PANEL
-    // Make sure there's no pending autocorrection before we call markMisspellingsAndBadGrammar() below.
-    VisibleSelection currentSelection(frame()->selection()->selection());
-    if (currentSelection != oldSelection) {
-        stopCorrectionPanelTimer();
-        dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
-    }
-#endif // SUPPORT_AUTOCORRECTION_PANEL
+    m_spellingCorrector->stopPendingCorrection(oldSelection);
 
     bool closeTyping = options & SelectionController::CloseTyping;
     bool isContinuousSpellCheckingEnabled = this->isContinuousSpellCheckingEnabled();
@@ -3514,11 +3162,8 @@ void Editor::respondToChangedSelection(const VisibleSelection& oldSelection, Sel
                 newSelectedSentence = VisibleSelection(startOfSentence(newStart), endOfSentence(newStart));
         }
 
-        bool shouldCheckSpellingAndGrammar = true;
-#if SUPPORT_AUTOCORRECTION_PANEL
         // Don't check spelling and grammar if the change of selection is triggered by spelling correction itself.
-        shouldCheckSpellingAndGrammar = !(options & SelectionController::SpellCorrectionTriggered);
-#endif
+        bool shouldCheckSpellingAndGrammar = !(options & SelectionController::SpellCorrectionTriggered);
 
         // When typing we check spelling elsewhere, so don't redo it here.
         // If this is a change in selection resulting from a delete operation,
@@ -3593,7 +3238,49 @@ bool Editor::selectionStartHasMarkerFor(DocumentMarker::MarkerType markerType, i
 FloatRect Editor::windowRectForRange(const Range* range) const
 {
     FrameView* view = frame()->view();
-    return view ? view->contentsToWindow(IntRect(range->boundingRect())) : FloatRect();
+    if (!view)
+        return FloatRect();
+    Vector<FloatQuad> textQuads;
+    range->textQuads(textQuads);
+    FloatRect boundingRect;
+    size_t size = textQuads.size();
+    for (size_t i = 0; i < size; ++i)
+        boundingRect.unite(textQuads[i].boundingBox());
+    return view->contentsToWindow(IntRect(boundingRect));
 }        
 
+TextCheckingTypeMask Editor::textCheckingTypeMaskFor(TextCheckingOptions textCheckingOptions)
+{
+    bool shouldMarkSpelling = textCheckingOptions & MarkSpelling;
+    bool shouldMarkGrammar = textCheckingOptions & MarkGrammar;
+    bool shouldShowCorrectionPanel = textCheckingOptions & ShowCorrectionPanel;
+    bool shouldCheckForCorrection = shouldShowCorrectionPanel || (textCheckingOptions & CheckForCorrection);
+
+    TextCheckingTypeMask checkingTypes = 0;
+    if (shouldMarkSpelling)
+        checkingTypes |= TextCheckingTypeSpelling;
+    if (shouldMarkGrammar)
+        checkingTypes |= TextCheckingTypeGrammar;
+    if (shouldCheckForCorrection)
+        checkingTypes |= TextCheckingTypeCorrection;
+
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
+    bool shouldPerformReplacement = textCheckingOptions & PerformReplacement;
+    if (shouldPerformReplacement) {
+        if (isAutomaticLinkDetectionEnabled())
+            checkingTypes |= TextCheckingTypeLink;
+        if (isAutomaticQuoteSubstitutionEnabled())
+            checkingTypes |= TextCheckingTypeQuote;
+        if (isAutomaticDashSubstitutionEnabled())
+            checkingTypes |= TextCheckingTypeDash;
+        if (isAutomaticTextReplacementEnabled())
+            checkingTypes |= TextCheckingTypeReplacement;
+        if (shouldMarkSpelling && isAutomaticSpellingCorrectionEnabled())
+            checkingTypes |= TextCheckingTypeCorrection;
+    }
+#endif
+
+    return checkingTypes;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index c723ddf..24d5c87 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -28,7 +28,6 @@
 
 #include "ClipboardAccessPolicy.h"
 #include "Color.h"
-#include "CorrectionPanelInfo.h"
 #include "DocumentMarker.h"
 #include "EditAction.h"
 #include "EditingBehavior.h"
@@ -51,6 +50,7 @@ namespace WebCore {
 class CSSMutableStyleDeclaration;
 class CSSStyleDeclaration;
 class Clipboard;
+class SpellingCorrectionController;
 class DeleteButtonController;
 class EditCommand;
 class EditorClient;
@@ -198,6 +198,7 @@ public:
     Command command(const String& commandName); // Command source is CommandFromMenuOrKeyBinding.
     Command command(const String& commandName, EditorCommandSource);
     static bool commandIsSupportedFromMenuOrKeyBinding(const String& commandName); // Works without a frame.
+    static bool hasTransparentBackgroundColor(CSSStyleDeclaration*);
 
     bool insertText(const String&, Event* triggeringEvent);
     bool insertTextForConfirmedComposition(const String& text);
@@ -219,10 +220,20 @@ public:
     Vector<String> guessesForMisspelledOrUngrammaticalSelection(bool& misspelled, bool& ungrammatical);
     bool isSpellCheckingEnabledInFocusedNode() const;
     bool isSpellCheckingEnabledFor(Node*) const;
-    void markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping);
+    void markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping, bool doReplacement);
     void markMisspellings(const VisibleSelection&, RefPtr<Range>& firstMisspellingRange);
     void markBadGrammar(const VisibleSelection&);
     void markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection);
+
+    enum TextCheckingOptionFlags {
+        MarkSpelling = 1 << 0,
+        MarkGrammar = 1 << 1,
+        PerformReplacement = 1 << 2,
+        ShowCorrectionPanel = 1 << 3,
+        CheckForCorrection = 1 << 4,
+    };
+    typedef unsigned TextCheckingOptions;
+
 #if USE(AUTOMATIC_TEXT_REPLACEMENT)
     void uppercaseWord();
     void lowercaseWord();
@@ -242,14 +253,6 @@ public:
     void toggleAutomaticSpellingCorrection();
 #endif
 
-    enum TextCheckingOptionFlags {
-        MarkSpelling = 1 << 0,
-        MarkGrammar = 1 << 1,
-        PerformReplacement = 1 << 2,
-        ShowCorrectionPanel = 1 << 3,
-    };
-    typedef unsigned TextCheckingOptions;
-
     void markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions, Range* spellingRange, Range* grammarRange);
     void changeBackToReplacedString(const String& replacedString);
 
@@ -323,9 +326,10 @@ public:
 
     void addToKillRing(Range*, bool prepend);
 
-    void startCorrectionPanelTimer(CorrectionPanelInfo::PanelType);
+    void startCorrectionPanelTimer();
     // If user confirmed a correction in the correction panel, correction has non-zero length, otherwise it means that user has dismissed the panel.
     void handleCorrectionPanelResult(const String& correction);
+    void dismissCorrectionPanelAsIgnored();
 
     void pasteAsFragment(PassRefPtr<DocumentFragment>, bool smartReplace, bool matchStyle);
     void pasteAsPlainText(const String&, bool smartReplace);
@@ -381,7 +385,7 @@ public:
 #endif
 
     bool selectionStartHasMarkerFor(DocumentMarker::MarkerType, int from, int length) const;
-    void removeSpellAndCorrectionMarkersFromWordsToBeEdited(bool doNotRemoveIfSelectionAtWordBoundary);
+    void updateMarkersForWordsAffectedByEditing(bool onlyHandleWordsContainingSelection);
 
 private:
     Frame* m_frame;
@@ -396,10 +400,8 @@ private:
     bool m_shouldStartNewKillRingSequence;
     bool m_shouldStyleWithCSS;
     OwnPtr<KillRing> m_killRing;
-    CorrectionPanelInfo m_correctionPanelInfo;
     OwnPtr<SpellChecker> m_spellChecker;
-    Timer<Editor> m_correctionPanelTimer;
-    bool m_correctionPanelIsDismissedByEditor;
+    OwnPtr<SpellingCorrectionController> m_spellingCorrector;
     VisibleSelection m_mark;
     bool m_areMarkedTextMatchesHighlighted;
 
@@ -413,6 +415,7 @@ private:
     void writeSelectionToPasteboard(Pasteboard*);
     void revealSelectionAfterEditingOperation();
     void markMisspellingsOrBadGrammar(const VisibleSelection&, bool checkSpelling, RefPtr<Range>& firstMisspellingRange);
+    TextCheckingTypeMask textCheckingTypeMaskFor(TextCheckingOptions);
 
     void selectComposition();
     void confirmComposition(const String&, bool preserveSelection);
@@ -423,11 +426,10 @@ private:
     PassRefPtr<Range> nextVisibleRange(Range*, const String&, FindOptions);
 
     void changeSelectionAfterCommand(const VisibleSelection& newSelection, bool closeTyping, bool clearTypingStyle);
-    void correctionPanelTimerFired(Timer<Editor>*);
+
     Node* findEventTargetFromSelection() const;
     void stopCorrectionPanelTimer();
-    void dismissCorrectionPanel(ReasonForDismissingCorrectionPanel);
-    String dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel);
+
     void applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>& markerTypesToAdd);
     // Return true if correction was applied, false otherwise.
     bool applyAutocorrectionBeforeTypingIfAppropriate();
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index 8ea37bb..290ee47 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -318,7 +318,7 @@ static bool executeDelete(Frame* frame, Event*, EditorCommandSource source, cons
     case CommandFromDOMWithUserInterface:
         // If the current selection is a caret, delete the preceding character. IE performs forwardDelete, but we currently side with Firefox.
         // Doesn't scroll to make the selection visible, or modify the kill ring (this time, siding with IE, not Firefox).
-        TypingCommand::deleteKeyPressed(frame->document(), frame->selection()->granularity() == WordGranularity);
+        TypingCommand::deleteKeyPressed(frame->document(), frame->selection()->granularity() == WordGranularity ? TypingCommand::SmartDelete : 0);
         return true;
     }
     ASSERT_NOT_REACHED();
@@ -1196,27 +1196,27 @@ static bool enabledCut(Frame* frame, Event*, EditorCommandSource)
     return frame->editor()->canDHTMLCut() || frame->editor()->canCut();
 }
 
+static bool enabledInEditableText(Frame* frame, Event* event, EditorCommandSource)
+{
+    return frame->editor()->selectionForCommand(event).rootEditableElement();
+}
+
 static bool enabledDelete(Frame* frame, Event* event, EditorCommandSource source)
 {
     switch (source) {
     case CommandFromMenuOrKeyBinding:
         // "Delete" from menu only affects selected range, just like Cut but without affecting pasteboard
-        return frame->editor()->canDHTMLCut() || frame->editor()->canCut();
+        return enabledCut(frame, event, source);
     case CommandFromDOM:
     case CommandFromDOMWithUserInterface:
         // "Delete" from DOM is like delete/backspace keypress, affects selected range if non-empty,
         // otherwise removes a character
-        return frame->editor()->selectionForCommand(event).isContentEditable();
+        return enabledInEditableText(frame, event, source);
     }
     ASSERT_NOT_REACHED();
     return false;
 }
 
-static bool enabledInEditableText(Frame* frame, Event* event, EditorCommandSource)
-{
-    return frame->editor()->selectionForCommand(event).isContentEditable();
-}
-
 static bool enabledInEditableTextOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
 {
     // The EditorCommandSource parameter is unused in enabledInEditableText, so just pass a dummy variable
@@ -1225,7 +1225,7 @@ static bool enabledInEditableTextOrCaretBrowsing(Frame* frame, Event* event, Edi
 
 static bool enabledInRichlyEditableText(Frame* frame, Event*, EditorCommandSource)
 {
-    return frame->selection()->isCaretOrRange() && frame->selection()->isContentRichlyEditable();
+    return frame->selection()->isCaretOrRange() && frame->selection()->isContentRichlyEditable() && frame->selection()->rootEditableElement();
 }
 
 static bool enabledPaste(Frame* frame, Event*, EditorCommandSource)
diff --git a/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 771c56a..2b7ee8c 100644
--- a/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -239,7 +239,7 @@ void InsertParagraphSeparatorCommand::doApply()
         // Recreate the same structure in the new paragraph.
         
         Vector<Element*> ancestors;
-        getAncestorsInsideBlock(insertionPosition.deprecatedNode(), startBlock, ancestors);      
+        getAncestorsInsideBlock(positionOutsideTabSpan(insertionPosition).deprecatedNode(), startBlock, ancestors);      
         RefPtr<Element> parent = cloneHierarchyUnderNewBlock(ancestors, blockToInsert);
         
         appendBlockPlaceholder(parent);
@@ -254,6 +254,9 @@ void InsertParagraphSeparatorCommand::doApply()
     // similar case where previous position is in another, presumeably nested, block.
     if (isFirstInBlock || !inSameBlock(visiblePos, visiblePos.previous())) {
         Node *refNode;
+        
+        insertionPosition = positionOutsideTabSpan(insertionPosition);
+
         if (isFirstInBlock && !nestNewBlock)
             refNode = startBlock;
         else if (insertionPosition.deprecatedNode() == startBlock && nestNewBlock) {
@@ -270,7 +273,7 @@ void InsertParagraphSeparatorCommand::doApply()
         // Recreate the same structure in the new paragraph.
 
         Vector<Element*> ancestors;
-        getAncestorsInsideBlock(positionAvoidingSpecialElementBoundary(insertionPosition).deprecatedNode(), startBlock, ancestors);
+        getAncestorsInsideBlock(positionAvoidingSpecialElementBoundary(positionOutsideTabSpan(insertionPosition)).deprecatedNode(), startBlock, ancestors);
         
         appendBlockPlaceholder(cloneHierarchyUnderNewBlock(ancestors, blockToInsert));
         
@@ -299,11 +302,7 @@ void InsertParagraphSeparatorCommand::doApply()
     // At this point, the insertionPosition's node could be a container, and we want to make sure we include
     // all of the correct nodes when building the ancestor list.  So this needs to be the deepest representation of the position
     // before we walk the DOM tree.
-    insertionPosition = VisiblePosition(insertionPosition).deepEquivalent();
-
-    // Build up list of ancestors in between the start node and the start block.
-    Vector<Element*> ancestors;
-    getAncestorsInsideBlock(insertionPosition.deprecatedNode(), startBlock, ancestors);
+    insertionPosition = positionOutsideTabSpan(VisiblePosition(insertionPosition).deepEquivalent());
 
     // Make sure we do not cause a rendered space to become unrendered.
     // FIXME: We need the affinity for pos, but pos.downstream() does not give it
@@ -335,48 +334,35 @@ void InsertParagraphSeparatorCommand::doApply()
         insertNodeAfter(blockToInsert.get(), startBlock);
 
     updateLayout();
-    
-    // Make clones of ancestors in between the start node and the outer block.
-    RefPtr<Element> parent = cloneHierarchyUnderNewBlock(ancestors, blockToInsert);
 
     // If the paragraph separator was inserted at the end of a paragraph, an empty line must be
     // created.  All of the nodes, starting at visiblePos, are about to be added to the new paragraph 
     // element.  If the first node to be inserted won't be one that will hold an empty line open, add a br.
     if (isEndOfParagraph(visiblePos) && !lineBreakExistsAtVisiblePosition(visiblePos))
         appendNode(createBreakElement(document()).get(), blockToInsert.get());
-        
+
     // Move the start node and the siblings of the start node.
-    if (insertionPosition.deprecatedNode() != startBlock) {
-        Node* n = insertionPosition.deprecatedNode();
-        if (insertionPosition.deprecatedEditingOffset() >= caretMaxOffset(n))
-            n = n->nextSibling();
+    if (VisiblePosition(insertionPosition) != VisiblePosition(positionBeforeNode(blockToInsert.get()))) {
+        Node* n;
+        if (insertionPosition.containerNode() == startBlock)
+            n = insertionPosition.computeNodeAfterPosition();
+        else {
+            splitTreeToNode(insertionPosition.containerNode(), startBlock);
+
+            for (n = startBlock->firstChild(); n; n = n->nextSibling()) {
+                if (comparePositions(VisiblePosition(insertionPosition), positionBeforeNode(n)) <= 0)
+                    break;
+            }
+        }
 
         while (n && n != blockToInsert) {
             Node *next = n->nextSibling();
             removeNode(n);
-            appendNode(n, parent.get());
+            appendNode(n, blockToInsert);
             n = next;
         }
     }            
 
-    // Move everything after the start node.
-    if (!ancestors.isEmpty()) {
-        Element* leftParent = ancestors.first();
-        while (leftParent && leftParent != startBlock) {
-            parent = parent->parentElement();
-            if (!parent)
-                break;
-            Node* n = leftParent->nextSibling();
-            while (n && n != blockToInsert) {
-                Node* next = n->nextSibling();
-                removeNode(n);
-                appendNode(n, parent.get());
-                n = next;
-            }
-            leftParent = leftParent->parentElement();
-        }
-    }
-
     // Handle whitespace that occurs after the split
     if (splitText) {
         updateLayout();
diff --git a/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
index 7ab3aba..662415b 100644
--- a/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
+++ b/Source/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -56,8 +56,8 @@ static void swapInNodePreservingAttributesAndChildren(HTMLElement* newNode, HTML
     parentNode->insertBefore(newNode, nodeToReplace, ec);
     ASSERT(!ec);
 
-    Node* nextChild;
-    for (Node* child = nodeToReplace->firstChild(); child; child = nextChild) {
+    RefPtr<Node> nextChild;
+    for (Node* child = nodeToReplace->firstChild(); child; child = nextChild.get()) {
         nextChild = child->nextSibling();
         newNode->appendChild(child, ec);
         ASSERT(!ec);
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index 94531a6..c3b1501 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -952,20 +952,17 @@ void ReplaceSelectionCommand::doApply()
     // We can skip this optimization for fragments not wrapped in one of
     // our style spans and for positions inside list items
     // since insertAsListItems already does the right thing.
-    if (!m_matchStyle && !enclosingList(insertionPos.anchorNode()) && isStyleSpan(fragment.firstChild())) {
-        Node* parentNode = insertionPos.anchorNode()->parentNode();
-        while (parentNode && parentNode->renderer() && isInlineNodeWithStyle(parentNode)) {
-            // If we are in the middle of a text node, we need to split it before we can
-            // move the insertion position.
-            if (insertionPos.anchorNode()->isTextNode() && insertionPos.anchorType() == Position::PositionIsOffsetInAnchor && insertionPos.offsetInContainerNode() && !insertionPos.atLastEditingPositionForNode())
-                splitTextNodeContainingElement(static_cast<Text*>(insertionPos.anchorNode()), insertionPos.offsetInContainerNode());
-            
-            // If the style element has more than one child, we need to split it.
-            if (parentNode->firstChild()->nextSibling())
-                splitElement(static_cast<Element*>(parentNode), insertionPos.computeNodeAfterPosition());
-            
-            insertionPos = positionInParentBeforeNode(parentNode);
-            parentNode = parentNode->parentNode();
+    if (!m_matchStyle && !enclosingList(insertionPos.containerNode()) && isStyleSpan(fragment.firstChild())) {
+        if (insertionPos.containerNode()->isTextNode() && insertionPos.offsetInContainerNode() && !insertionPos.atLastEditingPositionForNode()) {
+            splitTextNodeContainingElement(static_cast<Text*>(insertionPos.containerNode()), insertionPos.offsetInContainerNode());
+            insertionPos = firstPositionInNode(insertionPos.containerNode());
+        }
+
+        // FIXME: isInlineNodeWithStyle does not check editability.
+        if (RefPtr<Node> nodeToSplitTo = highestEnclosingNodeOfType(insertionPos, isInlineNodeWithStyle)) {
+            if (insertionPos.containerNode() != nodeToSplitTo)
+                nodeToSplitTo = splitTreeToNode(insertionPos.anchorNode(), nodeToSplitTo.get(), true).get();
+            insertionPos = positionInParentBeforeNode(nodeToSplitTo.get());
         }
     }
 
diff --git a/Source/WebCore/editing/SelectionController.cpp b/Source/WebCore/editing/SelectionController.cpp
index 698ba2c..c5a33d3 100644
--- a/Source/WebCore/editing/SelectionController.cpp
+++ b/Source/WebCore/editing/SelectionController.cpp
@@ -254,9 +254,9 @@ void SelectionController::respondToNodeModification(Node* node, bool baseRemoved
             m_selection.setWithoutValidation(m_selection.start(), m_selection.end());
         else
             m_selection.setWithoutValidation(m_selection.end(), m_selection.start());
-    } else if (m_selection.firstRange()) {
+    } else if (RefPtr<Range> range = m_selection.firstRange()) {
         ExceptionCode ec = 0;
-        Range::CompareResults compareResult = m_selection.firstRange()->compareNode(node, ec);
+        Range::CompareResults compareResult = range->compareNode(node, ec);
         if (!ec && (compareResult == Range::NODE_BEFORE_AND_AFTER || compareResult == Range::NODE_INSIDE)) {
             // If we did nothing here, when this node's renderer was destroyed, the rect that it 
             // occupied would be invalidated, but, selection gaps that change as a result of 
@@ -450,6 +450,9 @@ VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granul
     case DocumentBoundary:
         // FIXME: implement all of the above?
         pos = modifyExtendingForward(granularity);
+        break;
+    case WebKitVisualWordGranularity:
+        break;
     }
     return pos;
 }
@@ -489,6 +492,8 @@ VisiblePosition SelectionController::modifyExtendingForward(TextGranularity gran
         else
             pos = endOfDocument(pos);
         break;
+    case WebKitVisualWordGranularity:
+        break;
     }
     
     return pos;
@@ -520,6 +525,9 @@ VisiblePosition SelectionController::modifyMovingRight(TextGranularity granulari
     case LineBoundary:
         pos = rightBoundaryOfLine(startForPlatform(), directionOfEnclosingBlock());
         break;
+    case WebKitVisualWordGranularity:
+        pos = rightWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
+        break;
     }
     return pos;
 }
@@ -568,6 +576,8 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
         else
             pos = endOfDocument(pos);
         break;
+    case WebKitVisualWordGranularity:
+        break;
     }
     return pos;
 }
@@ -607,6 +617,9 @@ VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granula
     case ParagraphBoundary:
     case DocumentBoundary:
         pos = modifyExtendingBackward(granularity);
+        break;
+    case WebKitVisualWordGranularity:
+        break;
     }
     return pos;
 }
@@ -651,6 +664,8 @@ VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity gra
         else
             pos = startOfDocument(pos);
         break;
+    case WebKitVisualWordGranularity:
+        break;
     }
     return pos;
 }
@@ -681,6 +696,9 @@ VisiblePosition SelectionController::modifyMovingLeft(TextGranularity granularit
     case LineBoundary:
         pos = leftBoundaryOfLine(startForPlatform(), directionOfEnclosingBlock());
         break;
+    case WebKitVisualWordGranularity:
+        pos = leftWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
+        break;
     }
     return pos;
 }
@@ -723,6 +741,8 @@ VisiblePosition SelectionController::modifyMovingBackward(TextGranularity granul
         else
             pos = startOfDocument(pos);
         break;
+    case WebKitVisualWordGranularity:
+        break;
     }
     return pos;
 }
diff --git a/Source/WebCore/editing/SpellChecker.cpp b/Source/WebCore/editing/SpellChecker.cpp
index 7988e41..fedcc07 100644
--- a/Source/WebCore/editing/SpellChecker.cpp
+++ b/Source/WebCore/editing/SpellChecker.cpp
@@ -100,13 +100,13 @@ bool SpellChecker::isCheckable(Node* node) const
     return node && node->renderer();
 }
 
-void SpellChecker::requestCheckingFor(Node* node)
+void SpellChecker::requestCheckingFor(TextCheckingTypeMask mask, Node* node)
 {
     ASSERT(canCheckAsynchronously(node));
 
     if (!initRequest(node))
         return;
-    m_client->requestCheckingOfString(this, m_requestSequence, m_requestText);
+    m_client->requestCheckingOfString(this, m_requestSequence, mask, m_requestText);
 }
 
 static bool forwardIterator(PositionIterator& iterator, int distance)
@@ -131,7 +131,16 @@ static bool forwardIterator(PositionIterator& iterator, int distance)
     return false;    
 }
 
-void SpellChecker::didCheck(int sequence, const Vector<SpellCheckingResult>& results)
+static DocumentMarker::MarkerType toMarkerType(TextCheckingType type)
+{
+    if (type == TextCheckingTypeSpelling)
+        return DocumentMarker::Spelling;
+    ASSERT(type == TextCheckingTypeGrammar);
+    return DocumentMarker::Grammar;
+}
+
+// Currenntly ignoring TextCheckingResult::details but should be handled. See Bug 56368.
+void SpellChecker::didCheck(int sequence, const Vector<TextCheckingResult>& results)
 {
     if (!isValid(sequence))
         return;
@@ -144,16 +153,16 @@ void SpellChecker::didCheck(int sequence, const Vector<SpellCheckingResult>& res
     int startOffset = 0;
     PositionIterator start = firstPositionInOrBeforeNode(m_requestNode.get());
     for (size_t i = 0; i < results.size(); ++i) {
-        if (results[i].type() != DocumentMarker::Spelling && results[i].type() != DocumentMarker::Grammar)
+        if (results[i].type != TextCheckingTypeSpelling && results[i].type != TextCheckingTypeGrammar)
             continue;
 
         // To avoid moving the position backward, we assume the given results are sorted with
         // startOffset as the ones returned by [NSSpellChecker requestCheckingOfString:].
-        ASSERT(startOffset <= results[i].location());
-        if (!forwardIterator(start, results[i].location() - startOffset))
+        ASSERT(startOffset <= results[i].location);
+        if (!forwardIterator(start, results[i].location - startOffset))
             break;
         PositionIterator end = start;
-        if (!forwardIterator(end, results[i].length()))
+        if (!forwardIterator(end, results[i].length))
             break;
 
         // Users or JavaScript applications may change text while a spell-checker checks its
@@ -163,11 +172,11 @@ void SpellChecker::didCheck(int sequence, const Vector<SpellCheckingResult>& res
         RefPtr<Range> range = Range::create(m_requestNode->document(), start, end);
         // FIXME: Use textContent() compatible string conversion.
         String destination = range->text();
-        String source = m_requestText.substring(results[i].location(), results[i].length());
+        String source = m_requestText.substring(results[i].location, results[i].length);
         if (destination == source)
-            m_requestNode->document()->markers()->addMarker(range.get(), results[i].type());
+            m_requestNode->document()->markers()->addMarker(range.get(), toMarkerType(results[i].type));
 
-        startOffset = results[i].location();
+        startOffset = results[i].location;
     }
 
     clearRequest();
diff --git a/Source/WebCore/editing/SpellChecker.h b/Source/WebCore/editing/SpellChecker.h
index d3940e5..4bcb89e 100644
--- a/Source/WebCore/editing/SpellChecker.h
+++ b/Source/WebCore/editing/SpellChecker.h
@@ -27,6 +27,7 @@
 #define SpellChecker_h
 
 #include "DocumentMarker.h"
+#include "TextCheckerClient.h"
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
@@ -35,25 +36,6 @@ class TextCheckerClient;
 class Frame;
 class Node;
 
-class SpellCheckingResult {
-public:
-    explicit SpellCheckingResult(DocumentMarker::MarkerType type = DocumentMarker::Spelling, int location = 0, int length = 0)
-        : m_type(type)
-        , m_location(location)
-        , m_length(length)
-    {
-    }
-
-    DocumentMarker::MarkerType type() const { return m_type; } 
-    int location() const { return m_location; }
-    int length() const { return m_length; }
-
-private:
-    DocumentMarker::MarkerType m_type;
-    int m_location;
-    int m_length;
-};
-
 class SpellChecker {
     WTF_MAKE_NONCOPYABLE(SpellChecker);
 public:
@@ -65,8 +47,8 @@ public:
     bool isBusy() const;
     bool isValid(int sequence) const;
     bool isCheckable(Node*) const;
-    void requestCheckingFor(Node*);
-    void didCheck(int sequence, const Vector<SpellCheckingResult>&);
+    void requestCheckingFor(TextCheckingTypeMask, Node*);
+    void didCheck(int sequence, const Vector<TextCheckingResult>&);
 
 private:
     bool initRequest(Node*);
diff --git a/Source/WebCore/editing/SpellingCorrectionCommand.cpp b/Source/WebCore/editing/SpellingCorrectionCommand.cpp
index bad4a99..f0297c1 100644
--- a/Source/WebCore/editing/SpellingCorrectionCommand.cpp
+++ b/Source/WebCore/editing/SpellingCorrectionCommand.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "SpellingCorrectionCommand.h"
 
-#include "CorrectionPanelInfo.h"
+#include "SpellingCorrectionController.h"
 #include "DocumentFragment.h"
 #include "Frame.h"
 #include "ReplaceSelectionCommand.h"
@@ -94,7 +94,7 @@ void SpellingCorrectionCommand::doApply()
     if (!fragment)
         return;
 
-    applyCommandToComposite(SetSelectionCommand::create(m_selectionToBeCorrected, SelectionController::CloseTyping | SelectionController::ClearTypingStyle));
+    applyCommandToComposite(SetSelectionCommand::create(m_selectionToBeCorrected, SelectionController::SpellCorrectionTriggered | SelectionController::CloseTyping | SelectionController::ClearTypingStyle));
 #if SUPPORT_AUTOCORRECTION_PANEL
     applyCommandToComposite(SpellingCorrectionRecordUndoCommand::create(document(), m_corrected, m_correction));
 #endif
diff --git a/Source/WebCore/editing/SpellingCorrectionController.cpp b/Source/WebCore/editing/SpellingCorrectionController.cpp
new file mode 100644
index 0000000..c377fe8
--- /dev/null
+++ b/Source/WebCore/editing/SpellingCorrectionController.cpp
@@ -0,0 +1,479 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SpellingCorrectionController.h"
+
+#include "DocumentMarkerController.h"
+#include "EditCommand.h"
+#include "EditorClient.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "SpellingCorrectionCommand.h"
+#include "TextCheckerClient.h"
+#include "TextCheckingHelper.h"
+#include "TextIterator.h"
+#include "htmlediting.h"
+#include "markup.h"
+#include "visible_units.h"
+
+
+namespace WebCore {
+
+using namespace std;
+using namespace WTF;
+
+#if SUPPORT_AUTOCORRECTION_PANEL
+
+static const Vector<DocumentMarker::MarkerType>& markerTypesForAutocorrection()
+{
+    DEFINE_STATIC_LOCAL(Vector<DocumentMarker::MarkerType>, markerTypesForAutoCorrection, ());
+    if (markerTypesForAutoCorrection.isEmpty()) {
+        markerTypesForAutoCorrection.append(DocumentMarker::Replacement);
+        markerTypesForAutoCorrection.append(DocumentMarker::CorrectionIndicator);
+        markerTypesForAutoCorrection.append(DocumentMarker::SpellCheckingExemption);
+        markerTypesForAutoCorrection.append(DocumentMarker::Autocorrected);
+    }
+    return markerTypesForAutoCorrection;
+}
+
+static const Vector<DocumentMarker::MarkerType>& markerTypesForReplacement()
+{
+    DEFINE_STATIC_LOCAL(Vector<DocumentMarker::MarkerType>, markerTypesForReplacement, ());
+    if (markerTypesForReplacement.isEmpty()) {
+        markerTypesForReplacement.append(DocumentMarker::Replacement);
+        markerTypesForReplacement.append(DocumentMarker::SpellCheckingExemption);
+    }
+    return markerTypesForReplacement;
+}
+
+static bool markersHaveIdenticalDescription(const Vector<DocumentMarker>& markers)
+{
+    if (markers.isEmpty())
+        return true;
+
+    const String& description = markers[0].description;
+    for (size_t i = 1; i < markers.size(); ++i) {
+        if (description != markers[i].description)
+            return false;
+    }
+    return true;
+}
+
+SpellingCorrectionController::SpellingCorrectionController(Frame* frame)
+    : m_frame(frame)
+    , m_correctionPanelTimer(this, &SpellingCorrectionController::correctionPanelTimerFired)
+{
+}
+
+SpellingCorrectionController::~SpellingCorrectionController()
+{
+    dismiss(ReasonForDismissingCorrectionPanelIgnored);
+}
+
+void SpellingCorrectionController::startCorrectionPanelTimer(CorrectionPanelInfo::PanelType type)
+{
+    const double correctionPanelTimerInterval = 0.3;
+    if (!isAutomaticSpellingCorrectionEnabled())
+        return;
+
+    // If type is PanelTypeReversion, then the new range has been set. So we shouldn't clear it.
+    if (type == CorrectionPanelInfo::PanelTypeCorrection)
+        m_correctionPanelInfo.rangeToBeReplaced.clear();
+    m_correctionPanelInfo.panelType = type;
+    m_correctionPanelTimer.startOneShot(correctionPanelTimerInterval);
+}
+
+void SpellingCorrectionController::stopCorrectionPanelTimer()
+{
+    m_correctionPanelTimer.stop();
+    m_correctionPanelInfo.rangeToBeReplaced.clear();
+}
+
+void SpellingCorrectionController::stopPendingCorrection(const VisibleSelection& oldSelection)
+{
+    // Make sure there's no pending autocorrection before we call markMisspellingsAndBadGrammar() below.
+    VisibleSelection currentSelection(m_frame->selection()->selection());
+    if (currentSelection == oldSelection)
+        return;
+
+    stopCorrectionPanelTimer();
+    dismiss(ReasonForDismissingCorrectionPanelIgnored);
+}
+
+void SpellingCorrectionController::applyPendingCorrection(const VisibleSelection& selectionAfterTyping)
+{
+    // Apply pending autocorrection before next round of spell checking.
+    bool doApplyCorrection = true;
+    VisiblePosition startOfSelection = selectionAfterTyping.visibleStart();
+    VisibleSelection currentWord = VisibleSelection(startOfWord(startOfSelection, LeftWordIfOnBoundary), endOfWord(startOfSelection, RightWordIfOnBoundary));
+    if (currentWord.visibleEnd() == startOfSelection) {
+        String wordText = plainText(currentWord.toNormalizedRange().get());
+        if (wordText.length() > 0 && isAmbiguousBoundaryCharacter(wordText[wordText.length() - 1]))
+            doApplyCorrection = false;
+    }
+    if (doApplyCorrection)
+        handleCorrectionPanelResult(dismissSoon(ReasonForDismissingCorrectionPanelAccepted)); 
+    else
+        m_correctionPanelInfo.rangeToBeReplaced.clear();
+}
+
+bool SpellingCorrectionController::hasPendingCorrection() const
+{
+    return m_correctionPanelInfo.rangeToBeReplaced;
+}
+
+bool SpellingCorrectionController::isSpellingMarkerAllowed(PassRefPtr<Range> misspellingRange) const
+{
+    return !m_frame->document()->markers()->hasMarkers(misspellingRange.get(), DocumentMarker::SpellCheckingExemption);
+}
+
+void SpellingCorrectionController::show(PassRefPtr<Range> rangeToReplace, const String& replacement)
+{
+    FloatRect boundingBox = windowRectForRange(rangeToReplace.get());
+    if (boundingBox.isEmpty())
+        return;
+    m_correctionPanelInfo.replacedString = plainText(rangeToReplace.get());
+    m_correctionPanelInfo.rangeToBeReplaced = rangeToReplace;
+    m_correctionPanelInfo.replacementString = replacement;
+    m_correctionPanelInfo.isActive = true;
+    client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, replacement, Vector<String>());
+}
+
+void SpellingCorrectionController::handleCancelOperation()
+{
+    if (!m_correctionPanelInfo.isActive)
+        return;
+    m_correctionPanelInfo.isActive = false;
+    dismiss(ReasonForDismissingCorrectionPanelCancelled);
+}
+
+void SpellingCorrectionController::dismiss(ReasonForDismissingCorrectionPanel reasonForDismissing)
+{
+    if (!m_correctionPanelInfo.isActive)
+        return;
+    m_correctionPanelInfo.isActive = false;
+    m_correctionPanelIsDismissedByEditor = true;
+    if (client())
+        client()->dismissCorrectionPanel(reasonForDismissing);
+}
+
+String SpellingCorrectionController::dismissSoon(ReasonForDismissingCorrectionPanel reasonForDismissing)
+{
+    if (!m_correctionPanelInfo.isActive)
+        return String();
+    m_correctionPanelInfo.isActive = false;
+    m_correctionPanelIsDismissedByEditor = true;
+    if (!client())
+        return String();
+    return client()->dismissCorrectionPanelSoon(reasonForDismissing);
+}
+
+void SpellingCorrectionController::applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>& markerTypesToAdd)
+{
+    if (!m_correctionPanelInfo.rangeToBeReplaced)
+        return;
+
+    ExceptionCode ec = 0;
+    RefPtr<Range> paragraphRangeContainingCorrection = m_correctionPanelInfo.rangeToBeReplaced->cloneRange(ec);
+    if (ec)
+        return;
+
+    setStart(paragraphRangeContainingCorrection.get(), startOfParagraph(m_correctionPanelInfo.rangeToBeReplaced->startPosition()));
+    setEnd(paragraphRangeContainingCorrection.get(), endOfParagraph(m_correctionPanelInfo.rangeToBeReplaced->endPosition()));
+
+    // After we replace the word at range rangeToBeReplaced, we need to add markers to that range.
+    // However, once the replacement took place, the value of rangeToBeReplaced is not valid anymore.
+    // So before we carry out the replacement, we need to store the start position of rangeToBeReplaced
+    // relative to the start position of the containing paragraph. We use correctionStartOffsetInParagraph
+    // to store this value. In order to obtain this offset, we need to first create a range
+    // which spans from the start of paragraph to the start position of rangeToBeReplaced.
+    RefPtr<Range> correctionStartOffsetInParagraphAsRange = Range::create(paragraphRangeContainingCorrection->startContainer(ec)->document(), paragraphRangeContainingCorrection->startPosition(), paragraphRangeContainingCorrection->startPosition());
+    if (ec)
+        return;
+
+    Position startPositionOfRangeToBeReplaced = m_correctionPanelInfo.rangeToBeReplaced->startPosition();
+    correctionStartOffsetInParagraphAsRange->setEnd(startPositionOfRangeToBeReplaced.containerNode(), startPositionOfRangeToBeReplaced.computeOffsetInContainerNode(), ec);
+    if (ec)
+        return;
+
+    // Take note of the location of autocorrection so that we can add marker after the replacement took place.
+    int correctionStartOffsetInParagraph = TextIterator::rangeLength(correctionStartOffsetInParagraphAsRange.get());
+
+    // Clone the range, since the caller of this method may want to keep the original range around.
+    RefPtr<Range> rangeToBeReplaced = m_correctionPanelInfo.rangeToBeReplaced->cloneRange(ec);
+    applyCommand(SpellingCorrectionCommand::create(rangeToBeReplaced, m_correctionPanelInfo.replacementString));
+    setEnd(paragraphRangeContainingCorrection.get(), m_frame->selection()->selection().start());
+    RefPtr<Range> replacementRange = TextIterator::subrange(paragraphRangeContainingCorrection.get(), correctionStartOffsetInParagraph,  m_correctionPanelInfo.replacementString.length());
+    String newText = plainText(replacementRange.get());
+
+    // Check to see if replacement succeeded.
+    if (newText != m_correctionPanelInfo.replacementString)
+        return;
+
+    DocumentMarkerController* markers = replacementRange->startContainer()->document()->markers();
+    size_t size = markerTypesToAdd.size();
+    for (size_t i = 0; i < size; ++i) {
+        DocumentMarker::MarkerType markerType = markerTypesToAdd[i];
+        String description;
+        if (m_correctionPanelInfo.panelType != CorrectionPanelInfo::PanelTypeReversion && (markerType == DocumentMarker::Replacement || markerType == DocumentMarker::Autocorrected))
+            description = m_correctionPanelInfo.replacedString;
+        markers->addMarker(replacementRange.get(), markerType, description);
+    }
+}
+
+bool SpellingCorrectionController::applyAutocorrectionBeforeTypingIfAppropriate()
+{
+    if (!m_correctionPanelInfo.rangeToBeReplaced || !m_correctionPanelInfo.isActive)
+        return false;
+
+    if (m_correctionPanelInfo.panelType != CorrectionPanelInfo::PanelTypeCorrection)
+        return false;
+
+    Position caretPosition = m_frame->selection()->selection().start();
+
+    if (m_correctionPanelInfo.rangeToBeReplaced->endPosition() == caretPosition) {
+        handleCorrectionPanelResult(dismissSoon(ReasonForDismissingCorrectionPanelAccepted));
+        return true;
+    } 
+    
+    // Pending correction should always be where caret is. But in case this is not always true, we still want to dismiss the panel without accepting the correction.
+    ASSERT(m_correctionPanelInfo.rangeToBeReplaced->endPosition() == caretPosition);
+    dismiss(ReasonForDismissingCorrectionPanelIgnored);
+    return false;
+}
+
+void SpellingCorrectionController::respondToUnappliedSpellCorrection(const VisibleSelection& selectionOfCorrected, const String& corrected, const String& correction)
+{
+    client()->recordAutocorrectionResponse(EditorClient::AutocorrectionReverted, corrected, correction);
+    m_frame->document()->updateLayout();
+    m_frame->selection()->setSelection(selectionOfCorrected, SelectionController::CloseTyping | SelectionController::ClearTypingStyle | SelectionController::SpellCorrectionTriggered);
+    RefPtr<Range> range = Range::create(m_frame->document(), m_frame->selection()->selection().start(), m_frame->selection()->selection().end());
+
+    DocumentMarkerController* markers = m_frame->document()->markers();
+    markers->removeMarkers(range.get(), DocumentMarker::Spelling | DocumentMarker::Autocorrected, DocumentMarkerController::RemovePartiallyOverlappingMarker);
+    markers->addMarker(range.get(), DocumentMarker::Replacement);
+    markers->addMarker(range.get(), DocumentMarker::SpellCheckingExemption);
+}
+
+void SpellingCorrectionController::correctionPanelTimerFired(Timer<SpellingCorrectionController>*)
+{
+    m_correctionPanelIsDismissedByEditor = false;
+    switch (m_correctionPanelInfo.panelType) {
+    case CorrectionPanelInfo::PanelTypeCorrection: {
+        VisibleSelection selection(m_frame->selection()->selection());
+        VisiblePosition start(selection.start(), selection.affinity());
+        VisiblePosition p = startOfWord(start, LeftWordIfOnBoundary);
+        VisibleSelection adjacentWords = VisibleSelection(p, start);
+        m_frame->editor()->markAllMisspellingsAndBadGrammarInRanges(Editor::MarkSpelling | Editor::ShowCorrectionPanel, adjacentWords.toNormalizedRange().get(), 0);
+    }
+        break;
+    case CorrectionPanelInfo::PanelTypeReversion: {
+        m_correctionPanelInfo.isActive = true;
+        m_correctionPanelInfo.replacedString = plainText(m_correctionPanelInfo.rangeToBeReplaced.get());
+        FloatRect boundingBox = windowRectForRange(m_correctionPanelInfo.rangeToBeReplaced.get());
+        if (!boundingBox.isEmpty())
+            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, m_correctionPanelInfo.replacementString, Vector<String>());
+    }
+        break;
+    case CorrectionPanelInfo::PanelTypeSpellingSuggestions: {
+        if (plainText(m_correctionPanelInfo.rangeToBeReplaced.get()) != m_correctionPanelInfo.replacedString)
+            break;
+        String paragraphText = plainText(TextCheckingParagraph(m_correctionPanelInfo.rangeToBeReplaced).paragraphRange().get());
+        Vector<String> suggestions;
+        textChecker()->getGuessesForWord(m_correctionPanelInfo.replacedString, paragraphText, suggestions);
+        if (suggestions.isEmpty()) {
+            m_correctionPanelInfo.rangeToBeReplaced.clear();
+            break;
+        }
+        String topSuggestion = suggestions.first();
+        suggestions.remove(0);
+        m_correctionPanelInfo.isActive = true;
+        FloatRect boundingBox = windowRectForRange(m_correctionPanelInfo.rangeToBeReplaced.get());
+        if (!boundingBox.isEmpty())
+            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, topSuggestion, suggestions);
+    }
+        break;
+    }
+}
+
+void SpellingCorrectionController::handleCorrectionPanelResult(const String& correction)
+{
+    Range* replacedRange = m_correctionPanelInfo.rangeToBeReplaced.get();
+    if (!replacedRange || m_frame->document() != replacedRange->ownerDocument())
+        return;
+
+    String currentWord = plainText(m_correctionPanelInfo.rangeToBeReplaced.get());
+    // Check to see if the word we are about to correct has been changed between timer firing and callback being triggered.
+    if (currentWord != m_correctionPanelInfo.replacedString)
+        return;
+
+    m_correctionPanelInfo.isActive = false;
+
+    switch (m_correctionPanelInfo.panelType) {
+    case CorrectionPanelInfo::PanelTypeCorrection:
+        if (correction.length()) {
+            m_correctionPanelInfo.replacementString = correction;
+            applyCorrectionPanelInfo(markerTypesForAutocorrection());
+        } else if (!m_correctionPanelIsDismissedByEditor)
+            replacedRange->startContainer()->document()->markers()->addMarker(replacedRange, DocumentMarker::RejectedCorrection, m_correctionPanelInfo.replacedString);
+        break;
+    case CorrectionPanelInfo::PanelTypeReversion:
+    case CorrectionPanelInfo::PanelTypeSpellingSuggestions:
+        if (correction.length()) {
+            m_correctionPanelInfo.replacementString = correction;
+            applyCorrectionPanelInfo(markerTypesForReplacement());
+        }
+        break;
+    }
+
+    m_correctionPanelInfo.rangeToBeReplaced.clear();
+}
+
+bool SpellingCorrectionController::isAutomaticSpellingCorrectionEnabled()
+{
+    return client() && client()->isAutomaticSpellingCorrectionEnabled();
+}
+
+FloatRect SpellingCorrectionController::windowRectForRange(const Range* range) const
+{
+    FrameView* view = m_frame->view();
+    return view ? view->contentsToWindow(IntRect(range->boundingRect())) : FloatRect();
+}        
+
+void SpellingCorrectionController::respondToChangedSelection(const VisibleSelection& oldSelection)
+{
+    VisibleSelection currentSelection(m_frame->selection()->selection());
+    // When user moves caret to the end of autocorrected word and pauses, we show the panel
+    // containing the original pre-correction word so that user can quickly revert the
+    // undesired autocorrection. Here, we start correction panel timer once we confirm that
+    // the new caret position is at the end of a word.
+    if (!currentSelection.isCaret() || currentSelection == oldSelection)
+        return;
+
+    VisiblePosition selectionPosition = currentSelection.start();
+    VisiblePosition endPositionOfWord = endOfWord(selectionPosition, LeftWordIfOnBoundary);
+    if (selectionPosition != endPositionOfWord)
+        return;
+
+    Position position = endPositionOfWord.deepEquivalent();
+    if (position.anchorType() != Position::PositionIsOffsetInAnchor)
+        return;
+
+    Node* node = position.containerNode();
+    int endOffset = position.offsetInContainerNode();
+    Vector<DocumentMarker> markers = node->document()->markers()->markersForNode(node);
+    size_t markerCount = markers.size();
+    for (size_t i = 0; i < markerCount; ++i) {
+        const DocumentMarker& marker = markers[i];
+        if (!shouldStartTimeFor(marker, endOffset))
+            continue;
+        RefPtr<Range> wordRange = Range::create(m_frame->document(), node, marker.startOffset, node, marker.endOffset);
+        String currentWord = plainText(wordRange.get());
+        if (!currentWord.length())
+            continue;
+
+        m_correctionPanelInfo.rangeToBeReplaced = wordRange;
+        m_correctionPanelInfo.replacedString = currentWord;
+        if (marker.type == DocumentMarker::Spelling)
+            startCorrectionPanelTimer(CorrectionPanelInfo::PanelTypeSpellingSuggestions);
+        else {
+            m_correctionPanelInfo.replacementString = marker.description;
+            startCorrectionPanelTimer(CorrectionPanelInfo::PanelTypeReversion);
+        }
+
+        break;
+    }
+}
+
+void SpellingCorrectionController::respondToAppliedEditing(PassRefPtr<EditCommand> command)
+{
+    if (command->isTopLevelCommand() && !command->shouldRetainAutocorrectionIndicator())
+        m_frame->document()->markers()->removeMarkers(DocumentMarker::CorrectionIndicator);
+}
+
+EditorClient* SpellingCorrectionController::client()
+{
+    return m_frame->page() ? m_frame->page()->editorClient() : 0;
+}
+
+TextCheckerClient* SpellingCorrectionController::textChecker()
+{
+    if (EditorClient* owner = client())
+        return owner->textChecker();
+    return 0;
+}
+
+void SpellingCorrectionController::recordAutocorrectionResponseReversed(const String& replacedString, const String& replacementString)
+{
+    client()->recordAutocorrectionResponse(EditorClient::AutocorrectionReverted, replacedString, replacementString);
+}
+
+void SpellingCorrectionController::recordAutocorrectionResponseReversed(const String& replacedString, PassRefPtr<Range> replacementRange)
+{
+    recordAutocorrectionResponseReversed(replacedString, plainText(replacementRange.get()));
+}
+
+void SpellingCorrectionController::markReversed(PassRefPtr<Range> changedRange)
+{
+    changedRange->startContainer()->document()->markers()->removeMarkers(changedRange.get(), DocumentMarker::Autocorrected, DocumentMarkerController::RemovePartiallyOverlappingMarker);
+    changedRange->startContainer()->document()->markers()->addMarker(changedRange.get(), DocumentMarker::SpellCheckingExemption);
+}
+
+void SpellingCorrectionController::markCorrection(PassRefPtr<Range> replacedRange, const String& replacedString)
+{
+    Vector<DocumentMarker::MarkerType> markerTypesToAdd = markerTypesForAutocorrection();
+    DocumentMarkerController* markers = replacedRange->startContainer()->document()->markers();
+    for (size_t i = 0; i < markerTypesToAdd.size(); ++i) {
+        DocumentMarker::MarkerType markerType = markerTypesToAdd[i];
+        if (markerType == DocumentMarker::Replacement || markerType == DocumentMarker::Autocorrected)
+            markers->addMarker(replacedRange.get(), markerType, replacedString);
+        else
+            markers->addMarker(replacedRange.get(), markerType);
+    }
+}
+
+void SpellingCorrectionController::recordSpellcheckerResponseForModifiedCorrection(Range* rangeOfCorrection, const String& corrected, const String& correction)
+{
+    if (!rangeOfCorrection)
+        return;
+    DocumentMarkerController* markers = rangeOfCorrection->startContainer()->document()->markers();
+    Vector<DocumentMarker> correctedOnceMarkers = markers->markersInRange(rangeOfCorrection, DocumentMarker::Autocorrected);
+    if (correctedOnceMarkers.isEmpty())
+        return;
+    
+    // Spelling corrected text has been edited. We need to determine whether user has reverted it to original text or
+    // edited it to something else, and notify spellchecker accordingly.
+    if (markersHaveIdenticalDescription(correctedOnceMarkers) && correctedOnceMarkers[0].description == corrected)
+        client()->recordAutocorrectionResponse(EditorClient::AutocorrectionReverted, corrected, correction);
+    else
+        client()->recordAutocorrectionResponse(EditorClient::AutocorrectionEdited, corrected, correction);
+    markers->removeMarkers(rangeOfCorrection, DocumentMarker::Autocorrected, DocumentMarkerController::RemovePartiallyOverlappingMarker);
+}
+
+#endif
+
+} // namespace WebCore
diff --git a/Source/WebCore/editing/SpellingCorrectionController.h b/Source/WebCore/editing/SpellingCorrectionController.h
new file mode 100644
index 0000000..691510a
--- /dev/null
+++ b/Source/WebCore/editing/SpellingCorrectionController.h
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpellingCorrectionController_h
+#define SpellingCorrectionController_h
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+// Some platforms provide UI for suggesting autocorrection.
+#define SUPPORT_AUTOCORRECTION_PANEL 1
+// Some platforms use spelling and autocorrection markers to provide visual cue.
+// On such platform, if word with marker is edited, we need to remove the marker.
+#define REMOVE_MARKERS_UPON_EDITING 1
+#else
+#define SUPPORT_AUTOCORRECTION_PANEL 0
+#define REMOVE_MARKERS_UPON_EDITING 0
+#endif // #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+
+#include "DocumentMarker.h"
+#include "EditCommand.h"
+#include "FloatRect.h"
+#include "Range.h"
+#include "Timer.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
+
+namespace WebCore {
+
+class EditorClient;
+class Range;
+class TextCheckerClient;
+class VisibleSelection;
+
+struct CorrectionPanelInfo {
+    enum PanelType {
+        PanelTypeCorrection = 0,
+        PanelTypeReversion,
+        PanelTypeSpellingSuggestions
+    };
+
+    RefPtr<Range> rangeToBeReplaced;
+    String replacedString;
+    String replacementString;
+    PanelType panelType;
+    bool isActive;
+};
+
+enum ReasonForDismissingCorrectionPanel {
+    ReasonForDismissingCorrectionPanelCancelled = 0,
+    ReasonForDismissingCorrectionPanelIgnored,
+    ReasonForDismissingCorrectionPanelAccepted
+};
+
+#if SUPPORT_AUTOCORRECTION_PANEL
+#define UNLESS_ENABLED(functionBody) ;
+#else
+#define UNLESS_ENABLED(functionBody) functionBody
+#endif
+
+class SpellingCorrectionController {
+    WTF_MAKE_NONCOPYABLE(SpellingCorrectionController); WTF_MAKE_FAST_ALLOCATED;
+public:
+    SpellingCorrectionController(Frame*) UNLESS_ENABLED({})
+    ~SpellingCorrectionController() UNLESS_ENABLED({})
+
+    void startCorrectionPanelTimer(CorrectionPanelInfo::PanelType) UNLESS_ENABLED({})
+    void stopCorrectionPanelTimer() UNLESS_ENABLED({})
+
+    void dismiss(ReasonForDismissingCorrectionPanel) UNLESS_ENABLED({})
+    String dismissSoon(ReasonForDismissingCorrectionPanel) UNLESS_ENABLED({ return String(); })
+    void show(PassRefPtr<Range> rangeToReplace, const String& replacement) UNLESS_ENABLED({ UNUSED_PARAM(rangeToReplace); UNUSED_PARAM(replacement); })
+
+    void applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>&) UNLESS_ENABLED({})
+    // Return true if correction was applied, false otherwise.
+    bool applyAutocorrectionBeforeTypingIfAppropriate() UNLESS_ENABLED({ return false; })
+
+    void respondToUnappliedSpellCorrection(const VisibleSelection&, const String& corrected, const String& correction) UNLESS_ENABLED({ UNUSED_PARAM(corrected); UNUSED_PARAM(correction); })
+    void respondToAppliedEditing(PassRefPtr<EditCommand>) UNLESS_ENABLED({})
+    void respondToChangedSelection(const VisibleSelection& oldSelection) UNLESS_ENABLED({ UNUSED_PARAM(oldSelection); })
+
+    void stopPendingCorrection(const VisibleSelection& oldSelection) UNLESS_ENABLED({ UNUSED_PARAM(oldSelection); })
+    void applyPendingCorrection(const VisibleSelection& selectionAfterTyping) UNLESS_ENABLED({ UNUSED_PARAM(selectionAfterTyping); })
+
+    void handleCorrectionPanelResult(const String& correction) UNLESS_ENABLED({ UNUSED_PARAM(correction); })
+    void handleCancelOperation() UNLESS_ENABLED({})
+
+    bool hasPendingCorrection() const UNLESS_ENABLED({ return false; })
+    bool isSpellingMarkerAllowed(PassRefPtr<Range> misspellingRange) const UNLESS_ENABLED({ UNUSED_PARAM(misspellingRange); return true; })
+    bool isAutomaticSpellingCorrectionEnabled() UNLESS_ENABLED({ return false; })
+    bool shouldRemoveMarkersUponEditing() { return REMOVE_MARKERS_UPON_EDITING; }
+
+    void correctionPanelTimerFired(Timer<SpellingCorrectionController>*) UNLESS_ENABLED({})
+    void recordAutocorrectionResponseReversed(const String& replacedString, PassRefPtr<Range> replacementRange) UNLESS_ENABLED({ UNUSED_PARAM(replacedString); UNUSED_PARAM(replacementRange); })
+    void markReversed(PassRefPtr<Range> changedRange) UNLESS_ENABLED({ UNUSED_PARAM(changedRange); })
+    void markCorrection(PassRefPtr<Range> replacedRange, const String& replacedString) UNLESS_ENABLED({ UNUSED_PARAM(replacedRange); UNUSED_PARAM(replacedString); })
+    void recordSpellcheckerResponseForModifiedCorrection(Range* rangeOfCorrection, const String& corrected, const String& correction) UNLESS_ENABLED({ UNUSED_PARAM(rangeOfCorrection); UNUSED_PARAM(corrected); UNUSED_PARAM(correction); })
+
+#if SUPPORT_AUTOCORRECTION_PANEL
+private:
+    void recordAutocorrectionResponseReversed(const String& replacedString, const String& replacementString);
+
+    bool shouldStartTimeFor(const DocumentMarker& marker, int endOffset) const
+    {
+        return (((marker.type == DocumentMarker::Replacement && !marker.description.isNull()) 
+                 || marker.type == DocumentMarker::Spelling) && static_cast<int>(marker.endOffset) == endOffset);
+    }
+
+    EditorClient* client();
+    TextCheckerClient* textChecker();
+    FloatRect windowRectForRange(const Range*) const;
+
+    EditorClient* m_client;
+    Frame* m_frame;
+
+    Timer<SpellingCorrectionController> m_correctionPanelTimer;
+    CorrectionPanelInfo m_correctionPanelInfo;
+    bool m_correctionPanelIsDismissedByEditor;
+#endif
+};
+
+#undef UNLESS_ENABLED
+
+} // namespace WebCore
+
+#endif // SpellingCorrectionController_h
diff --git a/Source/WebCore/editing/TextCheckingHelper.cpp b/Source/WebCore/editing/TextCheckingHelper.cpp
index 009c807..3912a49 100644
--- a/Source/WebCore/editing/TextCheckingHelper.cpp
+++ b/Source/WebCore/editing/TextCheckingHelper.cpp
@@ -274,7 +274,7 @@ String TextCheckingHelper::findFirstMisspellingOrBadGrammar(bool checkGrammar, b
                 unsigned grammarDetailIndex = 0;
                 
                 Vector<TextCheckingResult> results;
-                uint64_t checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
+                TextCheckingTypeMask checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
                 m_client->textChecker()->checkTextOfParagraph(paragraphString.characters(), paragraphString.length(), checkingTypes, results);
                 
                 for (unsigned i = 0; i < results.size(); i++) {
@@ -524,7 +524,7 @@ Vector<String> TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange(bool
         return guesses;
 
     Vector<TextCheckingResult> results;
-    uint64_t checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
+    TextCheckingTypeMask checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
     m_client->textChecker()->checkTextOfParagraph(paragraph.textCharacters(), paragraph.textLength(), checkingTypes, results);
     
     for (unsigned i = 0; i < results.size(); i++) {
diff --git a/Source/WebCore/editing/TextGranularity.h b/Source/WebCore/editing/TextGranularity.h
index 09cc4ed..965d7a0 100644
--- a/Source/WebCore/editing/TextGranularity.h
+++ b/Source/WebCore/editing/TextGranularity.h
@@ -39,7 +39,10 @@ enum TextGranularity {
     SentenceBoundary,
     LineBoundary,
     ParagraphBoundary,
-    DocumentBoundary
+    DocumentBoundary,
+    // FIXME: this is added temporarily for experiment with visually move
+    // caret by wordGranularity. Once all patches are landed, it should be removed.
+    WebKitVisualWordGranularity
 };
 
 }
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index 1b25c87..c3be277 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -28,6 +28,7 @@
 #include "TextIterator.h"
 
 #include "Document.h"
+#include "Frame.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "htmlediting.h"
@@ -256,6 +257,7 @@ TextIterator::TextIterator()
     , m_emitsTextWithoutTranscoding(false)
     , m_handledFirstLetter(false)
     , m_ignoresStyleVisibility(false)
+    , m_emitsObjectReplacementCharacters(false)
 {
 }
 
@@ -274,6 +276,7 @@ TextIterator::TextIterator(const Range* r, TextIteratorBehavior behavior)
     , m_emitsTextWithoutTranscoding(behavior & TextIteratorEmitsTextsWithoutTranscoding)
     , m_handledFirstLetter(false)
     , m_ignoresStyleVisibility(behavior & TextIteratorIgnoresStyleVisibility)
+    , m_emitsObjectReplacementCharacters(behavior & TextIteratorEmitsObjectReplacementCharacters)
 {
     if (!r)
         return;
@@ -638,6 +641,11 @@ bool TextIterator::handleReplacedElement()
 
     m_hasEmitted = true;
 
+    if (m_emitsObjectReplacementCharacters && renderer && renderer->isReplaced()) {
+        emitCharacter(objectReplacementCharacter, m_node->parentNode(), m_node, 0, 1);
+        return true;
+    }
+
     if (m_emitsCharactersBetweenAllVisiblePositions) {
         // We want replaced elements to behave like punctuation for boundary 
         // finding, and to simply take up space for the selection preservation 
@@ -2369,6 +2377,38 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element* scope, int r
     return resultRange.release();
 }
 
+bool TextIterator::locationAndLengthFromRange(const Range* range, size_t& location, size_t& length)
+{
+    location = notFound;
+    length = 0;
+
+    if (!range->startContainer())
+        return false;
+
+    Element* selectionRoot = range->ownerDocument()->frame()->selection()->rootEditableElement();
+    Element* scope = selectionRoot ? selectionRoot : range->ownerDocument()->documentElement();
+
+    // The critical assumption is that this only gets called with ranges that
+    // concentrate on a given area containing the selection root. This is done
+    // because of text fields and textareas. The DOM for those is not
+    // directly in the document DOM, so ensure that the range does not cross a
+    // boundary of one of those.
+    if (range->startContainer() != scope && !range->startContainer()->isDescendantOf(scope))
+        return false;
+    if (range->endContainer() != scope && !range->endContainer()->isDescendantOf(scope))
+        return false;
+
+    RefPtr<Range> testRange = Range::create(scope->document(), scope, 0, range->startContainer(), range->startOffset());
+    ASSERT(testRange->startContainer() == scope);
+    location = TextIterator::rangeLength(testRange.get());
+    
+    ExceptionCode ec;
+    testRange->setEnd(range->endContainer(), range->endOffset(), ec);
+    ASSERT(testRange->startContainer() == scope);
+    length = TextIterator::rangeLength(testRange.get()) - location;
+    return true;
+}
+
 // --------
     
 UChar* plainTextToMallocAllocatedBuffer(const Range* r, unsigned& bufferLength, bool isDisplayString, TextIteratorBehavior defaultBehavior)
diff --git a/Source/WebCore/editing/TextIterator.h b/Source/WebCore/editing/TextIterator.h
index 0f1a6fd..9fe4ceb 100644
--- a/Source/WebCore/editing/TextIterator.h
+++ b/Source/WebCore/editing/TextIterator.h
@@ -41,7 +41,8 @@ enum TextIteratorBehavior {
     TextIteratorEmitsCharactersBetweenAllVisiblePositions = 1 << 0,
     TextIteratorEntersTextControls = 1 << 1,
     TextIteratorEmitsTextsWithoutTranscoding = 1 << 2,
-    TextIteratorIgnoresStyleVisibility = 1 << 3
+    TextIteratorIgnoresStyleVisibility = 1 << 3,
+    TextIteratorEmitsObjectReplacementCharacters = 1 << 4
 };
     
 // FIXME: Can't really answer this question correctly without knowing the white-space mode.
@@ -98,6 +99,7 @@ public:
      
     static int rangeLength(const Range*, bool spacesForReplacedElements = false);
     static PassRefPtr<Range> rangeFromLocationAndLength(Element* scope, int rangeLocation, int rangeLength, bool spacesForReplacedElements = false);
+    static bool locationAndLengthFromRange(const Range*, size_t& location, size_t& length);
     static PassRefPtr<Range> subrange(Range* entireRange, int characterOffset, int characterCount);
     
 private:
@@ -178,6 +180,8 @@ private:
     bool m_handledFirstLetter;
     // Used when the visibility of the style should not affect text gathering.
     bool m_ignoresStyleVisibility;
+    // Used when emitting the special 0xFFFC character is required.
+    bool m_emitsObjectReplacementCharacters;
 };
 
 // Iterates through the DOM range, returning all the text, and 0-length boundaries
diff --git a/Source/WebCore/editing/TypingCommand.cpp b/Source/WebCore/editing/TypingCommand.cpp
index aedda31..da93fab 100644
--- a/Source/WebCore/editing/TypingCommand.cpp
+++ b/Source/WebCore/editing/TypingCommand.cpp
@@ -39,6 +39,7 @@
 #include "InsertTextCommand.h"
 #include "RenderObject.h"
 #include "SelectionController.h"
+#include "TextIterator.h"
 #include "VisiblePosition.h"
 #include "htmlediting.h"
 #include "visible_units.h"
@@ -49,29 +50,34 @@ using namespace HTMLNames;
 
 static bool canAppendNewLineFeed(const VisibleSelection& selection)
 {
-    ExceptionCode ec = 0;
+    Node* node = selection.rootEditableElement();
+    if (!node)
+        return false;
+
     RefPtr<BeforeTextInsertedEvent> event = BeforeTextInsertedEvent::create(String("\n"));
-    selection.rootEditableElement()->dispatchEvent(event, ec);
+    ExceptionCode ec = 0;
+    node->dispatchEvent(event, ec);
     return event->text().length();
 }
 
-TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, TypingCommandOptions options, TextGranularity granularity, TextCompositionType compositionType)
+TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, Options options, TextGranularity granularity, TextCompositionType compositionType)
     : CompositeEditCommand(document)
     , m_commandType(commandType)
     , m_textToInsert(textToInsert)
     , m_openForMoreTyping(true)
     , m_selectInsertedText(options & SelectInsertedText)
-    , m_smartDelete(false)
+    , m_smartDelete(options & SmartDelete)
     , m_granularity(granularity)
     , m_compositionType(compositionType)
     , m_killRing(options & KillRing)
     , m_openedByBackwardDelete(false)
     , m_shouldRetainAutocorrectionIndicator(options & RetainAutocorrectionIndicator)
+    , m_shouldPreventSpellChecking(options & PreventSpellChecking)
 {
     updatePreservesTypingStyle(m_commandType);
 }
 
-void TypingCommand::deleteSelection(Document* document, bool smartDelete)
+void TypingCommand::deleteSelection(Document* document, Options options)
 {
     ASSERT(document);
     
@@ -83,16 +89,16 @@ void TypingCommand::deleteSelection(Document* document, bool smartDelete)
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
     if (isOpenForMoreTypingCommand(lastEditCommand)) {
-        static_cast<TypingCommand*>(lastEditCommand)->deleteSelection(smartDelete);
+        TypingCommand* lastTypingCommand = static_cast<TypingCommand*>(lastEditCommand);
+        lastTypingCommand->setShouldPreventSpellChecking(options & PreventSpellChecking);
+        lastTypingCommand->deleteSelection(options & SmartDelete);
         return;
     }
 
-    RefPtr<TypingCommand> typingCommand = TypingCommand::create(document, DeleteSelection, "", 0);
-    typingCommand->setSmartDelete(smartDelete);
-    typingCommand->apply();
+    TypingCommand::create(document, DeleteSelection, "", options)->apply();
 }
 
-void TypingCommand::deleteKeyPressed(Document *document, bool smartDelete, TextGranularity granularity, bool killRing)
+void TypingCommand::deleteKeyPressed(Document *document, Options options, TextGranularity granularity)
 {
     ASSERT(document);
     
@@ -101,18 +107,17 @@ void TypingCommand::deleteKeyPressed(Document *document, bool smartDelete, TextG
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
     if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
-        updateSelectionIfDifferentFromCurrentSelection(static_cast<TypingCommand*>(lastEditCommand), frame);
-        static_cast<TypingCommand*>(lastEditCommand)->deleteKeyPressed(granularity, killRing);
+        TypingCommand* lastTypingCommand = static_cast<TypingCommand*>(lastEditCommand);
+        updateSelectionIfDifferentFromCurrentSelection(lastTypingCommand, frame);
+        lastTypingCommand->setShouldPreventSpellChecking(options & PreventSpellChecking);
+        lastTypingCommand->deleteKeyPressed(granularity, options & KillRing);
         return;
     }
 
-    TypingCommandOptions options = killRing ? KillRing : 0;
-    RefPtr<TypingCommand> typingCommand = TypingCommand::create(document, DeleteKey, "", options, granularity);
-    typingCommand->setSmartDelete(smartDelete);
-    typingCommand->apply();
+    TypingCommand::create(document, DeleteKey, "", options, granularity)->apply();
 }
 
-void TypingCommand::forwardDeleteKeyPressed(Document *document, bool smartDelete, TextGranularity granularity, bool killRing)
+void TypingCommand::forwardDeleteKeyPressed(Document *document, Options options, TextGranularity granularity)
 {
     // FIXME: Forward delete in TextEdit appears to open and close a new typing command.
     ASSERT(document);
@@ -122,15 +127,14 @@ void TypingCommand::forwardDeleteKeyPressed(Document *document, bool smartDelete
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
     if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
-        updateSelectionIfDifferentFromCurrentSelection(static_cast<TypingCommand*>(lastEditCommand), frame);
-        static_cast<TypingCommand*>(lastEditCommand)->forwardDeleteKeyPressed(granularity, killRing);
+        TypingCommand* lastTypingCommand = static_cast<TypingCommand*>(lastEditCommand);
+        updateSelectionIfDifferentFromCurrentSelection(lastTypingCommand, frame);
+        lastTypingCommand->setShouldPreventSpellChecking(options & PreventSpellChecking);
+        lastTypingCommand->forwardDeleteKeyPressed(granularity, options & KillRing);
         return;
     }
 
-    TypingCommandOptions options = killRing ? KillRing : 0;
-    RefPtr<TypingCommand> typingCommand = TypingCommand::create(document, ForwardDeleteKey, "", options, granularity);
-    typingCommand->setSmartDelete(smartDelete);
-    typingCommand->apply();
+    TypingCommand::create(document, ForwardDeleteKey, "", options, granularity)->apply();
 }
 
 void TypingCommand::updateSelectionIfDifferentFromCurrentSelection(TypingCommand* typingCommand, Frame* frame)
@@ -144,23 +148,21 @@ void TypingCommand::updateSelectionIfDifferentFromCurrentSelection(TypingCommand
     typingCommand->setEndingSelection(currentSelection);
 }
 
-void TypingCommand::insertText(Document* document, const String& text, TypingCommandOptions options, TextCompositionType composition)
+void TypingCommand::insertText(Document* document, const String& text, Options options, TextCompositionType composition)
 {
     ASSERT(document);
 
     Frame* frame = document->frame();
     ASSERT(frame);
 
-#if REMOVE_MARKERS_UPON_EDITING
     if (!text.isEmpty())
-        document->frame()->editor()->removeSpellAndCorrectionMarkersFromWordsToBeEdited(isSpaceOrNewline(text.characters()[0]));
-#endif
-
+        document->frame()->editor()->updateMarkersForWordsAffectedByEditing(isSpaceOrNewline(text.characters()[0]));
+    
     insertText(document, text, frame->selection()->selection(), options, composition);
 }
 
 // FIXME: We shouldn't need to take selectionForInsertion. It should be identical to SelectionController's current selection.
-void TypingCommand::insertText(Document* document, const String& text, const VisibleSelection& selectionForInsertion, TypingCommandOptions options, TextCompositionType compositionType)
+void TypingCommand::insertText(Document* document, const String& text, const VisibleSelection& selectionForInsertion, Options options, TextCompositionType compositionType)
 {
     ASSERT(document);
 
@@ -196,6 +198,7 @@ void TypingCommand::insertText(Document* document, const String& text, const Vis
 
         lastTypingCommand->setCompositionType(compositionType);
         lastTypingCommand->setShouldRetainAutocorrectionIndicator(options & RetainAutocorrectionIndicator);
+        lastTypingCommand->setShouldPreventSpellChecking(options & PreventSpellChecking);
         lastTypingCommand->insertText(newText, options & SelectInsertedText);
         return;
     }
@@ -212,7 +215,7 @@ void TypingCommand::insertText(Document* document, const String& text, const Vis
     }
 }
 
-void TypingCommand::insertLineBreak(Document *document, TypingCommandOptions options)
+void TypingCommand::insertLineBreak(Document *document, Options options)
 {
     ASSERT(document);
 
@@ -246,7 +249,7 @@ void TypingCommand::insertParagraphSeparatorInQuotedContent(Document *document)
     applyCommand(TypingCommand::create(document, InsertParagraphSeparatorInQuotedContent));
 }
 
-void TypingCommand::insertParagraphSeparator(Document *document, TypingCommandOptions options)
+void TypingCommand::insertParagraphSeparator(Document *document, Options options)
 {
     ASSERT(document);
 
@@ -338,14 +341,14 @@ void TypingCommand::markMisspellingsAfterTyping(ETypingCommand commandType)
     if (previous.isNotNull()) {
         VisiblePosition p1 = startOfWord(previous, LeftWordIfOnBoundary);
         VisiblePosition p2 = startOfWord(start, LeftWordIfOnBoundary);
-        if (p1 != p2)
-            document()->frame()->editor()->markMisspellingsAfterTypingToWord(p1, endingSelection());
-#if SUPPORT_AUTOCORRECTION_PANEL
-        else if (commandType == TypingCommand::InsertText)
-            document()->frame()->editor()->startCorrectionPanelTimer(CorrectionPanelInfo::PanelTypeCorrection);
-#else
-    UNUSED_PARAM(commandType);
-#endif
+        if (p1 != p2) {
+            RefPtr<Range> range = makeRange(p1, p2);
+            String strippedPreviousWord;
+            if (range && (commandType == TypingCommand::InsertText || commandType == TypingCommand::InsertLineBreak || commandType == TypingCommand::InsertParagraphSeparator || commandType == TypingCommand::InsertParagraphSeparatorInQuotedContent))
+                strippedPreviousWord = plainText(range.get()).stripWhiteSpace();
+            document()->frame()->editor()->markMisspellingsAfterTypingToWord(p1, endingSelection(), !strippedPreviousWord.isEmpty());
+        } else if (commandType == TypingCommand::InsertText)
+            document()->frame()->editor()->startCorrectionPanelTimer();
     }
 }
 
@@ -356,7 +359,8 @@ void TypingCommand::typingAddedToOpenCommand(ETypingCommand commandTypeForAddedT
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     document()->frame()->editor()->appliedEditing(this);
     // Since the spellchecking code may also perform corrections and other replacements, it should happen after the typing changes.
-    markMisspellingsAfterTyping(commandTypeForAddedTyping);
+    if (!m_shouldPreventSpellChecking)
+        markMisspellingsAfterTyping(commandTypeForAddedTyping);
 #else
     // The old spellchecking code requires that checking be done first, to prevent issues like that in 6864072, where <doesn't> is marked as misspelled.
     markMisspellingsAfterTyping(commandTypeForAddedTyping);
@@ -463,9 +467,8 @@ bool TypingCommand::makeEditableRootEmpty()
 
 void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
 {
-#if REMOVE_MARKERS_UPON_EDITING
-    document()->frame()->editor()->removeSpellAndCorrectionMarkersFromWordsToBeEdited(false);
-#endif
+    document()->frame()->editor()->updateMarkersForWordsAffectedByEditing(false);
+
     VisibleSelection selectionToDelete;
     VisibleSelection selectionAfterUndo;
 
@@ -562,9 +565,8 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
 
 void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool killRing)
 {
-#if REMOVE_MARKERS_UPON_EDITING
-    document()->frame()->editor()->removeSpellAndCorrectionMarkersFromWordsToBeEdited(false);
-#endif
+    document()->frame()->editor()->updateMarkersForWordsAffectedByEditing(false);
+
     VisibleSelection selectionToDelete;
     VisibleSelection selectionAfterUndo;
 
diff --git a/Source/WebCore/editing/TypingCommand.h b/Source/WebCore/editing/TypingCommand.h
index beb4d02..a10634f 100644
--- a/Source/WebCore/editing/TypingCommand.h
+++ b/Source/WebCore/editing/TypingCommand.h
@@ -48,20 +48,22 @@ public:
         TextCompositionConfirm
     };
 
-    enum TypingCommandOption {
+    enum Option {
         SelectInsertedText = 1 << 0,
         KillRing = 1 << 1,
-        RetainAutocorrectionIndicator = 1 << 2
+        RetainAutocorrectionIndicator = 1 << 2,
+        PreventSpellChecking = 1 << 3,
+        SmartDelete = 1 << 4
     };
-    typedef unsigned TypingCommandOptions;
-
-    static void deleteSelection(Document*, bool smartDelete = false);
-    static void deleteKeyPressed(Document*, bool smartDelete = false, TextGranularity = CharacterGranularity, bool killRing = false);
-    static void forwardDeleteKeyPressed(Document*, bool smartDelete = false, TextGranularity = CharacterGranularity, bool killRing = false);
-    static void insertText(Document*, const String&, TypingCommandOptions, TextCompositionType = TextCompositionNone);
-    static void insertText(Document*, const String&, const VisibleSelection&, TypingCommandOptions, TextCompositionType = TextCompositionNone);
-    static void insertLineBreak(Document*, TypingCommandOptions);
-    static void insertParagraphSeparator(Document*, TypingCommandOptions);
+    typedef unsigned Options;
+
+    static void deleteSelection(Document*, Options = 0);
+    static void deleteKeyPressed(Document*, Options = 0, TextGranularity = CharacterGranularity);
+    static void forwardDeleteKeyPressed(Document*, Options = 0, TextGranularity = CharacterGranularity);
+    static void insertText(Document*, const String&, Options, TextCompositionType = TextCompositionNone);
+    static void insertText(Document*, const String&, const VisibleSelection&, Options, TextCompositionType = TextCompositionNone);
+    static void insertLineBreak(Document*, Options);
+    static void insertParagraphSeparator(Document*, Options);
     static void insertParagraphSeparatorInQuotedContent(Document*);
     static bool isOpenForMoreTypingCommand(const EditCommand*);
     static void closeTyping(EditCommand*);
@@ -80,17 +82,17 @@ public:
     void setCompositionType(TextCompositionType type) { m_compositionType = type; }
 
 private:
-    static PassRefPtr<TypingCommand> create(Document* document, ETypingCommand command, const String& text = "", TypingCommandOptions options = 0, TextGranularity granularity = CharacterGranularity)
+    static PassRefPtr<TypingCommand> create(Document* document, ETypingCommand command, const String& text = "", Options options = 0, TextGranularity granularity = CharacterGranularity)
     {
         return adoptRef(new TypingCommand(document, command, text, options, granularity, TextCompositionNone));
     }
 
-    static PassRefPtr<TypingCommand> create(Document* document, ETypingCommand command, const String& text, TypingCommandOptions options, TextCompositionType compositionType)
+    static PassRefPtr<TypingCommand> create(Document* document, ETypingCommand command, const String& text, Options options, TextCompositionType compositionType)
     {
         return adoptRef(new TypingCommand(document, command, text, options, CharacterGranularity, compositionType));
     }
 
-    TypingCommand(Document*, ETypingCommand, const String& text, TypingCommandOptions, TextGranularity, TextCompositionType);
+    TypingCommand(Document*, ETypingCommand, const String& text, Options, TextGranularity, TextCompositionType);
 
     bool smartDelete() const { return m_smartDelete; }
     void setSmartDelete(bool smartDelete) { m_smartDelete = smartDelete; }
@@ -101,6 +103,7 @@ private:
     virtual bool preservesTypingStyle() const { return m_preservesTypingStyle; }
     virtual bool shouldRetainAutocorrectionIndicator() const { return m_shouldRetainAutocorrectionIndicator; }
     virtual void setShouldRetainAutocorrectionIndicator(bool retain) { m_shouldRetainAutocorrectionIndicator = retain; }
+    void setShouldPreventSpellChecking(bool prevent) { m_shouldPreventSpellChecking = prevent; }
 
     static void updateSelectionIfDifferentFromCurrentSelection(TypingCommand*, Frame*);
 
@@ -125,6 +128,7 @@ private:
     bool m_openedByBackwardDelete;
 
     bool m_shouldRetainAutocorrectionIndicator;
+    bool m_shouldPreventSpellChecking;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/editing/VisibleSelection.cpp b/Source/WebCore/editing/VisibleSelection.cpp
index 5633c90..9e9692e 100644
--- a/Source/WebCore/editing/VisibleSelection.cpp
+++ b/Source/WebCore/editing/VisibleSelection.cpp
@@ -380,6 +380,8 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity(Text
             m_start = startOfSentence(VisiblePosition(m_start, m_affinity)).deepEquivalent();
             m_end = endOfSentence(VisiblePosition(m_end, m_affinity)).deepEquivalent();
             break;
+        case WebKitVisualWordGranularity:
+            break;
     }
     
     // Make sure we do not have a dangling start or end.
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index 564eff6..d89e6c5 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -122,7 +122,8 @@ int comparePositions(const Position& a, const Position& b)
         }
     }
 
-    int result = Range::compareBoundaryPoints(nodeA, offsetA, nodeB, offsetB);
+    ExceptionCode ec;
+    int result = Range::compareBoundaryPoints(nodeA, offsetA, nodeB, offsetB, ec);
     return result ? result : bias;
 }
 
@@ -638,7 +639,7 @@ Node* highestEnclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const N
 {
     Node* highest = 0;
     Node* root = rule == CannotCrossEditingBoundary ? highestEditableRoot(p) : 0;
-    for (Node* n = p.deprecatedNode(); n; n = n->parentNode()) {
+    for (Node* n = p.containerNode(); n; n = n->parentNode()) {
         if (root && !n->rendererIsEditable())
             continue;
         if (nodeIsOfType(n))
@@ -894,14 +895,17 @@ bool isNodeInTextFormControl(Node* node)
     return ancestor->isElementNode() && static_cast<Element*>(ancestor)->isTextFormControl();
 }
     
-Position positionBeforeTabSpan(const Position& pos)
+Position positionOutsideTabSpan(const Position& pos)
 {
-    Node* node = pos.deprecatedNode();
+    Node* node = pos.containerNode();
     if (isTabSpanTextNode(node))
         node = tabSpanNode(node);
     else if (!isTabSpanNode(node))
         return pos;
-    
+
+    if (node && VisiblePosition(pos) == lastPositionInNode(node))
+        return positionInParentAfterNode(node);
+
     return positionInParentBeforeNode(node);
 }
 
diff --git a/Source/WebCore/editing/htmlediting.h b/Source/WebCore/editing/htmlediting.h
index cb2b2a4..a006da6 100644
--- a/Source/WebCore/editing/htmlediting.h
+++ b/Source/WebCore/editing/htmlediting.h
@@ -111,7 +111,7 @@ Position previousCandidate(const Position&);
 Position nextVisuallyDistinctCandidate(const Position&);
 Position previousVisuallyDistinctCandidate(const Position&);
 
-Position positionBeforeTabSpan(const Position&);
+Position positionOutsideTabSpan(const Position&);
 Position positionBeforeContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
 Position positionAfterContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
 Position positionOutsideContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
@@ -224,6 +224,15 @@ inline bool isWhitespace(UChar c)
 {
     return c == noBreakSpace || c == ' ' || c == '\n' || c == '\t';
 }
+
+inline bool isAmbiguousBoundaryCharacter(UChar character)
+{
+    // These are characters that can behave as word boundaries, but can appear within words.
+    // If they are just typed, i.e. if they are immediately followed by a caret, we want to delay text checking until the next character has been typed.
+    // FIXME: this is required until 6853027 is fixed and text checking can do this for us.
+    return character == '\'' || character == rightSingleQuotationMark || character == hebrewPunctuationGershayim;
+}
+
 String stringWithRebalancedWhitespace(const String&, bool startIsStartOfParagraph, bool endIsEndOfParagraph);
 const String& nonBreakingSpaceString();
 
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index 316cec7..b93a78e 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -465,7 +465,7 @@ static bool isElementPresentational(const Node* node)
     RefPtr<CSSMutableStyleDeclaration> style = styleFromMatchedRulesAndInlineDecl(node);
     if (!style)
         return false;
-    return !propertyMissingOrEqualToNone(style.get(), CSSPropertyTextDecoration);
+    return !propertyMissingOrEqualToNone(style.get(), CSSPropertyTextDecoration) || !Editor::hasTransparentBackgroundColor(style.get());
 }
 
 static bool shouldIncludeWrapperForFullySelectedRoot(Node* fullySelectedRoot, CSSMutableStyleDeclaration* style)
@@ -571,11 +571,14 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
         accumulator.appendString(interchangeNewlineString);
         startNode = visibleStart.next().deepEquivalent().deprecatedNode();
 
-        if (pastEnd && Range::compareBoundaryPoints(startNode, 0, pastEnd, 0) >= 0) {
+        ExceptionCode ec = 0;
+        if (pastEnd && Range::compareBoundaryPoints(startNode, 0, pastEnd, 0, ec) >= 0) {
+            ASSERT(!ec);
             if (deleteButton)
                 deleteButton->enable();
             return interchangeNewlineString;
         }
+        ASSERT(!ec);
     }
 
     Node* body = enclosingNodeWithTag(firstPositionInNode(commonAncestor), bodyTag);
diff --git a/Source/WebCore/editing/qt/EditorQt.cpp b/Source/WebCore/editing/qt/EditorQt.cpp
index 7fb3634..ffb24e7 100644
--- a/Source/WebCore/editing/qt/EditorQt.cpp
+++ b/Source/WebCore/editing/qt/EditorQt.cpp
@@ -31,9 +31,9 @@
 #include "ClipboardQt.h"
 #include "Document.h"
 #include "Element.h"
-#include "VisibleSelection.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
+#include "VisibleSelection.h"
 #include "htmlediting.h"
 #include "visible_units.h"
 
diff --git a/Source/WebCore/editing/qt/SmartReplaceQt.cpp b/Source/WebCore/editing/qt/SmartReplaceQt.cpp
index 1436afe..dcd8bf7 100644
--- a/Source/WebCore/editing/qt/SmartReplaceQt.cpp
+++ b/Source/WebCore/editing/qt/SmartReplaceQt.cpp
@@ -40,15 +40,15 @@ bool isCharacterSmartReplaceExempt(UChar32 c, bool isPreviousCharacter)
     if (!isPreviousCharacter && d.isPunct())
         return true;
 
-    if ((c >= 0x1100 && c <= (0x1100 + 256))          // Hangul Jamo (0x1100 - 0x11FF)
-        || (c >= 0x2E80 && c <= (0x2E80 + 352))       // CJK & Kangxi Radicals (0x2E80 - 0x2FDF)
-        || (c >= 0x2FF0 && c <= (0x2FF0 + 464))       // Ideograph Deseriptions, CJK Symbols, Hiragana, Katakana, Bopomofo, Hangul Compatibility Jamo, Kanbun, & Bopomofo Ext (0x2FF0 - 0x31BF)
-        || (c >= 0x3200 && c <= (0x3200 + 29392))     // Enclosed CJK, CJK Ideographs (Uni Han & Ext A), & Yi (0x3200 - 0xA4CF)
-        || (c >= 0xAC00 && c <= (0xAC00 + 11183))     // Hangul Syllables (0xAC00 - 0xD7AF)
-        || (c >= 0xF900 && c <= (0xF900 + 352))       // CJK Compatibility Ideographs (0xF900 - 0xFA5F)
-        || (c >= 0xFE30 && c <= (0xFE30 + 32))        // CJK Compatibility From (0xFE30 - 0xFE4F)
-        || (c >= 0xFF00 && c <= (0xFF00 + 240))       // Half/Full Width Form (0xFF00 - 0xFFEF)
-        || (c >= 0x20000 && c <= (0x20000 + 0xA6D7))  // CJK Ideograph Exntension B
+    if ((c >= 0x1100 && c <= (0x1100 + 256)) // Hangul Jamo (0x1100 - 0x11FF)
+        || (c >= 0x2E80 && c <= (0x2E80 + 352)) // CJK & Kangxi Radicals (0x2E80 - 0x2FDF)
+        || (c >= 0x2FF0 && c <= (0x2FF0 + 464)) // Ideograph Deseriptions, CJK Symbols, Hiragana, Katakana, Bopomofo, Hangul Compatibility Jamo, Kanbun, & Bopomofo Ext (0x2FF0 - 0x31BF)
+        || (c >= 0x3200 && c <= (0x3200 + 29392)) // Enclosed CJK, CJK Ideographs (Uni Han & Ext A), & Yi (0x3200 - 0xA4CF)
+        || (c >= 0xAC00 && c <= (0xAC00 + 11183)) // Hangul Syllables (0xAC00 - 0xD7AF)
+        || (c >= 0xF900 && c <= (0xF900 + 352)) // CJK Compatibility Ideographs (0xF900 - 0xFA5F)
+        || (c >= 0xFE30 && c <= (0xFE30 + 32)) // CJK Compatibility From (0xFE30 - 0xFE4F)
+        || (c >= 0xFF00 && c <= (0xFF00 + 240)) // Half/Full Width Form (0xFF00 - 0xFFEF)
+        || (c >= 0x20000 && c <= (0x20000 + 0xA6D7)) // CJK Ideograph Exntension B
         || (c >= 0x2F800 && c <= (0x2F800 + 0x021E))) // CJK Compatibility Ideographs (0x2F800 - 0x2FA1D)
        return true;
 
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index c9ca8c0..e4a84ba 100644
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -37,6 +37,7 @@
 #include "TextBreakIterator.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
+#include "VisibleSelection.h"
 #include "htmlediting.h"
 #include <wtf/unicode/Unicode.h>
 
@@ -1146,4 +1147,396 @@ VisiblePosition rightBoundaryOfLine(const VisiblePosition& c, TextDirection dire
     return direction == LTR ? logicalEndOfLine(c) : logicalStartOfLine(c);
 }
 
+static const int invalidOffset = -1;
+    
+static VisiblePosition previousWordBreakInBoxInsideBlockWithSameDirectionality(const InlineBox* box, const VisiblePosition& previousWordBreak, int& offsetOfWordBreak)
+{
+    bool hasSeenWordBreakInThisBox = previousWordBreak.isNotNull();
+    // In a LTR block, the word break should be on the left boundary of a word.
+    // In a RTL block, the word break should be on the right boundary of a word.
+    // Because nextWordPosition() returns the word break on the right boundary of the word for LTR text,
+    // we need to use previousWordPosition() to traverse words within the inline boxes from right to left
+    // to find the previous word break (i.e. the first word break on the left). The same applies to RTL text.
+    
+    VisiblePosition wordBreak = hasSeenWordBreakInThisBox ? previousWordBreak : Position(box->renderer()->node(), box->caretMaxOffset(), Position::PositionIsOffsetInAnchor);
+
+    // FIXME: handle multi-spaces (http://webkit.org/b/57543).
+    
+    wordBreak = previousWordPosition(wordBreak);
+    if (previousWordBreak == wordBreak)
+        return VisiblePosition();
+
+    InlineBox* boxContainingPreviousWordBreak;
+    wordBreak.getInlineBoxAndOffset(boxContainingPreviousWordBreak, offsetOfWordBreak);
+    if (boxContainingPreviousWordBreak != box)
+        return VisiblePosition();
+    return wordBreak;
+}
+
+static VisiblePosition leftmostPositionInRTLBoxInLTRBlock(const InlineBox* box)
+{
+    // FIXME: Probably need to take care of bidi level too.
+    Node* node = box->renderer()->node();
+    InlineBox* previousLeaf = box->prevLeafChild();
+    InlineBox* nextLeaf = box->nextLeafChild();   
+    
+    if (previousLeaf && !previousLeaf->isLeftToRightDirection())
+        return Position(node, box->caretMaxOffset(), Position::PositionIsOffsetInAnchor);
+
+    if (nextLeaf && !nextLeaf->isLeftToRightDirection()) {
+        if (previousLeaf)
+            return Position(previousLeaf->renderer()->node(), previousLeaf->caretMaxOffset(), Position::PositionIsOffsetInAnchor);
+
+        InlineBox* lastRTLLeaf;
+        do {
+            lastRTLLeaf = nextLeaf;
+            nextLeaf = nextLeaf->nextLeafChild();
+        } while (nextLeaf && !nextLeaf->isLeftToRightDirection());
+        return Position(lastRTLLeaf->renderer()->node(), lastRTLLeaf->caretMinOffset(), Position::PositionIsOffsetInAnchor);
+    }
+
+    return Position(node, box->caretMinOffset(), Position::PositionIsOffsetInAnchor);
+}
+
+static VisiblePosition rightmostPositionInLTRBoxInRTLBlock(const InlineBox* box)
+{
+    // FIXME: Probably need to take care of bidi level too.
+    Node* node = box->renderer()->node();
+    InlineBox* previousLeaf = box->prevLeafChild();
+    InlineBox* nextLeaf = box->nextLeafChild();   
+    
+    if (nextLeaf && nextLeaf->isLeftToRightDirection())    
+        return Position(node, box->caretMaxOffset(), Position::PositionIsOffsetInAnchor);
+
+    if (previousLeaf && previousLeaf->isLeftToRightDirection()) {
+        if (nextLeaf)
+            return Position(nextLeaf->renderer()->node(), nextLeaf->caretMaxOffset(), Position::PositionIsOffsetInAnchor);
+
+        InlineBox* firstLTRLeaf;
+        do {
+            firstLTRLeaf = previousLeaf;
+            previousLeaf = previousLeaf->prevLeafChild();
+        } while (previousLeaf && previousLeaf->isLeftToRightDirection());
+        return Position(firstLTRLeaf->renderer()->node(), firstLTRLeaf->caretMinOffset(), Position::PositionIsOffsetInAnchor);
+    }
+
+    return Position(node, box->caretMinOffset(), Position::PositionIsOffsetInAnchor);
+}
+    
+static VisiblePosition lastWordBreakInBox(const InlineBox* box, int& offsetOfWordBreak)
+{
+    // Add the leftmost word break for RTL box or rightmost word break for LTR box.
+    InlineBox* previousLeaf = box->prevLeafChild();
+    InlineBox* nextLeaf = box->nextLeafChild();
+    VisiblePosition boundaryPosition;
+    if (box->direction() == RTL && (!previousLeaf || previousLeaf->isLeftToRightDirection()))
+        boundaryPosition = leftmostPositionInRTLBoxInLTRBlock(box);
+    else if (box->direction() == LTR && (!nextLeaf || !nextLeaf->isLeftToRightDirection()))
+        boundaryPosition = rightmostPositionInLTRBoxInRTLBlock(box);
+
+    if (boundaryPosition.isNull())
+        return VisiblePosition();            
+
+    VisiblePosition wordBreak = nextWordPosition(boundaryPosition);
+    if (wordBreak != boundaryPosition)
+        wordBreak = previousWordPosition(wordBreak);
+
+    InlineBox* boxOfWordBreak;
+    wordBreak.getInlineBoxAndOffset(boxOfWordBreak, offsetOfWordBreak);
+    if (boxOfWordBreak == box)
+        return wordBreak;
+    return VisiblePosition();    
+}
+
+static bool positionIsVisuallyOrderedInBoxInBlockWithDifferentDirectionality(const VisiblePosition& wordBreak, const InlineBox* box, int& offsetOfWordBreak)
+{
+    int previousOffset = offsetOfWordBreak;
+    InlineBox* boxOfWordBreak;
+    wordBreak.getInlineBoxAndOffset(boxOfWordBreak, offsetOfWordBreak);
+    if (boxOfWordBreak == box && (previousOffset == invalidOffset || previousOffset < offsetOfWordBreak))
+        return true;
+    return false;
+}
+    
+static VisiblePosition nextWordBreakInBoxInsideBlockWithDifferentDirectionality(
+    const InlineBox* box, const VisiblePosition& previousWordBreak, int& offsetOfWordBreak, bool& isLastWordBreakInBox)
+{
+    // FIXME: Probably need to take care of bidi level too.
+    
+    // In a LTR block, the word break should be on the left boundary of a word.
+    // In a RTL block, the word break should be on the right boundary of a word.
+    // Because previousWordPosition() returns the word break on the right boundary of the word for RTL text,
+    // we need to use nextWordPosition() to traverse words within the inline boxes from right to left to find the next word break.
+    // The same applies to LTR text, in which words are traversed within the inline boxes from left to right.
+    
+    // FIXME: handle multi-spaces (http://webkit.org/b/57543).
+    
+    bool hasSeenWordBreakInThisBox = previousWordBreak.isNotNull();
+    VisiblePosition wordBreak = hasSeenWordBreakInThisBox ? previousWordBreak : Position(box->renderer()->node(), box->caretMinOffset(), Position::PositionIsOffsetInAnchor);
+    wordBreak = nextWordPosition(wordBreak);
+    
+    if (wordBreak == previousWordBreak) {
+        isLastWordBreakInBox = true;
+        return VisiblePosition();
+    }
+
+
+    // Given RTL box "ABC DEF" either follows a LTR box or is the first visual box in an LTR block as an example,
+    // the visual display of the RTL box is: "(0)J(10)I(9)H(8) (7)F(6)E(5)D(4) (3)C(2)B(1)A(11)",
+    // where the number in parenthesis represents offset in visiblePosition. 
+    // Start at offset 0, the first word break is at offset 3, the 2nd word break is at offset 7, and the 3rd word break should be at offset 0.
+    // But nextWordPosition() of offset 7 is offset 11, which should be ignored, 
+    // and the position at offset 0 should be manually added as the last word break within the box.
+    if (positionIsVisuallyOrderedInBoxInBlockWithDifferentDirectionality(wordBreak, box, offsetOfWordBreak)) {
+        isLastWordBreakInBox = false;
+        return wordBreak;
+    }
+    
+    isLastWordBreakInBox = true;
+    return lastWordBreakInBox(box, offsetOfWordBreak);
+}
+
+struct WordBoundaryEntry {
+    WordBoundaryEntry()
+        : offsetInInlineBox(invalidOffset) 
+    { 
+    }
+
+    WordBoundaryEntry(const VisiblePosition& position, int offset)
+        : visiblePosition(position)
+        , offsetInInlineBox(offset) 
+    { 
+    }
+
+    VisiblePosition visiblePosition;
+    int offsetInInlineBox;
+};
+    
+typedef Vector<WordBoundaryEntry, 50> WordBoundaryVector;
+    
+static void collectWordBreaksInBoxInsideBlockWithSameDirectionality(const InlineBox* box, WordBoundaryVector& orderedWordBoundaries)
+{
+    orderedWordBoundaries.clear();
+    
+    VisiblePosition wordBreak;
+    int offsetOfWordBreak = invalidOffset;
+    while (1) {
+        wordBreak = previousWordBreakInBoxInsideBlockWithSameDirectionality(box, wordBreak, offsetOfWordBreak);
+        if (wordBreak.isNull())
+            break;
+        WordBoundaryEntry wordBoundaryEntry(wordBreak, offsetOfWordBreak);
+        orderedWordBoundaries.append(wordBoundaryEntry);
+    }
+}
+
+static void collectWordBreaksInBoxInsideBlockWithDifferntDirectionality(const InlineBox* box, WordBoundaryVector& orderedWordBoundaries)
+{
+    orderedWordBoundaries.clear();
+    
+    VisiblePosition wordBreak;
+    int offsetOfWordBreak = invalidOffset;
+    while (1) {
+        bool isLastWordBreakInBox = false;
+        wordBreak = nextWordBreakInBoxInsideBlockWithDifferentDirectionality(box, wordBreak, offsetOfWordBreak, isLastWordBreakInBox);
+        if (wordBreak.isNotNull()) {
+            WordBoundaryEntry wordBoundaryEntry(wordBreak, offsetOfWordBreak);
+            orderedWordBoundaries.append(wordBoundaryEntry);
+        }
+        if (isLastWordBreakInBox)
+            break;
+    }
+}
+    
+static VisiblePosition previousWordBreakInBox(const InlineBox* box, int offset, TextDirection blockDirection)
+{
+    int offsetOfWordBreak = 0;
+    VisiblePosition wordBreak;
+    while (true) {
+        if (box->direction() == blockDirection)
+            wordBreak = previousWordBreakInBoxInsideBlockWithSameDirectionality(box, wordBreak, offsetOfWordBreak);
+        // FIXME: Implement the 'else' case when the box direction is not equal to the block direction.
+        if (wordBreak.isNull())
+            break;
+        if (offset == invalidOffset || offsetOfWordBreak != offset)
+            return wordBreak;
+    }        
+    return VisiblePosition();
+}
+
+static int greatestValueUnder(int offset, bool boxAndBlockAreInSameDirection, const WordBoundaryVector& orderedWordBoundaries)
+{
+    if (!orderedWordBoundaries.size())
+        return invalidOffset;
+    // FIXME: binary search.
+    if (boxAndBlockAreInSameDirection) {
+        for (unsigned i = 0; i < orderedWordBoundaries.size(); ++i) {
+            if (orderedWordBoundaries[i].offsetInInlineBox < offset)
+                return i;
+        }
+        return invalidOffset;
+    }
+    for (int i = orderedWordBoundaries.size() - 1; i >= 0; --i) {
+        if (orderedWordBoundaries[i].offsetInInlineBox < offset)
+            return i;
+    }
+    return invalidOffset;
+}
+
+static int smallestOffsetAbove(int offset, bool boxAndBlockAreInSameDirection, const WordBoundaryVector& orderedWordBoundaries)
+{
+    if (!orderedWordBoundaries.size())
+        return invalidOffset;
+    // FIXME: binary search.
+    if (boxAndBlockAreInSameDirection) {
+        for (int i = orderedWordBoundaries.size() - 1; i >= 0; --i) {
+            if (orderedWordBoundaries[i].offsetInInlineBox > offset)
+                return i;
+        }
+        return invalidOffset;
+    }
+    for (unsigned i = 0; i < orderedWordBoundaries.size(); ++i) {
+        if (orderedWordBoundaries[i].offsetInInlineBox > offset)
+            return i;
+    }
+    return invalidOffset;
+}
+ 
+static VisiblePosition leftWordBoundary(const InlineBox* box, int offset, TextDirection blockDirection)
+{
+    VisiblePosition wordBreak;
+    for  (const InlineBox* adjacentBox = box; adjacentBox; adjacentBox = adjacentBox->prevLeafChild()) {
+        if (blockDirection == LTR) 
+            wordBreak = previousWordBreakInBox(adjacentBox, adjacentBox == box ? offset : invalidOffset, blockDirection);
+        // FIXME: Implement the "else" case.
+        if (wordBreak.isNotNull())
+            return wordBreak;
+    }
+    return VisiblePosition();
+}
+ 
+static VisiblePosition rightWordBoundary(const InlineBox* box, int offset, TextDirection blockDirection)
+{
+    
+    VisiblePosition wordBreak;
+    for (const InlineBox* adjacentBox = box; adjacentBox; adjacentBox = adjacentBox->nextLeafChild()) {
+        if (blockDirection == RTL)
+            wordBreak = previousWordBreakInBox(adjacentBox, adjacentBox == box ? offset : invalidOffset, blockDirection);
+        // FIXME: Implement the "else" case.
+        if (!wordBreak.isNull())
+            return wordBreak;
+    }
+    return VisiblePosition();
+}
+    
+static bool positionIsInsideBox(const VisiblePosition& wordBreak, const InlineBox* box)
+{
+    InlineBox* boxOfWordBreak;
+    int offsetOfWordBreak;
+    wordBreak.getInlineBoxAndOffset(boxOfWordBreak, offsetOfWordBreak);
+    return box == boxOfWordBreak && offsetOfWordBreak != box->caretMaxOffset() && offsetOfWordBreak != box->caretMinOffset();
+}
+
+static VisiblePosition positionBeforeNextWord(const VisiblePosition& position)
+{
+    VisiblePosition positionAfterCurrentWord = nextWordPosition(position);
+    VisiblePosition positionAfterNextWord = nextWordPosition(positionAfterCurrentWord);
+    if (positionAfterCurrentWord == positionAfterNextWord)
+        return positionAfterCurrentWord;
+    return previousWordPosition(positionAfterNextWord);
+}
+
+static VisiblePosition positionAfterPreviousWord(const VisiblePosition& position)
+{
+    VisiblePosition positionBeforeCurrentWord = previousWordPosition(position);
+    VisiblePosition positionBeforePreviousWord = previousWordPosition(positionBeforeCurrentWord);
+    if (positionBeforeCurrentWord == positionBeforePreviousWord)
+        return positionBeforeCurrentWord;
+    return nextWordPosition(positionBeforePreviousWord);
+}
+    
+VisiblePosition leftWordPosition(const VisiblePosition& visiblePosition)
+{
+    InlineBox* box;
+    int offset;
+    visiblePosition.getInlineBoxAndOffset(box, offset);
+    TextDirection blockDirection = directionOfEnclosingBlock(visiblePosition.deepEquivalent());
+    
+    // FIXME: If the box's directionality is the same as that of the enclosing block, when the offset is at the box boundary
+    // and the direction is towards inside the box, do I still need to make it a special case? For example, a LTR box inside a LTR block,
+    // when offset is at box's caretMinOffset and the direction is DirectionRight, should it be taken care as a general case?
+    if (offset == box->caretLeftmostOffset())
+        return leftWordBoundary(box->prevLeafChild(), invalidOffset, blockDirection);
+    if (offset == box->caretRightmostOffset())
+        return leftWordBoundary(box, offset, blockDirection);
+    
+    
+    VisiblePosition wordBreak;
+    if (box->direction() == blockDirection) {
+        if (blockDirection == RTL)
+            wordBreak = positionBeforeNextWord(visiblePosition);
+        else
+            wordBreak = previousWordPosition(visiblePosition);
+    } else {
+        if (blockDirection == RTL)
+            wordBreak = positionAfterPreviousWord(visiblePosition);
+        else
+            wordBreak = nextWordPosition(visiblePosition);
+    }
+    if (positionIsInsideBox(wordBreak, box))
+        return wordBreak;
+    
+    WordBoundaryVector orderedWordBoundaries;
+    if (box->direction() == blockDirection)
+        collectWordBreaksInBoxInsideBlockWithSameDirectionality(box, orderedWordBoundaries);
+    else
+        collectWordBreaksInBoxInsideBlockWithDifferntDirectionality(box, orderedWordBoundaries);
+
+    int index = box->isLeftToRightDirection() ? greatestValueUnder(offset, blockDirection == LTR, orderedWordBoundaries) :
+        smallestOffsetAbove(offset, blockDirection == RTL, orderedWordBoundaries);
+    if (index != invalidOffset)
+        return orderedWordBoundaries[index].visiblePosition;
+    
+    return leftWordBoundary(box->prevLeafChild(), invalidOffset, blockDirection);
+}
+
+VisiblePosition rightWordPosition(const VisiblePosition& visiblePosition)
+{
+    InlineBox* box;
+    int offset;
+    visiblePosition.getInlineBoxAndOffset(box, offset);
+    TextDirection blockDirection = directionOfEnclosingBlock(visiblePosition.deepEquivalent());
+    
+    if (offset == box->caretLeftmostOffset())
+        return rightWordBoundary(box, offset, blockDirection);
+    if (offset == box->caretRightmostOffset())
+        return rightWordBoundary(box->nextLeafChild(), invalidOffset, blockDirection);
+ 
+    VisiblePosition wordBreak;
+    if (box->direction() == blockDirection) {
+        if (blockDirection == LTR)
+            wordBreak = positionBeforeNextWord(visiblePosition);
+        else
+            wordBreak = previousWordPosition(visiblePosition);
+    } else {
+        if (blockDirection == LTR)
+            wordBreak = positionAfterPreviousWord(visiblePosition);
+        else
+            wordBreak = nextWordPosition(visiblePosition);
+    } 
+    if (positionIsInsideBox(wordBreak, box))
+        return wordBreak;
+    
+    WordBoundaryVector orderedWordBoundaries;
+    if (box->direction() == blockDirection)
+        collectWordBreaksInBoxInsideBlockWithSameDirectionality(box, orderedWordBoundaries);
+    else
+        collectWordBreaksInBoxInsideBlockWithDifferntDirectionality(box, orderedWordBoundaries);
+    int index = box->isLeftToRightDirection() ? smallestOffsetAbove(offset, blockDirection == LTR, orderedWordBoundaries) :
+        greatestValueUnder(offset, blockDirection == RTL, orderedWordBoundaries);
+    if (index != invalidOffset)
+        return orderedWordBoundaries[index].visiblePosition;
+    
+    return rightWordBoundary(box->nextLeafChild(), invalidOffset, blockDirection);
+}
+
 }
diff --git a/Source/WebCore/editing/visible_units.h b/Source/WebCore/editing/visible_units.h
index 18b9665..d734f78 100644
--- a/Source/WebCore/editing/visible_units.h
+++ b/Source/WebCore/editing/visible_units.h
@@ -42,6 +42,8 @@ VisiblePosition startOfWord(const VisiblePosition &, EWordSide = RightWordIfOnBo
 VisiblePosition endOfWord(const VisiblePosition &, EWordSide = RightWordIfOnBoundary);
 VisiblePosition previousWordPosition(const VisiblePosition &);
 VisiblePosition nextWordPosition(const VisiblePosition &);
+VisiblePosition rightWordPosition(const VisiblePosition&);
+VisiblePosition leftWordPosition(const VisiblePosition&);
 
 // sentences
 VisiblePosition startOfSentence(const VisiblePosition &);
diff --git a/Source/WebCore/features.pri b/Source/WebCore/features.pri
index 8fbcfee..7a34081 100644
--- a/Source/WebCore/features.pri
+++ b/Source/WebCore/features.pri
@@ -44,6 +44,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
 !contains(DEFINES, ENABLE_DIRECTORY_UPLOAD=.): DEFINES += ENABLE_DIRECTORY_UPLOAD=0
 !contains(DEFINES, ENABLE_FILE_SYSTEM=.): DEFINES += ENABLE_FILE_SYSTEM=0
+!contains(DEFINES, ENABLE_QUOTA=.): DEFINES += ENABLE_QUOTA=0 
 
 # turn on SQLITE support if any of the dependent features are turned on
 !contains(DEFINES, ENABLE_SQLITE=.) {
@@ -75,6 +76,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_WEB_AUDIO=.): DEFINES += ENABLE_WEB_AUDIO=0
 !contains(DEFINES, ENABLE_WEBGL=.): DEFINES += ENABLE_WEBGL=0
 !contains(DEFINES, ENABLE_MEDIA_STATISTICS=.): DEFINES += ENABLE_MEDIA_STATISTICS=0
+!contains(DEFINES, ENABLE_VIDEO_TRACK=.): DEFINES += ENABLE_VIDEO_TRACK=0
 
 # SVG support
 !contains(DEFINES, ENABLE_SVG=0) {
@@ -163,18 +165,18 @@ symbian|maemo5|maemo6 {
     contains(DEFINES, USE_GSTREAMER=1) {
         DEFINES -= ENABLE_VIDEO=0
         DEFINES += ENABLE_VIDEO=1
-        DEFINES -= ENABLE_QT_MULTIMEDIA=1
-        DEFINES += ENABLE_QT_MULTIMEDIA=0
+        DEFINES -= WTF_USE_QT_MULTIMEDIA=1
+        DEFINES += WTF_USE_QT_MULTIMEDIA=0
     } else:contains(MOBILITY_CONFIG, multimedia) {
         DEFINES -= ENABLE_VIDEO=0
         DEFINES += ENABLE_VIDEO=1
-        DEFINES -= ENABLE_QT_MULTIMEDIA=0
-        DEFINES += ENABLE_QT_MULTIMEDIA=1
+        DEFINES -= WTF_USE_QT_MULTIMEDIA=0
+        DEFINES += WTF_USE_QT_MULTIMEDIA=1
     } else:contains(QT_CONFIG, phonon) {
         DEFINES -= ENABLE_VIDEO=0
         DEFINES += ENABLE_VIDEO=1
-        DEFINES -= ENABLE_QT_MULTIMEDIA=1
-        DEFINES += ENABLE_QT_MULTIMEDIA=0
+        DEFINES -= WTF_USE_QT_MULTIMEDIA=1
+        DEFINES += WTF_USE_QT_MULTIMEDIA=0
     }
 }
 
@@ -196,7 +198,6 @@ FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
 v8: FEATURE_DEFINES_JAVASCRIPT += V8_BINDING=1
 contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
 contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
-contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0): DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
 contains(DEFINES, ENABLE_DATAGRID=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
 contains(DEFINES, ENABLE_EVENTSOURCE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
 contains(DEFINES, ENABLE_DATABASE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
@@ -229,4 +230,5 @@ contains(DEFINES, ENABLE_PROGRESS_TAG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_P
 contains(DEFINES, ENABLE_GEOLOCATION=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_GEOLOCATION=1
 contains(DEFINES, ENABLE_BLOB=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_BLOB=1
 contains(DEFINES, ENABLE_MEDIA_STATISTICS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_MEDIA_STATISTICS=1
+contains(DEFINES, ENABLE_VIDEO_TRACK=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO_TRACK=1
 contains(DEFINES, ENABLE_DATA_TRANSFER_ITEMS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATA_TRANSFER_ITEMS=1
diff --git a/Source/WebCore/fileapi/Blob.cpp b/Source/WebCore/fileapi/Blob.cpp
index 90df3c4..3b33cd6 100644
--- a/Source/WebCore/fileapi/Blob.cpp
+++ b/Source/WebCore/fileapi/Blob.cpp
@@ -63,7 +63,7 @@ Blob::~Blob()
 }
 
 #if ENABLE(BLOB)
-PassRefPtr<Blob> Blob::slice(long long start, long long length, const String& contentType) const
+PassRefPtr<Blob> Blob::webkitSlice(long long start, long long end, const String& contentType) const
 {
     // When we slice a file for the first time, we obtain a snapshot of the file by capturing its current size and modification time.
     // The modification time will be used to verify if the file has been changed or not, when the underlying data are accessed.
@@ -77,18 +77,26 @@ PassRefPtr<Blob> Blob::slice(long long start, long long length, const String& co
         size = m_size;
     }
 
+    // Convert the negative value that is used to select from the end.
+    if (start < 0)
+        start = start + size;
+    if (end < 0)
+        end = end + size;
+
     // Clamp the range if it exceeds the size limit.
     if (start < 0)
         start = 0;
-    if (length < 0)
-        length = 0;
-
+    if (end < 0)
+        end = 0;
     if (start >= size) {
         start = 0;
-        length = 0;
-    } else if (start + length > size || length > std::numeric_limits<long long>::max() - start)
-        length = size - start;
+        end = 0;
+    } else if (end < start)
+        end = start;
+    else if (end > size)
+        end = size;
 
+    long long length = end - start;
     OwnPtr<BlobData> blobData = BlobData::create();
     blobData->setContentType(contentType);
     if (isFile())
diff --git a/Source/WebCore/fileapi/Blob.h b/Source/WebCore/fileapi/Blob.h
index 2690ff5..5cefc65 100644
--- a/Source/WebCore/fileapi/Blob.h
+++ b/Source/WebCore/fileapi/Blob.h
@@ -63,7 +63,7 @@ public:
     virtual bool isFile() const { return false; }
 
 #if ENABLE(BLOB)
-    PassRefPtr<Blob> slice(long long start, long long length, const String& contentType = String()) const;
+    PassRefPtr<Blob> webkitSlice(long long start, long long end = std::numeric_limits<long long>::max(), const String& contentType = String()) const;
 #endif
 
 protected:
diff --git a/Source/WebCore/fileapi/Blob.idl b/Source/WebCore/fileapi/Blob.idl
index 297d039..8511c8e 100644
--- a/Source/WebCore/fileapi/Blob.idl
+++ b/Source/WebCore/fileapi/Blob.idl
@@ -38,7 +38,7 @@ module html {
 
 #if !defined(LANGUAGE_OBJECTIVE_C)
 #if defined(ENABLE_BLOB) && ENABLE_BLOB
-        Blob slice(in long long start, in long long length, in [Optional, ConvertUndefinedOrNullToNullString] DOMString contentType);
+        Blob webkitSlice(in long long start, in [Optional] long long end, in [Optional, ConvertUndefinedOrNullToNullString] DOMString contentType);
 #endif
 #endif
     };
diff --git a/Source/WebCore/fileapi/DOMFileSystemBase.cpp b/Source/WebCore/fileapi/DOMFileSystemBase.cpp
index 788d967..eafb815 100644
--- a/Source/WebCore/fileapi/DOMFileSystemBase.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystemBase.cpp
@@ -54,6 +54,8 @@ const char DOMFileSystemBase::kPersistentPathPrefix[] = "persistent";
 const size_t DOMFileSystemBase::kPersistentPathPrefixLength = sizeof(DOMFileSystemBase::kPersistentPathPrefix) - 1;
 const char DOMFileSystemBase::kTemporaryPathPrefix[] = "temporary";
 const size_t DOMFileSystemBase::kTemporaryPathPrefixLength = sizeof(DOMFileSystemBase::kTemporaryPathPrefix) - 1;
+const char DOMFileSystemBase::kExternalPathPrefix[] = "external";
+const size_t DOMFileSystemBase::kExternalPathPrefixLength = sizeof(DOMFileSystemBase::kExternalPathPrefix) - 1;
 
 bool DOMFileSystemBase::crackFileSystemURL(const KURL& url, AsyncFileSystem::Type& type, String& filePath)
 {
@@ -72,6 +74,9 @@ bool DOMFileSystemBase::crackFileSystemURL(const KURL& url, AsyncFileSystem::Typ
     } else if (path.startsWith(kPersistentPathPrefix)) {
         type = AsyncFileSystem::Persistent;
         path = path.substring(kPersistentPathPrefixLength);
+    } else if (path.startsWith(kExternalPathPrefix)) {
+        type = AsyncFileSystem::External;
+        path = path.substring(kExternalPathPrefixLength);
     } else
         return false;
 
@@ -200,7 +205,7 @@ bool DOMFileSystemBase::getParent(const EntryBase* entry, PassRefPtr<EntryCallba
     return true;
 }
 
-bool DOMFileSystemBase::getFile(const EntryBase* base, const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+bool DOMFileSystemBase::getFile(const EntryBase* base, const String& path, PassRefPtr<WebKitFlags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     String absolutePath;
     if (!pathToAbsolutePath(base, path, absolutePath))
@@ -215,7 +220,7 @@ bool DOMFileSystemBase::getFile(const EntryBase* base, const String& path, PassR
     return true;
 }
 
-bool DOMFileSystemBase::getDirectory(const EntryBase* base, const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+bool DOMFileSystemBase::getDirectory(const EntryBase* base, const String& path, PassRefPtr<WebKitFlags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     String absolutePath;
     if (!pathToAbsolutePath(base, path, absolutePath))
diff --git a/Source/WebCore/fileapi/DOMFileSystemBase.h b/Source/WebCore/fileapi/DOMFileSystemBase.h
index 6332b63..8bc0b65 100644
--- a/Source/WebCore/fileapi/DOMFileSystemBase.h
+++ b/Source/WebCore/fileapi/DOMFileSystemBase.h
@@ -34,7 +34,7 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "AsyncFileSystem.h"
-#include "Flags.h"
+#include "WebKitFlags.h"
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -66,6 +66,8 @@ public:
     static const size_t kPersistentPathPrefixLength;
     static const char kTemporaryPathPrefix[];
     static const size_t kTemporaryPathPrefixLength;
+    static const char kExternalPathPrefix[];
+    static const size_t kExternalPathPrefixLength;
     static bool crackFileSystemURL(const KURL&, AsyncFileSystem::Type&, String& filePath);
 
     const String& name() const { return m_name; }
@@ -80,8 +82,8 @@ public:
     bool remove(const EntryBase*, PassRefPtr<VoidCallback>, PassRefPtr<ErrorCallback>);
     bool removeRecursively(const EntryBase*, PassRefPtr<VoidCallback>, PassRefPtr<ErrorCallback>);
     bool getParent(const EntryBase*, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-    bool getFile(const EntryBase*, const String& path, PassRefPtr<Flags>, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-    bool getDirectory(const EntryBase*, const String& path, PassRefPtr<Flags>, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+    bool getFile(const EntryBase*, const String& path, PassRefPtr<WebKitFlags>, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+    bool getDirectory(const EntryBase*, const String& path, PassRefPtr<WebKitFlags>, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
     bool readDirectory(PassRefPtr<DirectoryReaderBase>, const String& path, PassRefPtr<EntriesCallback>, PassRefPtr<ErrorCallback>);
 
 protected:
diff --git a/Source/WebCore/fileapi/DirectoryEntry.cpp b/Source/WebCore/fileapi/DirectoryEntry.cpp
index 7bc0af8..0f6e49f 100644
--- a/Source/WebCore/fileapi/DirectoryEntry.cpp
+++ b/Source/WebCore/fileapi/DirectoryEntry.cpp
@@ -51,14 +51,14 @@ PassRefPtr<DirectoryReader> DirectoryEntry::createReader()
     return DirectoryReader::create(m_fileSystem, m_fullPath);
 }
 
-void DirectoryEntry::getFile(const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef)
+void DirectoryEntry::getFile(const String& path, PassRefPtr<WebKitFlags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef)
 {
     RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
     if (!m_fileSystem->getFile(this, path, flags, successCallback, errorCallback))
         filesystem()->scheduleCallback(errorCallback.release(), FileError::create(FileError::INVALID_MODIFICATION_ERR));
 }
 
-void DirectoryEntry::getDirectory(const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef)
+void DirectoryEntry::getDirectory(const String& path, PassRefPtr<WebKitFlags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef)
 {
     RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
     if (!m_fileSystem->getDirectory(this, path, flags, successCallback, errorCallback))
diff --git a/Source/WebCore/fileapi/DirectoryEntry.h b/Source/WebCore/fileapi/DirectoryEntry.h
index da903da..8227047 100644
--- a/Source/WebCore/fileapi/DirectoryEntry.h
+++ b/Source/WebCore/fileapi/DirectoryEntry.h
@@ -34,7 +34,7 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "Entry.h"
-#include "Flags.h"
+#include "WebKitFlags.h"
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -56,8 +56,8 @@ public:
     virtual bool isDirectory() const { return true; }
 
     PassRefPtr<DirectoryReader> createReader();
-    void getFile(const String& path, PassRefPtr<Flags> = 0, PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
-    void getDirectory(const String& path, PassRefPtr<Flags> = 0, PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
+    void getFile(const String& path, PassRefPtr<WebKitFlags> = 0, PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
+    void getDirectory(const String& path, PassRefPtr<WebKitFlags> = 0, PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
     void removeRecursively(PassRefPtr<VoidCallback> successCallback = 0, PassRefPtr<ErrorCallback> = 0) const;
 
 private:
diff --git a/Source/WebCore/fileapi/DirectoryEntry.idl b/Source/WebCore/fileapi/DirectoryEntry.idl
index 0e38153..8ba9549 100644
--- a/Source/WebCore/fileapi/DirectoryEntry.idl
+++ b/Source/WebCore/fileapi/DirectoryEntry.idl
@@ -36,8 +36,8 @@ module storage {
         NoStaticTables
     ] DirectoryEntry : Entry {
         DirectoryReader createReader();
-        [Custom] void getFile(in [ConvertUndefinedOrNullToNullString] DOMString path, in [Optional] Flags flags, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
-        [Custom] void getDirectory(in [ConvertUndefinedOrNullToNullString] DOMString path, in [Optional] Flags flags, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
+        [Custom] void getFile(in [ConvertUndefinedOrNullToNullString] DOMString path, in [Optional] WebKitFlags flags, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
+        [Custom] void getDirectory(in [ConvertUndefinedOrNullToNullString] DOMString path, in [Optional] WebKitFlags flags, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void removeRecursively(in [Optional, Callback] VoidCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
     };
 }
diff --git a/Source/WebCore/fileapi/DirectoryEntrySync.cpp b/Source/WebCore/fileapi/DirectoryEntrySync.cpp
index e68f7be..10deace 100644
--- a/Source/WebCore/fileapi/DirectoryEntrySync.cpp
+++ b/Source/WebCore/fileapi/DirectoryEntrySync.cpp
@@ -51,7 +51,7 @@ PassRefPtr<DirectoryReaderSync> DirectoryEntrySync::createReader(ExceptionCode&)
     return DirectoryReaderSync::create(m_fileSystem, m_fullPath);
 }
 
-PassRefPtr<FileEntrySync> DirectoryEntrySync::getFile(const String& path, PassRefPtr<Flags> flags, ExceptionCode& ec)
+PassRefPtr<FileEntrySync> DirectoryEntrySync::getFile(const String& path, PassRefPtr<WebKitFlags> flags, ExceptionCode& ec)
 {
     ec = 0;
     EntrySyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
@@ -62,7 +62,7 @@ PassRefPtr<FileEntrySync> DirectoryEntrySync::getFile(const String& path, PassRe
     return static_pointer_cast<FileEntrySync>(helper.getResult(ec));
 }
 
-PassRefPtr<DirectoryEntrySync> DirectoryEntrySync::getDirectory(const String& path, PassRefPtr<Flags> flags, ExceptionCode& ec)
+PassRefPtr<DirectoryEntrySync> DirectoryEntrySync::getDirectory(const String& path, PassRefPtr<WebKitFlags> flags, ExceptionCode& ec)
 {
     ec = 0;
     EntrySyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
diff --git a/Source/WebCore/fileapi/DirectoryEntrySync.h b/Source/WebCore/fileapi/DirectoryEntrySync.h
index eb412bb..62b481a 100644
--- a/Source/WebCore/fileapi/DirectoryEntrySync.h
+++ b/Source/WebCore/fileapi/DirectoryEntrySync.h
@@ -34,7 +34,7 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "EntrySync.h"
-#include "Flags.h"
+#include "WebKitFlags.h"
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -53,8 +53,8 @@ public:
     virtual bool isDirectory() const { return true; }
 
     PassRefPtr<DirectoryReaderSync> createReader(ExceptionCode&);
-    PassRefPtr<FileEntrySync> getFile(const String& path, PassRefPtr<Flags>, ExceptionCode&);
-    PassRefPtr<DirectoryEntrySync> getDirectory(const String& path, PassRefPtr<Flags>, ExceptionCode&);
+    PassRefPtr<FileEntrySync> getFile(const String& path, PassRefPtr<WebKitFlags>, ExceptionCode&);
+    PassRefPtr<DirectoryEntrySync> getDirectory(const String& path, PassRefPtr<WebKitFlags>, ExceptionCode&);
     void removeRecursively(ExceptionCode&);
 
 private:
diff --git a/Source/WebCore/fileapi/DirectoryEntrySync.idl b/Source/WebCore/fileapi/DirectoryEntrySync.idl
index 268b2a9..b0ab178 100644
--- a/Source/WebCore/fileapi/DirectoryEntrySync.idl
+++ b/Source/WebCore/fileapi/DirectoryEntrySync.idl
@@ -36,8 +36,8 @@ module storage {
         NoStaticTables
     ] DirectoryEntrySync : EntrySync {
         DirectoryReaderSync createReader() raises (FileException);
-        [Custom] FileEntrySync getFile(in [ConvertUndefinedOrNullToNullString] DOMString path, in Flags flags) raises (FileException);
-        [Custom] DirectoryEntrySync getDirectory(in [ConvertUndefinedOrNullToNullString] DOMString path, in Flags flags) raises (FileException);
+        [Custom] FileEntrySync getFile(in [ConvertUndefinedOrNullToNullString] DOMString path, in WebKitFlags flags) raises (FileException);
+        [Custom] DirectoryEntrySync getDirectory(in [ConvertUndefinedOrNullToNullString] DOMString path, in WebKitFlags flags) raises (FileException);
         void removeRecursively() raises (FileException);
     };
 }
diff --git a/Source/WebCore/fileapi/EntryBase.cpp b/Source/WebCore/fileapi/EntryBase.cpp
index e10964a..39453f6 100644
--- a/Source/WebCore/fileapi/EntryBase.cpp
+++ b/Source/WebCore/fileapi/EntryBase.cpp
@@ -64,7 +64,17 @@ String EntryBase::toURL()
     result.append("filesystem:");
     result.append(originString);
     result.append("/");
-    result.append(m_fileSystem->asyncFileSystem()->type() == AsyncFileSystem::Temporary ? DOMFileSystemBase::kTemporaryPathPrefix : DOMFileSystemBase::kPersistentPathPrefix);
+    switch (m_fileSystem->asyncFileSystem()->type()) {
+    case AsyncFileSystem::Temporary:
+        result.append(DOMFileSystemBase::kTemporaryPathPrefix);
+        break;
+    case AsyncFileSystem::Persistent:
+        result.append(DOMFileSystemBase::kPersistentPathPrefix);
+        break;
+    case AsyncFileSystem::External:
+        result.append(DOMFileSystemBase::kExternalPathPrefix);
+        break;
+    }
     result.append(m_fullPath);
     return result.toString();
 }
diff --git a/Source/WebCore/fileapi/FileReaderLoader.cpp b/Source/WebCore/fileapi/FileReaderLoader.cpp
index 918ffba..c9ef688 100644
--- a/Source/WebCore/fileapi/FileReaderLoader.cpp
+++ b/Source/WebCore/fileapi/FileReaderLoader.cpp
@@ -154,16 +154,16 @@ void FileReaderLoader::didReceiveResponse(const ResourceResponse& response)
         m_client->didStartLoading();
 }
 
-void FileReaderLoader::didReceiveData(const char* data, int lengthReceived)
+void FileReaderLoader::didReceiveData(const char* data, int dataLength)
 {
     ASSERT(data);
-    ASSERT(lengthReceived > 0);
+    ASSERT(dataLength > 0);
 
     // Bail out if we already encountered an error.
     if (m_errorCode)
         return;
 
-    int length = lengthReceived;
+    int length = dataLength;
     unsigned remainingBufferSpace = m_totalBytes - m_bytesLoaded;
     if (length > static_cast<long long>(remainingBufferSpace))
         length = static_cast<int>(remainingBufferSpace);
diff --git a/Source/WebCore/fileapi/BlobBuilder.cpp b/Source/WebCore/fileapi/WebKitBlobBuilder.cpp
index 9406899..2f40db7 100644
--- a/Source/WebCore/fileapi/BlobBuilder.cpp
+++ b/Source/WebCore/fileapi/WebKitBlobBuilder.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#include "BlobBuilder.h"
+#include "WebKitBlobBuilder.h"
 
 #include "ArrayBuffer.h"
 #include "Blob.h"
@@ -45,12 +45,12 @@
 
 namespace WebCore {
 
-BlobBuilder::BlobBuilder()
+WebKitBlobBuilder::WebKitBlobBuilder()
     : m_size(0)
 {
 }
 
-Vector<char>& BlobBuilder::getBuffer()
+Vector<char>& WebKitBlobBuilder::getBuffer()
 {
     // If the last item is not a data item, create one. Otherwise, we simply append the new string to the last data item.
     if (m_items.isEmpty() || m_items[m_items.size() - 1].type != BlobDataItem::Data)
@@ -59,7 +59,7 @@ Vector<char>& BlobBuilder::getBuffer()
     return *m_items[m_items.size() - 1].data->mutableData();
 }
 
-void BlobBuilder::append(const String& text, const String& endingType, ExceptionCode& ec)
+void WebKitBlobBuilder::append(const String& text, const String& endingType, ExceptionCode& ec)
 {
     bool isEndingTypeTransparent = endingType == "transparent";
     bool isEndingTypeNative = endingType == "native";
@@ -80,13 +80,13 @@ void BlobBuilder::append(const String& text, const String& endingType, Exception
     m_size += buffer.size() - oldSize;
 }
 
-void BlobBuilder::append(const String& text, ExceptionCode& ec)
+void WebKitBlobBuilder::append(const String& text, ExceptionCode& ec)
 {
     append(text, String(), ec);
 }
 
 #if ENABLE(BLOB)
-void BlobBuilder::append(ArrayBuffer* arrayBuffer)
+void WebKitBlobBuilder::append(ArrayBuffer* arrayBuffer)
 {
     Vector<char>& buffer = getBuffer();
     size_t oldSize = buffer.size();
@@ -95,7 +95,7 @@ void BlobBuilder::append(ArrayBuffer* arrayBuffer)
 }
 #endif
 
-void BlobBuilder::append(Blob* blob)
+void WebKitBlobBuilder::append(Blob* blob)
 {
     if (blob->isFile()) {
         // If the blob is file that is not snapshoted, capture the snapshot now.
@@ -114,7 +114,7 @@ void BlobBuilder::append(Blob* blob)
     }
 }
 
-PassRefPtr<Blob> BlobBuilder::getBlob(const String& contentType)
+PassRefPtr<Blob> WebKitBlobBuilder::getBlob(const String& contentType)
 {
     OwnPtr<BlobData> blobData = BlobData::create();
     blobData->setContentType(contentType);
diff --git a/Source/WebCore/fileapi/BlobBuilder.h b/Source/WebCore/fileapi/WebKitBlobBuilder.h
index db46591..34396fe 100644
--- a/Source/WebCore/fileapi/BlobBuilder.h
+++ b/Source/WebCore/fileapi/WebKitBlobBuilder.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef BlobBuilder_h
-#define BlobBuilder_h
+#ifndef WebKitBlobBuilder_h
+#define WebKitBlobBuilder_h
 
 #include "BlobData.h"
 #include <wtf/Forward.h>
@@ -43,9 +43,9 @@ class TextEncoding;
 
 typedef int ExceptionCode;
 
-class BlobBuilder : public RefCounted<BlobBuilder> {
+class WebKitBlobBuilder : public RefCounted<WebKitBlobBuilder> {
 public:
-    static PassRefPtr<BlobBuilder> create() { return adoptRef(new BlobBuilder()); }
+    static PassRefPtr<WebKitBlobBuilder> create() { return adoptRef(new WebKitBlobBuilder()); }
 
     void append(Blob*);
     void append(const String& text, ExceptionCode&);
@@ -57,7 +57,7 @@ public:
     PassRefPtr<Blob> getBlob(const String& contentType = String());
 
 private:
-    BlobBuilder();
+    WebKitBlobBuilder();
 
     Vector<char>& getBuffer();
 
@@ -67,4 +67,4 @@ private:
 
 } // namespace WebCore
 
-#endif // BlobBuilder_h
+#endif // WebKitBlobBuilder_h
diff --git a/Source/WebCore/fileapi/BlobBuilder.idl b/Source/WebCore/fileapi/WebKitBlobBuilder.idl
index 8f5049f..60d0c0a 100644
--- a/Source/WebCore/fileapi/BlobBuilder.idl
+++ b/Source/WebCore/fileapi/WebKitBlobBuilder.idl
@@ -33,7 +33,7 @@ module html {
         CanBeConstructed,
         GenerateNativeConverter,
         NoStaticTables
-    ] BlobBuilder {
+    ] WebKitBlobBuilder {
 #if !defined(LANGUAGE_OBJECTIVE_C)
         Blob getBlob(in [Optional, ConvertUndefinedOrNullToNullString] DOMString contentType);
 #endif
diff --git a/Source/WebCore/fileapi/Flags.h b/Source/WebCore/fileapi/WebKitFlags.h
index 30884fc..a75b472 100644
--- a/Source/WebCore/fileapi/Flags.h
+++ b/Source/WebCore/fileapi/WebKitFlags.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef Flags_h
-#define Flags_h
+#ifndef WebKitFlags_h
+#define WebKitFlags_h
 
 #if ENABLE(FILE_SYSTEM)
 
@@ -38,11 +38,11 @@
 
 namespace WebCore {
 
-class Flags : public RefCounted<Flags> {
+class WebKitFlags : public RefCounted<WebKitFlags> {
 public:
-    static PassRefPtr<Flags> create(bool create = false, bool exclusive = false)
+    static PassRefPtr<WebKitFlags> create(bool create = false, bool exclusive = false)
     {
-        return adoptRef(new Flags(create, exclusive));
+        return adoptRef(new WebKitFlags(create, exclusive));
     }
 
     bool isCreate() const { return m_create; }
@@ -51,7 +51,7 @@ public:
     void setExclusive(bool exclusive) { m_exclusive = exclusive; }
 
 private:
-    Flags(bool create, bool exclusive)
+    WebKitFlags(bool create, bool exclusive)
         : m_create(create)
         , m_exclusive(exclusive)
     {
@@ -64,4 +64,4 @@ private:
 
 #endif // ENABLE(FILE_SYSTEM)
 
-#endif // Flags_h
+#endif // WebKitFlags_h
diff --git a/Source/WebCore/fileapi/Flags.idl b/Source/WebCore/fileapi/WebKitFlags.idl
index 88cede3..533796a 100644
--- a/Source/WebCore/fileapi/Flags.idl
+++ b/Source/WebCore/fileapi/WebKitFlags.idl
@@ -33,7 +33,7 @@ module storage {
         Conditional=FILE_SYSTEM,
         CanBeConstructed,
         NoStaticTables
-    ] Flags {
+    ] WebKitFlags {
         attribute boolean create;
         attribute boolean exclusive;
     };
diff --git a/Source/WebCore/gyp/gtk.gyp b/Source/WebCore/gyp/gtk.gyp
new file mode 100644
index 0000000..f4fb3cb
--- /dev/null
+++ b/Source/WebCore/gyp/gtk.gyp
@@ -0,0 +1,17 @@
+{ # Just a stub file to allow Source/gyp/configure to run successfully for testing.
+  'includes': [
+    '../../gyp/common.gypi',
+    '../WebCore.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'WebCore',
+      'type': 'static_library',
+      'sources': [
+        '<@(webcore_files)',
+        '<@(webcore_privateheader_files)',
+        '<@(webcore_derived_source_files)',
+      ],
+    },
+   ], # targets
+}
diff --git a/Source/WebCore/gyp/streamline-inspector-source.sh b/Source/WebCore/gyp/streamline-inspector-source.sh
index 330d6ed..6611554 100755
--- a/Source/WebCore/gyp/streamline-inspector-source.sh
+++ b/Source/WebCore/gyp/streamline-inspector-source.sh
@@ -6,14 +6,18 @@ if [[ ${CONFIGURATION:=Debug} == "Debug" ]]; then
 fi
 
 # Combine all script resources in the inspector.html file.
-"$SRCROOT/../combine-javascript-resources" --input-html "${SRCROOT}/../inspector/front-end/inspector.html" --generated-scripts-dir ${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore --output-dir "${DERIVED_FILE_DIR}/WebCore" --output-script-name inspector.js
+"$SRCROOT/../inspector/combine-javascript-resources.pl" --input-html "${SRCROOT}/../inspector/front-end/inspector.html" --generated-scripts-dir ${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore --output-dir "${DERIVED_FILE_DIR}/WebCore" --output-script-name inspector.js
+
+# Inline script imports in ScriptFormatterWorker.js file.
+"$SRCROOT/../inspector/inline-javascript-imports.py" "${SRCROOT}/../inspector/front-end/ScriptFormatterWorker.js" "${SRCROOT}/../inspector/front-end" "${DERIVED_FILE_DIR}/WebCore/scriptFormatterWorker.js"
 
 if [ -d "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector" ]; then
-    # Remove any JavaScript files, since they will be replaced with the combined file.
+    # Remove any JavaScript files, since they will be replaced with the combined files.
     cd "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
     rm *.js
 
-    # Copy the modified HTML file and the combined script.
+    # Copy the modified HTML file and the combined scripts.
     cp "${DERIVED_FILE_DIR}/WebCore/inspector.html" inspector.html
     cp "${DERIVED_FILE_DIR}/WebCore/inspector.js" inspector.js
+    cp "${DERIVED_FILE_DIR}/WebCore/scriptFormatterWorker.js" scriptFormatterWorker.js
 fi
diff --git a/Source/WebCore/history/CachedPage.cpp b/Source/WebCore/history/CachedPage.cpp
index acbfd31..1eb7af6 100644
--- a/Source/WebCore/history/CachedPage.cpp
+++ b/Source/WebCore/history/CachedPage.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CachedPage.h"
 
+#include "CSSStyleSelector.h"
 #include "FocusController.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -49,6 +50,7 @@ PassRefPtr<CachedPage> CachedPage::create(Page* page)
 CachedPage::CachedPage(Page* page)
     : m_timeStamp(currentTime())
     , m_cachedMainFrame(CachedFrame::create(page->mainFrame()))
+    , m_needStyleRecalcForVisitedLinks(false)
 {
 #ifndef NDEBUG
     cachedPageCounter.increment();
@@ -80,7 +82,14 @@ void CachedPage::restore(Page* page)
         if (node->isElementNode())
             static_cast<Element*>(node)->updateFocusAppearance(true);
     }
-    
+
+    if (m_needStyleRecalcForVisitedLinks) {
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (CSSStyleSelector* styleSelector = frame->document()->styleSelector())
+                styleSelector->allVisitedStateChanged();
+        }
+    }
+
     clear();
 }
 
@@ -89,6 +98,7 @@ void CachedPage::clear()
     ASSERT(m_cachedMainFrame);
     m_cachedMainFrame->clear();
     m_cachedMainFrame = 0;
+    m_needStyleRecalcForVisitedLinks = false;
 }
 
 void CachedPage::destroy()
diff --git a/Source/WebCore/history/CachedPage.h b/Source/WebCore/history/CachedPage.h
index 4741c79..8a226be 100644
--- a/Source/WebCore/history/CachedPage.h
+++ b/Source/WebCore/history/CachedPage.h
@@ -50,11 +50,14 @@ public:
     
     CachedFrame* cachedMainFrame() { return m_cachedMainFrame.get(); }
 
+    void markForVistedLinkStyleRecalc() { m_needStyleRecalcForVisitedLinks = true; }
+
 private:
     CachedPage(Page*);
 
     double m_timeStamp;
     RefPtr<CachedFrame> m_cachedMainFrame;
+    bool m_needStyleRecalcForVisitedLinks;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/history/HistoryItem.h b/Source/WebCore/history/HistoryItem.h
index b9c9983..f96469f 100644
--- a/Source/WebCore/history/HistoryItem.h
+++ b/Source/WebCore/history/HistoryItem.h
@@ -29,6 +29,7 @@
 #include "IntPoint.h"
 #include "PlatformString.h"
 #include "SerializedScriptValue.h"
+#include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
diff --git a/Source/WebCore/history/PageCache.cpp b/Source/WebCore/history/PageCache.cpp
index d57df65..204ab36 100644
--- a/Source/WebCore/history/PageCache.cpp
+++ b/Source/WebCore/history/PageCache.cpp
@@ -341,6 +341,12 @@ int PageCache::autoreleasedPageCount() const
     return m_autoreleaseSet.size();
 }
 
+void PageCache::markPagesForVistedLinkStyleRecalc()
+{
+    for (HistoryItem* current = m_head; current; current = current->m_next)
+        current->m_cachedPage->markForVistedLinkStyleRecalc();
+}
+
 void PageCache::add(PassRefPtr<HistoryItem> prpItem, Page* page)
 {
     ASSERT(prpItem);
diff --git a/Source/WebCore/history/PageCache.h b/Source/WebCore/history/PageCache.h
index 912bd65..1bd2e13 100644
--- a/Source/WebCore/history/PageCache.h
+++ b/Source/WebCore/history/PageCache.h
@@ -59,6 +59,8 @@ namespace WebCore {
         int frameCount() const;
         int autoreleasedPageCount() const;
 
+        void markPagesForVistedLinkStyleRecalc();
+
     private:
         typedef HashSet<RefPtr<CachedPage> > CachedPageSet;
 
diff --git a/Source/WebCore/html/FormAssociatedElement.h b/Source/WebCore/html/FormAssociatedElement.h
index aa5abd9..7f3e9ac 100644
--- a/Source/WebCore/html/FormAssociatedElement.h
+++ b/Source/WebCore/html/FormAssociatedElement.h
@@ -46,7 +46,6 @@ public:
 
     virtual bool isFormControlElement() const = 0;
     virtual bool isEnumeratable() const = 0;
-    virtual bool isResettable() const = 0;
 
     const AtomicString& name() const { return formControlName(); }
 
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index 3a6fea4..5e0fe7b 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -85,6 +85,7 @@ coords
 data
 datetime
 declare
+default
 defer
 dir
 direction
@@ -118,6 +119,7 @@ incremental
 indeterminate
 ismap
 keytype
+kind
 label
 lang
 language
@@ -178,8 +180,6 @@ onerror
 onfocus
 onfocusin
 onfocusout
-onformchange
-onforminput
 onhashchange
 oninput
 oninvalid
@@ -276,6 +276,7 @@ x-webkit-speech
 x-webkit-grammar
 spellcheck
 src
+srclang
 standby
 start
 step
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 67d1caa..1747273 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -175,7 +175,7 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type, Canvas
 #if ENABLE(WEBGL)    
     Settings* settings = document()->settings();
     if (settings && settings->webGLEnabled()
-#if !PLATFORM(CHROMIUM)
+#if !PLATFORM(CHROMIUM) && !PLATFORM(GTK)
         && settings->acceleratedCompositingEnabled()
 #endif
         ) {
@@ -318,27 +318,6 @@ void HTMLCanvasElement::clearPresentationCopy()
     m_presentedImage.clear();
 }
 
-void HTMLCanvasElement::attach()
-{
-    HTMLElement::attach();
-
-    if (m_context && m_context->is2d()) {
-        CanvasRenderingContext2D* ctx = static_cast<CanvasRenderingContext2D*>(m_context.get());
-        ctx->updateFont();
-    }
-}
-
-void HTMLCanvasElement::recalcStyle(StyleChange change)
-{
-    HTMLElement::recalcStyle(change);
-
-    // Update font if needed.
-    if (change == Force && m_context && m_context->is2d()) {
-        CanvasRenderingContext2D* ctx = static_cast<CanvasRenderingContext2D*>(m_context.get());
-        ctx->updateFont();
-    }
-}
-
 void HTMLCanvasElement::setSurfaceSize(const IntSize& size)
 {
     m_size = size;
@@ -363,8 +342,12 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, const double* qualit
     if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(lowercaseMimeType))
         lowercaseMimeType = "image/png";
 
+<<<<<<< HEAD
 #if PLATFORM(CG) || (USE(SKIA) && !PLATFORM(ANDROID))
     // FIXME: Consider using this code path on Android. http://b/4572024
+=======
+#if USE(CG) || USE(SKIA)
+>>>>>>> WebKit.org at r84325
     // Try to get ImageData first, as that may avoid lossy conversions.
     RefPtr<ImageData> imageData = getImageData();
 
@@ -460,10 +443,8 @@ void HTMLCanvasElement::createImageBuffer() const
     m_imageBuffer->context()->setImageInterpolationQuality(DefaultInterpolationQuality);
 
 #if USE(JSC)
-    if (hasCachedDOMNodeWrapperUnchecked(document(), const_cast<HTMLCanvasElement*>(this))) {
-        JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-        scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(m_imageBuffer->dataSize());
-    }
+    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+    scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(m_imageBuffer->dataSize());
 #endif
 }
 
diff --git a/Source/WebCore/html/HTMLCanvasElement.h b/Source/WebCore/html/HTMLCanvasElement.h
index 6fdd222..9eab209 100644
--- a/Source/WebCore/html/HTMLCanvasElement.h
+++ b/Source/WebCore/html/HTMLCanvasElement.h
@@ -34,7 +34,7 @@
 
 #if PLATFORM(CHROMIUM) || PLATFORM(QT)
 #define DefaultInterpolationQuality InterpolationMedium
-#elif PLATFORM(CG)
+#elif USE(CG)
 #define DefaultInterpolationQuality InterpolationLow
 #else
 #define DefaultInterpolationQuality InterpolationDefault
@@ -150,10 +150,6 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    virtual void attach();
-
-    virtual void recalcStyle(StyleChange);
-
     void reset();
 
     void createImageBuffer() const;
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index f9c2f6c..b41f5dd 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -21,11 +21,12 @@
 #include "config.h"
 #include "HTMLDetailsElement.h"
 
-#include "Frame.h"
 #include "HTMLNames.h"
+#include "HTMLSummaryElement.h"
+#include "LocalizedStrings.h"
 #include "MouseEvent.h"
-#include "PlatformMouseEvent.h"
 #include "RenderDetails.h"
+#include "Text.h"
 
 namespace WebCore {
 
@@ -49,48 +50,76 @@ RenderObject* HTMLDetailsElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderDetails(this);
 }
 
-void HTMLDetailsElement::findMainSummary()
+Node* HTMLDetailsElement::findSummaryFor(ContainerNode* container)
 {
-    m_mainSummary = 0;
+    for (Node* child = container->firstChild(); child; child = child->nextSibling()) {
+        if (child->hasTagName(summaryTag))
+            return child;
+    }
 
-    for (Node* child = firstChild(); child; child = child->nextSibling()) {
-        if (child->hasTagName(summaryTag)) {
-            m_mainSummary = child;
-            break;
-        }
+    return 0;
+}
+
+Node* HTMLDetailsElement::findMainSummary()
+{
+    Node* found = findSummaryFor(this);
+    if (found) {
+        removeShadowRoot();
+        return found;
     }
+    
+    createShadowSubtree();
+    found = findSummaryFor(shadowRoot());
+    ASSERT(found);
+    return found;
+}
+
+void HTMLDetailsElement::refreshMainSummary(RefreshRenderer refreshRenderer)
+{
+    RefPtr<Node> oldSummary = m_mainSummary;
+    m_mainSummary = findMainSummary();
+
+    if (oldSummary == m_mainSummary || !attached())
+        return;
+
+    if (oldSummary && oldSummary->parentNodeForRenderingAndStyle()) {
+        oldSummary->detach();
+        oldSummary->attach();
+    }
+        
+    if (refreshRenderer == RefreshRendererAllowed) {
+        m_mainSummary->detach();
+        m_mainSummary->attach();
+    }
+}
+
+void HTMLDetailsElement::createShadowSubtree()
+{
+    if (shadowRoot())
+        return;
+
+    RefPtr<HTMLSummaryElement> defaultSummary = HTMLSummaryElement::create(summaryTag, document());
+    ExceptionCode ec = 0;
+    defaultSummary->appendChild(Text::create(document(), defaultDetailsSummaryText()), ec);
+    ensureShadowRoot()->appendChild(defaultSummary, ec, true);
 }
 
+
 void HTMLDetailsElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-    if (!changedByParser) {
-        Node* oldSummary = m_mainSummary;
-        findMainSummary();
-
-        if (oldSummary != m_mainSummary && !m_isOpen && attached()) {
-            if (oldSummary && oldSummary->attached())
-                oldSummary->detach();
-            if (m_mainSummary && childCountDelta < 0 && !m_mainSummary->renderer()) {
-                // If childCountDelta is less then zero and the main summary has changed it must be because previous main
-                // summary was removed. The new main summary was then inside the unrevealed content and needs to be
-                // reattached to create its renderer. If childCountDelta is not less then zero then a new <summary> element
-                // has been added and it will be attached without our help.
-                m_mainSummary->detach();
-                m_mainSummary->attach();
-            }
-        }
-    }
+    // If childCountDelta is less then zero and the main summary has changed it must be because previous main
+    // summary was removed. The new main summary was then inside the unrevealed content and needs to be
+    // reattached to create its renderer. If childCountDelta is not less then zero then a new <summary> element
+    // has been added and it will be attached without our help.
+    if (!changedByParser)
+        refreshMainSummary(childCountDelta < 0 ? RefreshRendererAllowed : RefreshRendererSupressed);
 }
 
 void HTMLDetailsElement::finishParsingChildren()
 {
     HTMLElement::finishParsingChildren();
-    findMainSummary();
-    if (attached() && m_mainSummary && !m_mainSummary->renderer()) {
-        m_mainSummary->detach();
-        m_mainSummary->attach();
-    }
+    refreshMainSummary(RefreshRendererAllowed);
 }
 
 void HTMLDetailsElement::parseMappedAttribute(Attribute* attr)
@@ -111,26 +140,9 @@ bool HTMLDetailsElement::childShouldCreateRenderer(Node* child) const
     return m_isOpen || child == m_mainSummary;
 }
 
-void HTMLDetailsElement::defaultEventHandler(Event* event)
+void HTMLDetailsElement::toggleOpen()
 {
-    HTMLElement::defaultEventHandler(event);
-
-    if (!renderer() || !renderer()->isDetails() || !event->isMouseEvent() || event->type() != eventNames().clickEvent || event->defaultHandled())
-        return;
-
-    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
-    if (mouseEvent->button() != LeftButton)
-        return;
-
-    RenderDetails* renderDetails = static_cast<RenderDetails*>(renderer());
-
-    float factor = document() && document()->frame() ? document()->frame()->pageZoomFactor() : 1.0f;
-    FloatPoint pos = renderDetails->absoluteToLocal(FloatPoint(mouseEvent->pageX() * factor, mouseEvent->pageY() * factor));
-
-    if (renderDetails->interactiveArea().contains(pos.x(), pos.y())) {
-        setAttribute(openAttr, m_isOpen ? String() : String(""));
-        event->setDefaultHandled();
-    }
+    setAttribute(openAttr, m_isOpen ? nullAtom : emptyAtom);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLDetailsElement.h b/Source/WebCore/html/HTMLDetailsElement.h
index 45a9035..70ae9c6 100644
--- a/Source/WebCore/html/HTMLDetailsElement.h
+++ b/Source/WebCore/html/HTMLDetailsElement.h
@@ -29,19 +29,29 @@ class HTMLDetailsElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLDetailsElement> create(const QualifiedName& tagName, Document* document);
     Node* mainSummary() const { return m_mainSummary; }
+    void toggleOpen();
 
 private:
+    enum RefreshRenderer {
+        RefreshRendererAllowed,
+        RefreshRendererSupressed,
+    };
+
     HTMLDetailsElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta);
     virtual void finishParsingChildren();
+    virtual bool canHaveLightChildRendererWithShadow() const { return true; }
 
     void parseMappedAttribute(Attribute*);
     bool childShouldCreateRenderer(Node*) const;
-    void defaultEventHandler(Event*);
 
-    void findMainSummary();
+    Node* findSummaryFor(ContainerNode*);
+    Node* findMainSummary();
+    void refreshMainSummary(RefreshRenderer);
+
+    void createShadowSubtree();
 
     Node* m_mainSummary;
     bool m_isOpen;
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index e3b5043..b2b57a2 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -194,10 +194,6 @@ void HTMLElement::parseMappedAttribute(Attribute* attr)
         setAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onfocusoutAttr) {
         setAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onformchangeAttr) {
-        setAttributeEventListener(eventNames().formchangeEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onforminputAttr) {
-        setAttributeEventListener(eventNames().forminputEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
         setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeydownAttr) {
@@ -657,11 +653,6 @@ bool HTMLElement::supportsFocus() const
     return Element::supportsFocus() || (rendererIsEditable() && parentNode() && !parentNode()->rendererIsEditable());
 }
 
-bool HTMLElement::isContentEditable() const
-{
-    return rendererIsEditable();
-}
-
 String HTMLElement::contentEditable() const
 {
     const AtomicString& value = fastGetAttribute(contenteditableAttr);
@@ -819,40 +810,6 @@ HTMLFormElement* HTMLElement::virtualForm() const
     return findFormAncestor();
 }
 
-HTMLFormElement* HTMLElement::shadowAncestorOwnerForm()
-{
-    Node* ancestorNode = shadowAncestorNode();
-    if (!ancestorNode)
-        return form();
-
-    if (!ancestorNode->isHTMLElement())
-        return 0;
-    HTMLElement* ancestorHTML = toHTMLElement(ancestorNode);
-    if (!ancestorHTML)
-        return 0;
-    return ancestorHTML->form();
-}
-
-void HTMLElement::dispatchChangeEvents()
-{
-    RefPtr<HTMLElement> protector(this);
-    RefPtr<HTMLFormElement> ownerForm(shadowAncestorOwnerForm());
-
-    Node::dispatchChangeEvents();
-    if (ownerForm)
-        ownerForm->dispatchFormChange();
-}
-
-void HTMLElement::dispatchInputEvents()
-{
-    RefPtr<HTMLElement> protector(this);
-    RefPtr<HTMLFormElement> ownerForm(shadowAncestorOwnerForm());
-
-    Node::dispatchInputEvents();
-    if (ownerForm)
-        ownerForm->dispatchFormInput();
-}
-
 static void setHasDirAutoFlagRecursively(Node* firstNode, bool flag, Node* lastNode = 0)
 {
     firstNode->setSelfOrAncestorHasDirAutoAttribute(flag);
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 077b1c3..5a5fdfb 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -57,8 +57,6 @@ public:
 
     virtual bool supportsFocus() const;
 
-    bool isContentEditable() const;
-
     String contentEditable() const;
     void setContentEditable(const String&, ExceptionCode&);
 
@@ -83,9 +81,6 @@ public:
 
     HTMLFormElement* findFormAncestor() const;
 
-    virtual void dispatchChangeEvents();
-    virtual void dispatchInputEvents();
-
     TextDirection directionalityIfhasDirAutoAttribute(bool& isAuto) const;
 
 protected:
@@ -108,8 +103,6 @@ private:
     Node* insertAdjacent(const String& where, Node* newChild, ExceptionCode&);
     PassRefPtr<DocumentFragment> textToFragment(const String&, ExceptionCode&);
 
-    HTMLFormElement* shadowAncestorOwnerForm();
-
     void dirAttributeChanged(Attribute*);
     void adjustDirectionalityIfNeededAfterChildAttributeChanged(Element* child);
     void calculateAndAdjustDirectionality();
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index af061fe..87f4e4d 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -201,14 +201,14 @@ void HTMLFormControlElement::setChangedSinceLastFormControlChangeEvent(bool chan
 
 void HTMLFormControlElement::dispatchFormControlChangeEvent()
 {
-    HTMLElement::dispatchChangeEvents();
+    HTMLElement::dispatchChangeEvent();
     setChangedSinceLastFormControlChangeEvent(false);
 }
 
 void HTMLFormControlElement::dispatchFormControlInputEvent()
 {
     setChangedSinceLastFormControlChangeEvent(true);
-    HTMLElement::dispatchInputEvents();
+    HTMLElement::dispatchInputEvent();
 }
 
 void HTMLFormControlElement::setDisabled(bool b)
@@ -638,7 +638,7 @@ void HTMLTextFormControlElement::select()
 void HTMLTextFormControlElement::dispatchFormControlChangeEvent()
 {
     if (m_textAsOfLastFormControlChangeEvent != value()) {
-        HTMLElement::dispatchChangeEvents();
+        HTMLElement::dispatchChangeEvent();
         setTextAsOfLastFormControlChangeEvent(value());
     }
     setChangedSinceLastFormControlChangeEvent(false);
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index ede3299..884ace0 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -63,7 +63,6 @@ public:
 
     virtual bool isFocusable() const;
     virtual bool isEnumeratable() const { return false; }
-    virtual bool isResettable() const { return false; }
 
     // Determines whether or not a control will be automatically focused.
     virtual bool autofocus() const;
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index f051ea1..cfea3d8 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -236,17 +236,11 @@ bool HTMLFormElement::validateInteractively(Event* event)
         FormAssociatedElement* unhandledAssociatedElement = unhandledInvalidControls[i].get();
         HTMLElement* unhandled = toHTMLElement(unhandledAssociatedElement);
         if (unhandled->isFocusable() && unhandled->inDocument()) {
-            RefPtr<Document> originalDocument(unhandled->document());
             unhandled->scrollIntoViewIfNeeded(false);
-            // scrollIntoViewIfNeeded() dispatches events, so the state
-            // of 'unhandled' might be changed so it's no longer focusable or
-            // moved to another document.
-            if (unhandled->isFocusable() && unhandled->inDocument() && originalDocument == unhandled->document()) {
-                unhandled->focus();
-                if (unhandled->isFormControlElement())
-                    static_cast<HTMLFormControlElement*>(unhandled)->updateVisibleValidationMessage();
-                break;
-            }
+            unhandled->focus();
+            if (unhandled->isFormControlElement())
+                static_cast<HTMLFormControlElement*>(unhandled)->updateVisibleValidationMessage();
+            break;
         }
     }
     // Warn about all of unfocusable controls.
@@ -417,7 +411,7 @@ unsigned HTMLFormElement::formElementIndexWithFormAttribute(Element* element)
     // Compares the position of the form element and the inserted element.
     // Updates the indeces in order to the relation of the position:
     unsigned short position = compareDocumentPosition(element);
-    if (position & DOCUMENT_POSITION_CONTAINS)
+    if (position & (DOCUMENT_POSITION_CONTAINS | DOCUMENT_POSITION_CONTAINED_BY))
         ++m_associatedElementsAfterIndex;
     else if (position & DOCUMENT_POSITION_PRECEDING) {
         ++m_associatedElementsBeforeIndex;
@@ -488,18 +482,15 @@ void HTMLFormElement::removeFormElement(FormAssociatedElement* e)
 {
     if (e->isFormControlElement())
         m_checkedRadioButtons.removeButton(static_cast<HTMLFormControlElement*>(e));
-    HTMLElement* element = toHTMLElement(e);
-    if (element->fastHasAttribute(formAttr)) {
-        unsigned index;
-        for (index = 0; index < m_associatedElements.size(); ++index)
-            if (m_associatedElements[index] == e)
-                break;
-        ASSERT(index < m_associatedElements.size());
-        if (index < m_associatedElementsBeforeIndex)
-            --m_associatedElementsBeforeIndex;
-        if (index < m_associatedElementsAfterIndex)
-            --m_associatedElementsAfterIndex;
-    } else
+    unsigned index;
+    for (index = 0; index < m_associatedElements.size(); ++index) {
+        if (m_associatedElements[index] == e)
+            break;
+    }
+    ASSERT(index < m_associatedElements.size());
+    if (index < m_associatedElementsBeforeIndex)
+        --m_associatedElementsBeforeIndex;
+    if (index < m_associatedElementsAfterIndex)
         --m_associatedElementsAfterIndex;
     removeFromVector(m_associatedElements, e);
 }
@@ -593,39 +584,6 @@ bool HTMLFormElement::checkValidity()
     return !checkInvalidControlsAndCollectUnhandled(controls);
 }
 
-void HTMLFormElement::broadcastFormEvent(const AtomicString& eventName)
-{
-    RefPtr<HTMLFormElement> protector(this);
-    // Copy m_associatedElements because event handlers called from
-    // formElement->dispatchEvent() might change m_associatedElements.
-    Vector<RefPtr<FormAssociatedElement> > elements;
-    elements.reserveCapacity(m_associatedElements.size());
-    for (unsigned i = 0; i < m_associatedElements.size(); ++i) {
-        if (!m_associatedElements[i]->isResettable())
-            continue;
-        elements.append(m_associatedElements[i]);
-    }
-
-    for (unsigned i = 0; i < elements.size(); ++i) {
-        // We can assume a resettable control is always a HTMLFormControlElement.
-        // FIXME: We should handle resettable non-HTMLFormControlElements maybe in the future.
-        ASSERT(elements[i]->isFormControlElement());
-        HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(elements[i].get());
-        if (!formElement->dispatchEvent(Event::create(eventName, false, false)))
-            continue;
-    }
-}
-
-void HTMLFormElement::dispatchFormInput()
-{
-    broadcastFormEvent(eventNames().forminputEvent);
-}
-
-void HTMLFormElement::dispatchFormChange()
-{
-    broadcastFormEvent(eventNames().formchangeEvent);
-}
-
 bool HTMLFormElement::checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >& unhandledInvalidControls)
 {
     RefPtr<HTMLFormElement> protector(this);
diff --git a/Source/WebCore/html/HTMLFormElement.h b/Source/WebCore/html/HTMLFormElement.h
index f723533..3100f67 100644
--- a/Source/WebCore/html/HTMLFormElement.h
+++ b/Source/WebCore/html/HTMLFormElement.h
@@ -114,9 +114,6 @@ public:
 
     const Vector<FormAssociatedElement*>& associatedElements() const { return m_associatedElements; }
 
-    void dispatchFormInput();
-    void dispatchFormChange();
-
 private:
     HTMLFormElement(const QualifiedName&, Document*);
 
@@ -148,8 +145,6 @@ private:
     // are any invalid controls in this form.
     bool checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >&);
 
-    void broadcastFormEvent(const AtomicString&);
-
     friend class HTMLFormCollection;
 
     typedef HashMap<RefPtr<AtomicStringImpl>, RefPtr<HTMLFormControlElement> > AliasMap;
diff --git a/Source/WebCore/html/HTMLFormElement.idl b/Source/WebCore/html/HTMLFormElement.idl
index 3e9e46d..e9759e2 100644
--- a/Source/WebCore/html/HTMLFormElement.idl
+++ b/Source/WebCore/html/HTMLFormElement.idl
@@ -43,9 +43,6 @@ module html {
 #endif
         void reset();
         boolean checkValidity();
-
-        void dispatchFormInput();
-        void dispatchFormChange();
     };
 
 }
diff --git a/Source/WebCore/html/HTMLFrameOwnerElement.cpp b/Source/WebCore/html/HTMLFrameOwnerElement.cpp
index 2a7b610..a217881 100644
--- a/Source/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/Source/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -89,6 +89,11 @@ void HTMLFrameOwnerElement::setSandboxFlags(SandboxFlags flags)
         frame->loader()->ownerElementSandboxFlagsChanged();
 }
 
+bool HTMLFrameOwnerElement::isKeyboardFocusable(KeyboardEvent* event) const
+{
+    return m_contentFrame && HTMLElement::isKeyboardFocusable(event);
+}
+
 #if ENABLE(SVG)
 SVGDocument* HTMLFrameOwnerElement::getSVGDocument(ExceptionCode& ec) const
 {
diff --git a/Source/WebCore/html/HTMLFrameOwnerElement.h b/Source/WebCore/html/HTMLFrameOwnerElement.h
index f784f4f..de9d153 100644
--- a/Source/WebCore/html/HTMLFrameOwnerElement.h
+++ b/Source/WebCore/html/HTMLFrameOwnerElement.h
@@ -66,7 +66,7 @@ private:
     friend class Frame;
 
     virtual bool isFrameOwnerElement() const { return true; }
-    virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
 
     Frame* m_contentFrame;
     SandboxFlags m_sandboxFlags;
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 7ae6ad9..83e8c7d 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -443,6 +443,7 @@ void HTMLInputElement::setType(const String& type)
 
 void HTMLInputElement::updateType()
 {
+<<<<<<< HEAD
     const AtomicString& typeString = fastGetAttribute(typeAttr);
 
     OwnPtr<InputType> newType = InputType::create(this, typeString);
@@ -450,19 +451,21 @@ void HTMLInputElement::updateType()
     if (newType->isPasswordField() && document()->focusedNode() == this)
         PlatformBridge::updateTextfield(document()->view(), this, true, String());
 #endif
+=======
+    OwnPtr<InputType> newType = InputType::create(this, fastGetAttribute(typeAttr));
+    bool hadType = m_hasType;
+    m_hasType = true;
+    if (m_inputType->formControlType() == newType->formControlType())
+        return;
+>>>>>>> WebKit.org at r84325
 
-    if (m_hasType && !newType->canChangeFromAnotherType()) {
+    if (hadType && !newType->canChangeFromAnotherType()) {
         // Set the attribute back to the old value.
         // Useful in case we were called from inside parseMappedAttribute.
         setAttribute(typeAttr, type());
         return;
     }
 
-    m_hasType = true;
-
-    if (m_inputType->formControlType() == newType->formControlType())
-        return;
-
     checkedRadioButtons().removeButton(this);
 
     bool wasAttached = attached();
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index f2c2625..2a98b13 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -215,7 +215,6 @@ private:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const;
-    virtual bool isResettable() const { return true; }
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod() const;
diff --git a/Source/WebCore/html/HTMLKeygenElement.cpp b/Source/WebCore/html/HTMLKeygenElement.cpp
index b90335e..29c9deb 100644
--- a/Source/WebCore/html/HTMLKeygenElement.cpp
+++ b/Source/WebCore/html/HTMLKeygenElement.cpp
@@ -32,6 +32,7 @@
 #include "HTMLSelectElement.h"
 #include "HTMLOptionElement.h"
 #include "SSLKeyGenerator.h"
+#include "ShadowRoot.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
 
@@ -67,15 +68,18 @@ inline HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Docume
     ASSERT(hasTagName(keygenTag));
 
     // Create a select element with one option element for each key size.
-    RefPtr<HTMLSelectElement> select = KeygenSelectElement::create(document);
     Vector<String> keys;
     getSupportedKeySizes(keys);
+
+    RefPtr<HTMLSelectElement> select = KeygenSelectElement::create(document);
+    ExceptionCode ec = 0;
     for (size_t i = 0; i < keys.size(); ++i) {
         RefPtr<HTMLOptionElement> option = HTMLOptionElement::create(document, this->form());
-        select->parserAddChild(option);
-        option->parserAddChild(Text::create(document, keys[i]));
+        select->appendChild(option, ec);
+        option->appendChild(Text::create(document, keys[i]), ec);
     }
-    setShadowRoot(select);
+
+    ensureShadowRoot()->appendChild(select, ec);
 }
 
 PassRefPtr<HTMLKeygenElement> HTMLKeygenElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
@@ -87,7 +91,7 @@ void HTMLKeygenElement::parseMappedAttribute(Attribute* attr)
 {
     // Reflect disabled attribute on the shadow select element
     if (attr->name() == disabledAttr)
-        selectShadow()->setAttribute(attr->name(), attr->value());
+        shadowSelect()->setAttribute(attr->name(), attr->value());
 
     if (attr->name() == challengeAttr)
         m_challenge = attr->value();
@@ -102,7 +106,7 @@ bool HTMLKeygenElement::appendFormData(FormDataList& encoded_values, bool)
     // Only RSA is supported at this time.
     if (!m_keyType.isNull() && !equalIgnoringCase(m_keyType, "rsa"))
         return false;
-    String value = signedPublicKeyAndChallengeString(selectShadow()->selectedIndex(), m_challenge, document()->baseURL());
+    String value = signedPublicKeyAndChallengeString(shadowSelect()->selectedIndex(), m_challenge, document()->baseURL());
     if (value.isNull())
         return false;
     encoded_values.appendData(name(), value.utf8());
@@ -117,12 +121,14 @@ const AtomicString& HTMLKeygenElement::formControlType() const
 
 void HTMLKeygenElement::reset()
 {
-    static_cast<HTMLFormControlElement*>(selectShadow())->reset();
+    static_cast<HTMLFormControlElement*>(shadowSelect())->reset();
 }
 
-HTMLSelectElement* HTMLKeygenElement::selectShadow()
+HTMLSelectElement* HTMLKeygenElement::shadowSelect() const
 {
-    return static_cast<HTMLSelectElement*>(shadowRoot());
+    Node* shadow = shadowRoot();
+    ASSERT(shadow);
+    return shadow ? static_cast<HTMLSelectElement*>(shadow->firstChild()) : 0;
 }
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLKeygenElement.h b/Source/WebCore/html/HTMLKeygenElement.h
index a7a8a64..88782c8 100644
--- a/Source/WebCore/html/HTMLKeygenElement.h
+++ b/Source/WebCore/html/HTMLKeygenElement.h
@@ -49,10 +49,9 @@ private:
 
     virtual bool isEnumeratable() const { return true; }
 
-    virtual bool isResettable() const { return true; }
     virtual void reset();
 
-    HTMLSelectElement* selectShadow();
+    HTMLSelectElement* shadowSelect() const;
 
     AtomicString m_challenge;
     AtomicString m_keyType;
diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp
index 67262d9..7cbf38b 100644
--- a/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/Source/WebCore/html/HTMLLinkElement.cpp
@@ -26,6 +26,7 @@
 
 #include "Attribute.h"
 #include "CachedCSSStyleSheet.h"
+#include "CachedResource.h"
 #include "CachedResourceLoader.h"
 #include "CSSStyleSelector.h"
 #include "Document.h"
@@ -78,8 +79,8 @@ HTMLLinkElement::~HTMLLinkElement()
     }
     
 #if ENABLE(LINK_PREFETCH)
-    if (m_cachedLinkPrefetch)
-        m_cachedLinkPrefetch->removeClient(this);
+    if (m_cachedLinkResource)
+        m_cachedLinkResource->removeClient(this);
 #endif
 }
 
@@ -163,6 +164,7 @@ void HTMLLinkElement::tokenizeRelAttribute(const AtomicString& rel, RelAttribute
     relAttribute.m_isDNSPrefetch = false;
 #if ENABLE(LINK_PREFETCH)
     relAttribute.m_isLinkPrefetch = false;
+    relAttribute.m_isLinkSubresource = false;
 #endif
 #ifdef ANDROID_APPLE_TOUCH_ICON
     relAttribute.m_isTouchIcon = false;
@@ -180,10 +182,6 @@ void HTMLLinkElement::tokenizeRelAttribute(const AtomicString& rel, RelAttribute
 #endif
     else if (equalIgnoringCase(rel, "dns-prefetch"))
         relAttribute.m_isDNSPrefetch = true;
-#if ENABLE(LINK_PREFETCH)
-    else if (equalIgnoringCase(rel, "prefetch"))
-        relAttribute.m_isLinkPrefetch = true;
-#endif
     else if (equalIgnoringCase(rel, "alternate stylesheet") || equalIgnoringCase(rel, "stylesheet alternate")) {
         relAttribute.m_isStyleSheet = true;
         relAttribute.m_isAlternate = true;
@@ -201,6 +199,12 @@ void HTMLLinkElement::tokenizeRelAttribute(const AtomicString& rel, RelAttribute
                 relAttribute.m_isAlternate = true;
             else if (equalIgnoringCase(*it, "icon"))
                 relAttribute.m_isIcon = true;
+#if ENABLE(LINK_PREFETCH)
+            else if (equalIgnoringCase(*it, "prefetch"))
+              relAttribute.m_isLinkPrefetch = true;
+            else if (equalIgnoringCase(*it, "subresource"))
+              relAttribute.m_isLinkSubresource = true;
+#endif
         }
     }
 }
@@ -250,12 +254,16 @@ void HTMLLinkElement::process()
     }
 
 #if ENABLE(LINK_PREFETCH)
-    if (m_relAttribute.m_isLinkPrefetch && m_url.isValid() && document()->frame()) {
+    if ((m_relAttribute.m_isLinkPrefetch || m_relAttribute.m_isLinkSubresource) && m_url.isValid() && document()->frame()) {
         if (!checkBeforeLoadEvent())
             return;
-        m_cachedLinkPrefetch = document()->cachedResourceLoader()->requestLinkPrefetch(m_url);
-        if (m_cachedLinkPrefetch)
-            m_cachedLinkPrefetch->addClient(this);
+        ResourceLoadPriority priority = ResourceLoadPriorityUnresolved;
+        if (m_relAttribute.m_isLinkSubresource)
+            priority = ResourceLoadPriorityLow;
+
+        m_cachedLinkResource = document()->cachedResourceLoader()->requestLinkResource(m_url, priority);
+        if (m_cachedLinkResource)
+            m_cachedLinkResource->addClient(this);
     }
 #endif
 
@@ -427,19 +435,19 @@ bool HTMLLinkElement::isLoading() const
 void HTMLLinkElement::onloadTimerFired(Timer<HTMLLinkElement>* timer)
 {
     ASSERT_UNUSED(timer, timer == &m_onloadTimer);
-    if (m_cachedLinkPrefetch->errorOccurred())
+    if (m_cachedLinkResource->errorOccurred())
         dispatchEvent(Event::create(eventNames().errorEvent, false, false));
     else
         dispatchEvent(Event::create(eventNames().loadEvent, false, false));
 
-    m_cachedLinkPrefetch->removeClient(this);
-    m_cachedLinkPrefetch = 0;
+    m_cachedLinkResource->removeClient(this);
+    m_cachedLinkResource = 0;
 }
 
 void HTMLLinkElement::notifyFinished(CachedResource* resource)
 {
     m_onloadTimer.startOneShot(0);
-    ASSERT(m_cachedLinkPrefetch.get() == resource);
+    ASSERT(m_cachedLinkResource.get() == resource);
 }
 #endif
 
diff --git a/Source/WebCore/html/HTMLLinkElement.h b/Source/WebCore/html/HTMLLinkElement.h
index d31feeb..f602d38 100644
--- a/Source/WebCore/html/HTMLLinkElement.h
+++ b/Source/WebCore/html/HTMLLinkElement.h
@@ -48,6 +48,7 @@ public:
 #endif
 #if ENABLE(LINK_PREFETCH)
         bool m_isLinkPrefetch;
+        bool m_isLinkSubresource;
 #endif
 
         RelAttribute()
@@ -57,6 +58,7 @@ public:
             , m_isDNSPrefetch(false)
 #if ENABLE(LINK_PREFETCH)
             , m_isLinkPrefetch(false)
+            , m_isLinkSubresource(false)
 #endif
             { 
             }
@@ -138,7 +140,7 @@ private:
     CachedResourceHandle<CachedCSSStyleSheet> m_cachedSheet;
     RefPtr<CSSStyleSheet> m_sheet;
 #if ENABLE(LINK_PREFETCH)
-    CachedResourceHandle<CachedResource> m_cachedLinkPrefetch;
+    CachedResourceHandle<CachedResource> m_cachedLinkResource;
     Timer<HTMLLinkElement> m_onloadTimer;
 #endif
     KURL m_url;
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 29c0cb8..5505343 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -33,6 +33,7 @@
 #include "ChromeClient.h"
 #include "ClientRect.h"
 #include "ClientRectList.h"
+#include "ContentSecurityPolicy.h"
 #include "ContentType.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -54,12 +55,14 @@
 #include "MediaList.h"
 #include "MediaPlayer.h"
 #include "MediaQueryEvaluator.h"
+#include "MouseEvent.h"
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScriptEventListener.h"
 #include "Settings.h"
+#include "ShadowRoot.h"
 #include "TimeRanges.h"
 #include <limits>
 #include <wtf/CurrentTime.h>
@@ -161,6 +164,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
     , m_sendProgressEvents(true)
     , m_isFullscreen(false)
     , m_closedCaptionsVisible(false)
+    , m_mouseOver(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_needWidgetUpdate(false)
 #endif
@@ -223,12 +227,14 @@ void HTMLMediaElement::attributeChanged(Attribute* attr, bool preserveDecls)
     }
     else if (attrName == controlsAttr) {
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-        if (!isVideo() && attached() && (controls() != (renderer() != 0))) {
-            detach();
-            attach();
-        }
-        if (hasMediaControls())
-            mediaControls()->reset();
+        if (controls()) {
+            if (!hasMediaControls()) {
+                ensureMediaControls();
+                mediaControls()->reset();
+            }
+            mediaControls()->show();
+        } else if (hasMediaControls())
+            mediaControls()->hide();
 #else
         if (m_player)
             m_player->setControls(controls());
@@ -743,6 +749,9 @@ bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction acti
         return false;
     }
 
+    if (!document()->contentSecurityPolicy()->allowMediaFromSource(url))
+        return false;
+
     return true;
 }
 
@@ -900,6 +909,8 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
             noneSupported();
 
         updateDisplayState();
+        if (hasMediaControls())
+            mediaControls()->reportedError();
         return;
     }
 
@@ -929,6 +940,9 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         m_networkState = NETWORK_IDLE;
         m_completelyLoaded = true;
     }
+
+    if (hasMediaControls())
+        mediaControls()->changedNetworkState();
 }
 
 void HTMLMediaElement::mediaPlayerReadyStateChanged(MediaPlayer*)
@@ -978,6 +992,8 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
     if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA) {
         scheduleEvent(eventNames().durationchangeEvent);
         scheduleEvent(eventNames().loadedmetadataEvent);
+        if (hasMediaControls())
+            mediaControls()->loadedMetadata();
         if (renderer())
             renderer()->updateFromElement();
         m_player->seek(0);
@@ -1491,6 +1507,10 @@ bool HTMLMediaElement::controls() const
     if (isVideo() && document()->page() && document()->page()->chrome()->requiresFullscreenForVideoPlayback())
         return true;
 
+    // Always show controls when in full screen mode.
+    if (isFullscreen())
+        return true;
+
     return hasAttribute(controlsAttr);
 }
 
@@ -1605,9 +1625,11 @@ void HTMLMediaElement::playbackProgressTimerFired(Timer<HTMLMediaElement>*)
         return;
 
     scheduleTimeupdateEvent(true);
-    if (hasMediaControls())
+    if (hasMediaControls()) {
+        if (!m_mouseOver && controls())
+            mediaControls()->makeTransparent();
         mediaControls()->playbackProgressed();
-
+    }
     // FIXME: deal with cue ranges here
 }
 
@@ -1997,13 +2019,26 @@ void HTMLMediaElement::mediaPlayerRenderingModeChanged(MediaPlayer*)
 
 void HTMLMediaElement::mediaPlayerEngineUpdated(MediaPlayer*)
 {
-    beginProcessingMediaPlayerCallback();
     LOG(Media, "HTMLMediaElement::mediaPlayerEngineUpdated");
+    beginProcessingMediaPlayerCallback();
     if (renderer())
         renderer()->updateFromElement();
     endProcessingMediaPlayerCallback();
 }
 
+void HTMLMediaElement::mediaPlayerFirstVideoFrameAvailable(MediaPlayer*)
+{
+    LOG(Media, "HTMLMediaElement::mediaPlayerFirstVideoFrameAvailable");
+    beginProcessingMediaPlayerCallback();
+    if (displayMode() == PosterWaitingForVideo) {
+        setDisplayMode(Video);
+#if USE(ACCELERATED_COMPOSITING)
+        mediaPlayerRenderingModeChanged(m_player.get());
+#endif
+    }
+    endProcessingMediaPlayerCallback();
+}
+
 PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
 {
     if (!m_player)
@@ -2148,9 +2183,11 @@ void HTMLMediaElement::updatePlayState()
             if (!m_isFullscreen && isVideo() && document() && document()->page() && document()->page()->chrome()->requiresFullscreenForVideoPlayback())
                 enterFullscreen();
 
-            // Set rate before calling play in case the rate was set before the media engine was setup.
-            // The media engine should just stash the rate since it isn't already playing.
+            // Set rate, muted before calling play in case they were set before the media engine was setup.
+            // The media engine should just stash the rate and muted values since it isn't already playing.
             m_player->setRate(m_playbackRate);
+            m_player->setMuted(m_muted);
+
             m_player->play();
         }
 
@@ -2323,10 +2360,18 @@ void HTMLMediaElement::defaultEventHandler(Event* event)
     if (widget)
         widget->handleEvent(event);
 #else
-    if (hasMediaControls())
-        mediaControls()->forwardEvent(event);
-    if (event->defaultHandled())
-        return;
+    if (event->isMouseEvent()) {
+        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        if (mouseEvent->relatedTarget() != this) {
+            if (event->type() == eventNames().mouseoverEvent) {
+                m_mouseOver = true;
+                if (hasMediaControls() && controls() && !canPlay())
+                    mediaControls()->makeOpaque();
+            } else if (event->type() == eventNames().mouseoutEvent)
+                m_mouseOver = false;
+        }
+    }
+
     HTMLElement::defaultEventHandler(event);
 #endif
 }
@@ -2459,9 +2504,16 @@ bool HTMLMediaElement::isFullscreen() const
 void HTMLMediaElement::enterFullscreen()
 {
     LOG(Media, "HTMLMediaElement::enterFullscreen");
-
+#if ENABLE(FULLSCREEN_API)
+    if (document() && document()->settings() && document()->settings()->fullScreenEnabled()) {
+        webkitRequestFullScreen(0);
+        return;
+    }
+#endif
     ASSERT(!m_isFullscreen);
     m_isFullscreen = true;
+    if (hasMediaControls())
+        mediaControls()->enteredFullscreen();
     if (document() && document()->page()) {
         document()->page()->chrome()->client()->enterFullscreenForNode(this);
         scheduleEvent(eventNames().webkitbeginfullscreenEvent);
@@ -2471,9 +2523,17 @@ void HTMLMediaElement::enterFullscreen()
 void HTMLMediaElement::exitFullscreen()
 {
     LOG(Media, "HTMLMediaElement::exitFullscreen");
-
+#if ENABLE(FULLSCREEN_API)
+    if (document() && document()->settings() && document()->settings()->fullScreenEnabled()) {
+        if (document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == this)
+            document()->webkitCancelFullScreen();
+        return;
+    }
+#endif
     ASSERT(m_isFullscreen);
     m_isFullscreen = false;
+    if (hasMediaControls())
+        mediaControls()->exitedFullscreen();
     if (document() && document()->page()) {
         if (document()->page()->chrome()->requiresFullscreenForVideoPlayback())
             pauseInternal();
@@ -2606,15 +2666,44 @@ void HTMLMediaElement::privateBrowsingStateDidChange()
 
 MediaControls* HTMLMediaElement::mediaControls()
 {
-    ASSERT(renderer());
-    return toRenderMedia(renderer())->controls();
+    if (!shadowRoot())
+        return 0;
+
+    Node* node = shadowRoot()->firstChild();
+    ASSERT(node->isHTMLElement());
+    return static_cast<MediaControls*>(node);
+}
+
+bool HTMLMediaElement::hasMediaControls()
+{
+    return shadowRoot();
+}
+
+void HTMLMediaElement::ensureMediaControls()
+{
+    if (hasMediaControls())
+        return;
+
+    ExceptionCode ec;
+    ensureShadowRoot()->appendChild(MediaControls::create(this), ec);
 }
 
-bool HTMLMediaElement::hasMediaControls() const
+void* HTMLMediaElement::preDispatchEventHandler(Event* event)
 {
-    return renderer() && renderer()->isMedia();
+    if (event && event->type() == eventNames().webkitfullscreenchangeEvent) {
+        if (controls()) {
+            if (!hasMediaControls()) {
+                ensureMediaControls();
+                mediaControls()->reset();
+            }
+            mediaControls()->show();
+        } else if (hasMediaControls())
+            mediaControls()->hide();
+    }
+    return 0;
 }
 
+
 }
 
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index ea958fa..604cdf8 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -212,7 +212,7 @@ protected:
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
 
-    enum DisplayMode { Unknown, None, Poster, Video };
+    enum DisplayMode { Unknown, None, Poster, PosterWaitingForVideo, Video };
     DisplayMode displayMode() const { return m_displayMode; }
     virtual void setDisplayMode(DisplayMode mode) { m_displayMode = mode; }
 
@@ -257,6 +257,7 @@ private:
     virtual void mediaPlayerRenderingModeChanged(MediaPlayer*);
 #endif
     virtual void mediaPlayerEngineUpdated(MediaPlayer*);
+    virtual void mediaPlayerFirstVideoFrameAvailable(MediaPlayer*);
 
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void asyncEventTimerFired(Timer<HTMLMediaElement>*);
@@ -323,7 +324,10 @@ private:
     void invalidateCachedTime();
     void refreshCachedTime() const;
 
-    bool hasMediaControls() const;
+    bool hasMediaControls();
+    void ensureMediaControls();
+
+    virtual void* preDispatchEventHandler(Event*);
 
     Timer<HTMLMediaElement> m_loadTimer;
     Timer<HTMLMediaElement> m_asyncEventTimer;
@@ -331,7 +335,7 @@ private:
     Timer<HTMLMediaElement> m_playbackProgressTimer;
     Vector<RefPtr<Event> > m_pendingEvents;
     RefPtr<TimeRanges> m_playedTimeRanges;
-    
+
     float m_playbackRate;
     float m_defaultPlaybackRate;
     bool m_webkitPreservesPitch;
@@ -404,6 +408,7 @@ private:
 
     bool m_isFullscreen : 1;
     bool m_closedCaptionsVisible : 1;
+    bool m_mouseOver : 1;
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool m_needWidgetUpdate : 1;
diff --git a/Source/WebCore/html/HTMLMeterElement.cpp b/Source/WebCore/html/HTMLMeterElement.cpp
index 2ebf57e..88b1622 100644
--- a/Source/WebCore/html/HTMLMeterElement.cpp
+++ b/Source/WebCore/html/HTMLMeterElement.cpp
@@ -29,7 +29,9 @@
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
+#include "MeterShadowElement.h"
 #include "RenderMeter.h"
+#include "ShadowRoot.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -42,9 +44,15 @@ HTMLMeterElement::HTMLMeterElement(const QualifiedName& tagName, Document* docum
     ASSERT(hasTagName(meterTag));
 }
 
+HTMLMeterElement::~HTMLMeterElement()
+{
+}
+
 PassRefPtr<HTMLMeterElement> HTMLMeterElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
 {
-    return adoptRef(new HTMLMeterElement(tagName, document, form));
+    RefPtr<HTMLMeterElement> meter = adoptRef(new HTMLMeterElement(tagName, document, form));
+    meter->createShadowSubtree();
+    return meter;
 }
 
 RenderObject* HTMLMeterElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -60,18 +68,16 @@ const AtomicString& HTMLMeterElement::formControlType() const
 
 void HTMLMeterElement::parseMappedAttribute(Attribute* attribute)
 {
-    if (attribute->name() == valueAttr || attribute->name() == minAttr || attribute->name() == maxAttr || attribute->name() == lowAttr || attribute->name() == highAttr || attribute->name() == optimumAttr) {
-        if (renderer())
-            renderer()->updateFromElement();
-    } else
+    if (attribute->name() == valueAttr || attribute->name() == minAttr || attribute->name() == maxAttr || attribute->name() == lowAttr || attribute->name() == highAttr || attribute->name() == optimumAttr)
+        didElementStateChange();
+    else
         HTMLFormControlElement::parseMappedAttribute(attribute);
 }
 
 void HTMLMeterElement::attach()
 {
     HTMLFormControlElement::attach();
-    if (renderer())
-        renderer()->updateFromElement();
+    didElementStateChange();
 }
 
 double HTMLMeterElement::min() const
@@ -203,5 +209,30 @@ HTMLMeterElement::GaugeRegion HTMLMeterElement::gaugeRegion() const
     return GaugeRegionSuboptimal;
 }
 
+double HTMLMeterElement::valueRatio() const
+{
+    double min = this->min();
+    double max = this->max();
+    double value = this->value();
+
+    if (max <= min)
+        return 0;
+    return (value - min) / (max - min);
+}
+
+void HTMLMeterElement::didElementStateChange()
+{
+    m_value->setWidthPercentage(valueRatio()*100);
+}
+
+void HTMLMeterElement::createShadowSubtree()
+{
+    RefPtr<MeterBarElement> bar = MeterBarElement::create(document());
+    m_value = MeterValueElement::create(document());
+    ExceptionCode ec = 0;
+    bar->appendChild(m_value, ec);
+    ensureShadowRoot()->appendChild(bar, ec);
+}
+
 } // namespace
 #endif
diff --git a/Source/WebCore/html/HTMLMeterElement.h b/Source/WebCore/html/HTMLMeterElement.h
index d5038e0..5ce1193 100644
--- a/Source/WebCore/html/HTMLMeterElement.h
+++ b/Source/WebCore/html/HTMLMeterElement.h
@@ -26,6 +26,8 @@
 
 namespace WebCore {
 
+class MeterValueElement;
+
 class HTMLMeterElement : public HTMLFormControlElement {
 public:
     static PassRefPtr<HTMLMeterElement> create(const QualifiedName&, Document*, HTMLFormElement*);
@@ -54,19 +56,23 @@ public:
     double optimum() const;
     void setOptimum(double, ExceptionCode&);
 
+    double valueRatio() const;
     GaugeRegion gaugeRegion() const;
+
 private:
     HTMLMeterElement(const QualifiedName&, Document*, HTMLFormElement*);
+    virtual ~HTMLMeterElement();
 
     virtual bool recalcWillValidate() const { return false; }
-
     virtual const AtomicString& formControlType() const;
-
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
     virtual void parseMappedAttribute(Attribute*);
-
     virtual void attach();
+
+    void didElementStateChange();
+    void createShadowSubtree();
+
+    RefPtr<MeterValueElement> m_value;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index 4f4d0a1..f5f0083 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -236,17 +236,19 @@ bool HTMLObjectElement::hasFallbackContent() const
     return false;
 }
     
-inline bool HTMLObjectElement::hasValidClassId()
+bool HTMLObjectElement::hasValidClassId()
 {
+#if PLATFORM(QT)
+    if (equalIgnoringCase(serviceType(), "application/x-qt-plugin") || equalIgnoringCase(serviceType(), "application/x-qt-styled-widget"))
+        return true;
+#endif
+
+    if (MIMETypeRegistry::isJavaAppletMIMEType(serviceType()) && classId().startsWith("java:", false))
+        return true;
+
     // HTML5 says that fallback content should be rendered if a non-empty
     // classid is specified for which the UA can't find a suitable plug-in.
-    // WebKit supports no classids, with the exception of Qt plug-ins, which use
-    // classid to specify which QObject to load.
-#if PLATFORM(QT)
-    return classId().isEmpty() || equalIgnoringCase(serviceType(), "application/x-qt-plugin") || equalIgnoringCase(serviceType(), "application/x-qt-styled-widget");
-#else
     return classId().isEmpty();
-#endif
 }
 
 // FIXME: This should be unified with HTMLEmbedElement::updateWidget and
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index 82d63f7..b929ad5 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -50,7 +50,6 @@ public:
     virtual bool isFormControlElement() const { return false; }
 
     virtual bool isEnumeratable() const { return true; }
-    virtual bool isResettable() const { return false; }
     virtual bool appendFormData(FormDataList&, bool);
 
     // Implementations of constraint validation API.
diff --git a/Source/WebCore/html/HTMLOutputElement.h b/Source/WebCore/html/HTMLOutputElement.h
index 4c5c684..83ecee2 100644
--- a/Source/WebCore/html/HTMLOutputElement.h
+++ b/Source/WebCore/html/HTMLOutputElement.h
@@ -56,7 +56,6 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual const AtomicString& formControlType() const;
     virtual bool isEnumeratable() const { return true; }
-    virtual bool isResettable() const { return true; }
     virtual void childrenChanged(bool createdByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void reset();
 
diff --git a/Source/WebCore/html/HTMLProgressElement.cpp b/Source/WebCore/html/HTMLProgressElement.cpp
index cab0429..710f7e4 100644
--- a/Source/WebCore/html/HTMLProgressElement.cpp
+++ b/Source/WebCore/html/HTMLProgressElement.cpp
@@ -30,23 +30,33 @@
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
-#include "ProgressBarValueElement.h"
+#include "ProgressShadowElement.h"
 #include "RenderProgress.h"
+#include "ShadowRoot.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
+const double HTMLProgressElement::IndeterminatePosition = -1;
+const double HTMLProgressElement::InvalidPosition = -2;
+
 HTMLProgressElement::HTMLProgressElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
     : HTMLFormControlElement(tagName, document, form)
 {
     ASSERT(hasTagName(progressTag));
 }
 
+HTMLProgressElement::~HTMLProgressElement()
+{
+}
+
 PassRefPtr<HTMLProgressElement> HTMLProgressElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
 {
-    return adoptRef(new HTMLProgressElement(tagName, document, form));
+    RefPtr<HTMLProgressElement> progress = adoptRef(new HTMLProgressElement(tagName, document, form));
+    progress->createShadowSubtree();
+    return progress;
 }
 
 RenderObject* HTMLProgressElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -72,7 +82,6 @@ void HTMLProgressElement::parseMappedAttribute(Attribute* attribute)
 
 void HTMLProgressElement::attach()
 {
-    createShadowSubtreeIfNeeded();
     HTMLFormControlElement::attach();
     didElementStateChange();
 }
@@ -117,21 +126,24 @@ void HTMLProgressElement::setMax(double max, ExceptionCode& ec)
 double HTMLProgressElement::position() const
 {
     if (!hasAttribute(valueAttr))
-        return -1;
+        return HTMLProgressElement::IndeterminatePosition;
     return value() / max();
 }
 
 void HTMLProgressElement::didElementStateChange()
 {
+    m_value->setWidthPercentage(position()*100);
     if (renderer())
         renderer()->updateFromElement();
 }
 
-void HTMLProgressElement::createShadowSubtreeIfNeeded()
+void HTMLProgressElement::createShadowSubtree()
 {
-    if (shadowRoot())
-        return;
-    setShadowRoot(ProgressBarValueElement::create(document()).get());
+    RefPtr<ProgressBarElement> bar = ProgressBarElement::create(document());
+    m_value = ProgressValueElement::create(document());
+    ExceptionCode ec = 0;
+    bar->appendChild(m_value, ec);
+    ensureShadowRoot()->appendChild(bar, ec);
 }
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLProgressElement.h b/Source/WebCore/html/HTMLProgressElement.h
index a0db966..42109f7 100644
--- a/Source/WebCore/html/HTMLProgressElement.h
+++ b/Source/WebCore/html/HTMLProgressElement.h
@@ -26,8 +26,13 @@
 
 namespace WebCore {
 
+class ProgressValueElement;
+
 class HTMLProgressElement : public HTMLFormControlElement {
 public:
+    static const double IndeterminatePosition;
+    static const double InvalidPosition;
+
     static PassRefPtr<HTMLProgressElement> create(const QualifiedName&, Document*, HTMLFormElement*);
 
     double value() const;
@@ -40,6 +45,7 @@ public:
 
 private:
     HTMLProgressElement(const QualifiedName&, Document*, HTMLFormElement*);
+    virtual ~HTMLProgressElement();
 
     virtual bool recalcWillValidate() const { return false; }
 
@@ -52,7 +58,9 @@ private:
     virtual void attach();
 
     void didElementStateChange();
-    void createShadowSubtreeIfNeeded();
+    void createShadowSubtree();
+
+    RefPtr<ProgressValueElement> m_value;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index 837675c..e6e1bec 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -107,7 +107,6 @@ private:
     virtual bool canStartSelection() const { return false; }
 
     virtual bool isEnumeratable() const { return true; }
-    virtual bool isResettable() const { return true; }
 
     virtual bool saveFormControlState(String& value) const;
     virtual void restoreFormControlState(const String&);
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index 9c2222a..1a1fefc 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -21,8 +21,11 @@
 #include "config.h"
 #include "HTMLSummaryElement.h"
 
+#include "DetailsMarkerControl.h"
 #include "HTMLDetailsElement.h"
 #include "HTMLNames.h"
+#include "MouseEvent.h"
+#include "PlatformMouseEvent.h"
 #include "RenderSummary.h"
 
 namespace WebCore {
@@ -31,7 +34,9 @@ using namespace HTMLNames;
 
 PassRefPtr<HTMLSummaryElement> HTMLSummaryElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new HTMLSummaryElement(tagName, document));
+    RefPtr<HTMLSummaryElement> result = adoptRef(new HTMLSummaryElement(tagName, document));
+    result->createShadowSubtree();
+    return result;
 }
 
 HTMLSummaryElement::HTMLSummaryElement(const QualifiedName& tagName, Document* document)
@@ -45,4 +50,40 @@ RenderObject* HTMLSummaryElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderSummary(this);
 }
 
+void HTMLSummaryElement::createShadowSubtree()
+{
+    ExceptionCode ec = 0;
+    ensureShadowRoot()->appendChild(DetailsMarkerControl::create(document()), ec, true);
+}
+
+HTMLDetailsElement* HTMLSummaryElement::detailsElement() const
+{
+    Element* mayDetails = toElement(parentNodeForRenderingAndStyle());
+    if (!mayDetails || !mayDetails->hasTagName(detailsTag))
+        return 0;
+    return static_cast<HTMLDetailsElement*>(mayDetails);
+}
+
+bool HTMLSummaryElement::isMainSummary() const
+{
+    if (HTMLDetailsElement* details = detailsElement())
+        return details->mainSummary() == this;
+    return 0;
+}
+
+void HTMLSummaryElement::defaultEventHandler(Event* event)
+{
+    HTMLElement::defaultEventHandler(event);
+    if (!isMainSummary() || !renderer() || !renderer()->isSummary() || !event->isMouseEvent() || event->type() != eventNames().clickEvent || event->defaultHandled())
+        return;
+
+    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+    if (mouseEvent->button() != LeftButton)
+        return;
+
+    if (HTMLDetailsElement* details = detailsElement())
+        details->toggleOpen();
+    event->setDefaultHandled();
+}
+
 }
diff --git a/Source/WebCore/html/HTMLSummaryElement.h b/Source/WebCore/html/HTMLSummaryElement.h
index 1a93ee9..7e3766a 100644
--- a/Source/WebCore/html/HTMLSummaryElement.h
+++ b/Source/WebCore/html/HTMLSummaryElement.h
@@ -25,14 +25,22 @@
 
 namespace WebCore {
 
+class HTMLDetailsElement;
+
 class HTMLSummaryElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLSummaryElement> create(const QualifiedName&, Document*);
+    bool isMainSummary() const;
 
 private:
     HTMLSummaryElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual void defaultEventHandler(Event*);
+    virtual void createShadowSubtree();
+    virtual bool canHaveLightChildRendererWithShadow() const { return true; }
+
+    HTMLDetailsElement* detailsElement() const;
 };
 
 }
diff --git a/Source/WebCore/html/HTMLTagNames.in b/Source/WebCore/html/HTMLTagNames.in
index bea63e4..0bf4ff9 100644
--- a/Source/WebCore/html/HTMLTagNames.in
+++ b/Source/WebCore/html/HTMLTagNames.in
@@ -126,7 +126,7 @@ th interfaceName=HTMLTableCellElement
 thead interfaceName=HTMLTableSectionElement
 title
 tr interfaceName=HTMLTableRowElement
-track interfaceName=HTMLElement
+track wrapperOnlyIfMediaIsAvailable, conditional=VIDEO_TRACK
 tt interfaceName=HTMLElement
 u interfaceName=HTMLElement
 ul interfaceName=HTMLUListElement
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index c8ec9ab..5b12a14 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -108,7 +108,8 @@ void HTMLTextAreaElement::restoreFormControlState(const String& state)
 
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    setNonDirtyValue(defaultValue());
+    if (!m_isDirty)
+        setNonDirtyValue(defaultValue());
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
     
@@ -347,12 +348,6 @@ String HTMLTextAreaElement::defaultValue() const
             value += static_cast<Text*>(n)->data();
     }
 
-    UChar firstCharacter = value[0];
-    if (firstCharacter == '\r' && value[1] == '\n')
-        value.remove(0, 2);
-    else if (firstCharacter == '\r' || firstCharacter == '\n')
-        value.remove(0, 1);
-
     return value;
 }
 
@@ -371,17 +366,14 @@ void HTMLTextAreaElement::setDefaultValue(const String& defaultValue)
         removeChild(textNodes[i].get(), ec);
 
     // Normalize line endings.
-    // Add an extra line break if the string starts with one, since
-    // the code to read default values from the DOM strips the leading one.
     String value = defaultValue;
     value.replace("\r\n", "\n");
     value.replace('\r', '\n');
-    if (value[0] == '\n')
-        value = "\n" + value;
 
     insertBefore(document()->createTextNode(value), firstChild(), ec);
 
-    setNonDirtyValue(value);
+    if (!m_isDirty)
+        setNonDirtyValue(value);
 }
 
 int HTMLTextAreaElement::maxLength() const
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index 40193a0..1ab8ba7 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -82,7 +82,6 @@ private:
     virtual void defaultEventHandler(Event*);
 
     virtual bool isEnumeratable() const { return true; }
-    virtual bool isResettable() const { return true; }
 
     virtual const AtomicString& formControlType() const;
 
diff --git a/Source/WebCore/html/HTMLTitleElement.cpp b/Source/WebCore/html/HTMLTitleElement.cpp
index 78c8b6a..b046c7b 100644
--- a/Source/WebCore/html/HTMLTitleElement.cpp
+++ b/Source/WebCore/html/HTMLTitleElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "RenderStyle.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -33,7 +34,6 @@ using namespace HTMLNames;
 
 inline HTMLTitleElement::HTMLTitleElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
-    , m_title("")
 {
     ASSERT(hasTagName(titleTag));
 }
@@ -57,7 +57,7 @@ void HTMLTitleElement::removedFromDocument()
 
 void HTMLTitleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    m_title = text();
+    m_title = textWithDirection();
     if (inDocument())
         document()->setTitleElement(m_title, this);
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
@@ -71,10 +71,20 @@ String HTMLTitleElement::text() const
         if (n->isTextNode())
             val += static_cast<Text*>(n)->data();
     }
-    
+
     return val;
 }
 
+StringWithDirection HTMLTitleElement::textWithDirection()
+{
+    TextDirection direction = LTR;
+    if (RenderStyle* style = computedStyle())
+        direction = style->direction();
+    else if (RefPtr<RenderStyle> style = styleForRenderer())
+        direction = style->direction();
+    return StringWithDirection(text(), direction);
+}
+
 void HTMLTitleElement::setText(const String &value)
 {
     ExceptionCode ec = 0;
diff --git a/Source/WebCore/html/HTMLTitleElement.h b/Source/WebCore/html/HTMLTitleElement.h
index 8b90f56..6920997 100644
--- a/Source/WebCore/html/HTMLTitleElement.h
+++ b/Source/WebCore/html/HTMLTitleElement.h
@@ -23,6 +23,7 @@
 #define HTMLTitleElement_h
 
 #include "HTMLElement.h"
+#include "StringWithDirection.h"
 
 namespace WebCore {
 
@@ -33,6 +34,8 @@ public:
     String text() const;
     void setText(const String&);
 
+    StringWithDirection textWithDirection();
+
 private:
     HTMLTitleElement(const QualifiedName&, Document*);
 
@@ -40,7 +43,7 @@ private:
     virtual void removedFromDocument();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    String m_title;
+    StringWithDirection m_title;
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLTrackElement.cpp b/Source/WebCore/html/HTMLTrackElement.cpp
new file mode 100644
index 0000000..63f2788
--- /dev/null
+++ b/Source/WebCore/html/HTMLTrackElement.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO_TRACK)
+#include "HTMLTrackElement.h"
+
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "Logging.h"
+
+using namespace std;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+inline HTMLTrackElement::HTMLTrackElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
+{
+    LOG(Media, "HTMLTrackElement::HTMLTrackElement - %p", this);
+    ASSERT(hasTagName(trackTag));
+}
+
+PassRefPtr<HTMLTrackElement> HTMLTrackElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLTrackElement(tagName, document));
+}
+
+void HTMLTrackElement::insertedIntoTree(bool deep)
+{
+    HTMLElement::insertedIntoTree(deep);
+    if (parentNode() && (parentNode()->hasTagName(audioTag) || parentNode()->hasTagName(videoTag))) {
+        // TODO(annacc):
+        // static_cast<HTMLMediaElement*>(parentNode())->trackWasAdded(this);
+    }
+}
+
+void HTMLTrackElement::willRemove()
+{
+    if (parentNode() && (parentNode()->hasTagName(audioTag) || parentNode()->hasTagName(videoTag))) {
+        // TODO(annacc):
+        // static_cast<HTMLMediaElement*>(parentNode())->trackWillBeRemoved(this);
+    }
+    HTMLElement::willRemove();
+}
+
+KURL HTMLTrackElement::src() const
+{
+    return document()->completeURL(getAttribute(srcAttr));
+}
+
+void HTMLTrackElement::setSrc(const String& url)
+{
+    setAttribute(srcAttr, url);
+}
+
+String HTMLTrackElement::kind() const
+{
+    return getAttribute(kindAttr);
+}
+
+void HTMLTrackElement::setKind(const String& kind)
+{
+    setAttribute(kindAttr, kind);
+}
+
+String HTMLTrackElement::srclang() const
+{
+    return getAttribute(srclangAttr);
+}
+
+void HTMLTrackElement::setSrclang(const String& srclang)
+{
+    setAttribute(srclangAttr, srclang);
+}
+
+String HTMLTrackElement::label() const
+{
+    return getAttribute(labelAttr);
+}
+
+void HTMLTrackElement::setLabel(const String& label)
+{
+    setAttribute(labelAttr, label);
+}
+
+bool HTMLTrackElement::isDefault() const
+{
+    return hasAttribute(defaultAttr);
+}
+
+void HTMLTrackElement::setIsDefault(bool isDefault)
+{
+    setBooleanAttribute(defaultAttr, isDefault);
+}
+
+bool HTMLTrackElement::isURLAttribute(Attribute* attribute) const
+{
+    return attribute->name() == srcAttr;
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/html/HTMLTrackElement.h b/Source/WebCore/html/HTMLTrackElement.h
new file mode 100644
index 0000000..4697e02
--- /dev/null
+++ b/Source/WebCore/html/HTMLTrackElement.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLTrackElement_h
+#define HTMLTrackElement_h
+
+#if ENABLE(VIDEO_TRACK)
+
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+class HTMLTrackElement : public HTMLElement {
+public:
+    static PassRefPtr<HTMLTrackElement> create(const QualifiedName&, Document*);
+
+    KURL src() const;
+    String kind() const;
+    String srclang() const;
+    String label() const;
+
+    bool isDefault() const;
+    void setKind(const String&);
+    void setSrc(const String&);
+    void setSrclang(const String&);
+    void setLabel(const String&);
+    void setIsDefault(bool);
+
+private:
+    HTMLTrackElement(const QualifiedName&, Document*);
+
+    virtual void insertedIntoTree(bool);
+    virtual void willRemove();
+    virtual bool isURLAttribute(Attribute*) const;
+};
+
+}
+
+#endif
+#endif
diff --git a/Source/WebCore/html/HTMLTrackElement.idl b/Source/WebCore/html/HTMLTrackElement.idl
new file mode 100644
index 0000000..309f0f0
--- /dev/null
+++ b/Source/WebCore/html/HTMLTrackElement.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+interface [Conditional=VIDEO_TRACK] HTMLTrackElement : HTMLElement {
+    attribute [Reflect, URL] DOMString src;
+    attribute DOMString kind;
+    attribute DOMString srclang;
+    attribute DOMString label;
+    attribute [Reflect=default] boolean isDefault;
+
+    // readonly attribute TextTrack track;
+};
+}
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index 4ddcdfe..5b7f42d 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -129,6 +129,11 @@ bool HTMLVideoElement::supportsFullscreen() const
         return false;
 
     // Check with the platform client.
+#if ENABLE(FULLSCREEN_API)
+    if (page->chrome()->client()->supportsFullScreenForElement(this, false))
+        return true;
+#endif
+
     return page->chrome()->client()->supportsFullscreenForNode(this);
 }
 
@@ -183,7 +188,7 @@ void HTMLVideoElement::setDisplayMode(DisplayMode mode)
             if (oldMode != Video && player())
                 player()->prepareForRendering();
             if (!hasAvailableVideoFrame())
-                mode = Poster;
+                mode = PosterWaitingForVideo;
         }
     } else if (oldMode != Video && player())
         player()->prepareForRendering();
diff --git a/Source/WebCore/html/HTMLVideoElement.h b/Source/WebCore/html/HTMLVideoElement.h
index 714fcaa..57b70ea 100644
--- a/Source/WebCore/html/HTMLVideoElement.h
+++ b/Source/WebCore/html/HTMLVideoElement.h
@@ -64,7 +64,7 @@ public:
     // Used by canvas to gain raw pixel access
     void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
 
-    bool shouldDisplayPosterImage() const { return displayMode() == Poster; }
+    bool shouldDisplayPosterImage() const { return displayMode() == Poster || displayMode() == PosterWaitingForVideo; }
 
 private:
     HTMLVideoElement(const QualifiedName&, Document*);
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index d944909..9756313 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -55,6 +55,7 @@
 #include "RenderObject.h"
 #include "ResetInputType.h"
 #include "SearchInputType.h"
+#include "ShadowRoot.h"
 #include "SubmitInputType.h"
 #include "TelephoneInputType.h"
 #include "TextInputType.h"
@@ -365,7 +366,7 @@ void InputType::createShadowSubtree()
 
 void InputType::destroyShadowSubtree()
 {
-    element()->setShadowRoot(0);
+    element()->removeShadowRoot();
 }
 
 double InputType::parseToDouble(const String&, double defaultValue) const
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index cbec740..22e7f8e 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -39,6 +39,7 @@
 #include "MouseEvent.h"
 #include "PlatformMouseEvent.h"
 #include "RenderSlider.h"
+#include "ShadowRoot.h"
 #include "SliderThumbElement.h"
 #include "StepRange.h"
 #include <limits>
@@ -152,7 +153,7 @@ void RangeInputType::handleMouseDownEvent(MouseEvent* event)
     if (event->button() != LeftButton || event->target() != element())
         return;
 
-    if (SliderThumbElement* thumb = toSliderThumbElement(element()->shadowRoot()))
+    if (SliderThumbElement* thumb = shadowSliderThumb())
         thumb->dragFrom(event->absoluteLocation());
 }
 
@@ -216,7 +217,8 @@ void RangeInputType::handleTouchStartEvent(TouchEvent* touchEvent)
 
 void RangeInputType::createShadowSubtree()
 {
-    element()->setShadowRoot(SliderThumbElement::create(element()->document()));
+    ExceptionCode ec = 0;
+    element()->ensureShadowRoot()->appendChild(SliderThumbElement::create(element()->document()), ec);
 }
 
 RenderObject* RangeInputType::createRenderer(RenderArena* arena, RenderStyle*) const
@@ -261,7 +263,7 @@ void RangeInputType::minOrMaxAttributeChanged()
 
 void RangeInputType::valueChanged()
 {
-    toSliderThumbElement(element()->shadowRoot())->setPositionFromValue();
+    shadowSliderThumb()->setPositionFromValue();
 }
 
 String RangeInputType::fallbackValue()
@@ -285,4 +287,10 @@ bool RangeInputType::shouldRespectListAttribute()
     return true;
 }
 
+SliderThumbElement* RangeInputType::shadowSliderThumb() const
+{
+    Node* shadow = element()->shadowRoot();
+    return shadow ? toSliderThumbElement(shadow->firstChild()) : 0;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/html/RangeInputType.h b/Source/WebCore/html/RangeInputType.h
index ac89d02..b7af291 100644
--- a/Source/WebCore/html/RangeInputType.h
+++ b/Source/WebCore/html/RangeInputType.h
@@ -35,6 +35,8 @@
 
 namespace WebCore {
 
+class SliderThumbElement;
+
 class RangeInputType : public InputType {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
@@ -67,9 +69,14 @@ private:
     virtual String fallbackValue();
     virtual String sanitizeValue(const String& proposedValue);
     virtual bool shouldRespectListAttribute();
+<<<<<<< HEAD
 #if PLATFORM(ANDROID) && ENABLE(TOUCH_EVENTS)
     virtual void handleTouchStartEvent(TouchEvent*);
 #endif
+=======
+
+    SliderThumbElement* shadowSliderThumb() const;
+>>>>>>> WebKit.org at r84325
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index 59a1467..48912d7 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -40,6 +40,7 @@
 #include "Page.h"
 #include "RenderObject.h"
 #include "Settings.h"
+#include "ShadowRoot.h"
 #include "Text.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -129,12 +130,7 @@ void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
     // contains non-absolute or non-fixed renderers as children.
     m_bubble->getInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueAbsolute);
     ExceptionCode ec = 0;
-    // FIXME: We need a way to host multiple shadow roots in a single node, or
-    // to inherit an existing shadow tree.
-    if (host->shadowRoot())
-        host->shadowRoot()->appendChild(m_bubble.get(), ec);
-    else
-        host->setShadowRoot(m_bubble);
+    host->ensureShadowRoot()->appendChild(m_bubble.get(), ec);
 
     RefPtr<HTMLElement> clipper = ElementWithPseudoId::create(doc, "-webkit-validation-bubble-arrow-clipper");
     clipper->appendChild(ElementWithPseudoId::create(doc, "-webkit-validation-bubble-arrow"), ec);
@@ -161,12 +157,8 @@ void ValidationMessage::deleteBubbleTree(Timer<ValidationMessage>*)
     if (m_bubble) {
         m_bubbleMessage = 0;
         HTMLElement* host = toHTMLElement(m_element);
-        if (m_bubble->isShadowRoot())
-            host->setShadowRoot(0);
-        else {
-            ExceptionCode ec;
-            host->shadowRoot()->removeChild(m_bubble.get(), ec);
-        }
+        ExceptionCode ec;
+        host->shadowRoot()->removeChild(m_bubble.get(), ec);
         m_bubble = 0;
     }
     m_message = String();
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index f5ff078..ab6427e 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -133,7 +133,11 @@ CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas, bo
         m_context3D = p->sharedGraphicsContext3D();
         if (m_context3D) {
             m_drawingBuffer = m_context3D->graphicsContext3D()->createDrawingBuffer(IntSize(canvas->width(), canvas->height()));
-            c->setSharedGraphicsContext3D(m_context3D.get(), m_drawingBuffer.get(), IntSize(canvas->width(), canvas->height()));
+            if (!m_drawingBuffer) {
+                c->setSharedGraphicsContext3D(0, 0, IntSize());
+                m_context3D.clear();
+            } else
+                c->setSharedGraphicsContext3D(m_context3D.get(), m_drawingBuffer.get(), IntSize(canvas->width(), canvas->height()));
         }
     }
 #endif
@@ -146,7 +150,8 @@ CanvasRenderingContext2D::~CanvasRenderingContext2D()
 bool CanvasRenderingContext2D::isAccelerated() const
 {
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    return canvas()->document()->page()->settings()->canvasUsesAcceleratedDrawing();
+    ImageBuffer* buffer = canvas()->buffer();
+    return buffer ? buffer->isAccelerated() : false;
 #elif ENABLE(ACCELERATED_2D_CANVAS)
     return m_context3D;
 #else
@@ -172,13 +177,18 @@ void CanvasRenderingContext2D::reset()
 #if ENABLE(ACCELERATED_2D_CANVAS)
     if (GraphicsContext* c = drawingContext()) {
         if (m_context3D && m_drawingBuffer) {
-            m_drawingBuffer->reset(IntSize(canvas()->width(), canvas()->height()));
-            c->setSharedGraphicsContext3D(m_context3D.get(), m_drawingBuffer.get(), IntSize(canvas()->width(), canvas()->height()));
+            if (m_drawingBuffer->reset(IntSize(canvas()->width(), canvas()->height()))) {
+                c->setSharedGraphicsContext3D(m_context3D.get(), m_drawingBuffer.get(), IntSize(canvas()->width(), canvas()->height()));
 #if USE(ACCELERATED_COMPOSITING)
-            RenderBox* renderBox = canvas()->renderBox();
-            if (renderBox && renderBox->hasLayer() && renderBox->layer()->hasAcceleratedCompositing())
-                renderBox->layer()->contentChanged(RenderLayer::CanvasChanged);
+                RenderBox* renderBox = canvas()->renderBox();
+                if (renderBox && renderBox->hasLayer() && renderBox->layer()->hasAcceleratedCompositing())
+                    renderBox->layer()->contentChanged(RenderLayer::CanvasChanged);
 #endif
+            } else {
+                c->setSharedGraphicsContext3D(0, 0, IntSize());
+                m_drawingBuffer.clear();
+                m_context3D.clear();
+            }
         }
     }
 #endif
@@ -203,6 +213,83 @@ CanvasRenderingContext2D::State::State()
 {
 }
 
+CanvasRenderingContext2D::State::State(const State& other)
+    : FontSelectorClient()
+{
+    m_unparsedStrokeColor = other.m_unparsedStrokeColor;
+    m_unparsedFillColor = other.m_unparsedFillColor;
+    m_strokeStyle = other.m_strokeStyle;
+    m_fillStyle = other.m_fillStyle;
+    m_lineWidth = other.m_lineWidth;
+    m_lineCap = other.m_lineCap;
+    m_lineJoin = other.m_lineJoin;
+    m_miterLimit = other.m_miterLimit;
+    m_shadowOffset = other.m_shadowOffset;
+    m_shadowBlur = other.m_shadowBlur;
+    m_shadowColor = other.m_shadowColor;
+    m_globalAlpha = other.m_globalAlpha;
+    m_globalComposite = other.m_globalComposite;
+    m_transform = other.m_transform;
+    m_invertibleCTM = other.m_invertibleCTM;
+    m_textAlign = other.m_textAlign;
+    m_textBaseline = other.m_textBaseline;
+    m_unparsedFont = other.m_unparsedFont;
+    m_font = other.m_font;
+    m_realizedFont = other.m_realizedFont;
+
+    if (m_realizedFont)
+        m_font.fontSelector()->registerForInvalidationCallbacks(this);
+}
+
+CanvasRenderingContext2D::State& CanvasRenderingContext2D::State::operator=(const State& other)
+{
+    if (this == &other)
+        return *this;
+
+    if (m_realizedFont)
+        m_font.fontSelector()->unregisterForInvalidationCallbacks(this);
+
+    m_unparsedStrokeColor = other.m_unparsedStrokeColor;
+    m_unparsedFillColor = other.m_unparsedFillColor;
+    m_strokeStyle = other.m_strokeStyle;
+    m_fillStyle = other.m_fillStyle;
+    m_lineWidth = other.m_lineWidth;
+    m_lineCap = other.m_lineCap;
+    m_lineJoin = other.m_lineJoin;
+    m_miterLimit = other.m_miterLimit;
+    m_shadowOffset = other.m_shadowOffset;
+    m_shadowBlur = other.m_shadowBlur;
+    m_shadowColor = other.m_shadowColor;
+    m_globalAlpha = other.m_globalAlpha;
+    m_globalComposite = other.m_globalComposite;
+    m_transform = other.m_transform;
+    m_invertibleCTM = other.m_invertibleCTM;
+    m_textAlign = other.m_textAlign;
+    m_textBaseline = other.m_textBaseline;
+    m_unparsedFont = other.m_unparsedFont;
+    m_font = other.m_font;
+    m_realizedFont = other.m_realizedFont;
+
+    if (m_realizedFont)
+        m_font.fontSelector()->registerForInvalidationCallbacks(this);
+
+    return *this;
+}
+
+CanvasRenderingContext2D::State::~State()
+{
+    if (m_realizedFont)
+        m_font.fontSelector()->unregisterForInvalidationCallbacks(this);
+}
+
+void CanvasRenderingContext2D::State::fontsNeedUpdate(FontSelector* fontSelector)
+{
+    ASSERT_ARG(fontSelector, fontSelector == m_font.fontSelector());
+    ASSERT(m_realizedFont);
+
+    m_font.update(fontSelector);
+}
+
 void CanvasRenderingContext2D::save()
 {
     ASSERT(m_stateStack.size() >= 1);
@@ -959,7 +1046,7 @@ void CanvasRenderingContext2D::strokeRect(float x, float y, float width, float h
     didDraw(boundingRect);
 }
 
-#if PLATFORM(CG)
+#if USE(CG)
 static inline CGSize adjustedShadowSize(CGFloat width, CGFloat height)
 {
     // Work around <rdar://problem/5539388> by ensuring that shadow offsets will get truncated
@@ -1063,7 +1150,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     GraphicsContext* dc = drawingContext();
     if (!dc)
         return;
-#if PLATFORM(CG)
+#if USE(CG)
     const CGFloat components[5] = { c, m, y, k, a };
     CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceCMYK();
     CGColorRef shadowColor = CGColorCreate(colorSpace, components);
@@ -1150,8 +1237,12 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image,
     drawImage(image, FloatRect(sx, sy, sw, sh), FloatRect(dx, dy, dw, dh), ec);
 }
 
-void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRect& srcRect, const FloatRect& dstRect,
-    ExceptionCode& ec)
+void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRect& srcRect, const FloatRect& dstRect, ExceptionCode& ec)
+{
+    drawImage(image, srcRect, dstRect, state().m_globalComposite, ec);
+}
+
+void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRect& srcRect, const FloatRect& dstRect, const CompositeOperator& op, ExceptionCode& ec)
 {
     if (!image) {
         ec = TYPE_MISMATCH_ERR;
@@ -1193,7 +1284,7 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
 
     FloatRect sourceRect = c->roundToDevicePixels(normalizedSrcRect);
     FloatRect destRect = c->roundToDevicePixels(normalizedDstRect);
-    c->drawImage(cachedImage->image(), ColorSpaceDeviceRGB, destRect, sourceRect, state().m_globalComposite);
+    c->drawImage(cachedImage->image(), ColorSpaceDeviceRGB, destRect, sourceRect, op);
     didDraw(destRect);
 }
 
@@ -1352,34 +1443,17 @@ void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, const FloatRec
 }
 #endif
 
-// FIXME: Why isn't this just another overload of drawImage? Why have a different name?
 void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
     float sx, float sy, float sw, float sh,
     float dx, float dy, float dw, float dh,
     const String& compositeOperation)
 {
-    if (!image)
-        return;
-
-    CachedImage* cachedImage = image->cachedImage();
-    if (!cachedImage)
-        return;
-
-    checkOrigin(image);
-
-    GraphicsContext* c = drawingContext();
-    if (!c)
-        return;
-    if (!state().m_invertibleCTM)
-        return;
-
     CompositeOperator op;
     if (!parseCompositeOperator(compositeOperation, op))
         op = CompositeSourceOver;
 
-    FloatRect destRect = FloatRect(dx, dy, dw, dh);
-    c->drawImage(cachedImage->image(), ColorSpaceDeviceRGB, destRect, FloatRect(sx, sy, sw, sh), op);
-    didDraw(destRect);
+    ExceptionCode ec;
+    drawImage(image, FloatRect(sx, sy, sw, sh), FloatRect(dx, dy, dw, dh), op, ec);
 }
 
 void CanvasRenderingContext2D::setAlpha(float alpha)
@@ -1680,15 +1754,7 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
     state().m_font = newStyle->font();
     state().m_font.update(styleSelector->fontSelector());
     state().m_realizedFont = true;
-}
-
-void CanvasRenderingContext2D::updateFont()
-{
-    if (!state().m_realizedFont)
-        return;
-
-    const Font& font = state().m_font;
-    font.update(font.fontSelector());
+    styleSelector->fontSelector()->registerForInvalidationCallbacks(&state());
 }
 
 String CanvasRenderingContext2D::textAlign() const
@@ -1825,7 +1891,7 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
     if (!fill)
         textRect.inflate(c->strokeThickness() / 2);
 
-#if PLATFORM(CG)
+#if USE(CG)
     CanvasStyle* drawStyle = fill ? state().m_fillStyle.get() : state().m_strokeStyle.get();
     if (drawStyle->canvasGradient() || drawStyle->canvasPattern()) {
         // FIXME: The rect is not big enough for miters on stroked text.
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.h b/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
index 206744e..fbaec9e 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -37,7 +37,7 @@
 
 #include <wtf/Vector.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <ApplicationServices/ApplicationServices.h>
 #endif
 
@@ -175,6 +175,7 @@ public:
     void drawImage(HTMLCanvasElement*, float x, float y, float width, float height, ExceptionCode&);
     void drawImage(HTMLCanvasElement*, float sx, float sy, float sw, float sh, float dx, float dy, float dw, float dh, ExceptionCode&);
     void drawImage(HTMLCanvasElement*, const FloatRect& srcRect, const FloatRect& dstRect, ExceptionCode&);
+    void drawImage(HTMLImageElement*, const FloatRect& srcRect, const FloatRect& dstRect, const CompositeOperator&, ExceptionCode&);
 #if ENABLE(VIDEO)
     void drawImage(HTMLVideoElement*, float x, float y, ExceptionCode&);
     void drawImage(HTMLVideoElement*, float x, float y, float width, float height, ExceptionCode&);
@@ -204,7 +205,6 @@ public:
 
     String font() const;
     void setFont(const String&);
-    void updateFont();
 
     String textAlign() const;
     void setTextAlign(const String&);
@@ -228,8 +228,14 @@ public:
 #endif
 
 private:
-    struct State {
+    struct State : FontSelectorClient {
         State();
+        virtual ~State();
+
+        State(const State&);
+        State& operator=(const State&);
+
+        virtual void fontsNeedUpdate(FontSelector*);
 
         String m_unparsedStrokeColor;
         String m_unparsedFillColor;
diff --git a/Source/WebCore/html/canvas/CanvasStyle.cpp b/Source/WebCore/html/canvas/CanvasStyle.cpp
index ee8567c..3aee6e8 100644
--- a/Source/WebCore/html/canvas/CanvasStyle.cpp
+++ b/Source/WebCore/html/canvas/CanvasStyle.cpp
@@ -38,7 +38,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGContext.h>
 #endif
 
@@ -238,7 +238,7 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
     case CMYKA: {
         // FIXME: Do this through platform-independent GraphicsContext API.
         // We'll need a fancier Color abstraction to support CMYKA correctly
-#if PLATFORM(CG)
+#if USE(CG)
         CGContextSetCMYKStrokeColor(context->platformContext(), m_cmyka.c, m_cmyka.m, m_cmyka.y, m_cmyka.k, m_cmyka.a);
 #elif PLATFORM(QT)
         QPen currentPen = context->platformContext()->pen();
@@ -275,7 +275,7 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
     case CMYKA: {
         // FIXME: Do this through platform-independent GraphicsContext API.
         // We'll need a fancier Color abstraction to support CMYKA correctly
-#if PLATFORM(CG)
+#if USE(CG)
         CGContextSetCMYKFillColor(context->platformContext(), m_cmyka.c, m_cmyka.m, m_cmyka.y, m_cmyka.k, m_cmyka.a);
 #elif PLATFORM(QT)
         QBrush currentBrush = context->platformContext()->brush();
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index aa40a64..933d37f 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -458,14 +458,14 @@ void WebGLRenderingContext::setupFlags()
     ASSERT(m_context);
 
     m_isGLES2Compliant = m_context->isGLES2Compliant();
-    m_isErrorGeneratedOnOutOfBoundsAccesses = m_context->getExtensions()->supports("GL_CHROMIUM_strict_attribs");
-    m_isResourceSafe = m_context->getExtensions()->supports("GL_CHROMIUM_resource_safe");
+    m_isErrorGeneratedOnOutOfBoundsAccesses = m_context->getExtensions()->isEnabled("GL_CHROMIUM_strict_attribs");
+    m_isResourceSafe = m_context->getExtensions()->isEnabled("GL_CHROMIUM_resource_safe");
     if (m_isGLES2Compliant) {
-        m_isGLES2NPOTStrict = !m_context->getExtensions()->supports("GL_OES_texture_npot");
-        m_isDepthStencilSupported = m_context->getExtensions()->supports("GL_OES_packed_depth_stencil");
+        m_isGLES2NPOTStrict = !m_context->getExtensions()->isEnabled("GL_OES_texture_npot");
+        m_isDepthStencilSupported = m_context->getExtensions()->isEnabled("GL_OES_packed_depth_stencil");
     } else {
-        m_isGLES2NPOTStrict = !m_context->getExtensions()->supports("GL_ARB_texture_non_power_of_two");
-        m_isDepthStencilSupported = m_context->getExtensions()->supports("GL_EXT_packed_depth_stencil");
+        m_isGLES2NPOTStrict = !m_context->getExtensions()->isEnabled("GL_ARB_texture_non_power_of_two");
+        m_isDepthStencilSupported = m_context->getExtensions()->isEnabled("GL_EXT_packed_depth_stencil");
     }
 }
 
@@ -502,12 +502,12 @@ bool WebGLRenderingContext::clearIfComposited(GC3Dbitfield mask)
     if (isContextLost()) 
         return false;
 
-    RefPtr<WebGLContextAttributes> contextAttributes = getContextAttributes();
-
     if (!m_context->layerComposited() || m_layerCleared
         || m_attributes.preserveDrawingBuffer || m_framebufferBinding)
         return false;
 
+    RefPtr<WebGLContextAttributes> contextAttributes = getContextAttributes();
+
     // Determine if it's possible to combine the clear the user asked for and this clear.
     bool combinedClear = mask && !m_scissorEnabled;
 
@@ -3140,10 +3140,8 @@ void WebGLRenderingContext::texImage2D(GC3Denum target, GC3Dint level, GC3Denum
     ec = 0;
     if (isContextLost())
         return;
-    if (!image || !image->cachedImage()) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    if (!validateHTMLImageElement(image))
         return;
-    }
     checkOrigin(image);
     texImage2DImpl(target, level, internalformat, format, type, image->cachedImage()->image(),
                    m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
@@ -3334,10 +3332,8 @@ void WebGLRenderingContext::texSubImage2D(GC3Denum target, GC3Dint level, GC3Din
     ec = 0;
     if (isContextLost())
         return;
-    if (!image || !image->cachedImage()) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    if (!validateHTMLImageElement(image))
         return;
-    }
     checkOrigin(image);
     texSubImage2DImpl(target, level, xoffset, yoffset, format, type, image->cachedImage()->image(),
                       m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
@@ -4613,6 +4609,20 @@ WebGLBuffer* WebGLRenderingContext::validateBufferDataParameters(GC3Denum target
     return 0;
 }
 
+bool WebGLRenderingContext::validateHTMLImageElement(HTMLImageElement* image)
+{
+    if (!image || !image->cachedImage()) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    const KURL& url = image->cachedImage()->response().url();
+    if (url.isNull() || url.isEmpty() || !url.isValid()) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    return true;
+}
+
 void WebGLRenderingContext::vertexAttribfImpl(GC3Duint index, GC3Dsizei expectedSize, GC3Dfloat v0, GC3Dfloat v1, GC3Dfloat v2, GC3Dfloat v3)
 {
     if (isContextLost())
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index f716efb..23c147d 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -590,6 +590,9 @@ public:
     // Return the current bound buffer to target, or 0 if parameters are invalid.
     WebGLBuffer* validateBufferDataParameters(GC3Denum target, GC3Denum usage);
 
+    // Helper function for tex{Sub}Image2D to make sure image is ready.
+    bool validateHTMLImageElement(HTMLImageElement*);
+
     // Helper functions for vertexAttribNf{v}.
     void vertexAttribfImpl(GC3Duint index, GC3Dsizei expectedSize, GC3Dfloat, GC3Dfloat, GC3Dfloat, GC3Dfloat);
     void vertexAttribfvImpl(GC3Duint index, Float32Array*, GC3Dsizei expectedSize);
diff --git a/Source/WebCore/html/parser/CSSPreloadScanner.cpp b/Source/WebCore/html/parser/CSSPreloadScanner.cpp
index 23364f9..3c23b9f 100644
--- a/Source/WebCore/html/parser/CSSPreloadScanner.cpp
+++ b/Source/WebCore/html/parser/CSSPreloadScanner.cpp
@@ -54,7 +54,7 @@ void CSSPreloadScanner::scan(const HTMLToken& token, bool scanningBody)
     m_scanningBody = scanningBody;
 
     const HTMLToken::DataVector& characters = token.characters();
-    for (HTMLToken::DataVector::const_iterator iter = characters.begin(); iter != characters.end(); ++iter)
+    for (HTMLToken::DataVector::const_iterator iter = characters.begin(); iter != characters.end() && m_state != DoneParsingImportRules; ++iter)
         tokenize(*iter);
 }
 
@@ -64,10 +64,14 @@ inline void CSSPreloadScanner::tokenize(UChar c)
     // Searching for other types of resources is probably low payoff.
     switch (m_state) {
     case Initial:
+        if (isHTMLSpace(c))
+            break;
         if (c == '@')
             m_state = RuleStart;
         else if (c == '/')
             m_state = MaybeComment;
+        else
+            m_state = DoneParsingImportRules;
         break;
     case MaybeComment:
         if (c == '*')
@@ -80,10 +84,10 @@ inline void CSSPreloadScanner::tokenize(UChar c)
             m_state = MaybeCommentEnd;
         break;
     case MaybeCommentEnd:
+        if (c == '*')
+            break;
         if (c == '/')
             m_state = Initial;
-        else if (c == '*')
-            ;
         else
             m_state = Comment;
         break;
@@ -106,9 +110,11 @@ inline void CSSPreloadScanner::tokenize(UChar c)
         break;
     case AfterRule:
         if (isHTMLSpace(c))
-            ;
-        else if (c == ';')
+            break;
+        if (c == ';')
             m_state = Initial;
+        else if (c == '{')
+            m_state = DoneParsingImportRules;
         else {
             m_state = RuleValue;
             m_ruleValue.append(c);
@@ -117,23 +123,26 @@ inline void CSSPreloadScanner::tokenize(UChar c)
     case RuleValue:
         if (isHTMLSpace(c))
             m_state = AfterRuleValue;
-        else if (c == ';') {
+        else if (c == ';')
             emitRule();
-            m_state = Initial;
-        } else 
+        else
             m_ruleValue.append(c);
         break;
     case AfterRuleValue:
         if (isHTMLSpace(c))
-            ;
-        else if (c == ';') {
+            break;
+        if (c == ';')
             emitRule();
-            m_state = Initial;
-        } else {
+        else if (c == '{')
+            m_state = DoneParsingImportRules;
+        else {
             // FIXME: media rules
             m_state = Initial;
         }
         break;
+    case DoneParsingImportRules:
+        ASSERT_NOT_REACHED();
+        break;
     }
 }
 
@@ -187,7 +196,11 @@ void CSSPreloadScanner::emitRule()
         String value = parseCSSStringOrURL(m_ruleValue.data(), m_ruleValue.size());
         if (!value.isEmpty())
             m_document->cachedResourceLoader()->preload(CachedResource::CSSStyleSheet, value, String(), m_scanningBody);
-    }
+        m_state = Initial;
+    } else if (equalIgnoringCase("charset", m_rule.data(), m_rule.size()))
+        m_state = Initial;
+    else
+        m_state = DoneParsingImportRules;
     m_rule.clear();
     m_ruleValue.clear();
 }
diff --git a/Source/WebCore/html/parser/CSSPreloadScanner.h b/Source/WebCore/html/parser/CSSPreloadScanner.h
index fae95a1..e45fa2d 100644
--- a/Source/WebCore/html/parser/CSSPreloadScanner.h
+++ b/Source/WebCore/html/parser/CSSPreloadScanner.h
@@ -53,7 +53,8 @@ private:
         Rule,
         AfterRule,
         RuleValue,
-        AfterRuleValue
+        AfterRuleValue,
+        DoneParsingImportRules,
     };
 
     inline void tokenize(UChar c);
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.cpp b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
index 88db3c2..7519699 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.cpp
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
@@ -40,7 +40,6 @@
 #include "InspectorInstrumentation.h"
 #include "NestingLevelIncrementer.h"
 #include "Settings.h"
-#include <wtf/CurrentTime.h>
 
 #ifdef ANDROID_INSTRUMENT
 #include "TimeCounter.h"
@@ -331,6 +330,14 @@ void HTMLDocumentParser::insert(const SegmentedString& source)
     excludedLineNumberSource.setExcludeLineNumbers();
     m_input.insertAtCurrentInsertionPoint(excludedLineNumberSource);
     pumpTokenizerIfPossible(ForceSynchronous);
+    
+    if (isWaitingForScripts()) {
+        // Check the document.write() output with a separate preload scanner as
+        // the main scanner can't deal with insertions.
+        HTMLPreloadScanner preloadScanner(document());
+        preloadScanner.appendToEnd(source);
+        preloadScanner.scan();
+    }
 
     endIfDelayed();
 }
@@ -344,9 +351,19 @@ void HTMLDocumentParser::append(const SegmentedString& source)
     // but we need to ensure it isn't deleted yet.
     RefPtr<HTMLDocumentParser> protect(this);
 
+    if (m_preloadScanner) {
+        if (m_input.current().isEmpty() && !isWaitingForScripts()) {
+            // We have parsed until the end of the current input and so are now moving ahead of the preload scanner.
+            // Clear the scanner so we know to scan starting from the current input point if we block again.
+            m_preloadScanner.clear();
+        } else {
+            m_preloadScanner->appendToEnd(source);
+            if (isWaitingForScripts())
+                m_preloadScanner->scan();
+        }
+    }
+
     m_input.appendToEnd(source);
-    if (m_preloadScanner)
-        m_preloadScanner->appendToEnd(source);
 
     if (inPumpSession()) {
         // We've gotten data off the network in a nested write.
@@ -473,7 +490,6 @@ void HTMLDocumentParser::resumeParsingAfterScriptExecution()
     ASSERT(!inScriptExecution());
     ASSERT(!m_treeBuilder->isPaused());
 
-    m_preloadScanner.clear();
     pumpTokenizerIfPossible(AllowYield);
     endIfDelayed();
 }
@@ -491,6 +507,13 @@ void HTMLDocumentParser::stopWatchingForLoad(CachedResource* cachedScript)
 {
     cachedScript->removeClient(this);
 }
+    
+void HTMLDocumentParser::appendCurrentInputStreamToPreloadScannerAndScan()
+{
+    ASSERT(m_preloadScanner);
+    m_preloadScanner->appendToEnd(m_input.current());
+    m_preloadScanner->scan();
+}
 
 void HTMLDocumentParser::notifyFinished(CachedResource* cachedResource)
 {
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.h b/Source/WebCore/html/parser/HTMLDocumentParser.h
index a016cf3..d482a3d 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.h
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.h
@@ -109,6 +109,8 @@ private:
     virtual void watchForLoad(CachedResource*);
     virtual void stopWatchingForLoad(CachedResource*);
     virtual HTMLInputStream& inputStream() { return m_input; }
+    virtual bool hasPreloadScanner() const { return m_preloadScanner.get(); }
+    virtual void appendCurrentInputStreamToPreloadScannerAndScan();
 
     // CachedResourceClient
     virtual void notifyFinished(CachedResource*);
diff --git a/Source/WebCore/html/parser/HTMLParserScheduler.h b/Source/WebCore/html/parser/HTMLParserScheduler.h
index 730b52b..b0e2e85 100644
--- a/Source/WebCore/html/parser/HTMLParserScheduler.h
+++ b/Source/WebCore/html/parser/HTMLParserScheduler.h
@@ -26,6 +26,8 @@
 #ifndef HTMLParserScheduler_h
 #define HTMLParserScheduler_h
 
+#include <limits.h>
+
 #include "NestingLevelIncrementer.h"
 #include "Timer.h"
 #include <wtf/CurrentTime.h>
@@ -39,8 +41,11 @@ class PumpSession : public NestingLevelIncrementer {
 public:
     PumpSession(unsigned& nestingLevel)
         : NestingLevelIncrementer(nestingLevel)
-        , processedTokens(0)
-        , startTime(currentTime())
+        // Setting processedTokens to INT_MAX causes us to check for yields
+        // after any token during any parse where yielding is allowed.
+        // At that time we'll initialize startTime.
+        , processedTokens(INT_MAX)
+        , startTime(0)
         , needsYield(false)
     {
     }
@@ -63,6 +68,11 @@ public:
     void checkForYieldBeforeToken(PumpSession& session)
     {
         if (session.processedTokens > m_parserChunkSize) {
+            // currentTime() can be expensive.  By delaying, we avoided calling
+            // currentTime() when constructing non-yielding PumpSessions.
+            if (!session.startTime)
+                session.startTime = currentTime();
+
             session.processedTokens = 0;
             double elapsedTime = currentTime() - session.startTime;
             if (elapsedTime > m_parserTimeLimit)
diff --git a/Source/WebCore/html/parser/HTMLScriptRunner.cpp b/Source/WebCore/html/parser/HTMLScriptRunner.cpp
index 99fff5e..7312334 100644
--- a/Source/WebCore/html/parser/HTMLScriptRunner.cpp
+++ b/Source/WebCore/html/parser/HTMLScriptRunner.cpp
@@ -169,12 +169,17 @@ bool HTMLScriptRunner::execute(PassRefPtr<Element> scriptElement, const TextPosi
     ASSERT(scriptElement);
     // FIXME: If scripting is disabled, always just return true;
 
+    bool hadPreloadScanner = m_host->hasPreloadScanner();
+
     // Try to execute the script given to us.
     runScript(scriptElement.get(), scriptStartPosition);
 
     if (haveParsingBlockingScript()) {
         if (m_scriptNestingLevel)
             return false; // Block the parser.  Unwind to the outermost HTMLScriptRunner::execute before continuing parsing.
+        // If preload scanner got created, it is missing the source after the current insertion point. Append it and scan.
+        if (!hadPreloadScanner && m_host->hasPreloadScanner())
+            m_host->appendCurrentInputStreamToPreloadScannerAndScan();
         if (!executeParsingBlockingScripts())
             return false; // We still have a parsing blocking script, block the parser.
     }
diff --git a/Source/WebCore/html/parser/HTMLScriptRunnerHost.h b/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
index 454bc6f..1f22896 100644
--- a/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
+++ b/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
@@ -45,6 +45,10 @@ public:
     virtual void stopWatchingForLoad(CachedResource*) = 0;
 
     virtual HTMLInputStream& inputStream() = 0;
+
+    virtual bool hasPreloadScanner() const = 0;
+    virtual void appendCurrentInputStreamToPreloadScannerAndScan() = 0;
+    
 };
 
 }
diff --git a/Source/WebCore/html/shadow/DetailsMarkerControl.cpp b/Source/WebCore/html/shadow/DetailsMarkerControl.cpp
new file mode 100644
index 0000000..e8c6d6e
--- /dev/null
+++ b/Source/WebCore/html/shadow/DetailsMarkerControl.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DetailsMarkerControl.h"
+
+#include "HTMLNames.h"
+#include "HTMLSummaryElement.h"
+#include "RenderDetailsMarker.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+DetailsMarkerControl::DetailsMarkerControl(Document* document) 
+    : HTMLDivElement(divTag, document)
+{
+}
+
+RenderObject* DetailsMarkerControl::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderDetailsMarker(this);
+}
+
+bool DetailsMarkerControl::rendererIsNeeded(RenderStyle* style)
+{
+    return summaryElement()->isMainSummary() && HTMLDivElement::rendererIsNeeded(style);
+}
+
+const AtomicString& DetailsMarkerControl::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-details-marker"));
+    return pseudId;
+}
+
+HTMLSummaryElement* DetailsMarkerControl::summaryElement()
+{
+    Node* node = this->shadowAncestorNode();
+    ASSERT(!node || toElement(node)->hasTagName(summaryTag));
+    return static_cast<HTMLSummaryElement*>(node);
+}
+
+}
diff --git a/Source/WebCore/inspector/front-end/Breakpoint.js b/Source/WebCore/html/shadow/DetailsMarkerControl.h
index ebc6029..3c5b09d 100644
--- a/Source/WebCore/inspector/front-end/Breakpoint.js
+++ b/Source/WebCore/html/shadow/DetailsMarkerControl.h
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,21 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Breakpoint = function(id, url, sourceID, lineNumber, columnNumber, condition, enabled)
+#ifndef DetailsMarkerControl_h
+#define DetailsMarkerControl_h
+
+#include "HTMLDivElement.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class HTMLSummaryElement;
+
+class DetailsMarkerControl : public HTMLDivElement {
+public:
+    DetailsMarkerControl(Document*);
+    static PassRefPtr<DetailsMarkerControl> create(Document*);
+
+private:
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool rendererIsNeeded(RenderStyle*);
+    virtual const AtomicString& shadowPseudoId() const;
+
+    HTMLSummaryElement* summaryElement();
+};
+
+inline PassRefPtr<DetailsMarkerControl> DetailsMarkerControl::create(Document* document)
 {
-    this.id = id;
-    this.url = url;
-    this.sourceID = sourceID;
-    this.lineNumber = lineNumber;
-    this.columnNumber = columnNumber;
-    this.condition = condition;
-    this.enabled = enabled;
-    this.locations = [];
+    return adoptRef(new DetailsMarkerControl(document));
 }
 
-WebInspector.Breakpoint.prototype = {
-    addLocation: function(sourceID, lineNumber, columnNumber)
-    {
-        this.locations.push({ sourceID: sourceID, lineNumber: lineNumber, columnNumber: columnNumber });
-    }
 }
+
+#endif
diff --git a/Source/WebCore/rendering/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index 07df4d9..68b301e 100644
--- a/Source/WebCore/rendering/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -67,128 +67,33 @@ static const float cSeekRepeatDelay = 0.1f;
 static const float cStepTime = 0.07f;
 static const float cSeekTime = 0.2f;
 
-inline MediaControlShadowRootElement::MediaControlShadowRootElement(HTMLMediaElement* mediaElement)
-    : HTMLDivElement(divTag, mediaElement->document())
-{
-    setShadowHost(mediaElement);
-}
-
-PassRefPtr<MediaControlShadowRootElement> MediaControlShadowRootElement::create(HTMLMediaElement* mediaElement)
-{
-    RefPtr<MediaControlShadowRootElement> element = adoptRef(new MediaControlShadowRootElement(mediaElement));
-
-    RefPtr<RenderStyle> rootStyle = RenderStyle::create();
-    rootStyle->inheritFrom(mediaElement->renderer()->style());
-    rootStyle->setDisplay(BLOCK);
-    rootStyle->setPosition(RelativePosition);
-
-    RenderMediaControlShadowRoot* renderer = new (mediaElement->renderer()->renderArena()) RenderMediaControlShadowRoot(element.get());
-    renderer->setStyle(rootStyle.release());
-
-    element->setRenderer(renderer);
-    element->setAttached();
-    element->setInDocument();
-
-    return element.release();
-}
-
-void MediaControlShadowRootElement::detach()
-{
-    HTMLDivElement::detach();
-    // FIXME: Remove once shadow DOM uses Element::setShadowRoot().
-    setShadowHost(0);
-}
-
 // ----------------------------
 
 MediaControlElement::MediaControlElement(HTMLMediaElement* mediaElement)
     : HTMLDivElement(divTag, mediaElement->document())
     , m_mediaElement(mediaElement)
 {
-    setInDocument();
-}
-
-void MediaControlElement::attachToParent(Element* parent)
-{
-    // FIXME: This code seems very wrong.  Why are we magically adding |this| to the DOM here?
-    //        We shouldn't be calling parser API methods outside of the parser!
-    parent->parserAddChild(this);
-}
-
-void MediaControlElement::update()
-{
-    if (renderer())
-        renderer()->updateFromElement();
-    updateStyle();
 }
 
-PassRefPtr<RenderStyle> MediaControlElement::styleForElement()
+static const String& displayString()
 {
-    ASSERT(m_mediaElement->renderer());
-    RefPtr<RenderStyle> style = document()->styleSelector()->styleForElement(this, m_mediaElement->renderer()->style(), true);
-    if (!style)
-        return 0;
-    
-    // text-decoration can't be overrided from CSS. So we do it here.
-    // See https://bugs.webkit.org/show_bug.cgi?id=27015
-    style->setTextDecoration(TDNONE);
-    style->setTextDecorationsInEffect(TDNONE);
-
-    return style;
+    DEFINE_STATIC_LOCAL(String, s, ("display"));
+    return s;
 }
 
-bool MediaControlElement::rendererIsNeeded(RenderStyle* style)
-{
-    ASSERT(document()->page());
-
-    return HTMLDivElement::rendererIsNeeded(style) && parentNode() && parentNode()->renderer()
-        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
-}
-    
-void MediaControlElement::attach()
+void MediaControlElement::show()
 {
-    RefPtr<RenderStyle> style = styleForElement();
-    if (!style)
-        return;
-    bool needsRenderer = rendererIsNeeded(style.get());
-    if (!needsRenderer)
-        return;
-    RenderObject* renderer = createRenderer(m_mediaElement->renderer()->renderArena(), style.get());
-    if (!renderer)
-        return;
-    renderer->setStyle(style.get());
-    setRenderer(renderer);
-    if (parentNode() && parentNode()->renderer()) {
-        // Find next sibling with a renderer to determine where to insert.
-        Node* sibling = nextSibling();
-        while (sibling && !sibling->renderer())
-            sibling = sibling->nextSibling();
-        parentNode()->renderer()->addChild(renderer, sibling ? sibling->renderer() : 0);
-    }
-    ContainerNode::attach();
+    ExceptionCode ec;
+    // FIXME: Make more efficient <http://webkit.org/b/58157>
+    style()->removeProperty(displayString(), ec);
 }
 
-void MediaControlElement::updateStyle()
+void MediaControlElement::hide()
 {
-    if (!m_mediaElement || !m_mediaElement->renderer())
-        return;
-
-    RefPtr<RenderStyle> style = styleForElement();
-    if (!style)
-        return;
-
-    bool needsRenderer = rendererIsNeeded(style.get()) && parentNode() && parentNode()->renderer();
-    if (renderer() && !needsRenderer)
-        detach();
-    else if (!renderer() && needsRenderer)
-        attach();
-    else if (renderer()) {
-        renderer()->setStyle(style.get());
-
-        // Make sure that if there is any innerText renderer, it is updated as well.
-        if (firstChild() && firstChild()->renderer())
-            firstChild()->renderer()->setStyle(style.get());
-    }
+    ExceptionCode ec;
+    // FIXME: Make more efficient <http://webkit.org/b/58157>
+    DEFINE_STATIC_LOCAL(String, none, ("none"));
+    style()->setProperty(displayString(), none, ec);
 }
 
 // ----------------------------
@@ -223,20 +128,9 @@ inline MediaControlTimelineContainerElement::MediaControlTimelineContainerElemen
 
 PassRefPtr<MediaControlTimelineContainerElement> MediaControlTimelineContainerElement::create(HTMLMediaElement* mediaElement)
 {
-    return adoptRef(new MediaControlTimelineContainerElement(mediaElement));
-}
-
-bool MediaControlTimelineContainerElement::rendererIsNeeded(RenderStyle* style)
-{
-    if (!MediaControlElement::rendererIsNeeded(style))
-        return false;
-
-    // Always show the timeline if the theme doesn't use status display (MediaControllerThemeClassic, for instance).
-    if (!document()->page()->theme()->usesMediaControlStatusDisplay())
-        return true;
-
-    float duration = mediaElement()->duration();
-    return !isnan(duration) && !isinf(duration);
+    RefPtr<MediaControlTimelineContainerElement> element = adoptRef(new MediaControlTimelineContainerElement(mediaElement));
+    element->hide();
+    return element.release();
 }
 
 MediaControlElementType MediaControlTimelineContainerElement::displayType() const
@@ -286,13 +180,14 @@ void RenderMediaVolumeSliderContainer::layout()
 
 inline MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement(HTMLMediaElement* mediaElement)
     : MediaControlElement(mediaElement)
-    , m_isVisible(false)
 {
 }
 
 PassRefPtr<MediaControlVolumeSliderContainerElement> MediaControlVolumeSliderContainerElement::create(HTMLMediaElement* mediaElement)
 {
-    return adoptRef(new MediaControlVolumeSliderContainerElement(mediaElement));
+    RefPtr<MediaControlVolumeSliderContainerElement> element = adoptRef(new MediaControlVolumeSliderContainerElement(mediaElement));
+    element->hide();
+    return element.release();
 }
 
 RenderObject* MediaControlVolumeSliderContainerElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -300,29 +195,23 @@ RenderObject* MediaControlVolumeSliderContainerElement::createRenderer(RenderAre
     return new (arena) RenderMediaVolumeSliderContainer(this);
 }
 
-PassRefPtr<RenderStyle> MediaControlVolumeSliderContainerElement::styleForElement()
+void MediaControlVolumeSliderContainerElement::defaultEventHandler(Event* event)
 {
-    RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
-    style->setPosition(AbsolutePosition);
-    style->setDisplay(m_isVisible ? BLOCK : NONE);
-    return style;
-}
+    if (!event->isMouseEvent() || event->type() != eventNames().mouseoutEvent)
+        return;
 
-void MediaControlVolumeSliderContainerElement::setVisible(bool visible)
-{
-    if (visible == m_isVisible)
+    // Poor man's mouseleave event detection.
+    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+    if (!mouseEvent->relatedTarget() || !mouseEvent->relatedTarget()->toNode())
         return;
-    m_isVisible = visible;
-}
 
-bool MediaControlVolumeSliderContainerElement::hitTest(const IntPoint& absPoint)
-{
-    if (renderer() && renderer()->style()->hasAppearance())
-        return renderer()->theme()->hitTestMediaControlPart(renderer(), absPoint);
+    if (this->containsIncludingShadowDOM(mouseEvent->relatedTarget()->toNode()))
+        return;
 
-    return false;
+    hide();
 }
 
+
 MediaControlElementType MediaControlVolumeSliderContainerElement::displayType() const
 {
     return MediaVolumeSliderContainer;
@@ -344,13 +233,13 @@ inline MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(HTMLMe
 
 PassRefPtr<MediaControlStatusDisplayElement> MediaControlStatusDisplayElement::create(HTMLMediaElement* mediaElement)
 {
-    return adoptRef(new MediaControlStatusDisplayElement(mediaElement));
+    RefPtr<MediaControlStatusDisplayElement> element = adoptRef(new MediaControlStatusDisplayElement(mediaElement));
+    element->hide();
+    return element.release();
 }
 
 void MediaControlStatusDisplayElement::update()
 {
-    MediaControlElement::update();
-
     // Get the new state that we'll have to display.
     StateBeingDisplayed newStateToDisplay = Nothing;
 
@@ -359,12 +248,18 @@ void MediaControlStatusDisplayElement::update()
     else if (mediaElement()->movieLoadType() == MediaPlayer::LiveStream)
         newStateToDisplay = LiveBroadcast;
 
-    // Propagate only if needed.
     if (newStateToDisplay == m_stateBeingDisplayed)
         return;
-    m_stateBeingDisplayed = newStateToDisplay;
 
     ExceptionCode e;
+
+    if (m_stateBeingDisplayed == Nothing)
+        show();
+    else if (newStateToDisplay == Nothing)
+        hide();
+
+    m_stateBeingDisplayed = newStateToDisplay;
+
     switch (m_stateBeingDisplayed) {
     case Nothing:
         setInnerText("", e);
@@ -378,14 +273,6 @@ void MediaControlStatusDisplayElement::update()
     }
 }
 
-bool MediaControlStatusDisplayElement::rendererIsNeeded(RenderStyle* style)
-{
-    if (!MediaControlElement::rendererIsNeeded(style) || !document()->page()->theme()->usesMediaControlStatusDisplay())
-        return false;
-    float duration = mediaElement()->duration();
-    return (isnan(duration) || isinf(duration));
-}
-
 MediaControlElementType MediaControlStatusDisplayElement::displayType() const
 {
     return MediaStatusDisplay;
@@ -406,96 +293,19 @@ MediaControlInputElement::MediaControlInputElement(HTMLMediaElement* mediaElemen
 {
 }
 
-void MediaControlInputElement::attachToParent(Element* parent)
-{
-    // FIXME: This code seems very wrong.  Why are we magically adding |this| to the DOM here?
-    //        We shouldn't be calling parser API methods outside of the parser!
-    parent->parserAddChild(this);
-}
-
-void MediaControlInputElement::update()
+void MediaControlInputElement::show()
 {
-    updateDisplayType();
-    if (renderer())
-        renderer()->updateFromElement();
-    updateStyle();
-}
-
-PassRefPtr<RenderStyle> MediaControlInputElement::styleForElement()
-{
-    return document()->styleSelector()->styleForElement(this, 0, true);
-}
-
-bool MediaControlInputElement::rendererIsNeeded(RenderStyle* style)
-{
-    ASSERT(document()->page());
-
-    return HTMLInputElement::rendererIsNeeded(style) && parentNode() && parentNode()->renderer()
-        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), mediaElement()));
+    ExceptionCode ec;
+    style()->removeProperty(displayString(), ec);
 }
 
-void MediaControlInputElement::attach()
+void MediaControlInputElement::hide()
 {
-    RefPtr<RenderStyle> style = styleForElement();
-    if (!style)
-        return;
-    
-    bool needsRenderer = rendererIsNeeded(style.get());
-    if (!needsRenderer)
-        return;
-    RenderObject* renderer = createRenderer(mediaElement()->renderer()->renderArena(), style.get());
-    if (!renderer)
-        return;
-    renderer->setStyle(style.get());
-    setRenderer(renderer);
-    if (parentNode() && parentNode()->renderer()) {
-        // Find next sibling with a renderer to determine where to insert.
-        Node* sibling = nextSibling();
-        while (sibling && !sibling->renderer())
-            sibling = sibling->nextSibling();
-        parentNode()->renderer()->addChild(renderer, sibling ? sibling->renderer() : 0);
-    }  
-    ContainerNode::attach();
-    // FIXME: Currently, MeidaControlInput circumvents the normal attachment
-    // and style recalc cycle and thus we need to add extra logic to be aware of
-    // the shadow DOM. Remove this once all media controls are transitioned to use the regular
-    // style calculation.
-    if (Node* shadowNode = shadowRoot())
-        shadowNode->attach();
-}
-
-void MediaControlInputElement::updateStyle()
-{
-    if (!mediaElement() || !mediaElement()->renderer())
-        return;
-    
-    RefPtr<RenderStyle> style = styleForElement();
-    if (!style)
-        return;
-    
-    bool needsRenderer = rendererIsNeeded(style.get()) && parentNode() && parentNode()->renderer();
-    if (renderer() && !needsRenderer)
-        detach();
-    else if (!renderer() && needsRenderer)
-        attach();
-    else if (renderer())
-        renderer()->setStyle(style.get());
-
-    // FIXME: Currently, MeidaControlInput circumvents the normal attachment
-    // and style recalc cycle and thus we need to add extra logic to be aware of
-    // the shadow DOM. Remove this once all media controls are transitioned to use
-    // the new shadow DOM.
-    if (Node* shadowNode = shadowRoot())
-        shadowNode->recalcStyle(Node::Force);
+    ExceptionCode ec;
+    DEFINE_STATIC_LOCAL(String, none, ("none"));
+    style()->setProperty(displayString(), none, ec);
 }
 
-bool MediaControlInputElement::hitTest(const IntPoint& absPoint)
-{
-    if (renderer() && renderer()->style()->hasAppearance())
-        return renderer()->theme()->hitTestMediaControlPart(renderer(), absPoint);
-
-    return false;
-}
 
 void MediaControlInputElement::setDisplayType(MediaControlElementType displayType)
 {
@@ -520,9 +330,15 @@ void MediaControlMuteButtonElement::defaultEventHandler(Event* event)
         mediaElement()->setMuted(!mediaElement()->muted());
         event->setDefaultHandled();
     }
+
     HTMLInputElement::defaultEventHandler(event);
 }
 
+void MediaControlMuteButtonElement::changedMute()
+{
+    updateDisplayType();
+}
+
 void MediaControlMuteButtonElement::updateDisplayType()
 {
     setDisplayType(mediaElement()->muted() ? MediaUnMuteButton : MediaMuteButton);
@@ -530,18 +346,29 @@ void MediaControlMuteButtonElement::updateDisplayType()
 
 // ----------------------------
 
-inline MediaControlPanelMuteButtonElement::MediaControlPanelMuteButtonElement(HTMLMediaElement* mediaElement)
+inline MediaControlPanelMuteButtonElement::MediaControlPanelMuteButtonElement(HTMLMediaElement* mediaElement, MediaControls* controls)
     : MediaControlMuteButtonElement(mediaElement, MediaMuteButton)
+    , m_controls(controls)
 {
 }
 
-PassRefPtr<MediaControlPanelMuteButtonElement> MediaControlPanelMuteButtonElement::create(HTMLMediaElement* mediaElement)
+PassRefPtr<MediaControlPanelMuteButtonElement> MediaControlPanelMuteButtonElement::create(HTMLMediaElement* mediaElement, MediaControls* controls)
 {
-    RefPtr<MediaControlPanelMuteButtonElement> button = adoptRef(new MediaControlPanelMuteButtonElement(mediaElement));
+    ASSERT(controls);
+
+    RefPtr<MediaControlPanelMuteButtonElement> button = adoptRef(new MediaControlPanelMuteButtonElement(mediaElement, controls));
     button->setType("button");
     return button.release();
 }
 
+void MediaControlPanelMuteButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().mouseoverEvent)
+        m_controls->showVolumeSlider();
+
+    MediaControlMuteButtonElement::defaultEventHandler(event);
+}
+
 const AtomicString& MediaControlPanelMuteButtonElement::shadowPseudoId() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-mute-button"));
@@ -551,7 +378,7 @@ const AtomicString& MediaControlPanelMuteButtonElement::shadowPseudoId() const
 // ----------------------------
 
 inline MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteButtonElement(HTMLMediaElement* mediaElement)
-    : MediaControlMuteButtonElement(mediaElement, MediaVolumeSliderMuteButton)
+    : MediaControlMuteButtonElement(mediaElement, MediaMuteButton)
 {
 }
 
@@ -586,6 +413,7 @@ void MediaControlPlayButtonElement::defaultEventHandler(Event* event)
 {
     if (event->type() == eventNames().clickEvent) {
         mediaElement()->togglePlayState();
+        updateDisplayType();
         event->setDefaultHandled();
     }
     HTMLInputElement::defaultEventHandler(event);
@@ -739,6 +567,7 @@ PassRefPtr<MediaControlReturnToRealtimeButtonElement> MediaControlReturnToRealti
 {
     RefPtr<MediaControlReturnToRealtimeButtonElement> button = adoptRef(new MediaControlReturnToRealtimeButtonElement(mediaElement));
     button->setType("button");
+    button->hide();
     return button.release();
 }
 
@@ -768,6 +597,7 @@ PassRefPtr<MediaControlToggleClosedCaptionsButtonElement> MediaControlToggleClos
 {
     RefPtr<MediaControlToggleClosedCaptionsButtonElement> button = adoptRef(new MediaControlToggleClosedCaptionsButtonElement(mediaElement));
     button->setType("button");
+    button->hide();
     return button.release();
 }
 
@@ -776,8 +606,10 @@ void MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler(Event* e
     if (event->type() == eventNames().clickEvent) {
         mediaElement()->setClosedCaptionsVisible(!mediaElement()->closedCaptionsVisible());
         setChecked(mediaElement()->closedCaptionsVisible());
+        updateDisplayType();
         event->setDefaultHandled();
     }
+
     HTMLInputElement::defaultEventHandler(event);
 }
 
@@ -794,14 +626,17 @@ const AtomicString& MediaControlToggleClosedCaptionsButtonElement::shadowPseudoI
 
 // ----------------------------
 
-MediaControlTimelineElement::MediaControlTimelineElement(HTMLMediaElement* mediaElement)
+MediaControlTimelineElement::MediaControlTimelineElement(HTMLMediaElement* mediaElement, MediaControls* controls)
     : MediaControlInputElement(mediaElement, MediaSlider)
+    , m_controls(controls)
 {
 }
 
-PassRefPtr<MediaControlTimelineElement> MediaControlTimelineElement::create(HTMLMediaElement* mediaElement)
+PassRefPtr<MediaControlTimelineElement> MediaControlTimelineElement::create(HTMLMediaElement* mediaElement, MediaControls* controls)
 {
-    RefPtr<MediaControlTimelineElement> timeline = adoptRef(new MediaControlTimelineElement(mediaElement));
+    ASSERT(controls);
+
+    RefPtr<MediaControlTimelineElement> timeline = adoptRef(new MediaControlTimelineElement(mediaElement, controls));
     timeline->setType("range");
     timeline->setAttribute(precisionAttr, "float");
     return timeline.release();
@@ -826,32 +661,39 @@ void MediaControlTimelineElement::defaultEventHandler(Event* event)
 
     float time = narrowPrecisionToFloat(value().toDouble());
     if (time != mediaElement()->currentTime()) {
+        // FIXME: This is fired 3 times on every click. We should not be doing that <http:/webkit.org/b/58160>.
         ExceptionCode ec;
         mediaElement()->setCurrentTime(time, ec);
     }
 
     RenderSlider* slider = toRenderSlider(renderer());
+<<<<<<< HEAD:Source/WebCore/rendering/MediaControlElements.cpp
     if (slider && slider->inDragMode()) {
         toRenderMedia(mediaElement()->renderer())->controls()->updateTimeDisplay();
 #if PLATFORM(ANDROID)
         toRenderMedia(mediaElement()->renderer())->controls()->updateLastTouch();
 #endif
     }
+=======
+    if (slider && slider->inDragMode())
+        m_controls->updateTimeDisplay();
+>>>>>>> WebKit.org at r84325:Source/WebCore/html/shadow/MediaControlElements.cpp
 
     if (event->type() == eventNames().mouseupEvent)
         mediaElement()->endScrubbing();
 }
 
-void MediaControlTimelineElement::update(bool updateDuration) 
+void MediaControlTimelineElement::setPosition(float currentTime) 
 {
-    if (updateDuration) {
-        float duration = mediaElement()->duration();
-        setAttribute(maxAttr, String::number(isfinite(duration) ? duration : 0));
-    }
-    setValue(String::number(mediaElement()->currentTime()));
-    MediaControlInputElement::update();
+    setValue(String::number(currentTime));
 }
 
+void MediaControlTimelineElement::setDuration(float duration)
+{
+    setAttribute(maxAttr, String::number(isfinite(duration) ? duration : 0));
+}
+
+
 const AtomicString& MediaControlTimelineElement::shadowPseudoId() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-timeline"));
@@ -897,12 +739,10 @@ void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
     }
 }
 
-void MediaControlVolumeSliderElement::update()
+void MediaControlVolumeSliderElement::setVolume(float volume)
 {
-    float volume = mediaElement()->volume();
     if (value().toFloat() != volume)
         setValue(String::number(volume));
-    MediaControlInputElement::update();
 }
 
 const AtomicString& MediaControlVolumeSliderElement::shadowPseudoId() const
@@ -914,7 +754,7 @@ const AtomicString& MediaControlVolumeSliderElement::shadowPseudoId() const
 // ----------------------------
 
 inline MediaControlFullscreenVolumeSliderElement::MediaControlFullscreenVolumeSliderElement(HTMLMediaElement* mediaElement)
-: MediaControlVolumeSliderElement(mediaElement)
+    : MediaControlVolumeSliderElement(mediaElement)
 {
 }
 
@@ -936,15 +776,19 @@ const AtomicString& MediaControlFullscreenVolumeSliderElement::shadowPseudoId()
 
 // ----------------------------
 
-inline MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(HTMLMediaElement* mediaElement)
+inline MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(HTMLMediaElement* mediaElement, MediaControls* controls)
     : MediaControlInputElement(mediaElement, MediaFullscreenButton)
+    , m_controls(controls)
 {
 }
 
-PassRefPtr<MediaControlFullscreenButtonElement> MediaControlFullscreenButtonElement::create(HTMLMediaElement* mediaElement)
+PassRefPtr<MediaControlFullscreenButtonElement> MediaControlFullscreenButtonElement::create(HTMLMediaElement* mediaElement, MediaControls* controls)
 {
-    RefPtr<MediaControlFullscreenButtonElement> button = adoptRef(new MediaControlFullscreenButtonElement(mediaElement));
+    ASSERT(controls);
+
+    RefPtr<MediaControlFullscreenButtonElement> button = adoptRef(new MediaControlFullscreenButtonElement(mediaElement, controls));
     button->setType("button");
+    button->hide();
     return button.release();
 }
 
@@ -953,15 +797,18 @@ void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
     if (event->type() == eventNames().clickEvent) {
 #if ENABLE(FULLSCREEN_API)
         // Only use the new full screen API if the fullScreenEnabled setting has 
-        // been explicitly enabled.  Otherwise, use the old fullscreen API.  This
+        // been explicitly enabled. Otherwise, use the old fullscreen API. This
         // allows apps which embed a WebView to retain the existing full screen
         // video implementation without requiring them to implement their own full 
         // screen behavior.
         if (document()->settings() && document()->settings()->fullScreenEnabled()) {
-            if (document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == mediaElement())
+            if (document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == mediaElement()) {
                 document()->webkitCancelFullScreen();
-            else
+                m_controls->exitedFullscreen();
+            } else {
                 mediaElement()->webkitRequestFullScreen(0);
+                m_controls->enteredFullscreen();
+            }
         } else
 #endif
             mediaElement()->enterFullscreen();
@@ -979,7 +826,7 @@ const AtomicString& MediaControlFullscreenButtonElement::shadowPseudoId() const
 // ----------------------------
 
 inline MediaControlFullscreenVolumeMinButtonElement::MediaControlFullscreenVolumeMinButtonElement(HTMLMediaElement* mediaElement)
-: MediaControlInputElement(mediaElement, MediaUnMuteButton)
+    : MediaControlInputElement(mediaElement, MediaUnMuteButton)
 {
 }
 
@@ -1059,6 +906,9 @@ void RenderMediaControlTimeDisplay::layout()
 {
     RenderFlexibleBox::layout();
     RenderBox* timelineContainerBox = parentBox();
+    while (timelineContainerBox && timelineContainerBox->isAnonymous())
+        timelineContainerBox = timelineContainerBox->parentBox();
+
     if (timelineContainerBox && timelineContainerBox->width() < minWidthToDisplayTimeDisplays)
         setWidth(0);
 }
diff --git a/Source/WebCore/rendering/MediaControlElements.h b/Source/WebCore/html/shadow/MediaControlElements.h
index 77116e3..db3158b 100644
--- a/Source/WebCore/rendering/MediaControlElements.h
+++ b/Source/WebCore/html/shadow/MediaControlElements.h
@@ -42,6 +42,7 @@ namespace WebCore {
 
 class Event;
 class Frame;
+class MediaControls;
 
 // Must match WebKitSystemInterface.h
 enum MediaControlElementType {
@@ -71,24 +72,12 @@ enum MediaControlElementType {
 
 HTMLMediaElement* toParentMediaElement(RenderObject*);
 
-class MediaControlShadowRootElement : public HTMLDivElement {
-public:
-    static PassRefPtr<MediaControlShadowRootElement> create(HTMLMediaElement*);
-
-    virtual void detach();
-    
-private:
-    MediaControlShadowRootElement(HTMLMediaElement*);
-};
-
 // ----------------------------
 
 class MediaControlElement : public HTMLDivElement {
 public:
-    virtual void attach();
-    void attachToParent(Element*);
-    void update();
-    void updateStyle();
+    void hide();
+    void show();
 
     virtual MediaControlElementType displayType() const = 0;
 
@@ -97,10 +86,6 @@ public:
 protected:
     MediaControlElement(HTMLMediaElement*);
 
-    virtual bool rendererIsNeeded(RenderStyle*);
-
-    virtual PassRefPtr<RenderStyle> styleForElement();
-
 private:
     virtual bool isMediaControlElement() const { return true; }
 
@@ -119,7 +104,6 @@ private:
     virtual const AtomicString& shadowPseudoId() const;
 };
 
-
 // ----------------------------
 
 class MediaControlTimelineContainerElement : public MediaControlElement {
@@ -128,9 +112,9 @@ public:
 
 private:
     MediaControlTimelineContainerElement(HTMLMediaElement*);
-    virtual MediaControlElementType displayType() const;
-    virtual bool rendererIsNeeded(RenderStyle*);
     virtual const AtomicString& shadowPseudoId() const;
+
+    virtual MediaControlElementType displayType() const;
 };
 
 // ----------------------------
@@ -139,19 +123,12 @@ class MediaControlVolumeSliderContainerElement : public MediaControlElement {
 public:
     static PassRefPtr<MediaControlVolumeSliderContainerElement> create(HTMLMediaElement*);
 
-    virtual PassRefPtr<RenderStyle> styleForElement();
-    void setVisible(bool);
-    bool isVisible() { return m_isVisible; }
-    bool hitTest(const IntPoint& absPoint);
-
 private:
     MediaControlVolumeSliderContainerElement(HTMLMediaElement*);
-
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual void defaultEventHandler(Event*);
     virtual MediaControlElementType displayType() const;
     virtual const AtomicString& shadowPseudoId() const;
-
-    bool m_isVisible;
 };
 
 // ----------------------------
@@ -166,7 +143,6 @@ private:
     MediaControlStatusDisplayElement(HTMLMediaElement*);
 
     virtual MediaControlElementType displayType() const;
-    virtual bool rendererIsNeeded(RenderStyle*);
     virtual const AtomicString& shadowPseudoId() const;
 
     enum StateBeingDisplayed { Nothing, Loading, LiveBroadcast };
@@ -177,11 +153,8 @@ private:
 
 class MediaControlInputElement : public HTMLInputElement {
 public:
-    void attachToParent(Element*);
-    void update();
-    void updateStyle();
-
-    bool hitTest(const IntPoint& absPoint);
+    void hide();
+    void show();
 
     MediaControlElementType displayType() const { return m_displayType; }
 
@@ -193,11 +166,6 @@ protected:
     void setDisplayType(MediaControlElementType);
 
 private:
-    virtual void attach();
-    virtual bool rendererIsNeeded(RenderStyle*);
-
-    virtual PassRefPtr<RenderStyle> styleForElement();
-
     virtual bool isMediaControlElement() const { return true; }
 
     virtual void updateDisplayType() { }
@@ -210,10 +178,12 @@ private:
 
 class MediaControlMuteButtonElement : public MediaControlInputElement {
 public:
-    virtual void defaultEventHandler(Event*);
+    void changedMute();
 
 protected:
     MediaControlMuteButtonElement(HTMLMediaElement*, MediaControlElementType);
+    virtual void defaultEventHandler(Event*);
+
 
 private:
     virtual void updateDisplayType();
@@ -223,12 +193,15 @@ private:
 
 class MediaControlPanelMuteButtonElement : public MediaControlMuteButtonElement {
 public:
-    static PassRefPtr<MediaControlPanelMuteButtonElement> create(HTMLMediaElement*);
+    static PassRefPtr<MediaControlPanelMuteButtonElement> create(HTMLMediaElement*, MediaControls*);
 
 private:
-    MediaControlPanelMuteButtonElement(HTMLMediaElement*);
+    MediaControlPanelMuteButtonElement(HTMLMediaElement*, MediaControls*);
 
+    virtual void defaultEventHandler(Event*);
     virtual const AtomicString& shadowPseudoId() const;
+
+    MediaControls* m_controls;
 };
 
 // ----------------------------
@@ -251,11 +224,11 @@ public:
     static PassRefPtr<MediaControlPlayButtonElement> create(HTMLMediaElement*);
 
     virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
 
 private:
     MediaControlPlayButtonElement(HTMLMediaElement*);
 
-    virtual void updateDisplayType();
     virtual const AtomicString& shadowPseudoId() const;
 };
 
@@ -340,11 +313,11 @@ public:
     static PassRefPtr<MediaControlToggleClosedCaptionsButtonElement> create(HTMLMediaElement*);
 
     virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
 
 private:
     MediaControlToggleClosedCaptionsButtonElement(HTMLMediaElement*);
 
-    virtual void updateDisplayType();
     virtual const AtomicString& shadowPseudoId() const;
 };    
 
@@ -352,15 +325,18 @@ private:
 
 class MediaControlTimelineElement : public MediaControlInputElement {
 public:
-    static PassRefPtr<MediaControlTimelineElement> create(HTMLMediaElement*);
+    static PassRefPtr<MediaControlTimelineElement> create(HTMLMediaElement*, MediaControls*);
 
     virtual void defaultEventHandler(Event*);
-    void update(bool updateDuration = true);
+    void setPosition(float);
+    void setDuration(float);
 
 private:
-    MediaControlTimelineElement(HTMLMediaElement*);
+    MediaControlTimelineElement(HTMLMediaElement*, MediaControls*);
 
     virtual const AtomicString& shadowPseudoId() const;
+
+    MediaControls* m_controls;
 };
 
 // ----------------------------
@@ -370,7 +346,7 @@ public:
     static PassRefPtr<MediaControlVolumeSliderElement> create(HTMLMediaElement*);
 
     virtual void defaultEventHandler(Event*);
-    void update();
+    void setVolume(float);
 
 protected:
     MediaControlVolumeSliderElement(HTMLMediaElement*);
@@ -383,14 +359,16 @@ private:
 
 class MediaControlFullscreenButtonElement : public MediaControlInputElement {
 public:
-    static PassRefPtr<MediaControlFullscreenButtonElement> create(HTMLMediaElement*);
+    static PassRefPtr<MediaControlFullscreenButtonElement> create(HTMLMediaElement*, MediaControls*);
 
     virtual void defaultEventHandler(Event*);
 
 private:
-    MediaControlFullscreenButtonElement(HTMLMediaElement*);
+    MediaControlFullscreenButtonElement(HTMLMediaElement*, MediaControls*);
 
     virtual const AtomicString& shadowPseudoId() const;
+
+    MediaControls* m_controls;
 };
 
 // ----------------------------
@@ -474,18 +452,10 @@ private:
     virtual MediaControlElementType displayType() const;
     virtual const AtomicString& shadowPseudoId() const;
 };
-
-// ----------------------------
-
-class RenderMediaControlShadowRoot : public RenderBlock {
-public:
-    RenderMediaControlShadowRoot(Element* e) : RenderBlock(e) { }
-    void setParent(RenderObject* p) { RenderObject::setParent(p); }
-};
-    
+ 
 // ----------------------------
 
-} //namespace WebCore
+} // namespace WebCore
 
 #endif // ENABLE(VIDEO)
 
diff --git a/Source/WebCore/html/shadow/MediaControlRootElement.cpp b/Source/WebCore/html/shadow/MediaControlRootElement.cpp
new file mode 100644
index 0000000..23a25f5
--- /dev/null
+++ b/Source/WebCore/html/shadow/MediaControlRootElement.cpp
@@ -0,0 +1,446 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+#include "MediaControlRootElement.h"
+
+#include "MediaControlElements.h"
+#include "Page.h"
+#include "RenderTheme.h"
+
+using namespace std;
+
+namespace WebCore {
+
+MediaControlRootElement::MediaControlRootElement(HTMLMediaElement* mediaElement)
+    : MediaControls(mediaElement)
+    , m_mediaElement(mediaElement)
+    , m_rewindButton(0)
+    , m_playButton(0)
+    , m_returnToRealTimeButton(0)
+    , m_statusDisplay(0)
+    , m_currentTimeDisplay(0)
+    , m_timeline(0)
+    , m_timeRemainingDisplay(0)
+    , m_timelineContainer(0)
+    , m_seekBackButton(0)
+    , m_seekForwardButton(0)
+    , m_toggleClosedCaptionsButton(0)
+    , m_panelMuteButton(0)
+    , m_volumeSlider(0)
+    , m_volumeSliderMuteButton(0)
+    , m_volumeSliderContainer(0)
+    , m_fullScreenButton(0)
+    , m_fullScreenMinVolumeButton(0)
+    , m_fullScreenVolumeSlider(0)
+    , m_fullScreenMaxVolumeButton(0)
+    , m_panel(0)
+    , m_opaque(true)
+{
+}
+
+PassRefPtr<MediaControls> MediaControls::create(HTMLMediaElement* mediaElement)
+{
+    return MediaControlRootElement::create(mediaElement);
+}
+
+PassRefPtr<MediaControlRootElement> MediaControlRootElement::create(HTMLMediaElement* mediaElement)
+{
+    if (!mediaElement->document()->page())
+        return 0;
+
+    RefPtr<MediaControlRootElement> controls = adoptRef(new MediaControlRootElement(mediaElement));
+
+    RefPtr<MediaControlPanelElement> panel = MediaControlPanelElement::create(mediaElement);
+
+    ExceptionCode ec;
+
+    RefPtr<MediaControlRewindButtonElement> rewindButton = MediaControlRewindButtonElement::create(mediaElement);
+    controls->m_rewindButton = rewindButton.get();
+    panel->appendChild(rewindButton.release(), ec, true);
+    if (ec)
+        return 0;
+
+    RefPtr<MediaControlPlayButtonElement> playButton = MediaControlPlayButtonElement::create(mediaElement);
+    controls->m_playButton = playButton.get();
+    panel->appendChild(playButton.release(), ec, true);
+    if (ec)
+        return 0;
+
+    RefPtr<MediaControlReturnToRealtimeButtonElement> returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(mediaElement);
+    controls->m_returnToRealTimeButton = returnToRealtimeButton.get();
+    panel->appendChild(returnToRealtimeButton.release(), ec, true);
+    if (ec)
+        return 0;
+
+    if (mediaElement->document()->page()->theme()->usesMediaControlStatusDisplay()) {
+        RefPtr<MediaControlStatusDisplayElement> statusDisplay = MediaControlStatusDisplayElement::create(mediaElement);
+        controls->m_statusDisplay = statusDisplay.get();
+        panel->appendChild(statusDisplay.release(), ec, true);
+        if (ec)
+            return 0;
+    }
+
+    RefPtr<MediaControlTimelineContainerElement> timelineContainer = MediaControlTimelineContainerElement::create(mediaElement);
+
+    RefPtr<MediaControlCurrentTimeDisplayElement> currentTimeDisplay = MediaControlCurrentTimeDisplayElement::create(mediaElement);
+    controls->m_currentTimeDisplay = currentTimeDisplay.get();
+    timelineContainer->appendChild(currentTimeDisplay.release(), ec, true);
+    if (ec)
+        return 0;
+
+    RefPtr<MediaControlTimelineElement> timeline = MediaControlTimelineElement::create(mediaElement, controls.get());
+    controls->m_timeline = timeline.get();
+    timelineContainer->appendChild(timeline.release(), ec, true);
+    if (ec)
+        return 0;
+
+    RefPtr<MediaControlTimeRemainingDisplayElement> timeRemainingDisplay = MediaControlTimeRemainingDisplayElement::create(mediaElement);
+    controls->m_timeRemainingDisplay = timeRemainingDisplay.get();
+    timelineContainer->appendChild(timeRemainingDisplay.release(), ec, true);
+    if (ec)
+        return 0;
+
+    controls->m_timelineContainer = timelineContainer.get();
+    panel->appendChild(timelineContainer.release(), ec, true);
+    if (ec)
+        return 0;
+
+    // FIXME: Only create when needed <http://webkit.org/b/57163>
+    RefPtr<MediaControlSeekBackButtonElement> seekBackButton = MediaControlSeekBackButtonElement::create(mediaElement);
+    controls->m_seekBackButton = seekBackButton.get();
+    panel->appendChild(seekBackButton.release(), ec, true);
+    if (ec)
+        return 0;
+
+    // FIXME: Only create when needed <http://webkit.org/b/57163>
+    RefPtr<MediaControlSeekForwardButtonElement> seekForwardButton = MediaControlSeekForwardButtonElement::create(mediaElement);
+    controls->m_seekForwardButton = seekForwardButton.get();
+    panel->appendChild(seekForwardButton.release(), ec, true);
+    if (ec)
+        return 0;
+
+    if (mediaElement->document()->page()->theme()->supportsClosedCaptioning()) {
+        RefPtr<MediaControlToggleClosedCaptionsButtonElement> toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(mediaElement);
+        controls->m_toggleClosedCaptionsButton = toggleClosedCaptionsButton.get();
+        panel->appendChild(toggleClosedCaptionsButton.release(), ec, true);
+        if (ec)
+            return 0;
+    }
+
+    // FIXME: Only create when needed <http://webkit.org/b/57163>
+    RefPtr<MediaControlFullscreenButtonElement> fullScreenButton = MediaControlFullscreenButtonElement::create(mediaElement, controls.get());
+    controls->m_fullScreenButton = fullScreenButton.get();
+    panel->appendChild(fullScreenButton.release(), ec, true);
+
+    RefPtr<MediaControlPanelMuteButtonElement> panelMuteButton = MediaControlPanelMuteButtonElement::create(mediaElement, controls.get());
+    controls->m_panelMuteButton = panelMuteButton.get();
+    panel->appendChild(panelMuteButton.release(), ec, true);
+    if (ec)
+        return 0;
+
+    if (mediaElement->document()->page()->theme()->usesMediaControlVolumeSlider()) {
+        RefPtr<MediaControlVolumeSliderContainerElement> volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(mediaElement);
+
+        RefPtr<MediaControlVolumeSliderElement> slider = MediaControlVolumeSliderElement::create(mediaElement);
+        controls->m_volumeSlider = slider.get();
+        volumeSliderContainer->appendChild(slider.release(), ec, true);
+        if (ec)
+            return 0;
+
+        RefPtr<MediaControlVolumeSliderMuteButtonElement> volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(mediaElement);
+        controls->m_volumeSliderMuteButton = volumeSliderMuteButton.get();
+        volumeSliderContainer->appendChild(volumeSliderMuteButton.release(), ec, true);
+        if (ec)
+            return 0;
+
+        controls->m_volumeSliderContainer = volumeSliderContainer.get();
+        panel->appendChild(volumeSliderContainer.release(), ec, true);
+        if (ec)
+            return 0;
+    }
+
+    // FIXME: Only create when needed <http://webkit.org/b/57163>
+    RefPtr<MediaControlFullscreenVolumeMinButtonElement> fullScreenMinVolumeButton = MediaControlFullscreenVolumeMinButtonElement::create(mediaElement);
+    controls->m_fullScreenMinVolumeButton = fullScreenMinVolumeButton.get();
+    panel->appendChild(fullScreenMinVolumeButton.release(), ec, true);
+    if (ec)
+        return 0;
+
+    RefPtr<MediaControlFullscreenVolumeSliderElement> fullScreenVolumeSlider = MediaControlFullscreenVolumeSliderElement::create(mediaElement);
+    controls->m_fullScreenVolumeSlider = fullScreenVolumeSlider.get();
+    panel->appendChild(fullScreenVolumeSlider.release(), ec, true);
+    if (ec)
+        return 0;
+
+    RefPtr<MediaControlFullscreenVolumeMaxButtonElement> fullScreenMaxVolumeButton = MediaControlFullscreenVolumeMaxButtonElement::create(mediaElement);
+    controls->m_fullScreenMaxVolumeButton = fullScreenMaxVolumeButton.get();
+    panel->appendChild(fullScreenMaxVolumeButton.release(), ec, true);
+    if (ec)
+        return 0;
+
+    controls->m_panel = panel.get();
+    controls->appendChild(panel.release(), ec, true);
+    if (ec)
+        return 0;
+
+    return controls.release();
+}
+
+void MediaControlRootElement::show()
+{
+    m_panel->show();
+}
+
+void MediaControlRootElement::hide()
+{
+    m_panel->hide();
+}
+
+static const String& webkitTransitionString()
+{
+    DEFINE_STATIC_LOCAL(String, s, ("-webkit-transition"));
+    return s;
+}
+
+static const String& opacityString()
+{
+    DEFINE_STATIC_LOCAL(String, s, ("opacity"));
+    return s;
+}
+
+void MediaControlRootElement::makeOpaque()
+{
+    if (m_opaque)
+        return;
+
+    DEFINE_STATIC_LOCAL(String, transitionValue, ());
+    if (transitionValue.isNull())
+        transitionValue = String::format("opacity %.1gs", document()->page()->theme()->mediaControlsFadeInDuration());
+    DEFINE_STATIC_LOCAL(String, opacityValue, ("1"));
+
+    ExceptionCode ec;
+    // FIXME: Make more efficient <http://webkit.org/b/58157>
+    m_panel->style()->setProperty(webkitTransitionString(), transitionValue, ec);
+    m_panel->style()->setProperty(opacityString(), opacityValue, ec);
+    m_opaque = true;
+}
+
+void MediaControlRootElement::makeTransparent()
+{
+    if (!m_opaque)
+        return;
+
+    DEFINE_STATIC_LOCAL(String, transitionValue, ());
+    if (transitionValue.isNull())
+        transitionValue = String::format("opacity %.1gs", document()->page()->theme()->mediaControlsFadeOutDuration());
+    DEFINE_STATIC_LOCAL(String, opacityValue, ("0"));
+
+    ExceptionCode ec;
+    // FIXME: Make more efficient <http://webkit.org/b/58157>
+    m_panel->style()->setProperty(webkitTransitionString(), transitionValue, ec);
+    m_panel->style()->setProperty(opacityString(), opacityValue, ec);
+    m_opaque = false;
+}
+
+void MediaControlRootElement::reset()
+{
+    Page* page = document()->page();
+    if (!page)
+        return;
+
+    changedNetworkState();
+
+    if (m_mediaElement->supportsFullscreen())
+        m_fullScreenButton->show();
+    else
+        m_fullScreenButton->hide();
+
+    float duration = m_mediaElement->duration();
+    if (isfinite(duration) || page->theme()->hasOwnDisabledStateHandlingFor(MediaSliderPart)) {
+        m_timeline->setDuration(duration);
+        m_timelineContainer->show();
+        m_timeline->setPosition(m_mediaElement->currentTime());
+        updateTimeDisplay();
+    } else
+        m_timelineContainer->hide();
+
+    if (m_mediaElement->hasAudio() || page->theme()->hasOwnDisabledStateHandlingFor(MediaMuteButtonPart))
+        m_panelMuteButton->show();
+    else
+        m_panelMuteButton->hide();
+
+    if (m_volumeSlider)
+        m_volumeSlider->setVolume(m_mediaElement->volume());
+
+    if (m_toggleClosedCaptionsButton) {
+        if (m_mediaElement->hasClosedCaptions())
+            m_toggleClosedCaptionsButton->show();
+        else
+            m_toggleClosedCaptionsButton->hide();
+    }
+
+    if (m_mediaElement->movieLoadType() != MediaPlayer::LiveStream) {
+        m_returnToRealTimeButton->hide();
+        m_rewindButton->show();
+    } else {
+        m_returnToRealTimeButton->show();
+        m_rewindButton->hide();
+    }
+
+    makeOpaque();
+}
+
+void MediaControlRootElement::playbackStarted()
+{
+    m_playButton->updateDisplayType();
+    m_timeline->setPosition(m_mediaElement->currentTime());
+    updateTimeDisplay();
+}
+
+void MediaControlRootElement::playbackProgressed()
+{
+    m_timeline->setPosition(m_mediaElement->currentTime());
+    updateTimeDisplay();
+}
+
+void MediaControlRootElement::playbackStopped()
+{
+    m_playButton->updateDisplayType();
+    m_timeline->setPosition(m_mediaElement->currentTime());
+    updateTimeDisplay();
+    makeOpaque();
+}
+
+void MediaControlRootElement::updateTimeDisplay()
+{
+    float now = m_mediaElement->currentTime();
+    float duration = m_mediaElement->duration();
+
+    Page* page = document()->page();
+    if (!page)
+        return;
+
+    // Allow the theme to format the time.
+    ExceptionCode ec;
+    m_currentTimeDisplay->setInnerText(page->theme()->formatMediaControlsCurrentTime(now, duration), ec);
+    m_currentTimeDisplay->setCurrentValue(now);
+    m_timeRemainingDisplay->setInnerText(page->theme()->formatMediaControlsRemainingTime(now, duration), ec);
+    m_timeRemainingDisplay->setCurrentValue(now - duration);
+}
+
+void MediaControlRootElement::reportedError()
+{
+    Page* page = document()->page();
+    if (!page)
+        return;
+
+    if (!page->theme()->hasOwnDisabledStateHandlingFor(MediaSliderPart))
+        m_timelineContainer->hide();
+
+    if (!page->theme()->hasOwnDisabledStateHandlingFor(MediaMuteButtonPart))
+        m_panelMuteButton->hide();
+
+     m_fullScreenButton->hide();
+
+    if (m_volumeSliderContainer)
+        m_volumeSliderContainer->hide();
+    if (m_toggleClosedCaptionsButton && !page->theme()->hasOwnDisabledStateHandlingFor(MediaToggleClosedCaptionsButtonPart))
+        m_toggleClosedCaptionsButton->hide();
+}
+
+void MediaControlRootElement::changedNetworkState()
+{
+    if (m_statusDisplay)
+        m_statusDisplay->update();
+}
+
+void MediaControlRootElement::loadedMetadata()
+{
+    if (m_statusDisplay)
+        m_statusDisplay->hide();
+
+    reset();
+}
+
+void MediaControlRootElement::changedClosedCaptionsVisibility()
+{
+    if (m_toggleClosedCaptionsButton)
+        m_toggleClosedCaptionsButton->updateDisplayType();
+}
+
+void MediaControlRootElement::changedMute()
+{
+    m_panelMuteButton->changedMute();
+    if (m_volumeSliderMuteButton)
+        m_volumeSliderMuteButton->changedMute();
+}
+
+void MediaControlRootElement::changedVolume()
+{
+    if (m_volumeSlider)
+        m_volumeSlider->setVolume(m_mediaElement->volume());
+}
+
+void MediaControlRootElement::enteredFullscreen()
+{
+    if (m_mediaElement->movieLoadType() == MediaPlayer::LiveStream || m_mediaElement->movieLoadType() == MediaPlayer::StoredStream) {
+        m_seekBackButton->hide();
+        m_seekForwardButton->hide();
+    } else
+        m_rewindButton->hide();
+}
+
+void MediaControlRootElement::exitedFullscreen()
+{
+    // "show" actually means removal of display:none style, so we are just clearing styles
+    // when exiting fullscreen.
+    // FIXME: Clarify naming of show/hide <http://webkit.org/b/58157>
+    m_rewindButton->show();
+    m_seekBackButton->show();
+    m_seekForwardButton->show();
+}
+
+void MediaControlRootElement::showVolumeSlider()
+{
+    if (!m_mediaElement->hasAudio())
+        return;
+
+    if (m_volumeSliderContainer)
+        m_volumeSliderContainer->show();
+}
+
+const AtomicString& MediaControlRootElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls"));
+    return id;
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/html/shadow/MediaControlRootElement.h b/Source/WebCore/html/shadow/MediaControlRootElement.h
new file mode 100644
index 0000000..8c6d3ec
--- /dev/null
+++ b/Source/WebCore/html/shadow/MediaControlRootElement.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MediaControlRootElement_h
+#define MediaControlRootElement_h
+
+#if ENABLE(VIDEO)
+
+#include "MediaControls.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class HTMLInputElement;
+class HTMLMediaElement;
+class Event;
+class MediaControlPanelMuteButtonElement;
+class MediaControlPlayButtonElement;
+class MediaControlSeekButtonElement;
+class MediaControlRewindButtonElement;
+class MediaControlReturnToRealtimeButtonElement;
+class MediaControlToggleClosedCaptionsButtonElement;
+class MediaControlCurrentTimeDisplayElement;
+class MediaControlTimelineElement;
+class MediaControlTimeRemainingDisplayElement;
+class MediaControlVolumeSliderElement;
+class MediaControlFullscreenButtonElement;
+class MediaControlTimeDisplayElement;
+class MediaControlStatusDisplayElement;
+class MediaControlTimelineContainerElement;
+class MediaControlSeekBackButtonElement;
+class MediaControlSeekForwardButtonElement;
+class MediaControlMuteButtonElement;
+class MediaControlVolumeSliderElement;
+class MediaControlVolumeSliderMuteButtonElement;
+class MediaControlVolumeSliderContainerElement;
+class MediaControlFullscreenVolumeMinButtonElement;
+class MediaControlFullscreenVolumeSliderElement;
+class MediaControlFullscreenVolumeMaxButtonElement;
+class MediaControlPanelElement;
+class MediaPlayer;
+
+class RenderBox;
+class RenderMedia;
+
+class MediaControlRootElement : public MediaControls {
+public:
+    static PassRefPtr<MediaControlRootElement> create(HTMLMediaElement*);
+
+    // MediaControls implementation.
+    void show();
+    void hide();
+    void makeOpaque();
+    void makeTransparent();
+
+    void reset();
+
+    void playbackProgressed();
+    void playbackStarted();
+    void playbackStopped();
+
+    void changedMute();
+    void changedVolume();
+
+    void enteredFullscreen();
+    void exitedFullscreen();
+
+    void reportedError();
+    void changedNetworkState();
+    void loadedMetadata();
+    void changedClosedCaptionsVisibility();
+
+    void showVolumeSlider();
+    void updateTimeDisplay();
+
+private:
+    MediaControlRootElement(HTMLMediaElement*);
+
+    virtual const AtomicString& shadowPseudoId() const;
+
+    HTMLMediaElement* m_mediaElement;
+
+    MediaControlRewindButtonElement* m_rewindButton;
+    MediaControlPlayButtonElement* m_playButton;
+    MediaControlReturnToRealtimeButtonElement* m_returnToRealTimeButton;
+    MediaControlStatusDisplayElement* m_statusDisplay;
+    MediaControlCurrentTimeDisplayElement* m_currentTimeDisplay;
+    MediaControlTimelineElement* m_timeline;
+    MediaControlTimeRemainingDisplayElement* m_timeRemainingDisplay;
+    MediaControlTimelineContainerElement* m_timelineContainer;
+    MediaControlSeekBackButtonElement* m_seekBackButton;
+    MediaControlSeekForwardButtonElement* m_seekForwardButton;
+    MediaControlToggleClosedCaptionsButtonElement* m_toggleClosedCaptionsButton;
+    MediaControlPanelMuteButtonElement* m_panelMuteButton;
+    MediaControlVolumeSliderElement* m_volumeSlider;
+    MediaControlVolumeSliderMuteButtonElement* m_volumeSliderMuteButton;
+    MediaControlVolumeSliderContainerElement* m_volumeSliderContainer;
+    MediaControlFullscreenButtonElement* m_fullScreenButton;
+    MediaControlFullscreenVolumeMinButtonElement* m_fullScreenMinVolumeButton;
+    MediaControlFullscreenVolumeSliderElement* m_fullScreenVolumeSlider;
+    MediaControlFullscreenVolumeMaxButtonElement* m_fullScreenMaxVolumeButton;
+    MediaControlPanelElement* m_panel;
+
+    bool m_opaque;
+};
+
+}
+
+#endif
+#endif
diff --git a/Source/WebCore/html/shadow/MediaControls.cpp b/Source/WebCore/html/shadow/MediaControls.cpp
index 04bdce4..690d1ce 100644
--- a/Source/WebCore/html/shadow/MediaControls.cpp
+++ b/Source/WebCore/html/shadow/MediaControls.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,11 +27,13 @@
 #include "config.h"
 
 #if ENABLE(VIDEO)
+
 #include "MediaControls.h"
 
-#include "EventNames.h"
-#include "FloatConversion.h"
+#include "HTMLDivElement.h"
+#include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+<<<<<<< HEAD
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
 #include "Page.h"
@@ -47,14 +49,13 @@
 
 
 using namespace std;
+=======
+>>>>>>> WebKit.org at r84325
 
 namespace WebCore {
 
-using namespace HTMLNames;
-
-static const double cOpacityAnimationRepeatDelay = 0.05;
-
 MediaControls::MediaControls(HTMLMediaElement* mediaElement)
+<<<<<<< HEAD
     : m_mediaElement(mediaElement)
     , m_opacityAnimationTimer(this, &MediaControls::opacityAnimationTimerFired)
     , m_opacityAnimationStartTime(0)
@@ -555,6 +556,10 @@ void MediaControls::forwardEvent(Event* event)
         }
     }
 #endif
+=======
+    : HTMLDivElement(HTMLNames::divTag, mediaElement->document())
+{
+>>>>>>> WebKit.org at r84325
 }
 
 #if PLATFORM(ANDROID)
diff --git a/Source/WebCore/html/shadow/MediaControls.h b/Source/WebCore/html/shadow/MediaControls.h
index 726573e..a14b359 100644
--- a/Source/WebCore/html/shadow/MediaControls.h
+++ b/Source/WebCore/html/shadow/MediaControls.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -29,76 +29,59 @@
 
 #if ENABLE(VIDEO)
 
-#include "Timer.h"
-#include <wtf/RefPtr.h>
+#include "HTMLDivElement.h"
 
 namespace WebCore {
 
-class HTMLElement;
-class HTMLInputElement;
 class HTMLMediaElement;
-class Event;
-class MediaControlMuteButtonElement;
-class MediaControlPlayButtonElement;
-class MediaControlSeekButtonElement;
-class MediaControlShadowRootElement;
-class MediaControlRewindButtonElement;
-class MediaControlReturnToRealtimeButtonElement;
-class MediaControlToggleClosedCaptionsButtonElement;
-class MediaControlTimelineElement;
-class MediaControlVolumeSliderElement;
-class MediaControlFullscreenButtonElement;
-class MediaControlTimeDisplayElement;
-class MediaControlStatusDisplayElement;
-class MediaControlTimelineContainerElement;
-class MediaControlVolumeSliderContainerElement;
-class MediaControlElement;
-class MediaControlFullscreenVolumeMinButtonElement;
-class MediaControlFullscreenVolumeSliderElement;
-class MediaControlFullscreenVolumeMaxButtonElement;
-class MediaPlayer;
-
-class RenderBox;
-class RenderMedia;
-
-class MediaControls {
-public:
-    MediaControls(HTMLMediaElement*);
 
-    void reset();
+class MediaControls : public HTMLDivElement {
+  public:
+    virtual ~MediaControls() {}
 
-    void playbackProgressed();
-    void playbackStarted();
-    void playbackStopped();
+    // This function is to be implemented in your port-specific media
+    // controls implementation.
+    static PassRefPtr<MediaControls> create(HTMLMediaElement*);
 
-    void changedMute();
-    void changedVolume();
-    void changedClosedCaptionsVisibility();
+    virtual void show() = 0;
+    virtual void hide() = 0;
+    virtual void makeOpaque() = 0;
+    virtual void makeTransparent() = 0;
 
-    void destroy();
-    void update();
-    void updateStyle();
-    void forwardEvent(Event*);
-    void updateTimeDisplay();
+    virtual void reset() = 0;
 
-    // FIXME: This is temporary to allow RenderMedia::layout tweak the position of controls.
-    // Once shadow DOM refactoring is complete, the tweaking will be in MediaControlsShadowRoot and this accessor will no longer be necessary.
-    RenderBox* renderBox();
+    virtual void playbackProgressed() = 0;
+    virtual void playbackStarted() = 0;
+    virtual void playbackStopped() = 0;
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     void updateLastTouch();
 #endif
 
 private:
     PassRefPtr<MediaControlShadowRootElement> create(HTMLMediaElement*);
+=======
+    virtual void changedMute() = 0;
+    virtual void changedVolume() = 0;
+>>>>>>> WebKit.org at r84325
+
+    virtual void enteredFullscreen() = 0;
+    virtual void exitedFullscreen() = 0;
+
+    virtual void reportedError() = 0;
+    virtual void changedNetworkState() = 0;
+    virtual void loadedMetadata() = 0;
+    virtual void changedClosedCaptionsVisibility() = 0;
 
-    void updateControlVisibility();
-    void changeOpacity(HTMLElement*, float opacity);
-    void opacityAnimationTimerFired(Timer<MediaControls>*);
+    virtual void showVolumeSlider() = 0;
+    virtual void updateTimeDisplay() = 0;
 
-    void updateVolumeSliderContainer(bool visible);
+protected:
+    MediaControls(HTMLMediaElement*);
 
 private:
+<<<<<<< HEAD
     RefPtr<MediaControlShadowRootElement> m_controlsShadowRoot;
     RefPtr<MediaControlElement> m_panel;
     RefPtr<MediaControlMuteButtonElement> m_muteButton;
@@ -134,10 +117,13 @@ private:
 #if PLATFORM(ANDROID)
     double m_lastTouch;
 #endif
+=======
+    MediaControls();
+>>>>>>> WebKit.org at r84325
 };
 
-
 }
 
 #endif
+
 #endif
diff --git a/Source/WebCore/html/shadow/MeterShadowElement.cpp b/Source/WebCore/html/shadow/MeterShadowElement.cpp
new file mode 100644
index 0000000..a5eb70b
--- /dev/null
+++ b/Source/WebCore/html/shadow/MeterShadowElement.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(METER_TAG)
+#include "MeterShadowElement.h"
+
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSPropertyNames.h"
+#include "HTMLMeterElement.h"
+#include "HTMLNames.h"
+#include "RenderMeter.h"
+#include "RenderTheme.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+MeterShadowElement::MeterShadowElement(Document* document) 
+    : HTMLDivElement(HTMLNames::divTag, document)
+{
+}
+
+HTMLMeterElement* MeterShadowElement::meterElement() const
+{
+    Node* node = const_cast<MeterShadowElement*>(this)->shadowAncestorNode();
+    ASSERT(!node || meterTag == toElement(node)->tagQName());
+    return static_cast<HTMLMeterElement*>(node);
+}
+
+bool MeterShadowElement::rendererIsNeeded(RenderStyle* style)
+{
+    RenderMeter* meterRenderer = toRenderMeter(meterElement()->renderer());
+    return meterRenderer && !meterRenderer->theme()->supportsMeter(meterRenderer->style()->appearance()) && HTMLDivElement::rendererIsNeeded(style);
+}
+
+const AtomicString& MeterBarElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-meter-bar"));
+    return pseudId;
+}
+
+
+const AtomicString& MeterValueElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, optimumPseudId, ("-webkit-meter-optimum-value"));
+    DEFINE_STATIC_LOCAL(AtomicString, suboptimumPseudId, ("-webkit-meter-suboptimum-value"));
+    DEFINE_STATIC_LOCAL(AtomicString, evenLessGoodPseudId, ("-webkit-meter-even-less-good-value"));
+
+    HTMLMeterElement* meter = meterElement();
+    if (!meter)
+        return optimumPseudId;
+
+    switch (meter->gaugeRegion()) {
+    case HTMLMeterElement::GaugeRegionOptimum:
+        return optimumPseudId;
+    case HTMLMeterElement::GaugeRegionSuboptimal:
+        return suboptimumPseudId;
+    case HTMLMeterElement::GaugeRegionEvenLessGood:
+        return evenLessGoodPseudId;
+    default:
+        ASSERT_NOT_REACHED();
+        return optimumPseudId;
+    }
+}
+
+void MeterValueElement::setWidthPercentage(double width)
+{
+    getInlineStyleDecl()->setProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
+}
+
+
+}
+
+#endif
+
diff --git a/Source/WebCore/html/shadow/MeterShadowElement.h b/Source/WebCore/html/shadow/MeterShadowElement.h
new file mode 100644
index 0000000..93626df
--- /dev/null
+++ b/Source/WebCore/html/shadow/MeterShadowElement.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MeterShadowElement_h
+#define MeterShadowElement_h
+
+#include "HTMLDivElement.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class HTMLMeterElement;
+
+class MeterShadowElement : public HTMLDivElement {
+public:
+    MeterShadowElement(Document*);
+    HTMLMeterElement* meterElement() const;
+
+private:
+    virtual bool rendererIsNeeded(RenderStyle*);
+};
+
+class MeterBarElement : public MeterShadowElement {
+public:
+    MeterBarElement(Document* document) 
+        : MeterShadowElement(document)
+    {
+    }
+
+    static PassRefPtr<MeterBarElement> create(Document*);
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+inline PassRefPtr<MeterBarElement> MeterBarElement::create(Document* document)
+{
+    return adoptRef(new MeterBarElement(document));
+}
+
+
+class MeterValueElement : public MeterShadowElement {
+public:
+    MeterValueElement(Document* document) 
+        : MeterShadowElement(document)
+    {
+    }
+
+    virtual const AtomicString& shadowPseudoId() const;
+    static PassRefPtr<MeterValueElement> create(Document*);
+    void setWidthPercentage(double);
+};
+
+inline PassRefPtr<MeterValueElement> MeterValueElement::create(Document* document)
+{
+    return adoptRef(new MeterValueElement(document));
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/html/shadow/ProgressShadowElement.cpp b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
new file mode 100644
index 0000000..1cedd0d
--- /dev/null
+++ b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(PROGRESS_TAG)
+#include "ProgressShadowElement.h"
+
+#include "HTMLNames.h"
+#include "HTMLProgressElement.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+ProgressShadowElement::ProgressShadowElement(Document* document) 
+    : HTMLDivElement(HTMLNames::divTag, document)
+{
+}
+
+HTMLProgressElement* ProgressShadowElement::progressElement() const
+{
+    Node* node = const_cast<ProgressShadowElement*>(this)->shadowAncestorNode();
+    ASSERT(!node || progressTag == toElement(node)->tagQName());
+    return static_cast<HTMLProgressElement*>(node);
+}
+
+bool ProgressShadowElement::rendererIsNeeded(RenderStyle* style)
+{
+    RenderObject* progressRenderer = progressElement()->renderer();
+    return progressRenderer && !progressRenderer->style()->hasAppearance() && HTMLDivElement::rendererIsNeeded(style);
+}
+
+const AtomicString& ProgressBarElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-progress-bar"));
+    return pseudId;
+}
+
+
+const AtomicString& ProgressValueElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-progress-value"));
+    return pseudId;
+}
+
+void ProgressValueElement::setWidthPercentage(double width)
+{
+    getInlineStyleDecl()->setProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
+}
+
+}
+#endif
+
diff --git a/Source/WebCore/html/shadow/ProgressBarValueElement.h b/Source/WebCore/html/shadow/ProgressShadowElement.h
index 22f4e57..a106bf8 100644
--- a/Source/WebCore/html/shadow/ProgressBarValueElement.h
+++ b/Source/WebCore/html/shadow/ProgressShadowElement.h
@@ -29,43 +29,57 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ProgressBarValueElement_h
-#define ProgressBarValueElement_h
+#ifndef ProgressShadowElement_h
+#define ProgressShadowElement_h
 
 #include "HTMLDivElement.h"
-#include "HTMLNames.h"
-#include "RenderProgress.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
-class ProgressBarValueElement : public HTMLDivElement {
+class HTMLProgressElement;
+
+class ProgressShadowElement : public HTMLDivElement {
+public:
+    ProgressShadowElement(Document*);
+    HTMLProgressElement* progressElement() const;
+
+private:
+    virtual bool rendererIsNeeded(RenderStyle*);
+};
+
+class ProgressBarElement : public ProgressShadowElement {
 public:
-    ProgressBarValueElement(Document* document) 
-        : HTMLDivElement(HTMLNames::divTag, document)
+    ProgressBarElement(Document* document) 
+        : ProgressShadowElement(document)
     {
     }
 
+    static PassRefPtr<ProgressBarElement> create(Document*);
     virtual const AtomicString& shadowPseudoId() const;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    static PassRefPtr<ProgressBarValueElement> create(Document*);
-
 };
 
-inline const AtomicString& ProgressBarValueElement::shadowPseudoId() const
+inline PassRefPtr<ProgressBarElement> ProgressBarElement::create(Document* document)
 {
-    DEFINE_STATIC_LOCAL(AtomicString, pseudId, ("-webkit-progress-bar-value"));
-    return pseudId;
+    return adoptRef(new ProgressBarElement(document));
 }
 
-inline RenderObject* ProgressBarValueElement::createRenderer(RenderArena* arena, RenderStyle*)
-{
-    return new (arena) RenderProgressBarValuePart(this);
-}
 
-inline PassRefPtr<ProgressBarValueElement> ProgressBarValueElement::create(Document* document)
+class ProgressValueElement : public ProgressShadowElement {
+public:
+    ProgressValueElement(Document* document) 
+        : ProgressShadowElement(document)
+    {
+    }
+
+    virtual const AtomicString& shadowPseudoId() const;
+    static PassRefPtr<ProgressValueElement> create(Document*);
+    void setWidthPercentage(double);
+};
+
+inline PassRefPtr<ProgressValueElement> ProgressValueElement::create(Document* document)
 {
-    return adoptRef(new ProgressBarValueElement(document));
+    return adoptRef(new ProgressValueElement(document));
 }
 
 }
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 6a6e901..e68ab00 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -110,7 +110,7 @@ void SliderThumbElement::dragFrom(const IntPoint& point)
 
 void SliderThumbElement::setPositionFromPoint(const IntPoint& point)
 {
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
+    HTMLInputElement* input = hostInput();
     ASSERT(input);
 
     if (!input->renderer() || !renderer())
@@ -260,6 +260,12 @@ void SliderThumbElement::detach()
     HTMLDivElement::detach();
 }
 
+HTMLInputElement* SliderThumbElement::hostInput()
+{
+    ASSERT(parentNode());
+    return static_cast<HTMLInputElement*>(parentNode()->shadowHost());
+}
+
 const AtomicString& SliderThumbElement::shadowPseudoId() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, sliderThumb, ("-webkit-slider-thumb"));
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.h b/Source/WebCore/html/shadow/SliderThumbElement.h
index 9414ac4..2fa60cb 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.h
+++ b/Source/WebCore/html/shadow/SliderThumbElement.h
@@ -41,6 +41,7 @@
 namespace WebCore {
 
 class HTMLElement;
+class HTMLInputElement;
 class Event;
 class FloatPoint;
 
@@ -62,6 +63,7 @@ private:
     void startDragging();
     void stopDragging();
     void setPositionFromPoint(const IntPoint&);
+    HTMLInputElement* hostInput();
 
     FloatPoint m_offsetToThumb;
     bool m_inDragMode;
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index 968c5e4..00fc667 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -393,6 +393,12 @@ void InputFieldSpeechButtonElement::defaultEventHandler(Event* event)
     // here, we take a temporary reference.
     RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
 
+    if (input->disabled() || input->isReadOnlyFormControl()) {
+        if (!event->defaultHandled())
+            HTMLDivElement::defaultEventHandler(event);
+        return;
+    }
+
     // On mouse down, select the text and set focus.
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         if (renderer() && renderer()->visibleToHitTesting()) {
@@ -471,6 +477,9 @@ void InputFieldSpeechButtonElement::setRecognitionResult(int, const SpeechInputR
     // remove the input element from DOM. To make sure it remains valid until we finish our work
     // here, we take a temporary reference.
     RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
+    if (input->disabled() || input->isReadOnlyFormControl())
+        return;
+
     RefPtr<InputFieldSpeechButtonElement> holdRefButton(this);
     input->setValue(results.isEmpty() ? "" : results[0]->utterance());
     input->dispatchEvent(SpeechInputEvent::create(eventNames().webkitspeechchangeEvent, results));
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.h b/Source/WebCore/html/shadow/TextControlInnerElements.h
index 4ba7857..2340970 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.h
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.h
@@ -133,6 +133,7 @@ public:
 
     virtual void detach();
     virtual void defaultEventHandler(Event*);
+    virtual bool isInputFieldSpeechButtonElement() const { return true; }
     SpeechInputState state() const { return m_state; }
 
     // SpeechInputListener methods.
@@ -151,6 +152,12 @@ private:
     SpeechInputResultArray m_results;
 };
 
+inline InputFieldSpeechButtonElement* toInputFieldSpeechButtonElement(Element* element)
+{
+    ASSERT(!element || element->isInputFieldSpeechButtonElement());
+    return static_cast<InputFieldSpeechButtonElement*>(element);
+}
+
 #endif // ENABLE(INPUT_SPEECH)
 
 } // namespace
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.pm b/Source/WebCore/inspector/CodeGeneratorInspector.pm
index ea65f2e..de8e1db 100644
--- a/Source/WebCore/inspector/CodeGeneratorInspector.pm
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.pm
@@ -90,13 +90,13 @@ $typeTransform{"Frontend"} = {
     "forward" => "InspectorFrontend",
     "header" => "InspectorFrontend.h",
 };
-$typeTransform{"InspectorClient"} = {
-    "forward" => "InspectorClient",
-    "header" => "InspectorClient.h",
-};
 $typeTransform{"PassRefPtr"} = {
     "forwardHeader" => "wtf/PassRefPtr.h",
 };
+$typeTransform{"InspectorFrontendChannel"} = {
+    "forward" => "InspectorFrontendChannel",
+    "header" => "InspectorFrontendChannel.h",
+};
 $typeTransform{"Object"} = {
     "param" => "PassRefPtr<InspectorObject>",
     "variable" => "RefPtr<InspectorObject>",
@@ -105,7 +105,6 @@ $typeTransform{"Object"} = {
     "header" => "InspectorValues.h",
     "JSONType" => "Object",
     "JSType" => "object",
-    "DocType" => "%s"
 };
 $typeTransform{"Array"} = {
     "param" => "PassRefPtr<InspectorArray>",
@@ -115,7 +114,6 @@ $typeTransform{"Array"} = {
     "header" => "InspectorValues.h",
     "JSONType" => "Array",
     "JSType" => "object",
-    "DocType" => "array of %s"
 };
 $typeTransform{"Value"} = {
     "param" => "PassRefPtr<InspectorValue>",
@@ -125,7 +123,6 @@ $typeTransform{"Value"} = {
     "header" => "InspectorValues.h",
     "JSONType" => "Value",
     "JSType" => "",
-    "DocType" => "value"
 };
 $typeTransform{"String"} = {
     "param" => "const String&",
@@ -195,6 +192,9 @@ $typeTransform{"void"} = {
     "forward" => "",
     "header" => ""
 };
+$typeTransform{"Vector"} = {
+    "header" => "wtf/Vector.h"
+};
 
 # Default License Templates
 
@@ -223,6 +223,7 @@ my @backendConstantDeclarations;
 my @backendConstantDefinitions;
 my @backendFooter;
 my @backendJSStubs;
+my @backendJSEvents;
 my %backendDomains;
 
 my $frontendClassName;
@@ -236,9 +237,6 @@ my @frontendConstantDeclarations;
 my @frontendConstantDefinitions;
 my @frontendFooter;
 
-my @documentationToc;
-my @documentationLines;
-
 # Default constructor
 sub new
 {
@@ -267,17 +265,17 @@ sub GenerateModule
     $namespace =~ s/core/WebCore/;
 
     $frontendClassName = "InspectorFrontend";
-    $frontendConstructor = "    ${frontendClassName}(InspectorClient*);";
+    $frontendConstructor = "    ${frontendClassName}(InspectorFrontendChannel*);";
     push(@frontendFooter, "private:");
-    push(@frontendFooter, "    InspectorClient* m_inspectorClient;");
+    push(@frontendFooter, "    InspectorFrontendChannel* m_inspectorFrontendChannel;");
     $frontendTypes{"String"} = 1;
-    $frontendTypes{"InspectorClient"} = 1;
+    $frontendTypes{"InspectorFrontendChannel"} = 1;
     $frontendTypes{"PassRefPtr"} = 1;
 
     $backendClassName = "InspectorBackendDispatcher";
     $backendJSStubName = "InspectorBackendStub";
     $backendTypes{"Inspector"} = 1;
-    $backendTypes{"InspectorClient"} = 1;
+    $backendTypes{"InspectorFrontendChannel"} = 1;
     $backendTypes{"PassRefPtr"} = 1;
     $backendTypes{"Object"} = 1;
 }
@@ -306,10 +304,12 @@ sub generateAgentDeclaration
     my $agentName = $interface->name;
     push(@frontendMethods, "    class ${agentName} {");
     push(@frontendMethods, "    public:");
-    push(@frontendMethods, "        ${agentName}(InspectorClient* inspectorClient) : m_inspectorClient(inspectorClient) { }");
+    push(@frontendMethods, "        ${agentName}(InspectorFrontendChannel* inspectorFrontendChannel) : m_inspectorFrontendChannel(inspectorFrontendChannel) { }");
     push(@frontendMethods, @{$agent->{methodDeclarations}});
+    push(@frontendMethods, "        void setInspectorFrontendChannel(InspectorFrontendChannel* inspectorFrontendChannel) { m_inspectorFrontendChannel = inspectorFrontendChannel; }");
+    push(@frontendMethods, "        InspectorFrontendChannel* getInspectorFrontendChannel() { return m_inspectorFrontendChannel; }");
     push(@frontendMethods, "    private:");
-    push(@frontendMethods, "        InspectorClient* m_inspectorClient;");
+    push(@frontendMethods, "        InspectorFrontendChannel* m_inspectorFrontendChannel;");
     push(@frontendMethods, "    };");
     push(@frontendMethods, "");
 
@@ -325,10 +325,10 @@ sub generateAgentDeclaration
 sub generateFrontendConstructorImpl
 {
     my @frontendConstructorImpl;
-    push(@frontendConstructorImpl, "${frontendClassName}::${frontendClassName}(InspectorClient* inspectorClient)");
-    push(@frontendConstructorImpl, "    : m_inspectorClient(inspectorClient)");
+    push(@frontendConstructorImpl, "${frontendClassName}::${frontendClassName}(InspectorFrontendChannel* inspectorFrontendChannel)");
+    push(@frontendConstructorImpl, "    : m_inspectorFrontendChannel(inspectorFrontendChannel)");
     foreach my $agentField (@frontendAgentFields) {
-        push(@frontendConstructorImpl, "    , ${agentField}(inspectorClient)");
+        push(@frontendConstructorImpl, "    , ${agentField}(inspectorFrontendChannel)");
     }
     push(@frontendConstructorImpl, "{");
     push(@frontendConstructorImpl, "}");
@@ -348,20 +348,8 @@ sub generateFunctions
         }
     }
 
-    push(@documentationToc, "<li><a href='#" . $interface->name . "'>" . $interface->name . "</a></li>");
-    push(@documentationLines, "<h2 id='" . $interface->name . "'><a name=" . $interface->name . "></a>" . $interface->name . "</h2>");
-
-    push(@documentationLines, "<h3>Events</h3>");
-    foreach my $function (grep($_->signature->extendedAttributes->{"event"}, @{$interface->functions}) ) {
-        generateDocumentationEvent($interface, $function);
-    }
-
-    push(@documentationLines, "<h3>Commands</h3>");
-    foreach my $function (grep(!$_->signature->extendedAttributes->{"event"}, @{$interface->functions})) {
-        generateDocumentationCommand($interface, $function);
-    }
-
     collectBackendJSStubFunctions($interface);
+    collectBackendJSStubEvents($interface);
 }
 
 sub generateFrontendFunction
@@ -386,55 +374,20 @@ sub generateFrontendFunction
     push(@function, "void ${frontendClassName}::${domain}::${functionName}(${arguments})");
     push(@function, "{");
     push(@function, "    RefPtr<InspectorObject> ${functionName}Message = InspectorObject::create();");
-    push(@function, "    ${functionName}Message->setString(\"type\", \"event\");");
-    push(@function, "    ${functionName}Message->setString(\"domain\", \"$domain\");");
-    push(@function, "    ${functionName}Message->setString(\"event\", \"$functionName\");");
-    push(@function, "    RefPtr<InspectorObject> bodyObject = InspectorObject::create();");
-    my @pushArguments = map("    bodyObject->set" . typeTraits($_->type, "JSONType") . "(\"" . $_->name . "\", " . $_->name . ");", @argsFiltered);
-    push(@function, @pushArguments);
-    push(@function, "    ${functionName}Message->setObject(\"body\", bodyObject);");
-    push(@function, "    m_inspectorClient->sendMessageToFrontend(${functionName}Message->toJSONString());");
-    push(@function, "}");
-    push(@function, "");
-    push(@frontendMethodsImpl, @function);
-}
-
-sub generateDocumentationEvent
-{
-    my $interface = shift;
-    my $function = shift;
-
-    my $functionName = $function->signature->name;
-    my $domain = $interface->name;
-
-    my @argsFiltered = grep($_->direction eq "out", @{$function->parameters});
-
-    my @lines;
-    push(@lines, "<h4>" . $interface->name . "." . ${functionName} . "</h4>");
-    my $doc = $function->signature->extendedAttributes->{"doc"};
-    if ($doc) {
-        push(@lines, $doc);
-    }
-
-    push(@lines, "<pre style='background: lightGrey; padding: 10px'>");
-    push(@lines, "{");
-    push(@lines, "    type: \"event\",");
-    push(@lines, "    domain: \"$domain\",");
+    push(@function, "    ${functionName}Message->setString(\"method\", \"$domain.$functionName\");");
     if (scalar(@argsFiltered)) {
-        push(@lines, "    event: \"${functionName}\",");
-        push(@lines, "    data: {");
-        my @parameters;
+        push(@function, "    RefPtr<InspectorObject> paramsObject = InspectorObject::create();");
+
         foreach my $parameter (@argsFiltered) {
-            push(@parameters, "        " . parameterDocLine($parameter));
+            my $optional = $parameter->extendedAttributes->{"optional"} ? "if (" . $parameter->name . ")\n        " : "";
+            push(@function, "    " . $optional . "paramsObject->set" . typeTraits($parameter->type, "JSONType") . "(\"" . $parameter->name . "\", " . $parameter->name . ");");
         }
-        push(@lines, join(",\n", @parameters));
-        push(@lines, "    }");
-    } else {
-        push(@lines, "    event: \"${functionName}\"");
+        push(@function, "    ${functionName}Message->setObject(\"params\", paramsObject);");
     }
-    push(@lines, "}");
-    push(@lines, "</pre>");
-    push(@documentationLines, @lines);
+    push(@function, "    m_inspectorFrontendChannel->sendMessageToFrontend(${functionName}Message->toJSONString());");
+    push(@function, "}");
+    push(@function, "");
+    push(@frontendMethodsImpl, @function);
 }
 
 sub camelCase
@@ -452,12 +405,13 @@ sub generateBackendFunction
 
     my $functionName = $function->signature->name;
     my $fullQualifiedFunctionName = $interface->name . "_" . $function->signature->name;
+    my $fullQualifiedFunctionNameDot = $interface->name . "." . $function->signature->name;
 
     push(@backendConstantDeclarations, "    static const char* ${fullQualifiedFunctionName}Cmd;");
-    push(@backendConstantDefinitions, "const char* ${backendClassName}::${fullQualifiedFunctionName}Cmd = \"${fullQualifiedFunctionName}\";");
+    push(@backendConstantDefinitions, "const char* ${backendClassName}::${fullQualifiedFunctionName}Cmd = \"${fullQualifiedFunctionNameDot}\";");
 
     map($backendTypes{$_->type} = 1, @{$function->parameters}); # register required types
-    my @inArgs = grep($_->direction eq "in" && !($_->name eq "callId") , @{$function->parameters});
+    my @inArgs = grep($_->direction eq "in", @{$function->parameters});
     my @outArgs = grep($_->direction eq "out", @{$function->parameters});
     
     my $signature = "    void ${fullQualifiedFunctionName}(long callId, InspectorObject* requestMessageObject);";
@@ -477,133 +431,106 @@ sub generateBackendFunction
     $backendTypes{$domain} = 1;
     $backendDomains{$domain} = 1;
     push(@function, "    if (!$domainAccessor)");
-    push(@function, "        protocolErrors->pushString(\"Protocol Error: $domain handler is not available.\");");
+    push(@function, "        protocolErrors->pushString(\"$domain handler is not available.\");");
     push(@function, "");
 
     # declare local variables for out arguments.
-    push(@function, map("    " . typeTraits($_->type, "variable") . " " . $_->name . " = " . typeTraits($_->type, "defaultValue") . ";", @outArgs));
-    push(@function, "");
+    if (scalar(@outArgs)) {
+        push(@function, map("    " . typeTraits($_->type, "variable") . " out_" . $_->name . " = " . typeTraits($_->type, "defaultValue") . ";", @outArgs));
+        push(@function, "");
+    }
     push(@function, "    ErrorString error;");
     push(@function, "");
 
     my $indent = "";
     if (scalar(@inArgs)) {
-        push(@function, "    if (RefPtr<InspectorObject> argumentsContainer = requestMessageObject->getObject(\"arguments\")) {");
+        push(@function, "    if (RefPtr<InspectorObject> paramsContainer = requestMessageObject->getObject(\"params\")) {");
 
         foreach my $parameter (@inArgs) {
             my $name = $parameter->name;
             my $type = $parameter->type;
             my $typeString = camelCase($parameter->type);
-            push(@function, "        " . typeTraits($type, "variable") . " $name = get$typeString(argumentsContainer.get(), \"$name\", protocolErrors.get());");
+            my $optional = $parameter->extendedAttributes->{"optional"} ? "true" : "false";
+            push(@function, "        " . typeTraits($type, "variable") . " in_$name = get$typeString(paramsContainer.get(), \"$name\", $optional, protocolErrors.get());");
         }
         push(@function, "");
         $indent = "    ";
     }
 
-    my $args = join(", ", ("&error", map($_->name, @inArgs), map("&" . $_->name, @outArgs)));
+
+    my $args = join(", ",
+                    ("&error",
+                     map(($_->extendedAttributes->{"optional"} ? "&" : "") . "in_" . $_->name, @inArgs),
+                     map("&out_" . $_->name, @outArgs)));
+
     push(@function, "$indent    if (!protocolErrors->length())");
     push(@function, "$indent        $domainAccessor->$functionName($args);");
     if (scalar(@inArgs)) {
-        push(@function, "    } else {");
-        push(@function, "        protocolErrors->pushString(\"Protocol Error: 'arguments' property with type 'object' was not found.\");");
-        push(@function, "    }");
+        push(@function, "    } else");
+        push(@function, "        protocolErrors->pushString(\"'params' property with type 'object' was not found.\");");
     }
 
+    push(@function, "");
     push(@function, "    // use InspectorFrontend as a marker of WebInspector availability");
-    push(@function, "    if (callId || protocolErrors->length()) {");
-    push(@function, "        RefPtr<InspectorObject> responseMessage = InspectorObject::create();");
-    push(@function, "        responseMessage->setNumber(\"requestId\", callId);");
     push(@function, "");
-    push(@function, "        if (protocolErrors->length())");
-    push(@function, "            responseMessage->setArray(\"protocolErrors\", protocolErrors);");
-    if (scalar(@outArgs)) {
-        push(@function, "        else {");
-        push(@function, "            if (error.length())");
-        push(@function, "                responseMessage->setString(\"error\", error);");
-        push(@function, "            RefPtr<InspectorObject> responseBody = InspectorObject::create();");
-        push(@function, map("            responseBody->set" . typeTraits($_->type, "JSONType") . "(\"" . $_->name . "\", " . $_->name . ");", @outArgs));
-        push(@function, "            responseMessage->setObject(\"body\", responseBody);");
-        push(@function, "        }");
-    }
-    push(@function, "        m_inspectorClient->sendMessageToFrontend(responseMessage->toJSONString());");
+    push(@function, "    if (protocolErrors->length()) {");
+    push(@function, "        reportProtocolError(&callId, InvalidParams, protocolErrors);");
+    push(@function, "        return;");
     push(@function, "    }");
-
-
+    push(@function, "");
+    push(@function, "    if (error.length()) {");
+    push(@function, "        reportProtocolError(&callId, ServerError, error);");
+    push(@function, "        return;");
+    push(@function, "    }");
+    push(@function, "");
+    push(@function, "    RefPtr<InspectorObject> responseMessage = InspectorObject::create();");
+    push(@function, "    RefPtr<InspectorObject> result = InspectorObject::create();");
+    push(@function, map("        result->set" . typeTraits($_->type, "JSONType") . "(\"" . $_->name . "\", out_" . $_->name . ");", @outArgs));
+    push(@function, "    responseMessage->setObject(\"result\", result);");
+    push(@function, "");
+    push(@function, "    responseMessage->setNumber(\"id\", callId);");
+    push(@function, "    m_inspectorFrontendChannel->sendMessageToFrontend(responseMessage->toJSONString());");
     push(@function, "}");
     push(@function, "");
     push(@backendMethodsImpl, @function);
 }
 
-sub generateDocumentationCommand
-{
-    my $interface = shift;
-    my $function = shift;
-
-    my $functionName = $function->signature->name;
-    my $domain = $interface->name;
-
-    my @lines;
-
-    push(@lines, "<h4>" . $interface->name . "." . ${functionName} . "</h4>");
-    my $doc = $function->signature->extendedAttributes->{"doc"};
-    if ($doc) {
-        push(@lines, $doc);
-    }
-
-    my @inArgs = grep($_->direction eq "in" && !($_->name eq "callId") , @{$function->parameters});
-    push(@lines, "<pre style='background: lightGrey; padding: 10px'>");
-    push(@lines, "request: {");
-    push(@lines, "    id: &lt;number&gt;,");
-    push(@lines, "    type: \"request\",");
-    push(@lines, "    domain: \"" . $interface->name . "\",");
-    if (scalar(@inArgs)) {
-        push(@lines, "    command: \"${functionName}\",");
-        push(@lines, "    arguments: {");
-        my @parameters;
-        foreach my $parameter (@inArgs) {
-            push(@parameters, "        " . parameterDocLine($parameter));
-        }
-        push(@lines, join(",\n", @parameters));
-        push(@lines, "    }");
-    } else {
-        push(@lines, "    command: \"${functionName}\"");
-    }
-    push(@lines, "}");
-
-    my @outArgs = grep($_->direction eq "out", @{$function->parameters});    
-    push(@lines, "");
-    push(@lines, "response: {");
-    push(@lines, "    requestId: &lt;number&gt;,");
-    if (scalar(@outArgs)) {
-        push(@lines, "    type: \"response\",");
-        push(@lines, "    body: {");
-            my @parameters;
-            foreach my $parameter (@outArgs) {
-                push(@parameters, "        " . parameterDocLine($parameter));
-            }
-            push(@lines, join(",\n", @parameters));
-        push(@lines, "    }");
-    } else {
-        push(@lines, "    type: \"response\"");
-    }
-    push(@lines, "}");
-    push(@lines, "</pre>");
-
-    push(@documentationLines, @lines);
-}
-
 sub generateBackendReportProtocolError
 {
     my $reportProtocolError = << "EOF";
 
-void ${backendClassName}::reportProtocolError(const long callId, const String& errorText) const
+void ${backendClassName}::reportProtocolError(const long* const callId, CommonErrorCode code, const String& customText) const
 {
+    RefPtr<InspectorArray> data = InspectorArray::create();
+    data->pushString(customText);
+    reportProtocolError(callId, code, data.release());
+}
+
+void ${backendClassName}::reportProtocolError(const long* const callId, CommonErrorCode code, PassRefPtr<InspectorArray> data) const
+{
+    DEFINE_STATIC_LOCAL(Vector<String>,s_commonErrors,);
+    if (!s_commonErrors.size()) {
+        s_commonErrors.insert(ParseError, "{\\\"code\\\":-32700,\\\"message\\\":\\\"Parse error.\\\"}");
+        s_commonErrors.insert(InvalidRequest, "{\\\"code\\\":-32600,\\\"message\\\":\\\"Invalid Request.\\\"}");
+        s_commonErrors.insert(MethodNotFound, "{\\\"code\\\":-32601,\\\"message\\\":\\\"Method not found.\\\"}");
+        s_commonErrors.insert(InvalidParams, "{\\\"code\\\":-32602,\\\"message\\\":\\\"Invalid params.\\\"}");
+        s_commonErrors.insert(InternalError, "{\\\"code\\\":-32603,\\\"message\\\":\\\"Internal error.\\\"}");
+        s_commonErrors.insert(ServerError, "{\\\"code\\\":-32000,\\\"message\\\":\\\"Server error.\\\"}");
+    }
+    ASSERT(code >=0);
+    ASSERT((unsigned)code < s_commonErrors.size());
+    ASSERT(s_commonErrors[code]);
+    ASSERT(InspectorObject::parseJSON(s_commonErrors[code]));
+    RefPtr<InspectorObject> error = InspectorObject::parseJSON(s_commonErrors[code])->asObject();
+    ASSERT(error);
+    error->setArray("data", data);
     RefPtr<InspectorObject> message = InspectorObject::create();
-    message->setNumber("requestId", callId);
-    RefPtr<InspectorArray> errors = InspectorArray::create();
-    errors->pushString(errorText);
-    message->setArray("protocolErrors", errors);
-    m_inspectorClient->sendMessageToFrontend(message->toJSONString());
+    message->setObject("error", error);
+    if (callId)
+        message->setNumber("id", *callId);
+    else
+        message->setValue("id", InspectorValue::null());
+    m_inspectorFrontendChannel->sendMessageToFrontend(message->toJSONString());
 }
 EOF
     return split("\n", $reportProtocolError);
@@ -618,10 +545,10 @@ sub generateArgumentGetters
     my $return  = typeTraits($type, "return") ? typeTraits($type, "return") : typeTraits($type, "param");
 
     my $typeString = camelCase($type);
-    push(@backendConstantDeclarations, "    $return get$typeString(InspectorObject* object, const String& name, InspectorArray* protocolErrors);");
+    push(@backendConstantDeclarations, "    $return get$typeString(InspectorObject* object, const String& name, bool optional, InspectorArray* protocolErrors);");
     my $getterBody = << "EOF";
 
-$return InspectorBackendDispatcher::get$typeString(InspectorObject* object, const String& name, InspectorArray* protocolErrors)
+$return InspectorBackendDispatcher::get$typeString(InspectorObject* object, const String& name, bool optional, InspectorArray* protocolErrors)
 {
     ASSERT(object);
     ASSERT(protocolErrors);
@@ -630,12 +557,14 @@ $return InspectorBackendDispatcher::get$typeString(InspectorObject* object, cons
     InspectorObject::const_iterator end = object->end();
     InspectorObject::const_iterator valueIterator = object->find(name);
 
-    if (valueIterator == end)
-        protocolErrors->pushString(String::format("Protocol Error: Argument '\%s' with type '$json' was not found.", name.utf8().data()));
-    else {
-        if (!valueIterator->second->as$json(&value))
-            protocolErrors->pushString(String::format("Protocol Error: Argument '\%s' has wrong type. It should be '$json'.", name.utf8().data()));
+    if (valueIterator == end) {
+        if (!optional)
+            protocolErrors->pushString(String::format("Parameter '\%s' with type '$json' was not found.", name.utf8().data()));
+        return value;
     }
+
+    if (!valueIterator->second->as$json(&value))
+        protocolErrors->pushString(String::format("Parameter '\%s' has wrong type. It should be '$json'.", name.utf8().data()));
     return value;
 }
 EOF
@@ -650,11 +579,6 @@ sub generateBackendDispatcher
     my $mapEntries = join("\n", @mapEntries);
 
     my $backendDispatcherBody = << "EOF";
-static String commandName(const String& domain, const String& command)
-{
-    return makeString(domain, "_", command);
-}
-
 void ${backendClassName}::dispatch(const String& message)
 {
     typedef void (${backendClassName}::*CallHandler)(long callId, InspectorObject* messageObject);
@@ -668,54 +592,42 @@ $mapEntries
 
     RefPtr<InspectorValue> parsedMessage = InspectorValue::parseJSON(message);
     if (!parsedMessage) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. Message should be in JSON format.");
+        reportProtocolError(0, ParseError, "Message should be in JSON format.");
         return;
     }
 
     RefPtr<InspectorObject> messageObject = parsedMessage->asObject();
     if (!messageObject) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. The message should be a JSONified object.");
+        reportProtocolError(0, InvalidRequest, "Invalid message format. The message should be a JSONified object.");
         return;
     }
 
-    RefPtr<InspectorValue> commandValue = messageObject->get("command");
-    if (!commandValue) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. 'command' property wasn't found.");
-        return;
-    }
-
-    String command;
-    if (!commandValue->asString(&command)) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. The type of 'command' property should be string.");
-        return;
-    }
-
-    RefPtr<InspectorValue> domainValue = messageObject->get("domain");
-    if (!domainValue) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. 'domain' property wasn't found.");
+    RefPtr<InspectorValue> callIdValue = messageObject->get("id");
+    if (!callIdValue) {
+        reportProtocolError(0, InvalidRequest, "Invalid message format. 'id' property was not found in the request.");
         return;
     }
 
-    String domain;
-    if (!domainValue->asString(&domain)) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. The type of 'domain' property should be string.");
+    if (!callIdValue->asNumber(&callId)) {
+        reportProtocolError(0, InvalidRequest, "Invalid message format. The type of 'id' property should be number.");
         return;
     }
 
-    RefPtr<InspectorValue> callIdValue = messageObject->get("id");
-    if (!callIdValue) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. 'id' property was not found in the request.");
+    RefPtr<InspectorValue> methodValue = messageObject->get("method");
+    if (!methodValue) {
+        reportProtocolError(&callId, InvalidRequest, "Invalid message format. 'method' property wasn't found.");
         return;
     }
 
-    if (!callIdValue->asNumber(&callId)) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. The type of 'id' property should be number.");
+    String method;
+    if (!methodValue->asString(&method)) {
+        reportProtocolError(&callId, InvalidRequest, "Invalid message format. The type of 'method' property should be string.");
         return;
     }
 
-    HashMap<String, CallHandler>::iterator it = dispatchMap.find(commandName(domain, command));
+    HashMap<String, CallHandler>::iterator it = dispatchMap.find(method);
     if (it == dispatchMap.end()) {
-        reportProtocolError(callId, makeString("Protocol Error: Invalid command was received. '", command, "' wasn't found in domain ", domain, "."));
+        reportProtocolError(&callId, MethodNotFound, makeString("Invalid method name was received. '", method, "' wasn't found."));
         return;
     }
 
@@ -738,15 +650,9 @@ bool ${backendClassName}::getCommandName(const String& message, String* result)
     if (!object)
         return false;
 
-    String domain;
-    if (!object->getString("domain", &domain))
+    if (!object->getString("method", result))
         return false;
 
-    String command;
-    if (!object->getString("command", &command))
-        return false;
-
-    *result = commandName(domain, command);
     return true;
 }
 EOF
@@ -761,19 +667,40 @@ sub collectBackendJSStubFunctions
 
     foreach my $function (@functions) {
         my $name = $function->signature->name;
-        my $argumentNames = join(",", map("\"" . $_->name . "\": \"" . typeTraits($_->type, "JSType") . "\"", grep($_->direction eq "in", @{$function->parameters})));
+        my @inArgs = grep($_->direction eq "in", @{$function->parameters});
+        my $argumentNames = join(
+            ",",
+            map("\"" . $_->name . "\": {"
+                . "\"optional\": " . ($_->extendedAttributes->{"optional"} ? "true " : "false") . ", "
+                . "\"type\": \"" . typeTraits($_->type, "JSType") . "\""
+                . "}",
+                 @inArgs));
         push(@backendJSStubs, "    this._registerDelegate('{" .
-            "\"id\": 0, " .
-            "\"domain\": \"$domain\", " .
-            "\"command\": \"$name\", " .
-            "\"arguments\": {$argumentNames}" .
+            "\"method\": \"$domain.$name\", " .
+            (scalar(@inArgs) ? "\"params\": {$argumentNames}, " : "") .
+            "\"id\": 0" .
         "}');");
     }
 }
 
+sub collectBackendJSStubEvents
+{
+    my $interface = shift;
+    my @functions = grep($_->signature->extendedAttributes->{"event"}, @{$interface->functions});
+    my $domain = $interface->name;
+
+    foreach my $function (@functions) {
+        my $name = $domain . "." . $function->signature->name;
+        my @outArgs = grep($_->direction eq "out", @{$function->parameters});
+        my $argumentNames = join(",", map("\"" . $_->name . "\"" , @outArgs));
+        push(@backendJSEvents, "    this._eventArgs[\"" . $name . "\"] = [" . $argumentNames ."];");
+    }
+}
+
 sub generateBackendStubJS
 {
     my $JSStubs = join("\n", @backendJSStubs);
+    my $JSEvents = join("\n", @backendJSEvents);
     my $inspectorBackendStubJS = << "EOF";
 $licenseTemplate
 
@@ -783,7 +710,9 @@ InspectorBackendStub = function()
     this._pendingResponsesCount = 0;
     this._callbacks = {};
     this._domainDispatchers = {};
+    this._eventArgs = {};
 $JSStubs
+$JSEvents
 }
 
 InspectorBackendStub.prototype = {
@@ -794,40 +723,53 @@ InspectorBackendStub.prototype = {
         return callbackId;
     },
 
-    _registerDelegate: function(commandInfo)
+    _registerDelegate: function(requestString)
     {
-        var commandObject = JSON.parse(commandInfo);
-        var agentName = commandObject.domain + "Agent";
+        var domainAndFunction = JSON.parse(requestString).method.split(".");
+        var agentName = domainAndFunction[0] + "Agent";
         if (!window[agentName])
             window[agentName] = {};
-        window[agentName][commandObject.command] = this.sendMessageToBackend.bind(this, commandInfo);
+        window[agentName][domainAndFunction[1]] = this.sendMessageToBackend.bind(this, requestString);
     },
 
     sendMessageToBackend: function()
     {
         var args = Array.prototype.slice.call(arguments);
         var request = JSON.parse(args.shift());
+        var callback = (args.length && typeof args[args.length - 1] === "function") ? args.pop() : 0;
+        var domainAndMethod = request.method.split(".");
+        var agentMethod = domainAndMethod[0] + "Agent." + domainAndMethod[1];
+
+        if (request.params) {
+            for (var key in request.params) {
+                var typeName = request.params[key].type;
+                var optionalFlag = request.params[key].optional;
+
+                if (args.length === 0 && !optionalFlag) {
+                    console.error("Protocol Error: Invalid number of arguments for method '" + agentMethod + "' call. It should have the next arguments '" + JSON.stringify(request.params) + "'.");
+                    return;
+                }
 
-        for (var key in request.arguments) {
-            if (args.length === 0) {
-                console.error("Protocol Error: Invalid number of arguments for '" + request.domain + "Agent." + request.command + "' call. It should have the next arguments '" + JSON.stringify(request.arguments) + "'.");
-                return;
-            }
-            var value = args.shift();
-            if (request.arguments[key] && typeof value !== request.arguments[key]) {
-                console.error("Protocol Error: Invalid type of argument '" + key + "' for '" + request.domain + "Agent." + request.command + "' call. It should be '" + request.arguments[key] + "' but it is '" + typeof value + "'.");
-                return;
+                var value = args.shift();
+                if (optionalFlag && typeof value === "undefined") {
+                    delete request.params[key];
+                    continue;
+                }
+
+                if (typeof value !== typeName) {
+                    console.error("Protocol Error: Invalid type of argument '" + key + "' for method '" + agentMethod + "' call. It should be '" + typeName + "' but it is '" + typeof value + "'.");
+                    return;
+                }
+
+                request.params[key] = value;
             }
-            request.arguments[key] = value;
         }
 
-        var callback;
-        if (args.length === 1) {
-            if (typeof args[0] !== "function" && typeof args[0] !== "undefined") {
-                console.error("Protocol Error: Optional callback argument for '" + request.domain + "Agent." + request.command + "' call should be a function but its type is '" + typeof args[0] + "'.");
+        if (args.length === 1 && !callback) {
+            if (typeof args[0] !== "undefined") {
+                console.error("Protocol Error: Optional callback argument for method '" + agentMethod + "' call should be a function but its type is '" + typeof args[0] + "'.");
                 return;
             }
-            callback = args[0];
         }
         request.id = this._wrap(callback || function() {});
 
@@ -852,51 +794,64 @@ InspectorBackendStub.prototype = {
 
         var messageObject = (typeof message === "string") ? JSON.parse(message) : message;
 
-        var arguments = [];
-        if (messageObject.body)
-            for (var key in messageObject.body)
-                arguments.push(messageObject.body[key]);
-
-        if ("requestId" in messageObject) { // just a response for some request
-            if (messageObject.protocolErrors)
+        if ("id" in messageObject) { // just a response for some request
+            if (messageObject.error && messageObject.error.code !== -32000)
                 this.reportProtocolError(messageObject);
 
-            var callback = this._callbacks[messageObject.requestId];
+            var arguments = [];
+            if (messageObject.result) {
+                for (var key in messageObject.result)
+                    arguments.push(messageObject.result[key]);
+            }
+
+            var callback = this._callbacks[messageObject.id];
             if (callback) {
-                if (!messageObject.protocolErrors) {
-                    arguments.unshift(messageObject.error);
-                    callback.apply(null, arguments);
-                }
+                arguments.unshift(messageObject.error);
+                callback.apply(null, arguments);
                 --this._pendingResponsesCount;
-                delete this._callbacks[messageObject.requestId];
+                delete this._callbacks[messageObject.id];
             }
 
             if (this._scripts && !this._pendingResponsesCount)
                 this.runAfterPendingDispatches();
 
             return;
-        }
-
-        if (messageObject.type === "event") {
-            if (!(messageObject.domain in this._domainDispatchers)) {
-                console.error("Protocol Error: the message is for non-existing domain '" + messageObject.domain + "'");
+        } else {
+            var method = messageObject.method.split(".");
+            var domainName = method[0];
+            var functionName = method[1];
+            if (!(domainName in this._domainDispatchers)) {
+                console.error("Protocol Error: the message is for non-existing domain '" + domainName + "'");
+                return;
+            }
+            var dispatcher = this._domainDispatchers[domainName];
+            if (!(functionName in dispatcher)) {
+                console.error("Protocol Error: Attempted to dispatch an unimplemented method '" + messageObject.method + "'");
                 return;
             }
-            var dispatcher = this._domainDispatchers[messageObject.domain];
-            if (!(messageObject.event in dispatcher)) {
-                console.error("Protocol Error: Attempted to dispatch an unimplemented method '" + messageObject.domain + "." + messageObject.event + "'");
+
+            if (!this._eventArgs[messageObject.method]) {
+                console.error("Protocol Error: Attempted to dispatch an unspecified method '" + messageObject.method + "'");
                 return;
             }
 
-            dispatcher[messageObject.event].apply(dispatcher, arguments);
+            var params = [];
+            if (messageObject.params) {
+                var paramNames = this._eventArgs[messageObject.method];
+                for (var i = 0; i < paramNames.length; ++i)
+                    params.push(messageObject.params[paramNames[i]]);
+            }
+
+            dispatcher[functionName].apply(dispatcher, params);
         }
     },
 
     reportProtocolError: function(messageObject)
     {
-        console.error("Protocol Error: InspectorBackend request with id = " + messageObject.requestId + " failed.");
-        for (var i = 0; i < messageObject.protocolErrors.length; ++i)
-            console.error("    " + messageObject.protocolErrors[i]);
+        var error = messageObject.error;
+        console.error(error.message + "(" + error.code + "): request with id = " + messageObject.id + " failed.");
+        for (var i = 0; i < error.data.length; ++i)
+            console.error("    " + error.data[i]);
     },
 
     runAfterPendingDispatches: function(script)
@@ -1010,44 +965,14 @@ sub typeTraits
     return $typeTransform{$type}->{$trait};
 }
 
-sub parameterDocType
-{
-    my $parameter = shift;
-    my $subtype = $parameter->extendedAttributes->{"type"};
-    if ($subtype) {
-        my $pattern = typeTraits($parameter->type, "DocType");
-        return sprintf($pattern, "&lt;$subtype&gt;");
-    }
-
-    my $subtypeRef = $parameter->extendedAttributes->{"typeRef"};
-    if ($subtypeRef) {
-        my $pattern = typeTraits($parameter->type, "DocType");
-        return sprintf($pattern, "&lt;<a href='#$subtypeRef'>" . $subtypeRef . "</a>&gt;");
-    }
-
-    return "&lt;" . typeTraits($parameter->type, "JSType") . "&gt;";
-}
-
-sub parameterDocLine
-{
-    my $parameter = shift;
-
-    my $result = $parameter->name . ": " . parameterDocType($parameter);
-    my $doc = $parameter->extendedAttributes->{"doc"};
-    if ($doc) {
-        $result = $result . " // " . $doc;
-    }
-    return $result;
-}
-
 sub generateBackendAgentFieldsAndConstructor
 {
     my @arguments;
     my @fieldInitializers;
 
-    push(@arguments, "InspectorClient* inspectorClient");
-    push(@fieldInitializers, "        : m_inspectorClient(inspectorClient)");
-    push(@backendFooter, "    InspectorClient* m_inspectorClient;");
+    push(@arguments, "InspectorFrontendChannel* inspectorFrontendChannel");
+    push(@fieldInitializers, "        : m_inspectorFrontendChannel(inspectorFrontendChannel)");
+    push(@backendFooter, "    InspectorFrontendChannel* m_inspectorFrontendChannel;");
 
     foreach my $domain (sort keys %backendDomains) {
         # Add agent field declaration to the footer.
@@ -1067,7 +992,19 @@ sub generateBackendAgentFieldsAndConstructor
     push(@backendHead, "    ${backendClassName}(${argumentString})");
     push(@backendHead, @fieldInitializers);
     push(@backendHead, "    { }");
-    push(@backendHead, "    void reportProtocolError(const long callId, const String& errorText) const;");
+    push(@backendHead, "");
+    push(@backendHead, "    enum CommonErrorCode {");
+    push(@backendHead, "        ParseError = 0,");
+    push(@backendHead, "        InvalidRequest,");
+    push(@backendHead, "        MethodNotFound,");
+    push(@backendHead, "        InvalidParams,");
+    push(@backendHead, "        InternalError,");
+    push(@backendHead, "        ServerError,");
+    push(@backendHead, "        LastEntry,");
+    push(@backendHead, "    };");
+    push(@backendHead, "");
+    push(@backendHead, "    void reportProtocolError(const long* const callId, CommonErrorCode, const String& errorText) const;");
+    push(@backendHead, "    void reportProtocolError(const long* const callId, CommonErrorCode, PassRefPtr<InspectorArray> data) const;");
     push(@backendHead, "    void dispatch(const String& message);");
     push(@backendHead, "    static bool getCommandName(const String& message, String* result);");
     $backendConstructor = join("\n", @backendHead);
@@ -1121,14 +1058,6 @@ sub finish
     print $JS_STUB join("\n", generateBackendStubJS());
     close($JS_STUB);
     undef($JS_STUB);
-
-    open(my $DOCS, ">$outputDir/WebInspectorProtocol.html") || die "Couldn't open file $outputDir/WebInspectorProtocol.html";
-    print $DOCS "<ol class='toc' style='list-style: none; padding: 0'>";
-    print $DOCS join("\n", @documentationToc);
-    print $DOCS "</ol>";
-    print $DOCS join("\n", @documentationLines);
-    close($DOCS);
-    undef($DOCS);
 }
 
 1;
diff --git a/Source/WebCore/inspector/ConsoleMessage.cpp b/Source/WebCore/inspector/ConsoleMessage.cpp
index de61ef8..5ced69a 100644
--- a/Source/WebCore/inspector/ConsoleMessage.cpp
+++ b/Source/WebCore/inspector/ConsoleMessage.cpp
@@ -86,18 +86,60 @@ ConsoleMessage::~ConsoleMessage()
 {
 }
 
+// Keep in sync with inspector/front-end/ConsoleView.js
+static String messageSourceValue(MessageSource source)
+{
+    switch (source) {
+    case HTMLMessageSource: return "html";
+    case WMLMessageSource: return "wml";
+    case XMLMessageSource: return "xml";
+    case JSMessageSource: return "javascript";
+    case CSSMessageSource: return "css";
+    case OtherMessageSource: return "other";
+    }
+    return "other";
+}
+
+static String messageTypeValue(MessageType type)
+{
+    switch (type) {
+    case LogMessageType: return "log";
+    case ObjectMessageType: return "other";
+    case TraceMessageType: return "trace";
+    case StartGroupMessageType: return "startGroup";
+    case StartGroupCollapsedMessageType: return "startGroupCollapsed";
+    case EndGroupMessageType: return "endGroup";
+    case AssertMessageType: return "assert";
+    case UncaughtExceptionMessageType: return "uncaughtException";
+    case NetworkErrorMessageType: return "networkError";
+    }
+    return "other";
+}
+
+static String messageLevelValue(MessageLevel level)
+{
+    switch (level) {
+    case TipMessageLevel: return "tip";
+    case LogMessageLevel: return "log";
+    case WarningMessageLevel: return "warning";
+    case ErrorMessageLevel: return "error";
+    case DebugMessageLevel: return "debug";
+    }
+    return "log";
+}
+
 void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, InjectedScriptManager* injectedScriptManager)
 {
     RefPtr<InspectorObject> jsonObj = InspectorObject::create();
-    jsonObj->setNumber("source", static_cast<int>(m_source));
-    jsonObj->setNumber("type", static_cast<int>(m_type));
-    jsonObj->setNumber("level", static_cast<int>(m_level));
+    jsonObj->setString("source", messageSourceValue(m_source));
+    jsonObj->setString("type", messageTypeValue(m_type));
+    jsonObj->setString("level", messageLevelValue(m_level));
     jsonObj->setNumber("line", static_cast<int>(m_line));
     jsonObj->setString("url", m_url);
     jsonObj->setNumber("repeatCount", static_cast<int>(m_repeatCount));
-    jsonObj->setString("message", m_message);
+    jsonObj->setString("text", m_message);
     if (m_type == NetworkErrorMessageType) 
-        jsonObj->setNumber("requestId", m_requestId);
+        jsonObj->setNumber("networkIdentifier", m_requestId);
     if (m_arguments && m_arguments->argumentCount()) {
         InjectedScript injectedScript = injectedScriptManager->injectedScriptFor(m_arguments->globalState());
         if (!injectedScript.hasNoValue()) {
@@ -115,12 +157,12 @@ void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, Injecte
     }
     if (m_callStack)
         jsonObj->setArray("stackTrace", m_callStack->buildInspectorArray());
-    frontend->consoleMessage(jsonObj);
+    frontend->messageAdded(jsonObj);
 }
 
 void ConsoleMessage::updateRepeatCountInConsole(InspectorFrontend::Console* frontend)
 {
-    frontend->consoleMessageRepeatCountUpdated(m_repeatCount);
+    frontend->messageRepeatCountUpdated(m_repeatCount);
 }
 
 bool ConsoleMessage::isEqual(ConsoleMessage* msg) const
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
index c87649b..41609d8 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.cpp
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
@@ -243,7 +243,10 @@ void DrawNodeHighlight(GraphicsContext& context, Node* node)
     if (renderer->isBox() && !isSVGRenderer) {
         RenderBox* renderBox = toRenderBox(renderer);
 
+        // RenderBox returns the "pure" content area box, exclusive of the scrollbars (if present), which also count towards the content area in CSS.
         IntRect contentBox = renderBox->contentBoxRect();
+        contentBox.setWidth(contentBox.width() + renderBox->verticalScrollbarWidth());
+        contentBox.setHeight(contentBox.height() + renderBox->horizontalScrollbarHeight());
 
         IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
                            contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
diff --git a/Source/WebCore/inspector/EventsCollector.cpp b/Source/WebCore/inspector/EventsCollector.cpp
new file mode 100644
index 0000000..1c365cf
--- /dev/null
+++ b/Source/WebCore/inspector/EventsCollector.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "EventsCollector.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "InspectorFrontendChannel.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+EventsCollector::EventsCollector()
+    : m_totalLength(0)
+{
+}
+
+void EventsCollector::addEvent(const String& message)
+{
+    m_totalLength += message.length();
+    m_events.append(message);
+    while (m_totalLength > maxCapacity) {
+        m_totalLength -= m_events[0].length();
+        m_events.remove(0);
+    }
+}
+
+void EventsCollector::sendCollectedEvents(InspectorFrontendChannel* receiver)
+{
+    for (Vector<String>::iterator it = m_events.begin(); it != m_events.end(); ++it)
+        receiver->sendMessageToFrontend(*it);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/EventsCollector.h b/Source/WebCore/inspector/EventsCollector.h
new file mode 100644
index 0000000..d53e109
--- /dev/null
+++ b/Source/WebCore/inspector/EventsCollector.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef EventsCollector_h
+#define EventsCollector_h
+
+#if ENABLE(INSPECTOR)
+
+#include <wtf/Forward.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class InspectorFrontendChannel;
+
+class EventsCollector {
+public:
+    EventsCollector();
+    ~EventsCollector() { }
+    void addEvent(const String& message);
+    void sendCollectedEvents(InspectorFrontendChannel*);
+private:
+    static const size_t maxCapacity = 1024*1024; // 1 Mb
+    size_t m_totalLength;
+    Vector<String> m_events;
+};
+
+} // namespace WebCore
+
+#endif // !defined(EventsCollector_h)
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index ee2e35a..e653290 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -43,8 +43,14 @@
 
 namespace WebCore {
 
-InjectedScript::InjectedScript(ScriptObject injectedScriptObject)
+InjectedScript::InjectedScript()
+    : m_inspectedStateAccessCheck(0)
+{
+}
+
+InjectedScript::InjectedScript(ScriptObject injectedScriptObject, InspectedStateAccessCheck accessCheck)
     : m_injectedScriptObject(injectedScriptObject)
+    , m_inspectedStateAccessCheck(accessCheck)
 {
 }
 
@@ -75,17 +81,16 @@ void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const String&
     makeObjectCall(errorString, function, result);
 }
 
-void InjectedScript::getProperties(ErrorString* errorString, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* properties)
+void InjectedScript::getProperties(ErrorString* errorString, const String& objectId, bool ignoreHasOwnProperty, RefPtr<InspectorArray>* properties)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "getProperties");
     function.appendArgument(objectId);
     function.appendArgument(ignoreHasOwnProperty);
-    function.appendArgument(abbreviate);
 
     RefPtr<InspectorValue> result; 
     makeCall(function, &result);
     if (!result || result->type() != InspectorValue::TypeArray) {
-        *errorString = "Internal error.";
+        *errorString = "Internal error";
         return;
     }
     *properties = result->asArray();
@@ -179,7 +184,7 @@ void InjectedScript::releaseObjectGroup(const String& objectGroup)
 
 bool InjectedScript::canAccessInspectedWindow()
 {
-    return InjectedScriptManager::canAccessInspectedWindow(m_injectedScriptObject.scriptState());
+    return m_inspectedStateAccessCheck(m_injectedScriptObject.scriptState());
 }
 
 void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValue>* result)
@@ -209,7 +214,7 @@ void InjectedScript::makeObjectCall(ErrorString* errorString, ScriptFunctionCall
     }
 
     if (!result || result->type() != InspectorValue::TypeObject) {
-        *errorString = "Internal error.";
+        *errorString = "Internal error";
         return;
     }
     *objectResult = result->asObject();
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index e165e9c..adcb208 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -50,7 +50,7 @@ typedef String ErrorString;
 
 class InjectedScript {
 public:
-    InjectedScript() { }
+    InjectedScript();
     ~InjectedScript() { }
 
     bool hasNoValue() const { return m_injectedScriptObject.hasNoValue(); }
@@ -58,7 +58,7 @@ public:
     void evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
     void evaluateOn(ErrorString*, const String& objectId, const String& expression, RefPtr<InspectorObject>* result);
     void evaluateOnCallFrame(ErrorString*, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
-    void getProperties(ErrorString*, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result);
+    void getProperties(ErrorString*, const String& objectId, bool ignoreHasOwnProperty, RefPtr<InspectorArray>* result);
     Node* nodeForObjectId(const String& objectId);
     void setPropertyValue(ErrorString*, const String& objectId, const String& propertyName, const String& expression);
     void releaseObject(const String& objectId);
@@ -75,7 +75,8 @@ public:
 
 private:
     friend InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState*);
-    explicit InjectedScript(ScriptObject);
+    typedef bool (*InspectedStateAccessCheck)(ScriptState*);
+    InjectedScript(ScriptObject, InspectedStateAccessCheck);
 
     bool canAccessInspectedWindow();
     void makeCall(ScriptFunctionCall&, RefPtr<InspectorValue>* result);
@@ -83,6 +84,7 @@ private:
     ScriptValue nodeAsScriptValue(Node*);
 
     ScriptObject m_injectedScriptObject;
+    InspectedStateAccessCheck m_inspectedStateAccessCheck;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InjectedScriptManager.cpp b/Source/WebCore/inspector/InjectedScriptManager.cpp
index 5c21802..7464355 100644
--- a/Source/WebCore/inspector/InjectedScriptManager.cpp
+++ b/Source/WebCore/inspector/InjectedScriptManager.cpp
@@ -44,14 +44,20 @@ using namespace std;
 
 namespace WebCore {
 
-PassOwnPtr<InjectedScriptManager> InjectedScriptManager::create()
+PassOwnPtr<InjectedScriptManager> InjectedScriptManager::createForPage()
 {
-    return adoptPtr(new InjectedScriptManager());
+    return adoptPtr(new InjectedScriptManager(&InjectedScriptManager::canAccessInspectedWindow));
 }
 
-InjectedScriptManager::InjectedScriptManager()
+PassOwnPtr<InjectedScriptManager> InjectedScriptManager::createForWorker()
+{
+    return adoptPtr(new InjectedScriptManager(&InjectedScriptManager::canAccessInspectedWorkerContext));
+}
+
+InjectedScriptManager::InjectedScriptManager(InspectedStateAccessCheck accessCheck)
     : m_nextInjectedScriptId(1)
     , m_injectedScriptHost(InjectedScriptHost::create())
+    , m_inspectedStateAccessCheck(accessCheck)
 {
 }
 
@@ -95,6 +101,11 @@ void InjectedScriptManager::discardInjectedScripts()
     m_idToInjectedScript.clear();
 }
 
+bool InjectedScriptManager::canAccessInspectedWorkerContext(ScriptState*)
+{
+    return true;
+}
+
 void InjectedScriptManager::releaseObjectGroup(const String& objectGroup)
 {
     for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != m_idToInjectedScript.end(); ++it)
diff --git a/Source/WebCore/inspector/InjectedScriptManager.h b/Source/WebCore/inspector/InjectedScriptManager.h
index 2896e8f..fcfa011 100644
--- a/Source/WebCore/inspector/InjectedScriptManager.h
+++ b/Source/WebCore/inspector/InjectedScriptManager.h
@@ -46,7 +46,8 @@ class ScriptObject;
 class InjectedScriptManager {
     WTF_MAKE_NONCOPYABLE(InjectedScriptManager);
 public:
-    static PassOwnPtr<InjectedScriptManager> create();
+    static PassOwnPtr<InjectedScriptManager> createForPage();
+    static PassOwnPtr<InjectedScriptManager> createForWorker();
     ~InjectedScriptManager();
 
     void disconnect();
@@ -60,19 +61,23 @@ public:
     void discardInjectedScripts();
     void releaseObjectGroup(const String& objectGroup);
 
-    static bool canAccessInspectedWindow(ScriptState*);
 
 private:
-    InjectedScriptManager();
+    typedef bool (*InspectedStateAccessCheck)(ScriptState*);
+    explicit InjectedScriptManager(InspectedStateAccessCheck);
 
     String injectedScriptSource();
     ScriptObject createInjectedScript(const String& source, ScriptState*, long id);
     void discardInjectedScript(ScriptState*);
 
+    static bool canAccessInspectedWindow(ScriptState*);
+    static bool canAccessInspectedWorkerContext(ScriptState*);
+
     long m_nextInjectedScriptId;
     typedef HashMap<long, InjectedScript> IdToInjectedScriptMap;
     IdToInjectedScriptMap m_idToInjectedScript;
     RefPtr<InjectedScriptHost> m_injectedScriptHost;
+    InspectedStateAccessCheck m_inspectedStateAccessCheck;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index f499a17..ce43a42 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -71,7 +71,7 @@ InjectedScript.prototype = {
         if (arguments.length === 0)
             return;
 
-        var objectId = this._wrapObject(object, "", false);
+        var objectId = this._wrapObject(object, "");
         var hints = {};
 
         switch (injectedScript._describe(object)) {
@@ -90,7 +90,7 @@ InjectedScript.prototype = {
         return object;
     },
 
-    _wrapObject: function(object, objectGroupName, abbreviate)
+    _wrapObject: function(object, objectGroupName)
     {
         try {
             if (typeof object === "object" || typeof object === "function" || this._isHTMLAllCollection(object)) {
@@ -107,7 +107,7 @@ InjectedScript.prototype = {
                     this._idToObjectGroupName[id] = objectGroupName;
                 }
             }
-            return InjectedScript.RemoteObject.fromObject(object, objectId, abbreviate);
+            return InjectedScript.RemoteObject.fromObject(object, objectId);
         } catch (e) {
             return InjectedScript.RemoteObject.fromObject("[ Exception: " + e.toString() + " ]");
         }
@@ -139,7 +139,7 @@ InjectedScript.prototype = {
         return result;
     },
 
-    getProperties: function(objectId, ignoreHasOwnProperty, abbreviate)
+    getProperties: function(objectId, ignoreHasOwnProperty)
     {
         var parsedObjectId = this._parseObjectId(objectId);
         var object = this._objectForId(parsedObjectId);
@@ -162,7 +162,7 @@ InjectedScript.prototype = {
             var isGetter = object["__lookupGetter__"] && object.__lookupGetter__(propertyName);
             if (!isGetter) {
                 try {
-                    property.value = this._wrapObject(object[propertyName], objectGroupName, abbreviate);
+                    property.value = this._wrapObject(object[propertyName], objectGroupName);
                 } catch(e) {
                     property.value = new InjectedScript.RemoteObject.fromException(e);
                 }
@@ -299,7 +299,6 @@ InjectedScript.prototype = {
         if (!callFrame)
             return false;
     
-        injectedScript.releaseObjectGroup("backtrace");
         var result = [];
         var depth = 0;
         do {
@@ -402,12 +401,13 @@ InjectedScript.prototype = {
         return type;
     },
 
-    _describe: function(obj, abbreviated)
+    _describe: function(obj)
     {
         var type = this._type(obj);
 
         switch (type) {
         case "object":
+            // Fall through.
         case "node":
             var result = InjectedScriptHost.internalConstructorName(obj);
             if (result === "Object") {
@@ -424,14 +424,9 @@ InjectedScript.prototype = {
                 className += "[" + obj.length + "]";
             return className;
         case "string":
-            if (abbreviated && obj.length > 100)
-                return obj.substring(0, 100) + "\u2026";
             return obj;
         case "function":
-            var objectText = this._toString(obj);
-            if (abbreviated)
-                objectText = /.*/.exec(objectText)[0].replace(/ +$/g, "");
-            return objectText;
+            // Fall through.
         default:
             return this._toString(obj);
         }
@@ -461,14 +456,14 @@ InjectedScript.RemoteObject.fromException = function(e)
     return new InjectedScript.RemoteObject(null, "error", e.toString());
 }
 
-InjectedScript.RemoteObject.fromObject = function(object, objectId, abbreviate)
+InjectedScript.RemoteObject.fromObject = function(object, objectId)
 {
     var type = injectedScript._type(object);
     var rawType = typeof object;
     var hasChildren = (rawType === "object" && object !== null && (!!Object.getOwnPropertyNames(object).length || !!object.__proto__)) || rawType === "function";
     var description = "";
     try {
-        var description = injectedScript._describe(object, abbreviate);
+        var description = injectedScript._describe(object);
         return new InjectedScript.RemoteObject(objectId, type, description, hasChildren);
     } catch (e) {
         return InjectedScript.RemoteObject.fromException(e);
@@ -478,11 +473,8 @@ InjectedScript.RemoteObject.fromObject = function(object, objectId, abbreviate)
 InjectedScript.CallFrameProxy = function(ordinal, callFrame)
 {
     this.id = "{\"ordinal\":" + ordinal + ",\"injectedScriptId\":" + injectedScriptId + "}";
-    this.type = callFrame.type;
-    this.functionName = (this.type === "function" ? callFrame.functionName : "");
-    this.sourceID = callFrame.sourceID;
-    this.line = callFrame.line;
-    this.column = callFrame.column;
+    this.functionName = (callFrame.type === "function" ? callFrame.functionName : "");
+    this.location = { sourceID: callFrame.sourceID, lineNumber: callFrame.line, columnNumber: callFrame.column };
     this.scopeChain = this._wrapScopeChain(callFrame);
 }
 
@@ -494,38 +486,28 @@ InjectedScript.CallFrameProxy.prototype = {
         const WITH_SCOPE = 2;
         const CLOSURE_SCOPE = 3;
         const CATCH_SCOPE = 4;
-    
+
+        var scopeTypeNames = {};
+        scopeTypeNames[GLOBAL_SCOPE] = "global";
+        scopeTypeNames[LOCAL_SCOPE] = "local";
+        scopeTypeNames[WITH_SCOPE] = "with";
+        scopeTypeNames[CLOSURE_SCOPE] = "closure";
+        scopeTypeNames[CATCH_SCOPE] = "catch";
+
         var scopeChain = callFrame.scopeChain;
         var scopeChainProxy = [];
         var foundLocalScope = false;
         for (var i = 0; i < scopeChain.length; i++) {
+            var scope = {};
+            scope.object = injectedScript._wrapObject(scopeChain[i], "backtrace");
+
             var scopeType = callFrame.scopeType(i);
-            var scopeObject = scopeChain[i];
-            var scopeObjectProxy = injectedScript._wrapObject(scopeObject, "backtrace", true);
-
-            switch(scopeType) {
-                case LOCAL_SCOPE: {
-                    foundLocalScope = true;
-                    scopeObjectProxy.isLocal = true;
-                    scopeObjectProxy.thisObject = injectedScript._wrapObject(callFrame.thisObject, "backtrace", true);
-                    break;
-                }
-                case CLOSURE_SCOPE: {
-                    scopeObjectProxy.isClosure = true;
-                    break;
-                }
-                case WITH_SCOPE:
-                case CATCH_SCOPE: {
-                    if (foundLocalScope && scopeObject instanceof inspectedWindow.Element)
-                        scopeObjectProxy.isElement = true;
-                    else if (foundLocalScope && scopeObject instanceof inspectedWindow.Document)
-                        scopeObjectProxy.isDocument = true;
-                    else
-                        scopeObjectProxy.isWithBlock = true;
-                    break;
-                }
-            }
-            scopeChainProxy.push(scopeObjectProxy);
+            scope.type = scopeTypeNames[scopeType];
+
+            if (scopeType === LOCAL_SCOPE)
+                scope.this = injectedScript._wrapObject(callFrame.thisObject, "backtrace");
+
+            scopeChainProxy.push(scope);
         }
         return scopeChainProxy;
     }
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index ed5929e..9d7168b 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -3,13 +3,6 @@
         "domain": "Inspector",
         "types": [],
         "commands": [
-            {
-                "name": "didEvaluateForTestInFrontend",
-                "parameters": [
-                    { "name": "testCallId", "type": "integer" },
-                    { "name": "jsonResult", "type": "string" }
-                ]
-            }
         ],
         "events": [
             {
@@ -43,7 +36,7 @@
             {
                 "name": "inspect",
                 "parameters": [
-                    { "name": "object", "$ref": "RemoteObject" },
+                    { "name": "object", "$ref": "Runtime.RemoteObject" },
                     { "name": "hints", "type": "object" }
                 ]
             },
@@ -79,7 +72,7 @@
             {
                 "name": "reloadPage",
                 "parameters": [
-                    { "name": "ignoreCache", "type": "boolean" }
+                    { "name": "ignoreCache", "type": "boolean", "optional": true }
                 ]
             },
             {
@@ -97,7 +90,7 @@
             {
                 "name": "getCookies",
                 "returns": [
-                    { "name": "cookies", "type": "array", "items": { "$ref" : "Cookie"} },
+                    { "name": "cookies", "type": "array", "items": { "$ref": "Cookie"} },
                     { "name": "cookiesString", "type": "string" }
                 ]
             },
@@ -119,119 +112,185 @@
             {
                 "name": "domContentEventFired",
                 "parameters": [
-                    { "name": "time", "type": "number" }
+                    { "name": "timestamp", "type": "number" }
                 ]
             },
             {
                 "name": "loadEventFired",
                 "parameters": [
-                    { "name": "time", "type": "number" }
+                    { "name": "timestamp", "type": "number" }
                 ]
             }
         ]
     },
     {
         "domain": "Runtime",
-        "types": [],
+        "description": "Runtime domain exposes JavaScript runtime by means of remote evaluation and mirror objects. Evaluation results are returned as mirror object that expose type, string representation and unique identifier that can be used for further object interaction. Original objects are maintained in memory unless they are either explicitly released or are released along with the other objects in their object group.",
+        "types": [
+            {
+                "id": "RemoteObject",
+                "type": "object",
+                "description": "Mirror object referencing original JavaScript object.",
+                "properties": [
+                    { "name": "description", "type": "string", "description": "String representation of the object." },
+                    { "name": "hasChildren", "type": "integer", "optional": true, "description": "True when this object can be queried for children." },
+                    { "name": "objectId", "type": "string", "optional": true, "description": "Unique object identifier (for non-primitive values)." },
+                    { "name": "type", "type": "string", "enum": ["object", "array", "function", "null", "node", "undefined", "string", "number", "boolean", "error", "regexp", "date"], "description": "Object type." }
+                ]
+            },
+            {
+                "id": "RemoteProperty",
+                "type": "object",
+                "description": "Mirror object property.",
+                "properties": [
+                    { "name": "name", "type": "string", "description": "Property name." },
+                    { "name": "value", "$ref": "RemoteObject", "description": "Property value." },
+                    { "name": "isGetter", "type": "string", "description": "True if this property is getter." }
+                ]
+            }
+        ],
         "commands": [
             {
                 "name": "evaluate",
                 "parameters": [
-                    { "name": "expression", "type": "string" },
-                    { "name": "objectGroup", "type": "string" },
-                    { "name": "includeCommandLineAPI", "type": "boolean" }
+                    { "name": "expression", "type": "string", "description": "Expression to evaluate." },
+                    { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." },
+                    { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Determines whether Command Line API should be available during the evaluation." }
                 ],
                 "returns": [
-                    { "name": "result", "$ref": "RuntimeObject" }
-                ]
+                    { "name": "result", "$ref": "RemoteObject", "description": "Evaluation result." }
+                ],
+                "description": "Evaluate expression on global object."
             },
             {
                 "name": "evaluateOn",
                 "parameters": [
-                    { "name": "objectId", "type": "string" },
-                    { "name": "expression", "type": "string" }
+                    { "name": "objectId", "type": "string", "description": "Identifier of the object to evaluate expression on." },
+                    { "name": "expression", "type": "string", "description": "Expression to evaluate." }
                 ],
                 "returns": [
-                    { "name": "result", "$ref": "RuntimeObject" }
-                ]
+                    { "name": "result", "$ref": "RemoteObject", "description": "Evaluation result." }
+                ],
+                "description": "Evaluate expression on given object using it as <code>this</code>."
             },
             {
                 "name": "getProperties",
                 "parameters": [
-                    { "name": "objectId", "type": "string" },
-                    { "name": "ignoreHasOwnProperty", "type": "boolean" },
-                    { "name": "abbreviate", "type": "boolean" }
+                    { "name": "objectId", "type": "string", "description": "Identifier of the object to return properties for." },
+                    { "name": "ignoreHasOwnProperty", "type": "boolean", "description": "If true, returns properties belonging to any element of the prototype chain." }
                 ],
                 "returns": [
-                    { "name": "result", "type": "array", "items": { "$ref" : "RuntimeProperty"} }
-                ]
+                    { "name": "result", "type": "array", "items": { "$ref": "RuntimeProperty"}, "description": "Object properties." }
+                ],
+                "description": "Returns properties of a given object."
             },
             {
                 "name": "setPropertyValue",
                 "parameters": [
-                    { "name": "objectId", "type": "string" },
-                    { "name": "propertyName", "type": "string" },
-                    { "name": "expression", "type": "string" }
-                ]
+                    { "name": "objectId", "type": "string", "description": "Identifier of the object to set property on." },
+                    { "name": "propertyName", "type": "string", "description": "Property name to set value for." },
+                    { "name": "expression", "type": "string", "description": "Expression to evaluate." }
+                ],
+                "description": "Makes property with given name equal to the expression evaluation result."
             },
             {
                 "name": "releaseObject",
                 "parameters": [
-                    { "name": "objectId", "type": "string" }
-                ]
+                    { "name": "objectId", "type": "string", "description": "Identifier of the object to release." }
+                ],
+                "description": "Releases remote object with given id."
             },
             {
                 "name": "releaseObjectGroup",
                 "parameters": [
-                    { "name": "objectGroup", "type": "string" }
-                ]
+                    { "name": "objectGroup", "type": "string", "description": "Symbolic object group name." }
+                ],
+                "description": "Releases all remote objects that belong to a given group."
             }
         ]
     },
     {
         "domain": "Console",
-        "types": [],
+        "description": "Console domain defines methods and events for interaction with the JavaScript console. One needs to enable this domain using <code>enable</code> function in order to start receiving the console messages.",
+        "types": [
+            {
+                "id": "ConsoleMessage",
+                "type": "object",
+                "description": "Console message.",
+                "properties": [
+                    { "name": "source", "type": "string", "enum": ["html", "wml", "xml", "javascript", "css", "other"], "description": "Message source." },
+                    { "name": "type", "type": "string", "enum": ["log", "other", "trace", "startGroup", "startGroupCollapsed", "endGroup", "assert", "uncaughtException", "networkError", "result"], "description": "Message type." },
+                    { "name": "level", "type": "string", "enum": ["tip", "log", "warning", "error", "debug"], "description": "Message severity." },
+                    { "name": "line", "type": "integer", "description": "JavaScript source line that created console message." },
+                    { "name": "url", "type": "string", "description": "JavaScript source url that created console message." },
+                    { "name": "repeatCount", "type": "integer", "optional": true, "description": "Repeat count for repeated messages." },
+                    { "name": "text", "type": "string", "description": "Message text." },
+                    { "name": "networkIdentifier", "type": "integer", "optional": true, "description": "Identifier of the network request associated with the console message." },
+                    { "name": "parameters", "type": "array", "items": { "$ref": "Runtime.RemoteObject" }, "description": "Message parameters in case of the formatted message." },
+                    { "name": "stackTrace", "type": "array", "optional": true, "items": { "$ref": "CallFrame" }, "description": "Call frames for assert and error messages." }
+                ]
+            },
+            {
+                "id": "CallFrame",
+                "type": "object",
+                "description": "Stack entry for console errors and assertions.",
+                "properties": [
+                    { "name": "functionName", "type": "string", "description": "JavaScript function name." },
+                    { "name": "url", "type": "string", "description": "JavaScript source name / url." },
+                    { "name": "lineNumber", "type": "string", "description": "JavaScript source line number." },
+                    { "name": "columnNumber", "type": "string", "description": "JavaScript source column number." }
+                ]
+            }
+        ],
         "commands": [
             {
                 "name": "enable",
                 "returns": [
-                   { "name": "expiredMessagesCount", "type": "integer" }
-                ]
+                    { "name": "expiredMessagesCount", "type": "integer", "description": "Number of messages cleared due to message threashold overflow." }
+                ],
+                "description": "Enables console domain, sends all the messages collected so far to the client." 
             },
             {
-                "name": "disable"
-           },
+                "name": "disable",
+                "description": "Disables console domain, prevents further console messages from being sent to the client." 
+            },
             {
-                "name": "clearConsoleMessages"
+                "name": "clearConsoleMessages",
+                "description": "Clears collected console messages." 
             },
             {
                 "name": "setMonitoringXHREnabled",
                 "parameters": [
-                    { "name": "enabled", "type": "boolean" }
-                ]
+                    { "name": "enabled", "type": "boolean", "description": "Monitoring enabled state." }
+                ],
+                "description": "Toggles monitoring of XMLHttpRequest. If <code>true</code>, console will receive messages upon each XHR issued." 
             },
             {
                 "name": "addInspectedNode",
                 "parameters": [
-                    { "name": "nodeId", "type": "integer" }
-                ]
+                    { "name": "nodeId", "type": "integer", "description": "DOM node id to be accessible by means of $x command line API." }
+                ],
+                "description": "Enables console to refer to the node with given id via $x (see Command Line API for more details $x functions)." 
             }
         ],
         "events": [
             {
-                "name": "consoleMessage",
+                "name": "messageAdded",
                 "parameters": [
-                    { "name": "messageObj", "$ref": "ConsoleMessage" }
-                ]
+                    { "name": "messageObj", "$ref": "ConsoleMessage", "description": "Console message that has been added." }
+                ],
+                "description": "Issued for each console message added."
             },
-           {
-                "name": "consoleMessageRepeatCountUpdated",
+            {
+                "name": "messageRepeatCountUpdated",
                 "parameters": [
-                    { "name": "count", "type": "integer" }
-                ]
+                    { "name": "count", "type": "integer", "description": "New repeat count value." }
+                ],
+                "description": "In case of subsequent message being equal to the previous one, only repeat count is being updated."
             },
             {
-                "name": "consoleMessagesCleared"
+                "name": "messagesCleared",
+                "description": "Issued when console is cleared."
             }
         ]
     },
@@ -243,89 +302,97 @@
                 "id": "ResourceTiming",
                 "type": "object",
                 "description": "Timing information for the request.",
-                "properties": {
-                    "requestTime": { "type": "number", "description": "Timing's requestTime is a baseline in seconds, while the other numbers are ticks in milliseconds relatively to this requestTime." },
-                    "proxyStart": { "type": "number", "description": "Started resolving proxy." },
-                    "proxyEnd": { "type": "number", "description": "Finished resolving proxy." },
-                    "dnsStart": { "type": "number", "description": "Started DNS address resolve." },
-                    "dnsEnd": { "type": "number", "description": "Finished DNS address resolve." },
-                    "connectStart": { "type": "number", "description": "Started connecting to the remote host." },
-                    "connectEnd": { "type": "number", "description": "Connected to the remote host." },
-                    "sslStart": { "type": "number", "description": "Started SSL handshake." },
-                    "sslEnd": { "type": "number", "description": "Finished SSL handshake." },
-                    "sendStart": { "type": "number", "description": "Started sending request." },
-                    "sendEnd": { "type": "number", "description": "Finished sending request." },
-                    "receiveHeadersEnd": { "type": "number", "description": "Finished receiving response headers." }
-                }
+                "properties": [
+                    { "name": "requestTime", "type": "number", "description": "Timing's requestTime is a baseline in seconds, while the other numbers are ticks in milliseconds relatively to this requestTime." },
+                    { "name": "proxyStart", "type": "number", "description": "Started resolving proxy." },
+                    { "name": "proxyEnd", "type": "number", "description": "Finished resolving proxy." },
+                    { "name": "dnsStart", "type": "number", "description": "Started DNS address resolve." },
+                    { "name": "dnsEnd", "type": "number", "description": "Finished DNS address resolve." },
+                    { "name": "connectStart", "type": "number", "description": "Started connecting to the remote host." },
+                    { "name": "connectEnd", "type": "number", "description": "Connected to the remote host." },
+                    { "name": "sslStart", "type": "number", "description": "Started SSL handshake." },
+                    { "name": "sslEnd", "type": "number", "description": "Finished SSL handshake." },
+                    { "name": "sendStart", "type": "number", "description": "Started sending request." },
+                    { "name": "sendEnd", "type": "number", "description": "Finished sending request." },
+                    { "name": "receiveHeadersEnd", "type": "number", "description": "Finished receiving response headers." }
+                ]
             },
             {
                 "id": "ResourceRequest",
                 "type": "object",
                 "description": "HTTP request data.",
-                "properties": {
-                    "url": { "type": "string", "description": "Request URL." },
-                    "method": { "type": "string", "description": "HTTP request method." },
-                    "headers": { "type": "object", "description": "HTTP request headers." },
-                    "postData": { "type": "string", "optional": true, "description": "HTTP POST request data." }
-                }
+                "properties": [
+                    { "name": "url", "type": "string", "description": "Request URL." },
+                    { "name": "method", "type": "string", "description": "HTTP request method." },
+                    { "name": "headers", "type": "object", "description": "HTTP request headers." },
+                    { "name": "postData", "type": "string", "optional": true, "description": "HTTP POST request data." }
+                ]
             },
             {
                 "id": "ResourceResponse",
                 "type": "object",
                 "description": "HTTP response data.",
-                "properties": {
-                    "status": { "type": "number", "description": "HTTP response status code." },
-                    "statusText": { "type": "string", "description": "HTTP response status text." },
-                    "headers": { "type": "object", "description": "HTTP response headers." },
-                    "mimeType": { "type": "string", "description": "Resource mimeType as determined by the browser." },
-                    "requestHeaders": { "type": "object", "optional": true, "description": "Refined HTTP request headers that were actually transmitted over the network." },
-                    "connectionReused": { "type": "boolean", "description": "Specifies whether physical connection was actually reused for this request." },
-                    "connectionID": { "type": "number", "description": "Physical connection id that was actually used for this request." },
-                    "fromDiskCache": { "type": "boolean", "optional": true, "description": "Specifies that the resource was loaded from the disk cache." },
-                    "timing": { "$ref": "ResourceTiming", "optional": true, "description": "Timing information for the given request." }
-                }
+                "properties": [
+                    { "name": "status", "type": "number", "description": "HTTP response status code." },
+                    { "name": "statusText", "type": "string", "description": "HTTP response status text." },
+                    { "name": "headers", "type": "object", "description": "HTTP response headers." },
+                    { "name": "headersText", "type": "string", "optional": true, "description": "HTTP response headers text." },
+                    { "name": "mimeType", "type": "string", "description": "Resource mimeType as determined by the browser." },
+                    { "name": "requestHeaders", "type": "object", "optional": true, "description": "Refined HTTP request headers that were actually transmitted over the network." },
+                    { "name": "requestHeadersText", "type": "string", "optional": true, "description": "HTTP request headers text." },
+                    { "name": "connectionReused", "type": "boolean", "description": "Specifies whether physical connection was actually reused for this request." },
+                    { "name": "connectionID", "type": "number", "description": "Physical connection id that was actually used for this request." },
+                    { "name": "fromDiskCache", "type": "boolean", "optional": true, "description": "Specifies that the resource was loaded from the disk cache." },
+                    { "name": "timing", "$ref": "ResourceTiming", "optional": true, "description": "Timing information for the given request." }
+                ]
+            },
+            {
+                "id": "ResourceType",
+                "type": "string",
+                "enum": ["Document", "Stylesheet", "Image", "Font", "Script", "XHR", "WebSocket", "Other"],
+                "description": "Resource type as it was perceived by the rendering enging."
             },
             {
                 "id": "CachedResource",
                 "type": "object",
                 "description": "Information about the cached resource.",
-                "properties": {
-                    "url": { "type": "string", "description": "Resource URL." },
-                    "type": { "type": "string", "description": "Type of this resource. // FIXME" },
-                    "response": { "$ref": "ResourceResponse", "description": "Cached response data." },
-                    "bodySize": { "type": "number", "description": "Cached response body size." }
-                }
+                "properties": [
+                    { "name": "url", "type": "string", "description": "Resource URL." },
+                    { "name": "type", "$ref": "ResourceType", "description": "Type of this resource." },
+                    { "name": "response", "$ref": "ResourceResponse", "description": "Cached response data." },
+                    { "name": "bodySize", "type": "number", "description": "Cached response body size." }
+                ]
             },
             {
                 "id": "Frame",
                 "type": "object",
                 "description": "Information about the Frame on the page.",
-                "properties": {
-                    "id": { "type": "string", "description": "Frame unique identifier." },
-                    "parentId": { "type": "string", "description": "Parent frame identifier." },
-                    "loaderId": { "type": "string", "description": "Identifier of the loader associated with this frame." },
-                    "name": { "type": "string", "optional": true, "description": "Frame's name as specified in the tag." },
-                    "url": { "type": "string", "description": "Frame document's URL." }
-                }
+                "properties": [
+                    { "name": "id", "type": "string", "description": "Frame unique identifier." },
+                    { "name": "parentId", "type": "string", "description": "Parent frame identifier." },
+                    { "name": "loaderId", "type": "string", "description": "Identifier of the loader associated with this frame." },
+                    { "name": "name", "type": "string", "optional": true, "description": "Frame's name as specified in the tag." },
+                    { "name": "url", "type": "string", "description": "Frame document's URL." }
+                ]
             },
             {
                 "id": "FrameResourceTree",
                 "type": "object",
                 "description": "Information about the Frame hierarchy along with their cached resources.",
-                "properties": {
-                    "frame": { "$ref": "Frame", "description": "Frame information for this tree item." },
-                    "childFrames": { "type": "array", "optional": true, "items": { "$ref": "FrameResourceTree" }, "description": "Child frames." },
-                    "resources": { "type": "array",
+                "properties": [
+                    { "name": "frame", "$ref": "Frame", "description": "Frame information for this tree item." },
+                    { "name": "childFrames", "type": "array", "optional": true, "items": { "$ref": "FrameResourceTree" }, "description": "Child frames." },
+                    { "name": "resources", "type": "array",
                         "items": {
                             "type": "object",
-                            "properties": {
-                                "url": { "type": "string", "description": "Resource URL." },
-                                "type": { "type": "string", "description": "Type of this resource. // FIXME" }
-                            }
+                            "properties": [
+                                { "name": "url", "type": "string", "description": "Resource URL." },
+                                { "name": "type", "$ref": "ResourceType", "description": "Type of this resource." }
+                            ]
                         },
                         "description": "Information about frame resources."
                     }
-                }
+                ]
             }
         ],
         "commands": [
@@ -366,10 +433,22 @@
         ],
         "events": [
             {
+                "name": "domContentEventFired",
+                "parameters": [
+                    { "name": "time", "type": "number" }
+                ]
+            },
+            {
+                "name": "loadEventFired",
+                "parameters": [
+                    { "name": "time", "type": "number" }
+                ]
+            },
+            {
                 "name": "frameDetached",
                 "description": "Fired when frame has been detached from its parent.",
                 "parameters": [
-                    { "name": "frameId", "type": "string", "description": "If of the frame that has been detached." }
+                    { "name": "frameId", "type": "string", "description": "Id of the frame that has been detached." }
                 ]
             },
             {
@@ -381,14 +460,14 @@
                     { "name": "loaderId", "type": "string", "description": "Loader identifier." },
                     { "name": "documentURL", "type": "string", "description": "URL of the document this resource is loaded for." },
                     { "name": "request", "$ref": "ResourceRequest", "description": "Request data." },
-                    { "name": "redirectResponse", "$ref": "ResourceResponse", "description": "Redirect response data." },
-                    { "name": "time", "type": "number", "description": "Timestamp." },
-                    { "name": "callStack", "type": "array", "items": { "$ref" : "DebuggerStackFrame"}, "description": "JavaScript stack trace upon issuing this request." }
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." },
+                    { "name": "stackTrace", "type": "array", "items": { "$ref": "Console.CallFrame"}, "description": "JavaScript stack trace upon issuing this request." },
+                    { "name": "redirectResponse", "optional": true, "$ref": "ResourceResponse", "description": "Redirect response data." }
                 ]
             },
             {
                 "name": "resourceMarkedAsCached",
-                "description": "Fired when request is known to be served from memory cache.",
+                "description": "Fired when request is known to be served from disk cache.",
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." }
                 ]
@@ -398,8 +477,8 @@
                 "description": "Fired when HTTP response is available.",
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." },
-                    { "name": "time", "type": "number", "description": "Timestamp." },
-                    { "name": "resourceType", "type": "string", "description": "Resource type. // FIXME" },
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." },
+                    { "name": "type", "$ref": "ResourceType", "description": "Resource type." },
                     { "name": "response", "$ref": "ResourceResponse", "description": "Response data." }
                 ]
             },
@@ -408,9 +487,9 @@
                 "description": "Fired when data chunk was received over the network.",
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." },
-                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." },
                     { "name": "dataLength", "type": "integer", "description": "Data chunk length." },
-                    { "name": "lengthReceived", "type": "integer", "description": "Actual bytes received (might be less than dataLength for compressed encodings)." }
+                    { "name": "encodedDataLength", "type": "integer", "description": "Actual bytes received (might be less than dataLength for compressed encodings)." }
                 ]
             },
             {
@@ -418,7 +497,7 @@
                 "description": "Fired when HTTP request has finished loading.",
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." },
-                    { "name": "finishTime", "type": "number", "description": "Timestamp." }
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." }
                 ]
             },
             {
@@ -426,8 +505,9 @@
                 "description": "Fired when HTTP request has failed to load.",
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." },
-                    { "name": "time", "type": "number", "description": "Timestamp." },
-                    { "name": "errorText", "type": "string", "description": "User friendly error message." }
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." },
+                    { "name": "errorText", "type": "string", "description": "User friendly error message." },
+                    { "name": "canceled", "type": "boolean", "optional": true, "description": "True if loading was canceled." }
                 ]
             },
             {
@@ -437,7 +517,7 @@
                     { "name": "frameId", "type": "string", "description": "Frame identifier." },
                     { "name": "loaderId", "type": "string", "description": "Loader identifier." },
                     { "name": "documentURL", "type": "string", "description": "URL of the document this resource is loaded for." },
-                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." },
                     { "name": "resource", "$ref": "CachedResource", "description": "Cached resource data." }
                 ]
             },
@@ -447,7 +527,7 @@
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." },
                     { "name": "content", "type": "string", "description": "Resource content." },
-                    { "name": "type", "type": "string", "description": "Resource type. // FIXME" }
+                    { "name": "type", "$ref": "ResourceType", "description": "Resource type." }
                 ]
             },
             {
@@ -463,7 +543,7 @@
                 "description": "Fired when WebSocket is about to initiate handshake.",
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." },
-                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." },
                     { "name": "request", "type": "object", "description": "WebSocket request data." }
                 ]
             },
@@ -472,7 +552,7 @@
                 "description": "Fired when WebSocket handshake response becomes available.",
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." },
-                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." },
                     { "name": "response", "type": "object", "description": "WebSocket response data." }
                 ]
             },
@@ -489,7 +569,7 @@
                 "description": "Fired when WebSocket is closed.",
                 "parameters": [
                     { "name": "identifier", "type": "integer", "description": "Request identifier." },
-                    { "name": "time", "type": "number", "description": "Timestamp." }
+                    { "name": "timestamp", "type": "number", "description": "Timestamp." }
                 ]
             }
         ]
@@ -499,6 +579,14 @@
         "types": [],
         "commands": [
             {
+                "name": "enable",
+                "description": "Enables database tracking, database events will now be delivered to the client."
+            },
+            {
+                "name": "disable",
+                "description": "Disables database tracking, prevents database events from being sent to the client."
+            },
+            {
                 "name": "getDatabaseTableNames",
                 "parameters": [
                     { "name": "databaseId", "type": "integer" }
@@ -553,7 +641,7 @@
                     { "name": "storageId", "type": "integer" }
                 ],
                 "returns": [
-                    { "name": "entries", "type": "array", "items": { "$ref" : "DOMStorageEntry"} }
+                    { "name": "entries", "type": "array", "items": { "$ref": "DOMStorageEntry"} }
                 ]
             },
             {
@@ -626,36 +714,36 @@
             {
                 "id": "DOMNode",
                 "type": "object",
-                "properties": {
-                    "id": { "type": "integer", "description": "Node identifier that is passed into the rest of the DOM messages as the <code>nodeId</code>. Backend will only push node with given <code>id</code> once. It is aware of all requested nodes and will only fire DOM events for nodes known to the client." },
-                    "nodeType": { "type": "integer",  "description": "<code>Node</code>'s nodeType." },
-                    "nodeName": { "type": "string", "description": "<code>Node</code>'s nodeName." },
-                    "localName": { "type": "string", "description": "<code>Node</code>'s localName." },
-                    "nodeValue": { "type": "string", "description": "<code>Node</code>'s nodeValue." },
-                    "childNodeCount": { "type": "integer", "optional": true, "description": "Child count for <code>Container</code> nodes." },
-                    "children": { "type": "array", "optional": true, "items": { "$ref" : "DOMNode" }, "description": "Child nodes of this node when requested with children." },
-                    "attributes": { "type": "array", "optional": true, "items": { "type" : "string" }, "description": "Attributes of the <code>Element</code> node in the form of flat array <code>[name1, value1, name2, value2]</code>." },
-                    "documentURL": { "type": "string", "optional": true, "description": "Document URL that <code>Document</code> or <code>FrameOwner</code> node points to." },
-                    "publicId": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s publicId. // FIXME" },
-                    "systemId": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s systemId. // FIXME" },
-                    "internalSubset": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s internalSubset. // FIXME" },
-                    "name": { "type": "string", "optional": true, "description": "<code>Attr</code>'s name. // FIXME" },
-                    "value": { "type": "string", "optional": true, "description": "<code>Attr</code>'s value. // FIXME" }
-                },
+                "properties": [
+                    { "name": "id", "type": "integer", "description": "Node identifier that is passed into the rest of the DOM messages as the <code>nodeId</code>. Backend will only push node with given <code>id</code> once. It is aware of all requested nodes and will only fire DOM events for nodes known to the client." },
+                    { "name": "nodeType", "type": "integer", "description": "<code>Node</code>'s nodeType." },
+                    { "name": "nodeName", "type": "string", "description": "<code>Node</code>'s nodeName." },
+                    { "name": "localName", "type": "string", "description": "<code>Node</code>'s localName." },
+                    { "name": "nodeValue", "type": "string", "description": "<code>Node</code>'s nodeValue." },
+                    { "name": "childNodeCount", "type": "integer", "optional": true, "description": "Child count for <code>Container</code> nodes." },
+                    { "name": "children", "type": "array", "optional": true, "items": { "$ref": "DOMNode" }, "description": "Child nodes of this node when requested with children." },
+                    { "name": "attributes", "type": "array", "optional": true, "items": { "type": "string" }, "description": "Attributes of the <code>Element</code> node in the form of flat array <code>[name1, value1, name2, value2]</code>." },
+                    { "name": "documentURL", "type": "string", "optional": true, "description": "Document URL that <code>Document</code> or <code>FrameOwner</code> node points to." },
+                    { "name": "publicId", "type": "string", "optional": true, "description": "<code>DocumentType</code>'s publicId. // FIXME" },
+                    { "name": "systemId", "type": "string", "optional": true, "description": "<code>DocumentType</code>'s systemId. // FIXME" },
+                    { "name": "internalSubset", "type": "string", "optional": true, "description": "<code>DocumentType</code>'s internalSubset. // FIXME" },
+                    { "name": "name", "type": "string", "optional": true, "description": "<code>Attr</code>'s name. // FIXME" },
+                    { "name": "value", "type": "string", "optional": true, "description": "<code>Attr</code>'s value. // FIXME" }
+                ],
                 "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
             },
             {
                 "id": "DOMEventListener",
                 "type": "object",
-                "properties": {
-                    "type": { "type": "string", "description": "<code>EventListener</code>'s type." },
-                    "useCapture": { "type": "boolean", "description": "<code>EventListener</code>'s useCapture." },
-                    "isAttribute": { "type": "boolean", "description": "<code>EventListener</code>'s isAttribute." },
-                    "nodeId": { "type": "integer",  "description": "Target <code>DOMNode</code> id." },
-                    "listenerBody": { "type": "string", "description": "Listener function body." },
-                    "sourceName": { "type": "string", "optional" : true, "description": "Handler location source name." },
-                    "lineNumber": { "type": "number", "optional" : true, "description": "Handler location line number." }
-                },
+                "properties": [
+                    { "name": "type", "type": "string", "description": "<code>EventListener</code>'s type." },
+                    { "name": "useCapture", "type": "boolean", "description": "<code>EventListener</code>'s useCapture." },
+                    { "name": "isAttribute", "type": "boolean", "description": "<code>EventListener</code>'s isAttribute." },
+                    { "name": "nodeId", "type": "integer", "description": "Target <code>DOMNode</code> id." },
+                    { "name": "listenerBody", "type": "string", "description": "Listener function body." },
+                    { "name": "sourceName", "type": "string", "optional": true, "description": "Handler location source name." },
+                    { "name": "lineNumber", "type": "number", "optional": true, "description": "Handler location line number." }
+                ],
                 "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
             }
         ],
@@ -678,11 +766,10 @@
                 "name": "querySelector",
                 "parameters": [
                     { "name": "nodeId", "type": "integer", "description": "Id of the node to query upon." },
-                    { "name": "selectors", "type": "string", "description": "Selector string." },
-                    { "name": "documentWide", "type": "boolean", "description": "Set to true to start querying from the node's document." }
+                    { "name": "selectors", "type": "string", "description": "Selector string." }
                 ],
                 "returns": [
-                    { "name": "elementId", "type": "integer", "description": "Query selector result." }
+                    { "name": "nodeId", "type": "integer", "description": "Query selector result." }
                 ],
                 "description": "Executes <code>querySelector</code> on a given node. Setting <code>documentWide</code> to true starts selecting from the document node."
             },
@@ -690,18 +777,17 @@
                 "name": "querySelectorAll",
                 "parameters": [
                     { "name": "nodeId", "type": "integer", "description": "Id of the node to query upon." },
-                    { "name": "selectors", "type": "string", "description": "Selector string." },
-                    { "name": "documentWide", "type": "boolean", "description": "Set to true to start querying from the node's document." }
+                    { "name": "selectors", "type": "string", "description": "Selector string." }
                 ],
                 "returns": [
-                    { "name": "nodeIds", "type": "array", "items": { "type": "integer" }, "description": "Query selector result."  }
+                    { "name": "nodeIds", "type": "array", "items": { "type": "integer" }, "description": "Query selector result." }
                 ],
                 "description": "Executes <code>querySelectorAll</code> on a given node. Setting <code>documentWide</code> to true starts selecting from the document node."
             },
             {
                 "name": "setNodeName",
                 "parameters": [
-                    { "name": "nodeId", "type": "integer", "description": "Id of the node to set name for."  },
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to set name for." },
                     { "name": "name", "type": "string", "description": "New node's name." }
                 ],
                 "returns": [
@@ -727,7 +813,7 @@
             {
                 "name": "setAttribute",
                 "parameters": [
-                    { "name": "elementId", "type": "integer", "description": "Id of the element to set attribute for." },
+                    { "name": "nodeId", "type": "integer", "description": "Id of the element to set attribute for." },
                     { "name": "name", "type": "string", "description": "Attribute name." },
                     { "name": "value", "type": "string", "description": "Attribute value." }
                 ],
@@ -736,7 +822,7 @@
             {
                 "name": "removeAttribute",
                 "parameters": [
-                    { "name": "elementId", "type": "integer", "description": "Id of the element to remove attribute from." },
+                    { "name": "nodeId", "type": "integer", "description": "Id of the element to remove attribute from." },
                     { "name": "name", "type": "string", "description": "Name of the attribute to remove." }
                 ],
                 "description": "Removes attribute with given name from an element with given id."
@@ -747,7 +833,7 @@
                     { "name": "nodeId", "type": "integer", "description": "Id of the node to get listeners for." }
                 ],
                 "returns": [
-                    { "name": "listenersArray", "type": "array", "items": { "$ref" : "DOMEventListener"}, "description": "Array of relevant listeners." }
+                    { "name": "listeners", "type": "array", "items": { "$ref": "DOMEventListener"}, "description": "Array of relevant listeners." }
                 ],
                 "description": "Returns event listeners relevant to the node."
             },
@@ -775,7 +861,7 @@
                     { "name": "outerHTML", "type": "string", "description": "Outer HTML markup to set." }
                 ],
                 "returns": [
-                    { "name": "outNodeId", "type": "integer", "description": "Setting outer HTML can change node's id." }
+                    { "name": "newNodeId", "type": "integer", "description": "Setting outer HTML can change node's id." }
                 ],
                 "description": "Sets node HTML markup, returns new node id."
             },
@@ -783,7 +869,7 @@
                 "name": "performSearch",
                 "parameters": [
                     { "name": "query", "type": "string", "description": "Plain text or query selector or XPath search query." },
-                    { "name": "runSynchronously", "type": "boolean", "description": "When set to true, performing search synchronously (can block user interaction)." }
+                    { "name": "runSynchronously", "type": "boolean", "optional": true, "description": "When set to true, performing search synchronously (can block user interaction)." }
                 ],
                 "description": "Starts asynchronous search for a given string in the DOM tree. Use <code>cancelSearch</code> to stop given asynchronous search task."
             },
@@ -805,9 +891,6 @@
                 "name": "setSearchingForNode",
                 "parameters": [
                     { "name": "enabled", "type": "boolean" }
-                ],
-                "returns": [
-                    { "name": "newState", "type": "boolean" }
                 ]
             },
             {
@@ -828,7 +911,6 @@
             {
                 "name": "hideFrameHighlight"
             },
-
             {
                 "name": "pushNodeByPathToFrontend",
                 "parameters": [
@@ -845,7 +927,7 @@
                     { "name": "nodeId", "type": "integer", "description": "Id of the node to resolve." }
                 ],
                 "returns": [
-                    { "name": "object", "$ref": "Object", "description": "JavaScript object wrapper for given node." }
+                    { "name": "object", "$ref": "Runtime.RemoteObject", "description": "JavaScript object wrapper for given node." }
                 ],
                 "description": "Resolves JavaScript node object for given node id."
             }
@@ -859,7 +941,7 @@
                 "name": "setChildNodes",
                 "parameters": [
                     { "name": "parentId", "type": "integer", "description": "Parent node id to populate with children." },
-                    { "name": "nodes", "type": "array", "items": { "$ref" : "DOMNode"}, "description": "Child nodes array." }
+                    { "name": "nodes", "type": "array", "items": { "$ref": "DOMNode"}, "description": "Child nodes array." }
                 ],
                 "description": "Fired when backend wants to provide client with the missing DOM structure. This happens upon most of the calls requesting node ids."
             },
@@ -867,7 +949,7 @@
                 "name": "attributesUpdated",
                 "parameters": [
                     { "name": "id", "type": "integer", "description": "Id of the node that has changed." },
-                    { "name": "attributes", "type": "array", "items": { "$ref" : "DOMAttribute"}, "description": "New attributes value." }
+                    { "name": "attributes", "type": "array", "items": { "$ref": "DOMAttribute"}, "description": "New attributes value." }
                 ],
                 "description": "Fired when <code>Element</code>'s attributes are updated."
             },
@@ -915,7 +997,140 @@
     },
     {
         "domain": "CSS",
-        "types": [],
+        "description": "This domain exposes CSS read/write operations. All CSS objects, like stylesheets, rules, and styles, have an associated <code>id</code> used in subsequent operations on the related object. Each object type has a specific <code>id</code> structure, and those are not interchangeable between objects of different kinds. CSS objects can be loaded using the <code>get*ForNode()</code> calls (which accept a DOM node id). Alternatively, a client can discover all the existing stylesheets with the <code>getAllStyleSheets()</code> method and subsequently load the required stylesheet contents using the <code>getStyleSheet[Text]()</code> methods.",
+        "types": [
+            {
+                "id": "CSSStyleId",
+                "type": "object",
+                "properties": [
+                    { "name": "styleSheetId", "type": "string", "description": "Enclosing stylesheet identifier." },
+                    { "name": "ordinal", "type": "integer", "description": "The style ordinal within the stylesheet." }
+                ],
+                "description": "This object identifies a CSS style in a unique way."
+            },
+            {
+                "id": "CSSRuleId",
+                "type": "object",
+                "properties": [
+                    { "name": "styleSheetId", "type": "string", "description": "Enclosing stylesheet identifier." },
+                    { "name": "ordinal", "type": "integer", "description": "The rule ordinal within the stylesheet." }
+                ],
+                "description": "This object identifies a CSS rule in a unique way."
+            },
+            {
+                "id": "CSSNodeStyles",
+                "type": "object",
+                "properties": [
+                    { "name": "inlineStyle", "$ref": "CSSStyle", "optional": true, "description": "The node's inline style, if any." },
+                    { "name": "computedStyle", "$ref": "CSSComputedStyle", "description": "The node's computed style." },
+                    { "name": "matchedCSSRules", "type": "array", "items": { "$ref": "CSSRule" }, "description": "CSS rules matching this node, from all applicable stylesheets." },
+                    { "name": "styleAttributes", "type": "array", "items": { "$ref": "CSSStyleAttribute" }, "description": "Entries for style-related element attributes (e.g. width=20)."},
+                    { "name": "pseudoElements", "type": "array", "items": { "$ref": "PseudoIdRules" }, "description": "Pseudo style rules for this node." },
+                    { "name": "inherited", "type": "array", "items": { "$ref": "InheritedStyleEntry" }, "description": "A chain of inherited styles (from the immediate node parent up to the DOM tree root)." }
+                ],
+                "description": "A holder for all CSS styles applicable to a particular DOM node."
+            },
+            {
+                "id": "PseudoIdRules",
+                "type": "object",
+                "properties": [
+                    { "name": "pseudoId", "type": "integer", "description": "Pseudo style identifier (see <code>enum PseudoId</code> in <code>RenderStyleConstants.h</code>)."},
+                    { "name": "rules", "type": "array", "items": { "$ref": "CSSRule" }, "description": "CSS rules applicable to the pseudo style."}
+                ],
+                "description": "CSS rule collection for a single pseudo style."
+            },
+            {
+                "id": "InheritedStyleEntry",
+                "type": "object",
+                "properties": [
+                    { "name": "inlineStyle", "$ref": "CSSStyle", "optional": true, "description": "The ancestor node's inline style, if any, in the style inheritance chain." },
+                    { "name": "matchedCSSRules", "type": "array", "items": { "$ref": "CSSRule" }, "description": "CSS rules matching the ancestor node in the style inheritance chain." }
+                ],
+                "description": "CSS rule collection for a single pseudo style."
+            },
+            {
+                "id": "CSSStyleAttribute",
+                "type": "object",
+                "properties": [
+                    { "name": "name", "type": "string", "description": "DOM attribute name (e.g. \"width\")."},
+                    { "name": "style", "$ref": "CSSStyle", "description": "CSS style generated by the respective DOM attribute."}
+                ],
+                "description": "CSS style information for a DOM style attribute."
+            },
+            {
+                "id": "CSSStyleSheetHeader",
+                "type": "object",
+                "properties": [
+                    { "name": "styleSheetId", "type": "string", "description": "The stylesheet identifier."},
+                    { "name": "sourceURL", "type": "string", "description": "Stylesheet resource URL."},
+                    { "name": "title", "type": "string", "description": "Stylesheet title."},
+                    { "name": "disabled", "type": "boolean", "description": "Denotes whether the stylesheet is disabled."}
+                ],
+                "description": "CSS stylesheet metainformation."
+            },
+            {
+                "id": "CSSStyleSheetBody",
+                "type": "object",
+                "properties": [
+                    { "name": "styleSheetId", "type": "string", "description": "The stylesheet identifier."},
+                    { "name": "rules", "type": "array", "items": { "$ref": "CSSRule" }, "description": "Stylesheet resource URL."},
+                    { "name": "text", "type": "string", "optional": true, "description": "Stylesheet resource contents (if available)."}
+                ],
+                "description": "CSS stylesheet contents."
+            },
+            {
+                "id": "CSSRule",
+                "type": "object",
+                "properties": [
+                    { "name": "ruleId", "$ref": "CSSRuleId", "description": "The CSS rule identifier."},
+                    { "name": "selectorText", "type": "string", "description": "Rule selector."},
+                    { "name": "sourceURL", "type": "string", "optional": true, "description": "Parent stylesheet resource URL (for regular rules)."},
+                    { "name": "sourceLine", "type": "integer", "description": "Line ordinal of the rule selector start character in the resource."},
+                    { "name": "origin", "type": "string", "enum": ["user", "user-agent", "inspector", ""], "description": "The parent stylesheet type: \"user\" for user stylesheets, \"user-agent\" for user-agent stylesheets, \"inspector\" for stylesheets created by the inspector (i.e. those holding new rules created with <code>addRule()</code>), \"\" for regular stylesheets."},
+                    { "name": "style", "$ref": "CSSStyle", "description": "Associated style declaration." },
+                    { "name": "selectorRange", "$ref": "SourceRange", "optional": true, "description": "The rule selector range in the underlying resource (if available)." }
+                ],
+                "description": "CSS rule representation."
+            },
+            {
+                "id": "SourceRange",
+                "type": "object",
+                "properties": [
+                    { "name": "start", "type": "integer", "description": "Start of range (inclusive)."},
+                    { "name": "end", "type": "integer", "description": "End of range (exclusive)."}
+                ],
+                "description": "Text range within a resource."
+            },
+            {
+                "id": "CSSStyle",
+                "type": "object",
+                "properties": [
+                    { "name": "styleId", "$ref": "CSSStyleId", "description": "The CSS style identifier."},
+                    { "name": "cssProperties", "type": "array", "items": { "$ref": "CSSProperty" }, "description": "CSS properties in the style."},
+                    { "name": "shorthandEntries", "type": "array", "items": { "$ref": "ShorthandEntry" }, "description": "Computed values for all shorthands found in the style." },
+                    { "name": "cssText", "type": "string", "optional": true, "description": "Style declaration text (if available)."},
+                    { "name": "range", "$ref": "SourceRange", "optional": true, "description": "Style declaration range in the enclosing stylesheet (if available)." },
+                    { "name": "width", "type": "integer", "description": "The effective \"width\" property value from this style." },
+                    { "name": "height", "type": "integer", "description": "The effective \"height\" property value from this style." }
+                ],
+                "description": "CSS style representation."
+            },
+            {
+                "id": "CSSProperty",
+                "type": "object",
+                "properties": [
+                    { "name": "name", "type": "string", "description": "The property name." },
+                    { "name": "value", "type": "string", "description": "The property value." },
+                    { "name": "priority", "type": "string", "optional": true, "description": "The property priority (implies \"\" if absent)." },
+                    { "name": "implicit", "type": "boolean", "optional": true, "description": "Whether the property is implicit (implies <code>false</code> if absent)." },
+                    { "name": "parsedOk", "type": "boolean", "optional": true, "description": "Whether the property is understood by the browser (implies <code>true</code> if absent)." },
+                    { "name": "status", "type": "string", "enum": ["active", "inactive", "disabled", "style"], "optional": true, "description": "The property status: \"active\" (implied if absent) if the property is effective in the style, \"inactive\" if the property is overridden by a same-named property in this style later on, \"disabled\" if the property is disabled by the user, \"style\" if the property is reported by the browser rather than by the CSS source parser." },
+                    { "name": "shorthandName", "type": "string", "description": "The related shorthand property name (absent if this property is not a longhand)." },
+                    { "name": "range", "$ref": "SourceRange", "optional": true, "description": "The entire property range in the enclosing style declaration (if available)." }
+                ],
+                "description": "CSS style effective visual dimensions and source offsets."
+            }
+        ],
         "commands": [
             {
                 "name": "getStylesForNode",
@@ -923,8 +1138,9 @@
                     { "name": "nodeId", "type": "integer" }
                 ],
                 "returns": [
-                    { "name": "styles", "$ref": "CSSNodeStyles" }
-                ]
+                    { "name": "styles", "$ref": "CSSNodeStyles", "description": "All styles for the specified DOM node." }
+                ],
+                "description": "Returns all styles for a DOM node identified by <code>nodeId</code>."
             },
             {
                 "name": "getComputedStyleForNode",
@@ -932,8 +1148,9 @@
                     { "name": "nodeId", "type": "integer" }
                 ],
                 "returns": [
-                    { "name": "style", "$ref": "CSSComputedStyle" }
-                ]
+                    { "name": "style", "$ref": "CSSStyle", "description": "Computed style for the specified DOM node." }
+                ],
+                "description": "Returns the computed style for a DOM node identified by <code>nodeId</code>."
             },
             {
                 "name": "getInlineStyleForNode",
@@ -941,14 +1158,16 @@
                     { "name": "nodeId", "type": "integer" }
                 ],
                 "returns": [
-                    { "name": "style", "$ref": "CSSStyle" }
-                ]
+                    { "name": "style", "$ref": "CSSStyle", "description": "Inline style for the specified DOM node." }
+                ],
+                "description": "Returns the inline style (if present) for a DOM node identified by <code>nodeId</code>."
             },
             {
                 "name": "getAllStyleSheets",
                 "returns": [
-                    { "name": "styleSheetInfos", "type": "array", "items": { "$ref": "CSSStyleSheetInfo" } }
-                ]
+                    { "name": "headers", "type": "array", "items": { "$ref": "CSSStyleSheetHeader" }, "description": "Descriptor entries for all available stylesheets." }
+                ],
+                "description": "Returns metainfo entries for all known stylesheets."
             },
             {
                 "name": "getStyleSheet",
@@ -956,8 +1175,9 @@
                     { "name": "styleSheetId", "type": "string" }
                 ],
                 "returns": [
-                    { "name": "styleSheet", "$ref": "CSSStyleSheet" }
-                ]
+                    { "name": "styleSheet", "$ref": "CSSStyleSheetBody", "description": "Stylesheet contents for the specified <code>styleSheetId</code>." }
+                ],
+                "description": "Returns stylesheet data for the specified <code>styleSheetId</code>."
             },
             {
                 "name": "getStyleSheetText",
@@ -965,9 +1185,9 @@
                     { "name": "styleSheetId", "type": "string" }
                 ],
                 "returns": [
-                    { "name": "url", "type": "string" },
-                    { "name": "text", "type": "string" }
-                ]
+                    { "name": "text", "type": "string", "description": "The stylesheet text." }
+                ],
+                "description": "Returns the current textual content and the URL for a stylesheet."
             },
             {
                 "name": "setStyleSheetText",
@@ -975,9 +1195,7 @@
                     { "name": "styleSheetId", "type": "string" },
                     { "name": "text", "type": "string" }
                 ],
-                "returns": [
-                    { "name": "success", "type": "boolean" }
-                ]
+                "description": "Sets the new stylesheet text, thereby invalidating all existing <code>CSSStyleId</code>'s and <code>CSSRuleId</code>'s contained by this stylesheet."
             },
             {
                 "name": "setPropertyText",
@@ -988,8 +1206,9 @@
                     { "name": "overwrite", "type": "boolean" }
                 ],
                 "returns": [
-                    { "name": "style", "$ref": "CSSStyle" }
-                ]
+                    { "name": "style", "$ref": "CSSStyle", "description": "The resulting style after the property text modification." }
+                ],
+                "description": "Sets the new <code>text</code> for a property in the respective style, at offset <code>propertyIndex</code>. If <code>overwrite</code> is <code>true</code>, a property at the given offset is overwritten, otherwise inserted. <code>text</code> entirely replaces the property <code>name: value</code>."
             },
             {
                 "name": "toggleProperty",
@@ -999,8 +1218,9 @@
                     { "name": "disable", "type": "boolean" }
                 ],
                 "returns": [
-                    { "name": "style", "$ref": "CSSStyle" }
-                ]
+                    { "name": "style", "$ref": "CSSStyle", "description": "The resulting style after the property toggling." }
+                ],
+                "description": "Toggles the property in the respective style, at offset <code>propertyIndex</code>. The <code>disable</code> parameter denotes whether the property should be disabled (i.e. removed from the style declaration). If <code>disable == false</code>, the property gets put back into its original place in the style declaration."
             },
             {
                 "name": "setRuleSelector",
@@ -1009,8 +1229,9 @@
                     { "name": "selector", "type": "string" }
                 ],
                 "returns": [
-                    { "name": "rule", "$ref": "CSSRule" }
-                ]
+                    { "name": "rule", "$ref": "CSSRule", "description": "The resulting rule after the selector modification." }
+                ],
+                "description": "Modifies the rule selector."
             },
             {
                 "name": "addRule",
@@ -1019,14 +1240,16 @@
                     { "name": "selector", "type": "string" }
                 ],
                 "returns": [
-                    { "name": "rule", "$ref": "CSSRule" }
-                ]
+                    { "name": "rule", "$ref": "CSSRule", "description": "The newly created rule." }
+                ],
+                "description": "Creates a new empty rule with the given <code>selector</code> in a special \"inspector\" stylesheet in the owner document of the context node."
             },
             {
                 "name": "getSupportedCSSProperties",
                 "returns": [
-                    { "name": "cssProperties", "type": "array", "items": { "type": "string" } }
-                ]
+                    { "name": "cssProperties", "type": "array", "items": { "type": "string" }, "description": "Supported property names." }
+                ],
+                "description": "Returns all supported CSS property names."
             }
         ]
     },
@@ -1037,11 +1260,11 @@
             {
                 "id": "TimelineRecord",
                 "type": "object",
-                "properties": {
-                    "type": { "type": "string", "description": "Event type." },
-                    "data": { "type": "object", "description": "Event data." },
-                    "children": { "type": "array", "optional" : true, "items": { "$ref": "TimelineRecord" }, "description": "Nested records." }
-                },
+                "properties": [
+                    { "name": "type", "type": "string", "description": "Event type." },
+                    { "name": "data", "type": "object", "description": "Event data." },
+                    { "name": "children", "type": "array", "optional": true, "items": { "$ref": "TimelineRecord" }, "description": "Nested records." }
+                ],
                 "description": "Timeline record contains information about the recorded activity."
             }
         ],
@@ -1080,25 +1303,32 @@
             {
                 "id": "Location",
                 "type": "object",
-                "properties": {
-                    "sourceID": { "type": "string",  "description": "Script identifier as reported by the <code>scriptParsed</code>" },
-                    "lineNumber": { "type": "integer", "description": "Line number in the script." },
-                    "columnNumber": { "type": "integer", "description": "Column number in the script." }
-                },
+                "properties": [
+                    { "name": "sourceID", "type": "string", "description": "Script identifier as reported by the <code>scriptParsed</code>" },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number in the script." },
+                    { "name": "columnNumber", "type": "integer", "optional": true, "description": "Column number in the script." }
+                ],
                 "description": "Location in the source code."
             },
             {
                 "id": "CallFrame",
                 "type": "object",
-                "properties": {
-                    "id": { "type": "string",  "description": "Call frame identifier" },
-                    "type": { "type": "string", "description": "Call frame type. // FIXME" },
-                    "functionName": { "type": "string", "description": "Name of the function called on this frame." },
-                    "sourceID": { "type": "string", "description": "Script identifier." },
-                    "line": { "type": "integer", "description": "Line number in the script." },
-                    "column": { "type": "integer", "description": "Column number in the script." },
-                    "scopeChain": { "type": "array", "items": { "type": "object" }, "description": "Scope chain for given call frame. // FIXME" }
-                },
+                "properties": [
+                    { "name": "id", "type": "string", "description": "Call frame identifier." },
+                    { "name": "functionName", "type": "string", "description": "Name of the function called on this frame." },
+                    { "name": "location", "$ref": "Location", "description": "Location in the source code." },
+                    { "name": "scopeChain", "type": "array", "items": { "$ref": "Scope" }, "description": "Scope chain for given call frame." }
+                ],
+                "description": "Debugger call frame. Array of call frames form call stack."
+            },
+            {
+                "id": "Scope",
+                "type": "object",
+                "properties": [
+                    { "name": "type", "type": "string", "enum": ["global", "local", "with", "closure", "catch"], "description": "Scope type." },
+                    { "name": "object", "$ref": "Runtime.RemoteObject", "description": "Object representing the scope." },
+                    { "name": "this", "$ref": "Runtime.RemoteObject", "optional": true, "description": "<code>this</code> object for local scope." }
+                ],
                 "description": "Debugger call frame. Array of call frames form call stack."
             }
         ],
@@ -1124,28 +1354,23 @@
                     { "name": "url", "type": "string", "description": "URL of the resource to set breakpoint on." },
                     { "name": "lineNumber", "type": "integer", "description": "Line number to set breakpoint at." },
                     { "name": "columnNumber", "type": "integer", "optional": true, "description": "Offset in the line to set breakpoint at." },
-                    { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." },
-                    { "name": "enabled", "type": "boolean", "optional": true, "description": "Determines initial state for the breakpoint." }
+                    { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." }
                 ],
                 "returns": [
                     { "name": "breakpointId", "type": "string", "description": "Id of the created breakpoint for further manipulations." },
-                    { "name": "locations", "type": "array", "items": { "$ref" : "Location"}, "description": "List of the locations this breakpoint resolved into."  }
+                    { "name": "locations", "optional": true, "type": "array", "items": { "$ref": "Location"}, "description": "List of the locations this breakpoint resolved into." }
                 ],
                 "description": "Sets JavaScript breakpoint at a given location specified by URL. This breakpoint will survive page reload."
             },
             {
                 "name": "setBreakpoint",
                 "parameters": [
-                    { "name": "sourceId", "type": "string", "description": "Source ID of the resource to set breakpoint on (as reported by <code>scriptParsed</code>)." },
-                    { "name": "lineNumber", "type": "integer", "description": "Line number to set breakpoint at." },
-                    { "name": "columnNumber", "type": "integer", "optional": true, "description": "Offset in the line to set breakpoint at." },
-                    { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." },
-                    { "name": "enabled", "type": "boolean", "optional": true, "description": "Determines initial state for the breakpoint." }
+                    { "name": "location", "$ref": "Location", "description": "Location to set breakpoint in." },
+                    { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." }
                 ],
                 "returns": [
                     { "name": "breakpointId", "type": "string", "description": "Id of the created breakpoint for further manipulations." },
-                    { "name": "actualLineNumber", "type": "integer", "description": "Line number in the script." },
-                    { "name": "actualColumnNumber", "type": "integer", "description": "Column number in the script." }
+                    { "name": "actualLocation", "$ref": "Location", "description": "Location this breakpoint resolved into." }
                 ],
                 "description": "Sets JavaScript breakpoint at a given location."
             },
@@ -1159,9 +1384,7 @@
             {
                 "name": "continueToLocation",
                 "parameters": [
-                    { "name": "sourceId", "type": "string", "description": "Source ID of the resource to continue to (as reported by <code>scriptParsed</code>)." },
-                    { "name": "lineNumber", "type": "integer", "description": "Line number to stop at." },
-                    { "name": "columnNumber", "type": "integer", "description": "Column number to stop at." }
+                    { "name": "location", "$ref": "Location", "description": "Location to continue to." }
                 ],
                 "description": "Continues execution until specific location is reached."
             },
@@ -1189,11 +1412,10 @@
                 "name": "editScriptSource",
                 "parameters": [
                     { "name": "sourceID", "type": "string", "description": "Id of the script to edit." },
-                    { "name": "newContent", "type": "string", "description": "New content of the script." }
+                    { "name": "scriptSource", "type": "string", "description": "New content of the script." }
                 ],
                 "returns": [
-                    { "name": "result", "type": "string", "description": "New content of the script." },
-                    { "name": "stackFrames", "type": "array", "items": { "$ref" : "CallFrame"}, "description": "New stack trace in case editing has happened while VM was stopped." }
+                    { "name": "callFrames", "type": "array", "optional": true, "items": { "$ref": "CallFrame"}, "description": "New stack trace in case editing has happened while VM was stopped." }
                 ],
                 "description": "Edits JavaScript script live."
             },
@@ -1208,9 +1430,9 @@
                 "description": "Returns source for the script with given ID."
             },
             {
-                "name": "setPauseOnExceptionsState",
+                "name": "setPauseOnExceptions",
                 "parameters": [
-                    { "name": "pauseOnExceptionsState", "type": "integer", "description": "Pause on exceptions mode. // FIXME, make enumerable." }
+                    { "name": "state", "type": "string", "enum": ["none", "uncaught", "all"], "description": "Pause on exceptions mode." }
                 ],
                 "description": "Defines pause on exceptions state. Can be set to stop on all exceptions, uncaught exceptions or no exceptions."
             },
@@ -1219,11 +1441,11 @@
                 "parameters": [
                     { "name": "callFrameId", "type": "string", "description": "Call frame identifier to evaluate on. This identifier is a part of backtrace reported by the <code>pausedScript</code>." },
                     { "name": "expression", "type": "string", "description": "Expression to evaluate." },
-                    { "name": "objectGroup", "type": "string", "description": "String object group name to put result into (allows rapid releasing resulting object handles using <code>releaseObjectGroup</code>)." },
+                    { "name": "objectGroup", "type": "string", "optional": true, "description": "String object group name to put result into (allows rapid releasing resulting object handles using <code>releaseObjectGroup</code>)." },
                     { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Specifies whether command line API should be available to the evaluated expression, defaults to false." }
                 ],
                 "returns": [
-                    { "name": "result", "$ref": "Object", "description": "Object wrapper for the evaluation result." }
+                    { "name": "result", "$ref": "Runtime.RemoteObject", "description": "Object wrapper for the evaluation result." }
                 ],
                 "description": "Evaluates expression on a given call frame."
             }
@@ -1231,11 +1453,11 @@
         "events": [
             {
                 "name": "debuggerWasEnabled",
-                "description": "Fired when debugger gets enabled."
+                "description": "Fired when debugger gets enabled (deprecated)."
             },
             {
                 "name": "debuggerWasDisabled",
-                "description": "Fired when debugger gets disabled."
+                "description": "Fired when debugger gets disabled (deprecated)."
             },
             {
                 "name": "scriptParsed",
@@ -1245,7 +1467,7 @@
                     { "name": "lineOffset", "type": "integer", "description": "Line offset of the script within the resource with given URL (for script tags)." },
                     { "name": "columnOffset", "type": "integer", "description": "Column offset of the script within the resource with given URL." },
                     { "name": "length", "type": "integer", "description": "Length of the script" },
-                    { "name": "scriptWorldType", "type": "integer", "description": "Script type. // FIXME." }
+                    { "name": "isContentScript", "type": "boolean", "optional": true, "description": "Determines whether this script is a user extension script." }
                 ],
                 "description": "Fired when virtual machine parses script. This even is also fired for all known scripts upon enabling debugger."
             },
@@ -1264,9 +1486,7 @@
                 "name": "breakpointResolved",
                 "parameters": [
                     { "name": "breakpointId", "type": "string", "description": "Breakpoint unique identifier." },
-                    { "name": "sourceId", "type": "string", "description": "Identifier of the script breakpoint is set in." },
-                    { "name": "lineNumber", "type": "integer", "description": "Line number of the statement breakpoint is set on." },
-                    { "name": "columnNumber", "type": "integer", "description": "Column offset of the statement breakpoint is set on." }
+                    { "name": "location", "$ref": "Location", "description": "Actual breakpoint location." }
                 ],
                 "description": "Fired when breakpoint is resolved to an actual script and location."
             },
@@ -1276,9 +1496,9 @@
                     { 
                         "name": "details",
                         "type": "object",
-                        "properties": {
-                            "callFrames": { "type": "array", "items": { "$ref": "CallFrame" }, "description": "Call stack the virtual machine stopped on." }
-                        },
+                        "properties": [
+                            { "name": "callFrames", "type": "array", "items": { "$ref": "CallFrame" }, "description": "Call stack the virtual machine stopped on." }
+                        ],
                         "description": "Call stack information."
                     }
                 ],
@@ -1365,7 +1585,7 @@
             {
                 "name": "getProfileHeaders",
                 "returns": [
-                    { "name": "headers", "type": "array", "items": { "$ref" : "ProfileHeader"} }
+                    { "name": "headers", "type": "array", "items": { "$ref": "ProfileHeader"} }
                 ]
             },
             {
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index beac507..0cfc5d2 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -89,6 +89,22 @@ static const char scriptsPanelName[] = "scripts";
 static const char consolePanelName[] = "console";
 static const char profilesPanelName[] = "profiles";
 
+namespace {
+
+class PageRuntimeAgent : public InspectorRuntimeAgent {
+public:
+    PageRuntimeAgent(InjectedScriptManager* injectedScriptManager, Page* page)
+        : InspectorRuntimeAgent(injectedScriptManager)
+        , m_inspectedPage(page) { }
+    virtual ~PageRuntimeAgent() { }
+
+private:
+    virtual ScriptState* getDefaultInspectedState() { return mainWorldScriptState(m_inspectedPage->mainFrame()); }
+    Page* m_inspectedPage;
+};
+
+}
+
 InspectorAgent::InspectorAgent(Page* page, InspectorClient* client, InjectedScriptManager* injectedScriptManager)
     : m_inspectedPage(page)
     , m_client(client)
@@ -100,7 +116,7 @@ InspectorAgent::InspectorAgent(Page* page, InspectorClient* client, InjectedScri
     , m_domAgent(InspectorDOMAgent::create(m_instrumentingAgents.get(), page, m_client, m_state.get(), injectedScriptManager))
     , m_cssAgent(new InspectorCSSAgent(m_instrumentingAgents.get(), m_domAgent.get()))
 #if ENABLE(DATABASE)
-    , m_databaseAgent(InspectorDatabaseAgent::create(m_instrumentingAgents.get()))
+    , m_databaseAgent(InspectorDatabaseAgent::create(m_instrumentingAgents.get(), m_state.get()))
 #endif
 #if ENABLE(DOM_STORAGE)
     , m_domStorageAgent(InspectorDOMStorageAgent::create(m_instrumentingAgents.get()))
@@ -110,6 +126,7 @@ InspectorAgent::InspectorAgent(Page* page, InspectorClient* client, InjectedScri
     , m_applicationCacheAgent(new InspectorApplicationCacheAgent(m_instrumentingAgents.get(), page))
 #endif
     , m_resourceAgent(InspectorResourceAgent::create(m_instrumentingAgents.get(), page, m_state.get()))
+    , m_runtimeAgent(adoptPtr(new PageRuntimeAgent(m_injectedScriptManager, page)))
     , m_consoleAgent(new InspectorConsoleAgent(m_instrumentingAgents.get(), this, m_state.get(), injectedScriptManager, m_domAgent.get()))
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerAgent(PageDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), page, injectedScriptManager))
@@ -162,7 +179,6 @@ void InspectorAgent::inspectedPageDestroyed()
     InspectorInstrumentation::unbindInspectorAgent(m_inspectedPage);
     m_inspectedPage = 0;
 
-    releaseFrontendLifetimeAgents();
     m_injectedScriptManager->disconnect();
 
     m_client->inspectorDestroyed();
@@ -180,6 +196,10 @@ void InspectorAgent::restoreInspectorStateFromCookie(const String& inspectorStat
     m_resourceAgent->restore();
     m_timelineAgent->restore();
 
+#if ENABLE(DATABASE)
+    m_databaseAgent->restore();
+#endif
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->restore();
     m_profilerAgent->restore();
@@ -201,7 +221,6 @@ void InspectorAgent::setFrontend(InspectorFrontend* inspectorFrontend)
     m_state->unmute();
 
     m_frontend = inspectorFrontend;
-    createFrontendLifetimeAgents();
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     m_applicationCacheAgent->setFrontend(m_frontend);
@@ -272,18 +291,6 @@ void InspectorAgent::disconnectFrontend()
     m_domStorageAgent->clearFrontend();
 #endif
     m_pageAgent->clearFrontend();
-
-    releaseFrontendLifetimeAgents();
-}
-
-void InspectorAgent::createFrontendLifetimeAgents()
-{
-    m_runtimeAgent = InspectorRuntimeAgent::create(m_injectedScriptManager, m_inspectedPage);
-}
-
-void InspectorAgent::releaseFrontendLifetimeAgents()
-{
-    m_runtimeAgent.clear();
 }
 
 void InspectorAgent::didCommitLoad()
@@ -390,17 +397,6 @@ void InspectorAgent::evaluateForTestInFrontend(long callId, const String& script
         issueEvaluateForTestCommands();
 }
 
-void InspectorAgent::didEvaluateForTestInFrontend(ErrorString*, long callId, const String& jsonResult)
-{
-    ScriptState* scriptState = scriptStateFromPage(debuggerWorld(), m_inspectedPage);
-    ScriptObject window;
-    ScriptGlobalObject::get(scriptState, "window", window);
-    ScriptFunctionCall function(window, "didEvaluateForTestInFrontend");
-    function.appendArgument(callId);
-    function.appendArgument(jsonResult);
-    function.call();
-}
-
 void InspectorAgent::setInspectorExtensionAPI(const String& source)
 {
     m_inspectorExtensionAPI = source;
diff --git a/Source/WebCore/inspector/InspectorAgent.h b/Source/WebCore/inspector/InspectorAgent.h
index cda9137..6802ad5 100644
--- a/Source/WebCore/inspector/InspectorAgent.h
+++ b/Source/WebCore/inspector/InspectorAgent.h
@@ -170,16 +170,11 @@ public:
     // InspectorAgent API
     void getInspectorState(RefPtr<InspectorObject>* state);
     void setMonitoringXHREnabled(bool enabled, bool* newState);
-    // Following are used from InspectorBackend and internally.
-    void didEvaluateForTestInFrontend(ErrorString*, long callId, const String& jsonResult);
 
 private:
     void showPanel(const String& panel);
     void unbindAllResources();
 
-    void releaseFrontendLifetimeAgents();
-    void createFrontendLifetimeAgents();
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     void toggleRecordButton(bool);
 #endif
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index 980fcf2..153c661 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -81,10 +81,11 @@
 //                          ...
 //                          #cssProperty
 //                         ],
-//    shorthandValues    : {
-//                          shorthandName1 : shorthandValue1,
-//                          shorthandName2 : shorthandValue2
-//                         },
+//    shorthandEntries   : [
+//                          #shorthandEntry,
+//                          ...
+//                          #shorthandEntry
+//                         ],
 //    cssText            : <string>, // Optional - declaration text
 //    properties         : {
 //                          width,
@@ -94,6 +95,11 @@
 //                         }
 // }
 //
+// shorthandEntry = {
+//    name: <string>,
+//    value: <string>
+// }
+//
 // cssRule = {
 //    ruleId       : <string>, // Optional
 //    selectorText : <string>,
@@ -271,33 +277,32 @@ void InspectorCSSAgent::getAllStyleSheets(ErrorString*, RefPtr<InspectorArray>*
 
 void InspectorCSSAgent::getStyleSheet(ErrorString* errorString, const String& styleSheetId, RefPtr<InspectorObject>* styleSheetObject)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
+    InspectorStyleSheet* inspectorStyleSheet = assertStyleSheetForId(errorString, styleSheetId);
     if (!inspectorStyleSheet)
         return;
 
     *styleSheetObject = inspectorStyleSheet->buildObjectForStyleSheet();
 }
 
-void InspectorCSSAgent::getStyleSheetText(ErrorString* errorString, const String& styleSheetId, String* url, String* result)
+void InspectorCSSAgent::getStyleSheetText(ErrorString* errorString, const String& styleSheetId, String* result)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
+    InspectorStyleSheet* inspectorStyleSheet = assertStyleSheetForId(errorString, styleSheetId);
     if (!inspectorStyleSheet)
         return;
-    *url = inspectorStyleSheet->finalURL();
+
     inspectorStyleSheet->text(result);
 }
 
-void InspectorCSSAgent::setStyleSheetText(ErrorString* errorString, const String& styleSheetId, const String& text, bool* success)
+void InspectorCSSAgent::setStyleSheetText(ErrorString* errorString, const String& styleSheetId, const String& text)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
-    if (!inspectorStyleSheet) {
-        *success = false;
+    InspectorStyleSheet* inspectorStyleSheet = assertStyleSheetForId(errorString, styleSheetId);
+    if (!inspectorStyleSheet)
         return;
-    }
 
-    *success = inspectorStyleSheet->setText(text);
-    if (*success)
+    if (inspectorStyleSheet->setText(text))
         inspectorStyleSheet->reparseStyleSheet(text);
+    else
+        *errorString = "Internal error setting style sheet text";
 }
 
 void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, const String& text, bool overwrite, RefPtr<InspectorObject>* result)
@@ -305,11 +310,11 @@ void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<I
     InspectorCSSId compoundId(fullStyleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = assertStyleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
-    bool success = inspectorStyleSheet->setPropertyText(compoundId, propertyIndex, text, overwrite);
+    bool success = inspectorStyleSheet->setPropertyText(errorString, compoundId, propertyIndex, text, overwrite);
     if (success)
         *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
 }
@@ -319,11 +324,11 @@ void InspectorCSSAgent::toggleProperty(ErrorString* errorString, const RefPtr<In
     InspectorCSSId compoundId(fullStyleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = assertStyleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
-    bool success = inspectorStyleSheet->toggleProperty(compoundId, propertyIndex, disable);
+    bool success = inspectorStyleSheet->toggleProperty(errorString, compoundId, propertyIndex, disable);
     if (success)
         *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
 }
@@ -333,7 +338,7 @@ void InspectorCSSAgent::setRuleSelector(ErrorString* errorString, const RefPtr<I
     InspectorCSSId compoundId(fullRuleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = assertStyleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
@@ -402,11 +407,11 @@ Element* InspectorCSSAgent::elementForId(ErrorString* errorString, int nodeId)
 {
     Node* node = m_domAgent->nodeForId(nodeId);
     if (!node) {
-        *errorString = "No node with given id found.";
+        *errorString = "No node with given id found";
         return 0;
     }
     if (node->nodeType() != Node::ELEMENT_NODE) {
-        *errorString = "Not an element node.";
+        *errorString = "Not an element node";
         return 0;
     }
     return static_cast<Element*>(node);
@@ -465,11 +470,11 @@ InspectorStyleSheet* InspectorCSSAgent::viaInspectorStyleSheet(Document* documen
     return inspectorStyleSheet.get();
 }
 
-InspectorStyleSheet* InspectorCSSAgent::styleSheetForId(ErrorString* errorString, const String& styleSheetId)
+InspectorStyleSheet* InspectorCSSAgent::assertStyleSheetForId(ErrorString* errorString, const String& styleSheetId)
 {
     IdToInspectorStyleSheet::iterator it = m_idToInspectorStyleSheet.find(styleSheetId);
     if (it == m_idToInspectorStyleSheet.end()) {
-        *errorString = "No style sheet with given id found.";
+        *errorString = "No style sheet with given id found";
         return 0;
     }
     return it->second.get();
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index 40bc2ab..c5337d6 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -66,8 +66,8 @@ public:
     void getComputedStyleForNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* style);
     void getAllStyleSheets(ErrorString*, RefPtr<InspectorArray>* styleSheetInfos);
     void getStyleSheet(ErrorString*, const String& styleSheetId, RefPtr<InspectorObject>* result);
-    void getStyleSheetText(ErrorString*, const String& styleSheetId, String* url, String* result);
-    void setStyleSheetText(ErrorString*, const String& styleSheetId, const String& text, bool* success);
+    void getStyleSheetText(ErrorString*, const String& styleSheetId, String* result);
+    void setStyleSheetText(ErrorString*, const String& styleSheetId, const String& text);
     void setPropertyText(ErrorString*, const RefPtr<InspectorObject>& styleId, int propertyIndex, const String& text, bool overwrite, RefPtr<InspectorObject>* result);
     void toggleProperty(ErrorString*, const RefPtr<InspectorObject>& styleId, int propertyIndex, bool disable, RefPtr<InspectorObject>* result);
     void setRuleSelector(ErrorString*, const RefPtr<InspectorObject>& ruleId, const String& selector, RefPtr<InspectorObject>* result);
@@ -87,7 +87,7 @@ private:
 
     InspectorStyleSheet* bindStyleSheet(CSSStyleSheet*);
     InspectorStyleSheet* viaInspectorStyleSheet(Document*, bool createIfAbsent);
-    InspectorStyleSheet* styleSheetForId(ErrorString*, const String&);
+    InspectorStyleSheet* assertStyleSheetForId(ErrorString*, const String&);
     String detectOrigin(CSSStyleSheet* pageStyleSheet, Document* ownerDocument);
 
     PassRefPtr<InspectorArray> buildArrayForRuleList(CSSRuleList* ruleList);
diff --git a/Source/WebCore/inspector/InspectorClient.h b/Source/WebCore/inspector/InspectorClient.h
index d24ce4d..551a488 100644
--- a/Source/WebCore/inspector/InspectorClient.h
+++ b/Source/WebCore/inspector/InspectorClient.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +27,7 @@
 #ifndef InspectorClient_h
 #define InspectorClient_h
 
+#include "InspectorFrontendChannel.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -34,7 +36,7 @@ class InspectorController;
 class Node;
 class Page;
 
-class InspectorClient {
+class InspectorClient : public InspectorFrontendChannel {
 public:
     virtual ~InspectorClient() { }
 
@@ -45,8 +47,6 @@ public:
     virtual void highlight(Node*) = 0;
     virtual void hideHighlight() = 0;
 
-    virtual bool sendMessageToFrontend(const String& message) = 0;
-
     // Navigation can cause some WebKit implementations to change the view / page / inspector controller instance.
     // However, there are some inspector controller states that should survive navigation (such as tracking resources
     // or recording timeline). Following callbacks allow embedders to track these states.
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.cpp b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
index 47cd2d5..53d647f 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.cpp
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
@@ -103,7 +103,7 @@ void InspectorConsoleAgent::clearConsoleMessages(ErrorString*)
     m_injectedScriptManager->releaseObjectGroup("console");
     m_inspectorDOMAgent->releaseDanglingNodes();
     if (m_frontend)
-        m_frontend->consoleMessagesCleared();
+        m_frontend->messagesCleared();
 }
 
 void InspectorConsoleAgent::reset()
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index 62b22ee..d9b9773 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -55,7 +55,7 @@
 namespace WebCore {
 
 InspectorController::InspectorController(Page* page, InspectorClient* inspectorClient)
-    : m_injectedScriptManager(InjectedScriptManager::create())
+    : m_injectedScriptManager(InjectedScriptManager::createForPage())
     , m_inspectorAgent(new InspectorAgent(page, inspectorClient, m_injectedScriptManager.get()))
     , m_inspectorClient(inspectorClient)
     , m_openingFrontend(false)
@@ -132,7 +132,6 @@ void InspectorController::connectFrontend()
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         m_inspectorAgent->debuggerAgent(),
 #endif
-        m_inspectorAgent.get(),
         m_inspectorAgent->resourceAgent(),
         m_inspectorAgent->pageAgent(),
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -255,6 +254,11 @@ void InspectorController::hideHighlight()
     m_inspectorAgent->domAgent()->hideHighlight(&error);
 }
 
+Node* InspectorController::highlightedNode() const
+{
+    return m_inspectorAgent->domAgent()->highlightedNode();
+}
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 void InspectorController::enableProfiler()
 {
diff --git a/Source/WebCore/inspector/InspectorController.h b/Source/WebCore/inspector/InspectorController.h
index f38eb3d..b97373e 100644
--- a/Source/WebCore/inspector/InspectorController.h
+++ b/Source/WebCore/inspector/InspectorController.h
@@ -80,6 +80,7 @@ public:
     void inspect(Node*);
     void drawNodeHighlight(GraphicsContext&) const;
     void hideHighlight();
+    Node* highlightedNode() const;
 
     void evaluateForTestInFrontend(long callId, const String& script);
 
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 06c5977..cb761d0 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009-2011 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
@@ -397,7 +397,7 @@ Node* InspectorDOMAgent::assertNode(ErrorString* errorString, int nodeId)
 {
     Node* node = nodeForId(nodeId);
     if (!node) {
-        *errorString = "Could not find node with given id.";
+        *errorString = "Could not find node with given id";
         return 0;
     }
     return node;
@@ -410,7 +410,7 @@ Element* InspectorDOMAgent::assertElement(ErrorString* errorString, int nodeId)
         return 0;
 
     if (node->nodeType() != Node::ELEMENT_NODE) {
-        *errorString = "Node is not an Element.";
+        *errorString = "Node is not an Element";
         return 0;
     }
     return toElement(node);
@@ -424,30 +424,12 @@ HTMLElement* InspectorDOMAgent::assertHTMLElement(ErrorString* errorString, int
         return 0;
 
     if (!element->isHTMLElement()) {
-        *errorString = "Node is not an HTML Element.";
+        *errorString = "Node is not an HTML Element";
         return 0;
     }
     return toHTMLElement(element);
 }
 
-Node* InspectorDOMAgent::nodeToSelectOn(ErrorString* errorString, int nodeId, bool documentWide)
-{
-    Node* node;
-    if (!nodeId) {
-        node = m_document.get();
-        if (!node)
-            *errorString = "No document to query on.";
-    } else
-        node = assertNode(errorString, nodeId);
-
-    if (!node)
-        return 0;
-
-    if (documentWide && nodeId)
-        node = node->ownerDocument();
-    return node;
-}
-
 void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>* root)
 {
     m_inspectorState->setBoolean(DOMAgentState::documentRequested, true);
@@ -460,8 +442,7 @@ void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>* root)
     reset();
     m_document = doc;
 
-    if (!m_documentNodeToIdMap.contains(m_document))
-        *root = buildObjectForNode(m_document.get(), 2, &m_documentNodeToIdMap);
+    *root = buildObjectForNode(m_document.get(), 2, &m_documentNodeToIdMap);
 }
 
 void InspectorDOMAgent::pushChildNodesToFrontend(int nodeId)
@@ -474,7 +455,6 @@ void InspectorDOMAgent::pushChildNodesToFrontend(int nodeId)
 
     NodeToIdMap* nodeMap = m_idToNodesMap.get(nodeId);
     RefPtr<InspectorArray> children = buildArrayForContainerChildren(node, 1, nodeMap);
-    m_childrenRequested.add(nodeId);
     m_frontend->setChildNodes(nodeId, children.release());
 }
 
@@ -502,17 +482,17 @@ void InspectorDOMAgent::getChildNodes(ErrorString*, int nodeId)
     pushChildNodesToFrontend(nodeId);
 }
 
-void InspectorDOMAgent::querySelector(ErrorString* errorString, int nodeId, const String& selectors, bool documentWide, int* elementId)
+void InspectorDOMAgent::querySelector(ErrorString* errorString, int nodeId, const String& selectors, int* elementId)
 {
     *elementId = 0;
-    Node* node = nodeToSelectOn(errorString, nodeId, documentWide);
+    Node* node = assertNode(errorString, nodeId);
     if (!node)
         return;
 
     ExceptionCode ec = 0;
     RefPtr<Element> element = node->querySelector(selectors, ec);
     if (ec) {
-        *errorString = "DOM Error while querying.";
+        *errorString = "DOM Error while querying";
         return;
     }
 
@@ -520,16 +500,16 @@ void InspectorDOMAgent::querySelector(ErrorString* errorString, int nodeId, cons
         *elementId = pushNodePathToFrontend(element.get());
 }
 
-void InspectorDOMAgent::querySelectorAll(ErrorString* errorString, int nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result)
+void InspectorDOMAgent::querySelectorAll(ErrorString* errorString, int nodeId, const String& selectors, RefPtr<InspectorArray>* result)
 {
-    Node* node = nodeToSelectOn(errorString, nodeId, documentWide);
+    Node* node = assertNode(errorString, nodeId);
     if (!node)
         return;
 
     ExceptionCode ec = 0;
     RefPtr<NodeList> nodes = node->querySelectorAll(selectors, ec);
     if (ec) {
-        *errorString = "DOM Error while querying.";
+        *errorString = "DOM Error while querying";
         return;
     }
 
@@ -595,7 +575,7 @@ void InspectorDOMAgent::setAttribute(ErrorString* errorString, int elementId, co
         ExceptionCode ec = 0;
         element->setAttribute(name, value, ec);
         if (ec)
-            *errorString = "Exception while setting attribute value.";
+            *errorString = "Exception while setting attribute value";
     }
 }
 
@@ -606,7 +586,7 @@ void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId,
         ExceptionCode ec = 0;
         element->removeAttribute(name, ec);
         if (ec)
-            *errorString = "Exception while removing attribute.";
+            *errorString = "Exception while removing attribute";
     }
 }
 
@@ -618,14 +598,14 @@ void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
 
     ContainerNode* parentNode = node->parentNode();
     if (!parentNode) {
-        *errorString = "Can not remove detached node.";
+        *errorString = "Can not remove detached node";
         return;
     }
 
     ExceptionCode ec = 0;
     parentNode->removeChild(node, ec);
     if (ec)
-        *errorString = "Could not remove node due to DOM exception.";
+        *errorString = "Could not remove node due to DOM exception";
 }
 
 void InspectorDOMAgent::setNodeName(ErrorString*, int nodeId, const String& tagName, int* newId)
@@ -716,7 +696,7 @@ void InspectorDOMAgent::setNodeValue(ErrorString* errorString, int nodeId, const
         return;
 
     if (node->nodeType() != Node::TEXT_NODE) {
-        *errorString = "Can only set value of text nodes.";
+        *errorString = "Can only set value of text nodes";
         return;
     }
 
@@ -724,7 +704,7 @@ void InspectorDOMAgent::setNodeValue(ErrorString* errorString, int nodeId, const
     ExceptionCode ec = 0;
     textNode->replaceWholeText(value, ec);
     if (ec)
-        *errorString = "DOM Error while setting the node value.";
+        *errorString = "DOM Error while setting the node value";
 }
 
 void InspectorDOMAgent::getEventListenersForNode(ErrorString*, int nodeId, RefPtr<InspectorArray>* listenersArray)
@@ -794,7 +774,7 @@ void InspectorDOMAgent::getEventListenersForNode(ErrorString*, int nodeId, RefPt
     }
 }
 
-void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespaceTrimmedQuery, bool runSynchronously)
+void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespaceTrimmedQuery, const bool* const runSynchronously)
 {
     // FIXME: Few things are missing here:
     // 1) Search works with node granularity - number of matches within node is not calculated.
@@ -869,7 +849,7 @@ void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespa
         m_pendingMatchJobs.append(new MatchXPathJob(document, whitespaceTrimmedQuery));
     }
 
-    if (runSynchronously) {
+    if (runSynchronously && *runSynchronously) {
         // For tests.
         ListHashSet<Node*> resultCollector;
         for (Deque<MatchJob*>::iterator it = m_pendingMatchJobs.begin(); it != m_pendingMatchJobs.end(); ++it)
@@ -961,9 +941,8 @@ void InspectorDOMAgent::setSearchingForNode(bool enabled)
     }
 }
 
-void InspectorDOMAgent::setSearchingForNode(ErrorString*, bool enabled, bool* newState)
+void InspectorDOMAgent::setSearchingForNode(ErrorString*, bool enabled)
 {
-    *newState = enabled;
     setSearchingForNode(enabled);
 }
 
@@ -1108,14 +1087,15 @@ PassRefPtr<InspectorArray> InspectorDOMAgent::buildArrayForContainerChildren(Nod
     Node* child = innerFirstChild(container);
 
     if (depth == 0) {
-        // Special case the_only text child.
+        // Special-case the only text child - pretend that container's children have been requested.
         if (child && child->nodeType() == Node::TEXT_NODE && !innerNextSibling(child))
-            children->pushObject(buildObjectForNode(child, 0, nodesMap));
+            return buildArrayForContainerChildren(container, 1, nodesMap);
         return children.release();
-    } else if (depth > 0) {
-        depth--;
     }
 
+    depth--;
+    m_childrenRequested.add(bind(container, nodesMap));
+
     while (child) {
         children->pushObject(buildObjectForNode(child, depth, nodesMap));
         child = innerNextSibling(child);
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index 8aeb66b..526bf34 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009-2011 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -111,8 +111,8 @@ public:
     void reset();
 
     // Methods called from the frontend for DOM nodes inspection.
-    void querySelector(ErrorString*, int nodeId, const String& selectors, bool documentWide, int* elementId);
-    void querySelectorAll(ErrorString*, int nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result);
+    void querySelector(ErrorString*, int nodeId, const String& selectors, int* elementId);
+    void querySelectorAll(ErrorString*, int nodeId, const String& selectors, RefPtr<InspectorArray>* result);
     void getDocument(ErrorString*, RefPtr<InspectorObject>* root);
     void getChildNodes(ErrorString*, int nodeId);
     void setAttribute(ErrorString*, int elementId, const String& name, const String& value);
@@ -123,10 +123,10 @@ public:
     void setOuterHTML(ErrorString*, int nodeId, const String& outerHTML, int* newId);
     void setNodeValue(ErrorString*, int nodeId, const String& value);
     void getEventListenersForNode(ErrorString*, int nodeId, RefPtr<InspectorArray>* listenersArray);
-    void performSearch(ErrorString*, const String& whitespaceTrimmedQuery, bool runSynchronously);
+    void performSearch(ErrorString*, const String& whitespaceTrimmedQuery, const bool* const runSynchronously);
     void cancelSearch(ErrorString*);
     void resolveNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* result);
-    void setSearchingForNode(ErrorString*, bool enabled, bool* newState);
+    void setSearchingForNode(ErrorString*, bool enabled);
     void pushNodeToFrontend(ErrorString*, const String& objectId, int* nodeId);
     void pushNodeByPathToFrontend(ErrorString*, const String& path, int* nodeId);
     void hideHighlight(ErrorString*);
@@ -134,6 +134,7 @@ public:
     void hideDOMNodeHighlight(ErrorString* error) { hideHighlight(error); }
     void highlightFrame(ErrorString*, const String& frameId);
     void hideFrameHighlight(ErrorString* error) { hideHighlight(error); }
+    Node* highlightedNode() const { return m_highlightedNode.get(); }
 
     // Methods called from the InspectorInstrumentation.
     void setDocument(Document*);
@@ -186,7 +187,6 @@ private:
     Node* assertNode(ErrorString*, int nodeId);
     Element* assertElement(ErrorString*, int nodeId);
     HTMLElement* assertHTMLElement(ErrorString*, int nodeId);
-    Node* nodeToSelectOn(ErrorString*, int nodeId, bool documentWide);
 
     int pushNodePathToFrontend(Node*);
     void pushChildNodesToFrontend(int nodeId);
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
index 7f6e379..03d8482 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
@@ -36,6 +36,7 @@
 #include "ExceptionCode.h"
 #include "InspectorDatabaseResource.h"
 #include "InspectorFrontend.h"
+#include "InspectorState.h"
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
 #include "SQLError.h"
@@ -52,6 +53,10 @@
 
 namespace WebCore {
 
+namespace DatabaseAgentState {
+static const char databaseAgentEnabled[] = "databaseAgentEnabled";
+};
+
 class InspectorDatabaseAgent::FrontendProvider : public RefCounted<InspectorDatabaseAgent::FrontendProvider> {
 public:
     static PassRefPtr<FrontendProvider> create(InspectorFrontend* inspectorFrontend)
@@ -220,10 +225,15 @@ private:
 
 void InspectorDatabaseAgent::didOpenDatabase(PassRefPtr<Database> database, const String& domain, const String& name, const String& version)
 {
+    if (InspectorDatabaseResource* resource = findByFileName(database->fileName())) {
+        resource->setDatabase(database);
+        return;
+    }
+
     RefPtr<InspectorDatabaseResource> resource = InspectorDatabaseResource::create(database, domain, name, version);
     m_resources.set(resource->id(), resource);
     // Resources are only bound while visible.
-    if (m_frontendProvider)
+    if (m_frontendProvider && m_enabled)
         resource->bind(m_frontendProvider->frontend());
 }
 
@@ -232,8 +242,10 @@ void InspectorDatabaseAgent::clearResources()
     m_resources.clear();
 }
 
-InspectorDatabaseAgent::InspectorDatabaseAgent(InstrumentingAgents* instrumentingAgents)
+InspectorDatabaseAgent::InspectorDatabaseAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state)
     : m_instrumentingAgents(instrumentingAgents)
+    , m_inspectorState(state)
+    , m_enabled(false)
 {
     m_instrumentingAgents->setInspectorDatabaseAgent(this);
 }
@@ -246,19 +258,47 @@ InspectorDatabaseAgent::~InspectorDatabaseAgent()
 void InspectorDatabaseAgent::setFrontend(InspectorFrontend* frontend)
 {
     m_frontendProvider = FrontendProvider::create(frontend);
-    DatabaseResourcesMap::iterator databasesEnd = m_resources.end();
-    for (DatabaseResourcesMap::iterator it = m_resources.begin(); it != databasesEnd; ++it)
-        it->second->bind(m_frontendProvider->frontend());
 }
 
 void InspectorDatabaseAgent::clearFrontend()
 {
     m_frontendProvider->clearFrontend();
     m_frontendProvider.clear();
+    disable(0);
+}
+
+void InspectorDatabaseAgent::enable(ErrorString*)
+{
+    if (m_enabled)
+        return;
+    m_enabled = true;
+    m_inspectorState->setBoolean(DatabaseAgentState::databaseAgentEnabled, m_enabled);
+
+    DatabaseResourcesMap::iterator databasesEnd = m_resources.end();
+    for (DatabaseResourcesMap::iterator it = m_resources.begin(); it != databasesEnd; ++it)
+        it->second->bind(m_frontendProvider->frontend());
 }
 
-void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString*, int databaseId, RefPtr<InspectorArray>* names)
+void InspectorDatabaseAgent::disable(ErrorString*)
 {
+    if (!m_enabled)
+        return;
+    m_enabled = false;
+    m_inspectorState->setBoolean(DatabaseAgentState::databaseAgentEnabled, m_enabled);
+}
+
+void InspectorDatabaseAgent::restore()
+{
+    m_enabled =  m_inspectorState->getBoolean(DatabaseAgentState::databaseAgentEnabled);
+}
+
+void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString* error, int databaseId, RefPtr<InspectorArray>* names)
+{
+    if (!m_enabled) {
+        *error = "Database agent is not enabled";
+        return;
+    }
+
     Database* database = databaseForId(databaseId);
     if (database) {
         Vector<String> tableNames = database->tableNames();
@@ -268,8 +308,13 @@ void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString*, int databaseId,
     }
 }
 
-void InspectorDatabaseAgent::executeSQL(ErrorString*, int databaseId, const String& query, bool* success, int* transactionId)
+void InspectorDatabaseAgent::executeSQL(ErrorString* error, int databaseId, const String& query, bool* success, int* transactionId)
 {
+    if (!m_enabled) {
+        *error = "Database agent is not enabled";
+        return;
+    }
+
     Database* database = databaseForId(databaseId);
     if (!database) {
         *success = false;
@@ -293,6 +338,15 @@ int InspectorDatabaseAgent::databaseId(Database* database)
     return 0;
 }
 
+InspectorDatabaseResource* InspectorDatabaseAgent::findByFileName(const String& fileName)
+{
+    for (DatabaseResourcesMap::iterator it = m_resources.begin(); it != m_resources.end(); ++it) {
+        if (it->second->database()->fileName() == fileName)
+            return it->second.get();
+    }
+    return 0;
+}
+
 Database* InspectorDatabaseAgent::databaseForId(int databaseId)
 {
     DatabaseResourcesMap::iterator it = m_resources.find(databaseId);
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.h b/Source/WebCore/inspector/InspectorDatabaseAgent.h
index 45fbfa4..354a6cd 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.h
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.h
@@ -39,6 +39,7 @@ class Database;
 class InspectorArray;
 class InspectorDatabaseResource;
 class InspectorFrontend;
+class InspectorState;
 class InstrumentingAgents;
 
 typedef String ErrorString;
@@ -47,9 +48,9 @@ class InspectorDatabaseAgent {
 public:
     class FrontendProvider;
 
-    static PassOwnPtr<InspectorDatabaseAgent> create(InstrumentingAgents* instrumentingAgents)
+    static PassOwnPtr<InspectorDatabaseAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state)
     {
-        return adoptPtr(new InspectorDatabaseAgent(instrumentingAgents));
+        return adoptPtr(new InspectorDatabaseAgent(instrumentingAgents, state));
     }
     ~InspectorDatabaseAgent();
 
@@ -57,8 +58,11 @@ public:
     void clearFrontend();
 
     void clearResources();
+    void restore();
 
     // Called from the front-end.
+    void enable(ErrorString*);
+    void disable(ErrorString*);
     void getDatabaseTableNames(ErrorString*, int databaseId, RefPtr<InspectorArray>* names);
     void executeSQL(ErrorString*, int databaseId, const String& query, bool* success, int* transactionId);
 
@@ -67,14 +71,17 @@ public:
 
     void didOpenDatabase(PassRefPtr<Database>, const String& domain, const String& name, const String& version);
 private:
-    explicit InspectorDatabaseAgent(InstrumentingAgents*);
+    explicit InspectorDatabaseAgent(InstrumentingAgents*, InspectorState*);
 
     Database* databaseForId(int databaseId);
+    InspectorDatabaseResource* findByFileName(const String& fileName);
 
     InstrumentingAgents* m_instrumentingAgents;
+    InspectorState* m_inspectorState;
     typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
     DatabaseResourcesMap m_resources;
     RefPtr<FrontendProvider> m_frontendProvider;
+    bool m_enabled;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDatabaseResource.h b/Source/WebCore/inspector/InspectorDatabaseResource.h
index 9fa7ebd..281568c 100644
--- a/Source/WebCore/inspector/InspectorDatabaseResource.h
+++ b/Source/WebCore/inspector/InspectorDatabaseResource.h
@@ -48,6 +48,7 @@ public:
 
     void bind(InspectorFrontend::Database*);
     Database* database() { return m_database.get(); }
+    void setDatabase(PassRefPtr<Database> database) { m_database = database; }
     int id() const { return m_id; }
 
 private:
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index 56bc7b7..70b07bc 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -141,46 +141,71 @@ void InspectorDebuggerAgent::inspectedURLChanged(const String&)
     m_breakpointIdToDebugServerBreakpointIds.clear();
 }
 
-void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString*, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, RefPtr<InspectorArray>* locations)
+static PassRefPtr<InspectorObject> buildObjectForBreakpointCookie(const String& url, int lineNumber, int columnNumber, const String& condition)
 {
-    String breakpointId = makeString(url, ":", String::number(lineNumber), ":", String::number(columnNumber));
-    RefPtr<InspectorObject> breakpointsCookie = m_inspectorState->getObject(DebuggerAgentState::javaScriptBreakpoints);
-    if (breakpointsCookie->find(breakpointId) != breakpointsCookie->end())
-        return;
     RefPtr<InspectorObject> breakpointObject = InspectorObject::create();
     breakpointObject->setString("url", url);
     breakpointObject->setNumber("lineNumber", lineNumber);
     breakpointObject->setNumber("columnNumber", columnNumber);
     breakpointObject->setString("condition", condition);
-    breakpointObject->setBoolean("enabled", enabled);
-    breakpointsCookie->setObject(breakpointId, breakpointObject);
+    return breakpointObject;
+}
+
+void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString*, const String& url, int lineNumber, const int* const optionalColumnNumber, const String* const optionalCondition, String* outBreakpointId, RefPtr<InspectorArray>* locations)
+{
+    int columnNumber = optionalColumnNumber ? *optionalColumnNumber : 0;
+    String condition = optionalCondition ? *optionalCondition : "";
+
+    String breakpointId = makeString(url, ":", String::number(lineNumber), ":", String::number(columnNumber));
+    RefPtr<InspectorObject> breakpointsCookie = m_inspectorState->getObject(DebuggerAgentState::javaScriptBreakpoints);
+    if (breakpointsCookie->find(breakpointId) != breakpointsCookie->end())
+        return;
+    breakpointsCookie->setObject(breakpointId, buildObjectForBreakpointCookie(url, lineNumber, columnNumber, condition));
     m_inspectorState->setObject(DebuggerAgentState::javaScriptBreakpoints, breakpointsCookie);
 
-    ScriptBreakpoint breakpoint(lineNumber, columnNumber, condition, enabled);
+    ScriptBreakpoint breakpoint(lineNumber, columnNumber, condition);
     for (ScriptsMap::iterator it = m_scripts.begin(); it != m_scripts.end(); ++it) {
         if (it->second.url != url)
             continue;
-        int actualLineNumber = 0, actualColumnNumber = 0;
-        if (!resolveBreakpoint(breakpointId, it->first, breakpoint, &actualLineNumber, &actualColumnNumber))
-            continue;
-        RefPtr<InspectorObject> location = InspectorObject::create();
-        location->setString("sourceID", it->first);
-        location->setNumber("lineNumber", actualLineNumber);
-        location->setNumber("columnNumber", actualColumnNumber);
-        locations->get()->pushObject(location);
+        RefPtr<InspectorObject> location = resolveBreakpoint(breakpointId, it->first, breakpoint);
+        if (location)
+            (*locations)->pushObject(location);
     }
     *outBreakpointId = breakpointId;
 }
 
-void InspectorDebuggerAgent::setBreakpoint(ErrorString*, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, int* actualLineNumber, int* actualColumnNumber)
+static bool parseLocation(ErrorString* errorString, RefPtr<InspectorObject> location, String* sourceId, int* lineNumber, int* columnNumber)
+{
+    if (!location->getString("sourceID", sourceId) || !location->getNumber("lineNumber", lineNumber)) {
+        // FIXME: replace with input validation.
+        *errorString = "sourceId and lineNumber are required.";
+        return false;
+    }
+    *columnNumber = 0;
+    location->getNumber("columnNumber", columnNumber);
+    return true;
+}
+
+void InspectorDebuggerAgent::setBreakpoint(ErrorString* errorString, PassRefPtr<InspectorObject> location, const String* const optionalCondition, String* outBreakpointId, RefPtr<InspectorObject>* actualLocation)
 {
+    String sourceId;
+    int lineNumber;
+    int columnNumber;
+
+    if (!parseLocation(errorString, location, &sourceId, &lineNumber, &columnNumber))
+        return;
+
+    String condition = optionalCondition ? *optionalCondition : "";
+
     String breakpointId = makeString(sourceId, ":", String::number(lineNumber), ":", String::number(columnNumber));
     if (m_breakpointIdToDebugServerBreakpointIds.find(breakpointId) != m_breakpointIdToDebugServerBreakpointIds.end())
         return;
-    ScriptBreakpoint breakpoint(lineNumber, columnNumber, condition, enabled);
-    if (!resolveBreakpoint(breakpointId, sourceId, breakpoint, actualLineNumber, actualColumnNumber))
-        return;
-    *outBreakpointId = breakpointId;
+    ScriptBreakpoint breakpoint(lineNumber, columnNumber, condition);
+    *actualLocation = resolveBreakpoint(breakpointId, sourceId, breakpoint);
+    if (*actualLocation)
+        *outBreakpointId = breakpointId;
+    else
+        *errorString = "Could not resolve breakpoint";
 }
 
 void InspectorDebuggerAgent::removeBreakpoint(ErrorString*, const String& breakpointId)
@@ -197,25 +222,33 @@ void InspectorDebuggerAgent::removeBreakpoint(ErrorString*, const String& breakp
     m_breakpointIdToDebugServerBreakpointIds.remove(debugServerBreakpointIdsIterator);
 }
 
-void InspectorDebuggerAgent::continueToLocation(ErrorString* error, const String& sourceId, int lineNumber, int columnNumber)
+void InspectorDebuggerAgent::continueToLocation(ErrorString* errorString, PassRefPtr<InspectorObject> location)
 {
     if (!m_continueToLocationBreakpointId.isEmpty()) {
         scriptDebugServer().removeBreakpoint(m_continueToLocationBreakpointId);
         m_continueToLocationBreakpointId = "";
     }
-    ScriptBreakpoint breakpoint(lineNumber, columnNumber, "", true);
+
+    String sourceId;
+    int lineNumber;
+    int columnNumber;
+
+    if (!parseLocation(errorString, location, &sourceId, &lineNumber, &columnNumber))
+        return;
+
+    ScriptBreakpoint breakpoint(lineNumber, columnNumber, "");
     m_continueToLocationBreakpointId = scriptDebugServer().setBreakpoint(sourceId, breakpoint, &lineNumber, &columnNumber);
-    resume(error);
+    resume(errorString);
 }
 
-bool InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const String& sourceId, const ScriptBreakpoint& breakpoint, int* actualLineNumber, int* actualColumnNumber)
+PassRefPtr<InspectorObject> InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const String& sourceId, const ScriptBreakpoint& breakpoint)
 {
     ScriptsMap::iterator scriptIterator = m_scripts.find(sourceId);
     if (scriptIterator == m_scripts.end())
-        return false;
+        return 0;
     Script& script = scriptIterator->second;
     if (breakpoint.lineNumber < script.lineOffset)
-        return false;
+        return 0;
     if (!script.linesCount) {
         script.linesCount = 1;
         for (size_t i = 0; i < script.data.length(); ++i) {
@@ -224,28 +257,30 @@ bool InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const
         }
     }
     if (breakpoint.lineNumber >= script.lineOffset + script.linesCount)
-        return false;
+        return 0;
 
-    String debugServerBreakpointId = scriptDebugServer().setBreakpoint(sourceId, breakpoint, actualLineNumber, actualColumnNumber);
+    int actualLineNumber;
+    int actualColumnNumber;
+    String debugServerBreakpointId = scriptDebugServer().setBreakpoint(sourceId, breakpoint, &actualLineNumber, &actualColumnNumber);
     if (debugServerBreakpointId.isEmpty())
-        return false;
+        return 0;
 
     BreakpointIdToDebugServerBreakpointIdsMap::iterator debugServerBreakpointIdsIterator = m_breakpointIdToDebugServerBreakpointIds.find(breakpointId);
     if (debugServerBreakpointIdsIterator == m_breakpointIdToDebugServerBreakpointIds.end())
         debugServerBreakpointIdsIterator = m_breakpointIdToDebugServerBreakpointIds.set(breakpointId, Vector<String>()).first;
     debugServerBreakpointIdsIterator->second.append(debugServerBreakpointId);
 
-    return true;
+    RefPtr<InspectorObject> location = InspectorObject::create();
+    location->setString("sourceID", sourceId);
+    location->setNumber("lineNumber", actualLineNumber);
+    location->setNumber("columnNumber", actualColumnNumber);
+    return location;
 }
 
-void InspectorDebuggerAgent::editScriptSource(ErrorString* errorString, const String& sourceID, const String& newContent, String* result, RefPtr<InspectorArray>* newCallFrames)
+void InspectorDebuggerAgent::editScriptSource(ErrorString* error, const String& sourceID, const String& newContent, RefPtr<InspectorArray>* newCallFrames)
 {
-    String editResult;
-    if (scriptDebugServer().editScriptSource(sourceID, newContent, editResult)) {
+    if (scriptDebugServer().editScriptSource(sourceID, newContent, error))
         *newCallFrames = currentCallFrames();
-        *result = editResult;
-    } else
-        *errorString = editResult;
 }
 
 void InspectorDebuggerAgent::getScriptSource(ErrorString*, const String& sourceID, String* scriptSource)
@@ -279,6 +314,7 @@ void InspectorDebuggerAgent::pause(ErrorString*)
 
 void InspectorDebuggerAgent::resume(ErrorString*)
 {
+    m_injectedScriptManager->releaseObjectGroup("backtrace");
     scriptDebugServer().continueProgram();
 }
 
@@ -297,18 +333,29 @@ void InspectorDebuggerAgent::stepOut(ErrorString*)
     scriptDebugServer().stepOutOfFunction();
 }
 
-void InspectorDebuggerAgent::setPauseOnExceptionsState(ErrorString* errorString, int pauseState)
+void InspectorDebuggerAgent::setPauseOnExceptions(ErrorString* errorString, const String& stringPauseState)
 {
+    ScriptDebugServer::PauseOnExceptionsState pauseState;
+    if (stringPauseState == "none")
+        pauseState = ScriptDebugServer::DontPauseOnExceptions;
+    else if (stringPauseState == "all")
+        pauseState = ScriptDebugServer::PauseOnAllExceptions;
+    else if (stringPauseState == "uncaught")
+        pauseState = ScriptDebugServer::PauseOnUncaughtExceptions;
+    else {
+        *errorString = "Unknown pause on exceptions mode: " + stringPauseState;
+        return;
+    }
     scriptDebugServer().setPauseOnExceptionsState(static_cast<ScriptDebugServer::PauseOnExceptionsState>(pauseState));
     if (scriptDebugServer().pauseOnExceptionsState() != pauseState)
-        *errorString = "Internal error. Could not change pause on exceptions state.";
+        *errorString = "Internal error. Could not change pause on exceptions state";
 }
 
-void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
+void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(callFrameId);
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluateOnCallFrame(errorString, callFrameId, expression, objectGroup, includeCommandLineAPI, result);
+        injectedScript.evaluateOnCallFrame(errorString, callFrameId, expression, objectGroup ? *objectGroup : "", includeCommandLineAPI ? *includeCommandLineAPI : false, result);
 }
 
 PassRefPtr<InspectorArray> InspectorDebuggerAgent::currentCallFrames()
@@ -325,10 +372,10 @@ PassRefPtr<InspectorArray> InspectorDebuggerAgent::currentCallFrames()
 
 // JavaScriptDebugListener functions
 
-void InspectorDebuggerAgent::didParseSource(const String& sourceID, const String& url, const String& data, int lineOffset, int columnOffset, ScriptWorldType worldType)
+void InspectorDebuggerAgent::didParseSource(const String& sourceID, const String& url, const String& data, int lineOffset, int columnOffset, bool isContentScript)
 {
     // Don't send script content to the front end until it's really needed.
-    m_frontend->scriptParsed(sourceID, url, lineOffset, columnOffset, data.length(), worldType);
+    m_frontend->scriptParsed(sourceID, url, lineOffset, columnOffset, data.length(), isContentScript);
 
     m_scripts.set(sourceID, Script(url, data, lineOffset, columnOffset));
 
@@ -346,10 +393,9 @@ void InspectorDebuggerAgent::didParseSource(const String& sourceID, const String
         breakpointObject->getNumber("lineNumber", &breakpoint.lineNumber);
         breakpointObject->getNumber("columnNumber", &breakpoint.columnNumber);
         breakpointObject->getString("condition", &breakpoint.condition);
-        breakpointObject->getBoolean("enabled", &breakpoint.enabled);
-        int actualLineNumber = 0, actualColumnNumber = 0;
-        if (resolveBreakpoint(it->first, sourceID, breakpoint, &actualLineNumber, &actualColumnNumber))
-            m_frontend->breakpointResolved(it->first, sourceID, actualLineNumber, actualColumnNumber);
+        RefPtr<InspectorObject> location = resolveBreakpoint(it->first, sourceID, breakpoint);
+        if (location)
+            m_frontend->breakpointResolved(it->first, location);
     }
 }
 
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index d5726e7..4c2e855 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -39,6 +39,7 @@
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
 
@@ -79,12 +80,12 @@ public:
     // Part of the protocol.
     void setBreakpointsActive(ErrorString*, bool active);
 
-    void setBreakpointByUrl(ErrorString*, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, RefPtr<InspectorArray>* locations);
-    void setBreakpoint(ErrorString*, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, int* actualLineNumber, int* actualColumnNumber);
+    void setBreakpointByUrl(ErrorString*, const String& url, int lineNumber, const int* const optionalColumnNumber, const String* const optionalCondition, String* breakpointId, RefPtr<InspectorArray>* locations);
+    void setBreakpoint(ErrorString*, PassRefPtr<InspectorObject> location, const String* const optionalCondition, String* breakpointId, RefPtr<InspectorObject>* actualLocation);
     void removeBreakpoint(ErrorString*, const String& breakpointId);
-    void continueToLocation(ErrorString*, const String& sourceId, int lineNumber, int columnNumber);
+    void continueToLocation(ErrorString*, PassRefPtr<InspectorObject> location);
 
-    void editScriptSource(ErrorString*, const String& sourceID, const String& newContent, String* result, RefPtr<InspectorArray>* newCallFrames);
+    void editScriptSource(ErrorString*, const String& sourceID, const String& newContent, RefPtr<InspectorArray>* newCallFrames);
     void getScriptSource(ErrorString*, const String& sourceID, String* scriptSource);
     void schedulePauseOnNextStatement(DebuggerEventType type, PassRefPtr<InspectorValue> data);
     void cancelPauseOnNextStatement();
@@ -94,8 +95,8 @@ public:
     void stepOver(ErrorString*);
     void stepInto(ErrorString*);
     void stepOut(ErrorString*);
-    void setPauseOnExceptionsState(ErrorString*, int pauseState);
-    void evaluateOnCallFrame(ErrorString*, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
+    void setPauseOnExceptions(ErrorString*, const String& pauseState);
+    void evaluateOnCallFrame(ErrorString*, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, RefPtr<InspectorObject>* result);
 
     class Listener {
     public:
@@ -118,12 +119,12 @@ private:
 
     PassRefPtr<InspectorArray> currentCallFrames();
 
-    virtual void didParseSource(const String& sourceID, const String& url, const String& data, int lineOffset, int columnOffset, ScriptWorldType);
+    virtual void didParseSource(const String& sourceID, const String& url, const String& data, int lineOffset, int columnOffset, bool isContentScript);
     virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
     virtual void didPause(ScriptState*);
     virtual void didContinue();
 
-    bool resolveBreakpoint(const String& breakpointId, const String& sourceId, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
+    PassRefPtr<InspectorObject> resolveBreakpoint(const String& breakpointId, const String& sourceId, const ScriptBreakpoint&);
     void clear();
 
     class Script {
diff --git a/Source/WebCore/inspector/InspectorFrontendChannel.h b/Source/WebCore/inspector/InspectorFrontendChannel.h
new file mode 100644
index 0000000..b3214ef
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorFrontendChannel.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef InspectorFrontendChannel_h
+#define InspectorFrontendChannel_h
+
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class InspectorFrontendChannel {
+public:
+    virtual ~InspectorFrontendChannel() { }
+    virtual bool sendMessageToFrontend(const String& message) = 0;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InspectorFrontendChannel_h)
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
index 36864f3..7743ec0 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
@@ -44,6 +44,7 @@
 #include "PlatformString.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
+#include "Settings.h"
 
 namespace WebCore {
 
@@ -67,6 +68,7 @@ InspectorFrontendClientLocal::InspectorFrontendClientLocal(InspectorController*
     , m_frontendScriptState(0)
     , m_settings(settings)
 {
+    m_frontendPage->settings()->setAllowFileAccessFromFileURLs(true);
 }
 
 InspectorFrontendClientLocal::~InspectorFrontendClientLocal()
diff --git a/Source/WebCore/inspector/InspectorFrontendProxy.cpp b/Source/WebCore/inspector/InspectorFrontendProxy.cpp
new file mode 100644
index 0000000..4e2188d
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorFrontendProxy.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontendProxy.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "EventsCollector.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+InspectorFrontendProxy::InspectorFrontendProxy(EventsCollector* collector)
+{
+    m_receiver = 0;
+    m_collector = collector;
+}
+
+InspectorFrontendProxy::InspectorFrontendProxy(EventsCollector* collector, InspectorFrontendChannel* nextChannel)
+{
+    m_collector = collector;
+    m_receiver = nextChannel;
+}
+
+void InspectorFrontendProxy::setInspectorFrontendChannel(InspectorFrontendChannel* receiver)
+{
+    m_receiver = receiver;
+}
+
+void InspectorFrontendProxy::setEventsCollector(EventsCollector* collector)
+{
+    m_collector = collector;
+}
+
+bool InspectorFrontendProxy::sendMessageToFrontend(const String& message)
+{
+    m_collector->addEvent(message);
+    if (m_receiver)
+        return m_receiver->sendMessageToFrontend(message);
+    return false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorFrontendProxy.h b/Source/WebCore/inspector/InspectorFrontendProxy.h
new file mode 100644
index 0000000..259af67
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorFrontendProxy.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef InspectorFrontendProxy_h
+#define InspectorFrontendProxy_h
+
+#if ENABLE(INSPECTOR)
+
+#include "InspectorFrontendChannel.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class EventsCollector;
+
+class InspectorFrontendProxy : public InspectorFrontendChannel {
+public:
+    explicit InspectorFrontendProxy(EventsCollector*);
+    InspectorFrontendProxy(EventsCollector*, InspectorFrontendChannel* nextChannel);
+    virtual ~InspectorFrontendProxy() { }
+
+    void setInspectorFrontendChannel(InspectorFrontendChannel*);
+    void setEventsCollector(EventsCollector*);
+    virtual bool sendMessageToFrontend(const String& message);
+
+private:
+    InspectorFrontendChannel* m_receiver;
+    EventsCollector* m_collector;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
+
+#endif // !defined(InspectorFrontendProxy_h)
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 6d3b4ad..9986677 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -457,10 +457,31 @@ void InspectorInstrumentation::didReceiveResourceResponseImpl(const InspectorIns
     }
 }
 
-void InspectorInstrumentation::didReceiveContentLengthImpl(InspectorAgent* inspectorAgent, unsigned long identifier, int dataLength, int lengthReceived)
+void InspectorInstrumentation::didReceiveResourceResponseButCanceledImpl(Frame* frame, DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceResponse(frame, identifier, r);
+    InspectorInstrumentation::didReceiveResourceResponse(cookie, identifier, loader, r);
+}
+
+void InspectorInstrumentation::continueAfterXFrameOptionsDeniedImpl(Frame* frame, DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+    didReceiveResourceResponseButCanceledImpl(frame, loader, identifier, r);
+}
+
+void InspectorInstrumentation::continueWithPolicyDownloadImpl(Frame* frame, DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+    didReceiveResourceResponseButCanceledImpl(frame, loader, identifier, r);
+}
+
+void InspectorInstrumentation::continueWithPolicyIgnoreImpl(Frame* frame, DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+    didReceiveResourceResponseButCanceledImpl(frame, loader, identifier, r);
+}
+
+void InspectorInstrumentation::didReceiveContentLengthImpl(InspectorAgent* inspectorAgent, unsigned long identifier, int dataLength, int encodedDataLength)
 {
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->didReceiveContentLength(identifier, dataLength, lengthReceived);
+        resourceAgent->didReceiveContentLength(identifier, dataLength, encodedDataLength);
 }
 
 void InspectorInstrumentation::didFinishLoadingImpl(InspectorAgent* inspectorAgent, unsigned long identifier, double finishTime)
@@ -484,13 +505,13 @@ void InspectorInstrumentation::resourceRetrievedByXMLHttpRequestImpl(InspectorAg
 {
     inspectorAgent->consoleAgent()->resourceRetrievedByXMLHttpRequest(url, sendURL, sendLineNumber);
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->setInitialContent(identifier, sourceString, "XHR");
+        resourceAgent->setInitialXHRContent(identifier, sourceString);
 }
 
 void InspectorInstrumentation::scriptImportedImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const String& sourceString)
 {
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->setInitialContent(identifier, sourceString, "Script");
+        resourceAgent->setInitialScriptContent(identifier, sourceString);
 }
 
 void InspectorInstrumentation::domContentLoadedEventFiredImpl(InspectorAgent* inspectorAgent, Frame* frame, const KURL& url)
@@ -509,6 +530,9 @@ void InspectorInstrumentation::domContentLoadedEventFiredImpl(InspectorAgent* in
     if (InspectorTimelineAgent* timelineAgent = inspectorAgent->instrumentingAgents()->inspectorTimelineAgent())
         timelineAgent->didMarkDOMContentEvent();
 
+    if (InspectorResourceAgent* resourceAgent = inspectorAgent->instrumentingAgents()->inspectorResourceAgent())
+        resourceAgent->domContentEventFired();
+
     if (InspectorPageAgent* pageAgent = inspectorAgent->instrumentingAgents()->inspectorPageAgent())
         pageAgent->domContentEventFired();
 }
@@ -527,6 +551,9 @@ void InspectorInstrumentation::loadEventFiredImpl(InspectorAgent* inspectorAgent
     if (InspectorTimelineAgent* timelineAgent = inspectorAgent->instrumentingAgents()->inspectorTimelineAgent())
         timelineAgent->didMarkLoadEvent();
 
+    if (InspectorResourceAgent* resourceAgent = inspectorAgent->instrumentingAgents()->inspectorResourceAgent())
+        resourceAgent->loadEventFired();
+
     if (InspectorPageAgent* pageAgent = inspectorAgent->instrumentingAgents()->inspectorPageAgent())
         pageAgent->loadEventFired();
 }
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 77c464e..d82c6a9 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -118,7 +118,10 @@ public:
     static void didReceiveResourceData(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willReceiveResourceResponse(Frame*, unsigned long identifier, const ResourceResponse&);
     static void didReceiveResourceResponse(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
-    static void didReceiveContentLength(Frame*, unsigned long identifier, int dataLength, int lengthReceived);
+    static void continueAfterXFrameOptionsDenied(Frame*, DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    static void continueWithPolicyDownload(Frame*, DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    static void continueWithPolicyIgnore(Frame*, DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    static void didReceiveContentLength(Frame*, unsigned long identifier, int dataLength, int encodedDataLength);
     static void didFinishLoading(Frame*, unsigned long identifier, double finishTime);
     static void didFailLoading(Frame*, unsigned long identifier, const ResourceError&);
     static void resourceRetrievedByXMLHttpRequest(ScriptExecutionContext*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
@@ -234,7 +237,11 @@ private:
     static void didReceiveResourceDataImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willReceiveResourceResponseImpl(InspectorAgent*, unsigned long identifier, const ResourceResponse&);
     static void didReceiveResourceResponseImpl(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
-    static void didReceiveContentLengthImpl(InspectorAgent*, unsigned long identifier, int dataLength, int lengthReceived);
+    static void didReceiveResourceResponseButCanceledImpl(Frame*, DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    static void continueAfterXFrameOptionsDeniedImpl(Frame*, DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    static void continueWithPolicyDownloadImpl(Frame*, DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    static void continueWithPolicyIgnoreImpl(Frame*, DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    static void didReceiveContentLengthImpl(InspectorAgent*, unsigned long identifier, int dataLength, int encodedDataLength);
     static void didFinishLoadingImpl(InspectorAgent*, unsigned long identifier, double finishTime);
     static void didFailLoadingImpl(InspectorAgent*, unsigned long identifier, const ResourceError&);
     static void resourceRetrievedByXMLHttpRequestImpl(InspectorAgent*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
@@ -612,7 +619,7 @@ inline void InspectorInstrumentation::applyUserAgentOverride(Frame* frame, Strin
 inline void InspectorInstrumentation::willSendRequest(Frame* frame, unsigned long identifier, DocumentLoader* loader, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* ic = inspectorAgentWithFrontendForFrame(frame))
+    if (InspectorAgent* ic = inspectorAgentForFrame(frame))
         willSendRequestImpl(ic, identifier, loader, request, redirectResponse);
 #endif
 }
@@ -651,7 +658,7 @@ inline void InspectorInstrumentation::didReceiveResourceData(const InspectorInst
 inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceResponse(Frame* frame, unsigned long identifier, const ResourceResponse& response)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
         return willReceiveResourceResponseImpl(inspectorAgent, identifier, response);
 #endif
     return InspectorInstrumentationCookie();
@@ -665,18 +672,42 @@ inline void InspectorInstrumentation::didReceiveResourceResponse(const Inspector
 #endif
 }
 
-inline void InspectorInstrumentation::didReceiveContentLength(Frame* frame, unsigned long identifier, int dataLength, int lengthReceived)
+inline void InspectorInstrumentation::continueAfterXFrameOptionsDenied(Frame* frame, DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
-        didReceiveContentLengthImpl(inspectorAgent, identifier, dataLength, lengthReceived);
+    if (inspectorAgentWithFrontendForFrame(frame))
+        InspectorInstrumentation::continueAfterXFrameOptionsDeniedImpl(frame, loader, identifier, r);
+#endif
+}
+
+inline void InspectorInstrumentation::continueWithPolicyDownload(Frame* frame, DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+#if ENABLE(INSPECTOR)
+    if (inspectorAgentWithFrontendForFrame(frame))
+        InspectorInstrumentation::continueWithPolicyDownloadImpl(frame, loader, identifier, r);
+#endif
+}
+
+inline void InspectorInstrumentation::continueWithPolicyIgnore(Frame* frame, DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+#if ENABLE(INSPECTOR)
+    if (inspectorAgentWithFrontendForFrame(frame))
+        InspectorInstrumentation::continueWithPolicyIgnoreImpl(frame, loader, identifier, r);
+#endif
+}
+
+inline void InspectorInstrumentation::didReceiveContentLength(Frame* frame, unsigned long identifier, int dataLength, int encodedDataLength)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
+        didReceiveContentLengthImpl(inspectorAgent, identifier, dataLength, encodedDataLength);
 #endif
 }
 
 inline void InspectorInstrumentation::didFinishLoading(Frame* frame, unsigned long identifier, double finishTime)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
         didFinishLoadingImpl(inspectorAgent, identifier, finishTime);
 #endif
 }
@@ -708,7 +739,7 @@ inline void InspectorInstrumentation::scriptImported(ScriptExecutionContext* con
 inline void InspectorInstrumentation::domContentLoadedEventFired(Frame* frame, const KURL& url)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
         domContentLoadedEventFiredImpl(inspectorAgent, frame, url);
 #endif
 }
@@ -716,7 +747,7 @@ inline void InspectorInstrumentation::domContentLoadedEventFired(Frame* frame, c
 inline void InspectorInstrumentation::loadEventFired(Frame* frame, const KURL& url)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
         loadEventFiredImpl(inspectorAgent, frame, url);
 #endif
 }
@@ -724,7 +755,7 @@ inline void InspectorInstrumentation::loadEventFired(Frame* frame, const KURL& u
 inline void InspectorInstrumentation::frameDetachedFromParent(Frame* frame)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
         frameDetachedFromParentImpl(inspectorAgent, frame);
 #endif
 }
@@ -792,7 +823,7 @@ inline void InspectorInstrumentation::didDestroyWorker(ScriptExecutionContext* c
 inline void InspectorInstrumentation::didCreateWebSocket(ScriptExecutionContext* context, unsigned long identifier, const KURL& requestURL, const KURL& documentURL)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForContext(context))
         didCreateWebSocketImpl(inspectorAgent, identifier, requestURL, documentURL);
 #endif
 }
@@ -800,7 +831,7 @@ inline void InspectorInstrumentation::didCreateWebSocket(ScriptExecutionContext*
 inline void InspectorInstrumentation::willSendWebSocketHandshakeRequest(ScriptExecutionContext* context, unsigned long identifier, const WebSocketHandshakeRequest& request)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForContext(context))
         willSendWebSocketHandshakeRequestImpl(inspectorAgent, identifier, request);
 #endif
 }
@@ -808,7 +839,7 @@ inline void InspectorInstrumentation::willSendWebSocketHandshakeRequest(ScriptEx
 inline void InspectorInstrumentation::didReceiveWebSocketHandshakeResponse(ScriptExecutionContext* context, unsigned long identifier, const WebSocketHandshakeResponse& response)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForContext(context))
         didReceiveWebSocketHandshakeResponseImpl(inspectorAgent, identifier, response);
 #endif
 }
@@ -816,7 +847,7 @@ inline void InspectorInstrumentation::didReceiveWebSocketHandshakeResponse(Scrip
 inline void InspectorInstrumentation::didCloseWebSocket(ScriptExecutionContext* context, unsigned long identifier)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForContext(context))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForContext(context))
         didCloseWebSocketImpl(inspectorAgent, identifier);
 #endif
 }
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index af053c9..8608543 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -32,7 +32,7 @@
 
 #include "InspectorPageAgent.h"
 
-#if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
+#if ENABLE(INSPECTOR)
 
 #include "CachedResourceLoader.h"
 #include "Cookie.h"
@@ -93,9 +93,9 @@ void InspectorPageAgent::removeAllScriptsToEvaluateOnLoad(ErrorString*)
     m_scriptsToEvaluateOnLoad.clear();
 }
 
-void InspectorPageAgent::reloadPage(ErrorString*, bool ignoreCache)
+void InspectorPageAgent::reloadPage(ErrorString*, const bool* const optionalIgnoreCache)
 {
-    m_inspectedPage->mainFrame()->loader()->reload(ignoreCache);
+    m_inspectedPage->mainFrame()->loader()->reload(optionalIgnoreCache ? *optionalIgnoreCache : false);
 }
 
 void InspectorPageAgent::openInInspectedWindow(ErrorString*, const String& url)
@@ -255,4 +255,4 @@ void InspectorPageAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWor
 
 } // namespace WebCore
 
-#endif // ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index bb6b96f..233a953 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -31,7 +31,7 @@
 #ifndef InspectorPageAgent_h
 #define InspectorPageAgent_h
 
-#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+#if ENABLE(INSPECTOR)
 
 #include "PlatformString.h"
 #include <wtf/RefCounted.h>
@@ -58,7 +58,7 @@ public:
     // Page API for InspectorFrontend
     void addScriptToEvaluateOnLoad(ErrorString*, const String& source);
     void removeAllScriptsToEvaluateOnLoad(ErrorString*);
-    void reloadPage(ErrorString*, bool ignoreCache);
+    void reloadPage(ErrorString*, const bool* const optionalIgnoreCache);
     void openInInspectedWindow(ErrorString*, const String& url);
     void setUserAgentOverride(ErrorString*, const String& userAgent);
     void getCookies(ErrorString*, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString);
@@ -90,6 +90,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+#endif // ENABLE(INSPECTOR)
 
-#endif // !defined(InspectorPageAgent_h)
+#endif // !defined(InspectorPagerAgent_h)
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.cpp b/Source/WebCore/inspector/InspectorResourceAgent.cpp
index 1e2c16d..f200702 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.cpp
+++ b/Source/WebCore/inspector/InspectorResourceAgent.cpp
@@ -34,21 +34,24 @@
 #if ENABLE(INSPECTOR)
 
 #include "Base64.h"
-#include "MemoryCache.h"
 #include "CachedResource.h"
 #include "CachedResourceLoader.h"
 #include "Document.h"
 #include "DocumentLoader.h"
+#include "EventsCollector.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
 #include "HTTPHeaderMap.h"
 #include "InspectorFrontend.h"
+#include "InspectorFrontendChannel.h"
+#include "InspectorFrontendProxy.h"
 #include "InspectorState.h"
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
 #include "KURL.h"
+#include "MemoryCache.h"
 #include "Page.h"
 #include "ProgressTracker.h"
 #include "ResourceError.h"
@@ -74,14 +77,36 @@ static const char resourceAgentEnabled[] = "resourceAgentEnabled";
 static const char extraRequestHeaders[] = "extraRequestHeaders";
 }
 
+namespace ResourceType {
+static const char document[] = "Document";
+static const char stylesheet[] = "Stylesheet";
+static const char image[] = "Image";
+static const char font[] = "Font";
+static const char script[] = "Script";
+static const char xhr[] = "XHR";
+static const char websocket[] = "WebSocket";
+static const char other[] = "Other";
+}
+
 void InspectorResourceAgent::setFrontend(InspectorFrontend* frontend)
 {
     m_frontend = frontend->network();
+    if (backgroundEventsCollectionEnabled()) {
+        // Insert Message Proxy in receiver chain.
+        InspectorFrontendChannel* client = m_frontend->getInspectorFrontendChannel();
+        m_inspectorFrontendProxy->setInspectorFrontendChannel(client);
+        m_frontend->setInspectorFrontendChannel(m_inspectorFrontendProxy.get());
+        m_eventsCollector->sendCollectedEvents(client);
+    }
 }
 
 void InspectorResourceAgent::clearFrontend()
 {
-    m_frontend = 0;
+    if (backgroundEventsCollectionEnabled()) {
+        m_inspectorFrontendProxy->setInspectorFrontendChannel(0);
+        m_frontend = m_mockFrontend.get();
+    } else
+        m_frontend = 0;
     disable(0);
 }
 
@@ -94,7 +119,7 @@ void InspectorResourceAgent::restore()
 void InspectorResourceAgent::resourceContent(ErrorString* errorString, Frame* frame, const KURL& url, String* result)
 {
     if (!frame) {
-        *errorString = "No frame to get resource content for."; 
+        *errorString = "No frame to get resource content for";
         return;
     }
 
@@ -108,7 +133,7 @@ void InspectorResourceAgent::resourceContent(ErrorString* errorString, Frame* fr
         *result = encoding.decode(buffer->data(), buffer->size());
         return;
     }
-    *errorString = "No resource with given URL found."; 
+    *errorString = "No resource with given URL found"; 
 }
 
 void InspectorResourceAgent::resourceContentBase64(ErrorString* errorString, Frame* frame, const KURL& url, String* result)
@@ -117,7 +142,7 @@ void InspectorResourceAgent::resourceContentBase64(ErrorString* errorString, Fra
     RefPtr<SharedBuffer> data = InspectorResourceAgent::resourceData(frame, url, &textEncodingName);
     if (!data) {
         *result = String();
-        *errorString = "No resource with given URL found."; 
+        *errorString = "No resource with given URL found"; 
         return;
     }
 
@@ -204,13 +229,12 @@ static PassRefPtr<InspectorObject> buildObjectForResourceRequest(const ResourceR
 
 static PassRefPtr<InspectorObject> buildObjectForResourceResponse(const ResourceResponse& response)
 {
-    RefPtr<InspectorObject> responseObject = InspectorObject::create();
     if (response.isNull())
-        return responseObject;
+        return 0;
 
+    RefPtr<InspectorObject> responseObject = InspectorObject::create();
     responseObject->setNumber("status", response.resourceLoadInfo() ? response.resourceLoadInfo()->httpStatusCode : response.httpStatusCode());
     responseObject->setString("statusText", response.resourceLoadInfo() ? response.resourceLoadInfo()->httpStatusText : response.httpStatusText());
-    responseObject->setObject("headers", buildObjectForHeaders(response.resourceLoadInfo() ? response.resourceLoadInfo()->responseHeaders : response.httpHeaderFields()));
 
     responseObject->setString("mimeType", response.mimeType());
     responseObject->setBoolean("connectionReused", response.connectionReused());
@@ -219,8 +243,16 @@ static PassRefPtr<InspectorObject> buildObjectForResourceResponse(const Resource
     if (response.resourceLoadTiming())
         responseObject->setObject("timing", buildObjectForTiming(*response.resourceLoadTiming()));
 
-    if (response.resourceLoadInfo())
+    if (response.resourceLoadInfo()) {
+        responseObject->setObject("headers", buildObjectForHeaders(response.resourceLoadInfo()->responseHeaders));
+        if (!response.resourceLoadInfo()->responseHeadersText.isEmpty())
+            responseObject->setString("headersText", response.resourceLoadInfo()->responseHeadersText);
+
         responseObject->setObject("requestHeaders", buildObjectForHeaders(response.resourceLoadInfo()->requestHeaders));
+        if (!response.resourceLoadInfo()->requestHeadersText.isEmpty())
+            responseObject->setString("requestHeadersText", response.resourceLoadInfo()->requestHeadersText);
+    } else
+        responseObject->setObject("headers", buildObjectForHeaders(response.httpHeaderFields()));
 
     return responseObject;
 }
@@ -236,21 +268,21 @@ static String cachedResourceTypeString(const CachedResource& cachedResource)
 {
     switch (cachedResource.type()) {
     case CachedResource::ImageResource:
-        return "Image";
+        return ResourceType::image;
     case CachedResource::FontResource:
-        return "Font";
+        return ResourceType::font;
     case CachedResource::CSSStyleSheet:
         // Fall through.
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
 #endif
-        return "Stylesheet";
+        return ResourceType::stylesheet;
     case CachedResource::Script:
-        return "Script";
+        return ResourceType::script;
     default:
         break;
     }
-    return "Other";
+    return ResourceType::other;
 }
 
 static PassRefPtr<InspectorObject> buildObjectForCachedResource(const CachedResource& cachedResource)
@@ -259,12 +291,18 @@ static PassRefPtr<InspectorObject> buildObjectForCachedResource(const CachedReso
     resourceObject->setString("url", cachedResource.url());
     resourceObject->setString("type", cachedResourceTypeString(cachedResource));
     resourceObject->setNumber("bodySize", cachedResource.encodedSize());
-    resourceObject->setObject("response", buildObjectForResourceResponse(cachedResource.response()));
+    RefPtr<InspectorObject> resourceResponse = buildObjectForResourceResponse(cachedResource.response());
+    if (resourceResponse)
+        resourceObject->setObject("response", resourceResponse);
     return resourceObject;
 }
 
 InspectorResourceAgent::~InspectorResourceAgent()
 {
+    if (m_state->getBoolean(ResourceAgentState::resourceAgentEnabled)) {
+        ErrorString error;
+        disable(&error);
+    }
     ASSERT(!m_instrumentingAgents->inspectorResourceAgent());
 }
 
@@ -290,7 +328,7 @@ void InspectorResourceAgent::willSendRequest(unsigned long identifier, DocumentL
         callStackValue = callStack->buildInspectorArray();
     else
         callStackValue = InspectorArray::create();
-    m_frontend->requestWillBeSent(static_cast<int>(identifier), pointerAsId(loader->frame()), pointerAsId(loader), loader->url().string(), buildObjectForResourceRequest(request), buildObjectForResourceResponse(redirectResponse), currentTime(), callStackValue);
+    m_frontend->requestWillBeSent(static_cast<int>(identifier), pointerAsId(loader->frame()), pointerAsId(loader), loader->url().string(), buildObjectForResourceRequest(request), currentTime(), callStackValue, buildObjectForResourceResponse(redirectResponse));
 }
 
 void InspectorResourceAgent::markResourceAsCached(unsigned long identifier)
@@ -314,9 +352,9 @@ void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, Docume
                 resourceResponse->setString("mimeType", cachedResource->response().mimeType());
         }
         if (equalIgnoringFragmentIdentifier(response.url(), loader->frameLoader()->iconURL()))
-            type = "Image";
+            type = ResourceType::image;
         else if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && type == "Other")
-            type = "Document";
+            type = ResourceType::document;
     }
     m_frontend->responseReceived(static_cast<int>(identifier), currentTime(), type, resourceResponse);
     // If we revalidated the resource and got Not modified, send content length following didReceiveResponse
@@ -325,9 +363,9 @@ void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, Docume
         didReceiveContentLength(identifier, cachedResourceSize, 0);
 }
 
-void InspectorResourceAgent::didReceiveContentLength(unsigned long identifier, int dataLength, int lengthReceived)
+void InspectorResourceAgent::didReceiveContentLength(unsigned long identifier, int dataLength, int encodedDataLength)
 {
-    m_frontend->dataReceived(static_cast<int>(identifier), currentTime(), dataLength, lengthReceived);
+    m_frontend->dataReceived(static_cast<int>(identifier), currentTime(), dataLength, encodedDataLength);
 }
 
 void InspectorResourceAgent::didFinishLoading(unsigned long identifier, double finishTime)
@@ -340,7 +378,7 @@ void InspectorResourceAgent::didFinishLoading(unsigned long identifier, double f
 
 void InspectorResourceAgent::didFailLoading(unsigned long identifier, const ResourceError& error)
 {
-    m_frontend->loadingFailed(static_cast<int>(identifier), currentTime(), error.localizedDescription());
+    m_frontend->loadingFailed(static_cast<int>(identifier), currentTime(), error.localizedDescription(), error.isCancellation());
 }
 
 void InspectorResourceAgent::didLoadResourceFromMemoryCache(DocumentLoader* loader, const CachedResource* resource)
@@ -348,9 +386,24 @@ void InspectorResourceAgent::didLoadResourceFromMemoryCache(DocumentLoader* load
     m_frontend->resourceLoadedFromMemoryCache(pointerAsId(loader->frame()), pointerAsId(loader), loader->url().string(), currentTime(), buildObjectForCachedResource(*resource));
 }
 
-void InspectorResourceAgent::setInitialContent(unsigned long identifier, const String& sourceString, const String& type)
+void InspectorResourceAgent::setInitialScriptContent(unsigned long identifier, const String& sourceString)
 {
-    m_frontend->initialContentSet(static_cast<int>(identifier), sourceString, type);
+    m_frontend->initialContentSet(static_cast<int>(identifier), sourceString, ResourceType::script);
+}
+
+void InspectorResourceAgent::setInitialXHRContent(unsigned long identifier, const String& sourceString)
+{
+    m_frontend->initialContentSet(static_cast<int>(identifier), sourceString, ResourceType::xhr);
+}
+
+void InspectorResourceAgent::domContentEventFired()
+{
+    m_frontend->domContentEventFired(currentTime());
+}
+
+void InspectorResourceAgent::loadEventFired()
+{
+    m_frontend->loadEventFired(currentTime());
 }
 
 static PassRefPtr<InspectorObject> buildObjectForFrame(Frame* frame)
@@ -465,6 +518,14 @@ Frame* InspectorResourceAgent::frameForId(const String& frameId)
     return 0;
 }
 
+bool InspectorResourceAgent::backgroundEventsCollectionEnabled()
+{
+    // FIXME (https://bugs.webkit.org/show_bug.cgi?id=58652)
+    // Add here condition to enable background events collection.
+    // Now this function is disable.
+    return false;
+}
+
 void InspectorResourceAgent::enable(ErrorString*)
 {
     enable();
@@ -489,14 +550,14 @@ void InspectorResourceAgent::getCachedResources(ErrorString*, RefPtr<InspectorOb
     *object = buildObjectForFrameTree(m_page->mainFrame());
 }
 
-void InspectorResourceAgent::getResourceContent(ErrorString* errorString, const String& frameId, const String& url, bool base64Encode, String* content)
+void InspectorResourceAgent::getResourceContent(ErrorString* errorString, const String& frameId, const String& url, const bool* const optionalBase64Encode, String* content)
 {
     Frame* frame = frameForId(frameId);
     if (!frame) {
-        *errorString = "No frame for given id found.";
+        *errorString = "No frame for given id found";
         return;
     }
-    if (base64Encode)
+    if (optionalBase64Encode ? *optionalBase64Encode : false)
         InspectorResourceAgent::resourceContentBase64(errorString, frame, KURL(ParsedURLString, url), content);
     else
         InspectorResourceAgent::resourceContent(errorString, frame, KURL(ParsedURLString, url), content);
@@ -511,8 +572,16 @@ InspectorResourceAgent::InspectorResourceAgent(InstrumentingAgents* instrumentin
     : m_instrumentingAgents(instrumentingAgents)
     , m_page(page)
     , m_state(state)
-    , m_frontend(0)
 {
+    if (backgroundEventsCollectionEnabled()) {
+        m_eventsCollector = new EventsCollector();
+        m_inspectorFrontendProxy = new InspectorFrontendProxy(m_eventsCollector.get());
+        // Create mock frontend, so we can collect network events.
+        m_mockFrontend = new InspectorFrontend::Network(m_inspectorFrontendProxy.get());
+        m_frontend = m_mockFrontend.get();
+        enable();
+    } else
+        m_frontend = 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.h b/Source/WebCore/inspector/InspectorResourceAgent.h
index c919469..dff7e3a 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.h
+++ b/Source/WebCore/inspector/InspectorResourceAgent.h
@@ -34,6 +34,7 @@
 #include "InspectorFrontend.h"
 #include "PlatformString.h"
 
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
 
@@ -51,10 +52,12 @@ class DocumentLoader;
 class Frame;
 class InspectorArray;
 class InspectorFrontend;
+class InspectorFrontendProxy;
 class InspectorObject;
 class InspectorState;
 class InstrumentingAgents;
 class KURL;
+class EventsCollector;
 class Page;
 class ResourceError;
 class ResourceRequest;
@@ -91,11 +94,14 @@ public:
     void willSendRequest(unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     void markResourceAsCached(unsigned long identifier);
     void didReceiveResponse(unsigned long identifier, DocumentLoader* laoder, const ResourceResponse&);
-    void didReceiveContentLength(unsigned long identifier, int dataLength, int lengthReceived);
+    void didReceiveContentLength(unsigned long identifier, int dataLength, int encodedDataLength);
     void didFinishLoading(unsigned long identifier, double finishTime);
     void didFailLoading(unsigned long identifier, const ResourceError&);
     void didLoadResourceFromMemoryCache(DocumentLoader*, const CachedResource*);
-    void setInitialContent(unsigned long identifier, const String& sourceString, const String& type);
+    void setInitialScriptContent(unsigned long identifier, const String& sourceString);
+    void setInitialXHRContent(unsigned long identifier, const String& sourceString);
+    void domContentEventFired();
+    void loadEventFired();
     void didCommitLoad(DocumentLoader*);
     void frameDetachedFromParent(Frame*);
 
@@ -107,12 +113,13 @@ public:
 #endif
 
     Frame* frameForId(const String& frameId);
+    bool backgroundEventsCollectionEnabled();
 
     // Called from frontend 
     void enable(ErrorString*);
     void disable(ErrorString*);
     void getCachedResources(ErrorString*, RefPtr<InspectorObject>*);
-    void getResourceContent(ErrorString*, const String& frameId, const String& url, bool base64Encode, String* content);
+    void getResourceContent(ErrorString*, const String& frameId, const String& url, const bool* const base64Encode, String* content);
     void setExtraHeaders(ErrorString*, PassRefPtr<InspectorObject>);
 
 private:
@@ -123,7 +130,10 @@ private:
     InstrumentingAgents* m_instrumentingAgents;
     Page* m_page;
     InspectorState* m_state;
+    OwnPtr<EventsCollector> m_eventsCollector;
     InspectorFrontend::Network* m_frontend;
+    OwnPtr<InspectorFrontend::Network> m_mockFrontend;
+    OwnPtr<InspectorFrontendProxy> m_inspectorFrontendProxy;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
index 04fed9d..f139071 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
@@ -36,20 +36,12 @@
 #include "InjectedScript.h"
 #include "InjectedScriptManager.h"
 #include "InspectorValues.h"
-#include "Page.h"
-#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
-PassOwnPtr<InspectorRuntimeAgent> InspectorRuntimeAgent::create(InjectedScriptManager* injectedScriptManager, Page* inspectedPage)
-{
-    return adoptPtr(new InspectorRuntimeAgent(injectedScriptManager, inspectedPage));
-}
-
-InspectorRuntimeAgent::InspectorRuntimeAgent(InjectedScriptManager* injectedScriptManager, Page* inspectedPage)
+InspectorRuntimeAgent::InspectorRuntimeAgent(InjectedScriptManager* injectedScriptManager)
     : m_injectedScriptManager(injectedScriptManager)
-    , m_inspectedPage(inspectedPage)
 {
 }
 
@@ -57,12 +49,11 @@ InspectorRuntimeAgent::~InspectorRuntimeAgent()
 {
 }
 
-void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
+void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
-    ScriptState* scriptState = mainWorldScriptState(m_inspectedPage->mainFrame());
-    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(scriptState);
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(getDefaultInspectedState());
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluate(errorString, expression, objectGroup, includeCommandLineAPI, result);
+        injectedScript.evaluate(errorString, expression, objectGroup ? *objectGroup : "", includeCommandLineAPI ? *includeCommandLineAPI : false, result);
 }
 
 void InspectorRuntimeAgent::evaluateOn(ErrorString* errorString, const String& objectId, const String& expression, RefPtr<InspectorObject>* result)
@@ -72,11 +63,11 @@ void InspectorRuntimeAgent::evaluateOn(ErrorString* errorString, const String& o
         injectedScript.evaluateOn(errorString, objectId, expression, result);
 }
 
-void InspectorRuntimeAgent::getProperties(ErrorString* errorString, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result)
+void InspectorRuntimeAgent::getProperties(ErrorString* errorString, const String& objectId, bool ignoreHasOwnProperty, RefPtr<InspectorArray>* result)
 {
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
-        injectedScript.getProperties(errorString, objectId, ignoreHasOwnProperty, abbreviate, result);
+        injectedScript.getProperties(errorString, objectId, ignoreHasOwnProperty, result);
 }
 
 void InspectorRuntimeAgent::setPropertyValue(ErrorString* errorString, const String& objectId, const String& propertyName, const String& expression)
@@ -85,7 +76,7 @@ void InspectorRuntimeAgent::setPropertyValue(ErrorString* errorString, const Str
     if (!injectedScript.hasNoValue())
         injectedScript.setPropertyValue(errorString, objectId, propertyName, expression);
     else
-        *errorString = "No injected script found.";
+        *errorString = "No injected script found";
 }
 
 void InspectorRuntimeAgent::releaseObject(ErrorString*, const String& objectId)
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.h b/Source/WebCore/inspector/InspectorRuntimeAgent.h
index 48f3670..406707f 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.h
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "ScriptState.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -42,29 +43,28 @@ class InjectedScriptManager;
 class InspectorArray;
 class InspectorObject;
 class InspectorValue;
-class Page;
 
 typedef String ErrorString;
 
 class InspectorRuntimeAgent {
     WTF_MAKE_NONCOPYABLE(InspectorRuntimeAgent);
 public:
-    static PassOwnPtr<InspectorRuntimeAgent> create(InjectedScriptManager*, Page*);
-    ~InspectorRuntimeAgent();
+    virtual ~InspectorRuntimeAgent();
 
     // Part of the protocol.
-    void evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
+    void evaluate(ErrorString*, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, RefPtr<InspectorObject>* result);
     void evaluateOn(ErrorString*, const String& objectId, const String& expression, RefPtr<InspectorObject>* result);
     void releaseObject(ErrorString*, const String& objectId);
-    void getProperties(ErrorString*, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result);
+    void getProperties(ErrorString*, const String& objectId, bool ignoreHasOwnProperty, RefPtr<InspectorArray>* result);
     void setPropertyValue(ErrorString*, const String& objectId, const String& propertyName, const String& expression);
     void releaseObjectGroup(ErrorString*, const String& objectGroup);
 
-private:
-    InspectorRuntimeAgent(InjectedScriptManager*, Page*);
+protected:
+    explicit InspectorRuntimeAgent(InjectedScriptManager*);
+    virtual ScriptState* getDefaultInspectedState() = 0;
 
+private:
     InjectedScriptManager* m_injectedScriptManager;
-    Page* m_inspectedPage;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorState.cpp b/Source/WebCore/inspector/InspectorState.cpp
index 2988cf2..02614a0 100644
--- a/Source/WebCore/inspector/InspectorState.cpp
+++ b/Source/WebCore/inspector/InspectorState.cpp
@@ -64,7 +64,7 @@ void InspectorState::unmute()
 
 void InspectorState::updateCookie()
 {
-    if (!m_isOnMute)
+    if (m_client && !m_isOnMute)
         m_client->updateInspectorStateCookie(m_properties->toJSONString());
 }
 
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index 342cf54..2edb8a1 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -102,6 +102,14 @@ RefPtr<WebCore::CSSRuleSourceData> ParsedStyleSheet::ruleSourceDataAt(unsigned i
 
 namespace WebCore {
 
+static PassRefPtr<InspectorObject> buildSourceRangeObject(const SourceRange& range)
+{
+    RefPtr<InspectorObject> result = InspectorObject::create();
+    result->setNumber("start", range.start);
+    result->setNumber("end", range.end);
+    return result.release();
+}
+
 static PassRefPtr<CSSRuleList> asCSSRuleList(StyleBase* styleBase)
 {
     if (!styleBase)
@@ -154,16 +162,12 @@ PassRefPtr<InspectorObject> InspectorStyle::buildObjectForStyle() const
     if (!m_styleId.isEmpty())
         result->setValue("styleId", m_styleId.asInspectorValue());
 
-    RefPtr<InspectorObject> propertiesObject = InspectorObject::create();
-    propertiesObject->setString("width", m_style->getPropertyValue("width"));
-    propertiesObject->setString("height", m_style->getPropertyValue("height"));
+    result->setString("width", m_style->getPropertyValue("width"));
+    result->setString("height", m_style->getPropertyValue("height"));
 
     RefPtr<CSSRuleSourceData> sourceData = m_parentStyleSheet ? m_parentStyleSheet->ruleSourceDataFor(m_style.get()) : 0;
-    if (sourceData) {
-        propertiesObject->setNumber("startOffset", sourceData->styleSourceData->styleBodyRange.start);
-        propertiesObject->setNumber("endOffset", sourceData->styleSourceData->styleBodyRange.end);
-    }
-    result->setObject("properties", propertiesObject);
+    if (sourceData)
+        result->setObject("range", buildSourceRangeObject(sourceData->styleSourceData->styleBodyRange));
 
     populateObjectWithStyleProperties(result.get());
 
@@ -176,11 +180,13 @@ PassRefPtr<InspectorObject> InspectorStyle::buildObjectForStyle() const
 //
 // The propertyText (if not empty) is checked to be a valid style declaration (containing at least one property). If not,
 // the method returns false (denoting an error).
-bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText, bool overwrite)
+bool InspectorStyle::setPropertyText(ErrorString* errorString, unsigned index, const String& propertyText, bool overwrite)
 {
     ASSERT(m_parentStyleSheet);
-    if (!m_parentStyleSheet->ensureParsedDataReady())
+    if (!m_parentStyleSheet->ensureParsedDataReady()) {
+        *errorString = "Internal error: no stylesheet parsed data available";
         return false;
+    }
 
     Vector<InspectorStyleProperty> allProperties;
     populateAllProperties(&allProperties);
@@ -197,12 +203,16 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
         unsigned propertyCount = propertyData.size();
 
         // At least one property + the bogus property added just above should be present.
-        if (propertyCount < 2)
+        if (propertyCount < 2) {
+            *errorString = "Invalid property value";
             return false;
+        }
 
         // Check for a proper propertyText termination (the parser could at least restore to the PROPERTY_NAME state).
-        if (propertyData.at(propertyCount - 1).name != "-webkit-boguz-propertee")
+        if (propertyData.at(propertyCount - 1).name != "-webkit-boguz-propertee") {
+            *errorString = "Invalid property value";
             return false;
+        }
     }
 
     if (overwrite) {
@@ -216,8 +226,10 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
 
         if (!property.disabled) {
             bool success = replacePropertyInStyleText(property, propertyText);
-            if (!success)
+            if (!success) {
+                *errorString = "Internal error: could not replace property value";
                 return false;
+            }
         } else {
             unsigned textLength = propertyText.length();
             unsigned disabledIndex = disabledIndexByOrdinal(index, false, allProperties);
@@ -235,12 +247,16 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
     } else {
         // Insert at index.
         RefPtr<CSSRuleSourceData> sourceData = m_parentStyleSheet->ruleSourceDataFor(m_style.get());
-        if (!sourceData)
+        if (!sourceData) {
+            *errorString = "Internal error: no CSS rule source found";
             return false;
+        }
         String text;
         bool success = styleText(&text);
-        if (!success)
+        if (!success) {
+            *errorString = "Internal error: could not fetch style text";
             return false;
+        }
         propertyLengthDelta = propertyText.length();
 
         bool insertLast = true;
@@ -283,19 +299,25 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
     return true;
 }
 
-bool InspectorStyle::toggleProperty(unsigned index, bool disable)
+bool InspectorStyle::toggleProperty(ErrorString* errorString, unsigned index, bool disable)
 {
     ASSERT(m_parentStyleSheet);
-    if (!m_parentStyleSheet->ensureParsedDataReady())
-        return false; // Can toggle only source-based properties.
+    if (!m_parentStyleSheet->ensureParsedDataReady()) {
+        *errorString = "Can toggle only source-based properties";
+        return false;
+    }
     RefPtr<CSSRuleSourceData> sourceData = m_parentStyleSheet->ruleSourceDataFor(m_style.get());
-    if (!sourceData)
-        return false; // No source data for the style.
+    if (!sourceData) {
+        *errorString = "Internal error: No source data for the style found";
+        return false;
+    }
 
     Vector<InspectorStyleProperty> allProperties;
     populateAllProperties(&allProperties);
-    if (index >= allProperties.size())
-        return false; // Outside of property range.
+    if (index >= allProperties.size()) {
+        *errorString = "Property index is outside of property range";
+        return false;
+    }
 
     InspectorStyleProperty& property = allProperties.at(index);
     if (property.disabled == disable)
@@ -413,7 +435,7 @@ bool InspectorStyle::populateAllProperties(Vector<InspectorStyleProperty>* resul
             InspectorStyleProperty p(*it, true, false);
             p.setRawTextFromStyleDeclaration(styleDeclaration);
             result->append(p);
-            sourcePropertyNames.add(it->name);
+            sourcePropertyNames.add(it->name.lower());
         }
     }
 
@@ -424,10 +446,10 @@ bool InspectorStyle::populateAllProperties(Vector<InspectorStyleProperty>* resul
 
     for (int i = 0, size = m_style->length(); i < size; ++i) {
         String name = m_style->item(i);
-        if (sourcePropertyNames.contains(name))
+        if (sourcePropertyNames.contains(name.lower()))
             continue;
 
-        sourcePropertyNames.add(name);
+        sourcePropertyNames.add(name.lower());
         result->append(InspectorStyleProperty(CSSPropertySourceData(name, m_style->getPropertyValue(name), !m_style->getPropertyPriority(name).isEmpty(), true, SourceRange()), false, false));
     }
 
@@ -440,7 +462,7 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
     populateAllProperties(&properties);
 
     RefPtr<InspectorArray> propertiesObject = InspectorArray::create();
-    RefPtr<InspectorObject> shorthandValues = InspectorObject::create();
+    RefPtr<InspectorArray> shorthandEntries = InspectorArray::create();
     HashMap<String, RefPtr<InspectorObject> > propertyNameToPreviousActiveProperty;
     HashSet<String> foundShorthands;
 
@@ -466,8 +488,7 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
         if (!it->disabled) {
             if (it->hasSource) {
                 property->setBoolean("implicit", false);
-                property->setNumber("startOffset", propertyEntry.range.start);
-                property->setNumber("endOffset", propertyEntry.range.end);
+                property->setObject("range", buildSourceRangeObject(propertyEntry.range));
 
                 // Parsed property overrides any property with the same name. Non-parsed property overrides
                 // previous non-parsed property with the same name (if any).
@@ -511,7 +532,10 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
                 property->setString("shorthandName", shorthand);
                 if (!foundShorthands.contains(shorthand)) {
                     foundShorthands.add(shorthand);
-                    shorthandValues->setString(shorthand, shorthandValue(shorthand));
+                    RefPtr<InspectorObject> shorthandEntry = InspectorObject::create();
+                    shorthandEntry->setString("name", shorthand);
+                    shorthandEntry->setString("value", shorthandValue(shorthand));
+                    shorthandEntries->pushObject(shorthandEntry.release());
                 }
             }
         }
@@ -519,7 +543,7 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
     }
 
     result->setArray("cssProperties", propertiesObject);
-    result->setObject("shorthandValues", shorthandValues);
+    result->setArray("shorthandEntries", shorthandEntries);
 }
 
 
@@ -799,22 +823,26 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyle(CSSStyleDec
     return result.release();
 }
 
-bool InspectorStyleSheet::setPropertyText(const InspectorCSSId& id, unsigned propertyIndex, const String& text, bool overwrite)
+bool InspectorStyleSheet::setPropertyText(ErrorString* errorString, const InspectorCSSId& id, unsigned propertyIndex, const String& text, bool overwrite)
 {
     RefPtr<InspectorStyle> inspectorStyle = inspectorStyleForId(id);
-    if (!inspectorStyle)
+    if (!inspectorStyle) {
+        *errorString = "No style found for given id";
         return false;
+    }
 
-    return inspectorStyle->setPropertyText(propertyIndex, text, overwrite);
+    return inspectorStyle->setPropertyText(errorString, propertyIndex, text, overwrite);
 }
 
-bool InspectorStyleSheet::toggleProperty(const InspectorCSSId& id, unsigned propertyIndex, bool disable)
+bool InspectorStyleSheet::toggleProperty(ErrorString* errorString, const InspectorCSSId& id, unsigned propertyIndex, bool disable)
 {
     RefPtr<InspectorStyle> inspectorStyle = inspectorStyleForId(id);
-    if (!inspectorStyle)
+    if (!inspectorStyle) {
+        *errorString = "No style found for given id";
         return false;
+    }
 
-    bool success = inspectorStyle->toggleProperty(propertyIndex, disable);
+    bool success = inspectorStyle->toggleProperty(errorString, propertyIndex, disable);
     if (success) {
         if (disable)
             rememberInspectorStyle(inspectorStyle);
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.h b/Source/WebCore/inspector/InspectorStyleSheet.h
index 3048b1b..f98b49e 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.h
+++ b/Source/WebCore/inspector/InspectorStyleSheet.h
@@ -49,6 +49,8 @@ class Node;
 
 #if ENABLE(INSPECTOR)
 
+typedef String ErrorString;
+
 class InspectorCSSId {
 public:
     InspectorCSSId() { }
@@ -127,8 +129,8 @@ public:
     CSSStyleDeclaration* cssStyle() const { return m_style.get(); }
     PassRefPtr<InspectorObject> buildObjectForStyle() const;
     bool hasDisabledProperties() const { return !m_disabledProperties.isEmpty(); }
-    bool setPropertyText(unsigned index, const String& text, bool overwrite);
-    bool toggleProperty(unsigned index, bool disable);
+    bool setPropertyText(ErrorString*, unsigned index, const String& text, bool overwrite);
+    bool toggleProperty(ErrorString*, unsigned index, bool disable);
 
 private:
     InspectorStyle(const InspectorCSSId& styleId, PassRefPtr<CSSStyleDeclaration> style, InspectorStyleSheet* parentStyleSheet);
@@ -171,8 +173,8 @@ public:
     PassRefPtr<InspectorObject> buildObjectForStyleSheetInfo();
     PassRefPtr<InspectorObject> buildObjectForRule(CSSStyleRule*);
     PassRefPtr<InspectorObject> buildObjectForStyle(CSSStyleDeclaration*);
-    bool setPropertyText(const InspectorCSSId&, unsigned propertyIndex, const String& text, bool overwrite);
-    bool toggleProperty(const InspectorCSSId&, unsigned propertyIndex, bool disable);
+    bool setPropertyText(ErrorString*, const InspectorCSSId&, unsigned propertyIndex, const String& text, bool overwrite);
+    bool toggleProperty(ErrorString*, const InspectorCSSId&, unsigned propertyIndex, bool disable);
 
     virtual bool text(String* result) const;
     virtual CSSStyleDeclaration* styleForId(const InspectorCSSId&) const;
diff --git a/Source/WebCore/inspector/ScriptBreakpoint.h b/Source/WebCore/inspector/ScriptBreakpoint.h
index 4917aef..920fb3f 100644
--- a/Source/WebCore/inspector/ScriptBreakpoint.h
+++ b/Source/WebCore/inspector/ScriptBreakpoint.h
@@ -39,18 +39,16 @@ struct ScriptBreakpoint {
     {
     }
 
-    ScriptBreakpoint(int lineNumber, int columnNumber, const String& condition, bool enabled)
+    ScriptBreakpoint(int lineNumber, int columnNumber, const String& condition)
         : lineNumber(lineNumber)
         , columnNumber(columnNumber)
         , condition(condition)
-        , enabled(enabled)
     {
     }
 
     int lineNumber;
     int columnNumber;
     String condition;
-    bool enabled;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/ScriptCallFrame.cpp b/Source/WebCore/inspector/ScriptCallFrame.cpp
index 0b5204b..641d192 100644
--- a/Source/WebCore/inspector/ScriptCallFrame.cpp
+++ b/Source/WebCore/inspector/ScriptCallFrame.cpp
@@ -60,9 +60,9 @@ PassRefPtr<InspectorObject> ScriptCallFrame::buildInspectorObject() const
 {
     RefPtr<InspectorObject> frame = InspectorObject::create();
     frame->setString("functionName", m_functionName);
-    frame->setString("scriptName", m_scriptName);
+    frame->setString("url", m_scriptName);
     frame->setNumber("lineNumber", m_lineNumber);
-    frame->setNumber("column", m_column);
+    frame->setNumber("columnNumber", m_column);
     return frame;
 }
 #endif
diff --git a/Source/WebCore/inspector/ScriptDebugListener.h b/Source/WebCore/inspector/ScriptDebugListener.h
index a28cabb..4a93a4c 100644
--- a/Source/WebCore/inspector/ScriptDebugListener.h
+++ b/Source/WebCore/inspector/ScriptDebugListener.h
@@ -37,16 +37,11 @@
 
 namespace WebCore {
 
-enum ScriptWorldType {
-MAIN_WORLD = 0,
-EXTENSIONS_WORLD
-};
-
 class ScriptDebugListener {
 public:
     virtual ~ScriptDebugListener() { }
 
-    virtual void didParseSource(const String&  sourceID, const String& url, const String& data, int lineOffset, int columnOffset, ScriptWorldType) = 0;
+    virtual void didParseSource(const String&  sourceID, const String& url, const String& data, int lineOffset, int columnOffset, bool isContentScript) = 0;
     virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage) = 0;
     virtual void didPause(ScriptState*) = 0;
     virtual void didContinue() = 0;
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
index afd00a5..14bde38 100755
--- a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
@@ -54,10 +54,12 @@ WorkerDebuggerAgent::~WorkerDebuggerAgent()
 
 void WorkerDebuggerAgent::startListeningScriptDebugServer()
 {
+    scriptDebugServer().addListener(this, m_inspectedWorkerContext);
 }
 
 void WorkerDebuggerAgent::stopListeningScriptDebugServer()
 {
+    scriptDebugServer().removeListener(this, m_inspectedWorkerContext);
 }
 
 WorkerScriptDebugServer& WorkerDebuggerAgent::scriptDebugServer()
diff --git a/Source/WebCore/inspector/WorkerInspectorController.cpp b/Source/WebCore/inspector/WorkerInspectorController.cpp
new file mode 100644
index 0000000..383cb04
--- /dev/null
+++ b/Source/WebCore/inspector/WorkerInspectorController.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(INSPECTOR) && ENABLE(WORKERS)
+
+#include "WorkerInspectorController.h"
+
+#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
+#include "InspectorBackendDispatcher.h"
+#include "InspectorClient.h"
+#include "InspectorFrontend.h"
+#include "InspectorFrontendChannel.h"
+#include "InspectorRuntimeAgent.h"
+#include "InspectorState.h"
+#include "InstrumentingAgents.h"
+#include "WorkerDebuggerAgent.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+namespace {
+
+class WorkerRuntimeAgent : public InspectorRuntimeAgent {
+public:
+    WorkerRuntimeAgent(InjectedScriptManager* injectedScriptManager, WorkerContext* workerContext)
+        : InspectorRuntimeAgent(injectedScriptManager)
+        , m_workerContext(workerContext) { }
+    virtual ~WorkerRuntimeAgent() { }
+
+private:
+    virtual ScriptState* getDefaultInspectedState()
+    {
+        return scriptStateFromWorkerContext(m_workerContext);
+    }
+
+    WorkerContext* m_workerContext;
+};
+
+}
+
+WorkerInspectorController::WorkerInspectorController(WorkerContext* workerContext)
+    : m_workerContext(workerContext)
+    , m_state(new InspectorState(0))
+    , m_instrumentingAgents(new InstrumentingAgents())
+    , m_injectedScriptManager(InjectedScriptManager::createForWorker())
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    , m_debuggerAgent(WorkerDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), workerContext, m_injectedScriptManager.get()))
+#endif
+    , m_runtimeAgent(adoptPtr(new WorkerRuntimeAgent(m_injectedScriptManager.get(), workerContext)))
+{
+    m_injectedScriptManager->injectedScriptHost()->init(0
+        , 0
+#if ENABLE(DATABASE)
+        , 0
+#endif
+#if ENABLE(DOM_STORAGE)
+        , 0
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        , m_debuggerAgent.get()
+#endif
+    );
+}
+ 
+WorkerInspectorController::~WorkerInspectorController()
+{
+}
+
+void WorkerInspectorController::connectFrontend(InspectorFrontendChannel* channel)
+{
+    ASSERT(!m_frontend);
+    m_state->unmute();
+    m_frontend = new InspectorFrontend(channel);
+    m_backendDispatcher = new InspectorBackendDispatcher(
+        channel,
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        0, // InspectorApplicationCacheAgent
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        0, // InspectorBrowserDebuggerAgent
+#endif
+        0, // InspectorCSSAgent
+        0, // InspectorConsoleAgent
+        0, // InspectorDOMAgent
+#if ENABLE(DOM_STORAGE)
+        0, // InspectorDOMStorageAgent
+#endif
+#if ENABLE(DATABASE)
+        0, // InspectorDatabaseAgent
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_debuggerAgent.get(),
+#endif
+        0, // InspectorResourceAgent
+        0, // InspectorPageAgent
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        0, // InspectorProfilerAgent
+#endif
+        m_runtimeAgent.get(),
+        0 // InspectorTimelineAgent
+    );
+
+    m_injectedScriptManager->injectedScriptHost()->setFrontend(m_frontend.get());
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    m_debuggerAgent->setFrontend(m_frontend.get());
+#endif
+}
+
+void WorkerInspectorController::disconnectFrontend()
+{
+    if (!m_frontend)
+        return;
+    m_backendDispatcher.clear();
+    // Destroying agents would change the state, but we don't want that.
+    // Pre-disconnect state will be used to restore inspector agents.
+    m_state->mute();
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    m_debuggerAgent->clearFrontend();
+#endif
+    m_injectedScriptManager->injectedScriptHost()->clearFrontend();
+
+    m_frontend.clear();
+}
+
+void WorkerInspectorController::dispatchMessageFromFrontend(const String& message)
+{
+    if (m_backendDispatcher)
+        m_backendDispatcher->dispatch(message);
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/inspector/WorkerInspectorController.h b/Source/WebCore/inspector/WorkerInspectorController.h
new file mode 100644
index 0000000..404c5a6
--- /dev/null
+++ b/Source/WebCore/inspector/WorkerInspectorController.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerInspectorController_h
+#define WorkerInspectorController_h
+
+#if ENABLE(INSPECTOR) && ENABLE(WORKERS)
+
+#include <wtf/FastAllocBase.h>
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+class InjectedScriptManager;
+class InspectorDebuggerAgent;
+class InspectorBackendDispatcher;
+class InspectorFrontend;
+class InspectorFrontendChannel;
+class InspectorInstrumentation;
+class InspectorRuntimeAgent;
+class InspectorState;
+class InstrumentingAgents;
+class WorkerContext;
+
+class WorkerInspectorController {
+    WTF_MAKE_NONCOPYABLE(WorkerInspectorController);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    WorkerInspectorController(WorkerContext*);
+    ~WorkerInspectorController();
+
+    void connectFrontend(InspectorFrontendChannel*);
+    void disconnectFrontend();
+    void dispatchMessageFromFrontend(const String&);
+
+private:
+    WorkerContext* m_workerContext;
+    OwnPtr<InspectorState> m_state;
+    OwnPtr<InstrumentingAgents> m_instrumentingAgents;
+    OwnPtr<InjectedScriptManager> m_injectedScriptManager;
+    OwnPtr<InspectorDebuggerAgent> m_debuggerAgent;
+    OwnPtr<InspectorRuntimeAgent> m_runtimeAgent;
+
+    OwnPtr<InspectorFrontend> m_frontend;
+    OwnPtr<InspectorBackendDispatcher> m_backendDispatcher;
+};
+
+}
+
+#endif // ENABLE(WORKERS)
+
+#endif // !defined(WorkerInspectorController_h)
diff --git a/Source/WebCore/combine-javascript-resources b/Source/WebCore/inspector/combine-javascript-resources.pl
index 428b6b7..428b6b7 100755
--- a/Source/WebCore/combine-javascript-resources
+++ b/Source/WebCore/inspector/combine-javascript-resources.pl
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index ddab1df..19a2c24 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -63,18 +63,6 @@ WebInspector.AuditRules.getDomainToResourcesMap = function(resources, types, nee
     return domainToResourcesMap;
 }
 
-WebInspector.AuditRules.evaluateInTargetWindow = function(func, args, callback)
-{
-    function mycallback(error, result)
-    {
-        if (!error && result)
-            callback(JSON.parse(result.description));
-        else
-            callback(null);
-    }
-    RuntimeAgent.evaluate("JSON.stringify((" + func + ")(" + JSON.stringify(args) + "))", "", false, mycallback);
-}
-
 WebInspector.AuditRules.GzipRule = function()
 {
     WebInspector.AuditRule.call(this, "network-gzip", "Enable gzip compression");
@@ -322,7 +310,7 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
                     for (var curRule = 0; curRule < styleSheet.rules.length; ++curRule) {
                         var rule = styleSheet.rules[curRule];
                         // Exact computation whenever source ranges are available.
-                        var textLength = (rule.selectorRange && rule.style.properties.endOffset) ? rule.style.properties.endOffset - rule.selectorRange.start + 1 : 0;
+                        var textLength = (rule.selectorRange && rule.style.range && rule.style.range.end) ? rule.style.range.end - rule.selectorRange.start + 1 : 0;
                         if (!textLength && rule.style.cssText)
                             textLength = rule.style.cssText.length + rule.selectorText.length;
                         stylesheetSize += textLength;
@@ -360,21 +348,21 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
                 callback(result);
             }
 
-            function routine(selectorArray)
+            var foundSelectors = {};
+            function queryCallback(boundSelectorsCallback, selector, styleSheets, testedSelectors, nodeId)
             {
-                var result = {};
-                for (var i = 0; i < selectorArray.length; ++i) {
-                    try {
-                        if (document.querySelector(selectorArray[i]))
-                            result[selectorArray[i]] = true;
-                    } catch(e) {
-                        // Ignore and mark as unused.
-                    }
-                }
-                return result;
+                if (nodeId)
+                    foundSelectors[selector] = true;
+                if (boundSelectorsCallback)
+                    boundSelectorsCallback(foundSelectors);
             }
 
-            WebInspector.AuditRules.evaluateInTargetWindow(routine, [selectors], selectorsCallback.bind(null, callback, styleSheets, testedSelectors));
+            function documentLoaded(selectors, document) {
+                for (var i = 0; i < selectors.length; ++i)
+                    WebInspector.domAgent.querySelector(document.id, selectors[i], queryCallback.bind(null, i === selectors.length - 1 ? selectorsCallback.bind(null, callback, styleSheets, testedSelectors) : null, selectors[i], styleSheets, testedSelectors));
+            }
+
+            WebInspector.domAgent.requestDocument(documentLoaded.bind(null, selectors));
         }
 
         function styleSheetCallback(styleSheets, sourceURL, continuation, styleSheet)
@@ -721,20 +709,22 @@ WebInspector.AuditRules.ImageDimensionsRule.prototype = {
                 doneCallback();
         }
 
-        function getStyles(error, nodeIds)
+        function getStyles(nodeIds)
         {
-            if (error)
+            if (!nodeIds) {
+                console.error("Failed to get styles");
                 return;
+            }
             for (var i = 0; i < nodeIds.length; ++i)
                 WebInspector.cssModel.getStylesAsync(nodeIds[i], imageStylesReady.bind(this, nodeIds[i], i === nodeIds.length - 1));
         }
 
-        function getImages()
+        function onDocumentAvailable(root)
         {
-            DOMAgent.querySelectorAll(0, "img[src]", true, getStyles);
+            WebInspector.domAgent.querySelectorAll(root.id, "img[src]", getStyles);
         }
 
-        WebInspector.domAgent.requestDocument(getImages);
+        WebInspector.domAgent.requestDocument(onDocumentAvailable);
     }
 }
 
@@ -771,46 +761,35 @@ WebInspector.AuditRules.CssInHeadRule.prototype = {
             callback(result);
         }
 
-        function routine()
+        function externalStylesheetsReceived(root, inlineStyleNodeIds, nodeIds)
         {
-            function allViews() {
-                var views = [document.defaultView];
-                var curView = 0;
-                while (curView < views.length) {
-                    var view = views[curView];
-                    var frames = view.frames;
-                    for (var i = 0; i < frames.length; ++i) {
-                        if (frames[i] !== view)
-                            views.push(frames[i]);
-                    }
-                    ++curView;
+            var externalStylesheetNodeIds = nodeIds;
+            var result = null;
+            if (inlineStyleNodeIds.length || externalStylesheetNodeIds.length) {
+                var urlToViolationsArray = {};
+                var externalStylesheetHrefs = [];
+                for (var j = 0; j < externalStylesheetNodeIds.length; ++j) {
+                    var linkNode = WebInspector.domAgent.nodeForId(externalStylesheetNodeIds[j]);
+                    var completeHref = WebInspector.completeURL(linkNode.ownerDocument.documentURL, linkNode.getAttribute("href"));
+                    externalStylesheetHrefs.push(completeHref || "<empty>");
                 }
-                return views;
+                urlToViolationsArray[root.documentURL] = [inlineStyleNodeIds.length, externalStylesheetHrefs];
+                result = urlToViolationsArray;
             }
+            evalCallback(result);
+        }
 
-            var views = allViews();
-            var urlToViolationsArray = {};
-            var found = false;
-            for (var i = 0; i < views.length; ++i) {
-                var view = views[i];
-                if (!view.document)
-                    continue;
-
-                var inlineStyles = view.document.querySelectorAll("body style");
-                var inlineStylesheets = view.document.querySelectorAll("body link[rel~='stylesheet'][href]");
-                if (!inlineStyles.length && !inlineStylesheets.length)
-                    continue;
+        function inlineStylesReceived(root, nodeIds)
+        {
+            WebInspector.domAgent.querySelectorAll(root.id, "body link[rel~='stylesheet'][href]", externalStylesheetsReceived.bind(null, root, nodeIds));
+        }
 
-                found = true;
-                var inlineStylesheetHrefs = [];
-                for (var j = 0; j < inlineStylesheets.length; ++j)
-                    inlineStylesheetHrefs.push(inlineStylesheets[j].href);
-                urlToViolationsArray[view.location.href] = [inlineStyles.length, inlineStylesheetHrefs];
-            }
-            return found ? urlToViolationsArray : null;
+        function onDocumentAvailable(root)
+        {
+            WebInspector.domAgent.querySelectorAll(root.id, "body style", inlineStylesReceived.bind(null, root));
         }
 
-        WebInspector.AuditRules.evaluateInTargetWindow(routine, [], evalCallback);
+        WebInspector.domAgent.requestDocument(onDocumentAvailable);
     }
 }
 
@@ -844,20 +823,34 @@ WebInspector.AuditRules.StylesScriptsOrderRule.prototype = {
             callback(result);
         }
 
-        function routine()
+        function cssBeforeInlineReceived(lateStyleIds, nodeIds)
+        {
+            var cssBeforeInlineCount = nodeIds.length;
+            var result = null;
+            if (lateStyleIds.length || cssBeforeInlineCount) {
+                var lateStyleUrls = [];
+                for (var i = 0; i < lateStyleIds.length; ++i) {
+                    var lateStyleNode = WebInspector.domAgent.nodeForId(lateStyleIds[i]);
+                    var completeHref = WebInspector.completeURL(lateStyleNode.ownerDocument.documentURL, lateStyleNode.getAttribute("href"));
+                    lateStyleUrls.push(completeHref || "<empty>");
+                }
+                result = [ lateStyleUrls, cssBeforeInlineCount ];
+            }
+
+            evalCallback(result);
+        }
+
+        function lateStylesReceived(root, nodeIds)
+        {
+            WebInspector.domAgent.querySelectorAll(root.id, "head link[rel~='stylesheet'][href] ~ script:not([src])", cssBeforeInlineReceived.bind(null, nodeIds));
+        }
+
+        function onDocumentAvailable(root)
         {
-            var lateStyles = document.querySelectorAll("head script[src] ~ link[rel~='stylesheet'][href]");
-            var cssBeforeInlineCount = document.querySelectorAll("head link[rel~='stylesheet'][href] ~ script:not([src])").length;
-            if (!lateStyles.length && !cssBeforeInlineCount)
-                return null;
-
-            var lateStyleUrls = [];
-            for (var i = 0; i < lateStyles.length; ++i)
-                lateStyleUrls.push(lateStyles[i].href);
-            return [ lateStyleUrls, cssBeforeInlineCount ];
+            WebInspector.domAgent.querySelectorAll(root.id, "head script[src] ~ link[rel~='stylesheet'][href]", lateStylesReceived.bind(null, root));
         }
 
-        WebInspector.AuditRules.evaluateInTargetWindow(routine, [], evalCallback.bind(this));
+        WebInspector.domAgent.requestDocument(onDocumentAvailable);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/BreakpointManager.js b/Source/WebCore/inspector/front-end/BreakpointManager.js
deleted file mode 100644
index 76348ff..0000000
--- a/Source/WebCore/inspector/front-end/BreakpointManager.js
+++ /dev/null
@@ -1,437 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.BreakpointManager = function()
-{
-    this._stickyBreakpoints = {};
-    var breakpoints = WebInspector.settings.findSettingForAllProjects("nativeBreakpoints");
-    for (var projectId in breakpoints)
-        this._stickyBreakpoints[projectId] = this._validateBreakpoints(breakpoints[projectId]);
-
-    this._breakpoints = {};
-    this._domBreakpointsRestored = false;
-
-    WebInspector.settings.addEventListener(WebInspector.Settings.Events.ProjectChanged, this._projectChanged, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
-}
-
-WebInspector.BreakpointManager.BreakpointTypes = {
-    DOM: "DOM",
-    EventListener: "EventListener",
-    XHR: "XHR"
-}
-
-WebInspector.BreakpointManager.Events = {
-    DOMBreakpointAdded: "dom-breakpoint-added",
-    ProjectChanged: "project-changed"
-}
-
-WebInspector.BreakpointManager.prototype = {
-    createDOMBreakpoint: function(nodeId, type)
-    {
-        this._createDOMBreakpoint(nodeId, type, true, false);
-    },
-
-    _createDOMBreakpoint: function(nodeId, type, enabled, restored)
-    {
-        var node = WebInspector.domAgent.nodeForId(nodeId);
-        if (!node)
-            return;
-
-        var breakpointId = this._createDOMBreakpointId(nodeId, type);
-        if (breakpointId in this._breakpoints)
-            return;
-
-        var breakpoint = new WebInspector.DOMBreakpoint(node, type);
-        this._setBreakpoint(breakpointId, breakpoint, enabled, restored);
-        if (enabled && restored)
-            breakpoint._enable();
-
-        breakpoint.view = new WebInspector.DOMBreakpointView(this, breakpointId, enabled, node, type);
-        this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.DOMBreakpointAdded, breakpoint.view);
-    },
-
-    _setBreakpoint: function(breakpointId, breakpoint, enabled, restored)
-    {
-        this._breakpoints[breakpointId] = breakpoint;
-        breakpoint.enabled = enabled;
-        if (restored)
-            return;
-        if (enabled)
-            breakpoint._enable();
-        this._saveBreakpoints();
-    },
-
-    _setBreakpointEnabled: function(breakpointId, enabled)
-    {
-        var breakpoint = this._breakpoints[breakpointId];
-        if (breakpoint.enabled === enabled)
-            return;
-        if (enabled)
-            breakpoint._enable();
-        else
-            breakpoint._disable();
-        breakpoint.enabled = enabled;
-        this._saveBreakpoints();
-    },
-
-    _removeBreakpoint: function(breakpointId)
-    {
-        var breakpoint = this._breakpoints[breakpointId];
-        if (breakpoint.enabled)
-            breakpoint._disable();
-        delete this._breakpoints[breakpointId];
-        this._saveBreakpoints();
-    },
-
-    breakpointViewForEventData: function(eventData)
-    {
-        var breakpointId;
-        if (eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.DOM)
-            breakpointId = this._createDOMBreakpointId(eventData.nodeId, eventData.type);
-        else
-            return;
-
-        var breakpoint = this._breakpoints[breakpointId];
-        if (breakpoint)
-            return breakpoint.view;
-    },
-
-    _debuggerPaused: function(event)
-    {
-        var eventType = event.data.eventType;
-        var eventData = event.data.eventData;
-
-        if (eventType !== WebInspector.DebuggerEventTypes.NativeBreakpoint)
-            return;
-
-        var breakpointView = this.breakpointViewForEventData(eventData);
-        if (!breakpointView)
-            return;
-
-        breakpointView.hit = true;
-        this._lastHitBreakpointView = breakpointView;
-    },
-
-    _debuggerResumed: function(event)
-    {
-        if (!this._lastHitBreakpointView)
-            return;
-        this._lastHitBreakpointView.hit = false;
-        delete this._lastHitBreakpointView;
-    },
-
-    _projectChanged: function(event)
-    {
-        this._breakpoints = {};
-        this._domBreakpointsRestored = false;
-        this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.ProjectChanged);
-    },
-
-    restoreDOMBreakpoints: function()
-    {
-        function didPushNodeByPathToFrontend(path, nodeId)
-        {
-            if (!nodeId)
-                return;
-
-            pathToNodeId[path] = nodeId;
-            pendingCalls -= 1;
-            if (pendingCalls)
-                return;
-            for (var i = 0; i < breakpoints.length; ++i) {
-                var breakpoint = breakpoints[i];
-                if (breakpoint.type !== WebInspector.BreakpointManager.BreakpointTypes.DOM)
-                    continue;
-                var nodeId = pathToNodeId[breakpoint.condition.path];
-                if (nodeId)
-                    this._createDOMBreakpoint(nodeId, breakpoint.condition.type, breakpoint.enabled, true);
-            }
-            this._domBreakpointsRestored = true;
-            this._saveBreakpoints();
-        }
-
-        var breakpoints = this._stickyBreakpoints[WebInspector.settings.projectId] || [];
-        var pathToNodeId = {};
-        var pendingCalls = 0;
-        for (var i = 0; i < breakpoints.length; ++i) {
-            if (breakpoints[i].type !== WebInspector.BreakpointManager.BreakpointTypes.DOM)
-                continue;
-            var path = breakpoints[i].condition.path;
-            if (path in pathToNodeId)
-                continue;
-            pathToNodeId[path] = 0;
-            pendingCalls += 1;
-            WebInspector.domAgent.pushNodeByPathToFrontend(path, didPushNodeByPathToFrontend.bind(this, path));
-        }
-        if (!pendingCalls)
-            this._domBreakpointsRestored = true;
-    },
-
-    _saveBreakpoints: function()
-    {
-        var breakpoints = [];
-        for (var breakpointId in this._breakpoints) {
-            var breakpoint = this._breakpoints[breakpointId];
-            var persistentBreakpoint = breakpoint._serializeToJSON();
-            persistentBreakpoint.enabled = breakpoint.enabled;
-            breakpoints.push(persistentBreakpoint);
-        }
-        if (!this._domBreakpointsRestored) {
-            var stickyBreakpoints = this._stickyBreakpoints[WebInspector.settings.projectId] || [];
-            for (var i = 0; i < stickyBreakpoints.length; ++i) {
-                if (stickyBreakpoints[i].type === WebInspector.BreakpointManager.BreakpointTypes.DOM)
-                    breakpoints.push(stickyBreakpoints[i]);
-            }
-        }
-        WebInspector.settings.nativeBreakpoints = breakpoints;
-
-        this._stickyBreakpoints[WebInspector.settings.projectId] = breakpoints;
-    },
-
-    _validateBreakpoints: function(persistentBreakpoints)
-    {
-        var breakpoints = [];
-        var breakpointsSet = {};
-        for (var i = 0; i < persistentBreakpoints.length; ++i) {
-            var breakpoint = persistentBreakpoints[i];
-            if (!("type" in breakpoint && "enabled" in breakpoint && "condition" in breakpoint))
-                continue;
-            var id = breakpoint.type + ":";
-            var condition = breakpoint.condition;
-            if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.DOM) {
-                if (typeof condition.path !== "string" || typeof condition.type !== "number")
-                    continue;
-                id += condition.path + ":" + condition.type;
-            } else
-                continue;
-
-            if (id in breakpointsSet)
-                continue;
-            breakpointsSet[id] = true;
-            breakpoints.push(breakpoint);
-        }
-        return breakpoints;
-    },
-
-    _createDOMBreakpointId: function(nodeId, type)
-    {
-        return "dom:" + nodeId + ":" + type;
-    }
-}
-
-WebInspector.BreakpointManager.prototype.__proto__ = WebInspector.Object.prototype;
-
-WebInspector.DOMBreakpoint = function(node, type)
-{
-    this._nodeId = node.id;
-    this._path = node.path();
-    this._type = type;
-}
-
-WebInspector.DOMBreakpoint.prototype = {
-    _enable: function()
-    {
-        BrowserDebuggerAgent.setDOMBreakpoint(this._nodeId, this._type);
-    },
-
-    _disable: function()
-    {
-        BrowserDebuggerAgent.removeDOMBreakpoint(this._nodeId, this._type);
-    },
-
-    _serializeToJSON: function()
-    {
-        var type = WebInspector.BreakpointManager.BreakpointTypes.DOM;
-        return { type: type, condition: { path: this._path, type: this._type } };
-    }
-}
-
-WebInspector.NativeBreakpointView = function(manager, id, enabled)
-{
-    this._manager = manager;
-    this._id = id;
-    this._enabled = enabled;
-    this._hit = false;
-}
-
-WebInspector.NativeBreakpointView.prototype = {
-    get enabled()
-    {
-        return this._enabled;
-    },
-
-    set enabled(enabled)
-    {
-        this._manager._setBreakpointEnabled(this._id, enabled);
-        this._enabled = enabled;
-        this.dispatchEventToListeners("enable-changed");
-    },
-
-    get hit()
-    {
-        return this._hit;
-    },
-
-    set hit(hit)
-    {
-        this._hit = hit;
-        this.dispatchEventToListeners("hit-state-changed");
-    },
-
-    remove: function()
-    {
-        this._manager._removeBreakpoint(this._id);
-        this._onRemove();
-        this.dispatchEventToListeners("removed");
-    },
-
-    _compare: function(x, y)
-    {
-        if (x !== y)
-            return x < y ? -1 : 1;
-        return 0;
-    },
-
-    _onRemove: function()
-    {
-    }
-}
-
-WebInspector.NativeBreakpointView.prototype.__proto__ = WebInspector.Object.prototype;
-
-WebInspector.DOMBreakpointView = function(manager, id, enabled, node, type)
-{
-    WebInspector.NativeBreakpointView.call(this, manager, id, enabled);
-    this._node = node;
-    this._nodeId = node.id;
-    this._type = type;
-    node.breakpoints[this._type] = this;
-}
-
-WebInspector.DOMBreakpointView.prototype = {
-    compareTo: function(other)
-    {
-        return this._compare(this._type, other._type);
-    },
-
-    populateLabelElement: function(element)
-    {
-        // FIXME: this should belong to the view, not the manager.
-        var linkifiedNode = WebInspector.panels.elements.linkifyNodeById(this._nodeId);
-        linkifiedNode.addStyleClass("monospace");
-        element.appendChild(linkifiedNode);
-        var description = document.createElement("div");
-        description.className = "source-text";
-        description.textContent = WebInspector.domBreakpointTypeLabel(this._type);
-        element.appendChild(description);
-    },
-
-    populateStatusMessageElement: function(element, eventData)
-    {
-        if (this._type === WebInspector.DOMBreakpointTypes.SubtreeModified) {
-            var targetNodeObject = WebInspector.RemoteObject.fromPayload(eventData.targetNode);
-            targetNodeObject.pushNodeToFrontend(decorateNode.bind(this));
-            function decorateNode(targetNodeId)
-            {
-                if (!targetNodeId)
-                    return;
-
-                targetNodeObject.release();
-                var targetNode = WebInspector.panels.elements.linkifyNodeById(targetNodeId);
-                if (eventData.insertion) {
-                    if (targetNodeId !== this._nodeId)
-                        this._format(element, "Paused on a \"%s\" breakpoint set on %s, because a new child was added to its descendant %s.", targetNode);
-                    else
-                        this._format(element, "Paused on a \"%s\" breakpoint set on %s, because a new child was added to that node.");
-                } else
-                    this._format(element, "Paused on a \"%s\" breakpoint set on %s, because its descendant %s was removed.", targetNode);
-            }
-        } else
-            this._format(element, "Paused on a \"%s\" breakpoint set on %s.");
-    },
-
-    _format: function(element, message, extraSubstitution)
-    {
-        var substitutions = [WebInspector.domBreakpointTypeLabel(this._type), WebInspector.panels.elements.linkifyNodeById(this._nodeId)];
-        if (extraSubstitution)
-            substitutions.push(extraSubstitution);
-
-        var formatters = {
-            s: function(substitution)
-            {
-                return substitution;
-            }
-        };
-        function append(a, b)
-        {
-            if (typeof b === "string")
-                b = document.createTextNode(b);
-            element.appendChild(b);
-        }
-        WebInspector.formatLocalized(message, substitutions, formatters, "", append);
-    },
-
-    _onRemove: function()
-    {
-        delete this._node.breakpoints[this._type];
-    }
-}
-
-WebInspector.DOMBreakpointView.prototype.__proto__ = WebInspector.NativeBreakpointView.prototype;
-
-WebInspector.DOMBreakpointTypes = {
-    SubtreeModified: 0,
-    AttributeModified: 1,
-    NodeRemoved: 2
-};
-
-WebInspector.domBreakpointTypeLabel = function(type)
-{
-    if (!WebInspector._DOMBreakpointTypeLabels) {
-        WebInspector._DOMBreakpointTypeLabels = {};
-        WebInspector._DOMBreakpointTypeLabels[WebInspector.DOMBreakpointTypes.SubtreeModified] = WebInspector.UIString("Subtree Modified");
-        WebInspector._DOMBreakpointTypeLabels[WebInspector.DOMBreakpointTypes.AttributeModified] = WebInspector.UIString("Attribute Modified");
-        WebInspector._DOMBreakpointTypeLabels[WebInspector.DOMBreakpointTypes.NodeRemoved] = WebInspector.UIString("Node Removed");
-    }
-    return WebInspector._DOMBreakpointTypeLabels[type];
-}
-
-WebInspector.domBreakpointTypeContextMenuLabel = function(type)
-{
-    if (!WebInspector._DOMBreakpointTypeContextMenuLabels) {
-        WebInspector._DOMBreakpointTypeContextMenuLabels = {};
-        WebInspector._DOMBreakpointTypeContextMenuLabels[WebInspector.DOMBreakpointTypes.SubtreeModified] = WebInspector.UIString("Break on Subtree Modifications");
-        WebInspector._DOMBreakpointTypeContextMenuLabels[WebInspector.DOMBreakpointTypes.AttributeModified] = WebInspector.UIString("Break on Attributes Modifications");
-        WebInspector._DOMBreakpointTypeContextMenuLabels[WebInspector.DOMBreakpointTypes.NodeRemoved] = WebInspector.UIString("Break on Node Removal");
-    }
-    return WebInspector._DOMBreakpointTypeContextMenuLabels[type];
-}
diff --git a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 63a6e2a..d2d7257 100644
--- a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -23,11 +23,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.JavaScriptBreakpointsSidebarPane = function(model)
+WebInspector.JavaScriptBreakpointsSidebarPane = function(model, showSourceLineDelegate)
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Breakpoints"));
 
     this._model = model;
+    this._showSourceLineDelegate = showSourceLineDelegate;
 
     this.listElement = document.createElement("ol");
     this.listElement.className = "breakpoint-list";
@@ -123,7 +124,7 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
 
     _breakpointClicked: function(breakpoint, event)
     {
-        WebInspector.panels.scripts.showSourceLine(breakpoint.sourceFileId, breakpoint.lineNumber + 1);
+        this._showSourceLineDelegate(breakpoint.sourceFileId, breakpoint.lineNumber);
     },
 
     _breakpointCheckboxClicked: function(breakpoint, event)
@@ -203,41 +204,9 @@ WebInspector.NativeBreakpointsSidebarPane = function(title)
     this.emptyElement.textContent = WebInspector.UIString("No Breakpoints");
 
     this.bodyElement.appendChild(this.emptyElement);
-
-    WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.ProjectChanged, this._projectChanged, this);
 }
 
 WebInspector.NativeBreakpointsSidebarPane.prototype = {
-    addBreakpointItem: function(breakpointItem)
-    {
-        var element = breakpointItem.element;
-        element._breakpointItem = breakpointItem;
-
-        breakpointItem.addEventListener("breakpoint-hit", this.expand, this);
-        breakpointItem.addEventListener("removed", this._removeListElement.bind(this, element), this);
-
-        var currentElement = this.listElement.firstChild;
-        while (currentElement) {
-            if (currentElement._breakpointItem && currentElement._breakpointItem.compareTo(element._breakpointItem) > 0)
-                break;
-            currentElement = currentElement.nextSibling;
-        }
-        this._addListElement(element, currentElement);
-
-        if (breakpointItem.click) {
-            element.addStyleClass("cursor-pointer");
-            element.addEventListener("click", breakpointItem.click.bind(breakpointItem), false);
-        }
-        element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this, breakpointItem), true);
-    },
-
-    _contextMenuEventFired: function(breakpointItem, event)
-    {
-        var contextMenu = new WebInspector.ContextMenu();
-        contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), breakpointItem.remove.bind(breakpointItem));
-        contextMenu.show(event);
-    },
-
     _addListElement: function(element, beforeElement)
     {
         if (beforeElement)
@@ -260,7 +229,7 @@ WebInspector.NativeBreakpointsSidebarPane.prototype = {
         }
     },
 
-    _projectChanged: function()
+    _reset: function()
     {
         this.listElement.removeChildren();
         if (this.listElement.parentElement) {
@@ -377,9 +346,9 @@ WebInspector.XHRBreakpointsSidebarPane.prototype = {
     _checkboxClicked: function(url, event)
     {
         if (event.target.checked)
-            WebInspector.breakpointManager.setXHRBreakpoint(url);
+            BrowserDebuggerAgent.setXHRBreakpoint(url);
         else
-            WebInspector.breakpointManager.removeXHRBreakpoint(url);
+            BrowserDebuggerAgent.removeXHRBreakpoint(url);
         this._saveBreakpoints();
     },
 
@@ -443,98 +412,11 @@ WebInspector.XHRBreakpointsSidebarPane.prototype = {
             if (breakpoint && typeof breakpoint.url === "string")
                 this._setBreakpoint(breakpoint.url, breakpoint.enabled);
         }
-    },
-
-    _projectChanged: function()
-    {
     }
 }
 
 WebInspector.XHRBreakpointsSidebarPane.prototype.__proto__ = WebInspector.NativeBreakpointsSidebarPane.prototype;
 
-WebInspector.BreakpointItem = function(breakpoint)
-{
-    this._breakpoint = breakpoint;
-
-    this._element = document.createElement("li");
-
-    var checkboxElement = document.createElement("input");
-    checkboxElement.className = "checkbox-elem";
-    checkboxElement.type = "checkbox";
-    checkboxElement.checked = this._breakpoint.enabled;
-    checkboxElement.addEventListener("click", this._checkboxClicked.bind(this), false);
-    this._element.appendChild(checkboxElement);
-
-    this._createLabelElement();
-
-    this._breakpoint.addEventListener("enable-changed", this._enableChanged, this);
-    this._breakpoint.addEventListener("hit-state-changed", this._hitStateChanged, this);
-    this._breakpoint.addEventListener("label-changed", this._labelChanged, this);
-    this._breakpoint.addEventListener("removed", this.dispatchEventToListeners.bind(this, "removed"));
-    if (breakpoint.click)
-        this.click = breakpoint.click.bind(breakpoint);
-}
-
-WebInspector.BreakpointItem.prototype = {
-    get element()
-    {
-        return this._element;
-    },
-
-    compareTo: function(other)
-    {
-        return this._breakpoint.compareTo(other._breakpoint);
-    },
-
-    populateEditElement: function(element)
-    {
-        this._breakpoint.populateEditElement(element);
-    },
-
-    remove: function()
-    {
-        this._breakpoint.remove();
-    },
-
-    _checkboxClicked: function(event)
-    {
-        this._breakpoint.enabled = !this._breakpoint.enabled;
-
-        // Breakpoint element may have it's own click handler.
-        event.stopPropagation();
-    },
-
-    _enableChanged: function(event)
-    {
-        var checkbox = this._element.firstChild;
-        checkbox.checked = this._breakpoint.enabled;
-    },
-
-    _hitStateChanged: function(event)
-    {
-        if (event.target.hit) {
-            this._element.addStyleClass("breakpoint-hit");
-            this.dispatchEventToListeners("breakpoint-hit");
-        } else
-            this._element.removeStyleClass("breakpoint-hit");
-    },
-
-    _labelChanged: function(event)
-    {
-        this._element.removeChild(this._labelElement);
-        this._createLabelElement();
-    },
-
-    _createLabelElement: function()
-    {
-        this._labelElement = document.createElement("span");
-        this._breakpoint.populateLabelElement(this._labelElement);
-        this._element.appendChild(this._labelElement);
-    }
-}
-
-WebInspector.BreakpointItem.prototype.__proto__ = WebInspector.Object.prototype;
-
 WebInspector.EventListenerBreakpointsSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Event Listener Breakpoints"));
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 148bfd8..7596bc4 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -30,6 +30,7 @@
 
 WebInspector.CSSStyleModel = function()
 {
+    new WebInspector.CSSStyleModelResourceBinding(this);
 }
 
 WebInspector.CSSStyleModel.parseRuleArrayPayload = function(ruleArray)
@@ -40,6 +41,10 @@ WebInspector.CSSStyleModel.parseRuleArrayPayload = function(ruleArray)
     return result;
 }
 
+WebInspector.CSSStyleModel.Events = {
+    StyleSheetChanged: 0
+}
+
 WebInspector.CSSStyleModel.prototype = {
     getStylesAsync: function(nodeId, userCallback)
     {
@@ -124,7 +129,7 @@ WebInspector.CSSStyleModel.prototype = {
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
             successCallback(rule, doesAffectSelectedNode);
-            this._styleSheetChanged(rule.id.styleSheetId, true);
+            this._fireStyleSheetChanged(rule.id.styleSheetId, true);
         }
 
         function callback(nodeId, successCallback, failureCallback, error, newSelector, rulePayload)
@@ -133,7 +138,7 @@ WebInspector.CSSStyleModel.prototype = {
             if (error)
                 failureCallback();
             else
-                DOMAgent.querySelectorAll(nodeId, newSelector, true, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
+                WebInspector.domAgent.querySelectorAll(nodeId, newSelector, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
         }
 
         CSSAgent.setRuleSelector(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback, newSelector));
@@ -146,7 +151,7 @@ WebInspector.CSSStyleModel.prototype = {
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
             successCallback(rule, doesAffectSelectedNode);
-            this._styleSheetChanged(rule.id.styleSheetId, true);
+            this._fireStyleSheetChanged(rule.id.styleSheetId, true);
         }
 
         function callback(successCallback, failureCallback, selector, error, rulePayload)
@@ -155,39 +160,39 @@ WebInspector.CSSStyleModel.prototype = {
                 // Invalid syntax for a selector
                 failureCallback();
             } else
-                DOMAgent.querySelectorAll(nodeId, selector, true, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
+                WebInspector.domAgent.querySelectorAll(nodeId, selector, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
         }
 
         CSSAgent.addRule(nodeId, selector, callback.bind(this, successCallback, failureCallback, selector));
     },
 
-    _styleSheetChanged: function(styleSheetId, majorChange)
+    _fireStyleSheetChanged: function(styleSheetId, majorChange, callback)
     {
-        if (!majorChange || !styleSheetId)
+        callback = callback || function() {};
+
+        if (!majorChange || !styleSheetId || !this.hasEventListeners(WebInspector.CSSStyleModel.Events.StyleSheetChanged)) {
+            callback();
             return;
+        }
 
-        function callback(error, href, content)
+        function mycallback(error, content)
         {
-            if (error)
-                return;
-            var resource = WebInspector.resourceForURL(href);
-            if (resource && resource.type === WebInspector.Resource.Type.Stylesheet) {
-                resource.setContent(content, this._onRevert.bind(this, styleSheetId));
-                this.dispatchEventToListeners("stylesheet changed");
-            }
+            if (!error)
+                this.dispatchEventToListeners(WebInspector.CSSStyleModel.Events.StyleSheetChanged, { styleSheetId: styleSheetId, content: content, majorChange: majorChange });
+            callback();
         }
-        CSSAgent.getStyleSheetText(styleSheetId, callback.bind(this));
+
+        CSSAgent.getStyleSheetText(styleSheetId, mycallback.bind(this));
     },
 
-    _onRevert: function(styleSheetId, contentToRevertTo)
+    setStyleSheetText: function(styleSheetId, newText, majorChange, userCallback)
     {
-        function callback(error, success)
+        function callback(error)
         {
-            if (error)
-                return;
-            this._styleSheetChanged(styleSheetId, true);
+             if (!error)
+                 this._fireStyleSheetChanged(styleSheetId, majorChange, userCallback ? userCallback.bind(this, error) : null);
         }
-        CSSAgent.setStyleSheetText(styleSheetId, contentToRevertTo, callback.bind(this));
+        CSSAgent.setStyleSheetText(styleSheetId, newText, callback.bind(this));
     }
 }
 
@@ -196,8 +201,10 @@ WebInspector.CSSStyleModel.prototype.__proto__ = WebInspector.Object.prototype;
 WebInspector.CSSStyleDeclaration = function(payload)
 {
     this.id = payload.styleId;
-    this.properties = payload.properties;
-    this._shorthandValues = payload.shorthandValues;
+    this.width = payload.width;
+    this.height = payload.height;
+    this.range = payload.range;
+    this._shorthandValues = WebInspector.CSSStyleDeclaration.buildShorthandValueMap(payload.shorthandEntries);
     this._livePropertyMap = {}; // LIVE properties (source-based or style-based) : { name -> CSSProperty }
     this._allProperties = []; // ALL properties: [ CSSProperty ]
     this._longhandProperties = {}; // shorthandName -> [ CSSProperty ]
@@ -232,6 +239,14 @@ WebInspector.CSSStyleDeclaration = function(payload)
         this.cssText = payload.cssText;
 }
 
+WebInspector.CSSStyleDeclaration.buildShorthandValueMap = function(shorthandEntries)
+{
+    var result = {};
+    for (var i = 0; i < shorthandEntries.length; ++i)
+        result[shorthandEntries[i].name] = shorthandEntries[i].value;
+    return result;
+}
+
 WebInspector.CSSStyleDeclaration.parsePayload = function(payload)
 {
     return new WebInspector.CSSStyleDeclaration(payload);
@@ -351,11 +366,12 @@ WebInspector.CSSStyleDeclaration.prototype = {
             if (!userCallback)
                 return;
 
-            if (error)
+            if (error) {
+                console.error(JSON.stringify(error));
                 userCallback(null);
-            else {
+            } else {
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(payload));
-                WebInspector.cssModel._styleSheetChanged(this.id.styleSheetId, true);
+                WebInspector.cssModel._fireStyleSheetChanged(this.id.styleSheetId, true);
             }
         }
 
@@ -476,14 +492,14 @@ WebInspector.CSSProperty.prototype = {
         function enabledCallback(style)
         {
             if (style)
-                WebInspector.cssModel._styleSheetChanged(style.id.styleSheetId, majorChange);
+                WebInspector.cssModel._fireStyleSheetChanged(style.id.styleSheetId, majorChange);
             if (userCallback)
                 userCallback(style);
         }
 
         function callback(error, stylePayload)
         {
-            if (!error && stylePayload) {
+            if (!error) {
                 this.text = propertyText;
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
                 var newProperty = style.allProperties[this.index];
@@ -491,11 +507,11 @@ WebInspector.CSSProperty.prototype = {
                 if (newProperty && this.disabled && !propertyText.match(/^\s*$/)) {
                     newProperty.setDisabled(false, enabledCallback);
                     return;
-                } else
-                    WebInspector.cssModel._styleSheetChanged(style.id.styleSheetId, majorChange);
-                if (userCallback)
-                    userCallback(style);
+                }
+
+                WebInspector.cssModel._fireStyleSheetChanged(style.id.styleSheetId, majorChange, userCallback.bind(this, style));
             } else {
+                console.error(JSON.stringify(error));
                 if (userCallback)
                     userCallback(null);
             }
@@ -530,7 +546,7 @@ WebInspector.CSSProperty.prototype = {
             else {
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
                 userCallback(style);
-                WebInspector.cssModel._styleSheetChanged(this.ownerStyle.id.styleSheetId, false);
+                WebInspector.cssModel._fireStyleSheetChanged(this.ownerStyle.id.styleSheetId, false);
             }
         }
 
@@ -571,16 +587,109 @@ WebInspector.CSSStyleSheet.prototype = {
         return this._text;
     },
 
-    setText: function(newText, userCallback)
+    setText: function(newText, majorChange, userCallback)
     {
-        function callback(error, isChangeSuccessful)
+        function callback(error)
         {
              if (userCallback)
-                 userCallback(isChangeSuccessful);
-             if (isChangeSuccessful)
-                 WebInspector.cssModel._styleSheetChanged(this.id, true);
+                 userCallback(error);
+             if (!error)
+                 WebInspector.cssModel._fireStyleSheetChanged(this.id, majorChange);
         }
 
         CSSAgent.setStyleSheetText(this.id, newText, callback.bind(this));
     }
 }
+
+WebInspector.CSSStyleModelResourceBinding = function(cssModel)
+{
+    this._cssModel = cssModel;
+    this._urlToStyleSheetId = {};
+    this._styleSheetIdToURL = {};
+    this._cssModel.addEventListener(WebInspector.CSSStyleModel.Events.StyleSheetChanged, this._styleSheetChanged, this);
+    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, this._frameNavigated, this);
+    WebInspector.Resource.registerDomainModelBinding(WebInspector.Resource.Type.Stylesheet, this);
+}
+
+WebInspector.CSSStyleModelResourceBinding.prototype = {
+    setContent: function(resource, content, majorChange, userCallback)
+    {
+        if (this._urlToStyleSheetId[resource.url]) {
+            this._innerSetContent(resource.url, content, majorChange, userCallback);
+            return;
+        }
+        this._loadStyleSheetHeaders(this._innerSetContent.bind(this, resource.url, content, majorChange, userCallback));
+    },
+
+    _frameNavigated: function(event)
+    {
+        var frameId = event.data;
+        if (!frameId) {
+            // Main frame navigation - clear history.
+            this._urlToStyleSheetId = {};
+            this._styleSheetIdToURL = {};
+        }
+    },
+
+    _innerSetContent: function(url, content, majorChange, userCallback, error)
+    {
+        if (error) {
+            userCallback(error);
+            return;
+        }
+
+        var styleSheetId = this._urlToStyleSheetId[url];
+        if (!styleSheetId) {
+            if (userCallback)
+                userCallback("No stylesheet found: " + url);
+            return;
+        }
+        this._cssModel.setStyleSheetText(styleSheetId, content, majorChange, userCallback);
+    },
+
+    _loadStyleSheetHeaders: function(callback)
+    {
+        function didGetAllStyleSheets(error, infos)
+        {
+            if (error) {
+                callback(error);
+                return;
+            }
+
+            for (var i = 0; i < infos.length; ++i) {
+                var info = infos[i];
+                this._urlToStyleSheetId[info.sourceURL] = info.styleSheetId;
+                this._styleSheetIdToURL[info.styleSheetId] = info.sourceURL;
+            }
+            callback();
+        }
+        CSSAgent.getAllStyleSheets(didGetAllStyleSheets.bind(this));
+    },
+
+    _styleSheetChanged: function(event)
+    {
+        var styleSheetId = event.data.styleSheetId;
+        function setContent()
+        {
+            var url = this._styleSheetIdToURL[styleSheetId];
+            if (!url)
+                return;
+    
+            var resource = WebInspector.resourceForURL(url);
+            if (!resource)
+                return;
+
+            var majorChange = event.data.majorChange;
+            if (majorChange)
+                resource.addRevision(event.data.content);
+        }
+
+        if (!this._styleSheetIdToURL[styleSheetId]) {
+            this._loadStyleSheetHeaders(setContent.bind(this));
+            return;
+        }
+        setContent.call(this);
+    }
+}
+
+WebInspector.CSSStyleModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
diff --git a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
index 3d71101..80187ea 100644
--- a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -46,20 +46,9 @@ WebInspector.CallStackSidebarPane.prototype = {
             return;
         }
 
-        var title;
-        var subtitle;
-        var script;
-
         for (var i = 0; i < callFrames.length; ++i) {
             var callFrame = callFrames[i];
-            switch (callFrame.type) {
-            case "function":
-                title = callFrame.functionName || WebInspector.UIString("(anonymous function)");
-                break;
-            case "program":
-                title = WebInspector.UIString("(program)");
-                break;
-            }
+            var title = callFrame.functionName || WebInspector.UIString("(anonymous function)");
 
             var subtitle;
             if (!callFrame.isInternalScript)
@@ -71,7 +60,7 @@ WebInspector.CallStackSidebarPane.prototype = {
             placard.callFrame = callFrame;
             placard.element.addEventListener("click", this._placardSelected.bind(this, placard), false);
 
-            function didGetSourceLocation(placard, sourceFileId, lineNumber, columnNumber)
+            function didGetSourceLine(placard, sourceFileId, lineNumber)
             {
                 if (placard.subtitle)
                     placard.subtitle += ":" + (lineNumber + 1);
@@ -79,16 +68,11 @@ WebInspector.CallStackSidebarPane.prototype = {
                     placard.subtitle = WebInspector.UIString("line %d", lineNumber + 1);
                 placard._text = WebInspector.UIString("%s() at %s", placard.title, placard.subtitle);
             }
-            callFrame.sourceLocation(didGetSourceLocation.bind(this, placard));
+            callFrame.sourceLine(didGetSourceLine.bind(this, placard));
 
             this.placards.push(placard);
             this.bodyElement.appendChild(placard.element);
         }
-
-        if (details.eventType === WebInspector.DebuggerEventTypes.NativeBreakpoint) {
-            if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.DOM)
-                this._domBreakpointHit(details.eventData);
-        }
     },
 
     set selectedCallFrame(x)
@@ -187,19 +171,10 @@ WebInspector.CallStackSidebarPane.prototype = {
     {
         var statusMessageElement = document.createElement("div");
         statusMessageElement.className = "info";
-        statusMessageElement.textContent = status;
-        this.bodyElement.appendChild(statusMessageElement);
-    },
-
-    _domBreakpointHit: function(eventData)
-    {
-        var breakpoint = WebInspector.breakpointManager.breakpointViewForEventData(eventData);
-        if (!breakpoint)
-            return;
-
-        var statusMessageElement = document.createElement("div");
-        statusMessageElement.className = "info";
-        breakpoint.populateStatusMessageElement(statusMessageElement, eventData);
+        if (typeof status === "string")
+            statusMessageElement.textContent = status;
+        else
+            statusMessageElement.appendChild(status);
         this.bodyElement.appendChild(statusMessageElement);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index f3e3425..4ab16d9e 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -105,7 +105,7 @@ WebInspector.ConsoleView.prototype = {
     _registerConsoleDomainDispatcher: function() {
         var console = this;
         var dispatcher = {
-            consoleMessage: function(payload)
+            messageAdded: function(payload)
             {
                 var consoleMessage = new WebInspector.ConsoleMessage(
                     payload.source,
@@ -114,14 +114,14 @@ WebInspector.ConsoleView.prototype = {
                     payload.line,
                     payload.url,
                     payload.repeatCount,
-                    payload.message,
+                    payload.text,
                     payload.parameters,
                     payload.stackTrace,
-                    payload.requestId);
+                    payload.networkIdentifier);
                 console.addMessage(consoleMessage);
             },
 
-            consoleMessageRepeatCountUpdated: function(count)
+            messageRepeatCountUpdated: function(count)
             {
                 var msg = console.previousMessage;
                 var prevRepeatCount = msg.totalRepeatCount;
@@ -140,7 +140,7 @@ WebInspector.ConsoleView.prototype = {
                 }
             },
 
-            consoleMessagesCleared: function()
+            messagesCleared: function()
             {
                 console.clearMessages();
             },
@@ -362,7 +362,7 @@ WebInspector.ConsoleView.prototype = {
         {
             if (!result)
                 return;
-            result.getProperties(true, false, evaluatedProperties.bind(this));
+            result.getAllProperties(evaluatedProperties.bind(this));
         }
 
         function evaluatedProperties(properties)
@@ -623,7 +623,7 @@ WebInspector.ConsoleView.prototype = {
 
     _formatarray: function(arr, elem)
     {
-        arr.getOwnProperties(false, this._printArray.bind(this, elem));
+        arr.getOwnProperties(this._printArray.bind(this, elem));
     },
 
     _formatstring: function(output, elem)
@@ -691,7 +691,7 @@ WebInspector.ConsoleMessage = function(source, type, level, line, url, repeatCou
     if (stackTrace && stackTrace.length) {
         var topCallFrame = stackTrace[0];
         if (!this.url)
-            this.url = topCallFrame.scriptName;
+            this.url = topCallFrame.url;
         if (!this.line)
             this.line = topCallFrame.lineNumber;
     }
@@ -923,7 +923,7 @@ WebInspector.ConsoleMessage.prototype = {
             messageTextElement.appendChild(document.createTextNode(functionName));
             content.appendChild(messageTextElement);
 
-            var urlElement = WebInspector.linkifyResourceAsNode(frame.scriptName, "scripts", frame.lineNumber, "console-message-url");
+            var urlElement = WebInspector.linkifyResourceAsNode(frame.url, "scripts", frame.lineNumber, "console-message-url");
             content.appendChild(urlElement);
 
             var treeElement = new TreeElement(content);
@@ -1027,10 +1027,10 @@ WebInspector.ConsoleMessage.prototype = {
             var l = this._stackTrace;
             var r = msg._stackTrace;
             for (var i = 0; i < l.length; i++) {
-                if (l[i].scriptName !== r[i].scriptName ||
+                if (l[i].url !== r[i].url ||
                     l[i].functionName !== r[i].functionName ||
                     l[i].lineNumber !== r[i].lineNumber ||
-                    l[i].column !== r[i].column)
+                    l[i].columnNumber !== r[i].columnNumber)
                     return false;
             }
         }
@@ -1047,33 +1047,33 @@ WebInspector.ConsoleMessage.prototype = {
 
 // Note: Keep these constants in sync with the ones in Console.h
 WebInspector.ConsoleMessage.MessageSource = {
-    HTML: 0,
-    WML: 1,
-    XML: 2,
-    JS: 3,
-    CSS: 4,
-    Other: 5
+    HTML: "html",
+    WML: "wml",
+    XML: "xml",
+    JS: "javascript",
+    CSS: "css",
+    Other: "other"
 }
 
 WebInspector.ConsoleMessage.MessageType = {
-    Log: 0,
-    Object: 1,
-    Trace: 2,
-    StartGroup: 3,
-    StartGroupCollapsed: 4,
-    EndGroup: 5,
-    Assert: 6,
-    UncaughtException: 7,
-    NetworkError:8,
-    Result: 9
+    Log: "log",
+    Object: "other",
+    Trace: "trace",
+    StartGroup: "startGroup",
+    StartGroupCollapsed: "startGroupCollapsed",
+    EndGroup: "endGroup",
+    Assert: "assert",
+    UncaughtException: "uncaughtException",
+    NetworkError: "networkError",
+    Result: "result"
 }
 
 WebInspector.ConsoleMessage.MessageLevel = {
-    Tip: 0,
-    Log: 1,
-    Warning: 2,
-    Error: 3,
-    Debug: 4
+    Tip: "tip",
+    Log: "log",
+    Warning: "warning",
+    Error: "error",
+    Debug: "debug"
 }
 
 WebInspector.ConsoleCommand = function(command)
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index a2a9c2d..5889320 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -59,8 +59,6 @@ WebInspector.DOMNode = function(doc, payload) {
     this.style = null;
     this._matchedCSSRules = [];
 
-    this.breakpoints = {};
-
     if (this._nodeType === Node.ELEMENT_NODE) {
         // HTML and BODY from internal iframes should not overwrite top-level ones.
         if (!this.ownerDocument.documentElement && this._nodeName === "HTML")
@@ -223,6 +221,28 @@ WebInspector.DOMNode.prototype = {
         return path.join(",");
     },
 
+    appropriateSelectorFor: function(justSelector)
+    {
+        var lowerCaseName = this.localName() || node.nodeName().toLowerCase();
+
+        var id = this.getAttribute("id");
+        if (id) {
+            var selector = "#" + id;
+            return (justSelector ? selector : lowerCaseName + selector);
+        }
+
+        var className = this.getAttribute("class");
+        if (className) {
+            var selector = "." + className.replace(/\s+/, ".");
+            return (justSelector ? selector : lowerCaseName + selector);
+        }
+
+        if (lowerCaseName === "input" && this.getAttribute("type"))
+            return lowerCaseName + "[type=\"" + this.getAttribute("type") + "\"]";
+
+        return lowerCaseName;
+    },
+
     _setAttributesPayload: function(attrs)
     {
         this._attributes = [];
@@ -328,52 +348,69 @@ WebInspector.DOMAgent.prototype = {
             return;
         }
 
-        function mycallback(error, root)
+        if (this._pendingDocumentRequestCallbacks) {
+            this._pendingDocumentRequestCallbacks.push(callback);
+            return;
+        }
+
+        this._pendingDocumentRequestCallbacks = [callback];
+
+        function onDocumentAvailable(error, root)
         {
             if (!error)
                 this._setDocument(root);
 
-            if (callback)
-                callback(this._document);
+            for (var i = 0; i < this._pendingDocumentRequestCallbacks.length; ++i) {
+                var callback = this._pendingDocumentRequestCallbacks[i];
+                if (callback)
+                    callback(this._document);
+            }
+            delete this._pendingDocumentRequestCallbacks;
         }
-        DOMAgent.getDocument(mycallback.bind(this));
+
+        DOMAgent.getDocument(onDocumentAvailable.bind(this));
     },
 
     pushNodeToFrontend: function(objectId, callback)
     {
-        function callbackWrapper(error, nodeId)
-        {
-            if (callback)
-                callback(error ? 0 : nodeId);
-        }
-
-        function mycallback()
-        {
-            if (this._document)
-                DOMAgent.pushNodeToFrontend(objectId, callbackWrapper);
-            else
-                callbackWrapper("No document");
-        }
-
-        this.requestDocument(mycallback.bind(this));
+        this._dispatchWhenDocumentAvailable(DOMAgent.pushNodeToFrontend.bind(DOMAgent), objectId, callback);
     },
 
     pushNodeByPathToFrontend: function(path, callback)
     {
-        function callbackWrapper(error, nodeId)
+        this._dispatchWhenDocumentAvailable(DOMAgent.pushNodeByPathToFrontend.bind(DOMAgent), path, callback);
+    },
+
+    _wrapClientCallback: function(callback)
+    {
+        if (!callback)
+            return;
+        return function(error, result)
         {
-            if (callback)
-                callback(error ? 0 : nodeId);
+            callback(error ? null : result);
         }
+    },
 
-        function mycallback()
+    _dispatchWhenDocumentAvailable: function(action)
+    {
+        var requestArguments = Array.prototype.slice.call(arguments, 1);
+        var callbackWrapper;
+
+        if (typeof requestArguments[requestArguments.length - 1] === "function") {
+            var callback = requestArguments.pop();
+            callbackWrapper = this._wrapClientCallback(callback);
+            requestArguments.push(callbackWrapper);
+        }
+        function onDocumentAvailable()
         {
             if (this._document)
-                DOMAgent.pushNodeByPathToFrontend(path, callbackWrapper);
-            else
-                callbackWrapper("No document");
+                action.apply(null, requestArguments);
+            else {
+                if (callbackWrapper)
+                    callbackWrapper("No document");
+            }
         }
-        this.requestDocument(mycallback.bind(this));
+        this.requestDocument(onDocumentAvailable.bind(this));
     },
 
     _attributesUpdated: function(nodeId, attrsArray)
@@ -465,17 +502,8 @@ WebInspector.DOMAgent.prototype = {
         parent.removeChild_(node);
         this.dispatchEventToListeners(WebInspector.DOMAgent.Events.NodeRemoved, {node:node, parent:parent});
         delete this._idToDOMNode[nodeId];
-        this._removeBreakpoints(node);
-    },
-
-    _removeBreakpoints: function(node)
-    {
-        for (var type in node.breakpoints)
-            node.breakpoints[type].remove();
-        if (!node.children)
-            return;
-        for (var i = 0; i < node.children.length; ++i)
-            this._removeBreakpoints(node.children[i]);
+        if (Preferences.nativeInstrumentationEnabled)
+            WebInspector.panels.elements.sidebarPanes.domBreakpoints.nodeRemoved(node);
     },
 
     performSearch: function(query, searchResultCollector, searchSynchronously)
@@ -488,6 +516,16 @@ WebInspector.DOMAgent.prototype = {
     {
         delete this._searchResultCollector;
         DOMAgent.cancelSearch();
+    },
+
+    querySelector: function(nodeId, selectors, callback)
+    {
+        DOMAgent.querySelector(nodeId, selectors, this._wrapClientCallback(callback));
+    },
+
+    querySelectorAll: function(nodeId, selectors, callback)
+    {
+        DOMAgent.querySelectorAll(nodeId, selectors, this._wrapClientCallback(callback));
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
new file mode 100644
index 0000000..df31f96
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js
@@ -0,0 +1,308 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMBreakpointsSidebarPane = function()
+{
+    WebInspector.NativeBreakpointsSidebarPane.call(this, WebInspector.UIString("DOM Breakpoints"));
+
+    this._breakpointElements = {};
+
+    this._breakpointTypes = {
+        SubtreeModified: 0,
+        AttributeModified: 1,
+        NodeRemoved: 2
+    };
+    this._breakpointTypeLabels = [
+        WebInspector.UIString("Subtree Modified"),
+        WebInspector.UIString("Attribute Modified"),
+        WebInspector.UIString("Node Removed")
+    ];
+    this._contextMenuLabels = [
+        WebInspector.UIString("Break on Subtree Modifications"),
+        WebInspector.UIString("Break on Attributes Modifications"),
+        WebInspector.UIString("Break on Node Removal")
+    ];
+}
+
+WebInspector.DOMBreakpointsSidebarPane.prototype = {
+    setInspectedURL: function(url)
+    {
+        this._reset();
+        this._inspectedURL = url.removeURLFragment();
+    },
+
+    populateNodeContextMenu: function(node, contextMenu)
+    {
+        var nodeBreakpoints = {};
+        for (var id in this._breakpointElements) {
+            var element = this._breakpointElements[id];
+            if (element._node === node)
+                nodeBreakpoints[element._type] = true;
+        }
+
+        function toggleBreakpoint(type)
+        {
+            if (!nodeBreakpoints[type])
+                this._setBreakpoint(node, type, true);
+            else
+                this._removeBreakpoint(node, type);
+            this._saveBreakpoints();
+        }
+
+        for (var type = 0; type < 3; ++type) {
+            var label = this._contextMenuLabels[type];
+            contextMenu.appendCheckboxItem(label, toggleBreakpoint.bind(this, type), nodeBreakpoints[type]);
+        }
+    },
+
+    createBreakpointHitStatusMessage: function(eventData, callback)
+    {
+        if (eventData.type === this._breakpointTypes.SubtreeModified) {
+            var targetNodeObject = WebInspector.RemoteObject.fromPayload(eventData.targetNode);
+            function didPushNodeToFrontend(targetNodeId)
+            {
+                if (targetNodeId)
+                    targetNodeObject.release();
+                this._doCreateBreakpointHitStatusMessage(eventData, targetNodeId, callback);
+            }
+            targetNodeObject.pushNodeToFrontend(didPushNodeToFrontend.bind(this));
+        } else
+            this._doCreateBreakpointHitStatusMessage(eventData, null, callback);
+    },
+
+    _doCreateBreakpointHitStatusMessage: function (eventData, targetNodeId, callback)
+    {
+        var message;
+        var typeLabel = this._breakpointTypeLabels[eventData.type];
+        var linkifiedNode = WebInspector.panels.elements.linkifyNodeById(eventData.nodeId);
+        var substitutions = [typeLabel, linkifiedNode];
+        var targetNode = "";
+        if (targetNodeId)
+            targetNode = WebInspector.panels.elements.linkifyNodeById(targetNodeId);
+
+        if (eventData.type === this._breakpointTypes.SubtreeModified) {
+            if (eventData.insertion) {
+                if (targetNodeId !== eventData.nodeId) {
+                    message = "Paused on a \"%s\" breakpoint set on %s, because a new child was added to its descendant %s.";
+                    substitutions.push(targetNode);
+                } else
+                    message = "Paused on a \"%s\" breakpoint set on %s, because a new child was added to that node.";
+            } else {
+                message = "Paused on a \"%s\" breakpoint set on %s, because its descendant %s was removed.";
+                substitutions.push(targetNode);
+            }
+        } else
+            message = "Paused on a \"%s\" breakpoint set on %s.";
+
+        var element = document.createElement("span");
+        var formatters = {
+            s: function(substitution)
+            {
+                return substitution;
+            }
+        };
+        function append(a, b)
+        {
+            if (typeof b === "string")
+                b = document.createTextNode(b);
+            element.appendChild(b);
+        }
+        WebInspector.formatLocalized(message, substitutions, formatters, "", append);
+
+        callback(element);
+    },
+
+    nodeRemoved: function(node)
+    {
+        this._removeBreakpointsForNode(node);
+        if (!node.children)
+            return;
+        for (var i = 0; i < node.children.length; ++i)
+            this._removeBreakpointsForNode(node.children[i]);
+        this._saveBreakpoints();
+    },
+
+    _removeBreakpointsForNode: function(node)
+    {
+        for (var id in this._breakpointElements) {
+            var element = this._breakpointElements[id];
+            if (element._node === node)
+                this._removeBreakpoint(element._node, element._type);
+        }
+    },
+
+    _setBreakpoint: function(node, type, enabled)
+    {
+        var breakpointId = this._createBreakpointId(node.id, type);
+        if (breakpointId in this._breakpointElements)
+            return;
+
+        var element = document.createElement("li");
+        element._node = node;
+        element._type = type;
+        element.addEventListener("contextmenu", this._contextMenu.bind(this, node, type), true);
+
+        var checkboxElement = document.createElement("input");
+        checkboxElement.className = "checkbox-elem";
+        checkboxElement.type = "checkbox";
+        checkboxElement.checked = enabled;
+        checkboxElement.addEventListener("click", this._checkboxClicked.bind(this, node, type), false);
+        element._checkboxElement = checkboxElement;
+        element.appendChild(checkboxElement);
+
+        var labelElement = document.createElement("span");
+        element.appendChild(labelElement);
+
+        var linkifiedNode = WebInspector.panels.elements.linkifyNodeById(node.id);
+        linkifiedNode.addStyleClass("monospace");
+        labelElement.appendChild(linkifiedNode);
+
+        var description = document.createElement("div");
+        description.className = "source-text";
+        description.textContent = this._breakpointTypeLabels[type];
+        labelElement.appendChild(description);
+
+        var currentElement = this.listElement.firstChild;
+        while (currentElement) {
+            if (currentElement._type && currentElement._type < element._type)
+                break;
+            currentElement = currentElement.nextSibling;
+        }
+        this._addListElement(element, currentElement);
+        this._breakpointElements[breakpointId] = element;
+        if (enabled)
+            BrowserDebuggerAgent.setDOMBreakpoint(node.id, type);
+    },
+
+    _removeBreakpoint: function(node, type)
+    {
+        var breakpointId = this._createBreakpointId(node.id, type);
+        var element = this._breakpointElements[breakpointId];
+        if (!element)
+            return;
+
+        this._removeListElement(element);
+        delete this._breakpointElements[breakpointId];
+        if (element._checkboxElement.checked)
+            BrowserDebuggerAgent.removeDOMBreakpoint(node.id, type);
+    },
+
+    _contextMenu: function(node, type, event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        function removeBreakpoint()
+        {
+            this._removeBreakpoint(node, type);
+            this._saveBreakpoints();
+        }
+        contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeBreakpoint.bind(this));
+        contextMenu.show(event);
+    },
+
+    _checkboxClicked: function(node, type, event)
+    {
+        if (event.target.checked)
+            BrowserDebuggerAgent.setDOMBreakpoint(node.id, type);
+        else
+            BrowserDebuggerAgent.removeDOMBreakpoint(node.id, type);
+        this._saveBreakpoints();
+    },
+
+    highlightBreakpoint: function(eventData)
+    {
+        var breakpointId = this._createBreakpointId(eventData.nodeId, eventData.type);
+        var element = this._breakpointElements[breakpointId];
+        if (!element)
+            return;
+        this.expanded = true;
+        element.addStyleClass("breakpoint-hit");
+        this._highlightedElement = element;
+    },
+
+    clearBreakpointHighlight: function()
+    {
+        if (this._highlightedElement) {
+            this._highlightedElement.removeStyleClass("breakpoint-hit");
+            delete this._highlightedElement;
+        }
+    },
+
+    _createBreakpointId: function(nodeId, type)
+    {
+        return nodeId + ":" + type;
+    },
+
+    _saveBreakpoints: function()
+    {
+        var breakpoints = [];
+        var storedBreakpoints = WebInspector.settings.domBreakpoints;
+        for (var i = 0; i < storedBreakpoints.length; ++i) {
+            var breakpoint = storedBreakpoints[i];
+            if (breakpoint.url !== this._inspectedURL)
+                breakpoints.push(breakpoint);
+        }
+        for (var id in this._breakpointElements) {
+            var element = this._breakpointElements[id];
+            breakpoints.push({ url: this._inspectedURL, path: element._node.path(), type: element._type, enabled: element._checkboxElement.checked });
+        }
+        WebInspector.settings.domBreakpoints = breakpoints;
+    },
+
+    restoreBreakpoints: function()
+    {
+        var pathToBreakpoints = {};
+
+        function didPushNodeByPathToFrontend(path, nodeId)
+        {
+            var node = WebInspector.domAgent.nodeForId(nodeId);
+            if (!node)
+                return;
+
+            var breakpoints = pathToBreakpoints[path];
+            for (var i = 0; i < breakpoints.length; ++i)
+                this._setBreakpoint(node, breakpoints[i].type, breakpoints[i].enabled);
+        }
+
+        var breakpoints = WebInspector.settings.domBreakpoints;
+        for (var i = 0; i < breakpoints.length; ++i) {
+            var breakpoint = breakpoints[i];
+            if (breakpoint.url !== this._inspectedURL)
+                continue;
+            var path = breakpoint.path;
+            if (!pathToBreakpoints[path]) {
+                pathToBreakpoints[path] = [];
+                WebInspector.domAgent.pushNodeByPathToFrontend(path, didPushNodeByPathToFrontend.bind(this, path));
+            }
+            pathToBreakpoints[path].push(breakpoint);
+        }
+    }
+}
+
+WebInspector.DOMBreakpointsSidebarPane.prototype.__proto__ = WebInspector.NativeBreakpointsSidebarPane.prototype;
diff --git a/Source/WebCore/inspector/front-end/DataGrid.js b/Source/WebCore/inspector/front-end/DataGrid.js
index 6d54941..7d7109a 100644
--- a/Source/WebCore/inspector/front-end/DataGrid.js
+++ b/Source/WebCore/inspector/front-end/DataGrid.js
@@ -133,6 +133,7 @@ WebInspector.DataGrid = function(columns, editCallback, deleteCallback)
     this._columnsArray = [];
     for (var columnIdentifier in columns) {
         columns[columnIdentifier].ordinal = this._columnsArray.length;
+        columns[columnIdentifier].identifier = columnIdentifier;
         this._columnsArray.push(columns[columnIdentifier]);
     }
 
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index c1d59b1..a33d69b 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -31,7 +31,6 @@
 WebInspector.DebuggerModel = function()
 {
     this._debuggerPausedDetails = {};
-    this._breakpoints = {};
     this._scripts = {};
 
     InspectorBackend.registerDomainDispatcher("Debugger", new WebInspector.DebuggerDispatcher(this));
@@ -66,16 +65,15 @@ WebInspector.DebuggerModel.prototype = {
 
     _debuggerWasDisabled: function()
     {
-        this._breakpoints = {};
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerWasDisabled);
     },
 
-    continueToLocation: function(sourceID, lineNumber, columnNumber)
+    continueToLocation: function(location)
     {
-        DebuggerAgent.continueToLocation(sourceID, lineNumber, columnNumber);
+        DebuggerAgent.continueToLocation(location);
     },
 
-    setBreakpoint: function(url, lineNumber, columnNumber, condition, enabled, callback)
+    setBreakpoint: function(url, lineNumber, columnNumber, condition, callback)
     {
         // Adjust column if needed.
         var minColumnNumber = 0;
@@ -88,62 +86,35 @@ WebInspector.DebuggerModel.prototype = {
 
         function didSetBreakpoint(error, breakpointId, locations)
         {
-            var breakpoint;
-            if (!error && breakpointId) {
-                breakpoint = new WebInspector.Breakpoint(breakpointId, url, "", lineNumber, columnNumber, condition, enabled);
-                breakpoint.locations = locations;
-                this._breakpoints[breakpointId] = breakpoint;
-            }
             if (callback)
-                callback(breakpoint);
+                callback(error ? null : breakpointId, locations);
         }
-        DebuggerAgent.setBreakpointByUrl(url, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
+        DebuggerAgent.setBreakpointByUrl(url, lineNumber, columnNumber, condition, didSetBreakpoint.bind(this));
     },
 
-    setBreakpointBySourceId: function(sourceID, lineNumber, columnNumber, condition, enabled, callback)
+    setBreakpointBySourceId: function(location, condition, callback)
     {
-        function didSetBreakpoint(error, breakpointId, actualLineNumber, actualColumnNumber)
+        function didSetBreakpoint(error, breakpointId, actualLocation)
         {
-            var breakpoint;
-            if (!error && breakpointId) {
-                breakpoint = new WebInspector.Breakpoint(breakpointId, "", sourceID, lineNumber, columnNumber, condition, enabled);
-                breakpoint.addLocation(sourceID, actualLineNumber, actualColumnNumber);
-                this._breakpoints[breakpointId] = breakpoint;
-            }
             if (callback)
-                callback(breakpoint);
+                callback(error ? null : breakpointId, [actualLocation]);
         }
-        DebuggerAgent.setBreakpoint(sourceID, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
+        DebuggerAgent.setBreakpoint(location, condition, didSetBreakpoint.bind(this));
     },
 
-    removeBreakpoint: function(breakpointId)
+    removeBreakpoint: function(breakpointId, callback)
     {
-        DebuggerAgent.removeBreakpoint(breakpointId);
-        delete this._breakpoints[breakpointId];
+        DebuggerAgent.removeBreakpoint(breakpointId, callback);
     },
 
-    _breakpointResolved: function(breakpointId, sourceID, lineNumber, columnNumber)
+    _breakpointResolved: function(breakpointId, location)
     {
-        var breakpoint = this._breakpoints[breakpointId];
-        breakpoint.addLocation(sourceID, lineNumber, columnNumber);
-        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointResolved, breakpoint);
-    },
-
-    get breakpoints()
-    {
-        return this._breakpoints;
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointResolved, {breakpointId: breakpointId, location: location});
     },
 
     reset: function()
     {
         this._debuggerPausedDetails = {};
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            if (!breakpoint.url)
-                delete this._breakpoints[id];
-            else
-                breakpoint.locations = [];
-        }
         this._scripts = {};
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.Reset);
     },
@@ -176,16 +147,14 @@ WebInspector.DebuggerModel.prototype = {
 
     editScriptSource: function(sourceID, newSource, callback)
     {
-        DebuggerAgent.editScriptSource(sourceID, newSource, this._didEditScriptSource.bind(this, sourceID, callback));
+        this._scripts[sourceID].editSource(newSource, this._didEditScriptSource.bind(this, sourceID, newSource, callback));
     },
 
-    _didEditScriptSource: function(sourceID, callback, error, newBody, callFrames)
+    _didEditScriptSource: function(sourceID, newSource, callback, error, callFrames)
     {
-        callback(!error, error || newBody);
-        if (error)
-            return;
-        this._scripts[sourceID].source = newBody;
-        this._debuggerPausedDetails.callFrames = callFrames;
+        if (!error && callFrames && callFrames.length)
+            this._debuggerPausedDetails.callFrames = callFrames;
+        callback(error);
     },
 
     get callFrames()
@@ -210,16 +179,16 @@ WebInspector.DebuggerModel.prototype = {
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerResumed);
     },
 
-    _parsedScriptSource: function(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType)
+    _parsedScriptSource: function(sourceID, sourceURL, lineOffset, columnOffset, length, isContentScript)
     {
-        var script = new WebInspector.Script(sourceID, sourceURL, "", lineOffset, columnOffset, length, undefined, undefined, scriptWorldType);
+        var script = new WebInspector.Script(sourceID, sourceURL, lineOffset, columnOffset, length, undefined, undefined, isContentScript);
         this._scripts[sourceID] = script;
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.ParsedScriptSource, script);
     },
 
     _failedToParseScriptSource: function(sourceURL, source, startingLine, errorLine, errorMessage)
     {
-        var script = new WebInspector.Script(null, sourceURL, source, startingLine, errorLine, errorMessage, undefined);
+        var script = new WebInspector.Script(null, sourceURL, startingLine, errorLine, errorMessage, undefined);
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, script);
     }
 }
@@ -258,9 +227,9 @@ WebInspector.DebuggerDispatcher.prototype = {
         this._debuggerModel._debuggerWasDisabled();
     },
 
-    scriptParsed: function(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType)
+    scriptParsed: function(sourceID, sourceURL, lineOffset, columnOffset, length, isContentScript)
     {
-        this._debuggerModel._parsedScriptSource(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType);
+        this._debuggerModel._parsedScriptSource(sourceID, sourceURL, lineOffset, columnOffset, length, isContentScript);
     },
 
     scriptFailedToParse: function(sourceURL, source, startingLine, errorLine, errorMessage)
diff --git a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
index d12affe..106d62f 100644
--- a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
@@ -32,7 +32,9 @@ WebInspector.DebuggerPresentationModel = function()
 {
     this._sourceFiles = {};
     this._messages = [];
-    this._presentationBreakpoints = {};
+    this._breakpointsByDebuggerId = {};
+    this._breakpointsWithoutSourceFile = {};
+
     this._presentationCallFrames = [];
     this._selectedCallFrameIndex = 0;
 
@@ -42,7 +44,9 @@ WebInspector.DebuggerPresentationModel = function()
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointResolved, this._breakpointResolved, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.Reset, this._reset, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.Reset, this._debuggerReset, this);
+
+    new WebInspector.DebuggerPresentationModelResourceBinding(this);
 }
 
 WebInspector.DebuggerPresentationModel.Events = {
@@ -59,7 +63,7 @@ WebInspector.DebuggerPresentationModel.Events = {
 WebInspector.DebuggerPresentationModel.prototype = {
     _debuggerWasEnabled: function()
     {
-        this._restoreBreakpoints();
+        this._restoreBreakpointsFromSettings();
     },
 
     sourceFile: function(sourceFileId)
@@ -67,6 +71,11 @@ WebInspector.DebuggerPresentationModel.prototype = {
         return this._sourceFiles[sourceFileId];
     },
 
+    sourceFileForScriptURL: function(scriptURL)
+    {
+        return this._sourceFiles[scriptURL];
+    },
+
     requestSourceFileContent: function(sourceFileId, callback)
     {
         this._sourceFiles[sourceFileId].requestContent(callback);
@@ -75,18 +84,16 @@ WebInspector.DebuggerPresentationModel.prototype = {
     _parsedScriptSource: function(event)
     {
         this._addScript(event.data);
-        this._refreshBreakpoints();
     },
 
     _failedToParseScriptSource: function(event)
     {
         this._addScript(event.data);
-        this._refreshBreakpoints();
     },
 
     _addScript: function(script)
     {
-        var sourceFileId = script.sourceURL || script.sourceID;
+        var sourceFileId = this._createSourceFileId(script.sourceURL, script.sourceID);
         var sourceFile = this._sourceFiles[sourceFileId];
         if (sourceFile) {
             sourceFile.addScript(script);
@@ -100,65 +107,74 @@ WebInspector.DebuggerPresentationModel.prototype = {
         if (!this._formatSourceFiles)
             sourceFile = new WebInspector.SourceFile(sourceFileId, script, contentChanged.bind(this));
         else
-            sourceFile = new WebInspector.FormattedSourceFile(sourceFileId, script, contentChanged.bind(this), this._formatter);
+            sourceFile = new WebInspector.FormattedSourceFile(sourceFileId, script, contentChanged.bind(this), this._formatter());
         this._sourceFiles[sourceFileId] = sourceFile;
+
+        this._restoreBreakpoints(sourceFile);
+
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.SourceFileAdded, sourceFile);
     },
 
-    _refreshBreakpoints: function()
+    _restoreBreakpoints: function(sourceFile)
     {
-        var breakpoints = WebInspector.debuggerModel.breakpoints;
-        for (var id in breakpoints) {
-            if (!(id in this._presentationBreakpoints))
-                this._breakpointAdded(breakpoints[id]);
+        var pendingBreakpoints = this._breakpointsWithoutSourceFile[sourceFile.id];
+        for (var i = 0; pendingBreakpoints && i < pendingBreakpoints.length; ++i) {
+            var breakpointData = pendingBreakpoints[i];
+            if ("debuggerId" in breakpointData) {
+                var breakpoint = new WebInspector.PresentationBreakpoint(sourceFile, breakpointData.lineNumber, breakpointData.condition, breakpointData.enabled);
+                this._bindDebuggerId(breakpoint, breakpointData.debuggerId);
+                this._breakpointAdded(breakpoint);
+            } else
+                this.setBreakpoint(sourceFile.id, breakpointData.lineNumber, breakpointData.condition, breakpointData.enabled, true);
         }
+        delete this._breakpointsWithoutSourceFile[sourceFile.id];
     },
 
     canEditScriptSource: function(sourceFileId)
     {
-        if (!Preferences.canEditScriptSource)
+        if (!Preferences.canEditScriptSource || this._formatSourceFiles)
             return false;
         var script = this._scriptForSourceFileId(sourceFileId);
-        return  !script.lineOffset && !script.columnOffset;
+        return !script.lineOffset && !script.columnOffset;
     },
 
-    editScriptSource: function(sourceFileId, text, callback)
+    editScriptSource: function(sourceFileId, newSource, callback)
     {
         var script = this._scriptForSourceFileId(sourceFileId);
         var sourceFile = this._sourceFiles[sourceFileId];
-        var oldSource = sourceFile.content;
-        function didEditScriptSource(success, newBodyOrErrorMessage)
-        {
-            if (!success) {
-                callback(false, newBodyOrErrorMessage);
-                return;
-            }
 
-            var newSource = newBodyOrErrorMessage;
-            this._updateBreakpointsAfterLiveEdit(sourceFileId, oldSource, newSource);
+        function didEditScriptSource(oldSource, error)
+        {
+            if (!error) {
+                sourceFile.content = newSource;
 
-            var resource = WebInspector.resourceForURL(script.sourceURL);
-            if (resource) {
-                var revertHandle = this.editScriptSource.bind(this, sourceFileId, oldSource, sourceFile.reload.bind(sourceFile));
-                resource.setContent(newSource, revertHandle);
+                var resource = WebInspector.resourceForURL(sourceFile.url);
+                if (resource)
+                    resource.addRevision(newSource);
             }
 
-            callback(true, newSource);
+            callback(error);
 
-            if (WebInspector.debuggerModel.callFrames)
+            if (!error && WebInspector.debuggerModel.callFrames)
                 this._debuggerPaused();
         }
-        WebInspector.debuggerModel.editScriptSource(script.sourceID, text, didEditScriptSource.bind(this));
+
+        var oldSource = sourceFile.requestContent(didReceiveSource.bind(this));
+        function didReceiveSource(oldSource)
+        {
+            WebInspector.debuggerModel.editScriptSource(script.sourceID, newSource, didEditScriptSource.bind(this, oldSource));
+        }
     },
 
     _updateBreakpointsAfterLiveEdit: function(sourceFileId, oldSource, newSource)
     {
+        var sourceFile = this._sourceFiles[sourceFileId];
+
         // Clear and re-create breakpoints according to text diff.
         var diff = Array.diff(oldSource.split("\n"), newSource.split("\n"));
-        for (var id in this._presentationBreakpoints) {
-            var breakpoint = this._presentationBreakpoints[id];
-            if (breakpoint.sourceFileId !== sourceFileId)
-                continue;
+        for (var lineNumber in sourceFile.breakpoints) {
+            var breakpoint = sourceFile.breakpoints[lineNumber];
+
             var lineNumber = breakpoint.lineNumber;
             this.removeBreakpoint(sourceFileId, lineNumber);
 
@@ -184,13 +200,15 @@ WebInspector.DebuggerPresentationModel.prototype = {
     toggleFormatSourceFiles: function()
     {
         this._formatSourceFiles = !this._formatSourceFiles;
-        if (this._formatSourceFiles && !this._formatter)
-            this._formatter = new WebInspector.ScriptFormatter();
+
+        for (var id in this._sourceFiles) {
+            var sourceFile = this._sourceFiles[id];
+            for (var line in sourceFile.breakpoints)
+                this._removeBreakpointFromDebugger(sourceFile.breakpoints[line]);
+        }
 
         var messages = this._messages;
-        this._sourceFiles = {};
-        this._messages = [];
-        this._presentationBreakpoints = {};
+        this._reset();
 
         var scripts = WebInspector.debuggerModel.scripts;
         for (var id in scripts)
@@ -199,17 +217,27 @@ WebInspector.DebuggerPresentationModel.prototype = {
         for (var i = 0; i < messages.length; ++i)
             this.addConsoleMessage(messages[i]);
 
-        this._refreshBreakpoints();
-
         if (WebInspector.debuggerModel.callFrames)
             this._debuggerPaused();
     },
 
+    formatSourceFilesToggled: function()
+    {
+        return this._formatSourceFiles;
+    },
+
+    _formatter: function()
+    {
+        if (!this._scriptFormatter)
+            this._scriptFormatter = new WebInspector.ScriptFormatter();
+        return this._scriptFormatter;
+    },
+
     addConsoleMessage: function(message)
     {
         this._messages.push(message);
 
-        var sourceFile = this._sourceFileForScriptURL(message.url);
+        var sourceFile = this._sourceFileForScript(message.url);
         if (!sourceFile)
             return;
 
@@ -217,7 +245,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
         {
             var presentationMessage = {};
             presentationMessage.sourceFileId = sourceFile.id;
-            presentationMessage.lineNumber = mapping.scriptLocationToSourceLocation(message.line - 1, 0).lineNumber;
+            presentationMessage.lineNumber = mapping.scriptLocationToSourceLine({lineNumber:message.line - 1, columnNumber:0});
             presentationMessage.originalMessage = message;
             sourceFile.messages.push(presentationMessage);
             this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, presentationMessage);
@@ -236,8 +264,8 @@ WebInspector.DebuggerPresentationModel.prototype = {
     {
         function didRequestSourceMapping(mapping)
         {
-            var location = mapping.sourceLocationToScriptLocation(lineNumber, 0);
-            WebInspector.debuggerModel.continueToLocation(location.scriptId, location.lineNumber, location.columnNumber);
+            var location = mapping.sourceLineToScriptLocation(lineNumber);
+            WebInspector.debuggerModel.continueToLocation(location);
         }
         this._sourceFiles[sourceFileId].requestSourceMapping(didRequestSourceMapping.bind(this));
     },
@@ -253,32 +281,104 @@ WebInspector.DebuggerPresentationModel.prototype = {
         return breakpoints;
     },
 
-    setBreakpoint: function(sourceFileId, lineNumber, condition, enabled)
+    setBreakpoint: function(sourceFileId, lineNumber, condition, enabled, dontSaveBreakpoints)
     {
-        function didSetBreakpoint(breakpoint)
+        var sourceFile = this._sourceFiles[sourceFileId];
+        if (!sourceFile)
+            return;
+
+        var breakpoint = new WebInspector.PresentationBreakpoint(sourceFile, lineNumber, condition, enabled);
+        if (!enabled) {
+            this._breakpointAdded(breakpoint);
+            if (!dontSaveBreakpoints)
+                this._saveBreakpoints();
+            return;
+        }
+
+        function callback()
         {
-            if (breakpoint) {
-                this._breakpointAdded(breakpoint);
+            this._breakpointAdded(breakpoint);
+            if (!dontSaveBreakpoints)
                 this._saveBreakpoints();
-            }
+        }
+        this._setBreakpointInDebugger(breakpoint, callback.bind(this));
+    },
+
+    _setBreakpointInDebugger: function(breakpoint, callback)
+    {
+        function didSetBreakpoint(breakpointId, locations)
+        {
+            if (!breakpointId)
+                return;
+
+            this._bindDebuggerId(breakpoint, breakpointId);
+            breakpoint.location = locations[0];
+            callback();
         }
 
         function didRequestSourceMapping(mapping)
         {
-            var location = mapping.sourceLocationToScriptLocation(lineNumber, 0);
-            var script = WebInspector.debuggerModel.scriptForSourceID(location.scriptId);
+            var location = mapping.sourceLineToScriptLocation(breakpoint.lineNumber);
+            var script = WebInspector.debuggerModel.scriptForSourceID(location.sourceID);
             if (script.sourceURL)
-                WebInspector.debuggerModel.setBreakpoint(script.sourceURL, location.lineNumber, location.columnNumber, condition, enabled, didSetBreakpoint.bind(this));
-            else
-                WebInspector.debuggerModel.setBreakpointBySourceId(script.sourceID, location.lineNumber, location.columnNumber, condition, enabled, didSetBreakpoint.bind(this));
+                WebInspector.debuggerModel.setBreakpoint(script.sourceURL, location.lineNumber, location.columnNumber, breakpoint.condition, didSetBreakpoint.bind(this));
+            else {
+                location.sourceID = script.sourceID;
+                WebInspector.debuggerModel.setBreakpointBySourceId(location, breakpoint.condition, didSetBreakpoint.bind(this));
+            }
         }
-        this._sourceFiles[sourceFileId].requestSourceMapping(didRequestSourceMapping.bind(this));
+        breakpoint.sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
+
+    _removeBreakpointFromDebugger: function(breakpoint, callback)
+    {
+        if (!("debuggerId" in breakpoint)) {
+            if (callback)
+                callback();
+            return;
+        }
+
+        function didRemoveBreakpoint()
+        {
+            this._unbindDebuggerId(breakpoint);
+            if (callback)
+                callback();
+        }
+        WebInspector.debuggerModel.removeBreakpoint(breakpoint.debuggerId, didRemoveBreakpoint.bind(this));
+    },
+
+    _bindDebuggerId: function(breakpoint, debuggerId)
+    {
+        breakpoint.debuggerId = debuggerId;
+        this._breakpointsByDebuggerId[debuggerId] = breakpoint;
+    },
+
+    _unbindDebuggerId: function(breakpoint)
+    {
+        delete this._breakpointsByDebuggerId[breakpoint.debuggerId];
+        delete breakpoint.debuggerId;
     },
 
     setBreakpointEnabled: function(sourceFileId, lineNumber, enabled)
     {
-        var breakpoint = this.removeBreakpoint(sourceFileId, lineNumber);
-        this.setBreakpoint(sourceFileId, lineNumber, breakpoint.condition, enabled);
+        var breakpoint = this.findBreakpoint(sourceFileId, lineNumber);
+        if (!breakpoint)
+            return;
+
+        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointRemoved, breakpoint);
+
+        breakpoint.enabled = enabled;
+
+        function afterUpdate()
+        {
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, breakpoint);
+            this._saveBreakpoints();
+        }
+
+        if (!enabled)
+            this._removeBreakpointFromDebugger(breakpoint, afterUpdate.call(this));
+        else
+            this._setBreakpointInDebugger(breakpoint, afterUpdate.bind(this));
     },
 
     updateBreakpoint: function(sourceFileId, lineNumber, condition, enabled)
@@ -290,10 +390,15 @@ WebInspector.DebuggerPresentationModel.prototype = {
     removeBreakpoint: function(sourceFileId, lineNumber)
     {
         var breakpoint = this.findBreakpoint(sourceFileId, lineNumber);
-        WebInspector.debuggerModel.removeBreakpoint(breakpoint._id);
-        this._breakpointRemoved(breakpoint._id);
-        this._saveBreakpoints();
-        return breakpoint;
+        if (!breakpoint)
+            return;
+
+        function callback()
+        {
+            this._breakpointRemoved(breakpoint);
+            this._saveBreakpoints();
+        }
+        this._removeBreakpointFromDebugger(breakpoint, callback.bind(this));
     },
 
     findBreakpoint: function(sourceFileId, lineNumber)
@@ -305,84 +410,96 @@ WebInspector.DebuggerPresentationModel.prototype = {
 
     _breakpointAdded: function(breakpoint)
     {
-        var script;
-        if (breakpoint.url)
-            script = WebInspector.debuggerModel.scriptsForURL(breakpoint.url)[0];
-        else
-            script = WebInspector.debuggerModel.scriptForSourceID(breakpoint.sourceID);
-        if (!script)
+        var sourceFile = breakpoint.sourceFile;
+        if (!sourceFile)
             return;
 
         function didRequestSourceMapping(mapping)
         {
-            var scriptLocation = breakpoint.locations.length ? breakpoint.locations[0] : breakpoint;
-            var sourceLocation = mapping.scriptLocationToSourceLocation(scriptLocation.lineNumber, scriptLocation.columnNumber);
-            var lineNumber = sourceLocation.lineNumber;
+            // Refine line number based on resolved location.
+            if (breakpoint.location)
+                breakpoint.lineNumber = mapping.scriptLocationToSourceLine(breakpoint.location);
 
-            if (this.findBreakpoint(sourceFile.id, lineNumber)) {
+            var existingBreakpoint = this.findBreakpoint(sourceFile.id, breakpoint.lineNumber);
+            if (existingBreakpoint) {
                 // We can't show more than one breakpoint on a single source file line.
-                WebInspector.debuggerModel.removeBreakpoint(breakpoint.id);
+                this._removeBreakpointFromDebugger(breakpoint);
                 return;
             }
-
-            var presentationBreakpoint = new WebInspector.PresentationBreakpoint(breakpoint, sourceFile, lineNumber);
-            presentationBreakpoint._id = breakpoint.id;
-            this._presentationBreakpoints[breakpoint.id] = presentationBreakpoint;
-            sourceFile.breakpoints[lineNumber] = presentationBreakpoint;
-            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, presentationBreakpoint);
+            sourceFile.breakpoints[breakpoint.lineNumber] = breakpoint;
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, breakpoint);
         }
-        var sourceFile = this._sourceFileForScript(script);
         sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
     },
 
-    _breakpointRemoved: function(breakpointId)
+    _breakpointRemoved: function(breakpoint)
     {
-        var breakpoint = this._presentationBreakpoints[breakpointId];
-        delete this._presentationBreakpoints[breakpointId];
-        var sourceFile = this.sourceFile(breakpoint.sourceFileId);
-        delete sourceFile.breakpoints[breakpoint.lineNumber];
-        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointRemoved, breakpoint);
+        var sourceFile = breakpoint.sourceFile;
+        if (sourceFile.breakpoints[breakpoint.lineNumber] === breakpoint) {
+            // There can already be a newer breakpoint;
+            delete sourceFile.breakpoints[breakpoint.lineNumber];
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointRemoved, breakpoint);
+        }
     },
 
     _breakpointResolved: function(event)
     {
-        var breakpoint = event.data;
-        if (!(breakpoint.id in this._presentationBreakpoints))
+        var debuggerId = event.data.breakpointId;
+        if (!(debuggerId in this._breakpointsByDebuggerId))
             return;
-        this._breakpointRemoved(breakpoint.id);
+        var breakpoint = this._breakpointsByDebuggerId[debuggerId];
+
+        this._breakpointRemoved(breakpoint);
+        breakpoint.location = event.data.location;
         this._breakpointAdded(breakpoint);
     },
 
-    _restoreBreakpoints: function()
+    _restoreBreakpointsFromSettings: function()
     {
-        function didSetBreakpoint(breakpoint)
-        {
-            if (breakpoint)
-                this._breakpointAdded(breakpoint);
-        }
         var breakpoints = WebInspector.settings.breakpoints;
         for (var i = 0; i < breakpoints.length; ++i) {
-            var breakpoint = breakpoints[i];
-            WebInspector.debuggerModel.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled, didSetBreakpoint.bind(this));
+            var breakpointData = breakpoints[i];
+            var sourceFileId = breakpointData.sourceFileId;
+            if (!sourceFileId)
+                continue;
+            var sourceFile = this._sourceFiles[sourceFileId];
+            if (sourceFile) {
+                this.setBreakpoint(sourceFileId, breakpointData.lineNumber, breakpointData.condition, breakpointData.enabled);
+                continue;
+            }
+
+            // Add breakpoint once source file becomes available.
+            var pendingBreakpoints = this._breakpointsWithoutSourceFile[sourceFileId];
+            if (!pendingBreakpoints) {
+                pendingBreakpoints = [];
+                this._breakpointsWithoutSourceFile[sourceFileId] = pendingBreakpoints;
+            }
+            pendingBreakpoints.push(breakpointData);
         }
     },
 
     _saveBreakpoints: function()
     {
         var serializedBreakpoints = [];
-        var breakpoints = WebInspector.debuggerModel.breakpoints;
-        for (var id in breakpoints) {
-            var breakpoint = breakpoints[id];
-            if (!breakpoint.url)
+
+        // Store added breakpoints.
+        for (var sourceFileId in this._sourceFiles) {
+            var sourceFile = this._sourceFiles[sourceFileId];
+            if (!sourceFile.url)
                 continue;
-            var serializedBreakpoint = {};
-            serializedBreakpoint.url = breakpoint.url;
-            serializedBreakpoint.lineNumber = breakpoint.lineNumber;
-            serializedBreakpoint.columnNumber = breakpoint.columnNumber;
-            serializedBreakpoint.condition = breakpoint.condition;
-            serializedBreakpoint.enabled = breakpoint.enabled;
-            serializedBreakpoints.push(serializedBreakpoint);
+
+            for (var lineNumber in sourceFile.breakpoints)
+                serializedBreakpoints.push(sourceFile.breakpoints[lineNumber].serialize());
         }
+
+        // Store not added breakpoints.
+        for (var sourceFileId in this._breakpointsWithoutSourceFile)
+            serializedBreakpoints = serializedBreakpoints.concat(this._breakpointsWithoutSourceFile[sourceFileId]);
+
+        // Sanitize debugger ids.
+        for (var i = 0; i < serializedBreakpoints.length; ++i)
+            delete serializedBreakpoints[i].debuggerId;
+
         WebInspector.settings.breakpoints = serializedBreakpoints;
     },
 
@@ -393,9 +510,9 @@ WebInspector.DebuggerPresentationModel.prototype = {
         for (var i = 0; i < callFrames.length; ++i) {
             var callFrame = callFrames[i];
             var sourceFile;
-            var script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
+            var script = WebInspector.debuggerModel.scriptForSourceID(callFrame.location.sourceID);
             if (script)
-                sourceFile = this._sourceFileForScript(script);
+                sourceFile = this._sourceFileForScript(script.sourceURL, script.sourceID);
             this._presentationCallFrames.push(new WebInspector.PresenationCallFrame(callFrame, i, sourceFile));
         }
         var details = WebInspector.debuggerModel.debuggerPausedDetails;
@@ -423,30 +540,48 @@ WebInspector.DebuggerPresentationModel.prototype = {
         return this._presentationCallFrames[this._selectedCallFrameIndex];
     },
 
-    _sourceFileForScript: function(script)
+    _sourceFileForScript: function(sourceURL, sourceID)
     {
-        return this._sourceFiles[script.sourceURL || script.sourceID];
-    },
-
-    _sourceFileForScriptURL: function(scriptURL)
-    {
-        return this._sourceFiles[scriptURL];
+        return this._sourceFiles[this._createSourceFileId(sourceURL, sourceID)];
     },
 
     _scriptForSourceFileId: function(sourceFileId)
     {
         function filter(script)
         {
-            return (script.sourceURL || script.sourceID) === sourceFileId;
+            return this._createSourceFileId(script.sourceURL, script.sourceID) === sourceFileId;
         }
-        return WebInspector.debuggerModel.queryScripts(filter)[0];
+        return WebInspector.debuggerModel.queryScripts(filter.bind(this))[0];
+    },
+
+    _createSourceFileId: function(sourceURL, sourceID)
+    {
+        var prefix = this._formatSourceFiles ? "deobfuscated:" : "";
+        return prefix + (sourceURL || sourceID);
     },
 
     _reset: function()
     {
+        for (var id in this._sourceFiles) {
+            var sourceFile = this._sourceFiles[id];
+            for (var line in sourceFile.breakpoints) {
+                var breakpoints = this._breakpointsWithoutSourceFile[sourceFile.id];
+                if (!breakpoints) {
+                    breakpoints = [];
+                    this._breakpointsWithoutSourceFile[sourceFile.id] = breakpoints;
+                }
+                breakpoints.push(sourceFile.breakpoints[line].serialize());
+            }
+        }
+
         this._sourceFiles = {};
         this._messages = [];
-        this._presentationBreakpoints = {};
+        this._breakpointsByDebuggerId = {};
+    },
+
+    _debuggerReset: function()
+    {
+        this._reset();
         this._presentationCallFrames = [];
         this._selectedCallFrameIndex = 0;
     }
@@ -454,42 +589,24 @@ WebInspector.DebuggerPresentationModel.prototype = {
 
 WebInspector.DebuggerPresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
 
-WebInspector.PresentationBreakpoint = function(breakpoint, sourceFile, lineNumber)
+WebInspector.PresentationBreakpoint = function(sourceFile, lineNumber, condition, enabled)
 {
-    this._breakpoint = breakpoint;
-    this._sourceFile = sourceFile;
-    this._lineNumber = lineNumber;
+    this.sourceFile = sourceFile;
+    this.sourceFileId = sourceFile.id;
+    this.lineNumber = lineNumber;
+    this.condition = condition;
+    this.enabled = enabled;
 }
 
 WebInspector.PresentationBreakpoint.prototype = {
-    get sourceFileId()
-    {
-        return this._sourceFile.id;
-    },
-
-    get lineNumber()
-    {
-        return this._lineNumber;
-    },
-
-    get condition()
-    {
-        return this._breakpoint.condition;
-    },
-
-    get enabled()
-    {
-        return this._breakpoint.enabled;
-    },
-
     get url()
     {
-        return this._sourceFile.url;
+        return this.sourceFile.url;
     },
 
     get resolved()
     {
-        return !!this._breakpoint.locations.length
+        return !!this.location;
     },
 
     loadSnippet: function(callback)
@@ -502,7 +619,22 @@ WebInspector.PresentationBreakpoint.prototype = {
                 snippet = content.substring(lineEndings[this.lineNumber - 1], lineEndings[this.lineNumber]);
             callback(snippet);
         }
-        this._sourceFile.requestContent(didRequestContent.bind(this));
+        if (!this.sourceFile) {
+            callback(WebInspector.UIString("N/A"));
+            return;
+        }
+        this.sourceFile.requestContent(didRequestContent.bind(this));
+    },
+
+    serialize: function()
+    {
+        var serializedBreakpoint = {};
+        serializedBreakpoint.sourceFileId = this.sourceFile.id;
+        serializedBreakpoint.lineNumber = this.lineNumber;
+        serializedBreakpoint.condition = this.condition;
+        serializedBreakpoint.enabled = this.enabled;
+        serializedBreakpoint.debuggerId = this.debuggerId;
+        return serializedBreakpoint;
     }
 }
 
@@ -511,7 +643,7 @@ WebInspector.PresenationCallFrame = function(callFrame, index, sourceFile)
     this._callFrame = callFrame;
     this._index = index;
     this._sourceFile = sourceFile;
-    this._script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
+    this._script = WebInspector.debuggerModel.scriptForSourceID(callFrame.location.sourceID);
 }
 
 WebInspector.PresenationCallFrame.prototype = {
@@ -561,18 +693,63 @@ WebInspector.PresenationCallFrame.prototype = {
         DebuggerAgent.evaluateOnCallFrame(this._callFrame.id, code, objectGroup, includeCommandLineAPI, didEvaluateOnCallFrame.bind(this));
     },
 
-    sourceLocation: function(callback)
+    sourceLine: function(callback)
     {
         if (!this._sourceFile) {
-            callback(undefined, this._callFrame.line, this._callFrame.column);
+            callback(undefined, this._callFrame.location.lineNumber);
             return;
         }
 
         function didRequestSourceMapping(mapping)
         {
-            var sourceLocation = mapping.scriptLocationToSourceLocation(this._callFrame.line, this._callFrame.column);
-            callback(this._sourceFile.id, sourceLocation.lineNumber, sourceLocation.columnNumber);
+            callback(this._sourceFile.id, mapping.scriptLocationToSourceLine(this._callFrame.location));
         }
         this._sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
     }
 }
+
+WebInspector.DebuggerPresentationModelResourceBinding = function(model)
+{
+    this._presentationModel = model;
+    WebInspector.Resource.registerDomainModelBinding(WebInspector.Resource.Type.Script, this);
+}
+
+WebInspector.DebuggerPresentationModelResourceBinding.prototype = {
+    canSetContent: function(resource)
+    {
+        var sourceFile = this._presentationModel._sourceFileForScript(resource.url)
+        if (!sourceFile)
+            return false;
+        return this._presentationModel.canEditScriptSource(sourceFile.id);
+    },
+
+    setContent: function(resource, content, majorChange, userCallback)
+    {
+        if (!majorChange)
+            return;
+
+        var sourceFile = this._presentationModel._sourceFileForScript(resource.url);
+        if (!sourceFile) {
+            userCallback("Resource is not editable");
+            return;
+        }
+
+        resource.requestContent(this._setContentWithInitialContent.bind(this, sourceFile, content, userCallback));
+    },
+
+    _setContentWithInitialContent: function(sourceFile, content, userCallback, oldContent)
+    {
+        function callback(error)
+        {
+            if (userCallback)
+                userCallback(error);
+            if (!error) {
+                this._presentationModel._updateBreakpointsAfterLiveEdit(sourceFile.id, oldContent, content);
+                sourceFile.reload();
+            }
+        }
+        this._presentationModel.editScriptSource(sourceFile.id, content, callback.bind(this));
+    }
+}
+
+WebInspector.DebuggerPresentationModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
index 4fc1844..e706e1d 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
@@ -28,10 +28,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.HeapSnapshotGridNode = function(tree, hasChildren, populateCount)
+WebInspector.HeapSnapshotGridNode = function(tree, hasChildren)
 {
     WebInspector.DataGridNode.call(this, null, hasChildren);
-    this._defaultPopulateCount = populateCount;
+    this._defaultPopulateCount = tree._defaultPopulateCount;
     this._provider = null;
     this.addEventListener("populate", this._populate, this);
 }
@@ -51,20 +51,24 @@ WebInspector.HeapSnapshotGridNode.prototype = {
 
         function doPopulate()
         {
-            this._provider.sort(this.comparator());
-            this._provider.first();
-            this.populateChildren();
             this.removeEventListener("populate", this._populate, this);
+            function sorted(ignored)
+            {
+                this.populateChildren();
+            }
+            this._provider.sortAndRewind(this.comparator(), sorted.bind(this));
         }
     },
 
-    populateChildren: function(provider, howMany, atIndex)
+    populateChildren: function(provider, howMany, atIndex, afterPopulate, suppressNotifyAboutCompletion)
     {
         if (!howMany && provider) {
             howMany = provider.instanceCount;
             provider.instanceCount = 0;
         }
         provider = provider || this._provider;
+        if (!("instanceCount" in provider))
+            provider.instanceCount = 0;
         howMany = howMany || this._defaultPopulateCount;
         atIndex = atIndex || this.children.length;
         var haveSavedChildren = !!this._savedChildren;
@@ -75,19 +79,35 @@ WebInspector.HeapSnapshotGridNode.prototype = {
                 break;
             }
         }
-        for ( ; howMany > 0 && provider.hasNext(); provider.next(), ++provider.instanceCount, --howMany) {
-            var item = provider.item;
-            if (haveSavedChildren) {
-                var hash = this._childHashForEntity(item);
-                if (hash in this._savedChildren) {
-                    this.insertChild(this._savedChildren[hash], atIndex++);
-                    continue;
+        
+        function childrenRetrieved(items, hasNext, length)
+        {
+            for (var i = 0, l = items.length; i < l; ++i) {
+                var item = items[i];
+                if (haveSavedChildren) {
+                    var hash = this._childHashForEntity(item);
+                    if (hash in this._savedChildren) {
+                        this.insertChild(this._savedChildren[hash], atIndex++);
+                        continue;
+                    }
+                }
+                this.insertChild(this._createChildNode(item, provider), atIndex++);
+            }
+            provider.instanceCount += items.length;
+
+            if (hasNext)
+                this.insertChild(new WebInspector.ShowMoreDataGridNode(this.populateChildren.bind(this, provider), this._defaultPopulateCount, length), atIndex++);
+            if (afterPopulate)
+                afterPopulate();
+            if (!suppressNotifyAboutCompletion) {
+                function notify()
+                {
+                    this.dispatchEventToListeners("populate complete");
                 }
+                setTimeout(notify.bind(this), 0);
             }
-            this.insertChild(this._createChildNode(provider), atIndex++);
         }
-        if (provider.hasNext())
-            this.insertChild(new WebInspector.ShowMoreDataGridNode(this.populateChildren.bind(this, provider), this._defaultPopulateCount, provider.length), atIndex++);
+        provider.getNextItems(howMany, childrenRetrieved.bind(this));
     },
 
     _saveChildren: function()
@@ -102,31 +122,38 @@ WebInspector.HeapSnapshotGridNode.prototype = {
 
     sort: function()
     {
-        var comparator = this.comparator();
-        WebInspector.PleaseWaitMessage.prototype.startAction(this.dataGrid.element, doSort.bind(this));
-
         function doSort()
         {
-            if (!this._provider.sort(comparator))
-                return;
-            this._saveChildren();
-            this.removeChildren();
-            this._provider.first();
-            this.populateChildren(this._provider);
-            for (var i = 0, l = this.children.length; i < l; ++i) {
-                var child = this.children[i];
-                if (child.expanded)
-                    child.sort();
+            function afterSort(sorted)
+            {
+                if (!sorted)
+                    return;
+                this._saveChildren();
+                this.removeChildren();
+     
+                function afterPopulate()
+                {
+                    for (var i = 0, l = this.children.length; i < l; ++i) {
+                        var child = this.children[i];
+                        if (child.expanded)
+                            child.sort();
+                    }
+                    this.dataGrid.dispatchEventToListeners("sorting complete");
+                }
+                this.populateChildren(this._provider, null, null, afterPopulate.bind(this));
             }
+            this._provider.sortAndRewind(this.comparator(), afterSort.bind(this));
         }
+        this.dataGrid.dispatchEventToListeners("start sorting");
+        WebInspector.PleaseWaitMessage.prototype.startAction(this.dataGrid.element, doSort.bind(this));
     }
 };
 
 WebInspector.HeapSnapshotGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
 
-WebInspector.HeapSnapshotGenericObjectNode = function(tree, node, hasChildren, populateCount)
+WebInspector.HeapSnapshotGenericObjectNode = function(tree, node)
 {
-    WebInspector.HeapSnapshotGridNode.call(this, tree, hasChildren, populateCount);
+    WebInspector.HeapSnapshotGridNode.call(this, tree, false);
     this._name = node.name;
     this._type = node.type;
     this._shallowSize = node.selfSize;
@@ -167,7 +194,7 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
 
     get _countPercent()
     {
-        return this._count / this.tree.snapshot.nodeCount * 100.0;
+        return this._count / this.dataGrid.snapshot.nodeCount * 100.0;
     },
 
     get data()
@@ -216,6 +243,15 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
     get _shallowSizePercent()
     {
         return this._shallowSize / this.dataGrid.snapshot.totalSize * 100.0;
+    },
+
+    _updateHasChildren: function()
+    {
+        function isEmptyCallback(isEmpty)
+        {
+            this.hasChildren = !isEmpty;
+        }
+        this._provider.isEmpty(isEmptyCallback.bind(this));
     }
 }
 
@@ -223,24 +259,23 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype.__proto__ = WebInspector.He
 
 WebInspector.HeapSnapshotObjectNode = function(tree, edge)
 {
-    var provider = this._createProvider(tree.snapshot, edge.nodeIndex);
-    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, edge.node, !provider.isEmpty, 100);
+    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, edge.node);
     this._referenceName = edge.name;
     this._referenceType = edge.type;
-    this._provider = provider;
+    this._provider = this._createProvider(tree.snapshot, edge.nodeIndex);
+    this._updateHasChildren();
 }
 
 WebInspector.HeapSnapshotObjectNode.prototype = {
-    _createChildNode: function(provider)
+    _createChildNode: function(item)
     {
-        return new WebInspector.HeapSnapshotObjectNode(this.dataGrid, provider.item);
+        return new WebInspector.HeapSnapshotObjectNode(this.dataGrid, item);
     },
 
     _createProvider: function(snapshot, nodeIndex)
     {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
-        return new WebInspector.HeapSnapshotEdgesProvider(
-            snapshot,
+        return snapshot.createEdgesProvider(
             nodeIndex,
             function(edge) {
                 return !edge.isInvisible
@@ -312,23 +347,22 @@ WebInspector.HeapSnapshotObjectNode.prototype.__proto__ = WebInspector.HeapSnaps
 
 WebInspector.HeapSnapshotInstanceNode = function(tree, baseSnapshot, snapshot, node)
 {
-    var provider = this._createProvider(baseSnapshot || snapshot, node.nodeIndex);  
-    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, node, !provider.isEmpty, 100);
+    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, node);
     this._isDeletedNode = !!baseSnapshot;
-    this._provider = provider;    
+    this._provider = this._createProvider(baseSnapshot || snapshot, node.nodeIndex);
+    this._updateHasChildren();
 };
 
 WebInspector.HeapSnapshotInstanceNode.prototype = {
-    _createChildNode: function(provider)
+    _createChildNode: function(item)
     {
-        return new WebInspector.HeapSnapshotObjectNode(this.dataGrid, provider.item);
+        return new WebInspector.HeapSnapshotObjectNode(this.dataGrid, item);
     },
 
     _createProvider: function(snapshot, nodeIndex)
     {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
-        return new WebInspector.HeapSnapshotEdgesProvider(
-            snapshot,
+        return snapshot.createEdgesProvider(
             nodeIndex,
             function(edge) {
                 return !edge.isInvisible
@@ -387,7 +421,7 @@ WebInspector.HeapSnapshotInstanceNode.prototype.__proto__ = WebInspector.HeapSna
 
 WebInspector.HeapSnapshotConstructorNode = function(tree, className, aggregate)
 {
-    WebInspector.HeapSnapshotGridNode.call(this, tree, aggregate.count > 0, 100);
+    WebInspector.HeapSnapshotGridNode.call(this, tree, aggregate.count > 0);
     this._name = className;
     this._count = aggregate.count;
     this._shallowSize = aggregate.self;
@@ -396,15 +430,14 @@ WebInspector.HeapSnapshotConstructorNode = function(tree, className, aggregate)
 }
 
 WebInspector.HeapSnapshotConstructorNode.prototype = {
-    _createChildNode: function(provider)
+    _createChildNode: function(item)
     {
-        return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, null, this.dataGrid.snapshot, provider.item);
+        return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, null, this.dataGrid.snapshot, item);
     },
 
     _createNodesProvider: function(snapshot, nodeType, nodeClassName)
     {
-        return new WebInspector.HeapSnapshotNodesProvider(
-            snapshot,
+        return snapshot.createNodesProvider(
             function (node) {
                  return node.type === nodeType
                     && (nodeClassName === null || node.className === nodeClassName);
@@ -469,97 +502,94 @@ WebInspector.HeapSnapshotIteratorsTuple = function(it1, it2)
 }
 
 WebInspector.HeapSnapshotIteratorsTuple.prototype = {
-    first: function()
+    sortAndRewind: function(comparator, callback)
     {
-        this._it1.first();
-        this._it2.first();
-    },
-
-    sort: function(comparator)
-    {
-        this._it1.sort(comparator);
-        this._it2.sort(comparator);
+        function afterSort(ignored)
+        {
+            this._it2.sortAndRewind(comparator, callback);
+        }
+        this._it1.sortAndRewind(comparator, afterSort.bind(this));
     }
 };
 
 WebInspector.HeapSnapshotDiffNode = function(tree, className, baseAggregate, aggregate)
 {
-    if (!baseAggregate)
-        baseAggregate = { count: 0, self: 0, maxRet: 0, type:aggregate.type, name:aggregate.name, idxs: [] };
-    if (!aggregate)
-        aggregate = { count: 0, self: 0, maxRet: 0, type:baseAggregate.type, name:baseAggregate.name, idxs: [] };
-    WebInspector.HeapSnapshotGridNode.call(this, tree, true, 50);
+    WebInspector.HeapSnapshotGridNode.call(this, tree, true);
     this._name = className;
-    this._calculateDiff(tree.baseSnapshot, tree.snapshot, baseAggregate.idxs, aggregate.idxs);
-    this._provider = this._createNodesProvider(tree.baseSnapshot, tree.snapshot, aggregate.type, className);
+    this._baseIndexes = baseAggregate ? baseAggregate.idxs : [];
+    this._indexes = aggregate ? aggregate.idxs : [];
+    this._provider = this._createNodesProvider(tree.baseSnapshot, tree.snapshot, aggregate ? aggregate.type : baseAggregate.type, className);
 }
 
 WebInspector.HeapSnapshotDiffNode.prototype = {
-    _calculateDiff: function(baseSnapshot, snapshot, baseIndexes, currentIndexes)
-    {
-        var i = 0, l = baseIndexes.length;
-        var j = 0, m = currentIndexes.length;
-        this._addedCount = 0;
-        this._removedCount = 0;
-        this._addedSize = 0;
-        this._removedSize = 0;
-        var nodeA = new WebInspector.HeapSnapshotNode(baseSnapshot);
-        var nodeB = new WebInspector.HeapSnapshotNode(snapshot);
-        nodeA.nodeIndex = baseIndexes[i];
-        nodeB.nodeIndex = currentIndexes[j];
-        while (i < l && j < m) {
-            if (nodeA.id < nodeB.id) {
-                this._removedCount++;
-                this._removedSize += nodeA.selfSize;
-                nodeA.nodeIndex = baseIndexes[++i];
-            } else if (nodeA.id > nodeB.id) {
-                this._addedCount++;
-                this._addedSize += nodeB.selfSize;
-                nodeB.nodeIndex = currentIndexes[++j];                
-            } else {
-                nodeA.nodeIndex = baseIndexes[++i];
-                nodeB.nodeIndex = currentIndexes[++j];                
-            }
+    calculateDiff: function(dataGrid, callback)
+    {
+        var diff = dataGrid.snapshot.createDiff(this._name);
+        
+        function diffCalculated(diffResult)
+        {
+            this._diff = diffResult;
+            this._baseIndexes = null;
+            this._indexes = null;
+            callback(this._diff.addedSize === 0 && this._diff.removedSize === 0);
+        }
+        function baseSelfSizesReceived(baseSelfSizes)
+        {
+            diff.pushBaseSelfSizes(baseSelfSizes);
+            diff.calculate(diffCalculated.bind(this));
         }
-        while (i < l) {
-            this._removedCount++;
-            this._removedSize += nodeA.selfSize;
-            nodeA.nodeIndex = baseIndexes[++i];
+        function baseIdsReceived(baseIds)
+        {
+            diff.pushBaseIds(dataGrid.baseSnapshot.uid, baseIds);
+            dataGrid.snapshot.pushBaseIds(dataGrid.baseSnapshot.uid, this._name, baseIds);
+            dataGrid.baseSnapshot.nodeFieldValuesByIndex("selfSize", this._baseIndexes, baseSelfSizesReceived.bind(this));
         }
-        while (j < m) {
-            this._addedCount++;
-            this._addedSize += nodeB.selfSize;
-            nodeB.nodeIndex = currentIndexes[++j];                
+        function idsReceived(ids)
+        {
+            dataGrid.baseSnapshot.pushBaseIds(dataGrid.snapshot.uid, this._name, ids);
         }
-        this._countDelta = this._addedCount - this._removedCount;
-        this._sizeDelta = this._addedSize - this._removedSize;
+        dataGrid.baseSnapshot.nodeFieldValuesByIndex("id", this._baseIndexes, baseIdsReceived.bind(this));
+        dataGrid.snapshot.nodeFieldValuesByIndex("id", this._indexes, idsReceived.bind(this));
     },
 
-    _createChildNode: function(provider)
+    _createChildNode: function(item, provider)
     {
         if (provider === this._provider._it1)
-            return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, null, provider.snapshot, provider.item);
+            return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, null, provider.snapshot, item);
         else
-            return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, provider.snapshot, null, provider.item);
+            return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, provider.snapshot, null, item);
     },
 
     _createNodesProvider: function(baseSnapshot, snapshot, nodeType, nodeClassName)
     {
+        var className = this._name;
         return new WebInspector.HeapSnapshotIteratorsTuple(
             createProvider(snapshot, baseSnapshot), createProvider(baseSnapshot, snapshot));
 
         function createProvider(snapshot, otherSnapshot)
         {
-            return new WebInspector.HeapSnapshotNodesProvider(
-                snapshot,
+            var otherSnapshotId = otherSnapshot.uid;
+            var provider = snapshot.createNodesProvider(
                 function (node) {
                      return node.type === nodeType
                          && (nodeClassName === null || node.className === nodeClassName)
-                         && !otherSnapshot.hasId(node.id);
+                         && !this.baseSnapshotHasNode(otherSnapshotId, className, node.id);
                 });
+            provider.snapshot = snapshot;
+            return provider;
         }
     },
 
+    _childHashForEntity: function(node)
+    {
+        return node.id;
+    },
+
+    _childHashForNode: function(childNode)
+    {
+        return childNode.snapshotNodeId;
+    },
+
     comparator: function()
     {
         var sortAscending = this.dataGrid.sortOrder === "ascending";
@@ -576,16 +606,22 @@ WebInspector.HeapSnapshotDiffNode.prototype = {
         return WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.createComparator(sortFields);
     },
 
-    populateChildren: function(provider, howMany, atIndex)
+    populateChildren: function(provider, howMany, atIndex, afterPopulate)
     {
         if (!provider && !howMany) {
-            WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, this._provider._it1, this._defaultPopulateCount);
-            WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, this._provider._it2, this._defaultPopulateCount);
+            var firstProviderPopulated = function()
+            {
+                WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, this._provider._it2, this._defaultPopulateCount, atIndex, afterPopulate);
+            };
+            WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, this._provider._it1, this._defaultPopulateCount, atIndex, firstProviderPopulated.bind(this), true);
         } else if (!howMany) {
-            WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, this._provider._it1);
-            WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, this._provider._it2);
+            var firstProviderPopulated = function()
+            {
+                WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, this._provider._it2, null, atIndex, afterPopulate);
+            };
+            WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, this._provider._it1, null, atIndex, firstProviderPopulated.bind(this), true);
         } else
-            WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, provider, howMany, atIndex);
+            WebInspector.HeapSnapshotGridNode.prototype.populateChildren.call(this, provider, howMany, atIndex, afterPopulate);
     },
 
     _signForDelta: function(delta)
@@ -602,19 +638,16 @@ WebInspector.HeapSnapshotDiffNode.prototype = {
     {
         var data = {object: this._name};
 
-        data["addedCount"] = this._addedCount;
-        data["removedCount"] = this._removedCount;
-        data["countDelta"] = WebInspector.UIString("%s%d", this._signForDelta(this._countDelta), Math.abs(this._countDelta));
-        data["addedSize"] = Number.bytesToString(this._addedSize);
-        data["removedSize"] = Number.bytesToString(this._removedSize);
-        data["sizeDelta"] = WebInspector.UIString("%s%s", this._signForDelta(this._sizeDelta), Number.bytesToString(Math.abs(this._sizeDelta)));
+        data["addedCount"] = this._diff.addedCount;
+        data["removedCount"] = this._diff.removedCount;
+        var countDelta = this._diff.countDelta;
+        data["countDelta"] = WebInspector.UIString("%s%d", this._signForDelta(countDelta), Math.abs(countDelta));
+        data["addedSize"] = Number.bytesToString(this._diff.addedSize);
+        data["removedSize"] = Number.bytesToString(this._diff.removedSize);
+        var sizeDelta = this._diff.sizeDelta;
+        data["sizeDelta"] = WebInspector.UIString("%s%s", this._signForDelta(sizeDelta), Number.bytesToString(Math.abs(sizeDelta)));
 
         return data;
-    },
-
-    get zeroDiff()
-    {
-        return this._addedCount === 0 && this._removedCount === 0;
     }
 };
 
@@ -622,22 +655,21 @@ WebInspector.HeapSnapshotDiffNode.prototype.__proto__ = WebInspector.HeapSnapsho
 
 WebInspector.HeapSnapshotDominatorObjectNode = function(tree, node)
 {
-    var provider = this._createProvider(tree.snapshot, node.nodeIndex);
-    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, node, !provider.isEmpty, 25);
-    this._provider = provider;
+    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, node);
+    this._provider = this._createProvider(tree.snapshot, node.nodeIndex);
+    this._updateHasChildren();
 };
 
 WebInspector.HeapSnapshotDominatorObjectNode.prototype = {
-    _createChildNode: function(provider)
+    _createChildNode: function(item)
     {
-        return new WebInspector.HeapSnapshotDominatorObjectNode(this.dataGrid, provider.item);
+        return new WebInspector.HeapSnapshotDominatorObjectNode(this.dataGrid, item);
     },
 
     _createProvider: function(snapshot, nodeIndex)
     {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
-        return new WebInspector.HeapSnapshotNodesProvider(
-            snapshot,
+        return snapshot.createNodesProvider(
             function (node) {
                  var dominatorIndex = node.dominatorIndex;
                  return dominatorIndex === nodeIndex
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
index 21d0fa9..1e46b51 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
@@ -37,10 +37,11 @@ WebInspector.HeapSnapshotContainmentDataGrid = function()
     };
     WebInspector.DataGrid.call(this, columns);
     this.addEventListener("sorting changed", this.sort, this);
-    this._defaultPopulateCount = 100;
 }
 
 WebInspector.HeapSnapshotContainmentDataGrid.prototype = {
+    _defaultPopulateCount: 100,
+
     setDataSource: function(snapshotView, snapshot)
     {
         this.snapshotView = snapshotView;
@@ -65,6 +66,10 @@ WebInspector.HeapSnapshotSortableDataGrid.prototype = {
     {
         var sortAscending = this.sortOrder === "ascending";
         var sortColumnIdentifier = this.sortColumnIdentifier;
+        if (this._lastSortColumnIdentifier === sortColumnIdentifier && this._lastSortAscending === sortAscending)
+            return;
+        this._lastSortColumnIdentifier = sortColumnIdentifier;
+        this._lastSortAscending = sortAscending;
         var sortFields = this._sortFields(sortColumnIdentifier, sortAscending);
 
         function SortByTwoFields(nodeA, nodeB)
@@ -89,6 +94,7 @@ WebInspector.HeapSnapshotSortableDataGrid.prototype = {
 
     _performSorting: function(sortFunction)
     {
+        this.dispatchEventToListeners("start sorting");
         var children = this.children;
         this.removeChildren();
         children.sort(sortFunction);
@@ -98,6 +104,7 @@ WebInspector.HeapSnapshotSortableDataGrid.prototype = {
             if (child.expanded)
                 child.sort();
         }
+        this.dispatchEventToListeners("sorting complete");
     }
 };
 
@@ -115,6 +122,8 @@ WebInspector.HeapSnapshotConstructorsDataGrid = function()
 }
 
 WebInspector.HeapSnapshotConstructorsDataGrid.prototype = {
+    _defaultPopulateCount: 100,
+
     _sortFields: function(sortColumn, sortAscending)
     {
         return {
@@ -130,14 +139,17 @@ WebInspector.HeapSnapshotConstructorsDataGrid.prototype = {
         this.snapshotView = snapshotView;
         this.snapshot = snapshot;
         this.populateChildren();
-        this.sortingChanged();
     },
 
     populateChildren: function()
     {
-        var aggregates = this.snapshot.aggregates();
-        for (var constructor in aggregates)
-            this.appendChild(new WebInspector.HeapSnapshotConstructorNode(this, constructor, aggregates[constructor]));
+        function aggregatesReceived(aggregates)
+        {
+            for (var constructor in aggregates)
+                this.appendChild(new WebInspector.HeapSnapshotConstructorNode(this, constructor, aggregates[constructor]));
+            this.sortingChanged();
+        }
+        this.snapshot.aggregates(false, aggregatesReceived.bind(this));
     }
 };
 
@@ -147,7 +159,6 @@ WebInspector.HeapSnapshotDiffDataGrid = function()
 {
     var columns = {
         object: { title: WebInspector.UIString("Constructor"), disclosure: true, sortable: true },
-        // \xb1 is a "plus-minus" sign.
         addedCount: { title: WebInspector.UIString("# New"), width: "72px", sortable: true, sort: "descending" },
         removedCount: { title: WebInspector.UIString("# Deleted"), width: "72px", sortable: true },
         // \u0394 is a Greek delta letter.
@@ -160,6 +171,8 @@ WebInspector.HeapSnapshotDiffDataGrid = function()
 }
 
 WebInspector.HeapSnapshotDiffDataGrid.prototype = {
+    _defaultPopulateCount: 50,
+
     _sortFields: function(sortColumn, sortAscending)
     {
         return {
@@ -183,28 +196,41 @@ WebInspector.HeapSnapshotDiffDataGrid.prototype = {
     {
         this.baseSnapshot = baseSnapshot;
         this.removeChildren();
-        if (this.baseSnapshot !== this.snapshot) {
-            this.populateChildren();
-            this.sortingChanged();
-        }
+        if (this.baseSnapshot === this.snapshot)
+            return;
+        this.populateChildren();        
     },
 
     populateChildren: function()
     {
-        var baseClasses = this.baseSnapshot.aggregates(true);
-        var classes = this.snapshot.aggregates(true);
-        for (var clss in baseClasses) {
-            var node = new WebInspector.HeapSnapshotDiffNode(this, clss, baseClasses[clss], classes[clss]);
-            if (!node.zeroDiff)
-                this.appendChild(node);
-        }
-        for (clss in classes) {
-            if (!(clss in baseClasses)) {
-                var node = new WebInspector.HeapSnapshotDiffNode(this, clss, null, classes[clss]);
-                if (!node.zeroDiff)
-                    this.appendChild(node);
+        function baseAggregatesReceived(baseClasses)
+        {
+            function aggregatesReceived(classes)
+            {
+                var nodeCount = 0;
+                function addNodeIfNonZeroDiff(node, zeroDiff)
+                {
+                    if (!zeroDiff)
+                        this.appendChild(node);
+                    if (!--nodeCount)
+                        this.sortingChanged();
+                }
+                for (var clss in baseClasses) {
+                    var node = new WebInspector.HeapSnapshotDiffNode(this, clss, baseClasses[clss], classes[clss]);
+                    ++nodeCount;
+                    node.calculateDiff(this, addNodeIfNonZeroDiff.bind(this, node));
+                }
+                for (clss in classes) {
+                    if (!(clss in baseClasses)) {
+                        var node = new WebInspector.HeapSnapshotDiffNode(this, clss, null, classes[clss]);
+                        ++nodeCount;
+                        node.calculateDiff(this, addNodeIfNonZeroDiff.bind(this, node));
+                    }
+                }
             }
+            this.snapshot.aggregates(true, aggregatesReceived.bind(this));
         }
+        this.baseSnapshot.aggregates(true, baseAggregatesReceived.bind(this));
     }
 };
 
@@ -219,10 +245,11 @@ WebInspector.HeapSnapshotDominatorsDataGrid = function()
     };
     WebInspector.DataGrid.call(this, columns);
     this.addEventListener("sorting changed", this.sort, this);
-    this._defaultPopulateCount = 25;
 }
 
 WebInspector.HeapSnapshotDominatorsDataGrid.prototype = {
+    _defaultPopulateCount: 25,
+
     setDataSource: function(snapshotView, snapshot)
     {
         this.snapshotView = snapshotView;
@@ -243,6 +270,7 @@ WebInspector.HeapSnapshotRetainingPathsList = function()
         len: { title: WebInspector.UIString("Length"), width: "90px", sortable: true, sort: "ascending" }
     };
     WebInspector.HeapSnapshotSortableDataGrid.call(this, columns);
+    this._defaultPopulateCount = 100;
 }
 
 WebInspector.HeapSnapshotRetainingPathsList.prototype = {
@@ -254,6 +282,14 @@ WebInspector.HeapSnapshotRetainingPathsList.prototype = {
         }[sortColumn];
     },
 
+    _resetPaths: function()
+    {
+        this._setRootChildrenForFinder();
+        this.removeChildren();
+        this._counter = 0;
+        this.showNext(this._defaultPopulateCount);
+    },
+
     setDataSource: function(snapshotView, snapshot, nodeIndex, prefix)
     {
         this.snapshotView = snapshotView;
@@ -261,53 +297,49 @@ WebInspector.HeapSnapshotRetainingPathsList.prototype = {
 
         if (this.pathFinder)
             this.searchCancelled();
-
-        this.pathFinder = new WebInspector.HeapSnapshotPathFinder(snapshot, nodeIndex);
-        this._setRootChildrenForFinder();
-
-        this.removeChildren();
-
-        this._counter = 0;
-        this.showNext(100);
+        this.pathFinder = snapshot.createPathFinder(nodeIndex);
+        this._resetPaths();
     },
 
     refresh: function()
     {
-        this.removeChildren();
-        this._counter = 0;
         delete this._cancel;
-        this._setRootChildrenForFinder();
-        this.showNext(100);
+        this._resetPaths();
     },
 
     showNext: function(pathsCount)
     {
         WebInspector.PleaseWaitMessage.prototype.show(this.element, this.searchCancelled.bind(this, pathsCount));
-        window.setTimeout(startSearching.bind(this), 500);
+
+        function pathFound(result)
+        {
+            if (result === null) {
+                WebInspector.PleaseWaitMessage.prototype.hide();
+                if (!this.children.length)
+                    this.appendChild(new WebInspector.DataGridNode({path:WebInspector.UIString("Can't find any paths."), len:""}, false));
+                return;
+            } else if (result !== false) {
+                if (this._prefix)
+                    result.path = this._prefix + result.path;
+                this.appendChild(new WebInspector.DataGridNode(result, false));
+                ++this._counter;
+            }
+            setTimeout(startSearching.bind(this), 0);
+        }
 
         function startSearching()
         {
-            if (this._cancel !== this.pathFinder) {
-                if (this._counter < pathsCount) {
-                    var result = this.pathFinder.findNext();
-                    if (result === null) {
-                        WebInspector.PleaseWaitMessage.prototype.hide();
-                        if (!this.children.length)
-                            this.appendChild(new WebInspector.DataGridNode({path:WebInspector.UIString("Can't find any paths."), len:""}, false));
-                        return;
-                    } else if (result !== false) {
-                        if (this._prefix)
-                            result.path = this._prefix + result.path;
-                        this.appendChild(new WebInspector.DataGridNode(result, false));
-                        ++this._counter;
-                    }
-                    window.setTimeout(startSearching.bind(this), 0);
-                    return;
-                } else
-                    this.searchCancelled.call(this, pathsCount);
+            if (this._cancel === this.pathFinder)
+                return;
+            delete this._cancel;
+            if (this._counter < pathsCount)
+                this.pathFinder.findNext(pathFound.bind(this));
+            else {
+                this.searchCancelled.call(this, pathsCount);
+                delete this._cancel;
             }
-            this._cancel = false;
         }
+        setTimeout(startSearching.bind(this), 0);
     },
 
     searchCancelled: function(pathsCount)
@@ -419,20 +451,17 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.viewSelectElement.className = "status-bar-item";
     this.viewSelectElement.addEventListener("change", this._changeView.bind(this), false);
 
-    var classesViewOption = document.createElement("option");
-    classesViewOption.label = WebInspector.UIString("Summary");
-    var diffViewOption = document.createElement("option");
-    diffViewOption.label = WebInspector.UIString("Comparison");
-    var containmentViewOption = document.createElement("option");
-    containmentViewOption.label = WebInspector.UIString("Containment");
-    var dominatorsViewOption = document.createElement("option");
-    dominatorsViewOption.label = WebInspector.UIString("Dominators");
-    this.viewSelectElement.appendChild(classesViewOption);
-    this.viewSelectElement.appendChild(diffViewOption);
-    this.viewSelectElement.appendChild(containmentViewOption);
-    this.viewSelectElement.appendChild(dominatorsViewOption);
-    this.views = ["Summary", "Comparison", "Containment", "Dominators"];
+    this.views = [{title: "Summary", view: this.constructorsView, grid: this.constructorsDataGrid},
+                  {title: "Comparison", view: this.diffView, grid: this.diffDataGrid},
+                  {title: "Containment", view: this.containmentView, grid: this.containmentDataGrid},
+                  {title: "Dominators", view: this.dominatorView, grid: this.dominatorDataGrid}];
     this.views.current = 0;
+    for (var i = 0; i < this.views.length; ++i) {
+        var view = this.views[i];
+        var option = document.createElement("option");
+        option.label = WebInspector.UIString(view.title);
+        this.viewSelectElement.appendChild(option);
+    }
 
     this._profileUid = profile.uid;
 
@@ -450,12 +479,12 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
 
     this._loadProfile(this._profileUid, profileCallback.bind(this));
 
-    function profileCallback(profile)
+    function profileCallback()
     {
         var list = this._profiles();
         var profileIndex;
         for (var i = 0; i < list.length; ++i)
-            if (list[i].uid === profile.uid) {
+            if (list[i].uid === this._profileUid) {
                 profileIndex = i;
                 break;
             }
@@ -490,7 +519,7 @@ WebInspector.DetailedHeapshotView.prototype = {
     get profileWrapper()
     {
         if (!this._profileWrapper)
-            this._profileWrapper = new WebInspector.HeapSnapshot(this.profile);
+            this._profileWrapper = this.profile.proxy;
         return this._profileWrapper;
     },
 
@@ -501,34 +530,27 @@ WebInspector.DetailedHeapshotView.prototype = {
 
     get baseProfileWrapper()
     {
-        if (!this._baseProfileWrapper) {
-            if (this.baseProfile !== this.profile)
-                this._baseProfileWrapper = new WebInspector.HeapSnapshot(this.baseProfile);
-            else
-                this._baseProfileWrapper = this.profileWrapper;
-        }
+        if (!this._baseProfileWrapper)
+            this._baseProfileWrapper = this.baseProfile.proxy;
         return this._baseProfileWrapper;
     },
 
     show: function(parentElement)
     {
         WebInspector.View.prototype.show.call(this, parentElement);
-        if (!this.profile._loaded)
+        if (!this.profileWrapper.loaded)
             this._loadProfile(this._profileUid, profileCallback1.bind(this));
         else
-            profileCallback1.call(this, this.profile);
+            profileCallback1.call(this);
 
-        function profileCallback1(profile) {
-            this.profileWrapper.restore(profile);
-            if (this.baseProfile && !this.baseProfile._loaded)
+        function profileCallback1() {
+            if (this.baseProfile && !this.baseProfileWrapper.loaded)
                 this._loadProfile(this._baseProfileUid, profileCallback2.bind(this));
             else
-                profileCallback2.call(this, this.baseProfile);
+                profileCallback2.call(this);
         }
 
-        function profileCallback2(profile) {
-            if (profile)
-                this.baseProfileWrapper.restore(profile);
+        function profileCallback2() {
             this.currentView.show();
             this.dataGrid.updateWidths();
         }
@@ -697,7 +719,7 @@ WebInspector.DetailedHeapshotView.prototype = {
         this._baseProfileUid = this._profiles()[this.baseSelectElement.selectedIndex].uid;
         this._loadProfile(this._baseProfileUid, baseProfileLoaded.bind(this));
 
-        function baseProfileLoaded(profile)
+        function baseProfileLoaded()
         {
             delete this._baseProfileWrapper;
             this.baseProfile._lastShown = Date.now();
@@ -770,19 +792,9 @@ WebInspector.DetailedHeapshotView.prototype = {
 
         this.views.current = event.target.selectedIndex;
         this.currentView.hide();
-        if (this.views[this.views.current] === "Containment") {
-            this.currentView = this.containmentView;
-            this.dataGrid = this.containmentDataGrid;
-        } else if (this.views[this.views.current] === "Summary") {
-            this.currentView = this.constructorsView;
-            this.dataGrid = this.constructorsDataGrid;
-        } else if (this.views[this.views.current] === "Comparison") {
-            this.currentView = this.diffView;
-            this.dataGrid = this.diffDataGrid;
-        } else if (this.views[this.views.current] === "Dominators") {
-            this.currentView = this.dominatorView;
-            this.dataGrid = this.dominatorDataGrid;
-        }
+        var view = this.views[this.views.current];
+        this.currentView = view.view;
+        this.dataGrid = view.grid;
         this.currentView.show();
         this.refreshVisibleData();
         if (this.currentView === this.diffView) {
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 724e0e2..1f6f56b 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -38,7 +38,7 @@ WebInspector.ElementsPanel = function()
     if (!WebInspector.settings.domWordWrap)
         this.contentElement.classList.add("nowrap");
 
-    this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
+    this.contentElement.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
 
     this.treeOutline = new WebInspector.ElementsTreeOutline();
     this.treeOutline.panel = this;
@@ -79,7 +79,7 @@ WebInspector.ElementsPanel = function()
     this.sidebarPanes.metrics = new WebInspector.MetricsSidebarPane();
     this.sidebarPanes.properties = new WebInspector.PropertiesSidebarPane();
     if (Preferences.nativeInstrumentationEnabled)
-        this.sidebarPanes.domBreakpoints = WebInspector.createDOMBreakpointsSidebarPane();
+        this.sidebarPanes.domBreakpoints = WebInspector.domBreakpointsSidebarPane;
     this.sidebarPanes.eventListeners = new WebInspector.EventListenersSidebarPane();
 
     this.sidebarPanes.styles.onexpand = this.updateStyles.bind(this);
@@ -153,6 +153,9 @@ WebInspector.ElementsPanel.prototype = {
         if (this.recentlyModifiedNodes.length)
             this.updateModifiedNodes();
 
+        if (Preferences.nativeInstrumentationEnabled)
+            this.sidebarElement.insertBefore(this.sidebarPanes.domBreakpoints.element, this.sidebarPanes.eventListeners.element);
+
         if (!this.rootDOMNode)
             WebInspector.domAgent.requestDocument();
     },
@@ -199,8 +202,8 @@ WebInspector.ElementsPanel.prototype = {
         if (!inspectedRootDocument)
             return;
 
-        WebInspector.breakpointManager.restoreDOMBreakpoints();
-
+        if (Preferences.nativeInstrumentationEnabled)
+            this.sidebarPanes.domBreakpoints.restoreBreakpoints();
 
         this.rootDOMNode = inspectedRootDocument;
 
@@ -483,7 +486,7 @@ WebInspector.ElementsPanel.prototype = {
                     nodeItem.updateTitle();
                 continue;
             }
-            
+
             if (!parent)
                 continue;
 
@@ -768,13 +771,13 @@ WebInspector.ElementsPanel.prototype = {
         var i = 0;
         var crumb = crumbs.firstChild;
         while (crumb) {
-            // Find the selected crumb and index. 
+            // Find the selected crumb and index.
             if (!selectedCrumb && crumb.hasStyleClass("selected")) {
                 selectedCrumb = crumb;
                 selectedIndex = i;
             }
 
-            // Find the focused crumb index. 
+            // Find the focused crumb index.
             if (crumb === focusedCrumb)
                 focusedIndex = i;
 
@@ -883,7 +886,7 @@ WebInspector.ElementsPanel.prototype = {
             while (crumb) {
                 var hidden = crumb.hasStyleClass("hidden");
                 if (!hidden) {
-                    var collapsed = crumb.hasStyleClass("collapsed"); 
+                    var collapsed = crumb.hasStyleClass("collapsed");
                     if (collapsedRun && collapsed) {
                         crumb.addStyleClass("hidden");
                         crumb.removeStyleClass("compact");
@@ -1120,15 +1123,14 @@ WebInspector.ElementsPanel.prototype = {
         this._nodeSearchButton.toggled = false;
     },
 
-    _setSearchingForNode: function(error, enabled)
+    _setSearchingForNode: function(enabled)
     {
-        if (!error)
-            this._nodeSearchButton.toggled = enabled;
+        this._nodeSearchButton.toggled = enabled;
     },
 
     setSearchingForNode: function(enabled)
     {
-        DOMAgent.setSearchingForNode(enabled, this._setSearchingForNode.bind(this));
+        DOMAgent.setSearchingForNode(enabled, this._setSearchingForNode.bind(this, enabled));
     },
 
     toggleSearchingForNode: function()
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index dd99db1..2ecc3f9 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -791,23 +791,8 @@ WebInspector.ElementsTreeElement.prototype = {
         if (Preferences.nativeInstrumentationEnabled) {
             // Add debbuging-related actions
             contextMenu.appendSeparator();
-
-            function handlerFunction(nodeId, breakType)
-            {
-                WebInspector.breakpointManager.createDOMBreakpoint(nodeId, breakType);
-                WebInspector.panels.elements.sidebarPanes.domBreakpoints.expand();
-            }
-            var node = this.representedObject;
-            for (var key in WebInspector.DOMBreakpointTypes) {
-                var type = WebInspector.DOMBreakpointTypes[key];
-                var label = WebInspector.domBreakpointTypeContextMenuLabel(type);
-                var breakpoint = node.breakpoints[type];
-                if (!breakpoint)
-                    var handler = handlerFunction.bind(this, node.id, type);
-                else
-                    var handler = breakpoint.remove.bind(breakpoint);
-                contextMenu.appendCheckboxItem(label, handler, !!breakpoint);
-            }
+            var pane = WebInspector.panels.elements.sidebarPanes.domBreakpoints;
+            pane.populateNodeContextMenu(this.representedObject, contextMenu);
         }
     },
 
diff --git a/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js b/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
index 00576f1..2dce7ee 100644
--- a/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -214,7 +214,7 @@ WebInspector.EventListenerBar.prototype = {
         }
 
         if (node.id === this._nodeId) {
-            this.titleElement.textContent = appropriateSelectorForNode(node);
+            this.titleElement.textContent = node.appropriateSelectorFor();
             return;
         }
 
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPI.js b/Source/WebCore/inspector/front-end/ExtensionAPI.js
index ea7324c..940e340 100644
--- a/Source/WebCore/inspector/front-end/ExtensionAPI.js
+++ b/Source/WebCore/inspector/front-end/ExtensionAPI.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -111,6 +111,7 @@ function Resources()
         this._fire(resource);
     }
     this.onFinished = new EventSink("resource-finished", resourceDispatch);
+    this.onNavigated = new EventSink("inspectedURLChanged");
 }
 
 Resources.prototype = {
@@ -182,6 +183,8 @@ Panels.prototype = {
 function PanelImpl(id)
 {
     this._id = id;
+    this.onShown = new EventSink("panel-shown-" + id);
+    this.onHidden = new EventSink("panel-hidden-" + id);
 }
 
 function PanelWithSidebarImpl(id)
@@ -190,35 +193,18 @@ function PanelWithSidebarImpl(id)
 }
 
 PanelWithSidebarImpl.prototype = {
-    createSidebarPane: function(title, url, callback)
+    createSidebarPane: function(title, callback)
     {
         var id = "extension-sidebar-" + extensionServer.nextObjectId();
         var request = {
             command: "createSidebarPane",
             panel: this._id,
             id: id,
-            title: title,
-            url: expandURL(url)
-        };
-        function callbackWrapper()
-        {
-            callback(new ExtensionSidebarPane(id));
-        }
-        extensionServer.sendRequest(request, callback && callbackWrapper);
-    },
-
-    createWatchExpressionSidebarPane: function(title, callback)
-    {
-        var id = "watch-sidebar-" + extensionServer.nextObjectId();
-        var request = {
-            command: "createWatchExpressionSidebarPane",
-            panel: this._id,
-            id: id,
             title: title
         };
         function callbackWrapper()
         {
-            callback(new WatchExpressionSidebarPane(id));
+            callback(new ExtensionSidebarPane(id));
         }
         extensionServer.sendRequest(request, callback && callbackWrapper);
     }
@@ -242,39 +228,29 @@ function ExtensionPanel(id)
 function ExtensionSidebarPaneImpl(id)
 {
     this._id = id;
+    this.onUpdated = new EventSink("sidebar-updated-" + id);
 }
 
 ExtensionSidebarPaneImpl.prototype = {
     setHeight: function(height)
     {
         extensionServer.sendRequest({ command: "setSidebarHeight", id: this._id, height: height });
-    }
-}
-
-function WatchExpressionSidebarPaneImpl(id)
-{
-    ExtensionSidebarPaneImpl.call(this, id);
-    this.onUpdated = new EventSink("watch-sidebar-updated-" + id);
-}
+    },
 
-WatchExpressionSidebarPaneImpl.prototype = {
     setExpression: function(expression, rootTitle)
     {
-        extensionServer.sendRequest({ command: "setWatchSidebarContent", id: this._id, expression: expression, rootTitle: rootTitle, evaluateOnPage: true });
+        extensionServer.sendRequest({ command: "setSidebarContent", id: this._id, expression: expression, rootTitle: rootTitle, evaluateOnPage: true });
     },
 
     setObject: function(jsonObject, rootTitle)
     {
-        extensionServer.sendRequest({ command: "setWatchSidebarContent", id: this._id, expression: jsonObject, rootTitle: rootTitle });
-    }
-}
-
-WatchExpressionSidebarPaneImpl.prototype.__proto__ = ExtensionSidebarPaneImpl.prototype;
+        extensionServer.sendRequest({ command: "setSidebarContent", id: this._id, expression: jsonObject, rootTitle: rootTitle });
+    },
 
-function WatchExpressionSidebarPane(id)
-{
-    var impl = new WatchExpressionSidebarPaneImpl(id);
-    ExtensionSidebarPane.call(this, id, impl);
+    setPage: function(url)
+    {
+        extensionServer.sendRequest({ command: "setSidebarPage", id: this._id, url: expandURL(url) });
+    }
 }
 
 function Audits()
@@ -381,9 +357,6 @@ AuditResultNode.prototype = {
 
 function InspectedWindow()
 {
-    this.onDOMContentLoaded = new EventSink("inspectedPageDOMContentLoaded");
-    this.onLoaded = new EventSink("inspectedPageLoaded");
-    this.onNavigated = new EventSink("inspectedURLChanged");
 }
 
 InspectedWindow.prototype = {
@@ -511,7 +484,6 @@ var ExtensionSidebarPane = declareInterfaceClass(ExtensionSidebarPaneImpl);
 var Panel = declareInterfaceClass(PanelImpl);
 var PanelWithSidebar = declareInterfaceClass(PanelWithSidebarImpl);
 var Resource = declareInterfaceClass(ResourceImpl);
-var WatchExpressionSidebarPane = declareInterfaceClass(WatchExpressionSidebarPaneImpl);
 
 var extensionServer = new ExtensionServerClient();
 
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPISchema.json b/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
index 0aa7aa8..c4c8358 100755
--- a/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
+++ b/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
@@ -19,11 +19,6 @@
                 "description": "A text that is displayed in sidebar caption."
               },
               {
-                "name": "url",
-                "type": "string",
-                "description": "An URL of the page that represents the sidebar."
-              },
-              {
                 "name": "callback",
                 "type": "function",
                 "description": "A callback invoked when sidebar is created",
@@ -36,30 +31,6 @@
                 ]
               }
             ]
-          },
-          {
-            "name": "createWatchExpressionSidebarPane",
-            "type": "function",
-            "description": "Creates a pane with an object property tree (similar to a watch sidebar pane).",
-            "parameters": [
-              {
-                "name": "title",
-                "type": "string",
-                "description": "A text that is displayed in sidebar caption."
-              },
-              {
-                "name": "callback",
-                "type": "function",
-                "description": "A callback invoked when sidebar is created",
-                "parameters": [
-                  {
-                    "name": "result",
-                    "description": "A WatchExpressionSidebarPane object for created sidebar pane",
-                    "$ref": "WatchExpressionSidebarPane"
-                  }
-                ]
-              }
-            ]
           }
         ]
       },
@@ -116,25 +87,6 @@
                 "description": "A CSS-like size specification, e.g. '10px' or '12pt'"
               }
             ]
-          }
-        ]
-      },
-      {
-        "id": "WatchExpressionSidebarPane",
-        "type": "object",
-        "description": "A sidebar created by the extension.",
-        "functions": [
-          {
-            "name": "setHeight",
-            "type": "function",
-            "description": "Sets the height of the sidebar.",
-            "parameters": [
-              {
-                "name": "height",
-                "type": "string",
-                "description": "A CSS-like size specification, e.g. '10px' or '12pt'"
-              }
-            ]
           },
           {
             "name": "setExpression",
@@ -171,6 +123,18 @@
                 "description": "An optional title for the root of the expression tree."
               }
             ]
+          },
+          {
+            "name": "setPage",
+            "type": "function",
+            "description": "Sets an HTML page to be displayed in the sidebar pane.",
+            "parameters": [
+              {
+                "name": "url",
+                "type": "string",
+                "description": "An URL of an extension page to display within the sidebar."
+              }
+            ]
           }
         ]
       }
@@ -201,12 +165,20 @@
             "name": "pageURL",
             "type": "string",
             "description": "An URL of the page that represents this panel."
+          },
+          {
+            "name": "callback",
+            "type": "function",
+            "description": "A function that is called upon request completion.",
+            "parameters": [
+              {
+                "name": "panel",
+                "description": "An ExtensionPanel object representing the created panel.",
+                "$ref": "ExtensionPanel"
+              }
+            ]
           }
-        ],
-        "returns" : {
-          "$ref": "ExtensionPanel",
-          "description": "A panel that was created."
-        }
+        ]
       }
     ]
   },
@@ -274,6 +246,18 @@
         "parameters": [
           { "name": "resource", "$ref": "Resource" }
         ]
+      },
+      {
+        "name": "onNavigation",
+        "type": "function",
+        "description": "Fired when an inspected window navigates to a new URL.",
+        "parameters": [
+          {
+            "name": "url",
+            "type": "stirng",
+            "description": "URL of the new page."
+          }
+        ]
       }
     ]
   },
diff --git a/Source/WebCore/inspector/front-end/ExtensionPanel.js b/Source/WebCore/inspector/front-end/ExtensionPanel.js
index 4249b2c..f09a720 100644
--- a/Source/WebCore/inspector/front-end/ExtensionPanel.js
+++ b/Source/WebCore/inspector/front-end/ExtensionPanel.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -81,13 +81,13 @@ WebInspector.ExtensionPanel.prototype = {
 
 WebInspector.ExtensionPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
-WebInspector.ExtensionWatchSidebarPane = function(title, id)
+WebInspector.ExtensionSidebarPane = function(title, id)
 {
     WebInspector.SidebarPane.call(this, title);
     this._id = id;
 }
 
-WebInspector.ExtensionWatchSidebarPane.prototype = {
+WebInspector.ExtensionSidebarPane.prototype = {
     setObject: function(object, title)
     {
         this._setObject(WebInspector.RemoteObject.fromLocalObject(object), title);
@@ -98,6 +98,14 @@ WebInspector.ExtensionWatchSidebarPane.prototype = {
         RuntimeAgent.evaluate(expression, "extension-watch", false, this._onEvaluate.bind(this, title));
     },
 
+    setPage: function(url)
+    {
+        this.bodyElement.removeChildren();
+        WebInspector.extensionServer.createClientIframe(this.bodyElement, url);
+        // TODO: Consider doing this upon load event.
+        WebInspector.extensionServer.notifyExtensionSidebarUpdated(this._id);
+    },
+
     _onEvaluate: function(title, error, result)
     {
         if (!error)
@@ -112,8 +120,8 @@ WebInspector.ExtensionWatchSidebarPane.prototype = {
             section.headerElement.addStyleClass("hidden");
         section.expanded = true;
         this.bodyElement.appendChild(section.element);
-        WebInspector.extensionServer.notifyExtensionWatchSidebarUpdated(this._id);
+        WebInspector.extensionServer.notifyExtensionSidebarUpdated(this._id);
     }
 }
 
-WebInspector.ExtensionWatchSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
+WebInspector.ExtensionSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
diff --git a/Source/WebCore/inspector/front-end/ExtensionServer.js b/Source/WebCore/inspector/front-end/ExtensionServer.js
index 9554dfa..2c95ef0 100644
--- a/Source/WebCore/inspector/front-end/ExtensionServer.js
+++ b/Source/WebCore/inspector/front-end/ExtensionServer.js
@@ -42,15 +42,15 @@ WebInspector.ExtensionServer = function()
     this._registerHandler("addAuditCategory", this._onAddAuditCategory.bind(this));
     this._registerHandler("addAuditResult", this._onAddAuditResult.bind(this));
     this._registerHandler("createPanel", this._onCreatePanel.bind(this));
-    this._registerHandler("createSidebarPane", this._onCreateSidebar.bind(this));
-    this._registerHandler("createWatchExpressionSidebarPane", this._onCreateWatchExpressionSidebarPane.bind(this));
+    this._registerHandler("createSidebarPane", this._onCreateSidebarPane.bind(this));
     this._registerHandler("evaluateOnInspectedPage", this._onEvaluateOnInspectedPage.bind(this));
     this._registerHandler("getHAR", this._onGetHAR.bind(this));
     this._registerHandler("getResourceContent", this._onGetResourceContent.bind(this));
     this._registerHandler("log", this._onLog.bind(this));
     this._registerHandler("reload", this._onReload.bind(this));
     this._registerHandler("setSidebarHeight", this._onSetSidebarHeight.bind(this));
-    this._registerHandler("setWatchSidebarContent", this._onSetWatchSidebarContent.bind(this));
+    this._registerHandler("setSidebarContent", this._onSetSidebarContent.bind(this));
+    this._registerHandler("setSidebarPage", this._onSetSidebarPage.bind(this));
     this._registerHandler("stopAuditCategoryRun", this._onStopAuditCategoryRun.bind(this));
     this._registerHandler("subscribe", this._onSubscribe.bind(this));
     this._registerHandler("unsubscribe", this._onUnsubscribe.bind(this));
@@ -59,11 +59,6 @@ WebInspector.ExtensionServer = function()
 }
 
 WebInspector.ExtensionServer.prototype = {
-    notifyPanelShown: function(panelName)
-    {
-        this._postNotification("panel-shown-" + panelName);
-    },
-
     notifyObjectSelected: function(panelId, objectId)
     {
         this._postNotification("panel-objectSelected-" + panelId, objectId);
@@ -74,19 +69,19 @@ WebInspector.ExtensionServer.prototype = {
         this._postNotification("panel-search-" + panelId, action, searchString);
     },
 
-    notifyPageLoaded: function(milliseconds)
+    notifyPanelShown: function(panelId)
     {
-        this._postNotification("inspectedPageLoaded", milliseconds);
+        this._postNotification("panel-shown-" + panelId);
     },
 
-    notifyPageDOMContentLoaded: function(milliseconds)
+    notifyPanelHidden: function(panelId)
     {
-        this._postNotification("inspectedPageDOMContentLoaded", milliseconds);
+        this._postNotification("panel-hidden-" + panelId);
     },
 
-    notifyInspectedURLChanged: function()
+    notifyInspectedURLChanged: function(url)
     {
-        this._postNotification("inspectedURLChanged");
+        this._postNotification("inspectedURLChanged", url);
     },
 
     notifyInspectorReset: function()
@@ -94,9 +89,9 @@ WebInspector.ExtensionServer.prototype = {
         this._postNotification("reset");
     },
 
-    notifyExtensionWatchSidebarUpdated: function(id)
+    notifyExtensionSidebarUpdated: function(id)
     {
-        this._postNotification("watch-sidebar-updated-" + id);
+        this._postNotification("sidebar-updated-" + id);
     },
 
     startAuditRun: function(category, auditRun)
@@ -195,27 +190,12 @@ WebInspector.ExtensionServer.prototype = {
         WebInspector.panels[id] = panel;
         WebInspector.addPanel(panel);
 
-        var iframe = this._createClientIframe(panel.element, message.url);
+        var iframe = this.createClientIframe(panel.element, message.url);
         iframe.style.height = "100%";
         return this._status.OK();
     },
 
-    _onCreateSidebar: function(message)
-    {
-        var sidebar = this._createSidebar(message, WebInspector.SidebarPane);
-        if (sidebar.isError)
-            return sidebar;
-        this._createClientIframe(sidebar.bodyElement, message.url);
-        return this._status.OK();
-    },
-
-    _onCreateWatchExpressionSidebarPane: function(message)
-    {
-        var sidebar = this._createSidebar(message, WebInspector.ExtensionWatchSidebarPane);
-        return sidebar.isError ? sidebar : this._status.OK();
-    },
-
-    _createSidebar: function(message, constructor)
+    _onCreateSidebarPane: function(message, constructor)
     {
         var panel = WebInspector.panels[message.panel];
         if (!panel)
@@ -223,15 +203,15 @@ WebInspector.ExtensionServer.prototype = {
         if (!panel.sidebarElement || !panel.sidebarPanes)
             return this._status.E_NOTSUPPORTED();
         var id = message.id;
-        var sidebar = new constructor(message.title, message.id);
+        var sidebar = new WebInspector.ExtensionSidebarPane(message.title, message.id);
         this._clientObjects[id] = sidebar;
         panel.sidebarPanes[id] = sidebar;
         panel.sidebarElement.appendChild(sidebar.element);
 
-        return sidebar;
+        return this._status.OK();
     },
 
-    _createClientIframe: function(parent, url, requestId, port)
+    createClientIframe: function(parent, url)
     {
         var iframe = document.createElement("iframe");
         iframe.src = url;
@@ -248,7 +228,7 @@ WebInspector.ExtensionServer.prototype = {
         sidebar.bodyElement.firstChild.style.height = message.height;
     },
 
-    _onSetWatchSidebarContent: function(message)
+    _onSetSidebarContent: function(message)
     {
         var sidebar = this._clientObjects[message.id];
         if (!sidebar)
@@ -259,6 +239,14 @@ WebInspector.ExtensionServer.prototype = {
             sidebar.setObject(message.expression, message.rootTitle);
     },
 
+    _onSetSidebarPage: function(message)
+    {
+        var sidebar = this._clientObjects[message.id];
+        if (!sidebar)
+            return this._status.E_NOTFOUND(message.id);
+        sidebar.setPage(message.url);
+    },
+
     _onLog: function(message)
     {
         WebInspector.log(message.message);
diff --git a/Source/WebCore/inspector/front-end/GoToLineDialog.js b/Source/WebCore/inspector/front-end/GoToLineDialog.js
index 9f4504d..b2490e6 100644
--- a/Source/WebCore/inspector/front-end/GoToLineDialog.js
+++ b/Source/WebCore/inspector/front-end/GoToLineDialog.js
@@ -118,9 +118,9 @@ WebInspector.GoToLineDialog.prototype = {
     _highlightSelectedLine: function()
     {
         var value = this._input.value;
-        var lineNumber = parseInt(value, 10);
-        if (!isNaN(lineNumber) && lineNumber > 0) {
-            lineNumber = Math.min(lineNumber, this._view.textModel.linesCount);
+        var lineNumber = parseInt(value, 10) - 1;
+        if (!isNaN(lineNumber) && lineNumber >= 0) {
+            lineNumber = Math.min(lineNumber, this._view.textModel.linesCount - 1);
             this._view.highlightLine(lineNumber);
         }
     }
diff --git a/Source/WebCore/inspector/front-end/HAREntry.js b/Source/WebCore/inspector/front-end/HAREntry.js
index b5223b6..072a55b 100644
--- a/Source/WebCore/inspector/front-end/HAREntry.js
+++ b/Source/WebCore/inspector/front-end/HAREntry.js
@@ -31,6 +31,9 @@
 // See http://groups.google.com/group/http-archive-specification/web/har-1-2-spec
 // for HAR specification.
 
+// FIXME: Some fields are not yet supported due to back-end limitations.
+// See https://bugs.webkit.org/show_bug.cgi?id=58127 for details.
+
 WebInspector.HAREntry = function(resource)
 {
     this._resource = resource;
@@ -45,7 +48,7 @@ WebInspector.HAREntry.prototype = {
             time: WebInspector.HAREntry._toMilliseconds(this._resource.duration),
             request: this._buildRequest(),
             response: this._buildResponse(),
-            // cache: {...}, -- Not supproted yet.
+            cache: { }, // Not supproted yet.
             timings: this._buildTimings()
         };
     },
@@ -57,33 +60,29 @@ WebInspector.HAREntry.prototype = {
             url: this._resource.url,
             // httpVersion: "HTTP/1.1" -- Not available.
             headers: this._buildHeaders(this._resource.requestHeaders),
+            queryString: this._buildParameters(this._resource.queryParameters || []),
+            cookies: this._buildCookies(this._resource.requestCookies || []),
             headersSize: -1, // Not available.
             bodySize: -1 // Not available.
         };
-        if (this._resource.queryParameters)
-            res.queryString = this._buildParameters(this._resource.queryParameters);
         if (this._resource.requestFormData)
             res.postData = this._buildPostData();
-        if (this._resource.requestCookies)
-            res.cookies = this._buildCookies(this._resource.requestCookies);
         return res;
     },
 
     _buildResponse: function()
     {
-        var res = {
+        return {
             status: this._resource.statusCode,
             statusText: this._resource.statusText,
             // "httpVersion": "HTTP/1.1" -- Not available.
             headers: this._buildHeaders(this._resource.responseHeaders),
+            cookies: this._buildCookies(this._resource.responseCookies || []),
             content: this._buildContent(),
             redirectURL: this._resource.responseHeaderValue("Location") || "",
             headersSize: -1, // Not available.
             bodySize: this._resource.resourceSize
         };
-        if (this._resource.responseCookies)
-            res.cookies = this._buildCookies(this._resource.responseCookies);
-        return res;
     },
 
     _buildContent: function()
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshot.js b/Source/WebCore/inspector/front-end/HeapSnapshot.js
index c9d1e30..781a13b 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshot.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshot.js
@@ -482,7 +482,7 @@ WebInspector.HeapSnapshotNodeIterator.prototype = {
 
 WebInspector.HeapSnapshot = function(profile)
 {
-    this.uid = profile.uid;
+    this.uid = profile.snapshot.uid;
     this._nodes = profile.nodes;
     this._strings = profile.strings;
 
@@ -534,6 +534,7 @@ WebInspector.HeapSnapshot.prototype = {
             delete this._aggregates;
             this._aggregatesWithIndexes = false;
         }
+        delete this._baseNodeIds;
     },
 
     get _allNodes()
@@ -552,10 +553,15 @@ WebInspector.HeapSnapshot.prototype = {
         return this._nodeCount;
     },
 
-    restore: function(profile)
+    nodeFieldValuesByIndex: function(fieldName, indexes)
     {
-        this._nodes = profile.nodes;
-        this._strings = profile.strings;
+        var node = new WebInspector.HeapSnapshotNode(this);
+        var result = new Array(indexes.length);
+        for (var i = 0, l = indexes.length; i < l; ++i) {
+            node.nodeIndex = indexes[i];
+            result[i] = node[fieldName];
+        }
+        return result;
     },
 
     get rootNode()
@@ -762,6 +768,20 @@ WebInspector.HeapSnapshot.prototype = {
     _numbersComparator: function(a, b)
     {
         return a < b ? -1 : (a > b ? 1 : 0);
+    },
+
+    baseSnapshotHasNode: function(baseSnapshotId, className, nodeId)
+    {
+        return this._baseNodeIds[baseSnapshotId][className].binaryIndexOf(nodeId, this._numbersComparator) !== -1;
+    },
+
+    updateBaseNodeIds: function(baseSnapshotId, className, nodeIds)
+    {
+        if (!this._baseNodeIds)
+            this._baseNodeIds = [];
+        if (!this._baseNodeIds[baseSnapshotId])
+            this._baseNodeIds[baseSnapshotId] = {};
+        this._baseNodeIds[baseSnapshotId][className] = nodeIds;
     }
 };
 
@@ -1125,3 +1145,59 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
         return sPath.join("");
     }
 };
+
+WebInspector.HeapSnapshotsDiff = function(snapshot, className)
+{
+    this._snapshot = snapshot;
+    this._className = className;
+};
+
+WebInspector.HeapSnapshotsDiff.prototype = {
+    set baseIds(baseIds)
+    {
+        this._baseIds = baseIds;
+    },
+
+    set baseSelfSizes(baseSelfSizes)
+    {
+        this._baseSelfSizes = baseSelfSizes;
+    },
+
+    calculate: function()
+    {
+        var indexes = this._snapshot.aggregates(true)[this._className].idxs;
+        var i = 0, l = this._baseIds.length;
+        var j = 0, m = indexes.length;
+        var diff = { addedCount: 0, removedCount: 0, addedSize: 0, removedSize: 0 };
+           
+        var nodeB = new WebInspector.HeapSnapshotNode(this._snapshot);
+        while (i < l && j < m) {
+            var nodeAId = this._baseIds[i];
+            if (nodeAId < nodeB.id) {
+                diff.removedCount++;
+                diff.removedSize += this._baseSelfSizes[i];
+                ++i;
+            } else if (nodeAId > nodeB.id) {
+                diff.addedCount++;
+                diff.addedSize += nodeB.selfSize;
+                nodeB.nodeIndex = indexes[++j];                
+            } else {
+                ++i;
+                nodeB.nodeIndex = indexes[++j];                
+            }
+        }
+        while (i < l) {
+            diff.removedCount++;
+            diff.removedSize += this._baseSelfSizes[i];
+            ++i;
+        }
+        while (j < m) {
+            diff.addedCount++;
+            diff.addedSize += nodeB.selfSize;
+            nodeB.nodeIndex = indexes[++j];
+        }
+        diff.countDelta = diff.addedCount - diff.removedCount;
+        diff.sizeDelta = diff.addedSize - diff.removedSize;
+        return diff;
+    }
+};
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
new file mode 100644
index 0000000..bb0a7ec
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
@@ -0,0 +1,287 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyrightdd
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.HeapSnapshotProxy = function()
+{   
+    this._snapshot = null;
+}
+
+WebInspector.HeapSnapshotProxy.prototype = {
+    _invokeGetter: function(getterName, callback)
+    {
+        function returnResult()
+        {
+            callback(this._snapshot[getterName]);
+        }
+        setTimeout(returnResult.bind(this), 0);
+    },
+
+    aggregates: function(withNodeIndexes, callback)
+    {
+        function returnResult()
+        {
+            callback(this._snapshot.aggregates(withNodeIndexes));
+        }
+        setTimeout(returnResult.bind(this), 0);
+    },
+
+    _extractEdgeData: function(edge)
+    {
+        return {name: edge.name, node: this._extractNodeData(edge.node), nodeIndex: edge.nodeIndex, type: edge.type};
+    },
+
+    _extractNodeData: function(node)
+    {
+        return {id: node.id, name: node.name, nodeIndex: node.nodeIndex, retainedSize: node.retainedSize, selfSize: node.selfSize, type: node.type};
+    },
+
+    createDiff: function(className)
+    {
+        return new WebInspector.HeapSnapshotsDiffProxy(new WebInspector.HeapSnapshotsDiff(this._snapshot, className));
+    },
+
+    createEdgesProvider: function(nodeIndex, filter)
+    {
+        function createProvider()
+        {
+            if (filter)
+                filter = filter.bind(this._snapshot);
+            return new WebInspector.HeapSnapshotEdgesProvider(this._snapshot, nodeIndex, filter);
+        }
+        return new WebInspector.HeapSnapshotProviderProxy(createProvider.bind(this), this._extractEdgeData.bind(this));
+    },
+
+    createNodesProvider: function(filter)
+    {
+        function createProvider()
+        {
+            if (filter)
+                filter = filter.bind(this._snapshot);
+            return new WebInspector.HeapSnapshotNodesProvider(this._snapshot, filter);
+        }
+        return new WebInspector.HeapSnapshotProviderProxy(createProvider.bind(this), this._extractNodeData.bind(this));
+    },
+
+    createPathFinder: function(targetNodeIndex)
+    {
+        return new WebInspector.HeapSnapshotPathFinderProxy(new WebInspector.HeapSnapshotPathFinder(this._snapshot, targetNodeIndex));
+    },
+
+    dispose: function()
+    {
+        this._snapshot.dispose();
+    },
+
+    finishLoading: function(callback)
+    {
+        if (this._snapshot || !this._isLoading)
+            return false;
+        function parse() {
+            var rawSnapshot = JSON.parse(this._json);
+            var loadCallbacks = this._onLoadCallbacks;
+            loadCallbacks.splice(0, 0, callback);
+            delete this._onLoadCallback;
+            delete this._json;
+            delete this._isLoading;
+            this._snapshot = new WebInspector.HeapSnapshot(rawSnapshot);
+            this._nodeCount = this._snapshot.nodeCount;
+            this._rootNodeIndex = this._snapshot._rootNodeIndex;
+            this._totalSize = this._snapshot.totalSize;
+            for (var i = 0; i < loadCallbacks.length; ++i)
+                loadCallbacks[i]();
+        }
+        setTimeout(parse.bind(this), 0);
+        return true;
+    },
+
+    get loaded()
+    {
+        return !!this._snapshot;
+    },
+
+    get nodeCount()
+    {
+        return this._nodeCount;
+    },
+
+    nodeFieldValuesByIndex: function(fieldName, indexes, callback)
+    {
+        function returnResult()
+        {
+            callback(this._snapshot.nodeFieldValuesByIndex(fieldName, indexes));
+        }
+        setTimeout(returnResult.bind(this), 0);
+    },
+
+    nodeIds: function(callback)
+    {
+        this._invokeGetter("nodeIds", callback);
+    },
+
+    pushJSONChunk: function(chunk)
+    {
+        if (this.loaded || !this._isLoading)
+            return;
+        this._json += chunk;
+    },
+
+    pushBaseIds: function(snapshotId, className, nodeIds)
+    {
+        this._snapshot.updateBaseNodeIds(snapshotId, className, nodeIds);
+    },
+
+    get rootNodeIndex()
+    {
+        return this._rootNodeIndex;
+    },
+
+    startLoading: function(callback)
+    {
+        if (this._snapshot) {
+            function asyncInvoke()
+            {
+                callback();
+            }
+            setTimeout(callback, 0);
+            return false;
+        } else if (this._isLoading) {
+            this._onLoadCallbacks.push(callback);
+            return false;
+        } else {
+            this._isLoading = true;
+            this._onLoadCallbacks = [callback];
+            this._json = "";
+            return true;
+        }
+    },
+
+    get totalSize()
+    {
+        return this._totalSize;
+    },
+
+    get uid()
+    {
+        return this._snapshot.uid;
+    }
+};
+
+WebInspector.HeapSnapshotProviderProxy = function(createProvider, extractData)
+{
+    this._provider = createProvider();
+    this._extractData = extractData;
+}
+
+WebInspector.HeapSnapshotProviderProxy.prototype = {
+    getNextItems: function(count, callback)
+    {
+        function returnResult()
+        {
+            var result = new Array(count);
+            for (var i = 0 ; i < count && this._provider.hasNext(); ++i, this._provider.next())
+                result[i] = this._extractData(this._provider.item);
+            result.length = i;
+            callback(result, this._provider.hasNext(), this._provider.length);
+        }
+        setTimeout(returnResult.bind(this), 0);
+    },
+
+    isEmpty: function(callback)
+    {
+        function returnResult()
+        {
+            callback(this._provider.isEmpty);
+        }
+        setTimeout(returnResult.bind(this), 0);
+    },
+
+    sortAndRewind: function(comparator, callback)
+    {
+        function returnResult()
+        {
+            var result = this._provider.sort(comparator);
+            if (result)
+                this._provider.first();
+            callback(result);
+        }
+        setTimeout(returnResult.bind(this), 0);
+    }
+};
+
+WebInspector.HeapSnapshotPathFinderProxy = function(pathFinder)
+{
+    this._pathFinder = pathFinder;
+}
+
+WebInspector.HeapSnapshotPathFinderProxy.prototype = {
+    findNext: function(callback)
+    {
+        function returnResult()
+        {
+            callback(this._pathFinder.findNext());
+        }
+        setTimeout(returnResult.bind(this), 0);
+    },
+
+    updateRoots: function(filter)
+    {
+        function asyncInvoke()
+        {
+            this._pathFinder.updateRoots(filter);
+        }
+        setTimeout(asyncInvoke.bind(this), 0);
+    }
+};
+
+WebInspector.HeapSnapshotsDiffProxy = function(diff)
+{
+    this._diff = diff;
+}
+
+WebInspector.HeapSnapshotsDiffProxy.prototype = {
+    calculate: function(callback)
+    {
+        function returnResult()
+        {
+            callback(this._diff.calculate());
+        }
+        setTimeout(returnResult.bind(this), 0);
+    },
+
+    pushBaseIds: function(baseSnapshotId, baseIds)
+    {
+        this._diff.baseIds = baseIds;
+    },
+
+    pushBaseSelfSizes: function(baseSelfSizes)
+    {
+        this._diff.baseSelfSizes = baseSelfSizes;
+    }
+};
diff --git a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
index 1288973..afa3839 100644
--- a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -61,11 +61,27 @@ WebInspector.MetricsSidebarPane.prototype = {
         WebInspector.cssModel.getInlineStyleAsync(node.id, inlineStyleCallback);
     },
 
+    _getPropertyValueAsPx: function(style, propertyName)
+    {
+        return Number(style.getPropertyValue(propertyName).replace(/px$/, "") || 0);
+    },
+
+    _getBox: function(computedStyle, componentName)
+    {
+        var suffix = componentName === "border" ? "-width" : "";
+        var left = this._getPropertyValueAsPx(computedStyle, componentName + "-left" + suffix);
+        var top = this._getPropertyValueAsPx(computedStyle, componentName + "-top" + suffix);
+        var right = this._getPropertyValueAsPx(computedStyle, componentName + "-right" + suffix);
+        var bottom = this._getPropertyValueAsPx(computedStyle, componentName + "-bottom" + suffix);
+        return { left: left, top: top, right: right, bottom: bottom };
+    },
+
     _update: function(style)
     {
         // Updating with computed style.
         var metricsElement = document.createElement("div");
         metricsElement.className = "metrics";
+        var self = this;
 
         function createBoxPartElement(style, name, side, suffix)
         {
@@ -84,6 +100,32 @@ WebInspector.MetricsSidebarPane.prototype = {
             return element;
         }
 
+        function getContentAreaWidthPx(style)
+        {
+            var width = style.getPropertyValue("width").replace(/px$/, "");
+            if (style.getPropertyValue("box-sizing") === "border-box") {
+                var borderBox = self._getBox(style, "border");
+                var paddingBox = self._getBox(style, "padding");
+
+                width = width - borderBox.left - borderBox.right - paddingBox.left - paddingBox.right;
+            }
+
+            return width;
+        }
+
+        function getContentAreaHeightPx(style)
+        {
+            var height = style.getPropertyValue("height").replace(/px$/, "");
+            if (style.getPropertyValue("box-sizing") === "border-box") {
+                var borderBox = self._getBox(style, "border");
+                var paddingBox = self._getBox(style, "padding");
+
+                height = height - borderBox.top - borderBox.bottom - paddingBox.top - paddingBox.bottom;
+            }
+
+            return height;
+        }
+
         // Display types for which margin is ignored.
         var noMarginDisplayType = {
             "table-cell": true,
@@ -127,15 +169,13 @@ WebInspector.MetricsSidebarPane.prototype = {
             boxElement.className = name;
 
             if (name === "content") {
-                var width = style.getPropertyValue("width").replace(/px$/, "");
                 var widthElement = document.createElement("span");
-                widthElement.textContent = width;
-                widthElement.addEventListener("dblclick", this.startEditing.bind(this, widthElement, "width", "width"), false);
+                widthElement.textContent = getContentAreaWidthPx(style);
+                widthElement.addEventListener("dblclick", this.startEditing.bind(this, widthElement, "width", "width", style), false);
 
-                var height = style.getPropertyValue("height").replace(/px$/, "");
                 var heightElement = document.createElement("span");
-                heightElement.textContent = height;
-                heightElement.addEventListener("dblclick", this.startEditing.bind(this, heightElement, "height", "height"), false);
+                heightElement.textContent = getContentAreaHeightPx(style);
+                heightElement.addEventListener("dblclick", this.startEditing.bind(this, heightElement, "height", "height", style), false);
 
                 boxElement.appendChild(widthElement);
                 boxElement.appendChild(document.createTextNode(" \u00D7 "));
@@ -168,12 +208,12 @@ WebInspector.MetricsSidebarPane.prototype = {
         this.bodyElement.appendChild(metricsElement);
     },
 
-    startEditing: function(targetElement, box, styleProperty)
+    startEditing: function(targetElement, box, styleProperty, computedStyle)
     {
         if (WebInspector.isBeingEdited(targetElement))
             return;
 
-        var context = { box: box, styleProperty: styleProperty };
+        var context = { box: box, styleProperty: styleProperty, computedStyle: computedStyle };
 
         WebInspector.startEditing(targetElement, {
             context: context,
@@ -202,10 +242,34 @@ WebInspector.MetricsSidebarPane.prototype = {
         else if (context.box === "position" && (!userInput || userInput === "\u2012"))
             userInput = "auto";
 
+        userInput = userInput.toLowerCase();
         // Append a "px" unit if the user input was just a number.
         if (/^\d+$/.test(userInput))
             userInput += "px";
 
+        var styleProperty = context.styleProperty;
+        var computedStyle = context.computedStyle;
+
+        if (computedStyle.getPropertyValue("box-sizing") === "border-box" && (styleProperty === "width" || styleProperty === "height")) {
+            if (!userInput.match(/px$/)) {
+                WebInspector.log("For elements with box-sizing: border-box, only absolute content area dimensions can be applied", WebInspector.ConsoleMessage.MessageLevel.Error);
+                WebInspector.showConsole();
+                return;
+            }
+
+            var borderBox = this._getBox(computedStyle, "border");
+            var paddingBox = this._getBox(computedStyle, "padding");
+            var userValuePx = Number(userInput.replace(/px$/, ""));
+            if (isNaN(userValuePx))
+                return;
+            if (styleProperty === "width")
+                userValuePx += borderBox.left + borderBox.right + paddingBox.left + paddingBox.right;
+            else
+                userValuePx += borderBox.top + borderBox.bottom + paddingBox.top + paddingBox.bottom;
+
+            userInput = userValuePx + "px";
+        }
+
         var self = this;
         var callback = function(style) {
             if (!style)
@@ -217,7 +281,7 @@ WebInspector.MetricsSidebarPane.prototype = {
 
         function setEnabledValueCallback(context, style)
         {
-            var property = style.getLiveProperty(context.styleProperty);
+            var property = style.getLiveProperty(styleProperty);
             if (!property)
                 style.appendProperty(context.styleProperty, userInput, callback);
              else
diff --git a/Source/WebCore/inspector/front-end/NetworkManager.js b/Source/WebCore/inspector/front-end/NetworkManager.js
index 98aa060..b6d413f 100644
--- a/Source/WebCore/inspector/front-end/NetworkManager.js
+++ b/Source/WebCore/inspector/front-end/NetworkManager.js
@@ -85,16 +85,19 @@ WebInspector.NetworkDispatcher.prototype = {
 
     _updateResourceWithResponse: function(resource, response)
     {
-        if (!("status" in response))
+        if (!response)
             return;
 
         resource.mimeType = response.mimeType;
         resource.statusCode = response.status;
         resource.statusText = response.statusText;
         resource.responseHeaders = response.headers;
-        // Raw request headers can be a part of response as well.
+        if (response.headersText)
+            resource.responseHeadersText = response.headersText;
         if (response.requestHeaders)
             resource.requestHeaders = response.requestHeaders;
+        if (response.requestHeadersText)
+            resource.requestHeadersText = response.requestHeadersText;
 
         resource.connectionReused = response.connectionReused;
         resource.connectionID = response.connectionID;
@@ -112,14 +115,14 @@ WebInspector.NetworkDispatcher.prototype = {
         this._updateResourceWithResponse(resource, cachedResource.response);
     },
 
-    requestWillBeSent: function(identifier, frameId, loaderId, documentURL, request, redirectResponse, time, callStack)
+    requestWillBeSent: function(identifier, frameId, loaderId, documentURL, request, time, stackTrace, redirectResponse)
     {
         var resource = this._inflightResourcesById[identifier];
         if (resource) {
             this.responseReceived(identifier, time, "Other", redirectResponse);
             resource = this._appendRedirect(identifier, time, request.url);
         } else
-            resource = this._createResource(identifier, frameId, loaderId, request.url, documentURL, callStack);
+            resource = this._createResource(identifier, frameId, loaderId, request.url, documentURL, stackTrace);
         this._updateResourceWithRequest(resource, request);
         resource.startTime = time;
 
@@ -150,15 +153,27 @@ WebInspector.NetworkDispatcher.prototype = {
         this._updateResource(resource);
     },
 
-    dataReceived: function(identifier, time, dataLength, lengthReceived)
+    domContentEventFired: function(time)
+    {
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.mainResourceDOMContentTime = time;
+    },
+
+    loadEventFired: function(time)
+    {
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.mainResourceLoadTime = time;
+    },
+
+    dataReceived: function(identifier, time, dataLength, encodedDataLength)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
         resource.resourceSize += dataLength;
-        if (lengthReceived != -1)
-            resource.increaseTransferSize(lengthReceived);
+        if (encodedDataLength != -1)
+            resource.increaseTransferSize(encodedDataLength);
         resource.endTime = time;
 
         this._updateResource(resource);
@@ -173,13 +188,14 @@ WebInspector.NetworkDispatcher.prototype = {
         this._finishResource(resource, finishTime);
     },
 
-    loadingFailed: function(identifier, time, localizedDescription)
+    loadingFailed: function(identifier, time, localizedDescription, canceled)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
         resource.failed = true;
+        resource.canceled = canceled;
         resource.localizedFailDescription = localizedDescription;
         this._finishResource(resource, time);
     },
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index 3c497d6..38be11a 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -827,14 +827,14 @@ WebInspector.NetworkPanel.prototype = {
             this._appendResource(resourcesToPreserve[i]);
     },
 
-    canShowSourceLine: function(url, line)
+    canShowAnchorLocation: function(anchor)
     {
-        return !!this._resourcesByURL[url];
+        return !!this._resourcesByURL[anchor.href];
     },
 
-    showSourceLine: function(url, line)
+    showAnchorLocation: function(anchor)
     {
-        this._showResource(this._resourcesByURL[url], line);
+        this._showResource(this._resourcesByURL[anchor.href], anchor.getAttribute("line_number") - 1);
     },
 
     _showResource: function(resource, line)
@@ -1506,6 +1506,15 @@ WebInspector.NetworkDataGridNode.prototype = {
     {
         this._statusCell.removeChildren();
 
+        if (this._resource.failed) {
+            if (this._resource.canceled) 
+                this._statusCell.textContent = WebInspector.UIString("(canceled)");
+            else
+                this._statusCell.textContent = WebInspector.UIString("(failed)");
+            this._statusCell.addStyleClass("network-dim-cell");
+            return;
+        }
+
         var fromCache = this._resource.cached;
         if (fromCache) {
             this._statusCell.textContent = WebInspector.UIString("(from cache)");
@@ -1520,8 +1529,11 @@ WebInspector.NetworkDataGridNode.prototype = {
             this._appendSubtitle(this._statusCell, this._resource.statusText);
             this._statusCell.title = this._resource.statusCode + " " + this._resource.statusText;
         } else {
+            if (this._resource.isDataURL() && this._resource.finished)
+                this._statusCell.textContent = WebInspector.UIString("(data url)");
+            else
+                this._statusCell.textContent = WebInspector.UIString("Pending");
             this._statusCell.addStyleClass("network-dim-cell");
-            this._statusCell.textContent = WebInspector.UIString("Pending");
         }
     },
 
diff --git a/Source/WebCore/inspector/front-end/Object.js b/Source/WebCore/inspector/front-end/Object.js
index 5872b8b..53c20e2 100644
--- a/Source/WebCore/inspector/front-end/Object.js
+++ b/Source/WebCore/inspector/front-end/Object.js
@@ -57,6 +57,13 @@ WebInspector.Object.prototype = {
         delete this._listeners;
     },
 
+    hasEventListeners: function(eventType)
+    {
+        if (!("_listeners" in this) || !(eventType in this._listeners))
+            return false;
+        return true;
+    },
+
     dispatchEventToListeners: function(eventType, eventData)
     {
         if (!("_listeners" in this) || !(eventType in this._listeners))
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 1795843..b42bea3 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -45,12 +45,16 @@ WebInspector.ObjectPropertiesSection.prototype = {
     update: function()
     {
         var self = this;
-        var callback = function(properties) {
+        function callback(properties)
+        {
             if (!properties)
                 return;
             self.updateProperties(properties);
-        };
-        this.object.getProperties(this.ignoreHasOwnProperty, true, callback);
+        }
+        if (this.ignoreHasOwnProperty)
+            this.object.getAllProperties(callback);
+        else
+            this.object.getOwnProperties(callback);
     },
 
     updateProperties: function(properties, rootTreeElementConstructor, rootPropertyComparer)
@@ -155,7 +159,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
                 this.appendChild(new this.treeOutline.section.treeElementConstructor(properties[i]));
             }
         };
-        this.property.value.getOwnProperties(true, callback.bind(this));
+        this.property.value.getOwnProperties(callback.bind(this));
     },
 
     ondblclick: function(event)
@@ -183,9 +187,14 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
         var description = this.property.value.description;
         // Render \n as a nice unicode cr symbol.
-        if (this.property.value.type === "string" && typeof description === "string")
-            description = "\"" + description.replace(/\n/g, "\u21B5") + "\"";
-        this.valueElement.textContent = description;
+        if (this.property.value.type === "string" && typeof description === "string") {
+            this.valueElement.textContent = "\"" + description.replace(/\n/g, "\u21B5") + "\"";
+            this.valueElement._originalTextContent = "\"" + description + "\"";
+        } else if (this.property.value.type === "function" && typeof description === "string") {
+            this.valueElement.textContent = /.*/.exec(description)[0].replace(/ +$/g, "");
+            this.valueElement._originalTextContent = description;
+        } else
+            this.valueElement.textContent = description;
 
         if (this.property.isGetter)
             this.valueElement.addStyleClass("dimmed");
@@ -243,6 +252,10 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
         this.listItemElement.addStyleClass("editing-sub-part");
 
+        // Edit original source.
+        if (typeof this.valueElement._originalTextContent === "string")
+            this.valueElement.textContent = this.valueElement._originalTextContent;
+
         WebInspector.startEditing(this.valueElement, {
             context: context,
             commitHandler: this.editingCommitted.bind(this),
diff --git a/Source/WebCore/inspector/front-end/Panel.js b/Source/WebCore/inspector/front-end/Panel.js
index 1b99dd4..49d7cc6 100644
--- a/Source/WebCore/inspector/front-end/Panel.js
+++ b/Source/WebCore/inspector/front-end/Panel.js
@@ -74,6 +74,7 @@ WebInspector.Panel.prototype = {
 
         this.restoreSidebarWidth();
         this._restoreScrollPositions();
+        WebInspector.extensionServer.notifyPanelShown(this.name);
     },
 
     hide: function()
@@ -86,6 +87,7 @@ WebInspector.Panel.prototype = {
         delete this._statusBarItemContainer;
         if ("_toolbarItem" in this)
             this._toolbarItem.removeStyleClass("toggled-on");
+        WebInspector.extensionServer.notifyPanelHidden(this.name);
     },
 
     reset: function()
@@ -235,7 +237,7 @@ WebInspector.Panel.prototype = {
 
         if (currentView !== this.visibleView) {
             this.showView(currentView);
-            WebInspector.focusSearchField();
+            WebInspector.searchController.focusSearchField();
         }
 
         if (showFirstResult)
@@ -268,7 +270,7 @@ WebInspector.Panel.prototype = {
 
         if (currentView !== this.visibleView) {
             this.showView(currentView);
-            WebInspector.focusSearchField();
+            WebInspector.searchController.focusSearchField();
         }
 
         if (showLastResult)
@@ -384,12 +386,12 @@ WebInspector.Panel.prototype = {
             visibleView.resize();
     },
 
-    canShowSourceLine: function(url, line)
+    canShowAnchorLocation: function(anchor)
     {
         return false;
     },
 
-    showSourceLine: function(url, line)
+    showAnchorLocation: function(anchor)
     {
         return false;
     },
diff --git a/Source/WebCore/inspector/front-end/PleaseWaitMessage.js b/Source/WebCore/inspector/front-end/PleaseWaitMessage.js
index e1980a0..c5ddd49 100644
--- a/Source/WebCore/inspector/front-end/PleaseWaitMessage.js
+++ b/Source/WebCore/inspector/front-end/PleaseWaitMessage.js
@@ -86,7 +86,7 @@ WebInspector.PleaseWaitMessage.prototype = {
         var instance = WebInspector.PleaseWaitMessage.prototype.instance;
         var message = instance.element;
         if (message.parentNode === element) {
-            actionCallback();
+            setTimeout(actionCallback, 0);
             return;
         }
      
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index ea5327b..d9a1178 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -211,11 +211,6 @@ WebInspector.ProfilesPanel.prototype = {
             if (view && ("dispose" in view))
                 view.dispose();
             delete this._profiles[i]._profileView;
-            var profile = this._profiles[i];
-            if (profile.nodes) {
-                delete profile.nodes;
-                delete profile.strings;
-            }
         }
         delete this.visibleView;
 
@@ -450,58 +445,84 @@ WebInspector.ProfilesPanel.prototype = {
         if (!profile)
             return;
 
-        if (profile._loaded)
-            callback(profile);
-        else if (profile._is_loading)
-            profile._callbacks.push(callback);
-        else {
-            profile._is_loading = true;
-            profile._callbacks = [callback];
-            profile._json = "";
-            profile.sideBarElement.subtitle = WebInspector.UIString("Loading…");
-            ProfilerAgent.getProfile(profile.typeId, profile.uid);
+        if (!Preferences.detailedHeapProfiles) {
+            if (profile._loaded)
+                callback(profile);
+            else if (profile._is_loading)
+                profile._callbacks.push(callback);
+            else {
+                profile._is_loading = true;
+                profile._callbacks = [callback];
+                profile._json = "";
+                profile.sideBarElement.subtitle = WebInspector.UIString("Loading\u2026");
+                ProfilerAgent.getProfile(profile.typeId, profile.uid);
+            }
+        } else {
+            if (!profile.proxy)
+                profile.proxy = new WebInspector.HeapSnapshotProxy();
+            var proxy = profile.proxy;
+            if (proxy.startLoading(callback)) {
+                profile.sideBarElement.subtitle = WebInspector.UIString("Loading\u2026");
+                ProfilerAgent.getProfile(profile.typeId, profile.uid);
+            }
         }
     },
 
     _addHeapSnapshotChunk: function(uid, chunk)
     {
         var profile = this._profilesIdMap[this._makeKey(uid, WebInspector.HeapSnapshotProfileType.TypeId)];
-        if (!profile || profile._loaded || !profile._is_loading)
+        if (!profile)
             return;
-
-        profile._json += chunk;
+        if (!Preferences.detailedHeapProfiles) {
+            if (profile._loaded || !profile._is_loading)
+                return;
+            profile._json += chunk;
+        } else {
+            if (!profile.proxy)
+                return;
+            profile.proxy.pushJSONChunk(chunk);
+        }
     },
 
     _finishHeapSnapshot: function(uid)
     {
         var profile = this._profilesIdMap[this._makeKey(uid, WebInspector.HeapSnapshotProfileType.TypeId)];
-        if (!profile || profile._loaded || !profile._is_loading)
+        if (!profile)
             return;
-
-        var callbacks = profile._callbacks;
-        delete profile._callbacks;
-        profile.sideBarElement.subtitle = WebInspector.UIString("Parsing…");
-        window.setTimeout(doParse, 0);
-
-        function doParse()
-        {
-            var loadedSnapshot = JSON.parse(profile._json);
-            delete profile._json;
-            delete profile._is_loading;
-            profile._loaded = true;
-            profile.sideBarElement.subtitle = "";
-
-            if (!Preferences.detailedHeapProfiles && WebInspector.DetailedHeapshotView.prototype.isDetailedSnapshot(loadedSnapshot)) {
-                WebInspector.panels.profiles._enableDetailedHeapProfiles(false);
+        if (!Preferences.detailedHeapProfiles) {
+            if (profile._loaded || !profile._is_loading)
                 return;
-            }
+            profile.sideBarElement.subtitle = WebInspector.UIString("Parsing\u2026");
+            function doParse()
+            {
+                var loadedSnapshot = JSON.parse(profile._json);
+                var callbacks = profile._callbacks;
+                delete profile._callbacks;
+                delete profile._json;
+                delete profile._is_loading;
+                profile._loaded = true;
+                profile.sideBarElement.subtitle = "";
+
+                if (WebInspector.DetailedHeapshotView.prototype.isDetailedSnapshot(loadedSnapshot)) {
+                    WebInspector.panels.profiles._enableDetailedHeapProfiles(false);
+                    return;
+                }
 
-            if (!Preferences.detailedHeapProfiles)
                 WebInspector.HeapSnapshotView.prototype.processLoadedSnapshot(profile, loadedSnapshot);
-            else
-                WebInspector.DetailedHeapshotView.prototype.processLoadedSnapshot(profile, loadedSnapshot);
-            for (var i = 0; i < callbacks.length; ++i)
-                callbacks[i](profile);
+                for (var i = 0; i < callbacks.length; ++i)
+                    callbacks[i](profile);
+            }
+            setTimeout(doParse, 0);
+        } else {
+            if (!profile.proxy)
+                return;
+            var proxy = profile.proxy;
+            function parsed()
+            {
+                profile.sideBarElement.subtitle = Number.bytesToString(proxy.totalSize);
+            }
+            if (proxy.finishLoading(parsed))
+                profile.sideBarElement.subtitle = WebInspector.UIString("Parsing\u2026");
         }
     },
 
diff --git a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
index 4df313c..e6ce0b2 100644
--- a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -57,7 +57,7 @@ WebInspector.PropertiesSidebarPane.prototype = {
             if (error || !objectPayload)
                 return;
             var object = WebInspector.RemoteObject.fromPayload(objectPayload);
-            object.getOwnProperties(false, fillSection.bind(this));
+            object.getOwnProperties(fillSection.bind(this));
         }
 
         function fillSection(prototypes)
diff --git a/Source/WebCore/inspector/front-end/RemoteObject.js b/Source/WebCore/inspector/front-end/RemoteObject.js
index 294be50..b6038ca 100644
--- a/Source/WebCore/inspector/front-end/RemoteObject.js
+++ b/Source/WebCore/inspector/front-end/RemoteObject.js
@@ -107,12 +107,17 @@ WebInspector.RemoteObject.prototype = {
         return this._type === "error";
     },
 
-    getOwnProperties: function(abbreviate, callback)
+    getOwnProperties: function(callback)
     {
-        this.getProperties(false, abbreviate, callback);
+        this._getProperties(false, callback);
     },
 
-    getProperties: function(ignoreHasOwnProperty, abbreviate, callback)
+    getAllProperties: function(callback)
+    {
+        this._getProperties(true, callback);
+    },
+
+    _getProperties: function(ignoreHasOwnProperty, callback)
     {
         if (!this._objectId) {
             callback([]);
@@ -126,7 +131,7 @@ WebInspector.RemoteObject.prototype = {
                 properties[i].value = WebInspector.RemoteObject.fromPayload(properties[i].value);
             callback(properties);
         }
-        RuntimeAgent.getProperties(this._objectId, !!ignoreHasOwnProperty, abbreviate, remoteObjectBinder);
+        RuntimeAgent.getProperties(this._objectId, !!ignoreHasOwnProperty, remoteObjectBinder);
     },
 
     setPropertyValue: function(name, value, callback)
@@ -237,12 +242,12 @@ WebInspector.LocalJSONObject.prototype = {
         return typeof this._value === "object" && this._value !== null && Object.keys(this._value).length;
     },
 
-    getOwnProperties: function(abbreviate, callback)
+    getOwnProperties: function(callback)
     {
-        return this.getProperties(false, abbreviate, callback);
+        callback(this._children());
     },
 
-    getProperties: function(ignoreHasOwnProperty, abbreviate, callback)
+    getAllProperties: function(callback)
     {
         callback(this._children());
     },
diff --git a/Source/WebCore/inspector/front-end/Resource.js b/Source/WebCore/inspector/front-end/Resource.js
index 8035fd8..d8373cd 100644
--- a/Source/WebCore/inspector/front-end/Resource.js
+++ b/Source/WebCore/inspector/front-end/Resource.js
@@ -33,7 +33,7 @@ WebInspector.Resource = function(identifier, url)
     this._endTime = -1;
     this._category = WebInspector.resourceCategories.other;
     this._pendingContentCallbacks = [];
-    this._responseHeadersSize = 0;
+    this.history = [];
 }
 
 // Keep these in sync with WebCore::InspectorResource::Type
@@ -101,6 +101,17 @@ WebInspector.Resource.Type = {
     }
 }
 
+WebInspector.Resource._domainModelBindings = [];
+
+WebInspector.Resource.registerDomainModelBinding = function(type, binding)
+{
+    WebInspector.Resource._domainModelBindings[type] = binding;
+}
+
+WebInspector.Resource.Events = {
+    RevisionAdded: 0
+}
+
 WebInspector.Resource.prototype = {
     get url()
     {
@@ -240,7 +251,7 @@ WebInspector.Resource.prototype = {
         if (this.cached)
             return 0;
         if (this.statusCode === 304) // Not modified
-            return this._responseHeadersSize;
+            return this.responseHeadersSize;
         if (this._transferSize !== undefined)
             return this._transferSize;
         // If we did not receive actual transfer size from network
@@ -254,7 +265,7 @@ WebInspector.Resource.prototype = {
         // work for chunks with non-trivial encodings. We need a way to
         // get actual transfer size from the network stack.
         var bodySize = Number(this.responseHeaders["Content-Length"] || this.resourceSize);
-        return this._responseHeadersSize + bodySize;
+        return this.responseHeadersSize + bodySize;
     },
 
     increaseTransferSize: function(x)
@@ -292,6 +303,16 @@ WebInspector.Resource.prototype = {
         this._failed = x;
     },
 
+    get canceled()
+    {
+        return this._canceled;
+    },
+
+    set canceled(x)
+    {
+        this._canceled = x;
+    },
+
     get category()
     {
         return this._category;
@@ -393,10 +414,35 @@ WebInspector.Resource.prototype = {
         this._requestHeaders = x;
         delete this._sortedRequestHeaders;
         delete this._requestCookies;
+        delete this._responseHeadersSize;
 
         this.dispatchEventToListeners("requestHeaders changed");
     },
 
+    get requestHeadersText()
+    {
+        return this._requestHeadersText;
+    },
+
+    set requestHeadersText(x)
+    {
+        this._requestHeadersText = x;
+        delete this._responseHeadersSize;
+
+        this.dispatchEventToListeners("requestHeaders changed");
+    },
+
+    get requestHeadersSize()
+    {
+        if (typeof(this._requestHeadersSize) === "undefined") {
+            if (this._requestHeadersText)
+                this._requestHeadersSize = this._requestHeadersText.length;
+            else 
+                this._requestHeadersSize = this._headersSize(this._requestHeaders)
+        }
+        return this._requestHeadersSize;
+    },
+
     get sortedRequestHeaders()
     {
         if (this._sortedRequestHeaders !== undefined)
@@ -441,13 +487,37 @@ WebInspector.Resource.prototype = {
     set responseHeaders(x)
     {
         this._responseHeaders = x;
-        // FIXME: we should take actual headers size from network stack, when possible.
-        this._responseHeadersSize = this._headersSize(x);
+        delete this._responseHeadersSize;
         delete this._sortedResponseHeaders;
         delete this._responseCookies;
 
         this.dispatchEventToListeners("responseHeaders changed");
     },
+    
+    get responseHeadersText()
+    {
+        return this._responseHeadersText;
+    },
+
+    set responseHeadersText(x)
+    {
+        this._responseHeadersText = x;
+        delete this._responseHeadersSize;
+
+        this.dispatchEventToListeners("responseHeaders changed");
+    },
+    
+    get responseHeadersSize()
+    {
+        if (typeof(this._responseHeadersSize) === "undefined") {
+            if (this._responseHeadersText)
+                this._responseHeadersSize = this._responseHeadersText.length;
+            else 
+                this._responseHeadersSize = this._headersSize(this._responseHeaders)
+        }
+        return this._responseHeadersSize;
+    },
+    
 
     get sortedResponseHeaders()
     {
@@ -526,9 +596,11 @@ WebInspector.Resource.prototype = {
 
     _headersSize: function(headers)
     {
+        // We should take actual headers size from network stack, when possible, but fall back to
+        // this lousy computation when no headers text is available.
         var size = 0;
         for (var header in headers)
-            size += header.length + headers[header].length + 3; // _typical_ overhead per herader is ": ".length + "\n".length.
+            size += header.length + headers[header].length + 4; // _typical_ overhead per header is ": ".length + "\r\n".length.
         return size;
     },
 
@@ -566,7 +638,10 @@ WebInspector.Resource.prototype = {
         // If status is an error, content is likely to be of an inconsistent type,
         // as it's going to be an error message. We do not want to emit a warning
         // for this, though, as this will already be reported as resource loading failure.
-        if (this.statusCode >= 400)
+        // Also, if a URL like http://localhost/wiki/load.php?debug=true&lang=en produces text/css and gets reloaded,
+        // it is 304 Not Modified and its guessed mime-type is text/php, which is wrong.
+        // Don't check for mime-types in 304-resources.
+        if (this.statusCode >= 400 || this.statusCode === 304)
             return true;
 
         if (typeof this.type === "undefined"
@@ -627,59 +702,34 @@ WebInspector.Resource.prototype = {
         this._content = content;
     },
 
-    isLocallyModified: function()
+    isEditable: function()
     {
-        return !!this._baseRevision;
+        if (this._actualResource)
+            return false;
+        var binding = WebInspector.Resource._domainModelBindings[this.type];
+        return binding && binding.canSetContent(this);
     },
 
-    setContent: function(newContent, onRevert)
+    setContent: function(newContent, majorChange, callback)
     {
-        var revisionResource = new WebInspector.Resource(null, this.url);
-        revisionResource.type = this.type;
-        revisionResource.loader = this.loader;
-        revisionResource.timestamp = this.timestamp;
-        revisionResource._content = this._content;
-        revisionResource._actualResource = this;
-        revisionResource._fireOnRevert = onRevert;
-
-        if (this.finished)
-            revisionResource.finished = true;
-        else {
-            function finished()
-            {
-                this.removeEventListener("finished", finished);
-                revisionResource.finished = true;
-            }
-            this.addEventListener("finished", finished.bind(this));
+        if (!this.isEditable(this)) {
+            if (callback)
+                callback("Resource is not editable");
+            return;
         }
-
-        if (!this._baseRevision)
-            this._baseRevision = revisionResource;
-        else
-            revisionResource._baseRevision = this._baseRevision;
-
-        var data = { revision: revisionResource };
-        this._content = newContent;
-        this.timestamp = new Date();
-        this.dispatchEventToListeners("content-changed", data);
+        var binding = WebInspector.Resource._domainModelBindings[this.type];
+        binding.setContent(this, newContent, majorChange, callback);
     },
 
-    revertToThis: function()
+    addRevision: function(newContent)
     {
-        if (!this._actualResource || !this._fireOnRevert)
-            return;
+        var revision = new WebInspector.ResourceRevision(this, this._content, this._contentTimestamp);
+        this.history.push(revision);
 
-        function callback(content)
-        {
-            if (content)
-                this._fireOnRevert(content);
-        }
-        this.requestContent(callback.bind(this));
-    },
+        this._content = newContent;
+        this._contentTimestamp = new Date();
 
-    get baseRevision()
-    {
-        return this._baseRevision;
+        this.dispatchEventToListeners(WebInspector.Resource.Events.RevisionAdded, revision);
     },
 
     requestContent: function(callback)
@@ -713,6 +763,11 @@ WebInspector.Resource.prototype = {
             image.src = this.url;
     },
 
+    isDataURL: function()
+    {
+        return this.url.match(/^data:/i);
+    },
+    
     _contentURL: function()
     {
         const maxDataUrlSize = 1024 * 1024;
@@ -733,6 +788,7 @@ WebInspector.Resource.prototype = {
         function onResourceContent(data)
         {
             this._content = data;
+            this._originalContent = data;
             var callbacks = this._pendingContentCallbacks.slice();
             for (var i = 0; i < callbacks.length; ++i)
                 callbacks[i](this._content, this._contentEncoded);
@@ -744,3 +800,76 @@ WebInspector.Resource.prototype = {
 }
 
 WebInspector.Resource.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.ResourceRevision = function(resource, content, timestamp)
+{
+    this._resource = resource;
+    this._content = content;
+    this._timestamp = timestamp;
+}
+
+WebInspector.ResourceRevision.prototype = {
+    get resource()
+    {
+        return this._resource;
+    },
+
+    get timestamp()
+    {
+        return this._timestamp;
+    },
+
+    get content()
+    {
+        return this._content;
+    },
+
+    revertToThis: function()
+    {
+        function revert(content)
+        {
+            this._resource.setContent(content, true);
+        }
+        this.requestContent(revert.bind(this));
+    },
+
+    requestContent: function(callback)
+    {
+        if (typeof this._content === "string") {
+            callback(this._content);
+            return;
+        }
+
+        // If we are here, this is initial revision. First, look up content fetched over the wire.
+        if (typeof this.resource._originalContent === "string") {
+            this._content = this._resource._originalContent;
+            callback(this._content);
+            return;
+        }
+
+        // If unsuccessful, request the content.
+        function mycallback(content)
+        {
+            this._content = content;
+            callback(content);
+        }
+        WebInspector.networkManager.requestContent(this._resource, false, mycallback.bind(this));
+    }
+}
+
+WebInspector.ResourceDomainModelBinding = function()
+{
+}
+
+WebInspector.ResourceDomainModelBinding.prototype = {
+    canSetContent: function()
+    {
+        // Implemented by the domains.
+        return true;
+    },
+
+    setContent: function(resource, content, majorChange, callback)
+    {
+        // Implemented by the domains.
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/ResourceHeadersView.js b/Source/WebCore/inspector/front-end/ResourceHeadersView.js
index e79078a..f13a392 100644
--- a/Source/WebCore/inspector/front-end/ResourceHeadersView.js
+++ b/Source/WebCore/inspector/front-end/ResourceHeadersView.js
@@ -59,9 +59,11 @@ WebInspector.ResourceHeadersView = function(resource)
     this._requestHeadersTreeElement.selectable = false;
     this._headersTreeOutline.appendChild(this._requestHeadersTreeElement);
 
-    this._decodeHover = WebInspector.UIString("Double-Click to toggle between URL encoded and decoded formats");
     this._decodeRequestParameters = true;
 
+    this._showRequestHeadersText = false;
+    this._showResponseHeadersText = false;
+
     this._queryStringTreeElement = new TreeElement("", null, true);
     this._queryStringTreeElement.expanded = true;
     this._queryStringTreeElement.selectable = false;
@@ -146,7 +148,19 @@ WebInspector.ResourceHeadersView.prototype = {
     {
         parmsTreeElement.removeChildren();
 
-        parmsTreeElement.titleHTML = title + "<span class=\"header-count\">" + WebInspector.UIString(" (%d)", parms.length) + "</span>";
+        parmsTreeElement.listItemElement.removeChildren();
+        parmsTreeElement.listItemElement.appendChild(document.createTextNode(title));
+        
+        var headerCount = document.createElement("span");
+        headerCount.addStyleClass("header-count");
+        headerCount.textContent = WebInspector.UIString(" (%d)", parms.length);
+        parmsTreeElement.listItemElement.appendChild(headerCount);
+
+        var toggleTitle = this._decodeRequestParameters ? WebInspector.UIString("view URL encoded") : WebInspector.UIString("view decoded");
+        var toggleButton = this._createToggleButton(toggleTitle);
+        toggleButton.addEventListener("click", this._toggleURLdecoding.bind(this));
+        parmsTreeElement.listItemElement.appendChild(toggleButton);
+
 
         for (var i = 0; i < parms.length; ++i) {
             var name = parms[i].name;
@@ -175,8 +189,6 @@ WebInspector.ResourceHeadersView.prototype = {
             var parmTreeElement = new TreeElement(null, null, false);
             parmTreeElement.titleHTML = title;
             parmTreeElement.selectable = false;
-            parmTreeElement.tooltip = this._decodeHover;
-            parmTreeElement.ondblclick = this._toggleURLdecoding.bind(this);
             parmsTreeElement.appendChild(parmTreeElement);
         }
     },
@@ -202,7 +214,17 @@ WebInspector.ResourceHeadersView.prototype = {
         var additionalRow = null;
         if (typeof this._resource.webSocketRequestKey3 !== "undefined")
             additionalRow = {header: "(Key3)", value: this._resource.webSocketRequestKey3};
-        this._refreshHeaders(WebInspector.UIString("Request Headers"), this._resource.sortedRequestHeaders, additionalRow, this._requestHeadersTreeElement);
+        if (this._showRequestHeadersText)
+            this._refreshHeadersText(WebInspector.UIString("Request Headers"), this._resource.requestHeadersText, this._requestHeadersTreeElement);
+        else 
+            this._refreshHeaders(WebInspector.UIString("Request Headers"), this._resource.sortedRequestHeaders, additionalRow, this._requestHeadersTreeElement);
+
+        if (this._resource.requestHeadersText) { 
+            var toggleButton = this._createHeadersToggleButton(this._showRequestHeadersText);
+            toggleButton.addEventListener("click", this._toggleRequestHeadersText.bind(this));
+            this._requestHeadersTreeElement.listItemElement.appendChild(toggleButton);
+        }
+
         this._refreshFormData();
     },
 
@@ -211,7 +233,16 @@ WebInspector.ResourceHeadersView.prototype = {
         var additionalRow = null;
         if (typeof this._resource.webSocketChallengeResponse !== "undefined")
             additionalRow = {header: "(Challenge Response)", value: this._resource.webSocketChallengeResponse};
-        this._refreshHeaders(WebInspector.UIString("Response Headers"), this._resource.sortedResponseHeaders, additionalRow, this._responseHeadersTreeElement);
+        if (this._showResponseHeadersText)
+            this._refreshHeadersText(WebInspector.UIString("Response Headers"), this._resource.responseHeadersText, this._responseHeadersTreeElement);
+        else
+            this._refreshHeaders(WebInspector.UIString("Response Headers"), this._resource.sortedResponseHeaders, additionalRow, this._responseHeadersTreeElement);
+        
+        if (this._resource.responseHeadersText) {
+            var toggleButton = this._createHeadersToggleButton(this._showResponseHeadersText);
+            toggleButton.addEventListener("click", this._toggleResponseHeadersText.bind(this));
+            this._responseHeadersTreeElement.listItemElement.appendChild(toggleButton);
+        }
     },
 
     _refreshHTTPInformation: function()
@@ -242,15 +273,26 @@ WebInspector.ResourceHeadersView.prototype = {
         }
     },
     
+    _refreshHeadersTitle: function(title, headersTreeElement, isHeadersTextShown, headersLength)
+    {
+        headersTreeElement.listItemElement.removeChildren();
+        headersTreeElement.listItemElement.appendChild(document.createTextNode(title));
+        
+        if (!isHeadersTextShown) {
+            var headerCount = document.createElement("span");
+            headerCount.addStyleClass("header-count");
+            headerCount.textContent = WebInspector.UIString(" (%d)", headersLength);
+            headersTreeElement.listItemElement.appendChild(headerCount);
+        }
+    },
+    
     _refreshHeaders: function(title, headers, additionalRow, headersTreeElement)
     {
         headersTreeElement.removeChildren();
-
+        
         var length = headers.length;
-        headersTreeElement.titleHTML = title.escapeHTML() + "<span class=\"header-count\">" + WebInspector.UIString(" (%d)", length) + "</span>";
+        this._refreshHeadersTitle(title, headersTreeElement, false, length);
         headersTreeElement.hidden = !length;
-
-        var length = headers.length;
         for (var i = 0; i < length; ++i) {
             var title = "<div class=\"header-name\">" + headers[i].header.escapeHTML() + ":</div>";
             title += "<div class=\"header-value source-code\">" + headers[i].value.escapeHTML() + "</div>"
@@ -270,6 +312,49 @@ WebInspector.ResourceHeadersView.prototype = {
             headerTreeElement.selectable = false;
             headersTreeElement.appendChild(headerTreeElement);
         }
+    },
+    
+    _refreshHeadersText: function(title, headersText, headersTreeElement)
+    {
+        headersTreeElement.removeChildren();
+        
+        this._refreshHeadersTitle(title, headersTreeElement, true);
+        var headerTreeElement = new TreeElement(null, null, false);
+        headerTreeElement.selectable = false;
+        headersTreeElement.appendChild(headerTreeElement);
+        headerTreeElement.listItemElement.addStyleClass("headers-text");
+        
+        var headersTextElement = document.createElement("span");
+        headersTextElement.addStyleClass("header-value");
+        headersTextElement.addStyleClass("source-code");
+        headersTextElement.textContent = String(headersText).trim();
+        headerTreeElement.listItemElement.appendChild(headersTextElement);
+    },
+
+    _toggleRequestHeadersText: function(event)
+    {
+        this._showRequestHeadersText = !this._showRequestHeadersText;
+        this._refreshRequestHeaders();
+    },
+
+    _toggleResponseHeadersText: function(event)
+    {
+        this._showResponseHeadersText = !this._showResponseHeadersText;
+        this._refreshResponseHeaders();
+    },
+
+    _createToggleButton: function(title)
+    {
+        var button = document.createElement("span");
+        button.addStyleClass("header-toggle");
+        button.textContent = title;
+        return button;
+    },
+    
+    _createHeadersToggleButton: function(isHeadersTextShown)
+    {
+        var toggleTitle = isHeadersTextShown ? WebInspector.UIString("view parsed") : WebInspector.UIString("view source");
+        return this._createToggleButton(toggleTitle);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ResourceTreeModel.js b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
index fa2c44e..890daeb 100644
--- a/Source/WebCore/inspector/front-end/ResourceTreeModel.js
+++ b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
@@ -31,8 +31,9 @@
 
 WebInspector.ResourceTreeModel = function(networkManager)
 {
-    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceFinished, this._onResourceUpdated, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceStarted, this._onResourceStarted, this);
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceUpdated, this._onResourceUpdated, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceFinished, this._onResourceUpdated, this);
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.FrameDetached, this._onFrameDetachedFromParent, this);
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.FrameCommittedLoad, this._onCommitLoad, this);
 
@@ -43,7 +44,8 @@ WebInspector.ResourceTreeModel.EventTypes = {
     FrameAdded: "FrameAdded",
     FrameNavigated: "FrameNavigated",
     FrameDetached: "FrameDetached",
-    ResourceAdded: "ResourceAdded"
+    ResourceAdded: "ResourceAdded",
+    CachedResourcesLoaded: "CachedResourcesLoaded"
 }
 
 WebInspector.ResourceTreeModel.prototype = {
@@ -64,6 +66,8 @@ WebInspector.ResourceTreeModel.prototype = {
 
         WebInspector.mainResource = this._addFramesRecursively(mainFramePayload);
         this._cachedResourcesProcessed = true;
+
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.CachedResourcesLoaded);
     },
 
     _addOrUpdateFrame: function(frame)
@@ -131,6 +135,13 @@ WebInspector.ResourceTreeModel.prototype = {
         this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, frameId);
     },
 
+    _onResourceStarted: function(event)
+    {
+        if (!this._cachedResourcesProcessed)
+            return;
+        this._bindResourceURL(event.data);
+    },
+
     _onResourceUpdated: function(event)
     {
         if (!this._cachedResourcesProcessed)
@@ -238,8 +249,6 @@ WebInspector.ResourceTreeModel.prototype = {
     _callForFrameResources: function(frameId, callback)
     {
         var resources = this._resourcesByFrameId[frameId];
-        if (!resources)
-            return;
 
         for (var url in resources) {
             if (callback(resources[url]))
@@ -293,6 +302,7 @@ WebInspector.ResourceTreeModel.prototype = {
         var resource = new WebInspector.Resource(null, url);
         resource.frameId = frame.id;
         resource.loaderId = frame.loaderId;
+        resource.documentURL = frame.url;
         return resource;
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ResourceView.js b/Source/WebCore/inspector/front-end/ResourceView.js
index ffd9062..acf5a28 100644
--- a/Source/WebCore/inspector/front-end/ResourceView.js
+++ b/Source/WebCore/inspector/front-end/ResourceView.js
@@ -45,20 +45,12 @@ WebInspector.ResourceView.prototype.__proto__ = WebInspector.View.prototype;
 
 WebInspector.ResourceView.createResourceView = function(resource)
 {
-    function sourceFrameForDelegateAndURL(delegate, url)
-    {
-        var view = new WebInspector.SourceFrame(delegate, url);
-        view.resource = resource;
-        return view;
-    }
-
     switch (resource.category) {
     case WebInspector.resourceCategories.documents:
     case WebInspector.resourceCategories.scripts:
     case WebInspector.resourceCategories.xhr:
-        return sourceFrameForDelegateAndURL(new WebInspector.SourceFrameDelegateForResourcesPanel(resource), resource.url);
     case WebInspector.resourceCategories.stylesheets:
-        return sourceFrameForDelegateAndURL(new WebInspector.CSSSourceFrameDelegateForResourcesPanel(resource), resource.url);
+        return new WebInspector.ResourceSourceFrame(resource);
     case WebInspector.resourceCategories.images:
         return new WebInspector.ImageView(resource);
     case WebInspector.resourceCategories.fonts:
@@ -70,13 +62,13 @@ WebInspector.ResourceView.createResourceView = function(resource)
 
 WebInspector.ResourceView.resourceViewTypeMatchesResource = function(resource)
 {
-    var resourceView = resource._resourcesView;
+    var resourceView = resource._resourceView;
     switch (resource.category) {
     case WebInspector.resourceCategories.documents:
-    case WebInspector.resourceCategories.stylesheets:
     case WebInspector.resourceCategories.scripts:
     case WebInspector.resourceCategories.xhr:
-        return resourceView.__proto__ === WebInspector.SourceFrame.prototype;
+    case WebInspector.resourceCategories.stylesheets:
+        return resourceView.__proto__ === WebInspector.ResourceSourceFrame.prototype;
     case WebInspector.resourceCategories.images:
         return resourceView.__proto__ === WebInspector.ImageView.prototype;
     case WebInspector.resourceCategories.fonts:
@@ -90,23 +82,23 @@ WebInspector.ResourceView.resourceViewForResource = function(resource)
 {
     if (!resource)
         return null;
-    if (!resource._resourcesView)
-        resource._resourcesView = WebInspector.ResourceView.createResourceView(resource);
-    return resource._resourcesView;
+    if (!resource._resourceView)
+        resource._resourceView = WebInspector.ResourceView.createResourceView(resource);
+    return resource._resourceView;
 }
 
 WebInspector.ResourceView.recreateResourceView = function(resource)
 {
     var newView = WebInspector.ResourceView.createResourceView(resource);
 
-    var oldView = resource._resourcesView;
+    var oldView = resource._resourceView;
     var oldViewParentNode = oldView.visible ? oldView.element.parentNode : null;
     var scrollTop = oldView.scrollTop;
 
-    resource._resourcesView.detach();
-    delete resource._resourcesView;
+    resource._resourceView.detach();
+    delete resource._resourceView;
 
-    resource._resourcesView = newView;
+    resource._resourceView = newView;
 
     if (oldViewParentNode)
         newView.show(oldViewParentNode);
@@ -120,88 +112,99 @@ WebInspector.ResourceView.existingResourceViewForResource = function(resource)
 {
     if (!resource)
         return null;
-    return resource._resourcesView;
+    return resource._resourceView;
 }
 
 
-WebInspector.SourceFrameDelegateForResourcesPanel = function(resource)
+WebInspector.ResourceSourceFrame = function(resource)
 {
-    WebInspector.SourceFrameDelegate.call(this);
+    WebInspector.SourceFrame.call(this, new WebInspector.SourceFrameDelegate(), resource.url);
     this._resource = resource;
 }
 
 //This is a map from resource.type to mime types
 //found in WebInspector.SourceTokenizer.Registry.
-WebInspector.SourceFrameDelegateForResourcesPanel.DefaultMIMETypeForResourceType = {
+WebInspector.ResourceSourceFrame.DefaultMIMETypeForResourceType = {
     0: "text/html",
     1: "text/css",
     4: "text/javascript"
 }
 
-WebInspector.SourceFrameDelegateForResourcesPanel.prototype = {
+WebInspector.ResourceSourceFrame.prototype = {
+    get resource()
+    {
+        return this._resource;
+    },
+
+    isContentEditable: function()
+    {
+        return this._resource.isEditable();
+    },
+
+    editContent: function(newText, callback)
+    {
+        this._clearIncrementalUpdateTimer();
+        var majorChange = true;
+        this._resource.setContent(newText, majorChange, callback);
+    },
+
+    endEditing: function(oldRange, newRange)
+    {
+        function commitIncrementalEdit()
+        {
+            var majorChange = false;
+            this._resource.setContent(this._textModel.text, majorChange, function() {});
+        }
+        const updateTimeout = 200;
+        this._incrementalUpdateTimer = setTimeout(commitIncrementalEdit.bind(this), updateTimeout);
+    },
+
+    _clearIncrementalUpdateTimer: function()
+    {
+        if (this._incrementalUpdateTimer)
+            clearTimeout(this._incrementalUpdateTimer);
+        delete this._incrementalUpdateTimer;
+    },
+
     requestContent: function(callback)
     {
         function contentLoaded(text)
         {
-            var mimeType = WebInspector.SourceFrameDelegateForResourcesPanel.DefaultMIMETypeForResourceType[this._resource.type] || this._resource.mimeType;
-            var sourceMapping = new WebInspector.IdenticalSourceMapping();
-            callback(mimeType, new WebInspector.SourceFrameContent(text, sourceMapping, []));
+            var mimeType = WebInspector.ResourceSourceFrame.DefaultMIMETypeForResourceType[this._resource.type] || this._resource.mimeType;
+            callback(mimeType, text);
         }
         this._resource.requestContent(contentLoaded.bind(this));
     }
 }
 
-WebInspector.SourceFrameDelegateForResourcesPanel.prototype.__proto__ = WebInspector.SourceFrameDelegate.prototype;
-
+WebInspector.ResourceSourceFrame.prototype.__proto__ = WebInspector.SourceFrame.prototype;
 
-WebInspector.CSSSourceFrameDelegateForResourcesPanel = function(resource)
+WebInspector.RevisionSourceFrame = function(revision)
 {
-    WebInspector.SourceFrameDelegateForResourcesPanel.call(this, resource);
+    WebInspector.SourceFrame.call(this, new WebInspector.SourceFrameDelegate(), revision.resource.url);
+    this._revision = revision;
 }
 
-WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype = {
-    canEditScriptSource: function()
+WebInspector.RevisionSourceFrame.prototype = {
+    get resource()
     {
-        return true;
+        return this._revision.resource;
     },
 
-    editScriptSource: function(newText)
+    isContentEditable: function()
     {
-        function handleStyleSheet(newText, styleSheet)
-        {
-            this._styleSheet = styleSheet;
-            this._saveStyleSheet(newText);
-        }
-
-        function handleInfos(newText, error, infos)
-        {
-            if (error)
-                return;
-            for (var i = 0; i < infos.length; ++i) {
-                var info = infos[i];
-                if (info.sourceURL === this._resource.url) {
-                    WebInspector.CSSStyleSheet.createForId(info.styleSheetId, handleStyleSheet.bind(this, newText));
-                    break;
-                }
-            }
-        }
-
-        if (this._styleSheet)
-            this._saveStyleSheet(newText);
-        else
-            CSSAgent.getAllStyleSheets(handleInfos.bind(this, newText));
+        return false;
     },
 
-    _saveStyleSheet: function(newText)
+    requestContent: function(callback)
     {
-        function callback(success)
+        function contentLoaded(text)
         {
-            if (!success)
-                console.error("Failed to save modified stylesheet %s", this._resource.url);
+            var mimeType = WebInspector.ResourceSourceFrame.DefaultMIMETypeForResourceType[this._revision.resource.type] || this._revision.resource.mimeType;
+            callback(mimeType, text);
         }
-
-        this._styleSheet.setText(newText, callback.bind(this));
+        this._revision.requestContent(contentLoaded.bind(this));
     }
 }
 
-WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.__proto__ = WebInspector.SourceFrameDelegateForResourcesPanel.prototype;
+WebInspector.RevisionSourceFrame.prototype.__proto__ = WebInspector.SourceFrame.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index c65e6b7..d8e2b10 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -111,10 +111,6 @@ WebInspector.ResourcesPanel.prototype = {
 
     _initDefaultSelection: function()
     {
-        if (this._initializedDefaultSelection)
-            return;
-
-        this._initializedDefaultSelection = true;
         var itemURL = WebInspector.settings.resourcesLastSelectedItem;
         if (itemURL) {
             for (var treeElement = this.sidebarTree.children[0]; treeElement; treeElement = treeElement.traverseNextTreeElement(false, this.sidebarTree, true)) {
@@ -177,6 +173,7 @@ WebInspector.ResourcesPanel.prototype = {
         WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, this._frameNavigated, this);
         WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, this._frameDetached, this);
         WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, this._resourceAdded, this);
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.CachedResourcesLoaded, this._cachedResourcesLoaded, this); 
 
         function populateFrame(frameId)
         {
@@ -191,7 +188,6 @@ WebInspector.ResourcesPanel.prototype = {
                 this._resourceAdded({data:resources[i]});
         }
         populateFrame.call(this, 0);
-        this._initDefaultSelection();
     },
 
     _frameAdded: function(event)
@@ -205,7 +201,11 @@ WebInspector.ResourcesPanel.prototype = {
         
         var frameTreeElement = this._treeElementForFrameId[frameId];
         if (frameTreeElement) {
+            // Maintain sorted order.
+            var parent = frameTreeElement.parent;
+            parent.removeChild(frameTreeElement);
             frameTreeElement.setTitles(title, subtitle);
+            parent.appendChild(frameTreeElement);
             return;
         }
 
@@ -217,20 +217,6 @@ WebInspector.ResourcesPanel.prototype = {
 
         var frameTreeElement = new WebInspector.FrameTreeElement(this, frameId, title, subtitle);
         this._treeElementForFrameId[frameId] = frameTreeElement;
-
-        // Insert in the alphabetical order, first frames, then resources.
-        var children = parentTreeElement.children;
-        for (var i = 0; i < children.length; ++i) {
-            var child = children[i];
-            if (!(child instanceof WebInspector.FrameTreeElement)) {
-                parentTreeElement.insertChild(frameTreeElement, i);
-                return;
-            }
-            if (child.displayName.localeCompare(frameTreeElement.displayName) > 0) {
-                parentTreeElement.insertChild(frameTreeElement, i);
-                return;
-            }
-        }
         parentTreeElement.appendChild(frameTreeElement);
     },
 
@@ -260,22 +246,7 @@ WebInspector.ResourcesPanel.prototype = {
             return;
         }
 
-        var resourceTreeElement = new WebInspector.FrameResourceTreeElement(this, resource);
-
-        // Insert in the alphabetical order, first frames, then resources. Document resource goes first.
-        var children = frameTreeElement.children;
-        for (var i = 0; i < children.length; ++i) {
-            var child = children[i];
-            if (!(child instanceof WebInspector.FrameResourceTreeElement))
-                continue;
-
-            if (resource.type === WebInspector.Resource.Type.Document ||
-                    (child._resource.type !== WebInspector.Resource.Type.Document && child._resource.displayName.localeCompare(resource.displayName) > 0)) {
-                frameTreeElement.insertChild(resourceTreeElement, i);
-                return;
-            }
-        }
-        frameTreeElement.appendChild(resourceTreeElement);
+        frameTreeElement.appendResource(resource);
     },
 
     _frameNavigated: function(event)
@@ -294,6 +265,11 @@ WebInspector.ResourcesPanel.prototype = {
             frameTreeElement.removeChildren();        
     },
 
+    _cachedResourcesLoaded: function()
+    {
+        this._initDefaultSelection();
+    },
+
     _refreshResource: function(event)
     {
         var resource = event.data;
@@ -365,23 +341,23 @@ WebInspector.ResourcesPanel.prototype = {
         }
     },
 
-    canShowSourceLine: function(url, line)
+    canShowAnchorLocation: function(anchor)
     {
-        return !!WebInspector.resourceForURL(url);
+        return !!WebInspector.resourceForURL(anchor.href);
     },
 
-    showSourceLine: function(url, line)
+    showAnchorLocation: function(anchor)
     {
-        var resource = WebInspector.resourceForURL(url);
+        var resource = WebInspector.resourceForURL(anchor.href);
         if (resource.type === WebInspector.Resource.Type.XHR) {
             // Show XHRs in the network panel only.
-            if (WebInspector.panels.network && WebInspector.panels.network.canShowSourceLine(url, line)) {
+            if (WebInspector.panels.network && WebInspector.panels.network.canShowAnchorLocation(anchor)) {
                 WebInspector.currentPanel = WebInspector.panels.network;
-                WebInspector.panels.network.showSourceLine(url, line);
+                WebInspector.panels.network.showAnchorLocation(anchor);
             }
             return;
         }
-        this.showResource(WebInspector.resourceForURL(url), line);
+        this.showResource(resource, anchor.getAttribute("line_number") - 1);
     },
 
     showResource: function(resource, line)
@@ -392,10 +368,8 @@ WebInspector.ResourcesPanel.prototype = {
             resourceTreeElement.select();
         }
 
-        if (line) {
+        if (line !== undefined) {
             var view = WebInspector.ResourceView.resourceViewForResource(resource);
-            if (view.revealLine)
-                view.revealLine(line);
             if (view.highlightLine)
                 view.highlightLine(line);
         }
@@ -405,19 +379,40 @@ WebInspector.ResourcesPanel.prototype = {
     _showResourceView: function(resource)
     {
         var view = WebInspector.ResourceView.resourceViewForResource(resource);
+        this._fetchAndApplyDiffMarkup(view, resource);
+        this._innerShowView(view);
+    },
 
-        // Consider rendering diff markup here.
-        if (resource.baseRevision && view instanceof WebInspector.SourceFrame) {
-            function callback(baseContent)
-            {
-                if (baseContent)
-                    this._applyDiffMarkup(view, baseContent, resource.content);
-            }
-            resource.baseRevision.requestContent(callback.bind(this));
-        }
+    _showRevisionView: function(revision)
+    {
+        if (!revision._view)
+            revision._view = new WebInspector.RevisionSourceFrame(revision);
+        var view = revision._view;
+        this._fetchAndApplyDiffMarkup(view, revision.resource, revision);
         this._innerShowView(view);
     },
 
+    _fetchAndApplyDiffMarkup: function(view, resource, revision)
+    {
+        var baseRevision = resource.history[0];
+        if (!baseRevision)
+            return;
+        if (!(view instanceof WebInspector.SourceFrame))
+            return;
+
+        baseRevision.requestContent(step1.bind(this));
+
+        function step1(baseContent)
+        {
+            (revision ? revision : resource).requestContent(step2.bind(this, baseContent));
+        }
+
+        function step2(baseContent, revisionContent)
+        {
+            this._applyDiffMarkup(view, baseContent, revisionContent);
+        }
+    },
+
     _applyDiffMarkup: function(view, baseContent, newContent) {
         var oldLines = baseContent.split(/\r?\n/);
         var newLines = newContent.split(/\r?\n/);
@@ -695,7 +690,7 @@ WebInspector.ResourcesPanel.prototype = {
         var views = [];
 
         const visibleView = this.visibleView;
-        if (visibleView.performSearch)
+        if (visibleView && visibleView.performSearch)
             views.push(visibleView);
 
         function callback(resourceTreeElement)
@@ -810,12 +805,13 @@ WebInspector.ResourcesPanel.prototype = {
 
 WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
-WebInspector.BaseStorageTreeElement = function(storagePanel, representedObject, title, iconClasses, hasChildren)
+WebInspector.BaseStorageTreeElement = function(storagePanel, representedObject, title, iconClasses, hasChildren, noIcon)
 {
     TreeElement.call(this, "", representedObject, hasChildren);
     this._storagePanel = storagePanel;
     this._titleText = title;
     this._iconClasses = iconClasses;
+    this._noIcon = noIcon;
 }
 
 WebInspector.BaseStorageTreeElement.prototype = {
@@ -831,9 +827,11 @@ WebInspector.BaseStorageTreeElement.prototype = {
         selectionElement.className = "selection";
         this.listItemElement.appendChild(selectionElement);
 
-        this.imageElement = document.createElement("img");
-        this.imageElement.className = "icon";
-        this.listItemElement.appendChild(this.imageElement);
+        if (!this._noIcon) {
+            this.imageElement = document.createElement("img");
+            this.imageElement.className = "icon";
+            this.listItemElement.appendChild(this.imageElement);
+        }
 
         this.titleElement = document.createElement("div");
         this.titleElement.className = "base-storage-tree-element-title";
@@ -879,9 +877,9 @@ WebInspector.BaseStorageTreeElement.prototype = {
 
 WebInspector.BaseStorageTreeElement.prototype.__proto__ = TreeElement.prototype;
 
-WebInspector.StorageCategoryTreeElement = function(storagePanel, categoryName, settingsKey, iconClasses)
+WebInspector.StorageCategoryTreeElement = function(storagePanel, categoryName, settingsKey, iconClasses, noIcon)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, categoryName, iconClasses, true);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, categoryName, iconClasses, true, noIcon);
     this._expandedSettingKey = "resources" + settingsKey + "Expanded";
     WebInspector.settings.installApplicationSetting(this._expandedSettingKey, settingsKey === "Frames");
     this._categoryName = categoryName;
@@ -923,6 +921,7 @@ WebInspector.FrameTreeElement = function(storagePanel, frameId, title, subtitle)
     WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, "", ["frame-storage-tree-item"]);
     this._frameId = frameId;
     this.setTitles(title, subtitle);
+    this._categoryElements = {};
 }
 
 WebInspector.FrameTreeElement.prototype = {
@@ -957,15 +956,16 @@ WebInspector.FrameTreeElement.prototype = {
 
     setTitles: function(title, subtitle)
     {
-        this._displayName = "";
+        this._displayName = title || "";
+        if (subtitle)
+            this._displayName += " (" + subtitle + ")";
+
         if (this.parent) {
             this.titleElement.textContent = title || "";
-            this._displayName = title || "";
             if (subtitle) {
                 var subtitleElement = document.createElement("span");
                 subtitleElement.className = "base-storage-tree-element-subtitle";
                 subtitleElement.textContent = "(" + subtitle + ")";
-                this._displayName += " (" + subtitle + ")";
                 this.titleElement.appendChild(subtitleElement);
             }
         } else {
@@ -983,8 +983,67 @@ WebInspector.FrameTreeElement.prototype = {
             this.listItemElement.removeStyleClass("hovered");
             DOMAgent.hideFrameHighlight();
         }
+    },
+
+    appendResource: function(resource)
+    {
+        var categoryName = resource.category.name;
+        var categoryElement = resource.category === WebInspector.resourceCategories.documents ? this : this._categoryElements[categoryName];
+        if (!categoryElement) {
+            categoryElement = new WebInspector.StorageCategoryTreeElement(this._storagePanel, resource.category.title, categoryName, null, true);
+            this._categoryElements[resource.category.name] = categoryElement;
+            this._insertInPresentationOrder(this, categoryElement);
+        }
+        var resourceTreeElement = new WebInspector.FrameResourceTreeElement(this._storagePanel, resource);
+        this._insertInPresentationOrder(categoryElement, resourceTreeElement);
+        resourceTreeElement._populateRevisions();
+    },
+
+    appendChild: function(treeElement)
+    {
+        this._insertInPresentationOrder(this, treeElement);
+    },
+
+    _insertInPresentationOrder: function(parentTreeElement, childTreeElement)
+    {
+        // Insert in the alphabetical order, first frames, then resources. Document resource goes last.
+        function typeWeight(treeElement)
+        {
+            if (treeElement instanceof WebInspector.StorageCategoryTreeElement)
+                return 2;
+            if (treeElement instanceof WebInspector.FrameTreeElement)
+                return 1;
+            return 3;
+        }
+
+        function compare(treeElement1, treeElement2)
+        {
+            var typeWeight1 = typeWeight(treeElement1);
+            var typeWeight2 = typeWeight(treeElement2);
+
+            var result;
+            if (typeWeight1 > typeWeight2)
+                result = 1;
+            else if (typeWeight1 < typeWeight2)
+                result = -1;
+            else {
+                var title1 = treeElement1.displayName || treeElement1.titleText;
+                var title2 = treeElement2.displayName || treeElement2.titleText;
+                result = title1.localeCompare(title2);
+            }
+            return result;            
+        }
+
+        var children = parentTreeElement.children;
+        var i;
+        for (i = 0; i < children.length; ++i) {
+            if (compare(childTreeElement, children[i]) < 0)
+                break;
+        }
+        parentTreeElement.insertChild(childTreeElement, i);
     }
 }
+
 WebInspector.FrameTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
 
 WebInspector.FrameResourceTreeElement = function(storagePanel, resource)
@@ -992,7 +1051,7 @@ WebInspector.FrameResourceTreeElement = function(storagePanel, resource)
     WebInspector.BaseStorageTreeElement.call(this, storagePanel, resource, resource.displayName, ["resource-sidebar-tree-item", "resources-category-" + resource.category.name]);
     this._resource = resource;
     this._resource.addEventListener("errors-warnings-updated", this._errorsWarningsUpdated, this);
-    this._resource.addEventListener("content-changed", this._contentChanged, this);
+    this._resource.addEventListener(WebInspector.Resource.Events.RevisionAdded, this._revisionAdded, this);
     this.tooltip = resource.url;
 }
 
@@ -1104,9 +1163,20 @@ WebInspector.FrameResourceTreeElement.prototype = {
             this._bubbleElement.addStyleClass("error");
     },
 
-    _contentChanged: function(event)
+    _populateRevisions: function()
+    {
+        for (var i = 0; i < this._resource.history.length; ++i)
+            this._appendRevision(this._resource.history[i]);
+    },
+
+    _revisionAdded: function(event)
+    {
+        this._appendRevision(event.data);
+    },
+
+    _appendRevision: function(revision)
     {
-        this.insertChild(new WebInspector.ResourceRevisionTreeElement(this._storagePanel, event.data.revision), 0);
+        this.insertChild(new WebInspector.ResourceRevisionTreeElement(this._storagePanel, revision), 0);
         var oldView = WebInspector.ResourceView.existingResourceViewForResource(this._resource);
         if (oldView) {
             var newView = WebInspector.ResourceView.recreateResourceView(this._resource);
@@ -1243,13 +1313,18 @@ WebInspector.ApplicationCacheTreeElement.prototype.__proto__ = WebInspector.Base
 WebInspector.ResourceRevisionTreeElement = function(storagePanel, revision)
 {
     var title = revision.timestamp ? revision.timestamp.toLocaleTimeString() : WebInspector.UIString("(original)");
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, title, ["resource-sidebar-tree-item", "resources-category-" + revision.category.name]);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, title, ["resource-sidebar-tree-item", "resources-category-" + revision.resource.category.name]);
     if (revision.timestamp)
         this.tooltip = revision.timestamp.toLocaleString();
-    this._resource = revision;
+    this._revision = revision;
 }
 
 WebInspector.ResourceRevisionTreeElement.prototype = {
+    get itemURL()
+    {
+        return this._revision.resource.url;
+    },
+
     onattach: function()
     {
         WebInspector.BaseStorageTreeElement.prototype.onattach.call(this);
@@ -1261,20 +1336,22 @@ WebInspector.ResourceRevisionTreeElement.prototype = {
     onselect: function()
     {
         WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
-        this._storagePanel._showResourceView(this._resource);
+        this._storagePanel._showRevisionView(this._revision);
     },
 
     _ondragstart: function(event)
     {
-        event.dataTransfer.setData("text/plain", this._resource.content);
-        event.dataTransfer.effectAllowed = "copy";
-        return true;
+        if (this._revision.content) {
+            event.dataTransfer.setData("text/plain", this._revision.content);
+            event.dataTransfer.effectAllowed = "copy";
+            return true;
+        }
     },
 
     _handleContextMenuEvent: function(event)
     {
         var contextMenu = new WebInspector.ContextMenu();
-        contextMenu.appendItem(WebInspector.UIString("Revert to this revision"), this._resource.revertToThis.bind(this._resource));
+        contextMenu.appendItem(WebInspector.UIString("Revert to this revision"), this._revision.revertToThis.bind(this._revision));
         contextMenu.show(event);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index bdbb0cf..b7f0dad 100644
--- a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -59,40 +59,45 @@ WebInspector.ScopeChainSidebarPane.prototype = {
         var foundLocalScope = false;
         var scopeChain = callFrame.scopeChain;
         for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObjectProxy = scopeChain[i];
+            var scope = scopeChain[i];
             var title = null;
-            var subtitle = scopeObjectProxy.description;
+            var subtitle = scope.object.description;
             var emptyPlaceholder = null;
             var extraProperties = null;
 
-            if (scopeObjectProxy.isLocal) {
-                foundLocalScope = true;
-                title = WebInspector.UIString("Local");
-                emptyPlaceholder = WebInspector.UIString("No Variables");
-                subtitle = null;
-                if (scopeObjectProxy.thisObject)
-                    extraProperties = [ new WebInspector.RemoteObjectProperty("this", WebInspector.RemoteObject.fromPayload(scopeObjectProxy.thisObject)) ];
-            } else if (scopeObjectProxy.isClosure) {
-                title = WebInspector.UIString("Closure");
-                emptyPlaceholder = WebInspector.UIString("No Variables");
-                subtitle = null;
-            } else if (i === (scopeChain.length - 1))
-                title = WebInspector.UIString("Global");
-            else if (scopeObjectProxy.isElement)
-                title = WebInspector.UIString("Event Target");
-            else if (scopeObjectProxy.isDocument)
-                title = WebInspector.UIString("Event Document");
-            else if (scopeObjectProxy.isWithBlock)
-                title = WebInspector.UIString("With Block");
+            switch (scope.type) {
+                case "local":
+                    foundLocalScope = true;
+                    title = WebInspector.UIString("Local");
+                    emptyPlaceholder = WebInspector.UIString("No Variables");
+                    subtitle = null;
+                    if (scope.this)
+                        extraProperties = [ new WebInspector.RemoteObjectProperty("this", WebInspector.RemoteObject.fromPayload(scope.this)) ];
+                    break;
+                case "closure":
+                    title = WebInspector.UIString("Closure");
+                    emptyPlaceholder = WebInspector.UIString("No Variables");
+                    subtitle = null;
+                    break;
+                case "catch":
+                    title = WebInspector.UIString("Catch");
+                    break;
+                case "with":
+                    title = WebInspector.UIString("With Block");
+                    break;
+                case "global":
+                    title = WebInspector.UIString("Global");
+                    break;
+            }
 
             if (!title || title === subtitle)
                 subtitle = null;
 
-            var section = new WebInspector.ObjectPropertiesSection(WebInspector.RemoteObject.fromPayload(scopeObjectProxy), title, subtitle, emptyPlaceholder, true, extraProperties, WebInspector.ScopeVariableTreeElement);
+            var section = new WebInspector.ObjectPropertiesSection(WebInspector.RemoteObject.fromPayload(scope.object), title, subtitle, emptyPlaceholder, true, extraProperties, WebInspector.ScopeVariableTreeElement);
             section.editInSelectedCallFrameWhenPaused = true;
             section.pane = this;
 
-            if (!foundLocalScope || scopeObjectProxy.isLocal || title in this._expandedSections)
+            if (!foundLocalScope || scope.type === "local" || title in this._expandedSections)
                 section.expanded = true;
 
             this._sections.push(section);
diff --git a/Source/WebCore/inspector/front-end/Script.js b/Source/WebCore/inspector/front-end/Script.js
index 805e191..9e75d83 100644
--- a/Source/WebCore/inspector/front-end/Script.js
+++ b/Source/WebCore/inspector/front-end/Script.js
@@ -23,91 +23,19 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Script = function(sourceID, sourceURL, source, lineOffset, columnOffset, length, errorLine, errorMessage, worldType)
+WebInspector.Script = function(sourceID, sourceURL, lineOffset, columnOffset, length, errorLine, errorMessage, isContentScript)
 {
     this.sourceID = sourceID;
     this.sourceURL = sourceURL;
-    this._source = source;
     this.lineOffset = lineOffset;
     this.columnOffset = columnOffset;
     this.length = length;
     this.errorLine = errorLine;
     this.errorMessage = errorMessage;
-    this.worldType = worldType;
-
-    // if no URL, look for "//@ sourceURL=" decorator
-    // note that this sourceURL comment decorator is behavior that FireBug added
-    // in it's 1.1 release as noted in the release notes:
-    // http://fbug.googlecode.com/svn/branches/firebug1.1/docs/ReleaseNotes_1.1.txt
-    if (!sourceURL) {
-        // use of [ \t] rather than \s is to prevent \n from matching
-        var pattern = /^\s*\/\/[ \t]*@[ \t]*sourceURL[ \t]*=[ \t]*(\S+).*$/m;
-        var match = pattern.exec(source);
-
-        if (match)
-            this.sourceURL = match[1];
-    }
-}
-
-WebInspector.Script.WorldType = {
-    MAIN_WORLD: 0,
-    EXTENSIONS_WORLD: 1
-}
-
-WebInspector.Script.WorldType = {
-    MAIN_WORLD: 0,
-    EXTENSIONS_WORLD: 1
+    this.isContentScript = isContentScript;
 }
 
 WebInspector.Script.prototype = {
-    get startingLine()
-    {
-        return this.lineOffset + 1;
-    },
-
-    get linesCount()
-    {
-        if (!this.source)
-            return 0;
-        if (!this._lineEndings)
-            this._lineEndings = this._source.findAll("\n");
-        return this._lineEndings.length + 1;
-    },
-
-    sourceLine: function(lineNumber, callback)
-    {
-        function extractSourceLine()
-        {
-            lineNumber -= this.lineOffset;
-            callback(this._source.substring(this._lineEndings[lineNumber - 1], this._lineEndings[lineNumber]));
-        }
-
-        if (this._lineEndings) {
-            extractSourceLine.call(this);
-            return;
-        }
-
-        function didRequestSource()
-        {
-            this._lineEndings = this._source.findAll("\n");
-            extractSourceLine.call(this);
-        }
-        this.requestSource(didRequestSource.bind(this));
-    },
-
-    get source()
-    {
-        if (!this._source && this.resource)
-            this._source = this.resource.content;
-        return this._source;
-    },
-
-    set source(source)
-    {
-        this._source = source;
-        delete this._lineEndings;
-    },
-
     requestSource: function(callback)
     {
         if (this._source) {
@@ -117,11 +45,20 @@ WebInspector.Script.prototype = {
 
         function didGetScriptSource(error, source)
         {
-            if (error)
-                return;
             this._source = source;
             callback(this._source);
         }
         DebuggerAgent.getScriptSource(this.sourceID, didGetScriptSource.bind(this));
+    },
+
+    editSource: function(newSource, callback)
+    {
+        function didEditScriptSource(error, callFrames)
+        {
+            if (!error)
+                this._source = newSource;
+            callback(error, callFrames);
+        }
+        DebuggerAgent.editScriptSource(this.sourceID, newSource, didEditScriptSource.bind(this));
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ScriptFormatter.js b/Source/WebCore/inspector/front-end/ScriptFormatter.js
index 2e166f4..8085c55 100644
--- a/Source/WebCore/inspector/front-end/ScriptFormatter.js
+++ b/Source/WebCore/inspector/front-end/ScriptFormatter.js
@@ -36,10 +36,15 @@ WebInspector.ScriptFormatter = function()
     this._tasks = [];
 }
 
-WebInspector.ScriptFormatter.locationToPosition = function(lineEndings, lineNumber, columnNumber)
+WebInspector.ScriptFormatter.locationToPosition = function(lineEndings, location)
 {
-    var position = lineNumber ? lineEndings[lineNumber - 1] + 1 : 0;
-    return position + columnNumber;
+    var position = location.lineNumber ? lineEndings[location.lineNumber - 1] + 1 : 0;
+    return position + location.columnNumber;
+}
+
+WebInspector.ScriptFormatter.lineToPosition = function(lineEndings, lineNumber)
+{
+    return this.locationToPosition(lineEndings, { lineNumber: lineNumber, columnNumber: 0 });
 }
 
 WebInspector.ScriptFormatter.positionToLocation = function(lineEndings, position)
@@ -58,7 +63,7 @@ WebInspector.ScriptFormatter.findScriptRanges = function(lineEndings, scripts)
     var scriptRanges = [];
     for (var i = 0; i < scripts.length; ++i) {
         var start = { lineNumber: scripts[i].lineOffset, columnNumber: scripts[i].columnOffset };
-        start.position = WebInspector.ScriptFormatter.locationToPosition(lineEndings, start.lineNumber, start.columnNumber);
+        start.position = WebInspector.ScriptFormatter.locationToPosition(lineEndings, start);
         var endPosition = start.position + scripts[i].length;
         var end = WebInspector.ScriptFormatter.positionToLocation(lineEndings, endPosition);
         end.position = endPosition;
diff --git a/Source/WebCore/inspector/front-end/ScriptFormatterWorker.js b/Source/WebCore/inspector/front-end/ScriptFormatterWorker.js
index 1a4c28e..ab68524 100644
--- a/Source/WebCore/inspector/front-end/ScriptFormatterWorker.js
+++ b/Source/WebCore/inspector/front-end/ScriptFormatterWorker.js
@@ -28,9 +28,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-var parse = loadModule("parse-js.js");
-var process = loadModule("process.js");
-
 onmessage = function(event) {
     var source = event.data;
     var formattedSource = beautify(source);
@@ -53,34 +50,31 @@ function beautify(source)
 function buildMapping(source, formattedSource)
 {
     var mapping = { original: [], formatted: [] };
-    var lastCodePosition = 0;
-    var regexp = /[\$\.\w]+|{|}/g;
+    var lastPosition = 0;
+    var regexp = /(^|[^\\])\b((?=\D)[\$\.\w]+)\b/g;
     while (true) {
         var match = regexp.exec(formattedSource);
         if (!match)
             break;
-        var position = source.indexOf(match[0], lastCodePosition);
+        var position = source.indexOf(match[2], lastPosition);
         if (position === -1)
-            continue;
+            throw "No match found in original source for " + match[2];
         mapping.original.push(position);
-        mapping.formatted.push(match.index);
-        lastCodePosition = position + match[0].length;
+        mapping.formatted.push(match.index + match[1].length);
+        lastPosition = position + match[2].length;
     }
     return mapping;
 }
 
-function loadModule(src)
-{
-    var request = new XMLHttpRequest();
-    request.open("GET", src, false);
-    request.send();
-
-    var exports = {};
-    eval(request.responseText);
-    return exports;
-}
-
 function require()
 {
     return parse;
 }
+
+var exports = {};
+importScripts("UglifyJS/parse-js.js");
+var parse = exports;
+
+var exports = {};
+importScripts("UglifyJS/process.js");
+var process = exports;
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index 7547c36..8a6c58e 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -65,15 +65,6 @@ WebInspector.ScriptsPanel = function()
     // FIXME: append the functions select element to the top status bar when it is implemented.
     // this.topStatusBar.appendChild(this.functionsSelectElement);
 
-    this.formatButton = document.createElement("button");
-    this.formatButton.className = "status-bar-item";
-    this.formatButton.id = "format-script";
-    this.formatButton.title = WebInspector.UIString("Format script.");
-    this.formatButton.appendChild(document.createElement("img"));
-    this.formatButton.addEventListener("click", this._toggleFormatSourceFiles.bind(this), false);
-    if (Preferences.debugMode)
-        this.topStatusBar.appendChild(this.formatButton);
-
     this.sidebarButtonsElement = document.createElement("div");
     this.sidebarButtonsElement.id = "scripts-sidebar-buttons";
     this.topStatusBar.appendChild(this.sidebarButtonsElement);
@@ -142,9 +133,9 @@ WebInspector.ScriptsPanel = function()
     this.sidebarPanes.watchExpressions = new WebInspector.WatchExpressionsSidebarPane();
     this.sidebarPanes.callstack = new WebInspector.CallStackSidebarPane(this._presentationModel);
     this.sidebarPanes.scopechain = new WebInspector.ScopeChainSidebarPane();
-    this.sidebarPanes.jsBreakpoints = new WebInspector.JavaScriptBreakpointsSidebarPane(this._presentationModel);
+    this.sidebarPanes.jsBreakpoints = new WebInspector.JavaScriptBreakpointsSidebarPane(this._presentationModel, this._showSourceLine.bind(this));
     if (Preferences.nativeInstrumentationEnabled) {
-        this.sidebarPanes.domBreakpoints = WebInspector.createDOMBreakpointsSidebarPane();
+        this.sidebarPanes.domBreakpoints = WebInspector.domBreakpointsSidebarPane;
         this.sidebarPanes.xhrBreakpoints = new WebInspector.XHRBreakpointsSidebarPane();
         this.sidebarPanes.eventListenerBreakpoints = new WebInspector.EventListenerBreakpointsSidebarPane();
     }
@@ -204,11 +195,17 @@ WebInspector.ScriptsPanel = function()
 
 // Keep these in sync with WebCore::ScriptDebugServer
 WebInspector.ScriptsPanel.PauseOnExceptionsState = {
-    DontPauseOnExceptions : 0,
-    PauseOnAllExceptions : 1,
-    PauseOnUncaughtExceptions: 2
+    DontPauseOnExceptions : "none",
+    PauseOnAllExceptions : "all",
+    PauseOnUncaughtExceptions: "uncaught"
 };
 
+WebInspector.ScriptsPanel.BrowserBreakpointTypes = {
+    DOM: "DOM",
+    EventListener: "EventListener",
+    XHR: "XHR"
+}
+
 WebInspector.ScriptsPanel.prototype = {
     get toolbarItemLabel()
     {
@@ -234,6 +231,8 @@ WebInspector.ScriptsPanel.prototype = {
     {
         WebInspector.Panel.prototype.show.call(this);
         this.sidebarResizeElement.style.right = (this.sidebarElement.offsetWidth - 3) + "px";
+        if (Preferences.nativeInstrumentationEnabled)
+            this.sidebarElement.insertBefore(this.sidebarPanes.domBreakpoints.element, this.sidebarPanes.xhrBreakpoints.element);
 
         if (this.visibleView)
             this.visibleView.show(this.viewsContainerElement);
@@ -280,7 +279,7 @@ WebInspector.ScriptsPanel.prototype = {
         var select = this._filesSelectElement;
         var option = document.createElement("option");
         option.text = sourceFile.url ? WebInspector.displayNameForURL(sourceFile.url) : WebInspector.UIString("(program)");
-        if (sourceFile.isExtensionScript)
+        if (sourceFile.isContentScript)
             option.addStyleClass("extension-script");
         function optionCompare(a, b)
         {
@@ -375,29 +374,33 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.callstack.update(callFrames, details);
         this.sidebarPanes.callstack.selectedCallFrame = this._presentationModel.selectedCallFrame;
 
-        var status;
         if (details.eventType === WebInspector.DebuggerEventTypes.NativeBreakpoint) {
-            if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.EventListener) {
+            if (details.eventData.breakpointType === WebInspector.ScriptsPanel.BrowserBreakpointTypes.DOM) {
+                this.sidebarPanes.domBreakpoints.highlightBreakpoint(details.eventData);
+                function didCreateBreakpointHitStatusMessage(element)
+                {
+                    this.sidebarPanes.callstack.setStatus(element);
+                }
+                this.sidebarPanes.domBreakpoints.createBreakpointHitStatusMessage(details.eventData, didCreateBreakpointHitStatusMessage.bind(this));
+            } else if (details.eventData.breakpointType === WebInspector.ScriptsPanel.BrowserBreakpointTypes.EventListener) {
                 var eventName = details.eventData.eventName;
                 this.sidebarPanes.eventListenerBreakpoints.highlightBreakpoint(details.eventData.eventName);
                 var eventNameForUI = WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI(eventName);
-                status = WebInspector.UIString("Paused on a \"%s\" Event Listener.", eventNameForUI);
-            } else if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.XHR) {
+                this.sidebarPanes.callstack.setStatus(WebInspector.UIString("Paused on a \"%s\" Event Listener.", eventNameForUI));
+            } else if (details.eventData.breakpointType === WebInspector.ScriptsPanel.BrowserBreakpointTypes.XHR) {
                 this.sidebarPanes.xhrBreakpoints.highlightBreakpoint(details.eventData.breakpointURL);
-                status = WebInspector.UIString("Paused on a XMLHttpRequest.");
+                this.sidebarPanes.callstack.setStatus(WebInspector.UIString("Paused on a XMLHttpRequest."));
             }
         } else {
-            function didGetSourceLocation(sourceFileId, lineNumber, columnNumber)
+            function didGetSourceLocation(sourceFileId, lineNumber)
             {
                 if (!sourceFileId || !this._presentationModel.findBreakpoint(sourceFileId, lineNumber))
                     return;
                 this.sidebarPanes.jsBreakpoints.highlightBreakpoint(sourceFileId, lineNumber);
-                status = WebInspector.UIString("Paused on a JavaScript breakpoint.");
+                this.sidebarPanes.callstack.setStatus(WebInspector.UIString("Paused on a JavaScript breakpoint."));
             }
-            callFrames[0].sourceLocation(didGetSourceLocation.bind(this));
+            callFrames[0].sourceLine(didGetSourceLocation.bind(this));
         }
-        if (status)
-            this.sidebarPanes.callstack.setStatus(status);
 
         window.focus();
         InspectorFrontendHost.bringToFront();
@@ -414,7 +417,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _debuggerWasEnabled: function()
     {
-        this._setPauseOnExceptions(WebInspector.settings.pauseOnExceptionState);
+        this._setPauseOnExceptions(WebInspector.settings.pauseOnExceptionStateString);
 
         if (this._debuggerEnabled)
             return;
@@ -478,17 +481,26 @@ WebInspector.ScriptsPanel.prototype = {
             x.show(this.viewsContainerElement);
     },
 
-    canShowSourceLine: function(url, line)
+    canShowAnchorLocation: function(anchor)
     {
-        return this._debuggerEnabled && (url in this._sourceFileIdToFilesSelectOption);
+        return this._debuggerEnabled && this._presentationModel.sourceFileForScriptURL(anchor.href);
     },
 
-    showSourceLine: function(url, line)
+    showAnchorLocation: function(anchor)
     {
-        if (!(url in this._sourceFileIdToFilesSelectOption))
-            return;
-        var sourceFrame = this._showSourceFrameAndAddToHistory(url);
-        sourceFrame.highlightLine(line);
+        function didRequestSourceMapping(mapping)
+        {
+            var lineNumber = mapping.scriptLocationToSourceLine({lineNumber:anchor.getAttribute("line_number") - 1, columnNumber:0});
+            this._showSourceLine(sourceFile.id, lineNumber);
+        }
+        var sourceFile = this._presentationModel.sourceFileForScriptURL(anchor.href);
+        sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
+
+    _showSourceLine: function(sourceFileId, lineNumber)
+    {
+        var sourceFrame = this._showSourceFrameAndAddToHistory(sourceFileId);
+        sourceFrame.highlightLine(lineNumber);
     },
 
     handleShortcut: function(event)
@@ -612,7 +624,7 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.watchExpressions.refreshExpressions();
         this.sidebarPanes.callstack.selectedCallFrame = this._presentationModel.selectedCallFrame;
 
-        function didGetSourceLocation(sourceFileId, lineNumber, columnNumber)
+        function didGetSourceLocation(sourceFileId, lineNumber)
         {
             if (!sourceFileId)
                 return;
@@ -625,7 +637,7 @@ WebInspector.ScriptsPanel.prototype = {
             sourceFrame.setExecutionLine(lineNumber);
             this._executionSourceFrame = sourceFrame;
         }
-        callFrame.sourceLocation(didGetSourceLocation.bind(this));
+        callFrame.sourceLine(didGetSourceLocation.bind(this));
     },
 
     _filesSelectChanged: function()
@@ -672,6 +684,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _setPauseOnExceptions: function(pauseOnExceptionsState)
     {
+        pauseOnExceptionsState = pauseOnExceptionsState || WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions;
         function callback(error)
         {
             if (error)
@@ -684,9 +697,9 @@ WebInspector.ScriptsPanel.prototype = {
                 this._pauseOnExceptionButton.title = WebInspector.UIString("Pause on uncaught exceptions.\nClick to Not pause on exceptions.");
 
             this._pauseOnExceptionButton.state = pauseOnExceptionsState;
-            WebInspector.settings.pauseOnExceptionState = pauseOnExceptionsState;
+            WebInspector.settings.pauseOnExceptionStateString = pauseOnExceptionsState;
         }
-        DebuggerAgent.setPauseOnExceptionsState(pauseOnExceptionsState, callback.bind(this));
+        DebuggerAgent.setPauseOnExceptions(pauseOnExceptionsState, callback.bind(this));
     },
 
     _updateDebuggerButtons: function()
@@ -741,6 +754,7 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.scopechain.update(null);
         this.sidebarPanes.jsBreakpoints.clearBreakpointHighlight();
         if (Preferences.nativeInstrumentationEnabled) {
+            this.sidebarPanes.domBreakpoints.clearBreakpointHighlight();
             this.sidebarPanes.eventListenerBreakpoints.clearBreakpointHighlight();
             this.sidebarPanes.xhrBreakpoints.clearBreakpointHighlight();
         }
@@ -771,12 +785,6 @@ WebInspector.ScriptsPanel.prototype = {
         this._updateBackAndForwardButtons();
     },
 
-    _toggleFormatSourceFiles: function()
-    {
-        this.reset();
-        this._presentationModel.toggleFormatSourceFiles();
-    },
-
     _enableDebugging: function()
     {
         if (this._debuggerEnabled)
@@ -801,7 +809,12 @@ WebInspector.ScriptsPanel.prototype = {
 
     _togglePauseOnExceptions: function()
     {
-        this._setPauseOnExceptions((this._pauseOnExceptionButton.state + 1) % this._pauseOnExceptionButton.states);
+        var nextStateMap = {};
+        var stateEnum = WebInspector.ScriptsPanel.PauseOnExceptionsState;
+        nextStateMap[stateEnum.DontPauseOnExceptions] = stateEnum.PauseOnAllExceptions;
+        nextStateMap[stateEnum.PauseOnAllExceptions] = stateEnum.PauseOnUncaughtExceptions;
+        nextStateMap[stateEnum.PauseOnUncaughtExceptions] = stateEnum.DontPauseOnExceptions;
+        this._setPauseOnExceptions(nextStateMap[this._pauseOnExceptionButton.state]);
     },
 
     _togglePause: function()
@@ -1008,11 +1021,7 @@ WebInspector.SourceFrameDelegateForScriptsPanel = function(model, sourceFileId)
 WebInspector.SourceFrameDelegateForScriptsPanel.prototype = {
     requestContent: function(callback)
     {
-        function didRequestSourceFileContent(mimeType, text)
-        {
-            callback(mimeType, { text: text });
-        }
-        this._model.requestSourceFileContent(this._sourceFileId, didRequestSourceFileContent.bind(this));
+        this._model.requestSourceFileContent(this._sourceFileId, callback);
     },
 
     debuggingSupported: function()
@@ -1076,6 +1085,17 @@ WebInspector.SourceFrameDelegateForScriptsPanel.prototype = {
     releaseEvaluationResult: function()
     {
         RuntimeAgent.releaseObjectGroup(this._popoverObjectGroup);
+    },
+
+    toggleFormatSourceFiles: function()
+    {
+        WebInspector.panels.scripts.reset();
+        this._model.toggleFormatSourceFiles();
+    },
+
+    formatSourceFilesToggled: function()
+    {
+        return this._model.formatSourceFilesToggled();
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/SearchController.js b/Source/WebCore/inspector/front-end/SearchController.js
index 735c424..d0f9cb4 100755
--- a/Source/WebCore/inspector/front-end/SearchController.js
+++ b/Source/WebCore/inspector/front-end/SearchController.js
@@ -84,7 +84,7 @@ WebInspector.SearchController.prototype = {
                     var isFindKey = event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey;
 
                 if (isFindKey) {
-                    this._focusSearchField();
+                    this.focusSearchField();
                     event.handled = true;
                 }
                 break;
@@ -92,7 +92,7 @@ WebInspector.SearchController.prototype = {
 
             case "F3":
                 if (!isMac) {
-                    this._focusSearchField();
+                    this.focusSearchField();
                     event.handled = true;
                 }
                 break;
@@ -157,7 +157,7 @@ WebInspector.SearchController.prototype = {
         WebInspector.toolbar.resize();
     },
 
-    _focusSearchField: function()
+    focusSearchField: function()
     {
         this.element.focus();
         this.element.select();
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index 9995ca2..856153a 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -72,13 +72,8 @@ WebInspector.Settings = function()
     this.installApplicationSetting("watchExpressions", []);
     this.installApplicationSetting("breakpoints", []);
     this.installApplicationSetting("eventListenerBreakpoints", []);
+    this.installApplicationSetting("domBreakpoints", []);
     this.installApplicationSetting("xhrBreakpoints", []);
-
-    this.installProjectSetting("nativeBreakpoints", []);
-}
-
-WebInspector.Settings.Events = {
-    ProjectChanged: "project-changed"
 }
 
 WebInspector.Settings.prototype = {
@@ -91,47 +86,6 @@ WebInspector.Settings.prototype = {
         this.__defineSetter__(key, this._set.bind(this, key));
     },
 
-    installProjectSetting: function(key, defaultValue)
-    {
-        this.__defineGetter__(key, this._getProjectSetting.bind(this, key, defaultValue));
-        this.__defineSetter__(key, this._setProjectSetting.bind(this, key));
-    },
-
-    inspectedURLChanged: function(url)
-    {
-        var fragmentIndex = url.indexOf("#");
-        if (fragmentIndex !== -1)
-            url = url.substring(0, fragmentIndex);
-        this._projectId = url;
-        this.dispatchEventToListeners(WebInspector.Settings.Events.ProjectChanged);
-    },
-
-    get projectId()
-    {
-        return this._projectId;
-    },
-
-    findSettingForAllProjects: function(key)
-    {
-        var result = {};
-        if (window.localStorage == null)
-            return result;
-
-        var regexp = "^" + key + ":(.*)";
-        for (var i = 0; i < window.localStorage.length; ++i) {
-            var fullKey =  window.localStorage.key(i);
-            var match = fullKey.match(regexp);
-            if (!match)
-                continue;
-            try {
-                result[match[1]] = JSON.parse(window.localStorage[fullKey]);
-            } catch(e) {
-                window.localStorage.removeItem(fullKey);
-            }
-        }
-        return result;
-    },
-
     _get: function(key, defaultValue)
     {
         if (window.localStorage != null && key in window.localStorage) {
@@ -148,21 +102,6 @@ WebInspector.Settings.prototype = {
     {
         if (window.localStorage != null)
             window.localStorage[key] = JSON.stringify(value);
-    },
-
-    _getProjectSetting: function(key, defaultValue)
-    {
-        return this._get(this._formatProjectKey(key), defaultValue);
-    },
-
-    _setProjectSetting: function(key, value)
-    {
-        return this._set(this._formatProjectKey(key), value);
-    },
-
-    _formatProjectKey: function(key)
-    {
-        return key + ":" + this._projectId;
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/SourceFile.js b/Source/WebCore/inspector/front-end/SourceFile.js
index 4f56c00..c58a0c7 100644
--- a/Source/WebCore/inspector/front-end/SourceFile.js
+++ b/Source/WebCore/inspector/front-end/SourceFile.js
@@ -38,7 +38,7 @@ WebInspector.SourceFile = function(id, script, contentChangedDelegate)
 
     this.id = id;
     this.url = script.sourceURL;
-    this.isExtensionScript = script.worldType === WebInspector.Script.WorldType.EXTENSIONS_WORLD;
+    this.isContentScript = script.isContentScript;
     this.messages = [];
     this.breakpoints = {};
 
@@ -68,6 +68,12 @@ WebInspector.SourceFile.prototype = {
         return this._content;
     },
 
+    set content(content)
+    {
+        // FIXME: move live edit implementation to SourceFile and remove this setter.
+        this._content = content;
+    },
+
     requestSourceMapping: function(callback)
     {
         if (!this._mapping)
@@ -126,6 +132,11 @@ WebInspector.SourceFile.prototype = {
     {
         function didRequestContent(text)
         {
+            if (!text) {
+                this._loadAndConcatenateScriptsContent();
+                return;
+            }
+
             if (resource.type === WebInspector.Resource.Type.Script)
                 this._didRequestContent("text/javascript", text);
             else {
@@ -150,7 +161,11 @@ WebInspector.SourceFile.prototype = {
         function didRequestSource(source)
         {
             sources.push(source);
-            if (sources.length === scripts.length)
+            if (sources.length < scripts.length)
+                return;
+            if (scripts.length === 1 && !scripts[0].lineOffset && !scripts[0].columnOffset)
+                this._didRequestContent("text/javascript", source);
+            else
                 this._concatenateScriptsContent(scripts, sources);
         }
         for (var i = 0; i < scripts.length; ++i)
@@ -248,18 +263,24 @@ WebInspector.FormattedSourceFile.prototype = {
 
 WebInspector.FormattedSourceFile.prototype.__proto__ = WebInspector.SourceFile.prototype;
 
-WebInspector.SourceMapping = function(sortedScripts)
+WebInspector.SourceMapping = function(scripts)
 {
-    this._sortedScripts = sortedScripts;
+    this._sortedScripts = scripts.slice();
+    this._sortedScripts.sort(function(x, y) { return x.lineOffset - y.lineOffset || x.columnOffset - y.columnOffset; });
 }
 
 WebInspector.SourceMapping.prototype = {
-    scriptLocationToSourceLocation: function(lineNumber, columnNumber)
+    scriptLocationToSourceLine: function(location)
     {
-        return { lineNumber: lineNumber, columnNumber: columnNumber };
+        return location.lineNumber;
     },
 
-    sourceLocationToScriptLocation: function(lineNumber, columnNumber)
+    sourceLineToScriptLocation: function(lineNumber)
+    {
+        return this._sourceLocationToScriptLocation(lineNumber, 0);
+    },
+
+    _sourceLocationToScriptLocation: function(lineNumber, columnNumber)
     {
         var closestScript = this._sortedScripts[0];
         for (var i = 1; i < this._sortedScripts.length; ++i) {
@@ -268,43 +289,34 @@ WebInspector.SourceMapping.prototype = {
                 break;
             closestScript = script;
         }
-        return { scriptId: closestScript.sourceID, lineNumber: lineNumber, columnNumber: columnNumber };
+        return { sourceID: closestScript.sourceID, lineNumber: lineNumber, columnNumber: columnNumber };
     }
 }
 
-WebInspector.FormattedSourceMapping = function(sortedScripts, originalText, formattedText, mapping)
+WebInspector.FormattedSourceMapping = function(scripts, originalText, formattedText, mapping)
 {
-    WebInspector.SourceMapping.call(this, sortedScripts);
+    WebInspector.SourceMapping.call(this, scripts);
     this._originalLineEndings = originalText.lineEndings();
     this._formattedLineEndings = formattedText.lineEndings();
     this._mapping = mapping;
 }
 
 WebInspector.FormattedSourceMapping.prototype = {
-    scriptLocationToSourceLocation: function(lineNumber, columnNumber)
+    scriptLocationToSourceLine: function(location)
     {
-        var originalPosition = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, lineNumber, columnNumber);
-        var formattedPosition = this._convertPosition(this._mapping.original, this._mapping.formatted, originalPosition);
-        return WebInspector.ScriptFormatter.positionToLocation(this._formattedLineEndings, formattedPosition);
+        var originalPosition = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, location);
+        var index = this._mapping.original.upperBound(originalPosition - 1);
+        var formattedPosition = this._mapping.formatted[index];
+        return WebInspector.ScriptFormatter.positionToLocation(this._formattedLineEndings, formattedPosition).lineNumber;
     },
 
-    sourceLocationToScriptLocation: function(lineNumber, columnNumber)
+    sourceLineToScriptLocation: function(lineNumber)
     {
-        var formattedPosition = WebInspector.ScriptFormatter.locationToPosition(this._formattedLineEndings, lineNumber, columnNumber);
-        var originalPosition = this._convertPosition(this._mapping.formatted, this._mapping.original, formattedPosition);
+        var formattedPosition = WebInspector.ScriptFormatter.lineToPosition(this._formattedLineEndings, lineNumber);
+        var index = this._mapping.formatted.upperBound(formattedPosition - 1);
+        var originalPosition = this._mapping.original[index];
         var originalLocation = WebInspector.ScriptFormatter.positionToLocation(this._originalLineEndings, originalPosition);
-        return WebInspector.SourceMapping.prototype.sourceLocationToScriptLocation.call(this, originalLocation.lineNumber, originalLocation.columnNumber);
-    },
-
-    _convertPosition: function(positions1, positions2, position)
-    {
-        var index = positions1.upperBound(position);
-        var range1 = positions1[index] - positions1[index - 1];
-        var range2 = positions2[index] - positions2[index - 1];
-        var position2 = positions2[index - 1];
-        if (range1)
-            position2 += Math.round((position - positions1[index - 1]) * range2 / range1);
-        return position2;
+        return WebInspector.SourceMapping.prototype._sourceLocationToScriptLocation.call(this, originalLocation.lineNumber, originalLocation.columnNumber);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index 7482f34..fda3e0c 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -30,9 +30,7 @@
 
 WebInspector.SourceFrame = function(delegate, url)
 {
-    WebInspector.View.call(this);
-
-    this.element.addStyleClass("script-view");
+    WebInspector.TextViewerDelegate.call(this);
 
     this._delegate = delegate;
     this._url = url;
@@ -40,6 +38,10 @@ WebInspector.SourceFrame = function(delegate, url)
     this._textModel = new WebInspector.TextEditorModel();
     this._textModel.replaceTabsWithSpaces = true;
 
+    this._textViewer = new WebInspector.TextViewer(this._textModel, WebInspector.platform, this._url, this);
+    this._textViewer.element.addStyleClass("script-view");
+    this._visible = false;
+
     this._currentSearchResultIndex = -1;
     this._searchResults = [];
 
@@ -47,8 +49,7 @@ WebInspector.SourceFrame = function(delegate, url)
     this._rowMessages = {};
     this._messageBubbles = {};
 
-    this._registerShortcuts();
-    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
+    this._breakpoints = {};
 }
 
 WebInspector.SourceFrame.Events = {
@@ -56,39 +57,54 @@ WebInspector.SourceFrame.Events = {
 }
 
 WebInspector.SourceFrame.prototype = {
+    get visible()
+    {
+        return this._textViewer.visible;
+    },
+
+    set visible(x)
+    {
+        this._textViewer.visible = x;
+    },
 
     show: function(parentElement)
     {
-        WebInspector.View.prototype.show.call(this, parentElement);
+        this._ensureContentLoaded();
 
-        if (!this._contentRequested) {
-            this._contentRequested = true;
-            this._delegate.requestContent(this._createTextViewer.bind(this));
-        }
+        this._textViewer.show(parentElement);
+        this._textViewer.resize();
 
-        if (this._textViewer) {
+        if (this.loaded) {
             if (this._scrollTop)
                 this._textViewer.scrollTop = this._scrollTop;
             if (this._scrollLeft)
                 this._textViewer.scrollLeft = this._scrollLeft;
-            this._textViewer.resize();
         }
     },
 
     hide: function()
     {
-        if (this._textViewer) {
+        if (this.loaded) {
             this._scrollTop = this._textViewer.scrollTop;
             this._scrollLeft = this._textViewer.scrollLeft;
             this._textViewer.freeCachedElements();
         }
 
-        WebInspector.View.prototype.hide.call(this);
-
+        this._textViewer.hide();
         this._hidePopup();
         this._clearLineHighlight();
     },
 
+    detach: function()
+    {
+        this._textViewer.detach();
+    },
+
+    get element()
+    {
+        return this._textViewer.element;
+    },
+
     get loaded()
     {
         return !!this._content;
@@ -99,28 +115,33 @@ WebInspector.SourceFrame.prototype = {
         return true;
     },
 
+    _ensureContentLoaded: function()
+    {
+        if (!this._contentRequested) {
+            this._contentRequested = true;
+            this.requestContent(this._initializeTextViewer.bind(this));
+        }
+    },
+
+    requestContent: function(callback)
+    {
+        this._delegate.requestContent(callback);
+    },
+
     markDiff: function(diffData)
     {
-        if (this._diffLines && this._textViewer)
+        if (this._diffLines && this.loaded)
             this._removeDiffDecorations();
 
         this._diffLines = diffData;
-        if (this._textViewer)
+        if (this.loaded)
             this._updateDiffDecorations();
     },
 
-    revealLine: function(lineNumber)
-    {
-        if (this._textViewer)
-            this._textViewer.revealLine(lineNumber - 1, 0);
-        else
-            this._lineNumberToReveal = lineNumber;
-    },
-
     addMessage: function(msg)
     {
         this._messages.push(msg);
-        if (this._textViewer)
+        if (this.loaded)
             this.addMessageToSource(msg.line - 1, msg);
     },
 
@@ -134,8 +155,8 @@ WebInspector.SourceFrame.prototype = {
         this._messages = [];
         this._rowMessages = {};
         this._messageBubbles = {};
-        if (this._textViewer)
-            this._textViewer.resize();
+
+        this._textViewer.resize();
     },
 
     get textModel()
@@ -145,36 +166,87 @@ WebInspector.SourceFrame.prototype = {
 
     get scrollTop()
     {
-        return this._textViewer ? this._textViewer.scrollTop : this._scrollTop;
+        return this.loaded ? this._textViewer.scrollTop : this._scrollTop;
     },
 
     set scrollTop(scrollTop)
     {
         this._scrollTop = scrollTop;
-        if (this._textViewer)
+        if (this.loaded)
             this._textViewer.scrollTop = scrollTop;
     },
 
     highlightLine: function(line)
     {
-        if (this._textViewer)
-            this._textViewer.highlightLine(line - 1);
+        if (this.loaded)
+            this._textViewer.highlightLine(line);
         else
             this._lineToHighlight = line;
     },
 
     _clearLineHighlight: function()
     {
-        if (this._textViewer)
+        if (this.loaded)
             this._textViewer.clearLineHighlight();
         else
             delete this._lineToHighlight;
     },
 
-    _startEditing: function()
+    _saveViewerState: function()
     {
-        if (this._originalTextModelContent === undefined) {
-            this._originalTextModelContent = this._textModel.text;
+        this._viewerState = {
+            textModelContent: this._textModel.text,
+            executionLineNumber: this._executionLineNumber,
+            messages: this._messages,
+            diffLines: this._diffLines,
+            breakpoints: this._breakpoints
+        };
+    },
+
+    _restoreViewerState: function()
+    {
+        if (!this._viewerState)
+            return;
+        this._textModel.setText(null, this._viewerState.textModelContent);
+
+        this._messages = this._viewerState.messages;
+        this._diffLines = this._viewerState.diffLines;
+        this._setTextViewerDecorations();
+
+        if (typeof this._viewerState.executionLineNumber === "number") {
+            this.clearExecutionLine();
+            this.setExecutionLine(this._viewerState.executionLineNumber);
+        }
+
+        var oldBreakpoints = this._breakpoints;
+        this._breakpoints = {};
+        for (var lineNumber in oldBreakpoints)
+            this.removeBreakpoint(Number(lineNumber));
+
+        var newBreakpoints = this._viewerState.breakpoints;
+        for (var lineNumber in newBreakpoints) {
+            lineNumber = Number(lineNumber);
+            var breakpoint = newBreakpoints[lineNumber];
+            this.addBreakpoint(lineNumber, breakpoint.resolved, breakpoint.conditional, breakpoint.enabled);
+        }
+
+        delete this._viewerState;
+    },
+
+    isContentEditable: function()
+    {
+        return this._delegate.canEditScriptSource();
+    },
+
+    readOnlyStateChanged: function(readOnly)
+    {
+        WebInspector.markBeingEdited(this._textViewer.element, !readOnly);
+    },
+
+    startEditing: function()
+    {
+        if (!this._viewerState) {
+            this._saveViewerState();
             this._delegate.setScriptSourceIsBeingEdited(true);
         }
 
@@ -182,19 +254,61 @@ WebInspector.SourceFrame.prototype = {
         this.clearMessages();
     },
 
-    _endEditing: function(oldRange, newRange)
+    endEditing: function(oldRange, newRange)
     {
-        // FIXME: Implement this.
+        if (!oldRange || !newRange)
+            return;
+
+        // Adjust execution line number.
+        if (typeof this._executionLineNumber === "number") {
+            var newExecutionLineNumber = this._lineNumberAfterEditing(this._executionLineNumber, oldRange, newRange);
+            this.clearExecutionLine();
+            this.setExecutionLine(newExecutionLineNumber, true);
+        }
+
+        // Adjust breakpoints.
+        var oldBreakpoints = this._breakpoints;
+        this._breakpoints = {};
+        for (var lineNumber in oldBreakpoints) {
+            lineNumber = Number(lineNumber);
+            var breakpoint = oldBreakpoints[lineNumber];
+            var newLineNumber = this._lineNumberAfterEditing(lineNumber, oldRange, newRange);
+            if (lineNumber === newLineNumber)
+                this._breakpoints[lineNumber] = breakpoint;
+            else {
+                this.removeBreakpoint(lineNumber);
+                this.addBreakpoint(newLineNumber, breakpoint.resolved, breakpoint.conditional, breakpoint.enabled);
+            }
+        }
     },
 
-    _createTextViewer: function(mimeType, content)
+    _lineNumberAfterEditing: function(lineNumber, oldRange, newRange)
     {
-        this._content = content;
-        this._textModel.setText(null, content.text);
+        var shiftOffset = lineNumber <= oldRange.startLine ? 0 : newRange.linesCount - oldRange.linesCount;
+
+        // Special case of editing the line itself. We should decide whether the line number should move below or not.
+        if (lineNumber === oldRange.startLine) {
+            var whiteSpacesRegex = /^[\s\xA0]*$/;
+            for (var i = 0; lineNumber + i <= newRange.endLine; ++i) {
+                if (!whiteSpacesRegex.test(this._textModel.line(lineNumber + i))) {
+                    shiftOffset = i;
+                    break;
+                }
+            }
+        }
 
-        this._textViewer = new WebInspector.TextViewer(this._textModel, WebInspector.platform, this._url);
-        this._textViewer.startEditingListener = this._startEditing.bind(this);
-        this._textViewer.endEditingListener = this._endEditing.bind(this);
+        var newLineNumber = Math.max(0, lineNumber + shiftOffset);
+        if (oldRange.startLine < lineNumber && lineNumber < oldRange.endLine)
+            newLineNumber = oldRange.startLine;
+        return newLineNumber;
+    },
+
+    _initializeTextViewer: function(mimeType, content)
+    {
+        this._textViewer.mimeType = mimeType;
+
+        this._content = content;
+        this._textModel.setText(null, content);
 
         var element = this._textViewer.element;
         if (this._delegate.debuggingSupported()) {
@@ -204,24 +318,13 @@ WebInspector.SourceFrame.prototype = {
             element.addEventListener("scroll", this._scroll.bind(this), true);
         }
 
-        if (this._delegate.canEditScriptSource())
-            element.addEventListener("dblclick", this._doubleClick.bind(this), true);
-
-        this.element.appendChild(element);
-
         this._textViewer.beginUpdates();
 
-        this._textViewer.mimeType = mimeType;
         this._setTextViewerDecorations();
 
-        if ("_executionLineNumber" in this)
+        if (typeof this._executionLineNumber === "number")
             this.setExecutionLine(this._executionLineNumber);
 
-        if (this._lineNumberToReveal) {
-            this.revealLine(this._lineNumberToReveal);
-            delete this._lineNumberToReveal;
-        }
-
         if (this._lineToHighlight) {
             this.highlightLine(this._lineToHighlight);
             delete this._lineToHighlight;
@@ -235,6 +338,9 @@ WebInspector.SourceFrame.prototype = {
         this.dispatchEventToListeners(WebInspector.SourceFrame.Events.Loaded);
 
         this._textViewer.endUpdates();
+
+        if (this._parentElement)
+            this.show(this._parentElement)
     },
 
     _setTextViewerDecorations: function()
@@ -277,17 +383,18 @@ WebInspector.SourceFrame.prototype = {
             callback(this, this._searchResults.length);
         }
 
-        if (this._textViewer)
+        if (this.loaded)
             doFindSearchMatches.call(this, query);
         else
             this._delayedFindSearchMatches = doFindSearchMatches.bind(this, query);
 
+        this._ensureContentLoaded();
     },
 
     searchCanceled: function()
     {
         delete this._delayedFindSearchMatches;
-        if (!this._textViewer)
+        if (!this.loaded)
             return;
 
         this._currentSearchResultIndex = -1;
@@ -327,7 +434,7 @@ WebInspector.SourceFrame.prototype = {
 
     _jumpToSearchResult: function(index)
     {
-        if (!this._textViewer || !this._searchResults.length)
+        if (!this.loaded || !this._searchResults.length)
             return;
         this._currentSearchResultIndex = (index + this._searchResults.length) % this._searchResults.length;
         this._textViewer.markAndRevealRange(this._searchResults[this._currentSearchResultIndex]);
@@ -365,18 +472,19 @@ WebInspector.SourceFrame.prototype = {
         msg._resourceMessageRepeatCountElement.textContent = WebInspector.UIString(" (repeated %d times)", msg.repeatCount);
     },
 
-    setExecutionLine: function(lineNumber)
+    setExecutionLine: function(lineNumber, skipRevealLine)
     {
         this._executionLineNumber = lineNumber;
-        if (this._textViewer) {
+        if (this.loaded) {
             this._textViewer.addDecoration(lineNumber, "webkit-execution-line");
-            this._textViewer.revealLine(lineNumber);
+            if (!skipRevealLine)
+                this._textViewer.revealLine(lineNumber);
         }
     },
 
     clearExecutionLine: function()
     {
-        if (this._textViewer)
+        if (this.loaded)
             this._textViewer.removeDecoration(this._executionLineNumber, "webkit-execution-line");
         delete this._executionLineNumber;
     },
@@ -418,7 +526,9 @@ WebInspector.SourceFrame.prototype = {
     addMessageToSource: function(lineNumber, msg)
     {
         if (lineNumber >= this._textModel.linesCount)
-            return;
+            lineNumber = this._textModel.linesCount - 1;
+        if (lineNumber < 0)
+            lineNumber = 0;
 
         var messageBubbleElement = this._messageBubbles[lineNumber];
         if (!messageBubbleElement || messageBubbleElement.nodeType !== Node.ELEMENT_NODE || !messageBubbleElement.hasStyleClass("webkit-html-message-bubble")) {
@@ -471,6 +581,11 @@ WebInspector.SourceFrame.prototype = {
 
     addBreakpoint: function(lineNumber, resolved, conditional, enabled)
     {
+        this._breakpoints[lineNumber] = {
+            resolved: resolved,
+            conditional: conditional,
+            enabled: enabled
+        };
         this._textViewer.beginUpdates();
         this._textViewer.addDecoration(lineNumber, "webkit-breakpoint");
         if (!enabled)
@@ -482,6 +597,7 @@ WebInspector.SourceFrame.prototype = {
 
     removeBreakpoint: function(lineNumber)
     {
+        delete this._breakpoints[lineNumber];
         this._textViewer.beginUpdates();
         this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint");
         this._textViewer.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
@@ -491,13 +607,17 @@ WebInspector.SourceFrame.prototype = {
 
     _contextMenu: function(event)
     {
-        var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
-        if (!target)
-            return;
-        var lineNumber = target.lineNumber;
-
         var contextMenu = new WebInspector.ContextMenu();
+        var target = event.target.enclosingNodeOrSelfWithClass("webkit-line-number");
+        if (target)
+            this._populateLineGutterContextMenu(target.lineNumber, contextMenu);
+        else
+            this._populateTextAreaContextMenu(contextMenu);
+        contextMenu.show(event);
+    },
 
+    _populateLineGutterContextMenu: function(lineNumber, contextMenu)
+    {
         contextMenu.appendItem(WebInspector.UIString("Continue to Here"), this._delegate.continueToLine.bind(this._delegate, lineNumber));
 
         var breakpoint = this._delegate.findBreakpoint(lineNumber);
@@ -539,7 +659,11 @@ WebInspector.SourceFrame.prototype = {
             else
                 contextMenu.appendItem(WebInspector.UIString("Enable Breakpoint"), setBreakpointEnabled.bind(this, true));
         }
-        contextMenu.show(event);
+    },
+
+    _populateTextAreaContextMenu: function(contextMenu)
+    {
+        contextMenu.appendCheckboxItem(WebInspector.UIString("De-obfuscate Source"), this._delegate.toggleFormatSourceFiles.bind(this._delegate), this._delegate.formatSourceFilesToggled());
     },
 
     _scroll: function(event)
@@ -764,107 +888,64 @@ WebInspector.SourceFrame.prototype = {
 
     resize: function()
     {
-        if (this._textViewer)
-            this._textViewer.resize();
+        this._textViewer.resize();
     },
 
-    formatSource: function()
+    commitEditing: function(callback)
     {
-        if (!this._content)
+        if (!this._viewerState) {
+            // No editing was actually done.
+            this._delegate.setScriptSourceIsBeingEdited(false);
+            callback();
             return;
+        }
 
-        function didFormat(formattedContent)
+        function didEditContent(error)
         {
-            this._content = formattedContent;
-            this._textModel.setText(null, formattedContent.text);
-            this._setTextViewerDecorations();
-        }
-        var formatter = new WebInspector.ScriptFormatter();
-        formatter.formatContent(this._content, didFormat.bind(this))
-    },
+            if (error) {
+                if (error.data && error.data[0]) {
+                    WebInspector.log(error.data[0], WebInspector.ConsoleMessage.MessageLevel.Error);
+                    WebInspector.showConsole();
+                }
+                callback(error);
+                return;
+            }
 
-    _registerShortcuts: function()
-    {
-        this._shortcuts = {};
-        var handleSaveCallback = this._handleSave.bind(this);
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("s", WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta)] = handleSaveCallback;
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.Keys.Enter.code, WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta)] = handleSaveCallback;
-        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.Keys.Esc.code)] = this._handleRevertEditing.bind(this);
-    },
+            var newBreakpoints = {};
+            for (var lineNumber in this._breakpoints) {
+                newBreakpoints[lineNumber] = this._breakpoints[lineNumber];
+                this.removeBreakpoint(Number(lineNumber));
+            }
 
-    _handleKeyDown: function(e)
-    {
-        var shortcutKey = WebInspector.KeyboardShortcut.makeKeyFromEvent(e);
-        var handler = this._shortcuts[shortcutKey];
-        if (handler && handler.call(this)) {
-            e.preventDefault();
-            e.stopPropagation();
-        }
-    },
+            for (var lineNumber in this._viewerState.breakpoints)
+                this._delegate.removeBreakpoint(Number(lineNumber));
 
-    _handleSave: function()
-    {
-        if (this._textViewer.readOnly || !this._delegate.canEditScriptSource())
-            return false;
+            for (var lineNumber in newBreakpoints) {
+                var breakpoint = newBreakpoints[lineNumber];
+                this._delegate.setBreakpoint(Number(lineNumber), breakpoint.condition, breakpoint.enabled);
+            }
 
-        if (this._originalTextModelContent === undefined) {
-            // No editing was actually done.
-            this._textViewer.readOnly = true;
+            delete this._viewerState;
             this._delegate.setScriptSourceIsBeingEdited(false);
-            return true;
-        }
-
-        var originalTextModelContent = this._originalTextModelContent;
-        var newSource = this._textModel.text;
-
-        delete this._originalTextModelContent;
-        this._textViewer.readOnly = true;
-        this._delegate.setScriptSourceIsBeingEdited(false);
 
-        function didEditScriptSource(success, newBodyOrErrorMessage)
-        {
-            if (!success && this._originalTextModelContent === undefined && this._textModel.text === newSource) {
-                this._originalTextModelContent = originalTextModelContent;
-                this._textViewer.readOnly = false;
-                this._delegate.setScriptSourceIsBeingEdited(true);
-                WebInspector.log(newBodyOrErrorMessage, WebInspector.ConsoleMessage.MessageLevel.Error);
-                WebInspector.showConsole();
-            }
+            callback();
         }
-        this._delegate.editScriptSource(newSource, didEditScriptSource.bind(this));
-        return true;
+        this.editContent(this._textModel.text, didEditContent.bind(this));
     },
 
-    _handleRevertEditing: function()
+    editContent: function(newContent, callback)
     {
-        if (this._textViewer.readOnly)
-            return false;
-
-        if (this._originalTextModelContent !== undefined)
-            this._textModel.setText(null, this._originalTextModelContent);
-        delete this._originalTextModelContent;
-        this._textViewer.readOnly = true;
-        this._delegate.setScriptSourceIsBeingEdited(false);
-        return true;
+        this._delegate.editScriptSource(newContent, callback);
     },
 
-    _doubleClick: function(event)
+    cancelEditing: function()
     {
-        if (!this._delegate.canEditScriptSource())
-            return;
-
-        var lineRow = event.target.enclosingNodeOrSelfWithClass("webkit-line-content");
-        if (!lineRow)
-            return;  // Do not trigger editing from line numbers.
-
-        if (this._textViewer.readOnly) {
-            this._textViewer.readOnly = false;
-            window.getSelection().collapseToStart();
-        }
+        this._restoreViewerState();
+        this._delegate.setScriptSourceIsBeingEdited(false);
     }
 }
 
-WebInspector.SourceFrame.prototype.__proto__ = WebInspector.View.prototype;
+WebInspector.SourceFrame.prototype.__proto__ = WebInspector.TextViewerDelegate.prototype;
 
 
 WebInspector.SourceFrameDelegate = function()
@@ -935,5 +1016,15 @@ WebInspector.SourceFrameDelegate.prototype = {
     releaseEvaluationResult: function()
     {
         // Should be implemented by subclasses.
+    },
+
+    toggleFormatSourceFiles: function()
+    {
+        // Should be implemented by subclasses.
+    },
+
+    formatSourceFilesToggled: function()
+    {
+        // Should be implemented by subclasses.
     }
 }
diff --git a/Source/WebCore/inspector/front-end/SourceFrameContent.js b/Source/WebCore/inspector/front-end/SourceFrameContent.js
deleted file mode 100644
index 3f3a8e9..0000000
--- a/Source/WebCore/inspector/front-end/SourceFrameContent.js
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.SourceFrameContent = function(text, mapping, scriptRanges)
-{
-    this._text = text;
-    this._mapping = mapping;
-    this._scriptRanges = scriptRanges;
-}
-
-WebInspector.SourceFrameContent.prototype = {
-    get text()
-    {
-        return this._text;
-    },
-
-    get scriptRanges()
-    {
-        return this._scriptRanges;
-    },
-
-    sourceFrameLineNumberToActualLocation: function(lineNumber)
-    {
-        var location = this._mapping.sourceLocationToActualLocation(lineNumber, 0);
-        location.sourceID = this._sourceIDForSourceFrameLineNumber(lineNumber);
-        return location;
-    },
-
-    actualLocationToSourceFrameLineNumber: function(lineNumber, columnNumber)
-    {
-        return this._mapping.actualLocationToSourceLocation(lineNumber, columnNumber).lineNumber;
-    },
-
-    _sourceIDForSourceFrameLineNumber: function(lineNumber)
-    {
-        for (var i = 0; i < this._scriptRanges.length; ++i) {
-            var scriptRange = this._scriptRanges[i];
-            if (lineNumber < scriptRange.start.lineNumber)
-                return;
-            if (lineNumber > scriptRange.end.lineNumber)
-                continue;
-            if (lineNumber === scriptRange.end.lineNumber && !scriptRange.end.columnNumber)
-                continue;
-            return scriptRange.sourceID;
-        }
-    }
-}
-
-
-WebInspector.SourceMapping = function()
-{
-}
-
-WebInspector.SourceMapping.prototype = {
-    actualLocationToSourceLocation: function(lineNumber, columnNumber)
-    {
-        // Should be implemented by subclasses.
-    },
-
-    sourceLocationToActualLocation: function(lineNumber, columnNumber)
-    {
-        // Should be implemented by subclasses.
-    }
-}
-
-
-WebInspector.IdenticalSourceMapping = function()
-{
-    WebInspector.SourceMapping.call(this);
-}
-
-WebInspector.IdenticalSourceMapping.prototype = {
-    actualLocationToSourceLocation: function(lineNumber, columnNumber)
-    {
-        return { lineNumber: lineNumber, columnNumber: columnNumber};
-    },
-
-    sourceLocationToActualLocation: function(lineNumber, columnNumber)
-    {
-        return { lineNumber: lineNumber, columnNumber: columnNumber};
-    }
-}
-
-WebInspector.IdenticalSourceMapping.prototype.__proto__ = WebInspector.SourceMapping.prototype;
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index 29d0317..a662008 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -503,7 +503,7 @@ WebInspector.StylesSidebarPane.prototype = {
 
     addBlankSection: function()
     {
-        var blankSection = new WebInspector.BlankStylePropertiesSection(this, appropriateSelectorForNode(this.node, true));
+        var blankSection = new WebInspector.BlankStylePropertiesSection(this, this.node ? this.node.appropriateSelectorFor(true) : "");
         blankSection.pane = this;
 
         var elementStyleSection = this.sections[0][1];
@@ -635,8 +635,6 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
     function linkifyUncopyable(url, line)
     {
         var link = WebInspector.linkifyResourceAsNode(url, "resources", line + 1);
-        link.setAttribute("data-uncopyable", link.textContent);
-        link.textContent = "";
         return link;
     }
 
@@ -1643,47 +1641,29 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
         var wordRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, WebInspector.StylesSidebarPane.StyleValueDelimiters, this.valueElement);
         var wordString = wordRange.toString();
-        var replacementString = wordString;
+        var replacementString;
+        var prefix, suffix, number;
 
-        var matches = /(.*?)(-?\d+(?:\.\d+)?)(.*)/.exec(wordString);
+        var matches;
+        matches = /(.*#)([\da-fA-F]+)(.*)/.exec(wordString);
         if (matches && matches.length) {
-            var prefix = matches[1];
-            var number = parseFloat(matches[2]);
-            var suffix = matches[3];
-
-            // If the number is near zero or the number is one and the direction will take it near zero.
-            var numberNearZero = (number < 1 && number > -1);
-            if (number === 1 && event.keyIdentifier === "Down")
-                numberNearZero = true;
-            else if (number === -1 && event.keyIdentifier === "Up")
-                numberNearZero = true;
-
-            if (numberNearZero && event.altKey && arrowKeyPressed) {
-                if (event.keyIdentifier === "Down")
-                    number = Math.ceil(number - 1);
-                else
-                    number = Math.floor(number + 1);
-            } else {
-                // Jump by 10 when shift is down or jump by 0.1 when near zero or Alt/Option is down.
-                // Also jump by 10 for page up and down, or by 100 if shift is held with a page key.
-                var changeAmount = 1;
-                if (event.shiftKey && pageKeyPressed)
-                    changeAmount = 100;
-                else if (event.shiftKey || pageKeyPressed)
-                    changeAmount = 10;
-                else if (event.altKey || numberNearZero)
-                    changeAmount = 0.1;
-
-                if (event.keyIdentifier === "Down" || event.keyIdentifier === "PageDown")
-                    changeAmount *= -1;
-
-                // Make the new number and constrain it to a precision of 6, this matches numbers the engine returns.
-                // Use the Number constructor to forget the fixed precision, so 1.100000 will print as 1.1.
-                number = Number((number + changeAmount).toFixed(6));
-            }
+            prefix = matches[1];
+            suffix = matches[3];
+            number = this._alteredHexNumber(matches[2], event);
 
             replacementString = prefix + number + suffix;
+        } else {
+            matches = /(.*?)(-?(?:\d+(?:\.\d+)?|\.\d+))(.*)/.exec(wordString);
+            if (matches && matches.length) {
+                prefix = matches[1];
+                suffix = matches[3];
+                number = this._alteredFloatNumber(parseFloat(matches[2]), event);
 
+                replacementString = prefix + number + suffix;
+            }
+        }
+
+        if (replacementString) {
             var replacementTextNode = document.createTextNode(replacementString);
 
             wordRange.deleteContents();
@@ -1710,6 +1690,75 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
     },
 
+    _alteredFloatNumber: function(number, event)
+    {
+        var arrowKeyPressed = (event.keyIdentifier === "Up" || event.keyIdentifier === "Down");
+        // If the number is near zero or the number is one and the direction will take it near zero.
+        var numberNearZero = (number < 1 && number > -1);
+        if (number === 1 && event.keyIdentifier === "Down")
+            numberNearZero = true;
+        else if (number === -1 && event.keyIdentifier === "Up")
+            numberNearZero = true;
+
+        var result;
+        if (numberNearZero && event.altKey && arrowKeyPressed) {
+            if (event.keyIdentifier === "Down")
+                result = Math.ceil(number - 1);
+            else
+                result = Math.floor(number + 1);
+        } else {
+            // Jump by 10 when shift is down or jump by 0.1 when near zero or Alt/Option is down.
+            // Also jump by 10 for page up and down, or by 100 if shift is held with a page key.
+            var changeAmount = 1;
+            if (event.shiftKey && !arrowKeyPressed)
+                changeAmount = 100;
+            else if (event.shiftKey || !arrowKeyPressed)
+                changeAmount = 10;
+            else if (event.altKey || numberNearZero)
+                changeAmount = 0.1;
+
+            if (event.keyIdentifier === "Down" || event.keyIdentifier === "PageDown")
+                changeAmount *= -1;
+
+            // Make the new number and constrain it to a precision of 6, this matches numbers the engine returns.
+            // Use the Number constructor to forget the fixed precision, so 1.100000 will print as 1.1.
+            result = Number((number + changeAmount).toFixed(6));
+        }
+
+        return result;
+    },
+
+    _alteredHexNumber: function(hexString, event)
+    {
+        var number = parseInt(hexString, 16);
+        if (isNaN(number) || !isFinite(number))
+            return hexString;
+
+        var maxValue = Math.pow(16, hexString.length) - 1;
+        var arrowKeyPressed = (event.keyIdentifier === "Up" || event.keyIdentifier === "Down");
+
+        var delta;
+        if (arrowKeyPressed)
+            delta = (event.keyIdentifier === "Up") ? 1 : -1;
+        else
+            delta = (event.keyIdentifier === "PageUp") ? 16 : -16;
+
+        if (event.shiftKey)
+            delta *= 16;
+
+        var result = number + delta;
+        if (result < 0)
+            result = 0; // Color hex values are never negative, so clamp to 0.
+        else if (result > maxValue)
+            return hexString;
+
+        // Ensure the result length is the same as the original hex value.
+        var resultString = result.toString(16).toUpperCase();
+        for (var i = 0, lengthDelta = hexString.length - resultString.length; i < lengthDelta; ++i)
+            resultString = "0" + resultString;
+        return resultString;
+    },
+
     editingEnded: function(context)
     {
         this.hasChildren = context.hasChildren;
diff --git a/Source/WebCore/inspector/front-end/TestController.js b/Source/WebCore/inspector/front-end/TestController.js
index e6783f9..301994c 100644
--- a/Source/WebCore/inspector/front-end/TestController.js
+++ b/Source/WebCore/inspector/front-end/TestController.js
@@ -36,7 +36,7 @@ WebInspector.TestController.prototype = {
     notifyDone: function(callId, result)
     {
         var message = typeof result === "undefined" ? "\"<undefined>\"" : JSON.stringify(result);
-        InspectorAgent.didEvaluateForTestInFrontend(callId, message);
+        RuntimeAgent.evaluate("didEvaluateForTestInFrontend(" + callId + ", " + message + ")", "test");
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/TextEditorModel.js b/Source/WebCore/inspector/front-end/TextEditorModel.js
index b14a3b7..47c53d7 100644
--- a/Source/WebCore/inspector/front-end/TextEditorModel.js
+++ b/Source/WebCore/inspector/front-end/TextEditorModel.js
@@ -59,6 +59,7 @@ WebInspector.TextEditorModel = function()
     this._attributes = [];
     this._undoStack = [];
     this._noPunctuationRegex = /[^ !%&()*+,-.:;<=>?\[\]\^{|}~]+/;
+    this._lineBreak = "\n";
 }
 
 WebInspector.TextEditorModel.prototype = {
@@ -74,7 +75,7 @@ WebInspector.TextEditorModel.prototype = {
 
     get text()
     {
-        return this._lines.join("\n");
+        return this._lines.join(this._lineBreak);
     },
 
     line: function(lineNumber)
@@ -91,9 +92,12 @@ WebInspector.TextEditorModel.prototype = {
 
     setText: function(range, text)
     {
-        if (!range)
+        text = text || "";
+        if (!range) {
             range = new WebInspector.TextRange(0, 0, this._lines.length - 1, this._lines[this._lines.length - 1].length);
-        var command = this._pushUndoableCommand(range, text);
+            this._lineBreak = /\r\n/.test(text) ? "\r\n" : "\n";
+        }
+        var command = this._pushUndoableCommand(range);
         var newRange = this._innerSetText(range, text);
         command.range = newRange.clone();
 
@@ -113,11 +117,10 @@ WebInspector.TextEditorModel.prototype = {
         if (text === "")
             return new WebInspector.TextRange(range.startLine, range.startColumn, range.startLine, range.startColumn);
 
-        var newLines = text.split("\n");
+        var newLines = text.split(/\r?\n/);
         this._replaceTabsIfNeeded(newLines);
 
         var prefix = this._lines[range.startLine].substring(0, range.startColumn);
-        var prefixArguments = this._arguments
         var suffix = this._lines[range.startLine].substring(range.startColumn);
 
         var postCaret = prefix.length;
@@ -211,13 +214,13 @@ WebInspector.TextEditorModel.prototype = {
         var clip = [];
         if (range.startLine === range.endLine) {
             clip.push(this._lines[range.startLine].substring(range.startColumn, range.endColumn));
-            return clip.join("\n");
+            return clip.join(this._lineBreak);
         }
         clip.push(this._lines[range.startLine].substring(range.startColumn));
         for (var i = range.startLine + 1; i < range.endLine; ++i)
             clip.push(this._lines[i]);
         clip.push(this._lines[range.endLine].substring(0, range.endColumn));
-        return clip.join("\n");
+        return clip.join(this._lineBreak);
     },
 
     setAttribute: function(line, name, value)
@@ -243,7 +246,7 @@ WebInspector.TextEditorModel.prototype = {
             delete attrs[name];
     },
 
-    _pushUndoableCommand: function(range, text)
+    _pushUndoableCommand: function(range)
     {
         var command = {
             text: this.copyRange(range),
@@ -262,29 +265,29 @@ WebInspector.TextEditorModel.prototype = {
         return command;
     },
 
-    undo: function()
+    undo: function(callback)
     {
         this._markRedoableState();
 
         this._inUndo = true;
-        var range = this._doUndo(this._undoStack);
+        var range = this._doUndo(this._undoStack, callback);
         delete this._inUndo;
 
         return range;
     },
 
-    redo: function()
+    redo: function(callback)
     {
         this.markUndoableState();
 
         this._inRedo = true;
-        var range = this._doUndo(this._redoStack);
+        var range = this._doUndo(this._redoStack, callback);
         delete this._inRedo;
 
         return range;
     },
 
-    _doUndo: function(stack)
+    _doUndo: function(stack, callback)
     {
         var range = null;
         for (var i = stack.length - 1; i >= 0; --i) {
@@ -292,6 +295,8 @@ WebInspector.TextEditorModel.prototype = {
             stack.length = i;
 
             range = this.setText(command.range, command.text);
+            if (callback)
+                callback(command.range, range);
             if (i > 0 && stack[i - 1].explicit)
                 return range;
         }
diff --git a/Source/WebCore/inspector/front-end/TextViewer.js b/Source/WebCore/inspector/front-end/TextViewer.js
index 43b34f6..1b40b3e 100644
--- a/Source/WebCore/inspector/front-end/TextViewer.js
+++ b/Source/WebCore/inspector/front-end/TextViewer.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -29,12 +29,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.TextViewer = function(textModel, platform, url)
+WebInspector.TextViewer = function(textModel, platform, url, delegate)
 {
+    WebInspector.View.call(this);
+
     this._textModel = textModel;
     this._textModel.changeListener = this._textChanged.bind(this);
+    this._textModel.resetUndoStack();
+    this._delegate = delegate;
 
-    this.element = document.createElement("div");
     this.element.className = "text-editor monospace";
 
     var enterTextChangeMode = this._enterInternalTextChangeMode.bind(this);
@@ -49,7 +52,12 @@ WebInspector.TextViewer = function(textModel, platform, url)
     // Forward mouse wheel events from the unscrollable gutter to the main panel.
     this._gutterPanel.element.addEventListener("mousewheel", function(e) {
         this._mainPanel.element.dispatchEvent(e);
-    }.bind(this), false)
+    }.bind(this), false);
+
+    this.element.addEventListener("dblclick", this._doubleClick.bind(this), true);
+    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
+
+    this._registerShortcuts();
 }
 
 WebInspector.TextViewer.prototype = {
@@ -60,7 +68,10 @@ WebInspector.TextViewer.prototype = {
 
     set readOnly(readOnly)
     {
+        if (this._mainPanel.readOnly === readOnly)
+            return;
         this._mainPanel.readOnly = readOnly;
+        this._delegate.readOnlyStateChanged(readOnly);
     },
 
     get readOnly()
@@ -68,16 +79,6 @@ WebInspector.TextViewer.prototype = {
         return this._mainPanel.readOnly;
     },
 
-    set startEditingListener(startEditingListener)
-    {
-        this._startEditingListener = startEditingListener;
-    },
-
-    set endEditingListener(endEditingListener)
-    {
-        this._endEditingListener = endEditingListener;
-    },
-
     get textModel()
     {
         return this._textModel;
@@ -164,31 +165,23 @@ WebInspector.TextViewer.prototype = {
     // WebInspector.TextModel listener
     _textChanged: function(oldRange, newRange, oldText, newText)
     {
-        if (!this._internalTextChangeMode) {
-            this._mainPanel.textChanged(oldRange, newRange);
-            this._gutterPanel.textChanged(oldRange, newRange);
-            this._updatePanelOffsets();
-        }
+        if (!this._internalTextChangeMode)
+            this._textModel.resetUndoStack();
+        this._mainPanel.textChanged(oldRange, newRange);
+        this._gutterPanel.textChanged(oldRange, newRange);
+        this._updatePanelOffsets();
     },
 
     _enterInternalTextChangeMode: function()
     {
         this._internalTextChangeMode = true;
-
-        if (this._startEditingListener)
-            this._startEditingListener();
+        this._delegate.startEditing();
     },
 
     _exitInternalTextChangeMode: function(oldRange, newRange)
     {
         this._internalTextChangeMode = false;
-
-        // Update the gutter panel.
-        this._gutterPanel.textChanged(oldRange, newRange);
-        this._updatePanelOffsets();
-
-        if (this._endEditingListener)
-            this._endEditingListener(oldRange, newRange);
+        this._delegate.endEditing(oldRange, newRange);
     },
 
     _updatePanelOffsets: function()
@@ -218,7 +211,7 @@ WebInspector.TextViewer.prototype = {
             return;
 
         var mainChunk = this._mainPanel.chunkForLine(lineNumber);
-        if (mainChunk.linesCount === 1) {
+        if (mainChunk.linesCount === 1 && mainChunk.decorated) {
             var gutterChunk = this._gutterPanel.makeLineAChunk(lineNumber);
             var height = mainChunk.height;
             if (height)
@@ -230,9 +223,125 @@ WebInspector.TextViewer.prototype = {
             if (gutterChunk.linesCount === 1)
                 gutterChunk.element.style.removeProperty("height");
         }
+    },
+
+    _doubleClick: function(event)
+    {
+        if (!this.readOnly || this._commitEditingInProgress)
+            return;
+
+        var lineRow = event.target.enclosingNodeOrSelfWithClass("webkit-line-content");
+        if (!lineRow)
+            return;  // Do not trigger editing from line numbers.
+
+        if (!this._delegate.isContentEditable())
+            return;
+
+        this.readOnly = false;
+        window.getSelection().collapseToStart();
+    },
+
+    _registerShortcuts: function()
+    {
+        var keys = WebInspector.KeyboardShortcut.Keys;
+        var modifiers = WebInspector.KeyboardShortcut.Modifiers;
+
+        this._shortcuts = {};
+        var commitEditing = this._commitEditing.bind(this);
+        var cancelEditing = this._cancelEditing.bind(this);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("s", modifiers.CtrlOrMeta)] = commitEditing;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Enter.code, modifiers.CtrlOrMeta)] = commitEditing;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Esc.code)] = cancelEditing;
+
+        var handleUndo = this._mainPanel.handleUndoRedo.bind(this._mainPanel, false);
+        var handleRedo = this._mainPanel.handleUndoRedo.bind(this._mainPanel, true);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("z", modifiers.CtrlOrMeta)] = handleUndo;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("z", modifiers.Shift | modifiers.CtrlOrMeta)] = handleRedo;
+
+        var handleTabKey = this._mainPanel.handleTabKeyPress.bind(this._mainPanel, false);
+        var handleShiftTabKey = this._mainPanel.handleTabKeyPress.bind(this._mainPanel, true);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Tab.code)] = handleTabKey;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(keys.Tab.code, modifiers.Shift)] = handleShiftTabKey;
+    },
+
+    _handleKeyDown: function(e)
+    {
+        var shortcutKey = WebInspector.KeyboardShortcut.makeKeyFromEvent(e);
+        var handler = this._shortcuts[shortcutKey];
+        if (handler && handler.call(this)) {
+            e.preventDefault();
+            e.stopPropagation();
+        }
+    },
+
+    _commitEditing: function()
+    {
+        if (this.readOnly)
+            return false;
+
+        this.readOnly = true;
+        function didCommitEditing(error)
+        {
+            this._commitEditingInProgress = false;
+            if (error)
+                this.readOnly = false;
+        }
+        this._commitEditingInProgress = true;
+        this._delegate.commitEditing(didCommitEditing.bind(this));
+        return true;
+    },
+
+    _cancelEditing: function()
+    {
+        if (this.readOnly)
+            return false;
+
+        this.readOnly = true;
+        this._delegate.cancelEditing();
+        return true;
     }
 }
 
+WebInspector.TextViewer.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.TextViewerDelegate = function()
+{
+}
+
+WebInspector.TextViewerDelegate.prototype = {
+    isContentEditable: function()
+    {
+        // Should be implemented by subclasses.
+    },
+
+    readOnlyStateChanged: function(readOnly)
+    {
+        // Should be implemented by subclasses.
+    },
+
+    startEditing: function()
+    {
+        // Should be implemented by subclasses.
+    },
+
+    endEditing: function(oldRange, newRange)
+    {
+        // Should be implemented by subclasses.
+    },
+
+    commitEditing: function()
+    {
+        // Should be implemented by subclasses.
+    },
+
+    cancelEditing: function()
+    {
+        // Should be implemented by subclasses.
+    }
+}
+
+WebInspector.TextViewerDelegate.prototype.__proto__ = WebInspector.Object.prototype;
+
 WebInspector.TextEditorChunkedPanel = function(textModel)
 {
     this._textModel = textModel;
@@ -259,19 +368,20 @@ WebInspector.TextEditorChunkedPanel.prototype = {
 
     addDecoration: function(lineNumber, decoration)
     {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
         var chunk = this.makeLineAChunk(lineNumber);
         chunk.addDecoration(decoration);
     },
 
     removeDecoration: function(lineNumber, decoration)
     {
-        var chunk = this.makeLineAChunk(lineNumber);
-        chunk.removeDecoration(decoration);
-    },
+        if (lineNumber >= this._textModel.linesCount)
+            return;
 
-    textChanged: function(oldRange, newRange)
-    {
-        this._buildChunks();
+        var chunk = this.chunkForLine(lineNumber);
+        chunk.removeDecoration(decoration);
     },
 
     _buildChunks: function()
@@ -294,16 +404,19 @@ WebInspector.TextEditorChunkedPanel.prototype = {
 
     makeLineAChunk: function(lineNumber)
     {
-        if (!this._textChunks)
-            this._buildChunks();
-
         var chunkNumber = this._chunkNumberForLine(lineNumber);
         var oldChunk = this._textChunks[chunkNumber];
         if (oldChunk.linesCount === 1)
             return oldChunk;
 
+        return this._splitChunkOnALine(lineNumber, chunkNumber);
+    },
+
+    _splitChunkOnALine: function(lineNumber, chunkNumber)
+    {
         this.beginDomUpdates();
 
+        var oldChunk = this._textChunks[chunkNumber];
         var wasExpanded = oldChunk.expanded;
         oldChunk.expanded = false;
 
@@ -447,9 +560,6 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         if (this._paintCoalescingLevel || this._dirtyLines)
             return;
 
-        if (!this._textChunks)
-            this._buildChunks();
-
         var visibleFrom = this.element.scrollTop;
         var visibleTo = this.element.scrollTop + this.element.clientHeight;
 
@@ -526,10 +636,7 @@ WebInspector.TextEditorGutterPanel.prototype = {
 
     textChanged: function(oldRange, newRange)
     {
-        if (!this._textChunks) {
-            this._buildChunks();
-            return;
-        }
+        this.beginDomUpdates();
 
         var linesDiff = newRange.linesCount - oldRange.linesCount;
         if (linesDiff) {
@@ -565,6 +672,8 @@ WebInspector.TextEditorGutterPanel.prototype = {
                 chunk = this._textChunks[++chunkNumber];
             }
         }
+
+        this.endDomUpdates();
     },
 
     syncClientHeight: function(clientHeight)
@@ -744,6 +853,9 @@ WebInspector.TextEditorMainPanel.prototype = {
 
     set readOnly(readOnly)
     {
+        if (this._readOnly === readOnly)
+            return;
+
         this.beginDomUpdates();
         this._readOnly = readOnly;
         if (this._readOnly)
@@ -762,14 +874,25 @@ WebInspector.TextEditorMainPanel.prototype = {
     {
         if (this._rangeToMark) {
             var markedLine = this._rangeToMark.startLine;
-            this._rangeToMark = null;
-            this._paintLines(markedLine, markedLine + 1);
+            delete this._rangeToMark;
+            // Remove the marked region immediately.
+            if (!this._dirtyLines) {
+                this.beginDomUpdates();
+                var chunk = this.chunkForLine(markedLine);
+                var wasExpanded = chunk.expanded;
+                chunk.expanded = false;
+                chunk.updateCollapsedLineRow();
+                chunk.expanded = wasExpanded;
+                this.endDomUpdates();
+            } else
+                this._paintLines(markedLine, markedLine + 1);
         }
 
         if (range) {
             this._rangeToMark = range;
             this.revealLine(range.startLine);
-            this._paintLines(range.startLine, range.startLine + 1);
+            var chunk = this.makeLineAChunk(range.startLine);
+            this._paintLine(chunk.element);
             if (this._markedRangeElement)
                 this._markedRangeElement.scrollIntoViewIfNeeded();
         }
@@ -799,6 +922,65 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._cachedRows = [];
     },
 
+    handleUndoRedo: function(redo)
+    {
+        if (this._readOnly || this._dirtyLines)
+            return false;
+
+        this.beginUpdates();
+        this._enterTextChangeMode();
+
+        var callback = function(oldRange, newRange) {
+            this._exitTextChangeMode(oldRange, newRange);
+            this._enterTextChangeMode();
+        }.bind(this);
+
+        var range = redo ? this._textModel.redo(callback) : this._textModel.undo(callback);
+        if (range)
+            this._setCaretLocation(range.endLine, range.endColumn, true);
+
+        this._exitTextChangeMode(null, null);
+        this.endUpdates();
+
+        return true;
+    },
+
+    handleTabKeyPress: function(shiftKey)
+    {
+        if (this._readOnly || this._dirtyLines)
+            return false;
+
+        var selection = this._getSelection();
+        if (!selection)
+            return false;
+
+        if (shiftKey)
+            return true;
+
+        this.beginUpdates();
+        this._enterTextChangeMode();
+
+        var range = selection;
+        if (range.startLine > range.endLine || (range.startLine === range.endLine && range.startColumn > range.endColumn))
+            range = new WebInspector.TextRange(range.endLine, range.endColumn, range.startLine, range.startColumn);
+
+        var newRange = this._setText(range, "\t");
+
+        this._exitTextChangeMode(range, newRange);
+        this.endUpdates();
+
+        this._setCaretLocation(newRange.endLine, newRange.endColumn, true);
+        return true;
+    },
+
+    _splitChunkOnALine: function(lineNumber, chunkNumber)
+    {
+        var selection = this._getSelection();
+        var chunk = WebInspector.TextEditorChunkedPanel.prototype._splitChunkOnALine.call(this, lineNumber, chunkNumber);
+        this._restoreSelection(selection);
+        return chunk;
+    },
+
     _buildChunks: function()
     {
         for (var i = 0; i < this._textModel.linesCount; ++i)
@@ -825,6 +1007,7 @@ WebInspector.TextEditorMainPanel.prototype = {
 
         this._restorePaintLinesOperationsCredit();
         WebInspector.TextEditorChunkedPanel.prototype._expandChunks.call(this, fromIndex, toIndex);
+        this._adjustPaintLinesOperationsRefreshValue();
 
         this._restoreSelection(selection);
     },
@@ -844,7 +1027,7 @@ WebInspector.TextEditorMainPanel.prototype = {
 
         if (!this._scheduledPaintLines) {
             this._scheduledPaintLines = [ { startLine: startLine, endLine: endLine } ];
-            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 10);
+            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 0);
         } else {
             for (var i = 0; i < this._scheduledPaintLines.length; ++i) {
                 var chunk = this._scheduledPaintLines[i];
@@ -879,14 +1062,31 @@ WebInspector.TextEditorMainPanel.prototype = {
 
         var scheduledPaintLines = this._scheduledPaintLines;
         delete this._scheduledPaintLines;
-        
+
         this._restorePaintLinesOperationsCredit();
         this._paintLineChunks(scheduledPaintLines, !skipRestoreSelection);
+        this._adjustPaintLinesOperationsRefreshValue();
     },
 
     _restorePaintLinesOperationsCredit: function()
     {
-        this._paintLinesOperationsCredit = 250;
+        if (!this._paintLinesOperationsRefreshValue)
+            this._paintLinesOperationsRefreshValue = 250;
+        this._paintLinesOperationsCredit = this._paintLinesOperationsRefreshValue;
+        this._paintLinesOperationsLastRefresh = Date.now();
+    },
+
+    _adjustPaintLinesOperationsRefreshValue: function()
+    {
+        var operationsDone = this._paintLinesOperationsRefreshValue - this._paintLinesOperationsCredit;
+        if (operationsDone <= 0)
+            return;
+        var timePast = Date.now() - this._paintLinesOperationsLastRefresh;
+        if (timePast <= 0)
+            return;
+        // Make the synchronous CPU chunk for painting the lines 50 msec.
+        var value = Math.floor(operationsDone / timePast * 50);
+        this._paintLinesOperationsRefreshValue = Number.constrain(value, 150, 1500);
     },
 
     _paintLines: function(fromLine, toLine, restoreSelection)
@@ -943,20 +1143,22 @@ WebInspector.TextEditorMainPanel.prototype = {
     _paintLine: function(lineRow)
     {
         var lineNumber = lineRow.lineNumber;
-        if (this._dirtyLines || this._scheduledPaintLines || this._paintLinesOperationsCredit < 0) {
+        if (this._dirtyLines) {
             this._schedulePaintLines(lineNumber, lineNumber + 1);
             return;
         }
 
         this.beginDomUpdates();
         try {
-            var highlight = this._textModel.getAttribute(lineNumber, "highlight");
-            if (!highlight) {
-                if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
-                    this._markedRangeElement = highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
+            if (this._scheduledPaintLines || this._paintLinesOperationsCredit < 0) {
+                this._schedulePaintLines(lineNumber, lineNumber + 1);
                 return;
             }
 
+            var highlight = this._textModel.getAttribute(lineNumber, "highlight");
+            if (!highlight)
+                return;
+
             lineRow.removeChildren();
             var line = this._textModel.line(lineNumber);
             if (!line)
@@ -990,11 +1192,11 @@ WebInspector.TextEditorMainPanel.prototype = {
                 this._appendTextNode(lineRow, line.substring(plainTextStart, line.length));
                 --this._paintLinesOperationsCredit;
             }
-            if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
-                this._markedRangeElement = highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
             if (lineRow.decorationsElement)
                 lineRow.appendChild(lineRow.decorationsElement);
         } finally {
+            if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
+                this._markedRangeElement = highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
             this.endDomUpdates();
         }
     },
@@ -1035,13 +1237,28 @@ WebInspector.TextEditorMainPanel.prototype = {
             return new WebInspector.TextRange(end.line, end.column, start.line, start.column);
     },
 
-    _restoreSelection: function(range)
+    _restoreSelection: function(range, scrollIntoView)
     {
         if (!range)
             return;
         var start = this._positionToSelection(range.startLine, range.startColumn);
         var end = range.isEmpty() ? start : this._positionToSelection(range.endLine, range.endColumn);
         window.getSelection().setBaseAndExtent(start.container, start.offset, end.container, end.offset);
+
+        if (scrollIntoView) {
+            for (var node = end.container; node; node = node.parentElement) {
+                if (node.scrollIntoViewIfNeeded) {
+                    node.scrollIntoViewIfNeeded();
+                    break;
+                }
+            }
+        }
+    },
+
+    _setCaretLocation: function(line, column, scrollIntoView)
+    {
+        var range = new WebInspector.TextRange(line, column, line, column);
+        this._restoreSelection(range, scrollIntoView);
     },
 
     _selectionToPosition: function(container, offset)
@@ -1051,14 +1268,14 @@ WebInspector.TextEditorMainPanel.prototype = {
         if (container === this._container && offset === 1)
             return { line: this._textModel.linesCount - 1, column: this._textModel.lineLength(this._textModel.linesCount - 1) };
 
-        var lineRow = container.enclosingNodeOrSelfWithNodeName("DIV");
+        var lineRow = this._enclosingLineRowOrSelf(container);
         var lineNumber = lineRow.lineNumber;
         if (container === lineRow && offset === 0)
             return { line: lineNumber, column: 0 };
 
         // This may be chunk and chunks may contain \n.
         var column = 0;
-        var node = lineRow.traverseNextTextNode(lineRow);
+        var node = lineRow.nodeType === Node.TEXT_NODE ? lineRow : lineRow.traverseNextTextNode(lineRow);
         while (node && node !== container) {
             var text = node.textContent;
             for (var i = 0; i < text.length; ++i) {
@@ -1087,7 +1304,8 @@ WebInspector.TextEditorMainPanel.prototype = {
     _positionToSelection: function(line, column)
     {
         var chunk = this.chunkForLine(line);
-        var lineRow = chunk.getExpandedLineRow(line);
+        // One-lined collapsed chunks may still stay highlighted.
+        var lineRow = chunk.linesCount === 1 ? chunk.element : chunk.getExpandedLineRow(line);
         if (lineRow)
             var rangeBoundary = lineRow.rangeBoundaryForOffset(column);
         else {
@@ -1103,6 +1321,18 @@ WebInspector.TextEditorMainPanel.prototype = {
         return rangeBoundary;
     },
 
+    _enclosingLineRowOrSelf: function(element)
+    {
+        var lineRow = element.enclosingNodeOrSelfWithClass("webkit-line-content");
+        if (lineRow)
+            return lineRow;
+        for (var lineRow = element; lineRow; lineRow = lineRow.parentElement) {
+            if (lineRow.parentElement === this._container)
+                return lineRow;
+        }
+        return null;
+    },
+
     _appendSpan: function(element, content, className)
     {
         if (className === "html-resource-link" || className === "html-external-link") {
@@ -1167,7 +1397,7 @@ WebInspector.TextEditorMainPanel.prototype = {
         if (target === this._container)
             return;
 
-        var lineRow = target.enclosingNodeOrSelfWithClass("webkit-line-content");
+        var lineRow = this._enclosingLineRowOrSelf(target);
         if (!lineRow)
             return;
 
@@ -1195,7 +1425,7 @@ WebInspector.TextEditorMainPanel.prototype = {
 
         var endLine = startLine + 1;
         for (var row = lineRow.nextSibling; row; row = row.nextSibling) {
-            if (typeof row.lineNumber === "number") {
+            if (typeof row.lineNumber === "number" && row.lineNumber > startLine) {
                 endLine = row.lineNumber;
                 break;
             }
@@ -1205,7 +1435,7 @@ WebInspector.TextEditorMainPanel.prototype = {
             // Now this will no longer be valid.
             delete lineRow.lineNumber;
         }
- 
+
         if (this._dirtyLines) {
             this._dirtyLines.start = Math.min(this._dirtyLines.start, startLine);
             this._dirtyLines.end = Math.max(this._dirtyLines.end, endLine);
@@ -1258,7 +1488,7 @@ WebInspector.TextEditorMainPanel.prototype = {
             this._collectLinesFromDiv(lines, lineRow);
         }
 
-        // Try to decrease the range being replaced if possible.
+        // Try to decrease the range being replaced, if possible.
         var startOffset = 0;
         while (startLine < dirtyLines.start && startOffset < lines.length) {
             if (this._textModel.line(startLine) !== lines[startOffset])
@@ -1277,26 +1507,65 @@ WebInspector.TextEditorMainPanel.prototype = {
 
         lines = lines.slice(startOffset, endOffset);
 
+        // Try to decrease the range being replaced by column offsets, if possible.
+        var startColumn = 0;
+        var endColumn = this._textModel.lineLength(endLine - 1);
+        if (lines.length > 0) {
+            var line1 = this._textModel.line(startLine);
+            var line2 = lines[0];
+            while (line1[startColumn] && line1[startColumn] === line2[startColumn])
+                ++startColumn;
+            lines[0] = line2.substring(startColumn);
+
+            var line1 = this._textModel.line(endLine - 1);
+            var line2 = lines[lines.length - 1];
+            for (var i = 0; i < endColumn && i < line2.length; ++i) {
+                if (startLine === endLine - 1 && endColumn - i <= startColumn)
+                    break;
+                if (line1[endColumn - i - 1] !== line2[line2.length - i - 1])
+                    break;
+            }
+            if (i) {
+                endColumn -= i;
+                lines[lines.length - 1] = line2.substring(0, line2.length - i);
+            }
+        }
+
         var selection = this._getSelection();
 
-        if (lines.length === 0 && endLine < this._textModel.linesCount) {
+        if (lines.length === 0 && endLine < this._textModel.linesCount)
             var oldRange = new WebInspector.TextRange(startLine, 0, endLine, 0);
-            var newRange = this._textModel.setText(oldRange, "");
-        } else {
-            var oldRange = new WebInspector.TextRange(startLine, 0, endLine - 1, this._textModel.lineLength(endLine - 1));
-            var newRange = this._textModel.setText(oldRange, lines.join("\n"));
-        }
+        else if (lines.length === 0 && startLine > 0)
+            var oldRange = new WebInspector.TextRange(startLine - 1, this._textModel.lineLength(startLine - 1), endLine - 1, this._textModel.lineLength(endLine - 1));
+        else
+            var oldRange = new WebInspector.TextRange(startLine, startColumn, endLine - 1, endColumn);
+
+        var newRange = this._setText(oldRange, lines.join("\n"));
+        
+        this._paintScheduledLines(true);
+        this._restoreSelection(selection);
+
+        this._exitTextChangeMode(oldRange, newRange);
+    },
 
+    textChanged: function(oldRange, newRange)
+    {
         this.beginDomUpdates();
         this._removeDecorationsInRange(oldRange);
         this._updateChunksForRanges(oldRange, newRange);
         this._updateHighlightsForRange(newRange);
-        this._paintScheduledLines(true);
         this.endDomUpdates();
+    },
 
-        this._restoreSelection(selection);
+    _setText: function(range, text)
+    {
+        if (this._lastEditedRange && (!text || text.indexOf("\n") !== -1 || this._lastEditedRange.endLine !== range.startLine || this._lastEditedRange.endColumn !== range.startColumn))
+            this._textModel.markUndoableState();
 
-        this._exitTextChangeMode(oldRange, newRange);
+        var newRange = this._textModel.setText(range, text);
+        this._lastEditedRange = newRange;
+
+        return newRange;
     },
 
     _removeDecorationsInRange: function(range)
@@ -1342,6 +1611,8 @@ WebInspector.TextEditorMainPanel.prototype = {
         // Most frequent case: a chunk remained the same.
         for (var chunkNumber = firstChunkNumber; chunkNumber <= lastChunkNumber; ++chunkNumber) {
             var chunk = this._textChunks[chunkNumber];
+            if (chunk.startLine + chunk.linesCount > this._textModel.linesCount)
+                break;
             var lineNumber = chunk.startLine;
             for (var lineRow = firstLineRow; lineRow && lineNumber < chunk.startLine + chunk.linesCount; lineRow = lineRow.nextSibling) {
                 if (lineRow.lineNumber !== lineNumber || lineRow !== chunk.getExpandedLineRow(lineNumber) || lineRow.textContent !== this._textModel.line(lineNumber) || !lineRow.firstChild)
@@ -1428,7 +1699,7 @@ WebInspector.TextEditorMainPanel.prototype = {
     _collectLinesFromDiv: function(lines, element)
     {
         var textContents = [];
-        var node = element.traverseNextNode(element);
+        var node = element.nodeType === Node.TEXT_NODE ? element : element.traverseNextNode(element);
         while (node) {
             if (element.decorationsElement === node) {
                 node = node.nextSibling;
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index 0777a19..1b5cb39 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -9,8 +9,6 @@
     <file>AuditRules.js</file>
     <file>AuditsPanel.js</file>
     <file>BottomUpProfileDataGridTree.js</file>
-    <file>Breakpoint.js</file>
-    <file>BreakpointManager.js</file>
     <file>BreakpointsSidebarPane.js</file>
     <file>CallStackSidebarPane.js</file>
     <file>Checkbox.js</file>
@@ -34,6 +32,7 @@
     <file>DebuggerPresentationModel.js</file>
     <file>SourceFile.js</file>
     <file>DOMAgent.js</file>
+    <file>DOMBreakpointsSidebarPane.js</file>
     <file>DOMStorage.js</file>
     <file>DOMStorageItemsView.js</file>
     <file>DOMSyntaxHighlighter.js</file>
@@ -51,6 +50,7 @@
     <file>GoToLineDialog.js</file>
     <file>HAREntry.js</file>
     <file>HeapSnapshot.js</file>
+    <file>HeapSnapshotProxy.js</file>
     <file>HeapSnapshotView.js</file>
     <file>HelpScreen.js</file>
     <file>ImageView.js</file>
@@ -98,7 +98,6 @@
     <file>SidebarTreeElement.js</file>
     <file>SourceCSSTokenizer.js</file>
     <file>SourceFrame.js</file>
-    <file>SourceFrameContent.js</file>
     <file>SourceHTMLTokenizer.js</file>
     <file>SourceJavaScriptTokenizer.js</file>
     <file>SourceTokenizer.js</file>
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index 0311f22..d6fef89 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -89,8 +89,8 @@ body.inactive #toolbar {
     border-bottom: 1px solid rgb(64%, 64%, 64%);
 }
 
-body.detached.platform-mac-leopard #toolbar,
-body.detached.platform-mac-snowleopard #toolbar {
+body.detached.platform-mac-leopard:not(.remote) #toolbar,
+body.detached.platform-mac-snowleopard:not(.remote) #toolbar {
     background: transparent !important;
 }
 
@@ -349,7 +349,7 @@ body.attached #search {
     background-position: 0 0;
     background-color: transparent;
     border: 0 none transparent;
-    margin-top: 9px;
+    margin-top: 4px;
 }
 
 #close-button-left:hover, #close-button-right:hover {
@@ -493,14 +493,6 @@ button.status-bar-item.toggled-on .glyph {
     background-color: rgb(66, 129, 235);
 }
 
-button.status-bar-item.toggled-1 .glyph {
-    background-color: rgb(66, 129, 235);
-}
-
-button.status-bar-item.toggled-2 .glyph {
-    background-color: purple;   
-}
-
 button.status-bar-item:disabled {
     opacity: 0.5;
     background-position: 0 0 !important;
@@ -872,7 +864,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 
 .console-formatted-string, .console-formatted-regexp {
     color: rgb(196, 26, 22);
-    white-space: pre-wrap;
+    white-space: pre;
 }
 
 .console-formatted-null, .console-formatted-undefined {
@@ -2520,6 +2512,14 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-mask-image: url(Images/pauseOnExceptionButtonGlyph.png);
 }
 
+.scripts-pause-on-exceptions-status-bar-item.toggled-all .glyph {
+    background-color: rgb(66, 129, 235);
+}
+
+.scripts-pause-on-exceptions-status-bar-item.toggled-uncaught .glyph {
+    background-color: purple;   
+}
+
 #scripts-status-bar {
     position: absolute;
     top: -1px;
@@ -4309,10 +4309,6 @@ a.worker-item {
     color: inherit;
 }
 
-.styles-section a::before {
-    content: attr(data-uncopyable);
-}
-
 .styles-section .properties {
     display: none;
     margin: 0;
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index 9ba1dca..18c2564 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -46,7 +46,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ExtensionRegistryStub.js"></script>
     <script type="text/javascript" src="Object.js"></script>
     <script type="text/javascript" src="Settings.js"></script>
-    <script type="text/javascript" src="CSSStyleModel.js"></script>
     <script type="text/javascript" src="Checkbox.js"></script>
     <script type="text/javascript" src="ContextMenu.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
@@ -61,6 +60,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Panel.js"></script>
     <script type="text/javascript" src="TimelineGrid.js"></script>    
     <script type="text/javascript" src="Resource.js"></script>
+    <script type="text/javascript" src="CSSStyleModel.js"></script>
     <script type="text/javascript" src="NetworkManager.js"></script>
     <script type="text/javascript" src="ResourceTreeModel.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
@@ -73,8 +73,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="CookieItemsView.js"></script>
     <script type="text/javascript" src="ApplicationCacheItemsView.js"></script>
     <script type="text/javascript" src="Script.js"></script>
-    <script type="text/javascript" src="Breakpoint.js"></script>
-    <script type="text/javascript" src="BreakpointManager.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
     <script type="text/javascript" src="ElementsTreeOutline.js"></script>
     <script type="text/javascript" src="SidebarTreeElement.js"></script>
@@ -83,6 +81,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="RemoteObject.js"></script>
     <script type="text/javascript" src="ObjectPropertiesSection.js"></script>
     <script type="text/javascript" src="BreakpointsSidebarPane.js"></script>
+    <script type="text/javascript" src="DOMBreakpointsSidebarPane.js"></script>
     <script type="text/javascript" src="CallStackSidebarPane.js"></script>
     <script type="text/javascript" src="ScopeChainSidebarPane.js"></script>
     <script type="text/javascript" src="WatchExpressionsSidebarPane.js"></script>
@@ -101,8 +100,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ElementsPanel.js"></script>
     <script type="text/javascript" src="NetworkPanel.js"></script>
     <script type="text/javascript" src="InjectedFakeWorker.js"></script>
+    <script type="text/javascript" src="TextViewer.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
-    <script type="text/javascript" src="SourceFrameContent.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="ScriptsPanel.js"></script>
     <script type="text/javascript" src="ResourcesPanel.js"></script>
@@ -128,7 +127,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMSyntaxHighlighter.js"></script>
     <script type="text/javascript" src="TextEditorModel.js"></script>
     <script type="text/javascript" src="TextEditorHighlighter.js"></script>
-    <script type="text/javascript" src="TextViewer.js"></script>
     <script type="text/javascript" src="SourceTokenizer.js"></script>
     <script type="text/javascript" src="SourceCSSTokenizer.js"></script>
     <script type="text/javascript" src="SourceHTMLTokenizer.js"></script>
@@ -142,6 +140,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="TopDownProfileDataGridTree.js"></script>
     <script type="text/javascript" src="ProfileView.js"></script>
     <script type="text/javascript" src="HeapSnapshot.js"></script>
+    <script type="text/javascript" src="HeapSnapshotProxy.js"></script>
     <script type="text/javascript" src="HeapSnapshotView.js"></script>
     <script type="text/javascript" src="DetailedHeapshotGridNodes.js"></script>
     <script type="text/javascript" src="DetailedHeapshotView.js"></script>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 59171db..b125e7e 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -171,17 +171,6 @@ var WebInspector = {
         }
     },
 
-    createDOMBreakpointsSidebarPane: function()
-    {
-        var pane = new WebInspector.NativeBreakpointsSidebarPane(WebInspector.UIString("DOM Breakpoints"));
-        function breakpointAdded(event)
-        {
-            pane.addBreakpointItem(new WebInspector.BreakpointItem(event.data));
-        }
-        WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.DOMBreakpointAdded, breakpointAdded);
-        return pane;
-    },
-
     _createPanels: function()
     {
         var hiddenPanels = (InspectorFrontendHost.hiddenPanels() || "").split(',');
@@ -427,6 +416,8 @@ WebInspector.doLoadedDone = function()
         document.body.addStyleClass("platform-" + flavor);
     var port = WebInspector.port;
     document.body.addStyleClass("port-" + port);
+    if (WebInspector.socket)
+        document.body.addStyleClass("remote");
 
     WebInspector.settings = new WebInspector.Settings();
 
@@ -460,8 +451,8 @@ WebInspector.doLoadedDone = function()
     this.cssModel = new WebInspector.CSSStyleModel();
     this.debuggerModel = new WebInspector.DebuggerModel();
 
-    this.breakpointManager = new WebInspector.BreakpointManager();
     this.searchController = new WebInspector.SearchController();
+    this.domBreakpointsSidebarPane = new WebInspector.DOMBreakpointsSidebarPane();
 
     this.panels = {};
     this._createPanels();
@@ -508,6 +499,8 @@ WebInspector.doLoadedDone = function()
         ConsoleAgent.setMonitoringXHREnabled(true);
     ConsoleAgent.enable(this.console.setConsoleMessageExpiredCount.bind(this.console));
 
+    DatabaseAgent.enable();
+
     WebInspector.showPanel(WebInspector.settings.lastActivePanel);
 
     function propertyNamesCallback(error, names)
@@ -624,16 +617,8 @@ WebInspector.documentClick = function(event)
 
     function followLink()
     {
-        // FIXME: support webkit-html-external-link links here.
-        if (WebInspector.canShowSourceLine(anchor.href, anchor.getAttribute("line_number"), anchor.getAttribute("preferred_panel"))) {
-            if (anchor.hasStyleClass("webkit-html-external-link")) {
-                anchor.removeStyleClass("webkit-html-external-link");
-                anchor.addStyleClass("webkit-html-resource-link");
-            }
-
-            WebInspector.showSourceLine(anchor.href, anchor.getAttribute("line_number"), anchor.getAttribute("preferred_panel"));
+        if (WebInspector._showAnchorLocation(anchor))
             return;
-        }
 
         const profileMatch = WebInspector.ProfileType.URLRegExp.exec(anchor.href);
         if (profileMatch) {
@@ -995,18 +980,13 @@ WebInspector.startUserInitiatedDebugging = function()
 WebInspector.domContentEventFired = function(time)
 {
     this.panels.audits.mainResourceDOMContentTime = time;
-    if (this.panels.network)
-        this.panels.network.mainResourceDOMContentTime = time;
-    this.extensionServer.notifyPageDOMContentLoaded((time - WebInspector.mainResource.startTime) * 1000);
     this.mainResourceDOMContentTime = time;
 }
 
 WebInspector.loadEventFired = function(time)
 {
     this.panels.audits.mainResourceLoadTime = time;
-    this.panels.network.mainResourceLoadTime = time;
     this.panels.resources.loadEventFired();
-    this.extensionServer.notifyPageLoaded((time - WebInspector.mainResource.startTime) * 1000);
     this.mainResourceLoadTime = time;
 }
 
@@ -1045,8 +1025,8 @@ WebInspector.bringToFront = function()
 WebInspector.inspectedURLChanged = function(url)
 {
     InspectorFrontendHost.inspectedURLChanged(url);
-    this.settings.inspectedURLChanged(url);
-    this.extensionServer.notifyInspectedURLChanged();
+    this.domBreakpointsSidebarPane.setInspectedURL(url);
+    this.extensionServer.notifyInspectedURLChanged(url);
 }
 
 WebInspector.didCreateWorker = function()
@@ -1225,30 +1205,31 @@ WebInspector.displayNameForURL = function(url)
     return url.trimURL(WebInspector.mainResource.domain);
 }
 
-WebInspector._choosePanelToShowSourceLine = function(url, line, preferredPanel)
-{
-    preferredPanel = preferredPanel || "resources";
-
-    var panel = this.panels[preferredPanel];
-    if (panel && panel.canShowSourceLine(url, line))
-        return panel;
-    panel = this.panels.resources;
-    return panel.canShowSourceLine(url, line) ? panel : null;
-}
-
-WebInspector.canShowSourceLine = function(url, line, preferredPanel)
+WebInspector._showAnchorLocation = function(anchor)
 {
-    return !!this._choosePanelToShowSourceLine(url, line, preferredPanel);
+    var preferedPanel = this.panels[anchor.getAttribute("preferred_panel") || "resources"];
+    if (WebInspector._showAnchorLocationInPanel(anchor, preferedPanel))
+        return true;
+    if (preferedPanel !== this.panels.resources && WebInspector._showAnchorLocationInPanel(anchor, this.panels.resources))
+        return true;
+    return false;
 }
 
-WebInspector.showSourceLine = function(url, line, preferredPanel)
+WebInspector._showAnchorLocationInPanel = function(anchor, panel)
 {
-    this.currentPanel = this._choosePanelToShowSourceLine(url, line, preferredPanel);
-    if (!this.currentPanel)
+    if (!panel.canShowAnchorLocation(anchor))
         return false;
+
+    // FIXME: support webkit-html-external-link links here.
+    if (anchor.hasStyleClass("webkit-html-external-link")) {
+        anchor.removeStyleClass("webkit-html-external-link");
+        anchor.addStyleClass("webkit-html-resource-link");
+    }
+
+    this.currentPanel = panel;
     if (this.drawer)
         this.drawer.immediatelyFinishAnimation();
-    this.currentPanel.showSourceLine(url, line);
+    this.currentPanel.showAnchorLocation(anchor);
     return true;
 }
 
@@ -1315,6 +1296,7 @@ WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal, too
     else if (typeof tooltipText !== "string" || tooltipText.length)
         a.title = tooltipText;
     a.textContent = linkText;
+    a.style.maxWidth = "100%";
 
     return a;
 }
@@ -1451,9 +1433,25 @@ WebInspector.isBeingEdited = function(element)
     return element.__editing;
 }
 
+WebInspector.markBeingEdited = function(element, value)
+{
+    if (value) {
+        if (element.__editing)
+            return false;
+        element.__editing = true;
+        WebInspector.__editingCount = (WebInspector.__editingCount || 0) + 1;
+    } else {
+        if (!element.__editing)
+            return false;
+        delete element.__editing;
+        --WebInspector.__editingCount;
+    }
+    return true;
+}
+
 WebInspector.isEditingAnyField = function()
 {
-    return this.__editing;
+    return !!WebInspector.__editingCount;
 }
 
 // Available config fields (all optional):
@@ -1465,10 +1463,8 @@ WebInspector.isEditingAnyField = function()
 // multiline: Boolean - whether the edited element is multiline
 WebInspector.startEditing = function(element, config)
 {
-    if (element.__editing)
+    if (!WebInspector.markBeingEdited(element, true))
         return;
-    element.__editing = true;
-    WebInspector.__editing = true;
 
     config = config || {};
     var committedCallback = config.commitHandler;
@@ -1496,8 +1492,7 @@ WebInspector.startEditing = function(element, config)
     }
 
     function cleanUpAfterEditing() {
-        delete this.__editing;
-        delete WebInspector.__editing;
+        WebInspector.markBeingEdited(element, false);
 
         this.removeStyleClass("editing");
         this.tabIndex = oldTabIndex;
diff --git a/Source/WebCore/inspector/front-end/networkPanel.css b/Source/WebCore/inspector/front-end/networkPanel.css
index 2711347..8ff5e9e 100644
--- a/Source/WebCore/inspector/front-end/networkPanel.css
+++ b/Source/WebCore/inspector/front-end/networkPanel.css
@@ -714,6 +714,22 @@
     display: none;
 }
 
+.resource-headers-view .outline-disclosure li .header-toggle {
+    display: none;
+}
+
+.resource-headers-view .outline-disclosure li.expanded .header-toggle {
+    display: inline;
+    margin-left: 30px;
+    font-weight: normal;
+    color: rgb(45%, 45%, 45%);
+}
+
+.resource-headers-view .outline-disclosure li .header-toggle:hover {
+    color: rgb(20%, 20%, 45%);
+    cursor: pointer;
+}
+
 .resource-headers-view .outline-disclosure .header-name {
     color: rgb(33%, 33%, 33%);
     display: inline-block;
@@ -731,6 +747,11 @@
     margin-top: 1px;
 }
 
+.resource-headers-view .outline-disclosure li.headers-text {
+    text-indent: 0;
+    margin-left: -2px;
+}
+
 .resource-headers-view .outline-disclosure .raw-form-data {
     white-space: pre-wrap;
 }
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index fbfdfbb..839fce5 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -451,6 +451,14 @@ String.prototype.trimURL = function(baseURLDomain)
     return result;
 }
 
+String.prototype.removeURLFragment = function()
+{
+    var fragmentIndex = this.indexOf("#");
+    if (fragmentIndex == -1)
+        fragmentIndex = this.length;
+    return this.substring(0, fragmentIndex);
+}
+
 function isNodeWhitespace()
 {
     if (!this || this.nodeType !== Node.TEXT_NODE)
@@ -592,31 +600,6 @@ function traversePreviousNode(stayWithin)
     return this.parentNode;
 }
 
-function appropriateSelectorForNode(node, justSelector)
-{
-    if (!node)
-        return "";
-
-    var lowerCaseName = node.localName || node.nodeName.toLowerCase();
-
-    var id = node.getAttribute("id");
-    if (id) {
-        var selector = "#" + id;
-        return (justSelector ? selector : lowerCaseName + selector);
-    }
-
-    var className = node.getAttribute("class");
-    if (className) {
-        var selector = "." + className.replace(/\s+/, ".");
-        return (justSelector ? selector : lowerCaseName + selector);
-    }
-
-    if (lowerCaseName === "input" && node.getAttribute("type"))
-        return lowerCaseName + "[type=\"" + node.getAttribute("type") + "\"]";
-
-    return lowerCaseName;
-}
-
 function getDocumentForNode(node)
 {
     return node.nodeType == Node.DOCUMENT_NODE ? node : node.ownerDocument;
diff --git a/Source/WebCore/inspector/generate-inspector-idl b/Source/WebCore/inspector/generate-inspector-idl
index f2f0e35..b5ecb78 100755
--- a/Source/WebCore/inspector/generate-inspector-idl
+++ b/Source/WebCore/inspector/generate-inspector-idl
@@ -81,6 +81,8 @@ type_traits = {
     "object": "Object"
 }
 
+ref_types = {}
+
 macro_traits = {
     "Database": "DATABASE",
     "DOMStorage": "DOM_STORAGE",
@@ -90,34 +92,61 @@ macro_traits = {
     "Profiler": "JAVASCRIPT_DEBUGGER"
 }
 
-def param_type(param):
+def full_qualified_type_id(domain_name, type_id):
+    if type_id.find(".") == -1:
+       return "%s.%s" % (domain_name, type_id)
+    return type_id
+    
+
+def param_type(domain_name, param):
     if "type" in param:
-        return type_traits[param["type"]];
+        return type_traits[param["type"]]
     if "$ref" in param:
-        return "Object"
+        type_id = full_qualified_type_id(domain_name, param["$ref"])
+        if type_id in ref_types:
+            ref_type = ref_types[type_id]
+            return type_traits[ref_type["type"]]
+        else:
+            return "Object"
 
 for domain in json_api:
     domain_name = domain["domain"]
     if domain_name in macro_traits:
         output_file.write("\n#if defined(ENABLE_%s) && ENABLE_%s" % (macro_traits[domain_name], macro_traits[domain_name]))
     output_file.write("\n    interface [Conditional=INSPECTOR] %s {" % domain_name)
+
+    if "types" in domain:
+        for type in domain["types"]:
+            type_id = full_qualified_type_id(domain_name, type["id"])
+            ref_types[type_id] = type;
+
     if "commands" in domain:
         for command in domain["commands"]:
-            params = [];
+            params = []
             if ("parameters" in command):
                 for in_param in command["parameters"]:
-                    params.append("in %s %s" % (param_type(in_param), in_param["name"]))
+                    if ("optional" in in_param):
+                        optional = " [optional]"
+                    else:
+                        optional = ""
+                    params.append("in%s %s %s" % (optional, param_type(domain_name, in_param), in_param["name"]))
             if ("returns" in command):
                 for out_param in command["returns"]:
-                    params.append("out %s %s" % (param_type(out_param), out_param["name"]))
+                    params.append("out %s %s" % (param_type(domain_name, out_param), out_param["name"]))
             output_file.write("\n        void %s(%s);" % (command["name"], ", ".join(params)))
+
     if "events" in domain:
         for event in domain["events"]:
-            params = [];
+            params = []
             if ("parameters" in event):
                 for in_param in event["parameters"]:
-                    params.append("out %s %s" % (param_type(in_param), in_param["name"]))
+                    if ("optional" in in_param):
+                        optional = " [optional]"
+                    else:
+                        optional = ""
+                    params.append("out%s %s %s" % (optional, param_type(domain_name, in_param), in_param["name"]))
             output_file.write("\n        [event] void %s(%s);" % (event["name"], ", ".join(params)))
+
     output_file.write("\n    };")
     if domain["domain"] in macro_traits:
         output_file.write("\n#endif // ENABLE_%s" % macro_traits[domain["domain"]])
diff --git a/Source/WebCore/inspector/inline-javascript-imports.py b/Source/WebCore/inspector/inline-javascript-imports.py
new file mode 100755
index 0000000..5f1d9e4
--- /dev/null
+++ b/Source/WebCore/inspector/inline-javascript-imports.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#         * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#         * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#         * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+# This script replaces calls to importScripts with script sources
+# in input script file and dumps result into output script file.
+
+from cStringIO import StringIO
+
+import os.path
+import re
+import sys
+
+
+def main(argv):
+
+    if len(argv) < 3:
+        print('usage: %s inputFile importsDir outputFile' % argv[0])
+        return 1
+
+    inputFileName = argv[1]
+    importsDir = argv[2]
+    outputFileName = argv[3]
+
+    inputFile = open(inputFileName, 'r')
+    inputScript = inputFile.read()
+    inputFile.close()
+
+    def replace(match):
+        importFileName = match.group(1)
+        fullPath = os.path.join(importsDir, importFileName)
+        if not os.access(fullPath, os.F_OK):
+            raise Exception('File %s referenced in %s not found on any source paths, '
+                            'check source tree for consistency' %
+                            (importFileName, inputFileName))
+        importFile = open(fullPath, 'r')
+        importScript = importFile.read()
+        importFile.close()
+        return importScript
+
+    outputScript = re.sub(r'importScripts\([\'"]([^\'"]+)[\'"]\)', replace, inputScript)
+
+    outputFile = open(outputFileName, 'w')
+    outputFile.write(outputScript)
+    outputFile.close()
+
+    # Touch output file directory to make sure that Xcode will copy
+    # modified resource files.
+    if sys.platform == 'darwin':
+        outputDirName = os.path.dirname(outputFileName)
+        os.utime(outputDirName, None)
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index 121045b..1437adc 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -649,7 +649,7 @@ void DocumentLoader::stopRecordingResponses()
     m_stopRecordingResponses = true;
 }
 
-void DocumentLoader::setTitle(const String& title)
+void DocumentLoader::setTitle(const StringWithDirection& title)
 {
     if (title.isEmpty())
         return;
diff --git a/Source/WebCore/loader/DocumentLoader.h b/Source/WebCore/loader/DocumentLoader.h
index 1f88272..c6f0bc5 100644
--- a/Source/WebCore/loader/DocumentLoader.h
+++ b/Source/WebCore/loader/DocumentLoader.h
@@ -36,6 +36,7 @@
 #include "ResourceError.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
+#include "StringWithDirection.h"
 #include "SubstituteData.h"
 #include "Timer.h"
 #include <wtf/HashSet.h>
@@ -121,7 +122,7 @@ namespace WebCore {
         bool wasOnloadHandled() { return m_wasOnloadHandled; }
         bool isLoadingInAPISense() const;
         void setPrimaryLoadComplete(bool);
-        void setTitle(const String&);
+        void setTitle(const StringWithDirection&);
         void setIconURL(const String&);
         const String& overrideEncoding() const { return m_overrideEncoding; }
 
@@ -168,7 +169,7 @@ namespace WebCore {
         const ResourceRequest& lastCheckedRequest()  { return m_lastCheckedRequest; }
 
         void stopRecordingResponses();
-        const String& title() const { return m_pageTitle; }
+        const StringWithDirection& title() const { return m_pageTitle; }
         const String& iconURL() const { return m_pageIconURL; }
 
         KURL urlForHistory() const;
@@ -298,7 +299,7 @@ namespace WebCore {
         bool m_isClientRedirect;
         bool m_wasOnloadHandled;
 
-        String m_pageTitle;
+        StringWithDirection m_pageTitle;
         String m_pageIconURL;
 
         String m_overrideEncoding;
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index 73c3e80..f02994a 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -232,7 +232,7 @@ void DocumentThreadableLoader::didReceiveResponse(SubresourceLoader* loader, con
     }
 }
 
-void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const char* data, int lengthReceived)
+void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const char* data, int dataLength)
 {
     ASSERT(m_client);
     ASSERT_UNUSED(loader, loader == m_loader);
@@ -241,10 +241,10 @@ void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const c
     if (m_actualRequest)
         return;
 
-    m_client->didReceiveData(data, lengthReceived);
+    m_client->didReceiveData(data, dataLength);
 }
 
-void DocumentThreadableLoader::didReceiveCachedMetadata(SubresourceLoader* loader, const char* data, int lengthReceived)
+void DocumentThreadableLoader::didReceiveCachedMetadata(SubresourceLoader* loader, const char* data, int dataLength)
 {
     ASSERT(m_client);
     ASSERT_UNUSED(loader, loader == m_loader);
@@ -253,7 +253,7 @@ void DocumentThreadableLoader::didReceiveCachedMetadata(SubresourceLoader* loade
     if (m_actualRequest)
         return;
 
-    m_client->didReceiveCachedMetadata(data, lengthReceived);
+    m_client->didReceiveCachedMetadata(data, dataLength);
 }
 
 void DocumentThreadableLoader::didFinishLoading(SubresourceLoader* loader, double finishTime)
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.h b/Source/WebCore/loader/DocumentThreadableLoader.h
index c511306..50f60ca 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.h
+++ b/Source/WebCore/loader/DocumentThreadableLoader.h
@@ -76,8 +76,8 @@ namespace WebCore {
         virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
 
         virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&);
-        virtual void didReceiveData(SubresourceLoader*, const char*, int lengthReceived);
-        virtual void didReceiveCachedMetadata(SubresourceLoader*, const char*, int lengthReceived);
+        virtual void didReceiveData(SubresourceLoader*, const char*, int dataLength);
+        virtual void didReceiveCachedMetadata(SubresourceLoader*, const char*, int dataLength);
         virtual void didFinishLoading(SubresourceLoader*, double);
         virtual void didFail(SubresourceLoader*, const ResourceError&);
 
diff --git a/Source/WebCore/loader/DocumentWriter.cpp b/Source/WebCore/loader/DocumentWriter.cpp
index af9ea53..2fc02d1 100644
--- a/Source/WebCore/loader/DocumentWriter.cpp
+++ b/Source/WebCore/loader/DocumentWriter.cpp
@@ -121,6 +121,8 @@ void DocumentWriter::begin(const KURL& url, bool dispatch, SecurityOrigin* origi
     if (document->isPluginDocument() && m_frame->loader()->isSandboxed(SandboxPlugins))
         document = SinkDocument::create(m_frame, url);
 
+    // FIXME: Do we need to consult the content security policy here about blocked plug-ins?
+
     bool resetScripting = !(m_frame->loader()->stateMachine()->isDisplayingInitialEmptyDocument() && m_frame->document()->securityOrigin()->isSecureTransitionTo(url));
     m_frame->loader()->clear(resetScripting, resetScripting);
     clear();
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index cabb4ae..f082317 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -196,6 +196,10 @@ public:
     virtual NotificationPresenter* notificationPresenter() const { return 0; }
 #endif
 
+#if ENABLE(DIRECTORY_UPLOAD)
+    virtual void enumerateChosenDirectory(const String&, FileChooser*) { }
+#endif
+
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }
     virtual void chooseIconForFiles(const Vector<String>&, FileChooser*) { }
 
@@ -270,7 +274,7 @@ public:
     virtual void dispatchWillClose() { }
     virtual void dispatchDidReceiveIcon() { }
     virtual void dispatchDidStartProvisionalLoad() { }
-    virtual void dispatchDidReceiveTitle(const String&) { }
+    virtual void dispatchDidReceiveTitle(const StringWithDirection&) { }
     virtual void dispatchDidChangeIcons() { }
     virtual void dispatchDidCommitLoad() { }
     virtual void dispatchDidFailProvisionalLoad(const ResourceError&) { }
@@ -338,7 +342,7 @@ public:
     virtual void prepareForDataSourceReplacement() { }
 
     virtual PassRefPtr<DocumentLoader> createDocumentLoader(const ResourceRequest& request, const SubstituteData& substituteData) { return DocumentLoader::create(request, substituteData); }
-    virtual void setTitle(const String&, const KURL&) { }
+    virtual void setTitle(const StringWithDirection&, const KURL&) { }
 
     virtual String userAgent(const KURL&) { return ""; }
 
@@ -415,11 +419,11 @@ public:
     virtual void checkGrammarOfString(const UChar*, int, Vector<GrammarDetail>&, int*, int*) { }
 
 #if USE(UNIFIED_TEXT_CHECKING)
-    virtual void checkTextOfParagraph(const UChar*, int, uint64_t, Vector<TextCheckingResult>&) { };
+    virtual void checkTextOfParagraph(const UChar*, int, TextCheckingTypeMask, Vector<TextCheckingResult>&) { };
 #endif
 
     virtual void getGuessesForWord(const String&, const String&, Vector<String>&) { }
-    virtual void requestCheckingOfString(SpellChecker*, int, const String&) { }
+    virtual void requestCheckingOfString(SpellChecker*, int, TextCheckingTypeMask, const String&) { }
 };
 
 class EmptyEditorClient : public EditorClient {
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 6819e71..dcaf03a 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -615,7 +615,7 @@ void FrameLoader::receivedFirstData()
     dispatchDidClearWindowObjectsInAllWorlds();
     
     if (m_documentLoader) {
-        String ptitle = m_documentLoader->title();
+        StringWithDirection ptitle = m_documentLoader->title();
         // If we have a title let the WebView know about it.
         if (!ptitle.isNull())
             m_client->dispatchDidReceiveTitle(ptitle);
@@ -712,10 +712,10 @@ void FrameLoader::startIconLoader()
     if (urlString.isEmpty())
         return;
 
-    // People who want to avoid loading images generally want to avoid loading all images.
+    // People who want to avoid loading images generally want to avoid loading all images, unless an exception has been made for site icons.
     // Now that we've accounted for URL mapping, avoid starting the network load if images aren't set to display automatically.
     Settings* settings = m_frame->settings();
-    if (settings && !settings->loadsImagesAutomatically())
+    if (settings && !settings->loadsImagesAutomatically() && !settings->loadsSiteIconsIgnoringImageLoadingSetting())
         return;
 
     // If we're reloading the page, always start the icon load now.
@@ -798,11 +798,11 @@ void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 
 void FrameLoader::finishedParsing()
 {
+    m_frame->injectUserScripts(InjectAtDocumentEnd);
+
     if (m_stateMachine.creatingInitialEmptyDocument())
         return;
 
-    m_frame->injectUserScripts(InjectAtDocumentEnd);
-
     // This can be called from the Frame's destructor, in which case we shouldn't protect ourselves
     // because doing so will cause us to re-enter the destructor when protector goes out of scope.
     // Null-checking the FrameView indicates whether or not we're in the destructor.
@@ -1478,6 +1478,11 @@ void FrameLoader::load(DocumentLoader* newDocumentLoader)
     // shouldn't a more explicit type of reload be defined, that means roughly 
     // "load without affecting history" ? 
     if (shouldReloadToHandleUnreachableURL(newDocumentLoader)) {
+        // shouldReloadToHandleUnreachableURL() returns true only when the original load type is back-forward.
+        // In this case we should save the document state now. Otherwise the state can be lost because load type is
+        // changed and updateForBackForwardNavigation() will not be called when loading is committed.
+        history()->saveDocumentAndScrollState();
+
         ASSERT(type == FrameLoadTypeStandard);
         type = FrameLoadTypeReload;
     }
@@ -1936,9 +1941,9 @@ void FrameLoader::commitProvisionalLoad()
         dispatchDidCommitLoad();
 
         // If we have a title let the WebView know about it. 
-        String title = m_documentLoader->title();
-        if (!title.isNull()) 
-            m_client->dispatchDidReceiveTitle(title);         
+        StringWithDirection title = m_documentLoader->title();
+        if (!title.isNull())
+            m_client->dispatchDidReceiveTitle(title);
 
         checkCompleted();
     } else {        
@@ -2839,7 +2844,8 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
         }
 #endif
     }
-    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), static_cast<int>(response.expectedContentLength()), error);
+    int encodedDataLength = response.resourceLoadInfo() ? static_cast<int>(response.resourceLoadInfo()->encodedDataLength) : -1;
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), encodedDataLength, error);
     return identifier;
 }
 
@@ -3393,7 +3399,7 @@ bool FrameLoader::canAuthenticateAgainstProtectionSpace(ResourceLoader* loader,
 }
 #endif
 
-void FrameLoader::setTitle(const String& title)
+void FrameLoader::setTitle(const StringWithDirection& title)
 {
     documentLoader()->setTitle(title);
 }
diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
index 1fb9e3c..ae4c6d3 100644
--- a/Source/WebCore/loader/FrameLoader.h
+++ b/Source/WebCore/loader/FrameLoader.h
@@ -38,6 +38,7 @@
 #include "IconDatabaseBase.h"
 #include "PolicyChecker.h"
 #include "ResourceLoadNotifier.h"
+#include "ScriptValue.h"
 #include "SubframeLoader.h"
 #include "ThreadableLoader.h"
 #include "Timer.h"
@@ -78,6 +79,7 @@ class ScriptValue;
 class SecurityOrigin;
 class SerializedScriptValue;
 class SharedBuffer;
+class StringWithDirection;
 class SubstituteData;
 class TextResourceDecoder;
 
@@ -282,7 +284,7 @@ public:
 
     void cancelAndClear();
 
-    void setTitle(const String&);
+    void setTitle(const StringWithDirection&);
     void setIconURL(const String&);
 
     void commitProvisionalLoad();
diff --git a/Source/WebCore/loader/FrameLoaderClient.h b/Source/WebCore/loader/FrameLoaderClient.h
index e89056d..3709335 100644
--- a/Source/WebCore/loader/FrameLoaderClient.h
+++ b/Source/WebCore/loader/FrameLoaderClient.h
@@ -84,6 +84,7 @@ namespace WebCore {
     class ResourceResponse;
     class SecurityOrigin;
     class SharedBuffer;
+    class StringWithDirection;
     class SubstituteData;
     class Widget;
 
@@ -122,7 +123,7 @@ namespace WebCore {
         virtual bool canAuthenticateAgainstProtectionSpace(DocumentLoader*, unsigned long identifier, const ProtectionSpace&) = 0;
 #endif
         virtual void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&) = 0;
-        virtual void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived) = 0;
+        virtual void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int dataLength) = 0;
         virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier) = 0;
         virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&) = 0;
         virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length) = 0;
@@ -139,7 +140,7 @@ namespace WebCore {
         virtual void dispatchWillClose() = 0;
         virtual void dispatchDidReceiveIcon() = 0;
         virtual void dispatchDidStartProvisionalLoad() = 0;
-        virtual void dispatchDidReceiveTitle(const String& title) = 0;
+        virtual void dispatchDidReceiveTitle(const StringWithDirection&) = 0;
         virtual void dispatchDidChangeIcons() = 0;
         virtual void dispatchDidCommitLoad() = 0;
         virtual void dispatchDidFailProvisionalLoad(const ResourceError&) = 0;
@@ -227,7 +228,7 @@ namespace WebCore {
         virtual void prepareForDataSourceReplacement() = 0;
 
         virtual PassRefPtr<DocumentLoader> createDocumentLoader(const ResourceRequest&, const SubstituteData&) = 0;
-        virtual void setTitle(const String& title, const KURL&) = 0;
+        virtual void setTitle(const StringWithDirection&, const KURL&) = 0;
 
         virtual String userAgent(const KURL&) = 0;
         
diff --git a/Source/WebCore/loader/HistoryController.cpp b/Source/WebCore/loader/HistoryController.cpp
index b8bece9..f9d85bc 100644
--- a/Source/WebCore/loader/HistoryController.cpp
+++ b/Source/WebCore/loader/HistoryController.cpp
@@ -79,7 +79,7 @@ void HistoryController::saveScrollPositionAndViewStateToItem(HistoryItem* item)
     if (!item || !m_frame->view())
         return;
         
-    item->setScrollPoint(m_frame->view()->scrollPosition());
+    item->setScrollPoint(m_frame->view()->cachedScrollPosition());
     item->setPageScaleFactor(m_frame->pageScaleFactor());
     
     // FIXME: It would be great to work out a way to put this code in WebCore instead of calling through to the client.
@@ -265,7 +265,7 @@ void HistoryController::updateForBackForwardNavigation()
 {
 #if !LOG_DISABLED
     if (m_frame->loader()->documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+        LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", m_frame->loader()->documentLoader()->title().string().utf8().data());
 #endif
 
     // Must grab the current scroll position before disturbing it
@@ -281,7 +281,7 @@ void HistoryController::updateForReload()
 {
 #if !LOG_DISABLED
     if (m_frame->loader()->documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for reload in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+        LOG(History, "WebCoreHistory: Updating History for reload in frame %s", m_frame->loader()->documentLoader()->title().string().utf8().data());
 #endif
 
     if (m_currentItem) {
@@ -343,7 +343,7 @@ void HistoryController::updateForRedirectWithLockedBackForwardList()
 {
 #if !LOG_DISABLED
     if (m_frame->loader()->documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", m_frame->loader()->documentLoader()->title().string().utf8().data());
 #endif
     
     Settings* settings = m_frame->settings();
@@ -385,7 +385,7 @@ void HistoryController::updateForClientRedirect()
 {
 #if !LOG_DISABLED
     if (m_frame->loader()->documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for client redirect in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+        LOG(History, "WebCoreHistory: Updating History for client redirect in frame %s", m_frame->loader()->documentLoader()->title().string().utf8().data());
 #endif
 
     // Clear out form data so we don't try to restore it into the incoming page.  Must happen after
@@ -410,7 +410,7 @@ void HistoryController::updateForCommit()
     FrameLoader* frameLoader = m_frame->loader();
 #if !LOG_DISABLED
     if (frameLoader->documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for commit in frame %s", frameLoader->documentLoader()->title().utf8().data());
+        LOG(History, "WebCoreHistory: Updating History for commit in frame %s", frameLoader->documentLoader()->title().string().utf8().data());
 #endif
     FrameLoadType type = frameLoader->loadType();
     if (isBackForwardLoadType(type)
@@ -526,10 +526,11 @@ void HistoryController::setCurrentItem(HistoryItem* item)
     m_currentItem = item;
 }
 
-void HistoryController::setCurrentItemTitle(const String& title)
+void HistoryController::setCurrentItemTitle(const StringWithDirection& title)
 {
     if (m_currentItem)
-        m_currentItem->setTitle(title);
+        // FIXME: make use of title.direction() as well.
+        m_currentItem->setTitle(title.string());
 }
 
 bool HistoryController::currentItemShouldBeReplaced() const
@@ -576,12 +577,13 @@ void HistoryController::initializeItem(HistoryItem* item)
     
     Frame* parentFrame = m_frame->tree()->parent();
     String parent = parentFrame ? parentFrame->tree()->uniqueName() : "";
-    String title = documentLoader->title();
+    StringWithDirection title = documentLoader->title();
 
     item->setURL(url);
     item->setTarget(m_frame->tree()->uniqueName());
     item->setParent(parent);
-    item->setTitle(title);
+    // FIXME: should store title directionality in history as well.
+    item->setTitle(title.string());
     item->setOriginalURLString(originalURL.string());
 
     if (!unreachableURL.isEmpty() || documentLoader->response().httpStatusCode() >= 400)
@@ -797,6 +799,10 @@ void HistoryController::pushState(PassRefPtr<SerializedScriptValue> stateObject,
     m_currentItem->setURLString(urlString);
 
     page->backForward()->addItem(topItem.release());
+
+    addVisitedLink(page, KURL(ParsedURLString, urlString));
+    m_frame->loader()->client()->updateGlobalHistory();
+
 }
 
 void HistoryController::replaceState(PassRefPtr<SerializedScriptValue> stateObject, const String& title, const String& urlString)
@@ -808,6 +814,10 @@ void HistoryController::replaceState(PassRefPtr<SerializedScriptValue> stateObje
         m_currentItem->setURLString(urlString);
     m_currentItem->setTitle(title);
     m_currentItem->setStateObject(stateObject);
+
+    ASSERT(m_frame->page());
+    addVisitedLink(m_frame->page(), KURL(ParsedURLString, urlString));
+    m_frame->loader()->client()->updateGlobalHistory();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/loader/HistoryController.h b/Source/WebCore/loader/HistoryController.h
index 59f11a2..15e12c0 100644
--- a/Source/WebCore/loader/HistoryController.h
+++ b/Source/WebCore/loader/HistoryController.h
@@ -40,6 +40,7 @@ namespace WebCore {
 class Frame;
 class HistoryItem;
 class SerializedScriptValue;
+class StringWithDirection;
 
 class HistoryController {
     WTF_MAKE_NONCOPYABLE(HistoryController);
@@ -71,7 +72,7 @@ public:
 
     HistoryItem* currentItem() const { return m_currentItem.get(); }
     void setCurrentItem(HistoryItem*);
-    void setCurrentItemTitle(const String&);
+    void setCurrentItemTitle(const StringWithDirection&);
     bool currentItemShouldBeReplaced() const;
 
     HistoryItem* previousItem() const { return m_previousItem.get(); }
diff --git a/Source/WebCore/loader/MainResourceLoader.cpp b/Source/WebCore/loader/MainResourceLoader.cpp
index 0cdbc21..2078fdc 100644
--- a/Source/WebCore/loader/MainResourceLoader.cpp
+++ b/Source/WebCore/loader/MainResourceLoader.cpp
@@ -31,6 +31,7 @@
 #include "MainResourceLoader.h"
 
 #include "ApplicationCacheHost.h"
+#include "DOMWindow.h"
 #include "Document.h"
 #include "DocumentLoadTiming.h"
 #include "DocumentLoader.h"
@@ -39,6 +40,7 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "HTMLFormElement.h"
+#include "InspectorInstrumentation.h"
 #include "Page.h"
 #if PLATFORM(QT)
 #include "PluginDatabase.h"
@@ -262,6 +264,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
             receivedError(cannotShowURLError());
             return;
         }
+        InspectorInstrumentation::continueWithPolicyDownload(m_frame.get(), documentLoader(), identifier(), r);
         frameLoader()->client()->download(m_handle.get(), request(), m_handle.get()->firstRequest(), r);
         // It might have gone missing
         if (frameLoader())
@@ -269,6 +272,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
         return;
 
     case PolicyIgnore:
+        InspectorInstrumentation::continueWithPolicyIgnore(m_frame.get(), documentLoader(), identifier(), r);
         stopLoadingForPolicyChange();
         return;
     
@@ -355,6 +359,10 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     if (it != r.httpHeaderFields().end()) {
         String content = it->second;
         if (m_frame->loader()->shouldInterruptLoadForXFrameOptions(content, r.url())) {
+            InspectorInstrumentation::continueAfterXFrameOptionsDenied(m_frame.get(), documentLoader(), identifier(), r);
+            DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to display document because display forbidden by X-Frame-Options.\n"));
+            m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
+
             cancel();
             return;
         }
@@ -411,7 +419,7 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     frameLoader()->policyChecker()->checkContentPolicy(m_response, callContinueAfterContentPolicy, this);
 }
 
-void MainResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
+void MainResourceLoader::didReceiveData(const char* data, int length, long long encodedDataLength, bool allAtOnce)
 {
     ASSERT(data);
     ASSERT(length != 0);
@@ -434,7 +442,7 @@ void MainResourceLoader::didReceiveData(const char* data, int length, long long
 #endif
  
  #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    documentLoader()->applicationCacheHost()->mainResourceDataReceived(data, length, lengthReceived, allAtOnce);
+    documentLoader()->applicationCacheHost()->mainResourceDataReceived(data, length, encodedDataLength, allAtOnce);
 #endif
 
     // The additional processing can do anything including possibly removing the last
@@ -443,7 +451,7 @@ void MainResourceLoader::didReceiveData(const char* data, int length, long long
 
     m_timeOfLastDataReceived = currentTime();
 
-    ResourceLoader::didReceiveData(data, length, lengthReceived, allAtOnce);
+    ResourceLoader::didReceiveData(data, length, encodedDataLength, allAtOnce);
 }
 
 void MainResourceLoader::didFinishLoading(double finishTime)
diff --git a/Source/WebCore/loader/MainResourceLoader.h b/Source/WebCore/loader/MainResourceLoader.h
index 1620f7a..73e7cfd 100644
--- a/Source/WebCore/loader/MainResourceLoader.h
+++ b/Source/WebCore/loader/MainResourceLoader.h
@@ -57,7 +57,7 @@ namespace WebCore {
 
         virtual void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didReceiveResponse(const ResourceResponse&);
-        virtual void didReceiveData(const char*, int, long long lengthReceived, bool allAtOnce);
+        virtual void didReceiveData(const char*, int, long long encodedDataLength, bool allAtOnce);
         virtual void didFinishLoading(double finishTime);
         virtual void didFail(const ResourceError&);
 
diff --git a/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp b/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp
index 75a2fe9..97a3ce6 100644
--- a/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp
+++ b/Source/WebCore/loader/NetscapePlugInStreamLoader.cpp
@@ -92,13 +92,13 @@ void NetscapePlugInStreamLoader::didReceiveResponse(const ResourceResponse& resp
         didCancel(frameLoader()->fileDoesNotExistError(response));
 }
 
-void NetscapePlugInStreamLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
+void NetscapePlugInStreamLoader::didReceiveData(const char* data, int length, long long encodedDataLength, bool allAtOnce)
 {
     RefPtr<NetscapePlugInStreamLoader> protect(this);
 
     m_client->didReceiveData(this, data, length);
     
-    ResourceLoader::didReceiveData(data, length, lengthReceived, allAtOnce);
+    ResourceLoader::didReceiveData(data, length, encodedDataLength, allAtOnce);
 }
 
 void NetscapePlugInStreamLoader::didFinishLoading(double finishTime)
diff --git a/Source/WebCore/loader/NetscapePlugInStreamLoader.h b/Source/WebCore/loader/NetscapePlugInStreamLoader.h
index 8db555e..1e7c629 100644
--- a/Source/WebCore/loader/NetscapePlugInStreamLoader.h
+++ b/Source/WebCore/loader/NetscapePlugInStreamLoader.h
@@ -57,7 +57,7 @@ namespace WebCore {
 
     private:
         virtual void didReceiveResponse(const ResourceResponse&);
-        virtual void didReceiveData(const char*, int, long long lengthReceived, bool allAtOnce);
+        virtual void didReceiveData(const char*, int, long long encodedDataLength, bool allAtOnce);
         virtual void didFinishLoading(double finishTime);
         virtual void didFail(const ResourceError&);
 
diff --git a/Source/WebCore/loader/ResourceLoadNotifier.cpp b/Source/WebCore/loader/ResourceLoadNotifier.cpp
index 3a02aa3..ea6cf22 100644
--- a/Source/WebCore/loader/ResourceLoadNotifier.cpp
+++ b/Source/WebCore/loader/ResourceLoadNotifier.cpp
@@ -74,12 +74,12 @@ void ResourceLoadNotifier::didReceiveResponse(ResourceLoader* loader, const Reso
     dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
 }
 
-void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int dataLength, int lengthReceived)
+void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int dataLength, int encodedDataLength)
 {
     if (Page* page = m_frame->page())
         page->progress()->incrementProgress(loader->identifier(), data, dataLength);
 
-    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), dataLength, lengthReceived);
+    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), dataLength, encodedDataLength);
 }
 
 void ResourceLoadNotifier::didFinishLoad(ResourceLoader* loader, double finishTime)
@@ -130,11 +130,11 @@ void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, un
     InspectorInstrumentation::didReceiveResourceResponse(cookie, identifier, loader, r);
 }
 
-void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int dataLength, int lengthReceived)
+void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int dataLength, int encodedDataLength)
 {
     m_frame->loader()->client()->dispatchDidReceiveContentLength(loader, identifier, dataLength);
 
-    InspectorInstrumentation::didReceiveContentLength(m_frame, identifier, dataLength, lengthReceived);
+    InspectorInstrumentation::didReceiveContentLength(m_frame, identifier, dataLength, encodedDataLength);
 }
 
 void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier, double finishTime)
@@ -152,13 +152,13 @@ void ResourceLoadNotifier::dispatchTransferLoadingResourceFromPage(unsigned long
     oldPage->progress()->completeProgress(identifier);
 }
 
-void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int dataLength, int lengthReceived, const ResourceError& error)
+void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int dataLength, int encodedDataLength, const ResourceError& error)
 {
     if (!response.isNull())
         dispatchDidReceiveResponse(loader, identifier, response);
 
     if (dataLength > 0)
-        dispatchDidReceiveContentLength(loader, identifier, dataLength, lengthReceived);
+        dispatchDidReceiveContentLength(loader, identifier, dataLength, encodedDataLength);
 
     if (error.isNull())
         dispatchDidFinishLoading(loader, identifier, 0);
diff --git a/Source/WebCore/loader/ResourceLoadNotifier.h b/Source/WebCore/loader/ResourceLoadNotifier.h
index 5753c28..dafd619 100644
--- a/Source/WebCore/loader/ResourceLoadNotifier.h
+++ b/Source/WebCore/loader/ResourceLoadNotifier.h
@@ -53,18 +53,18 @@ public:
 
     void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
-    void didReceiveData(ResourceLoader*, const char*, int dataLength, int lengthReceived);
+    void didReceiveData(ResourceLoader*, const char*, int dataLength, int encodedDataLength);
     void didFinishLoad(ResourceLoader*, double finishTime);
     void didFailToLoad(ResourceLoader*, const ResourceError&);
 
     void assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
     void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
     void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int dataLength, int lengthReceived);
+    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int dataLength, int encodedDataLength);
     void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier, double finishTime);
     void dispatchTransferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*);
 
-    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int dataLength, int lengthReceived, const ResourceError&);
+    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int dataLength, int encodedDataLength, const ResourceError&);
 
 private:
     Frame* m_frame;
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.cpp b/Source/WebCore/loader/ResourceLoadScheduler.cpp
index 7cceff7..0c0abb1 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.cpp
+++ b/Source/WebCore/loader/ResourceLoadScheduler.cpp
@@ -183,7 +183,7 @@ void ResourceLoadScheduler::servePendingRequests(HostInformation* host, Resource
     LOG(ResourceLoading, "ResourceLoadScheduler::servePendingRequests HostInformation.m_name='%s'", host->name().latin1().data());
 
     for (int priority = ResourceLoadPriorityHighest; priority >= minimumPriority; --priority) {
-        HostInformation::RequestQueue& requestsPending = host->requestsPending((ResourceLoadPriority) priority);
+        HostInformation::RequestQueue& requestsPending = host->requestsPending(ResourceLoadPriority(priority));
 
         while (!requestsPending.isEmpty()) {
             RefPtr<ResourceLoader> resourceLoader = requestsPending.first();
@@ -193,7 +193,7 @@ void ResourceLoadScheduler::servePendingRequests(HostInformation* host, Resource
             // and we don't know all stylesheets yet.
             Document* document = resourceLoader->frameLoader() ? resourceLoader->frameLoader()->frame()->document() : 0;
             bool shouldLimitRequests = !host->name().isNull() || (document && (document->parsing() || !document->haveStylesheetsLoaded()));
-            if (shouldLimitRequests && host->limitRequests())
+            if (shouldLimitRequests && host->limitRequests(ResourceLoadPriority(priority)))
                 return;
 
             requestsPending.removeFirst();
@@ -283,8 +283,10 @@ bool ResourceLoadScheduler::HostInformation::hasRequests() const
     return false;
 }
 
-bool ResourceLoadScheduler::HostInformation::limitRequests() const 
-{ 
+bool ResourceLoadScheduler::HostInformation::limitRequests(ResourceLoadPriority priority) const 
+{
+    if (priority == ResourceLoadPriorityVeryLow && !m_requestsLoading.isEmpty())
+        return true;
     return m_requestsLoading.size() >= (resourceLoadScheduler()->isSerialLoadingEnabled() ? 1 : m_maxRequestsInFlight);
 }
 
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.h b/Source/WebCore/loader/ResourceLoadScheduler.h
index 49a4546..a32b307 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.h
+++ b/Source/WebCore/loader/ResourceLoadScheduler.h
@@ -82,7 +82,7 @@ private:
         void addLoadInProgress(ResourceLoader*);
         void remove(ResourceLoader*);
         bool hasRequests() const;
-        bool limitRequests() const;
+        bool limitRequests(ResourceLoadPriority) const;
 
         typedef Deque<RefPtr<ResourceLoader> > RequestQueue;
         RequestQueue& requestsPending(ResourceLoadPriority priority) { return m_requestsPending[priority]; }
diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
index 78c86d9..5172e92 100644
--- a/Source/WebCore/loader/ResourceLoader.cpp
+++ b/Source/WebCore/loader/ResourceLoader.cpp
@@ -273,7 +273,7 @@ void ResourceLoader::didReceiveResponse(const ResourceResponse& r)
         frameLoader()->notifier()->didReceiveResponse(this, m_response);
 }
 
-void ResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
+void ResourceLoader::didReceiveData(const char* data, int length, long long encodedDataLength, bool allAtOnce)
 {
     // The following assertions are not quite valid here, since a subclass
     // might override didReceiveData in a way that invalidates them. This
@@ -290,7 +290,7 @@ void ResourceLoader::didReceiveData(const char* data, int length, long long leng
     // However, with today's computers and networking speeds, this won't happen in practice.
     // Could be an issue with a giant local file.
     if (m_sendResourceLoadCallbacks && m_frame)
-        frameLoader()->notifier()->didReceiveData(this, data, length, static_cast<int>(lengthReceived));
+        frameLoader()->notifier()->didReceiveData(this, data, length, static_cast<int>(encodedDataLength));
 }
 
 void ResourceLoader::willStopBufferingData(const char* data, int length)
@@ -433,10 +433,10 @@ void ResourceLoader::didReceiveResponse(ResourceHandle*, const ResourceResponse&
     didReceiveResponse(response);
 }
 
-void ResourceLoader::didReceiveData(ResourceHandle*, const char* data, int length, int lengthReceived)
+void ResourceLoader::didReceiveData(ResourceHandle*, const char* data, int length, int encodedDataLength)
 {
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceData(m_frame.get(), identifier());
-    didReceiveData(data, length, lengthReceived, false);
+    didReceiveData(data, length, encodedDataLength, false);
     InspectorInstrumentation::didReceiveResourceData(cookie);
 }
 
diff --git a/Source/WebCore/loader/ResourceLoader.h b/Source/WebCore/loader/ResourceLoader.h
index 339b130..571f568 100644
--- a/Source/WebCore/loader/ResourceLoader.h
+++ b/Source/WebCore/loader/ResourceLoader.h
@@ -83,7 +83,7 @@ namespace WebCore {
         virtual void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
         virtual void didReceiveResponse(const ResourceResponse&);
-        virtual void didReceiveData(const char*, int, long long lengthReceived, bool allAtOnce);
+        virtual void didReceiveData(const char*, int, long long encodedDataLength, bool allAtOnce);
         virtual void didReceiveCachedMetadata(const char*, int) { }
         void willStopBufferingData(const char*, int);
         virtual void didFinishLoading(double finishTime);
@@ -104,7 +104,7 @@ namespace WebCore {
         virtual void willSendRequest(ResourceHandle*, ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(ResourceHandle*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
         virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-        virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
+        virtual void didReceiveData(ResourceHandle*, const char*, int, int encodedDataLength);
         virtual void didReceiveCachedMetadata(ResourceHandle*, const char* data, int length) { didReceiveCachedMetadata(data, length); }
         virtual void didFinishLoading(ResourceHandle*, double finishTime);
         virtual void didFail(ResourceHandle*, const ResourceError&);
diff --git a/Source/WebCore/loader/SubframeLoader.cpp b/Source/WebCore/loader/SubframeLoader.cpp
index e7f851f..d290765 100644
--- a/Source/WebCore/loader/SubframeLoader.cpp
+++ b/Source/WebCore/loader/SubframeLoader.cpp
@@ -33,6 +33,7 @@
 #include "config.h"
 #include "SubframeLoader.h"
 
+#include "ContentSecurityPolicy.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "HTMLAppletElement.h"
@@ -109,8 +110,12 @@ bool SubframeLoader::requestPlugin(HTMLPlugInImageElement* ownerElement, const K
         || (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
         return false;
 
-    if (m_frame->document() && m_frame->document()->securityOrigin()->isSandboxed(SandboxPlugins))
-        return false;
+    if (m_frame->document()) {
+        if (m_frame->document()->securityOrigin()->isSandboxed(SandboxPlugins))
+            return false;
+        if (!m_frame->document()->contentSecurityPolicy()->allowObjectFromSource(url))
+            return false;
+    }
 
     ASSERT(ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag));
     return loadPlugin(ownerElement, url, mimeType, paramNames, paramValues, useFallback);
diff --git a/Source/WebCore/loader/SubresourceLoader.cpp b/Source/WebCore/loader/SubresourceLoader.cpp
index cfe8d0a..3e37c1c 100644
--- a/Source/WebCore/loader/SubresourceLoader.cpp
+++ b/Source/WebCore/loader/SubresourceLoader.cpp
@@ -154,13 +154,13 @@ void SubresourceLoader::didReceiveResponse(const ResourceResponse& r)
     }
 }
 
-void SubresourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
+void SubresourceLoader::didReceiveData(const char* data, int length, long long encodedDataLength, bool allAtOnce)
 {
     // Reference the object in this method since the additional processing can do
     // anything including removing the last reference to this object; one example of this is 3266216.
     RefPtr<SubresourceLoader> protect(this);
     
-    ResourceLoader::didReceiveData(data, length, lengthReceived, allAtOnce);
+    ResourceLoader::didReceiveData(data, length, encodedDataLength, allAtOnce);
 
     // A subresource loader does not load multipart sections progressively.
     // So don't deliver any data to the loader yet.
diff --git a/Source/WebCore/loader/SubresourceLoader.h b/Source/WebCore/loader/SubresourceLoader.h
index b3aefb6..a33b166 100644
--- a/Source/WebCore/loader/SubresourceLoader.h
+++ b/Source/WebCore/loader/SubresourceLoader.h
@@ -52,7 +52,7 @@ namespace WebCore {
         virtual void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
         virtual void didReceiveResponse(const ResourceResponse&);
-        virtual void didReceiveData(const char*, int, long long lengthReceived, bool allAtOnce);
+        virtual void didReceiveData(const char*, int, long long encodedDataLength, bool allAtOnce);
         virtual void didReceiveCachedMetadata(const char*, int);
         virtual void didFinishLoading(double finishTime);
         virtual void didFail(const ResourceError&);
diff --git a/Source/WebCore/loader/SubresourceLoaderClient.h b/Source/WebCore/loader/SubresourceLoaderClient.h
index c4b082c..53ac561 100644
--- a/Source/WebCore/loader/SubresourceLoaderClient.h
+++ b/Source/WebCore/loader/SubresourceLoaderClient.h
@@ -46,8 +46,8 @@ public:
     virtual void didSendData(SubresourceLoader*, unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
 
     virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&) { }
-    virtual void didReceiveData(SubresourceLoader*, const char*, int /*lengthReceived*/) { }
-    virtual void didReceiveCachedMetadata(SubresourceLoader*, const char*, int /*lengthReceived*/) { }
+    virtual void didReceiveData(SubresourceLoader*, const char*, int /*dataLength*/) { }
+    virtual void didReceiveCachedMetadata(SubresourceLoader*, const char*, int /*dataLength*/) { }
     virtual void didFinishLoading(SubresourceLoader*, double /*finishTime*/) { }
     virtual void didFail(SubresourceLoader*, const ResourceError&) { }
     
diff --git a/Source/WebCore/loader/WorkerThreadableLoader.cpp b/Source/WebCore/loader/WorkerThreadableLoader.cpp
index d753ecb..6672eee 100644
--- a/Source/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/Source/WebCore/loader/WorkerThreadableLoader.cpp
@@ -191,10 +191,10 @@ static void workerContextDidReceiveData(ScriptExecutionContext* context, RefPtr<
     workerClientWrapper->didReceiveData(vectorData->data(), vectorData->size());
 }
 
-void WorkerThreadableLoader::MainThreadBridge::didReceiveData(const char* data, int lengthReceived)
+void WorkerThreadableLoader::MainThreadBridge::didReceiveData(const char* data, int dataLength)
 {
-    OwnPtr<Vector<char> > vector = adoptPtr(new Vector<char>(lengthReceived)); // needs to be an OwnPtr for usage with createCallbackTask.
-    memcpy(vector->data(), data, lengthReceived);
+    OwnPtr<Vector<char> > vector = adoptPtr(new Vector<char>(dataLength)); // needs to be an OwnPtr for usage with createCallbackTask.
+    memcpy(vector->data(), data, dataLength);
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector.release()), m_taskMode);
 }
 
@@ -204,10 +204,10 @@ static void workerContextDidReceiveCachedMetadata(ScriptExecutionContext* contex
     workerClientWrapper->didReceiveCachedMetadata(vectorData->data(), vectorData->size());
 }
 
-void WorkerThreadableLoader::MainThreadBridge::didReceiveCachedMetadata(const char* data, int lengthReceived)
+void WorkerThreadableLoader::MainThreadBridge::didReceiveCachedMetadata(const char* data, int dataLength)
 {
-    OwnPtr<Vector<char> > vector = adoptPtr(new Vector<char>(lengthReceived)); // needs to be an OwnPtr for usage with createCallbackTask.
-    memcpy(vector->data(), data, lengthReceived);
+    OwnPtr<Vector<char> > vector = adoptPtr(new Vector<char>(dataLength)); // needs to be an OwnPtr for usage with createCallbackTask.
+    memcpy(vector->data(), data, dataLength);
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveCachedMetadata, m_workerClientWrapper, vector.release()), m_taskMode);
 }
 
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 01c3836..1d347a8 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -553,9 +553,9 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
     m_currentResource = ApplicationCacheResource::create(url, response, type);
 }
 
-void ApplicationCacheGroup::didReceiveData(ResourceHandle* handle, const char* data, int length, int lengthReceived)
+void ApplicationCacheGroup::didReceiveData(ResourceHandle* handle, const char* data, int length, int encodedDataLength)
 {
-    UNUSED_PARAM(lengthReceived);
+    UNUSED_PARAM(encodedDataLength);
 
 #if ENABLE(INSPECTOR)
     InspectorInstrumentation::didReceiveContentLength(m_frame, m_currentResourceIdentifier, length, 0);
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheGroup.h b/Source/WebCore/loader/appcache/ApplicationCacheGroup.h
index f3a117e..ab7b16b 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheGroup.h
+++ b/Source/WebCore/loader/appcache/ApplicationCacheGroup.h
@@ -112,7 +112,7 @@ private:
     virtual bool shouldUseCredentialStorage(ResourceHandle*) { return true; }
 
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int length, int lengthReceived);
+    virtual void didReceiveData(ResourceHandle*, const char*, int length, int encodedDataLength);
     virtual void didFinishLoading(ResourceHandle*, double finishTime);
     virtual void didFail(ResourceHandle*, const ResourceError&);
 
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheHost.h b/Source/WebCore/loader/appcache/ApplicationCacheHost.h
index 56a5f57..24073cf 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/Source/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -126,7 +126,7 @@ namespace WebCore {
         void maybeLoadMainResourceForRedirect(ResourceRequest&, SubstituteData&);
         bool maybeLoadFallbackForMainResponse(const ResourceRequest&, const ResourceResponse&);
         bool maybeLoadFallbackForMainError(const ResourceRequest&, const ResourceError&);
-        void mainResourceDataReceived(const char* data, int length, long long lengthReceived, bool allAtOnce);
+        void mainResourceDataReceived(const char* data, int length, long long encodedDataLength, bool allAtOnce);
         void finishedLoadingMainResource();
         void failedLoadingMainResource();
 
diff --git a/Source/WebCore/loader/cache/CachedFont.cpp b/Source/WebCore/loader/cache/CachedFont.cpp
index ea2ee14..60f0d6c 100644
--- a/Source/WebCore/loader/cache/CachedFont.cpp
+++ b/Source/WebCore/loader/cache/CachedFont.cpp
@@ -27,7 +27,8 @@
 #include "config.h"
 #include "CachedFont.h"
 
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (OS(WINDOWS) || OS(LINUX) || OS(FREEBSD))) || PLATFORM(HAIKU) || OS(WINCE) || PLATFORM(ANDROID) || PLATFORM(BREWMP)
+// FIXME: This should really be a blacklist instead of a whitelist
+#if USE(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (OS(WINDOWS) || OS(LINUX) || OS(FREEBSD) || USE(SKIA_MAC_ON_CHROME))) || PLATFORM(HAIKU) || OS(WINCE) || PLATFORM(ANDROID) || PLATFORM(BREWMP)
 #define STORE_FONT_CUSTOM_PLATFORM_DATA
 #endif
 
@@ -58,9 +59,6 @@ CachedFont::CachedFont(const String &url)
     : CachedResource(url, FontResource)
     , m_fontData(0)
     , m_loadInitiated(false)
-#if ENABLE(SVG_FONTS)
-    , m_isSVGFont(false)
-#endif
 {
 }
 
@@ -105,9 +103,6 @@ void CachedFont::beginLoadIfNeeded(CachedResourceLoader* dl)
 bool CachedFont::ensureCustomFontData()
 {
 #ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
-#if ENABLE(SVG_FONTS)
-    ASSERT(!m_isSVGFont);
-#endif
     if (!m_fontData && !errorOccurred() && !isLoading() && m_data) {
         m_fontData = createFontCustomPlatformData(m_data.get());
         if (!m_fontData)
@@ -134,13 +129,14 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
 #if ENABLE(SVG_FONTS)
 bool CachedFont::ensureSVGFontData()
 {
-    ASSERT(m_isSVGFont);
     if (!m_externalSVGDocument && !errorOccurred() && !isLoading() && m_data) {
         m_externalSVGDocument = SVGDocument::create(0, KURL());
 
         RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("application/xml");
-
-        m_externalSVGDocument->setContent(decoder->decode(m_data->data(), m_data->size()) + decoder->flush());
+        String svgSource = decoder->decode(m_data->data(), m_data->size());
+        svgSource += decoder->flush();
+        
+        m_externalSVGDocument->setContent(svgSource);
         
         if (decoder->sawError())
             m_externalSVGDocument = 0;
@@ -151,7 +147,6 @@ bool CachedFont::ensureSVGFontData()
 
 SVGFontElement* CachedFont::getSVGFontById(const String& fontName) const
 {
-    ASSERT(m_isSVGFont);
     RefPtr<NodeList> list = m_externalSVGDocument->getElementsByTagNameNS(SVGNames::fontTag.namespaceURI(), SVGNames::fontTag.localName());
     if (!list)
         return 0;
diff --git a/Source/WebCore/loader/cache/CachedFont.h b/Source/WebCore/loader/cache/CachedFont.h
index d677f7b..dd9d60e 100644
--- a/Source/WebCore/loader/cache/CachedFont.h
+++ b/Source/WebCore/loader/cache/CachedFont.h
@@ -68,8 +68,6 @@ public:
     FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
 #if ENABLE(SVG_FONTS)
-    bool isSVGFont() const { return m_isSVGFont; }
-    void setSVGFont(bool isSVG) { m_isSVGFont = isSVG; }
     bool ensureSVGFontData();
     SVGFontElement* getSVGFontById(const String&) const;
 #endif
@@ -79,7 +77,6 @@ private:
     bool m_loadInitiated;
 
 #if ENABLE(SVG_FONTS)
-    bool m_isSVGFont;
     RefPtr<SVGDocument> m_externalSVGDocument;
 #endif
 
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index cc49415..ba30860 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -40,7 +40,7 @@
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include "PDFDocumentImage.h"
 #endif
 
@@ -244,7 +244,7 @@ inline void CachedImage::createImage()
     // Create the image if it doesn't yet exist.
     if (m_image)
         return;
-#if PLATFORM(CG) && !USE(WEBKIT_IMAGE_DECODERS)
+#if USE(CG) && !USE(WEBKIT_IMAGE_DECODERS)
     if (m_response.mimeType() == "application/pdf") {
         m_image = PDFDocumentImage::create();
         return;
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 9413472..95f5522 100644
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -62,7 +62,7 @@ static ResourceLoadPriority defaultPriorityForResourceType(CachedResource::Type
         case CachedResource::ImageResource:
             return ResourceLoadPriorityLow;
 #if ENABLE(LINK_PREFETCH)
-        case CachedResource::LinkPrefetch:
+        case CachedResource::LinkResource:
             return ResourceLoadPriorityVeryLow;
 #endif
     }
@@ -504,10 +504,7 @@ bool CachedResource::canUseCacheValidator() const
 
     if (m_response.cacheControlContainsNoStore())
         return false;
-
-    DEFINE_STATIC_LOCAL(const AtomicString, lastModifiedHeader, ("last-modified"));
-    DEFINE_STATIC_LOCAL(const AtomicString, eTagHeader, ("etag"));
-    return !m_response.httpHeaderField(lastModifiedHeader).isEmpty() || !m_response.httpHeaderField(eTagHeader).isEmpty();
+    return m_response.hasCacheValidatorFields();
 }
 
 bool CachedResource::mustRevalidateDueToCacheHeaders(CachePolicy cachePolicy) const
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index 16920a5..72b00e5 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -65,7 +65,7 @@ public:
         , XSLStyleSheet
 #endif
 #if ENABLE(LINK_PREFETCH)
-        , LinkPrefetch
+        , LinkResource
 #endif
     };
 
@@ -129,10 +129,10 @@ public:
     void setLoading(bool b) { m_loading = b; }
 
     virtual bool isImage() const { return false; }
-    bool isPrefetch() const
+    bool isLinkResource() const
     {
 #if ENABLE(LINK_PREFETCH)
-        return type() == LinkPrefetch;
+        return type() == LinkResource;
 #else
         return false;
 #endif
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 9103eff..38fcee4 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -47,6 +47,7 @@
 #include "ResourceLoadScheduler.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringConcatenate.h>
 
@@ -70,8 +71,8 @@ static CachedResource* createResource(CachedResource::Type type, const KURL& url
         return new CachedXSLStyleSheet(url.string());
 #endif
 #if ENABLE(LINK_PREFETCH)
-    case CachedResource::LinkPrefetch:
-        return new CachedResource(url.string(), CachedResource::LinkPrefetch);
+    case CachedResource::LinkResource:
+        return new CachedResource(url.string(), CachedResource::LinkResource);
 #endif
     }
     ASSERT_NOT_REACHED();
@@ -195,10 +196,10 @@ CachedXSLStyleSheet* CachedResourceLoader::requestXSLStyleSheet(const String& ur
 #endif
 
 #if ENABLE(LINK_PREFETCH)
-CachedResource* CachedResourceLoader::requestLinkPrefetch(const String& url)
+CachedResource* CachedResourceLoader::requestLinkResource(const String& url, ResourceLoadPriority priority)
 {
     ASSERT(frame());
-    return requestResource(CachedResource::LinkPrefetch, url, String());
+    return requestResource(CachedResource::LinkResource, url, String(), priority);
 }
 #endif
 
@@ -213,7 +214,7 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
     case CachedResource::Script:
     case CachedResource::FontResource:
 #if ENABLE(LINK_PREFETCH)
-    case CachedResource::LinkPrefetch:
+    case CachedResource::LinkResource:
 #endif
         // These types of resources can be loaded from any origin.
         // FIXME: Are we sure about CachedResource::FontResource?
@@ -255,15 +256,39 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         break;
     }
 #if ENABLE(LINK_PREFETCH)
-    case CachedResource::LinkPrefetch:
+    case CachedResource::LinkResource:
         // Prefetch cannot affect the current document.
         break;
 #endif
     }
     // FIXME: Consider letting the embedder block mixed content loads.
 
-    if (type == CachedResource::Script && !m_document->contentSecurityPolicy()->allowScriptFromSource(url))
-        return false;
+    switch (type) {
+    case CachedResource::Script:
+        if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url))
+            return false;
+        break;
+#if ENABLE(XSLT)
+    case CachedResource::XSLStyleSheet:
+#endif
+    case CachedResource::CSSStyleSheet:
+        if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url))
+            return false;
+        break;
+    case CachedResource::ImageResource:
+        if (!m_document->contentSecurityPolicy()->allowImageFromSource(url))
+            return false;
+        break;
+    case CachedResource::FontResource: {
+        if (!m_document->contentSecurityPolicy()->allowFontFromSource(url))
+            return false;
+        break;
+    }
+#if ENABLE(LINK_PREFETCH)
+    case CachedResource::LinkResource:
+        break;
+#endif
+    }
 
     return true;
 }
@@ -615,7 +640,7 @@ void CachedResourceLoader::notifyLoadedFromMemoryCache(CachedResource* resource)
 
 void CachedResourceLoader::incrementRequestCount(const CachedResource* res)
 {
-    if (res->isPrefetch())
+    if (res->isLinkResource())
         return;
 
     ++m_requestCount;
@@ -623,7 +648,7 @@ void CachedResourceLoader::incrementRequestCount(const CachedResource* res)
 
 void CachedResourceLoader::decrementRequestCount(const CachedResource* res)
 {
-    if (res->isPrefetch())
+    if (res->isLinkResource())
         return;
 
     --m_requestCount;
@@ -639,10 +664,14 @@ int CachedResourceLoader::requestCount()
     
 void CachedResourceLoader::preload(CachedResource::Type type, const String& url, const String& charset, bool referencedFromBody)
 {
+    // FIXME: Rip this out when we are sure it is no longer necessary (even for mobile).
+    UNUSED_PARAM(referencedFromBody);
+
     bool hasRendering = m_document->body() && m_document->body()->renderer();
-    if (!hasRendering && (referencedFromBody || type == CachedResource::ImageResource)) {
-        // Don't preload images or body resources before we have something to draw. This prevents
-        // preloads from body delaying first display when bandwidth is limited.
+    bool canBlockParser = type == CachedResource::Script || type == CachedResource::CSSStyleSheet;
+    if (!hasRendering && !canBlockParser) {
+        // Don't preload subresources that can't block the parser before we have something to draw.
+        // This helps prevent preloads from delaying first display when bandwidth is limited.
         PendingPreload pendingPreload = { type, url, charset };
         m_pendingPreloads.append(pendingPreload);
         return;
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.h b/Source/WebCore/loader/cache/CachedResourceLoader.h
index 881ad2f..79c63b9 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.h
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.h
@@ -69,7 +69,7 @@ public:
     CachedXSLStyleSheet* requestXSLStyleSheet(const String& url);
 #endif
 #if ENABLE(LINK_PREFETCH)
-    CachedResource* requestLinkPrefetch(const String &url);
+    CachedResource* requestLinkResource(const String &url, ResourceLoadPriority priority = ResourceLoadPriorityUnresolved);
 #endif
 
     // Logs an access denied message to the console for the specified URL.
diff --git a/Source/WebCore/loader/cache/CachedResourceRequest.cpp b/Source/WebCore/loader/cache/CachedResourceRequest.cpp
index 02cf13e..9e7fe8f 100644
--- a/Source/WebCore/loader/cache/CachedResourceRequest.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceRequest.cpp
@@ -42,8 +42,11 @@
 
 namespace WebCore {
     
-static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource::Type type)
+static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource::Type type, ResourceLoadPriority priority)
 {
+#if !ENABLE(LINK_PREFETCH)
+    UNUSED_PARAM(priority);
+#endif
     switch (type) {
     case CachedResource::CSSStyleSheet:
 #if ENABLE(XSLT)
@@ -57,8 +60,10 @@ static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource
     case CachedResource::ImageResource:
         return ResourceRequest::TargetIsImage;
 #if ENABLE(LINK_PREFETCH)
-    case CachedResource::LinkPrefetch:
-        return ResourceRequest::TargetIsPrefetch;
+    case CachedResource::LinkResource:
+        if (priority == ResourceLoadPriorityLowest)
+            return ResourceRequest::TargetIsPrefetch;
+        return ResourceRequest::TargetIsSubresource;
 #endif
     }
     ASSERT_NOT_REACHED();
@@ -85,7 +90,7 @@ PassRefPtr<CachedResourceRequest> CachedResourceRequest::load(CachedResourceLoad
     RefPtr<CachedResourceRequest> request = adoptRef(new CachedResourceRequest(cachedResourceLoader, resource, incremental));
 
     ResourceRequest resourceRequest(resource->url());
-    resourceRequest.setTargetType(cachedResourceTypeToTargetType(resource->type()));
+    resourceRequest.setTargetType(cachedResourceTypeToTargetType(resource->type(), resource->loadPriority()));
 
     if (!resource->accept().isEmpty())
         resourceRequest.setHTTPAccept(resource->accept());
@@ -108,7 +113,7 @@ PassRefPtr<CachedResourceRequest> CachedResourceRequest::load(CachedResourceLoad
     }
     
 #if ENABLE(LINK_PREFETCH)
-    if (resource->type() == CachedResource::LinkPrefetch)
+    if (resource->type() == CachedResource::LinkResource)
         resourceRequest.setHTTPHeaderField("Purpose", "prefetch");
 #endif
 
diff --git a/Source/WebCore/loader/icon/IconDatabase.cpp b/Source/WebCore/loader/icon/IconDatabase.cpp
index e5578e0..3cefea7 100644
--- a/Source/WebCore/loader/icon/IconDatabase.cpp
+++ b/Source/WebCore/loader/icon/IconDatabase.cpp
@@ -533,7 +533,7 @@ void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal,
             icon = getOrCreateIconRecord(iconURL);
     
         // Update the data and set the time stamp
-        icon->setImageData(data);
+        icon->setImageData(data.release());
         icon->setTimestamp((int)currentTime());
         
         // Copy the current retaining pageURLs - if any - to notify them of the change
@@ -1487,7 +1487,7 @@ bool IconDatabase::readFromDatabase()
                 
                 if (m_iconsPendingReading.contains(icons[i])) {
                     // Set the new data
-                    icons[i]->setImageData(imageData.get());
+                    icons[i]->setImageData(imageData.release());
                     
                     // Remove this icon from the set that needs to be read
                     m_iconsPendingReading.remove(icons[i]);
@@ -1576,41 +1576,44 @@ bool IconDatabase::writeToDatabase()
     // We can copy the current work queue then clear it out - If any new work comes in while we're writing out,
     // we'll pick it up on the next pass.  This greatly simplifies the locking strategy for this method and remains cohesive with changes
     // asked for by the database on the main thread
-    Vector<IconSnapshot> iconSnapshots;
-    Vector<PageURLSnapshot> pageSnapshots;
     {
-        MutexLocker locker(m_pendingSyncLock);
-        
-        iconSnapshots.appendRange(m_iconsPendingSync.begin().values(), m_iconsPendingSync.end().values());
-        m_iconsPendingSync.clear();
-        
-        pageSnapshots.appendRange(m_pageURLsPendingSync.begin().values(), m_pageURLsPendingSync.end().values());
-        m_pageURLsPendingSync.clear();
-    }
-    
-    if (iconSnapshots.size() || pageSnapshots.size())
-        didAnyWork = true;
-        
-    SQLiteTransaction syncTransaction(m_syncDB);
-    syncTransaction.begin();
-    
-    for (unsigned i = 0; i < iconSnapshots.size(); ++i) {
-        writeIconSnapshotToSQLDatabase(iconSnapshots[i]);
-        LOG(IconDatabase, "Wrote IconRecord for IconURL %s with timeStamp of %i to the DB", urlForLogging(iconSnapshots[i].iconURL).ascii().data(), iconSnapshots[i].timestamp);
-    }
-    
-    for (unsigned i = 0; i < pageSnapshots.size(); ++i) {
-        // If the icon URL is empty, this page is meant to be deleted
-        // ASSERTs are sanity checks to make sure the mappings exist if they should and don't if they shouldn't
-        if (pageSnapshots[i].iconURL.isEmpty())
-            removePageURLFromSQLDatabase(pageSnapshots[i].pageURL);
-        else
-            setIconURLForPageURLInSQLDatabase(pageSnapshots[i].iconURL, pageSnapshots[i].pageURL);
-        LOG(IconDatabase, "Committed IconURL for PageURL %s to database", urlForLogging(pageSnapshots[i].pageURL).ascii().data());
+        MutexLocker locker(m_urlAndIconLock);
+        Vector<IconSnapshot> iconSnapshots;
+        Vector<PageURLSnapshot> pageSnapshots;
+        {
+            MutexLocker locker(m_pendingSyncLock);
+
+            iconSnapshots.appendRange(m_iconsPendingSync.begin().values(), m_iconsPendingSync.end().values());
+            m_iconsPendingSync.clear();
+
+            pageSnapshots.appendRange(m_pageURLsPendingSync.begin().values(), m_pageURLsPendingSync.end().values());
+            m_pageURLsPendingSync.clear();
+        }
+
+        if (iconSnapshots.size() || pageSnapshots.size())
+            didAnyWork = true;
+
+        SQLiteTransaction syncTransaction(m_syncDB);
+        syncTransaction.begin();
+
+        for (unsigned i = 0; i < iconSnapshots.size(); ++i) {
+            writeIconSnapshotToSQLDatabase(iconSnapshots[i]);
+            LOG(IconDatabase, "Wrote IconRecord for IconURL %s with timeStamp of %i to the DB", urlForLogging(iconSnapshots[i].iconURL()).ascii().data(), iconSnapshots[i].timestamp());
+        }
+
+        for (unsigned i = 0; i < pageSnapshots.size(); ++i) {
+            // If the icon URL is empty, this page is meant to be deleted
+            // ASSERTs are sanity checks to make sure the mappings exist if they should and don't if they shouldn't
+            if (pageSnapshots[i].iconURL().isEmpty())
+                removePageURLFromSQLDatabase(pageSnapshots[i].pageURL());
+            else
+                setIconURLForPageURLInSQLDatabase(pageSnapshots[i].iconURL(), pageSnapshots[i].pageURL());
+            LOG(IconDatabase, "Committed IconURL for PageURL %s to database", urlForLogging(pageSnapshots[i].pageURL()).ascii().data());
+        }
+
+        syncTransaction.commit();
     }
 
-    syncTransaction.commit();
-    
     // Check to make sure there are no dangling PageURLs - If there are, we want to output one log message but not spam the console potentially every few seconds
     if (didAnyWork)
         checkForDanglingPageURLs(false);
@@ -2029,13 +2032,13 @@ void IconDatabase::writeIconSnapshotToSQLDatabase(const IconSnapshot& snapshot)
 {
     ASSERT_ICON_SYNC_THREAD();
     
-    if (snapshot.iconURL.isEmpty())
+    if (snapshot.iconURL().isEmpty())
         return;
         
     // A nulled out timestamp and data means this icon is destined to be deleted - do that instead of writing it out
-    if (!snapshot.timestamp && !snapshot.data) {
-        LOG(IconDatabase, "Removing %s from on-disk database", urlForLogging(snapshot.iconURL).ascii().data());
-        removeIconFromSQLDatabase(snapshot.iconURL);
+    if (!snapshot.timestamp() && !snapshot.data()) {
+        LOG(IconDatabase, "Removing %s from on-disk database", urlForLogging(snapshot.iconURL()).ascii().data());
+        removeIconFromSQLDatabase(snapshot.iconURL());
         return;
     }
 
@@ -2043,18 +2046,18 @@ void IconDatabase::writeIconSnapshotToSQLDatabase(const IconSnapshot& snapshot)
     // In practice the only caller of this method is always wrapped in a transaction itself so placing another here is unnecessary
         
     // Get the iconID for this url
-    int64_t iconID = getIconIDForIconURLFromSQLDatabase(snapshot.iconURL);
+    int64_t iconID = getIconIDForIconURLFromSQLDatabase(snapshot.iconURL());
     
     // If there is already an iconID in place, update the database.  
     // Otherwise, insert new records
     if (iconID) {    
         readySQLiteStatement(m_updateIconInfoStatement, m_syncDB, "UPDATE IconInfo SET stamp = ?, url = ? WHERE iconID = ?;");
-        m_updateIconInfoStatement->bindInt64(1, snapshot.timestamp);
-        m_updateIconInfoStatement->bindText(2, snapshot.iconURL);
+        m_updateIconInfoStatement->bindInt64(1, snapshot.timestamp());
+        m_updateIconInfoStatement->bindText(2, snapshot.iconURL());
         m_updateIconInfoStatement->bindInt64(3, iconID);
 
         if (m_updateIconInfoStatement->step() != SQLResultDone)
-            LOG_ERROR("Failed to update icon info for url %s", urlForLogging(snapshot.iconURL).ascii().data());
+            LOG_ERROR("Failed to update icon info for url %s", urlForLogging(snapshot.iconURL()).ascii().data());
         
         m_updateIconInfoStatement->reset();
         
@@ -2063,22 +2066,22 @@ void IconDatabase::writeIconSnapshotToSQLDatabase(const IconSnapshot& snapshot)
                 
         // If we *have* image data, bind it to this statement - Otherwise bind "null" for the blob data, 
         // signifying that this icon doesn't have any data    
-        if (snapshot.data && snapshot.data->size())
-            m_updateIconDataStatement->bindBlob(1, snapshot.data->data(), snapshot.data->size());
+        if (snapshot.data() && snapshot.data()->size())
+            m_updateIconDataStatement->bindBlob(1, snapshot.data()->data(), snapshot.data()->size());
         else
             m_updateIconDataStatement->bindNull(1);
         
         if (m_updateIconDataStatement->step() != SQLResultDone)
-            LOG_ERROR("Failed to update icon data for url %s", urlForLogging(snapshot.iconURL).ascii().data());
+            LOG_ERROR("Failed to update icon data for url %s", urlForLogging(snapshot.iconURL()).ascii().data());
 
         m_updateIconDataStatement->reset();
     } else {    
         readySQLiteStatement(m_setIconInfoStatement, m_syncDB, "INSERT INTO IconInfo (url,stamp) VALUES (?, ?);");
-        m_setIconInfoStatement->bindText(1, snapshot.iconURL);
-        m_setIconInfoStatement->bindInt64(2, snapshot.timestamp);
+        m_setIconInfoStatement->bindText(1, snapshot.iconURL());
+        m_setIconInfoStatement->bindInt64(2, snapshot.timestamp());
 
         if (m_setIconInfoStatement->step() != SQLResultDone)
-            LOG_ERROR("Failed to set icon info for url %s", urlForLogging(snapshot.iconURL).ascii().data());
+            LOG_ERROR("Failed to set icon info for url %s", urlForLogging(snapshot.iconURL()).ascii().data());
         
         m_setIconInfoStatement->reset();
         
@@ -2089,13 +2092,13 @@ void IconDatabase::writeIconSnapshotToSQLDatabase(const IconSnapshot& snapshot)
 
         // If we *have* image data, bind it to this statement - Otherwise bind "null" for the blob data, 
         // signifying that this icon doesn't have any data    
-        if (snapshot.data && snapshot.data->size())
-            m_setIconDataStatement->bindBlob(2, snapshot.data->data(), snapshot.data->size());
+        if (snapshot.data() && snapshot.data()->size())
+            m_setIconDataStatement->bindBlob(2, snapshot.data()->data(), snapshot.data()->size());
         else
             m_setIconDataStatement->bindNull(2);
         
         if (m_setIconDataStatement->step() != SQLResultDone)
-            LOG_ERROR("Failed to set icon data for url %s", urlForLogging(snapshot.iconURL).ascii().data());
+            LOG_ERROR("Failed to set icon data for url %s", urlForLogging(snapshot.iconURL()).ascii().data());
 
         m_setIconDataStatement->reset();
     }
diff --git a/Source/WebCore/loader/icon/IconRecord.h b/Source/WebCore/loader/icon/IconRecord.h
index f1fe12f..50ef7f7 100644
--- a/Source/WebCore/loader/icon/IconRecord.h
+++ b/Source/WebCore/loader/icon/IconRecord.h
@@ -38,6 +38,10 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/text/StringHash.h>
 
+#if OS(SOLARIS)
+#include <sys/types.h> // For time_t structure.
+#endif
+
 namespace WebCore { 
 
 class IconDataSnapshot;
@@ -51,17 +55,22 @@ enum ImageDataStatus {
 
 class IconSnapshot {
 public:
-    IconSnapshot() : timestamp(0) { }
+    IconSnapshot() : m_timestamp(0) { }
     
-    IconSnapshot(const String& url, int stamp, SharedBuffer* theData)
-        : iconURL(url)
-        , timestamp(stamp)
-        , data(theData)
+    IconSnapshot(const String& iconURL, int timestamp, SharedBuffer* data)
+        : m_iconURL(iconURL)
+        , m_timestamp(timestamp)
+        , m_data(data)
     { }
-        
-    String iconURL;
-    int timestamp;
-    RefPtr<SharedBuffer> data;
+
+    const String& iconURL() const { return m_iconURL; }
+    int timestamp() const { return m_timestamp; }
+    SharedBuffer* data() const { return m_data.get(); }
+
+private:
+    String m_iconURL;
+    int m_timestamp;
+    RefPtr<SharedBuffer> m_data;
 };
     
 class IconRecord : public RefCounted<IconRecord> {
diff --git a/Source/WebCore/loader/icon/PageURLRecord.h b/Source/WebCore/loader/icon/PageURLRecord.h
index 7935dc9..b9e0a41 100644
--- a/Source/WebCore/loader/icon/PageURLRecord.h
+++ b/Source/WebCore/loader/icon/PageURLRecord.h
@@ -42,13 +42,17 @@ class PageURLSnapshot {
 public:
     PageURLSnapshot() { }
     
-    PageURLSnapshot(const String& page, const String& icon)
-        : pageURL(page)
-        , iconURL(icon)
+    PageURLSnapshot(const String& pageURL, const String& iconURL)
+        : m_pageURL(pageURL)
+        , m_iconURL(iconURL)
     { }
-    
-    String pageURL;
-    String iconURL;
+
+    const String& pageURL() const { return m_pageURL; }
+    const String& iconURL() const { return m_iconURL; }
+
+private:
+    String m_pageURL;
+    String m_iconURL;
 };
 
 class PageURLRecord {
diff --git a/Source/WebCore/manual-tests/about-blank-xhr.html b/Source/WebCore/manual-tests/about-blank-xhr.html
new file mode 100644
index 0000000..8747878
--- /dev/null
+++ b/Source/WebCore/manual-tests/about-blank-xhr.html
@@ -0,0 +1,10 @@
+<ol>
+<li>Create a new tab.</li>
+<li>Navigate that tab to about:blank.</li>
+<li>Paste the following into the location bar:
+  <pre>javascript:x = new XMLHttpRequest(); x.open('get', 'http://jquery.com', false); x.send(); alert(x.responseText)</pre>
+</li>
+<li>Press "Enter".</li>
+<li>If you see the contents of jquery.com appear in an alert dialog, something
+has gone wrong.</li>
+</ol>
diff --git a/Source/WebCore/manual-tests/autofill-popup-location.html b/Source/WebCore/manual-tests/autofill-popup-location.html
new file mode 100644
index 0000000..5e28a15
--- /dev/null
+++ b/Source/WebCore/manual-tests/autofill-popup-location.html
@@ -0,0 +1,20 @@
+<html>
+  <head>
+    <META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+    <title>
+      Test autofill popup window shows at the correct location.
+    </title>
+  </head>
+  <body>
+    <h3>Test autofill popup window shows at the correct location.</h3>
+    <ol>
+      <li> Enter 'Always show bookmarks bar' in the following text input area.</li>
+      <li> Enter 'Test' in the text input area.</li>
+      <li> Press 'a' and make sure 'Always show bookmarks bar' is shown in autofill popup window.</li>
+      <li> Select all with pressing Ctrl-a.</li>
+      <li> Press 't' and make sure 'Test' is shown and the popup window location is correct.</li>
+    </ol>
+    <br>
+    <form><input name=q autofocus></form>
+  </body>
+</html> 
diff --git a/Source/WebCore/manual-tests/media-elements/video-replaces-poster.html b/Source/WebCore/manual-tests/media-elements/video-replaces-poster.html
index 8d852aa..bf91a39 100644
--- a/Source/WebCore/manual-tests/media-elements/video-replaces-poster.html
+++ b/Source/WebCore/manual-tests/media-elements/video-replaces-poster.html
@@ -8,8 +8,8 @@
       start playing.</p>
 
     <video width="480" height="270" type="video/mp4"
-            src="../../../LayoutTests/media/content/test.mp4"
-            poster="../../../LayoutTests/media/content/abe.png" autoplay>
+            src="../../../../LayoutTests/media/content/test.mp4"
+            poster="../../../../LayoutTests/media/content/abe.png" autoplay>
     </video>
   </body>
 </html>
diff --git a/Source/WebCore/manual-tests/media-muted.html b/Source/WebCore/manual-tests/media-muted.html
new file mode 100644
index 0000000..40e4e41
--- /dev/null
+++ b/Source/WebCore/manual-tests/media-muted.html
@@ -0,0 +1,32 @@
+<html>
+    <!-- LayoutTests location is hard-coded to avoid duplication of code. -->
+    <script src="http://svn.webkit.org/repository/webkit/trunk/LayoutTests/media/media-file.js"></script>
+    <script>
+        var vid;
+
+        function canplaythrough()
+        {
+            vid.play();
+        }
+
+        function load()
+        {
+            vid = document.getElementById('vid');
+            vid.addEventListener('canplaythrough', canplaythrough);
+
+            // Mute first
+            vid.muted = true;
+
+            vid.src = "http://src.chromium.org/svn/trunk/src/chrome/test/data/media/" + findMediaFile("video", "bear");
+        }
+    </script>
+
+    <body>
+        <video id=vid controls autoplay>
+        </video>
+        <p>TEST: Video should be muted (e.g., controls) and also produce no sound (<a href="https://bugs.webkit.org/show_bug.cgi?id=57673">bug 57673</a>).</p>
+        <input type="button" value="Load movie" onclick="load()">
+        <br>
+    </body>
+
+</html>
diff --git a/Source/WebCore/manual-tests/qt/plugin-painting.html b/Source/WebCore/manual-tests/qt/plugin-painting.html
new file mode 100644
index 0000000..3aa87bc
--- /dev/null
+++ b/Source/WebCore/manual-tests/qt/plugin-painting.html
@@ -0,0 +1,60 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<title>Flash In IFrame Test File</title>
+</head>
+
+<body>
+
+    <b> This manual tests verifies paging and arrow-navigating up and down a page of plugins doesn't result
+        in them appearing to get fused together. QtWebKit wasn't updating the position of the plugins
+        within the page before scheduling them for a repaint, with the result that parts of the plugin
+        were appearing in their old position after a page scroll. This was a problem for
+        Qt in <a href="https://bugs.webkit.org/show_bug.cgi?id=57179">bug 57179</a></b> <br/><br/>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<iframe src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></iframe>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+<embed src="../plugins/test.swf" type="application/x-shockwave-flash" style="position: relative; "></embed>
+
+</body>
+
+</html>
+
+
+
+
diff --git a/Source/WebCore/manual-tests/video-rtsp.html b/Source/WebCore/manual-tests/video-rtsp.html
index 4fff987..f500f69 100644
--- a/Source/WebCore/manual-tests/video-rtsp.html
+++ b/Source/WebCore/manual-tests/video-rtsp.html
@@ -3,9 +3,7 @@
 <title>RTSP playback test</title>
 </head>
 <body>
-<video with=640 height=352 autoplay controls src="rtsp://a2047.v1411b.c1411.g.vq.akamaistream.net/5/2047/1411/2_h264_650/1a1a1ae454c430950065de4cbb2f94c226950c7ae655b61a48a91475e243acda3dac194879adde0f/wwdc_2006_2_650.mov"></video>
-<p>Test that QuickTime file with RTSP URL loads.<p>
-<script>start()</script>
-<pre id="console"></pre>
+<video width=400 height=300 preload=none autoplay src="rtsp://dmzosx001.dpa.act.gov.au/medium"></video>
+<p>Test that RTSP URL loads.<p>
 </body>
 </html>
diff --git a/Source/WebCore/manual-tests/video-statistics.html b/Source/WebCore/manual-tests/video-statistics.html
new file mode 100644
index 0000000..ed9b128
--- /dev/null
+++ b/Source/WebCore/manual-tests/video-statistics.html
@@ -0,0 +1,79 @@
+<html>
+<head><title>WebKit video playback statistics</title></head>
+<body>
+<!-- inspired by --
+  -- http://people.mozilla.org/~cpearce/paint-stats-demo.html -->
+<video src="http://movies.apple.com/movies/us/apple/ipoditunes/2007/touch/ads/apple_ipodtouch_touch_r640-9cie.mov" id="v" controls autoplay></video>
+<div id="log">
+    Audio bytes decoded: 0 average p/s: 0<br>
+    Video bytes decoded: 0 average p/s: 0<br>
+    Decoded frames: 0 average p/s: 0<br>
+    Dropped frames: 0 average p/s: 0<br>
+</div>
+<script>
+
+var decodedFrames = 0;
+var decodedPerSec = 0;
+var audioBytesDecoded = 0;
+var audioBytesDecodedPerSec = 0;
+var videoBytesDecoded = 0;
+var videoBytesDecodedPerSec = 0;
+var droppedFrames = 0;
+var droppedFramesPerSec = 0;
+
+function Mean() {
+  this.count = 0;
+  this.sum = 0;
+  
+  this.record = function(val) {
+    this.count++;
+    this.sum += val;
+  };
+  
+  this.mean = function() {
+    return this.count ? (this.sum / this.count).toFixed(3) : 0;
+  };
+}
+
+
+var decodedMean = new Mean();
+var audioMean = new Mean();
+var videoMean = new Mean();
+var dropMean = new Mean();
+
+function recalcRates() {
+  var v = document.getElementById("v");
+
+  if (v.readyState <= HTMLMediaElement.HAVE_CURRENT_DATA || v.paused) {
+    return;
+  }
+
+  decodedPerSec = (v.webkitDecodedFrameCount - decodedFrames);
+  decodedFrames = v.webkitDecodedFrameCount;
+
+  audioBytesDecodedPerSec = v.webkitAudioDecodedByteCount - audioBytesDecoded;
+  audioBytesDecoded = v.webkitAudioDecodedByteCount;
+
+  videoBytesDecodedPerSec = v.webkitVideoDecodedByteCount - videoBytesDecoded;
+  videoBytesDecoded = v.webkitVideoDecodedByteCount;
+
+  droppedFramesPerSec = v.webkitDroppedFrameCount - droppedFrames;
+  droppedFrames = v.webkitDroppedFrameCount;
+
+  decodedMean.record(decodedPerSec);
+  audioMean.record(audioBytesDecodedPerSec);
+  videoMean.record(videoBytesDecodedPerSec);
+  dropMean.record(droppedFramesPerSec);
+  
+  var d = document.getElementById("log");
+  d.innerHTML =
+        "Audio bytes decoded: " + v.webkitAudioDecodedByteCount + " average p/s: " + audioMean.mean() + "<br>" +
+        "Video bytes decoded: " + v.webkitVideoDecodedByteCount + " average p/s: " + videoMean.mean() + "<br>" +
+        "Decoded frames: " + v.webkitDecodedFrameCount + " average p/s: " + decodedMean.mean() + "<br>" +
+        "Dropped frames: " + v.webkitDroppedFrameCount + " average p/s: " + dropMean.mean() + "<br>";
+}
+
+setInterval(recalcRates, 1000);
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/notifications/Notification.cpp b/Source/WebCore/notifications/Notification.cpp
index 2facd1b..0192b05 100644
--- a/Source/WebCore/notifications/Notification.cpp
+++ b/Source/WebCore/notifications/Notification.cpp
@@ -190,9 +190,9 @@ void Notification::didReceiveResponse(const ResourceResponse& response)
     m_iconData = SharedBuffer::create();
 }
 
-void Notification::didReceiveData(const char* data, int lengthReceived)
+void Notification::didReceiveData(const char* data, int dataLength)
 {
-    m_iconData->append(data, lengthReceived);
+    m_iconData->append(data, dataLength);
 }
 
 void Notification::didFinishLoading(unsigned long, double)
diff --git a/Source/WebCore/notifications/Notification.h b/Source/WebCore/notifications/Notification.h
index b5c6b9a..d05a3bd 100644
--- a/Source/WebCore/notifications/Notification.h
+++ b/Source/WebCore/notifications/Notification.h
@@ -105,7 +105,7 @@ namespace WebCore {
         void detachPresenter() { }
 
         virtual void didReceiveResponse(const ResourceResponse&);
-        virtual void didReceiveData(const char* data, int lengthReceived);
+        virtual void didReceiveData(const char* data, int dataLength);
         virtual void didFinishLoading(unsigned long identifier, double finishTime);
         virtual void didFail(const ResourceError&);
         virtual void didFailRedirectCheck();
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index 5881d5e..dce7d33 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -280,8 +280,16 @@ void Chrome::closeWindowSoon()
     m_client->closeWindowSoon();
 }
 
+static inline void willRunModalDialog(const Frame* frame, const ChromeClient::DialogType& dialogType, const ChromeClient* client)
+{
+    if (frame->loader()->pageDismissalEventBeingDispatched())
+        client->willRunModalDialogDuringPageDismissal(dialogType);
+}
+
 void Chrome::runJavaScriptAlert(Frame* frame, const String& message)
 {
+    willRunModalDialog(frame, ChromeClient::AlertDialog, m_client);
+
     // Defer loads in case the client method runs a new event loop that would
     // otherwise cause the load to continue while we're in the middle of executing JavaScript.
     PageGroupLoadDeferrer deferrer(m_page, true);
@@ -292,6 +300,8 @@ void Chrome::runJavaScriptAlert(Frame* frame, const String& message)
 
 bool Chrome::runJavaScriptConfirm(Frame* frame, const String& message)
 {
+    willRunModalDialog(frame, ChromeClient::ConfirmDialog, m_client);
+
     // Defer loads in case the client method runs a new event loop that would
     // otherwise cause the load to continue while we're in the middle of executing JavaScript.
     PageGroupLoadDeferrer deferrer(m_page, true);
@@ -302,6 +312,8 @@ bool Chrome::runJavaScriptConfirm(Frame* frame, const String& message)
 
 bool Chrome::runJavaScriptPrompt(Frame* frame, const String& prompt, const String& defaultValue, String& result)
 {
+    willRunModalDialog(frame, ChromeClient::PromptDialog, m_client);
+
     // Defer loads in case the client method runs a new event loop that would
     // otherwise cause the load to continue while we're in the middle of executing JavaScript.
     PageGroupLoadDeferrer deferrer(m_page, true);
@@ -432,6 +444,13 @@ void Chrome::cancelGeolocationPermissionRequestForFrame(Frame* frame, Geolocatio
     m_client->cancelGeolocationPermissionRequestForFrame(frame, geolocation);
 }
 
+#if ENABLE(DIRECTORY_UPLOAD)
+void Chrome::enumerateChosenDirectory(const String& path, FileChooser* fileChooser)
+{
+    m_client->enumerateChosenDirectory(path, fileChooser);
+}
+#endif
+
 void Chrome::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> fileChooser)
 {
     m_client->runOpenPanel(frame, fileChooser);
@@ -547,4 +566,9 @@ bool Chrome::requiresFullscreenForVideoPlayback()
     return m_client->requiresFullscreenForVideoPlayback();
 }
 
+void Chrome::willRunModalHTMLDialog(const Frame* frame) const
+{
+    willRunModalDialog(frame, ChromeClient::HTMLDialog, m_client);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index 9984a7c..9adfec8 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -153,6 +153,9 @@ namespace WebCore {
 
         void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
         void chooseIconForFiles(const Vector<String>&, FileChooser*);
+#if ENABLE(DIRECTORY_UPLOAD)
+        void enumerateChosenDirectory(const String&, FileChooser*);
+#endif
 
         void dispatchViewportDataDidChange(const ViewportArguments&) const;
 
@@ -175,6 +178,8 @@ namespace WebCore {
         void showContextMenu();
 #endif
 
+        void willRunModalHTMLDialog(const Frame*) const;
+
     private:
         Page* m_page;
         ChromeClient* m_client;
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 73fe904..4e6b45e 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -224,6 +224,11 @@ namespace WebCore {
         // Asynchronous request to load an icon for specified filenames.
         virtual void chooseIconForFiles(const Vector<String>&, FileChooser*) = 0;
 
+#if ENABLE(DIRECTORY_UPLOAD)
+        // Asychronous request to enumerate all files in a directory chosen by the user.
+        virtual void enumerateChosenDirectory(const String&, FileChooser*) = 0;
+#endif
+
         // Notification that the given form element has changed. This function
         // will be called frequently, so handling should be very fast.
         virtual void formStateDidChange(const Node*) = 0;
@@ -303,9 +308,20 @@ namespace WebCore {
 
         virtual void didCompleteRubberBandForMainFrame(const IntSize&) const { }
 
+<<<<<<< HEAD
 #if ENABLE(ANDROID_INSTALLABLE_WEB_APPS)
         virtual void webAppCanBeInstalled() = 0;
 #endif
+=======
+        enum DialogType {
+            AlertDialog = 0,
+            ConfirmDialog = 1,
+            PromptDialog = 2,
+            HTMLDialog = 3,
+            NumDialogTypes = 4
+        };
+        virtual void willRunModalDialogDuringPageDismissal(const DialogType&) const { }
+>>>>>>> WebKit.org at r84325
 
     protected:
         virtual ~ChromeClient() { }
diff --git a/Source/WebCore/page/Console.h b/Source/WebCore/page/Console.h
index ceefb38..bfdcaa7 100644
--- a/Source/WebCore/page/Console.h
+++ b/Source/WebCore/page/Console.h
@@ -50,7 +50,6 @@ class Frame;
 class Page;
 class ScriptCallStack;
 
-// Keep in sync with inspector/front-end/Console.js
 enum MessageSource {
     HTMLMessageSource,
     WMLMessageSource,
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 6bcf99c..98e311c 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -57,6 +57,11 @@ bool isHostCharacter(UChar c)
     return isASCIIAlphanumeric(c) || c == '-';
 }
 
+bool isOptionValueCharacter(UChar c)
+{
+    return isASCIIAlphanumeric(c) || c == '-';
+}
+
 bool isSchemeContinuationCharacter(UChar c)
 {
     return isASCIIAlphanumeric(c) || c == '+' || c == '-' || c == '.';
@@ -385,8 +390,7 @@ bool CSPSourceList::parsePort(const UChar* begin, const UChar* end, int& port, b
 
 void CSPSourceList::addSourceSelf()
 {
-    // FIXME: Inherit the scheme, host, and port from the current URL.
-    notImplemented();
+    m_list.append(CSPSource(m_origin->protocol(), m_origin->host(), m_origin->port(), false, false));
 }
 
 class CSPDirective {
@@ -406,6 +410,55 @@ private:
     CSPSourceList m_sourceList;
 };
 
+class CSPOptions {
+public:
+    explicit CSPOptions(const String& value)
+        : m_disableXSSProtection(false)
+        , m_evalScript(false)
+    {
+        parse(value);
+    }
+
+    bool disableXSSProtection() const { return m_disableXSSProtection; }
+    bool evalScript() const { return m_evalScript; }
+
+private:
+    void parse(const String&);
+
+    bool m_disableXSSProtection;
+    bool m_evalScript;
+};
+
+// options           = "options" *( 1*WSP option-value ) *WSP
+// option-value      = 1*( ALPHA / DIGIT / "-" )
+//
+void CSPOptions::parse(const String& value)
+{
+    DEFINE_STATIC_LOCAL(String, disableXSSProtection, ("disable-xss-protection"));
+    DEFINE_STATIC_LOCAL(String, evalScript, ("eval-script"));
+
+    const UChar* position = value.characters();
+    const UChar* end = position + value.length();
+
+    while (position < end) {
+        skipWhile<isASCIISpace>(position, end);
+
+        const UChar* optionsValueBegin = position;
+
+        if (!skipExactly<isOptionValueCharacter>(position, end))
+            return;
+
+        skipWhile<isOptionValueCharacter>(position, end);
+
+        String optionsValue(optionsValueBegin, position - optionsValueBegin);
+
+        if (equalIgnoringCase(optionsValue, disableXSSProtection))
+            m_disableXSSProtection = true;
+        else if (equalIgnoringCase(optionsValue, evalScript))
+            m_evalScript = true;
+    }
+}
+
 ContentSecurityPolicy::ContentSecurityPolicy(SecurityOrigin* origin)
     : m_havePolicy(false)
     , m_origin(origin)
@@ -425,14 +478,29 @@ void ContentSecurityPolicy::didReceiveHeader(const String& header)
     m_havePolicy = true;
 }
 
+bool ContentSecurityPolicy::protectAgainstXSS() const
+{
+    return m_scriptSrc && (!m_options || !m_options->disableXSSProtection());
+}
+
 bool ContentSecurityPolicy::allowJavaScriptURLs() const
 {
-    return !m_scriptSrc;
+    return !protectAgainstXSS();
 }
 
 bool ContentSecurityPolicy::allowInlineEventHandlers() const
 {
-    return !m_scriptSrc;
+    return !protectAgainstXSS();
+}
+
+bool ContentSecurityPolicy::allowInlineScript() const
+{
+    return !protectAgainstXSS();
+}
+
+bool ContentSecurityPolicy::allowEval() const
+{
+    return !m_scriptSrc || (m_options && m_options->evalScript());
 }
 
 bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url) const
@@ -440,6 +508,31 @@ bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url) const
     return !m_scriptSrc || m_scriptSrc->allows(url);
 }
 
+bool ContentSecurityPolicy::allowObjectFromSource(const KURL& url) const
+{
+    return !m_objectSrc || m_objectSrc->allows(url);
+}
+
+bool ContentSecurityPolicy::allowImageFromSource(const KURL& url) const
+{
+    return !m_imgSrc || m_imgSrc->allows(url);
+}
+
+bool ContentSecurityPolicy::allowStyleFromSource(const KURL& url) const
+{
+    return !m_styleSrc || m_styleSrc->allows(url);
+}
+
+bool ContentSecurityPolicy::allowFontFromSource(const KURL& url) const
+{
+    return !m_fontSrc || m_fontSrc->allows(url);
+}
+
+bool ContentSecurityPolicy::allowMediaFromSource(const KURL& url) const
+{
+    return !m_mediaSrc || m_mediaSrc->allows(url);
+}
+
 // policy            = directive-list
 // directive-list    = [ directive *( ";" [ directive ] ) ]
 //
@@ -514,11 +607,29 @@ bool ContentSecurityPolicy::parseDirective(const UChar* begin, const UChar* end,
 void ContentSecurityPolicy::addDirective(const String& name, const String& value)
 {
     DEFINE_STATIC_LOCAL(String, scriptSrc, ("script-src"));
+    DEFINE_STATIC_LOCAL(String, objectSrc, ("object-src"));
+    DEFINE_STATIC_LOCAL(String, imgSrc, ("img-src"));
+    DEFINE_STATIC_LOCAL(String, styleSrc, ("style-src"));
+    DEFINE_STATIC_LOCAL(String, fontSrc, ("font-src"));
+    DEFINE_STATIC_LOCAL(String, mediaSrc, ("media-src"));
+    DEFINE_STATIC_LOCAL(String, options, ("options"));
 
     ASSERT(!name.isEmpty());
 
     if (!m_scriptSrc && equalIgnoringCase(name, scriptSrc))
         m_scriptSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
+    else if (!m_objectSrc && equalIgnoringCase(name, objectSrc))
+        m_objectSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
+    else if (!m_imgSrc && equalIgnoringCase(name, imgSrc))
+        m_imgSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
+    else if (!m_styleSrc && equalIgnoringCase(name, styleSrc))
+        m_styleSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
+    else if (!m_fontSrc && equalIgnoringCase(name, fontSrc))
+        m_fontSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
+    else if (!m_mediaSrc && equalIgnoringCase(name, mediaSrc))
+        m_mediaSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
+    else if (!m_options && equalIgnoringCase(name, options))
+        m_options = adoptPtr(new CSPOptions(value));
 }
 
 }
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index a7cd216..2b430f4 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -32,6 +32,7 @@
 namespace WebCore {
 
 class CSPDirective;
+class CSPOptions;
 class KURL;
 class SecurityOrigin;
 
@@ -47,11 +48,21 @@ public:
 
     bool allowJavaScriptURLs() const;
     bool allowInlineEventHandlers() const;
+    bool allowInlineScript() const;
+    bool allowEval() const;
+
     bool allowScriptFromSource(const KURL&) const;
+    bool allowObjectFromSource(const KURL&) const;
+    bool allowImageFromSource(const KURL&) const;
+    bool allowStyleFromSource(const KURL&) const;
+    bool allowFontFromSource(const KURL&) const;
+    bool allowMediaFromSource(const KURL&) const;
 
 private:
     explicit ContentSecurityPolicy(SecurityOrigin*);
 
+    bool protectAgainstXSS() const;
+
     void parse(const String&);
     bool parseDirective(const UChar* begin, const UChar* end, String& name, String& value);
     void addDirective(const String& name, const String& value);
@@ -59,6 +70,12 @@ private:
     bool m_havePolicy;
     RefPtr<SecurityOrigin> m_origin;
     OwnPtr<CSPDirective> m_scriptSrc;
+    OwnPtr<CSPDirective> m_objectSrc;
+    OwnPtr<CSPDirective> m_imgSrc;
+    OwnPtr<CSPDirective> m_styleSrc;
+    OwnPtr<CSPDirective> m_fontSrc;
+    OwnPtr<CSPDirective> m_mediaSrc;
+    OwnPtr<CSPOptions> m_options;
 };
 
 }
diff --git a/Source/WebCore/page/DOMSelection.cpp b/Source/WebCore/page/DOMSelection.cpp
index 31ab956..2e4e09c 100644
--- a/Source/WebCore/page/DOMSelection.cpp
+++ b/Source/WebCore/page/DOMSelection.cpp
@@ -332,6 +332,8 @@ void DOMSelection::modify(const String& alterString, const String& directionStri
         granularity = ParagraphBoundary;
     else if (equalIgnoringCase(granularityString, "documentboundary"))
         granularity = DocumentBoundary;
+    else if (equalIgnoringCase(granularityString, "-webkit-visual-word"))
+        granularity = WebKitVisualWordGranularity;
     else
         return;
 
@@ -472,14 +474,14 @@ bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
         return false;
 
     ExceptionCode ec = 0;
-    bool nodeFullySelected = Range::compareBoundaryPoints(parentNode, nodeIndex, selectedRange->startContainer(ec), selectedRange->startOffset(ec)) >= 0
-        && Range::compareBoundaryPoints(parentNode, nodeIndex + 1, selectedRange->endContainer(ec), selectedRange->endOffset(ec)) <= 0;
+    bool nodeFullySelected = Range::compareBoundaryPoints(parentNode, nodeIndex, selectedRange->startContainer(ec), selectedRange->startOffset(ec), ec) >= 0 && !ec
+        && Range::compareBoundaryPoints(parentNode, nodeIndex + 1, selectedRange->endContainer(ec), selectedRange->endOffset(ec), ec) <= 0 && !ec;
     ASSERT(!ec);
     if (nodeFullySelected)
         return true;
 
-    bool nodeFullyUnselected = Range::compareBoundaryPoints(parentNode, nodeIndex, selectedRange->endContainer(ec), selectedRange->endOffset(ec)) > 0
-        || Range::compareBoundaryPoints(parentNode, nodeIndex + 1, selectedRange->startContainer(ec), selectedRange->startOffset(ec)) < 0;
+    bool nodeFullyUnselected = (Range::compareBoundaryPoints(parentNode, nodeIndex, selectedRange->endContainer(ec), selectedRange->endOffset(ec), ec) > 0 && !ec)
+        || (Range::compareBoundaryPoints(parentNode, nodeIndex + 1, selectedRange->startContainer(ec), selectedRange->startOffset(ec), ec) < 0 && !ec);
     ASSERT(!ec);
     if (nodeFullyUnselected)
         return false;
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 90458ff..fda46df 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -86,6 +86,7 @@
 #include "Settings.h"
 #include "Storage.h"
 #include "StorageArea.h"
+#include "StorageInfo.h"
 #include "StorageNamespace.h"
 #include "StyleMedia.h"
 #include "SuddenTermination.h"
@@ -743,7 +744,7 @@ IDBFactory* DOMWindow::webkitIndexedDB() const
 #endif
 
 #if ENABLE(FILE_SYSTEM)
-void DOMWindow::requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void DOMWindow::webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     Document* document = this->document();
     if (!document)
@@ -755,7 +756,7 @@ void DOMWindow::requestFileSystem(int type, long long size, PassRefPtr<FileSyste
     }
 
     AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (fileSystemType != AsyncFileSystem::Temporary && fileSystemType != AsyncFileSystem::Persistent) {
+    if (fileSystemType != AsyncFileSystem::Temporary && fileSystemType != AsyncFileSystem::Persistent && fileSystemType != AsyncFileSystem::External) {
         DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
         return;
     }
@@ -763,7 +764,7 @@ void DOMWindow::requestFileSystem(int type, long long size, PassRefPtr<FileSyste
     LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document), false);
 }
 
-void DOMWindow::resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void DOMWindow::webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     Document* document = this->document();
     if (!document)
@@ -786,6 +787,8 @@ void DOMWindow::resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCal
     LocalFileSystem::localFileSystem().readFileSystem(document, type, ResolveURICallbacks::create(successCallback, errorCallback, document, filePath));
 }
 
+COMPILE_ASSERT(static_cast<int>(DOMWindow::EXTERNAL) == static_cast<int>(AsyncFileSystem::External), enum_mismatch);
+
 COMPILE_ASSERT(static_cast<int>(DOMWindow::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
 COMPILE_ASSERT(static_cast<int>(DOMWindow::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
 
@@ -1867,6 +1870,9 @@ void DOMWindow::showModalDialog(const String& urlString, const String& dialogFea
     if (!firstFrame)
         return;
 
+    if (m_frame->page())
+        m_frame->page()->chrome()->willRunModalHTMLDialog(m_frame);
+
     if (!canShowModalDialogNow(m_frame) || !firstWindow->allowPopUp())
         return;
 
@@ -1887,4 +1893,13 @@ DOMURL* DOMWindow::webkitURL() const
 }
 #endif
 
+#if ENABLE(QUOTA)
+StorageInfo* DOMWindow::webkitStorageInfo() const
+{
+    if (!m_storageInfo)
+        m_storageInfo = StorageInfo::create();
+    return m_storageInfo.get();
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index 404f40f..14ae79c 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -64,6 +64,7 @@ namespace WebCore {
     class Screen;
     class SerializedScriptValue;
     class Storage;
+    class StorageInfo;
     class StyleMedia;
     class WebKitPoint;
 
@@ -284,8 +285,6 @@ namespace WebCore {
         DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(formchange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(forminput);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(hashchange);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
@@ -391,9 +390,10 @@ namespace WebCore {
         enum FileSystemType {
             TEMPORARY,
             PERSISTENT,
+            EXTERNAL,
         };
-        void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
-        void resolveLocalFileSystemURL(const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+        void webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
+        void webkitResolveLocalFileSystemURL(const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
@@ -404,6 +404,10 @@ namespace WebCore {
         NotificationCenter* webkitNotifications() const;
 #endif
 
+#if ENABLE(QUOTA)
+        StorageInfo* webkitStorageInfo() const;
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         DOMApplicationCache* applicationCache() const;
         DOMApplicationCache* optionalApplicationCache() const { return m_applicationCache.get(); }
@@ -496,6 +500,10 @@ namespace WebCore {
 #if ENABLE(BLOB)
         mutable RefPtr<DOMURL> m_domURL;
 #endif
+
+#if ENABLE(QUOTA)
+        mutable RefPtr<StorageInfo> m_storageInfo;
+#endif
     };
 
     inline String DOMWindow::status() const
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 8c6e929..9f7313c 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -194,10 +194,10 @@ module window {
 #if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
         const unsigned short TEMPORARY = 0;
         const unsigned short PERSISTENT = 1;
-        [EnabledAtRuntime=FileSystem] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [EnabledAtRuntime=FileSystem] void resolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
 
-        attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
+        attribute [EnabledAtRuntime=FileSystem] WebKitFlagsConstructor WebKitFlags;
 #endif
 
 #if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
@@ -268,8 +268,6 @@ module window {
         attribute EventListener onended;
         attribute EventListener onerror;
         attribute EventListener onfocus;
-        attribute EventListener onformchange;
-        attribute EventListener onforminput;
         attribute EventListener onhashchange;
         attribute EventListener oninput;
         attribute EventListener oninvalid;
@@ -785,10 +783,14 @@ module window {
         attribute [Conditional=BLOB|FILE_SYSTEM] FileErrorConstructor FileError;
         attribute [Conditional=BLOB] FileReaderConstructor FileReader;
 
-        attribute [Conditional=BLOB] BlobBuilderConstructor BlobBuilder;
+        attribute [Conditional=BLOB] WebKitBlobBuilderConstructor WebKitBlobBuilder;
 
         readonly attribute [Conditional=BLOB] DOMURL webkitURL;
 
+#if defined(ENABLE_QUOTA) && ENABLE_QUOTA
+        readonly attribute [EnabledAtRuntime=Quota] StorageInfo webkitStorageInfo;
+#endif
+
 #endif // defined(LANGUAGE_JAVASCRIPT)
 
 #if defined(V8_BINDING) && V8_BINDING
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index aeda844..df24a5b 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -27,7 +27,7 @@
 #ifndef EditorClient_h
 #define EditorClient_h
 
-#include "CorrectionPanelInfo.h"
+#include "SpellingCorrectionController.h"
 #include "EditorInsertAction.h"
 #include "FloatRect.h"
 #include "PlatformString.h"
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index de59083..d5ba4de 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -79,6 +79,7 @@
 #include "UserGestureIndicator.h"
 #include "UserTypingGestureIndicator.h"
 #include "WheelEvent.h"
+#include "WindowsKeyboardCodes.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
@@ -133,8 +134,6 @@ const double autoscrollInterval = 0.05;
 
 const double fakeMouseMoveInterval = 0.1;
 
-static Frame* subframeForHitTestResult(const MouseEventWithHitTestResults&);
-
 static inline bool scrollNode(float delta, WheelEvent::Granularity granularity, ScrollDirection positiveDirection, ScrollDirection negativeDirection, Node* node, Node** stopNode)
 {
     if (!delta)
@@ -283,7 +282,7 @@ static void setNonDirectionalSelectionIfNeeded(SelectionController* selection, c
 
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
 {
-    Node* innerNode = result.targetNode();
+    Node* innerNode = targetNode(result);
     VisibleSelection newSelection;
 
     if (innerNode && innerNode->renderer() && m_mouseDownMayStartSelect) {
@@ -310,7 +309,7 @@ void EventHandler::selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHit
     if (!result.hitTestResult().isLiveLink())
         return selectClosestWordFromMouseEvent(result);
 
-    Node* innerNode = result.targetNode();
+    Node* innerNode = targetNode(result);
 
     if (innerNode && innerNode->renderer() && m_mouseDownMayStartSelect) {
         VisibleSelection newSelection;
@@ -352,7 +351,7 @@ bool EventHandler::handleMousePressEventTripleClick(const MouseEventWithHitTestR
     if (event.event().button() != LeftButton)
         return false;
     
-    Node* innerNode = event.targetNode();
+    Node* innerNode = targetNode(event);
     if (!(innerNode && innerNode->renderer() && m_mouseDownMayStartSelect))
         return false;
 
@@ -382,7 +381,7 @@ static int textDistance(const Position& start, const Position& end)
 
 bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestResults& event)
 {
-    Node* innerNode = event.targetNode();
+    Node* innerNode = targetNode(event);
     if (!(innerNode && innerNode->renderer() && m_mouseDownMayStartSelect))
         return false;
 
@@ -458,7 +457,7 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
 
     // If we got the event back, that must mean it wasn't prevented,
     // so it's allowed to start a drag or selection.
-    m_mouseDownMayStartSelect = canMouseDownStartSelect(event.targetNode());
+    m_mouseDownMayStartSelect = canMouseDownStartSelect(targetNode(event));
     
 #if ENABLE(DRAG_SUPPORT)
     // Careful that the drag starting logic stays in sync with eventMayStartDrag()
@@ -488,7 +487,7 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     if (singleClick)
         focusDocumentView();
 
-    Node* innerNode = event.targetNode();
+    Node* innerNode = targetNode(event);
 
     m_mousePressNode = innerNode;
 #if ENABLE(DRAG_SUPPORT)
@@ -545,7 +544,7 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
     if (!m_mousePressed)
         return false;
 
-    Node* targetNode = event.targetNode();
+    Node* targetNode = EventHandler::targetNode(event);
     if (event.event().button() != LeftButton || !targetNode || !targetNode->renderer())
         return false;
 
@@ -577,9 +576,10 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
         HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
         HitTestResult result(m_mouseDownPos);
         m_frame->document()->renderView()->layer()->hitTest(request, result);
-        updateSelectionForMouseDrag(result.innerNode(), result.localPoint());
+
+        updateSelectionForMouseDrag(result);
     }
-    updateSelectionForMouseDrag(targetNode, event.localPoint());
+    updateSelectionForMouseDrag(event.hitTestResult());
     return true;
 }
     
@@ -629,25 +629,42 @@ void EventHandler::updateSelectionForMouseDrag()
                            HitTestRequest::MouseMove);
     HitTestResult result(view->windowToContents(m_currentMousePosition));
     layer->hitTest(request, result);
-    updateSelectionForMouseDrag(result.innerNode(), result.localPoint());
+    updateSelectionForMouseDrag(result);
 }
 
-void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint& localPoint)
+static VisiblePosition selectionExtentRespectingEditingBoundary(const VisibleSelection& selection, const IntPoint& localPoint, Node* targetNode)
 {
-    if (!m_mouseDownMayStartSelect)
-        return;
+    IntPoint selectionEndPoint = localPoint;
+    Element* editableElement = selection.rootEditableElement();
 
-    if (!targetNode)
+    if (!targetNode->renderer())
+        return VisiblePosition();
+
+    if (editableElement && !editableElement->contains(targetNode)) {
+        if (!editableElement->renderer())
+            return VisiblePosition();
+
+        FloatPoint absolutePoint = targetNode->renderer()->localToAbsolute(FloatPoint(selectionEndPoint));
+        selectionEndPoint = roundedIntPoint(editableElement->renderer()->absoluteToLocal(absolutePoint));
+        targetNode = editableElement;
+    }
+
+    return targetNode->renderer()->positionForPoint(selectionEndPoint);
+}
+
+void EventHandler::updateSelectionForMouseDrag(const HitTestResult& hitTestResult)
+{
+    if (!m_mouseDownMayStartSelect)
         return;
 
-    if (!canMouseDragExtendSelect(targetNode))
+    Node* target = targetNode(hitTestResult);
+    if (!target)
         return;
 
-    RenderObject* targetRenderer = targetNode->renderer();
-    if (!targetRenderer)
+    if (!canMouseDragExtendSelect(target))
         return;
 
-    VisiblePosition targetPosition(targetRenderer->positionForPoint(localPoint));
+    VisiblePosition targetPosition = selectionExtentRespectingEditingBoundary(m_frame->selection()->selection(), hitTestResult.localPoint(), target);
 
     // Don't modify the selection if we're not on a node.
     if (targetPosition.isNull())
@@ -663,7 +680,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
     if (Node* selectionBaseNode = newSelection.base().deprecatedNode())
         if (RenderObject* selectionBaseRenderer = selectionBaseNode->renderer())
             if (selectionBaseRenderer->isSVGText())
-                if (targetNode->renderer()->containingBlock() != selectionBaseRenderer->containingBlock())
+                if (target->renderer()->containingBlock() != selectionBaseRenderer->containingBlock())
                     return;
 #endif
 
@@ -731,7 +748,7 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
             && m_frame->selection()->isRange()
             && event.event().button() != RightButton) {
         VisibleSelection newSelection;
-        Node* node = event.targetNode();
+        Node* node = targetNode(event);
         bool caretBrowsing = m_frame->settings()->caretBrowsingEnabled();
         if (node && (caretBrowsing || node->rendererIsEditable()) && node->renderer()) {
             VisiblePosition pos = node->renderer()->positionForPoint(event.localPoint());
@@ -1106,11 +1123,11 @@ IntPoint EventHandler::currentMousePosition() const
     return m_currentMousePosition;
 }
 
-Frame* subframeForHitTestResult(const MouseEventWithHitTestResults& hitTestResult)
+Frame* EventHandler::subframeForHitTestResult(const MouseEventWithHitTestResults& hitTestResult)
 {
     if (!hitTestResult.isOverWidget())
         return 0;
-    return EventHandler::subframeForTargetNode(hitTestResult.targetNode());
+    return subframeForTargetNode(targetNode(hitTestResult));
 }
 
 Frame* EventHandler::subframeForTargetNode(Node* node)
@@ -1142,7 +1159,7 @@ static bool nodeIsNotBeingEdited(Node* node, Frame* frame)
 
 Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scrollbar* scrollbar)
 {
-    Node* node = event.targetNode();
+    Node* node = targetNode(event);
     RenderObject* renderer = node ? node->renderer() : 0;
     RenderStyle* style = renderer ? renderer->style() : 0;
 
@@ -1307,6 +1324,27 @@ static IntPoint documentPointForWindowPoint(Frame* frame, const IntPoint& window
     return view ? view->windowToContents(windowPoint) : windowPoint;
 }
 
+Node* EventHandler::targetNode(const MouseEventWithHitTestResults& event)
+{
+    return targetNode(event.hitTestResult());
+}
+
+Node* EventHandler::targetNode(const HitTestResult& hitTestResult)
+{
+    Node* node = hitTestResult.innerNode();
+    if (!node)
+        return 0;
+    if (node->inDocument())
+        return node;
+
+    Element* element = node->parentElement();
+    if (element && element->inDocument())
+        return element;
+
+    return node;
+
+}
+
 bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 {
     RefPtr<FrameView> protector(m_frame->view());
@@ -1344,12 +1382,12 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     IntPoint documentPoint = documentPointForWindowPoint(m_frame, mouseEvent.pos());
     MouseEventWithHitTestResults mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
 
-    if (!mev.targetNode()) {
+    if (!targetNode(mev)) {
         invalidateClick();
         return false;
     }
 
-    m_mousePressNode = mev.targetNode();
+    m_mousePressNode = targetNode(mev);
 
     if (InspectorInstrumentation::handleMousePress(m_frame->page())) {
         invalidateClick();
@@ -1362,7 +1400,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
         // the m_mousePressed flag, which may happen if an AppKit widget entered a modal event loop.
         m_capturesDragging = subframe->eventHandler()->capturesDragging();
         if (m_mousePressed && m_capturesDragging) {
-            m_capturingMouseEventsNode = mev.targetNode();
+            m_capturingMouseEventsNode = targetNode(mev);
             m_eventHandlerWillResetCapturingMouseEventsNode = true;
         }
         invalidateClick();
@@ -1370,16 +1408,21 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     }
 
 #if ENABLE(PAN_SCROLLING)
-    Page* page = m_frame->page();
-    if ((page && page->mainFrame()->eventHandler()->panScrollInProgress()) || m_autoscrollInProgress) {
+    // We store whether pan scrolling is in progress before calling stopAutoscrollTimer()
+    // because it will set m_panScrollInProgress to false on return.
+    bool isPanScrollInProgress = m_frame->page() && m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress();
+    if (isPanScrollInProgress || m_autoscrollInProgress)
         stopAutoscrollTimer();
+    if (isPanScrollInProgress) {
+        // We invalidate the click when exiting pan scrolling so that we don't inadvertently navigate
+        // away from the current page (e.g. the click was on a hyperlink). See <rdar://problem/6095023>.
         invalidateClick();
         return true;
     }
 #endif
 
     m_clickCount = mouseEvent.clickCount();
-    m_clickNode = mev.targetNode();
+    m_clickNode = targetNode(mev);
 
     if (FrameView* view = m_frame->view()) {
         RenderLayer* layer = m_clickNode->renderer() ? m_clickNode->renderer()->enclosingLayer() : 0;
@@ -1395,7 +1438,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_frame->selection()->setCaretBlinkingSuspended(true);
 
-    bool swallowEvent = dispatchMouseEvent(eventNames().mousedownEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    bool swallowEvent = dispatchMouseEvent(eventNames().mousedownEvent, targetNode(mev), true, m_clickCount, mouseEvent, true);
     m_capturesDragging = !swallowEvent;
 
     // If the hit testing originally determined the event was in a scrollbar, refetch the MouseEventWithHitTestResults
@@ -1421,7 +1464,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
         // If a mouse event handler changes the input element type to one that has a widget associated,
         // we'd like to EventHandler::handleMousePressEvent to pass the event to the widget and thus the
         // event target node can't still be the shadow node.
-        if (mev.targetNode()->isShadowRoot() && mev.targetNode()->shadowHost()->hasTagName(inputTag)) {
+        if (targetNode(mev)->isShadowRoot() && targetNode(mev)->shadowHost()->hasTagName(inputTag)) {
             HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
             mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
         }
@@ -1462,9 +1505,9 @@ bool EventHandler::handleMouseDoubleClickEvent(const PlatformMouseEvent& mouseEv
         return true;
 
     m_clickCount = mouseEvent.clickCount();
-    bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, mev.targetNode(), true, m_clickCount, mouseEvent, false);
+    bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, targetNode(mev), true, m_clickCount, mouseEvent, false);
 
-    bool swallowClickEvent = mouseEvent.button() != RightButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    bool swallowClickEvent = mouseEvent.button() != RightButton && targetNode(mev) == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, targetNode(mev), true, m_clickCount, mouseEvent, true);
 
     if (m_lastScrollbarUnderMouse)
         swallowMouseUpEvent = m_lastScrollbarUnderMouse->mouseUp();
@@ -1590,7 +1633,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
 
     if (newSubframe) {
         // Update over/out state before passing the event to the subframe.
-        updateMouseEventTargetNode(mev.targetNode(), mouseEvent, true);
+        updateMouseEventTargetNode(targetNode(mev), mouseEvent, true);
         
         // Event dispatch in updateMouseEventTargetNode may have caused the subframe of the target
         // node to be detached from its FrameView, in which case the event should not be passed.
@@ -1605,8 +1648,8 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
                 // in case the particular plugin doesn't manipulate cursor at all. Thus,  even a CSS cursor set on body has no
                 // effect on plugins (which matches Firefox).
                 bool overPluginElement = false;
-                if (mev.targetNode() && mev.targetNode()->isHTMLElement()) {
-                    HTMLElement* el = toHTMLElement(mev.targetNode());
+                if (targetNode(mev) && targetNode(mev)->isHTMLElement()) {
+                    HTMLElement* el = toHTMLElement(targetNode(mev));
                     overPluginElement = el->hasTagName(appletTag) || el->hasTagName(objectTag) || el->hasTagName(embedTag);
                 }
                 if (!overPluginElement) {
@@ -1622,7 +1665,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     if (swallowEvent)
         return true;
     
-    swallowEvent = dispatchMouseEvent(eventNames().mousemoveEvent, mev.targetNode(), false, 0, mouseEvent, true);
+    swallowEvent = dispatchMouseEvent(eventNames().mousemoveEvent, targetNode(mev), false, 0, mouseEvent, true);
 #if ENABLE(DRAG_SUPPORT)
     if (!swallowEvent)
         swallowEvent = handleMouseDraggedEvent(mev);
@@ -1684,9 +1727,9 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
     if (subframe && passMouseReleaseEventToSubframe(mev, subframe))
         return true;
 
-    bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, mev.targetNode(), true, m_clickCount, mouseEvent, false);
+    bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, targetNode(mev), true, m_clickCount, mouseEvent, false);
 
-    bool swallowClickEvent = m_clickCount > 0 && mouseEvent.button() != RightButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    bool swallowClickEvent = m_clickCount > 0 && mouseEvent.button() != RightButton && targetNode(mev) == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, targetNode(mev), true, m_clickCount, mouseEvent, true);
 
     if (m_resizeLayer) {
         m_resizeLayer->setInResizeMode(false);
@@ -1712,11 +1755,9 @@ bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTa
         return false;
 
     view->resetDeferredRepaintDelay();
-    IntPoint contentsPos = view->windowToContents(event.pos());
-
     RefPtr<MouseEvent> me = MouseEvent::create(eventType,
         true, true, m_frame->document()->defaultView(),
-        0, event.globalX(), event.globalY(), contentsPos.x(), contentsPos.y(),
+        0, event.globalX(), event.globalY(), event.x(), event.y(),
         event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
         0, 0, clipboard);
 
@@ -1765,7 +1806,7 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
     MouseEventWithHitTestResults mev = prepareMouseEvent(request, event);
 
     // Drag events should never go to text nodes (following IE, and proper mouseover/out dispatch)
-    Node* newTarget = mev.targetNode();
+    Node* newTarget = targetNode(mev);
     if (newTarget && newTarget->isTextNode())
         newTarget = newTarget->parentNode();
     if (newTarget)
@@ -2074,6 +2115,10 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     HitTestResult result(vPoint);
     doc->renderView()->layer()->hitTest(request, result);
 
+#if PLATFORM(MAC)
+    m_useLatchedWheelEventNode = e.momentumPhase() == PlatformWheelEventPhaseBegan || e.momentumPhase() == PlatformWheelEventPhaseChanged;
+#endif
+
     if (m_useLatchedWheelEventNode) {
         if (!m_latchedWheelEventNode) {
             m_latchedWheelEventNode = result.innerNode();
@@ -2108,9 +2153,10 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         }
 
         node = node->shadowAncestorNode();
-        node->dispatchWheelEvent(e);
-        if (e.isAccepted())
+        if (!node->dispatchWheelEvent(e)) {
+            e.accept();
             return true;
+        }
     }
 
     if (e.isAccepted())
@@ -2178,12 +2224,12 @@ bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
         // FIXME: In the editable case, word selection sometimes selects content that isn't underneath the mouse.
         // If the selection is non-editable, we do word selection to make it easier to use the contextual menu items
         // available for text selections.  But only if we're above text.
-        && (m_frame->selection()->isContentEditable() || (mev.targetNode() && mev.targetNode()->isTextNode()))) {
+        && (m_frame->selection()->isContentEditable() || (targetNode(mev) && targetNode(mev)->isTextNode()))) {
         m_mouseDownMayStartSelect = true; // context menu events are always allowed to perform a selection
         selectClosestWordOrLinkFromMouseEvent(mev);
     }
 
-    swallowEvent = dispatchMouseEvent(eventNames().contextmenuEvent, mev.targetNode(), true, 0, event, false);
+    swallowEvent = dispatchMouseEvent(eventNames().contextmenuEvent, targetNode(mev), true, 0, event, false);
     
     return swallowEvent;
 }
@@ -2414,6 +2460,9 @@ bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 {
     RefPtr<FrameView> protector(m_frame->view()); 
 
+    if (initialKeyEvent.windowsVirtualKeyCode() == VK_CAPITAL)
+        capsLockStateMayHaveChanged();
+
 #if ENABLE(PAN_SCROLLING)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
@@ -2553,6 +2602,8 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
             return;
         if (event->keyIdentifier() == "U+0009")
             defaultTabEventHandler(event);
+        else if (event->keyIdentifier() == "U+0008")
+            defaultBackspaceEventHandler(event);
         else {
             FocusDirection direction = focusDirectionForKey(event->keyIdentifier());
             if (direction != FocusDirectionNone)
@@ -2854,20 +2905,30 @@ void EventHandler::defaultTextInputEventHandler(TextEvent* event)
         event->setDefaultHandled();
 }
 
+<<<<<<< HEAD
 #if PLATFORM(QT) || PLATFORM(MAC) || PLATFORM(ANDROID)
 
 // These two platforms handle the space event in the platform-specific WebKit code.
 // Eventually it would be good to eliminate that and use the code here instead, but
 // the Qt version is inside an ifdef and the Mac version has some extra behavior
 // so we can't unify everything yet.
+=======
+#if PLATFORM(QT)
+// Qt handles the space event in platform-specific WebKit code.
+// Eventually it would be good to eliminate that and use the code here instead.
+>>>>>>> WebKit.org at r84325
 void EventHandler::defaultSpaceEventHandler(KeyboardEvent*)
 {
 }
-
 #else
 
 void EventHandler::defaultSpaceEventHandler(KeyboardEvent* event)
 {
+    ASSERT(event->type() == eventNames().keypressEvent);
+
+    if (event->ctrlKey() || event->metaKey() || event->altKey() || event->altGraphKey())
+        return;
+
     ScrollLogicalDirection direction = event->shiftKey() ? ScrollBlockDirectionBackward : ScrollBlockDirectionForward;
     if (logicalScrollOverflow(direction, ScrollByPage)) {
         event->setDefaultHandled();
@@ -2884,8 +2945,33 @@ void EventHandler::defaultSpaceEventHandler(KeyboardEvent* event)
 
 #endif
 
+void EventHandler::defaultBackspaceEventHandler(KeyboardEvent* event)
+{
+    ASSERT(event->type() == eventNames().keydownEvent);
+
+    if (event->ctrlKey() || event->metaKey() || event->altKey() || event->altGraphKey())
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    bool handledEvent = false;
+
+    if (event->shiftKey())
+        handledEvent = page->goForward();
+    else
+        handledEvent = page->goBack();
+
+    if (handledEvent)
+        event->setDefaultHandled();
+}
+
+
 void EventHandler::defaultArrowEventHandler(FocusDirection focusDirection, KeyboardEvent* event)
 {
+    ASSERT(event->type() == eventNames().keydownEvent);
+
     if (event->ctrlKey() || event->metaKey() || event->altGraphKey() || event->shiftKey())
         return;
 
@@ -2907,6 +2993,8 @@ void EventHandler::defaultArrowEventHandler(FocusDirection focusDirection, Keybo
 
 void EventHandler::defaultTabEventHandler(KeyboardEvent* event)
 {
+    ASSERT(event->type() == eventNames().keydownEvent);
+
     // We should only advance focus on tabs if no special modifier keys are held down.
     if (event->ctrlKey() || event->metaKey() || event->altGraphKey())
         return;
@@ -2947,7 +3035,7 @@ void EventHandler::sendScrollEvent()
 {
     setFrameWasScrolledByUser();
     if (m_frame->view() && m_frame->document())
-        m_frame->document()->eventQueue()->enqueueScrollEvent(m_frame->document(), EventQueue::ScrollEventDocumentTarget);
+        m_frame->document()->eventQueue()->enqueueOrDispatchScrollEvent(m_frame->document(), EventQueue::ScrollEventDocumentTarget);
 }
 
 void EventHandler::setFrameWasScrolledByUser()
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index 70d6194..7b4bcce 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -143,6 +143,7 @@ public:
     void setIgnoreWheelEvents(bool);
 
     static Frame* subframeForTargetNode(Node*);
+    static Frame* subframeForHitTestResult(const MouseEventWithHitTestResults&);
 
     bool scrollOverflow(ScrollDirection, ScrollGranularity, Node* startingNode = 0);
     bool logicalScrollOverflow(ScrollLogicalDirection, ScrollGranularity, Node* startingNode = 0);
@@ -264,13 +265,16 @@ private:
     
     PassRefPtr<Clipboard> createDraggingClipboard() const;
 #endif // ENABLE(DRAG_SUPPORT)
-    
+
     bool eventActivatedView(const PlatformMouseEvent&) const;
     void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults&);
     void selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHitTestResults&);
 
     bool handleMouseDoubleClickEvent(const PlatformMouseEvent&);
 
+    static Node* targetNode(const MouseEventWithHitTestResults&);
+    static Node* targetNode(const HitTestResult&);
+
     bool handleMousePressEvent(const MouseEventWithHitTestResults&);
     bool handleMousePressEventSingleClick(const MouseEventWithHitTestResults&);
     bool handleMousePressEventDoubleClick(const MouseEventWithHitTestResults&);
@@ -344,6 +348,7 @@ private:
     bool passWheelEventToWidget(PlatformWheelEvent&, Widget*);
 
     void defaultSpaceEventHandler(KeyboardEvent*);
+    void defaultBackspaceEventHandler(KeyboardEvent*);
     void defaultTabEventHandler(KeyboardEvent*);
     void defaultArrowEventHandler(FocusDirection, KeyboardEvent*);
 
@@ -359,7 +364,7 @@ private:
 #endif
 
 #if ENABLE(DRAG_SUPPORT)
-    void updateSelectionForMouseDrag(Node* targetNode, const IntPoint& localPoint);
+    void updateSelectionForMouseDrag(const HitTestResult&);
 #endif
 
     void updateLastScrollbarUnderMouse(Scrollbar*, bool);
diff --git a/Source/WebCore/page/EventSource.cpp b/Source/WebCore/page/EventSource.cpp
index 08d0868..2a52bcb 100644
--- a/Source/WebCore/page/EventSource.cpp
+++ b/Source/WebCore/page/EventSource.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2009 Ericsson AB
  * All rights reserved.
  * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, Code Aurora Forum. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,6 +46,7 @@
 #include "ResourceError.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
+#include "ScriptCallStack.h"
 #include "ScriptExecutionContext.h"
 #include "SerializedScriptValue.h"
 #include "TextResourceDecoder.h"
@@ -180,7 +182,32 @@ ScriptExecutionContext* EventSource::scriptExecutionContext() const
 void EventSource::didReceiveResponse(const ResourceResponse& response)
 {
     int statusCode = response.httpStatusCode();
-    if (statusCode == 200 && response.mimeType() == "text/event-stream") {
+    bool mimeTypeIsValid = response.mimeType() == "text/event-stream";
+    bool responseIsValid = statusCode == 200 && mimeTypeIsValid;
+    if (responseIsValid) {
+        const String& charset = response.textEncodingName();
+        // If we have a charset, the only allowed value is UTF-8 (case-insensitive). This should match
+        // the updated EventSource standard.
+        responseIsValid = charset.isEmpty() || equalIgnoringCase(charset, "UTF-8");
+        if (!responseIsValid) {
+            String message = "EventSource's response has a charset (\"";
+            message += charset;
+            message += "\") that is not UTF-8. Aborting the connection.";
+            // FIXME: We are missing the source line.
+            scriptExecutionContext()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String(), 0);
+        }
+    } else {
+        // To keep the signal-to-noise ratio low, we only log 200-response with an invalid MIME type.
+        if (statusCode == 200 && !mimeTypeIsValid) {
+            String message = "EventSource's response has a MIME type (\"";
+            message += response.mimeType();
+            message += "\") that is not \"text/event-stream\". Aborting the connection.";
+            // FIXME: We are missing the source line.
+            scriptExecutionContext()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String(), 0);
+        }
+    }
+
+    if (responseIsValid) {
         m_state = OPEN;
         dispatchEvent(Event::create(eventNames().openEvent, false, false));
     } else {
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index 41cfee4..5b91eeb 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -170,7 +170,15 @@ static Node* deepFocusableNode(FocusDirection direction, Node* node, KeyboardEve
 
 bool FocusController::setInitialFocus(FocusDirection direction, KeyboardEvent* event)
 {
-    return advanceFocus(direction, event, true);
+    bool didAdvanceFocus = advanceFocus(direction, event, true);
+    
+    // If focus is being set initially, accessibility needs to be informed that system focus has moved 
+    // into the web area again, even if focus did not change within WebCore. PostNotification is called instead
+    // of handleFocusedUIElementChanged, because this will send the notification even if the element is the same.
+    if (AXObjectCache::accessibilityEnabled())
+        focusedOrMainFrame()->document()->axObjectCache()->postNotification(focusedOrMainFrame()->document()->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
+
+    return didAdvanceFocus;
 }
 
 bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* event, bool initialFocus)
@@ -589,6 +597,9 @@ bool FocusController::advanceFocusDirectionally(FocusDirection direction, Keyboa
     Node* focusedNode = focusedDocument->focusedNode();
     Node* container = focusedDocument;
 
+    if (container->isDocumentNode())
+        static_cast<Document*>(container)->updateLayoutIgnorePendingStylesheets();
+        
     // Figure out the starting rect.
     IntRect startingRect;
     if (focusedNode) {
@@ -604,11 +615,11 @@ bool FocusController::advanceFocusDirectionally(FocusDirection direction, Keyboa
 
     bool consumed = false;
     do {
-        if (container->isDocumentNode())
-            static_cast<Document*>(container)->updateLayoutIgnorePendingStylesheets();
         consumed = advanceFocusDirectionallyInContainer(container, startingRect, direction, event);
         startingRect = nodeRectInAbsoluteCoordinates(container, true /* ignore border */);
         container = scrollableEnclosingBoxOrParentFrameForNodeInDirection(direction, container);
+        if (container && container->isDocumentNode())
+            static_cast<Document*>(container)->updateLayoutIgnorePendingStylesheets();
     } while (!consumed && container);
 
     return consumed;
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 3652c9a..c3b56e7 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -5,7 +5,7 @@
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
@@ -72,6 +72,7 @@
 #include "RenderView.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
+#include "ScriptValue.h"
 #include "Settings.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
@@ -522,9 +523,9 @@ void Frame::injectUserScripts(UserScriptInjectionTime injectionTime)
     if (!m_page)
         return;
 
-    if (loader()->stateMachine()->creatingInitialEmptyDocument())
+    if (loader()->stateMachine()->creatingInitialEmptyDocument() && !settings()->shouldInjectUserScriptsInInitialEmptyDocument())
         return;
-    
+
     // Walk the hashtable. Inject by world.
     const UserScriptMap* userScripts = m_page->group().userScripts();
     if (!userScripts)
@@ -808,6 +809,31 @@ Document* Frame::documentAtPoint(const IntPoint& point)
     return result.innerNode() ? result.innerNode()->document() : 0;
 }
 
+PassRefPtr<Range> Frame::rangeForPoint(const IntPoint& framePoint)
+{
+    VisiblePosition position = visiblePositionForPoint(framePoint);
+    if (position.isNull())
+        return 0;
+
+    VisiblePosition previous = position.previous();
+    if (previous.isNotNull()) {
+        RefPtr<Range> previousCharacterRange = makeRange(previous, position);
+        IntRect rect = editor()->firstRectForRange(previousCharacterRange.get());
+        if (rect.contains(framePoint))
+            return previousCharacterRange.release();
+    }
+
+    VisiblePosition next = position.next();
+    if (next.isNotNull()) {
+        RefPtr<Range> nextCharacterRange = makeRange(position, next);
+        IntRect rect = editor()->firstRectForRange(nextCharacterRange.get());
+        if (rect.contains(framePoint))
+            return nextCharacterRange.release();
+    }
+
+    return 0;
+}
+
 void Frame::createView(const IntSize& viewportSize,
                        const Color& backgroundColor, bool transparent,
                        const IntSize& fixedLayoutSize, bool useFixedLayout,
@@ -947,6 +973,8 @@ void Frame::setPageAndTextZoomFactors(float pageZoomFactor, float textZoomFactor
     if (!document)
         return;
 
+    m_editor.dismissCorrectionPanelAsIgnored();
+
 #if ENABLE(SVG)
     // Respect SVGs zoomAndPan="disabled" property in standalone SVG documents.
     // FIXME: How to handle compound documents + zoomAndPan="disabled"? Needs SVG WG clarification.
@@ -999,16 +1027,18 @@ void Frame::scalePage(float scale, const IntPoint& origin)
     if (!document)
         return;
 
-    m_pageScaleFactor = scale;
+    if (scale != m_pageScaleFactor) {
+        m_pageScaleFactor = scale;
 
-    if (document->renderer())
-        document->renderer()->setNeedsLayout(true);
+        if (document->renderer())
+            document->renderer()->setNeedsLayout(true);
 
-    document->recalcStyle(Node::Force);
+        document->recalcStyle(Node::Force);
 
 #if USE(ACCELERATED_COMPOSITING)
-    updateContentsScale(scale);
+        updateContentsScale(scale);
 #endif
+    }
 
     if (FrameView* view = this->view()) {
         if (document->renderer() && document->renderer()->needsLayout() && view->didFirstLayout())
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index f22fcb8..05805cf 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -184,6 +184,7 @@ namespace WebCore {
 
         VisiblePosition visiblePositionForPoint(const IntPoint& framePoint);
         Document* documentAtPoint(const IntPoint& windowPoint);
+        PassRefPtr<Range> rangeForPoint(const IntPoint& framePoint);
 
         String searchForLabelsAboveCell(RegularExpression*, HTMLTableCellElement*, size_t* resultDistanceFromStartOfCell);
         String searchForLabelsBeforeElement(const Vector<String>& labels, Element*, size_t* resultDistance, bool* resultIsInCellAbove);
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 9cf2c57..ee6bd6b 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -152,6 +152,11 @@ FrameView::FrameView(Frame* frame)
         if (Page* page = m_frame->page()) {
             m_page = page;
             m_page->addScrollableArea(this);
+
+            if (m_frame == m_page->mainFrame()) {
+                ScrollableArea::setVerticalScrollElasticity(ScrollElasticityAllowed);
+                ScrollableArea::setHorizontalScrollElasticity(ScrollElasticityAllowed);
+            }
         }
     }
 }
@@ -265,6 +270,10 @@ void FrameView::resetScrollbars()
 
 void FrameView::resetScrollbarsAndClearContentsSize()
 {
+    // Since the contents size is being cleared, the scroll position will lost as a consequence.
+    // Cache the scroll position so it can be restored by the page cache if necessary. 
+    cacheCurrentScrollPosition();
+
     resetScrollbars();
 
     setScrollbarsSuppressed(true);
@@ -335,7 +344,7 @@ bool FrameView::didFirstLayout() const
 void FrameView::invalidateRect(const IntRect& rect)
 {
     if (!parent()) {
-        if (hostWindow() && shouldUpdate())
+        if (hostWindow())
             hostWindow()->invalidateContentsAndWindow(rect, false /*immediate*/);
         return;
     }
@@ -524,6 +533,8 @@ void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, S
 
 void FrameView::calculateScrollbarModesForLayout(ScrollbarMode& hMode, ScrollbarMode& vMode)
 {
+    m_viewportRenderer = 0;
+
     const HTMLFrameOwnerElement* owner = m_frame->ownerElement();
     if (owner && (owner->scrollingMode() == ScrollbarAlwaysOff)) {
         hMode = ScrollbarAlwaysOff;
@@ -590,6 +601,30 @@ void FrameView::updateCompositingLayers()
 #endif
 }
 
+GraphicsLayer* FrameView::layerForHorizontalScrollbar() const
+{
+    RenderView* view = m_frame->contentRenderer();
+    if (!view)
+        return 0;
+    return view->compositor()->layerForHorizontalScrollbar();
+}
+
+GraphicsLayer* FrameView::layerForVerticalScrollbar() const
+{
+    RenderView* view = m_frame->contentRenderer();
+    if (!view)
+        return 0;
+    return view->compositor()->layerForVerticalScrollbar();
+}
+
+GraphicsLayer* FrameView::layerForScrollCorner() const
+{
+    RenderView* view = m_frame->contentRenderer();
+    if (!view)
+        return 0;
+    return view->compositor()->layerForScrollCorner();
+}
+
 bool FrameView::syncCompositingStateForThisFrame()
 {
     ASSERT(m_frame->view() == this);
@@ -602,6 +637,13 @@ bool FrameView::syncCompositingStateForThisFrame()
     if (needsLayout())
         return false;
 
+    if (GraphicsLayer* graphicsLayer = view->compositor()->layerForHorizontalScrollbar())
+        graphicsLayer->syncCompositingStateForThisLayerOnly();
+    if (GraphicsLayer* graphicsLayer = view->compositor()->layerForVerticalScrollbar())
+        graphicsLayer->syncCompositingStateForThisLayerOnly();
+    if (GraphicsLayer* graphicsLayer = view->compositor()->layerForScrollCorner())
+        graphicsLayer->syncCompositingStateForThisLayerOnly();
+
     view->compositor()->flushPendingLayerChanges();
 
 #if ENABLE(FULLSCREEN_API)
@@ -646,7 +688,7 @@ bool FrameView::hasCompositedContentIncludingDescendants() const
             if (compositor->inCompositingMode())
                 return true;
 
-            if (!RenderLayerCompositor::allowsIndependentlyCompositedIFrames(this))
+            if (!RenderLayerCompositor::allowsIndependentlyCompositedFrames(this))
                 break;
         }
     }
@@ -857,7 +899,7 @@ void FrameView::layout(bool allowSubtree)
             printf("Elapsed time before first layout: %d\n", document->elapsedTime());
 #endif        
     }
-    
+
     ScrollbarMode hMode;
     ScrollbarMode vMode;    
     calculateScrollbarModesForLayout(hMode, vMode);
@@ -1320,7 +1362,7 @@ void FrameView::setIsOverlapped(bool isOverlapped)
             }
         }
 
-        if (RenderLayerCompositor::allowsIndependentlyCompositedIFrames(this)) {
+        if (RenderLayerCompositor::allowsIndependentlyCompositedFrames(this)) {
             // We also need to trigger reevaluation for this and all descendant frames,
             // since a frame uses compositing if any ancestor is compositing.
             for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext(m_frame.get())) {
@@ -1503,7 +1545,7 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
 {
     ASSERT(!m_frame->ownerElement());
 
-    double delay = adjustedDeferredRepaintDelay();
+    double delay = m_deferringRepaints ? 0 : adjustedDeferredRepaintDelay();
     if ((m_deferringRepaints || m_deferredRepaintTimer.isActive() || delay) && !immediate) {
         IntRect paintRect = r;
         if (clipsRepaints() && !paintsEntireContents())
@@ -1561,6 +1603,13 @@ void FrameView::visibleContentsResized()
 
     if (needsLayout())
         layout();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (RenderView* root = m_frame->contentRenderer()) {
+        if (root->usesCompositing())
+            root->compositor()->frameViewDidChangeSize();
+    }
+#endif
 }
 
 void FrameView::beginDeferredRepaints()
@@ -1659,6 +1708,7 @@ void FrameView::resetDeferredRepaintDelay()
 
 double FrameView::adjustedDeferredRepaintDelay() const
 {
+    ASSERT(!m_deferringRepaints);
     if (!m_deferredRepaintDelay)
         return 0;
     double timeSinceLastPaint = currentTime() - m_lastPaintTime;
@@ -1748,10 +1798,12 @@ void FrameView::scheduleRelayoutOfSubtree(RenderObject* relayoutRoot)
             if (isObjectAncestorContainerOf(m_layoutRoot, relayoutRoot)) {
                 // Keep the current root
                 relayoutRoot->markContainingBlocksForLayout(false, m_layoutRoot);
+                ASSERT(!m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout());
             } else if (m_layoutRoot && isObjectAncestorContainerOf(relayoutRoot, m_layoutRoot)) {
                 // Re-root at relayoutRoot
                 m_layoutRoot->markContainingBlocksForLayout(false, relayoutRoot);
                 m_layoutRoot = relayoutRoot;
+                ASSERT(!m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout());
             } else {
                 // Just do a full relayout
                 if (m_layoutRoot)
@@ -1763,6 +1815,7 @@ void FrameView::scheduleRelayoutOfSubtree(RenderObject* relayoutRoot)
     } else if (m_layoutSchedulingEnabled) {
         int delay = m_frame->document()->minimumLayoutDelay();
         m_layoutRoot = relayoutRoot;
+        ASSERT(!m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout());
         m_delayedLayout = delay != 0;
         m_layoutTimer.startOneShot(delay * 0.001);
     }
@@ -1869,8 +1922,6 @@ bool FrameView::shouldUpdate(bool immediateRequested) const
 {
     if (!immediateRequested && isOffscreen() && !shouldUpdateWhileOffscreen())
         return false;
-    if (!m_frame || !m_frame->document() || m_frame->document()->mayCauseFlashOfUnstyledContent())
-        return false;
     return true;
 }
 
@@ -2141,7 +2192,11 @@ void FrameView::didCompleteRubberBand(const IntSize& initialOverhang) const
 
 void FrameView::scrollbarStyleChanged()
 {
-    m_frame->page()->setNeedsRecalcStyleInAllFrames();
+    Page* page = m_frame->page();
+    ASSERT(page);
+    if (!page)
+        return;
+    page->setNeedsRecalcStyleInAllFrames();
 }
 
 bool FrameView::shouldSuspendScrollAnimations() const
@@ -2179,11 +2234,6 @@ void FrameView::updateDashboardRegions()
 }
 #endif
 
-void FrameView::invalidateScrollCorner()
-{
-    invalidateRect(scrollCornerRect());
-}
-
 void FrameView::updateScrollCorner()
 {
     RenderObject* renderer = 0;
@@ -2218,11 +2268,13 @@ void FrameView::updateScrollCorner()
         if (!m_scrollCorner)
             m_scrollCorner = new (renderer->renderArena()) RenderScrollbarPart(renderer->document());
         m_scrollCorner->setStyle(cornerStyle.release());
-        invalidateRect(scrollCornerRect());
+        invalidateScrollCorner();
     } else if (m_scrollCorner) {
         m_scrollCorner->destroy();
         m_scrollCorner = 0;
     }
+
+    ScrollView::updateScrollCorner();
 }
 
 void FrameView::paintScrollCorner(GraphicsContext* context, const IntRect& cornerRect)
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 9af0552..d00b423 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -218,6 +218,7 @@ public:
     void setNodeToDraw(Node*);
 
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
+    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
 
     static double currentPaintTimeStamp() { return sCurrentPaintTimeStamp; } // returns 0 if not painting
     
@@ -258,7 +259,6 @@ public:
     virtual IntPoint convertToRenderer(const RenderObject*, const IntPoint&) const;
 
     bool isFrameViewScrollCorner(RenderScrollbarPart* scrollCorner) const { return m_scrollCorner == scrollCorner; }
-    void invalidateScrollCorner();
 
     void calculateScrollbarModesForLayout(ScrollbarMode& hMode, ScrollbarMode& vMode);
 
@@ -324,6 +324,11 @@ private:
     virtual void scrollTo(const IntSize&);
     virtual void didCompleteRubberBand(const IntSize&) const;
     virtual void scrollbarStyleChanged();
+#if USE(ACCELERATED_COMPOSITING)
+    virtual GraphicsLayer* layerForHorizontalScrollbar() const;
+    virtual GraphicsLayer* layerForVerticalScrollbar() const;
+    virtual GraphicsLayer* layerForScrollCorner() const;
+#endif
 
     virtual void notifyPageThatContentAreaWillPaint() const;
     virtual void disconnectFromPage() { m_page = 0; }
@@ -341,7 +346,6 @@ private:
     bool hasCustomScrollbars() const;
 
     virtual void updateScrollCorner();
-    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
 
     FrameView* parentFrameView() const;
 
diff --git a/Source/WebCore/page/MouseEventWithHitTestResults.cpp b/Source/WebCore/page/MouseEventWithHitTestResults.cpp
index 042269c..b372cff 100644
--- a/Source/WebCore/page/MouseEventWithHitTestResults.cpp
+++ b/Source/WebCore/page/MouseEventWithHitTestResults.cpp
@@ -32,21 +32,6 @@ MouseEventWithHitTestResults::MouseEventWithHitTestResults(const PlatformMouseEv
     , m_hitTestResult(hitTestResult)
 {
 }
-        
-Node* MouseEventWithHitTestResults::targetNode() const
-{
-    Node* node = m_hitTestResult.innerNode();
-    if (!node)
-        return 0;
-    if (node->inDocument())
-        return node;
-
-    Element* element = node->parentElement();
-    if (element && element->inDocument())
-        return element;
-
-    return node;
-}
 
 const IntPoint MouseEventWithHitTestResults::localPoint() const
 {
diff --git a/Source/WebCore/page/MouseEventWithHitTestResults.h b/Source/WebCore/page/MouseEventWithHitTestResults.h
index 8c28574..b351f92 100644
--- a/Source/WebCore/page/MouseEventWithHitTestResults.h
+++ b/Source/WebCore/page/MouseEventWithHitTestResults.h
@@ -34,7 +34,6 @@ public:
 
     const PlatformMouseEvent& event() const { return m_event; }
     const HitTestResult& hitTestResult() const { return m_hitTestResult; }
-    Node* targetNode() const;
     const IntPoint localPoint() const;
     Scrollbar* scrollbar() const;
     bool isOverLink() const;
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 9526536..773483e 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -34,6 +34,8 @@
 #include "Geolocation.h"
 #include "KURL.h"
 #include "Language.h"
+#include "NavigatorUserMediaErrorCallback.h"
+#include "NavigatorUserMediaSuccessCallback.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "PlatformString.h"
@@ -281,4 +283,13 @@ void Navigator::registerProtocolHandler(const String& scheme, const String& url,
 }
 #endif
 
+#if ENABLE(MEDIA_STREAM)
+void Navigator::webkitGetUserMedia(const String& options,
+                                   PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback,
+                                   PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
+{
+    // FIXME: implement a call to the media stream context when available.
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index 8514279..f0963ac 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -36,6 +36,8 @@ class DOMMimeTypeArray;
 class DOMPluginArray;
 class Frame;
 class Geolocation;
+class NavigatorUserMediaErrorCallback;
+class NavigatorUserMediaSuccessCallback;
 class PluginData;
 #if PLATFORM(ANDROID)
 class ApplicationInstalledCallback;
@@ -84,6 +86,11 @@ public:
     void registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode&);
 #endif
 
+#if ENABLE(MEDIA_STREAM)
+    virtual void webkitGetUserMedia(const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>,
+                                    PassRefPtr<NavigatorUserMediaErrorCallback> = 0);
+#endif
+
 private:
     Navigator(Frame*);
     Frame* m_frame;
diff --git a/Source/WebCore/page/Navigator.idl b/Source/WebCore/page/Navigator.idl
index b92ef4a..9b54f2f 100644
--- a/Source/WebCore/page/Navigator.idl
+++ b/Source/WebCore/page/Navigator.idl
@@ -37,7 +37,7 @@ module window {
         readonly attribute DOMString vendorSub;
         readonly attribute boolean cookieEnabled;
         boolean javaEnabled();
-        
+
         readonly attribute boolean onLine;
 
 #if defined(ENABLE_CONNECTION) && ENABLE_CONNECTION
@@ -62,6 +62,12 @@ module window {
         void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
             raises(DomException);
 #endif
+
+#if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
+        [Custom, EnabledAtRuntime] void webkitGetUserMedia(in DOMString options,
+                                                           in [Callback=FunctionOnly] NavigatorUserMediaSuccessCallback successCallback,
+                                                           in [Callback=FunctionOnly, Optional] NavigatorUserMediaErrorCallback errorCallback);
+#endif
     };
 
 }
diff --git a/Source/WebCore/page/NavigatorUserMediaError.h b/Source/WebCore/page/NavigatorUserMediaError.h
new file mode 100644
index 0000000..cc88b4f
--- /dev/null
+++ b/Source/WebCore/page/NavigatorUserMediaError.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NavigatorUserMediaError_h
+#define NavigatorUserMediaError_h
+
+#include <wtf/RefCounted.h>
+
+#if ENABLE(MEDIA_STREAM)
+
+namespace WebCore {
+
+class NavigatorUserMediaError : public RefCounted<NavigatorUserMediaError> {
+public:
+    // Should be kept in sync with the values in the idl file.
+    enum ErrorCode {
+        PERMISSION_DENIED = 1
+    };
+
+    NavigatorUserMediaError(ErrorCode code) : m_code(code) { }
+    virtual ~NavigatorUserMediaError() { }
+
+    ErrorCode code() const { return m_code; }
+
+private:
+    ErrorCode m_code;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // NavigatorUserMediaError_h
diff --git a/Source/WebCore/page/NavigatorUserMediaError.idl b/Source/WebCore/page/NavigatorUserMediaError.idl
new file mode 100644
index 0000000..293450b
--- /dev/null
+++ b/Source/WebCore/page/NavigatorUserMediaError.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+    interface [
+        Conditional=MEDIA_STREAM
+    ] NavigatorUserMediaError {
+        const unsigned short PERMISSION_DENIED = 1;
+        readonly attribute unsigned short code;
+    };
+
+}
+
diff --git a/Source/WebCore/page/NavigatorUserMediaErrorCallback.h b/Source/WebCore/page/NavigatorUserMediaErrorCallback.h
new file mode 100644
index 0000000..19fb9f6
--- /dev/null
+++ b/Source/WebCore/page/NavigatorUserMediaErrorCallback.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NavigatorUserMediaErrorCallback_h
+#define NavigatorUserMediaErrorCallback_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class NavigatorUserMediaError;
+
+class NavigatorUserMediaErrorCallback : public RefCounted<NavigatorUserMediaErrorCallback> {
+public:
+    virtual ~NavigatorUserMediaErrorCallback() { }
+    virtual bool handleEvent(NavigatorUserMediaError*) = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // NavigatorUserMediaErrorCallback_h
diff --git a/Source/WebCore/page/NavigatorUserMediaErrorCallback.idl b/Source/WebCore/page/NavigatorUserMediaErrorCallback.idl
new file mode 100644
index 0000000..66748cd
--- /dev/null
+++ b/Source/WebCore/page/NavigatorUserMediaErrorCallback.idl
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+    interface [
+        Conditional=MEDIA_STREAM,
+        Callback=FunctionOnly
+    ] NavigatorUserMediaErrorCallback {
+        boolean handleEvent(in NavigatorUserMediaError error);
+    };
+
+}
diff --git a/Source/WebCore/page/NavigatorUserMediaSuccessCallback.h b/Source/WebCore/page/NavigatorUserMediaSuccessCallback.h
new file mode 100644
index 0000000..770693d
--- /dev/null
+++ b/Source/WebCore/page/NavigatorUserMediaSuccessCallback.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NavigatorUserMediaSuccessCallback_h
+#define NavigatorUserMediaSuccessCallback_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class NavigatorUserMediaSuccessCallback : public RefCounted<NavigatorUserMediaSuccessCallback> {
+public:
+    virtual ~NavigatorUserMediaSuccessCallback() { }
+    // FIXME: set correct type when the GeneratedStream class is available.
+    // virtual bool handleEvent(GeneratedStream*) = 0;
+    virtual bool handleEvent(int dummy) = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // NavigatorUserMediaSuccessCallback_h
diff --git a/Source/WebCore/page/NavigatorUserMediaSuccessCallback.idl b/Source/WebCore/page/NavigatorUserMediaSuccessCallback.idl
new file mode 100644
index 0000000..e12540c
--- /dev/null
+++ b/Source/WebCore/page/NavigatorUserMediaSuccessCallback.idl
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+    interface [
+        Conditional=MEDIA_STREAM,
+        Callback=FunctionOnly
+    ] NavigatorUserMediaSuccessCallback {
+        // FIXME: implement the correct type when the GeneratedStream class is available.
+        // boolean handleEvent(in GeneratedStream stream);
+        boolean handleEvent(in int dummy);
+    };
+
+}
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index 8307123..ac4c160 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -29,6 +29,10 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 
+#if OS(SOLARIS)
+#include <sys/time.h> // For time_t structure.
+#endif
+
 #if PLATFORM(MAC)
 #include "SchedulePair.h"
 #endif
diff --git a/Source/WebCore/page/PageGroup.cpp b/Source/WebCore/page/PageGroup.cpp
index 969e2a6..b1efbc5 100644
--- a/Source/WebCore/page/PageGroup.cpp
+++ b/Source/WebCore/page/PageGroup.cpp
@@ -33,6 +33,7 @@
 #include "GroupSettings.h"
 #include "IDBFactoryBackendInterface.h"
 #include "Page.h"
+#include "PageCache.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
@@ -291,6 +292,7 @@ inline void PageGroup::addVisitedLink(LinkHash hash)
         return;
 #endif
     Page::visitedStateChanged(this, hash);
+    pageCache()->markPagesForVistedLinkStyleRecalc();
 }
 
 void PageGroup::addVisitedLink(const KURL& url)
@@ -315,11 +317,13 @@ void PageGroup::removeVisitedLinks()
         return;
     m_visitedLinkHashes.clear();
     Page::allVisitedStateChanged(this);
+    pageCache()->markPagesForVistedLinkStyleRecalc();
 }
 
 void PageGroup::removeAllVisitedLinks()
 {
     Page::removeAllVisitedLinks();
+    pageCache()->markPagesForVistedLinkStyleRecalc();
 }
 
 void PageGroup::setShouldTrackVisitedLinks(bool shouldTrack)
diff --git a/Source/WebCore/page/PerformanceTiming.cpp b/Source/WebCore/page/PerformanceTiming.cpp
index 56d6aa9..f17e771 100644
--- a/Source/WebCore/page/PerformanceTiming.cpp
+++ b/Source/WebCore/page/PerformanceTiming.cpp
@@ -161,7 +161,7 @@ unsigned long long PerformanceTiming::domainLookupStart() const
 {
     ResourceLoadTiming* timing = resourceLoadTiming();
     if (!timing)
-        return 0;
+        return fetchStart();
 
     // This will be -1 when a DNS request is not performed.
     // Rather than exposing a special value that indicates no DNS, we "backfill" with fetchStart.
@@ -176,7 +176,7 @@ unsigned long long PerformanceTiming::domainLookupEnd() const
 {
     ResourceLoadTiming* timing = resourceLoadTiming();
     if (!timing)
-        return 0;
+        return domainLookupStart();
 
     // This will be -1 when a DNS request is not performed.
     // Rather than exposing a special value that indicates no DNS, we "backfill" with domainLookupStart.
@@ -191,11 +191,11 @@ unsigned long long PerformanceTiming::connectStart() const
 {
     DocumentLoader* loader = documentLoader();
     if (!loader)
-        return 0;
+        return domainLookupEnd();
 
     ResourceLoadTiming* timing = loader->response().resourceLoadTiming();
     if (!timing)
-        return 0;
+        return domainLookupEnd();
 
     // connectStart will be -1 when a network request is not made.
     // Rather than exposing a special value that indicates no new connection, we "backfill" with domainLookupEnd.
@@ -215,11 +215,11 @@ unsigned long long PerformanceTiming::connectEnd() const
 {
     DocumentLoader* loader = documentLoader();
     if (!loader)
-        return 0;
+        return connectStart();
 
     ResourceLoadTiming* timing = loader->response().resourceLoadTiming();
     if (!timing)
-        return 0;
+        return connectStart();
 
     // connectEnd will be -1 when a network request is not made.
     // Rather than exposing a special value that indicates no new connection, we "backfill" with connectStart.
@@ -251,7 +251,7 @@ unsigned long long PerformanceTiming::requestStart() const
 {
     ResourceLoadTiming* timing = resourceLoadTiming();
     if (!timing)
-        return 0;
+        return connectEnd();
 
     ASSERT(timing->sendStart >= 0);
     return resourceLoadTimeRelativeToAbsolute(timing->sendStart);
@@ -261,7 +261,7 @@ unsigned long long PerformanceTiming::responseStart() const
 {
     ResourceLoadTiming* timing = resourceLoadTiming();
     if (!timing)
-        return 0;
+        return requestStart();
 
     // FIXME: Response start needs to be the time of the first received byte.
     // However, the ResourceLoadTiming API currently only supports the time
@@ -286,7 +286,7 @@ unsigned long long PerformanceTiming::domLoading() const
 {
     const DocumentTiming* timing = documentTiming();
     if (!timing)
-        return 0;
+        return fetchStart();
 
     return toIntegerMilliseconds(timing->domLoading);
 }
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp
index ddd42ea..243f02a 100644
--- a/Source/WebCore/page/SecurityOrigin.cpp
+++ b/Source/WebCore/page/SecurityOrigin.cpp
@@ -103,6 +103,8 @@ SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     // For edge case URLs that were probably misparsed, make sure that the origin is unique.
     if (schemeRequiresAuthority(m_protocol) && m_host.isEmpty())
         m_isUnique = true;
+    if (m_protocol.isEmpty())
+        m_isUnique = true;
 
     // document.domain starts as m_host, but can be set by the DOM.
     m_domain = m_host;
diff --git a/Source/WebCore/page/SecurityOrigin.h b/Source/WebCore/page/SecurityOrigin.h
index 262dd8d..f6ef570 100644
--- a/Source/WebCore/page/SecurityOrigin.h
+++ b/Source/WebCore/page/SecurityOrigin.h
@@ -133,9 +133,6 @@ public:
     // resources, and can set arbitrary headers on XMLHttpRequests.
     bool isLocal() const;
 
-    // The empty SecurityOrigin is the least privileged SecurityOrigin.
-    bool isEmpty() const;
-
     // The origin is a globally unique identifier assigned when the Document is
     // created. http://www.whatwg.org/specs/web-apps/current-work/#sandboxOrigin
     //
@@ -144,6 +141,13 @@ public:
     // addition, the SandboxOrigin flag is inherited by iframes.
     bool isUnique() const { return m_isUnique; }
 
+    // The empty SecurityOrigin is a unique security orign (in the sense of
+    // isUnique above) that was created for a "blank" document, such about
+    // about:blank. Empty origins differ from unique origins in that they can
+    // sometimes be replaced by non-empty origins, for example when an
+    // about:blank iframe inherits its security origin from its parent frame.
+    bool isEmpty() const;
+
     // Marks a file:// origin as being in a domain defined by its path.
     void enforceFilePathSeparation();
 
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index 5cf20d6..f272325 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -101,6 +101,7 @@ Settings::Settings(Page* page)
     , m_isSpatialNavigationEnabled(false)
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
+    , m_loadsSiteIconsIgnoringImageLoadingSetting(false)
     , m_privateBrowsingEnabled(false)
     , m_caretBrowsingEnabled(false)
     , m_areImagesEnabled(true)
@@ -175,6 +176,7 @@ Settings::Settings(Page* page)
     , m_crossOriginCheckInGetMatchedCSSRulesDisabled(false)
     , m_useQuickLookResourceCachingQuirks(false)
     , m_forceCompositingMode(false)
+<<<<<<< HEAD
 #ifdef ANDROID_LAYOUT
     , m_useWideViewport(false)
 #endif
@@ -190,6 +192,9 @@ Settings::Settings(Page* page)
 #ifdef ANDROID_PLUGINS
     , m_pluginsOnDemand(false)
 #endif
+=======
+    , m_shouldInjectUserScriptsInInitialEmptyDocument(false)
+>>>>>>> WebKit.org at r84325
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -303,6 +308,11 @@ void Settings::setLoadsImagesAutomatically(bool loadsImagesAutomatically)
     setLoadsImagesAutomaticallyInAllFrames(m_page);
 }
 
+void Settings::setLoadsSiteIconsIgnoringImageLoadingSetting(bool loadsSiteIcons)
+{
+    m_loadsSiteIconsIgnoringImageLoadingSetting = loadsSiteIcons;
+}
+
 void Settings::setJavaScriptEnabled(bool isJavaScriptEnabled)
 {
     m_isJavaScriptEnabled = isJavaScriptEnabled;
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 35446c5..8aedd77 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -109,10 +109,18 @@ namespace WebCore {
         void setLoadsImagesAutomatically(bool);
         bool loadsImagesAutomatically() const { return m_loadsImagesAutomatically; }
 
+<<<<<<< HEAD
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
         void setBlockNetworkImage(bool);
         bool blockNetworkImage() const { return m_blockNetworkImage; }
 #endif
+=======
+        // This setting only affects site icon image loading if loadsImagesAutomatically setting is false and this setting is true.
+        // All other permutations still heed loadsImagesAutomatically setting.
+        void setLoadsSiteIconsIgnoringImageLoadingSetting(bool);
+        bool loadsSiteIconsIgnoringImageLoadingSetting() const { return m_loadsSiteIconsIgnoringImageLoadingSetting; }
+
+>>>>>>> WebKit.org at r84325
         void setJavaScriptEnabled(bool);
         // Instead of calling isJavaScriptEnabled directly, please consider calling
         // ScriptController::canExecuteScripts, which takes things like the
@@ -453,6 +461,9 @@ namespace WebCore {
 
         void setForceCompositingMode(bool flag) { m_forceCompositingMode = flag; }
         bool forceCompositingMode() { return m_forceCompositingMode; }
+        
+        void setShouldInjectUserScriptsInInitialEmptyDocument(bool flag) { m_shouldInjectUserScriptsInInitialEmptyDocument = flag; }
+        bool shouldInjectUserScriptsInInitialEmptyDocument() { return m_shouldInjectUserScriptsInInitialEmptyDocument; }
 
 #if ENABLE(WEB_AUTOFILL)
         void setAutoFillEnabled(bool flag) { m_autoFillEnabled = flag; }
@@ -505,6 +516,7 @@ namespace WebCore {
         bool m_isSpatialNavigationEnabled : 1;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
+        bool m_loadsSiteIconsIgnoringImageLoadingSetting : 1;
         bool m_privateBrowsingEnabled : 1;
         bool m_caretBrowsingEnabled : 1;
         bool m_areImagesEnabled : 1;
@@ -577,6 +589,7 @@ namespace WebCore {
         bool m_crossOriginCheckInGetMatchedCSSRulesDisabled : 1;
         bool m_useQuickLookResourceCachingQuirks : 1;
         bool m_forceCompositingMode : 1;
+<<<<<<< HEAD
 #ifdef ANDROID_META_SUPPORT
         // default is yes
         bool m_viewport_user_scalable : 1;
@@ -606,6 +619,9 @@ namespace WebCore {
 #ifdef ANDROID_PLUGINS
         bool m_pluginsOnDemand : 1;
 #endif
+=======
+        bool m_shouldInjectUserScriptsInInitialEmptyDocument : 1;
+>>>>>>> WebKit.org at r84325
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/Source/WebCore/page/SpatialNavigation.cpp b/Source/WebCore/page/SpatialNavigation.cpp
index 15d3639..26b24aa 100644
--- a/Source/WebCore/page/SpatialNavigation.cpp
+++ b/Source/WebCore/page/SpatialNavigation.cpp
@@ -300,6 +300,8 @@ bool hasOffscreenRect(Node* node, FocusDirection direction)
     if (!frameView)
         return true;
 
+    ASSERT(!frameView->needsLayout());
+
     IntRect containerViewportRect = frameView->visibleContentRect();
     // We want to select a node if it is currently off screen, but will be
     // exposed after we scroll. Adjust the viewport to post-scrolling position.
@@ -517,7 +519,7 @@ static IntRect rectToAbsoluteCoordinates(Frame* initialFrame, const IntRect& ini
 
 IntRect nodeRectInAbsoluteCoordinates(Node* node, bool ignoreBorder)
 {
-    ASSERT(node && node->renderer());
+    ASSERT(node && node->renderer() && !node->document()->view()->needsLayout());
 
     if (node->isDocumentNode())
         return frameRectInAbsoluteCoordinates(static_cast<Document*>(node)->frame());
diff --git a/Source/WebCore/page/android/EventHandlerAndroid.cpp b/Source/WebCore/page/android/EventHandlerAndroid.cpp
index 16ca09c..6b36583 100644
--- a/Source/WebCore/page/android/EventHandlerAndroid.cpp
+++ b/Source/WebCore/page/android/EventHandlerAndroid.cpp
@@ -53,7 +53,7 @@ void EventHandler::focusDocumentView()
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
 {
     // Figure out which view to send the event to.
-    RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
+    RenderObject* target = targetNode(event) ? targetNode(event)->renderer() : 0;
     if (!target || !target->isWidget())
         return false;
     return passMouseDownEventToWidget(toRenderWidget(target)->widget());
diff --git a/Source/WebCore/page/animation/AnimationBase.cpp b/Source/WebCore/page/animation/AnimationBase.cpp
index 0fe98be..e232b03 100644
--- a/Source/WebCore/page/animation/AnimationBase.cpp
+++ b/Source/WebCore/page/animation/AnimationBase.cpp
@@ -142,6 +142,9 @@ static inline ShadowStyle blendFunc(const AnimationBase* anim, ShadowStyle from,
 static inline ShadowData* blendFunc(const AnimationBase* anim, const ShadowData* from, const ShadowData* to, double progress)
 {  
     ASSERT(from && to);
+    if (from->style() != to->style())
+        return new ShadowData(*to);
+
     return new ShadowData(blendFunc(anim, from->x(), to->x(), progress),
                           blendFunc(anim, from->y(), to->y(), progress), 
                           blendFunc(anim, from->blur(), to->blur(), progress),
@@ -360,14 +363,15 @@ public:
         const ShadowData* shadowA = (a->*m_getter)();
         const ShadowData* shadowB = (b->*m_getter)();
         ShadowData defaultShadowData(0, 0, 0, 0, Normal, property() == CSSPropertyWebkitBoxShadow, Color::transparent);
+        ShadowData defaultInsetShadowData(0, 0, 0, 0, Inset, property() == CSSPropertyWebkitBoxShadow, Color::transparent);
 
         ShadowData* newShadowData = 0;
         ShadowData* lastShadow = 0;
         
         while (shadowA || shadowB) {
-            const ShadowData* srcShadow = shadowA ? shadowA : &defaultShadowData;
-            const ShadowData* dstShadow = shadowB ? shadowB : &defaultShadowData;
-            
+            const ShadowData* srcShadow = shadowA ? shadowA : (shadowB->style() == Inset ? &defaultInsetShadowData : &defaultShadowData);
+            const ShadowData* dstShadow = shadowB ? shadowB : (shadowA->style() == Inset ? &defaultInsetShadowData : &defaultShadowData);
+
             ShadowData* blendedShadow = blendFunc(anim, srcShadow, dstShadow, progress);
             if (!lastShadow)
                 newShadowData = blendedShadow;
@@ -926,6 +930,9 @@ bool AnimationBase::animationsMatch(const Animation* anim) const
 
 void AnimationBase::updateStateMachine(AnimStateInput input, double param)
 {
+    if (!m_compAnim)
+        return;
+
     // If we get AnimationStateInputRestartAnimation then we force a new animation, regardless of state.
     if (input == AnimationStateInputMakeNew) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
@@ -1194,6 +1201,9 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
     
 void AnimationBase::fireAnimationEventsIfNeeded()
 {
+    if (!m_compAnim)
+        return;
+
     // If we are waiting for the delay time to expire and it has, go to the next state
     if (m_animState != AnimationStateStartWaitTimer && m_animState != AnimationStateLooping && m_animState != AnimationStateEnding)
         return;
@@ -1248,6 +1258,9 @@ void AnimationBase::fireAnimationEventsIfNeeded()
 
 void AnimationBase::updatePlayState(EAnimPlayState playState)
 {
+    if (!m_compAnim)
+        return;
+
     // When we get here, we can have one of 4 desired states: running, paused, suspended, paused & suspended.
     // The state machine can be in one of two states: running, paused.
     // Set the state machine to the desired state.
@@ -1357,6 +1370,9 @@ void AnimationBase::goIntoEndingOrLoopingState()
   
 void AnimationBase::freezeAtTime(double t)
 {
+    if (!m_compAnim)
+        return;
+
     if (!m_startTime) {
         // If we haven't started yet, just generate the start event now
         m_compAnim->animationController()->receivedStartTimeResponse(currentTime());
@@ -1376,6 +1392,9 @@ void AnimationBase::freezeAtTime(double t)
 
 double AnimationBase::beginAnimationUpdateTime() const
 {
+    if (!m_compAnim)
+        return 0;
+
     return m_compAnim->animationController()->beginAnimationUpdateTime();
 }
 
diff --git a/Source/WebCore/page/animation/AnimationBase.h b/Source/WebCore/page/animation/AnimationBase.h
index 1ab14e3..c07f66e 100644
--- a/Source/WebCore/page/animation/AnimationBase.h
+++ b/Source/WebCore/page/animation/AnimationBase.h
@@ -54,7 +54,7 @@ public:
     virtual ~AnimationBase() { }
 
     RenderObject* renderer() const { return m_object; }
-    void clearRenderer() { m_object = 0; }
+    void clear() { m_object = 0; m_compAnim = 0; }
     
     double duration() const;
 
diff --git a/Source/WebCore/page/animation/CompositeAnimation.cpp b/Source/WebCore/page/animation/CompositeAnimation.cpp
index 27409d9..29b32eb 100644
--- a/Source/WebCore/page/animation/CompositeAnimation.cpp
+++ b/Source/WebCore/page/animation/CompositeAnimation.cpp
@@ -43,7 +43,10 @@ namespace WebCore {
 
 CompositeAnimation::~CompositeAnimation()
 {
-    // Toss the refs to all animations
+    // Toss the refs to all animations, but make sure we remove them from
+    // any waiting lists first.
+
+    clearRenderer();
     m_transitions.clear();
     m_keyframeAnimations.clear();
 }
@@ -57,7 +60,7 @@ void CompositeAnimation::clearRenderer()
         for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
             ImplicitAnimation* transition = it->second.get();
             animationController()->animationWillBeRemoved(transition);
-            transition->clearRenderer();
+            transition->clear();
         }
     }
     if (!m_keyframeAnimations.isEmpty()) {
@@ -66,7 +69,7 @@ void CompositeAnimation::clearRenderer()
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* anim = it->second.get();
             animationController()->animationWillBeRemoved(anim);
-            anim->clearRenderer();
+            anim->clear();
         }
     }
 }
@@ -261,7 +264,7 @@ void CompositeAnimation::updateKeyframeAnimations(RenderObject* renderer, Render
         if (keyframeAnim->index() < 0) {
             animsToBeRemoved.append(keyframeAnim->name().impl());
             animationController()->animationWillBeRemoved(keyframeAnim);
-            keyframeAnim->clearRenderer();
+            keyframeAnim->clear();
         }
     }
     
diff --git a/Source/WebCore/page/brew/EventHandlerBrew.cpp b/Source/WebCore/page/brew/EventHandlerBrew.cpp
index f3acec6..ae5d83b 100644
--- a/Source/WebCore/page/brew/EventHandlerBrew.cpp
+++ b/Source/WebCore/page/brew/EventHandlerBrew.cpp
@@ -59,7 +59,7 @@ void EventHandler::focusDocumentView()
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
 {
     // Figure out which view to send the event to.
-    RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
+    RenderObject* target = targetNode(event) ? targetNode(event)->renderer() : 0;
     if (!target || !target->isWidget())
         return false;
     return passMouseDownEventToWidget(toRenderWidget(target)->widget());
diff --git a/Source/WebCore/page/chromium/EventHandlerChromium.cpp b/Source/WebCore/page/chromium/EventHandlerChromium.cpp
index 09b4dfa..faf4d47 100644
--- a/Source/WebCore/page/chromium/EventHandlerChromium.cpp
+++ b/Source/WebCore/page/chromium/EventHandlerChromium.cpp
@@ -61,7 +61,7 @@ bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& m
     IntPoint p = m_frame->view()->windowToContents(mev.event().pos());
     if (m_frame->selection()->contains(p)) {
         VisiblePosition visiblePos(
-            mev.targetNode()->renderer()->positionForPoint(mev.localPoint()));
+            targetNode(mev)->renderer()->positionForPoint(mev.localPoint()));
         VisibleSelection newSelection(visiblePos);
         if (m_frame->selection()->shouldChangeSelection(newSelection))
             m_frame->selection()->setSelection(newSelection);
@@ -103,9 +103,9 @@ bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& wheelEvent, Widget
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
 {
     // Figure out which view to send the event to.
-    if (!event.targetNode() || !event.targetNode()->renderer() || !event.targetNode()->renderer()->isWidget())
+    if (!targetNode(event) || !targetNode(event)->renderer() || !targetNode(event)->renderer()->isWidget())
         return false;
-    return passMouseDownEventToWidget(toRenderWidget(event.targetNode()->renderer())->widget());
+    return passMouseDownEventToWidget(toRenderWidget(targetNode(event)->renderer())->widget());
 }
 
 bool EventHandler::passMouseDownEventToWidget(Widget* widget)
diff --git a/Source/WebCore/page/efl/EventHandlerEfl.cpp b/Source/WebCore/page/efl/EventHandlerEfl.cpp
index c079617..3a3c4dd 100644
--- a/Source/WebCore/page/efl/EventHandlerEfl.cpp
+++ b/Source/WebCore/page/efl/EventHandlerEfl.cpp
@@ -61,7 +61,7 @@ void EventHandler::focusDocumentView()
 
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
 {
-    RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
+    RenderObject* target = targetNode(event) ? targetNode(event)->renderer() : 0;
 
     if (!target || !target->isWidget())
         return false;
diff --git a/Source/WebCore/page/gtk/EventHandlerGtk.cpp b/Source/WebCore/page/gtk/EventHandlerGtk.cpp
index ceb7565..ab54d83 100644
--- a/Source/WebCore/page/gtk/EventHandlerGtk.cpp
+++ b/Source/WebCore/page/gtk/EventHandlerGtk.cpp
@@ -59,7 +59,7 @@ void EventHandler::focusDocumentView()
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
 {
     // Figure out which view to send the event to.
-    RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
+    RenderObject* target = targetNode(event) ? targetNode(event)->renderer() : 0;
     if (!target || !target->isWidget())
         return false;
     return passMouseDownEventToWidget(toRenderWidget(target)->widget());
diff --git a/Source/WebCore/page/haiku/EventHandlerHaiku.cpp b/Source/WebCore/page/haiku/EventHandlerHaiku.cpp
index ed4ea32..5c53614 100644
--- a/Source/WebCore/page/haiku/EventHandlerHaiku.cpp
+++ b/Source/WebCore/page/haiku/EventHandlerHaiku.cpp
@@ -73,7 +73,7 @@ void EventHandler::focusDocumentView()
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
 {
     // Figure out which view to send the event to.
-    RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
+    RenderObject* target = targetNode(event) ? targetNode(event)->renderer() : 0;
     if (!target || !target->isWidget())
         return false;
     return passMouseDownEventToWidget(toRenderWidget(target)->widget());
diff --git a/Source/WebCore/page/mac/DragControllerMac.mm b/Source/WebCore/page/mac/DragControllerMac.mm
index 9b61510..70a10a7 100644
--- a/Source/WebCore/page/mac/DragControllerMac.mm
+++ b/Source/WebCore/page/mac/DragControllerMac.mm
@@ -72,8 +72,11 @@ void DragController::cleanupAfterSystemDrag()
     // Drag has ended, dragEnded *should* have been called, however it is possible
     // for the UIDelegate to take over the drag, and fail to send the appropriate
     // drag termination event.  As dragEnded just resets drag variables, we just
-    // call it anyway to be on the safe side
-    dragEnded();
+    // call it anyway to be on the safe side.
+    // We don't want to do this for WebKit2, since the client call to start the drag
+    // is asynchronous.
+    if (m_page->mainFrame()->view()->platformWidget())
+        dragEnded();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/mac/EventHandlerMac.mm b/Source/WebCore/page/mac/EventHandlerMac.mm
index 5e96917..d93cc82 100644
--- a/Source/WebCore/page/mac/EventHandlerMac.mm
+++ b/Source/WebCore/page/mac/EventHandlerMac.mm
@@ -113,8 +113,6 @@ bool EventHandler::wheelEvent(NSEvent *event)
 
     CurrentEventScope scope(event);
 
-    m_useLatchedWheelEventNode = wkIsLatchingWheelEvent(event);
-    
     PlatformWheelEvent wheelEvent(event, page->chrome()->platformPageClient());
     handleWheelEvent(wheelEvent);
 
@@ -170,7 +168,7 @@ void EventHandler::focusDocumentView()
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
 {
     // Figure out which view to send the event to.
-    RenderObject* target = event.targetNode() ? event.targetNode()->renderer() : 0;
+    RenderObject* target = targetNode(event) ? targetNode(event)->renderer() : 0;
     if (!target || !target->isWidget())
         return false;
     
@@ -383,7 +381,7 @@ bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults& eve
             return true;
         
         case NSLeftMouseDown: {
-            Node* node = event.targetNode();
+            Node* node = targetNode(event);
             if (!node)
                 return false;
             RenderObject* renderer = node->renderer();
diff --git a/Source/WebCore/page/qt/DragControllerQt.cpp b/Source/WebCore/page/qt/DragControllerQt.cpp
index cdea55b..dccd6cc 100644
--- a/Source/WebCore/page/qt/DragControllerQt.cpp
+++ b/Source/WebCore/page/qt/DragControllerQt.cpp
@@ -50,7 +50,7 @@ bool DragController::isCopyKeyDown(DragData*)
     
 DragOperation DragController::dragOperation(DragData* dragData)
 {
-    //FIXME: This logic is incomplete
+    // FIXME: This logic is incomplete.
     if (dragData->containsURL(0))
         return DragOperationCopy;
         
diff --git a/Source/WebCore/page/wx/EventHandlerWx.cpp b/Source/WebCore/page/wx/EventHandlerWx.cpp
index 66bae01..ba2f9cd 100644
--- a/Source/WebCore/page/wx/EventHandlerWx.cpp
+++ b/Source/WebCore/page/wx/EventHandlerWx.cpp
@@ -63,10 +63,10 @@ bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults&
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
 {
     // Figure out which view to send the event to.
-    if (!event.targetNode() || !event.targetNode()->renderer() || !event.targetNode()->renderer()->isWidget())
+    if (!targetNode(event) || !targetNode(event)->renderer() || !targetNode(event)->renderer()->isWidget())
         return false;
     
-    return passMouseDownEventToWidget(toRenderWidget(event.targetNode()->renderer())->widget());
+    return passMouseDownEventToWidget(toRenderWidget(targetNode(event)->renderer())->widget());
 }
 
 bool EventHandler::passWidgetMouseDownEventToWidget(RenderWidget* renderWidget)
diff --git a/Source/WebCore/platform/AsyncFileSystem.h b/Source/WebCore/platform/AsyncFileSystem.h
index f5207ce..3570de4 100644
--- a/Source/WebCore/platform/AsyncFileSystem.h
+++ b/Source/WebCore/platform/AsyncFileSystem.h
@@ -53,6 +53,7 @@ public:
     enum Type {
         Temporary,
         Persistent,
+        External,
     };
 
     virtual void stop() { }
diff --git a/Source/WebCore/platform/ContentType.cpp b/Source/WebCore/platform/ContentType.cpp
index c094d54..b02bc7c 100644
--- a/Source/WebCore/platform/ContentType.cpp
+++ b/Source/WebCore/platform/ContentType.cpp
@@ -45,11 +45,17 @@ String ContentType::parameter(const String& parameterName) const
     if (semi != notFound) {
         size_t start = strippedType.find(parameterName, semi + 1, false);
         if (start != notFound) {
-            start = strippedType.find('=', start + 6);
+            start = strippedType.find('=', start + parameterName.length());
             if (start != notFound) {
-                size_t end = strippedType.find(';', start + 6);
-                if (end == notFound)
-                    end = strippedType.length();
+                size_t quote = strippedType.find('\"', start + 1);
+                size_t end = strippedType.find('\"', start + 2);
+                if (quote != notFound && end != notFound)
+                    start = quote;
+                else {
+                    end = strippedType.find(';', start + 1);
+                    if (end == notFound)
+                        end = strippedType.length();
+                }
                 parameterValue = strippedType.substring(start + 1, end - (start + 1)).stripWhiteSpace();
             }
         }
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.cpp b/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
index 1a50c3c..0a7dd42 100644
--- a/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
+++ b/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
@@ -74,44 +74,44 @@ DefaultLocalizationStrategy::DefaultLocalizationStrategy()
 
 String DefaultLocalizationStrategy::inputElementAltText()
 {
-    return UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
+    return WEB_UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
 }
 
 String DefaultLocalizationStrategy::resetButtonDefaultLabel()
 {
-    return UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
+    return WEB_UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
 }
 
 String DefaultLocalizationStrategy::searchableIndexIntroduction()
 {
-    return UI_STRING("This is a searchable index. Enter search keywords: ",
+    return WEB_UI_STRING("This is a searchable index. Enter search keywords: ",
         "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
 }
 
 String DefaultLocalizationStrategy::submitButtonDefaultLabel()
 {
-    return UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
+    return WEB_UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
 }
 
 String DefaultLocalizationStrategy::fileButtonChooseFileLabel()
 {
-    return UI_STRING("Choose File", "title for file button used in HTML forms");
+    return WEB_UI_STRING("Choose File", "title for file button used in HTML forms");
 }
 
 String DefaultLocalizationStrategy::fileButtonNoFileSelectedLabel()
 {
-    return UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
+    return WEB_UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
 }
 
 String DefaultLocalizationStrategy::defaultDetailsSummaryText()
 {
-    return UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
+    return WEB_UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
 }
 
 #if PLATFORM(MAC)
 String DefaultLocalizationStrategy::copyImageUnknownFileLabel()
 {
-    return UI_STRING("unknown", "Unknown filename");
+    return WEB_UI_STRING("unknown", "Unknown filename");
 }
 #endif
 
@@ -119,129 +119,129 @@ String DefaultLocalizationStrategy::copyImageUnknownFileLabel()
 
 String DefaultLocalizationStrategy::contextMenuItemTagOpenLinkInNewWindow()
 {
-    return UI_STRING("Open Link in New Window", "Open in New Window context menu item");
+    return WEB_UI_STRING("Open Link in New Window", "Open in New Window context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagDownloadLinkToDisk()
 {
-    return UI_STRING("Download Linked File", "Download Linked File context menu item");
+    return WEB_UI_STRING("Download Linked File", "Download Linked File context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCopyLinkToClipboard()
 {
-    return UI_STRING("Copy Link", "Copy Link context menu item");
+    return WEB_UI_STRING("Copy Link", "Copy Link context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagOpenImageInNewWindow()
 {
-    return UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
+    return WEB_UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagDownloadImageToDisk()
 {
-    return UI_STRING("Download Image", "Download Image context menu item");
+    return WEB_UI_STRING("Download Image", "Download Image context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCopyImageToClipboard()
 {
-    return UI_STRING("Copy Image", "Copy Image context menu item");
+    return WEB_UI_STRING("Copy Image", "Copy Image context menu item");
 }
 
 #if PLATFORM(QT)
 String DefaultLocalizationStrategy::contextMenuItemTagCopyImageUrlToClipboard()
 {
-    return UI_STRING("Copy Image Address", "Copy Image Address menu item");
+    return WEB_UI_STRING("Copy Image Address", "Copy Image Address menu item");
 }
 #endif
 
 String DefaultLocalizationStrategy::contextMenuItemTagOpenVideoInNewWindow()
 {
-    return UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
+    return WEB_UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagOpenAudioInNewWindow()
 {
-    return UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
+    return WEB_UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCopyVideoLinkToClipboard()
 {
-    return UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
+    return WEB_UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCopyAudioLinkToClipboard()
 {
-    return UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
+    return WEB_UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaControls()
 {
-    return UI_STRING("Controls", "Media Controls context menu item");
+    return WEB_UI_STRING("Controls", "Media Controls context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaLoop()
 {
-    return UI_STRING("Loop", "Media Loop context menu item");
+    return WEB_UI_STRING("Loop", "Media Loop context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagEnterVideoFullscreen()
 {
-    return UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
+    return WEB_UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagMediaPlay()
 {
-    return UI_STRING("Play", "Media Play context menu item");
+    return WEB_UI_STRING("Play", "Media Play context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagMediaPause()
 {
-    return UI_STRING("Pause", "Media Pause context menu item");
+    return WEB_UI_STRING("Pause", "Media Pause context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagMediaMute()
 {
-    return UI_STRING("Mute", "Media Mute context menu item");
+    return WEB_UI_STRING("Mute", "Media Mute context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagOpenFrameInNewWindow()
 {
-    return UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
+    return WEB_UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCopy()
 {
-    return UI_STRING("Copy", "Copy context menu item");
+    return WEB_UI_STRING("Copy", "Copy context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagGoBack()
 {
-    return UI_STRING("Back", "Back context menu item");
+    return WEB_UI_STRING("Back", "Back context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagGoForward()
 {
-    return UI_STRING("Forward", "Forward context menu item");
+    return WEB_UI_STRING("Forward", "Forward context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagStop()
 {
-    return UI_STRING("Stop", "Stop context menu item");
+    return WEB_UI_STRING("Stop", "Stop context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagReload()
 {
-    return UI_STRING("Reload", "Reload context menu item");
+    return WEB_UI_STRING("Reload", "Reload context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCut()
 {
-    return UI_STRING("Cut", "Cut context menu item");
+    return WEB_UI_STRING("Cut", "Cut context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagPaste()
 {
-    return UI_STRING("Paste", "Paste context menu item");
+    return WEB_UI_STRING("Paste", "Paste context menu item");
 }
 
 #if PLATFORM(GTK)
@@ -278,218 +278,223 @@ String DefaultLocalizationStrategy::contextMenuItemTagSelectAll()
 
 String DefaultLocalizationStrategy::contextMenuItemTagNoGuessesFound()
 {
-    return UI_STRING("No Guesses Found", "No Guesses Found context menu item");
+    return WEB_UI_STRING("No Guesses Found", "No Guesses Found context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagIgnoreSpelling()
 {
-    return UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
+    return WEB_UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagLearnSpelling()
 {
-    return UI_STRING("Learn Spelling", "Learn Spelling context menu item");
+    return WEB_UI_STRING("Learn Spelling", "Learn Spelling context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagSearchWeb()
 {
-    return UI_STRING("Search in Google", "Search in Google context menu item");
+    return WEB_UI_STRING("Search in Google", "Search in Google context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagLookUpInDictionary(const String& selectedString)
 {
 #if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
     UNUSED_PARAM(selectedString);
-    return UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
+    return WEB_UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
 #else
-    return UI_STRING("Look Up “<selection>”", "Look Up context menu item with selected word").replace("<selection>", selectedString);
+#if USE(CF)
+    RetainPtr<CFStringRef> selectedCFString(AdoptCF, selectedString.createCFString());
+    return formatLocalizedString(WEB_UI_STRING("Look Up “%@”", "Look Up context menu item with selected word"), selectedCFString.get());
+#else
+    return WEB_UI_STRING("Look Up “<selection>”", "Look Up context menu item with selected word").replace("<selection>", selectedString);
+#endif
 #endif
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagOpenLink()
 {
-    return UI_STRING("Open Link", "Open Link context menu item");
+    return WEB_UI_STRING("Open Link", "Open Link context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagIgnoreGrammar()
 {
-    return UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
+    return WEB_UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagSpellingMenu()
 {
-    return UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
+    return WEB_UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagShowSpellingPanel(bool show)
 {
     if (show)
-        return UI_STRING("Show Spelling and Grammar", "menu item title");
-    return UI_STRING("Hide Spelling and Grammar", "menu item title");
+        return WEB_UI_STRING("Show Spelling and Grammar", "menu item title");
+    return WEB_UI_STRING("Hide Spelling and Grammar", "menu item title");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCheckSpelling()
 {
-    return UI_STRING("Check Document Now", "Check spelling context menu item");
+    return WEB_UI_STRING("Check Document Now", "Check spelling context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCheckSpellingWhileTyping()
 {
-    return UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
+    return WEB_UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCheckGrammarWithSpelling()
 {
-    return UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
+    return WEB_UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagFontMenu()
 {
-    return UI_STRING("Font", "Font context sub-menu item");
+    return WEB_UI_STRING("Font", "Font context sub-menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagBold()
 {
-    return UI_STRING("Bold", "Bold context menu item");
+    return WEB_UI_STRING("Bold", "Bold context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagItalic()
 {
-    return UI_STRING("Italic", "Italic context menu item");
+    return WEB_UI_STRING("Italic", "Italic context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagUnderline()
 {
-    return UI_STRING("Underline", "Underline context menu item");
+    return WEB_UI_STRING("Underline", "Underline context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagOutline()
 {
-    return UI_STRING("Outline", "Outline context menu item");
+    return WEB_UI_STRING("Outline", "Outline context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagWritingDirectionMenu()
 {
-    return UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
+    return WEB_UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagTextDirectionMenu()
 {
-    return UI_STRING("Selection Direction", "Selection direction context sub-menu item");
+    return WEB_UI_STRING("Selection Direction", "Selection direction context sub-menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagDefaultDirection()
 {
-    return UI_STRING("Default", "Default writing direction context menu item");
+    return WEB_UI_STRING("Default", "Default writing direction context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagLeftToRight()
 {
-    return UI_STRING("Left to Right", "Left to Right context menu item");
+    return WEB_UI_STRING("Left to Right", "Left to Right context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagRightToLeft()
 {
-    return UI_STRING("Right to Left", "Right to Left context menu item");
+    return WEB_UI_STRING("Right to Left", "Right to Left context menu item");
 }
 
 #if PLATFORM(MAC)
 
 String DefaultLocalizationStrategy::contextMenuItemTagSearchInSpotlight()
 {
-    return UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
+    return WEB_UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagShowFonts()
 {
-    return UI_STRING("Show Fonts", "Show fonts context menu item");
+    return WEB_UI_STRING("Show Fonts", "Show fonts context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagStyles()
 {
-    return UI_STRING("Styles...", "Styles context menu item");
+    return WEB_UI_STRING("Styles...", "Styles context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagShowColors()
 {
-    return UI_STRING("Show Colors", "Show colors context menu item");
+    return WEB_UI_STRING("Show Colors", "Show colors context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagSpeechMenu()
 {
-    return UI_STRING("Speech", "Speech context sub-menu item");
+    return WEB_UI_STRING("Speech", "Speech context sub-menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagStartSpeaking()
 {
-    return UI_STRING("Start Speaking", "Start speaking context menu item");
+    return WEB_UI_STRING("Start Speaking", "Start speaking context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagStopSpeaking()
 {
-    return UI_STRING("Stop Speaking", "Stop speaking context menu item");
+    return WEB_UI_STRING("Stop Speaking", "Stop speaking context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCorrectSpellingAutomatically()
 {
-    return UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
+    return WEB_UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagSubstitutionsMenu()
 {
-    return UI_STRING("Substitutions", "Substitutions context sub-menu item");
+    return WEB_UI_STRING("Substitutions", "Substitutions context sub-menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagShowSubstitutions(bool show)
 {
     if (show) 
-        return UI_STRING("Show Substitutions", "menu item title");
-    return UI_STRING("Hide Substitutions", "menu item title");
+        return WEB_UI_STRING("Show Substitutions", "menu item title");
+    return WEB_UI_STRING("Hide Substitutions", "menu item title");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagSmartCopyPaste()
 {
-    return UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
+    return WEB_UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagSmartQuotes()
 {
-    return UI_STRING("Smart Quotes", "Smart Quotes context menu item");
+    return WEB_UI_STRING("Smart Quotes", "Smart Quotes context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagSmartDashes()
 {
-    return UI_STRING("Smart Dashes", "Smart Dashes context menu item");
+    return WEB_UI_STRING("Smart Dashes", "Smart Dashes context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagSmartLinks()
 {
-    return UI_STRING("Smart Links", "Smart Links context menu item");
+    return WEB_UI_STRING("Smart Links", "Smart Links context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagTextReplacement()
 {
-    return UI_STRING("Text Replacement", "Text Replacement context menu item");
+    return WEB_UI_STRING("Text Replacement", "Text Replacement context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagTransformationsMenu()
 {
-    return UI_STRING("Transformations", "Transformations context sub-menu item");
+    return WEB_UI_STRING("Transformations", "Transformations context sub-menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagMakeUpperCase()
 {
-    return UI_STRING("Make Upper Case", "Make Upper Case context menu item");
+    return WEB_UI_STRING("Make Upper Case", "Make Upper Case context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagMakeLowerCase()
 {
-    return UI_STRING("Make Lower Case", "Make Lower Case context menu item");
+    return WEB_UI_STRING("Make Lower Case", "Make Lower Case context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagCapitalize()
 {
-    return UI_STRING("Capitalize", "Capitalize context menu item");
+    return WEB_UI_STRING("Capitalize", "Capitalize context menu item");
 }
 
 String DefaultLocalizationStrategy::contextMenuItemTagChangeBack(const String& replacedString)
@@ -502,133 +507,133 @@ String DefaultLocalizationStrategy::contextMenuItemTagChangeBack(const String& r
 
 String DefaultLocalizationStrategy::contextMenuItemTagInspectElement()
 {
-    return UI_STRING("Inspect Element", "Inspect Element context menu item");
+    return WEB_UI_STRING("Inspect Element", "Inspect Element context menu item");
 }
 
 #endif // ENABLE(CONTEXT_MENUS)
 
 String DefaultLocalizationStrategy::searchMenuNoRecentSearchesText()
 {
-    return UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
+    return WEB_UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
 }
 
 String DefaultLocalizationStrategy::searchMenuRecentSearchesText()
 {
-    return UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
+    return WEB_UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
 }
 
 String DefaultLocalizationStrategy::searchMenuClearRecentSearchesText()
 {
-    return UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
+    return WEB_UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
 }
 
 String DefaultLocalizationStrategy::AXWebAreaText()
 {
-    return UI_STRING("HTML content", "accessibility role description for web area");
+    return WEB_UI_STRING("HTML content", "accessibility role description for web area");
 }
 
 String DefaultLocalizationStrategy::AXLinkText()
 {
-    return UI_STRING("link", "accessibility role description for link");
+    return WEB_UI_STRING("link", "accessibility role description for link");
 }
 
 String DefaultLocalizationStrategy::AXListMarkerText()
 {
-    return UI_STRING("list marker", "accessibility role description for list marker");
+    return WEB_UI_STRING("list marker", "accessibility role description for list marker");
 }
 
 String DefaultLocalizationStrategy::AXImageMapText()
 {
-    return UI_STRING("image map", "accessibility role description for image map");
+    return WEB_UI_STRING("image map", "accessibility role description for image map");
 }
 
 String DefaultLocalizationStrategy::AXHeadingText()
 {
-    return UI_STRING("heading", "accessibility role description for headings");
+    return WEB_UI_STRING("heading", "accessibility role description for headings");
 }
 
 String DefaultLocalizationStrategy::AXDefinitionListTermText()
 {
-    return UI_STRING("term", "term word of a definition");
+    return WEB_UI_STRING("term", "term word of a definition");
 }
 
 String DefaultLocalizationStrategy::AXDefinitionListDefinitionText()
 {
-    return UI_STRING("definition", "definition phrase");
+    return WEB_UI_STRING("definition", "definition phrase");
 }
 
 #if PLATFORM(MAC)
 String DefaultLocalizationStrategy::AXARIAContentGroupText(const String& ariaType)
 {
     if (ariaType == "ARIAApplicationAlert")
-        return UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
+        return WEB_UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
     if (ariaType == "ARIAApplicationAlertDialog")
-        return UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
+        return WEB_UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
     if (ariaType == "ARIAApplicationDialog")
-        return UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
+        return WEB_UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
     if (ariaType == "ARIAApplicationLog")
-        return UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
+        return WEB_UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
     if (ariaType == "ARIAApplicationMarquee")
-        return UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");    
+        return WEB_UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");    
     if (ariaType == "ARIAApplicationStatus")
-        return UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");    
+        return WEB_UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");    
     if (ariaType == "ARIAApplicationTimer")
-        return UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");    
+        return WEB_UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");    
     if (ariaType == "ARIADocument")
-        return UI_STRING("document", "An ARIA accessibility group that acts as a document.");    
+        return WEB_UI_STRING("document", "An ARIA accessibility group that acts as a document.");    
     if (ariaType == "ARIADocumentArticle")
-        return UI_STRING("article", "An ARIA accessibility group that acts as an article.");    
+        return WEB_UI_STRING("article", "An ARIA accessibility group that acts as an article.");    
     if (ariaType == "ARIADocumentNote")
-        return UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");    
+        return WEB_UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");    
     if (ariaType == "ARIADocumentRegion")
-        return UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
+        return WEB_UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
     if (ariaType == "ARIALandmarkApplication")
-        return UI_STRING("application", "An ARIA accessibility group that acts as an application.");    
+        return WEB_UI_STRING("application", "An ARIA accessibility group that acts as an application.");    
     if (ariaType == "ARIALandmarkBanner")
-        return UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");    
+        return WEB_UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");    
     if (ariaType == "ARIALandmarkComplementary")
-        return UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
+        return WEB_UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
     if (ariaType == "ARIALandmarkContentInfo")
-        return UI_STRING("content", "An ARIA accessibility group that contains content.");    
+        return WEB_UI_STRING("content", "An ARIA accessibility group that contains content.");    
     if (ariaType == "ARIALandmarkMain")
-        return UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");    
+        return WEB_UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");    
     if (ariaType == "ARIALandmarkNavigation")
-        return UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
+        return WEB_UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
     if (ariaType == "ARIALandmarkSearch")
-        return UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
+        return WEB_UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
     if (ariaType == "ARIAUserInterfaceTooltip")
-        return UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
+        return WEB_UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
     if (ariaType == "ARIATabPanel")
-        return UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
+        return WEB_UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
     if (ariaType == "ARIADocumentMath")
-        return UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
+        return WEB_UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
     return String();
 }
 #endif
 
 String DefaultLocalizationStrategy::AXButtonActionVerb()
 {
-    return UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
+    return WEB_UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
 }
 
 String DefaultLocalizationStrategy::AXRadioButtonActionVerb() 
 {
-    return UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
+    return WEB_UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
 }
 
 String DefaultLocalizationStrategy::AXTextFieldActionVerb()
 {
-    return UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
+    return WEB_UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
 }
 
 String DefaultLocalizationStrategy::AXCheckedCheckBoxActionVerb()
 {
-    return UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
+    return WEB_UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
 }
 
 String DefaultLocalizationStrategy::AXUncheckedCheckBoxActionVerb()
 {
-    return UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
+    return WEB_UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
 }
 
 String DefaultLocalizationStrategy::AXMenuListActionVerb()
@@ -645,27 +650,27 @@ String DefaultLocalizationStrategy::AXMenuListPopupActionVerb()
 
 String DefaultLocalizationStrategy::AXLinkActionVerb()
 {
-    return UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
+    return WEB_UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
 }
 
 String DefaultLocalizationStrategy::missingPluginText()
 {
-    return UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
+    return WEB_UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
 }
 
 String DefaultLocalizationStrategy::crashedPluginText()
 {
-    return UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
+    return WEB_UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
 }
 
 String DefaultLocalizationStrategy::multipleFileUploadText(unsigned numberOfFiles)
 {
-    return formatLocalizedString(UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
+    return formatLocalizedString(WEB_UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
 }
 
 String DefaultLocalizationStrategy::unknownFileSizeText()
 {
-    return UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
+    return WEB_UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
 }
 
 #if PLATFORM(WIN)
@@ -688,80 +693,101 @@ String DefaultLocalizationStrategy::allFilesText()
 
 String DefaultLocalizationStrategy::keygenMenuItem512()
 {
-    return UI_STRING("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
+    return WEB_UI_STRING("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String DefaultLocalizationStrategy::keygenMenuItem1024()
 {
-    return UI_STRING("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
+    return WEB_UI_STRING("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String DefaultLocalizationStrategy::keygenMenuItem2048()
 {
-    return UI_STRING("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
+    return WEB_UI_STRING("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String DefaultLocalizationStrategy::keygenKeychainItemName(const String& host)
 {
-    return UI_STRING("Key from <hostname>", "Name of keychain key generated by the KEYGEN tag").replace("<hostname>", host);
+    RetainPtr<CFStringRef> hostCFString(AdoptCF, host.createCFString());
+    return formatLocalizedString(WEB_UI_STRING("Key from %@", "Name of keychain key generated by the KEYGEN tag"), hostCFString.get());
 }
 
 #endif
 
 String DefaultLocalizationStrategy::imageTitle(const String& filename, const IntSize& size)
 {
-    // FIXME: This should format the numbers correctly. In Mac WebKit, we used +[NSNumberFormatter localizedStringFromNumber:numberStyle:].
-    return formatLocalizedString(UI_STRING("<filename> %d×%d pixels", "window title suffix for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
+#if USE(CF)
+#if !defined(BUILDING_ON_LEOPARD)
+    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
+    RetainPtr<CFLocaleRef> locale(AdoptCF, CFLocaleCopyCurrent());
+    RetainPtr<CFNumberFormatterRef> formatter(AdoptCF, CFNumberFormatterCreate(0, locale.get(), kCFNumberFormatterDecimalStyle));
+
+    int widthInt = size.width();
+    RetainPtr<CFNumberRef> width(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &widthInt));
+    RetainPtr<CFStringRef> widthString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), width.get()));
+
+    int heightInt = size.height();
+    RetainPtr<CFNumberRef> height(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &heightInt));
+    RetainPtr<CFStringRef> heightString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), height.get()));
+
+    return formatLocalizedString(WEB_UI_STRING("%@ %@×%@ pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), widthString.get(), heightString.get());
+#else
+    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
+    return formatLocalizedString(WEB_UI_STRING("%@ %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), size.width(), size.height());
+#endif
+#else
+    return formatLocalizedString(WEB_UI_STRING("<filename> %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
+#endif
 }
 
 String DefaultLocalizationStrategy::mediaElementLoadingStateText()
 {
-    return UI_STRING("Loading...", "Media controller status message when the media is loading");
+    return WEB_UI_STRING("Loading...", "Media controller status message when the media is loading");
 }
 
 String DefaultLocalizationStrategy::mediaElementLiveBroadcastStateText()
 {
-    return UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
+    return WEB_UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
 }
 
 String DefaultLocalizationStrategy::localizedMediaControlElementString(const String& name)
 {
     if (name == "AudioElement")
-        return UI_STRING("audio element controller", "accessibility role description for audio element controller");
+        return WEB_UI_STRING("audio element controller", "accessibility role description for audio element controller");
     if (name == "VideoElement")
-        return UI_STRING("video element controller", "accessibility role description for video element controller");
+        return WEB_UI_STRING("video element controller", "accessibility role description for video element controller");
     if (name == "MuteButton")
-        return UI_STRING("mute", "accessibility role description for mute button");
+        return WEB_UI_STRING("mute", "accessibility role description for mute button");
     if (name == "UnMuteButton")
-        return UI_STRING("unmute", "accessibility role description for turn mute off button");
+        return WEB_UI_STRING("unmute", "accessibility role description for turn mute off button");
     if (name == "PlayButton")
-        return UI_STRING("play", "accessibility role description for play button");
+        return WEB_UI_STRING("play", "accessibility role description for play button");
     if (name == "PauseButton")
-        return UI_STRING("pause", "accessibility role description for pause button");
+        return WEB_UI_STRING("pause", "accessibility role description for pause button");
     if (name == "Slider")
-        return UI_STRING("movie time", "accessibility role description for timeline slider");
+        return WEB_UI_STRING("movie time", "accessibility role description for timeline slider");
     if (name == "SliderThumb")
-        return UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
+        return WEB_UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
     if (name == "RewindButton")
-        return UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
+        return WEB_UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
     if (name == "ReturnToRealtimeButton")
-        return UI_STRING("return to realtime", "accessibility role description for return to real time button");
+        return WEB_UI_STRING("return to realtime", "accessibility role description for return to real time button");
     if (name == "CurrentTimeDisplay")
-        return UI_STRING("elapsed time", "accessibility role description for elapsed time display");
+        return WEB_UI_STRING("elapsed time", "accessibility role description for elapsed time display");
     if (name == "TimeRemainingDisplay")
-        return UI_STRING("remaining time", "accessibility role description for time remaining display");
+        return WEB_UI_STRING("remaining time", "accessibility role description for time remaining display");
     if (name == "StatusDisplay")
-        return UI_STRING("status", "accessibility role description for movie status");
+        return WEB_UI_STRING("status", "accessibility role description for movie status");
     if (name == "FullscreenButton")
-        return UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
+        return WEB_UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
     if (name == "SeekForwardButton")
-        return UI_STRING("fast forward", "accessibility role description for fast forward button");
+        return WEB_UI_STRING("fast forward", "accessibility role description for fast forward button");
     if (name == "SeekBackButton")
-        return UI_STRING("fast reverse", "accessibility role description for fast reverse button");
+        return WEB_UI_STRING("fast reverse", "accessibility role description for fast reverse button");
     if (name == "ShowClosedCaptionsButton")
-        return UI_STRING("show closed captions", "accessibility role description for show closed captions button");
+        return WEB_UI_STRING("show closed captions", "accessibility role description for show closed captions button");
     if (name == "HideClosedCaptionsButton")
-        return UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
+        return WEB_UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
 
     // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
     if (name == "ControlsPanel")
@@ -774,41 +800,41 @@ String DefaultLocalizationStrategy::localizedMediaControlElementString(const Str
 String DefaultLocalizationStrategy::localizedMediaControlElementHelpText(const String& name)
 {
     if (name == "AudioElement")
-        return UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
+        return WEB_UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
     if (name == "VideoElement")
-        return UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
+        return WEB_UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
     if (name == "MuteButton")
-        return UI_STRING("mute audio tracks", "accessibility help text for mute button");
+        return WEB_UI_STRING("mute audio tracks", "accessibility help text for mute button");
     if (name == "UnMuteButton")
-        return UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
+        return WEB_UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
     if (name == "PlayButton")
-        return UI_STRING("begin playback", "accessibility help text for play button");
+        return WEB_UI_STRING("begin playback", "accessibility help text for play button");
     if (name == "PauseButton")
-        return UI_STRING("pause playback", "accessibility help text for pause button");
+        return WEB_UI_STRING("pause playback", "accessibility help text for pause button");
     if (name == "Slider")
-        return UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
+        return WEB_UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
     if (name == "SliderThumb")
-        return UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
+        return WEB_UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
     if (name == "RewindButton")
-        return UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
+        return WEB_UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
     if (name == "ReturnToRealtimeButton")
-        return UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
+        return WEB_UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
     if (name == "CurrentTimeDisplay")
-        return UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
+        return WEB_UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
     if (name == "TimeRemainingDisplay")
-        return UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
+        return WEB_UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
     if (name == "StatusDisplay")
-        return UI_STRING("current movie status", "accessibility help text for movie status display");
+        return WEB_UI_STRING("current movie status", "accessibility help text for movie status display");
     if (name == "SeekBackButton")
-        return UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
+        return WEB_UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
     if (name == "SeekForwardButton")
-        return UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
+        return WEB_UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
     if (name == "FullscreenButton")
-        return UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
+        return WEB_UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
     if (name == "ShowClosedCaptionsButton")
-        return UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
+        return WEB_UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
     if (name == "HideClosedCaptionsButton")
-        return UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
+        return WEB_UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
 
     ASSERT_NOT_REACHED();
     return String();
@@ -817,7 +843,7 @@ String DefaultLocalizationStrategy::localizedMediaControlElementHelpText(const S
 String DefaultLocalizationStrategy::localizedMediaTimeDescription(float time)
 {
     if (!isfinite(time))
-        return UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
+        return WEB_UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
 
     int seconds = static_cast<int>(fabsf(time)); 
     int days = seconds / (60 * 60 * 24);
@@ -826,47 +852,47 @@ String DefaultLocalizationStrategy::localizedMediaTimeDescription(float time)
     seconds %= 60;
 
     if (days)
-        return formatLocalizedString(UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
+        return formatLocalizedString(WEB_UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
     if (hours)
-        return formatLocalizedString(UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
+        return formatLocalizedString(WEB_UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
     if (minutes)
-        return formatLocalizedString(UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
-    return formatLocalizedString(UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
+        return formatLocalizedString(WEB_UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
+    return formatLocalizedString(WEB_UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
 }
 
 String DefaultLocalizationStrategy::validationMessageValueMissingText()
 {
-    return UI_STRING("value missing", "Validation message for required form control elements that have no value");
+    return WEB_UI_STRING("value missing", "Validation message for required form control elements that have no value");
 }
 
 String DefaultLocalizationStrategy::validationMessageTypeMismatchText()
 {
-    return UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
+    return WEB_UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
 }
 
 String DefaultLocalizationStrategy::validationMessagePatternMismatchText()
 {
-    return UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
+    return WEB_UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
 }
 
 String DefaultLocalizationStrategy::validationMessageTooLongText()
 {
-    return UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
+    return WEB_UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
 }
 
 String DefaultLocalizationStrategy::validationMessageRangeUnderflowText()
 {
-    return UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
+    return WEB_UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
 }
 
 String DefaultLocalizationStrategy::validationMessageRangeOverflowText()
 {
-    return UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
+    return WEB_UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
 }
 
 String DefaultLocalizationStrategy::validationMessageStepMismatchText()
 {
-    return UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
+    return WEB_UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/DragData.h b/Source/WebCore/platform/DragData.h
index b89748e..5b29610 100644
--- a/Source/WebCore/platform/DragData.h
+++ b/Source/WebCore/platform/DragData.h
@@ -119,6 +119,9 @@ public:
     bool canSmartReplace() const;
     bool containsColor() const;
     bool containsFiles() const;
+#if PLATFORM(MAC)
+    NSPasteboard *pasteboard() { return m_pasteboard.get(); }
+#endif
 private:
     IntPoint m_clientPosition;
     IntPoint m_globalPosition;
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 49a78e8..418a645 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -47,6 +47,11 @@
 #endif
 #endif
 
+#if PLATFORM(WX)
+#include <wx/defs.h>
+#include <wx/file.h>
+#endif
+
 #if USE(CF) || (PLATFORM(QT) && defined(Q_WS_MAC))
 typedef struct __CFBundle* CFBundleRef;
 typedef const struct __CFData* CFDataRef;
@@ -72,7 +77,9 @@ typedef struct _GModule GModule;
 namespace WebCore {
 
 // PlatformModule
-#if OS(WINDOWS)
+#if PLATFORM(GTK)
+typedef GModule* PlatformModule;
+#elif OS(WINDOWS)
 typedef HMODULE PlatformModule;
 #elif PLATFORM(QT)
 #if defined(Q_WS_MAC)
@@ -82,8 +89,6 @@ typedef QLibrary* PlatformModule;
 #else
 typedef void* PlatformModule;
 #endif
-#elif PLATFORM(GTK)
-typedef GModule* PlatformModule;
 #elif USE(CF)
 typedef CFBundleRef PlatformModule;
 #else
@@ -117,6 +122,9 @@ typedef unsigned PlatformModuleVersion;
 #if PLATFORM(QT)
 typedef QFile* PlatformFileHandle;
 const PlatformFileHandle invalidPlatformFileHandle = 0;
+#elif PLATFORM(GTK)
+typedef GFileIOStream* PlatformFileHandle;
+const PlatformFileHandle invalidPlatformFileHandle = 0;
 #elif OS(WINDOWS)
 typedef HANDLE PlatformFileHandle;
 // FIXME: -1 is INVALID_HANDLE_VALUE, defined in <winbase.h>. Chromium tries to
@@ -125,8 +133,8 @@ const PlatformFileHandle invalidPlatformFileHandle = reinterpret_cast<HANDLE>(-1
 #elif PLATFORM(BREWMP)
 typedef IFile* PlatformFileHandle;
 const PlatformFileHandle invalidPlatformFileHandle = 0;
-#elif PLATFORM(GTK)
-typedef GFileIOStream* PlatformFileHandle;
+#elif PLATFORM(WX)
+typedef wxFile* PlatformFileHandle;
 const PlatformFileHandle invalidPlatformFileHandle = 0;
 #else
 typedef int PlatformFileHandle;
diff --git a/Source/WebCore/platform/FloatConversion.h b/Source/WebCore/platform/FloatConversion.h
index 655ab44..fb76833 100644
--- a/Source/WebCore/platform/FloatConversion.h
+++ b/Source/WebCore/platform/FloatConversion.h
@@ -29,7 +29,7 @@
 #ifndef FloatConversion_h
 #define FloatConversion_h
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGBase.h>
 #endif
 
@@ -44,7 +44,7 @@ namespace WebCore {
         return static_cast<float>(number);
     }
 
-#if PLATFORM(CG)
+#if USE(CG)
     template<typename T>
     CGFloat narrowPrecisionToCGFloat(T);
 
diff --git a/Source/WebCore/platform/KURL.h b/Source/WebCore/platform/KURL.h
index 5764494..db2dd42 100644
--- a/Source/WebCore/platform/KURL.h
+++ b/Source/WebCore/platform/KURL.h
@@ -76,6 +76,12 @@ public:
     KURL(ParsedURLStringTag, const char*);
     KURL(ParsedURLStringTag, const String&);
     KURL(ParsedURLStringTag, const URLString&);
+#if USE(GOOGLEURL)
+    KURL(WTF::HashTableDeletedValueType) : m_url(WTF::HashTableDeletedValue) { }
+#else
+    KURL(WTF::HashTableDeletedValueType) : m_string(WTF::HashTableDeletedValue) { }
+#endif
+    bool isHashTableDeletedValue() const { return string().isHashTableDeletedValue(); }
 
     // Resolves the relative URL with the given base URL. If provided, the
     // TextEncoding is used to encode non-ASCII characers. The base URL can be
diff --git a/Source/WebCore/platform/KURLGoogle.cpp b/Source/WebCore/platform/KURLGoogle.cpp
index 88120a8..0d11b99 100644
--- a/Source/WebCore/platform/KURLGoogle.cpp
+++ b/Source/WebCore/platform/KURLGoogle.cpp
@@ -169,6 +169,11 @@ KURLGooglePrivate::KURLGooglePrivate(const url_parse::Parsed& parsed, bool isVal
 {
 }
 
+KURLGooglePrivate::KURLGooglePrivate(WTF::HashTableDeletedValueType)
+    : m_string(WTF::HashTableDeletedValue)
+{
+}
+ 
 // Setters for the data. Using the ASCII version when you know the
 // data is ASCII will be slightly more efficient. The UTF-8 version
 // will always be correct if the caller is unsure.
diff --git a/Source/WebCore/platform/KURLGooglePrivate.h b/Source/WebCore/platform/KURLGooglePrivate.h
index c74a6b4..12427a3 100644
--- a/Source/WebCore/platform/KURLGooglePrivate.h
+++ b/Source/WebCore/platform/KURLGooglePrivate.h
@@ -48,6 +48,7 @@ namespace WebCore {
     public:
         KURLGooglePrivate();
         KURLGooglePrivate(const url_parse::Parsed&, bool isValid);
+        KURLGooglePrivate(WTF::HashTableDeletedValueType);
 
         // Initializes the object. This will call through the backend initializer
         // below.
diff --git a/Source/WebCore/platform/KURLHash.h b/Source/WebCore/platform/KURLHash.h
index 44a4624..a236508 100644
--- a/Source/WebCore/platform/KURLHash.h
+++ b/Source/WebCore/platform/KURLHash.h
@@ -50,11 +50,7 @@ namespace WebCore {
 
 namespace WTF {
 
-    template<> struct HashTraits<WebCore::KURL> : GenericHashTraits<WebCore::KURL> {
-        static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(WebCore::KURL& slot) { new (&slot) WebCore::KURL(WebCore::ParsedURLString, WTF::String(HashTableDeletedValue)); }
-        static bool isDeletedValue(const WebCore::KURL& slot) { return slot.string().isHashTableDeletedValue(); }
-    };
+    template<> struct HashTraits<WebCore::KURL> : SimpleClassHashTraits<WebCore::KURL> { };
 
 } // namespace WTF
 
diff --git a/Source/WebCore/platform/LocalizedStrings.h b/Source/WebCore/platform/LocalizedStrings.h
index 3885439..777fcec 100644
--- a/Source/WebCore/platform/LocalizedStrings.h
+++ b/Source/WebCore/platform/LocalizedStrings.h
@@ -195,8 +195,8 @@ namespace WebCore {
     String validationMessageStepMismatchText(const String& base, const String& step);
 
 
-#define UI_STRING(string, description) WebCore::localizedString(string)
-#define UI_STRING_KEY(string, key, description) WebCore::localizedString(key)
+#define WEB_UI_STRING(string, description) WebCore::localizedString(string)
+#define WEB_UI_STRING_KEY(string, key, description) WebCore::localizedString(key)
 
     String localizedString(const char* key);
 
diff --git a/Source/WebCore/platform/MIMETypeRegistry.cpp b/Source/WebCore/platform/MIMETypeRegistry.cpp
index d0ad985..c334683 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.cpp
+++ b/Source/WebCore/platform/MIMETypeRegistry.cpp
@@ -33,7 +33,7 @@
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringHash.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include "ImageSourceCG.h"
 #include <ApplicationServices/ApplicationServices.h>
 #include <wtf/RetainPtr.h>
@@ -61,7 +61,7 @@ typedef HashMap<String, Vector<String>*, CaseFoldingHash> MediaMIMETypeMap;
     
 static void initializeSupportedImageMIMETypes()
 {
-#if PLATFORM(CG)
+#if USE(CG)
     RetainPtr<CFArrayRef> supportedTypes(AdoptCF, CGImageSourceCopyTypeIdentifiers());
     CFIndex count = CFArrayGetCount(supportedTypes.get());
     for (CFIndex i = 0; i < count; i++) {
@@ -157,7 +157,7 @@ static void initializeSupportedImageMIMETypesForEncoding()
 {
     supportedImageMIMETypesForEncoding = new HashSet<String>;
 
-#if PLATFORM(CG)
+#if USE(CG)
 #if PLATFORM(MAC)
     RetainPtr<CFArrayRef> supportedTypes(AdoptCF, CGImageDestinationCopyTypeIdentifiers());
     CFIndex count = CFArrayGetCount(supportedTypes.get());
@@ -187,7 +187,7 @@ static void initializeSupportedImageMIMETypesForEncoding()
     supportedImageMIMETypesForEncoding->add("image/tiff");
     supportedImageMIMETypesForEncoding->add("image/bmp");
     supportedImageMIMETypesForEncoding->add("image/ico");
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
     supportedImageMIMETypesForEncoding->add("image/png");
 #endif
 }
diff --git a/Source/WebCore/platform/RuntimeApplicationChecks.cpp b/Source/WebCore/platform/RuntimeApplicationChecks.cpp
new file mode 100644
index 0000000..bdb44c0
--- /dev/null
+++ b/Source/WebCore/platform/RuntimeApplicationChecks.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RuntimeApplicationChecks.h"
+
+#if USE(CF)
+#include <CoreFoundation/CoreFoundation.h>
+#include <wtf/RetainPtr.h>
+#endif
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+    
+static bool mainBundleIsEqualTo(const String& bundleIdentifierString)
+{
+#if USE(CF)
+    CFBundleRef mainBundle = CFBundleGetMainBundle();
+    if (!mainBundle)
+        return false;
+
+    CFStringRef bundleIdentifier = CFBundleGetIdentifier(mainBundle);
+    if (!bundleIdentifier)
+        return false;
+
+    RetainPtr<CFStringRef> bundleIdentifierToCompare(AdoptCF, bundleIdentifierString.createCFString());
+    return CFStringCompare(bundleIdentifier, bundleIdentifierToCompare.get(), 0) == kCFCompareEqualTo;
+#else
+    return false;
+#endif
+}
+
+bool applicationIsSafari()
+{
+    // FIXME: For the WebProcess case, ensure that this is Safari's WebProcess.
+    static bool isSafari = mainBundleIsEqualTo("com.apple.Safari") || mainBundleIsEqualTo("com.apple.WebProcess");
+    return isSafari;
+}
+
+bool applicationIsAppleMail()
+{
+    static bool isAppleMail = mainBundleIsEqualTo("com.apple.mail");
+    return isAppleMail;
+}
+
+bool applicationIsMicrosoftMessenger()
+{
+    static bool isMicrosoftMessenger = mainBundleIsEqualTo("com.microsoft.Messenger");
+    return isMicrosoftMessenger;
+}
+
+bool applicationIsAdobeInstaller()
+{
+    static bool isAdobeInstaller = mainBundleIsEqualTo("com.adobe.Installers.Setup");
+    return isAdobeInstaller;
+}
+
+bool applicationIsAOLInstantMessenger()
+{
+    static bool isAOLInstantMessenger = mainBundleIsEqualTo("com.aol.aim.desktop");
+    return isAOLInstantMessenger;
+}
+
+bool applicationIsMicrosoftMyDay()
+{
+    static bool isMicrosoftMyDay = mainBundleIsEqualTo("com.microsoft.myday");
+    return isMicrosoftMyDay;
+}
+
+bool applicationIsMicrosoftOutlook()
+{
+    static bool isMicrosoftOutlook = mainBundleIsEqualTo("com.microsoft.Outlook");
+    return isMicrosoftOutlook;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/mac/RuntimeApplicationChecks.h b/Source/WebCore/platform/RuntimeApplicationChecks.h
index f938048..c2f4ba1 100644
--- a/Source/WebCore/platform/mac/RuntimeApplicationChecks.h
+++ b/Source/WebCore/platform/RuntimeApplicationChecks.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +34,7 @@ bool applicationIsMicrosoftMessenger();
 bool applicationIsAdobeInstaller();
 bool applicationIsAOLInstantMessenger();
 bool applicationIsMicrosoftMyDay();
+bool applicationIsMicrosoftOutlook();
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/ScrollTypes.h b/Source/WebCore/platform/ScrollTypes.h
index 1f8e095..62b4645 100644
--- a/Source/WebCore/platform/ScrollTypes.h
+++ b/Source/WebCore/platform/ScrollTypes.h
@@ -108,6 +108,12 @@ namespace WebCore {
         ScrollByPixel
     };
 
+    enum ScrollElasticity {
+        ScrollElasticityAutomatic,
+        ScrollElasticityNone,
+        ScrollElasticityAllowed
+    };
+
     enum ScrollbarOrientation { HorizontalScrollbar, VerticalScrollbar };
 
     enum ScrollbarMode { ScrollbarAuto, ScrollbarAlwaysOff, ScrollbarAlwaysOn };
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index 58615fb..e79f049 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -28,6 +28,7 @@
 
 #include "AXObjectCache.h"
 #include "GraphicsContext.h"
+#include "GraphicsLayer.h"
 #include "HostWindow.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformWheelEvent.h"
@@ -56,6 +57,7 @@ ScrollView::ScrollView()
     , m_paintsEntireContents(false)
     , m_clipsRepaints(true)
     , m_delegatesScrolling(false)
+    , m_containsScrollableAreaWithOverlayScrollbars(false)
 {
     platformInit();
 }
@@ -873,8 +875,45 @@ void ScrollView::frameRectsChanged()
     HashSet<RefPtr<Widget> >::const_iterator end = m_children.end();
     for (HashSet<RefPtr<Widget> >::const_iterator current = m_children.begin(); current != end; ++current)
         (*current)->frameRectsChanged();
+    positionScrollbarLayers();
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+static void positionScrollbarLayer(GraphicsLayer* graphicsLayer, Scrollbar* scrollbar)
+{
+    if (!graphicsLayer || !scrollbar)
+        return;
+    graphicsLayer->setDrawsContent(true);
+    IntRect scrollbarRect = scrollbar->frameRect();
+    graphicsLayer->setPosition(scrollbarRect.location());
+    if (scrollbarRect.size() != graphicsLayer->size())
+        graphicsLayer->setNeedsDisplay();
+    graphicsLayer->setSize(scrollbarRect.size());
+}
+
+static void positionScrollCornerLayer(GraphicsLayer* graphicsLayer, const IntRect& cornerRect)
+{
+    if (!graphicsLayer)
+        return;
+    graphicsLayer->setDrawsContent(!cornerRect.isEmpty());
+    graphicsLayer->setPosition(cornerRect.location());
+    if (cornerRect.size() != graphicsLayer->size())
+        graphicsLayer->setNeedsDisplay();
+    graphicsLayer->setSize(cornerRect.size());
+}
+#endif
+
+
+void ScrollView::positionScrollbarLayers()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    positionScrollbarLayer(layerForHorizontalScrollbar(), horizontalScrollbar());
+    positionScrollbarLayer(layerForVerticalScrollbar(), verticalScrollbar());
+    positionScrollCornerLayer(layerForScrollCorner(), scrollCornerRect());
+#endif
+}
+
+
 void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
 {
     IntRect paintRect = rect;
@@ -919,6 +958,11 @@ IntRect ScrollView::scrollCornerRect() const
     return cornerRect;
 }
 
+bool ScrollView::isScrollCornerVisible() const
+{
+    return !scrollCornerRect().isEmpty();
+}
+
 void ScrollView::updateScrollCorner()
 {
 }
@@ -928,13 +972,30 @@ void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& corn
     ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, cornerRect);
 }
 
+void ScrollView::invalidateScrollCornerRect(const IntRect& rect)
+{
+    invalidateRect(rect);
+}
+
 void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
 {
-    if (m_horizontalScrollbar)
+    if (m_horizontalScrollbar
+#if USE(ACCELERATED_COMPOSITING)
+        && !layerForHorizontalScrollbar()
+#endif
+                                      )
         m_horizontalScrollbar->paint(context, rect);
-    if (m_verticalScrollbar)
+    if (m_verticalScrollbar
+#if USE(ACCELERATED_COMPOSITING)
+        && !layerForVerticalScrollbar()
+#endif
+                                    )
         m_verticalScrollbar->paint(context, rect);
 
+#if USE(ACCELERATED_COMPOSITING)
+    if (layerForScrollCorner())
+        return;
+#endif
     paintScrollCorner(context, scrollCornerRect());
 }
 
@@ -955,6 +1016,9 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     notifyPageThatContentAreaWillPaint();
+
+    // If we encounter any overlay scrollbars as we paint, this will be set to true.
+    m_containsScrollableAreaWithOverlayScrollbars = false;
     
     IntRect documentDirtyRect = rect;
     documentDirtyRect.intersect(frameRect());
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index bff77d5..558aee2 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -63,6 +63,7 @@ public:
     virtual void setScrollOffset(const IntPoint&);
     virtual void didCompleteRubberBand(const IntSize&) const;
     virtual void notifyPageThatContentAreaWillPaint() const;
+    virtual bool isScrollCornerVisible() const;
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     virtual void scrollTo(const IntSize& newOffset);
@@ -85,6 +86,8 @@ public:
     virtual Scrollbar* verticalScrollbar() const { return m_verticalScrollbar.get(); }
     bool isScrollViewScrollbar(const Widget* child) const { return horizontalScrollbar() == child || verticalScrollbar() == child; }
 
+    void positionScrollbarLayers();
+
     // Functions for setting and retrieving the scrolling mode in each axis (horizontal/vertical). The mode has values of
     // AlwaysOff, AlwaysOn, and Auto. AlwaysOff means never show a scrollbar, AlwaysOn means always show a scrollbar.
     // Auto means show a scrollbar only when one is needed.
@@ -183,6 +186,9 @@ public:
 
     IntSize overhangAmount() const;
 
+    void cacheCurrentScrollPosition() { m_cachedScrollPosition = scrollPosition(); }
+    IntPoint cachedScrollPosition() const { return m_cachedScrollPosition; }
+
     // Functions for scrolling the view.
     void setScrollPosition(const IntPoint&);
     void scrollBy(const IntSize& s) { return setScrollPosition(scrollPosition() + s); }
@@ -278,12 +284,17 @@ public:
 
     virtual bool isPointInScrollbarCorner(const IntPoint&);
     virtual bool scrollbarCornerPresent() const;
+    virtual IntRect scrollCornerRect() const;
+    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
 
     virtual IntRect convertFromScrollbarToContainingView(const Scrollbar*, const IntRect&) const;
     virtual IntRect convertFromContainingViewToScrollbar(const Scrollbar*, const IntRect&) const;
     virtual IntPoint convertFromScrollbarToContainingView(const Scrollbar*, const IntPoint&) const;
     virtual IntPoint convertFromContainingViewToScrollbar(const Scrollbar*, const IntPoint&) const;
 
+    bool containsScrollableAreaWithOverlayScrollbars() const { return m_containsScrollableAreaWithOverlayScrollbars; }
+    void setContainsScrollableAreaWithOverlayScrollbars(bool contains) { m_containsScrollableAreaWithOverlayScrollbars = contains; }
+
 protected:
     ScrollView();
 
@@ -303,9 +314,8 @@ protected:
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
 
-    IntRect scrollCornerRect() const;
     virtual void updateScrollCorner();
-    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+    virtual void invalidateScrollCornerRect(const IntRect&);
 
     // Scroll the content by blitting the pixels.
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
@@ -338,6 +348,7 @@ private:
 
     IntRect m_actualVisibleContentRect;
     IntSize m_scrollOffset; // FIXME: Would rather store this as a position, but we will wait to make this change until more code is shared.
+    IntPoint m_cachedScrollPosition;
     IntSize m_fixedLayoutSize;
     IntSize m_contentsSize;
 
@@ -355,6 +366,8 @@ private:
     bool m_clipsRepaints;
     bool m_delegatesScrolling;
 
+    bool m_containsScrollableAreaWithOverlayScrollbars;
+
     IntSize m_boundsSize;
 
     void init();
diff --git a/Source/WebCore/platform/ScrollableArea.cpp b/Source/WebCore/platform/ScrollableArea.cpp
index 34cec9e..2b49427 100644
--- a/Source/WebCore/platform/ScrollableArea.cpp
+++ b/Source/WebCore/platform/ScrollableArea.cpp
@@ -32,6 +32,8 @@
 #include "config.h"
 #include "ScrollableArea.h"
 
+#include "GraphicsContext.h"
+#include "GraphicsLayer.h"
 #include "FloatPoint.h"
 #include "PlatformWheelEvent.h"
 #include "ScrollAnimator.h"
@@ -44,6 +46,8 @@ ScrollableArea::ScrollableArea()
     : m_scrollAnimator(ScrollAnimator::create(this))
     , m_constrainsScrollingToContentEdge(true)
     , m_inLiveResize(false)
+    , m_verticalScrollElasticity(ScrollElasticityNone)
+    , m_horizontalScrollElasticity(ScrollElasticityNone)
 {
 }
 
@@ -194,4 +198,33 @@ bool ScrollableArea::hasOverlayScrollbars() const
         || (horizontalScrollbar() && horizontalScrollbar()->isOverlayScrollbar());
 }
 
+void ScrollableArea::invalidateScrollbar(Scrollbar* scrollbar, const IntRect& rect)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (scrollbar == horizontalScrollbar()) {
+        if (GraphicsLayer* graphicsLayer = layerForHorizontalScrollbar()) {
+            graphicsLayer->setNeedsDisplay();
+            return;
+        }
+    } else if (scrollbar == verticalScrollbar()) {
+        if (GraphicsLayer* graphicsLayer = layerForVerticalScrollbar()) {
+            graphicsLayer->setNeedsDisplay();
+            return;
+        }
+    }
+#endif
+    invalidateScrollbarRect(scrollbar, rect);
+}
+
+void ScrollableArea::invalidateScrollCorner()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (GraphicsLayer* graphicsLayer = layerForScrollCorner()) {
+        graphicsLayer->setNeedsDisplay();
+        return;
+    }
+#endif
+    invalidateScrollCornerRect(scrollCornerRect());
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollableArea.h b/Source/WebCore/platform/ScrollableArea.h
index d08de00..cc63595 100644
--- a/Source/WebCore/platform/ScrollableArea.h
+++ b/Source/WebCore/platform/ScrollableArea.h
@@ -33,9 +33,13 @@
 namespace WebCore {
 
 class FloatPoint;
+class GraphicsContext;
 class PlatformGestureEvent;
 class PlatformWheelEvent;
 class ScrollAnimator;
+#if USE(ACCELERATED_COMPOSITING)
+class GraphicsLayer;
+#endif
 
 class ScrollableArea {
 public:
@@ -57,6 +61,12 @@ public:
     bool constrainsScrollingToContentEdge() const { return m_constrainsScrollingToContentEdge; }
     void setConstrainsScrollingToContentEdge(bool constrainsScrollingToContentEdge) { m_constrainsScrollingToContentEdge = constrainsScrollingToContentEdge; }
 
+    void setVerticalScrollElasticity(ScrollElasticity scrollElasticity) { m_verticalScrollElasticity = scrollElasticity; }
+    ScrollElasticity verticalScrollElasticity() const { return m_verticalScrollElasticity; }
+
+    void setHorizontalScrollElasticity(ScrollElasticity scrollElasticity) { m_horizontalScrollElasticity = scrollElasticity; }
+    ScrollElasticity horizontalScrollElasticity() const { return m_horizontalScrollElasticity; }
+
     bool inLiveResize() const { return m_inLiveResize; }
     void willStartLiveResize();
     void willEndLiveResize();
@@ -71,11 +81,13 @@ public:
     ScrollAnimator* scrollAnimator() const { return m_scrollAnimator.get(); }
     const IntPoint& scrollOrigin() const { return m_scrollOrigin; }
 
+    virtual bool isActive() const = 0;
     virtual int scrollSize(ScrollbarOrientation) const = 0;
     virtual int scrollPosition(Scrollbar*) const = 0;
-    virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&) = 0;
-    virtual bool isActive() const = 0;
-    virtual bool scrollbarCornerPresent() const = 0;
+    void invalidateScrollbar(Scrollbar*, const IntRect&);
+    virtual bool isScrollCornerVisible() const = 0;
+    virtual IntRect scrollCornerRect() const = 0;
+    void invalidateScrollCorner();
     virtual void getTickmarks(Vector<IntRect>&) const { }
 
     // This function should be overriden by subclasses to perform the actual
@@ -130,7 +142,19 @@ private:
 
     bool m_inLiveResize;
 
+    ScrollElasticity m_verticalScrollElasticity;
+    ScrollElasticity m_horizontalScrollElasticity;
+
 protected:
+    virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&) = 0;
+    virtual void invalidateScrollCornerRect(const IntRect&) = 0;
+
+#if USE(ACCELERATED_COMPOSITING)
+    virtual GraphicsLayer* layerForHorizontalScrollbar() const { return 0; }
+    virtual GraphicsLayer* layerForVerticalScrollbar() const { return 0; }
+    virtual GraphicsLayer* layerForScrollCorner() const { return 0; }
+#endif
+
     // There are 8 possible combinations of writing mode and direction. Scroll origin will be non-zero in the x or y axis
     // if there is any reversed direction or writing-mode. The combinations are:
     // writing-mode / direction     scrollOrigin.x() set    scrollOrigin.y() set
diff --git a/Source/WebCore/platform/Scrollbar.cpp b/Source/WebCore/platform/Scrollbar.cpp
index ba00ab0..e59b763 100644
--- a/Source/WebCore/platform/Scrollbar.cpp
+++ b/Source/WebCore/platform/Scrollbar.cpp
@@ -456,8 +456,9 @@ void Scrollbar::invalidateRect(const IntRect& rect)
 {
     if (suppressInvalidation())
         return;
+
     if (m_scrollableArea)
-        m_scrollableArea->invalidateScrollbarRect(this, rect);
+        m_scrollableArea->invalidateScrollbar(this, rect);
 }
 
 IntRect Scrollbar::convertToContainingView(const IntRect& localRect) const
diff --git a/Source/WebCore/platform/Scrollbar.h b/Source/WebCore/platform/Scrollbar.h
index 267eada..161f51e 100644
--- a/Source/WebCore/platform/Scrollbar.h
+++ b/Source/WebCore/platform/Scrollbar.h
@@ -146,7 +146,7 @@ protected:
     ScrollbarOrientation m_orientation;
     ScrollbarControlSize m_controlSize;
     ScrollbarTheme* m_theme;
-    
+
     int m_visibleSize;
     int m_totalSize;
     float m_currentPos;
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.cpp b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
index 26f1494..d9f2662 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -95,7 +95,7 @@ bool ScrollbarThemeComposite::paint(Scrollbar* scrollbar, GraphicsContext* graph
             scrollMask |= BackTrackPart;
         if (damageRect.intersects(endTrackRect))
             scrollMask |= ForwardTrackPart;
-    } 
+    }
 
 #if PLATFORM(WIN)
     // FIXME: This API makes the assumption that the custom scrollbar's metrics will match
diff --git a/Source/WebCore/platform/SecureTextInput.cpp b/Source/WebCore/platform/SecureTextInput.cpp
index bebb37e..06e1c86 100644
--- a/Source/WebCore/platform/SecureTextInput.cpp
+++ b/Source/WebCore/platform/SecureTextInput.cpp
@@ -10,49 +10,34 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
+
+// FIXME: This should be moved to WebKit, because browser process needs to track secure input state anyway to manipulate input contexts.
+#if PLATFORM(CHROMIUM) && OS(DARWIN)
 #include "SecureTextInput.h"
 
-#if USE(CARBON_SECURE_INPUT_MODE)
 #import <Carbon/Carbon.h>
-#endif
 
 namespace WebCore {
 
-#if USE(CARBON_SECURE_INPUT_MODE)
-
-#ifdef BUILDING_ON_TIGER
-const short enableRomanKeyboardsOnly = -23;
-#endif
-
 void enableSecureTextInput()
 {
     if (IsSecureEventInputEnabled())
         return;
     EnableSecureEventInput();
-#ifdef BUILDING_ON_TIGER
-    KeyScript(enableRomanKeyboardsOnly);
-#else
-    // WebKit substitutes nil for input context when in password field, which corresponds to null TSMDocument. So, there is
-    // no need to call TSMGetActiveDocument(), which may return an incorrect result when selection hasn't been yet updated
-    // after focusing a node.
-    CFArrayRef inputSources = TISCreateASCIICapableInputSourceList();
-    TSMSetDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag, sizeof(CFArrayRef), &inputSources);
-    CFRelease(inputSources);
-#endif
 }
 
 void disableSecureTextInput()
@@ -60,13 +45,8 @@ void disableSecureTextInput()
     if (!IsSecureEventInputEnabled())
         return;
     DisableSecureEventInput();
-#ifdef BUILDING_ON_TIGER
-    KeyScript(smKeyEnableKybds);
-#else
-    TSMRemoveDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag);
-#endif
 }
 
-#endif // USE(CARBON_SECURE_INPUT_MODE)
-
 } // namespace WebCore
+
+#endif // PLATFORM(CHROMIUM) && OS(DARWIN)
diff --git a/Source/WebCore/platform/SecureTextInput.h b/Source/WebCore/platform/SecureTextInput.h
index c55981e..f1fc083 100644
--- a/Source/WebCore/platform/SecureTextInput.h
+++ b/Source/WebCore/platform/SecureTextInput.h
@@ -40,7 +40,7 @@ namespace WebCore {
 void enableSecureTextInput();
 void disableSecureTextInput();
 
-#if !USE(CARBON_SECURE_INPUT_MODE)
+#if !(PLATFORM(CHROMIUM) && OS(DARWIN))
 inline void enableSecureTextInput() { }
 inline void disableSecureTextInput() { }
 #endif
diff --git a/Source/WebCore/platform/TreeShared.h b/Source/WebCore/platform/TreeShared.h
index 9e27c5e..2888ebf 100644
--- a/Source/WebCore/platform/TreeShared.h
+++ b/Source/WebCore/platform/TreeShared.h
@@ -109,11 +109,7 @@ public:
     bool m_inRemovedLastRefFunction;
 #endif
 
-private:
-#ifndef NDEBUG
-    friend void adopted<>(TreeShared<T>*);
-#endif
-
+protected:
     virtual void removedLastRef()
     {
 #ifndef NDEBUG
@@ -122,6 +118,11 @@ private:
         delete this;
     }
 
+private:
+#ifndef NDEBUG
+    friend void adopted<>(TreeShared<T>*);
+#endif
+
     int m_refCount;
     T* m_parent;
 #ifndef NDEBUG
diff --git a/Source/WebCore/platform/audio/FFTFrame.cpp b/Source/WebCore/platform/audio/FFTFrame.cpp
index d9979d9..fbb5dfe 100644
--- a/Source/WebCore/platform/audio/FFTFrame.cpp
+++ b/Source/WebCore/platform/audio/FFTFrame.cpp
@@ -32,6 +32,10 @@
 
 #include "FFTFrame.h"
 
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
 #include <wtf/Complex.h>
 #include <wtf/MathExtras.h>
 #include <wtf/OwnPtr.h>
diff --git a/Source/WebCore/platform/audio/FFTFrameStub.cpp b/Source/WebCore/platform/audio/FFTFrameStub.cpp
index c76c0e2..5494cd0 100644
--- a/Source/WebCore/platform/audio/FFTFrameStub.cpp
+++ b/Source/WebCore/platform/audio/FFTFrameStub.cpp
@@ -79,6 +79,10 @@ void FFTFrame::doInverseFFT(float* data)
     ASSERT_NOT_REACHED();
 }
 
+void FFTFrame::initialize()
+{
+}
+
 void FFTFrame::cleanup()
 {
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp b/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
index 4368d22..4fcce31 100644
--- a/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
+++ b/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
@@ -120,6 +120,14 @@ bool HRTFDatabaseLoader::isLoaded() const
     return m_hrtfDatabase.get();
 }
 
+
+void HRTFDatabaseLoader::waitForLoaderThreadCompletion()
+{
+    ASSERT(!isMainThread());
+    ASSERT(m_databaseLoaderThread);
+    waitForThreadCompletion(m_databaseLoaderThread, 0);    
+}
+
 HRTFDatabase* HRTFDatabaseLoader::defaultHRTFDatabase()
 {
     if (!s_loader)
diff --git a/Source/WebCore/platform/audio/HRTFDatabaseLoader.h b/Source/WebCore/platform/audio/HRTFDatabaseLoader.h
index 72002c5..6dc02a6 100644
--- a/Source/WebCore/platform/audio/HRTFDatabaseLoader.h
+++ b/Source/WebCore/platform/audio/HRTFDatabaseLoader.h
@@ -46,11 +46,18 @@ public:
     // Must be called from the main thread.
     static PassRefPtr<HRTFDatabaseLoader> createAndLoadAsynchronouslyIfNecessary(double sampleRate);
 
+    // Returns the singleton HRTFDatabaseLoader.
+    static HRTFDatabaseLoader* loader() { return s_loader; }
+    
     // Both constructor and destructor must be called from the main thread.
     ~HRTFDatabaseLoader();
     
     // Returns true once the default database has been completely loaded.
     bool isLoaded() const;
+
+    // May not be called on the main thread.
+    // This is so a different background thread may synchronize with the loader thread.
+    void waitForLoaderThreadCompletion();
     
     HRTFDatabase* database() { return m_hrtfDatabase.get(); }
     
diff --git a/Source/WebCore/platform/audio/SincResampler.h b/Source/WebCore/platform/audio/SincResampler.h
index 92adb95..62339b3 100644
--- a/Source/WebCore/platform/audio/SincResampler.h
+++ b/Source/WebCore/platform/audio/SincResampler.h
@@ -40,7 +40,7 @@ public:
     // scaleFactor == sourceSampleRate / destinationSampleRate
     // kernelSize can be adjusted for quality (higher is better)
     // numberOfKernelOffsets is used for interpolation and is the number of sub-sample kernel shifts.
-    SincResampler(double scaleFactor, unsigned kernelSize = 64, unsigned numberOfKernelOffsets = 32);
+    SincResampler(double scaleFactor, unsigned kernelSize = 32, unsigned numberOfKernelOffsets = 32);
     
     // Processes numberOfSourceFrames from source to produce numberOfSourceFrames / scaleFactor frames in destination.
     void process(float* source, float* destination, unsigned numberOfSourceFrames);
diff --git a/Source/WebCore/platform/audio/fftw/FFTFrameFFTW.cpp b/Source/WebCore/platform/audio/fftw/FFTFrameFFTW.cpp
index 878ed9f..1a344a6 100644
--- a/Source/WebCore/platform/audio/fftw/FFTFrameFFTW.cpp
+++ b/Source/WebCore/platform/audio/fftw/FFTFrameFFTW.cpp
@@ -29,6 +29,8 @@
 
 #if ENABLE(WEB_AUDIO)
 
+#if !OS(DARWIN) && USE(WEBAUDIO_FFTW)
+
 #include "FFTFrame.h"
 
 #include <wtf/MathExtras.h>
@@ -298,4 +300,6 @@ fftwf_plan FFTFrame::fftwPlanForSize(unsigned fftSize, Direction direction,
 
 } // namespace WebCore
 
+#endif // !OS(DARWIN) && USE(WEBAUDIO_FFTW)
+
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/mkl/FFTFrameMKL.cpp b/Source/WebCore/platform/audio/mkl/FFTFrameMKL.cpp
index 3ac6b36..6bf2c1e 100644
--- a/Source/WebCore/platform/audio/mkl/FFTFrameMKL.cpp
+++ b/Source/WebCore/platform/audio/mkl/FFTFrameMKL.cpp
@@ -30,6 +30,8 @@
 
 #if ENABLE(WEB_AUDIO)
 
+#if !OS(DARWIN) && USE(WEBAUDIO_MKL)
+
 #include "FFTFrame.h"
 
 #include "mkl_vml.h"
@@ -172,7 +174,7 @@ void FFTFrame::doFFT(float* data)
 {
     // Compute Forward transform.
     MKL_LONG status = DftiComputeForward(m_handle, data, m_complexData.data());
-    ASSERT(DftiErrorClass(status, DFTI_NO_ERROR));
+    ASSERT_UNUSED(status, DftiErrorClass(status, DFTI_NO_ERROR));
 
     // De-interleave to separate real and complex arrays. FIXME:
     // figure out if it's possible to get MKL to use split-complex
@@ -197,7 +199,7 @@ void FFTFrame::doInverseFFT(float* data)
 
     // Compute backward transform.
     MKL_LONG status = DftiComputeBackward(m_handle, interleavedData, data);
-    ASSERT(DftiErrorClass(status, DFTI_NO_ERROR));
+    ASSERT_UNUSED(status, DftiErrorClass(status, DFTI_NO_ERROR));
 }
 
 void FFTFrame::initialize()
@@ -212,7 +214,7 @@ void FFTFrame::cleanup()
     for (int i = 0; i < kMaxFFTPow2Size; ++i) {
         if (descriptorHandles[i]) {
             MKL_LONG status = DftiFreeDescriptor(&descriptorHandles[i]);
-            ASSERT(DftiErrorClass(status, DFTI_NO_ERROR));
+            ASSERT_UNUSED(status, DftiErrorClass(status, DFTI_NO_ERROR));
         }
     }
 
@@ -261,4 +263,6 @@ DFTI_DESCRIPTOR_HANDLE FFTFrame::descriptorHandleForSize(unsigned fftSize)
 
 } // namespace WebCore
 
+#endif // !OS(DARWIN) && USE(WEBAUDIO_MKL)
+
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/chromium/ClipboardMimeTypes.cpp b/Source/WebCore/platform/chromium/ClipboardMimeTypes.cpp
index 27e68ff..94ce27d 100644
--- a/Source/WebCore/platform/chromium/ClipboardMimeTypes.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardMimeTypes.cpp
@@ -41,5 +41,6 @@ const char mimeTypeURL[] = "url";
 const char mimeTypeTextURIList[] = "text/uri-list";
 const char mimeTypeDownloadURL[] = "downloadurl";
 const char mimeTypeFiles[] = "Files";
+const char mimeTypeImagePng[] = "image/png";
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ClipboardMimeTypes.h b/Source/WebCore/platform/chromium/ClipboardMimeTypes.h
index 31e2d3e..3e4ab50 100644
--- a/Source/WebCore/platform/chromium/ClipboardMimeTypes.h
+++ b/Source/WebCore/platform/chromium/ClipboardMimeTypes.h
@@ -41,6 +41,7 @@ extern const char mimeTypeURL[];
 extern const char mimeTypeTextURIList[];
 extern const char mimeTypeDownloadURL[];
 extern const char mimeTypeFiles[];
+extern const char mimeTypeImagePng[];
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp b/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp
index 7857336..24b498e 100644
--- a/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp
+++ b/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp
@@ -33,9 +33,11 @@
 
 #if ENABLE(DATA_TRANSFER_ITEMS)
 
+#include "Blob.h"
 #include "Clipboard.h"
 #include "ClipboardMimeTypes.h"
 #include "PlatformBridge.h"
+#include "SharedBuffer.h"
 #include "StringCallback.h"
 
 namespace WebCore {
@@ -88,6 +90,8 @@ void DataTransferItemChromium::getAsString(PassRefPtr<StringCallback> callback)
         callback->scheduleCallback(m_context, m_data);
         return;
     }
+
+    ASSERT(m_source == PasteboardSource);
     // This is ugly but there's no real alternative.
     if (m_type == mimeTypeTextPlain) {
         callback->scheduleCallback(m_context, PlatformBridge::clipboardReadPlainText(PasteboardPrivate::StandardBuffer));
@@ -103,6 +107,33 @@ void DataTransferItemChromium::getAsString(PassRefPtr<StringCallback> callback)
     ASSERT_NOT_REACHED();
 }
 
+PassRefPtr<Blob> DataTransferItemChromium::getAsFile()
+{
+    if (m_source == InternalSource)
+        return 0;
+
+    ASSERT(m_source == PasteboardSource);
+    if (m_type == mimeTypeImagePng) {
+        // FIXME: This is pretty inefficient. We copy the data from the browser
+        // to the renderer. We then place it in a blob in WebKit, which
+        // registers it and copies it *back* to the browser. When a consumer
+        // wants to read the data, we then copy the data back into the renderer.
+        // https://bugs.webkit.org/show_bug.cgi?id=58107 has been filed to track
+        // improvements to this code (in particular, add a registerClipboardBlob
+        // method to the blob registry; that way the data is only copied over
+        // into the renderer when it's actually read, not when the blob is
+        // initially constructed).
+        RefPtr<SharedBuffer> data = PlatformBridge::clipboardReadImage(PasteboardPrivate::StandardBuffer);
+        RefPtr<RawData> rawData = RawData::create();
+        rawData->mutableData()->append(data->data(), data->size());
+        OwnPtr<BlobData> blobData = BlobData::create();
+        blobData->appendData(rawData, 0, -1);
+        blobData->setContentType(mimeTypeImagePng);
+        return Blob::create(blobData.release(), data->size());
+    }
+    return 0;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DATA_TRANSFER_ITEMS)
diff --git a/Source/WebCore/platform/chromium/DataTransferItemChromium.h b/Source/WebCore/platform/chromium/DataTransferItemChromium.h
index 77f74f2..66be96e 100644
--- a/Source/WebCore/platform/chromium/DataTransferItemChromium.h
+++ b/Source/WebCore/platform/chromium/DataTransferItemChromium.h
@@ -51,6 +51,7 @@ public:
     virtual String type() const;
 
     virtual void getAsString(PassRefPtr<StringCallback>);
+    virtual PassRefPtr<Blob> getAsFile();
 
 private:
     enum DataSource {
diff --git a/Source/WebCore/platform/chromium/PlatformBridge.h b/Source/WebCore/platform/chromium/PlatformBridge.h
index 1c3ccbd..3a04617 100644
--- a/Source/WebCore/platform/chromium/PlatformBridge.h
+++ b/Source/WebCore/platform/chromium/PlatformBridge.h
@@ -98,6 +98,7 @@ public:
 
     static String clipboardReadPlainText(PasteboardPrivate::ClipboardBuffer);
     static void clipboardReadHTML(PasteboardPrivate::ClipboardBuffer, String*, KURL*);
+    static PassRefPtr<SharedBuffer> clipboardReadImage(PasteboardPrivate::ClipboardBuffer);
 
     // Only the clipboardRead functions take a buffer argument because
     // Chromium currently uses a different technique to write to alternate
diff --git a/Source/WebCore/platform/chromium/PopupMenuChromium.cpp b/Source/WebCore/platform/chromium/PopupMenuChromium.cpp
index e83ebe4..af97ecf 100644
--- a/Source/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/Source/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -571,10 +571,10 @@ void PopupContainer::refresh(const IntRect& targetControlRect)
     location.move(0, targetControlRect.height());
 
     listBox()->updateFromElement();
-    // Store the original height to check if we need to request the location.
-    int originalHeight = height();
+    // Store the original size to check if we need to request the location.
+    IntSize originalSize = size();
     IntRect widgetRect = layoutAndCalculateWidgetRect(targetControlRect.height(), location);
-    if (originalHeight != widgetRect.height())
+    if (originalSize != widgetRect.size())
         setFrameRect(widgetRect);
 
     invalidate();
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index 439e377..3ce50e3 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -34,6 +34,7 @@
 #include "NotImplemented.h"
 #include "PaintInfo.h"
 #include "Page.h"
+#include "PlatformContextCairo.h"
 #include "RenderBox.h"
 #include "RenderObject.h"
 #include "RenderProgress.h"
@@ -605,6 +606,8 @@ const char* RenderThemeEfl::edjeGroupFromFormType(FormType type) const
 #if ENABLE(VIDEO)
         W("mediacontrol/playpause_button"),
         W("mediacontrol/mute_button"),
+        W("mediacontrol/seekforward_button"),
+        W("mediacontrol/seekbackward_button"),
 #endif
 #undef W
         0
@@ -1075,7 +1078,11 @@ bool RenderThemeEfl::emitMediaButtonSignal(FormType formType, MediaControlElemen
         edje_object_signal_emit(entry->o, "mute", "");
     else if (mediaElementType == MediaUnMuteButton)
         edje_object_signal_emit(entry->o, "sound", "");
-    else 
+    else if (mediaElementType == MediaSeekForwardButton)
+        edje_object_signal_emit(entry->o, "seekforward", "");
+    else if (mediaElementType == MediaSeekBackButton)
+        edje_object_signal_emit(entry->o, "seekbackward", "");
+    else
         return false;
 
     return true;
@@ -1106,35 +1113,49 @@ bool RenderThemeEfl::paintMediaMuteButton(RenderObject* object, const PaintInfo&
 
     HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
 
-    if (!emitMediaButtonSignal(MediaMuteUnMuteButton, mediaElement->muted() ? MediaMuteButton : MediaUnMuteButton, rect))
+    if (!emitMediaButtonSignal(MuteUnMuteButton, mediaElement->muted() ? MediaMuteButton : MediaUnMuteButton, rect))
         return false;
 
-    return paintThemePart(object, MediaMuteUnMuteButton, info, rect);
+    return paintThemePart(object, MuteUnMuteButton, info, rect);
 }
 
 bool RenderThemeEfl::paintMediaPlayButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
     Node* node = object->node();
-    if (!node)
+    if (!node || !node->isMediaControlElement())
         return false;
 
     MediaControlPlayButtonElement* button = static_cast<MediaControlPlayButtonElement*>(node);
-    if (!emitMediaButtonSignal(MediaPlayPauseButton, button->displayType(), rect))
+    if (!emitMediaButtonSignal(PlayPauseButton, button->displayType(), rect))
         return false;
 
-    return paintThemePart(object, MediaPlayPauseButton, info, rect);
+    return paintThemePart(object, PlayPauseButton, info, rect);
 }
 
 bool RenderThemeEfl::paintMediaSeekBackButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    notImplemented();
-    return false;
+    Node* node = object->node();
+    if (!node || !node->isMediaControlElement())
+        return 0;
+
+    MediaControlSeekButtonElement* button = static_cast<MediaControlSeekButtonElement*>(node);
+    if (!emitMediaButtonSignal(SeekBackwardButton, button->displayType(), rect))
+        return false;
+
+    return paintThemePart(object, SeekBackwardButton, info, rect);
 }
 
 bool RenderThemeEfl::paintMediaSeekForwardButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    notImplemented();
-    return false;
+    Node* node = object->node();
+    if (!node || !node->isMediaControlElement())
+        return 0;
+
+    MediaControlSeekButtonElement* button = static_cast<MediaControlSeekButtonElement*>(node);
+    if (!emitMediaButtonSignal(SeekForwardButton, button->displayType(), rect))
+        return false;
+
+    return paintThemePart(object, SeekForwardButton, info, rect);
 }
 
 bool RenderThemeEfl::paintMediaSliderTrack(RenderObject* object, const PaintInfo& info, const IntRect& rect)
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.h b/Source/WebCore/platform/efl/RenderThemeEfl.h
index fe8e2d2..054f91d 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.h
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.h
@@ -59,8 +59,10 @@ enum FormType { // KEEP IN SYNC WITH edjeGroupFromFormType()
     SliderVertical,
     SliderHorizontal,
 #if ENABLE(VIDEO)
-    MediaPlayPauseButton,
-    MediaMuteUnMuteButton,
+    PlayPauseButton,
+    MuteUnMuteButton,
+    SeekForwardButton,
+    SeekBackwardButton,
 #endif
     FormTypeLast
 };
diff --git a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
index 7bddbf4..a9d2238 100644
--- a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
+++ b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
@@ -26,11 +26,15 @@
 #ifndef ANGLEWebKitBridge_h
 #define ANGLEWebKitBridge_h
 
-#include "ANGLE/ShaderLang.h"
 #include "PlatformString.h"
-
 #include <wtf/text/CString.h>
 
+#if !PLATFORM(GTK)
+#include "ANGLE/ShaderLang.h"
+#else
+#include "ShaderLang.h"
+#endif
+
 namespace WebCore {
 
 enum ANGLEShaderType {
diff --git a/Source/WebCore/platform/graphics/BitmapImage.cpp b/Source/WebCore/platform/graphics/BitmapImage.cpp
index 6027f34..7cdb43d 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.cpp
+++ b/Source/WebCore/platform/graphics/BitmapImage.cpp
@@ -103,6 +103,7 @@ void BitmapImage::destroyDecodedDataIfNecessary(bool destroyAll)
 void BitmapImage::destroyMetadataAndNotify(int framesCleared)
 {
     m_isSolidColor = false;
+    m_checkedForSolidColor = false;
     invalidatePlatformData();
 
     int deltaBytes = framesCleared * -frameBytes(m_size);
diff --git a/Source/WebCore/platform/graphics/BitmapImage.h b/Source/WebCore/platform/graphics/BitmapImage.h
index c8cf0ab..8d9cd94 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.h
+++ b/Source/WebCore/platform/graphics/BitmapImage.h
@@ -53,11 +53,11 @@ namespace WebCore {
     struct FrameData;
 }
 
-// This complicated-looking declaration tells the FrameData Vector that it should copy without
-// invoking our constructor or destructor. This allows us to have a vector even for a struct
-// that's not copyable.
 namespace WTF {
-    template<> struct VectorTraits<WebCore::FrameData> : public SimpleClassVectorTraits {};
+    // FIXME: This declaration gives FrameData a default constructor that zeroes
+    // all its data members, even though FrameData's default constructor defined
+    // below does not zero all its data members. One of these must be wrong!
+    template<> struct VectorTraits<WebCore::FrameData> : public SimpleClassVectorTraits { };
 }
 
 namespace WebCore {
@@ -139,8 +139,9 @@ public:
     virtual CFDataRef getTIFFRepresentation();
 #endif
     
-#if PLATFORM(CG)
+#if USE(CG)
     virtual CGImageRef getCGImageRef();
+    virtual CGImageRef getFirstCGImageRefOfSize(const IntSize&);
 #endif
 
 #if PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS))
@@ -160,6 +161,14 @@ public:
 #endif
 
     virtual NativeImagePtr nativeImageForCurrentFrame() { return frameAtIndex(currentFrame()); }
+    bool frameHasAlphaAtIndex(size_t); 
+
+#if !ASSERT_DISABLED
+    bool notSolidColor()
+    {
+        return size().width() != 1 || size().height() != 1 || frameCount() > 1;
+    }
+#endif
 
 protected:
     enum RepetitionCountStatus {
@@ -190,7 +199,6 @@ protected:
     NativeImagePtr frameAtIndex(size_t);
     bool frameIsCompleteAtIndex(size_t);
     float frameDurationAtIndex(size_t);
-    bool frameHasAlphaAtIndex(size_t); 
 
     // Decodes and caches a frame. Never accessed except internally.
     void cacheFrame(size_t index);
diff --git a/Source/WebCore/platform/graphics/Color.h b/Source/WebCore/platform/graphics/Color.h
index 05d9554..02ec005 100644
--- a/Source/WebCore/platform/graphics/Color.h
+++ b/Source/WebCore/platform/graphics/Color.h
@@ -30,7 +30,7 @@
 #include <wtf/Forward.h>
 #include <wtf/unicode/Unicode.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include "ColorSpace.h"
 typedef struct CGColor* CGColorRef;
 #endif
@@ -143,7 +143,7 @@ public:
     operator wxColour() const;
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG)
     Color(CGColorRef);
 #endif
 
@@ -191,7 +191,7 @@ inline bool operator!=(const Color& a, const Color& b)
 Color colorFromPremultipliedARGB(unsigned);
 unsigned premultipliedARGBFromColor(const Color&);
 
-#if PLATFORM(CG)
+#if USE(CG)
 CGColorRef cachedCGColor(const Color&, ColorSpace);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/ContextShadow.h b/Source/WebCore/platform/graphics/ContextShadow.h
index 850d489..87acee0 100644
--- a/Source/WebCore/platform/graphics/ContextShadow.h
+++ b/Source/WebCore/platform/graphics/ContextShadow.h
@@ -34,7 +34,7 @@
 #include "IntRect.h"
 #include <wtf/RefCounted.h>
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 typedef struct _cairo cairo_t;
 typedef struct _cairo_surface cairo_surface_t;
 #elif PLATFORM(QT)
@@ -49,7 +49,7 @@ namespace WebCore {
 class AffineTransform;
 class GraphicsContext;
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 typedef cairo_surface_t* PlatformImage;
 typedef cairo_t* PlatformContext;
 #elif PLATFORM(QT)
@@ -116,7 +116,7 @@ public:
 
     void setShadowsIgnoreTransforms(bool enable) { m_shadowsIgnoreTransforms = enable; }
     bool shadowsIgnoreTransforms() const { return m_shadowsIgnoreTransforms; }
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     void drawRectShadow(GraphicsContext* context, const IntRect& rect, const IntSize& topLeftRadius = IntSize(), const IntSize& topRightRadius = IntSize(), const IntSize& bottomLeftRadius = IntSize(), const IntSize& bottomRightRadius = IntSize());
 #endif
 #if PLATFORM(QT)
@@ -135,7 +135,7 @@ private:
     void blurLayerImage(unsigned char*, const IntSize& imageSize, int stride);
     IntRect calculateLayerBoundingRect(GraphicsContext*, const FloatRect& layerArea, const IntRect& clipRect);
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     void drawRectShadowWithoutTiling(GraphicsContext*, const IntRect& shadowRect, const IntSize& topLeftRadius, const IntSize& topRightRadius, const IntSize& bottomLeftRadius, const IntSize& bottomRightRadius, float alpha);
 #endif
 };
diff --git a/Source/WebCore/platform/graphics/DashArray.h b/Source/WebCore/platform/graphics/DashArray.h
index 46b84a4..0516584 100644
--- a/Source/WebCore/platform/graphics/DashArray.h
+++ b/Source/WebCore/platform/graphics/DashArray.h
@@ -28,9 +28,9 @@
 
 #include <wtf/Vector.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 typedef Vector<CGFloat> DashArray;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 typedef Vector<double> DashArray;
 #else
 typedef Vector<float> DashArray;
diff --git a/Source/WebCore/platform/graphics/Extensions3D.h b/Source/WebCore/platform/graphics/Extensions3D.h
index 5d5a5b7..fee1133 100644
--- a/Source/WebCore/platform/graphics/Extensions3D.h
+++ b/Source/WebCore/platform/graphics/Extensions3D.h
@@ -66,6 +66,11 @@ public:
     // extension names for which supports returns true.
     virtual void ensureEnabled(const String&) = 0;
 
+    // Takes full name of extension: for example, "GL_EXT_texture_format_BGRA8888".
+    // Checks to see whether the given extension is actually enabled (see ensureEnabled).
+    // Has no other side-effects.
+    virtual bool isEnabled(const String&) = 0;
+
     enum ExtensionsEnumType {
         // GL_EXT_texture_format_BGRA8888 enums
         BGRA_EXT = 0x80E1,
diff --git a/Source/WebCore/platform/graphics/FloatPoint.cpp b/Source/WebCore/platform/graphics/FloatPoint.cpp
index 226ae71..abe9b86 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.cpp
+++ b/Source/WebCore/platform/graphics/FloatPoint.cpp
@@ -31,6 +31,7 @@
 #include "TransformationMatrix.h"
 #include "FloatConversion.h"
 #include "IntPoint.h"
+#include <limits>
 #include <math.h>
 
 namespace WebCore {
@@ -73,4 +74,43 @@ FloatPoint FloatPoint::narrowPrecision(double x, double y)
     return FloatPoint(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y));
 }
 
+float findSlope(const FloatPoint& p1, const FloatPoint& p2, float& c)
+{
+    if (p2.x() == p1.x())
+        return std::numeric_limits<float>::infinity();
+
+    // y = mx + c
+    float slope = (p2.y() - p1.y()) / (p2.x() - p1.x());
+    c = p1.y() - slope * p1.x();
+    return slope;
+}
+
+bool findIntersection(const FloatPoint& p1, const FloatPoint& p2, const FloatPoint& d1, const FloatPoint& d2, FloatPoint& intersection) 
+{
+    float pOffset = 0;
+    float pSlope = findSlope(p1, p2, pOffset);
+
+    float dOffset = 0;
+    float dSlope = findSlope(d1, d2, dOffset);
+
+    if (dSlope == pSlope)
+        return false;
+    
+    if (pSlope == std::numeric_limits<float>::infinity()) {
+        intersection.setX(p1.x());
+        intersection.setY(dSlope * intersection.x() + dOffset);
+        return true;
+    }
+    if (dSlope == std::numeric_limits<float>::infinity()) {
+        intersection.setX(d1.x());
+        intersection.setY(pSlope * intersection.x() + pOffset);
+        return true;
+    }
+    
+    // Find x at intersection, where ys overlap; x = (c' - c) / (m - m')
+    intersection.setX((dOffset - pOffset) / (pSlope - dSlope));
+    intersection.setY(pSlope * intersection.x() + pOffset);
+    return true;
+}
+
 }
diff --git a/Source/WebCore/platform/graphics/FloatPoint.h b/Source/WebCore/platform/graphics/FloatPoint.h
index c4b2943..fd73c69 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.h
+++ b/Source/WebCore/platform/graphics/FloatPoint.h
@@ -31,7 +31,7 @@
 #include "IntPoint.h"
 #include <wtf/MathExtras.h>
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 typedef struct CGPoint CGPoint;
 #endif
 
@@ -109,7 +109,7 @@ public:
         return m_x * m_x + m_y * m_y;
     }
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
     FloatPoint(const CGPoint&);
     operator CGPoint() const;
 #endif
@@ -202,6 +202,11 @@ inline IntPoint roundedIntPoint(const FloatPoint& p)
     return IntPoint(static_cast<int>(roundf(p.x())), static_cast<int>(roundf(p.y())));
 }
 
+float findSlope(const FloatPoint& p1, const FloatPoint& p2, float& c);
+
+// Find point where lines through the two pairs of points intersect. Returns false if the lines don't intersect.
+bool findIntersection(const FloatPoint& p1, const FloatPoint& p2, const FloatPoint& d1, const FloatPoint& d2, FloatPoint& intersection);
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/FloatRect.cpp b/Source/WebCore/platform/graphics/FloatRect.cpp
index 36f3d3a..165ef76 100644
--- a/Source/WebCore/platform/graphics/FloatRect.cpp
+++ b/Source/WebCore/platform/graphics/FloatRect.cpp
@@ -30,8 +30,8 @@
 #include "FloatConversion.h"
 #include "IntRect.h"
 #include <algorithm>
-#include <limits>
 #include <math.h>
+#include <wtf/MathExtras.h>
 
 using std::max;
 using std::min;
@@ -97,6 +97,24 @@ void FloatRect::unite(const FloatRect& other)
     setLocationAndSizeFromEdges(l, t, r, b);
 }
 
+void FloatRect::uniteIfNonZero(const FloatRect& other)
+{
+    // Handle empty special cases first.
+    if (!other.width() && !other.height())
+        return;
+    if (!width() && !height()) {
+        *this = other;
+        return;
+    }
+
+    float left = min(x(), other.x());
+    float top = min(y(), other.y());
+    float right = max(maxX(), other.maxX());
+    float bottom = max(maxY(), other.maxY());
+
+    setLocationAndSizeFromEdges(left, top, right, bottom);
+}
+
 void FloatRect::scale(float sx, float sy)
 {
     m_location.setX(x() * sx);
@@ -182,6 +200,7 @@ IntRect enclosingIntRect(const FloatRect& rect)
     float top = floorf(rect.y());
     float width = ceilf(rect.maxX()) - left;
     float height = ceilf(rect.maxY()) - top;
+    
     return IntRect(safeFloatToInt(left), safeFloatToInt(top), 
                    safeFloatToInt(width), safeFloatToInt(height));
 }
diff --git a/Source/WebCore/platform/graphics/FloatRect.h b/Source/WebCore/platform/graphics/FloatRect.h
index bd23476..493c068 100644
--- a/Source/WebCore/platform/graphics/FloatRect.h
+++ b/Source/WebCore/platform/graphics/FloatRect.h
@@ -29,7 +29,7 @@
 
 #include "FloatPoint.h"
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 typedef struct CGRect CGRect;
 #endif
 
@@ -59,7 +59,7 @@ class BRect;
 struct SkRect;
 #endif
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 typedef struct _cairo_rectangle cairo_rectangle_t;
 #endif
 
@@ -112,6 +112,7 @@ public:
 
     void intersect(const FloatRect&);
     void unite(const FloatRect&);
+    void uniteIfNonZero(const FloatRect&);
 
     // Note, this doesn't match what IntRect::contains(IntPoint&) does; the int version
     // is really checking for containment of 1x1 rect, but that doesn't make sense with floats.
@@ -136,7 +137,7 @@ public:
     void fitToPoints(const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2);
     void fitToPoints(const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2, const FloatPoint& p3);
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
     FloatRect(const CGRect&);
     operator CGRect() const;
 #endif
@@ -172,7 +173,7 @@ public:
     operator VGRect() const;
 #endif
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     FloatRect(const cairo_rectangle_t&);
     operator cairo_rectangle_t() const;
 #endif
diff --git a/Source/WebCore/platform/graphics/FloatSize.h b/Source/WebCore/platform/graphics/FloatSize.h
index 160fc9a..1485c71 100644
--- a/Source/WebCore/platform/graphics/FloatSize.h
+++ b/Source/WebCore/platform/graphics/FloatSize.h
@@ -31,7 +31,7 @@
 #include "IntSize.h"
 #include <wtf/MathExtras.h>
 
-#if PLATFORM(CG) || (PLATFORM(WX) && OS(DARWIN))
+#if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROME)
 typedef struct CGSize CGSize;
 #endif
 
@@ -89,7 +89,7 @@ public:
         return m_width * m_width + m_height * m_height;
     }
 
-#if PLATFORM(CG) || (PLATFORM(WX) && OS(DARWIN))
+#if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROME)
     explicit FloatSize(const CGSize&); // don't do this implicitly since it's lossy
     operator CGSize() const;
 #endif
@@ -148,6 +148,11 @@ inline IntSize roundedIntSize(const FloatSize& p)
     return IntSize(static_cast<int>(roundf(p.width())), static_cast<int>(roundf(p.height())));
 }
 
+inline IntSize expandedIntSize(const FloatSize& p)
+{
+    return IntSize(clampToInteger(ceilf(p.width())), clampToInteger(ceilf(p.height())));
+}
+
 } // namespace WebCore
 
 #endif // FloatSize_h
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index 554f8a0..beafdc7 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -203,7 +203,8 @@ public:
 
     FontSelector* fontSelector() const;
     static bool treatAsSpace(UChar c) { return c == ' ' || c == '\t' || c == '\n' || c == noBreakSpace; }
-    static bool treatAsZeroWidthSpace(UChar c) { return c < 0x20 || (c >= 0x7F && c < 0xA0) || c == softHyphen || (c >= 0x200c && c <= 0x200f) || (c >= 0x202a && c <= 0x202e) || c == objectReplacementCharacter; }
+    static bool treatAsZeroWidthSpace(UChar c) { return treatAsZeroWidthSpaceInComplexScript(c) || c == 0x200c || c == 0x200d; }
+    static bool treatAsZeroWidthSpaceInComplexScript(UChar c) { return c < 0x20 || (c >= 0x7F && c < 0xA0) || c == softHyphen || (c >= 0x200e && c <= 0x200f) || (c >= 0x202a && c <= 0x202e) || c == zeroWidthNoBreakSpace || c == objectReplacementCharacter; }
     static bool canReceiveTextEmphasis(UChar32 c);
 
     static inline UChar normalizeSpaces(UChar character)
diff --git a/Source/WebCore/platform/graphics/FontCache.cpp b/Source/WebCore/platform/graphics/FontCache.cpp
index 8c5edfe..d64878b 100644
--- a/Source/WebCore/platform/graphics/FontCache.cpp
+++ b/Source/WebCore/platform/graphics/FontCache.cpp
@@ -121,22 +121,7 @@ struct FontPlatformDataCacheKeyHash {
     static const bool safeToCompareToEmptyOrDeleted = true;
 };
 
-struct FontPlatformDataCacheKeyTraits : WTF::GenericHashTraits<FontPlatformDataCacheKey> {
-    static const bool emptyValueIsZero = true;
-    static const FontPlatformDataCacheKey& emptyValue()
-    {
-        DEFINE_STATIC_LOCAL(FontPlatformDataCacheKey, key, (nullAtom));
-        return key;
-    }
-    static void constructDeletedValue(FontPlatformDataCacheKey& slot)
-    {
-        new (&slot) FontPlatformDataCacheKey(HashTableDeletedValue);
-    }
-    static bool isDeletedValue(const FontPlatformDataCacheKey& value)
-    {
-        return value.isHashTableDeletedValue();
-    }
-};
+struct FontPlatformDataCacheKeyTraits : WTF::SimpleClassHashTraits<FontPlatformDataCacheKey> { };
 
 typedef HashMap<FontPlatformDataCacheKey, FontPlatformData*, FontPlatformDataCacheKeyHash, FontPlatformDataCacheKeyTraits> FontPlatformDataCache;
 
diff --git a/Source/WebCore/platform/graphics/FontMetrics.h b/Source/WebCore/platform/graphics/FontMetrics.h
index 89c5545..367f004 100644
--- a/Source/WebCore/platform/graphics/FontMetrics.h
+++ b/Source/WebCore/platform/graphics/FontMetrics.h
@@ -96,6 +96,11 @@ public:
     int lineGap() const { return lroundf(m_lineGap); }
     int lineSpacing() const { return lroundf(m_lineSpacing); }
 
+    bool hasIdenticalAscentDescentAndLineGap(const FontMetrics& other) const
+    {
+        return ascent() == other.ascent() && descent() == other.descent() && lineGap() == other.lineGap();
+    }
+
 private:
     friend class SimpleFontData;
 
diff --git a/Source/WebCore/platform/graphics/FontPlatformData.h b/Source/WebCore/platform/graphics/FontPlatformData.h
index 5981c16..a32215d 100644
--- a/Source/WebCore/platform/graphics/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/FontPlatformData.h
@@ -51,7 +51,7 @@
 #include "RefCountedGDIHandle.h"
 #endif
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 #include "HashFunctions.h"
 #include <cairo.h>
 #endif
@@ -86,7 +86,7 @@ typedef const struct __CTFont* CTFontRef;
 typedef struct HFONT__* HFONT;
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 typedef struct CGFont* CGFontRef;
 #if OS(DARWIN)
 #ifndef BUILDING_ON_TIGER
@@ -119,9 +119,9 @@ public:
 #elif OS(DARWIN)
         , m_font(hashTableDeletedFontValue())
 #endif
-#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+#if USE(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
         , m_cgFont(0)
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
         , m_scaledFont(hashTableDeletedFontValue())
 #endif
         , m_isColorBitmapFont(false)
@@ -141,9 +141,9 @@ public:
 #if OS(DARWIN)
         , m_font(0)
 #endif
-#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+#if USE(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
         , m_cgFont(0)
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
         , m_scaledFont(0)
 #endif
         , m_isColorBitmapFont(false)
@@ -166,9 +166,9 @@ public:
 #if OS(DARWIN)
         , m_font(0)
 #endif
-#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+#if USE(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
         , m_cgFont(0)
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
         , m_scaledFont(0)
 #endif
         , m_isColorBitmapFont(false)
@@ -181,6 +181,7 @@ public:
 #if OS(DARWIN)
     FontPlatformData(NSFont*, float size, bool syntheticBold = false, bool syntheticOblique = false, FontOrientation = Horizontal,
                      TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth);
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
     FontPlatformData(CGFontRef cgFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation,
                      TextOrientation textOrientation, FontWidthVariant widthVariant)
         : m_syntheticBold(syntheticBold)
@@ -195,13 +196,14 @@ public:
     {
     }
 #endif
+#endif
 #if PLATFORM(WIN)
     FontPlatformData(HFONT, float size, bool syntheticBold, bool syntheticOblique, bool useGDI);
-#if PLATFORM(CG)
+#if USE(CG)
     FontPlatformData(HFONT, CGFontRef, float size, bool syntheticBold, bool syntheticOblique, bool useGDI);
 #endif
 #endif
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     FontPlatformData(cairo_font_face_t*, float size, bool bold, bool italic);
 #endif
 
@@ -215,7 +217,7 @@ public:
     void setFont(NSFont*);
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 #if OS(DARWIN)
 #ifndef BUILDING_ON_TIGER
     CGFontRef cgFont() const { return m_cgFont.get(); }
@@ -243,19 +245,21 @@ public:
 
     void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
 #endif
 
     unsigned hash() const
     {
-#if PLATFORM(WIN) && !PLATFORM(CAIRO)
+#if PLATFORM(WIN) && !USE(CAIRO)
         return m_font ? m_font->hash() : 0;
 #elif OS(DARWIN)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
         ASSERT(m_font || !m_cgFont);
+#endif
         uintptr_t hashCodes[3] = { (uintptr_t)m_font, m_widthVariant, m_textOrientation << 3 | m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique };
         return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
         return PtrHash<cairo_scaled_font_t*>::hash(m_scaledFont);
 #endif
     }
@@ -276,11 +280,11 @@ public:
 
     bool isHashTableDeletedValue() const
     {
-#if PLATFORM(WIN) && !PLATFORM(CAIRO)
+#if PLATFORM(WIN) && !USE(CAIRO)
         return m_font.isHashTableDeletedValue();
 #elif OS(DARWIN)
         return m_font == hashTableDeletedFontValue();
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
         return m_scaledFont == hashTableDeletedFontValue();
 #endif
     }
@@ -307,7 +311,7 @@ private:
     void platformDataInit(HFONT, float size, HDC, WCHAR* faceName);
 #endif
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     static cairo_scaled_font_t* hashTableDeletedFontValue() { return reinterpret_cast<cairo_scaled_font_t*>(-1); }
 #endif
 
@@ -326,7 +330,7 @@ private:
     RefPtr<RefCountedGDIHandle<HFONT> > m_font;
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 #if PLATFORM(WIN)
     RetainPtr<CGFontRef> m_cgFont;
 #else
@@ -339,7 +343,7 @@ private:
 #endif
 #endif
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     cairo_scaled_font_t* m_scaledFont;
 #endif
 
diff --git a/Source/WebCore/platform/graphics/FontSelector.h b/Source/WebCore/platform/graphics/FontSelector.h
index 156bf10..e18161b 100644
--- a/Source/WebCore/platform/graphics/FontSelector.h
+++ b/Source/WebCore/platform/graphics/FontSelector.h
@@ -33,6 +33,7 @@ namespace WebCore {
 
 class FontData;
 class FontDescription;
+class FontSelectorClient;
 
 class FontSelector : public RefCounted<FontSelector> {
 public:
@@ -40,6 +41,16 @@ public:
     virtual FontData* getFontData(const FontDescription&, const AtomicString& familyName) = 0;
 
     virtual void fontCacheInvalidated() { }
+
+    virtual void registerForInvalidationCallbacks(FontSelectorClient*) = 0;
+    virtual void unregisterForInvalidationCallbacks(FontSelectorClient*) = 0;
+};
+
+class FontSelectorClient {
+public:
+    virtual ~FontSelectorClient() { }
+
+    virtual void fontsNeedUpdate(FontSelector*) = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/GlyphBuffer.h b/Source/WebCore/platform/graphics/GlyphBuffer.h
index 7aac1e3..f5216a9 100644
--- a/Source/WebCore/platform/graphics/GlyphBuffer.h
+++ b/Source/WebCore/platform/graphics/GlyphBuffer.h
@@ -34,11 +34,11 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(CG) || (PLATFORM(WX) && OS(DARWIN))
+#if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROME)
 #include <ApplicationServices/ApplicationServices.h>
 #endif
 
-#if PLATFORM(CAIRO) || (PLATFORM(WX) && defined(__WXGTK__))
+#if USE(CAIRO) || (PLATFORM(WX) && defined(__WXGTK__))
 #include <cairo.h>
 #endif
 
@@ -47,7 +47,7 @@ namespace WebCore {
 typedef unsigned short Glyph;
 class SimpleFontData;
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 // FIXME: Why does Cairo use such a huge struct instead of just an offset into an array?
 typedef cairo_glyph_t GlyphBufferGlyph;
 #elif OS(WINCE)
@@ -58,7 +58,7 @@ typedef Glyph GlyphBufferGlyph;
 
 // CG uses CGSize instead of FloatSize so that the result of advances()
 // can be passed directly to CGContextShowGlyphsWithAdvances in FontMac.mm
-#if PLATFORM(CG) || (PLATFORM(WX) && OS(DARWIN))
+#if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROME)
 typedef CGSize GlyphBufferAdvance;
 #elif OS(WINCE)
 // There is no cross-platform code that uses the height of GlyphBufferAdvance,
@@ -113,7 +113,7 @@ public:
 
     Glyph glyphAt(int index) const
     {
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
         return m_glyphs[index].index;
 #else
         return m_glyphs[index];
@@ -122,7 +122,7 @@ public:
 
     float advanceAt(int index) const
     {
-#if PLATFORM(CG) || (PLATFORM(WX) && OS(DARWIN))
+#if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROME)
         return m_advances[index].width;
 #elif OS(WINCE)
         return m_advances[index];
@@ -145,7 +145,7 @@ public:
     {
         m_fontData.append(font);
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
         cairo_glyph_t cairoGlyph;
         cairoGlyph.index = glyph;
         m_glyphs.append(cairoGlyph);
@@ -153,7 +153,7 @@ public:
         m_glyphs.append(glyph);
 #endif
 
-#if PLATFORM(CG) || (PLATFORM(WX) && OS(DARWIN))
+#if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROME)
         CGSize advance = { width, 0 };
         m_advances.append(advance);
 #elif OS(WINCE)
@@ -176,7 +176,7 @@ public:
     void add(Glyph glyph, const SimpleFontData* font, GlyphBufferAdvance advance)
     {
         m_fontData.append(font);
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
         cairo_glyph_t cairoGlyph;
         cairoGlyph.index = glyph;
         m_glyphs.append(cairoGlyph);
@@ -192,7 +192,7 @@ public:
     {
         ASSERT(!isEmpty());
         GlyphBufferAdvance& lastAdvance = m_advances.last();
-#if PLATFORM(CG) || (PLATFORM(WX) && OS(DARWIN))
+#if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROME)
         lastAdvance.width += width;
 #elif OS(WINCE)
         lastAdvance += width;
diff --git a/Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp b/Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp
index e7ed193..951cf56 100644
--- a/Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp
+++ b/Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp
@@ -191,6 +191,9 @@ void GlyphPageTreeNode::initializePage(const FontData* fontData, unsigned pageNu
                 } else if (start == (objectReplacementCharacter & ~(GlyphPage::size - 1))) {
                     // Object replacement character must not render at all.
                     buffer[objectReplacementCharacter - start] = zeroWidthSpace;
+                } else if (start == (zeroWidthNoBreakSpace & ~(GlyphPage::size - 1))) {
+                    // ZWNBS/BOM must not render at all.
+                    buffer[zeroWidthNoBreakSpace - start] = zeroWidthSpace;
                 }
             } else {
                 bufferLength = GlyphPage::size * 2;
diff --git a/Source/WebCore/platform/graphics/Gradient.cpp b/Source/WebCore/platform/graphics/Gradient.cpp
index 783e552..4edb4bd 100644
--- a/Source/WebCore/platform/graphics/Gradient.cpp
+++ b/Source/WebCore/platform/graphics/Gradient.cpp
@@ -221,7 +221,11 @@ void Gradient::setGradientSpaceTransform(const AffineTransform& gradientSpaceTra
     setPlatformGradientSpaceTransform(gradientSpaceTransformation);
 }
 
+<<<<<<< HEAD
 #if !(USE(SKIA) && !PLATFORM(ANDROID)) && !PLATFORM(CAIRO)
+=======
+#if !USE(SKIA) && !USE(CAIRO)
+>>>>>>> WebKit.org at r84325
 void Gradient::setPlatformGradientSpaceTransform(const AffineTransform&)
 {
 }
diff --git a/Source/WebCore/platform/graphics/Gradient.h b/Source/WebCore/platform/graphics/Gradient.h
index acc6125..7595896 100644
--- a/Source/WebCore/platform/graphics/Gradient.h
+++ b/Source/WebCore/platform/graphics/Gradient.h
@@ -35,7 +35,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 
 typedef struct CGContext* CGContextRef;
 
@@ -54,7 +54,7 @@ QT_BEGIN_NAMESPACE
 class QGradient;
 QT_END_NAMESPACE
 typedef QGradient* PlatformGradient;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 typedef struct _cairo_pattern cairo_pattern_t;
 typedef cairo_pattern_t* PlatformGradient;
 #elif USE(SKIA)
@@ -146,7 +146,7 @@ namespace WebCore {
 
         void setPlatformGradientSpaceTransform(const AffineTransform& gradientSpaceTransformation);
 
-#if PLATFORM(CG)
+#if USE(CG)
         void paint(CGContextRef);
         void paint(GraphicsContext*);
 #endif
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.cpp b/Source/WebCore/platform/graphics/GraphicsContext.cpp
index fa3280e..ddaf938 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext.cpp
@@ -148,7 +148,7 @@ void GraphicsContext::setLegacyShadow(const FloatSize& offset, float blur, const
     m_state.shadowBlur = blur;
     m_state.shadowColor = color;
     m_state.shadowColorSpace = colorSpace;
-#if PLATFORM(CG)
+#if USE(CG)
     m_state.shadowsUseLegacyRadius = true;
 #endif
     setPlatformShadow(offset, blur, color, colorSpace);
@@ -397,7 +397,11 @@ void GraphicsContext::drawBidiText(const Font& font, const TextRun& run, const F
     if (paintingDisabled())
         return;
 
+    // FIXME: This ownership should be reversed. We should pass BidiRunList
+    // to BidiResolver in createBidiRunsForLine.
     BidiResolver<TextRunIterator, BidiCharacterRun> bidiResolver;
+    BidiRunList<BidiCharacterRun>& bidiRuns = bidiResolver.runs();
+
     WTF::Unicode::Direction paragraphDirection = run.ltr() ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
 
     bidiResolver.setStatus(BidiStatus(paragraphDirection, paragraphDirection, paragraphDirection, BidiContext::create(run.ltr() ? 0 : 1, paragraphDirection, run.directionalOverride())));
@@ -405,11 +409,11 @@ void GraphicsContext::drawBidiText(const Font& font, const TextRun& run, const F
     bidiResolver.setPosition(TextRunIterator(&run, 0));
     bidiResolver.createBidiRunsForLine(TextRunIterator(&run, run.length()));
 
-    if (!bidiResolver.runCount())
+    if (!bidiRuns.runCount())
         return;
 
     FloatPoint currPoint = point;
-    BidiCharacterRun* bidiRun = bidiResolver.firstRun();
+    BidiCharacterRun* bidiRun = bidiRuns.firstRun();
     while (bidiRun) {
 
         TextRun subrun = run;
@@ -425,7 +429,7 @@ void GraphicsContext::drawBidiText(const Font& font, const TextRun& run, const F
             currPoint.move(font.width(subrun), 0);
     }
 
-    bidiResolver.deleteRuns();
+    bidiRuns.deleteRuns();
 }
 
 void GraphicsContext::drawHighlightForText(const Font& font, const TextRun& run, const FloatPoint& point, int h, const Color& backgroundColor, ColorSpace colorSpace, int from, int to)
@@ -563,7 +567,7 @@ void GraphicsContext::addRoundedRectClip(const RoundedIntRect& rect)
         return;
 
     Path path;
-    path.addRoundedRect(rect.rect(), rect.radii().topLeft(), rect.radii().topRight(), rect.radii().bottomLeft(), rect.radii().bottomRight());
+    path.addRoundedRect(rect);
     clip(path);
 }
 
@@ -573,7 +577,7 @@ void GraphicsContext::clipOutRoundedRect(const RoundedIntRect& rect)
         return;
 
     Path path;
-    path.addRoundedRect(rect.rect(), rect.radii().topLeft(), rect.radii().topRight(), rect.radii().bottomLeft(), rect.radii().bottomRight());
+    path.addRoundedRect(rect);
     clipOut(path);
 }
 
@@ -584,7 +588,7 @@ void GraphicsContext::clipToImageBuffer(ImageBuffer* buffer, const FloatRect& re
     buffer->clip(this, rect);
 }
 
-#if !PLATFORM(CG)
+#if !USE(CG)
 IntRect GraphicsContext::clipBounds() const
 {
     ASSERT_NOT_REACHED();
@@ -617,7 +621,7 @@ void GraphicsContext::fillRoundedRect(const RoundedIntRect& rect, const Color& c
     fillRoundedRect(rect.rect(), rect.radii().topLeft(), rect.radii().topRight(), rect.radii().bottomLeft(), rect.radii().bottomRight(), color, colorSpace);
 }
 
-#if !PLATFORM(CG)
+#if !USE(CG)
 void GraphicsContext::fillRectWithRoundedHole(const IntRect& rect, const RoundedIntRect& roundedHoleRect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
@@ -627,7 +631,7 @@ void GraphicsContext::fillRectWithRoundedHole(const IntRect& rect, const Rounded
     path.addRect(rect);
 
     if (!roundedHoleRect.radii().isZero())
-        path.addRoundedRect(roundedHoleRect.rect(), roundedHoleRect.radii().topLeft(), roundedHoleRect.radii().topRight(), roundedHoleRect.radii().bottomLeft(), roundedHoleRect.radii().bottomRight());
+        path.addRoundedRect(roundedHoleRect);
     else
         path.addRect(roundedHoleRect.rect());
 
@@ -674,7 +678,11 @@ void GraphicsContext::setPlatformStrokePattern(Pattern*)
 }
 #endif
 
+<<<<<<< HEAD
 #if !PLATFORM(CG) && !(USE(SKIA) && !PLATFORM(ANDROID))
+=======
+#if !USE(CG) && !USE(SKIA)
+>>>>>>> WebKit.org at r84325
 // Implement this if you want to go ahead and push the drawing mode into your native context
 // immediately.
 void GraphicsContext::setPlatformTextDrawingMode(TextDrawingModeFlags mode)
@@ -682,13 +690,17 @@ void GraphicsContext::setPlatformTextDrawingMode(TextDrawingModeFlags mode)
 }
 #endif
 
+<<<<<<< HEAD
 #if !PLATFORM(QT) && !PLATFORM(CAIRO) && !(USE(SKIA) && !PLATFORM(ANDROID)) && !PLATFORM(HAIKU) && !PLATFORM(OPENVG)
+=======
+#if !PLATFORM(QT) && !USE(CAIRO) && !USE(SKIA) && !PLATFORM(HAIKU) && !PLATFORM(OPENVG)
+>>>>>>> WebKit.org at r84325
 void GraphicsContext::setPlatformStrokeStyle(StrokeStyle)
 {
 }
 #endif
 
-#if !PLATFORM(CG)
+#if !USE(CG)
 void GraphicsContext::setPlatformShouldSmoothFonts(bool)
 {
 }
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.h b/Source/WebCore/platform/graphics/GraphicsContext.h
index c555a5f..2b41c2e 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext.h
@@ -37,9 +37,9 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 typedef struct CGContext PlatformGraphicsContext;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 namespace WebCore {
 class ContextShadow;
 class PlatformContextCairo;
@@ -99,8 +99,9 @@ typedef void PlatformGraphicsContext;
 #endif
 
 #if PLATFORM(WIN)
+#include "DIBPixelData.h"
 typedef struct HDC__* HDC;
-#if !PLATFORM(CG)
+#if !USE(CG)
 // UInt8 is defined in CoreFoundation/CFBase.h
 typedef unsigned char UInt8;
 #endif
@@ -161,7 +162,7 @@ namespace WebCore {
         GraphicsContextState()
             : strokeThickness(0)
             , shadowBlur(0)
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
             , globalAlpha(1)
 #endif
             , textDrawingMode(TextModeFill)
@@ -177,7 +178,7 @@ namespace WebCore {
             , shouldSmoothFonts(true)
             , paintingDisabled(false)
             , shadowsIgnoreTransforms(false)
-#if PLATFORM(CG)
+#if USE(CG)
             // Core Graphics incorrectly renders shadows with radius > 8px (<rdar://problem/8103442>),
             // but we need to preserve this buggy behavior for canvas and -webkit-box-shadow.
             , shadowsUseLegacyRadius(false)
@@ -196,7 +197,7 @@ namespace WebCore {
         float strokeThickness;
         float shadowBlur;
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
         float globalAlpha;
 #endif
         TextDrawingModeFlags textDrawingMode;
@@ -218,7 +219,7 @@ namespace WebCore {
         bool shouldSmoothFonts : 1;
         bool paintingDisabled : 1;
         bool shadowsIgnoreTransforms : 1;
-#if PLATFORM(CG)
+#if USE(CG)
         bool shadowsUseLegacyRadius : 1;
 #endif
     };
@@ -270,7 +271,7 @@ namespace WebCore {
 
         const GraphicsContextState& state() const;
 
-#if PLATFORM(CG)
+#if USE(CG)
         void applyStrokePattern();
         void applyFillPattern();
         void drawPath(const Path&);
@@ -383,7 +384,11 @@ namespace WebCore {
         void drawBidiText(const Font&, const TextRun&, const FloatPoint&);
         void drawHighlightForText(const Font&, const TextRun&, const FloatPoint&, int h, const Color& backgroundColor, ColorSpace, int from = 0, int to = -1);
 
-        FloatRect roundToDevicePixels(const FloatRect&);
+        enum RoundingMode {
+            RoundAllSides,
+            RoundOriginAndDimensions
+        };
+        FloatRect roundToDevicePixels(const FloatRect&, RoundingMode = RoundAllSides);
 
         void drawLineForText(const FloatPoint&, float width, bool printing);
         enum TextCheckingLineStyle {
@@ -420,7 +425,7 @@ namespace WebCore {
         void setMiterLimit(float);
 
         void setAlpha(float);
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
         float getAlpha();
 #endif
 
@@ -486,18 +491,17 @@ namespace WebCore {
             ~WindowsBitmap();
 
             HDC hdc() const { return m_hdc; }
-            UInt8* buffer() const { return m_bitmapBuffer; }
-            unsigned bufferLength() const { return m_bitmapBufferLength; }
-            IntSize size() const { return m_size; }
-            unsigned bytesPerRow() const { return m_bytesPerRow; }
+            UInt8* buffer() const { return m_pixelData.buffer(); }
+            unsigned bufferLength() const { return m_pixelData.bufferLength(); }
+            const IntSize& size() const { return m_pixelData.size(); }
+            unsigned bytesPerRow() const { return m_pixelData.bytesPerRow(); }
+            unsigned short bitsPerPixel() const { return m_pixelData.bitsPerPixel(); }
+            const DIBPixelData& windowsDIB() const { return m_pixelData; }
 
         private:
             HDC m_hdc;
             HBITMAP m_bitmap;
-            UInt8* m_bitmapBuffer;
-            unsigned m_bitmapBufferLength;
-            IntSize m_size;
-            unsigned m_bytesPerRow;
+            DIBPixelData m_pixelData;
         };
 
         WindowsBitmap* createWindowsBitmap(IntSize);
@@ -521,13 +525,12 @@ namespace WebCore {
         void takeOwnershipOfPlatformContext();
 #endif
 
-#if PLATFORM(QT) || PLATFORM(CAIRO)
+#if PLATFORM(QT) || USE(CAIRO)
         ContextShadow* contextShadow();
 #endif
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
         GraphicsContext(cairo_t*);
-        void pushImageMask(cairo_surface_t*, const FloatRect&);
 #endif
 
 #if PLATFORM(GTK)
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 351b445..80226cf 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -43,8 +43,11 @@
 #undef VERSION
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(GTK)
 #include "ANGLEWebKitBridge.h"
+#endif
+
+#if PLATFORM(MAC)
 #include <OpenGL/OpenGL.h>
 #include <wtf/RetainPtr.h>
 #ifdef __OBJC__
@@ -73,7 +76,7 @@ typedef void* PlatformGraphicsContext3D;
 const PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
 const Platform3DObject NullPlatform3DObject = 0;
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGContext.h>
 #endif
 
@@ -81,12 +84,15 @@ namespace WebCore {
 class CanvasRenderingContext;
 class DrawingBuffer;
 class Extensions3D;
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(GTK)
 class Extensions3DOpenGL;
 #endif
 class HostWindow;
 class Image;
 class ImageData;
+#if USE(CAIRO)
+class PlatformContextCairo;
+#endif
 
 struct ActiveInfo {
     String name;
@@ -95,7 +101,7 @@ struct ActiveInfo {
 };
 
 // FIXME: ideally this would be used on all platforms.
-#if PLATFORM(CHROMIUM) || PLATFORM(QT)
+#if PLATFORM(CHROMIUM) || PLATFORM(QT) || PLATFORM(GTK)
 class GraphicsContext3DInternal;
 #endif
 
@@ -465,6 +471,9 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     PlatformLayer* platformLayer() const;
 #endif
+#elif PLATFORM(GTK)
+    PlatformGraphicsContext3D platformGraphicsContext3D();
+    Platform3DObject platformTexture() const { return m_texture; }
 #else
     PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
     Platform3DObject platformTexture() const { return NullPlatform3DObject; }
@@ -476,7 +485,7 @@ public:
 
     PassRefPtr<DrawingBuffer> createDrawingBuffer(const IntSize& = IntSize());
     
-#if PLATFORM(MAC) || PLATFORM(CHROMIUM)
+#if PLATFORM(MAC) || PLATFORM(CHROMIUM) || PLATFORM(GTK)
     // With multisampling on, blit from multisampleFBO to regular FBO.
     void prepareTexture();
 #endif
@@ -753,9 +762,12 @@ public:
 
     void reshape(int width, int height);
 
-#if PLATFORM(CG)
+#if USE(CG)
     void paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight,
                        int canvasWidth, int canvasHeight, CGContextRef context);
+#elif PLATFORM(GTK)
+    void paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight,
+                       int canvasWidth, int canvasHeight, PlatformContextCairo* context);
 #endif
 
     void markContextChanged();
@@ -769,6 +781,8 @@ public:
     bool paintsIntoCanvasBuffer() const { return true; }
 #elif PLATFORM(CHROMIUM)
     bool paintsIntoCanvasBuffer() const;
+#elif PLATFORM(GTK)
+    bool paintsIntoCanvasBuffer() const { return true; }
 #else
     bool paintsIntoCanvasBuffer() const { return false; }
 #endif
@@ -859,7 +873,7 @@ public:
                     AlphaOp alphaOp,
                     void* destinationData);
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(GTK)
     // Take into account the user's requested context creation attributes,
     // in particular stencil and antialias, and determine which could or
     // could not be honored based on the capabilities of the OpenGL
@@ -874,6 +888,11 @@ public:
     int m_currentWidth, m_currentHeight;
 
 #if PLATFORM(MAC)
+    CGLContextObj m_contextObj;
+    RetainPtr<WebGLLayer> m_webGLLayer;
+#endif
+
+#if PLATFORM(MAC) || PLATFORM(GTK)
     typedef struct {
         String source;
         String log;
@@ -889,8 +908,6 @@ public:
     Attributes m_attrs;
     Vector<Vector<float> > m_vertexArray;
 
-    CGLContextObj m_contextObj;
-    RetainPtr<WebGLLayer> m_webGLLayer;
     GC3Duint m_texture, m_compositorTexture;
     GC3Duint m_fbo;
     GC3Duint m_depthStencilBuffer;
@@ -912,7 +929,7 @@ public:
 #endif
 
     // FIXME: ideally this would be used on all platforms.
-#if PLATFORM(CHROMIUM) || PLATFORM(QT)
+#if PLATFORM(CHROMIUM) || PLATFORM(QT) || PLATFORM(GTK)
     friend class GraphicsContext3DInternal;
     OwnPtr<GraphicsContext3DInternal> m_internal;
 #endif
diff --git a/Source/WebCore/platform/graphics/Image.cpp b/Source/WebCore/platform/graphics/Image.cpp
index 3096680..11da0ab 100644
--- a/Source/WebCore/platform/graphics/Image.cpp
+++ b/Source/WebCore/platform/graphics/Image.cpp
@@ -36,7 +36,7 @@
 #include <math.h>
 #include <wtf/StdLibExtras.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
diff --git a/Source/WebCore/platform/graphics/Image.h b/Source/WebCore/platform/graphics/Image.h
index 3c5e7fd..834a0d3 100644
--- a/Source/WebCore/platform/graphics/Image.h
+++ b/Source/WebCore/platform/graphics/Image.h
@@ -45,7 +45,7 @@ class NSImage;
 #endif
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG)
 struct CGContext;
 #endif
 
@@ -136,8 +136,9 @@ public:
     virtual CFDataRef getTIFFRepresentation() { return 0; }
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG)
     virtual CGImageRef getCGImageRef() { return 0; }
+    virtual CGImageRef getFirstCGImageRefOfSize(const IntSize&) { return 0; }
 #endif
 
 #if PLATFORM(WIN)
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.cpp b/Source/WebCore/platform/graphics/ImageBuffer.cpp
index 4a76be4..23b925a 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.cpp
+++ b/Source/WebCore/platform/graphics/ImageBuffer.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "ImageBuffer.h"
 
-#if !PLATFORM(CG)
+#if !USE(CG)
 
 #include <math.h>
 
@@ -69,4 +69,4 @@ void ImageBuffer::transformColorSpace(ColorSpace srcColorSpace, ColorSpace dstCo
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index 860f574..c184bbe 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -41,10 +41,6 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
 
-#if (PLATFORM(MAC) && PLATFORM(CA) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD))
-#define WTF_USE_IOSURFACE_CANVAS_BACKING_STORE 1
-#endif
-
 namespace WebCore {
 
     class GraphicsContext;
@@ -86,6 +82,7 @@ namespace WebCore {
         
         GraphicsContext* context() const;
 
+        bool isAccelerated() const { return m_accelerateRendering; }
         bool drawsUsingCopy() const; // If the image buffer has to render using a copied image, it will return true.
         PassRefPtr<Image> copyImage() const; // Return a new image that is a copy of the buffer.
 
@@ -96,7 +93,7 @@ namespace WebCore {
         void putPremultipliedImageData(ByteArray*, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint);
         
         String toDataURL(const String& mimeType, const double* quality = 0) const;
-#if !PLATFORM(CG)
+#if !USE(CG)
         AffineTransform baseTransform() const { return AffineTransform(); }
         void transformColorSpace(ColorSpace srcColorSpace, ColorSpace dstColorSpace);
         void platformTransformColorSpace(const Vector<int>&);
@@ -122,7 +119,7 @@ namespace WebCore {
         bool m_accelerateRendering;
         OwnPtr<GraphicsContext> m_context;
 
-#if !PLATFORM(CG)
+#if !USE(CG)
         Vector<int> m_linearRgbLUT;
         Vector<int> m_deviceRgbLUT;
 #endif
@@ -132,7 +129,7 @@ namespace WebCore {
         ImageBuffer(const IntSize&, ColorSpace colorSpace, RenderingMode renderingMode, bool& success);
     };
 
-#if PLATFORM(CG) || USE(SKIA)
+#if USE(CG) || USE(SKIA)
     String ImageDataToDataURL(const ImageData& input, const String& mimeType, const double* quality);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/ImageBufferData.h b/Source/WebCore/platform/graphics/ImageBufferData.h
new file mode 100644
index 0000000..670a10f
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ImageBufferData.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#if USE(CG)
+#include "ImageBufferDataCG.h"
+#elif USE(CAIRO)
+#include "ImageBufferDataCairo.h"
+#elif PLATFORM(QT)
+#include "ImageBufferDataQt.h"
+#elif USE(SKIA)
+#include "ImageBufferDataSkia.h"
+#elif PLATFORM(HAIKU)
+#include "ImageBufferDataHaiku.h"
+#elif OS(WINCE)
+#include "ImageBufferDataWince.h"
+#elif PLATFORM(WX)
+#include "ImageBufferDataWx.h"
+#endif
diff --git a/Source/WebCore/platform/graphics/ImageSource.h b/Source/WebCore/platform/graphics/ImageSource.h
index 5ece15b..8dcc9a2 100644
--- a/Source/WebCore/platform/graphics/ImageSource.h
+++ b/Source/WebCore/platform/graphics/ImageSource.h
@@ -34,7 +34,7 @@
 #if PLATFORM(WX)
 class wxBitmap;
 class wxGraphicsBitmap;
-#elif PLATFORM(CG)
+#elif USE(CG)
 typedef struct CGImageSource* CGImageSourceRef;
 typedef struct CGImage* CGImageRef;
 typedef const struct __CFData* CFDataRef;
@@ -43,7 +43,7 @@ typedef const struct __CFData* CFDataRef;
 QT_BEGIN_NAMESPACE
 class QPixmap;
 QT_END_NAMESPACE
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 struct _cairo_surface;
 typedef struct _cairo_surface cairo_surface_t;
 #elif USE(SKIA)
@@ -68,7 +68,7 @@ class IntPoint;
 class IntSize;
 class SharedBuffer;
 
-#if PLATFORM(CG)
+#if USE(CG)
 #if USE(WEBKIT_IMAGE_DECODERS)
 class ImageDecoder;
 typedef ImageDecoder* NativeImageSourcePtr;
@@ -107,7 +107,7 @@ typedef wxGraphicsBitmap* NativeImagePtr;
 #else
 typedef wxBitmap* NativeImagePtr;
 #endif
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 typedef cairo_surface_t* NativeImagePtr;
 #elif USE(SKIA)
 typedef WebCore::NativeImageSkia* NativeImagePtr;
diff --git a/Source/WebCore/platform/graphics/IntPoint.h b/Source/WebCore/platform/graphics/IntPoint.h
index d27906b..46d49eb 100644
--- a/Source/WebCore/platform/graphics/IntPoint.h
+++ b/Source/WebCore/platform/graphics/IntPoint.h
@@ -32,7 +32,7 @@
 #include <QDataStream>
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 typedef struct CGPoint CGPoint;
 #endif
 
@@ -114,7 +114,7 @@ public:
         return IntPoint(m_y, m_x);
     }
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
     explicit IntPoint(const CGPoint&); // don't do this implicitly since it's lossy
     operator CGPoint() const;
 #endif
diff --git a/Source/WebCore/platform/graphics/IntRect.cpp b/Source/WebCore/platform/graphics/IntRect.cpp
index 7591c41..9507406 100644
--- a/Source/WebCore/platform/graphics/IntRect.cpp
+++ b/Source/WebCore/platform/graphics/IntRect.cpp
@@ -96,6 +96,27 @@ void IntRect::unite(const IntRect& other)
     m_size.setHeight(b - t);
 }
 
+void IntRect::uniteIfNonZero(const IntRect& other)
+{
+    // Handle empty special cases first.
+    if (!other.width() && !other.height())
+        return;
+    if (!width() && !height()) {
+        *this = other;
+        return;
+    }
+
+    int left = min(x(), other.x());
+    int top = min(y(), other.y());
+    int right = max(maxX(), other.maxX());
+    int bottom = max(maxY(), other.maxY());
+
+    m_location.setX(left);
+    m_location.setY(top);
+    m_size.setWidth(right - left);
+    m_size.setHeight(bottom - top);
+}
+
 void IntRect::scale(float s)
 {
     m_location.setX((int)(x() * s));
diff --git a/Source/WebCore/platform/graphics/IntRect.h b/Source/WebCore/platform/graphics/IntRect.h
index c413e7a..d2b348b 100644
--- a/Source/WebCore/platform/graphics/IntRect.h
+++ b/Source/WebCore/platform/graphics/IntRect.h
@@ -29,7 +29,7 @@
 #include "IntPoint.h"
 #include <wtf/Vector.h>
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 typedef struct CGRect CGRect;
 #endif
 
@@ -133,6 +133,11 @@ public:
         setHeight(std::max(0, height() + delta));
     }
 
+    IntPoint minXMinYCorner() const { return m_location; } // typically topLeft
+    IntPoint maxXMinYCorner() const { return IntPoint(m_location.x() + m_size.width(), m_location.y()); } // typically topRight
+    IntPoint minXMaxYCorner() const { return IntPoint(m_location.x(), m_location.y() + m_size.height()); } // typically bottomLeft
+    IntPoint maxXMaxYCorner() const { return IntPoint(m_location.x() + m_size.width(), m_location.y() + m_size.height()); } // typically bottomRight
+    
     bool intersects(const IntRect&) const;
     bool contains(const IntRect&) const;
 
@@ -144,6 +149,7 @@ public:
 
     void intersect(const IntRect&);
     void unite(const IntRect&);
+    void uniteIfNonZero(const IntRect&);
 
     void inflateX(int dx)
     {
@@ -182,7 +188,7 @@ public:
     operator Eina_Rectangle() const;
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
     operator CGRect() const;
 #endif
 
@@ -228,7 +234,7 @@ inline bool operator!=(const IntRect& a, const IntRect& b)
     return a.location() != b.location() || a.size() != b.size();
 }
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 IntRect enclosingIntRect(const CGRect&);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/IntSize.h b/Source/WebCore/platform/graphics/IntSize.h
index 9db2224..8cfabf5 100644
--- a/Source/WebCore/platform/graphics/IntSize.h
+++ b/Source/WebCore/platform/graphics/IntSize.h
@@ -26,7 +26,7 @@
 #ifndef IntSize_h
 #define IntSize_h
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 typedef struct CGSize CGSize;
 #endif
 
@@ -109,7 +109,7 @@ public:
         return IntSize(m_height, m_width);
     }
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
     explicit IntSize(const CGSize&); // don't do this implicitly since it's lossy
     operator CGSize() const;
 #endif
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 03004b6..a7e4b90 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -792,11 +792,12 @@ void MediaPlayer::networkStateChanged()
     // If more than one media engine is installed and this one failed before finding metadata,
     // let the next engine try.
     if (m_private->networkState() >= FormatError
-        && m_private->readyState() < HaveMetadata 
-        && installedMediaEngines().size() > 1 
-        && bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, m_currentMediaEngine)) {
+        && m_private->readyState() < HaveMetadata
+        && installedMediaEngines().size() > 1) {
+        if ( m_contentMIMEType.isEmpty() || bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, m_currentMediaEngine)) {
             m_reloadTimer.startOneShot(0);
             return;
+        }
     }
     if (m_mediaPlayerClient)
         m_mediaPlayerClient->mediaPlayerNetworkStateChanged(this);
@@ -858,6 +859,12 @@ void MediaPlayer::playbackStateChanged()
         m_mediaPlayerClient->mediaPlayerPlaybackStateChanged(this);
 }
 
+void MediaPlayer::firstVideoFrameAvailable()
+{
+    if (m_mediaPlayerClient)
+        m_mediaPlayerClient->mediaPlayerFirstVideoFrameAvailable(this);
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index ff304ea..41cb6d2 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -143,6 +143,10 @@ public:
 
     virtual void mediaPlayerEngineUpdated(MediaPlayer*) { }
 
+    // The first frame of video is available to render. A media engine need only make this callback if the
+    // first frame is not available immediately when prepareForRendering is called.
+    virtual void mediaPlayerFirstVideoFrameAvailable(MediaPlayer*) { }
+
 #if USE(ACCELERATED_COMPOSITING)
     // whether the rendering system can accelerate the display of this MediaPlayer.
     virtual bool mediaPlayerRenderingCanBeAccelerated(MediaPlayer*) { return false; }
@@ -262,6 +266,7 @@ public:
     void rateChanged();
     void playbackStateChanged();
     void durationChanged();
+    void firstVideoFrameAvailable();
 
     void repaint();
 
diff --git a/Source/WebCore/platform/graphics/Path.cpp b/Source/WebCore/platform/graphics/Path.cpp
index f7aedbe..da09c76 100644
--- a/Source/WebCore/platform/graphics/Path.cpp
+++ b/Source/WebCore/platform/graphics/Path.cpp
@@ -188,4 +188,9 @@ void Path::addRoundedRect(const FloatRect& rect, const FloatSize& topLeftRadius,
     closeSubpath();
 }
 
+void Path::addRoundedRect(const RoundedIntRect& r)
+{
+    addRoundedRect(r.rect(), r.radii().topLeft(), r.radii().topRight(), r.radii().bottomLeft(), r.radii().bottomRight());
+}
+
 }
diff --git a/Source/WebCore/platform/graphics/Path.h b/Source/WebCore/platform/graphics/Path.h
index c2ca576..9c07247 100644
--- a/Source/WebCore/platform/graphics/Path.h
+++ b/Source/WebCore/platform/graphics/Path.h
@@ -28,10 +28,11 @@
 #ifndef Path_h
 #define Path_h
 
+#include "RoundedIntRect.h"
 #include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 typedef struct CGPath PlatformPath;
 #elif PLATFORM(OPENVG)
 namespace WebCore {
@@ -44,7 +45,7 @@ typedef QPainterPath PlatformPath;
 #elif PLATFORM(WX) && USE(WXGC)
 class wxGraphicsPath;
 typedef wxGraphicsPath PlatformPath;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 namespace WebCore {
 class CairoPath;
 }
@@ -137,6 +138,7 @@ namespace WebCore {
         void addEllipse(const FloatRect&);
         void addRoundedRect(const FloatRect&, const FloatSize& roundingRadii);
         void addRoundedRect(const FloatRect&, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius);
+        void addRoundedRect(const RoundedIntRect&);
 
         void translate(const FloatSize&);
 
diff --git a/Source/WebCore/platform/graphics/Pattern.h b/Source/WebCore/platform/graphics/Pattern.h
index c88f2fb..1d0b0f8 100644
--- a/Source/WebCore/platform/graphics/Pattern.h
+++ b/Source/WebCore/platform/graphics/Pattern.h
@@ -35,10 +35,10 @@
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 typedef struct CGPattern* CGPatternRef;
 typedef CGPatternRef PlatformPatternPtr;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 #include <cairo.h>
 typedef cairo_pattern_t* PlatformPatternPtr;
 #elif USE(SKIA)
diff --git a/Source/WebCore/platform/graphics/RoundedIntRect.cpp b/Source/WebCore/platform/graphics/RoundedIntRect.cpp
index 4e80c9a..e919c4f 100644
--- a/Source/WebCore/platform/graphics/RoundedIntRect.cpp
+++ b/Source/WebCore/platform/graphics/RoundedIntRect.cpp
@@ -30,6 +30,8 @@
 #include "IntRect.h"
 #include <algorithm>
 
+using namespace std;
+
 namespace WebCore {
 
 bool RoundedIntRect::Radii::isZero() const
@@ -60,17 +62,17 @@ void RoundedIntRect::Radii::scale(float factor)
 
 void RoundedIntRect::Radii::expand(int topWidth, int bottomWidth, int leftWidth, int rightWidth)
 {
-    m_topLeft.setWidth(std::max(0, m_topLeft.width() + leftWidth));
-    m_topLeft.setHeight(std::max(0, m_topLeft.height() + topWidth));
+    m_topLeft.setWidth(max(0, m_topLeft.width() + leftWidth));
+    m_topLeft.setHeight(max(0, m_topLeft.height() + topWidth));
 
-    m_topRight.setWidth(std::max(0, m_topRight.width() + rightWidth));
-    m_topRight.setHeight(std::max(0, m_topRight.height() + topWidth));
+    m_topRight.setWidth(max(0, m_topRight.width() + rightWidth));
+    m_topRight.setHeight(max(0, m_topRight.height() + topWidth));
 
-    m_bottomLeft.setWidth(std::max(0, m_bottomLeft.width() + leftWidth));
-    m_bottomLeft.setHeight(std::max(0, m_bottomLeft.height() + bottomWidth));
+    m_bottomLeft.setWidth(max(0, m_bottomLeft.width() + leftWidth));
+    m_bottomLeft.setHeight(max(0, m_bottomLeft.height() + bottomWidth));
 
-    m_bottomRight.setWidth(std::max(0, m_bottomRight.width() + rightWidth));
-    m_bottomRight.setHeight(std::max(0, m_bottomRight.height() + bottomWidth));
+    m_bottomRight.setWidth(max(0, m_bottomRight.width() + rightWidth));
+    m_bottomRight.setHeight(max(0, m_bottomRight.height() + bottomWidth));
 }
 
 void RoundedIntRect::Radii::includeLogicalEdges(const RoundedIntRect::Radii& edges, bool isHorizontal, bool includeLogicalLeftEdge, bool includeLogicalRightEdge)
@@ -138,4 +140,12 @@ void RoundedIntRect::excludeLogicalEdges(bool isHorizontal, bool excludeLogicalL
     m_radii.excludeLogicalEdges(isHorizontal, excludeLogicalLeftEdge, excludeLogicalRightEdge);
 }
 
+bool RoundedIntRect::isRenderable() const
+{
+    return m_radii.topLeft().width() + m_radii.topRight().width() <= m_rect.width()
+        && m_radii.bottomLeft().width() + m_radii.bottomRight().width() <= m_rect.width()
+        && m_radii.topLeft().height() + m_radii.topRight().height() <= m_rect.height()
+        && m_radii.bottomLeft().height() + m_radii.bottomRight().height() <= m_rect.height();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/RoundedIntRect.h b/Source/WebCore/platform/graphics/RoundedIntRect.h
index c3c972f..74ee892 100644
--- a/Source/WebCore/platform/graphics/RoundedIntRect.h
+++ b/Source/WebCore/platform/graphics/RoundedIntRect.h
@@ -93,11 +93,24 @@ public:
     void includeLogicalEdges(const Radii& edges, bool isHorizontal, bool includeLogicalLeftEdge, bool includeLogicalRightEdge);
     void excludeLogicalEdges(bool isHorizontal, bool excludeLogicalLeftEdge, bool excludeLogicalRightEdge);
 
+    bool isRenderable() const;
+
 private:
     IntRect m_rect;
     Radii m_radii;
 };
 
+inline bool operator==(const RoundedIntRect::Radii& a, const RoundedIntRect::Radii& b)
+{
+    return a.topLeft() == b.topLeft() && a.topRight() == b.topRight() && a.bottomLeft() == b.bottomLeft() && a.bottomRight() == b.bottomRight();
+}
+
+inline bool operator==(const RoundedIntRect& a, const RoundedIntRect& b)
+{
+    return a.rect() == b.rect() && a.radii() == b.radii();
+}
+
+
 } // namespace WebCore
 
 #endif // RoundedIntRect_h
diff --git a/Source/WebCore/platform/graphics/ShadowBlur.cpp b/Source/WebCore/platform/graphics/ShadowBlur.cpp
index 0df51a4..2f25221 100644
--- a/Source/WebCore/platform/graphics/ShadowBlur.cpp
+++ b/Source/WebCore/platform/graphics/ShadowBlur.cpp
@@ -54,6 +54,8 @@ class ScratchBuffer {
 public:
     ScratchBuffer()
         : m_purgeTimer(this, &ScratchBuffer::timerFired)
+        , m_lastRadius(0)
+        , m_lastWasInset(false)
 #if !ASSERT_DISABLED
         , m_bufferInUse(false)
 #endif
@@ -77,6 +79,41 @@ public:
         return m_imageBuffer.get();
     }
 
+    void setLastShadowValues(float radius, const Color& color, ColorSpace colorSpace, const FloatRect& shadowRect, const RoundedIntRect::Radii& radii)
+    {
+        m_lastWasInset = false;
+        m_lastRadius = radius;
+        m_lastColor = color;
+        m_lastColorSpace = colorSpace;
+        m_lastShadowRect = shadowRect;
+        m_lastRadii = radii;
+    }
+
+    void setLastInsetShadowValues(float radius, const Color& color, ColorSpace colorSpace, const FloatRect& bounds, const FloatRect& shadowRect, const RoundedIntRect::Radii& radii)
+    {
+        m_lastWasInset = true;
+        m_lastInsetBounds = bounds;
+        m_lastRadius = radius;
+        m_lastColor = color;
+        m_lastColorSpace = colorSpace;
+        m_lastShadowRect = shadowRect;
+        m_lastRadii = radii;
+    }
+    
+    bool matchesLastShadow(float radius, const Color& color, ColorSpace colorSpace, const FloatRect& shadowRect, const RoundedIntRect::Radii& radii) const
+    {
+        if (m_lastWasInset)
+            return false;
+        return m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && shadowRect == m_lastShadowRect && radii == m_lastRadii;
+    }
+
+    bool matchesLastInsetShadow(float radius, const Color& color, ColorSpace colorSpace, const FloatRect& bounds, const FloatRect& shadowRect, const RoundedIntRect::Radii& radii) const
+    {
+        if (!m_lastWasInset)
+            return false;
+        return m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && m_lastInsetBounds == bounds && shadowRect == m_lastShadowRect && radii == m_lastRadii;
+    }
+
     void scheduleScratchBufferPurge()
     {
 #if !ASSERT_DISABLED
@@ -100,10 +137,20 @@ private:
     void clearScratchBuffer()
     {
         m_imageBuffer = 0;
+        m_lastRadius = 0;
     }
 
     OwnPtr<ImageBuffer> m_imageBuffer;
     Timer<ScratchBuffer> m_purgeTimer;
+    
+    FloatRect m_lastInsetBounds;
+    FloatRect m_lastShadowRect;
+    RoundedIntRect::Radii m_lastRadii;
+    Color m_lastColor;
+    ColorSpace m_lastColorSpace;
+    float m_lastRadius;
+    bool m_lastWasInset;
+    
 #if !ASSERT_DISABLED
     bool m_bufferInUse;
 #endif
@@ -147,14 +194,7 @@ static const int blurSumShift = 15;
 
 void ShadowBlur::blurLayerImage(unsigned char* imageData, const IntSize& size, int rowStride)
 {
-    const int channels[4] =
-#if CPU(BIG_ENDIAN)
-        { 0, 3, 2, 0 };
-#elif CPU(MIDDLE_ENDIAN)
-        { 1, 2, 3, 1 };
-#else
-        { 3, 0, 1, 3 };
-#endif
+    const int channels[4] = { 3, 0, 1, 3 };
 
     int diameter;
     if (m_shadowsIgnoreTransforms)
@@ -356,40 +396,10 @@ IntRect ShadowBlur::calculateLayerBoundingRect(GraphicsContext* context, const F
     return enclosingIntRect(layerRect);
 }
 
-GraphicsContext* ShadowBlur::beginShadowLayer(GraphicsContext* graphicsContext, const IntRect& layerRect)
-{
-    adjustBlurRadius(graphicsContext);
-
-    // Don't paint if we are totally outside the clip region.
-    if (layerRect.isEmpty())
-        return 0;
-
-    m_layerImage = ScratchBuffer::shared().getScratchBuffer(layerRect.size());
-    GraphicsContext* layerContext = m_layerImage->context();
-
-    layerContext->save(); // Balanced by restore() in endShadowLayer().
-
-    // Always clear the surface first. FIXME: we could avoid the clear on first allocation.
-    // Add a pixel to avoid later edge aliasing when rotated.
-    layerContext->clearRect(FloatRect(0, 0, m_layerSize.width() + 1, m_layerSize.height() + 1));
-    layerContext->translate(m_layerContextTranslation);
-
-    return layerContext;
-}
-
-void ShadowBlur::endShadowLayer(GraphicsContext* graphicsContext)
+void ShadowBlur::drawShadowBuffer(GraphicsContext* graphicsContext)
 {
     if (!m_layerImage)
         return;
-        
-    m_layerImage->context()->restore();
-
-    if (m_type == BlurShadow) {
-        IntRect blurRect = enclosingIntRect(FloatRect(FloatPoint(), m_layerSize));
-        RefPtr<ByteArray> layerData = m_layerImage->getUnmultipliedImageData(blurRect);
-        blurLayerImage(layerData->data(), blurRect.size(), blurRect.width() * 4);
-        m_layerImage->putUnmultipliedImageData(layerData.get(), blurRect.size(), blurRect, IntPoint());
-    }
 
     graphicsContext->save();
 
@@ -406,11 +416,6 @@ void ShadowBlur::endShadowLayer(GraphicsContext* graphicsContext)
     graphicsContext->fillRect(FloatRect(m_layerOrigin, m_sourceRect.size()));
     
     graphicsContext->restore();
-
-    m_layerImage = 0;
-
-    // Schedule a purge of the scratch buffer. We do not need to destroy the surface.
-    ScratchBuffer::shared().scheduleScratchBufferPurge();
 }
 
 static void computeSliceSizesFromRadii(int twiceRadius, const RoundedIntRect::Radii& radii, int& leftSlice, int& rightSlice, int& topSlice, int& bottomSlice)
@@ -442,6 +447,8 @@ void ShadowBlur::drawRectShadow(GraphicsContext* graphicsContext, const FloatRec
     if (layerRect.isEmpty())
         return;
 
+    adjustBlurRadius(graphicsContext);
+
     // drawRectShadowWithTiling does not work with rotations.
     // https://bugs.webkit.org/show_bug.cgi?id=45042
     if (!graphicsContext->getCTM().isIdentityOrTranslationOrFlipped() || m_type != BlurShadow) {
@@ -466,6 +473,8 @@ void ShadowBlur::drawInsetShadow(GraphicsContext* graphicsContext, const FloatRe
     if (layerRect.isEmpty())
         return;
 
+    adjustBlurRadius(graphicsContext);
+
     // drawInsetShadowWithTiling does not work with rotations.
     // https://bugs.webkit.org/show_bug.cgi?id=45042
     if (!graphicsContext->getCTM().isIdentityOrTranslationOrFlipped() || m_type != BlurShadow) {
@@ -486,34 +495,81 @@ void ShadowBlur::drawInsetShadow(GraphicsContext* graphicsContext, const FloatRe
 
 void ShadowBlur::drawRectShadowWithoutTiling(GraphicsContext* graphicsContext, const FloatRect& shadowedRect, const RoundedIntRect::Radii& radii, const IntRect& layerRect)
 {
-    GraphicsContext* shadowContext = beginShadowLayer(graphicsContext, layerRect);
-    if (!shadowContext)
+    m_layerImage = ScratchBuffer::shared().getScratchBuffer(layerRect.size());
+    if (!m_layerImage)
         return;
 
-    Path path;
-    path.addRoundedRect(shadowedRect, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
+    FloatRect bufferRelativeShadowedRect = shadowedRect;
+    bufferRelativeShadowedRect.move(m_layerContextTranslation);
+    if (!ScratchBuffer::shared().matchesLastShadow(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeShadowedRect, radii)) {
+        GraphicsContext* shadowContext = m_layerImage->context();
+        shadowContext->save();
+
+        // Add a pixel to avoid later edge aliasing when rotated.
+        shadowContext->clearRect(FloatRect(0, 0, m_layerSize.width() + 1, m_layerSize.height() + 1));
+        shadowContext->translate(m_layerContextTranslation);
+        shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
+        if (radii.isZero())
+            shadowContext->fillRect(shadowedRect);
+        else {
+            Path path;
+            path.addRoundedRect(shadowedRect, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
+            shadowContext->fillPath(path);
+        }
+
+        blurShadowBuffer(expandedIntSize(m_layerSize));
 
-    shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
-    shadowContext->fillPath(path);
+        shadowContext->restore();
+        
+        ScratchBuffer::shared().setLastShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeShadowedRect, radii);
+    }
     
-    endShadowLayer(graphicsContext);
+    drawShadowBuffer(graphicsContext);
+    m_layerImage = 0;
+    ScratchBuffer::shared().scheduleScratchBufferPurge();
 }
 
 void ShadowBlur::drawInsetShadowWithoutTiling(GraphicsContext* graphicsContext, const FloatRect& rect, const FloatRect& holeRect, const RoundedIntRect::Radii& holeRadii, const IntRect& layerRect)
 {
-    GraphicsContext* shadowContext = beginShadowLayer(graphicsContext, layerRect);
-    if (!shadowContext)
+    m_layerImage = ScratchBuffer::shared().getScratchBuffer(layerRect.size());
+    if (!m_layerImage)
         return;
 
-    Path path;
-    path.addRect(rect);
-    path.addRoundedRect(holeRect, holeRadii.topLeft(), holeRadii.topRight(), holeRadii.bottomLeft(), holeRadii.bottomRight());
+    FloatRect bufferRelativeRect = rect;
+    bufferRelativeRect.move(m_layerContextTranslation);
+
+    FloatRect bufferRelativeHoleRect = holeRect;
+    bufferRelativeHoleRect.move(m_layerContextTranslation);
 
-    shadowContext->setFillRule(RULE_EVENODD);
-    shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
-    shadowContext->fillPath(path);
+    if (!ScratchBuffer::shared().matchesLastInsetShadow(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeRect, bufferRelativeHoleRect, holeRadii)) {
+        GraphicsContext* shadowContext = m_layerImage->context();
+        shadowContext->save();
 
-    endShadowLayer(graphicsContext);
+        // Add a pixel to avoid later edge aliasing when rotated.
+        shadowContext->clearRect(FloatRect(0, 0, m_layerSize.width() + 1, m_layerSize.height() + 1));
+        shadowContext->translate(m_layerContextTranslation);
+
+        Path path;
+        path.addRect(rect);
+        if (holeRadii.isZero())
+            path.addRect(holeRect);
+        else
+            path.addRoundedRect(holeRect, holeRadii.topLeft(), holeRadii.topRight(), holeRadii.bottomLeft(), holeRadii.bottomRight());
+
+        shadowContext->setFillRule(RULE_EVENODD);
+        shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
+        shadowContext->fillPath(path);
+
+        blurShadowBuffer(expandedIntSize(m_layerSize));
+
+        shadowContext->restore();
+
+        ScratchBuffer::shared().setLastInsetShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeRect, bufferRelativeHoleRect, holeRadii);
+    }
+    
+    drawShadowBuffer(graphicsContext);
+    m_layerImage = 0;
+    ScratchBuffer::shared().scheduleScratchBufferPurge();
 }
 
 /*
@@ -557,23 +613,35 @@ void ShadowBlur::drawInsetShadowWithTiling(GraphicsContext* graphicsContext, con
     const float twiceRadius = roundedRadius * 2;
 
     m_layerImage = ScratchBuffer::shared().getScratchBuffer(templateSize);
+    if (!m_layerImage)
+        return;
 
     // Draw the rectangle with hole.
     FloatRect templateBounds(0, 0, templateSize.width(), templateSize.height());
     FloatRect templateHole = FloatRect(roundedRadius, roundedRadius, templateSize.width() - twiceRadius, templateSize.height() - twiceRadius);
-    Path path;
-    path.addRect(templateBounds);
-    path.addRoundedRect(templateHole, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
 
-    // Draw shadow into a new ImageBuffer.
-    GraphicsContext* shadowContext = m_layerImage->context();
-    shadowContext->save();
-    shadowContext->clearRect(templateBounds);
-    shadowContext->setFillRule(RULE_EVENODD);
-    shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
-    shadowContext->fillPath(path);
-    blurAndColorShadowBuffer(templateSize);
-    shadowContext->restore();
+    if (!ScratchBuffer::shared().matchesLastInsetShadow(m_blurRadius, m_color, m_colorSpace, templateBounds, templateHole, radii)) {
+        // Draw shadow into a new ImageBuffer.
+        GraphicsContext* shadowContext = m_layerImage->context();
+        shadowContext->save();
+        shadowContext->clearRect(templateBounds);
+        shadowContext->setFillRule(RULE_EVENODD);
+        shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
+
+        Path path;
+        path.addRect(templateBounds);
+        if (radii.isZero())
+            path.addRect(templateHole);
+        else
+            path.addRoundedRect(templateHole, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
+
+        shadowContext->fillPath(path);
+
+        blurAndColorShadowBuffer(templateSize);
+        shadowContext->restore();
+    
+        ScratchBuffer::shared().setLastInsetShadowValues(m_blurRadius, m_color, m_colorSpace, templateBounds, templateHole, radii);
+    }
 
     FloatRect boundingRect = rect;
     boundingRect.move(m_offset);
@@ -599,7 +667,6 @@ void ShadowBlur::drawInsetShadowWithTiling(GraphicsContext* graphicsContext, con
     graphicsContext->restore();
 
     m_layerImage = 0;
-    // Schedule a purge of the scratch buffer.
     ScratchBuffer::shared().scheduleScratchBufferPurge();
 }
 
@@ -612,20 +679,31 @@ void ShadowBlur::drawRectShadowWithTiling(GraphicsContext* graphicsContext, cons
     const float twiceRadius = roundedRadius * 2;
 
     m_layerImage = ScratchBuffer::shared().getScratchBuffer(templateSize);
+    if (!m_layerImage)
+        return;
 
-    // Draw the rectangle.
     FloatRect templateShadow = FloatRect(roundedRadius, roundedRadius, templateSize.width() - twiceRadius, templateSize.height() - twiceRadius);
-    Path path;
-    path.addRoundedRect(templateShadow, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
 
-    // Draw shadow into the ImageBuffer.
-    GraphicsContext* shadowContext = m_layerImage->context();
-    shadowContext->save();
-    shadowContext->clearRect(FloatRect(0, 0, templateSize.width(), templateSize.height()));
-    shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
-    shadowContext->fillPath(path);
-    blurAndColorShadowBuffer(templateSize);
-    shadowContext->restore();
+    if (!ScratchBuffer::shared().matchesLastShadow(m_blurRadius, m_color, m_colorSpace, templateShadow, radii)) {
+        // Draw shadow into the ImageBuffer.
+        GraphicsContext* shadowContext = m_layerImage->context();
+        shadowContext->save();
+        shadowContext->clearRect(FloatRect(0, 0, templateSize.width(), templateSize.height()));
+        shadowContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
+        
+        if (radii.isZero())
+            shadowContext->fillRect(templateShadow);
+        else {
+            Path path;
+            path.addRoundedRect(templateShadow, radii.topLeft(), radii.topRight(), radii.bottomLeft(), radii.bottomRight());
+            shadowContext->fillPath(path);
+        }
+
+        blurAndColorShadowBuffer(templateSize);
+        shadowContext->restore();
+
+        ScratchBuffer::shared().setLastShadowValues(m_blurRadius, m_color, m_colorSpace, templateShadow, radii);
+    }
 
     FloatRect shadowBounds = shadowedRect;
     shadowBounds.move(m_offset.width(), m_offset.height());
@@ -636,7 +714,6 @@ void ShadowBlur::drawRectShadowWithTiling(GraphicsContext* graphicsContext, cons
     graphicsContext->restore();
 
     m_layerImage = 0;
-    // Schedule a purge of the scratch buffer.
     ScratchBuffer::shared().scheduleScratchBufferPurge();
 }
 
@@ -714,14 +791,20 @@ void ShadowBlur::drawLayerPieces(GraphicsContext* graphicsContext, const FloatRe
 }
 
 
+void ShadowBlur::blurShadowBuffer(const IntSize& templateSize)
+{
+    if (m_type != BlurShadow)
+        return;
+
+    IntRect blurRect(IntPoint(), templateSize);
+    RefPtr<ByteArray> layerData = m_layerImage->getUnmultipliedImageData(blurRect);
+    blurLayerImage(layerData->data(), blurRect.size(), blurRect.width() * 4);
+    m_layerImage->putUnmultipliedImageData(layerData.get(), blurRect.size(), blurRect, IntPoint());
+}
+
 void ShadowBlur::blurAndColorShadowBuffer(const IntSize& templateSize)
 {
-    {
-        IntRect blurRect(IntPoint(), templateSize);
-        RefPtr<ByteArray> layerData = m_layerImage->getUnmultipliedImageData(blurRect);
-        blurLayerImage(layerData->data(), blurRect.size(), blurRect.width() * 4);
-        m_layerImage->putUnmultipliedImageData(layerData.get(), blurRect.size(), blurRect, IntPoint());
-    }
+    blurShadowBuffer(templateSize);
 
     // Mask the image with the shadow color.
     GraphicsContext* shadowContext = m_layerImage->context();
diff --git a/Source/WebCore/platform/graphics/ShadowBlur.h b/Source/WebCore/platform/graphics/ShadowBlur.h
index e52d6dc..4ba8e23 100644
--- a/Source/WebCore/platform/graphics/ShadowBlur.h
+++ b/Source/WebCore/platform/graphics/ShadowBlur.h
@@ -53,8 +53,7 @@ public:
     void drawInsetShadow(GraphicsContext*, const FloatRect&, const FloatRect& holeRect, const RoundedIntRect::Radii& holeRadii);
 
 private:
-    GraphicsContext* beginShadowLayer(GraphicsContext*, const IntRect& layerRect);
-    void endShadowLayer(GraphicsContext*);
+    void drawShadowBuffer(GraphicsContext*);
 
     void adjustBlurRadius(GraphicsContext*);
     void blurLayerImage(unsigned char*, const IntSize&, int stride);
@@ -75,6 +74,7 @@ private:
     
     void drawLayerPieces(GraphicsContext*, const FloatRect& shadowBounds, const RoundedIntRect::Radii&, float roundedRadius, const IntSize& templateSize, ShadowDirection);
     
+    void blurShadowBuffer(const IntSize& templateSize);
     void blurAndColorShadowBuffer(const IntSize& templateSize);
     
     enum ShadowType {
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.h b/Source/WebCore/platform/graphics/SimpleFontData.h
index dfb4be3..67e864a 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.h
+++ b/Source/WebCore/platform/graphics/SimpleFontData.h
@@ -48,7 +48,7 @@ typedef struct OpaqueATSUStyle* ATSUStyle;
 #include <usp10.h>
 #endif
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 #include <cairo.h>
 #endif
 
@@ -115,7 +115,7 @@ public:
 
     float spaceWidth() const { return m_spaceWidth; }
 
-#if PLATFORM(CG) || PLATFORM(CAIRO) || PLATFORM(WX)
+#if USE(CG) || USE(CAIRO) || PLATFORM(WX) || USE(SKIA_ON_MAC_CHROME)
     float syntheticBoldOffset() const { return m_syntheticBoldOffset; }
 #endif
 
@@ -252,7 +252,7 @@ private:
 
     mutable OwnPtr<DerivedFontData> m_derivedFontData;
 
-#if PLATFORM(CG) || PLATFORM(CAIRO) || PLATFORM(WX)
+#if USE(CG) || USE(CAIRO) || PLATFORM(WX) || USE(SKIA_ON_MAC_CHROME)
     float m_syntheticBoldOffset;
 #endif
 
diff --git a/Source/WebCore/platform/graphics/WOFFFileFormat.cpp b/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
index 80a6dcb..d54f3df 100644
--- a/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
+++ b/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
@@ -43,7 +43,7 @@
 #define ntohs(x) std_ntohs(x)
 #endif
 
-#if PLATFORM(WIN)
+#if OS(WINDOWS)
 #if CPU(BIG_ENDIAN)
 #define ntohs(x) ((uint16_t)(x))
 #define htons(x) ((uint16_t)(x))
@@ -61,7 +61,7 @@
                  (((uint32_t)(x) & 0x0000ff00) <<  8) | (((uint32_t)(x) & 0x000000ff) << 24)))
 #define htonl(x) ntohl(x)
 #endif
-#endif // PLATFORM(WIN)
+#endif // OS(WINDOWS)
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
index eb96532..681003f 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
@@ -74,6 +74,8 @@ MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation(MediaPlayer* play
     , m_cachedHasVideo(false)
     , m_cachedHasCaptions(false)
     , m_ignoreLoadStateChanges(false)
+    , m_haveReportedFirstVideoFrame(false)
+    , m_playWhenFramesAvailable(false)
 {
     LOG(Media, "MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation(%p)", this);
 }
@@ -248,6 +250,25 @@ void MediaPlayerPrivateAVFoundation::prepareToPlay()
     checkPlayability();
 }
 
+void MediaPlayerPrivateAVFoundation::play()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::play(%p)", this);
+
+    // If the file has video, don't request playback until the first frame of video is ready to display
+    // or the audio may start playing before we can render video.
+    if (!m_cachedHasVideo || hasAvailableVideoFrame())
+        platformPlay();
+    else
+        m_playWhenFramesAvailable = true;
+}
+
+void MediaPlayerPrivateAVFoundation::pause()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::pause(%p)", this);
+    m_playWhenFramesAvailable = false;
+    platformPause();
+}
+
 void MediaPlayerPrivateAVFoundation::paint(GraphicsContext*, const IntRect&)
 {
     // This is the base class, only need to remember that a frame has been drawn.
@@ -285,6 +306,8 @@ void MediaPlayerPrivateAVFoundation::setRate(float rate)
 {
     LOG(Media, "MediaPlayerPrivateAVFoundation::setRate(%p) - seting to %f", this, rate);
     m_requestedRate = rate;
+
+    updateRate();
 }
 
 bool MediaPlayerPrivateAVFoundation::paused() const
@@ -464,12 +487,22 @@ void MediaPlayerPrivateAVFoundation::updateStates()
     if (isReadyForVideoSetup() && currentRenderingMode() != preferredRenderingMode())
         setUpVideoRendering();
 
+    if (!m_haveReportedFirstVideoFrame && m_cachedHasVideo && hasAvailableVideoFrame()) {
+        m_haveReportedFirstVideoFrame = true;
+        m_player->firstVideoFrameAvailable();
+    }
+
     if (m_networkState != oldNetworkState)
         m_player->networkStateChanged();
 
     if (m_readyState != oldReadyState)
         m_player->readyStateChanged();
 
+    if (m_playWhenFramesAvailable && hasAvailableVideoFrame()) {
+        m_playWhenFramesAvailable = false;
+        platformPlay();
+    }
+
     LOG(Media, "MediaPlayerPrivateAVFoundation::updateStates(%p) - exiting with networkState = %i, readyState = %i", 
         this, static_cast<int>(m_networkState), static_cast<int>(m_readyState));
 }
@@ -566,6 +599,14 @@ void MediaPlayerPrivateAVFoundation::timeChanged(double time)
     }
 }
 
+void MediaPlayerPrivateAVFoundation::seekCompleted(bool finished)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::seekCompleted(%p) - finished = %d", this, finished);
+    
+    if (finished)
+        m_seekTo = invalidTime;
+}
+
 void MediaPlayerPrivateAVFoundation::didEnd()
 {
     // Hang onto the current time and use it as duration from now on since we are definitely at
@@ -629,12 +670,22 @@ void MediaPlayerPrivateAVFoundation::clearMainThreadPendingFlag()
 
 void MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(Notification::Type type, double time)
 {
-    LOG(Media, "MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(%p) - notification %d", this, static_cast<int>(type));
+    scheduleMainThreadNotification(Notification(type, time));
+}
+
+void MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(Notification::Type type, bool finished)
+{
+    scheduleMainThreadNotification(Notification(type, finished));
+}
+
+void MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(Notification notification)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(%p) - notification %d", this, static_cast<int>(notification.type()));
     m_queueMutex.lock();
 
     // It is important to always process the properties in the order that we are notified, 
     // so always go through the queue because notifications happen on different threads.
-    m_queuedNotifications.append(Notification(type, time));
+    m_queuedNotifications.append(notification);
 
     bool delayDispatch = m_delayCallbacks || !isMainThread();
     if (delayDispatch && !m_mainThreadCallPending) {
@@ -714,6 +765,9 @@ void MediaPlayerPrivateAVFoundation::dispatchNotification()
     case Notification::PlayerTimeChanged:
         timeChanged(notification.time());
         break;
+    case Notification::SeekCompleted:
+        seekCompleted(notification.finished());
+        break;
     case Notification::AssetMetadataLoaded:
         metadataLoaded();
         break;
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
index a768ab4..becba61 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
@@ -48,6 +48,7 @@ public:
     virtual void loadedTimeRangesChanged();
     virtual void seekableTimeRangesChanged();
     virtual void timeChanged(double);
+    virtual void seekCompleted(bool);
     virtual void didEnd();
 
     class Notification {
@@ -66,31 +67,45 @@ public:
             AssetMetadataLoaded,
             AssetPlayabilityKnown,
             PlayerRateChanged,
-            PlayerTimeChanged
+            PlayerTimeChanged,
+            SeekCompleted,
         };
         
         Notification()
             : m_type(None)
             , m_time(0)
+            , m_finished(false)
         {
         }
 
         Notification(Type type, double time)
             : m_type(type)
             , m_time(time)
+            , m_finished(false)
+        {
+        }
+        
+        Notification(Type type, bool finished)
+        : m_type(type)
+        , m_time(0)
+        , m_finished(finished)
         {
         }
         
         Type type() { return m_type; }
         bool isValid() { return m_type != None; }
         double time() { return m_time; }
+        bool finished() { return m_finished; }
         
     private:
         Type m_type;
         double m_time;
+        bool m_finished;
     };
 
+    void scheduleMainThreadNotification(Notification);
     void scheduleMainThreadNotification(Notification::Type, double time = 0);
+    void scheduleMainThreadNotification(Notification::Type, bool completed);
     void dispatchNotification();
     void clearMainThreadPendingFlag();
 
@@ -105,8 +120,8 @@ protected:
     virtual void prepareToPlay();
     virtual PlatformMedia platformMedia() const = 0;
 
-    virtual void play() = 0;
-    virtual void pause() = 0;
+    virtual void play();
+    virtual void pause();
 
     virtual IntSize naturalSize() const;
     virtual bool hasVideo() const { return m_cachedHasVideo; }
@@ -169,7 +184,10 @@ protected:
     };
     virtual AVAssetStatus assetStatus() const = 0;
 
+    virtual void platformPlay() = 0;
+    virtual void platformPause() = 0;
     virtual void checkPlayability() = 0;
+    virtual void updateRate() = 0;
     virtual float rate() const = 0;
     virtual void seekToTime(float time) = 0;
     virtual unsigned totalBytes() const = 0;
@@ -254,6 +272,8 @@ private:
     bool m_cachedHasVideo;
     bool m_cachedHasCaptions;
     bool m_ignoreLoadStateChanges;
+    bool m_haveReportedFirstVideoFrame;
+    bool m_playWhenFramesAvailable;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h
index cc00c15..7f214b8 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h
@@ -73,8 +73,8 @@ private:
 
     virtual PlatformMedia platformMedia() const;
 
-    virtual void play();
-    virtual void pause();
+    virtual void platformPlay();
+    virtual void platformPause();
     virtual float currentTime() const;
     virtual void setVolume(float);
     virtual void setClosedCaptionsVisible(bool);
@@ -93,6 +93,7 @@ private:
     virtual MediaPlayerPrivateAVFoundation::AVAssetStatus assetStatus() const;
 
     virtual void checkPlayability();
+    virtual void updateRate();
     virtual float rate() const;
     virtual void seekToTime(float time);
     virtual unsigned totalBytes() const;
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm
index 55eb433..c4efb9f 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm
@@ -100,6 +100,7 @@ enum MediaPlayerAVFoundationObservationContext {
 -(void)playableKnown;
 -(void)metadataLoaded;
 -(void)timeChanged:(double)time;
+-(void)seekCompleted:(BOOL)finished;
 -(void)didEnd:(NSNotification *)notification;
 -(void)observeValueForKeyPath:keyPath ofObject:(id)object change:(NSDictionary *)change context:(MediaPlayerAVFoundationObservationContext)context;
 @end
@@ -200,7 +201,7 @@ void MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer()
     if (!m_imageGenerator)
         return;
 
-    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer(%p) - destroying", this, m_imageGenerator.get());
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer(%p) - destroying  %p", this, m_imageGenerator.get());
 
     m_imageGenerator = 0;
 }
@@ -213,7 +214,7 @@ void MediaPlayerPrivateAVFoundationObjC::createVideoLayer()
     if (!m_videoLayer) {
         m_videoLayer.adoptNS([[AVPlayerLayer alloc] init]);
         [m_videoLayer.get() setPlayer:m_avPlayer.get()];
-        LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createVideoLayer(%p) - returning", this, m_videoLayer.get());
+        LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createVideoLayer(%p) - returning %p", this, m_videoLayer.get());
     }
 }
 
@@ -327,9 +328,9 @@ MediaPlayerPrivateAVFoundation::ItemStatus MediaPlayerPrivateAVFoundationObjC::p
         return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusFailed;
     if ([m_avPlayerItem.get() isPlaybackLikelyToKeepUp])
         return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackLikelyToKeepUp;
-    if ([m_avPlayerItem.get() isPlaybackBufferFull])
+    if (buffered()->contain(duration()))
         return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackBufferFull;
-    if ([m_avPlayerItem.get() isPlaybackBufferEmpty])
+    if (buffered()->contain(currentTime()))
         return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackBufferEmpty;
 
     return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusReadyToPlay;
@@ -350,9 +351,9 @@ PlatformLayer* MediaPlayerPrivateAVFoundationObjC::platformLayer() const
     return m_videoLayer.get();
 }
 
-void MediaPlayerPrivateAVFoundationObjC::play()
+void MediaPlayerPrivateAVFoundationObjC::platformPlay()
 {
-    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::play(%p)", this);
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::platformPlay(%p)", this);
     if (!metaDataAvailable())
         return;
 
@@ -361,9 +362,9 @@ void MediaPlayerPrivateAVFoundationObjC::play()
     setDelayCallbacks(false);
 }
 
-void MediaPlayerPrivateAVFoundationObjC::pause()
+void MediaPlayerPrivateAVFoundationObjC::platformPause()
 {
-    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::pause(%p)", this);
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::platformPause(%p)", this);
     if (!metaDataAvailable())
         return;
 
@@ -408,14 +409,10 @@ void MediaPlayerPrivateAVFoundationObjC::seekToTime(float time)
     // setCurrentTime generates several event callbacks, update afterwards.
     setDelayCallbacks(true);
 
-    float now = currentTime();
-    if (time != now)
-        [m_avPlayerItem.get() seekToTime:CMTimeMakeWithSeconds(time, 600) toleranceBefore:kCMTimeZero toleranceAfter:kCMTimeZero];
-    else {
-        // Force a call to the "time changed" notifier manually because a seek to the current time is a noop 
-        // so the seek will never seem to complete.
-        [m_objcObserver.get() timeChanged:now];
-    }
+    WebCoreAVFMovieObserver *observer = m_objcObserver.get();
+    [m_avPlayerItem.get() seekToTime:CMTimeMakeWithSeconds(time, 600) toleranceBefore:kCMTimeZero toleranceAfter:kCMTimeZero completionHandler:^(BOOL finished) {
+        [observer seekCompleted:finished];
+    }];
 
     setDelayCallbacks(false);
 }
@@ -437,6 +434,13 @@ void MediaPlayerPrivateAVFoundationObjC::setClosedCaptionsVisible(bool closedCap
     [m_avPlayer.get() setClosedCaptionDisplayEnabled:closedCaptionsVisible];
 }
 
+void MediaPlayerPrivateAVFoundationObjC::updateRate()
+{
+    setDelayCallbacks(true);
+    [m_avPlayer.get() setRate:requestedRate()];
+    setDelayCallbacks(false);
+}
+
 float MediaPlayerPrivateAVFoundationObjC::rate() const
 {
     if (!metaDataAvailable())
@@ -621,12 +625,16 @@ void MediaPlayerPrivateAVFoundationObjC::getSupportedTypes(HashSet<String>& supp
 
 MediaPlayer::SupportsType MediaPlayerPrivateAVFoundationObjC::supportsType(const String& type, const String& codecs)
 {
-    // Only return "IsSupported" if there is no codecs parameter for now as there is no way to ask if it supports an
-    // extended MIME type until rdar://6220037 is fixed.
-    if (mimeTypeCache().contains(type))
-        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
+    if (!mimeTypeCache().contains(type))
+        return MediaPlayer::IsNotSupported;
+
+    // The spec says:
+    // "Implementors are encouraged to return "maybe" unless the type can be confidently established as being supported or not."
+    if (codecs.isEmpty())
+        return MediaPlayer::MayBeSupported;
 
-    return MediaPlayer::IsNotSupported;
+    NSString *typeString = [NSString stringWithFormat:@"%@; codecs=\"%@\"", (NSString *)type, (NSString *)codecs];
+    return [AVURLAsset isPlayableExtendedMIMEType:typeString] ? MediaPlayer::IsSupported : MediaPlayer::MayBeSupported;;
 }
 
 bool MediaPlayerPrivateAVFoundationObjC::isAvailable()
@@ -758,6 +766,14 @@ NSArray* itemKVOProperties()
     m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::PlayerTimeChanged, time);
 }
 
+- (void)seekCompleted:(BOOL)finished
+{
+    if (!m_callback)
+        return;
+    
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::SeekCompleted, static_cast<bool>(finished));
+}
+
 - (void)didEnd:(NSNotification *)unusedNotification
 {
     UNUSED_PARAM(unusedNotification);
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index 427c7bf..8fb4c9f 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -255,6 +255,7 @@ GraphicsLayerCA::GraphicsLayerCA(GraphicsLayerClient* client)
     , m_contentsLayerHasBackgroundColor(false)
     , m_uncommittedChanges(NoChange)
     , m_contentsScale(1)
+    , m_allowTiledLayer(true)
 {
     m_layer = PlatformCALayer::create(PlatformCALayer::LayerTypeWebLayer, this);
 
@@ -492,6 +493,17 @@ void GraphicsLayerCA::setAcceleratesDrawing(bool acceleratesDrawing)
     noteLayerPropertyChanged(AcceleratesDrawingChanged);
 }
 
+void GraphicsLayerCA::setAllowTiledLayer(bool allowTiledLayer)
+{
+    if (allowTiledLayer == m_allowTiledLayer)
+        return;
+
+    m_allowTiledLayer = allowTiledLayer;
+    
+    // Handling this as a SizeChanged will cause use to switch in or out of tiled layer as needed
+    noteLayerPropertyChanged(SizeChanged);
+}
+
 void GraphicsLayerCA::setBackgroundColor(const Color& color)
 {
     if (m_backgroundColorSet && m_backgroundColor == color)
@@ -2005,7 +2017,7 @@ FloatSize GraphicsLayerCA::constrainedSize() const
 
 bool GraphicsLayerCA::requiresTiledLayer(const FloatSize& size) const
 {
-    if (!m_drawsContent)
+    if (!m_drawsContent || !m_allowTiledLayer)
         return false;
 
     // FIXME: catch zero-size height or width here (or earlier)?
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
index 2c39c0a..3f2d3e4 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
@@ -122,6 +122,9 @@ public:
     virtual void syncCompositingState();
     virtual void syncCompositingStateForThisLayerOnly();
 
+    bool allowTiledLayer() const { return m_allowTiledLayer; }
+    virtual void setAllowTiledLayer(bool b);
+
 protected:
     virtual void setOpacityInternal(float);
 
@@ -399,6 +402,8 @@ private:
 
     float clampedContentsScaleForScale(float) const;
     float m_contentsScale;
+    
+    bool m_allowTiledLayer;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/ca/TransformationMatrixCA.cpp b/Source/WebCore/platform/graphics/ca/TransformationMatrixCA.cpp
index 0ef5fd0..e5ff5ba 100644
--- a/Source/WebCore/platform/graphics/ca/TransformationMatrixCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/TransformationMatrixCA.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "TransformationMatrix.h"
 
-#if PLATFORM(CA)
+#if USE(CA)
 
 #include "FloatConversion.h"
 #include <QuartzCore/CATransform3D.h>
@@ -66,4 +66,4 @@ TransformationMatrix::operator CATransform3D() const
 
 }
 
-#endif // PLATFORM(CA)
+#endif // USE(CA)
diff --git a/Source/WebCore/platform/graphics/ca/win/AbstractCACFLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/AbstractCACFLayerTreeHost.h
new file mode 100644
index 0000000..13c6746
--- /dev/null
+++ b/Source/WebCore/platform/graphics/ca/win/AbstractCACFLayerTreeHost.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AbstractCACFLayerTreeHost_h
+#define AbstractCACFLayerTreeHost_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class PlatformCALayer;
+
+class AbstractCACFLayerTreeHost {
+public:
+    virtual PlatformCALayer* rootLayer() const = 0;
+    virtual void addPendingAnimatedLayer(PassRefPtr<PlatformCALayer>) = 0;
+    virtual void layerTreeDidChange() = 0;
+    virtual void flushPendingLayerChangesNow() = 0;
+
+protected:
+    virtual ~AbstractCACFLayerTreeHost() { }
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // AbstractCACFLayerTreeHost_h
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
index 6d91a73..507af0f 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
@@ -28,6 +28,7 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "AbstractCACFLayerTreeHost.h"
 #include "COMPtr.h"
 #include "Timer.h"
 
@@ -50,9 +51,7 @@ namespace WebCore {
 class CACFLayerTreeHostClient;
 class PlatformCALayer;
 
-class CACFLayerTreeHost : public RefCounted<CACFLayerTreeHost> {
-    friend PlatformCALayer;
-
+class CACFLayerTreeHost : public RefCounted<CACFLayerTreeHost>, private AbstractCACFLayerTreeHost {
 public:
     static PassRefPtr<CACFLayerTreeHost> create();
     virtual ~CACFLayerTreeHost();
@@ -66,24 +65,31 @@ public:
     virtual void paint();
     virtual void resize() = 0;
     void flushPendingGraphicsLayerChangesSoon();
-    void flushPendingLayerChangesNow();
+
+    // AbstractCACFLayerTreeHost
+    virtual void flushPendingLayerChangesNow();
 
 protected:
     CACFLayerTreeHost();
 
     CGRect bounds() const;
-    PlatformCALayer* rootLayer() const;
     HWND window() const { return m_window; }
     void notifyAnimationsStarted();
 
+    // AbstractCACFLayerTreeHost
+    virtual PlatformCALayer* rootLayer() const;
+
     virtual bool createRenderer() = 0;
     virtual void destroyRenderer();
     virtual void contextDidChange();
 
 private:
     void initialize();
-    void addPendingAnimatedLayer(PassRefPtr<PlatformCALayer>);
-    void layerTreeDidChange();
+
+    // AbstractCACFLayerTreeHost
+    virtual void addPendingAnimatedLayer(PassRefPtr<PlatformCALayer>);
+    virtual void layerTreeDidChange();
+
 
     virtual void flushContext() = 0;
     virtual CFTimeInterval lastCommitTime() const = 0;
diff --git a/Source/WebCore/platform/graphics/ca/win/LayerChangesFlusher.cpp b/Source/WebCore/platform/graphics/ca/win/LayerChangesFlusher.cpp
index 3fd857b..ec2a9ff 100644
--- a/Source/WebCore/platform/graphics/ca/win/LayerChangesFlusher.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/LayerChangesFlusher.cpp
@@ -28,8 +28,7 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "CACFLayerTreeHost.h"
-#include "WebCoreInstanceHandle.h"
+#include "AbstractCACFLayerTreeHost.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
@@ -47,7 +46,7 @@ LayerChangesFlusher::LayerChangesFlusher()
 {
 }
 
-void LayerChangesFlusher::flushPendingLayerChangesSoon(CACFLayerTreeHost* host)
+void LayerChangesFlusher::flushPendingLayerChangesSoon(AbstractCACFLayerTreeHost* host)
 {
     if (!m_hostsWithChangesToFlush.add(host).second || m_hook)
         return;
@@ -55,7 +54,7 @@ void LayerChangesFlusher::flushPendingLayerChangesSoon(CACFLayerTreeHost* host)
     setHook();
 }
 
-void LayerChangesFlusher::cancelPendingFlush(CACFLayerTreeHost* host)
+void LayerChangesFlusher::cancelPendingFlush(AbstractCACFLayerTreeHost* host)
 {
     m_hostsWithChangesToFlush.remove(host);
 
@@ -80,9 +79,8 @@ LRESULT LayerChangesFlusher::hookFired(int code, WPARAM wParam, LPARAM lParam)
     ASSERT(m_hook);
 
     // Calling out to the hosts can cause m_hostsWithChangesToFlush to be modified, so we copy it
-    // into a Vector first. We have to hold a reference to them because otherwise they could be
-    // destroyed while we're calling out to them.
-    Vector<RefPtr<CACFLayerTreeHost> > hosts;
+    // into a Vector first.
+    Vector<AbstractCACFLayerTreeHost*> hosts;
     copyToVector(m_hostsWithChangesToFlush, hosts);
     m_hostsWithChangesToFlush.clear();
 
@@ -108,7 +106,7 @@ void LayerChangesFlusher::setHook()
 
     DWORD threadID = ::GetCurrentThreadId();
 
-    m_hook = ::SetWindowsHookExW(WH_GETMESSAGE, hookCallback, instanceHandle(), threadID);
+    m_hook = ::SetWindowsHookExW(WH_GETMESSAGE, hookCallback, 0, threadID);
     ASSERT_WITH_MESSAGE(m_hook, "::SetWindowsHookExW failed with error %lu", ::GetLastError());
 
     // Post a message to the message queue to prevent ::GetMessage from blocking, which will ensure
diff --git a/Source/WebCore/platform/graphics/ca/win/LayerChangesFlusher.h b/Source/WebCore/platform/graphics/ca/win/LayerChangesFlusher.h
index 6a98a99..1e7ab31 100644
--- a/Source/WebCore/platform/graphics/ca/win/LayerChangesFlusher.h
+++ b/Source/WebCore/platform/graphics/ca/win/LayerChangesFlusher.h
@@ -34,15 +34,15 @@
 
 namespace WebCore {
 
-class CACFLayerTreeHost;
+class AbstractCACFLayerTreeHost;
 
 class LayerChangesFlusher {
     WTF_MAKE_NONCOPYABLE(LayerChangesFlusher);
 public:
     static LayerChangesFlusher& shared();
 
-    void flushPendingLayerChangesSoon(CACFLayerTreeHost*);
-    void cancelPendingFlush(CACFLayerTreeHost*);
+    void flushPendingLayerChangesSoon(AbstractCACFLayerTreeHost*);
+    void cancelPendingFlush(AbstractCACFLayerTreeHost*);
 
 private:
     LayerChangesFlusher();
@@ -53,7 +53,7 @@ private:
     void setHook();
     void removeHook();
 
-    HashSet<CACFLayerTreeHost*> m_hostsWithChangesToFlush;
+    HashSet<AbstractCACFLayerTreeHost*> m_hostsWithChangesToFlush;
     HHOOK m_hook;
     bool m_isCallingHosts;
 };
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
index b5a26f4..5d20928 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
@@ -29,7 +29,7 @@
 
 #include "PlatformCALayer.h"
 
-#include "CACFLayerTreeHost.h"
+#include "AbstractCACFLayerTreeHost.h"
 #include "Font.h"
 #include "GraphicsContext.h"
 #include "PlatformCALayerWinInternal.h"
@@ -65,14 +65,14 @@ static CFStringRef toCACFFilterType(PlatformCALayer::FilterType type)
     }
 }
 
-static CACFLayerTreeHost* layerTreeHostForLayer(const PlatformCALayer* layer)
+static AbstractCACFLayerTreeHost* layerTreeHostForLayer(const PlatformCALayer* layer)
 {
-    // We need the CACFLayerTreeHost associated with this layer, which is stored in the UserData of the CACFContext
+    // We need the AbstractCACFLayerTreeHost associated with this layer, which is stored in the UserData of the CACFContext
     void* userData = wkCACFLayerGetContextUserData(layer->platformLayer());
     if (!userData)
         return 0;
 
-    return static_cast<CACFLayerTreeHost*>(userData);
+    return static_cast<AbstractCACFLayerTreeHost*>(userData);
 }
 
 static PlatformCALayerWinInternal* intern(const PlatformCALayer* layer)
@@ -156,7 +156,7 @@ PlatformLayer* PlatformCALayer::platformLayer() const
 
 PlatformCALayer* PlatformCALayer::rootLayer() const
 {
-    CACFLayerTreeHost* host = layerTreeHostForLayer(this);
+    AbstractCACFLayerTreeHost* host = layerTreeHostForLayer(this);
     return host ? host->rootLayer() : 0;
 }
 
@@ -167,7 +167,7 @@ void PlatformCALayer::setNeedsDisplay(const FloatRect* dirtyRect)
     
 void PlatformCALayer::setNeedsCommit()
 {
-    CACFLayerTreeHost* host = layerTreeHostForLayer(this);
+    AbstractCACFLayerTreeHost* host = layerTreeHostForLayer(this);
     if (host)
         host->layerTreeDidChange();
 }
@@ -270,7 +270,7 @@ void PlatformCALayer::addAnimationForKey(const String& key, PlatformCAAnimation*
     setNeedsCommit();
 
     // Tell the host about it so we can fire the start animation event
-    CACFLayerTreeHost* host = layerTreeHostForLayer(this);
+    AbstractCACFLayerTreeHost* host = layerTreeHostForLayer(this);
     if (host)
         host->addPendingAnimatedLayer(this);
 }
@@ -283,7 +283,7 @@ void PlatformCALayer::removeAnimationForKey(const String& key)
     RetainPtr<CFStringRef> s(AdoptCF, key.createCFString());
     CACFLayerRemoveAnimation(m_layer.get(), s.get());
 
-    // We don't "remove" a layer from CACFLayerTreeHost when it loses an animation.
+    // We don't "remove" a layer from AbstractCACFLayerTreeHost when it loses an animation.
     // There may be other active animations on the layer and if an animation
     // callback is fired on a layer without any animations no harm is done.
 
diff --git a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
index e672c2d..c4c3374 100644
--- a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
@@ -31,6 +31,7 @@
 #include "PlatformCALayer.h"
 #include "SoftLinking.h"
 #include <wtf/CurrentTime.h>
+#include <wtf/Threading.h>
 
 typedef struct _CACFLayer* CACFLayerRef;
 
@@ -42,7 +43,13 @@ SOFT_LINK_DEBUG_LIBRARY(WebKitQuartzCoreAdditions)
 SOFT_LINK_LIBRARY(WebKitQuartzCoreAdditions)
 #endif
 
-SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewCreate, WKCACFViewRef, __cdecl, (), ())
+enum WKCACFViewDrawingDestination {
+    kWKCACFViewDrawingDestinationWindow = 0,
+    kWKCACFViewDrawingDestinationImage,
+};
+typedef enum WKCACFViewDrawingDestination WKCACFViewDrawingDestination;
+
+SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewCreate, WKCACFViewRef, __cdecl, (WKCACFViewDrawingDestination destination), (destination))
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewSetLayer, void, __cdecl, (WKCACFViewRef view, CACFLayerRef layer), (view, layer))
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewUpdate, void, __cdecl, (WKCACFViewRef view, HWND window, const CGRect* bounds), (view, window, bounds))
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewCanDraw, bool, __cdecl, (WKCACFViewRef view), (view))
@@ -63,7 +70,7 @@ PassRefPtr<WKCACFViewLayerTreeHost> WKCACFViewLayerTreeHost::create()
 }
 
 WKCACFViewLayerTreeHost::WKCACFViewLayerTreeHost()
-    : m_view(AdoptCF, WKCACFViewCreate())
+    : m_view(AdoptCF, WKCACFViewCreate(kWKCACFViewDrawingDestinationWindow))
     , m_viewNeedsUpdate(true)
 {
 }
@@ -98,6 +105,12 @@ void WKCACFViewLayerTreeHost::contextDidChangeCallback(WKCACFViewRef view, void*
 
 void WKCACFViewLayerTreeHost::contextDidChange()
 {
+    // This should only be called on a background thread when no changes have actually 
+    // been committed to the context, eg. when a video frame has been added to an image
+    // queue, so return without triggering animations etc.
+    if (!isMainThread())
+        return;
+
     // Tell the WKCACFView to start rendering now that we have some contents to render.
     updateViewIfNeeded();
 
diff --git a/Source/WebCore/platform/graphics/cairo/CairoPath.h b/Source/WebCore/platform/graphics/cairo/CairoPath.h
deleted file mode 100644
index da7affb..0000000
--- a/Source/WebCore/platform/graphics/cairo/CairoPath.h
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
-    Copyright (C) 2007 Alp Toker <alp.toker@collabora.co.uk>
-    Copyright (C) 2010 Igalia S.L.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef CairoPath_h
-#define CairoPath_h
-
-#include <cairo.h>
-
-namespace WebCore {
-
-// This is necessary since cairo_path_fixed_t isn't exposed in Cairo's public API.
-class CairoPath {
-public:
-    CairoPath()
-    {
-        static cairo_surface_t* pathSurface = cairo_image_surface_create(CAIRO_FORMAT_A8, 1, 1);
-        m_cr = cairo_create(pathSurface);
-    }
-
-    ~CairoPath()
-    {
-        cairo_destroy(m_cr);
-    }
-
-    cairo_t* context() { return m_cr; }
-
-private:
-    cairo_t* m_cr;
-};
-
-} // namespace WebCore
-
-#endif // CairoPath_h
diff --git a/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp b/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
index ee159a1..758bce9 100644
--- a/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
+++ b/Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp
@@ -27,13 +27,13 @@
 #include "CairoUtilities.h"
 
 #include "AffineTransform.h"
-#include "CairoPath.h"
 #include "Color.h"
 #include "FloatPoint.h"
 #include "FloatRect.h"
 #include "IntRect.h"
 #include "OwnPtrCairo.h"
 #include "Path.h"
+#include "PlatformPathCairo.h"
 #include "RefPtrCairo.h"
 #include <wtf/Vector.h>
 
diff --git a/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp b/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
index 0f90ce4..d968ee9 100644
--- a/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
@@ -42,11 +42,10 @@ using WTF::max;
 
 namespace WebCore {
 
-static cairo_surface_t* scratchBuffer = 0;
+static RefPtr<cairo_surface_t> gScratchBuffer;
 static void purgeScratchBuffer()
 {
-    cairo_surface_destroy(scratchBuffer);
-    scratchBuffer = 0;
+    gScratchBuffer.clear();
 }
 
 // ContextShadow needs a scratch image as the buffer for the blur filter.
@@ -68,20 +67,20 @@ static cairo_surface_t* getScratchBuffer(const IntSize& size)
 {
     int width = size.width();
     int height = size.height();
-    int scratchWidth = scratchBuffer ? cairo_image_surface_get_width(scratchBuffer) : 0;
-    int scratchHeight = scratchBuffer ? cairo_image_surface_get_height(scratchBuffer) : 0;
+    int scratchWidth = gScratchBuffer.get() ? cairo_image_surface_get_width(gScratchBuffer.get()) : 0;
+    int scratchHeight = gScratchBuffer.get() ? cairo_image_surface_get_height(gScratchBuffer.get()) : 0;
 
     // We do not need to recreate the buffer if the current buffer is large enough.
-    if (scratchBuffer && scratchWidth >= width && scratchHeight >= height)
-        return scratchBuffer;
+    if (gScratchBuffer.get() && scratchWidth >= width && scratchHeight >= height)
+        return gScratchBuffer.get();
 
     purgeScratchBuffer();
 
     // Round to the nearest 32 pixels so we do not grow the buffer for similar sized requests.
     width = (1 + (width >> 5)) << 5;
     height = (1 + (height >> 5)) << 5;
-    scratchBuffer = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, width, height);
-    return scratchBuffer;
+    gScratchBuffer = adoptRef(cairo_image_surface_create(CAIRO_FORMAT_ARGB32, width, height));
+    return gScratchBuffer.get();
 }
 
 PlatformContext ContextShadow::beginShadowLayer(GraphicsContext* context, const FloatRect& layerArea)
diff --git a/Source/WebCore/platform/graphics/cairo/DrawErrorUnderline.h b/Source/WebCore/platform/graphics/cairo/DrawErrorUnderline.h
index b90bb8c..3a49d5c 100644
--- a/Source/WebCore/platform/graphics/cairo/DrawErrorUnderline.h
+++ b/Source/WebCore/platform/graphics/cairo/DrawErrorUnderline.h
@@ -21,7 +21,7 @@
  *
  */
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 
 #ifndef DrawErrorUnderline_h
 #define DrawErrorUnderline_h
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
new file mode 100644
index 0000000..c90d8ab
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GraphicsContext3D.h"
+#include "PlatformContextCairo.h"
+
+#if ENABLE(WEBGL)
+
+#include "Image.h"
+#include "RefPtrCairo.h"
+#include <cairo.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+bool GraphicsContext3D::getImageData(Image* image, unsigned int format, unsigned int type, bool premultiplyAlpha, bool ignoreGammaAndColorProfile, Vector<uint8_t>& outputVector)
+{
+    if (!image)
+        return false;
+    // We need this to stay in scope because the native image is just a shallow copy of the data.
+    ImageSource decoder(premultiplyAlpha ? ImageSource::AlphaPremultiplied : ImageSource::AlphaNotPremultiplied,
+                        ignoreGammaAndColorProfile ? ImageSource::GammaAndColorProfileIgnored : ImageSource::GammaAndColorProfileApplied);
+    AlphaOp alphaOp = AlphaDoNothing;
+    RefPtr<cairo_surface_t> imageSurface;
+    if (image->data()) {
+        decoder.setData(image->data(), true);
+        if (!decoder.frameCount() || !decoder.frameIsCompleteAtIndex(0))
+            return false;
+        imageSurface = decoder.createFrameAtIndex(0);
+    } else {
+        imageSurface = image->nativeImageForCurrentFrame();
+        if (!premultiplyAlpha)
+            alphaOp = AlphaDoUnmultiply;
+    }
+
+    if (!imageSurface)
+        return false;
+
+    int width = cairo_image_surface_get_width(imageSurface.get());
+    int height = cairo_image_surface_get_height(imageSurface.get());
+    if (!width || !height)
+        return false;
+
+    if (cairo_image_surface_get_format(imageSurface.get()) != CAIRO_FORMAT_ARGB32)
+        return false;
+
+    unsigned int srcUnpackAlignment = 1;
+    size_t bytesPerRow = cairo_image_surface_get_stride(imageSurface.get());
+    size_t bitsPerPixel = 32;
+    unsigned int padding = bytesPerRow - bitsPerPixel / 8 * width;
+    if (padding) {
+        srcUnpackAlignment = padding + 1;
+        while (bytesPerRow % srcUnpackAlignment)
+            ++srcUnpackAlignment;
+    }
+
+    outputVector.resize(width * height * 4);
+    return packPixels(cairo_image_surface_get_data(imageSurface.get()), SourceFormatBGRA8,
+                      width, height, srcUnpackAlignment, format, type, alphaOp, outputVector.data());
+}
+
+void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight, int canvasWidth, int canvasHeight, PlatformContextCairo* context)
+{
+    if (!imagePixels || imageWidth <= 0 || imageHeight <= 0 || canvasWidth <= 0 || canvasHeight <= 0 || !context)
+        return;
+
+    cairo_t *cr = context->cr();
+    context->save();
+
+    cairo_rectangle(cr, 0, 0, canvasWidth, canvasHeight);
+    cairo_set_operator(cr, CAIRO_OPERATOR_CLEAR);
+    cairo_paint(cr);
+
+    RefPtr<cairo_surface_t> imageSurface = adoptRef(cairo_image_surface_create_for_data(
+        const_cast<unsigned char*>(imagePixels), CAIRO_FORMAT_ARGB32, imageWidth, imageHeight, imageWidth * 4));
+
+    // OpenGL keeps the pixels stored bottom up, so we need to flip the image here.
+    cairo_translate(cr, 0, imageHeight);
+    cairo_scale(cr, 1, -1);
+
+    cairo_set_operator(cr, CAIRO_OPERATOR_OVER);
+    cairo_set_source_surface(cr, imageSurface.get(), 0, 0);
+    cairo_rectangle(cr, 0, 0, canvasWidth, -canvasHeight);
+
+    cairo_fill(cr);
+    context->restore();
+}
+
+void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 0fc94df..4cd0844 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -32,10 +32,9 @@
 #include "config.h"
 #include "GraphicsContext.h"
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 
 #include "AffineTransform.h"
-#include "CairoPath.h"
 #include "CairoUtilities.h"
 #include "ContextShadow.h"
 #include "FloatConversion.h"
@@ -48,6 +47,7 @@
 #include "Path.h"
 #include "Pattern.h"
 #include "PlatformContextCairo.h"
+#include "PlatformPathCairo.h"
 #include "RefPtrCairo.h"
 #include "SimpleFontData.h"
 #include <cairo.h>
@@ -201,8 +201,9 @@ static void strokeCurrentCairoPath(GraphicsContext* context,  cairo_t* cairoCont
 }
 
 GraphicsContext::GraphicsContext(cairo_t* cr)
+    : m_updatingControlTints(false)
 {
-    m_data = new GraphicsContextPlatformPrivate(new PlatformContextCairo(cr));
+    m_data = new GraphicsContextPlatformPrivateToplevel(new PlatformContextCairo(cr));
 }
 
 void GraphicsContext::platformInit(PlatformContextCairo* platformContext)
@@ -234,24 +235,13 @@ PlatformContextCairo* GraphicsContext::platformContext() const
 
 void GraphicsContext::savePlatformState()
 {
-    cairo_save(platformContext()->cr());
+    platformContext()->save();
     m_data->save();
     m_data->shadowStack.append(m_data->shadow);
-    m_data->maskImageStack.append(ImageMaskInformation());
 }
 
 void GraphicsContext::restorePlatformState()
 {
-    cairo_t* cr = platformContext()->cr();
-
-    const ImageMaskInformation& maskInformation = m_data->maskImageStack.last();
-    if (maskInformation.isValid()) {
-        const FloatRect& maskRect = maskInformation.maskRect();
-        cairo_pop_group_to_source(cr);
-        cairo_mask_surface(cr, maskInformation.maskSurface(), maskRect.x(), maskRect.y());
-    }
-    m_data->maskImageStack.removeLast();
-
     if (m_data->shadowStack.isEmpty())
         m_data->shadow = ContextShadow();
     else {
@@ -259,7 +249,7 @@ void GraphicsContext::restorePlatformState()
         m_data->shadowStack.removeLast();
     }
 
-    cairo_restore(cr);
+    platformContext()->restore();
     m_data->restore();
 }
 
@@ -765,7 +755,7 @@ void GraphicsContext::drawLineForTextChecking(const FloatPoint& origin, float wi
     cairo_restore(cr);
 }
 
-FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect, RoundingMode)
 {
     FloatRect result;
     double x = frect.x();
@@ -1190,33 +1180,6 @@ InterpolationQuality GraphicsContext::imageInterpolationQuality() const
     return InterpolationDefault;
 }
 
-void GraphicsContext::pushImageMask(cairo_surface_t* surface, const FloatRect& rect)
-{
-    // We must call savePlatformState at least once before we can use image masking,
-    // since we actually apply the mask in restorePlatformState.
-    ASSERT(!m_data->maskImageStack.isEmpty());
-    m_data->maskImageStack.last().update(surface, rect);
-
-    // Cairo doesn't support the notion of an image clip, so we push a group here
-    // and then paint it to the surface with an image mask (which is an immediate
-    // operation) during restorePlatformState.
-
-    // We want to allow the clipped elements to composite with the surface as it
-    // is now, but they are isolated in another group. To make this work, we're
-    // going to blit the current surface contents onto the new group once we push it.
-    cairo_t* cr = platformContext()->cr();
-    cairo_surface_t* currentTarget = cairo_get_target(cr);
-    cairo_surface_flush(currentTarget);
-
-    // Pushing a new group ensures that only things painted after this point are clipped.
-    cairo_push_group(cr);
-    cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
-
-    cairo_set_source_surface(cr, currentTarget, 0, 0);
-    cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
-    cairo_fill(cr);
-}
-
 } // namespace WebCore
 
-#endif // PLATFORM(CAIRO)
+#endif // USE(CAIRO)
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h b/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
index 2bc290b..8fd056d 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
@@ -47,25 +47,6 @@ typedef struct _GdkExposeEvent GdkExposeEvent;
 
 namespace WebCore {
 
-// In Cairo image masking is immediate, so to emulate image clipping we must save masking
-// details as part of the context state and apply it during platform restore.
-class ImageMaskInformation {
-public:
-    void update(cairo_surface_t* maskSurface, const FloatRect& maskRect)
-    {
-        m_maskSurface = maskSurface;
-        m_maskRect = maskRect;
-    }
-
-    bool isValid() const { return m_maskSurface; }
-    cairo_surface_t* maskSurface() const { return m_maskSurface.get(); }
-    const FloatRect& maskRect() const { return m_maskRect; }
-
-private:
-    RefPtr<cairo_surface_t> m_maskSurface;
-    FloatRect m_maskRect;
-};
-
 class GraphicsContextPlatformPrivate {
 public:
     GraphicsContextPlatformPrivate(PlatformContextCairo* newPlatformContext)
@@ -81,7 +62,7 @@ public:
     {
     }
 
-    ~GraphicsContextPlatformPrivate()
+    virtual ~GraphicsContextPlatformPrivate()
     {
     }
 
@@ -121,7 +102,6 @@ public:
     Vector<float> layers;
     ContextShadow shadow;
     Vector<ContextShadow> shadowStack;
-    Vector<ImageMaskInformation> maskImageStack;
 
 #if PLATFORM(GTK)
     GdkEventExpose* expose;
@@ -142,7 +122,7 @@ public:
     {
     }
 
-    ~GraphicsContextPlatformPrivateToplevel()
+    virtual ~GraphicsContextPlatformPrivateToplevel()
     {
         delete platformContext;
     }
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 1d5d492..8aa6531 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -55,11 +55,10 @@ static inline cairo_surface_t* copySurface(cairo_surface_t* surface)
     int height = cairo_image_surface_get_height(surface);
     cairo_surface_t* newsurface = cairo_image_surface_create(format, width, height);
 
-    cairo_t* cr = cairo_create(newsurface);
-    cairo_set_source_surface(cr, surface, 0, 0);
-    cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
-    cairo_paint(cr);
-    cairo_destroy(cr);
+    RefPtr<cairo_t> cr = adoptRef(cairo_create(newsurface));
+    cairo_set_source_surface(cr.get(), surface, 0, 0);
+    cairo_set_operator(cr.get(), CAIRO_OPERATOR_SOURCE);
+    cairo_paint(cr.get());
 
     return newsurface;
 }
@@ -117,7 +116,7 @@ PassRefPtr<Image> ImageBuffer::copyImage() const
 
 void ImageBuffer::clip(GraphicsContext* context, const FloatRect& maskRect) const
 {
-    context->pushImageMask(m_data.m_surface, maskRect);
+    context->platformContext()->pushImageMask(m_data.m_surface, maskRect);
 }
 
 void ImageBuffer::draw(GraphicsContext* context, ColorSpace styleColorSpace, const FloatRect& destRect, const FloatRect& srcRect,
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferData.h b/Source/WebCore/platform/graphics/cairo/ImageBufferDataCairo.h
index 42867d1..5ca7262 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferDataCairo.h
@@ -23,9 +23,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ImageBufferData_h
-#define ImageBufferData_h
-
 #include "PlatformContextCairo.h"
 
 typedef struct _cairo_surface cairo_surface_t;
@@ -42,6 +39,4 @@ public:
     PlatformContextCairo m_platformContext;
 };
 
-}  // namespace WebCore
-
-#endif  // ImageBufferData_h
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
index d3a52ce..ce7d8b2 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
@@ -28,7 +28,7 @@
 #include "config.h"
 #include "BitmapImage.h"
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 
 #include "AffineTransform.h"
 #include "CairoUtilities.h"
@@ -205,4 +205,4 @@ void BitmapImage::checkForSolidColor()
 
 }
 
-#endif // PLATFORM(CAIRO)
+#endif // USE(CAIRO)
diff --git a/Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp b/Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp
new file mode 100644
index 0000000..92d79f9
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp
@@ -0,0 +1,191 @@
+/*
+ *  Copyright (C) 2011 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#if ENABLE(WEBGL)
+
+#define DISABLE_SHIMS
+#include "OpenGLShims.h"
+
+#include <dlfcn.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+#define ASSIGN_FUNCTION_TABLE_ENTRY(FunctionName, success) \
+    openGLFunctionTable()->FunctionName = reinterpret_cast<FunctionName##Type>(lookupOpenGLFunctionAddress(#FunctionName, success))
+
+namespace WebCore {
+
+typedef void* (*glGetProcAddressType) (const char* procName);
+static void* getProcAddress(const char* procName)
+{
+    static bool initialized = false;
+    static glGetProcAddressType getProcAddressFunction = 0;
+
+    if (!initialized) {
+        getProcAddressFunction = reinterpret_cast<glGetProcAddressType>(dlsym(RTLD_DEFAULT, "glXGetProcAddress"));
+        if (!getProcAddressFunction)
+            getProcAddressFunction = reinterpret_cast<glGetProcAddressType>(dlsym(RTLD_DEFAULT, "glXGetProcAddressARB"));
+    }
+
+    if (!getProcAddressFunction)
+        return dlsym(RTLD_DEFAULT, procName);
+    return getProcAddressFunction(procName);
+}
+
+static void* lookupOpenGLFunctionAddress(const char* functionName, bool& success)
+{
+    if (!success)
+        return 0;
+
+    void* target = getProcAddress(functionName);
+    if (target)
+        return target;
+
+    String fullFunctionName(functionName);
+    fullFunctionName.append("ARB");
+    target = getProcAddress(fullFunctionName.utf8().data());
+    if (target)
+        return target;
+
+    fullFunctionName = functionName;
+    fullFunctionName.append("EXT");
+    target = getProcAddress(fullFunctionName.utf8().data());
+
+    // A null address is still a failure case.
+    if (!target)
+        success = false;
+
+    return target;
+}
+
+OpenGLFunctionTable* openGLFunctionTable()
+{
+    static OpenGLFunctionTable table;
+    return &table;
+}
+
+bool initializeOpenGLShims()
+{
+    static bool success = true;
+    static bool initialized = false;
+    if (initialized)
+        return success;
+
+    initialized = true;
+    ASSIGN_FUNCTION_TABLE_ENTRY(glActiveTexture, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glAttachShader, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBindAttribLocation, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBindBuffer, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBindFramebuffer, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBindRenderbuffer, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBlendColor, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBlendEquation, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBlendEquationSeparate, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBlendFuncSeparate, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBlitFramebuffer, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBufferData, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glBufferSubData, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glCheckFramebufferStatus, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glCompileShader, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glCreateProgram, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glCreateShader, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glDeleteBuffers, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glDeleteFramebuffers, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glDeleteProgram, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glDeleteRenderbuffers, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glDeleteShader, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glDetachShader, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glDisableVertexAttribArray, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glEnableVertexAttribArray, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glFramebufferRenderbuffer, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glFramebufferTexture2D, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGenBuffers, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGenerateMipmap, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGenFramebuffers, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGenRenderbuffers, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetActiveAttrib, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetActiveUniform, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetAttachedShaders, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetAttribLocation, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetBufferParameteriv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetFramebufferAttachmentParameteriv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetProgramInfoLog, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetProgramiv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetRenderbufferParameteriv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetShaderInfoLog, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetShaderiv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetShaderSource, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetUniformfv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetUniformiv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetUniformLocation, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetVertexAttribfv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetVertexAttribiv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glGetVertexAttribPointerv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glIsBuffer, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glIsFramebuffer, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glIsProgram, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glIsRenderbuffer, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glIsShader, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glLinkProgram, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glRenderbufferStorage, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glRenderbufferStorageMultisample, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glSampleCoverage, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glShaderSource, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glStencilFuncSeparate, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glStencilMaskSeparate, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glStencilOpSeparate, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform1f, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform1fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform1i, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform1iv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform2f, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform2fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform2i, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform2iv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform3f, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform3fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform3i, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform3iv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform4f, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform4fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform4i, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniform4iv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniformMatrix2fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniformMatrix3fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUniformMatrix4fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glUseProgram, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glValidateProgram, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttrib1f, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttrib1fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttrib2f, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttrib2fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttrib3f, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttrib3fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttrib4f, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttrib4fv, success);
+    ASSIGN_FUNCTION_TABLE_ENTRY(glVertexAttribPointer, success);
+
+    if (!success)
+        LOG_ERROR("Could not initialize OpenGL shims");
+    return success;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/cairo/OpenGLShims.h b/Source/WebCore/platform/graphics/cairo/OpenGLShims.h
new file mode 100644
index 0000000..a431b03
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/OpenGLShims.h
@@ -0,0 +1,315 @@
+/*
+ *  Copyright (C) 2010 Tieto Corporation.
+ *  Copyright (C) 2011 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include <GL/gl.h>
+
+typedef struct _OpenGLFunctionTable OpenGLFunctionTable;
+
+namespace WebCore {
+bool initializeOpenGLShims();
+OpenGLFunctionTable* openGLFunctionTable();
+}
+
+typedef void (*glActiveTextureType) (GLenum);
+typedef void (*glAttachShaderType) (GLuint, GLuint);
+typedef void (*glBindAttribLocationType) (GLuint, GLuint, const char*);
+typedef void (*glBindBufferType) (GLenum, GLuint);
+typedef void (*glBindFramebufferType) (GLenum, GLuint);
+typedef void (*glBindRenderbufferType) (GLenum, GLuint);
+typedef void (*glBlendColorType) (GLclampf, GLclampf, GLclampf, GLclampf);
+typedef void (*glBlendEquationType) (GLenum);
+typedef void (*glBlendEquationSeparateType)(GLenum, GLenum);
+typedef void (*glBlendFuncSeparateType)(GLenum srcRGB, GLenum dstRGB, GLenum srcAlpha, GLenum dstAlpha);
+typedef void (*glBlitFramebufferType) (GLint, GLint, GLint, GLint, GLint, GLint, GLint, GLint, GLbitfield, GLenum);
+typedef void (*glBufferDataType) (GLenum, GLsizeiptr, const GLvoid*, GLenum);
+typedef void (*glBufferSubDataType) (GLenum, GLintptr, GLsizeiptr, const GLvoid*);
+typedef GLenum (*glCheckFramebufferStatusType) (GLenum);
+typedef void (*glCompileShaderType) (GLuint);
+typedef GLuint (*glCreateProgramType) ();
+typedef GLuint (*glCreateShaderType) (GLenum);
+typedef void (*glDeleteBuffersType) (GLsizei, const GLuint*);
+typedef void (*glDeleteFramebuffersType) (GLsizei n, const GLuint*);
+typedef void (*glDeleteProgramType) (GLuint);
+typedef void (*glDeleteRenderbuffersType) (GLsizei n, const GLuint*);
+typedef void (*glDeleteShaderType) (GLuint);
+typedef void (*glDetachShaderType) (GLuint, GLuint);
+typedef void (*glDisableVertexAttribArrayType) (GLuint);
+typedef void (*glEnableVertexAttribArrayType) (GLuint);
+typedef void (*glFramebufferRenderbufferType) (GLenum, GLenum, GLenum, GLuint);
+typedef void (*glFramebufferTexture2DType) (GLenum, GLenum, GLenum, GLuint, GLint);
+typedef void (*glGenBuffersType) (GLsizei, GLuint*);
+typedef void (*glGenerateMipmapType) (GLenum target);
+typedef void (*glGenFramebuffersType) (GLsizei, GLuint*);
+typedef void (*glGenRenderbuffersType) (GLsizei, GLuint*);
+typedef void (*glGetActiveAttribType) (GLuint, GLuint, GLsizei, GLsizei*, GLint*, GLenum*, GLchar*);
+typedef void (*glGetActiveUniformType) (GLuint, GLuint, GLsizei, GLsizei*, GLint*, GLenum*, GLchar*);
+typedef void (*glGetAttachedShadersType) (GLuint, GLsizei, GLsizei*, GLuint*);
+typedef GLint (*glGetAttribLocationType) (GLuint, const char*);
+typedef void (*glGetBufferParameterivType) (GLenum, GLenum, GLint*);
+typedef void (*glGetFramebufferAttachmentParameterivType) (GLenum, GLenum, GLenum, GLint* params);
+typedef void (*glGetProgramInfoLogType) (GLuint, GLsizei, GLsizei*, char*);
+typedef void (*glGetProgramivType) (GLuint, GLenum, GLint*);
+typedef void (*glGetRenderbufferParameterivType) (GLenum, GLenum, GLint*);
+typedef void (*glGetShaderInfoLogType) (GLuint, GLsizei, GLsizei*, char*);
+typedef void (*glGetShaderivType) (GLuint, GLenum, GLint*);
+typedef void (*glGetShaderSourceType) (GLuint, GLsizei, GLsizei*, char*);
+typedef GLint (*glGetUniformLocationType) (GLuint, const char*);
+typedef void (*glGetUniformfvType) (GLuint, GLint, GLfloat*);
+typedef void (*glGetUniformivType) (GLuint, GLint, GLint*);
+typedef void (*glGetVertexAttribfvType) (GLuint, GLenum, GLfloat*);
+typedef void (*glGetVertexAttribivType) (GLuint, GLenum, GLint*);
+typedef void (*glGetVertexAttribPointervType) (GLuint, GLenum, GLvoid**);
+typedef GLboolean (*glIsBufferType) (GLuint);
+typedef GLboolean (*glIsFramebufferType) (GLuint);
+typedef GLboolean (*glIsProgramType) (GLuint);
+typedef GLboolean (*glIsRenderbufferType) (GLuint);
+typedef GLboolean (*glIsShaderType) (GLuint);
+typedef void (*glLinkProgramType) (GLuint);
+typedef void (*glRenderbufferStorageType) (GLenum, GLenum, GLsizei, GLsizei);
+typedef void (*glRenderbufferStorageMultisampleType) (GLenum, GLsizei, GLenum, GLsizei, GLsizei);
+typedef void (*glSampleCoverageType) (GLclampf, GLboolean);
+typedef void (*glShaderSourceType) (GLuint, GLsizei, const char**, const GLint*);
+typedef void (*glStencilFuncSeparateType) (GLenum, GLenum, GLint, GLuint);
+typedef void (*glStencilMaskSeparateType) (GLenum, GLuint);
+typedef void (*glStencilOpSeparateType) (GLenum, GLenum, GLenum, GLenum);
+typedef void (*glUniform1fType) (GLint, GLfloat);
+typedef void (*glUniform1fvType) (GLint, GLsizei, const GLfloat*);
+typedef void (*glUniform1iType) (GLint, GLint);
+typedef void (*glUniform1ivType) (GLint, GLsizei, const GLint*);
+typedef void (*glUniform2fType) (GLint, GLfloat, GLfloat);
+typedef void (*glUniform2fvType) (GLint, GLsizei, const GLfloat*);
+typedef void (*glUniform2iType) (GLint, GLint, GLint);
+typedef void (*glUniform2ivType) (GLint, GLsizei, const GLint*);
+typedef void (*glUniform3fType) (GLint, GLfloat, GLfloat, GLfloat);
+typedef void (*glUniform3fvType) (GLint, GLsizei, const GLfloat*);
+typedef void (*glUniform3iType) (GLint, GLint, GLint, GLint);
+typedef void (*glUniform3ivType) (GLint, GLsizei, const GLint*);
+typedef void (*glUniform4fType) (GLint, GLfloat, GLfloat, GLfloat, GLfloat);
+typedef void (*glUniform4fvType) (GLint, GLsizei, const GLfloat*);
+typedef void (*glUniform4iType) (GLint, GLint, GLint, GLint, GLint);
+typedef void (*glUniform4ivType) (GLint, GLsizei, const GLint*);
+typedef void (*glUniformMatrix2fvType) (GLint, GLsizei, GLboolean, const GLfloat*);
+typedef void (*glUniformMatrix3fvType) (GLint, GLsizei, GLboolean, const GLfloat*);
+typedef void (*glUniformMatrix4fvType) (GLint, GLsizei, GLboolean, const GLfloat*);
+typedef void (*glUseProgramType) (GLuint);
+typedef void (*glValidateProgramType) (GLuint);
+typedef void (*glVertexAttrib1fType) (GLuint, const GLfloat);
+typedef void (*glVertexAttrib1fvType) (GLuint, const GLfloat*);
+typedef void (*glVertexAttrib2fType) (GLuint, const GLfloat, const GLfloat);
+typedef void (*glVertexAttrib2fvType) (GLuint, const GLfloat*);
+typedef void (*glVertexAttrib3fType) (GLuint, const GLfloat, const GLfloat, const GLfloat);
+typedef void (*glVertexAttrib3fvType) (GLuint, const GLfloat*);
+typedef void (*glVertexAttrib4fType) (GLuint, const GLfloat, const GLfloat, const GLfloat, const GLfloat);
+typedef void (*glVertexAttrib4fvType) (GLuint, const GLfloat*);
+typedef void (*glVertexAttribPointerType) (GLuint, GLint, GLenum, GLboolean, GLsizei, const GLvoid*);
+
+#define FUNCTION_TABLE_ENTRY(FunctionName) FunctionName##Type FunctionName
+
+typedef struct _OpenGLFunctionTable {
+    FUNCTION_TABLE_ENTRY(glActiveTexture);
+    FUNCTION_TABLE_ENTRY(glAttachShader);
+    FUNCTION_TABLE_ENTRY(glBindAttribLocation);
+    FUNCTION_TABLE_ENTRY(glBindBuffer);
+    FUNCTION_TABLE_ENTRY(glBindFramebuffer);
+    FUNCTION_TABLE_ENTRY(glBindRenderbuffer);
+    FUNCTION_TABLE_ENTRY(glBlendColor);
+    FUNCTION_TABLE_ENTRY(glBlendEquation);
+    FUNCTION_TABLE_ENTRY(glBlendEquationSeparate);
+    FUNCTION_TABLE_ENTRY(glBlendFuncSeparate);
+    FUNCTION_TABLE_ENTRY(glBlitFramebuffer);
+    FUNCTION_TABLE_ENTRY(glBufferData);
+    FUNCTION_TABLE_ENTRY(glBufferSubData);
+    FUNCTION_TABLE_ENTRY(glCheckFramebufferStatus);
+    FUNCTION_TABLE_ENTRY(glCompileShader);
+    FUNCTION_TABLE_ENTRY(glCreateProgram);
+    FUNCTION_TABLE_ENTRY(glCreateShader);
+    FUNCTION_TABLE_ENTRY(glDeleteBuffers);
+    FUNCTION_TABLE_ENTRY(glDeleteFramebuffers);
+    FUNCTION_TABLE_ENTRY(glDeleteProgram);
+    FUNCTION_TABLE_ENTRY(glDeleteRenderbuffers);
+    FUNCTION_TABLE_ENTRY(glDeleteShader);
+    FUNCTION_TABLE_ENTRY(glDetachShader);
+    FUNCTION_TABLE_ENTRY(glDisableVertexAttribArray);
+    FUNCTION_TABLE_ENTRY(glEnableVertexAttribArray);
+    FUNCTION_TABLE_ENTRY(glFramebufferRenderbuffer);
+    FUNCTION_TABLE_ENTRY(glFramebufferTexture2D);
+    FUNCTION_TABLE_ENTRY(glGenBuffers);
+    FUNCTION_TABLE_ENTRY(glGenerateMipmap);
+    FUNCTION_TABLE_ENTRY(glGenFramebuffers);
+    FUNCTION_TABLE_ENTRY(glGenRenderbuffers);
+    FUNCTION_TABLE_ENTRY(glGetActiveAttrib);
+    FUNCTION_TABLE_ENTRY(glGetActiveUniform);
+    FUNCTION_TABLE_ENTRY(glGetAttachedShaders);
+    FUNCTION_TABLE_ENTRY(glGetAttribLocation);
+    FUNCTION_TABLE_ENTRY(glGetBufferParameteriv);
+    FUNCTION_TABLE_ENTRY(glGetFramebufferAttachmentParameteriv);
+    FUNCTION_TABLE_ENTRY(glGetProgramInfoLog);
+    FUNCTION_TABLE_ENTRY(glGetProgramiv);
+    FUNCTION_TABLE_ENTRY(glGetRenderbufferParameteriv);
+    FUNCTION_TABLE_ENTRY(glGetShaderInfoLog);
+    FUNCTION_TABLE_ENTRY(glGetShaderiv);
+    FUNCTION_TABLE_ENTRY(glGetShaderSource);
+    FUNCTION_TABLE_ENTRY(glGetUniformfv);
+    FUNCTION_TABLE_ENTRY(glGetUniformiv);
+    FUNCTION_TABLE_ENTRY(glGetUniformLocation);
+    FUNCTION_TABLE_ENTRY(glGetVertexAttribfv);
+    FUNCTION_TABLE_ENTRY(glGetVertexAttribiv);
+    FUNCTION_TABLE_ENTRY(glGetVertexAttribPointerv);
+    FUNCTION_TABLE_ENTRY(glIsBuffer);
+    FUNCTION_TABLE_ENTRY(glIsFramebuffer);
+    FUNCTION_TABLE_ENTRY(glIsProgram);
+    FUNCTION_TABLE_ENTRY(glIsRenderbuffer);
+    FUNCTION_TABLE_ENTRY(glIsShader);
+    FUNCTION_TABLE_ENTRY(glLinkProgram);
+    FUNCTION_TABLE_ENTRY(glRenderbufferStorage);
+    FUNCTION_TABLE_ENTRY(glRenderbufferStorageMultisample);
+    FUNCTION_TABLE_ENTRY(glSampleCoverage);
+    FUNCTION_TABLE_ENTRY(glShaderSource);
+    FUNCTION_TABLE_ENTRY(glStencilFuncSeparate);
+    FUNCTION_TABLE_ENTRY(glStencilMaskSeparate);
+    FUNCTION_TABLE_ENTRY(glStencilOpSeparate);
+    FUNCTION_TABLE_ENTRY(glUniform1f);
+    FUNCTION_TABLE_ENTRY(glUniform1fv);
+    FUNCTION_TABLE_ENTRY(glUniform1i);
+    FUNCTION_TABLE_ENTRY(glUniform1iv);
+    FUNCTION_TABLE_ENTRY(glUniform2f);
+    FUNCTION_TABLE_ENTRY(glUniform2fv);
+    FUNCTION_TABLE_ENTRY(glUniform2i);
+    FUNCTION_TABLE_ENTRY(glUniform2iv);
+    FUNCTION_TABLE_ENTRY(glUniform3f);
+    FUNCTION_TABLE_ENTRY(glUniform3fv);
+    FUNCTION_TABLE_ENTRY(glUniform3i);
+    FUNCTION_TABLE_ENTRY(glUniform3iv);
+    FUNCTION_TABLE_ENTRY(glUniform4f);
+    FUNCTION_TABLE_ENTRY(glUniform4fv);
+    FUNCTION_TABLE_ENTRY(glUniform4i);
+    FUNCTION_TABLE_ENTRY(glUniform4iv);
+    FUNCTION_TABLE_ENTRY(glUniformMatrix2fv);
+    FUNCTION_TABLE_ENTRY(glUniformMatrix3fv);
+    FUNCTION_TABLE_ENTRY(glUniformMatrix4fv);
+    FUNCTION_TABLE_ENTRY(glUseProgram);
+    FUNCTION_TABLE_ENTRY(glValidateProgram);
+    FUNCTION_TABLE_ENTRY(glVertexAttrib1f);
+    FUNCTION_TABLE_ENTRY(glVertexAttrib1fv);
+    FUNCTION_TABLE_ENTRY(glVertexAttrib2f);
+    FUNCTION_TABLE_ENTRY(glVertexAttrib2fv);
+    FUNCTION_TABLE_ENTRY(glVertexAttrib3f);
+    FUNCTION_TABLE_ENTRY(glVertexAttrib3fv);
+    FUNCTION_TABLE_ENTRY(glVertexAttrib4f);
+    FUNCTION_TABLE_ENTRY(glVertexAttrib4fv);
+    FUNCTION_TABLE_ENTRY(glVertexAttribPointer);
+} OpenGLFunctionTable;
+
+// We disable the shims for OpenGLShims.cpp, so that we can set them.
+#ifndef DISABLE_SHIMS
+#define LOOKUP_GL_FUNCTION(Function) WebCore::openGLFunctionTable()->Function
+#define glActiveTexture                        LOOKUP_GL_FUNCTION(glActiveTexture)
+#define glAttachShader                         LOOKUP_GL_FUNCTION(glAttachShader)
+#define glBindAttribLocation                   LOOKUP_GL_FUNCTION(glBindAttribLocation)
+#define glBindBuffer                           LOOKUP_GL_FUNCTION(glBindBuffer)
+#define glBindFramebufferEXT                   LOOKUP_GL_FUNCTION(glBindFramebuffer)
+#define glBindRenderbufferEXT                  LOOKUP_GL_FUNCTION(glBindRenderbuffer)
+#define glBlendColor                           LOOKUP_GL_FUNCTION(glBlendColor)
+#define glBlendEquation                        LOOKUP_GL_FUNCTION(glBlendEquation)
+#define glBlendEquationSeparate                LOOKUP_GL_FUNCTION(glBlendEquationSeparate)
+#define glBlendFuncSeparate                    LOOKUP_GL_FUNCTION(glBlendFuncSeparate)
+#define glBlitFramebufferEXT                   LOOKUP_GL_FUNCTION(glBlitFramebuffer)
+#define glBufferData                           LOOKUP_GL_FUNCTION(glBufferData)
+#define glBufferSubData                        LOOKUP_GL_FUNCTION(glBufferSubData)
+#define glCheckFramebufferStatusEXT            LOOKUP_GL_FUNCTION(glCheckFramebufferStatus)
+#define glCompileShader                        LOOKUP_GL_FUNCTION(glCompileShader)
+#define glCreateProgram                        LOOKUP_GL_FUNCTION(glCreateProgram)
+#define glCreateShader                         LOOKUP_GL_FUNCTION(glCreateShader)
+#define glDeleteBuffers                        LOOKUP_GL_FUNCTION(glDeleteBuffers)
+#define glDeleteFramebuffersEXT                LOOKUP_GL_FUNCTION(glDeleteFramebuffers)
+#define glDeleteProgram                        LOOKUP_GL_FUNCTION(glDeleteProgram)
+#define glDeleteRenderbuffersEXT               LOOKUP_GL_FUNCTION(glDeleteRenderbuffers)
+#define glDeleteShader                         LOOKUP_GL_FUNCTION(glDeleteShader)
+#define glDetachShader                         LOOKUP_GL_FUNCTION(glDetachShader)
+#define glDisableVertexAttribArray             LOOKUP_GL_FUNCTION(glDisableVertexAttribArray)
+#define glEnableVertexAttribArray              LOOKUP_GL_FUNCTION(glEnableVertexAttribArray)
+#define glFramebufferRenderbufferEXT           LOOKUP_GL_FUNCTION(glFramebufferRenderbuffer)
+#define glFramebufferTexture2DEXT              LOOKUP_GL_FUNCTION(glFramebufferTexture2D)
+#define glGenBuffers                           LOOKUP_GL_FUNCTION(glGenBuffers)
+#define glGenerateMipmapEXT                    LOOKUP_GL_FUNCTION(glGenerateMipmap)
+#define glGenFramebuffersEXT                   LOOKUP_GL_FUNCTION(glGenFramebuffers)
+#define glGenRenderbuffersEXT                  LOOKUP_GL_FUNCTION(glGenRenderbuffers)
+#define glGetActiveAttrib                      LOOKUP_GL_FUNCTION(glGetActiveAttrib)
+#define glGetActiveUniform                     LOOKUP_GL_FUNCTION(glGetActiveUniform)
+#define glGetAttachedShaders                   LOOKUP_GL_FUNCTION(glGetAttachedShaders)
+#define glGetAttribLocation                    LOOKUP_GL_FUNCTION(glGetAttribLocation)
+#define glGetBufferParameteriv                 LOOKUP_GL_FUNCTION(glGetBufferParameteriv)
+#define glGetBufferParameterivEXT              LOOKUP_GL_FUNCTION(glGetBufferParameteriv)
+#define glGetFramebufferAttachmentParameterivEXT LOOKUP_GL_FUNCTION(glGetFramebufferAttachmentParameteriv)
+#define glGetProgramInfoLog                    LOOKUP_GL_FUNCTION(glGetProgramInfoLog)
+#define glGetProgramiv                         LOOKUP_GL_FUNCTION(glGetProgramiv)
+#define glGetRenderbufferParameterivEXT        LOOKUP_GL_FUNCTION(glGetRenderbufferParameteriv)
+#define glGetShaderInfoLog                     LOOKUP_GL_FUNCTION(glGetShaderInfoLog)
+#define glGetShaderiv                          LOOKUP_GL_FUNCTION(glGetShaderiv)
+#define glGetShaderSource                      LOOKUP_GL_FUNCTION(glGetShaderSource)
+#define glGetUniformfv                         LOOKUP_GL_FUNCTION(glGetUniformfv)
+#define glGetUniformiv                         LOOKUP_GL_FUNCTION(glGetUniformiv)
+#define glGetUniformLocation                   LOOKUP_GL_FUNCTION(glGetUniformLocation)
+#define glGetVertexAttribfv                    LOOKUP_GL_FUNCTION(glGetVertexAttribfv)
+#define glGetVertexAttribiv                    LOOKUP_GL_FUNCTION(glGetVertexAttribiv)
+#define glGetVertexAttribPointerv              LOOKUP_GL_FUNCTION(glGetVertexAttribPointerv)
+#define glIsBuffer                             LOOKUP_GL_FUNCTION(glIsBuffer)
+#define glIsFramebufferEXT                     LOOKUP_GL_FUNCTION(glIsFramebuffer)
+#define glIsProgram                            LOOKUP_GL_FUNCTION(glIsProgram)
+#define glIsRenderbufferEXT                    LOOKUP_GL_FUNCTION(glIsRenderbuffer)
+#define glIsShader                             LOOKUP_GL_FUNCTION(glIsShader)
+#define glLinkProgram                          LOOKUP_GL_FUNCTION(glLinkProgram)
+#define glRenderbufferStorageEXT               LOOKUP_GL_FUNCTION(glRenderbufferStorage)
+#define glRenderbufferStorageMultisampleEXT    LOOKUP_GL_FUNCTION(glRenderbufferStorageMultisample)
+#define glSampleCoverage                       LOOKUP_GL_FUNCTION(glSampleCoverage)
+#define glShaderSource                         LOOKUP_GL_FUNCTION(glShaderSource)
+#define glStencilFuncSeparate                  LOOKUP_GL_FUNCTION(glStencilFuncSeparate)
+#define glStencilMaskSeparate                  LOOKUP_GL_FUNCTION(glStencilMaskSeparate)
+#define glStencilOpSeparate                    LOOKUP_GL_FUNCTION(glStencilOpSeparate)
+#define glUniform1f                            LOOKUP_GL_FUNCTION(glUniform1f)
+#define glUniform1fv                           LOOKUP_GL_FUNCTION(glUniform1fv)
+#define glUniform1i                            LOOKUP_GL_FUNCTION(glUniform1i)
+#define glUniform1iv                           LOOKUP_GL_FUNCTION(glUniform1iv)
+#define glUniform2f                            LOOKUP_GL_FUNCTION(glUniform2f)
+#define glUniform2fv                           LOOKUP_GL_FUNCTION(glUniform2fv)
+#define glUniform2i                            LOOKUP_GL_FUNCTION(glUniform2i)
+#define glUniform2iv                           LOOKUP_GL_FUNCTION(glUniform2iv)
+#define glUniform3f                            LOOKUP_GL_FUNCTION(glUniform3f)
+#define glUniform3fv                           LOOKUP_GL_FUNCTION(glUniform3fv)
+#define glUniform3i                            LOOKUP_GL_FUNCTION(glUniform3i)
+#define glUniform3iv                           LOOKUP_GL_FUNCTION(glUniform3iv)
+#define glUniform4f                            LOOKUP_GL_FUNCTION(glUniform4f)
+#define glUniform4fv                           LOOKUP_GL_FUNCTION(glUniform4fv)
+#define glUniform4i                            LOOKUP_GL_FUNCTION(glUniform4i)
+#define glUniform4iv                           LOOKUP_GL_FUNCTION(glUniform4iv)
+#define glUniformMatrix2fv                     LOOKUP_GL_FUNCTION(glUniformMatrix2fv)
+#define glUniformMatrix3fv                     LOOKUP_GL_FUNCTION(glUniformMatrix3fv)
+#define glUniformMatrix4fv                     LOOKUP_GL_FUNCTION(glUniformMatrix4fv)
+#define glUseProgram                           LOOKUP_GL_FUNCTION(glUseProgram)
+#define glValidateProgram                      LOOKUP_GL_FUNCTION(glValidateProgram)
+#define glVertexAttrib1f                       LOOKUP_GL_FUNCTION(glVertexAttrib1f)
+#define glVertexAttrib1fv                      LOOKUP_GL_FUNCTION(glVertexAttrib1fv)
+#define glVertexAttrib2f                       LOOKUP_GL_FUNCTION(glVertexAttrib2f)
+#define glVertexAttrib2fv                      LOOKUP_GL_FUNCTION(glVertexAttrib2fv)
+#define glVertexAttrib3f                       LOOKUP_GL_FUNCTION(glVertexAttrib3f)
+#define glVertexAttrib3fv                      LOOKUP_GL_FUNCTION(glVertexAttrib3fv)
+#define glVertexAttrib4f                       LOOKUP_GL_FUNCTION(glVertexAttrib4f)
+#define glVertexAttrib4fv                      LOOKUP_GL_FUNCTION(glVertexAttrib4fv)
+#define glVertexAttribPointer                  LOOKUP_GL_FUNCTION(glVertexAttribPointer)
+#endif
diff --git a/Source/WebCore/platform/graphics/cairo/PathCairo.cpp b/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
index 533df10..d62c33f 100644
--- a/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
@@ -27,10 +27,10 @@
 #include "Path.h"
 
 #include "AffineTransform.h"
-#include "CairoPath.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "OwnPtrCairo.h"
+#include "PlatformPathCairo.h"
 #include "PlatformString.h"
 #include "StrokeStyleApplier.h"
 #include <cairo.h>
diff --git a/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp
index ba75162..061ee06 100644
--- a/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp
@@ -35,4 +35,51 @@ PlatformContextCairo::PlatformContextCairo(cairo_t* cr)
 {
 }
 
+void PlatformContextCairo::restore()
+{
+    const ImageMaskInformation& maskInformation = m_maskImageStack.last();
+    if (maskInformation.isValid()) {
+        const FloatRect& maskRect = maskInformation.maskRect();
+        cairo_pop_group_to_source(m_cr.get());
+        cairo_mask_surface(m_cr.get(), maskInformation.maskSurface(), maskRect.x(), maskRect.y());
+    }
+    m_maskImageStack.removeLast();
+
+    cairo_restore(m_cr.get());
+}
+
+void PlatformContextCairo::save()
+{
+    m_maskImageStack.append(ImageMaskInformation());
+
+    cairo_save(m_cr.get());
+}
+
+void PlatformContextCairo::pushImageMask(cairo_surface_t* surface, const FloatRect& rect)
+{
+    // We must call savePlatformState at least once before we can use image masking,
+    // since we actually apply the mask in restorePlatformState.
+    ASSERT(!m_maskImageStack.isEmpty());
+    m_maskImageStack.last().update(surface, rect);
+
+    // Cairo doesn't support the notion of an image clip, so we push a group here
+    // and then paint it to the surface with an image mask (which is an immediate
+    // operation) during restorePlatformState.
+
+    // We want to allow the clipped elements to composite with the surface as it
+    // is now, but they are isolated in another group. To make this work, we're
+    // going to blit the current surface contents onto the new group once we push it.
+    cairo_surface_t* currentTarget = cairo_get_target(m_cr.get());
+    cairo_surface_flush(currentTarget);
+
+    // Pushing a new group ensures that only things painted after this point are clipped.
+    cairo_push_group(m_cr.get());
+    cairo_set_operator(m_cr.get(), CAIRO_OPERATOR_SOURCE);
+
+    cairo_set_source_surface(m_cr.get(), currentTarget, 0, 0);
+    cairo_rectangle(m_cr.get(), rect.x(), rect.y(), rect.width(), rect.height());
+    cairo_fill(m_cr.get());
+}
+
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h
index c6cceda..937417a 100644
--- a/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h
@@ -31,6 +31,25 @@
 
 namespace WebCore {
 
+// In Cairo image masking is immediate, so to emulate image clipping we must save masking
+// details as part of the context state and apply them during platform restore.
+class ImageMaskInformation {
+public:
+    void update(cairo_surface_t* maskSurface, const FloatRect& maskRect)
+    {
+        m_maskSurface = maskSurface;
+        m_maskRect = maskRect;
+    }
+
+    bool isValid() const { return m_maskSurface; }
+    cairo_surface_t* maskSurface() const { return m_maskSurface.get(); }
+    const FloatRect& maskRect() const { return m_maskRect; }
+
+private:
+    RefPtr<cairo_surface_t> m_maskSurface;
+    FloatRect m_maskRect;
+};
+
 // Much like PlatformContextSkia in the Skia port, this class holds information that
 // would normally be private to GraphicsContext, except that we want to allow access
 // to it in Font and Image code. This allows us to separate the concerns of Cairo-specific
@@ -40,11 +59,17 @@ class PlatformContextCairo {
     WTF_MAKE_NONCOPYABLE(PlatformContextCairo);
 public:
     PlatformContextCairo(cairo_t*);
+
     cairo_t* cr() { return m_cr.get(); }
     void setCr(cairo_t* cr) { m_cr = cr; }
 
+    void save();
+    void restore();
+    void pushImageMask(cairo_surface_t*, const FloatRect&);
+
 private:
     RefPtr<cairo_t> m_cr;
+    Vector<ImageMaskInformation> m_maskImageStack;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cairo/PlatformPathCairo.cpp b/Source/WebCore/platform/graphics/cairo/PlatformPathCairo.cpp
new file mode 100644
index 0000000..3a7d512
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/PlatformPathCairo.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2011 Collabora Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PlatformPathCairo.h"
+
+#include <cairo.h>
+
+namespace WebCore {
+
+static cairo_surface_t* getPathSurface() 
+{
+    return cairo_image_surface_create(CAIRO_FORMAT_A8, 1, 1);
+}
+
+static cairo_surface_t* gPathSurface = getPathSurface(); 
+
+CairoPath::CairoPath()
+    : m_cr(adoptRef(cairo_create(gPathSurface)))
+{
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/cairo/PlatformPathCairo.h b/Source/WebCore/platform/graphics/cairo/PlatformPathCairo.h
new file mode 100644
index 0000000..938b942
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/PlatformPathCairo.h
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2007 Alp Toker <alp.toker@collabora.co.uk>
+ *  Copyright (C) 2010 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef PlatformPathCairo_h
+#define PlatformPathCairo_h
+
+#include "RefPtrCairo.h"
+
+namespace WebCore {
+
+// This is necessary since cairo_path_fixed_t isn't exposed in Cairo's public API.
+class CairoPath {
+public:
+    CairoPath();
+
+    ~CairoPath() {}
+
+    cairo_t* context() { return m_cr.get(); }
+
+private:
+    RefPtr<cairo_t> m_cr;
+};
+
+} // namespace WebCore
+
+#endif // PlatformPathCairo_h
diff --git a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
index 1792002..90bc3b1 100644
--- a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
@@ -61,7 +61,7 @@ template<> void refIfNotNull(cairo_font_face_t* ptr)
 template<> void derefIfNotNull(cairo_font_face_t* ptr)
 {
     if (LIKELY(ptr != 0))
-        cairo_font_face_reference(ptr);
+        cairo_font_face_destroy(ptr);
 }
 
 template<> void refIfNotNull(cairo_scaled_font_t* ptr)
diff --git a/Source/WebCore/platform/graphics/cg/ColorCG.cpp b/Source/WebCore/platform/graphics/cg/ColorCG.cpp
index c9b05da..55a3017 100644
--- a/Source/WebCore/platform/graphics/cg/ColorCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ColorCG.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "Color.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 
 #include "GraphicsContextCG.h"
 #include <wtf/Assertions.h>
@@ -146,4 +146,4 @@ CGColorRef cachedCGColor(const Color& color, ColorSpace colorSpace)
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/FloatPointCG.cpp b/Source/WebCore/platform/graphics/cg/FloatPointCG.cpp
index f9c3353..5e7aab3 100644
--- a/Source/WebCore/platform/graphics/cg/FloatPointCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/FloatPointCG.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "FloatPoint.h"
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -44,4 +44,4 @@ FloatPoint::operator CGPoint() const
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/FloatRectCG.cpp b/Source/WebCore/platform/graphics/cg/FloatRectCG.cpp
index a1ce367..131b7ac 100644
--- a/Source/WebCore/platform/graphics/cg/FloatRectCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/FloatRectCG.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "FloatRect.h"
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -44,4 +44,4 @@ FloatRect::operator CGRect() const
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/FloatSizeCG.cpp b/Source/WebCore/platform/graphics/cg/FloatSizeCG.cpp
index 383af21..a035c7a 100644
--- a/Source/WebCore/platform/graphics/cg/FloatSizeCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/FloatSizeCG.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "FloatSize.h"
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -44,4 +44,4 @@ FloatSize::operator CGSize() const
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
index 187d296..57abe71 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
@@ -29,8 +29,9 @@
 #if ENABLE(WEBGL)
 
 #include "GraphicsContext3D.h"
-#include "GraphicsContextCG.h"
 
+#include "BitmapImage.h"
+#include "GraphicsContextCG.h"
 #include "Image.h"
 
 #include <CoreGraphics/CGBitmapContext.h>
@@ -99,7 +100,8 @@ bool GraphicsContext3D::getImageData(Image* image,
         return false;
     CGImageRef cgImage;
     RetainPtr<CGImageRef> decodedImage;
-    if (image->data()) {
+    bool hasAlpha = image->isBitmapImage() ? static_cast<BitmapImage*>(image)->frameHasAlphaAtIndex(0) : true;
+    if ((ignoreGammaAndColorProfile || (hasAlpha && !premultiplyAlpha)) && image->data()) {
         ImageSource decoder(ImageSource::AlphaNotPremultiplied,
                             ignoreGammaAndColorProfile ? ImageSource::GammaAndColorProfileIgnored : ImageSource::GammaAndColorProfileApplied);
         decoder.setData(image->data(), true);
@@ -196,11 +198,6 @@ bool GraphicsContext3D::getImageData(Image* image,
     AlphaFormat alphaFormat = AlphaFormatNone;
     switch (CGImageGetAlphaInfo(cgImage)) {
     case kCGImageAlphaPremultipliedFirst:
-        // This is a special case for texImage2D with HTMLCanvasElement input,
-        // in which case image->data() should be null, or indexed color models,
-        // where we need premultiplied alpha to create the bitmap context
-        // successfully.
-        ASSERT(!image->data() || model == kCGColorSpaceModelIndexed);
         if (!premultiplyAlpha)
             neededAlphaOp = AlphaDoUnmultiply;
         alphaFormat = AlphaFormatFirst;
@@ -216,9 +213,6 @@ bool GraphicsContext3D::getImageData(Image* image,
         alphaFormat = AlphaFormatFirst;
         break;
     case kCGImageAlphaPremultipliedLast:
-        // This is a special case for texImage2D with HTMLCanvasElement input,
-        // in which case image->data() should be null.
-        ASSERT(!image->data());
         if (!premultiplyAlpha)
             neededAlphaOp = AlphaDoUnmultiply;
         alphaFormat = AlphaFormatLast;
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 7799137..c7626b9 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -756,9 +756,6 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
     if (oldFillColor != color || oldColorSpace != colorSpace)
         setCGFillColor(context, color, colorSpace);
 
-    Path path;
-    path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
-
     bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
@@ -771,7 +768,15 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
         contextShadow.drawRectShadow(this, rect, RoundedIntRect::Radii(topLeft, topRight, bottomLeft, bottomRight));
     }
 
-    fillPath(path);
+    bool equalWidths = (topLeft.width() == topRight.width() && topRight.width() == bottomLeft.width() && bottomLeft.width() == bottomRight.width());
+    bool equalHeights = (topLeft.height() == bottomLeft.height() && bottomLeft.height() == topRight.height() && topRight.height() == bottomRight.height());
+    if (equalWidths && equalHeights && topLeft.width() * 2 == rect.width() && topLeft.height() * 2 == rect.height())
+        CGContextFillEllipseInRect(context, rect);
+    else {
+        Path path;
+        path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
+        fillPath(path);
+    }
 
     if (drawOwnShadow)
         CGContextRestoreGState(context);
@@ -791,7 +796,7 @@ void GraphicsContext::fillRectWithRoundedHole(const IntRect& rect, const Rounded
     path.addRect(rect);
 
     if (!roundedHoleRect.radii().isZero())
-        path.addRoundedRect(roundedHoleRect.rect(), roundedHoleRect.radii().topLeft(), roundedHoleRect.radii().topRight(), roundedHoleRect.radii().bottomLeft(), roundedHoleRect.radii().bottomRight());
+        path.addRoundedRect(roundedHoleRect);
     else
         path.addRect(roundedHoleRect.rect());
 
@@ -1167,8 +1172,11 @@ AffineTransform GraphicsContext::getCTM() const
     return AffineTransform(t.a, t.b, t.c, t.d, t.tx, t.ty);
 }
 
-FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect, RoundingMode roundingMode)
 {
+#if PLATFORM(CHROMIUM)
+    return rect;
+#else
     // It is not enough just to round to pixels in device space. The rotation part of the
     // affine transform matrix to device space can mess with this conversion if we have a
     // rotating image like the hands of the world clock widget. We just need the scale, so
@@ -1192,8 +1200,13 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
 
     deviceOrigin.x = roundf(deviceOrigin.x);
     deviceOrigin.y = roundf(deviceOrigin.y);
-    deviceLowerRight.x = roundf(deviceLowerRight.x);
-    deviceLowerRight.y = roundf(deviceLowerRight.y);
+    if (roundingMode == RoundAllSides) {
+        deviceLowerRight.x = roundf(deviceLowerRight.x);
+        deviceLowerRight.y = roundf(deviceLowerRight.y);
+    } else {
+        deviceLowerRight.x = deviceOrigin.x + roundf(rect.width() * deviceScaleX);
+        deviceLowerRight.y = deviceOrigin.y + roundf(rect.height() * deviceScaleY);
+    }
 
     // Don't let the height or width round to 0 unless either was originally 0
     if (deviceOrigin.y == deviceLowerRight.y && rect.height())
@@ -1204,6 +1217,7 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
     FloatPoint roundedOrigin = FloatPoint(deviceOrigin.x / deviceScaleX, deviceOrigin.y / deviceScaleY);
     FloatPoint roundedLowerRight = FloatPoint(deviceLowerRight.x / deviceScaleX, deviceLowerRight.y / deviceScaleY);
     return FloatRect(roundedOrigin, roundedLowerRight - roundedOrigin);
+#endif
 }
 
 void GraphicsContext::drawLineForText(const FloatPoint& point, float width, bool printing)
@@ -1232,7 +1246,7 @@ void GraphicsContext::drawLineForText(const FloatPoint& point, float width, bool
         // We try to round all parameters to integer boundaries in device space. If rounding pixels in device space
         // makes our thickness more than double, then there must be a shrinking-scale factor and rounding to pixels
         // in device space will make the underlines too thick.
-        CGRect lineRect = roundToDevicePixels(FloatRect(x, y, lineLength, adjustedThickness));
+        CGRect lineRect = roundToDevicePixels(FloatRect(x, y, lineLength, adjustedThickness), RoundOriginAndDimensions);
         if (lineRect.size.height < thickness * 2.0) {
             x = lineRect.origin.x;
             y = lineRect.origin.y;
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index 3c8f959..95ce8c1 100644
--- a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -42,10 +42,6 @@
 #include <wtf/Threading.h>
 #include <math.h>
 
-#if USE(IOSURFACE_CANVAS_BACKING_STORE)
-#include <IOSurface/IOSurface.h>
-#endif
-
 #if PLATFORM(MAC) || PLATFORM(CHROMIUM)
 #include "WebCoreSystemInterface.h"
 #endif
@@ -56,6 +52,7 @@ namespace WebCore {
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
 static const int maxIOSurfaceDimension = 4096;
+static const int minIOSurfaceArea = 50 * 100;
 
 static RetainPtr<IOSurfaceRef> createIOSurface(const IntSize& size)
 {
@@ -100,14 +97,6 @@ static void releaseImageData(void*, const void* data, size_t)
     fastFree(const_cast<void*>(data));
 }
 
-ImageBufferData::ImageBufferData(const IntSize&)
-    : m_data(0)
-#if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    , m_surface(0)
-#endif
-{
-}
-
 ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, RenderingMode renderingMode, bool& success)
     : m_data(size)
     , m_size(size)
@@ -117,7 +106,7 @@ ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, Render
     if (size.width() < 0 || size.height() < 0)
         return;
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    if (size.width() >= maxIOSurfaceDimension || size.height() >= maxIOSurfaceDimension)
+    if (size.width() >= maxIOSurfaceDimension || size.height() >= maxIOSurfaceDimension || size.width() * size.height() < minIOSurfaceArea)
         m_accelerateRendering = false;
 #else
     ASSERT(renderingMode == Unaccelerated);
@@ -262,208 +251,32 @@ void ImageBuffer::clip(GraphicsContext* contextToClip, const FloatRect& rect) co
     CGContextTranslateCTM(platformContextToClip, -rect.x(), -rect.y() - rect.height());
 }
 
-template <Multiply multiplied>
-PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& imageData, const IntSize& size, bool accelerateRendering)
-{
-    RefPtr<ByteArray> result = ByteArray::create(rect.width() * rect.height() * 4);
-    unsigned char* data = result->data();
-
-    if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > size.width() || rect.maxY() > size.height())
-        memset(data, 0, result->length());
-
-    int originx = rect.x();
-    int destx = 0;
-    if (originx < 0) {
-        destx = -originx;
-        originx = 0;
-    }
-    int endx = rect.maxX();
-    if (endx > size.width())
-        endx = size.width();
-    int numColumns = endx - originx;
-
-    int originy = rect.y();
-    int desty = 0;
-    if (originy < 0) {
-        desty = -originy;
-        originy = 0;
-    }
-    int endy = rect.maxY();
-    if (endy > size.height())
-        endy = size.height();
-    int numRows = endy - originy;
-    
-    unsigned destBytesPerRow = 4 * rect.width();
-    unsigned char* destRows = data + desty * destBytesPerRow + destx * 4;
-
-    unsigned srcBytesPerRow;
-    unsigned char* srcRows;
-
-    if (!accelerateRendering) {
-        srcBytesPerRow = 4 * size.width();
-        srcRows = reinterpret_cast<unsigned char*>(imageData.m_data) + originy * srcBytesPerRow + originx * 4;
-        
-        for (int y = 0; y < numRows; ++y) {
-            for (int x = 0; x < numColumns; x++) {
-                int basex = x * 4;
-                unsigned char alpha = srcRows[basex + 3];
-                if (multiplied == Unmultiplied && alpha) {
-                    destRows[basex] = (srcRows[basex] * 255) / alpha;
-                    destRows[basex + 1] = (srcRows[basex + 1] * 255) / alpha;
-                    destRows[basex + 2] = (srcRows[basex + 2] * 255) / alpha;
-                    destRows[basex + 3] = alpha;
-                } else
-                    reinterpret_cast<uint32_t*>(destRows + basex)[0] = reinterpret_cast<uint32_t*>(srcRows + basex)[0];
-            }
-            srcRows += srcBytesPerRow;
-            destRows += destBytesPerRow;
-        }
-    } else {
-#if USE(IOSURFACE_CANVAS_BACKING_STORE)
-        IOSurfaceRef surface = imageData.m_surface.get();
-        IOSurfaceLock(surface, kIOSurfaceLockReadOnly, 0);
-        srcBytesPerRow = IOSurfaceGetBytesPerRow(surface);
-        srcRows = (unsigned char*)(IOSurfaceGetBaseAddress(surface)) + originy * srcBytesPerRow + originx * 4;
-        
-        for (int y = 0; y < numRows; ++y) {
-            for (int x = 0; x < numColumns; x++) {
-                int basex = x * 4;
-                unsigned char alpha = srcRows[basex + 3];
-                if (multiplied == Unmultiplied && alpha) {
-                    destRows[basex] = (srcRows[basex + 2] * 255) / alpha;
-                    destRows[basex + 1] = (srcRows[basex + 1] * 255) / alpha;
-                    destRows[basex + 2] = (srcRows[basex] * 255) / alpha;
-                    destRows[basex + 3] = alpha;
-                } else {
-                    destRows[basex] = srcRows[basex + 2];
-                    destRows[basex + 1] = srcRows[basex + 1];
-                    destRows[basex + 2] = srcRows[basex];
-                    destRows[basex + 3] = alpha;
-                }
-            }
-            srcRows += srcBytesPerRow;
-            destRows += destBytesPerRow;
-        }
-        IOSurfaceUnlock(surface, kIOSurfaceLockReadOnly, 0);
-#else
-        ASSERT_NOT_REACHED();
-#endif
-    }
-    
-    return result.release();
-}
-
 PassRefPtr<ByteArray> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
 {
     if (m_accelerateRendering)
         CGContextFlush(context()->platformContext());
-    return getImageData<Unmultiplied>(rect, m_data, m_size, m_accelerateRendering);
+    return m_data.getData(rect, m_size, m_accelerateRendering, true);
 }
 
 PassRefPtr<ByteArray> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
 {
     if (m_accelerateRendering)
         CGContextFlush(context()->platformContext());
-    return getImageData<Premultiplied>(rect, m_data, m_size, m_accelerateRendering);
-}
-
-template <Multiply multiplied>
-void putImageData(ByteArray*& source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& imageData, const IntSize& size, bool accelerateRendering)
-{
-    ASSERT(sourceRect.width() > 0);
-    ASSERT(sourceRect.height() > 0);
-
-    int originx = sourceRect.x();
-    int destx = destPoint.x() + sourceRect.x();
-    ASSERT(destx >= 0);
-    ASSERT(destx < size.width());
-    ASSERT(originx >= 0);
-    ASSERT(originx <= sourceRect.maxX());
-
-    int endx = destPoint.x() + sourceRect.maxX();
-    ASSERT(endx <= size.width());
-
-    int numColumns = endx - destx;
-
-    int originy = sourceRect.y();
-    int desty = destPoint.y() + sourceRect.y();
-    ASSERT(desty >= 0);
-    ASSERT(desty < size.height());
-    ASSERT(originy >= 0);
-    ASSERT(originy <= sourceRect.maxY());
-
-    int endy = destPoint.y() + sourceRect.maxY();
-    ASSERT(endy <= size.height());
-    int numRows = endy - desty;
-
-    unsigned srcBytesPerRow = 4 * sourceSize.width();
-    unsigned char* srcRows = source->data() + originy * srcBytesPerRow + originx * 4;
-    unsigned destBytesPerRow;
-    unsigned char* destRows;
-
-    if (!accelerateRendering) {
-        destBytesPerRow = 4 * size.width();
-        destRows = reinterpret_cast<unsigned char*>(imageData.m_data) + desty * destBytesPerRow + destx * 4;
-        for (int y = 0; y < numRows; ++y) {
-            for (int x = 0; x < numColumns; x++) {
-                int basex = x * 4;
-                unsigned char alpha = srcRows[basex + 3];
-                if (multiplied == Unmultiplied && alpha != 255) {
-                    destRows[basex] = (srcRows[basex] * alpha + 254) / 255;
-                    destRows[basex + 1] = (srcRows[basex + 1] * alpha + 254) / 255;
-                    destRows[basex + 2] = (srcRows[basex + 2] * alpha + 254) / 255;
-                    destRows[basex + 3] = alpha;
-                } else
-                    reinterpret_cast<uint32_t*>(destRows + basex)[0] = reinterpret_cast<uint32_t*>(srcRows + basex)[0];
-            }
-            destRows += destBytesPerRow;
-            srcRows += srcBytesPerRow;
-        }
-    } else {
-#if USE(IOSURFACE_CANVAS_BACKING_STORE)
-        IOSurfaceRef surface = imageData.m_surface.get();
-        IOSurfaceLock(surface, 0, 0);
-        destBytesPerRow = IOSurfaceGetBytesPerRow(surface);
-        destRows = (unsigned char*)(IOSurfaceGetBaseAddress(surface)) + desty * destBytesPerRow + destx * 4;
-        
-        for (int y = 0; y < numRows; ++y) {
-            for (int x = 0; x < numColumns; x++) {
-                int basex = x * 4;
-                unsigned char alpha = srcRows[basex + 3];
-                if (multiplied == Unmultiplied && alpha != 255) {
-                    destRows[basex] = (srcRows[basex + 2] * alpha + 254) / 255;
-                    destRows[basex + 1] = (srcRows[basex + 1] * alpha + 254) / 255;
-                    destRows[basex + 2] = (srcRows[basex] * alpha + 254) / 255;
-                    destRows[basex + 3] = alpha;
-                } else {
-                    destRows[basex] = srcRows[basex + 2];
-                    destRows[basex + 1] = srcRows[basex + 1];
-                    destRows[basex + 2] = srcRows[basex];
-                    destRows[basex + 3] = alpha;
-                }
-            }
-            destRows += destBytesPerRow;
-            srcRows += srcBytesPerRow;
-        }
-        IOSurfaceUnlock(surface, 0, 0);
-#else
-        ASSERT_NOT_REACHED();
-#endif
-    }
+    return m_data.getData(rect, m_size, m_accelerateRendering, false);
 }
 
 void ImageBuffer::putUnmultipliedImageData(ByteArray* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint)
 {
     if (m_accelerateRendering)
         CGContextFlush(context()->platformContext());
-    putImageData<Unmultiplied>(source, sourceSize, sourceRect, destPoint, m_data, m_size, m_accelerateRendering);
+    m_data.putData(source, sourceSize, sourceRect, destPoint, m_size, m_accelerateRendering, true);
 }
 
 void ImageBuffer::putPremultipliedImageData(ByteArray* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint)
 {
     if (m_accelerateRendering)
         CGContextFlush(context()->platformContext());
-    putImageData<Premultiplied>(source, sourceSize, sourceRect, destPoint, m_data, m_size, m_accelerateRendering);
+    m_data.putData(source, sourceSize, sourceRect, destPoint, m_size, m_accelerateRendering, false);
 }
 
 static inline CFStringRef jpegUTI()
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferDataCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferDataCG.cpp
new file mode 100644
index 0000000..f067b66
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferDataCG.cpp
@@ -0,0 +1,387 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ImageBufferData.h"
+
+#include <wtf/Assertions.h>
+
+#if USE(ACCELERATE)
+#include <Accelerate/Accelerate.h>
+#endif
+
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+#include <IOSurface/IOSurface.h>
+#include <dispatch/dispatch.h>
+#endif
+
+#if USE(ACCELERATE)
+struct ScanlineData {
+    vImagePixelCount scanlineWidth;
+    unsigned char* srcData;
+    size_t srcRowBytes;
+    unsigned char* destData;
+    size_t destRowBytes;
+};
+#endif
+
+namespace WebCore {
+
+ImageBufferData::ImageBufferData(const IntSize&)
+: m_data(0)
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+, m_surface(0)
+#endif
+{
+}
+
+#if USE(ACCELERATE)
+// The vImage unpremultiply routine had a rounding bug before 10.6.7 <rdar://problem/8631548>
+static bool haveVImageRoundingErrorFix()
+{
+    SInt32 version;
+    static bool result = (Gestalt(gestaltSystemVersion, &version) == noErr && version > 0x1066);
+    return result;
+}
+
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+static void convertScanline(void* data, size_t tileNumber, bool premultiply)
+{
+    ScanlineData* scanlineData = static_cast<ScanlineData*>(data);
+
+    vImage_Buffer src;
+    src.data = scanlineData->srcData + tileNumber * scanlineData->srcRowBytes;
+    src.height = 1;
+    src.width = scanlineData->scanlineWidth;
+    src.rowBytes = scanlineData->srcRowBytes;
+
+    vImage_Buffer dest;
+    dest.data = scanlineData->destData + tileNumber * scanlineData->destRowBytes;
+    dest.height = 1;
+    dest.width = scanlineData->scanlineWidth;
+    dest.rowBytes = scanlineData->destRowBytes;
+
+    if (premultiply) {
+        if (kvImageNoError != vImagePremultiplyData_RGBA8888(&src, &dest, kvImageDoNotTile))
+            return;
+    } else {
+        if (kvImageNoError != vImageUnpremultiplyData_RGBA8888(&src, &dest, kvImageDoNotTile))
+            return;
+    }
+
+    // Swap channels 1 and 3, to convert BGRA<->RGBA. IOSurfaces is BGRA, ImageData expects RGBA.
+    const uint8_t map[4] = { 2, 1, 0, 3 };
+    vImagePermuteChannels_ARGB8888(&dest, &dest, map, kvImageDoNotTile);
+}
+
+static void unpremultitplyScanline(void* data, size_t tileNumber)
+{
+    convertScanline(data, tileNumber, false);
+}
+
+static void premultitplyScanline(void* data, size_t tileNumber)
+{
+    convertScanline(data, tileNumber, true);
+}
+#endif // USE(IOSURFACE_CANVAS_BACKING_STORE)
+#endif // USE(ACCELERATE)
+
+PassRefPtr<ByteArray> ImageBufferData::getData(const IntRect& rect, const IntSize& size, bool accelerateRendering, bool unmultiplied) const
+{
+    RefPtr<ByteArray> result = ByteArray::create(rect.width() * rect.height() * 4);
+    unsigned char* data = result->data();
+    
+    if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > size.width() || rect.maxY() > size.height())
+        memset(data, 0, result->length());
+    
+    int originx = rect.x();
+    int destx = 0;
+    if (originx < 0) {
+        destx = -originx;
+        originx = 0;
+    }
+    int endx = rect.maxX();
+    if (endx > size.width())
+        endx = size.width();
+    int width = endx - originx;
+    
+    int originy = rect.y();
+    int desty = 0;
+    if (originy < 0) {
+        desty = -originy;
+        originy = 0;
+    }
+    int endy = rect.maxY();
+    if (endy > size.height())
+        endy = size.height();
+    int height = endy - originy;
+    
+    if (width <= 0 || height <= 0)
+        return result.release();
+    
+    unsigned destBytesPerRow = 4 * rect.width();
+    unsigned char* destRows = data + desty * destBytesPerRow + destx * 4;
+    
+    unsigned srcBytesPerRow;
+    unsigned char* srcRows;
+    
+    if (!accelerateRendering) {
+        srcBytesPerRow = 4 * size.width();
+        srcRows = reinterpret_cast<unsigned char*>(m_data) + originy * srcBytesPerRow + originx * 4;
+        
+#if USE(ACCELERATE)
+        if (unmultiplied && haveVImageRoundingErrorFix()) {
+            vImage_Buffer src;
+            src.height = height;
+            src.width = width;
+            src.rowBytes = srcBytesPerRow;
+            src.data = srcRows;
+            
+            vImage_Buffer dst;
+            dst.height = height;
+            dst.width = width;
+            dst.rowBytes = destBytesPerRow;
+            dst.data = destRows;
+            
+            vImageUnpremultiplyData_RGBA8888(&src, &dst, kvImageNoFlags);
+            return result.release();
+        }
+#endif
+        for (int y = 0; y < height; ++y) {
+            for (int x = 0; x < width; x++) {
+                int basex = x * 4;
+                unsigned char alpha = srcRows[basex + 3];
+                if (unmultiplied && alpha) {
+                    destRows[basex] = (srcRows[basex] * 255) / alpha;
+                    destRows[basex + 1] = (srcRows[basex + 1] * 255) / alpha;
+                    destRows[basex + 2] = (srcRows[basex + 2] * 255) / alpha;
+                    destRows[basex + 3] = alpha;
+                } else
+                    reinterpret_cast<uint32_t*>(destRows + basex)[0] = reinterpret_cast<uint32_t*>(srcRows + basex)[0];
+            }
+            srcRows += srcBytesPerRow;
+            destRows += destBytesPerRow;
+        }
+    } else {
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+        IOSurfaceRef surface = m_surface.get();
+        IOSurfaceLock(surface, kIOSurfaceLockReadOnly, 0);
+        srcBytesPerRow = IOSurfaceGetBytesPerRow(surface);
+        srcRows = (unsigned char*)(IOSurfaceGetBaseAddress(surface)) + originy * srcBytesPerRow + originx * 4;
+
+#if USE(ACCELERATE)
+        if (unmultiplied) {
+            ScanlineData scanlineData;
+            scanlineData.scanlineWidth = width;
+            scanlineData.srcData = srcRows;
+            scanlineData.srcRowBytes = srcBytesPerRow;
+            scanlineData.destData = destRows;
+            scanlineData.destRowBytes = destBytesPerRow;
+
+            dispatch_apply_f(height, dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), &scanlineData, unpremultitplyScanline);
+        } else {
+            vImage_Buffer src;
+            src.height = height;
+            src.width = width;
+            src.rowBytes = srcBytesPerRow;
+            src.data = srcRows;
+
+            vImage_Buffer dest;
+            dest.height = height;
+            dest.width = width;
+            dest.rowBytes = destBytesPerRow;
+            dest.data = destRows;
+
+            // Swap pixel channels from BGRA to RGBA.
+            const uint8_t map[4] = { 2, 1, 0, 3 };
+            vImagePermuteChannels_ARGB8888(&src, &dest, map, kvImageNoFlags);
+        }
+#else
+        for (int y = 0; y < height; ++y) {
+            for (int x = 0; x < width; x++) {
+                int basex = x * 4;
+                unsigned char alpha = srcRows[basex + 3];
+                if (unmultiplied && alpha) {
+                    destRows[basex] = (srcRows[basex + 2] * 255) / alpha;
+                    destRows[basex + 1] = (srcRows[basex + 1] * 255) / alpha;
+                    destRows[basex + 2] = (srcRows[basex] * 255) / alpha;
+                    destRows[basex + 3] = alpha;
+                } else {
+                    destRows[basex] = srcRows[basex + 2];
+                    destRows[basex + 1] = srcRows[basex + 1];
+                    destRows[basex + 2] = srcRows[basex];
+                    destRows[basex + 3] = alpha;
+                }
+            }
+            srcRows += srcBytesPerRow;
+            destRows += destBytesPerRow;
+        }
+#endif // USE(ACCELERATE)
+        IOSurfaceUnlock(surface, kIOSurfaceLockReadOnly, 0);
+#else
+        ASSERT_NOT_REACHED();
+#endif // USE(IOSURFACE_CANVAS_BACKING_STORE)
+    }
+    
+    return result.release();
+}
+
+void ImageBufferData::putData(ByteArray*& source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint, const IntSize& size, bool accelerateRendering, bool unmultiplied)
+{
+    ASSERT(sourceRect.width() > 0);
+    ASSERT(sourceRect.height() > 0);
+    
+    int originx = sourceRect.x();
+    int destx = destPoint.x() + sourceRect.x();
+    ASSERT(destx >= 0);
+    ASSERT(destx < size.width());
+    ASSERT(originx >= 0);
+    ASSERT(originx <= sourceRect.maxX());
+    
+    int endx = destPoint.x() + sourceRect.maxX();
+    ASSERT(endx <= size.width());
+    
+    int width = endx - destx;
+    
+    int originy = sourceRect.y();
+    int desty = destPoint.y() + sourceRect.y();
+    ASSERT(desty >= 0);
+    ASSERT(desty < size.height());
+    ASSERT(originy >= 0);
+    ASSERT(originy <= sourceRect.maxY());
+    
+    int endy = destPoint.y() + sourceRect.maxY();
+    ASSERT(endy <= size.height());
+    int height = endy - desty;
+    
+    if (width <= 0 || height <= 0)
+        return;
+    
+    unsigned srcBytesPerRow = 4 * sourceSize.width();
+    unsigned char* srcRows = source->data() + originy * srcBytesPerRow + originx * 4;
+    unsigned destBytesPerRow;
+    unsigned char* destRows;
+    
+    if (!accelerateRendering) {
+        destBytesPerRow = 4 * size.width();
+        destRows = reinterpret_cast<unsigned char*>(m_data) + desty * destBytesPerRow + destx * 4;
+        
+#if USE(ACCELERATE)
+        if (haveVImageRoundingErrorFix() && unmultiplied) {
+            vImage_Buffer src;
+            src.height = height;
+            src.width = width;
+            src.rowBytes = srcBytesPerRow;
+            src.data = srcRows;
+            
+            vImage_Buffer dst;
+            dst.height = height;
+            dst.width = width;
+            dst.rowBytes = destBytesPerRow;
+            dst.data = destRows;
+            
+            vImagePremultiplyData_RGBA8888(&src, &dst, kvImageNoFlags);
+            return;
+        }
+#endif
+        for (int y = 0; y < height; ++y) {
+            for (int x = 0; x < width; x++) {
+                int basex = x * 4;
+                unsigned char alpha = srcRows[basex + 3];
+                if (unmultiplied && alpha != 255) {
+                    destRows[basex] = (srcRows[basex] * alpha + 254) / 255;
+                    destRows[basex + 1] = (srcRows[basex + 1] * alpha + 254) / 255;
+                    destRows[basex + 2] = (srcRows[basex + 2] * alpha + 254) / 255;
+                    destRows[basex + 3] = alpha;
+                } else
+                    reinterpret_cast<uint32_t*>(destRows + basex)[0] = reinterpret_cast<uint32_t*>(srcRows + basex)[0];
+            }
+            destRows += destBytesPerRow;
+            srcRows += srcBytesPerRow;
+        }
+    } else {
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+        IOSurfaceRef surface = m_surface.get();
+        IOSurfaceLock(surface, 0, 0);
+        destBytesPerRow = IOSurfaceGetBytesPerRow(surface);
+        destRows = (unsigned char*)(IOSurfaceGetBaseAddress(surface)) + desty * destBytesPerRow + destx * 4;
+
+#if USE(ACCELERATE)
+        if (unmultiplied) {
+            ScanlineData scanlineData;
+            scanlineData.scanlineWidth = width;
+            scanlineData.srcData = srcRows;
+            scanlineData.srcRowBytes = srcBytesPerRow;
+            scanlineData.destData = destRows;
+            scanlineData.destRowBytes = destBytesPerRow;
+
+            dispatch_apply_f(height, dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), &scanlineData, premultitplyScanline);
+        } else {
+            vImage_Buffer src;
+            src.height = height;
+            src.width = width;
+            src.rowBytes = srcBytesPerRow;
+            src.data = srcRows;
+
+            vImage_Buffer dest;
+            dest.height = height;
+            dest.width = width;
+            dest.rowBytes = destBytesPerRow;
+            dest.data = destRows;
+
+            // Swap pixel channels from RGBA to BGRA.
+            const uint8_t map[4] = { 2, 1, 0, 3 };
+            vImagePermuteChannels_ARGB8888(&src, &dest, map, kvImageNoFlags);
+        }
+#else
+        for (int y = 0; y < height; ++y) {
+            for (int x = 0; x < width; x++) {
+                int basex = x * 4;
+                unsigned char alpha = srcRows[basex + 3];
+                if (unmultiplied && alpha != 255) {
+                    destRows[basex] = (srcRows[basex + 2] * alpha + 254) / 255;
+                    destRows[basex + 1] = (srcRows[basex + 1] * alpha + 254) / 255;
+                    destRows[basex + 2] = (srcRows[basex] * alpha + 254) / 255;
+                    destRows[basex + 3] = alpha;
+                } else {
+                    destRows[basex] = srcRows[basex + 2];
+                    destRows[basex + 1] = srcRows[basex + 1];
+                    destRows[basex + 2] = srcRows[basex];
+                    destRows[basex + 3] = alpha;
+                }
+            }
+            destRows += destBytesPerRow;
+            srcRows += srcBytesPerRow;
+        }
+#endif // USE(ACCELERATE)
+
+        IOSurfaceUnlock(surface, 0, 0);
+#else
+        ASSERT_NOT_REACHED();
+#endif // USE(IOSURFACE_CANVAS_BACKING_STORE)
+    }
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferData.h b/Source/WebCore/platform/graphics/cg/ImageBufferDataCG.h
index 1f706ec..54169e6 100644
--- a/Source/WebCore/platform/graphics/cg/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferDataCG.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -23,13 +24,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ImageBufferData_h
-#define ImageBufferData_h
-
 #include "Image.h"
+#include <wtf/ByteArray.h>
 #include <wtf/RefPtr.h>
 #include <wtf/RetainPtr.h>
 
+#if (PLATFORM(MAC) && USE(CA) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD))
+#define WTF_USE_IOSURFACE_CANVAS_BACKING_STORE 1
+#endif
+
 typedef struct __IOSurface *IOSurfaceRef;
 typedef struct CGColorSpace *CGColorSpaceRef;
 typedef struct CGDataProvider *CGDataProviderRef;
@@ -50,8 +53,9 @@ public:
     unsigned m_bytesPerRow;
     CGColorSpaceRef m_colorSpace;
     RetainPtr<IOSurfaceRef> m_surface;
-};
 
-}  // namespace WebCore
+    PassRefPtr<ByteArray> getData(const IntRect& rect, const IntSize& size, bool accelerateRendering, bool unmultiplied) const;
+    void putData(ByteArray*& source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint, const IntSize& size, bool accelerateRendering, bool unmultiplied);
+};
 
-#endif  // ImageBufferData_h
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cg/ImageCG.cpp b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
index 08f65bd..635a804 100644
--- a/Source/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "BitmapImage.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 
 #include "AffineTransform.h"
 #include "FloatConversion.h"
@@ -154,6 +154,19 @@ CGImageRef BitmapImage::getCGImageRef()
     return frameAtIndex(0);
 }
 
+CGImageRef BitmapImage::getFirstCGImageRefOfSize(const IntSize& size)
+{
+    size_t count = frameCount();
+    for (size_t i = 0; i < count; ++i) {
+        CGImageRef cgImage = frameAtIndex(i);
+        if (IntSize(CGImageGetWidth(cgImage), CGImageGetHeight(cgImage)) == size)
+            return cgImage;
+    }
+
+    // Fallback to the default CGImageRef if we can't find the right size
+    return getCGImageRef();
+}
+
 void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator compositeOp)
 {
     startAnimation();
@@ -186,7 +199,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
         // containing only the portion we want to display. We need to do this because high-quality
         // interpolation smoothes sharp edges, causing pixels from outside the source rect to bleed
         // into the destination rect. See <rdar://problem/6112909>.
-        shouldUseSubimage = (interpolationQuality == kCGInterpolationHigh || interpolationQuality == kCGInterpolationDefault) && (srcRect.size() != destRect.size() || !ctxt->getCTM().isIdentityOrTranslationOrFlipped());
+        shouldUseSubimage = (interpolationQuality != kCGInterpolationNone) && (srcRect.size() != destRect.size() || !ctxt->getCTM().isIdentityOrTranslationOrFlipped());
         float xScale = srcRect.width() / destRect.width();
         float yScale = srcRect.height() / destRect.height();
         if (shouldUseSubimage) {
@@ -255,6 +268,11 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
         // Avoid a hang under CGContextDrawTiledImage on release builds.
         return;
 
+#if !ASSERT_DISABLED
+    if (this->isBitmapImage())
+        ASSERT(static_cast<BitmapImage*>(this)->notSolidColor());
+#endif
+
     CGContextRef context = ctxt->platformContext();
     ctxt->save();
     CGContextClipToRect(context, destRect);
@@ -346,4 +364,4 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/ImageSourceCG.cpp b/Source/WebCore/platform/graphics/cg/ImageSourceCG.cpp
index 068ea5b..1a630d4 100644
--- a/Source/WebCore/platform/graphics/cg/ImageSourceCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageSourceCG.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "ImageSource.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include "ImageSourceCG.h"
 
 #include "IntPoint.h"
@@ -356,4 +356,4 @@ bool ImageSource::frameHasAlphaAtIndex(size_t)
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/IntPointCG.cpp b/Source/WebCore/platform/graphics/cg/IntPointCG.cpp
index 95dbe5f..4a1096b 100644
--- a/Source/WebCore/platform/graphics/cg/IntPointCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/IntPointCG.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "IntPoint.h"
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -43,4 +43,4 @@ IntPoint::operator CGPoint() const
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/IntRectCG.cpp b/Source/WebCore/platform/graphics/cg/IntRectCG.cpp
index 73fd63f..18edeb0 100644
--- a/Source/WebCore/platform/graphics/cg/IntRectCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/IntRectCG.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "IntRect.h"
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -48,4 +48,4 @@ IntRect enclosingIntRect(const CGRect& rect)
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/IntSizeCG.cpp b/Source/WebCore/platform/graphics/cg/IntSizeCG.cpp
index d8e8c83..c844cbc 100644
--- a/Source/WebCore/platform/graphics/cg/IntSizeCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/IntSizeCG.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "IntSize.h"
 
-#if PLATFORM(CG)
+#if USE(CG) || USE(SKIA_ON_MAC_CHROME)
 
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -43,4 +43,4 @@ IntSize::operator CGSize() const
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp b/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
index 8bf04f1..a7d465f 100644
--- a/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
+++ b/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "PDFDocumentImage.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 
 #include "GraphicsContext.h"
 #include "ImageObserver.h"
@@ -188,4 +188,4 @@ void PDFDocumentImage::draw(GraphicsContext* context, const FloatRect& dstRect,
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/PDFDocumentImage.h b/Source/WebCore/platform/graphics/cg/PDFDocumentImage.h
index ecd57be..c69a222 100644
--- a/Source/WebCore/platform/graphics/cg/PDFDocumentImage.h
+++ b/Source/WebCore/platform/graphics/cg/PDFDocumentImage.h
@@ -31,7 +31,7 @@
 #include "FloatRect.h"
 #include "GraphicsTypes.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -78,6 +78,6 @@ namespace WebCore {
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
 
 #endif // PDFDocumentImage_h
diff --git a/Source/WebCore/platform/graphics/cg/PathCG.cpp b/Source/WebCore/platform/graphics/cg/PathCG.cpp
index b8fc7d4..3b9725a 100644
--- a/Source/WebCore/platform/graphics/cg/PathCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/PathCG.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "Path.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 
 #include "AffineTransform.h"
 #include "FloatRect.h"
@@ -309,4 +309,4 @@ void Path::transform(const AffineTransform& transform)
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/cg/TransformationMatrixCG.cpp b/Source/WebCore/platform/graphics/cg/TransformationMatrixCG.cpp
index ec40836..b49a2ab 100644
--- a/Source/WebCore/platform/graphics/cg/TransformationMatrixCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/TransformationMatrixCG.cpp
@@ -27,7 +27,7 @@
 #include "AffineTransform.h"
 #include "TransformationMatrix.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 
 #include <CoreGraphics/CGAffineTransform.h>
 #include "FloatConversion.h"
@@ -66,4 +66,4 @@ AffineTransform::operator CGAffineTransform() const
 
 }
 
-#endif // PLATFORM(CG)
+#endif // USE(CG)
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
index 4cb119a..26ad37a 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
@@ -36,6 +36,7 @@
 
 #include "DrawingBuffer.h"
 #include "GraphicsContext3D.h"
+#include "LayerRendererChromium.h"
 
 namespace WebCore {
 
@@ -54,6 +55,8 @@ Canvas2DLayerChromium::~Canvas2DLayerChromium()
 {
     if (m_textureId)
         layerRendererContext()->deleteTexture(m_textureId);
+    if (m_drawingBuffer && layerRenderer())
+        layerRenderer()->removeChildContext(m_drawingBuffer->graphicsContext3D().get());
 }
 
 void Canvas2DLayerChromium::updateCompositorResources()
@@ -103,8 +106,28 @@ unsigned Canvas2DLayerChromium::textureId() const
 void Canvas2DLayerChromium::setDrawingBuffer(DrawingBuffer* drawingBuffer)
 {
     if (drawingBuffer != m_drawingBuffer) {
+        if (m_drawingBuffer && layerRenderer())
+            layerRenderer()->removeChildContext(m_drawingBuffer->graphicsContext3D().get());
+
         m_drawingBuffer = drawingBuffer;
         m_textureChanged = true;
+
+        if (drawingBuffer && layerRenderer())
+            layerRenderer()->addChildContext(m_drawingBuffer->graphicsContext3D().get());
+    }
+}
+
+void Canvas2DLayerChromium::setLayerRenderer(LayerRendererChromium* newLayerRenderer)
+{
+    if (layerRenderer() != newLayerRenderer) {
+        if (m_drawingBuffer->graphicsContext3D()) {
+            if (layerRenderer())
+                layerRenderer()->removeChildContext(m_drawingBuffer->graphicsContext3D().get());
+            if (newLayerRenderer)
+                newLayerRenderer->addChildContext(m_drawingBuffer->graphicsContext3D().get());
+        }
+
+        LayerChromium::setLayerRenderer(newLayerRenderer);
     }
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
index 81b118c..4224ab1 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
@@ -52,6 +52,8 @@ public:
     unsigned textureId() const;
     void setDrawingBuffer(DrawingBuffer*);
 
+    virtual void setLayerRenderer(LayerRendererChromium*);
+
 private:
     explicit Canvas2DLayerChromium(DrawingBuffer*, GraphicsLayerChromium* owner);
     DrawingBuffer* m_drawingBuffer;
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index 4ea9c92..aff2981 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -41,6 +41,14 @@
 #include "RenderLayerBacking.h"
 #include "TextStream.h"
 
+// Maximum size the width or height of this layer can be before enabling tiling
+// when m_tilingOption == AutoTile.
+static int maxUntiledSize = 512;
+// When tiling is enabled, use tiles of this dimension squared.
+static int defaultTileSize = 256;
+
+using namespace std;
+
 namespace WebCore {
 
 PassRefPtr<ContentLayerChromium> ContentLayerChromium::create(GraphicsLayerChromium* owner)
@@ -50,240 +58,171 @@ PassRefPtr<ContentLayerChromium> ContentLayerChromium::create(GraphicsLayerChrom
 
 ContentLayerChromium::ContentLayerChromium(GraphicsLayerChromium* owner)
     : LayerChromium(owner)
-    , m_contentsTexture(0)
-    , m_skipsDraw(false)
+    , m_tilingOption(ContentLayerChromium::AutoTile)
 {
 }
 
 ContentLayerChromium::~ContentLayerChromium()
 {
-    cleanupResources();
-}
-
-void ContentLayerChromium::cleanupResources()
-{
+    m_tiler.clear();
     LayerChromium::cleanupResources();
-    m_contentsTexture.clear();
 }
 
-bool ContentLayerChromium::requiresClippedUpdateRect()
-{
-    // To avoid allocating excessively large textures, switch into "large layer mode" if
-    // one of the layer's dimensions is larger than 2000 pixels or the size of
-    // surface it's rendering into. This is a temporary measure until layer tiling is implemented.
-    static const int maxLayerSize = 2000;
-    return (bounds().width() > max(maxLayerSize, ccLayerImpl()->targetRenderSurface()->contentRect().width())
-            || bounds().height() > max(maxLayerSize, ccLayerImpl()->targetRenderSurface()->contentRect().height())
-            || !layerRenderer()->checkTextureSize(bounds()));
-}
+class ContentLayerPainter : public TilePaintInterface {
+public:
+    explicit ContentLayerPainter(GraphicsLayerChromium* owner)
+        : m_owner(owner)
+    {
+    }
 
-void ContentLayerChromium::paintContentsIfDirty()
-{
-    RenderLayerBacking* backing = static_cast<RenderLayerBacking*>(m_owner->client());
-    if (!backing || backing->paintingGoesToWindow())
-        return;
+    virtual void paint(GraphicsContext& context, const IntRect& contentRect)
+    {
+        context.save();
+        context.clearRect(contentRect);
+        context.clip(contentRect);
+        m_owner->paintGraphicsLayerContents(context, contentRect);
+        context.restore();
+    }
+private:
+    GraphicsLayerChromium* m_owner;
+};
 
+void ContentLayerChromium::paintContentsIfDirty(const IntRect& targetSurfaceRect)
+{
     ASSERT(drawsContent());
-
     ASSERT(layerRenderer());
 
-    IntRect dirtyRect;
-    IntRect boundsRect(IntPoint(0, 0), bounds());
-    IntPoint paintingOffset;
-
-    // FIXME: Remove this test when tiled layers are implemented.
-    if (requiresClippedUpdateRect()) {
-        // Calculate the region of this layer that is currently visible.
-        const IntRect clipRect = ccLayerImpl()->targetRenderSurface()->contentRect();
-
-        TransformationMatrix layerOriginTransform = ccLayerImpl()->drawTransform();
-        layerOriginTransform.translate3d(-0.5 * bounds().width(), -0.5 * bounds().height(), 0);
-
-        // We compute the visible portion of the layer by back-mapping the current RenderSurface
-        // content area to the layer. To do that, we invert the drawing matrix of the layer
-        // and project the content area rectangle to it. If the layer transform is not invertible
-        // then we skip rendering the layer.
-        if (!layerOriginTransform.isInvertible()) {
-            m_skipsDraw = true;
-            return;
-        }
-        TransformationMatrix targetToLayerMatrix = layerOriginTransform.inverse();
-        FloatQuad mappedClipToLayer = targetToLayerMatrix.projectQuad(FloatRect(clipRect));
-        IntRect visibleRectInLayerCoords = mappedClipToLayer.enclosingBoundingBox();
-        visibleRectInLayerCoords.intersect(IntRect(0, 0, bounds().width(), bounds().height()));
-
-        // If this is still too large to render, then skip the layer completely.
-        if (!layerRenderer()->checkTextureSize(visibleRectInLayerCoords.size())) {
-            m_skipsDraw = true;
-            return;
-        }
-
-        // If we need to resize the upload buffer we have to repaint everything.
-        if (m_canvas.size() != visibleRectInLayerCoords.size()) {
-            resizeUploadBuffer(visibleRectInLayerCoords.size());
-            m_dirtyRect = boundsRect;
-        }
-        // If the visible portion of the layer is different from the last upload.
-        if (visibleRectInLayerCoords != m_visibleRectInLayerCoords)
-            m_dirtyRect = boundsRect;
-        m_visibleRectInLayerCoords = visibleRectInLayerCoords;
-
-        // Calculate the portion of the dirty rectangle that is visible.  m_dirtyRect is in layer space.
-        IntRect visibleDirtyRectInLayerSpace = enclosingIntRect(m_dirtyRect);
-        visibleDirtyRectInLayerSpace.intersect(visibleRectInLayerCoords);
-
-        // What the rectangles mean:
-        //   dirtyRect: The region of this layer that will be updated.
-        //   m_uploadUpdateRect: The region of the layer's texture that will be uploaded into.
-        dirtyRect = visibleDirtyRectInLayerSpace;
-        m_uploadUpdateRect = dirtyRect;
-        IntSize visibleRectOffsetInLayerCoords(visibleRectInLayerCoords.x(), visibleRectInLayerCoords.y());
-        paintingOffset = IntPoint(visibleRectOffsetInLayerCoords);
-        m_uploadUpdateRect.move(-visibleRectOffsetInLayerCoords);
-    } else {
-        dirtyRect = IntRect(m_dirtyRect);
-        // If the texture needs to be reallocated then we must redraw the entire
-        // contents of the layer.
-        if (m_canvas.size() != bounds()) {
-            resizeUploadBuffer(bounds());
-            dirtyRect = boundsRect;
-        } else {
-            // Clip the dirtyRect to the size of the layer to avoid drawing
-            // outside the bounds of the backing texture.
-            dirtyRect.intersect(boundsRect);
-        }
-        m_uploadUpdateRect = dirtyRect;
-    }
+    createTilerIfNeeded();
 
-    if (dirtyRect.isEmpty())
-        return;
+    ContentLayerPainter painter(m_owner);
+    updateLayerSize(layerBounds().size());
 
-    PlatformCanvas::Painter painter(&m_canvas);
-    painter.context()->save();
-    painter.context()->translate(-paintingOffset.x(), -paintingOffset.y());
-    painter.context()->clearRect(dirtyRect);
-    painter.context()->clip(dirtyRect);
+    IntRect layerRect = visibleLayerRect(targetSurfaceRect);
+    if (layerRect.isEmpty())
+        return;
+    m_tiler->invalidateRect(enclosingIntRect(m_dirtyRect));
+    m_tiler->update(painter, layerRect);
+    m_dirtyRect = FloatRect();
+}
 
-    m_owner->paintGraphicsLayerContents(*painter.context(), dirtyRect);
-    painter.context()->restore();
+void ContentLayerChromium::setLayerRenderer(LayerRendererChromium* layerRenderer)
+{
+    LayerChromium::setLayerRenderer(layerRenderer);
+    createTilerIfNeeded();
+    m_tiler->setLayerRenderer(layerRenderer);
 }
 
-void ContentLayerChromium::resizeUploadBuffer(const IntSize& size)
+TransformationMatrix ContentLayerChromium::tilingTransform()
 {
-    m_canvas.resize(size);
+    TransformationMatrix transform = ccLayerImpl()->drawTransform();
+    // Tiler draws from the upper left corner. The draw transform
+    // specifies the middle of the layer.
+    IntSize size = bounds();
+    transform.translate(-size.width() / 2.0, -size.height() / 2.0);
+
+    return transform;
 }
 
-void ContentLayerChromium::updateTextureIfNeeded()
+IntRect ContentLayerChromium::visibleLayerRect(const IntRect& targetSurfaceRect)
+{
+    if (targetSurfaceRect.isEmpty())
+        return targetSurfaceRect;
+
+    const IntRect layerBoundRect = layerBounds();
+    const TransformationMatrix transform = tilingTransform();
+
+    // Is this layer fully contained within the target surface?
+    IntRect layerInSurfaceSpace = transform.mapRect(layerBoundRect);
+    if (targetSurfaceRect.contains(layerInSurfaceSpace))
+        return layerBoundRect;
+
+    // If the layer doesn't fill up the entire surface, then find the part of
+    // the surface rect where the layer could be visible. This avoids trying to
+    // project surface rect points that are behind the projection point.
+    IntRect minimalSurfaceRect = targetSurfaceRect;
+    minimalSurfaceRect.intersect(layerInSurfaceSpace);
+
+    // Project the corners of the target surface rect into the layer space.
+    // This bounding rectangle may be larger than it needs to be (being
+    // axis-aligned), but is a reasonable filter on the space to consider.
+    // Non-invertible transforms will create an empty rect here.
+    const TransformationMatrix surfaceToLayer = transform.inverse();
+    IntRect layerRect = surfaceToLayer.projectQuad(FloatQuad(FloatRect(minimalSurfaceRect))).enclosingBoundingBox();
+    layerRect.intersect(layerBoundRect);
+    return layerRect;
+}
+
+IntRect ContentLayerChromium::layerBounds() const
 {
-    PlatformCanvas::AutoLocker locker(&m_canvas);
-    updateTexture(locker.pixels(), m_canvas.size());
+    return IntRect(IntPoint(0, 0), bounds());
 }
 
-void ContentLayerChromium::updateTexture(const uint8_t* pixels, const IntSize& size)
+void ContentLayerChromium::updateLayerSize(const IntSize& layerSize)
 {
-    if (!pixels)
+    if (!m_tiler)
         return;
 
-    GraphicsContext3D* context = layerRendererContext();
-    if (!m_contentsTexture)
-        m_contentsTexture = LayerTexture::create(context, layerRenderer()->textureManager());
+    const IntSize tileSize(min(defaultTileSize, layerSize.width()), min(defaultTileSize, layerSize.height()));
+    const bool autoTiled = layerSize.width() > maxUntiledSize || layerSize.height() > maxUntiledSize;
 
-    // If we have to allocate a new texture we have to upload the full contents.
-    if (!m_contentsTexture->isValid(size, GraphicsContext3D::RGBA))
-        m_uploadUpdateRect = IntRect(IntPoint(0, 0), size);
+    bool isTiled;
+    if (m_tilingOption == AlwaysTile)
+        isTiled = true;
+    else if (m_tilingOption == NeverTile)
+        isTiled = false;
+    else
+        isTiled = autoTiled;
 
-    if (!m_contentsTexture->reserve(size, GraphicsContext3D::RGBA)) {
-        m_skipsDraw = true;
-        return;
-    }
-
-    IntRect srcRect = IntRect(IntPoint(0, 0), size);
-    if (requiresClippedUpdateRect())
-        srcRect = m_visibleRectInLayerCoords;
-
-    const size_t destStride = m_uploadUpdateRect.width() * 4;
-    const size_t srcStride = srcRect.width() * 4;
-
-    const uint8_t* uploadPixels = pixels + srcStride * m_uploadUpdateRect.y();
-    Vector<uint8_t> uploadBuffer;
-    if (srcStride != destStride || m_uploadUpdateRect.x()) {
-        uploadBuffer.resize(m_uploadUpdateRect.height() * destStride);
-        for (int row = 0; row < m_uploadUpdateRect.height(); ++row) {
-            size_t srcOffset = (m_uploadUpdateRect.y() + row) * srcStride + m_uploadUpdateRect.x() * 4;
-            ASSERT(srcOffset + destStride <= static_cast<size_t>(size.width() * size.height() * 4));
-            size_t destOffset = row * destStride;
-            ASSERT(destOffset  + destStride <= uploadBuffer.size());
-            memcpy(uploadBuffer.data() + destOffset, pixels + srcOffset, destStride);
-        }
-        uploadPixels = uploadBuffer.data();
-    }
-
-    m_contentsTexture->bindTexture();
-    GLC(context, context->texSubImage2D(GraphicsContext3D::TEXTURE_2D, 0,
-                                        m_uploadUpdateRect.x(), m_uploadUpdateRect.y(), m_uploadUpdateRect.width(), m_uploadUpdateRect.height(),
-                                        GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE,
-                                        uploadPixels));
+    m_tiler->setTileSize(isTiled ? tileSize : layerSize);
+}
 
-    m_uploadUpdateRect = IntRect();
-    m_dirtyRect.setSize(FloatSize());
-    // Large layers always stay dirty, because they need to update when the content rect changes.
-    m_contentsDirty = requiresClippedUpdateRect();
+void ContentLayerChromium::draw(const IntRect& targetSurfaceRect)
+{
+    const TransformationMatrix transform = tilingTransform();
+    IntRect layerRect = visibleLayerRect(targetSurfaceRect);
+    if (!layerRect.isEmpty())
+        m_tiler->draw(layerRect, transform, ccLayerImpl()->drawOpacity());
+    m_tiler->unreserveTextures();
 }
 
-void ContentLayerChromium::draw()
+void ContentLayerChromium::createTilerIfNeeded()
 {
-    if (m_skipsDraw)
+    if (m_tiler)
         return;
+    m_tiler = LayerTilerChromium::create(layerRenderer(), IntSize(defaultTileSize, defaultTileSize), LayerTilerChromium::HasBorderTexels);
+}
 
-    ASSERT(layerRenderer());
+void ContentLayerChromium::updateCompositorResources()
+{
+    m_tiler->uploadCanvas();
+}
 
-    const ContentLayerChromium::Program* program = layerRenderer()->contentLayerProgram();
-    ASSERT(program && program->initialized());
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-    bindContentsTexture();
-    layerRenderer()->useShader(program->program());
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-    GLC(context, context->blendFunc(GraphicsContext3D::ONE, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
-
-    if (requiresClippedUpdateRect()) {
-        // Compute the offset between the layer's center point and the center of the visible portion
-        // of the layer.
-        FloatPoint visibleRectCenterOffset = FloatRect(m_visibleRectInLayerCoords).center();
-        visibleRectCenterOffset.move(-0.5 * bounds().width(), -0.5 * bounds().height());
-
-        TransformationMatrix transform = ccLayerImpl()->drawTransform();
-        transform.translate(visibleRectCenterOffset.x(), visibleRectCenterOffset.y());
-
-        drawTexturedQuad(context, layerRenderer()->projectionMatrix(),
-                         transform, m_visibleRectInLayerCoords.width(),
-                         m_visibleRectInLayerCoords.height(), ccLayerImpl()->drawOpacity(),
-                         program->vertexShader().matrixLocation(),
-                         program->fragmentShader().alphaLocation());
-    } else {
-        drawTexturedQuad(context, layerRenderer()->projectionMatrix(),
-                         ccLayerImpl()->drawTransform(), bounds().width(), bounds().height(),
-                         ccLayerImpl()->drawOpacity(), program->vertexShader().matrixLocation(),
-                         program->fragmentShader().alphaLocation());
-    }
-    unreserveContentsTexture();
+void ContentLayerChromium::setTilingOption(TilingOption option)
+{
+    m_tilingOption = option;
+    updateLayerSize(bounds());
 }
 
-void ContentLayerChromium::updateCompositorResources()
+void ContentLayerChromium::bindContentsTexture()
 {
-    updateTextureIfNeeded();
+    // This function is only valid for single texture layers, e.g. masks.
+    ASSERT(m_tilingOption == NeverTile);
+    ASSERT(m_tiler);
+
+    LayerTexture* texture = m_tiler->getSingleTexture();
+    ASSERT(texture);
+
+    texture->bindTexture();
 }
 
 void ContentLayerChromium::unreserveContentsTexture()
 {
-    if (!m_skipsDraw && m_contentsTexture)
-        m_contentsTexture->unreserve();
+    m_tiler->unreserveTextures();
 }
 
-void ContentLayerChromium::bindContentsTexture()
+void ContentLayerChromium::setIsMask(bool isMask)
 {
-    if (!m_skipsDraw && m_contentsTexture)
-        m_contentsTexture->bindTexture();
+    setTilingOption(isMask ? NeverTile : AutoTile);
 }
 
 static void writeIndent(TextStream& ts, int indent)
@@ -296,7 +235,7 @@ void ContentLayerChromium::dumpLayerProperties(TextStream& ts, int indent) const
 {
     LayerChromium::dumpLayerProperties(ts, indent);
     writeIndent(ts, indent);
-    ts << "skipsDraw: " << m_skipsDraw << "\n";
+    ts << "skipsDraw: " << m_tiler->skipsDraw() << "\n";
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index cf296ab..c0cf582 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -35,7 +35,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "LayerChromium.h"
-#include "PlatformCanvas.h"
+#include "LayerTilerChromium.h"
 #include "TextureManager.h"
 
 namespace WebCore {
@@ -46,43 +46,43 @@ class LayerTexture;
 class ContentLayerChromium : public LayerChromium {
     friend class LayerRendererChromium;
 public:
+    enum TilingOption { AlwaysTile, NeverTile, AutoTile };
+
     static PassRefPtr<ContentLayerChromium> create(GraphicsLayerChromium* owner = 0);
 
     virtual ~ContentLayerChromium();
 
-    virtual void paintContentsIfDirty();
+    virtual void paintContentsIfDirty(const IntRect& targetSurfaceRect);
     virtual void updateCompositorResources();
+    virtual void setIsMask(bool);
     virtual void unreserveContentsTexture();
     virtual void bindContentsTexture();
 
-    virtual void draw();
-    virtual bool drawsContent() const { return m_owner && m_owner->drawsContent(); }
-
-    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderTexAlpha> Program;
+    virtual void draw(const IntRect& targetSurfaceRect);
+    virtual bool drawsContent() const { return m_owner && m_owner->drawsContent() && (!m_tiler || !m_tiler->skipsDraw()); }
 
 protected:
     explicit ContentLayerChromium(GraphicsLayerChromium* owner);
 
-    virtual void cleanupResources();
-    bool requiresClippedUpdateRect();
-    void resizeUploadBuffer(const IntSize&);
-
     virtual const char* layerTypeAsString() const { return "ContentLayer"; }
     virtual void dumpLayerProperties(TextStream&, int indent) const;
 
-    OwnPtr<LayerTexture> m_contentsTexture;
-    bool m_skipsDraw;
+    virtual void setLayerRenderer(LayerRendererChromium*);
+
+    virtual IntRect layerBounds() const;
 
-    // The portion of the upload buffer that has a pending update, in the coordinates of the texture.
-    IntRect m_uploadUpdateRect;
+    virtual TransformationMatrix tilingTransform();
 
-    virtual void updateTextureIfNeeded();
-    void updateTexture(const uint8_t* pixels, const IntSize&);
+    // For a given render surface rect that this layer will be transformed and
+    // drawn into, return the layer space rect that is visible in that surface.
+    IntRect visibleLayerRect(const IntRect&);
 
-private:
-    PlatformCanvas m_canvas;
+    void updateLayerSize(const IntSize&);
+    void createTilerIfNeeded();
+    void setTilingOption(TilingOption);
 
-    IntRect m_visibleRectInLayerCoords;
+    OwnPtr<LayerTilerChromium> m_tiler;
+    TilingOption m_tilingOption;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index e559edb..bad0c6c 100644
--- a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -76,7 +76,7 @@ DrawingBuffer::DrawingBuffer(GraphicsContext3D* context,
                              bool multisampleExtensionSupported,
                              bool packedDepthStencilExtensionSupported)
     : m_context(context)
-    , m_size(size)
+    , m_size(-1, -1)
     , m_multisampleExtensionSupported(multisampleExtensionSupported)
     , m_packedDepthStencilExtensionSupported(packedDepthStencilExtensionSupported)
     , m_fbo(0)
@@ -173,6 +173,29 @@ void DrawingBuffer::setGrContext(GrContext* context)
     // the SharedGraphicsContext3D object that is giving us the context.
     m_grContext = context;
 }
+
+void DrawingBuffer::getGrPlatformSurfaceDesc(GrPlatformSurfaceDesc* desc)
+{
+    desc->fSurfaceType = kTextureRenderTarget_GrPlatformSurfaceType;
+
+    desc->fPlatformTexture = m_colorBuffer;
+    if (multisample()) {
+        desc->fRenderTargetFlags = kIsMultisampled_GrPlatformRenderTargetFlagBit | kGrCanResolve_GrPlatformRenderTargetFlagBit;
+        desc->fPlatformRenderTarget = m_multisampleFBO;
+        desc->fPlatformResolveDestination = m_fbo;
+    } else {
+        desc->fRenderTargetFlags = kNone_GrPlatformRenderTargetFlagBit;
+        desc->fPlatformRenderTarget = m_fbo;
+        desc->fPlatformResolveDestination = 0;
+    }
+
+    desc->fWidth = m_size.width();
+    desc->fHeight = m_size.height();
+    desc->fConfig = kRGBA_8888_GrPixelConfig;
+
+    desc->fStencilBits = (m_depthStencilBuffer || m_stencilBuffer) ? 8 : 0;
+}
+
 #endif
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
index 3b0fdbf..c542351 100644
--- a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
@@ -43,6 +43,7 @@ public:
     // Extensions3D methods.
     virtual bool supports(const String&);
     virtual void ensureEnabled(const String&);
+    virtual bool isEnabled(const String&);
     virtual int getGraphicsResetStatusARB();
     virtual void blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter);
     virtual void renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height);
@@ -66,6 +67,12 @@ public:
     // GL_CHROMIUM_copy_texture_to_parent_texture
     void copyTextureToParentTextureCHROMIUM(unsigned texture, unsigned parentTexture);
 
+    // Latch support
+    void getParentToChildLatchCHROMIUM(GC3Duint* latchId);
+    void getChildToParentLatchCHROMIUM(GC3Duint* latchId);
+    void waitLatchCHROMIUM(GC3Duint latchId);
+    void setLatchCHROMIUM(GC3Duint latchId);
+
 private:
     // Instances of this class are strictly owned by the GraphicsContext3D implementation and do not
     // need to be instantiated by any other code.
diff --git a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index 3c254dc..ac1e1af 100644
--- a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -43,7 +43,7 @@
 #include "TransparencyWin.h"
 #include "UniscribeHelperTextRun.h"
 
-#include "skia/ext/platform_canvas_win.h"
+#include "skia/ext/platform_canvas.h"
 #include "skia/ext/skia_utils_win.h"  // FIXME: remove this dependency.
 
 #include <windows.h>
@@ -165,7 +165,7 @@ void TransparencyAwareFontPainter::initializeForGDI()
 
     // Set up the DC, using the one from the transparency helper.
     if (m_transparency.platformContext()) {
-        m_hdc = m_transparency.platformContext()->canvas()->beginPlatformPaint();
+        m_hdc = skia::BeginPlatformPaint(m_transparency.platformContext()->canvas());
         SetTextColor(m_hdc, skia::SkColorToCOLORREF(color));
         SetBkMode(m_hdc, TRANSPARENT);
     }
@@ -179,7 +179,7 @@ TransparencyAwareFontPainter::~TransparencyAwareFontPainter()
     if (m_createdTransparencyLayer)
         m_graphicsContext->endTransparencyLayer();
     m_graphicsContext->restore();
-    m_platformContext->canvas()->endPlatformPaint();
+    skia::EndPlatformPaint(m_platformContext->canvas());
 }
 
 // Specialization for simple GlyphBuffer painting.
@@ -374,21 +374,14 @@ bool Font::canExpandAroundIdeographsInComplexText()
     return false;
 }
 
-void Font::drawGlyphs(GraphicsContext* graphicsContext,
-                      const SimpleFontData* font,
-                      const GlyphBuffer& glyphBuffer,
-                      int from,
-                      int numGlyphs,
-                      const FloatPoint& point) const
-{
+static void drawGlyphsWin(GraphicsContext* graphicsContext,
+                          const SimpleFontData* font,
+                          const GlyphBuffer& glyphBuffer,
+                          int from,
+                          int numGlyphs,
+                          const FloatPoint& point) {
     graphicsContext->platformContext()->prepareForSoftwareDraw();
 
-    SkColor color = graphicsContext->platformContext()->effectiveFillColor();
-    unsigned char alpha = SkColorGetA(color);
-    // Skip 100% transparent text; no need to draw anything.
-    if (!alpha && graphicsContext->platformContext()->getStrokeStyle() == NoStroke)
-        return;
-
     TransparencyAwareGlyphPainter painter(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
 
     // We draw the glyphs in chunks to avoid having to do a heap allocation for
@@ -449,6 +442,39 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext,
     }
 }
 
+void Font::drawGlyphs(GraphicsContext* graphicsContext,
+                      const SimpleFontData* font,
+                      const GlyphBuffer& glyphBuffer,
+                      int from,
+                      int numGlyphs,
+                      const FloatPoint& point) const
+{
+    SkColor color = graphicsContext->platformContext()->effectiveFillColor();
+    unsigned char alpha = SkColorGetA(color);
+    // Skip 100% transparent text; no need to draw anything.
+    if (!alpha && graphicsContext->platformContext()->getStrokeStyle() == NoStroke && !graphicsContext->hasShadow())
+        return;
+    if (!alpha || windowsCanHandleDrawTextShadow(graphicsContext) || !windowsCanHandleTextDrawingWithoutShadow(graphicsContext)) {
+        drawGlyphsWin(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
+        return;
+    }
+    // Draw in two passes: skia for the shadow, GDI for foreground text
+    // pass1: shadow (will use skia)
+    graphicsContext->save();
+    graphicsContext->setFillColor(Color::transparent, graphicsContext->fillColorSpace());
+    drawGlyphsWin(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
+    graphicsContext->restore();
+    // pass2: foreground text (will use GDI)
+    FloatSize shadowOffset;
+    float shadowBlur;
+    Color shadowColor;
+    ColorSpace shadowColorSpace;
+    graphicsContext->getShadow(shadowOffset, shadowBlur, shadowColor, shadowColorSpace);
+    graphicsContext->setShadow(shadowOffset, shadowBlur, Color::transparent, shadowColorSpace);
+    drawGlyphsWin(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
+    graphicsContext->setShadow(shadowOffset, shadowBlur, shadowColor, shadowColorSpace);
+}
+
 FloatRect Font::selectionRectForComplexText(const TextRun& run,
                                             const FloatPoint& point,
                                             int h,
@@ -516,7 +542,7 @@ void Font::drawComplexText(GraphicsContext* graphicsContext,
     // the baseline, so we have to subtract off the ascent.
     state.draw(graphicsContext, hdc, lroundf(point.x()), lroundf(point.y() - fontMetrics().ascent()), from, to);
 
-    context->canvas()->endPlatformPaint();
+    skia::EndPlatformPaint(context->canvas());
 }
 
 void Font::drawEmphasisMarksForComplexText(GraphicsContext* /* context */, const TextRun& /* run */, const AtomicString& /* mark */, const FloatPoint& /* point */, int /* from */, int /* to */) const
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
index c3edfac..1fb5957 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
@@ -122,7 +122,7 @@ int FontPlatformData::emSizeInFontUnits() const
     if (m_emSizeInFontUnits)
         return m_emSizeInFontUnits;
 
-    SkAdvancedTypefaceMetrics* metrics = m_typeface->getAdvancedTypefaceMetrics(false);
+    SkAdvancedTypefaceMetrics* metrics = m_typeface->getAdvancedTypefaceMetrics(SkAdvancedTypefaceMetrics::kNo_PerGlyphInfo);
     m_emSizeInFontUnits = metrics->fEmSize;
     metrics->unref();
     return m_emSizeInFontUnits;
diff --git a/Source/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
index bea0572..a4798dd 100644
--- a/Source/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
@@ -250,17 +250,31 @@ int getAscent(HFONT hfont)
     return gotMetrics ? tm.tmAscent : kUndefinedAscent;
 }
 
+WORD getSpaceGlyph(HFONT hfont) 
+{
+    HDC dc = GetDC(0);
+    HGDIOBJ oldFont = SelectObject(dc, hfont);
+    WCHAR space = L' ';
+    WORD spaceGlyph = 0;
+    GetGlyphIndices(dc, &space, 1, &spaceGlyph, 0);
+    SelectObject(dc, oldFont);
+    ReleaseDC(0, dc);
+    return spaceGlyph;
+}
+
 struct FontData {
     FontData()
         : hfont(0)
         , ascent(kUndefinedAscent)
         , scriptCache(0)
+        , spaceGlyph(0)
     {
     }
 
     HFONT hfont;
     int ascent;
     mutable SCRIPT_CACHE scriptCache;
+    WORD spaceGlyph;
 };
 
 // Again, using hash_map does not earn us much here.  page_cycler_test intl2
@@ -379,7 +393,8 @@ bool getDerivedFontData(const UChar* family,
                         LOGFONT* logfont,
                         int* ascent,
                         HFONT* hfont,
-                        SCRIPT_CACHE** scriptCache)
+                        SCRIPT_CACHE** scriptCache,
+                        WORD* spaceGlyph)
 {
     ASSERT(logfont);
     ASSERT(family);
@@ -408,6 +423,7 @@ bool getDerivedFontData(const UChar* family,
         // cache it so that we won't have to call CreateFontIndirect once
         // more for HFONT next time.
         derived->ascent = getAscent(derived->hfont);
+        derived->spaceGlyph = getSpaceGlyph(derived->hfont);
     } else {
         derived = &iter->second;
         // Last time, GetAscent failed so that only HFONT was
@@ -419,6 +435,7 @@ bool getDerivedFontData(const UChar* family,
     *hfont = derived->hfont;
     *ascent = derived->ascent;
     *scriptCache = &(derived->scriptCache);
+    *spaceGlyph = derived->spaceGlyph;
     return *ascent != kUndefinedAscent;
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.h b/Source/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.h
index b637ede..d9de002 100644
--- a/Source/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.h
+++ b/Source/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.h
@@ -78,7 +78,7 @@ const UChar* getFallbackFamily(const UChar* characters, int length,
 // intl2 page-cycler test is noticeably slower with one out param than
 // the current version although the subsequent 9 passes take about the
 // same time.
-bool getDerivedFontData(const UChar* family, int style, LOGFONT*, int* ascent, HFONT*, SCRIPT_CACHE**);
+bool getDerivedFontData(const UChar* family, int style, LOGFONT*, int* ascent, HFONT*, SCRIPT_CACHE**, WORD* spaceGlyph);
 
 enum {
     FontStyleNormal = 0,
diff --git a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
index cc5a060..87d54b0 100644
--- a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
@@ -38,6 +38,7 @@
 #include "GraphicsContext3D.h"
 #include "internal_glu.h"
 #include "IntRect.h"
+#include "LoopBlinnMathUtils.h"
 #include "LoopBlinnPathProcessor.h"
 #include "LoopBlinnSolidFillShader.h"
 #include "Path.h"
@@ -60,7 +61,7 @@ namespace WebCore {
 const int pathTesselation = 30;
 typedef void (GLAPIENTRY *TESSCB)();
 typedef WTF::Vector<float> FloatVector;
-typedef WTF::Vector<double> DoubleVector;
+typedef WTF::Vector<FloatPoint> FloatPointVector;
 
 struct PathAndTransform {
     PathAndTransform(const Path& p, const AffineTransform& t)
@@ -186,7 +187,7 @@ class Cubic {
         FloatPoint d = -1.0f * p0 + 3.0f * p1s - 3.0f * p2s + p3s;
         return Cubic(p0, b, c, d);
     }
-    FloatPoint evaluate(float t)
+    inline FloatPoint evaluate(float t)
     {
         return m_a + t * (m_b + t * (m_c + t * m_d));
     }
@@ -198,6 +199,7 @@ GLES2Canvas::GLES2Canvas(SharedGraphicsContext3D* context, DrawingBuffer* drawin
     , m_context(context)
     , m_drawingBuffer(drawingBuffer)
     , m_state(0)
+    , m_pathIndexBuffer(0)
     , m_pathVertexBuffer(0)
 {
     m_flipMatrix.translate(-1.0f, 1.0f);
@@ -209,6 +211,10 @@ GLES2Canvas::GLES2Canvas(SharedGraphicsContext3D* context, DrawingBuffer* drawin
 
 GLES2Canvas::~GLES2Canvas()
 {
+    if (m_pathIndexBuffer)
+        m_context->graphicsContext3D()->deleteBuffer(m_pathIndexBuffer);
+    if (m_pathVertexBuffer)
+        m_context->graphicsContext3D()->deleteBuffer(m_pathVertexBuffer);
 }
 
 void GLES2Canvas::bindFramebuffer()
@@ -229,6 +235,13 @@ void GLES2Canvas::clearRect(const FloatRect& rect)
     }
 }
 
+void GLES2Canvas::applyState()
+{
+    bindFramebuffer();
+    m_context->applyCompositeOperator(m_state->m_compositeOp);
+    applyClipping(m_state->clippingEnabled());
+}
+
 void GLES2Canvas::scissorClear(float x, float y, float width, float height)
 {
     int intX = static_cast<int>(x + 0.5f);
@@ -250,10 +263,7 @@ void GLES2Canvas::fillPath(const Path& path)
         endShadowDraw(path.boundingRect());
     }
 
-    bindFramebuffer();
-    m_context->applyCompositeOperator(m_state->m_compositeOp);
-    applyClipping(m_state->clippingEnabled());
-
+    applyState();
     fillPathInternal(path, m_state->applyAlpha(m_state->m_fillColor));
 }
 
@@ -265,10 +275,7 @@ void GLES2Canvas::fillRect(const FloatRect& rect, const Color& color, ColorSpace
         endShadowDraw(rect);
     }
 
-    bindFramebuffer();
-    m_context->applyCompositeOperator(m_state->m_compositeOp);
-    applyClipping(m_state->clippingEnabled());
-
+    applyState();
     fillRectInternal(rect, color);
 }
 
@@ -546,38 +553,30 @@ Texture* GLES2Canvas::getTexture(NativeImagePtr ptr)
 #if USE(SKIA)
 // This is actually cross-platform code, but since its only caller is inside a
 // USE(SKIA), it will cause a warning-as-error on Chrome/Mac.
-static void interpolateQuadratic(DoubleVector* vertices, const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2)
+static void interpolateQuadratic(FloatPointVector* vertices, const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2)
 {
     float tIncrement = 1.0f / pathTesselation, t = tIncrement;
     Quadratic c = Quadratic::fromBezier(p0, p1, p2);
-    for (int i = 0; i < pathTesselation; ++i, t += tIncrement) {
-        FloatPoint p = c.evaluate(t);
-        vertices->append(p.x());
-        vertices->append(p.y());
-        vertices->append(1.0);
-    }
+    for (int i = 0; i < pathTesselation; ++i, t += tIncrement)
+        vertices->append(c.evaluate(t));
 }
 
-static void interpolateCubic(DoubleVector* vertices, const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2, const FloatPoint& p3)
+static void interpolateCubic(FloatPointVector* vertices, const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2, const FloatPoint& p3)
 {
     float tIncrement = 1.0f / pathTesselation, t = tIncrement;
     Cubic c = Cubic::fromBezier(p0, p1, p2, p3);
-    for (int i = 0; i < pathTesselation; ++i, t += tIncrement) {
-        FloatPoint p = c.evaluate(t);
-        vertices->append(p.x());
-        vertices->append(p.y());
-        vertices->append(1.0);
-    }
+    for (int i = 0; i < pathTesselation; ++i, t += tIncrement)
+        vertices->append(c.evaluate(t));
 }
 #endif
 
 struct PolygonData {
-    PolygonData(FloatVector* vertices, WTF::Vector<short>* indices)
+    PolygonData(FloatPointVector* vertices, WTF::Vector<short>* indices)
       : m_vertices(vertices)
       , m_indices(indices)
     {
     }
-    FloatVector* m_vertices;
+    FloatPointVector* m_vertices;
     WTF::Vector<short>* m_indices;
 };
 
@@ -603,22 +602,24 @@ static void combineData(GLdouble coords[3], void* vertexData[4],
                                  GLfloat weight[4], void **outData, void* data)
 {
     PolygonData* polygonData = static_cast<PolygonData*>(data);
-    int index = polygonData->m_vertices->size() / 3;
-    polygonData->m_vertices->append(static_cast<float>(coords[0]));
-    polygonData->m_vertices->append(static_cast<float>(coords[1]));
-    polygonData->m_vertices->append(1.0f);
+    int index = polygonData->m_vertices->size();
+    polygonData->m_vertices->append(FloatPoint(static_cast<float>(coords[0]), static_cast<float>(coords[1])));
     *outData = reinterpret_cast<void*>(index);
 }
 
 typedef void (*TESSCB)();
 
-void GLES2Canvas::createVertexBufferFromPath(const Path& path, int* count, unsigned* vertexBuffer, unsigned* indexBuffer)
+void GLES2Canvas::tesselateAndFillPath(const Path& path, const Color& color)
 {
-    *vertexBuffer = m_context->graphicsContext3D()->createBuffer();
-    checkGLError("createVertexBufferFromPath, createBuffer");
-    *indexBuffer = m_context->graphicsContext3D()->createBuffer();
-    checkGLError("createVertexBufferFromPath, createBuffer");
-    DoubleVector inVertices;
+    if (!m_pathVertexBuffer)
+        m_pathVertexBuffer = m_context->graphicsContext3D()->createBuffer();
+    if (!m_pathIndexBuffer)
+        m_pathIndexBuffer = m_context->graphicsContext3D()->createBuffer();
+
+    AffineTransform matrix(m_flipMatrix);
+    matrix *= m_state->m_ctm;
+
+    FloatPointVector inVertices;
     WTF::Vector<size_t> contours;
 #if USE(SKIA)
     const SkPath* skPath = path.platformPath();
@@ -628,14 +629,10 @@ void GLES2Canvas::createVertexBufferFromPath(const Path& path, int* count, unsig
     while ((verb = iter.next(pts)) != SkPath::kDone_Verb) {
         switch (verb) {
         case SkPath::kMove_Verb:
-            inVertices.append(pts[0].fX);
-            inVertices.append(pts[0].fY);
-            inVertices.append(1.0);
+            inVertices.append(pts[0]);
             break;
         case SkPath::kLine_Verb:
-            inVertices.append(pts[1].fX);
-            inVertices.append(pts[1].fY);
-            inVertices.append(1.0);
+            inVertices.append(pts[1]);
             break;
         case SkPath::kQuad_Verb:
             interpolateQuadratic(&inVertices, pts[0], pts[1], pts[2]);
@@ -644,7 +641,7 @@ void GLES2Canvas::createVertexBufferFromPath(const Path& path, int* count, unsig
             interpolateCubic(&inVertices, pts[0], pts[1], pts[2], pts[3]);
             break;
         case SkPath::kClose_Verb:
-            contours.append(inVertices.size() / 3);
+            contours.append(inVertices.size());
             break;
         case SkPath::kDone_Verb:
             break;
@@ -654,6 +651,21 @@ void GLES2Canvas::createVertexBufferFromPath(const Path& path, int* count, unsig
     ASSERT(!"Path extraction not implemented on this platform.");
 #endif
 
+    if (contours.size() == 1 && LoopBlinnMathUtils::isConvex(inVertices.begin(), inVertices.size())) {
+        m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_pathVertexBuffer);
+        m_context->graphicsContext3D()->bufferData(GraphicsContext3D::ARRAY_BUFFER, inVertices.size() * 2 * sizeof(float), inVertices.data(), GraphicsContext3D::STREAM_DRAW);
+        m_context->useFillSolidProgram(matrix, color);
+        m_context->graphicsContext3D()->drawArrays(GraphicsContext3D::TRIANGLE_FAN, 0, inVertices.size());
+        return;
+    }
+
+    OwnArrayPtr<double> inVerticesDouble = adoptArrayPtr(new double[inVertices.size() * 3]);
+    for (size_t i = 0; i < inVertices.size(); ++i) {
+        inVerticesDouble[i * 3    ] = inVertices[i].x();
+        inVerticesDouble[i * 3 + 1] = inVertices[i].y();
+        inVerticesDouble[i * 3 + 2] = 1.0;
+    }
+
     GLUtesselator* tess = internal_gluNewTess();
     internal_gluTessProperty(tess, GLU_TESS_WINDING_RULE, GLU_TESS_WINDING_NONZERO);
     internal_gluTessCallback(tess, GLU_TESS_BEGIN_DATA, (TESSCB) &beginData);
@@ -662,7 +674,7 @@ void GLES2Canvas::createVertexBufferFromPath(const Path& path, int* count, unsig
     internal_gluTessCallback(tess, GLU_TESS_EDGE_FLAG_DATA, (TESSCB) &edgeFlagData);
     internal_gluTessCallback(tess, GLU_TESS_COMBINE_DATA, (TESSCB) &combineData);
     WTF::Vector<short> indices;
-    FloatVector vertices;
+    FloatPointVector vertices;
     vertices.reserveInitialCapacity(inVertices.size());
     PolygonData data(&vertices, &indices);
     internal_gluTessBeginPolygon(tess, &data);
@@ -671,26 +683,27 @@ void GLES2Canvas::createVertexBufferFromPath(const Path& path, int* count, unsig
     for (contour = contours.begin(); contour != contours.end(); ++contour) {
         internal_gluTessBeginContour(tess);
         for (; i < *contour; ++i) {
-            vertices.append(inVertices[i * 3]);
-            vertices.append(inVertices[i * 3 + 1]);
-            vertices.append(1.0f);
-            internal_gluTessVertex(tess, &inVertices[i * 3], reinterpret_cast<void*>(i));
+            double* inVertex = &inVerticesDouble[i * 3];
+            vertices.append(FloatPoint(inVertex[0], inVertex[1]));
+            internal_gluTessVertex(tess, inVertex, reinterpret_cast<void*>(i));
         }
         internal_gluTessEndContour(tess);
     }
     internal_gluTessEndPolygon(tess);
     internal_gluDeleteTess(tess);
 
-    m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, *vertexBuffer);
+    m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_pathVertexBuffer);
     checkGLError("createVertexBufferFromPath, bindBuffer ARRAY_BUFFER");
-    m_context->graphicsContext3D()->bufferData(GraphicsContext3D::ARRAY_BUFFER, vertices.size() * sizeof(float), vertices.data(), GraphicsContext3D::STREAM_DRAW);
+    m_context->graphicsContext3D()->bufferData(GraphicsContext3D::ARRAY_BUFFER, vertices.size() * 2 * sizeof(float), vertices.data(), GraphicsContext3D::STREAM_DRAW);
     checkGLError("createVertexBufferFromPath, bufferData ARRAY_BUFFER");
 
-    m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, *indexBuffer);
+    m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, m_pathIndexBuffer);
     checkGLError("createVertexBufferFromPath, bindBuffer ELEMENT_ARRAY_BUFFER");
     m_context->graphicsContext3D()->bufferData(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, indices.size() * sizeof(short), indices.data(), GraphicsContext3D::STREAM_DRAW);
     checkGLError("createVertexBufferFromPath, bufferData ELEMENT_ARRAY_BUFFER");
-    *count = indices.size();
+
+    m_context->useFillSolidProgram(matrix, color);
+    m_context->graphicsContext3D()->drawElements(GraphicsContext3D::TRIANGLES, indices.size(), GraphicsContext3D::UNSIGNED_SHORT, 0);
 }
 
 void GLES2Canvas::fillPathInternal(const Path& path, const Color& color)
@@ -723,29 +736,7 @@ void GLES2Canvas::fillPathInternal(const Path& path, const Color& color)
         m_context->useLoopBlinnInteriorProgram(byteSizeOfVertices + byteSizeOfTexCoords, matrix, color);
         m_context->drawArrays(GraphicsContext3D::TRIANGLES, 0, m_pathCache.numberOfInteriorVertices());
     } else {
-        int count;
-        unsigned vertexBuffer, indexBuffer;
-        createVertexBufferFromPath(path, &count, &vertexBuffer, &indexBuffer);
-
-        AffineTransform matrix(m_flipMatrix);
-        matrix *= m_state->m_ctm;
-
-        m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, vertexBuffer);
-        checkGLError("bindBuffer");
-        m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, indexBuffer);
-        checkGLError("bindBuffer");
-
-        m_context->useFillSolidProgram(matrix, color);
-        checkGLError("useFillSolidProgram");
-
-        m_context->graphicsContext3D()->drawElements(GraphicsContext3D::TRIANGLES, count, GraphicsContext3D::UNSIGNED_SHORT, 0);
-        checkGLError("drawArrays");
-
-        m_context->graphicsContext3D()->deleteBuffer(vertexBuffer);
-        checkGLError("deleteBuffer");
-
-        m_context->graphicsContext3D()->deleteBuffer(indexBuffer);
-        checkGLError("deleteBuffer");
+        tesselateAndFillPath(path, color);
     }
 }
 
@@ -787,9 +778,7 @@ void GLES2Canvas::beginShadowDraw()
         m_context->clearColor(Color(RGBA32(0)));
         m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT);
     } else {
-        bindFramebuffer();
-        m_context->applyCompositeOperator(m_state->m_compositeOp);
-        applyClipping(m_state->clippingEnabled());
+        applyState();
     }
 }
 
@@ -864,19 +853,14 @@ void GLES2Canvas::endShadowDraw(const FloatRect& boundingBox)
             std::swap(srcBuffer, dstBuffer);
 
             // Upsample srcBuffer -> main framebuffer using bicubic filtering.
-            bindFramebuffer();
-            m_context->applyCompositeOperator(m_state->m_compositeOp);
-            applyClipping(m_state->clippingEnabled());
+            applyState();
             m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, srcBuffer->colorBuffer());
             FloatRect dstRect = srcRect;
             dstRect.scale(scaleFactor);
             drawTexturedQuadMitchell(srcBuffer->size(), flipRect(srcRect), dstRect, AffineTransform(), 1.0);
         } else {
             // Blur in Y directly to framebuffer.
-            bindFramebuffer();
-            m_context->applyCompositeOperator(m_state->m_compositeOp);
-            applyClipping(m_state->clippingEnabled());
-
+            applyState();
             convolveRect(srcBuffer->colorBuffer(), srcBuffer->size(), flipRect(srcRect), srcRect, imageIncrementY, kernel.get(), kernelWidth);
         }
     }
diff --git a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
index f6a8bcf..635eb10 100644
--- a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
+++ b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
@@ -100,14 +100,14 @@ public:
     DrawingBuffer* drawingBuffer() const { return m_drawingBuffer; }
 
 private:
+    void applyState();
     void scissorClear(float x, float y, float width, float height);
     void drawTexturedRectTile(Texture* texture, int tile, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
     void drawTexturedQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
     void drawTexturedQuadMitchell(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
     void convolveRect(unsigned texture, const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, float imageIncrement[2], const float* kernel, int kernelWidth);
 
-    void applyCompositeOperator(CompositeOperator);
-    void createVertexBufferFromPath(const Path&, int* count, unsigned* vertexBuffer, unsigned* indexBuffer);
+    void tesselateAndFillPath(const Path&, const Color&);
     void fillPathInternal(const Path&, const Color&);
     void fillRectInternal(const FloatRect&, const Color&);
     FloatRect flipRect(const FloatRect&);
@@ -131,6 +131,7 @@ private:
 
     // Members for GPU-accelerated path rendering.
     LoopBlinnPathCache m_pathCache;
+    unsigned m_pathIndexBuffer;
     unsigned m_pathVertexBuffer;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index 067c54d..2301ca3 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -283,6 +283,8 @@ void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
     GraphicsLayer::setMaskLayer(maskLayer);
 
     LayerChromium* maskLayerChromium = m_maskLayer ? m_maskLayer->platformLayer() : 0;
+    if (maskLayerChromium)
+        maskLayerChromium->setIsMask(true);
     m_layer->setMaskLayer(maskLayerChromium);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/ImageBufferData.h b/Source/WebCore/platform/graphics/chromium/ImageBufferDataSkia.h
index 504b893..75c91ed 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/chromium/ImageBufferDataSkia.h
@@ -28,9 +28,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ImageBufferData_h
-#define ImageBufferData_h
-
 #include "PlatformContextSkia.h"
 
 #include "skia/ext/platform_canvas.h"
@@ -41,10 +38,8 @@ class ImageBufferData {
 public:
     ImageBufferData(const IntSize&);
 
-    skia::PlatformCanvas m_canvas;
+    OwnPtr<SkCanvas> m_canvas;
     PlatformContextSkia m_platformContext;
 };
 
-}  // namespace WebCore
-
-#endif  // ImageBufferData_h
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index 60c1332..d72fb1e 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -34,6 +34,7 @@
 
 #include "ImageLayerChromium.h"
 
+#include "cc/CCLayerImpl.h"
 #include "Image.h"
 #include "LayerRendererChromium.h"
 #include "LayerTexture.h"
@@ -47,42 +48,69 @@ PassRefPtr<ImageLayerChromium> ImageLayerChromium::create(GraphicsLayerChromium*
 
 ImageLayerChromium::ImageLayerChromium(GraphicsLayerChromium* owner)
     : ContentLayerChromium(owner)
+    , m_imageForCurrentFrame(0)
     , m_contents(0)
 {
 }
 
 void ImageLayerChromium::setContents(Image* contents)
 {
-    // Check if the image has changed.
-    if (m_contents == contents)
+    // setContents() currently gets called whenever there is any
+    // style change that affects the layer even if that change doesn't
+    // affect the actual contents of the image (e.g. a CSS animation).
+    // With this check in place we avoid unecessary texture uploads.
+    if ((m_contents == contents) && (m_contents->nativeImageForCurrentFrame() == m_imageForCurrentFrame))
         return;
+
     m_contents = contents;
+    m_imageForCurrentFrame = m_contents->nativeImageForCurrentFrame();
+    m_dirtyRect = IntRect(IntPoint(0, 0), bounds());
     setNeedsDisplay();
 }
 
-void ImageLayerChromium::paintContentsIfDirty()
+void ImageLayerChromium::paintContentsIfDirty(const IntRect&)
 {
     ASSERT(layerRenderer());
 
-    // FIXME: Remove this test when tiled layers are implemented.
-    if (requiresClippedUpdateRect()) {
-        // Use the base version of updateContents which draws a subset of the
-        // image to a bitmap, as the pixel contents can't be uploaded directly.
-        ContentLayerChromium::paintContentsIfDirty();
-        return;
+    if (!m_dirtyRect.isEmpty()) {
+        m_decodedImage.updateFromImage(m_contents->nativeImageForCurrentFrame());
     }
-
-    m_decodedImage.updateFromImage(m_contents->nativeImageForCurrentFrame());
 }
 
-void ImageLayerChromium::updateTextureIfNeeded()
+void ImageLayerChromium::updateCompositorResources()
 {
-    // FIXME: Remove this test when tiled layers are implemented.
-    if (requiresClippedUpdateRect()) {
-        ContentLayerChromium::updateTextureIfNeeded();
-        return;
+    updateLayerSize(m_decodedImage.size());
+
+    IntRect paintRect(IntPoint(0, 0), m_decodedImage.size());
+    if (!m_dirtyRect.isEmpty()) {
+        m_tiler->invalidateRect(paintRect);
+        m_dirtyRect = IntRect();
     }
-    updateTexture(m_decodedImage.pixels(), m_decodedImage.size());
+    m_tiler->updateFromPixels(paintRect, m_decodedImage.pixels());
+}
+
+IntRect ImageLayerChromium::layerBounds() const
+{
+    return IntRect(IntPoint(0, 0), m_decodedImage.size());
+}
+
+TransformationMatrix ImageLayerChromium::tilingTransform()
+{
+    // Tiler draws from the upper left corner. The draw transform
+    // specifies the middle of the layer.
+    TransformationMatrix transform = ccLayerImpl()->drawTransform();
+    const IntRect sourceRect = layerBounds();
+    const IntSize destSize = bounds();
+
+    transform.translate(-destSize.width() / 2.0, -destSize.height() / 2.0);
+
+    // Tiler also draws at the original content size, so rescale the original
+    // image dimensions to the bounds that it is meant to be drawn at.
+    float scaleX = destSize.width() / static_cast<float>(sourceRect.size().width());
+    float scaleY = destSize.height() / static_cast<float>(sourceRect.size().height());
+    transform.scale3d(scaleX, scaleY, 1.0f);
+
+    return transform;
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
index 6addabc..8ab76a8 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
@@ -37,7 +37,7 @@
 #include "ContentLayerChromium.h"
 #include "PlatformImage.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <wtf/RetainPtr.h>
 #endif
 
@@ -50,7 +50,8 @@ class ImageLayerChromium : public ContentLayerChromium {
 public:
     static PassRefPtr<ImageLayerChromium> create(GraphicsLayerChromium* owner = 0);
 
-    virtual void paintContentsIfDirty();
+    virtual void paintContentsIfDirty(const IntRect& targetSurfaceRect);
+    virtual void updateCompositorResources();
     virtual bool drawsContent() const { return m_contents; }
 
     void setContents(Image* image);
@@ -58,12 +59,14 @@ public:
 protected:
     virtual const char* layerTypeAsString() const { return "ImageLayer"; }
 
-private:
-    virtual void updateTextureIfNeeded();
+    virtual TransformationMatrix tilingTransform();
+    virtual IntRect layerBounds() const;
 
+private:
     ImageLayerChromium(GraphicsLayerChromium* owner);
 
     PlatformImage m_decodedImage;
+    NativeImagePtr m_imageForCurrentFrame;
     RefPtr<Image> m_contents;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index bc28239..fba1dc5 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -89,6 +89,9 @@ LayerChromium::~LayerChromium()
     // way for us to be destroyed while we still have a superlayer.
     ASSERT(!superlayer());
 
+    if (m_ccLayerImpl)
+        m_ccLayerImpl->resetOwner();
+
     // Remove the superlayer reference from all sublayers.
     removeAllSublayers();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 428ce61..5564f91 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -50,11 +50,6 @@
 #include <wtf/text/StringHash.h>
 #include <wtf/text/WTFString.h>
 
-
-namespace skia {
-class PlatformCanvas;
-}
-
 namespace WebCore {
 
 class CCLayerImpl;
@@ -113,6 +108,7 @@ public:
 
     void setNeedsDisplay(const FloatRect& dirtyRect);
     void setNeedsDisplay();
+    virtual void invalidateRect(const FloatRect& dirtyRect) {}
     const FloatRect& dirtyRect() const { return m_dirtyRect; }
     void resetNeedsDisplay();
 
@@ -156,11 +152,13 @@ public:
 
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() const { return false; }
+    virtual void paintContentsIfDirty(const IntRect&) { }
     virtual void paintContentsIfDirty() { }
     virtual void updateCompositorResources() { }
+    virtual void setIsMask(bool) {}
     virtual void unreserveContentsTexture() { }
     virtual void bindContentsTexture() { }
-    virtual void draw() { }
+    virtual void draw(const IntRect&) { }
 
     // These exists just for debugging (via drawDebugBorder()).
     void setBorderColor(const Color&);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index fc15abd..27a67e9 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -34,8 +34,8 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "LayerRendererChromium.h"
 
-#include "cc/CCLayerImpl.h"
 #include "Canvas2DLayerChromium.h"
+#include "Extensions3DChromium.h"
 #include "FloatQuad.h"
 #include "GeometryBinding.h"
 #include "GraphicsContext3D.h"
@@ -50,7 +50,7 @@
 #if USE(SKIA)
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
-#elif PLATFORM(CG)
+#elif USE(CG)
 #include <CoreGraphics/CGBitmapContext.h>
 #endif
 
@@ -88,35 +88,38 @@ static bool isScaleOrTranslation(const TransformationMatrix& m)
 
 }
 
-bool LayerRendererChromium::compareLayerZ(const CCLayerImpl* a, const CCLayerImpl* b)
+bool LayerRendererChromium::compareLayerZ(const RefPtr<CCLayerImpl>& a, const RefPtr<CCLayerImpl>& b)
 {
     return a->drawDepth() < b->drawDepth();
 }
 
-PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint)
+PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TilePaintInterface> contentPaint)
 {
     if (!context)
         return 0;
 
-    RefPtr<LayerRendererChromium> layerRenderer(adoptRef(new LayerRendererChromium(context, contentPaint, scrollbarPaint)));
+    RefPtr<LayerRendererChromium> layerRenderer(adoptRef(new LayerRendererChromium(context, contentPaint)));
     if (!layerRenderer->hardwareCompositing())
         return 0;
 
     return layerRenderer.release();
 }
 
-LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint)
+LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> context,
+                                             PassOwnPtr<TilePaintInterface> contentPaint)
     : m_viewportScrollPosition(IntPoint(-1, -1))
     , m_rootLayer(0)
     , m_rootLayerContentPaint(contentPaint)
-    , m_rootLayerScrollbarPaint(scrollbarPaint)
     , m_currentShader(0)
     , m_currentRenderSurface(0)
     , m_offscreenFramebufferId(0)
     , m_compositeOffscreen(false)
     , m_context(context)
+    , m_childContextsWereCopied(false)
+    , m_contextSupportsLatch(false)
     , m_defaultRenderSurface(0)
 {
+    m_contextSupportsLatch = m_context->getExtensions()->supports("GL_CHROMIUM_latch");
     m_hardwareCompositing = initializeSharedObjects();
     m_rootLayerContentTiler = LayerTilerChromium::create(this, IntSize(256, 256), LayerTilerChromium::NoBorderTexels);
     ASSERT(m_rootLayerContentTiler);
@@ -150,40 +153,9 @@ void LayerRendererChromium::useShader(unsigned programId)
     }
 }
 
-IntRect LayerRendererChromium::verticalScrollbarRect() const
-{
-    IntRect verticalScrollbar(IntPoint(m_viewportContentRect.maxX(), m_viewportContentRect.y()), IntSize(m_viewportVisibleRect.width() - m_viewportContentRect.width(), m_viewportVisibleRect.height()));
-    return verticalScrollbar;
-}
-
-IntRect LayerRendererChromium::horizontalScrollbarRect() const
-{
-    IntRect horizontalScrollbar(IntPoint(m_viewportContentRect.x(), m_viewportContentRect.maxY()), IntSize(m_viewportVisibleRect.width(), m_viewportVisibleRect.height() - m_viewportContentRect.height()));
-    return horizontalScrollbar;
-}
-
 void LayerRendererChromium::invalidateRootLayerRect(const IntRect& dirtyRect)
 {
     m_rootLayerContentTiler->invalidateRect(dirtyRect);
-
-    // Scrollbars never need to render beyond the fold, so clip to the viewport.
-    IntRect visibleDirtyRect = dirtyRect;
-    visibleDirtyRect.intersect(m_viewportVisibleRect);
-
-    if (m_horizontalScrollbarTiler) {
-        IntRect scrollbar = horizontalScrollbarRect();
-        if (visibleDirtyRect.intersects(scrollbar)) {
-            m_horizontalScrollbarTiler->setLayerPosition(scrollbar.location());
-            m_horizontalScrollbarTiler->invalidateRect(visibleDirtyRect);
-        }
-    }
-    if (m_verticalScrollbarTiler) {
-        IntRect scrollbar = verticalScrollbarRect();
-        if (visibleDirtyRect.intersects(scrollbar)) {
-            m_verticalScrollbarTiler->setLayerPosition(scrollbar.location());
-            m_verticalScrollbarTiler->invalidateRect(visibleDirtyRect);
-        }
-    }
 }
 
 void LayerRendererChromium::updateRootLayerContents()
@@ -192,43 +164,14 @@ void LayerRendererChromium::updateRootLayerContents()
     m_rootLayerContentTiler->update(*m_rootLayerContentPaint, m_viewportVisibleRect);
 }
 
-void LayerRendererChromium::updateRootLayerScrollbars()
-{
-    TRACE_EVENT("LayerRendererChromium::updateRootLayerScrollbars", this, 0);
-    if (m_viewportVisibleRect.width() > m_viewportContentRect.width()) {
-        IntRect verticalScrollbar = verticalScrollbarRect();
-        IntSize tileSize = verticalScrollbar.size().shrunkTo(IntSize(m_maxTextureSize, m_maxTextureSize));
-        if (!m_verticalScrollbarTiler)
-            m_verticalScrollbarTiler = LayerTilerChromium::create(this, tileSize, LayerTilerChromium::NoBorderTexels);
-        else
-            m_verticalScrollbarTiler->setTileSize(tileSize);
-        m_verticalScrollbarTiler->setLayerPosition(verticalScrollbar.location());
-        m_verticalScrollbarTiler->update(*m_rootLayerScrollbarPaint, m_viewportVisibleRect);
-    } else
-        m_verticalScrollbarTiler.clear();
-
-    if (m_viewportVisibleRect.height() > m_viewportContentRect.height()) {
-        IntRect horizontalScrollbar = horizontalScrollbarRect();
-        IntSize tileSize = horizontalScrollbar.size().shrunkTo(IntSize(m_maxTextureSize, m_maxTextureSize));
-        if (!m_horizontalScrollbarTiler)
-            m_horizontalScrollbarTiler = LayerTilerChromium::create(this, tileSize, LayerTilerChromium::NoBorderTexels);
-        else
-            m_horizontalScrollbarTiler->setTileSize(tileSize);
-        m_horizontalScrollbarTiler->setLayerPosition(horizontalScrollbar.location());
-        m_horizontalScrollbarTiler->update(*m_rootLayerScrollbarPaint, m_viewportVisibleRect);
-    } else
-        m_horizontalScrollbarTiler.clear();
-}
-
 void LayerRendererChromium::drawRootLayer()
 {
-    m_rootLayerContentTiler->draw(m_viewportVisibleRect);
-
-    if (m_verticalScrollbarTiler)
-        m_verticalScrollbarTiler->draw(m_viewportVisibleRect);
+    TransformationMatrix scroll;
+    scroll.translate(-m_viewportVisibleRect.x(), -m_viewportVisibleRect.y());
 
-    if (m_horizontalScrollbarTiler)
-        m_horizontalScrollbarTiler->draw(m_viewportVisibleRect);
+    m_rootLayerContentTiler->uploadCanvas();
+    m_rootLayerContentTiler->draw(m_viewportVisibleRect, scroll, 1.0f);
+    m_rootLayerContentTiler->unreserveTextures();
 }
 
 void LayerRendererChromium::setViewport(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition)
@@ -243,12 +186,7 @@ void LayerRendererChromium::setViewport(const IntRect& visibleRect, const IntRec
         // Reset the current render surface to force an update of the viewport and
         // projection matrix next time useRenderSurface is called.
         m_currentRenderSurface = 0;
-
         m_rootLayerContentTiler->invalidateEntireLayer();
-        if (m_horizontalScrollbarTiler)
-            m_horizontalScrollbarTiler->invalidateEntireLayer();
-        if (m_verticalScrollbarTiler)
-            m_verticalScrollbarTiler->invalidateEntireLayer();
     }
 }
 
@@ -266,18 +204,56 @@ void LayerRendererChromium::updateAndDrawLayers()
     if (!m_rootLayer)
         return;
 
-    updateRootLayerScrollbars();
+    LayerList renderSurfaceLayerList;
 
-    Vector<CCLayerImpl*> renderSurfaceLayerList;
     updateLayers(renderSurfaceLayerList);
 
+    // Before drawLayers:
+    if (hardwareCompositing() && m_contextSupportsLatch) {
+        // FIXME: The multithreaded compositor case will not work as long as
+        // copyTexImage2D resolves to the parent texture, because the main
+        // thread can execute WebGL calls on the child context at any time,
+        // potentially clobbering the parent texture that is being renderered
+        // by the compositor thread.
+        if (m_childContextsWereCopied) {
+            Extensions3DChromium* parentExt = static_cast<Extensions3DChromium*>(m_context->getExtensions());
+            // For each child context:
+            //   glWaitLatch(Offscreen->Compositor);
+            ChildContextMap::iterator i = m_childContexts.begin();
+            for (; i != m_childContexts.end(); ++i) {
+                Extensions3DChromium* childExt = static_cast<Extensions3DChromium*>(i->first->getExtensions());
+                GC3Duint latchId;
+                childExt->getChildToParentLatchCHROMIUM(&latchId);
+                parentExt->waitLatchCHROMIUM(latchId);
+            }
+        }
+        // Reset to false to indicate that we have consumed the dirty child
+        // contexts' parent textures. (This is only useful when the compositor
+        // is multithreaded.)
+        m_childContextsWereCopied = false;
+    }
+
     drawLayers(renderSurfaceLayerList);
 
+    // After drawLayers:
+    if (hardwareCompositing() && m_contextSupportsLatch) {
+        Extensions3DChromium* parentExt = static_cast<Extensions3DChromium*>(m_context->getExtensions());
+        // For each child context:
+        //   glSetLatch(Compositor->Offscreen);
+        ChildContextMap::iterator i = m_childContexts.begin();
+        for (; i != m_childContexts.end(); ++i) {
+            Extensions3DChromium* childExt = static_cast<Extensions3DChromium*>(i->first->getExtensions());
+            GC3Duint latchId;
+            childExt->getParentToChildLatchCHROMIUM(&latchId);
+            parentExt->setLatchCHROMIUM(latchId);
+        }
+    }
+
     if (isCompositingOffscreen())
         copyOffscreenTextureToDisplay();
 }
 
-void LayerRendererChromium::updateLayers(Vector<CCLayerImpl*>& renderSurfaceLayerList)
+void LayerRendererChromium::updateLayers(LayerList& renderSurfaceLayerList)
 {
     TRACE_EVENT("LayerRendererChromium::updateLayers", this, 0);
     m_rootLayer->createCCLayerImplIfNeeded();
@@ -289,8 +265,7 @@ void LayerRendererChromium::updateLayers(Vector<CCLayerImpl*>& renderSurfaceLaye
 
     rootDrawLayer->renderSurface()->m_contentRect = IntRect(IntPoint(0, 0), m_viewportVisibleRect.size());
 
-    // Scissor out the scrollbars to avoid rendering on top of them.
-    IntRect rootScissorRect(m_viewportContentRect);
+    IntRect rootScissorRect(m_viewportVisibleRect);
     // The scissorRect should not include the scroll offset.
     rootScissorRect.move(-m_viewportScrollPosition.x(), -m_viewportScrollPosition.y());
     rootDrawLayer->setScissorRect(rootScissorRect);
@@ -309,10 +284,51 @@ void LayerRendererChromium::updateLayers(Vector<CCLayerImpl*>& renderSurfaceLaye
 
     paintContentsRecursive(m_rootLayer.get());
 
+    // FIXME: Before updateCompositorResourcesRecursive, when the compositor runs in
+    // its own thread, and when the copyTexImage2D bug is fixed, insert
+    // a glWaitLatch(Compositor->Offscreen) on all child contexts here instead
+    // of after updateCompositorResourcesRecursive.
+    // Also uncomment the glSetLatch(Compositor->Offscreen) code in addChildContext.
+//  if (hardwareCompositing() && m_contextSupportsLatch) {
+//      // For each child context:
+//      //   glWaitLatch(Compositor->Offscreen);
+//      ChildContextMap::iterator i = m_childContexts.begin();
+//      for (; i != m_childContexts.end(); ++i) {
+//          Extensions3DChromium* ext = static_cast<Extensions3DChromium*>(i->first->getExtensions());
+//          GC3Duint childToParentLatchId, parentToChildLatchId;
+//          ext->getParentToChildLatchCHROMIUM(&parentToChildLatchId);
+//          ext->waitLatchCHROMIUM(parentToChildLatchId);
+//      }
+//  }
+
     updateCompositorResourcesRecursive(m_rootLayer.get());
+
+    // After updateCompositorResourcesRecursive, set/wait latches for all child
+    // contexts. This will prevent the compositor from using any of the child
+    // parent textures while WebGL commands are executing from javascript *and*
+    // while the final parent texture is being blit'd. copyTexImage2D
+    // uses the parent texture as a temporary resolve buffer, so that's why the
+    // waitLatch is below, to block the compositor from using the parent texture
+    // until the next WebGL SwapBuffers (or copyTextureToParentTexture for
+    // Canvas2D).
+    if (hardwareCompositing() && m_contextSupportsLatch) {
+        m_childContextsWereCopied = true;
+        // For each child context:
+        //   glSetLatch(Offscreen->Compositor);
+        //   glWaitLatch(Compositor->Offscreen);
+        ChildContextMap::iterator i = m_childContexts.begin();
+        for (; i != m_childContexts.end(); ++i) {
+            Extensions3DChromium* ext = static_cast<Extensions3DChromium*>(i->first->getExtensions());
+            GC3Duint childToParentLatchId, parentToChildLatchId;
+            ext->getParentToChildLatchCHROMIUM(&parentToChildLatchId);
+            ext->getChildToParentLatchCHROMIUM(&childToParentLatchId);
+            ext->setLatchCHROMIUM(childToParentLatchId);
+            ext->waitLatchCHROMIUM(parentToChildLatchId);
+        }
+    }
 }
 
-void LayerRendererChromium::drawLayers(const Vector<CCLayerImpl*>& renderSurfaceLayerList)
+void LayerRendererChromium::drawLayers(const LayerList& renderSurfaceLayerList)
 {
     TRACE_EVENT("LayerRendererChromium::drawLayers", this, 0);
     CCLayerImpl* rootDrawLayer = m_rootLayer->ccLayerImpl();
@@ -347,13 +363,14 @@ void LayerRendererChromium::drawLayers(const Vector<CCLayerImpl*>& renderSurface
     m_context->colorMask(true, true, true, true);
 
     GLC(m_context.get(), m_context->enable(GraphicsContext3D::BLEND));
+    GLC(m_context.get(), m_context->blendFunc(GraphicsContext3D::ONE, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
     GLC(m_context.get(), m_context->enable(GraphicsContext3D::SCISSOR_TEST));
 
     // Update the contents of the render surfaces. We traverse the array from
     // back to front to guarantee that nested render surfaces get rendered in the
     // correct order.
     for (int surfaceIndex = renderSurfaceLayerList.size() - 1; surfaceIndex >= 0 ; --surfaceIndex) {
-        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex];
+        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex].get();
         ASSERT(renderSurfaceLayer->renderSurface());
 
         // Render surfaces whose drawable area has zero width or height
@@ -369,10 +386,10 @@ void LayerRendererChromium::drawLayers(const Vector<CCLayerImpl*>& renderSurface
                 GLC(m_context.get(), m_context->enable(GraphicsContext3D::SCISSOR_TEST));
             }
 
-            Vector<CCLayerImpl*>& layerList = renderSurfaceLayer->renderSurface()->m_layerList;
+            LayerList& layerList = renderSurfaceLayer->renderSurface()->m_layerList;
             ASSERT(layerList.size());
             for (unsigned layerIndex = 0; layerIndex < layerList.size(); ++layerIndex)
-                drawLayer(layerList[layerIndex], renderSurfaceLayer->renderSurface());
+                drawLayer(layerList[layerIndex].get(), renderSurfaceLayer->renderSurface());
         }
     }
 
@@ -412,10 +429,6 @@ void LayerRendererChromium::setRootLayer(PassRefPtr<LayerChromium> layer)
     if (m_rootLayer)
         m_rootLayer->setLayerRenderer(this);
     m_rootLayerContentTiler->invalidateEntireLayer();
-    if (m_horizontalScrollbarTiler)
-        m_horizontalScrollbarTiler->invalidateEntireLayer();
-    if (m_verticalScrollbarTiler)
-        m_verticalScrollbarTiler->invalidateEntireLayer();
 }
 
 void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& rect)
@@ -473,7 +486,7 @@ bool LayerRendererChromium::isLayerVisible(LayerChromium* layer, const Transform
 
 // Recursively walks the layer tree starting at the given node and computes all the
 // necessary transformations, scissor rectangles, render surfaces, etc.
-void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* layer, const TransformationMatrix& parentMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList)
+void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* layer, const TransformationMatrix& parentMatrix, LayerList& renderSurfaceLayerList, LayerList& layerList)
 {
     // Make sure we have CCLayerImpls for this subtree.
     layer->createCCLayerImplIfNeeded();
@@ -659,7 +672,18 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // M[s] = M * Tr[-center]
     sublayerMatrix.translate3d(-bounds.width() * 0.5, -bounds.height() * 0.5, 0);
 
-    Vector<CCLayerImpl*>& descendants = (drawLayer->renderSurface() ? drawLayer->renderSurface()->m_layerList : layerList);
+    // Compute the depth value of the center of the layer which will be used when
+    // sorting the layers for the preserves-3d property.
+    const TransformationMatrix& layerDrawMatrix = drawLayer->renderSurface() ? drawLayer->renderSurface()->m_drawTransform : drawLayer->drawTransform();
+    if (drawLayer->superlayer()) {
+        if (!drawLayer->superlayer()->preserves3D())
+            drawLayer->setDrawDepth(drawLayer->superlayer()->drawDepth());
+        else
+            drawLayer->setDrawDepth(layerDrawMatrix.m43());
+    } else
+        drawLayer->setDrawDepth(0);
+
+    LayerList& descendants = (drawLayer->renderSurface() ? drawLayer->renderSurface()->m_layerList : layerList);
     descendants.append(drawLayer);
     unsigned thisLayerIndex = descendants.size() - 1;
 
@@ -730,17 +754,6 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         }
     }
 
-    // Compute the depth value of the center of the layer which will be used when
-    // sorting the layers for the preserves-3d property.
-    const TransformationMatrix& layerDrawMatrix = drawLayer->renderSurface() ? drawLayer->renderSurface()->m_drawTransform : drawLayer->drawTransform();
-    if (drawLayer->superlayer()) {
-        if (!drawLayer->superlayer()->preserves3D())
-            drawLayer->setDrawDepth(drawLayer->superlayer()->drawDepth());
-        else
-            drawLayer->setDrawDepth(layerDrawMatrix.m43());
-    } else
-        drawLayer->setDrawDepth(0);
-
     // If preserves-3d then sort all the descendants by the Z coordinate of their
     // center. If the preserves-3d property is also set on the superlayer then
     // skip the sorting as the superlayer will sort all the descendants anyway.
@@ -757,14 +770,16 @@ void LayerRendererChromium::paintContentsRecursive(LayerChromium* layer)
     if (layer->bounds().isEmpty())
         return;
 
+    const IntRect targetSurfaceRect = layer->ccLayerImpl()->scissorRect();
+
     if (layer->drawsContent())
-        layer->paintContentsIfDirty();
+        layer->paintContentsIfDirty(targetSurfaceRect);
     if (layer->maskLayer() && layer->maskLayer()->drawsContent())
-        layer->maskLayer()->paintContentsIfDirty();
+        layer->maskLayer()->paintContentsIfDirty(targetSurfaceRect);
     if (layer->replicaLayer() && layer->replicaLayer()->drawsContent())
-        layer->replicaLayer()->paintContentsIfDirty();
+        layer->replicaLayer()->paintContentsIfDirty(targetSurfaceRect);
     if (layer->replicaLayer() && layer->replicaLayer()->maskLayer() && layer->replicaLayer()->maskLayer()->drawsContent())
-        layer->replicaLayer()->maskLayer()->paintContentsIfDirty();
+        layer->replicaLayer()->maskLayer()->paintContentsIfDirty(targetSurfaceRect);
 }
 
 void LayerRendererChromium::updateCompositorResourcesRecursive(LayerChromium* layer)
@@ -816,7 +831,7 @@ void LayerRendererChromium::copyOffscreenTextureToDisplay()
         m_defaultRenderSurface->m_drawTransform.translate3d(0.5 * m_defaultRenderSurface->m_contentRect.width(),
                                                             0.5 * m_defaultRenderSurface->m_contentRect.height(), 0);
         m_defaultRenderSurface->m_drawOpacity = 1;
-        m_defaultRenderSurface->draw();
+        m_defaultRenderSurface->draw(m_defaultRenderSurface->m_contentRect);
     }
 }
 
@@ -857,10 +872,13 @@ bool LayerRendererChromium::useRenderSurface(RenderSurfaceChromium* renderSurfac
 void LayerRendererChromium::drawLayer(CCLayerImpl* layer, RenderSurfaceChromium* targetSurface)
 {
     if (layer->renderSurface() && layer->renderSurface() != targetSurface) {
-        layer->renderSurface()->draw();
+        layer->renderSurface()->draw(layer->getDrawRect());
         return;
     }
 
+    if (!layer->drawsContent())
+        return;
+
     if (layer->bounds().isEmpty()) {
         layer->unreserveContentsTexture();
         return;
@@ -894,8 +912,7 @@ void LayerRendererChromium::drawLayer(CCLayerImpl* layer, RenderSurfaceChromium*
         }
     }
 
-    if (layer->drawsContent())
-        layer->draw();
+    layer->draw(layer->scissorRect());
 
     // Draw the debug border if there is one.
     layer->drawDebugBorder();
@@ -968,7 +985,6 @@ bool LayerRendererChromium::initializeSharedObjects()
 
     m_sharedGeometry = adoptPtr(new GeometryBinding(m_context.get()));
     m_borderProgram = adoptPtr(new LayerChromium::BorderProgram(m_context.get()));
-    m_contentLayerProgram = adoptPtr(new ContentLayerChromium::Program(m_context.get()));
     m_canvasLayerProgram = adoptPtr(new CCCanvasLayerImpl::Program(m_context.get()));
     m_videoLayerRGBAProgram = adoptPtr(new CCVideoLayerImpl::RGBAProgram(m_context.get()));
     m_videoLayerYUVProgram = adoptPtr(new CCVideoLayerImpl::YUVProgram(m_context.get()));
@@ -978,7 +994,7 @@ bool LayerRendererChromium::initializeSharedObjects()
     m_tilerProgram = adoptPtr(new LayerTilerChromium::Program(m_context.get()));
 
     if (!m_sharedGeometry->initialized() || !m_borderProgram->initialized()
-        || !m_contentLayerProgram->initialized() || !m_canvasLayerProgram->initialized()
+        || !m_canvasLayerProgram->initialized()
         || !m_videoLayerRGBAProgram->initialized() || !m_videoLayerYUVProgram->initialized()
         || !m_pluginLayerProgram->initialized() || !m_renderSurfaceProgram->initialized()
         || !m_renderSurfaceMaskProgram->initialized() || !m_tilerProgram->initialized()) {
@@ -997,7 +1013,6 @@ void LayerRendererChromium::cleanupSharedObjects()
 
     m_sharedGeometry.clear();
     m_borderProgram.clear();
-    m_contentLayerProgram.clear();
     m_canvasLayerProgram.clear();
     m_videoLayerRGBAProgram.clear();
     m_videoLayerYUVProgram.clear();
@@ -1010,8 +1025,6 @@ void LayerRendererChromium::cleanupSharedObjects()
 
     // Clear tilers before the texture manager, as they have references to textures.
     m_rootLayerContentTiler.clear();
-    m_horizontalScrollbarTiler.clear();
-    m_verticalScrollbarTiler.clear();
 
     m_textureManager.clear();
 }
@@ -1027,6 +1040,48 @@ String LayerRendererChromium::layerTreeAsText() const
     return ts.release();
 }
 
+void LayerRendererChromium::addChildContext(GraphicsContext3D* ctx)
+{
+    if (!ctx->getExtensions()->supports("GL_CHROMIUM_latch"))
+        return;
+
+    // This is a ref-counting map, because some contexts are shared by multiple
+    // layers (specifically, Canvas2DLayerChromium).
+
+    // Insert the ctx with a count of 1, or return the existing iterator.
+    std::pair<ChildContextMap::iterator, bool> insert_result = m_childContexts.add(ctx, 1);
+    if (!insert_result.second) {
+        // Already present in map, so increment.
+        ++insert_result.first->second;
+    } else {
+// FIXME(jbates): when compositor is multithreaded and copyTexImage2D bug is fixed,
+// uncomment this block:
+//      // This is a new child context - set the parentToChild latch so that it
+//      // can continue past its first wait latch.
+//      Extensions3DChromium* ext = static_cast<Extensions3DChromium*>(ctx->getExtensions());
+//      GC3Duint latchId;
+//      ext->getParentToChildLatchCHROMIUM(&latchId);
+//      ext->setLatchCHROMIUM(0, latchId);
+    }
+}
+
+void LayerRendererChromium::removeChildContext(GraphicsContext3D* ctx)
+{
+    if (!ctx->getExtensions()->supports("GL_CHROMIUM_latch"))
+        return;
+
+    ChildContextMap::iterator i = m_childContexts.find(ctx);
+    if (i != m_childContexts.end()) {
+        if (--i->second <= 0) {
+            // Count reached zero, so remove from map.
+            m_childContexts.remove(i);
+        }
+    } else {
+        // error
+        ASSERT(0 && "m_childContexts map has mismatched add/remove calls");
+    }
+}
+
 void LayerRendererChromium::dumpRenderSurfaces(TextStream& ts, int indent, LayerChromium* layer) const
 {
     if (layer->ccLayerImpl()->renderSurface())
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index 667ede2..813eb46 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -52,22 +52,22 @@
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGContext.h>
 #include <wtf/RetainPtr.h>
 #endif
 
 namespace WebCore {
 
+class CCHeadsUpDisplay;
 class CCLayerImpl;
 class GeometryBinding;
 class GraphicsContext3D;
-class CCHeadsUpDisplay;
 
 // Class that handles drawing of composited render layers using GL.
 class LayerRendererChromium : public RefCounted<LayerRendererChromium> {
 public:
-    static PassRefPtr<LayerRendererChromium> create(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint);
+    static PassRefPtr<LayerRendererChromium> create(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TilePaintInterface> contentPaint);
 
     ~LayerRendererChromium();
 
@@ -88,7 +88,7 @@ public:
 
     IntSize viewportSize() const { return m_viewportVisibleRect.size(); }
 
-    void setRootLayer(PassRefPtr<LayerChromium> layer);
+    void setRootLayer(PassRefPtr<LayerChromium>);
     LayerChromium* rootLayer() { return m_rootLayer.get(); }
     void transferRootLayer(LayerRendererChromium* other) { other->m_rootLayer = m_rootLayer.release(); }
 
@@ -110,7 +110,6 @@ public:
 
     const GeometryBinding* sharedGeometry() const { return m_sharedGeometry.get(); }
     const LayerChromium::BorderProgram* borderProgram() const { return m_borderProgram.get(); }
-    const ContentLayerChromium::Program* contentLayerProgram() const { return m_contentLayerProgram.get(); }
     const RenderSurfaceChromium::Program* renderSurfaceProgram() const { return m_renderSurfaceProgram.get(); }
     const RenderSurfaceChromium::MaskProgram* renderSurfaceMaskProgram() const { return m_renderSurfaceMaskProgram.get(); }
     const LayerTilerChromium::Program* tilerProgram() const { return m_tilerProgram.get(); }
@@ -131,17 +130,23 @@ public:
 
     String layerTreeAsText() const;
 
+    void addChildContext(GraphicsContext3D*);
+    void removeChildContext(GraphicsContext3D*);
+
 private:
-    explicit LayerRendererChromium(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint);
+    typedef Vector<RefPtr<CCLayerImpl> > LayerList;
+    typedef HashMap<GraphicsContext3D*, int> ChildContextMap;
+
+    explicit LayerRendererChromium(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TilePaintInterface> contentPaint);
 
-    void updateLayers(Vector<CCLayerImpl*>& renderSurfaceLayerList);
+    void updateLayers(LayerList& renderSurfaceLayerList);
     void updateRootLayerContents();
-    void updateRootLayerScrollbars();
-    void updatePropertiesAndRenderSurfaces(LayerChromium*, const TransformationMatrix& parentMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList);
+    void updatePropertiesAndRenderSurfaces(LayerChromium*, const TransformationMatrix& parentMatrix, LayerList& renderSurfaceLayerList, LayerList& layers);
+
     void paintContentsRecursive(LayerChromium*);
     void updateCompositorResourcesRecursive(LayerChromium*);
 
-    void drawLayers(const Vector<CCLayerImpl*>& renderSurfaceLayerList);
+    void drawLayers(const LayerList& renderSurfaceLayerList);
     void drawLayer(CCLayerImpl*, RenderSurfaceChromium*);
 
     void drawRootLayer();
@@ -156,16 +161,13 @@ private:
 
     bool makeContextCurrent();
 
-    static bool compareLayerZ(const CCLayerImpl*, const CCLayerImpl*);
+    static bool compareLayerZ(const RefPtr<CCLayerImpl>&, const RefPtr<CCLayerImpl>&);
 
     void dumpRenderSurfaces(TextStream&, int indent, LayerChromium*) const;
 
     bool initializeSharedObjects();
     void cleanupSharedObjects();
 
-    IntRect verticalScrollbarRect() const;
-    IntRect horizontalScrollbarRect() const;
-
     IntRect m_viewportVisibleRect;
     IntRect m_viewportContentRect;
     IntPoint m_viewportScrollPosition;
@@ -174,10 +176,7 @@ private:
 
     RefPtr<LayerChromium> m_rootLayer;
     OwnPtr<TilePaintInterface> m_rootLayerContentPaint;
-    OwnPtr<TilePaintInterface> m_rootLayerScrollbarPaint;
     OwnPtr<LayerTilerChromium> m_rootLayerContentTiler;
-    OwnPtr<LayerTilerChromium> m_horizontalScrollbarTiler;
-    OwnPtr<LayerTilerChromium> m_verticalScrollbarTiler;
 
     bool m_hardwareCompositing;
 
@@ -188,10 +187,10 @@ private:
     bool m_compositeOffscreen;
 
 #if USE(SKIA)
-    OwnPtr<skia::PlatformCanvas> m_rootLayerCanvas;
+    OwnPtr<SkCanvas> m_rootLayerCanvas;
     OwnPtr<PlatformContextSkia> m_rootLayerSkiaContext;
     OwnPtr<GraphicsContext> m_rootLayerGraphicsContext;
-#elif PLATFORM(CG)
+#elif USE(CG)
     Vector<uint8_t> m_rootLayerBackingStore;
     RetainPtr<CGContextRef> m_rootLayerCGContext;
     OwnPtr<GraphicsContext> m_rootLayerGraphicsContext;
@@ -206,7 +205,6 @@ private:
     // we cannot store these values in static variables.
     OwnPtr<GeometryBinding> m_sharedGeometry;
     OwnPtr<LayerChromium::BorderProgram> m_borderProgram;
-    OwnPtr<ContentLayerChromium::Program> m_contentLayerProgram;
     OwnPtr<RenderSurfaceChromium::Program> m_renderSurfaceProgram;
     OwnPtr<RenderSurfaceChromium::MaskProgram> m_renderSurfaceMaskProgram;
     OwnPtr<LayerTilerChromium::Program> m_tilerProgram;
@@ -220,6 +218,15 @@ private:
     OwnPtr<CCHeadsUpDisplay> m_headsUpDisplay;
 
     RefPtr<GraphicsContext3D> m_context;
+    ChildContextMap m_childContexts;
+
+    // If true, the child contexts were copied to the compositor texture targets
+    // and the compositor will need to wait on the proper latches before using
+    // the target textures. If false, the compositor is reusing the textures
+    // from last frame.
+    bool m_childContextsWereCopied;
+
+    bool m_contextSupportsLatch;
 
     RenderSurfaceChromium* m_defaultRenderSurface;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
index bc37201..54c6ac2 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
@@ -40,6 +40,8 @@
 
 using namespace std;
 
+static int minTextureSize = 16;
+
 namespace WebCore {
 
 PassOwnPtr<LayerTilerChromium> LayerTilerChromium::create(LayerRendererChromium* layerRenderer, const IntSize& tileSize, BorderTexelOption border)
@@ -69,8 +71,10 @@ GraphicsContext3D* LayerTilerChromium::layerRendererContext() const
     return layerRenderer()->context();
 }
 
-void LayerTilerChromium::setTileSize(const IntSize& size)
+void LayerTilerChromium::setTileSize(const IntSize& requestedSize)
 {
+    IntSize size(max(minTextureSize, requestedSize.width()), max(minTextureSize, requestedSize.height()));
+
     if (m_tileSize == size)
         return;
 
@@ -81,6 +85,12 @@ void LayerTilerChromium::setTileSize(const IntSize& size)
     m_tilingData.setMaxTextureSize(max(size.width(), size.height()));
 }
 
+LayerTexture* LayerTilerChromium::getSingleTexture()
+{
+    Tile* tile = tileAt(0, 0);
+    return tile ? tile->texture() : 0;
+}
+
 void LayerTilerChromium::reset()
 {
     m_tiles.clear();
@@ -180,7 +190,7 @@ IntRect LayerTilerChromium::tileLayerRect(const Tile* tile) const
 
 void LayerTilerChromium::invalidateRect(const IntRect& contentRect)
 {
-    if (contentRect.isEmpty())
+    if (contentRect.isEmpty() || m_skipsDraw)
         return;
 
     growLayerToContain(contentRect);
@@ -236,6 +246,8 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
                 tile = createTile(i, j);
             if (!tile->texture()->isValid(m_tileSize, GraphicsContext3D::RGBA))
                 tile->m_dirtyLayerRect = tileLayerRect(tile);
+            else
+                tile->texture()->reserve(m_tileSize, GraphicsContext3D::RGBA);
             dirtyLayerRect.unite(tile->m_dirtyLayerRect);
         }
     }
@@ -243,27 +255,35 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
     if (dirtyLayerRect.isEmpty())
         return;
 
-    const IntRect paintRect = layerRectToContentRect(dirtyLayerRect);
+    m_paintRect = layerRectToContentRect(dirtyLayerRect);
+
+    m_canvas.resize(m_paintRect.size());
 
-    m_canvas.resize(paintRect.size());
-    PlatformCanvas::Painter canvasPainter(&m_canvas);
-    canvasPainter.context()->translate(-paintRect.x(), -paintRect.y());
+    // Assumption: if a tiler is using border texels, then it is because the
+    // layer is likely to be filtered or transformed. Because of it might be
+    // transformed, draw the text in grayscale instead of subpixel antialiasing.
+    PlatformCanvas::Painter::TextOption textOption = m_tilingData.borderTexels() ? PlatformCanvas::Painter::GrayscaleText : PlatformCanvas::Painter::SubpixelText;
+    PlatformCanvas::Painter canvasPainter(&m_canvas, textOption);
+    canvasPainter.context()->translate(-m_paintRect.x(), -m_paintRect.y());
     {
         TRACE_EVENT("LayerTilerChromium::update::paint", this, 0);
-        painter.paint(*canvasPainter.context(), paintRect);
+        painter.paint(*canvasPainter.context(), m_paintRect);
     }
+}
 
+void LayerTilerChromium::uploadCanvas()
+{
     PlatformCanvas::AutoLocker locker(&m_canvas);
     {
         TRACE_EVENT("LayerTilerChromium::updateFromPixels", this, 0);
-        updateFromPixels(paintRect, locker.pixels());
+        updateFromPixels(m_paintRect, locker.pixels());
     }
 }
 
 void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_t* paintPixels)
 {
     // Painting could cause compositing to get turned off, which may cause the tiler to become invalidated mid-update.
-    if (!m_tiles.size())
+    if (!m_tilingData.totalSizeX() || !m_tilingData.totalSizeY())
         return;
 
     GraphicsContext3D* context = layerRendererContext();
@@ -274,21 +294,26 @@ void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_
         for (int i = left; i <= right; ++i) {
             Tile* tile = tileAt(i, j);
             if (!tile)
-                CRASH();
-            if (!tile->dirty())
+                tile = createTile(i, j);
+            else if (!tile->dirty())
                 continue;
 
             // Calculate page-space rectangle to copy from.
             IntRect sourceRect = tileContentRect(tile);
             const IntPoint anchor = sourceRect.location();
             sourceRect.intersect(layerRectToContentRect(tile->m_dirtyLayerRect));
+            // Paint rect not guaranteed to line up on tile boundaries, so
+            // make sure that sourceRect doesn't extend outside of it.
+            sourceRect.intersect(paintRect);
             if (sourceRect.isEmpty())
                 continue;
 
-            if (!tile->texture()->reserve(m_tileSize, GraphicsContext3D::RGBA)) {
-                m_skipsDraw = true;
-                reset();
-                return;
+            if (!tile->texture()->isReserved()) {
+                if (!tile->texture()->reserve(m_tileSize, GraphicsContext3D::RGBA)) {
+                    m_skipsDraw = true;
+                    reset();
+                    return;
+                }
             }
 
             // Calculate tile-space rectangle to upload into.
@@ -324,8 +349,10 @@ void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_
             }
 
             tile->texture()->bindTexture();
-            GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::NEAREST));
-            GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST));
+
+            const GC3Dint filter = m_tilingData.borderTexels() ? GraphicsContext3D::LINEAR : GraphicsContext3D::NEAREST;
+            GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, filter));
+            GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, filter));
 
             GLC(context, context->texSubImage2D(GraphicsContext3D::TEXTURE_2D, 0, destRect.x(), destRect.y(), destRect.width(), destRect.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, pixelSource));
 
@@ -339,7 +366,7 @@ void LayerTilerChromium::setLayerPosition(const IntPoint& layerPosition)
     m_layerPosition = layerPosition;
 }
 
-void LayerTilerChromium::draw(const IntRect& contentRect)
+void LayerTilerChromium::draw(const IntRect& contentRect, const TransformationMatrix& globalTransform, float opacity)
 {
     if (m_skipsDraw || !m_tiles.size())
         return;
@@ -354,17 +381,18 @@ void LayerTilerChromium::draw(const IntRect& contentRect)
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
             Tile* tile = tileAt(i, j);
-            ASSERT(tile);
+            if (!tile)
+                continue;
 
             tile->texture()->bindTexture();
 
-            TransformationMatrix tileMatrix;
+            TransformationMatrix tileMatrix(globalTransform);
 
             // Don't use tileContentRect here, as that contains the full
             // rect with border texels which shouldn't be drawn.
             IntRect tileRect = m_tilingData.tileBounds(m_tilingData.tileIndex(tile->i(), tile->j()));
             tileRect.move(m_layerPosition.x(), m_layerPosition.y());
-            tileMatrix.translate3d(tileRect.x() - contentRect.x() + tileRect.width() / 2.0, tileRect.y() - contentRect.y() + tileRect.height() / 2.0, 0);
+            tileMatrix.translate3d(tileRect.x() + tileRect.width() / 2.0, tileRect.y() + tileRect.height() / 2.0, 0);
 
             IntPoint texOffset = m_tilingData.textureOffset(tile->i(), tile->j());
             float tileWidth = static_cast<float>(m_tileSize.width());
@@ -374,13 +402,21 @@ void LayerTilerChromium::draw(const IntRect& contentRect)
             float texScaleX = tileRect.width() / tileWidth;
             float texScaleY = tileRect.height() / tileHeight;
 
-            drawTexturedQuad(context, layerRenderer()->projectionMatrix(), tileMatrix, tileRect.width(), tileRect.height(), 1, texTranslateX, texTranslateY, texScaleX, texScaleY, program);
-
-            tile->texture()->unreserve();
+            drawTexturedQuad(context, layerRenderer()->projectionMatrix(), tileMatrix, tileRect.width(), tileRect.height(), opacity, texTranslateX, texTranslateY, texScaleX, texScaleY, program);
         }
     }
 }
 
+void LayerTilerChromium::unreserveTextures()
+{
+    for (TileMap::iterator iter = m_tiles.begin(); iter != m_tiles.end(); ++iter) {
+        Tile* tile = iter->second.get();
+        if (!tile)
+            continue;
+        tile->texture()->unreserve();
+    }
+}
+
 void LayerTilerChromium::growLayerToContain(const IntRect& contentRect)
 {
     // Grow the tile array to contain this content rect.
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
index 2f356e4..111dd7e 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
@@ -56,19 +56,40 @@ public:
 
     ~LayerTilerChromium();
 
+    // Set invalidations to be potentially repainted during update().
     void invalidateRect(const IntRect& contentRect);
     void invalidateEntireLayer();
+
+    // Paint all invalidations and missing tiles needed to draw the contentRect
+    // into the internal canvas.
     void update(TilePaintInterface& painter, const IntRect& contentRect);
+
+    // Reserve and upload tile textures from the internal canvas.
+    void uploadCanvas();
+
+    // Reserve and upload tile textures from an externally painted buffer.
     void updateFromPixels(const IntRect& paintRect, const uint8_t* pixels);
-    void draw(const IntRect& contentRect);
+
+    // Draw all tiles that intersect with the content rect.
+    void draw(const IntRect& contentRect, const TransformationMatrix&, float opacity);
+
+    // If uploadCanvas/updateFromPixels is called, this must be called after
+    // draw() to unreserve any textures that were reserved prior to uploading.
+    void unreserveTextures();
 
     // Set position of this tiled layer in content space.
     void setLayerPosition(const IntPoint& position);
     // Change the tile size.  This may invalidate all the existing tiles.
     void setTileSize(const IntSize& size);
+    void setLayerRenderer(LayerRendererChromium* layerRenderer) { m_layerRenderer = layerRenderer; }
+
+    bool skipsDraw() const { return m_skipsDraw; }
 
     typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderTexAlpha> Program;
 
+    // If this tiler has exactly one tile, return its texture. Otherwise, null.
+    LayerTexture* getSingleTexture();
+
 private:
     LayerTilerChromium(LayerRendererChromium*, const IntSize& tileSize, BorderTexelOption);
 
@@ -140,6 +161,7 @@ private:
     // Tightly packed set of unused tiles.
     Vector<RefPtr<Tile> > m_unusedTiles;
 
+    IntRect m_paintRect;
     PlatformCanvas m_canvas;
 
     // Cache a tile-sized pixel buffer to draw into.
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
index 29589f4..afaa6f7 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
@@ -34,7 +34,7 @@
 #include "PlatformContextSkia.h"
 #include "SkColorPriv.h"
 #include "skia/ext/platform_canvas.h"
-#elif PLATFORM(CG)
+#elif USE(CG)
 #include <CoreGraphics/CGBitmapContext.h>
 #endif
 
@@ -52,8 +52,8 @@ void PlatformCanvas::resize(const IntSize& size)
 {
     m_size = size;
 #if USE(SKIA)
-    m_skiaCanvas = new skia::PlatformCanvas(size.width(), size.height(), false);
-#elif PLATFORM(CG)
+    m_skiaCanvas = skia::CreateBitmapCanvas(size.width(), size.height(), false);
+#elif USE(CG)
     size_t bufferSize = size.width() * size.height() * 4;
     m_pixelData = adoptArrayPtr(new uint8_t[bufferSize]);
     memset(m_pixelData.get(), 0, bufferSize);
@@ -73,8 +73,9 @@ PlatformCanvas::AutoLocker::AutoLocker(PlatformCanvas* canvas)
             m_pixels = static_cast<uint8_t*>(m_bitmap->getPixels());
     } else
         m_bitmap = 0;
-#elif PLATFORM(CG)
-    m_pixels = &canvas->m_pixelData[0];
+#elif USE(CG)
+    if (canvas->m_pixelData)
+        m_pixels = &canvas->m_pixelData[0];
 #endif
 }
 
@@ -86,16 +87,15 @@ PlatformCanvas::AutoLocker::~AutoLocker()
 #endif
 }
 
-PlatformCanvas::Painter::Painter(PlatformCanvas* canvas)
+PlatformCanvas::Painter::Painter(PlatformCanvas* canvas, PlatformCanvas::Painter::TextOption option)
 {
 #if USE(SKIA)
     m_skiaContext = adoptPtr(new PlatformContextSkia(canvas->m_skiaCanvas.get()));
 
-    // This is needed to get text to show up correctly.
-    m_skiaContext->setDrawingToImageBuffer(true);
+    m_skiaContext->setDrawingToImageBuffer(option == GrayscaleText);
 
     m_context = adoptPtr(new GraphicsContext(reinterpret_cast<PlatformGraphicsContext*>(m_skiaContext.get())));
-#elif PLATFORM(CG)
+#elif USE(CG)
 
     m_colorSpace = CGColorSpaceCreateDeviceRGB();
     size_t rowBytes = canvas->size().width() * 4;
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
index 262fdd0..b002d26 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
+++ b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
@@ -31,7 +31,7 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGColorSpace.h>
 #include <CoreGraphics/CGContext.h>
 #include <wtf/OwnArrayPtr.h>
@@ -39,8 +39,8 @@
 #endif
 
 #if USE(SKIA)
-namespace skia { class PlatformCanvas; }
 class SkBitmap;
+class SkCanvas;
 #endif
 
 namespace WebCore {
@@ -78,7 +78,9 @@ public:
     class Painter {
         WTF_MAKE_NONCOPYABLE(Painter);
     public:
-        explicit Painter(PlatformCanvas*);
+        enum TextOption { GrayscaleText, SubpixelText };
+
+        Painter(PlatformCanvas*, TextOption);
         ~Painter();
 
         GraphicsContext* context() const { return m_context.get(); }
@@ -86,7 +88,7 @@ public:
         OwnPtr<GraphicsContext> m_context;
 #if USE(SKIA)
         OwnPtr<PlatformContextSkia> m_skiaContext;
-#elif PLATFORM(CG)
+#elif USE(CG)
         RetainPtr<CGColorSpaceRef> m_colorSpace;
         RetainPtr<CGContextRef> m_contextCG;
 #endif
@@ -97,8 +99,8 @@ public:
 
 private:
 #if USE(SKIA)
-    OwnPtr<skia::PlatformCanvas> m_skiaCanvas;
-#elif PLATFORM(CG)
+    OwnPtr<SkCanvas> m_skiaCanvas;
+#elif USE(CG)
     OwnArrayPtr<uint8_t> m_pixelData;
 #endif
     IntSize m_size;
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformImage.cpp b/Source/WebCore/platform/graphics/chromium/PlatformImage.cpp
index 62cf4f8..c31b29c 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformImage.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PlatformImage.cpp
@@ -30,7 +30,7 @@
 #if USE(SKIA)
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
-#elif PLATFORM(CG)
+#elif USE(CG)
 #include <CoreGraphics/CGBitmapContext.h>
 #include <CoreGraphics/CGContext.h>
 #include <CoreGraphics/CGImage.h>
@@ -54,7 +54,7 @@ void PlatformImage::updateFromImage(NativeImagePtr nativeImage)
 
     IntSize bitmapSize(skiaBitmap->width(), skiaBitmap->height());
     ASSERT(skiaBitmap);
-#elif PLATFORM(CG)
+#elif USE(CG)
     // NativeImagePtr is a CGImageRef on Mac OS X.
     int width = CGImageGetWidth(nativeImage);
     int height = CGImageGetHeight(nativeImage);
@@ -73,7 +73,7 @@ void PlatformImage::updateFromImage(NativeImagePtr nativeImage)
     // FIXME: do we need to support more image configurations?
     ASSERT(skiaBitmap->config()== SkBitmap::kARGB_8888_Config);
     skiaBitmap->copyPixelsTo(m_pixelData.get(), bufferSize);
-#elif PLATFORM(CG)
+#elif USE(CG)
     // FIXME: we should get rid of this temporary copy where possible.
     int tempRowBytes = width * 4;
     // Note we do not zero this vector since we are going to
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
index ca42d0b..c93ef3f 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
@@ -143,7 +143,7 @@ void RenderSurfaceChromium::drawSurface(CCLayerImpl* maskLayer, const Transforma
         maskLayer->unreserveContentsTexture();
 }
 
-void RenderSurfaceChromium::draw()
+void RenderSurfaceChromium::draw(const IntRect&)
 {
     if (m_skipsDraw || !m_contentsTexture)
         return;
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
index 6400c63..7c0e984 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
@@ -52,7 +52,7 @@ public:
 
     bool prepareContentsTexture();
     void cleanupResources();
-    void draw();
+    void draw(const IntRect& targetSurfaceRect);
 
     String name() const;
     void dumpSurface(TextStream&, int indent) const;
@@ -84,7 +84,7 @@ private:
     TransformationMatrix m_replicaDrawTransform;
     TransformationMatrix m_originTransform;
     IntRect m_scissorRect;
-    Vector<CCLayerImpl*> m_layerList;
+    Vector<RefPtr<CCLayerImpl> > m_layerList;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp b/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
index 193271d..f2c2394 100644
--- a/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
@@ -49,14 +49,14 @@ namespace {
 // into. Buffers larger than this will be destroyed when we're done with them.
 const int maxCachedBufferPixelSize = 65536;
 
-inline skia::PlatformCanvas* canvasForContext(const GraphicsContext& context)
+inline SkCanvas* canvasForContext(const GraphicsContext& context)
 {
     return context.platformContext()->canvas();
 }
 
 inline const SkBitmap& bitmapForContext(const GraphicsContext& context)
 {
-    return canvasForContext(context)->getTopPlatformDevice().accessBitmap(false);
+    return canvasForContext(context)->getTopDevice()->accessBitmap(false);
 }
 
 void compositeToCopy(const GraphicsContext& sourceLayers,
@@ -466,7 +466,7 @@ void TransparencyWin::compositeTextComposite()
     if (!m_validLayer)
         return;
 
-    const SkBitmap& bitmap = m_layerBuffer->context()->platformContext()->canvas()->getTopPlatformDevice().accessBitmap(true);
+    const SkBitmap& bitmap = m_layerBuffer->context()->platformContext()->canvas()->getTopDevice()->accessBitmap(true);
     SkColor textColor = m_textCompositeColor.rgb();
     for (int y = 0; y < m_layerSize.height(); y++) {
         uint32_t* row = bitmap.getAddr32(0, y);
@@ -502,7 +502,7 @@ void TransparencyWin::makeLayerOpaque()
         return;
 
     SkBitmap& bitmap = const_cast<SkBitmap&>(m_drawContext->platformContext()->
-        canvas()->getTopPlatformDevice().accessBitmap(true));
+        canvas()->getTopDevice()->accessBitmap(true));
     for (int y = 0; y < m_layerSize.height(); y++) {
         uint32_t* row = bitmap.getAddr32(0, y);
         for (int x = 0; x < m_layerSize.width(); x++)
diff --git a/Source/WebCore/platform/graphics/chromium/UniscribeHelper.cpp b/Source/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
index dda84a9..524beec 100644
--- a/Source/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
+++ b/Source/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
@@ -31,45 +31,16 @@
 #include "config.h"
 #include "UniscribeHelper.h"
 
-#include <windows.h>
-
+#include "Font.h"
 #include "FontUtilsChromiumWin.h"
 #include "PlatformContextSkia.h"
 #include "SkiaFontWin.h"
 #include "SkPoint.h"
+#include <windows.h>
 #include <wtf/Assertions.h>
 
 namespace WebCore {
 
-// This function is used to see where word spacing should be applied inside
-// runs. Note that this must match Font::treatAsSpace so we all agree where
-// and how much space this is, so we don't want to do more general Unicode
-// "is this a word break" thing.
-static bool treatAsSpace(UChar c)
-{
-    return c == ' ' || c == '\t' || c == '\n' || c == 0x00A0;
-}
-
-// SCRIPT_FONTPROPERTIES contains glyph indices for default, invalid
-// and blank glyphs. Just because ScriptShape succeeds does not mean
-// that a text run is rendered correctly. Some characters may be rendered
-// with default/invalid/blank glyphs. Therefore, we need to check if the glyph
-// array returned by ScriptShape contains any of those glyphs to make
-// sure that the text run is rendered successfully.
-static bool containsMissingGlyphs(WORD *glyphs,
-                                  int length,
-                                  SCRIPT_FONTPROPERTIES* properties)
-{
-    for (int i = 0; i < length; ++i) {
-        if (glyphs[i] == properties->wgDefault
-            || (glyphs[i] == properties->wgInvalid
-            && glyphs[i] != properties->wgBlank))
-            return true;
-    }
-
-    return false;
-}
-
 // HFONT is the 'incarnation' of 'everything' about font, but it's an opaque
 // handle and we can't directly query it to make a new HFONT sharing
 // its characteristics (height, style, etc) except for family name.
@@ -102,13 +73,15 @@ UniscribeHelper::UniscribeHelper(const UChar* input,
                                 bool isRtl,
                                 HFONT hfont,
                                 SCRIPT_CACHE* scriptCache,
-                                SCRIPT_FONTPROPERTIES* fontProperties)
+                                SCRIPT_FONTPROPERTIES* fontProperties,
+                                WORD spaceGlyph)
     : m_input(input)
     , m_inputLength(inputLength)
     , m_isRtl(isRtl)
     , m_hfont(hfont)
     , m_scriptCache(scriptCache)
     , m_fontProperties(fontProperties)
+    , m_spaceGlyph(spaceGlyph)
     , m_directionalOverride(false)
     , m_inhibitLigate(false)
     , m_letterSpacing(0)
@@ -546,6 +519,7 @@ bool UniscribeHelper::shape(const UChar* input,
     SCRIPT_CACHE* scriptCache = m_scriptCache;
     SCRIPT_FONTPROPERTIES* fontProperties = m_fontProperties;
     int ascent = m_ascent;
+    WORD spaceGlyph = m_spaceGlyph;
     HDC tempDC = 0;
     HGDIOBJ oldFont = 0;
     HRESULT hr;
@@ -601,7 +575,7 @@ bool UniscribeHelper::shape(const UChar* input,
         } else if (hr == E_OUTOFMEMORY) {
             numGlyphs *= 2;
             continue;
-        } else if (SUCCEEDED(hr) && (lastFallbackTried || !containsMissingGlyphs(&shaping.m_glyphs[0], generatedGlyphs, fontProperties)))
+        } else if (SUCCEEDED(hr) && (lastFallbackTried || !containsMissingGlyphs(shaping, run, fontProperties)))
             break;
 
         // The current font can't render this run. clear DC and try
@@ -632,7 +606,9 @@ bool UniscribeHelper::shape(const UChar* input,
             const UChar *family = getFallbackFamily(input, itemLength,
                 FontDescription::StandardFamily, 0, 0);
             bool fontOk = getDerivedFontData(family, m_style, &m_logfont,
-                                              &ascent, &hfont, &scriptCache);
+                                             &ascent, &hfont, &scriptCache,
+                                             &spaceGlyph);
+                                              
 
             if (!fontOk) {
                 // If this GetDerivedFontData is called from the renderer it
@@ -644,7 +620,8 @@ bool UniscribeHelper::shape(const UChar* input,
 
                 // Try again.
                 fontOk = getDerivedFontData(family, m_style, &m_logfont,
-                                             &ascent, &hfont, &scriptCache);
+                                            &ascent, &hfont, &scriptCache,
+                                            &spaceGlyph);
                 ASSERT(fontOk);
             }
 
@@ -673,6 +650,7 @@ bool UniscribeHelper::shape(const UChar* input,
     // because it's not used elsewhere.
     shaping.m_hfont = hfont;
     shaping.m_scriptCache = scriptCache;
+    shaping.m_spaceGlyph = spaceGlyph;
 
     // The ascent of a font for this run can be different from
     // that of the primary font so that we need to keep track of
@@ -806,22 +784,39 @@ void UniscribeHelper::adjustSpaceAdvances()
     for (size_t run = 0; run < m_runs.size(); run++) {
         Shaping& shaping = m_shapes[run];
 
+        // FIXME: This loop is not UTF-16-safe. Unicode 6.0 has a couple
+        // of complex script blocks in Plane 1.
         for (int i = 0; i < shaping.charLength(); i++) {
-            if (!treatAsSpace(m_input[m_runs[run].iCharPos + i]))
+            UChar c = m_input[m_runs[run].iCharPos + i];
+            bool treatAsSpace = Font::treatAsSpace(c);
+            if (!treatAsSpace && !Font::treatAsZeroWidthSpaceInComplexScript(c))
                 continue;
 
             int glyphIndex = shaping.m_logs[i];
             int currentAdvance = shaping.m_advance[glyphIndex];
 
-            // currentAdvance does not include additional letter-spacing, but
-            // space_width does. Here we find out how off we are from the
-            // correct width for the space not including letter-spacing, then
-            // just subtract that diff.
-            int diff = currentAdvance - spaceWidthWithoutLetterSpacing;
-            // The shaping can consist of a run of text, so only subtract the
-            // difference in the width of the glyph.
-            shaping.m_advance[glyphIndex] -= diff;
-            shaping.m_abc.abcB -= diff;
+            if (treatAsSpace) {
+                // currentAdvance does not include additional letter-spacing,
+                // but m_spaceWidth does. Here we find out how off we are from
+                // the correct width (spaceWidthWithoutLetterSpacing) and
+                // just subtract that diff.
+                int diff = currentAdvance - spaceWidthWithoutLetterSpacing;
+                // The shaping can consist of a run of text, so only subtract
+                // the difference in the width of the glyph.
+                shaping.m_advance[glyphIndex] -= diff;
+                shaping.m_abc.abcB -= diff;
+                continue;
+            }
+
+            // For characters treated as zero-width space in complex
+            // scripts, set the advance width to zero, adjust
+            // |abcB| of the current run accordingly and set 
+            // the glyph to m_spaceGlyph (invisible).
+            shaping.m_advance[glyphIndex] = 0;
+            shaping.m_abc.abcB -= currentAdvance;
+            shaping.m_offsets[glyphIndex].du = 0;
+            shaping.m_offsets[glyphIndex].dv = 0;
+            shaping.m_glyphs[glyphIndex] = shaping.m_spaceGlyph;
         }
     }
 }
@@ -872,7 +867,7 @@ void UniscribeHelper::applySpacing()
         // extra wordspacing amount for the glyphs they correspond to.
         if (m_wordSpacing != 0) {
             for (int i = 0; i < shaping.charLength(); i++) {
-                if (!treatAsSpace(m_input[m_runs[run].iCharPos + i]))
+                if (!Font::treatAsSpace(m_input[m_runs[run].iCharPos + i]))
                     continue;
 
                 // The char in question is a word separator...
@@ -929,4 +924,31 @@ int UniscribeHelper::advanceForItem(int itemIndex) const
     return shaping.m_prePadding + justification;
 }
 
+// SCRIPT_FONTPROPERTIES contains glyph indices for default, invalid
+// and blank glyphs. Just because ScriptShape succeeds does not mean
+// that a text run is rendered correctly. Some characters may be rendered
+// with default/invalid/blank glyphs. Therefore, we need to check if the glyph
+// array returned by ScriptShape contains any of those glyphs to make
+// sure that the text run is rendered successfully.
+// However, we should not subject zero-width characters to this test.
+
+bool UniscribeHelper::containsMissingGlyphs(const Shaping& shaping,
+                                            const SCRIPT_ITEM& run,
+                                            const SCRIPT_FONTPROPERTIES* properties) const
+{
+    for (int i = 0; i < shaping.charLength(); i++) {
+        UChar c = m_input[run.iCharPos + i];
+        // Skip zero-width space characters because they're not considered to be missing in a font.
+        if (Font::treatAsZeroWidthSpaceInComplexScript(c))
+            continue;
+        int glyphIndex = shaping.m_logs[i];
+        WORD glyph = shaping.m_glyphs[glyphIndex];
+        if (glyph == properties->wgDefault
+            || (glyph == properties->wgInvalid && glyph != properties->wgBlank))
+            return true;
+    }
+    return false;
+}
+
+
 }  // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/UniscribeHelper.h b/Source/WebCore/platform/graphics/chromium/UniscribeHelper.h
index ffd57db..4bcdbd6 100644
--- a/Source/WebCore/platform/graphics/chromium/UniscribeHelper.h
+++ b/Source/WebCore/platform/graphics/chromium/UniscribeHelper.h
@@ -76,7 +76,8 @@ public:
                     bool isRtl,
                     HFONT,
                     SCRIPT_CACHE*,
-                    SCRIPT_FONTPROPERTIES*);
+                    SCRIPT_FONTPROPERTIES*,
+                    WORD);
 
     virtual ~UniscribeHelper();
 
@@ -225,7 +226,9 @@ private:
             : m_prePadding(0)
             , m_hfont(NULL)
             , m_scriptCache(NULL)
-            , m_ascentOffset(0) {
+            , m_ascentOffset(0)
+            , m_spaceGlyph(0)
+        {
             m_abc.abcA = 0;
             m_abc.abcB = 0;
             m_abc.abcC = 0;
@@ -319,6 +322,8 @@ private:
         // when drawing a string, to align multiple runs rendered with
         // different fonts.
         int m_ascentOffset;
+
+        WORD m_spaceGlyph;
     };
 
     // Computes the runs_ array from the text run.
@@ -343,6 +348,10 @@ private:
     // Returns the total width of a single item.
     int advanceForItem(int) const;
 
+    bool containsMissingGlyphs(const Shaping&,
+                               const SCRIPT_ITEM&,
+                               const SCRIPT_FONTPROPERTIES*) const;
+
     // Shapes a run (pointed to by |input|) using |hfont| first.
     // Tries a series of fonts specified retrieved with NextWinFontData
     // and finally a font covering characters in |*input|. A string pointed
@@ -384,6 +393,7 @@ private:
     int m_ascent;
     LOGFONT m_logfont;
     int m_style;
+    WORD m_spaceGlyph;
 
     // Options, see the getters/setters above.
     bool m_directionalOverride;
diff --git a/Source/WebCore/platform/graphics/chromium/UniscribeHelperTextRun.cpp b/Source/WebCore/platform/graphics/chromium/UniscribeHelperTextRun.cpp
index c060b43..8e0bc04 100644
--- a/Source/WebCore/platform/graphics/chromium/UniscribeHelperTextRun.cpp
+++ b/Source/WebCore/platform/graphics/chromium/UniscribeHelperTextRun.cpp
@@ -43,7 +43,8 @@ UniscribeHelperTextRun::UniscribeHelperTextRun(const TextRun& run,
     : UniscribeHelper(run.characters(), run.length(), run.rtl(),
                       font.primaryFont()->platformData().hfont(),
                       font.primaryFont()->platformData().scriptCache(),
-                      font.primaryFont()->platformData().scriptFontProperties())
+                      font.primaryFont()->platformData().scriptFontProperties(),
+                      font.primaryFont()->spaceGlyph())
     , m_font(&font)
     , m_fontIndex(0)
 {
@@ -69,7 +70,7 @@ UniscribeHelperTextRun::UniscribeHelperTextRun(
     SCRIPT_CACHE* scriptCache,
     SCRIPT_FONTPROPERTIES* fontProperties)
     : UniscribeHelper(input, inputLength, isRtl, hfont,
-                      scriptCache, fontProperties)
+                      scriptCache, fontProperties, 0)
     , m_font(0)
     , m_fontIndex(-1)
 {
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index 182e730..e75df24 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -96,7 +96,7 @@ void VideoLayerChromium::cleanupResources()
 
 void VideoLayerChromium::updateCompositorResources()
 {
-    if (!m_contentsDirty)
+    if (!m_contentsDirty || !m_owner)
         return;
 
     RenderLayerBacking* backing = static_cast<RenderLayerBacking*>(m_owner->client());
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
index 652e752..aef14ed 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
@@ -51,6 +51,12 @@ WebGLLayerChromium::WebGLLayerChromium(GraphicsLayerChromium* owner)
 {
 }
 
+WebGLLayerChromium::~WebGLLayerChromium()
+{
+    if (m_context && layerRenderer())
+        layerRenderer()->removeChildContext(m_context);
+}
+
 void WebGLLayerChromium::updateCompositorResources()
 {
     if (!m_contentsDirty)
@@ -70,6 +76,9 @@ void WebGLLayerChromium::updateCompositorResources()
     }
     // Update the contents of the texture used by the compositor.
     if (m_contentsDirty && m_textureUpdated) {
+        // prepareTexture copies the contents of the off-screen render target into the texture
+        // used by the compositor.
+        //
         m_context->prepareTexture();
         m_context->markLayerComposited();
         m_contentsDirty = false;
@@ -84,6 +93,13 @@ void WebGLLayerChromium::setTextureUpdated()
 
 void WebGLLayerChromium::setContext(const GraphicsContext3D* context)
 {
+    if (m_context != context && layerRenderer()) {
+        if (m_context)
+            layerRenderer()->removeChildContext(m_context);
+        if (context)
+            layerRenderer()->addChildContext(const_cast<GraphicsContext3D*>(context));
+    }
+
     m_context = const_cast<GraphicsContext3D*>(context);
 
     unsigned int textureId = m_context->platformTexture();
@@ -95,5 +111,19 @@ void WebGLLayerChromium::setContext(const GraphicsContext3D* context)
     m_premultipliedAlpha = m_context->getContextAttributes().premultipliedAlpha;
 }
 
+void WebGLLayerChromium::setLayerRenderer(LayerRendererChromium* newLayerRenderer)
+{
+    if (layerRenderer() != newLayerRenderer) {
+        if (m_context) {
+            if (layerRenderer())
+                layerRenderer()->removeChildContext(m_context);
+            if (newLayerRenderer)
+                newLayerRenderer->addChildContext(m_context);
+        }
+
+        LayerChromium::setLayerRenderer(newLayerRenderer);
+    }
+}
+
 }
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
index 33db730..342275b 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
@@ -44,12 +44,17 @@ class GraphicsContext3D;
 class WebGLLayerChromium : public CanvasLayerChromium {
 public:
     static PassRefPtr<WebGLLayerChromium> create(GraphicsLayerChromium* owner = 0);
+
+    virtual ~WebGLLayerChromium();
+
     virtual bool drawsContent() const { return m_context; }
     virtual void updateCompositorResources();
     void setTextureUpdated();
 
     void setContext(const GraphicsContext3D* context);
 
+    virtual void setLayerRenderer(LayerRendererChromium*);
+
 protected:
     virtual const char* layerTypeAsString() const { return "WebGLLayer"; }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp
index 649d049..d70e15c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp
@@ -47,7 +47,7 @@ CCCanvasLayerImpl::~CCCanvasLayerImpl()
 {
 }
 
-void CCCanvasLayerImpl::draw()
+void CCCanvasLayerImpl::draw(const IntRect&)
 {
     ASSERT(layerRenderer());
     const CCCanvasLayerImpl::Program* program = layerRenderer()->canvasLayerProgram();
@@ -77,4 +77,3 @@ void CCCanvasLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
 }
 
 #endif // USE(ACCELERATED_COMPOSITING)
-
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
index 8cbf8d1..3aa917c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
@@ -42,7 +42,7 @@ public:
 
     typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
 
-    virtual void draw();
+    virtual void draw(const IntRect&);
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
 
@@ -58,4 +58,3 @@ private:
 }
 
 #endif // CCCanvasLayerImpl_h
-
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCompletionEvent.h b/Source/WebCore/platform/graphics/chromium/cc/CCCompletionEvent.h
new file mode 100644
index 0000000..a8ac151
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCompletionEvent.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCCompletionEvent_h
+#define CCCompletionEvent_h
+
+#include <wtf/ThreadingPrimitives.h>
+
+namespace WebCore {
+
+class CCCompletionEvent {
+public:
+    CCCompletionEvent()
+    {
+        m_mutex.lock();
+    }
+
+    ~CCCompletionEvent()
+    {
+        m_mutex.unlock();
+    }
+
+    void wait()
+    {
+        m_condition.wait(m_mutex);
+    }
+
+    void signal()
+    {
+        MutexLocker lock(m_mutex);
+        m_condition.signal();
+    }
+
+private:
+    Mutex m_mutex;
+    ThreadCondition m_condition;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
index 404944b..d22b098 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
@@ -44,13 +44,30 @@ namespace WebCore {
 using namespace std;
 
 CCHeadsUpDisplay::CCHeadsUpDisplay(LayerRendererChromium* owner)
-    : m_currentFrameNumber(0)
+    : m_currentFrameNumber(1)
+    , m_filteredFrameTime(0)
     , m_layerRenderer(owner)
     , m_showFPSCounter(false)
     , m_showPlatformLayerTree(false)
 {
     m_presentTimeHistoryInSec[0] = currentTime();
     m_presentTimeHistoryInSec[1] = m_presentTimeHistoryInSec[0];
+    for (int i = 2; i < kPresentHistorySize; i++)
+        m_presentTimeHistoryInSec[i] = 0;
+
+    FontDescription mediumFontDesc;
+    mediumFontDesc.setGenericFamily(FontDescription::MonospaceFamily);
+    mediumFontDesc.setComputedSize(20);
+
+    m_mediumFont = adoptPtr(new Font(mediumFontDesc, 0, 0));
+    m_mediumFont->update(0);
+
+    FontDescription smallFontDesc;
+    smallFontDesc.setGenericFamily(FontDescription::MonospaceFamily);
+    smallFontDesc.setComputedSize(10);
+
+    m_smallFont = adoptPtr(new Font(smallFontDesc, 0, 0));
+    m_smallFont->update(0);
 }
 
 CCHeadsUpDisplay::~CCHeadsUpDisplay()
@@ -79,7 +96,7 @@ void CCHeadsUpDisplay::draw()
     PlatformCanvas canvas;
     canvas.resize(hudSize);
     {
-        PlatformCanvas::Painter painter(&canvas);
+        PlatformCanvas::Painter painter(&canvas, PlatformCanvas::Painter::GrayscaleText);
         drawHudContents(painter.context(), hudSize);
     }
 
@@ -92,7 +109,7 @@ void CCHeadsUpDisplay::draw()
     }
 
     // Draw the HUD onto the default render surface.
-    const ContentLayerChromium::Program* program = m_layerRenderer->contentLayerProgram();
+    const LayerTilerChromium::Program* program = m_layerRenderer->tilerProgram();
     ASSERT(program && program->initialized());
     GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
     m_hudTexture->bindTexture();
@@ -111,59 +128,98 @@ void CCHeadsUpDisplay::draw()
 
 void CCHeadsUpDisplay::drawHudContents(GraphicsContext* ctx, const IntSize& hudSize)
 {
-    FontDescription mediumFontDesc;
-    mediumFontDesc.setGenericFamily(FontDescription::MonospaceFamily);
-    mediumFontDesc.setComputedSize(12);
-    Font mediumFont(mediumFontDesc, 0, 0);
-    mediumFont.update(0);
-
-    FontDescription smallFontDesc;
-    smallFontDesc.setGenericFamily(FontDescription::MonospaceFamily);
-    smallFontDesc.setComputedSize(10);
-    Font smallFont(smallFontDesc, 0, 0);
-    smallFont.update(0);
-
-    // We haven't finished rendering yet, so we don't now the "current" present time.
-    // So, consider the *last two* present times and use those as our present time.
-    double secForLastFrame = m_presentTimeHistoryInSec[(m_currentFrameNumber - 1) % 2] - m_presentTimeHistoryInSec[m_currentFrameNumber % 2];
-
-    int y = 14;
-
     if (m_showPlatformLayerTree) {
         ctx->setFillColor(Color(0, 0, 0, 192), ColorSpaceDeviceRGB);
         ctx->fillRect(FloatRect(0, 0, hudSize.width(), hudSize.height()));
     }
 
-    // Draw fps.
-    String topLine = "";
-    if (secForLastFrame > 0 && m_showFPSCounter) {
-        double fps = 1.0 / secForLastFrame;
-        topLine += String::format("FPS: %3.1f", fps);
-    }
-    if (topLine.length()) {
-        ctx->setFillColor(Color(0, 0, 0, 255), ColorSpaceDeviceRGB);
-        TextRun run(topLine);
-        ctx->fillRect(FloatRect(2, 2, mediumFont.width(run) + 2.0f, 15));
+    int fpsCounterHeight = m_mediumFont->fontMetrics().floatHeight() + 2;
+    int fpsCounterTop = 2;
+    int platformLayerTreeTop;
+    if (m_showFPSCounter)
+        platformLayerTreeTop = fpsCounterTop + fpsCounterHeight + 2;
+    else
+        platformLayerTreeTop = 0;
+
+    if (m_showFPSCounter)
+        drawFPSCounter(ctx, fpsCounterTop, fpsCounterHeight);
+
+    if (m_showPlatformLayerTree)
+        drawPlatformLayerTree(ctx, platformLayerTreeTop);
+}
+
+void CCHeadsUpDisplay::drawFPSCounter(GraphicsContext* ctx, int top, int height)
+{
+    // Note that since we haven't finished the current frame, the FPS counter
+    // actually reports the last frame's time.
+    double secForLastFrame = m_presentTimeHistoryInSec[(m_currentFrameNumber + kPresentHistorySize - 1) % kPresentHistorySize] -
+                             m_presentTimeHistoryInSec[(m_currentFrameNumber + kPresentHistorySize - 2) % kPresentHistorySize];
+
+    // Filter the frame times to avoid spikes.
+    const float alpha = 0.1;
+    if (!m_filteredFrameTime) {
+        if (m_currentFrameNumber == 2)
+            m_filteredFrameTime = secForLastFrame;
+    } else
+        m_filteredFrameTime = ((1.0 - alpha) * m_filteredFrameTime) + (alpha * secForLastFrame);
+
+    // Create & measure FPS text.
+    String text(String::format("FPS: %5.1f", 1.0 / m_filteredFrameTime));
+    TextRun run(text);
+    float textWidth = m_mediumFont->width(run) + 2.0f;
+    float graphWidth = kPresentHistorySize;
+
+    // Draw background.
+    ctx->setFillColor(Color(0, 0, 0, 255), ColorSpaceDeviceRGB);
+    ctx->fillRect(FloatRect(2, top, textWidth + graphWidth, height));
+
+    // Draw FPS text.
+    if (m_filteredFrameTime) {
         ctx->setFillColor(Color(255, 0, 0), ColorSpaceDeviceRGB);
-        ctx->drawText(mediumFont, run, IntPoint(3, y));
-        y = 26;
+        ctx->drawText(*m_mediumFont, run, IntPoint(3, top + height - 6));
     }
 
-    // Draw layer tree, if enabled.
-    if (m_showPlatformLayerTree) {
-        ctx->setFillColor(Color(255, 0, 0), ColorSpaceDeviceRGB);
-        Vector<String> lines;
-        m_layerRenderer->layerTreeAsText().split('\n', lines);
-        for (size_t i = 0; i < lines.size(); ++i) {
-            ctx->drawText(smallFont, TextRun(lines[i]), IntPoint(2, y));
-            y += 12;
-        }
+    // Draw FPS graph.
+    const double loFPS = 0.0;
+    const double hiFPS = 120.0;
+    ctx->setStrokeStyle(SolidStroke);
+    ctx->setStrokeColor(Color(255, 0, 0), ColorSpaceDeviceRGB);
+    int graphLeft = static_cast<int>(textWidth + 3);
+    IntPoint prev(-1, 0);
+    int x = 0;
+    double h = static_cast<double>(height - 2);
+    for (int i = m_currentFrameNumber % kPresentHistorySize; i != (m_currentFrameNumber - 1) % kPresentHistorySize; i = (i + 1) % kPresentHistorySize) {
+        int j = (i + 1) % kPresentHistorySize;
+        double fps = 1.0 / (m_presentTimeHistoryInSec[j] - m_presentTimeHistoryInSec[i]);
+        double p = 1 - ((fps - loFPS) / (hiFPS - loFPS));
+        if (p < 0)
+            p = 0;
+        if (p > 1)
+            p = 1;
+        IntPoint cur(graphLeft + x, 1 + top + p*h);
+        if (prev.x() != -1)
+            ctx->drawLine(prev, cur);
+        prev = cur;
+        x += 1;
+    }
+}
+
+void CCHeadsUpDisplay::drawPlatformLayerTree(GraphicsContext* ctx, int top)
+{
+    float smallFontHeight = m_smallFont->fontMetrics().floatHeight();
+    int y = top + smallFontHeight - 4;
+    ctx->setFillColor(Color(255, 0, 0), ColorSpaceDeviceRGB);
+    Vector<String> lines;
+    m_layerRenderer->layerTreeAsText().split('\n', lines);
+    for (size_t i = 0; i < lines.size(); ++i) {
+        ctx->drawText(*m_smallFont, TextRun(lines[i]), IntPoint(2, y));
+        y += smallFontHeight;
     }
 }
 
 void CCHeadsUpDisplay::onPresent()
 {
-    m_presentTimeHistoryInSec[m_currentFrameNumber % 2] = currentTime();
+    m_presentTimeHistoryInSec[m_currentFrameNumber % kPresentHistorySize] = currentTime();
     m_currentFrameNumber += 1;
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
index d56f8ab..09f198a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
@@ -27,8 +27,10 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "Font.h"
 #include "LayerRendererChromium.h"
 
+
 namespace WebCore {
 
 class GeometryBinding;
@@ -59,17 +61,26 @@ public:
 private:
     explicit CCHeadsUpDisplay(LayerRendererChromium* owner);
     void drawHudContents(GraphicsContext*, const IntSize& hudSize);
+    void drawFPSCounter(GraphicsContext*, int top, int height);
+    void drawPlatformLayerTree(GraphicsContext*, int top);
+
 
     int m_currentFrameNumber;
 
+    double m_filteredFrameTime;
+
     OwnPtr<LayerTexture> m_hudTexture;
 
     LayerRendererChromium* m_layerRenderer;
 
-    double m_presentTimeHistoryInSec[2];
+    static const int kPresentHistorySize = 64;
+    double m_presentTimeHistoryInSec[kPresentHistorySize];
 
     bool m_showFPSCounter;
     bool m_showPlatformLayerTree;
+
+    OwnPtr<Font> m_smallFont;
+    OwnPtr<Font> m_mediumFont;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 9411e5a..e2d651d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -126,12 +126,12 @@ bool CCLayerImpl::descendantsDrawsContent()
 // These belong on CCLayerImpl, but should be overridden by each type and not defer to the LayerChromium subtypes.
 bool CCLayerImpl::drawsContent() const
 {
-    return m_owner->drawsContent();
+    return m_owner && m_owner->drawsContent();
 }
 
-void CCLayerImpl::draw()
+void CCLayerImpl::draw(const IntRect& targetSurfaceRect)
 {
-    return m_owner->draw();
+    return m_owner->draw(targetSurfaceRect);
 }
 
 void CCLayerImpl::updateCompositorResources()
@@ -215,4 +215,3 @@ void CCLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
 }
 
 #endif // USE(ACCELERATED_COMPOSITING)
-
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 96c4f1b..649f4dd 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -50,6 +50,7 @@ public:
     }
     // When this class gets subclasses, remember to add 'virtual' here.
     virtual ~CCLayerImpl();
+    void resetOwner() { m_owner = 0; }
 
 #ifndef NDEBUG
     int debugID() const { return m_debugID; }
@@ -59,7 +60,7 @@ public:
     CCLayerImpl* maskLayer() const;
     CCLayerImpl* replicaLayer() const;
 
-    virtual void draw();
+    virtual void draw(const IntRect& contentRect);
     virtual void updateCompositorResources();
     void unreserveContentsTexture();
     void bindContentsTexture();
@@ -205,4 +206,3 @@ private:
 }
 
 #endif // CCLayerImpl_h
-
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCMainThread.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCMainThread.cpp
new file mode 100644
index 0000000..cd36817
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCMainThread.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+
+#include "CCMainThread.h"
+
+#include <wtf/MainThread.h>
+
+using namespace WTF;
+
+namespace WebCore {
+
+void CCMainThread::performTask(void* userdata)
+{
+    Task* task = static_cast<Task*>(userdata);
+    task->performTask();
+    delete task;
+}
+
+void CCMainThread::postTask(PassOwnPtr<Task> task)
+{
+    callOnMainThread(performTask, task.leakPtr());
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCMainThread.h b/Source/WebCore/platform/graphics/chromium/cc/CCMainThread.h
new file mode 100644
index 0000000..ca8e8c1
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCMainThread.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CCMainThread_h
+#define CCMainThread_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+// Task wrapper around WTF::callOnMainThreadThread
+class CCMainThread {
+public:
+    class Task {
+        WTF_MAKE_NONCOPYABLE(Task);
+    public:
+        virtual ~Task() { }
+        virtual void performTask() = 0;
+        void* instance() const { return m_instance; }
+    protected:
+        Task(void* instance) : m_instance(instance) { }
+        void* m_instance;
+    };
+
+    static void postTask(PassOwnPtr<Task>); // Executes the task on main thread asynchronously.
+private:
+    static void performTask(void*);
+};
+
+} // namespace WebCore
+
+#endif // CCMainThread_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCMainThreadTask.h b/Source/WebCore/platform/graphics/chromium/cc/CCMainThreadTask.h
new file mode 100644
index 0000000..7de8d71
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCMainThreadTask.h
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CCMainThreadTask_h
+#define CCMainThreadTask_h
+
+#include "CCMainThread.h"
+#include "CrossThreadCopier.h"
+#include "CrossThreadTask.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+template<typename T>
+class MainThreadTask0 : public CCMainThread::Task {
+public:
+    typedef void (T::*Method)();
+    typedef MainThreadTask0<T> MainThreadTaskImpl;
+
+    static PassOwnPtr<MainThreadTaskImpl> create(T* instance, Method method)
+    {
+        return adoptPtr(new MainThreadTaskImpl(instance, method));
+    }
+
+private:
+    MainThreadTask0(T* instance, Method method)
+        : CCMainThread::Task(instance)
+        , m_method(method)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)();
+    }
+
+private:
+    Method m_method;
+};
+
+template<typename T, typename P1, typename MP1>
+class MainThreadTask1 : public CCMainThread::Task {
+public:
+    typedef void (T::*Method)(MP1);
+    typedef MainThreadTask1<T, P1, MP1> MainThreadTaskImpl;
+    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
+
+    static PassOwnPtr<MainThreadTaskImpl> create(T* instance, Method method, Param1 parameter1)
+    {
+        return adoptPtr(new MainThreadTaskImpl(instance, method, parameter1));
+    }
+
+private:
+    MainThreadTask1(T* instance, Method method, Param1 parameter1)
+        : CCMainThread::Task(instance)
+        , m_method(method)
+        , m_parameter1(parameter1)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)(m_parameter1);
+    }
+
+private:
+    Method m_method;
+    P1 m_parameter1;
+};
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2>
+class MainThreadTask2 : public CCMainThread::Task {
+public:
+    typedef void (T::*Method)(MP1, MP2);
+    typedef MainThreadTask2<T, P1, MP1, P2, MP2> MainThreadTaskImpl;
+    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
+    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
+
+    static PassOwnPtr<MainThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2)
+    {
+        return adoptPtr(new MainThreadTaskImpl(instance, method, parameter1, parameter2));
+    }
+
+private:
+    MainThreadTask2(T* instance, Method method, Param1 parameter1, Param2 parameter2)
+        : CCMainThread::Task(instance)
+        , m_method(method)
+        , m_parameter1(parameter1)
+        , m_parameter2(parameter2)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)(m_parameter1, m_parameter2);
+    }
+
+private:
+    Method m_method;
+    P1 m_parameter1;
+    P2 m_parameter2;
+};
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
+class MainThreadTask3 : public CCMainThread::Task {
+public:
+    typedef void (T::*Method)(MP1, MP2, MP3);
+    typedef MainThreadTask3<T, P1, MP1, P2, MP2, P3, MP3> MainThreadTaskImpl;
+    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
+    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
+    typedef typename CrossThreadTaskTraits<P3>::ParamType Param3;
+
+    static PassOwnPtr<MainThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+    {
+        return adoptPtr(new MainThreadTaskImpl(instance, method, parameter1, parameter2, parameter3));
+    }
+
+private:
+    MainThreadTask3(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+        : CCMainThread::Task(instance)
+        , m_method(method)
+        , m_parameter1(parameter1)
+        , m_parameter2(parameter2)
+        , m_parameter3(parameter3)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)(m_parameter1, m_parameter2, m_parameter3);
+    }
+
+private:
+    Method m_method;
+    P1 m_parameter1;
+    P2 m_parameter2;
+    P3 m_parameter3;
+};
+
+template<typename T>
+PassOwnPtr<CCMainThread::Task> createMainThreadTask(
+    T* const callee,
+    void (T::*method)());
+
+template<typename T>
+PassOwnPtr<CCMainThread::Task> createMainThreadTask(
+    T* const callee,
+    void (T::*method)())
+{
+    return MainThreadTask0<T>::create(
+        callee,
+        method);
+}
+
+template<typename T, typename P1, typename MP1>
+PassOwnPtr<CCMainThread::Task> createMainThreadTask(
+    T* const callee,
+    void (T::*method)(MP1),
+    const P1& parameter1)
+{
+    return MainThreadTask1<T, typename CrossThreadCopier<P1>::Type, MP1>::create(
+        callee,
+        method,
+        CrossThreadCopier<P1>::copy(parameter1));
+}
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2>
+PassOwnPtr<CCMainThread::Task> createMainThreadTask(
+    T* const callee,
+    void (T::*method)(MP1, MP2),
+    const P1& parameter1,
+    const P2& parameter2)
+{
+    return MainThreadTask2<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2>::create(
+        callee,
+        method,
+        CrossThreadCopier<P1>::copy(parameter1),
+        CrossThreadCopier<P2>::copy(parameter2));
+}
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
+PassOwnPtr<CCMainThread::Task> createMainThreadTask(
+    T* const callee,
+    void (T::*method)(MP1, MP2, MP3),
+    const P1& parameter1,
+    const P2& parameter2,
+    const P3& parameter3)
+{
+    return MainThreadTask3<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3>::create(
+        callee,
+        method,
+        CrossThreadCopier<P1>::copy(parameter1),
+        CrossThreadCopier<P2>::copy(parameter2),
+        CrossThreadCopier<P3>::copy(parameter3));
+}
+
+} // namespace WebCore
+
+#endif // CCMainThreadTask_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
index 4aef639..a428829 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
@@ -46,7 +46,7 @@ CCPluginLayerImpl::~CCPluginLayerImpl()
 {
 }
 
-void CCPluginLayerImpl::draw()
+void CCPluginLayerImpl::draw(const IntRect&)
 {
     ASSERT(layerRenderer());
     const CCPluginLayerImpl::Program* program = layerRenderer()->pluginLayerProgram();
@@ -81,4 +81,3 @@ void CCPluginLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
 }
 
 #endif // USE(ACCELERATED_COMPOSITING)
-
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
index 65eb5b7..4fd7457 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
@@ -42,7 +42,7 @@ public:
 
     typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
 
-    virtual void draw();
+    virtual void draw(const IntRect&);
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
 
@@ -57,4 +57,3 @@ private:
 }
 
 #endif // CCPluginLayerImpl_h
-
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThread.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThread.cpp
new file mode 100644
index 0000000..9566584
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThread.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CCThread.h"
+
+#include "LayerRendererChromium.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/ThreadingPrimitives.h>
+
+namespace WebCore {
+
+using namespace WTF;
+
+CCThread::CCThread()
+{
+    MutexLocker lock(m_threadCreationMutex);
+    m_threadID = createThread(CCThread::compositorThreadStart, this, "Chromium Compositor");
+}
+
+CCThread::~CCThread()
+{
+    m_queue.kill();
+
+    // Stop thread.
+    void* exitCode;
+    waitForThreadCompletion(m_threadID, &exitCode);
+    m_threadID = 0;
+}
+
+void CCThread::postTask(PassOwnPtr<Task> task)
+{
+    m_queue.append(task);
+}
+
+void* CCThread::compositorThreadStart(void* userdata)
+{
+    CCThread* ccThread = static_cast<CCThread*>(userdata);
+    return ccThread->runLoop();
+}
+
+void* CCThread::runLoop()
+{
+    {
+        // Wait for CCThread::start() to complete to have m_threadID
+        // established before starting the main loop.
+        MutexLocker lock(m_threadCreationMutex);
+    }
+
+    while (OwnPtr<Task> task = m_queue.waitForMessage())
+        task->performTask();
+
+    return 0;
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThread.h b/Source/WebCore/platform/graphics/chromium/cc/CCThread.h
new file mode 100644
index 0000000..177d3f3
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThread.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCThread_h
+#define CCThread_h
+
+#include <wtf/MessageQueue.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+// The CCThread singleton owns the compositor thread and provides
+// basic infrastructure for messaging between the two threads.
+class CCThread {
+public:
+    static PassOwnPtr<CCThread> create()
+    {
+        return adoptPtr(new CCThread());
+    }
+
+    virtual ~CCThread();
+
+    class Task {
+        WTF_MAKE_NONCOPYABLE(Task);
+    public:
+        virtual ~Task() { }
+        virtual void performTask() = 0;
+        void* instance() const { return m_instance; }
+    protected:
+        Task(void* instance) : m_instance(instance) { }
+        void* m_instance;
+    };
+
+    void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
+
+    WTF::ThreadIdentifier threadID() const { return m_threadID; }
+
+protected:
+    explicit CCThread();
+
+    static void* compositorThreadStart(void*);
+    void* runLoop();
+
+    WTF::ThreadIdentifier m_threadID;
+    MessageQueue<Task> m_queue;
+
+    Mutex m_threadCreationMutex;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadTask.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadTask.h
new file mode 100644
index 0000000..71245d3
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadTask.h
@@ -0,0 +1,279 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CCThreadTask_h
+#define CCThreadTask_h
+
+#include "CCThread.h"
+#include "CrossThreadCopier.h"
+#include "CrossThreadTask.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+template<typename T>
+class CCThreadTask0 : public CCThread::Task {
+public:
+    typedef void (T::*Method)();
+    typedef CCThreadTask0<T> CCThreadTaskImpl;
+
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method)
+    {
+        return adoptPtr(new CCThreadTaskImpl(instance, method));
+    }
+
+private:
+    CCThreadTask0(T* instance, Method method)
+        : CCThread::Task(instance)
+        , m_method(method)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)();
+    }
+
+private:
+    Method m_method;
+};
+
+template<typename T, typename P1, typename MP1>
+class CCThreadTask1 : public CCThread::Task {
+public:
+    typedef void (T::*Method)(MP1);
+    typedef CCThreadTask1<T, P1, MP1> CCThreadTaskImpl;
+    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
+
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1)
+    {
+        return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1));
+    }
+
+private:
+    CCThreadTask1(T* instance, Method method, Param1 parameter1)
+        : CCThread::Task(instance)
+        , m_method(method)
+        , m_parameter1(parameter1)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)(m_parameter1);
+    }
+
+private:
+    Method m_method;
+    P1 m_parameter1;
+};
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2>
+class CCThreadTask2 : public CCThread::Task {
+public:
+    typedef void (T::*Method)(MP1, MP2);
+    typedef CCThreadTask2<T, P1, MP1, P2, MP2> CCThreadTaskImpl;
+    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
+    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
+
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2)
+    {
+        return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1, parameter2));
+    }
+
+private:
+    CCThreadTask2(T* instance, Method method, Param1 parameter1, Param2 parameter2)
+        : CCThread::Task(instance)
+        , m_method(method)
+        , m_parameter1(parameter1)
+        , m_parameter2(parameter2)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)(m_parameter1, m_parameter2);
+    }
+
+private:
+    Method m_method;
+    P1 m_parameter1;
+    P2 m_parameter2;
+};
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
+class CCThreadTask3 : public CCThread::Task {
+public:
+    typedef void (T::*Method)(MP1, MP2, MP3);
+    typedef CCThreadTask3<T, P1, MP1, P2, MP2, P3, MP3> CCThreadTaskImpl;
+    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
+    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
+    typedef typename CrossThreadTaskTraits<P3>::ParamType Param3;
+
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+    {
+        return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1, parameter2, parameter3));
+    }
+
+private:
+    CCThreadTask3(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+        : CCThread::Task(instance)
+        , m_method(method)
+        , m_parameter1(parameter1)
+        , m_parameter2(parameter2)
+        , m_parameter3(parameter3)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)(m_parameter1, m_parameter2, m_parameter3);
+    }
+
+private:
+    Method m_method;
+    P1 m_parameter1;
+    P2 m_parameter2;
+    P3 m_parameter3;
+};
+
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4>
+class CCThreadTask4 : public CCThread::Task {
+public:
+    typedef void (T::*Method)(MP1, MP2, MP3, MP4);
+    typedef CCThreadTask4<T, P1, MP1, P2, MP2, P3, MP3, P4, MP4> CCThreadTaskImpl;
+    typedef typename CrossThreadTaskTraits<P1>::ParamType Param1;
+    typedef typename CrossThreadTaskTraits<P2>::ParamType Param2;
+    typedef typename CrossThreadTaskTraits<P3>::ParamType Param3;
+    typedef typename CrossThreadTaskTraits<P4>::ParamType Param4;
+
+    static PassOwnPtr<CCThreadTaskImpl> create(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+    {
+        return adoptPtr(new CCThreadTaskImpl(instance, method, parameter1, parameter2, parameter3, parameter4));
+    }
+
+private:
+    CCThreadTask4(T* instance, Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+        : CCThread::Task(instance)
+        , m_method(method)
+        , m_parameter1(parameter1)
+        , m_parameter2(parameter2)
+        , m_parameter3(parameter3)
+        , m_parameter4(parameter4)
+    {
+    }
+
+    virtual void performTask()
+    {
+        (*static_cast<T*>(instance()).*m_method)(m_parameter1, m_parameter2, m_parameter3, m_parameter4);
+    }
+
+private:
+    Method m_method;
+    P1 m_parameter1;
+    P2 m_parameter2;
+    P3 m_parameter3;
+    P4 m_parameter4;
+};
+
+template<typename T>
+PassOwnPtr<CCThread::Task> createCCThreadTask(
+    T* const callee,
+    void (T::*method)());
+
+template<typename T>
+PassOwnPtr<CCThread::Task> createCCThreadTask(
+    T* const callee,
+    void (T::*method)())
+{
+    return CCThreadTask0<T>::create(
+        callee,
+        method);
+}
+
+template<typename T, typename P1, typename MP1>
+PassOwnPtr<CCThread::Task> createCCThreadTask(
+    T* const callee,
+    void (T::*method)(MP1),
+    const P1& parameter1)
+{
+    return CCThreadTask1<T, typename CrossThreadCopier<P1>::Type, MP1>::create(
+        callee,
+        method,
+        CrossThreadCopier<P1>::copy(parameter1));
+}
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2>
+PassOwnPtr<CCThread::Task> createCCThreadTask(
+    T* const callee,
+    void (T::*method)(MP1, MP2),
+    const P1& parameter1,
+    const P2& parameter2)
+{
+    return CCThreadTask2<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2>::create(
+        callee,
+        method,
+        CrossThreadCopier<P1>::copy(parameter1),
+        CrossThreadCopier<P2>::copy(parameter2));
+}
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
+PassOwnPtr<CCThread::Task> createCCThreadTask(
+    T* const callee,
+    void (T::*method)(MP1, MP2, MP3),
+    const P1& parameter1,
+    const P2& parameter2,
+    const P3& parameter3)
+{
+    return CCThreadTask3<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3>::create(
+        callee,
+        method,
+        CrossThreadCopier<P1>::copy(parameter1),
+        CrossThreadCopier<P2>::copy(parameter2),
+        CrossThreadCopier<P3>::copy(parameter3));
+}
+
+template<typename T, typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4>
+PassOwnPtr<CCThread::Task> createCCThreadTask(
+    T* const callee,
+    void (T::*method)(MP1, MP2, MP3, MP4),
+    const P1& parameter1,
+    const P2& parameter2,
+    const P3& parameter3,
+    const P4& parameter4)
+{
+    return CCThreadTask4<T, typename CrossThreadCopier<P1>::Type, MP1, typename CrossThreadCopier<P2>::Type, MP2, typename CrossThreadCopier<P3>::Type, MP3, typename CrossThreadCopier<P4>::Type, MP4>::create(
+        callee,
+        method,
+        CrossThreadCopier<P1>::copy(parameter1),
+        CrossThreadCopier<P2>::copy(parameter2),
+        CrossThreadCopier<P3>::copy(parameter3),
+        CrossThreadCopier<P4>::copy(parameter4));
+
+}
+
+} // namespace WebCore
+
+#endif // CCThreadTask_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
index eb3612b..99a148d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -75,7 +75,7 @@ void CCVideoLayerImpl::setTexture(size_t i, VideoLayerChromium::Texture texture)
     m_textures[i] = texture;
 }
 
-void CCVideoLayerImpl::draw()
+void CCVideoLayerImpl::draw(const IntRect&)
 {
     if (m_skipsDraw)
         return;
@@ -170,4 +170,3 @@ void CCVideoLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
 }
 
 #endif // USE(ACCELERATED_COMPOSITING)
-
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
index 62f8778..0e1d1f6 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
@@ -47,7 +47,7 @@ public:
     typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> RGBAProgram;
     typedef ProgramBinding<VertexShaderPosTexYUVStretch, FragmentShaderYUVVideo> YUVProgram;
 
-    virtual void draw();
+    virtual void draw(const IntRect&);
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
 
@@ -72,4 +72,3 @@ private:
 }
 
 #endif // CCVideoLayerImpl_h
-
diff --git a/Source/WebCore/platform/graphics/filters/FEFlood.cpp b/Source/WebCore/platform/graphics/filters/FEFlood.cpp
index 3c48cf9..d832d2b 100644
--- a/Source/WebCore/platform/graphics/filters/FEFlood.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEFlood.cpp
@@ -49,9 +49,12 @@ Color FEFlood::floodColor() const
     return m_floodColor;
 }
 
-void FEFlood::setFloodColor(const Color& color)
+bool FEFlood::setFloodColor(const Color& color)
 {
+    if (m_floodColor == color)
+        return false;
     m_floodColor = color;
+    return true;
 }
 
 float FEFlood::floodOpacity() const
@@ -59,9 +62,12 @@ float FEFlood::floodOpacity() const
     return m_floodOpacity;
 }
 
-void FEFlood::setFloodOpacity(float floodOpacity)
+bool FEFlood::setFloodOpacity(float floodOpacity)
 {
+    if (m_floodOpacity == floodOpacity)
+        return false;
     m_floodOpacity = floodOpacity;
+    return true;
 }
 
 void FEFlood::apply()
diff --git a/Source/WebCore/platform/graphics/filters/FEFlood.h b/Source/WebCore/platform/graphics/filters/FEFlood.h
index 2e8824f..cac4153 100644
--- a/Source/WebCore/platform/graphics/filters/FEFlood.h
+++ b/Source/WebCore/platform/graphics/filters/FEFlood.h
@@ -34,10 +34,10 @@ public:
     static PassRefPtr<FEFlood> create(Filter* filter, const Color&, float);
 
     Color floodColor() const;
-    void setFloodColor(const Color &);
+    bool setFloodColor(const Color &);
 
     float floodOpacity() const;
-    void setFloodOpacity(float);
+    bool setFloodOpacity(float);
 
     virtual void apply();
     virtual void dump();
diff --git a/Source/WebCore/platform/graphics/filters/FELighting.cpp b/Source/WebCore/platform/graphics/filters/FELighting.cpp
index ec1ca88..13a69fd 100644
--- a/Source/WebCore/platform/graphics/filters/FELighting.cpp
+++ b/Source/WebCore/platform/graphics/filters/FELighting.cpp
@@ -30,6 +30,13 @@
 #include "FELighting.h"
 
 #include "LightSource.h"
+#include "PointLightSource.h"
+#include "SpotLightSource.h"
+
+#if CPU(ARM_NEON) && COMPILER(GCC)
+#include "FELightingNEON.h"
+#include <wtf/Vector.h>
+#endif
 
 namespace WebCore {
 
@@ -301,6 +308,9 @@ bool FELighting::drawLighting(ByteArray* pixels, int width, int height)
 
     if (width >= 3 && height >= 3) {
         // Interior pixels
+#if CPU(ARM_NEON) && COMPILER(GCC)
+        drawInteriorPixels(data, paintingData);
+#else
         for (int y = 1; y < data.heightDecreasedByOne; ++y) {
             offset = y * data.widthMultipliedByPixelSize + cPixelSize;
             for (int x = 1; x < data.widthDecreasedByOne; ++x, offset += cPixelSize) {
@@ -308,6 +318,7 @@ bool FELighting::drawLighting(ByteArray* pixels, int width, int height)
                 inlineSetPixel(offset, data, paintingData, x, y, cFactor1div4, cFactor1div4, normalVector);
             }
         }
+#endif
     }
 
     int lastPixel = data.widthMultipliedByPixelSize * height;
@@ -354,6 +365,118 @@ void FELighting::apply()
     drawLighting(srcPixelArray, absolutePaintSize.width(), absolutePaintSize.height());
 }
 
+#if CPU(ARM_NEON) && COMPILER(GCC)
+
+static int getPowerCoefficients(float exponent)
+{
+    // Calling a powf function from the assembly code would require to save
+    // and reload a lot of NEON registers. Since the base is in range [0..1]
+    // and only 8 bit precision is required, we use our own powf function.
+    // This is probably not the best, but it uses only a few registers and
+    // gives us enough precision (modifying the exponent field directly would
+    // also be possible).
+
+    // First, we limit the exponent to maximum of 64, which gives us enough
+    // precision. We split the exponent to an integer and fraction part,
+    // since a^x = (a^y)*(a^z) where x = y+z. The integer exponent of the
+    // power is estimated by square, and the fraction exponent of the power
+    // is estimated by square root assembly instructions.
+    int i, result;
+
+    if (exponent < 0)
+        exponent = 1 / (-exponent);
+
+    if (exponent > 63.99)
+        exponent = 63.99;
+
+    exponent /= 64;
+    result = 0;
+    for (i = 11; i >= 0; --i) {
+        exponent *= 2;
+        if (exponent >= 1) {
+            result |= 1 << i;
+            exponent -= 1;
+        }
+    }
+    return result;
+}
+
+void FELighting::drawInteriorPixels(LightingData& data, LightSource::PaintingData& paintingData)
+{
+    WTF_ALIGNED(FELightingFloatArgumentsForNeon, floatArguments, 16);
+
+    FELightingPaintingDataForNeon neonData = {
+        data.pixels->data(),
+        data.widthDecreasedByOne - 1,
+        data.heightDecreasedByOne - 1,
+        0,
+        0,
+        0,
+        &floatArguments,
+        feLightingConstantsForNeon()
+    };
+
+    // Set light source arguments.
+    floatArguments.constOne = 1;
+
+    floatArguments.colorRed = m_lightingColor.red();
+    floatArguments.colorGreen = m_lightingColor.green();
+    floatArguments.colorBlue = m_lightingColor.blue();
+    floatArguments.padding4 = 0;
+
+    if (m_lightSource->type() == LS_POINT) {
+        neonData.flags |= FLAG_POINT_LIGHT;
+        PointLightSource* pointLightSource = static_cast<PointLightSource*>(m_lightSource.get());
+        floatArguments.lightX = pointLightSource->position().x();
+        floatArguments.lightY = pointLightSource->position().y();
+        floatArguments.lightZ = pointLightSource->position().z();
+        floatArguments.padding2 = 0;
+    } else if (m_lightSource->type() == LS_SPOT) {
+        neonData.flags |= FLAG_SPOT_LIGHT;
+        SpotLightSource* spotLightSource = static_cast<SpotLightSource*>(m_lightSource.get());
+        floatArguments.lightX = spotLightSource->position().x();
+        floatArguments.lightY = spotLightSource->position().y();
+        floatArguments.lightZ = spotLightSource->position().z();
+        floatArguments.padding2 = 0;
+
+        floatArguments.directionX = paintingData.directionVector.x();
+        floatArguments.directionY = paintingData.directionVector.y();
+        floatArguments.directionZ = paintingData.directionVector.z();
+        floatArguments.padding3 = 0;
+
+        floatArguments.coneCutOffLimit = paintingData.coneCutOffLimit;
+        floatArguments.coneFullLight = paintingData.coneFullLight;
+        floatArguments.coneCutOffRange = paintingData.coneCutOffLimit - paintingData.coneFullLight;
+        neonData.coneExponent = getPowerCoefficients(spotLightSource->specularExponent());
+        if (spotLightSource->specularExponent() == 1)
+            neonData.flags |= FLAG_CONE_EXPONENT_IS_1;
+    } else {
+        ASSERT(m_lightSource.type == LS_DISTANT);
+        floatArguments.lightX = paintingData.lightVector.x();
+        floatArguments.lightY = paintingData.lightVector.y();
+        floatArguments.lightZ = paintingData.lightVector.z();
+        floatArguments.padding2 = 1;
+    }
+
+    // Set lighting arguments.
+    floatArguments.surfaceScale = data.surfaceScale;
+    floatArguments.minusSurfaceScaleDividedByFour = -data.surfaceScale / 4;
+    if (m_lightingType == FELighting::DiffuseLighting)
+        floatArguments.diffuseConstant = m_diffuseConstant;
+    else {
+        neonData.flags |= FLAG_SPECULAR_LIGHT;
+        floatArguments.diffuseConstant = m_specularConstant;
+        neonData.specularExponent = getPowerCoefficients(m_specularExponent);
+        if (m_specularExponent == 1)
+            neonData.flags |= FLAG_SPECULAR_EXPONENT_IS_1;
+    }
+    if (floatArguments.diffuseConstant == 1)
+        neonData.flags |= FLAG_DIFFUSE_CONST_IS_1;
+
+    neonDrawLighting(&neonData);
+}
+#endif // CPU(ARM_NEON) && COMPILER(GCC)
+
 } // namespace WebCore
 
 #endif // ENABLE(FILTERS)
diff --git a/Source/WebCore/platform/graphics/filters/FELighting.h b/Source/WebCore/platform/graphics/filters/FELighting.h
index fa1c0aa..3dc46e9 100644
--- a/Source/WebCore/platform/graphics/filters/FELighting.h
+++ b/Source/WebCore/platform/graphics/filters/FELighting.h
@@ -33,6 +33,7 @@
 #include "FilterEffect.h"
 #include "LightSource.h"
 #include <wtf/ByteArray.h>
+#include <wtf/Platform.h>
 
 // Common base class for FEDiffuseLighting and FESpecularLighting
 
@@ -79,6 +80,10 @@ protected:
     void setPixel(int offset, LightingData&, LightSource::PaintingData&,
                   int lightX, int lightY, float factorX, float factorY, IntPoint& normalVector);
 
+#if CPU(ARM_NEON) && COMPILER(GCC)
+    void drawInteriorPixels(LightingData&, LightSource::PaintingData&);
+#endif
+
     LightingType m_lightingType;
     RefPtr<LightSource> m_lightSource;
 
diff --git a/Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp b/Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp
index a20eb8c..2c7b1eb 100644
--- a/Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp
+++ b/Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp
@@ -54,9 +54,12 @@ Color FESpecularLighting::lightingColor() const
     return m_lightingColor;
 }
 
-void FESpecularLighting::setLightingColor(const Color& lightingColor)
+bool FESpecularLighting::setLightingColor(const Color& lightingColor)
 {
+    if (m_lightingColor == lightingColor)
+        return false;
     m_lightingColor = lightingColor;
+    return true;
 }
 
 float FESpecularLighting::surfaceScale() const
diff --git a/Source/WebCore/platform/graphics/filters/FESpecularLighting.h b/Source/WebCore/platform/graphics/filters/FESpecularLighting.h
index 9d3ea2d..9fa3add 100644
--- a/Source/WebCore/platform/graphics/filters/FESpecularLighting.h
+++ b/Source/WebCore/platform/graphics/filters/FESpecularLighting.h
@@ -34,7 +34,7 @@ public:
     virtual ~FESpecularLighting();
 
     Color lightingColor() const;
-    void setLightingColor(const Color&);
+    bool setLightingColor(const Color&);
 
     float surfaceScale() const;
     bool setSurfaceScale(float);
diff --git a/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp b/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp
new file mode 100644
index 0000000..3807f1f
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp
@@ -0,0 +1,464 @@
+/*
+ * Copyright (C) 2011 University of Szeged
+ * Copyright (C) 2011 Zoltan Herczeg
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FELightingNEON.h"
+
+#if CPU(ARM_NEON) && COMPILER(GCC)
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+// These constants are copied to the following SIMD registers:
+//   ALPHAX_Q ALPHAY_Q REMAPX_D REMAPY_D
+
+WTF_ALIGNED(short, s_FELightingConstantsForNeon[], 16) = {
+    // Alpha coefficients.
+    -2, 1, 0, -1, 2, 1, 0, -1,
+    0, -1, -2, -1, 0, 1, 2, 1,
+    // Remapping indicies.
+    0x0f0e, 0x0302, 0x0504, 0x0706,
+    0x0b0a, 0x1312, 0x1514, 0x1716,
+};
+
+short* feLightingConstantsForNeon()
+{
+    return s_FELightingConstantsForNeon;
+}
+
+#define ASSTRING(str) #str
+#define TOSTRING(value) ASSTRING(value)
+
+#define PIXELS_OFFSET TOSTRING(0)
+#define WIDTH_OFFSET TOSTRING(4)
+#define HEIGHT_OFFSET TOSTRING(8)
+#define FLAGS_OFFSET TOSTRING(12)
+#define SPECULAR_EXPONENT_OFFSET TOSTRING(16)
+#define CONE_EXPONENT_OFFSET TOSTRING(20)
+#define FLOAT_ARGUMENTS_OFFSET TOSTRING(24)
+#define DRAWING_CONSTANTS_OFFSET TOSTRING(28)
+#define NL "\n"
+
+// Register allocation
+#define PAINTING_DATA_R       "r11"
+#define RESET_WIDTH_R         PAINTING_DATA_R
+#define PIXELS_R              "r4"
+#define WIDTH_R               "r5"
+#define HEIGHT_R              "r6"
+#define FLAGS_R               "r7"
+#define SPECULAR_EXPONENT_R   "r8"
+#define CONE_EXPONENT_R       "r10"
+#define SCANLINE_R            "r12"
+
+#define TMP1_Q                "q0"
+#define TMP1_D0               "d0"
+#define TMP1_S0               "s0"
+#define TMP1_S1               "s1"
+#define TMP1_D1               "d1"
+#define TMP1_S2               "s2"
+#define TMP1_S3               "s3"
+#define TMP2_Q                "q1"
+#define TMP2_D0               "d2"
+#define TMP2_S0               "s4"
+#define TMP2_S1               "s5"
+#define TMP2_D1               "d3"
+#define TMP2_S2               "s6"
+#define TMP2_S3               "s7"
+#define TMP3_Q                "q2"
+#define TMP3_D0               "d4"
+#define TMP3_S0               "s8"
+#define TMP3_S1               "s9"
+#define TMP3_D1               "d5"
+#define TMP3_S2               "s10"
+#define TMP3_S3               "s11"
+
+#define COSINE_OF_ANGLE       "s12"
+#define POWF_INT_S            "s13"
+#define POWF_FRAC_S           "s14"
+#define SPOT_COLOR_Q          "q4"
+
+// Because of VMIN and VMAX CONST_ZERO_S and CONST_ONE_S
+// must be placed on the same side of the double vector
+
+// Current pixel position
+#define POSITION_Q            "q5"
+#define POSITION_X_S          "s20"
+#define POSITION_Y_S          "s21"
+#define POSITION_Z_S          "s22"
+#define CONST_ZERO_HI_D       "d11"
+#define CONST_ZERO_S          "s23"
+
+// -------------------------------
+//     Variable arguments
+// Misc arguments
+#define READ1_RANGE           "d12-d15"
+#define READ2_RANGE           "d16-d19"
+#define READ3_RANGE           "d20-d21"
+
+#define SCALE_S               "s24"
+#define SCALE_DIV4_S          "s25"
+#define DIFFUSE_CONST_S       "s26"
+
+// Light source position
+#define CONE_CUT_OFF_S        "s28"
+#define CONE_FULL_LIGHT_S     "s29"
+#define CONE_CUT_OFF_RANGE_S  "s30"
+#define CONST_ONE_HI_D        "d15"
+#define CONST_ONE_S           "s31"
+
+#define LIGHT_Q               "q8"
+#define DIRECTION_Q           "q9"
+#define COLOR_Q               "q10"
+// -------------------------------
+//    Constant coefficients
+#define READ4_RANGE           "d22-d25"
+#define READ5_RANGE           "d26-d27"
+
+#define ALPHAX_Q              "q11"
+#define ALPHAY_Q              "q12"
+#define REMAPX_D              "d26"
+#define REMAPY_D              "d27"
+// -------------------------------
+
+#define ALL_ROWS_D            "{d28,d29,d30}"
+#define TOP_ROW_D             "d28"
+#define MIDDLE_ROW_D          "d29"
+#define BOTTOM_ROW_D          "d30"
+
+#define GET_LENGTH(source, temp) \
+    "vmul.f32 " temp##_Q ", " source##_Q ", " source##_Q NL \
+    "vadd.f32 " source##_S3 ", " temp##_S0 ", " temp##_S1 NL \
+    "vadd.f32 " source##_S3 ", " source##_S3 ", " temp##_S2 NL \
+    "vsqrt.f32 " source##_S3 ", " source##_S3 NL
+
+// destination##_S3 can contain the multiply of length.
+#define DOT_PRODUCT(destination, source1, source2) \
+    "vmul.f32 " destination##_Q ", " source1##_Q ", " source2##_Q NL \
+    "vadd.f32 " destination##_S0 ", " destination##_S0 ", " destination##_S1 NL \
+    "vadd.f32 " destination##_S0 ", " destination##_S0 ", " destination##_S2 NL
+
+#define MULTIPLY_BY_DIFFUSE_CONST(normalVectorLength, dotProductLength) \
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_DIFFUSE_CONST_IS_1) NL \
+    "vmuleq.f32 " TMP2_S1 ", " DIFFUSE_CONST_S ", " normalVectorLength NL \
+    "vdiveq.f32 " TMP2_S1 ", " TMP2_S1 ", " dotProductLength NL \
+    "vdivne.f32 " TMP2_S1 ", " normalVectorLength ", " dotProductLength NL
+
+#define POWF_SQR(value, exponent, current, remaining) \
+    "tst " exponent ", #" ASSTRING(current) NL \
+    "vmulne.f32 " value ", " value ", " POWF_INT_S NL \
+    "tst " exponent ", #" ASSTRING(remaining) NL \
+    "vmulne.f32 " POWF_INT_S ", " POWF_INT_S ", " POWF_INT_S NL
+
+#define POWF_SQRT(value, exponent, current, remaining) \
+    "tst " exponent ", #" ASSTRING(remaining) NL \
+    "vsqrtne.f32 " POWF_FRAC_S ", " POWF_FRAC_S NL \
+    "tst " exponent ", #" ASSTRING(current) NL \
+    "vmulne.f32 " value ", " value ", " POWF_FRAC_S NL
+
+// This simplified powf function is sufficiently accurate.
+#define POWF(value, exponent) \
+    "tst " exponent ", #0xfc0" NL \
+    "vmovne.f32 " POWF_INT_S ", " value NL \
+    "tst " exponent ", #0x03f" NL \
+    "vmovne.f32 " POWF_FRAC_S ", " value NL \
+    "vmov.f32 " value ", " CONST_ONE_S NL \
+    \
+    POWF_SQR(value, exponent, 0x040, 0xf80) \
+    POWF_SQR(value, exponent, 0x080, 0xf00) \
+    POWF_SQR(value, exponent, 0x100, 0xe00) \
+    POWF_SQR(value, exponent, 0x200, 0xc00) \
+    POWF_SQR(value, exponent, 0x400, 0x800) \
+    "tst " exponent ", #0x800" NL \
+    "vmulne.f32 " value ", " value ", " POWF_INT_S NL \
+    \
+    POWF_SQRT(value, exponent, 0x20, 0x3f) \
+    POWF_SQRT(value, exponent, 0x10, 0x1f) \
+    POWF_SQRT(value, exponent, 0x08, 0x0f) \
+    POWF_SQRT(value, exponent, 0x04, 0x07) \
+    POWF_SQRT(value, exponent, 0x02, 0x03) \
+    POWF_SQRT(value, exponent, 0x01, 0x01)
+
+// The following algorithm is an ARM-NEON optimized version of
+// the main loop found in FELighting.cpp. Since the whole code
+// is redesigned to be as effective as possible (ARM specific
+// thinking), it is four times faster than its C++ counterpart.
+
+asm ( // NOLINT
+".globl " TOSTRING(neonDrawLighting) NL
+TOSTRING(neonDrawLighting) ":" NL
+    // Because of the clever register allocation, nothing is stored on the stack
+    // except the saved registers.
+    // Stack must be aligned to 8 bytes.
+    "stmdb sp!, {r4-r8, r10, r11, lr}" NL
+    "vstmdb sp!, {d8-d15}" NL
+    "mov " PAINTING_DATA_R ", r0" NL
+
+    // The following two arguments are loaded to SIMD registers.
+    "ldr r0, [" PAINTING_DATA_R ", #" FLOAT_ARGUMENTS_OFFSET "]" NL
+    "ldr r1, [" PAINTING_DATA_R ", #" DRAWING_CONSTANTS_OFFSET "]" NL
+    "ldr " PIXELS_R ", [" PAINTING_DATA_R ", #" PIXELS_OFFSET "]" NL
+    "ldr " WIDTH_R ", [" PAINTING_DATA_R ", #" WIDTH_OFFSET "]" NL
+    "ldr " HEIGHT_R ", [" PAINTING_DATA_R ", #" HEIGHT_OFFSET "]" NL
+    "ldr " FLAGS_R ", [" PAINTING_DATA_R ", #" FLAGS_OFFSET "]" NL
+    "ldr " SPECULAR_EXPONENT_R ", [" PAINTING_DATA_R ", #" SPECULAR_EXPONENT_OFFSET "]" NL
+    "ldr " CONE_EXPONENT_R ", [" PAINTING_DATA_R ", #" CONE_EXPONENT_OFFSET "]" NL
+
+    // Load all data to the SIMD registers with the least number of instructions.
+    "vld1.f32 { " READ1_RANGE " }, [r0]!" NL
+    "vld1.f32 { " READ2_RANGE " }, [r0]!" NL
+    "vld1.f32 { " READ3_RANGE " }, [r0]!" NL
+    "vld1.s16 {" READ4_RANGE "}, [r1]!" NL
+    "vld1.s16 {" READ5_RANGE "}, [r1]!" NL
+
+    // Initializing local variables.
+    "mov " SCANLINE_R ", " WIDTH_R ", lsl #2" NL
+    "add " SCANLINE_R ", " SCANLINE_R ", #8" NL
+    "add " PIXELS_R ", " PIXELS_R ", " SCANLINE_R NL
+    "add " PIXELS_R ", " PIXELS_R ", #3" NL
+    "mov r0, #0" NL
+    "vmov.f32 " CONST_ZERO_S ", r0" NL
+    "vmov.f32 " POSITION_Y_S ", " CONST_ONE_S NL
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_SPOT_LIGHT) NL
+    "vmov.f32 " SPOT_COLOR_Q ", " COLOR_Q NL
+    "mov " RESET_WIDTH_R ", " WIDTH_R NL
+
+".mainloop:" NL
+    "mov r3, #3" NL
+    "vmov.f32 " POSITION_X_S ", " CONST_ONE_S NL
+
+".scanline:" NL
+    // The ROW registers are storing the alpha channel of the last three pixels.
+    // The alpha channel is stored as signed short (sint16) values. The fourth value
+    // is garbage. The following instructions are shifting out the unnecessary alpha
+    // values and load the next ones.
+    "ldrb r0, [" PIXELS_R ", -" SCANLINE_R "]" NL
+    "ldrb r1, [" PIXELS_R ", +" SCANLINE_R "]" NL
+    "ldrb r2, [" PIXELS_R "], #4" NL
+    "vext.s16 " TOP_ROW_D ", " TOP_ROW_D ", " TOP_ROW_D ", #3" NL
+    "vext.s16 " MIDDLE_ROW_D ", " MIDDLE_ROW_D ", " MIDDLE_ROW_D ", #3" NL
+    "vext.s16 " BOTTOM_ROW_D ", " BOTTOM_ROW_D ", " BOTTOM_ROW_D ", #3" NL
+    "vmov.s16 " TOP_ROW_D "[1], r0" NL
+    "vmov.s16 " MIDDLE_ROW_D "[1], r2" NL
+    "vmov.s16 " BOTTOM_ROW_D "[1], r1" NL
+
+    // The two border pixels (rightmost and leftmost) are skipped when
+    // the next scanline is reached. It also jumps, when the algorithm
+    // is started, and the first free alpha values are loaded to each row.
+    "subs r3, r3, #1" NL
+    "bne .scanline" NL
+
+    // The light vector goes to TMP1_Q. It is constant in case of distant light.
+    // The fourth value contains the length of the light vector.
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_POINT_LIGHT | FLAG_SPOT_LIGHT) NL
+    "beq .distantLight" NL
+
+    "vmov.s16 r3, " MIDDLE_ROW_D "[2]" NL
+    "vmov.f32 " POSITION_Z_S ", r3" NL
+    "vcvt.f32.s32 " POSITION_Z_S ", " POSITION_Z_S NL
+    "vmul.f32 " POSITION_Z_S ", " POSITION_Z_S ", " SCALE_S NL
+
+    "vsub.f32 " TMP1_Q ", " LIGHT_Q ", " POSITION_Q NL
+    GET_LENGTH(TMP1, TMP2)
+
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_SPOT_LIGHT) NL
+    "bne .cosineOfAngle" NL
+".visiblePixel:" NL
+
+    //     | -1  0  1 |      | -1 -2 -1 |
+    // X = | -2  0  2 |  Y = |  0  0  0 |
+    //     | -1  0  1 |      |  1  2  1 |
+
+    // Multiply the alpha values by the X and Y matrices.
+
+    // Moving the 8 alpha value to TMP3.
+    "vtbl.8 " TMP3_D0 ", " ALL_ROWS_D ", " REMAPX_D NL
+    "vtbl.8 " TMP3_D1 ", " ALL_ROWS_D ", " REMAPY_D NL
+
+    "vmul.s16 " TMP2_Q ", " TMP3_Q ", " ALPHAX_Q NL
+    "vpadd.s16 " TMP2_D0 ", " TMP2_D0 ", " TMP2_D1 NL
+    "vpadd.s16 " TMP2_D0 ", " TMP2_D0 ", " TMP2_D0 NL
+    "vpadd.s16 " TMP2_D0 ", " TMP2_D0 ", " TMP2_D0 NL
+    "vmov.s16 r0, " TMP2_D0 "[0]" NL
+
+    "vmul.s16 " TMP2_Q ", " TMP3_Q ", " ALPHAY_Q NL
+    "vpadd.s16 " TMP2_D0 ", " TMP2_D0 ", " TMP2_D1 NL
+    "vpadd.s16 " TMP2_D0 ", " TMP2_D0 ", " TMP2_D0 NL
+    "vpadd.s16 " TMP2_D0 ", " TMP2_D0 ", " TMP2_D0 NL
+    "vmov.s16 r1, " TMP2_D0 "[0]" NL
+
+    // r0 and r1 contains the X and Y coordinates of the
+    // normal vector, respectively.
+
+    // Calculating the spot light strength.
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_SPOT_LIGHT) NL
+    "beq .endLight" NL
+
+    "vneg.f32 " TMP3_S1 ", " COSINE_OF_ANGLE NL
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_CONE_EXPONENT_IS_1) NL
+    "beq .coneExpPowf" NL
+".coneExpPowfFinished:" NL
+
+    // Smoothing the cone edge if necessary.
+    "vcmp.f32 " COSINE_OF_ANGLE ", " CONE_FULL_LIGHT_S NL
+    "fmstat" NL
+    "bhi .cutOff" NL
+".cutOffFinished:" NL
+
+    "vmin.f32 " TMP3_D0 ", " TMP3_D0 ", " CONST_ONE_HI_D NL
+    "vmul.f32 " COLOR_Q ", " SPOT_COLOR_Q ", " TMP3_D0 "[1]" NL
+
+".endLight:" NL
+    // Summarize:
+    // r0 and r1 contains the normalVector.
+    // TMP1_Q contains the light vector and its length.
+    // COLOR_Q contains the color of the light vector.
+
+    // Test whether both r0 and r1 are zero (Normal vector is (0, 0, 1)).
+    "orrs r2, r0, r1" NL
+    "bne .normalVectorIsNonZero" NL
+
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_SPECULAR_LIGHT) NL
+    "bne .specularLight1" NL
+
+    // Calculate diffuse light strength.
+    MULTIPLY_BY_DIFFUSE_CONST(TMP1_S2, TMP1_S3)
+    "b .lightStrengthCalculated" NL
+
+".specularLight1:" NL
+    // Calculating specular light strength.
+    "vadd.f32 " TMP1_S2 ", " TMP1_S2 ", " TMP1_S3 NL
+    GET_LENGTH(TMP1, TMP2)
+
+    // When the exponent is 1, we don't need to call an expensive powf function.
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_SPECULAR_EXPONENT_IS_1) NL
+    "vdiveq.f32 " TMP2_S1 ", " TMP1_S2 ", " TMP1_S3 NL
+    "beq .specularExpPowf" NL
+
+    MULTIPLY_BY_DIFFUSE_CONST(TMP1_S2, TMP1_S3)
+    "b .lightStrengthCalculated" NL
+
+".normalVectorIsNonZero:" NL
+    // Normal vector goes to TMP2, and its length is calculated as well.
+    "vmov.s32 " TMP2_S0 ", r0" NL
+    "vcvt.f32.s32 " TMP2_S0 ", " TMP2_S0 NL
+    "vmul.f32 " TMP2_S0 ", " TMP2_S0 ", " SCALE_DIV4_S NL
+    "vmov.s32 " TMP2_S1 ", r1" NL
+    "vcvt.f32.s32 " TMP2_S1 ", " TMP2_S1 NL
+    "vmul.f32 " TMP2_S1 ", " TMP2_S1 ", " SCALE_DIV4_S NL
+    "vmov.f32 " TMP2_S2 ", " CONST_ONE_S NL
+    GET_LENGTH(TMP2, TMP3)
+
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_SPECULAR_LIGHT) NL
+    "bne .specularLight2" NL
+
+    // Calculating diffuse light strength.
+    DOT_PRODUCT(TMP3, TMP2, TMP1)
+    MULTIPLY_BY_DIFFUSE_CONST(TMP3_S0, TMP3_S3)
+    "b .lightStrengthCalculated" NL
+
+".specularLight2:" NL
+    // Calculating specular light strength.
+    "vadd.f32 " TMP1_S2 ", " TMP1_S2 ", " TMP1_S3 NL
+    GET_LENGTH(TMP1, TMP3)
+    DOT_PRODUCT(TMP3, TMP2, TMP1)
+
+    // When the exponent is 1, we don't need to call an expensive powf function.
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_SPECULAR_EXPONENT_IS_1) NL
+    "vdiveq.f32 " TMP2_S1 ", " TMP3_S0 ", " TMP3_S3 NL
+    "beq .specularExpPowf" NL
+    MULTIPLY_BY_DIFFUSE_CONST(TMP3_S0, TMP3_S3)
+
+".lightStrengthCalculated:" NL
+    // TMP2_S1 contains the light strength. Clamp it to [0, 1]
+    "vmax.f32 " TMP2_D0 ", " TMP2_D0 ", " CONST_ZERO_HI_D NL
+    "vmin.f32 " TMP2_D0 ", " TMP2_D0 ", " CONST_ONE_HI_D NL
+    "vmul.f32 " TMP3_Q ", " COLOR_Q ", " TMP2_D0 "[1]" NL
+    "vcvt.u32.f32 " TMP3_Q ", " TMP3_Q NL
+    "vmov.u32 r2, r3, " TMP3_S0 ", " TMP3_S1 NL
+    // The color values are stored in-place.
+    "strb r2, [" PIXELS_R ", #-11]" NL
+    "strb r3, [" PIXELS_R ", #-10]" NL
+    "vmov.u32 r2, " TMP3_S2 NL
+    "strb r2, [" PIXELS_R ", #-9]" NL
+
+    // Continue to the next pixel.
+".blackPixel:" NL
+    "vadd.f32 " POSITION_X_S ", " CONST_ONE_S NL
+    "mov r3, #1" NL
+    "subs " WIDTH_R ", " WIDTH_R ", #1" NL
+    "bne .scanline" NL
+
+    // If the end of the scanline is reached, we continue
+    // to the next scanline.
+    "vadd.f32 " POSITION_Y_S ", " CONST_ONE_S NL
+    "mov " WIDTH_R ", " RESET_WIDTH_R NL
+    "subs " HEIGHT_R ", " HEIGHT_R ", #1" NL
+    "bne .mainloop" NL
+
+    // Return.
+    "vldmia sp!, {d8-d15}" NL
+    "ldmia sp!, {r4-r8, r10, r11, pc}" NL
+
+".distantLight:" NL
+    // In case of distant light, the light vector is constant,
+    // we simply copy it.
+    "vmov.f32 " TMP1_Q ", " LIGHT_Q NL
+    "b .visiblePixel" NL
+
+".cosineOfAngle:" NL
+    // If the pixel is outside of the cone angle, it is simply a black pixel.
+    DOT_PRODUCT(TMP3, TMP1, DIRECTION)
+    "vdiv.f32 " COSINE_OF_ANGLE ", " TMP3_S0 ", " TMP1_S3 NL
+    "vcmp.f32 " COSINE_OF_ANGLE ", " CONE_CUT_OFF_S NL
+    "fmstat" NL
+    "bls .visiblePixel" NL
+    "mov r0, #0" NL
+    "strh r0, [" PIXELS_R ", #-11]" NL
+    "strb r0, [" PIXELS_R ", #-9]" NL
+    "b .blackPixel" NL
+
+".cutOff:" NL
+    // Smoothing the light strength on the cone edge.
+    "vsub.f32 " TMP3_S0 ", " CONE_CUT_OFF_S ", " COSINE_OF_ANGLE NL
+    "vdiv.f32 " TMP3_S0 ", " TMP3_S0 ", " CONE_CUT_OFF_RANGE_S NL
+    "vmul.f32 " TMP3_S1 ", " TMP3_S1 ", " TMP3_S0 NL
+    "b .cutOffFinished" NL
+
+".coneExpPowf:" NL
+    POWF(TMP3_S1, CONE_EXPONENT_R)
+    "b .coneExpPowfFinished" NL
+
+".specularExpPowf:" NL
+    POWF(TMP2_S1, SPECULAR_EXPONENT_R)
+    "tst " FLAGS_R ", #" TOSTRING(FLAG_DIFFUSE_CONST_IS_1) NL
+    "vmuleq.f32 " TMP2_S1 ", " TMP2_S1 ", " DIFFUSE_CONST_S NL
+    "b .lightStrengthCalculated" NL
+); // NOLINT
+
+} // namespace WebCore
+
+#endif // CPU(ARM_NEON) && COMPILER(GCC)
diff --git a/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h b/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h
new file mode 100644
index 0000000..d83b7fe
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2011 University of Szeged
+ * Copyright (C) 2011 Zoltan Herczeg
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FELightingNeon_h
+#define FELightingNeon_h
+
+#include <wtf/Platform.h>
+
+#if CPU(ARM_NEON) && COMPILER(GCC)
+
+namespace WebCore {
+
+// Otherwise: Distant Light.
+#define FLAG_POINT_LIGHT                 0x01
+#define FLAG_SPOT_LIGHT                  0x02
+#define FLAG_CONE_EXPONENT_IS_1          0x04
+
+// Otherwise: Diffuse light.
+#define FLAG_SPECULAR_LIGHT              0x10
+#define FLAG_DIFFUSE_CONST_IS_1          0x20
+#define FLAG_SPECULAR_EXPONENT_IS_1      0x40
+
+// Must be aligned to 16 bytes.
+struct FELightingFloatArgumentsForNeon {
+    float surfaceScale;
+    float minusSurfaceScaleDividedByFour;
+    float diffuseConstant;
+    float padding1;
+
+    float coneCutOffLimit;
+    float coneFullLight;
+    float coneCutOffRange;
+    float constOne;
+
+    float lightX;
+    float lightY;
+    float lightZ;
+    float padding2;
+
+    float directionX;
+    float directionY;
+    float directionZ;
+    float padding3;
+
+    float colorRed;
+    float colorGreen;
+    float colorBlue;
+    float padding4;
+};
+
+struct FELightingPaintingDataForNeon {
+    unsigned char* pixels;
+    int widthDecreasedByTwo;
+    int heightDecreasedByTwo;
+    // Combination of FLAG constants above.
+    int flags;
+    int specularExponent;
+    int coneExponent;
+    FELightingFloatArgumentsForNeon* floatArguments;
+    short* paintingConstants;
+};
+
+short* feLightingConstantsForNeon();
+
+extern "C" {
+void neonDrawLighting(FELightingPaintingDataForNeon*);
+}
+
+} // namespace WebCore
+
+#endif // CPU(ARM_NEON) && COMPILER(GCC)
+
+#endif // FELightingNeon_h
diff --git a/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp b/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp
index 40c9843..f6f428d 100644
--- a/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp
+++ b/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp
@@ -55,11 +55,12 @@ PassOwnPtr<BicubicShader> BicubicShader::create(GraphicsContext3D* context)
     static const char* vertexShaderSource =
         "uniform mat3 matrix;\n"
         "uniform mat3 texMatrix;\n"
-        "attribute vec3 position;\n"
+        "attribute vec2 position;\n"
         "varying vec2 texCoord;\n"
         "void main() {\n"
-        "    texCoord = (texMatrix * position).xy;\n"
-        "    gl_Position = vec4(matrix * position, 1.0);\n"
+        "    vec3 pos = vec3(position, 1.0);\n"
+        "    texCoord = (texMatrix * pos).xy;\n"
+        "    gl_Position = vec4(matrix * pos, 1.0);\n"
         "}\n";
     static const char* fragmentShaderSource =
         "#ifdef GL_ES\n"
@@ -127,7 +128,7 @@ void BicubicShader::use(const AffineTransform& transform, const AffineTransform&
     m_context->uniform1i(m_imageLocation, 0);
     m_context->uniform1f(m_alphaLocation, alpha);
 
-    m_context->vertexAttribPointer(m_positionLocation, 3, GraphicsContext3D::FLOAT, false, 0, 0);
+    m_context->vertexAttribPointer(m_positionLocation, 2, GraphicsContext3D::FLOAT, false, 0, 0);
 
     m_context->enableVertexAttribArray(m_positionLocation);
 }
diff --git a/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp
index f0b6bd9..b11d966 100644
--- a/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp
+++ b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp
@@ -58,13 +58,14 @@ PassOwnPtr<ConvolutionShader> ConvolutionShader::create(GraphicsContext3D* conte
         "uniform mat3 matrix;\n"
         "uniform mat3 texMatrix;\n"
         "uniform vec2 imageIncrement;\n"
-        "attribute vec3 position;\n"
+        "attribute vec2 position;\n"
         "varying vec2 imageCoord;\n"
         "void main() {\n"
+        "    vec3 pos = vec3(position, 1.0);\n"
         "    // Offset image coords by half of kernel width, in image texels\n"
-        "    gl_Position = vec4(matrix * position, 1.0);\n"
+        "    gl_Position = vec4(matrix * pos, 1.0);\n"
         "    float scale = (float(KERNEL_WIDTH) - 1.0) / 2.0;\n"
-        "    imageCoord = (texMatrix * position).xy - vec2(scale, scale) * imageIncrement;\n"
+        "    imageCoord = (texMatrix * pos).xy - vec2(scale, scale) * imageIncrement;\n"
         "}\n";
     char vertexShaderSource[1024];
     snprintf(vertexShaderSource, sizeof(vertexShaderSource), vertexShaderRaw, kernelWidth);
@@ -115,7 +116,7 @@ void ConvolutionShader::use(const AffineTransform& transform, const AffineTransf
         kernelWidth = m_kernelWidth;
     m_context->uniform1fv(m_kernelLocation, const_cast<float*>(kernel), kernelWidth);
 
-    m_context->vertexAttribPointer(m_positionLocation, 3, GraphicsContext3D::FLOAT, false, 0, 0);
+    m_context->vertexAttribPointer(m_positionLocation, 2, GraphicsContext3D::FLOAT, false, 0, 0);
 
     m_context->enableVertexAttribArray(m_positionLocation);
 }
diff --git a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
index 2a83fcf..8e293f7 100644
--- a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
+++ b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
@@ -144,112 +144,128 @@ void DrawingBuffer::resizeDepthStencil(int sampleCount)
     m_context->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
 }
 
-void DrawingBuffer::reset(const IntSize& newSize)
+void DrawingBuffer::clearFramebuffer()
 {
-    m_size = newSize;
+    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_multisampleFBO ? m_multisampleFBO : m_fbo);
+    const GraphicsContext3D::Attributes& attributes = m_context->getContextAttributes();
+    float clearDepth = 0;
+    int clearStencil = 0;
+    unsigned char depthMask = false;
+    unsigned int stencilMask = 0xffffffff;
+    unsigned char isScissorEnabled = false;
+    unsigned long clearMask = GraphicsContext3D::COLOR_BUFFER_BIT;
+    if (attributes.depth) {
+        m_context->getFloatv(GraphicsContext3D::DEPTH_CLEAR_VALUE, &clearDepth);
+        m_context->clearDepth(1);
+        m_context->getBooleanv(GraphicsContext3D::DEPTH_WRITEMASK, &depthMask);
+        m_context->depthMask(true);
+        clearMask |= GraphicsContext3D::DEPTH_BUFFER_BIT;
+    }
+    if (attributes.stencil) {
+        m_context->getIntegerv(GraphicsContext3D::STENCIL_CLEAR_VALUE, &clearStencil);
+        m_context->clearStencil(0);
+        m_context->getIntegerv(GraphicsContext3D::STENCIL_WRITEMASK, reinterpret_cast<int*>(&stencilMask));
+        m_context->stencilMaskSeparate(GraphicsContext3D::FRONT, 0xffffffff);
+        clearMask |= GraphicsContext3D::STENCIL_BUFFER_BIT;
+    }
+    isScissorEnabled = m_context->isEnabled(GraphicsContext3D::SCISSOR_TEST);
+    m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+
+    float clearColor[4];
+    m_context->getFloatv(GraphicsContext3D::COLOR_CLEAR_VALUE, clearColor);
+    m_context->clearColor(0, 0, 0, 0);
+    m_context->clear(clearMask);
+    m_context->clearColor(clearColor[0], clearColor[1], clearColor[2], clearColor[3]);
+
+    if (attributes.depth) {
+        m_context->clearDepth(clearDepth);
+        m_context->depthMask(depthMask);
+    }
+    if (attributes.stencil) {
+        m_context->clearStencil(clearStencil);
+        m_context->stencilMaskSeparate(GraphicsContext3D::FRONT, stencilMask);
+    }
+    if (isScissorEnabled)
+        m_context->enable(GraphicsContext3D::SCISSOR_TEST);
+    else
+        m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+}
 
+bool DrawingBuffer::reset(const IntSize& newSize)
+{
     if (!m_context)
-        return;
-        
+        return false;
+
     m_context->makeContextCurrent();
-    
-    const GraphicsContext3D::Attributes& attributes = m_context->getContextAttributes();
-    unsigned long internalColorFormat, colorFormat, internalRenderbufferFormat;
-    if (attributes.alpha) {
-        internalColorFormat = GraphicsContext3D::RGBA;
-        colorFormat = GraphicsContext3D::RGBA;
-        internalRenderbufferFormat = Extensions3D::RGBA8_OES;
-    } else {
-        internalColorFormat = GraphicsContext3D::RGB;
-        colorFormat = GraphicsContext3D::RGB;
-        internalRenderbufferFormat = Extensions3D::RGB8_OES;
-    }
 
+    int maxTextureSize = 0;
+    m_context->getIntegerv(GraphicsContext3D::MAX_TEXTURE_SIZE, &maxTextureSize);
+    if (newSize.height() > maxTextureSize || newSize.width() > maxTextureSize) {
+      clear();
+      return false;
+    }
 
-    // resize multisample FBO
-    if (multisample()) {
-        int maxSampleCount = 0;
-        
-        m_context->getIntegerv(Extensions3D::MAX_SAMPLES, &maxSampleCount);
-        int sampleCount = std::min(8, maxSampleCount);
+    const GraphicsContext3D::Attributes& attributes = m_context->getContextAttributes();
 
-        m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_multisampleFBO);
+    if (newSize != m_size) {
+        m_size = newSize;
 
-        m_context->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_multisampleColorBuffer);
-        m_context->getExtensions()->renderbufferStorageMultisample(GraphicsContext3D::RENDERBUFFER, sampleCount, internalRenderbufferFormat, m_size.width(), m_size.height());
-        m_context->framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::RENDERBUFFER, m_multisampleColorBuffer);
-        resizeDepthStencil(sampleCount);
-        if (m_context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
-            // Cleanup
-            clear();
-            return;
+        unsigned long internalColorFormat, colorFormat, internalRenderbufferFormat;
+        if (attributes.alpha) {
+            internalColorFormat = GraphicsContext3D::RGBA;
+            colorFormat = GraphicsContext3D::RGBA;
+            internalRenderbufferFormat = Extensions3D::RGBA8_OES;
+        } else {
+            internalColorFormat = GraphicsContext3D::RGB;
+            colorFormat = GraphicsContext3D::RGB;
+            internalRenderbufferFormat = Extensions3D::RGB8_OES;
         }
-    }
 
-    // resize regular FBO
-    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
 
-    m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_colorBuffer);
-    m_context->texImage2DResourceSafe(GraphicsContext3D::TEXTURE_2D, 0, internalColorFormat, m_size.width(), m_size.height(), 0, colorFormat, GraphicsContext3D::UNSIGNED_BYTE);
-    m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_colorBuffer, 0);
-    m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, 0);
-    if (!multisample())
-        resizeDepthStencil(0);
-    if (m_context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
-        // Cleanup
-        clear();
-        return;
-    }
+        // resize multisample FBO
+        if (multisample()) {
+            int maxSampleCount = 0;
+            
+            m_context->getIntegerv(Extensions3D::MAX_SAMPLES, &maxSampleCount);
+            int sampleCount = std::min(8, maxSampleCount);
 
-    if (multisample())
-        m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_multisampleFBO);
+            m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_multisampleFBO);
 
-    if (!m_context->getExtensions()->supports("GL_CHROMIUM_resource_safe")) {
-        // Initialize renderbuffers (depth/stencil).
-        float clearDepth = 0;
-        int clearStencil = 0;
-        unsigned char depthMask = true;
-        unsigned int stencilMask = 0xffffffff;
-        unsigned char isScissorEnabled = false;
-        unsigned long clearMask = 0;
-        if (attributes.depth) {
-            m_context->getFloatv(GraphicsContext3D::DEPTH_CLEAR_VALUE, &clearDepth);
-            m_context->clearDepth(1);
-            m_context->getBooleanv(GraphicsContext3D::DEPTH_WRITEMASK, &depthMask);
-            m_context->depthMask(true);
-            clearMask |= GraphicsContext3D::DEPTH_BUFFER_BIT;
-        }
-        if (attributes.stencil) {
-            m_context->getIntegerv(GraphicsContext3D::STENCIL_CLEAR_VALUE, &clearStencil);
-            m_context->clearStencil(0);
-            m_context->getIntegerv(GraphicsContext3D::STENCIL_WRITEMASK, reinterpret_cast<int*>(&stencilMask));
-            m_context->stencilMaskSeparate(GraphicsContext3D::FRONT, 0xffffffff);
-            clearMask |= GraphicsContext3D::STENCIL_BUFFER_BIT;
+            m_context->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_multisampleColorBuffer);
+            m_context->getExtensions()->renderbufferStorageMultisample(GraphicsContext3D::RENDERBUFFER, sampleCount, internalRenderbufferFormat, m_size.width(), m_size.height());
+            m_context->framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::RENDERBUFFER, m_multisampleColorBuffer);
+            resizeDepthStencil(sampleCount);
+            if (m_context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
+                // Cleanup
+                clear();
+                return false;
+            }
         }
-        if (clearMask) {
-            isScissorEnabled = m_context->isEnabled(GraphicsContext3D::SCISSOR_TEST);
-            m_context->disable(GraphicsContext3D::SCISSOR_TEST);
 
-            m_context->clear(clearMask);
+        // resize regular FBO
+        m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
 
-            if (attributes.depth) {
-                m_context->clearDepth(clearDepth);
-                m_context->depthMask(depthMask);
-            }
-            if (attributes.stencil) {
-                m_context->clearStencil(clearStencil);
-                m_context->stencilMaskSeparate(GraphicsContext3D::FRONT, stencilMask);
-            }
-            if (isScissorEnabled)
-                m_context->enable(GraphicsContext3D::SCISSOR_TEST);
-            else
-                m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+        m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_colorBuffer);
+        
+        m_context->texImage2DResourceSafe(GraphicsContext3D::TEXTURE_2D, 0, internalColorFormat, m_size.width(), m_size.height(), 0, colorFormat, GraphicsContext3D::UNSIGNED_BYTE);
+
+        m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_colorBuffer, 0);
+        m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, 0);
+
+        if (!multisample())
+            resizeDepthStencil(0);
+        if (m_context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
+            // Cleanup
+            clear();
+            return false;
         }
     }
 
-    m_context->flush();
-    
+    clearFramebuffer();
+
     didReset();
+
+    return true;
 }
 
 void DrawingBuffer::commit(long x, long y, long width, long height)
diff --git a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
index 606484e..caf3aa5 100644
--- a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
+++ b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
@@ -44,6 +44,7 @@
 
 #if ENABLE(SKIA_GPU)
 class GrContext;
+struct GrPlatformSurfaceDesc;
 #endif
 
 namespace WebCore {
@@ -60,7 +61,10 @@ public:
     
     ~DrawingBuffer();
 
-    void reset(const IntSize&);
+    void clearFramebuffer();
+
+    // Returns true if the buffer was successfully resized.
+    bool reset(const IntSize&);
     void bind();
     IntSize size() const { return m_size; }
     Platform3DObject colorBuffer() const { return m_colorBuffer; }
@@ -101,6 +105,7 @@ public:
 
 #if ENABLE(SKIA_GPU)
     void setGrContext(GrContext* ctx);
+    void getGrPlatformSurfaceDesc(GrPlatformSurfaceDesc*);
 #endif
 
     PassRefPtr<GraphicsContext3D> graphicsContext3D() const { return m_context; }
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.cpp b/Source/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.cpp
index 5b155a5..b228cbf 100644
--- a/Source/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.cpp
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.cpp
@@ -562,6 +562,108 @@ int numXRayCrossingsForCubic(const XRay& xRay, const FloatPoint cubic[4], bool&
     return numCrossings;
 }
 
+/*
+ * Based on C code from the article
+ * "Testing the Convexity of a Polygon"
+ * by Peter Schorn and Frederick Fisher,
+ * (schorn@inf.ethz.ch, fred@kpc.com)
+ * in "Graphics Gems IV", Academic Press, 1994
+ */
+
+static inline int convexCompare(const FloatSize& delta)
+{
+    return (delta.width() > 0) ? -1 : /* x coord diff, second pt > first pt */
+           (delta.width() < 0) ?  1 : /* x coord diff, second pt < first pt */
+           (delta.height() > 0) ? -1 : /* x coord same, second pt > first pt */
+           (delta.height() < 0) ?  1 : /* x coord same, second pt > first pt */
+           0; /* second pt equals first point */
+}
+
+static inline float convexCross(const FloatSize& p, const FloatSize& q)
+{
+    return p.width() * q.height() - p.height() * q.width();
+}
+
+static inline bool convexCheckTriple(const FloatSize& dcur, const FloatSize& dprev, int* curDir, int* dirChanges, int* angleSign)
+{
+    int thisDir = convexCompare(dcur);
+    if (thisDir == -*curDir)
+        ++*dirChanges;
+    *curDir = thisDir;
+    float cross = convexCross(dprev, dcur);
+    if (cross > 0) {
+        if (*angleSign == -1)
+            return false;
+        *angleSign = 1;
+    } else if (cross < 0) {
+        if (*angleSign == 1)
+            return false;
+        *angleSign = -1;
+    }
+    return true;
+}
+
+bool isConvex(const FloatPoint* vertices, int nVertices)
+{
+    int dirChanges = 0, angleSign = 0;
+    FloatPoint second, third;
+    FloatSize dprev, dcur;
+
+    /* Get different point, return if less than 3 diff points. */
+    if (nVertices < 3)
+        return false;
+    int i = 1;
+    while (true) {
+        second = vertices[i++];
+        dprev = second - vertices[0];
+        if (dprev.width() || dprev.height())
+            break;
+        /* Check if out of points. Check here to avoid slowing down cases
+         * without repeated points.
+         */
+        if (i >= nVertices)
+            return false;
+    }
+    FloatPoint saveSecond = second;
+    int curDir = convexCompare(dprev);        /* Find initial direction */
+    while (i < nVertices) {
+        /* Get different point, break if no more points */
+        third = vertices[i++];
+        dcur = third - second;
+        if (!dcur.width() && !dcur.height())
+            continue;
+
+        /* Check current three points */
+        if (!convexCheckTriple(dcur, dprev, &curDir, &dirChanges, &angleSign)) 
+            return false;
+        second = third;     /* Remember ptr to current point. */
+        dprev = dcur;       /* Remember current delta. */
+    }
+
+    /* Must check for direction changes from last vertex back to first */
+    third = vertices[0];                  /* Prepare for 'ConvexCheckTriple' */
+    dcur = third - second;
+    if (convexCompare(dcur)) {
+        if (!convexCheckTriple(dcur, dprev, &curDir, &dirChanges, &angleSign)) 
+            return false;
+        second = third;     /* Remember ptr to current point. */
+        dprev = dcur;       /* Remember current delta. */
+    }
+
+    /* and check for direction changes back to second vertex */
+    dcur = saveSecond - second;
+    if (!convexCheckTriple(dcur, dprev, &curDir, &dirChanges, &angleSign)) 
+        return false;
+
+    /* Decide on polygon type given accumulated status */
+    if (dirChanges > 2)
+        return false;
+
+    if (angleSign > 0 || angleSign < 0)
+        return true;
+    return false;
+}
+
 } // namespace LoopBlinnMathUtils
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.h b/Source/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.h
index b9d19c5..361d901 100644
--- a/Source/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.h
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.h
@@ -101,6 +101,9 @@ bool xRayCrossesLine(const XRay& xRay,
                      const FloatPoint lineEndpoints[2],
                      bool& ambiguous);
 
+
+bool isConvex(const FloatPoint* vertices, int nVertices);
+
 } // namespace LoopBlinnMathUtils
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/gpu/Shader.cpp b/Source/WebCore/platform/graphics/gpu/Shader.cpp
index 1b9bfd5..13c5ebf 100644
--- a/Source/WebCore/platform/graphics/gpu/Shader.cpp
+++ b/Source/WebCore/platform/graphics/gpu/Shader.cpp
@@ -140,7 +140,7 @@ String Shader::generateVertex(Shader::VertexType vertexType, Shader::FillType fi
     case TwoDimensional:
         builder.append(
             "uniform mat3 matrix;\n"
-            "attribute vec3 position;\n");
+            "attribute vec2 position;\n");
         break;
     case LoopBlinnInterior:
         builder.append(
@@ -167,7 +167,7 @@ String Shader::generateVertex(Shader::VertexType vertexType, Shader::FillType fi
 
     if (vertexType == TwoDimensional) {
         builder.append(
-            "gl_Position = vec4(matrix * position, 1.0);\n");
+            "gl_Position = vec4(matrix * vec3(position, 1.0), 1.0);\n");
     } else {
         builder.append(
             "gl_Position = worldViewProjection * vec4(position, 0.0, 1.0);\n");
@@ -179,7 +179,7 @@ String Shader::generateVertex(Shader::VertexType vertexType, Shader::FillType fi
 
     if (fillType == TextureFill) {
         builder.append(
-            "texCoord = texMatrix * position;\n");
+            "texCoord = texMatrix * vec3(position, 1.0);\n");
     }
 
     builder.append(
diff --git a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
index 662d6a8..b7b94c4 100644
--- a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
@@ -346,10 +346,10 @@ void SharedGraphicsContext3D::enableStencil(bool enable)
 void SharedGraphicsContext3D::useQuadVertices()
 {
     if (!m_quadVertices) {
-        float vertices[] = { 0.0f, 0.0f, 1.0f,
-                             1.0f, 0.0f, 1.0f,
-                             0.0f, 1.0f, 1.0f,
-                             1.0f, 1.0f, 1.0f };
+        float vertices[] = { 0.0f, 0.0f,
+                             1.0f, 0.0f,
+                             0.0f, 1.0f,
+                             1.0f, 1.0f };
         m_quadVertices = m_context->createBuffer();
         m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_quadVertices);
         m_context->bufferData(GraphicsContext3D::ARRAY_BUFFER, sizeof(vertices), vertices, GraphicsContext3D::STATIC_DRAW);
diff --git a/Source/WebCore/platform/graphics/gpu/SolidFillShader.cpp b/Source/WebCore/platform/graphics/gpu/SolidFillShader.cpp
index 78381f0..0a6e084 100644
--- a/Source/WebCore/platform/graphics/gpu/SolidFillShader.cpp
+++ b/Source/WebCore/platform/graphics/gpu/SolidFillShader.cpp
@@ -69,7 +69,7 @@ void SolidFillShader::use(const AffineTransform& transform, const Color& color)
     affineTo3x3(transform, matrix);
     m_context->uniformMatrix3fv(m_matrixLocation, false /*transpose*/, matrix, 1 /*count*/);
 
-    m_context->vertexAttribPointer(m_positionLocation, 3, GraphicsContext3D::FLOAT, false, 0, 0);
+    m_context->vertexAttribPointer(m_positionLocation, 2, GraphicsContext3D::FLOAT, false, 0, 0);
 
     m_context->enableVertexAttribArray(m_positionLocation);
 }
diff --git a/Source/WebCore/platform/graphics/gpu/TexShader.cpp b/Source/WebCore/platform/graphics/gpu/TexShader.cpp
index 9eb5c16..ac141a5 100644
--- a/Source/WebCore/platform/graphics/gpu/TexShader.cpp
+++ b/Source/WebCore/platform/graphics/gpu/TexShader.cpp
@@ -72,7 +72,7 @@ void TexShader::use(const AffineTransform& transform, const AffineTransform& tex
     m_context->uniform1i(m_samplerLocation, sampler);
     m_context->uniform1f(m_alphaLocation, alpha);
 
-    m_context->vertexAttribPointer(m_positionLocation, 3, GraphicsContext3D::FLOAT, false, 0, 0);
+    m_context->vertexAttribPointer(m_positionLocation, 2, GraphicsContext3D::FLOAT, false, 0, 0);
 
     m_context->enableVertexAttribArray(m_positionLocation);
 
diff --git a/Source/WebCore/platform/graphics/gpu/TilingData.cpp b/Source/WebCore/platform/graphics/gpu/TilingData.cpp
index 1370543..2415ee4 100644
--- a/Source/WebCore/platform/graphics/gpu/TilingData.cpp
+++ b/Source/WebCore/platform/graphics/gpu/TilingData.cpp
@@ -44,6 +44,9 @@ namespace WebCore {
 
 static int computeNumTiles(int maxTextureSize, int totalSize, int borderTexels)
 {
+    if (maxTextureSize - 2 * borderTexels <= 0)
+        return totalSize > 0 && maxTextureSize >= totalSize ? 1 : 0;
+
     int numTiles = max(1, 1 + (totalSize - 1 - 2 * borderTexels) / (maxTextureSize - 2 * borderTexels));
     return totalSize > 0 ? numTiles : 0;
 }
diff --git a/Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
index 6e53cfc..332908d 100644
--- a/Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
@@ -27,7 +27,7 @@
 #include <gst/video/video.h>
 #include <wtf/PassRefPtr.h>
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 #include <cairo.h>
 #endif
 
@@ -48,7 +48,7 @@ class ImageGStreamer : public RefCounted<ImageGStreamer> {
     private:
         RefPtr<BitmapImage> m_image;
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
         ImageGStreamer(GstBuffer*&, IntSize, cairo_format_t&);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index 2fb4cef..56c2f30 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -81,194 +81,74 @@ static int greatestCommonDivisor(int a, int b)
     return ABS(a);
 }
 
-gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data)
+static gboolean mediaPlayerPrivateMessageCallback(GstBus*, GstMessage* message, MediaPlayerPrivateGStreamer* player)
 {
-    GOwnPtr<GError> err;
-    GOwnPtr<gchar> debug;
-    MediaPlayer::NetworkState error;
-    MediaPlayerPrivateGStreamer* mp = reinterpret_cast<MediaPlayerPrivateGStreamer*>(data);
-    bool issueError = true;
-    bool attemptNextLocation = false;
-    GstElement* pipeline = mp->pipeline();
-
-    if (message->structure) {
-        const gchar* messageTypeName = gst_structure_get_name(message->structure);
-
-        // Redirect messages are sent from elements, like qtdemux, to
-        // notify of the new location(s) of the media.
-        if (!g_strcmp0(messageTypeName, "redirect")) {
-            mp->mediaLocationChanged(message);
-            return true;
-        }
-    }
-
-    switch (GST_MESSAGE_TYPE(message)) {
-    case GST_MESSAGE_ERROR:
-        if (mp && mp->pipelineReset())
-            break;
-        gst_message_parse_error(message, &err.outPtr(), &debug.outPtr());
-        LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
-
-        error = MediaPlayer::Empty;
-        if (err->code == GST_STREAM_ERROR_CODEC_NOT_FOUND
-            || err->code == GST_STREAM_ERROR_WRONG_TYPE
-            || err->code == GST_STREAM_ERROR_FAILED
-            || err->code == GST_CORE_ERROR_MISSING_PLUGIN
-            || err->code == GST_RESOURCE_ERROR_NOT_FOUND)
-            error = MediaPlayer::FormatError;
-        else if (err->domain == GST_STREAM_ERROR) {
-            // Let the mediaPlayerClient handle the stream error, in
-            // this case the HTMLMediaElement will emit a stalled
-            // event.
-            if (err->code == GST_STREAM_ERROR_TYPE_NOT_FOUND) {
-                LOG_VERBOSE(Media, "Decode error, let the Media element emit a stalled event.");
-                break;
-            }
-            error = MediaPlayer::DecodeError;
-            attemptNextLocation = true;
-        } else if (err->domain == GST_RESOURCE_ERROR)
-            error = MediaPlayer::NetworkError;
-
-        if (mp) {
-            if (attemptNextLocation)
-                issueError = !mp->loadNextLocation();
-            if (issueError)
-                mp->loadingFailed(error);
-        }
-        break;
-    case GST_MESSAGE_EOS:
-        LOG_VERBOSE(Media, "End of Stream");
-        mp->didEnd();
-        break;
-    case GST_MESSAGE_STATE_CHANGED:
-        // Ignore state changes if load is delayed (preload=none). The
-        // player state will be updated once commitLoad() is called.
-        if (mp->loadDelayed()) {
-            LOG_VERBOSE(Media, "Media load has been delayed. Ignoring state changes for now");
-            break;
-        }
-
-        // Ignore state changes from internal elements. They are
-        // forwarded to playbin2 anyway.
-        if (GST_MESSAGE_SRC(message) == reinterpret_cast<GstObject*>(pipeline))
-            mp->updateStates();
-        break;
-    case GST_MESSAGE_BUFFERING:
-        mp->processBufferingStats(message);
-        break;
-    case GST_MESSAGE_DURATION:
-        LOG_VERBOSE(Media, "Duration changed");
-        mp->durationChanged();
-        break;
-    default:
-        LOG_VERBOSE(Media, "Unhandled GStreamer message type: %s",
-                    GST_MESSAGE_TYPE_NAME(message));
-        break;
-    }
-    return true;
+    return player->handleMessage(message);
 }
 
-void mediaPlayerPrivateSourceChangedCallback(GObject *object, GParamSpec *pspec, gpointer data)
+static void mediaPlayerPrivateSourceChangedCallback(GObject*, GParamSpec*, MediaPlayerPrivateGStreamer* player)
 {
-    MediaPlayerPrivateGStreamer* mp = reinterpret_cast<MediaPlayerPrivateGStreamer*>(data);
-    GOwnPtr<GstElement> element;
-
-    g_object_get(mp->m_playBin, "source", &element.outPtr(), NULL);
-    gst_object_replace((GstObject**) &mp->m_source, (GstObject*) element.get());
-
-    if (WEBKIT_IS_WEB_SRC(element.get())) {
-        Frame* frame = mp->m_player->frameView() ? mp->m_player->frameView()->frame() : 0;
-
-        if (frame)
-            webKitWebSrcSetFrame(WEBKIT_WEB_SRC(element.get()), frame);
-    }
+    player->sourceChanged();
 }
 
-void mediaPlayerPrivateVolumeChangedCallback(GObject *element, GParamSpec *pspec, gpointer data)
+static void mediaPlayerPrivateVolumeChangedCallback(GObject*, GParamSpec*, MediaPlayerPrivateGStreamer* player)
 {
     // This is called when playbin receives the notify::volume signal.
-    MediaPlayerPrivateGStreamer* mp = reinterpret_cast<MediaPlayerPrivateGStreamer*>(data);
-    mp->volumeChanged();
+    player->volumeChanged();
 }
 
-gboolean mediaPlayerPrivateVolumeChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player)
+static gboolean mediaPlayerPrivateVolumeChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player)
 {
     // This is the callback of the timeout source created in ::volumeChanged.
     player->notifyPlayerOfVolumeChange();
     return FALSE;
 }
 
-void mediaPlayerPrivateMuteChangedCallback(GObject *element, GParamSpec *pspec, gpointer data)
+static void mediaPlayerPrivateMuteChangedCallback(GObject*, GParamSpec*, MediaPlayerPrivateGStreamer* player)
 {
     // This is called when playbin receives the notify::mute signal.
-    MediaPlayerPrivateGStreamer* mp = reinterpret_cast<MediaPlayerPrivateGStreamer*>(data);
-    mp->muteChanged();
+    player->muteChanged();
 }
 
-gboolean mediaPlayerPrivateMuteChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player)
+static gboolean mediaPlayerPrivateMuteChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player)
 {
     // This is the callback of the timeout source created in ::muteChanged.
     player->notifyPlayerOfMute();
     return FALSE;
 }
 
-void mediaPlayerPrivateVideoTagsChangedCallback(GObject* element, gint streamId, MediaPlayerPrivateGStreamer* player)
+static void mediaPlayerPrivateVideoSinkCapsChangedCallback(GObject*, GParamSpec*, MediaPlayerPrivateGStreamer* player)
 {
-    player->videoTagsChanged(streamId);
+    player->videoChanged();
 }
 
-void mediaPlayerPrivateAudioTagsChangedCallback(GObject* element, gint streamId, MediaPlayerPrivateGStreamer* player)
+static void mediaPlayerPrivateVideoChangedCallback(GObject*, MediaPlayerPrivateGStreamer* player)
 {
-    player->audioTagsChanged(streamId);
+    player->videoChanged();
 }
 
-gboolean mediaPlayerPrivateAudioTagsChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player)
+static void mediaPlayerPrivateAudioChangedCallback(GObject*, MediaPlayerPrivateGStreamer* player)
 {
-    // This is the callback of the timeout source created in ::audioTagsChanged.
-    player->notifyPlayerOfAudioTags();
-    return FALSE;
+    player->audioChanged();
 }
 
-gboolean mediaPlayerPrivateVideoTagsChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player)
+static gboolean mediaPlayerPrivateAudioChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player)
 {
-    // This is the callback of the timeout source created in ::videoTagsChanged.
-    player->notifyPlayerOfVideoTags();
+    // This is the callback of the timeout source created in ::audioChanged.
+    player->notifyPlayerOfAudio();
     return FALSE;
 }
 
-static float playbackPosition(GstElement* playbin)
+static gboolean mediaPlayerPrivateVideoChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player)
 {
-
-    float ret = 0.0f;
-
-    GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
-    if (!gst_element_query(playbin, query)) {
-        LOG_VERBOSE(Media, "Position query failed...");
-        gst_query_unref(query);
-        return ret;
-    }
-
-    gint64 position;
-    gst_query_parse_position(query, 0, &position);
-
-    // Position is available only if the pipeline is not in GST_STATE_NULL or
-    // GST_STATE_READY state.
-    if (position !=  static_cast<gint64>(GST_CLOCK_TIME_NONE))
-        ret = static_cast<float>(position) / static_cast<float>(GST_SECOND);
-
-    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
-
-    gst_query_unref(query);
-
-    return ret;
+    // This is the callback of the timeout source created in ::videoChanged.
+    player->notifyPlayerOfVideo();
+    return FALSE;
 }
 
-
-void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer *buffer, MediaPlayerPrivateGStreamer* playerPrivate)
+static void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer *buffer, MediaPlayerPrivateGStreamer* playerPrivate)
 {
-    g_return_if_fail(GST_IS_BUFFER(buffer));
-    gst_buffer_replace(&playerPrivate->m_buffer, buffer);
-    playerPrivate->repaint();
+    playerPrivate->triggerRepaint(buffer);
 }
 
 MediaPlayerPrivateInterface* MediaPlayerPrivateGStreamer::create(MediaPlayer* player)
@@ -347,8 +227,9 @@ MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer(MediaPlayer* player)
     , m_muteTimerHandler(0)
     , m_hasVideo(false)
     , m_hasAudio(false)
-    , m_audioTagsTimerHandler(0)
-    , m_videoTagsTimerHandler(0)
+    , m_audioTimerHandler(0)
+    , m_videoTimerHandler(0)
+    , m_webkitAudioSink(0)
 {
     if (doGstInit())
         createGSTPlayBin();
@@ -392,11 +273,11 @@ MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer()
     if (m_volumeTimerHandler)
         g_source_remove(m_volumeTimerHandler);
 
-    if (m_videoTagsTimerHandler)
-        g_source_remove(m_videoTagsTimerHandler);
+    if (m_videoTimerHandler)
+        g_source_remove(m_videoTimerHandler);
 
-    if (m_audioTagsTimerHandler)
-        g_source_remove(m_audioTagsTimerHandler);
+    if (m_audioTimerHandler)
+        g_source_remove(m_audioTimerHandler);
 }
 
 void MediaPlayerPrivateGStreamer::load(const String& url)
@@ -425,6 +306,32 @@ void MediaPlayerPrivateGStreamer::commitLoad()
     updateStates();
 }
 
+float MediaPlayerPrivateGStreamer::playbackPosition() const
+{
+    float ret = 0.0f;
+
+    GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
+    if (!gst_element_query(m_playBin, query)) {
+        LOG_VERBOSE(Media, "Position query failed...");
+        gst_query_unref(query);
+        return ret;
+    }
+
+    gint64 position;
+    gst_query_parse_position(query, 0, &position);
+
+    // Position is available only if the pipeline is not in GST_STATE_NULL or
+    // GST_STATE_READY state.
+    if (position != static_cast<gint64>(GST_CLOCK_TIME_NONE))
+        ret = static_cast<float>(position) / static_cast<float>(GST_SECOND);
+
+    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
+
+    gst_query_unref(query);
+
+    return ret;
+}
+
 bool MediaPlayerPrivateGStreamer::changePipelineState(GstState newState)
 {
     ASSERT(newState == GST_STATE_PLAYING || newState == GST_STATE_PAUSED);
@@ -504,14 +411,14 @@ float MediaPlayerPrivateGStreamer::currentTime() const
     if (m_seeking)
         return m_seekTime;
 
-    return playbackPosition(m_playBin);
+    return playbackPosition();
 
 }
 
 void MediaPlayerPrivateGStreamer::seek(float time)
 {
     // Avoid useless seeking.
-    if (time == playbackPosition(m_playBin))
+    if (time == playbackPosition())
         return;
 
     if (!m_playBin)
@@ -582,6 +489,7 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
         || !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
                                                     &pixelAspectRatioDenominator)) {
         gst_object_unref(GST_OBJECT(pad));
+        // The video-sink has likely not yet negotiated its caps.
         return IntSize();
     }
 
@@ -618,39 +526,40 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     return IntSize(static_cast<int>(width), static_cast<int>(height));
 }
 
-void MediaPlayerPrivateGStreamer::videoTagsChanged(gint streamId)
+void MediaPlayerPrivateGStreamer::videoChanged()
 {
-    if (m_videoTagsTimerHandler)
-        g_source_remove(m_videoTagsTimerHandler);
-    m_videoTagsTimerHandler = g_timeout_add(0, reinterpret_cast<GSourceFunc>(mediaPlayerPrivateVideoTagsChangeTimeoutCallback), this);
+    if (m_videoTimerHandler)
+        g_source_remove(m_videoTimerHandler);
+    m_videoTimerHandler = g_timeout_add(0, reinterpret_cast<GSourceFunc>(mediaPlayerPrivateVideoChangeTimeoutCallback), this);
 }
 
-void MediaPlayerPrivateGStreamer::notifyPlayerOfVideoTags()
+void MediaPlayerPrivateGStreamer::notifyPlayerOfVideo()
 {
-    m_videoTagsTimerHandler = 0;
+    m_videoTimerHandler = 0;
 
-    gint currentVideo = -1;
+    gint videoTracks = 0;
     if (m_playBin)
-        g_object_get(m_playBin, "current-video", &currentVideo, NULL);
-    m_hasVideo = currentVideo > -1;
+        g_object_get(m_playBin, "n-video", &videoTracks, NULL);
+
+    m_hasVideo = videoTracks > 0;
     m_player->mediaPlayerClient()->mediaPlayerEngineUpdated(m_player);
 }
 
-void MediaPlayerPrivateGStreamer::audioTagsChanged(gint streamId)
+void MediaPlayerPrivateGStreamer::audioChanged()
 {
-    if (m_audioTagsTimerHandler)
-        g_source_remove(m_audioTagsTimerHandler);
-    m_audioTagsTimerHandler = g_timeout_add(0, reinterpret_cast<GSourceFunc>(mediaPlayerPrivateAudioTagsChangeTimeoutCallback), this);
+    if (m_audioTimerHandler)
+        g_source_remove(m_audioTimerHandler);
+    m_audioTimerHandler = g_timeout_add(0, reinterpret_cast<GSourceFunc>(mediaPlayerPrivateAudioChangeTimeoutCallback), this);
 }
 
-void MediaPlayerPrivateGStreamer::notifyPlayerOfAudioTags()
+void MediaPlayerPrivateGStreamer::notifyPlayerOfAudio()
 {
-    m_audioTagsTimerHandler = 0;
+    m_audioTimerHandler = 0;
 
-    gint currentAudio = -1;
+    gint audioTracks = 0;
     if (m_playBin)
-        g_object_get(m_playBin, "current-audio", &currentAudio, NULL);
-    m_hasAudio = currentAudio > -1;
+        g_object_get(m_playBin, "n-audio", &audioTracks, NULL);
+    m_hasAudio = audioTracks > 0;
     m_player->mediaPlayerClient()->mediaPlayerEngineUpdated(m_player);
 }
 
@@ -704,13 +613,19 @@ void MediaPlayerPrivateGStreamer::setRate(float rate)
 
     m_playbackRate = rate;
     m_changingRate = true;
-    float currentPosition = static_cast<float>(playbackPosition(m_playBin) * GST_SECOND);
+
+    if (!rate) {
+        gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+        return;
+    }
+
+    float currentPosition = static_cast<float>(playbackPosition() * GST_SECOND);
     GstSeekFlags flags = (GstSeekFlags)(GST_SEEK_FLAG_FLUSH);
     gint64 start, end;
     bool mute = false;
 
     LOG_VERBOSE(Media, "Set Rate to %f", rate);
-    if (rate >= 0) {
+    if (rate > 0) {
         // Mute the sound if the playback rate is too extreme.
         // TODO: in other cases we should perform pitch adjustments.
         mute = (bool) (rate < 0.8 || rate > 2);
@@ -788,6 +703,89 @@ PassRefPtr<TimeRanges> MediaPlayerPrivateGStreamer::buffered() const
     return timeRanges.release();
 }
 
+gboolean MediaPlayerPrivateGStreamer::handleMessage(GstMessage* message)
+{
+    GOwnPtr<GError> err;
+    GOwnPtr<gchar> debug;
+    MediaPlayer::NetworkState error;
+    bool issueError = true;
+    bool attemptNextLocation = false;
+
+    if (message->structure) {
+        const gchar* messageTypeName = gst_structure_get_name(message->structure);
+
+        // Redirect messages are sent from elements, like qtdemux, to
+        // notify of the new location(s) of the media.
+        if (!g_strcmp0(messageTypeName, "redirect")) {
+            mediaLocationChanged(message);
+            return TRUE;
+        }
+    }
+
+    switch (GST_MESSAGE_TYPE(message)) {
+    case GST_MESSAGE_ERROR:
+        if (m_resetPipeline)
+            break;
+        gst_message_parse_error(message, &err.outPtr(), &debug.outPtr());
+        LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
+
+        error = MediaPlayer::Empty;
+        if (err->code == GST_STREAM_ERROR_CODEC_NOT_FOUND
+            || err->code == GST_STREAM_ERROR_WRONG_TYPE
+            || err->code == GST_STREAM_ERROR_FAILED
+            || err->code == GST_CORE_ERROR_MISSING_PLUGIN
+            || err->code == GST_RESOURCE_ERROR_NOT_FOUND)
+            error = MediaPlayer::FormatError;
+        else if (err->domain == GST_STREAM_ERROR) {
+            // Let the mediaPlayerClient handle the stream error, in
+            // this case the HTMLMediaElement will emit a stalled
+            // event.
+            if (err->code == GST_STREAM_ERROR_TYPE_NOT_FOUND) {
+                LOG_VERBOSE(Media, "Decode error, let the Media element emit a stalled event.");
+                break;
+            }
+            error = MediaPlayer::DecodeError;
+            attemptNextLocation = true;
+        } else if (err->domain == GST_RESOURCE_ERROR)
+            error = MediaPlayer::NetworkError;
+
+        if (attemptNextLocation)
+            issueError = !loadNextLocation();
+        if (issueError)
+            loadingFailed(error);
+        break;
+    case GST_MESSAGE_EOS:
+        LOG_VERBOSE(Media, "End of Stream");
+        didEnd();
+        break;
+    case GST_MESSAGE_STATE_CHANGED:
+        // Ignore state changes if load is delayed (preload=none). The
+        // player state will be updated once commitLoad() is called.
+        if (m_delayingLoad) {
+            LOG_VERBOSE(Media, "Media load has been delayed. Ignoring state changes for now");
+            break;
+        }
+
+        // Ignore state changes from internal elements. They are
+        // forwarded to playbin2 anyway.
+        if (GST_MESSAGE_SRC(message) == reinterpret_cast<GstObject*>(m_playBin))
+            updateStates();
+        break;
+    case GST_MESSAGE_BUFFERING:
+        processBufferingStats(message);
+        break;
+    case GST_MESSAGE_DURATION:
+        LOG_VERBOSE(Media, "Duration changed");
+        durationChanged();
+        break;
+    default:
+        LOG_VERBOSE(Media, "Unhandled GStreamer message type: %s",
+                    GST_MESSAGE_TYPE_NAME(message));
+        break;
+    }
+    return TRUE;
+}
+
 void MediaPlayerPrivateGStreamer::processBufferingStats(GstMessage* message)
 {
     // This is the immediate buffering that needs to happen so we have
@@ -952,6 +950,75 @@ unsigned MediaPlayerPrivateGStreamer::totalBytes() const
     return static_cast<unsigned>(length);
 }
 
+unsigned MediaPlayerPrivateGStreamer::decodedFrameCount() const
+{
+    guint64 decodedFrames = 0;
+    if (m_fpsSink)
+        g_object_get(m_fpsSink, "frames-rendered", &decodedFrames, NULL);
+    return static_cast<unsigned>(decodedFrames);
+}
+
+unsigned MediaPlayerPrivateGStreamer::droppedFrameCount() const
+{
+    guint64 framesDropped = 0;
+    if (m_fpsSink)
+        g_object_get(m_fpsSink, "frames-dropped", &framesDropped, NULL);
+    return static_cast<unsigned>(framesDropped);
+}
+
+unsigned MediaPlayerPrivateGStreamer::audioDecodedByteCount() const
+{
+    GstQuery* query = gst_query_new_position(GST_FORMAT_BYTES);
+    gint64 position = 0;
+
+    if (m_webkitAudioSink && gst_element_query(m_webkitAudioSink, query))
+        gst_query_parse_position(query, 0, &position);
+
+    gst_query_unref(query);
+    return static_cast<unsigned>(position);
+}
+
+unsigned MediaPlayerPrivateGStreamer::videoDecodedByteCount() const
+{
+    GstQuery* query = gst_query_new_position(GST_FORMAT_BYTES);
+    gint64 position = 0;
+
+    if (gst_element_query(m_webkitVideoSink, query))
+        gst_query_parse_position(query, 0, &position);
+
+    gst_query_unref(query);
+    return static_cast<unsigned>(position);
+}
+
+void MediaPlayerPrivateGStreamer::updateAudioSink()
+{
+    if (!m_playBin)
+        return;
+
+    GOwnPtr<GstElement> element;
+
+    g_object_get(m_playBin, "audio-sink", &element.outPtr(), NULL);
+    gst_object_replace(reinterpret_cast<GstObject**>(&m_webkitAudioSink),
+                       reinterpret_cast<GstObject*>(element.get()));
+}
+
+
+void MediaPlayerPrivateGStreamer::sourceChanged()
+{
+    GOwnPtr<GstElement> element;
+
+    g_object_get(m_playBin, "source", &element.outPtr(), NULL);
+    gst_object_replace(reinterpret_cast<GstObject**>(&m_source),
+                       reinterpret_cast<GstObject*>(element.get()));
+
+    if (WEBKIT_IS_WEB_SRC(element.get())) {
+        Frame* frame = m_player->frameView() ? m_player->frameView()->frame() : 0;
+
+        if (frame)
+            webKitWebSrcSetFrame(WEBKIT_WEB_SRC(element.get()), frame);
+    }
+}
+
 void MediaPlayerPrivateGStreamer::cancelLoad()
 {
     if (m_networkState < MediaPlayer::Loading || m_networkState == MediaPlayer::Loaded)
@@ -1011,6 +1078,8 @@ void MediaPlayerPrivateGStreamer::updateStates()
         // information from GStreamer, while we sync states where
         // needed.
         if (state == GST_STATE_PAUSED) {
+            if (!m_webkitAudioSink)
+                updateAudioSink();
             if (m_buffering && m_bufferingPercentage == 100) {
                 m_buffering = false;
                 m_bufferingPercentage = 0;
@@ -1347,8 +1416,11 @@ void MediaPlayerPrivateGStreamer::setVisible(bool visible)
 {
 }
 
-void MediaPlayerPrivateGStreamer::repaint()
+
+void MediaPlayerPrivateGStreamer::triggerRepaint(GstBuffer* buffer)
 {
+    g_return_if_fail(GST_IS_BUFFER(buffer));
+    gst_buffer_replace(&m_buffer, buffer);
     m_player->repaint();
 }
 
@@ -1359,6 +1431,7 @@ void MediaPlayerPrivateGStreamer::paint(GraphicsContext* context, const IntRect&
 
     if (!m_player->visible())
         return;
+
     if (!m_buffer)
         return;
 
@@ -1477,6 +1550,9 @@ static HashSet<String> mimeTypeCache()
                         || (g_str_equal(mimetype[0], "application")
                             && handledApplicationSubtypes.contains(String(mimetype[1]))))
                         cache.add(String(name));
+                    else if (g_str_equal(name, "application/x-hls"))
+                        cache.add(String("application/vnd.apple.mpegurl"));
+
 
                     g_strfreev(mimetype);
                 }
@@ -1584,8 +1660,8 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
     g_signal_connect(m_playBin, "notify::volume", G_CALLBACK(mediaPlayerPrivateVolumeChangedCallback), this);
     g_signal_connect(m_playBin, "notify::source", G_CALLBACK(mediaPlayerPrivateSourceChangedCallback), this);
     g_signal_connect(m_playBin, "notify::mute", G_CALLBACK(mediaPlayerPrivateMuteChangedCallback), this);
-    g_signal_connect(m_playBin, "video-tags-changed", G_CALLBACK(mediaPlayerPrivateVideoTagsChangedCallback), this);
-    g_signal_connect(m_playBin, "audio-tags-changed", G_CALLBACK(mediaPlayerPrivateAudioTagsChangedCallback), this);
+    g_signal_connect(m_playBin, "video-changed", G_CALLBACK(mediaPlayerPrivateVideoChangedCallback), this);
+    g_signal_connect(m_playBin, "audio-changed", G_CALLBACK(mediaPlayerPrivateAudioChangedCallback), this);
 
     m_webkitVideoSink = webkit_video_sink_new();
 
@@ -1613,39 +1689,44 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
     gst_object_unref(GST_OBJECT(srcPad));
     gst_object_unref(GST_OBJECT(sinkPad));
 
-    WTFLogChannel* channel = getChannelFromName("Media");
-    if (channel->state == WTFLogChannelOn) {
-        m_fpsSink = gst_element_factory_make("fpsdisplaysink", "sink");
-        if (g_object_class_find_property(G_OBJECT_GET_CLASS(m_fpsSink), "video-sink")) {
-            g_object_set(m_fpsSink, "video-sink", m_webkitVideoSink, NULL);
-            gst_bin_add(GST_BIN(m_videoSinkBin), m_fpsSink);
-#if GST_CHECK_VERSION(0, 10, 30)
-            // Faster elements linking, if possible.
-            gst_element_link_pads_full(queue, "src", m_fpsSink, "sink", GST_PAD_LINK_CHECK_NOTHING);
-#else
-            gst_element_link(queue, m_fpsSink);
-#endif
-        } else {
+    GstElement* actualVideoSink = 0;
+    m_fpsSink = gst_element_factory_make("fpsdisplaysink", "sink");
+    if (m_fpsSink) {
+        // The verbose property has been added in -bad 0.10.22. Making
+        // this whole code depend on it because we don't want
+        // fpsdiplaysink to spit data on stdout.
+        GstElementFactory* factory = GST_ELEMENT_FACTORY(GST_ELEMENT_GET_CLASS(m_fpsSink)->elementfactory);
+        if (gst_plugin_feature_check_version(GST_PLUGIN_FEATURE(factory), 0, 10, 22)) {
+            g_object_set(m_fpsSink, "silent", TRUE , NULL);
+
+            // Turn off text overlay unless logging is enabled.
+            WTFLogChannel* channel = getChannelFromName("Media");
+            if (channel->state != WTFLogChannelOn)
+                g_object_set(m_fpsSink, "text-overlay", FALSE , NULL);
+
+            if (g_object_class_find_property(G_OBJECT_GET_CLASS(m_fpsSink), "video-sink")) {
+                g_object_set(m_fpsSink, "video-sink", m_webkitVideoSink, NULL);
+                gst_bin_add(GST_BIN(m_videoSinkBin), m_fpsSink);
+                actualVideoSink = m_fpsSink;
+            } else
+                m_fpsSink = 0;
+        } else
             m_fpsSink = 0;
-            gst_bin_add(GST_BIN(m_videoSinkBin), m_webkitVideoSink);
-#if GST_CHECK_VERSION(0, 10, 30)
-            // Faster elements linking, if possible.
-            gst_element_link_pads_full(queue, "src", m_webkitVideoSink, "sink", GST_PAD_LINK_CHECK_NOTHING);
-#else
-            gst_element_link(queue, m_webkitVideoSink);
-#endif
-            LOG_VERBOSE(Media, "Can't display FPS statistics, you need gst-plugins-bad >= 0.10.18");
-        }
-    } else {
+    }
+
+    if (!m_fpsSink) {
         gst_bin_add(GST_BIN(m_videoSinkBin), m_webkitVideoSink);
+        actualVideoSink = m_webkitVideoSink;
+    }
+
+    ASSERT(actualVideoSink);
 #if GST_CHECK_VERSION(0, 10, 30)
         // Faster elements linking, if possible.
         gst_element_link_pads_full(queue, "src", identity, "sink", GST_PAD_LINK_CHECK_NOTHING);
-        gst_element_link_pads_full(identity, "src", m_webkitVideoSink, "sink", GST_PAD_LINK_CHECK_NOTHING);
+        gst_element_link_pads_full(identity, "src", actualVideoSink, "sink", GST_PAD_LINK_CHECK_NOTHING);
 #else
-        gst_element_link_many(queue, identity, m_webkitVideoSink, NULL);
+        gst_element_link_many(queue, identity, actualVideoSink, NULL);
 #endif
-    }
 
     // Add a ghostpad to the bin so it can proxy to tee.
     GstPad* pad = gst_element_get_static_pad(videoTee, "sink");
@@ -1654,6 +1735,14 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 
     // Set the bin as video sink of playbin.
     g_object_set(m_playBin, "video-sink", m_videoSinkBin, NULL);
+
+
+    pad = gst_element_get_static_pad(m_webkitVideoSink, "sink");
+    if (pad) {
+        g_signal_connect(pad, "notify::caps", G_CALLBACK(mediaPlayerPrivateVideoSinkCapsChangedCallback), this);
+        gst_object_unref(GST_OBJECT(pad));
+    }
+
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
index 8003887..024fad0 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -35,7 +35,6 @@ typedef struct _WebKitVideoSink WebKitVideoSink;
 typedef struct _GstBuffer GstBuffer;
 typedef struct _GstMessage GstMessage;
 typedef struct _GstElement GstElement;
-typedef struct _GstBus GstBus;
 
 namespace WebCore {
 
@@ -45,25 +44,11 @@ class IntRect;
 class GStreamerGWorld;
 class MediaPlayerPrivateGStreamer;
 
-gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data);
-void mediaPlayerPrivateVolumeChangedCallback(GObject* element, GParamSpec* pspec, gpointer data);
-void mediaPlayerPrivateMuteChangedCallback(GObject* element, GParamSpec* pspec, gpointer data);
-void mediaPlayerPrivateSourceChangedCallback(GObject* element, GParamSpec* pspec, gpointer data);
-void mediaPlayerPrivateVideoTagsChangedCallback(GObject* element, gint, MediaPlayerPrivateGStreamer*);
-void mediaPlayerPrivateAudioTagsChangedCallback(GObject* element, gint, MediaPlayerPrivateGStreamer*);
-gboolean mediaPlayerPrivateAudioTagsChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player);
-gboolean mediaPlayerPrivateVideoTagsChangeTimeoutCallback(MediaPlayerPrivateGStreamer* player);
-
-gboolean mediaPlayerPrivateVolumeChangeTimeoutCallback(MediaPlayerPrivateGStreamer*);
-gboolean mediaPlayerPrivateMuteChangeTimeoutCallback(MediaPlayerPrivateGStreamer*);
-
 class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
-        friend gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data);
-        friend void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer* buffer, MediaPlayerPrivateGStreamer* playerPrivate);
-        friend void mediaPlayerPrivateSourceChangedCallback(GObject* element, GParamSpec* pspec, gpointer data);
 
         public:
             static void registerMediaEngine(MediaEngineRegistrar);
+            gboolean handleMessage(GstMessage*);
 
             IntSize naturalSize() const;
             bool hasVideo() const { return m_hasVideo; }
@@ -72,7 +57,6 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             void load(const String &url);
             void commitLoad();
             void cancelLoad();
-            bool loadNextLocation();
 
             void prepareToPlay();
             void play();
@@ -96,7 +80,6 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             void muteChanged();
             void notifyPlayerOfMute();
 
-            bool loadDelayed() const { return m_delayingLoad; }
             void setPreload(MediaPlayer::Preload);
             void fillTimerFired(Timer<MediaPlayerPrivateGStreamer>*);
 
@@ -111,7 +94,6 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             void setVisible(bool);
             void setSize(const IntSize&);
 
-            void mediaLocationChanged(GstMessage*);
             void loadStateChanged();
             void sizeChanged();
             void timeChanged();
@@ -119,6 +101,7 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             void durationChanged();
             void loadingFailed(MediaPlayer::NetworkState);
 
+            void triggerRepaint(GstBuffer*);
             void repaint();
             void paint(GraphicsContext*, const IntRect&);
 
@@ -127,13 +110,17 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             bool supportsFullscreen() const;
             PlatformMedia platformMedia() const;
 
-            GstElement* pipeline() const { return m_playBin; }
-            bool pipelineReset() const { return m_resetPipeline; }
+            void videoChanged();
+            void audioChanged();
+            void notifyPlayerOfVideo();
+            void notifyPlayerOfAudio();
+
+            void sourceChanged();
 
-            void videoTagsChanged(gint);
-            void audioTagsChanged(gint);
-            void notifyPlayerOfVideoTags();
-            void notifyPlayerOfAudioTags();
+            unsigned decodedFrameCount() const;
+            unsigned droppedFrameCount() const;
+            unsigned audioDecodedByteCount() const;
+            unsigned videoDecodedByteCount() const;
 
         private:
             MediaPlayerPrivateGStreamer(MediaPlayer*);
@@ -145,6 +132,10 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
             static bool isAvailable();
 
+            void updateAudioSink();
+
+            float playbackPosition() const;
+
             void cacheDuration();
             void updateStates();
             float maxTimeLoaded() const;
@@ -152,7 +143,10 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             void createGSTPlayBin();
             bool changePipelineState(GstState state);
 
-            void processBufferingStats(GstMessage* message);
+            bool loadNextLocation();
+            void mediaLocationChanged(GstMessage*);
+
+            void processBufferingStats(GstMessage*);
 
         private:
             MediaPlayer* m_player;
@@ -191,8 +185,9 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             guint m_muteTimerHandler;
             bool m_hasVideo;
             bool m_hasAudio;
-            guint m_audioTagsTimerHandler;
-            guint m_videoTagsTimerHandler;
+            guint m_audioTimerHandler;
+            guint m_videoTimerHandler;
+            GstElement* m_webkitAudioSink;
     };
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
index 0ae4587..7b441f4 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
@@ -20,21 +20,37 @@
 #ifndef PlatformVideoWindowPrivate_h
 #define PlatformVideoWindowPrivate_h
 
+#include <QTimer>
 #include <QWidget>
 
 class QKeyEvent;
 
 namespace WebCore {
 
+class HTMLVideoElement;
+
 class FullScreenVideoWindow: public QWidget {
 Q_OBJECT
 public:
     FullScreenVideoWindow();
+    void setVideoElement(HTMLVideoElement*);
 signals:
     void closed();
 protected:
-    void keyPressEvent(QKeyEvent* ev);
-    bool event(QEvent* ev);
+    void closeEvent(QCloseEvent*);
+    void keyPressEvent(QKeyEvent*);
+    bool event(QEvent*);
+
+public slots:
+    void showFullScreen();
+
+private slots:
+    void hideCursor();
+
+private:
+    void showCursor();
+    QTimer m_cursorTimer;
+    HTMLVideoElement* m_mediaElement;
 };
 
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
index 872d055..7270785 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "PlatformVideoWindow.h"
 
+#include "HTMLVideoElement.h"
 #include "PlatformVideoWindowPrivate.h"
 
 #include <QApplication>
@@ -28,29 +29,55 @@
 #include <QPalette>
 using namespace WebCore;
 
+static const int gHideMouseCursorDelay = 3000;
+
 FullScreenVideoWindow::FullScreenVideoWindow()
     : QWidget(0, Qt::Window)
+    , m_mediaElement(0)
 {
     setAttribute(Qt::WA_NativeWindow);
-    // Setting these values ensures smooth resizing since it
-    // will prevent the system from clearing the background.
+    setWindowModality(Qt::ApplicationModal);
     setAttribute(Qt::WA_NoSystemBackground, true);
     setAttribute(Qt::WA_PaintOnScreen, true);
+
+    m_cursorTimer.setSingleShot(true);
+    connect(&m_cursorTimer, SIGNAL(timeout()), this, SLOT(hideCursor()));
+}
+
+void FullScreenVideoWindow::setVideoElement(HTMLVideoElement* element)
+{
+    m_mediaElement = element;
+}
+
+void FullScreenVideoWindow::closeEvent(QCloseEvent*)
+{
+    m_cursorTimer.stop();
+    setMouseTracking(false);
+    releaseMouse();
+    QApplication::restoreOverrideCursor();
 }
 
 void FullScreenVideoWindow::keyPressEvent(QKeyEvent* ev)
 {
-    if (ev->key() == Qt::Key_Escape) {
-        close();
+    if (m_mediaElement && ev->key() == Qt::Key_Space) {
+        if (!m_mediaElement->paused())
+            m_mediaElement->pause(true);
+        else
+            m_mediaElement->play(true);
+    } else if (ev->key() == Qt::Key_Escape)
         emit closed();
-    }
+    QWidget::keyPressEvent(ev);
 }
 
 bool FullScreenVideoWindow::event(QEvent* ev)
 {
     switch (ev->type()) {
+    case QEvent::MouseMove:
+        showCursor();
+        ev->accept();
+        return true;
     case QEvent::MouseButtonDblClick:
-        close();
+        emit closed();
         ev->accept();
         return true;
     default:
@@ -58,6 +85,26 @@ bool FullScreenVideoWindow::event(QEvent* ev)
     }
 }
 
+void FullScreenVideoWindow::showFullScreen()
+{
+    QWidget::showFullScreen();
+    setMouseTracking(true);
+    raise();
+    setFocus();
+    hideCursor();
+}
+
+void FullScreenVideoWindow::hideCursor()
+{
+    QApplication::setOverrideCursor(QCursor(Qt::BlankCursor));
+}
+
+void FullScreenVideoWindow::showCursor()
+{
+    QApplication::restoreOverrideCursor();
+    m_cursorTimer.start(gHideMouseCursorDelay);
+}
+
 
 PlatformVideoWindow::PlatformVideoWindow()
 {
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index 66ea9ba..e48998f 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -791,7 +791,7 @@ void StreamingClient::didReceiveResponse(ResourceHandle*, const ResourceResponse
         gst_element_found_tags_for_pad(GST_ELEMENT(m_src), m_src->priv->srcpad, tags);
 }
 
-void StreamingClient::didReceiveData(ResourceHandle* handle, const char* data, int length, int lengthReceived)
+void StreamingClient::didReceiveData(ResourceHandle* handle, const char* data, int length, int encodedDataLength)
 {
     WebKitWebSrcPrivate* priv = m_src->priv;
 
diff --git a/Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp b/Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp
new file mode 100644
index 0000000..17fc334
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
+
+#include "DrawingBuffer.h"
+
+#include "Extensions3D.h"
+
+namespace WebCore {
+
+DrawingBuffer::DrawingBuffer(GraphicsContext3D* context,
+                             const IntSize& size,
+                             bool multisampleExtensionSupported,
+                             bool packedDepthStencilExtensionSupported)
+    : m_context(context)
+    , m_size(-1, -1)
+    , m_multisampleExtensionSupported(multisampleExtensionSupported)
+    , m_packedDepthStencilExtensionSupported(packedDepthStencilExtensionSupported)
+    , m_fbo(context->createFramebuffer())
+    , m_colorBuffer(0)
+    , m_depthStencilBuffer(0)
+    , m_multisampleFBO(0)
+    , m_multisampleColorBuffer(0)
+{
+    ASSERT(m_fbo);
+    if (!m_fbo) {
+        clear();
+        return;
+    }
+        
+    // create a texture to render into
+    m_colorBuffer = context->createTexture();
+    context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_colorBuffer);
+    context->texParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
+    context->texParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+    context->bindTexture(GraphicsContext3D::TEXTURE_2D, 0);
+    
+    // Create the FBO
+    m_fbo = context->createFramebuffer();
+    ASSERT(m_fbo);
+    if (!m_fbo) {
+        clear();
+        return;
+    }
+
+    createSecondaryBuffers();
+    reset(size);
+}
+
+DrawingBuffer::~DrawingBuffer()
+{
+    clear();
+}
+
+void DrawingBuffer::didReset()
+{
+}
+
+Platform3DObject DrawingBuffer::platformColorBuffer() const
+{
+    return m_colorBuffer;
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/gtk/FontGtk.cpp b/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
index d14b052..977aa62 100644
--- a/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -35,9 +35,10 @@
 
 #include "CairoUtilities.h"
 #include "ContextShadow.h"
-#include "PlatformContextCairo.h"
+#include "GOwnPtr.h"
 #include "GraphicsContext.h"
 #include "NotImplemented.h"
+#include "PlatformContextCairo.h"
 #include "SimpleFontData.h"
 #include "TextRun.h"
 #include <cairo.h>
@@ -84,75 +85,71 @@ IntRect getPangoRegionExtents(PangoRegionType region)
 #define IS_HIGH_SURROGATE(u)  ((UChar)(u) >= (UChar)0xd800 && (UChar)(u) <= (UChar)0xdbff)
 #define IS_LOW_SURROGATE(u)  ((UChar)(u) >= (UChar)0xdc00 && (UChar)(u) <= (UChar)0xdfff)
 
-static void utf16_to_utf8(const UChar* aText, gint aLength, char* &text, gint &length)
+static gchar* utf16ToUtf8(const UChar* aText, gint aLength, gint &length)
 {
-  gboolean need_copy = FALSE;
-  int i;
+    gboolean needCopy = FALSE;
 
-  for (i = 0; i < aLength; i++) {
-    if (!aText[i] || IS_LOW_SURROGATE(aText[i])) {
-      need_copy = TRUE;
-      break;
-    }
-    else if (IS_HIGH_SURROGATE(aText[i])) {
-      if (i < aLength - 1 && IS_LOW_SURROGATE(aText[i+1]))
-        i++;
-      else {
-        need_copy = TRUE;
-        break;
-      }
+    for (int i = 0; i < aLength; i++) {
+        if (!aText[i] || IS_LOW_SURROGATE(aText[i])) {
+            needCopy = TRUE;
+            break;
+        } 
+
+        if (IS_HIGH_SURROGATE(aText[i])) {
+            if (i < aLength - 1 && IS_LOW_SURROGATE(aText[i+1]))
+                i++;
+            else {
+                needCopy = TRUE;
+                break;
+            }
+        }
     }
-  }
-
-  if (need_copy) {
 
-    /* Pango doesn't correctly handle nuls.  We convert them to 0xff. */
-    /* Also "validate" UTF-16 text to make sure conversion doesn't fail. */
-
-    UChar* p = (UChar*)g_memdup(aText, aLength * sizeof(aText[0]));
-
-    /* don't need to reset i */
-    for (i = 0; i < aLength; i++) {
-      if (!p[i] || IS_LOW_SURROGATE(p[i]))
-        p[i] = 0xFFFD;
-      else if (IS_HIGH_SURROGATE(p[i])) {
-        if (i < aLength - 1 && IS_LOW_SURROGATE(aText[i+1]))
-          i++;
-        else
-          p[i] = 0xFFFD;
-      }
+    GOwnPtr<UChar> copiedString;
+    if (needCopy) {
+        /* Pango doesn't correctly handle nuls.  We convert them to 0xff. */
+        /* Also "validate" UTF-16 text to make sure conversion doesn't fail. */
+
+        copiedString.set(static_cast<UChar*>(g_memdup(aText, aLength * sizeof(aText[0]))));
+        UChar* p = copiedString.get();
+
+        /* don't need to reset i */
+        for (int i = 0; i < aLength; i++) {
+            if (!p[i] || IS_LOW_SURROGATE(p[i]))
+                p[i] = 0xFFFD;
+            else if (IS_HIGH_SURROGATE(p[i])) {
+                if (i < aLength - 1 && IS_LOW_SURROGATE(aText[i+1]))
+                    i++;
+                else
+                    p[i] = 0xFFFD;
+            }
+        }
+
+        aText = p;
     }
 
-    aText = p;
-  }
-
-  glong items_written;
-  text = g_utf16_to_utf8(reinterpret_cast<const gunichar2*>(aText), aLength, NULL, &items_written, NULL);
-  length = items_written;
-
-  if (need_copy)
-    g_free((gpointer)aText);
+    gchar* utf8Text;
+    glong itemsWritten;
+    utf8Text = g_utf16_to_utf8(static_cast<const gunichar2*>(aText), aLength, 0, &itemsWritten, 0);
+    length = itemsWritten;
 
+    return utf8Text;
 }
 
 static gchar* convertUniCharToUTF8(const UChar* characters, gint length, int from, int to)
 {
-    gchar* utf8 = 0;
-    gint new_length = 0;
-    utf16_to_utf8(characters, length, utf8, new_length);
-    if (!utf8)
-        return NULL;
+    gint newLength = 0;
+    GOwnPtr<gchar> utf8Text(utf16ToUtf8(characters, length, newLength));
+    if (!utf8Text)
+        return 0;
 
+    gchar* pos = utf8Text.get();
     if (from > 0) {
         // discard the first 'from' characters
         // FIXME: we should do this before the conversion probably
-        gchar* str_left = g_utf8_offset_to_pointer(utf8, from);
-        gchar* tmp = g_strdup(str_left);
-        g_free(utf8);
-        utf8 = tmp;
+        pos = g_utf8_offset_to_pointer(utf8Text.get(), from);
     }
 
-    gchar* pos = utf8;
     gint len = strlen(pos);
     GString* ret = g_string_new_len(NULL, len);
 
diff --git a/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp b/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp
new file mode 100644
index 0000000..8e03ad7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GraphicsContext3D.h"
+
+#if ENABLE(WEBGL)
+
+#include "Extensions3DOpenGL.h"
+#include "GraphicsContext3DInternal.h"
+#include "OpenGLShims.h"
+#include "ShaderLang.h"
+#include <wtf/NotFound.h>
+
+namespace WebCore {
+
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
+{
+    // This implementation doesn't currently support rendering directly to the HostWindow.
+    if (renderStyle == RenderDirectlyToHostWindow)
+        return 0;
+
+    GraphicsContext3DInternal* internal = GraphicsContext3DInternal::create();
+    if (!internal)
+        return 0;
+
+    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, false));
+    context->m_internal.set(internal);
+    return context.release();
+}
+
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow*, bool)
+    : m_currentWidth(0)
+    , m_currentHeight(0)
+    , m_attrs(attributes)
+    , m_texture(0)
+    , m_fbo(0)
+    , m_depthStencilBuffer(0)
+    , m_boundFBO(0)
+    , m_multisampleFBO(0)
+    , m_multisampleDepthStencilBuffer(0)
+    , m_multisampleColorBuffer(0)
+{
+    GraphicsContext3DInternal::addActiveGraphicsContext(this);
+
+    validateAttributes();
+
+    // Create a texture to render into.
+    ::glGenTextures(1, &m_texture);
+    ::glBindTexture(GL_TEXTURE_2D, m_texture);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
+    ::glBindTexture(GL_TEXTURE_2D, 0);
+
+    // Create an FBO.
+    ::glGenFramebuffersEXT(1, &m_fbo);
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+
+    m_boundFBO = m_fbo;
+    if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth))
+        ::glGenRenderbuffersEXT(1, &m_depthStencilBuffer);
+    
+    // Create a multisample FBO.
+    if (m_attrs.antialias) {
+        ::glGenFramebuffersEXT(1, &m_multisampleFBO);
+        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_multisampleFBO);
+        m_boundFBO = m_multisampleFBO;
+        ::glGenRenderbuffersEXT(1, &m_multisampleColorBuffer);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glGenRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
+    }
+
+    // ANGLE initialization.
+    ShBuiltInResources ANGLEResources;
+    ShInitBuiltInResources(&ANGLEResources);
+
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &ANGLEResources.MaxVertexAttribs);
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS, &ANGLEResources.MaxVertexUniformVectors);
+    getIntegerv(GraphicsContext3D::MAX_VARYING_VECTORS, &ANGLEResources.MaxVaryingVectors);
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxVertexTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxCombinedTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS, &ANGLEResources.MaxFragmentUniformVectors);
+
+    // Always set to 1 for OpenGL ES.
+    ANGLEResources.MaxDrawBuffers = 1;
+    m_compiler.setResources(ANGLEResources);
+
+    ::glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
+    ::glEnable(GL_POINT_SPRITE);
+    ::glClearColor(0, 0, 0, 0);
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+    GraphicsContext3DInternal::removeActiveGraphicsContext(this);
+    if (!m_internal->m_context)
+        return;
+
+    makeContextCurrent();
+    ::glDeleteTextures(1, &m_texture);
+    if (m_attrs.antialias) {
+        ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glDeleteRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
+        ::glDeleteFramebuffersEXT(1, &m_multisampleFBO);
+    } else {
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glDeleteRenderbuffersEXT(1, &m_depthStencilBuffer);
+    }
+    ::glDeleteFramebuffersEXT(1, &m_fbo);
+}
+
+void GraphicsContext3D::makeContextCurrent()
+{
+    if (!m_internal)
+        return;
+    m_internal->makeContextCurrent();
+}
+
+PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
+{
+    return m_internal->m_context;
+}
+
+bool GraphicsContext3D::isGLES2Compliant() const
+{
+    return false;
+}
+
+}
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/gtk/GraphicsContext3DInternal.cpp b/Source/WebCore/platform/graphics/gtk/GraphicsContext3DInternal.cpp
new file mode 100644
index 0000000..de24554
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gtk/GraphicsContext3DInternal.cpp
@@ -0,0 +1,254 @@
+/*
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free
+ *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301 USA
+ */
+
+#include "config.h"
+#include "GraphicsContext3DInternal.h"
+
+#if ENABLE(WEBGL)
+
+#include "GraphicsContext3D.h"
+#include "OpenGLShims.h"
+#include <GL/glx.h>
+#include <dlfcn.h>
+
+// We do not want to call glXMakeContextCurrent using different Display pointers,
+// because it might lead to crashes in some drivers (fglrx). We use a shared display
+// pointer here.
+static Display* gSharedDisplay = 0;
+static Display* sharedDisplay()
+{
+    if (!gSharedDisplay)
+        gSharedDisplay = XOpenDisplay(0);
+    return gSharedDisplay;
+}
+
+namespace WebCore {
+
+// Because of driver bugs, exiting the program when there are active pbuffers
+// can crash the X server (this has been observed with the official Nvidia drivers).
+// We need to ensure that we clean everything up on exit. There are several reasons
+// that GraphicsContext3Ds will still be alive at exit, including user error (memory
+// leaks) and the page cache. In any case, we don't want the X server to crash.
+static bool cleaningUpAtExit = false;
+static Vector<GraphicsContext3D*>& activeGraphicsContexts()
+{
+    DEFINE_STATIC_LOCAL(Vector<GraphicsContext3D*>, contexts, ());
+    return contexts;
+}
+
+void GraphicsContext3DInternal::addActiveGraphicsContext(GraphicsContext3D* context)
+{
+    static bool addedAtExitHandler = false;
+    if (!addedAtExitHandler) {
+        atexit(&GraphicsContext3DInternal::cleanupActiveContextsAtExit);
+        addedAtExitHandler = true;
+    }
+    activeGraphicsContexts().append(context);
+}
+
+void GraphicsContext3DInternal::removeActiveGraphicsContext(GraphicsContext3D* context)
+{
+    if (cleaningUpAtExit)
+        return;
+
+    Vector<GraphicsContext3D*>& contexts = activeGraphicsContexts();
+    size_t location = contexts.find(context);
+    if (location != WTF::notFound)
+        contexts.remove(location);
+}
+
+void GraphicsContext3DInternal::cleanupActiveContextsAtExit()
+{
+    cleaningUpAtExit = true;
+
+    Vector<GraphicsContext3D*>& contexts = activeGraphicsContexts();
+    for (size_t i = 0; i < contexts.size(); i++)
+        contexts[i]->~GraphicsContext3D();
+
+    if (!gSharedDisplay)
+        return;
+    XCloseDisplay(gSharedDisplay);
+    gSharedDisplay = 0;
+}
+
+GraphicsContext3DInternal* GraphicsContext3DInternal::create()
+{
+    if (!sharedDisplay())
+        return 0;
+
+    static bool initialized = false;
+    static bool success = true;
+    if (!initialized) {
+        success = initializeOpenGLShims();
+        initialized = true;
+    }
+    if (!success)
+        return 0;
+
+    GraphicsContext3DInternal* internal = createPbufferContext();
+    if (!internal)
+        internal = createPixmapContext();
+    if (!internal)
+        return 0;
+
+    // The GraphicsContext3D constructor requires that this context is the current OpenGL context.
+    internal->makeContextCurrent();
+    return internal;
+}
+
+GraphicsContext3DInternal* GraphicsContext3DInternal::createPbufferContext()
+{
+    int fbConfigAttributes[] = {
+        GLX_DRAWABLE_TYPE, GLX_PBUFFER_BIT,
+        GLX_RENDER_TYPE, GLX_RGBA_BIT,
+        GLX_RED_SIZE, 1,
+        GLX_GREEN_SIZE, 1,
+        GLX_BLUE_SIZE, 1,
+        GLX_ALPHA_SIZE, 1,
+        GLX_DEPTH_SIZE, 1,
+        GLX_STENCIL_SIZE, 1,
+        GLX_SAMPLE_BUFFERS, 1,
+        GLX_DOUBLEBUFFER, GL_FALSE,
+        GLX_SAMPLES, 4,
+        0
+    };
+    int returnedElements;
+    GLXFBConfig* configs = glXChooseFBConfig(sharedDisplay(), 0, fbConfigAttributes, &returnedElements);
+    if (!configs) {
+        fbConfigAttributes[20] = 0; // Attempt without anti-aliasing.
+        configs = glXChooseFBConfig(sharedDisplay(), 0, fbConfigAttributes, &returnedElements);
+    }
+    if (!returnedElements) {
+        XFree(configs);
+        return 0;
+    }
+
+    // We will be rendering to a texture, so our pbuffer does not need to be large.
+    static const int pbufferAttributes[] = { GLX_PBUFFER_WIDTH, 1, GLX_PBUFFER_HEIGHT, 1, 0 };
+    GLXPbuffer pbuffer = glXCreatePbuffer(sharedDisplay(), configs[0], pbufferAttributes);
+    if (!pbuffer) {
+        XFree(configs);
+        return 0;
+    }
+
+    GLXContext context = glXCreateNewContext(sharedDisplay(), configs[0], GLX_RGBA_TYPE, 0, GL_TRUE);
+    XFree(configs);
+    if (!context)
+        return 0;
+    return new GraphicsContext3DInternal(context, pbuffer);
+}
+
+GraphicsContext3DInternal* GraphicsContext3DInternal::createPixmapContext()
+{
+    static int visualAttributes[] = {
+        GLX_RGBA,
+        GLX_RED_SIZE, 1,
+        GLX_GREEN_SIZE, 1,
+        GLX_BLUE_SIZE, 1,
+        GLX_ALPHA_SIZE, 1,
+        GLX_DOUBLEBUFFER,
+        0
+    };
+
+    XVisualInfo* visualInfo = glXChooseVisual(sharedDisplay(), DefaultScreen(sharedDisplay()), visualAttributes);
+    if (!visualInfo)
+        return 0;
+ 
+    GLXContext context = glXCreateContext(sharedDisplay(), visualInfo, 0, GL_TRUE);
+    if (!context) {
+        XFree(visualInfo);
+        return 0;
+    }
+
+    Pixmap pixmap = XCreatePixmap(sharedDisplay(), DefaultRootWindow(sharedDisplay()), 1, 1, visualInfo->depth);
+    if (!pixmap) {
+        XFree(visualInfo);
+        return 0;
+    }
+
+    GLXPixmap glxPixmap = glXCreateGLXPixmap(sharedDisplay(), visualInfo, pixmap);
+    if (!glxPixmap) {
+        XFreePixmap(sharedDisplay(), pixmap);
+        XFree(visualInfo);
+        return 0;
+    }
+
+    return new GraphicsContext3DInternal(context, pixmap, glxPixmap);
+}
+
+GraphicsContext3DInternal::GraphicsContext3DInternal(GLXContext context, GLXPbuffer pbuffer)
+    : m_context(context)
+    , m_pbuffer(pbuffer)
+    , m_pixmap(0)
+    , m_glxPixmap(0)
+{
+}
+
+GraphicsContext3DInternal::GraphicsContext3DInternal(GLXContext context, Pixmap pixmap, GLXPixmap glxPixmap)
+    : m_context(context)
+    , m_pbuffer(0)
+    , m_pixmap(pixmap)
+    , m_glxPixmap(glxPixmap)
+{
+}
+
+GraphicsContext3DInternal::~GraphicsContext3DInternal()
+{
+    if (m_context) {
+        // This may be necessary to prevent crashes with NVidia's closed source drivers. Originally
+        // from Mozilla's 3D canvas implementation at: http://bitbucket.org/ilmari/canvas3d/
+        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, 0);
+
+        ::glXMakeContextCurrent(sharedDisplay(), 0, 0, 0);
+        ::glXDestroyContext(sharedDisplay(), m_context);
+        m_context = 0;
+    }
+
+    if (m_pbuffer) {
+        ::glXDestroyPbuffer(sharedDisplay(), m_pbuffer);
+        m_pbuffer = 0;
+    }
+    if (m_glxPixmap) {
+        glXDestroyGLXPixmap(sharedDisplay(), m_glxPixmap);
+        m_glxPixmap = 0;
+    }
+    if (m_pixmap) {
+        XFreePixmap(sharedDisplay(), m_pixmap);
+        m_pixmap = 0;
+    }
+}
+
+void GraphicsContext3DInternal::makeContextCurrent()
+{
+    if (::glXGetCurrentContext() == m_context)
+        return;
+    if (!m_context)
+        return;
+    if (m_pbuffer) {
+        ::glXMakeCurrent(sharedDisplay(), m_pbuffer, m_context);
+        return;
+    }
+
+    ASSERT(m_glxPixmap);
+    ::glXMakeCurrent(sharedDisplay(), m_glxPixmap, m_context);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE_WEBGL
diff --git a/Source/WebCore/platform/graphics/gtk/GraphicsContext3DInternal.h b/Source/WebCore/platform/graphics/gtk/GraphicsContext3DInternal.h
new file mode 100644
index 0000000..f4a60d9
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gtk/GraphicsContext3DInternal.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free
+ *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301 USA
+ */
+
+#ifndef GraphicsContext3DInternal_h
+#define GraphicsContext3DInternal_h
+
+typedef struct __GLXcontextRec *GLXContext;
+typedef unsigned long GLXPbuffer;
+typedef unsigned long GLXPixmap;
+typedef unsigned char GLubyte;
+typedef unsigned long Pixmap;
+
+namespace WebCore {
+
+class GraphicsContext3D;
+
+class GraphicsContext3DInternal {
+    public:
+    static GraphicsContext3DInternal* create();
+    ~GraphicsContext3DInternal();
+    void makeContextCurrent();
+
+    private:
+    friend class GraphicsContext3D;
+    static GraphicsContext3DInternal* createPbufferContext();
+    static GraphicsContext3DInternal* createPixmapContext();
+    GraphicsContext3DInternal(GLXContext, GLXPbuffer);
+    GraphicsContext3DInternal(GLXContext, Pixmap, GLXPixmap);
+
+    static void addActiveGraphicsContext(GraphicsContext3D*);
+    static void removeActiveGraphicsContext(GraphicsContext3D*);
+    static void cleanupActiveContextsAtExit();
+
+    GLXContext m_context;
+    GLXPbuffer m_pbuffer;
+    Pixmap m_pixmap;
+    GLXPixmap m_glxPixmap;
+};
+
+}
+
+#endif // GraphicsContext3DIternal_h
diff --git a/Source/WebCore/platform/graphics/haiku/ImageBufferData.h b/Source/WebCore/platform/graphics/haiku/ImageBufferDataHaiku.h
index 7c676cd..10285fc 100644
--- a/Source/WebCore/platform/graphics/haiku/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/haiku/ImageBufferDataHaiku.h
@@ -25,9 +25,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ImageBufferData_h
-#define ImageBufferData_h
-
 #include <Bitmap.h>
 #include <View.h>
 
@@ -45,6 +42,3 @@ public:
 };
 
 } // namespace WebCore
-
-#endif // ImageBufferData_h
-
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextController.h b/Source/WebCore/platform/graphics/mac/ComplexTextController.h
index 44a7994..281e49f 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextController.h
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextController.h
@@ -116,9 +116,6 @@ private:
         static OSStatus overrideLayoutOperation(ATSULayoutOperationSelector, ATSULineRef, URefCon, void*, ATSULayoutOperationCallbackStatus*);
 #endif
 
-#if USE(CORE_TEXT)
-        RetainPtr<CTRunRef> m_coreTextRun;
-#endif
         unsigned m_glyphCount;
         const SimpleFontData* m_fontData;
         const UChar* m_characters;
@@ -159,6 +156,10 @@ private:
 
     Vector<UChar, 256> m_smallCapsBuffer;
 
+#if USE(CORE_TEXT)
+    // Retain lines rather than their runs for better performance.
+    Vector<RetainPtr<CTLineRef> > m_coreTextLines;
+#endif
     Vector<RefPtr<ComplexTextRun>, 16> m_complexTextRuns;
     Vector<CGSize, 256> m_adjustedAdvances;
     Vector<CGGlyph, 256> m_adjustedGlyphs;
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
index d2fbaf5..1473b1e 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
@@ -43,33 +43,32 @@ extern const CFStringRef kCTTypesetterOptionForcedEmbeddingLevel;
 namespace WebCore {
 
 ComplexTextController::ComplexTextRun::ComplexTextRun(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, CFRange runRange)
-    : m_coreTextRun(ctRun)
-    , m_fontData(fontData)
+    : m_fontData(fontData)
     , m_characters(characters)
     , m_stringLocation(stringLocation)
     , m_stringLength(stringLength)
     , m_indexEnd(runRange.location + runRange.length)
     , m_isMonotonic(true)
 {
-    m_glyphCount = CTRunGetGlyphCount(m_coreTextRun.get());
-    m_coreTextIndices = CTRunGetStringIndicesPtr(m_coreTextRun.get());
+    m_glyphCount = CTRunGetGlyphCount(ctRun);
+    m_coreTextIndices = CTRunGetStringIndicesPtr(ctRun);
     if (!m_coreTextIndices) {
         m_coreTextIndicesVector.grow(m_glyphCount);
-        CTRunGetStringIndices(m_coreTextRun.get(), CFRangeMake(0, 0), m_coreTextIndicesVector.data());
+        CTRunGetStringIndices(ctRun, CFRangeMake(0, 0), m_coreTextIndicesVector.data());
         m_coreTextIndices = m_coreTextIndicesVector.data();
     }
 
-    m_glyphs = CTRunGetGlyphsPtr(m_coreTextRun.get());
+    m_glyphs = CTRunGetGlyphsPtr(ctRun);
     if (!m_glyphs) {
         m_glyphsVector.grow(m_glyphCount);
-        CTRunGetGlyphs(m_coreTextRun.get(), CFRangeMake(0, 0), m_glyphsVector.data());
+        CTRunGetGlyphs(ctRun, CFRangeMake(0, 0), m_glyphsVector.data());
         m_glyphs = m_glyphsVector.data();
     }
 
-    m_advances = CTRunGetAdvancesPtr(m_coreTextRun.get());
+    m_advances = CTRunGetAdvancesPtr(ctRun);
     if (!m_advances) {
         m_advancesVector.grow(m_glyphCount);
-        CTRunGetAdvances(m_coreTextRun.get(), CFRangeMake(0, 0), m_advancesVector.data());
+        CTRunGetAdvances(ctRun, CFRangeMake(0, 0), m_advancesVector.data());
         m_advances = m_advancesVector.data();
     }
 }
@@ -159,6 +158,8 @@ void ComplexTextController::collectComplexTextRunsForCharactersCoreText(const UC
         line.adoptCF(wkCreateCTLineWithUniCharProvider(&provideStringAndAttributes, 0, &info));
     }
 
+    m_coreTextLines.append(line.get());
+
     CFArrayRef runArray = CTLineGetGlyphRuns(line.get());
 
     CFIndex runCount = CFArrayGetCount(runArray);
diff --git a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
index 997c976..2a469a7 100644
--- a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
+++ b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
@@ -90,8 +90,8 @@ PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attri
 GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, bool)
     : m_currentWidth(0)
     , m_currentHeight(0)
-    , m_attrs(attrs)
     , m_contextObj(0)
+    , m_attrs(attrs)
     , m_texture(0)
     , m_compositorTexture(0)
     , m_fbo(0)
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index cd34000..f34d53b 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -241,6 +241,7 @@ void SimpleFontData::platformInit()
     NSString *familyName = [m_platformData.font() familyName];
     if ([familyName isEqualToString:@"Times"] || [familyName isEqualToString:@"Helvetica"] || [familyName isEqualToString:@"Courier"])
         ascent += floorf(((ascent + descent) * 0.15f) + 0.5f);
+#if defined(BUILDING_ON_LEOPARD)
     else if ([familyName isEqualToString:@"Geeza Pro"]) {
         // Geeza Pro has glyphs that draw slightly above the ascent or far below the descent. Adjust
         // those vertical metrics to better match reality, so that diacritics at the bottom of one line
@@ -248,6 +249,7 @@ void SimpleFontData::platformInit()
         ascent *= 1.08f;
         descent *= 2.f;
     }
+#endif
 
     // Compute and store line spacing, before the line metrics hacks are applied.
     m_fontMetrics.setLineSpacing(lroundf(ascent) + lroundf(descent) + lroundf(lineGap));
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
index e09534e..4c7164e 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
@@ -35,6 +35,8 @@
 #if PLATFORM(MAC)
 #include "ANGLE/ShaderLang.h"
 #include <OpenGL/gl.h>
+#elif PLATFORM(GTK)
+#include "OpenGLShims.h"
 #endif
 
 namespace WebCore {
@@ -116,6 +118,17 @@ void Extensions3DOpenGL::ensureEnabled(const String& name)
 #endif
 }
 
+bool Extensions3DOpenGL::isEnabled(const String& name)
+{
+#if PLATFORM(MAC)
+    if (name == "GL_OES_standard_derivatives") {
+        ANGLEWebKitBridge& compiler = m_context->m_compiler;
+        return compiler.getResources().OES_standard_derivatives;
+    }
+#endif
+    return supports(name);
+}
+
 int Extensions3DOpenGL::getGraphicsResetStatusARB()
 {
     return GraphicsContext3D::NO_ERROR;
@@ -134,7 +147,7 @@ void Extensions3DOpenGL::renderbufferStorageMultisample(unsigned long target, un
 Platform3DObject Extensions3DOpenGL::createVertexArrayOES()
 {
     m_context->makeContextCurrent();
-#if defined GL_APPLE_vertex_array_object && GL_APPLE_vertex_array_object
+#if !PLATFORM(GTK) && defined(GL_APPLE_vertex_array_object) && GL_APPLE_vertex_array_object
     GLuint array = 0;
     glGenVertexArraysAPPLE(1, &array);
     return array;
@@ -149,7 +162,7 @@ void Extensions3DOpenGL::deleteVertexArrayOES(Platform3DObject array)
         return;
     
     m_context->makeContextCurrent();
-#if defined GL_APPLE_vertex_array_object && GL_APPLE_vertex_array_object
+#if !PLATFORM(GTK) && defined(GL_APPLE_vertex_array_object) && GL_APPLE_vertex_array_object
     glDeleteVertexArraysAPPLE(1, &array);
 #endif
 }
@@ -160,7 +173,7 @@ GC3Dboolean Extensions3DOpenGL::isVertexArrayOES(Platform3DObject array)
         return GL_FALSE;
     
     m_context->makeContextCurrent();
-#if defined GL_APPLE_vertex_array_object && GL_APPLE_vertex_array_object
+#if !PLATFORM(GTK) && defined(GL_APPLE_vertex_array_object) && GL_APPLE_vertex_array_object
     return glIsVertexArrayAPPLE(array);
 #else
     return GL_FALSE;
@@ -173,7 +186,7 @@ void Extensions3DOpenGL::bindVertexArrayOES(Platform3DObject array)
         return;
 
     m_context->makeContextCurrent();
-#if defined GL_APPLE_vertex_array_object && GL_APPLE_vertex_array_object
+#if !PLATFORM(GTK) && defined(GL_APPLE_vertex_array_object) && GL_APPLE_vertex_array_object
     glBindVertexArrayAPPLE(array);
 #endif
 }
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
index 9188507..e545fbc 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
@@ -41,6 +41,7 @@ public:
     // Extensions3D methods.
     virtual bool supports(const String&);
     virtual void ensureEnabled(const String&);
+    virtual bool isEnabled(const String&);
     virtual int getGraphicsResetStatusARB();
     virtual void blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter);
     virtual void renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height);
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index f831550..af46293 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -42,14 +42,16 @@
 #include "Int32Array.h"
 #include "NotImplemented.h"
 #include "Uint8Array.h"
+#include <cstring>
+#include <wtf/UnusedParam.h>
+#include <wtf/text/CString.h>
 
 #if PLATFORM(MAC)
 #include <OpenGL/gl.h>
+#elif PLATFORM(GTK)
+#include "OpenGLShims.h"
 #endif
 
-#include <wtf/UnusedParam.h>
-#include <wtf/text/CString.h>
-
 namespace WebCore {
 
 void GraphicsContext3D::validateAttributes()
@@ -163,7 +165,7 @@ PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData()
 
 void GraphicsContext3D::reshape(int width, int height)
 {
-    if (!m_contextObj)
+    if (!platformGraphicsContext3D())
         return;
 
     if (width == m_currentWidth && height == m_currentHeight)
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
index 9765937..1493966 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
@@ -388,7 +388,7 @@ void TextureMapperGL::drawTexture(const BitmapTexture& texture, const IntRect& t
     GL_CMD(glBindTexture(GL_TEXTURE_2D, textureGL.m_id))
     GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0))
     const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
+    GL_CMD(glVertexAttribPointer(gInVertexAttributeIndex, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
 
     TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
             targetRect.width(), 0, 0, 0,
@@ -641,7 +641,7 @@ void TextureMapperGL::paintToTarget(const BitmapTexture& aSurface, const IntSize
     GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::ShaderInfo::InSourceMatrixVariable], 1, GL_FALSE, m4src))
     GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0))
     const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
+    GL_CMD(glVertexAttribPointer(gInVertexAttributeIndex, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
     GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
     GL_CMD(glEnable(GL_BLEND))
     setClip(visibleRect);
diff --git a/Source/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/Source/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
index 7f4547d..6afe3d9 100644
--- a/Source/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
+++ b/Source/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -70,7 +70,7 @@ struct TableDirectoryEntry {
     BigEndianULong length;
 };
 
-#if !PLATFORM(CG) || !defined(COREGRAPHICS_INCLUDES_CORESERVICES_HEADER)
+#if !USE(CG) || !defined(COREGRAPHICS_INCLUDES_CORESERVICES_HEADER)
 // Fixed type is not defined on non-CG and Windows platforms. |version| in sfntHeader
 // and headTable and |fontRevision| in headTable are of Fixed, but they're
 // not actually refered to anywhere. Therefore, we just have to match
diff --git a/Source/WebCore/platform/graphics/openvg/GraphicsContextOpenVG.cpp b/Source/WebCore/platform/graphics/openvg/GraphicsContextOpenVG.cpp
index 75dbadb..1595692 100644
--- a/Source/WebCore/platform/graphics/openvg/GraphicsContextOpenVG.cpp
+++ b/Source/WebCore/platform/graphics/openvg/GraphicsContextOpenVG.cpp
@@ -257,7 +257,7 @@ void GraphicsContext::drawLineForTextChecking(const IntPoint& origin, int width,
     UNUSED_PARAM(style);
 }
 
-FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect, RoundingMode)
 {
     if (paintingDisabled())
         return FloatRect();
diff --git a/Source/WebCore/platform/graphics/pango/FontPlatformData.h b/Source/WebCore/platform/graphics/pango/FontPlatformData.h
index 180d23b..bd9251b 100644
--- a/Source/WebCore/platform/graphics/pango/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/pango/FontPlatformData.h
@@ -68,6 +68,7 @@ public:
     bool syntheticOblique() const { return m_syntheticOblique; }
 
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
 
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
index 3adc93f..45d5e9c 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
@@ -52,6 +52,11 @@ void Extensions3DQt::ensureEnabled(const String& name)
     ASSERT(supports(name));
 }
 
+bool Extensions3DQt::isEnabled(const String& name)
+{
+    return supports(name);
+}
+
 int Extensions3DQt::getGraphicsResetStatusARB()
 {
     return GraphicsContext3D::NO_ERROR;
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.h b/Source/WebCore/platform/graphics/qt/Extensions3DQt.h
index c67fbed..1bc47b8 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.h
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.h
@@ -37,6 +37,7 @@ public:
     // Extensions3D methods.
     virtual bool supports(const String&);
     virtual void ensureEnabled(const String&);
+    virtual bool isEnabled(const String&);
     virtual int getGraphicsResetStatusARB();
     virtual void blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter);
     virtual void renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height);
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 4daa4dc..e92f927 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -447,6 +447,12 @@ GraphicsContext3DInternal::GraphicsContext3DInternal(GraphicsContext3D::Attribut
 
 GraphicsContext3DInternal::~GraphicsContext3DInternal()
 {
+    m_glWidget->makeCurrent();
+    if (m_glWidget->isValid()) {
+        ::glDeleteTextures(1, &m_texture);
+        deleteRenderbuffers(1, &m_depthBuffer);
+        deleteFramebuffers(1, &m_canvasFbo);
+    }
     delete m_glWidget;
     m_glWidget = 0;
 }
@@ -588,7 +594,7 @@ void* GraphicsContext3DInternal::getProcAddress(const String& proc)
     for (int i = 0; i < 3; i++) {
         String nameWithExt = proc + ext[i];
 
-        void* addr = m_glWidget->context()->getProcAddress(nameWithExt.utf8().data());
+        void* addr = m_glWidget->context()->getProcAddress(QString(nameWithExt));
         if (addr) 
             return addr;
     }
@@ -656,7 +662,7 @@ PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData()
 
 void GraphicsContext3D::reshape(int width, int height)
 {
-    if (width == m_currentWidth && height == m_currentHeight || (!m_internal))
+    if ((width == m_currentWidth && height == m_currentHeight) || (!m_internal))
         return;
 
     m_currentWidth = width;
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index e3e0fa6..a3a08eb 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -900,7 +900,7 @@ void GraphicsContext::drawLineForTextChecking(const FloatPoint&, float, TextChec
     notImplemented();
 }
 
-FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect, RoundingMode)
 {
     // It is not enough just to round to pixels in device space. The rotation part of the
     // affine transform matrix to device space can mess with this conversion if we have a
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferData.h b/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.h
index 602197e..8b49829 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.h
@@ -23,16 +23,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ImageBufferData_h
-#define ImageBufferData_h
-
 #include "Image.h"
-#include <wtf/RefPtr.h>
 
+#include "OwnPtr.h"
 #include <QPainter>
 #include <QPixmap>
-
-#include "OwnPtr.h"
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
@@ -49,6 +45,4 @@ public:
     RefPtr<Image> m_image;
 };
 
-}  // namespace WebCore
-
-#endif  // ImageBufferData_h
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
index bc43acf..e7efdf9 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -84,7 +84,17 @@ MediaPlayer::SupportsType MediaPlayerPrivateQt::supportsType(const String& mime,
     if (!mime.startsWith("audio/") && !mime.startsWith("video/"))
         return MediaPlayer::IsNotSupported;
 
-    if (QMediaPlayer::hasSupport(mime, QStringList(codec)) >= QtMultimediaKit::ProbablySupported)
+    // Parse and trim codecs.
+    QString codecStr = codec;
+    QStringList codecList = codecStr.split(QLatin1Char(','), QString::SkipEmptyParts);
+    QStringList codecListTrimmed;
+    foreach (const QString& codecStrNotTrimmed, codecList) {
+        QString codecStrTrimmed = codecStrNotTrimmed.trimmed();
+        if (!codecStrTrimmed.isEmpty())
+            codecListTrimmed.append(codecStrTrimmed);
+    }
+
+    if (QMediaPlayer::hasSupport(mime, codecListTrimmed) >= QtMultimediaKit::ProbablySupported)
         return MediaPlayer::IsSupported;
 
     return MediaPlayer::MayBeSupported;
diff --git a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index 5d0b302..9bf1030 100644
--- a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2008, 2009, 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2008 Holger Hans Peter Freyther
 
     This library is free software; you can redistribute it and/or
@@ -48,11 +48,29 @@ void SimpleFontData::platformInit()
     }
 
     QFontMetricsF fm(m_platformData.font());
-    m_fontMetrics.setAscent(fm.ascent());
-    m_fontMetrics.setDescent(fm.descent());
+
+    // Qt subtracts 1 from the descent to account for the baseline,
+    // we add it back here to get correct metrics for WebKit.
+    float descent = fm.descent() + 1;
+    float ascent = fm.ascent();
+
+    float lineSpacing = fm.lineSpacing();
+
+    // The line spacing should always be >= (ascent + descent), but this
+    // may be false in some cases due to misbehaving platform libraries.
+    // Workaround from SimpleFontPango.cpp and SimpleFontFreeType.cpp
+    if (lineSpacing < ascent + descent)
+        lineSpacing = ascent + descent;
+
+    // QFontMetricsF::leading() may return negative values on platforms
+    // such as FreeType. Calculate the line gap manually instead.
+    float lineGap = lineSpacing - ascent - descent;
+
+    m_fontMetrics.setAscent(ascent);
+    m_fontMetrics.setDescent(descent);
+    m_fontMetrics.setLineSpacing(lineSpacing);
     m_fontMetrics.setXHeight(fm.xHeight());
-    m_fontMetrics.setLineGap(fm.leading());
-    m_fontMetrics.setLineSpacing(fm.lineSpacing());
+    m_fontMetrics.setLineGap(lineGap);
     m_spaceWidth = fm.width(QLatin1Char(' '));
 }
 
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
index 5950c35..0fb44e7 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
@@ -30,6 +30,7 @@
 
 #include "GraphicsContext3D.h"
 
+#include "BitmapImage.h"
 #include "Image.h"
 #include "ImageSource.h"
 #include "NativeImageSkia.h"
@@ -50,15 +51,17 @@ bool GraphicsContext3D::getImageData(Image* image,
     if (!image)
         return false;
     OwnPtr<NativeImageSkia> pixels;
-    NativeImageSkia* skiaImage = 0;
+    NativeImageSkia* skiaImage = image->nativeImageForCurrentFrame();
     AlphaOp neededAlphaOp = AlphaDoNothing;
-    if (image->data()) {
+    bool hasAlpha = skiaImage ? !skiaImage->isOpaque() : true;
+    if ((!skiaImage || ignoreGammaAndColorProfile || (hasAlpha && !premultiplyAlpha)) && image->data()) {
         ImageSource decoder(ImageSource::AlphaNotPremultiplied,
                             ignoreGammaAndColorProfile ? ImageSource::GammaAndColorProfileIgnored : ImageSource::GammaAndColorProfileApplied);
+        // Attempt to get raw unpremultiplied image data 
         decoder.setData(image->data(), true);
         if (!decoder.frameCount() || !decoder.frameIsCompleteAtIndex(0))
             return false;
-        bool hasAlpha = decoder.frameHasAlphaAtIndex(0);
+        hasAlpha = decoder.frameHasAlphaAtIndex(0);
         pixels = adoptPtr(decoder.createFrameAtIndex(0));
         if (!pixels.get() || !pixels->isDataComplete() || !pixels->width() || !pixels->height())
             return false;
@@ -68,12 +71,8 @@ bool GraphicsContext3D::getImageData(Image* image,
         skiaImage = pixels.get();
         if (hasAlpha && premultiplyAlpha)
             neededAlphaOp = AlphaDoPremultiply;
-    } else {
-        // This is a special case for texImage2D with HTMLCanvasElement input.
-        skiaImage = image->nativeImageForCurrentFrame();
-        if (!premultiplyAlpha)
-            neededAlphaOp = AlphaDoUnmultiply;
-    }
+    } else if (!premultiplyAlpha && hasAlpha)
+        neededAlphaOp = AlphaDoUnmultiply;
     if (!skiaImage)
         return false;
     SkBitmap& skiaImageRef = *skiaImage;
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index df680eb..f285c9b 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -44,8 +44,10 @@
 #include "PlatformContextSkia.h"
 
 #include "SkBitmap.h"
-#include "SkBlurDrawLooper.h"
+#include "SkBlurMaskFilter.h"
+#include "SkColorFilter.h"
 #include "SkCornerPathEffect.h"
+#include "SkLayerDrawLooper.h"
 #include "SkShader.h"
 #include "SkiaUtils.h"
 #include "skia/ext/platform_canvas.h"
@@ -853,6 +855,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect,
 
     SkPaint paint;
     platformContext()->setupPaintForFilling(&paint);
+    paint.setColor(color.rgb());
     platformContext()->canvas()->drawPath(path, paint);
 }
 
@@ -867,7 +870,7 @@ AffineTransform GraphicsContext::getCTM() const
                            SkScalarToDouble(m.getTranslateY()));
 }
 
-FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect, RoundingMode)
 {
     return rect;
 }
@@ -1043,16 +1046,15 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
     double height = size.height();
     double blur = blurFloat;
 
-    uint32_t blurFlags = SkBlurDrawLooper::kHighQuality_BlurFlag | 
-        SkBlurDrawLooper::kOverrideColor_BlurFlag;
+    uint32_t mfFlags = SkBlurMaskFilter::kHighQuality_BlurFlag;
 
     if (m_state.shadowsIgnoreTransforms)  {
         // Currently only the GraphicsContext associated with the
         // CanvasRenderingContext for HTMLCanvasElement have shadows ignore
         // Transforms. So with this flag set, we know this state is associated
         // with a CanvasRenderingContext.
-        blurFlags |= SkBlurDrawLooper::kIgnoreTransform_BlurFlag;
-        
+        mfFlags |= SkBlurMaskFilter::kIgnoreTransform_BlurFlag;
+
         // CG uses natural orientation for Y axis, but the HTML5 canvas spec
         // does not.
         // So we now flip the height since it was flipped in
@@ -1068,9 +1070,32 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
 
     // TODO(tc): Should we have a max value for the blur?  CG clamps at 1000.0
     // for perf reasons.
-    SkDrawLooper* dl = new SkBlurDrawLooper(blur / 2, width, height, c, blurFlags);
+
+    SkLayerDrawLooper* dl = new SkLayerDrawLooper;
+    SkAutoUnref aur(dl);
+
+    // top layer, we just draw unchanged
+    dl->addLayer();
+
+    // lower layer contains our offset, blur, and colorfilter
+    SkLayerDrawLooper::LayerInfo info;
+
+    info.fPaintBits |= SkLayerDrawLooper::kMaskFilter_Bit; // our blur
+    info.fPaintBits |= SkLayerDrawLooper::kColorFilter_Bit;
+    info.fColorMode = SkXfermode::kDst_Mode;
+    info.fOffset.set(width, height);
+    info.fPostTranslate = m_state.shadowsIgnoreTransforms;
+
+    SkMaskFilter* mf = SkBlurMaskFilter::Create(blur / 2, SkBlurMaskFilter::kNormal_BlurStyle, mfFlags);
+
+    SkColorFilter* cf = SkColorFilter::CreateModeFilter(c, SkXfermode::kSrcIn_Mode);
+
+    SkPaint* paint = dl->addLayer(info);
+    SkSafeUnref(paint->setMaskFilter(mf));
+    SkSafeUnref(paint->setColorFilter(cf));
+
+    // dl is now built, just install it
     platformContext()->setDrawLooper(dl);
-    dl->unref();
 }
 
 void GraphicsContext::setPlatformStrokeColor(const Color& strokecolor, ColorSpace colorSpace)
diff --git a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index b89c68d..2352672 100644
--- a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -66,19 +66,21 @@ ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, RenderingMode, bool& s
     : m_data(size)
     , m_size(size)
 {
-    if (!m_data.m_canvas.initialize(size.width(), size.height(), false)) {
+    SkCanvas* canvas = skia::CreateBitmapCanvas(size.width(), size.height(), false);
+    if (!canvas) {
         success = false;
         return;
     }
 
-    m_data.m_platformContext.setCanvas(&m_data.m_canvas);
+    m_data.m_canvas = canvas;
+    m_data.m_platformContext.setCanvas(m_data.m_canvas.get());
     m_context.set(new GraphicsContext(&m_data.m_platformContext));
     m_context->platformContext()->setDrawingToImageBuffer(true);
 
     // Make the background transparent. It would be nice if this wasn't
     // required, but the canvas is currently filled with the magic transparency
     // color. Can we have another way to manage this?
-    m_data.m_canvas.drawARGB(0, 0, 0, 0, SkXfermode::kClear_Mode);
+    m_data.m_canvas->drawARGB(0, 0, 0, 0, SkXfermode::kClear_Mode);
     success = true;
 }
 
@@ -117,6 +119,7 @@ void ImageBuffer::draw(GraphicsContext* context, ColorSpace styleColorSpace, con
 {
     if (m_data.m_platformContext.useGPU() && context->platformContext()->useGPU()) {
         if (context->platformContext()->canAccelerate()) {
+            m_data.m_platformContext.prepareForHardwareDraw();
             DrawingBuffer* sourceDrawingBuffer = m_data.m_platformContext.gpuCanvas()->drawingBuffer();
             unsigned sourceTexture = static_cast<unsigned>(sourceDrawingBuffer->platformColorBuffer());
             FloatRect destRectNormalized(normalizeRect(destRect));
@@ -344,6 +347,8 @@ void ImageBuffer::putPremultipliedImageData(ByteArray* source, const IntSize& so
 template <typename T>
 static String ImageToDataURL(T& source, const String& mimeType, const double* quality)
 {
+    ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
+
     Vector<unsigned char> encodedImage;
     if (mimeType == "image/jpeg") {
         int compressionQuality = JPEGImageEncoder::DefaultCompressionQuality;
@@ -365,9 +370,6 @@ static String ImageToDataURL(T& source, const String& mimeType, const double* qu
 
 String ImageBuffer::toDataURL(const String& mimeType, const double* quality) const
 {
-    ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
-
-    Vector<unsigned char> encodedImage;
     SkDevice* device = context()->platformContext()->canvas()->getDevice();
     SkBitmap bitmap = device->accessBitmap(false);
 
diff --git a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
index 72bec29..6987e00 100644
--- a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -66,6 +66,7 @@ enum ResamplingMode {
     RESAMPLE_AWESOME,
 };
 
+#if !ENABLE(SKIA_GPU)
 static ResamplingMode computeResamplingMode(PlatformContextSkia* platformContext, const NativeImageSkia& bitmap, int srcWidth, int srcHeight, float destWidth, float destHeight)
 {
     if (platformContext->hasImageResamplingHint()) {
@@ -150,6 +151,7 @@ static ResamplingMode computeResamplingMode(PlatformContextSkia* platformContext
     
     return RESAMPLE_LINEAR;
 }
+#endif
 
 // Draws the given bitmap to the given canvas. The subset of the source bitmap
 // identified by src_rect is drawn to the given destination rect. The bitmap
@@ -262,12 +264,17 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
     paint.setAlpha(platformContext->getNormalizedAlpha());
     paint.setLooper(platformContext->getDrawLooper());
 
-    skia::PlatformCanvas* canvas = platformContext->canvas();
+    SkCanvas* canvas = platformContext->canvas();
 
-    ResamplingMode resampling = platformContext->isPrinting() ? RESAMPLE_NONE :
+    ResamplingMode resampling;
+#if ENABLE(SKIA_GPU)
+    resampling = RESAMPLE_LINEAR;
+#else
+    resampling = platformContext->printing() ? RESAMPLE_NONE :
         computeResamplingMode(platformContext, bitmap, srcRect.width(), srcRect.height(),
                               SkScalarToFloat(destRect.width()),
                               SkScalarToFloat(destRect.height()));
+#endif
     if (resampling == RESAMPLE_AWESOME) {
         drawResampledBitmap(*canvas, paint, bitmap, srcRect, destRect);
     } else {
@@ -363,13 +370,17 @@ void Image::drawPattern(GraphicsContext* context,
 
     // Compute the resampling mode.
     ResamplingMode resampling;
-    if (context->platformContext()->isPrinting())
+#if ENABLE(SKIA_GPU)
+    resampling = RESAMPLE_LINEAR;
+#else
+    if (context->platformContext()->printing())
       resampling = RESAMPLE_LINEAR;
     else {
       resampling = computeResamplingMode(context->platformContext(), *bitmap,
                                          srcRect.width(), srcRect.height(),
                                          destBitmapWidth, destBitmapHeight);
     }
+#endif
 
     // Load the transform WebKit requested.
     SkMatrix matrix(patternTransform);
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index 8e1937f..4cc5457 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -213,8 +213,9 @@ SkColor PlatformContextSkia::State::applyAlpha(SkColor c) const
 // PlatformContextSkia ---------------------------------------------------------
 
 // Danger: canvas can be NULL.
-PlatformContextSkia::PlatformContextSkia(skia::PlatformCanvas* canvas)
+PlatformContextSkia::PlatformContextSkia(SkCanvas* canvas)
     : m_canvas(canvas)
+    , m_printing(false)
     , m_drawingToImageBuffer(false)
     , m_useGPU(false)
 #if ENABLE(ACCELERATED_2D_CANVAS)
@@ -232,15 +233,18 @@ PlatformContextSkia::~PlatformContextSkia()
     if (m_gpuCanvas) {
 #if ENABLE(SKIA_GPU)
         // make sure everything related to this platform context has been flushed
-        if (!m_useGPU)
-            m_gpuCanvas->context()->grContext()->flush(0);
+        if (!m_useGPU) {
+            SharedGraphicsContext3D* context = m_gpuCanvas->context();
+            context->makeContextCurrent();
+            context->grContext()->flush(0);
+        }
 #endif
         m_gpuCanvas->drawingBuffer()->setWillPublishCallback(0);
     }
 #endif
 }
 
-void PlatformContextSkia::setCanvas(skia::PlatformCanvas* canvas)
+void PlatformContextSkia::setCanvas(SkCanvas* canvas)
 {
     m_canvas = canvas;
 }
@@ -609,12 +613,12 @@ const SkBitmap* PlatformContextSkia::bitmap() const
     return &m_canvas->getDevice()->accessBitmap(false);
 }
 
-bool PlatformContextSkia::isPrinting()
+bool PlatformContextSkia::isNativeFontRenderingAllowed()
 {
 #if ENABLE(SKIA_GPU)
-    return true;
+    return false;
 #else
-    return m_canvas->getTopPlatformDevice().IsVectorial();
+    return skia::SupportsPlatformPaint(m_canvas);
 #endif
 }
 
@@ -738,7 +742,12 @@ void PlatformContextSkia::setSharedGraphicsContext3D(SharedGraphicsContext3D* co
         gr->resetContext();
         drawingBuffer->setGrContext(gr);
 
-        SkDeviceFactory* factory = new SkGpuDeviceFactory(gr, SkGpuDevice::Current3DApiRenderTarget());
+        GrPlatformSurfaceDesc drawBufDesc;
+        drawingBuffer->getGrPlatformSurfaceDesc(&drawBufDesc);
+        GrTexture* drawBufTex = static_cast<GrTexture*>(gr->createPlatformSurface(drawBufDesc));
+        SkDeviceFactory* factory = new SkGpuDeviceFactory(gr, drawBufTex);
+        drawBufTex->unref();
+
         SkDevice* device = factory->newDevice(m_canvas, SkBitmap::kARGB_8888_Config, drawingBuffer->size().width(), drawingBuffer->size().height(), false, false);
         m_canvas->setDevice(device)->unref();
         m_canvas->setDeviceFactory(factory);
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
index d7dd6a9..fc82221 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
@@ -72,12 +72,12 @@ class PlatformContextSkia {
 public:
     // For printing, there shouldn't be any canvas. canvas can be NULL. If you
     // supply a NULL canvas, you can also call setCanvas later.
-    PlatformContextSkia(skia::PlatformCanvas*);
+    PlatformContextSkia(SkCanvas*);
     ~PlatformContextSkia();
 
     // Sets the canvas associated with this context. Use when supplying NULL
     // to the constructor.
-    void setCanvas(skia::PlatformCanvas*);
+    void setCanvas(SkCanvas*);
 
     // If false we're rendering to a GraphicsContext for a web page, if false
     // we're not (as is the case when rendering to a canvas object).
@@ -146,7 +146,8 @@ public:
     // by the current alpha.
     SkColor effectiveStrokeColor() const;
 
-    skia::PlatformCanvas* canvas() { return m_canvas; }
+    // Returns the canvas used for painting, NOT guaranteed to be non-null.
+    SkCanvas* canvas() { return m_canvas; }
 
     InterpolationQuality interpolationQuality() const;
     void setInterpolationQuality(InterpolationQuality interpolationQuality);
@@ -159,17 +160,16 @@ public:
 
     const SkBitmap* bitmap() const;
 
-    // Returns the canvas used for painting, NOT guaranteed to be non-NULL.
-    //
-    // Warning: This function is deprecated so the users are reminded that they
-    // should use this layer of indirection instead of using the canvas
-    // directly. This is to help with the eventual serialization.
-    skia::PlatformCanvas* canvas() const;
-
     // Returns if the context is a printing context instead of a display
     // context. Bitmap shouldn't be resampled when printing to keep the best
     // possible quality.
-    bool isPrinting();
+    bool printing() const { return m_printing; }
+    void setPrinting(bool p) { m_printing = p; }
+
+    // Returns if the context allows rendering of fonts using native platform
+    // APIs. If false is returned font rendering is performed using the skia
+    // text drawing APIs.
+    bool isNativeFontRenderingAllowed();
 
     void getImageResamplingHint(IntSize* srcSize, FloatSize* dstSize) const;
     void setImageResamplingHint(const IntSize& srcSize, const FloatSize& dstSize);
@@ -186,10 +186,10 @@ public:
     GLES2Canvas* gpuCanvas() const { return 0; }
 #endif
     // Call these before making a call that manipulates the underlying
-    // skia::PlatformCanvas or WebCore::GLES2Canvas
+    // SkCanvas or WebCore::GLES2Canvas
     void prepareForSoftwareDraw() const;
     void prepareForHardwareDraw() const;
-    // Call to force the skia::PlatformCanvas to contain all rendering results.
+    // Call to force the SkCanvas to contain all rendering results.
     void syncSoftwareCanvas() const;
     void markDirtyRect(const IntRect& rect);
 
@@ -206,7 +206,7 @@ private:
     struct State;
 
     // NULL indicates painting is disabled. Never delete this object.
-    skia::PlatformCanvas* m_canvas;
+    SkCanvas* m_canvas;
 
     // States stack. Enables local drawing state change with save()/restore()
     // calls.
@@ -219,6 +219,7 @@ private:
     // Values are used in ImageSkia.cpp
     IntSize m_imageResamplingHintSrcSize;
     FloatSize m_imageResamplingHintDstSize;
+    bool m_printing;
     bool m_drawingToImageBuffer;
     bool m_useGPU;
 #if ENABLE(ACCELERATED_2D_CANVAS)
diff --git a/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp b/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
index b0cb0c7..8ab823e 100644
--- a/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
+++ b/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
@@ -39,16 +39,11 @@
 #include "SkPaint.h"
 #include "SkShader.h"
 #include "SkTemplates.h"
-#include "SkTypeface.h"
+#include "SkTypeface_win.h"
 
 #include <wtf/ListHashSet.h>
 #include <wtf/Vector.h>
 
-#if ENABLE(SKIA_TEXT)
-// FIXME: a future role of skia will have this in a proper header
-extern SkTypeface* SkCreateTypefaceFromLOGFONT(const LOGFONT&);
-#endif
-
 namespace WebCore {
 
 struct CachedOutlineKey {
@@ -235,11 +230,23 @@ bool windowsCanHandleDrawTextShadow(GraphicsContext *context)
     ColorSpace shadowColorSpace;
 
     bool hasShadow = context->getShadow(shadowOffset, shadowBlur, shadowColor, shadowColorSpace);
-    return (hasShadow && (shadowBlur == 0) && (shadowColor.alpha() == 255) && (context->fillColor().alpha() == 255));
+    return !hasShadow || (!shadowBlur && (shadowColor.alpha() == 255) && (context->fillColor().alpha() == 255));
 }
 
 bool windowsCanHandleTextDrawing(GraphicsContext* context)
 {
+    if (!windowsCanHandleTextDrawingWithoutShadow(context))
+        return false;
+
+    // Check for shadow effects.
+    if (!windowsCanHandleDrawTextShadow(context))
+        return false;
+
+    return true;
+}
+
+bool windowsCanHandleTextDrawingWithoutShadow(GraphicsContext* context)
+{
     // Check for non-translation transforms. Sometimes zooms will look better in
     // Skia, and sometimes better in Windows. The main problem is that zooming
     // in using Skia will show you the hinted outlines for the smaller size,
@@ -261,8 +268,7 @@ bool windowsCanHandleTextDrawing(GraphicsContext* context)
     if (context->fillPattern() || context->strokePattern())
         return false;
 
-    // Check for shadow effects.
-    if (context->platformContext()->getDrawLooper() && (!windowsCanHandleDrawTextShadow(context)))
+    if (!context->platformContext()->isNativeFontRenderingAllowed())
         return false;
 
     return true;
@@ -272,7 +278,7 @@ bool windowsCanHandleTextDrawing(GraphicsContext* context)
 // pattern may be NULL, in which case a solid colour is used.
 static bool skiaDrawText(HFONT hfont,
                          HDC dc,
-                         SkCanvas* canvas,
+                         PlatformContextSkia* platformContext,
                          const SkPoint& point,
                          SkPaint* paint,
                          const WORD* glyphs,
@@ -280,47 +286,47 @@ static bool skiaDrawText(HFONT hfont,
                          const GOFFSET* offsets,
                          int numGlyphs)
 {
-#if ENABLE(SKIA_TEXT)
-    SkASSERT(sizeof(WORD) == sizeof(uint16_t));
-
-    // Reserve space for 64 glyphs on the stack. If numGlyphs is larger, the array
-    // will dynamically allocate it space for numGlyph glyphs.
-    static const size_t kLocalGlyphMax = 64;
-    SkAutoSTArray<kLocalGlyphMax, SkPoint> posStorage(numGlyphs);
-    SkPoint* pos = posStorage.get();
-    SkScalar x = point.fX;
-    SkScalar y = point.fY;
-    for (int i = 0; i < numGlyphs; i++) {
-        pos[i].set(x + (offsets ? offsets[i].du : 0),
-                   y + (offsets ? offsets[i].dv : 0));
-        x += SkIntToScalar(advances[i]);
-    }
-    canvas->drawPosText(glyphs, numGlyphs * sizeof(uint16_t), pos, *paint);
-#else
-    float x = point.fX, y = point.fY;
-
-    for (int i = 0; i < numGlyphs; i++) {
-        const SkPath* path = SkiaWinOutlineCache::lookupOrCreatePathForGlyph(dc, hfont, glyphs[i]);
-        if (!path)
-            return false;
-
-        float offsetX = 0.0f, offsetY = 0.0f;
-        if (offsets && (offsets[i].du != 0 || offsets[i].dv != 0)) {
-            offsetX = offsets[i].du;
-            offsetY = offsets[i].dv;
+    SkCanvas* canvas = platformContext->canvas();
+    if (!platformContext->isNativeFontRenderingAllowed()) {
+        SkASSERT(sizeof(WORD) == sizeof(uint16_t));
+
+        // Reserve space for 64 glyphs on the stack. If numGlyphs is larger, the array
+        // will dynamically allocate it space for numGlyph glyphs.
+        static const size_t kLocalGlyphMax = 64;
+        SkAutoSTArray<kLocalGlyphMax, SkPoint> posStorage(numGlyphs);
+        SkPoint* pos = posStorage.get();
+        SkScalar x = point.fX;
+        SkScalar y = point.fY;
+        for (int i = 0; i < numGlyphs; i++) {
+            pos[i].set(x + (offsets ? offsets[i].du : 0),
+                       y + (offsets ? offsets[i].dv : 0));
+            x += SkIntToScalar(advances[i]);
         }
+        canvas->drawPosText(glyphs, numGlyphs * sizeof(uint16_t), pos, *paint);
+    } else {
+        float x = point.fX, y = point.fY;
+
+        for (int i = 0; i < numGlyphs; i++) {
+            const SkPath* path = SkiaWinOutlineCache::lookupOrCreatePathForGlyph(dc, hfont, glyphs[i]);
+            if (!path)
+                return false;
+
+            float offsetX = 0.0f, offsetY = 0.0f;
+            if (offsets && (offsets[i].du || offsets[i].dv)) {
+                offsetX = offsets[i].du;
+                offsetY = offsets[i].dv;
+            }
 
-        SkPath newPath;
-        newPath.addPath(*path, x + offsetX, y + offsetY);
-        canvas->drawPath(newPath, *paint);
+            SkPath newPath;
+            newPath.addPath(*path, x + offsetX, y + offsetY);
+            canvas->drawPath(newPath, *paint);
 
-        x += advances[i];
+            x += advances[i];
+        }
     }
-#endif
     return true;
 }
 
-#if ENABLE(SKIA_TEXT)
 static void setupPaintForFont(HFONT hfont, SkPaint* paint)
 {
     //  FIXME:
@@ -339,7 +345,6 @@ static void setupPaintForFont(HFONT hfont, SkPaint* paint)
     paint->setTypeface(face);
     SkSafeUnref(face);
 }
-#endif
 
 bool paintSkiaText(GraphicsContext* context,
                    HFONT hfont,
@@ -359,14 +364,14 @@ bool paintSkiaText(GraphicsContext* context,
     SkPaint paint;
     platformContext->setupPaintForFilling(&paint);
     paint.setFlags(SkPaint::kAntiAlias_Flag);
-#if ENABLE(SKIA_TEXT)
-    paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
-    setupPaintForFont(hfont, &paint);
-#endif
+    if (!platformContext->isNativeFontRenderingAllowed()) {
+        paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
+        setupPaintForFont(hfont, &paint);
+    }
     bool didFill = false;
 
-    if ((textMode & TextModeFill) && SkColorGetA(paint.getColor())) {
-        if (!skiaDrawText(hfont, dc, platformContext->canvas(), *origin, &paint,
+    if ((textMode & TextModeFill) && (SkColorGetA(paint.getColor()) || paint.getLooper())) {
+        if (!skiaDrawText(hfont, dc, platformContext, *origin, &paint,
                           &glyphs[0], &advances[0], &offsets[0], numGlyphs))
             return false;
         didFill = true;
@@ -380,10 +385,10 @@ bool paintSkiaText(GraphicsContext* context,
         paint.reset();
         platformContext->setupPaintForStroking(&paint, 0, 0);
         paint.setFlags(SkPaint::kAntiAlias_Flag);
-#if ENABLE(SKIA_TEXT)
-        paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
-        setupPaintForFont(hfont, &paint);
-#endif
+        if (!platformContext->isNativeFontRenderingAllowed()) {
+            paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
+            setupPaintForFont(hfont, &paint);
+        }
 
         if (didFill) {
             // If there is a shadow and we filled above, there will already be
@@ -398,7 +403,7 @@ bool paintSkiaText(GraphicsContext* context,
             paint.setLooper(0);
         }
 
-        if (!skiaDrawText(hfont, dc, platformContext->canvas(), *origin, &paint,
+        if (!skiaDrawText(hfont, dc, platformContext, *origin, &paint,
                           &glyphs[0], &advances[0], &offsets[0], numGlyphs))
             return false;
     }
diff --git a/Source/WebCore/platform/graphics/skia/SkiaFontWin.h b/Source/WebCore/platform/graphics/skia/SkiaFontWin.h
index 40bee62..33b4aaf 100644
--- a/Source/WebCore/platform/graphics/skia/SkiaFontWin.h
+++ b/Source/WebCore/platform/graphics/skia/SkiaFontWin.h
@@ -76,6 +76,10 @@ bool windowsCanHandleDrawTextShadow(GraphicsContext*);
 // Returns true if advanced font rendering is recommended.
 bool windowsCanHandleTextDrawing(GraphicsContext*);
 
+// Returns true if advanced font rendering is recommended if shadows are
+// disregarded.
+bool windowsCanHandleTextDrawingWithoutShadow(GraphicsContext*);
+
 // Note that the offsets parameter is optional.  If not NULL it represents a
 // per glyph offset (such as returned by ScriptPlace Windows API function).
 //
diff --git a/Source/WebCore/platform/graphics/transforms/AffineTransform.h b/Source/WebCore/platform/graphics/transforms/AffineTransform.h
index 14431aa..176c41e 100644
--- a/Source/WebCore/platform/graphics/transforms/AffineTransform.h
+++ b/Source/WebCore/platform/graphics/transforms/AffineTransform.h
@@ -32,9 +32,9 @@
 #include <string.h> // for memcpy
 #include <wtf/FastAllocBase.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGAffineTransform.h>
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 #include <cairo.h>
 #elif PLATFORM(OPENVG)
 #include "VGUtils.h"
@@ -157,9 +157,9 @@ public:
         return result;
     }
 
-#if PLATFORM(CG)
+#if USE(CG)
     operator CGAffineTransform() const;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
     operator cairo_matrix_t() const;
 #elif PLATFORM(OPENVG)
     operator VGMatrix() const;
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
index adda46b..ff668bb 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -31,12 +31,12 @@
 #include <string.h> //for memcpy
 #include <wtf/FastAllocBase.h>
 
-#if PLATFORM(CA)
+#if USE(CA)
 typedef struct CATransform3D CATransform3D;
 #endif
-#if PLATFORM(CG)
+#if USE(CG)
 typedef struct CGAffineTransform CGAffineTransform;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 #include <cairo.h>
 #elif PLATFORM(OPENVG)
 #include "VGUtils.h"
@@ -308,14 +308,14 @@ public:
         return result;
     }
 
-#if PLATFORM(CA)
+#if USE(CA)
     TransformationMatrix(const CATransform3D&);
     operator CATransform3D() const;
 #endif
-#if PLATFORM(CG)
+#if USE(CG)
     TransformationMatrix(const CGAffineTransform&);
     operator CGAffineTransform() const;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
     operator cairo_matrix_t() const;
 #elif PLATFORM(OPENVG)
     operator VGMatrix() const;
diff --git a/Source/WebCore/platform/graphics/win/DIBPixelData.cpp b/Source/WebCore/platform/graphics/win/DIBPixelData.cpp
new file mode 100644
index 0000000..e45ba06
--- /dev/null
+++ b/Source/WebCore/platform/graphics/win/DIBPixelData.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2011 Brent Fulgham <bfulgham@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DIBPixelData.h"
+
+namespace WebCore {
+
+static const WORD bitmapType = 0x4d42; // BMP format
+static const WORD bitmapPixelsPerMeter = 2834; // 72 dpi
+
+DIBPixelData::DIBPixelData(HBITMAP bitmap)
+{
+    initialize(bitmap);
+}
+
+void DIBPixelData::initialize(HBITMAP bitmap)
+{
+    BITMAP bmpInfo;
+    GetObject(bitmap, sizeof(bmpInfo), &bmpInfo);
+
+    m_bitmapBuffer = reinterpret_cast<UInt8*>(bmpInfo.bmBits);
+    m_bitmapBufferLength = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+    m_size = IntSize(bmpInfo.bmWidth, bmpInfo.bmHeight);
+    m_bytesPerRow = bmpInfo.bmWidthBytes;
+    m_bitsPerPixel = bmpInfo.bmBitsPixel;
+}
+
+#ifndef NDEBUG
+void DIBPixelData::writeToFile(LPCWSTR filePath)
+{
+    HANDLE hFile = ::CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
+    if (INVALID_HANDLE_VALUE == hFile)
+        return;
+
+    BITMAPFILEHEADER header;
+    header.bfType = bitmapType;
+    header.bfOffBits = sizeof(BITMAPFILEHEADER) + sizeof(BITMAPINFOHEADER);
+    header.bfReserved1 = 0;
+    header.bfReserved2 = 0;
+    header.bfSize = sizeof(BITMAPFILEHEADER);
+
+    BITMAPINFOHEADER info;
+    info.biSize = sizeof(BITMAPINFOHEADER);
+    info.biWidth = m_size.width();
+    info.biHeight = m_size.height();
+    info.biPlanes = 1;
+    info.biBitCount = m_bitsPerPixel;
+    info.biCompression = BI_RGB;
+    info.biSizeImage = bufferLength();
+    info.biXPelsPerMeter = bitmapPixelsPerMeter;
+    info.biYPelsPerMeter = bitmapPixelsPerMeter;
+    info.biClrUsed = 0;
+    info.biClrImportant = 0;
+
+    DWORD bytesWritten = 0;
+    ::WriteFile(hFile, &header, sizeof(header), &bytesWritten, 0);
+    ::WriteFile(hFile, &info, sizeof(info), &bytesWritten, 0);
+    ::WriteFile(hFile, buffer(), bufferLength(), &bytesWritten, 0);
+
+    ::CloseHandle(hFile);
+}
+#endif
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/win/DIBPixelData.h b/Source/WebCore/platform/graphics/win/DIBPixelData.h
new file mode 100644
index 0000000..40afa2b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/win/DIBPixelData.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Brent Fulgham <bfulgham@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DIBPixelData_h
+#define DIBPixelData_h
+
+#include "IntSize.h"
+#include <windows.h>
+
+#if !USE(CG)
+// UInt8 is defined in CoreFoundation/CFBase.h
+typedef unsigned char UInt8;
+#endif
+
+namespace WebCore {
+
+class DIBPixelData {
+    public:
+        DIBPixelData()
+            : m_bitmapBuffer(0)
+            , m_bitmapBufferLength(0)
+            , m_bytesPerRow(0)
+            , m_bitsPerPixel(0)
+        {
+        }
+        DIBPixelData(HBITMAP);
+
+        void initialize(HBITMAP);
+
+#ifndef NDEBUG
+        void writeToFile(LPCWSTR);
+#endif
+
+        UInt8* buffer() const { return m_bitmapBuffer; }
+        unsigned bufferLength() const { return m_bitmapBufferLength; }
+        const IntSize& size() const { return m_size; }
+        unsigned bytesPerRow() const { return m_bytesPerRow; }
+        unsigned short bitsPerPixel() const { return m_bitsPerPixel; }
+
+    private:
+        UInt8* m_bitmapBuffer;
+        unsigned m_bitmapBufferLength;
+        IntSize m_size;
+        unsigned m_bytesPerRow;
+        unsigned short m_bitsPerPixel;
+};
+
+} // namespace WebCore
+
+#endif // DIBPixelData_h
diff --git a/Source/WebCore/platform/graphics/win/FontCacheWin.cpp b/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
index 5382ef7..46f6f11 100644
--- a/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
@@ -36,7 +36,7 @@
 #include <windows.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringHash.h>
-#if PLATFORM(CG)
+#if USE(CG)
 #include <ApplicationServices/ApplicationServices.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #endif
@@ -48,7 +48,7 @@ namespace WebCore
 
 void FontCache::platformInit()
 {
-#if PLATFORM(CG)
+#if USE(CG)
     wkSetUpFontCache(1536 * 1024 * 4); // This size matches Mac.
 #endif
 }
@@ -471,7 +471,7 @@ static HFONT createGDIFont(const AtomicString& family, LONG desiredWeight, bool
     matchData.m_chosen.lfUnderline = false;
     matchData.m_chosen.lfStrikeOut = false;
     matchData.m_chosen.lfCharSet = DEFAULT_CHARSET;
-#if PLATFORM(CG) || PLATFORM(CAIRO)
+#if USE(CG) || USE(CAIRO)
     matchData.m_chosen.lfOutPrecision = OUT_TT_ONLY_PRECIS;
 #else
     matchData.m_chosen.lfOutPrecision = OUT_TT_PRECIS;
@@ -581,9 +581,9 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
 
     FontPlatformData* result = new FontPlatformData(hfont, fontDescription.computedPixelSize(), synthesizeBold, synthesizeItalic, useGDI);
 
-#if PLATFORM(CG)
+#if USE(CG)
     bool fontCreationFailed = !result->cgFont();
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
     bool fontCreationFailed = !result->scaledFont();
 #endif
 
diff --git a/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp b/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
index 301198d..d0b37bd 100644
--- a/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
@@ -41,9 +41,9 @@ FontPlatformData::FontPlatformData(HFONT font, float size, bool bold, bool obliq
     , m_orientation(Horizontal)
     , m_textOrientation(TextOrientationVerticalRight)
     , m_widthVariant(RegularWidth)
-#if PLATFORM(CG)
+#if USE(CG)
     , m_cgFont(0)
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
     , m_scaledFont(0)
 #endif
     , m_isColorBitmapFont(false)
diff --git a/Source/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp b/Source/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
index d0bd4e9..cb0c9a7 100644
--- a/Source/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
+++ b/Source/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
@@ -40,25 +40,24 @@ namespace WebCore {
 static CGContextRef CGContextWithHDC(HDC hdc, bool hasAlpha)
 {
     HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
-    BITMAP info;
 
-    GetObject(bitmap, sizeof(info), &info);
+    DIBPixelData pixelData(bitmap);
 
     // FIXME: We can get here because we asked for a bitmap that is too big
     // when we have a tiled layer and we're compositing. In that case 
     // bmBitsPixel will be 0. This seems to be benign, so for now we will
     // exit gracefully and look at it later:
     //  https://bugs.webkit.org/show_bug.cgi?id=52041   
-    // ASSERT(info.bmBitsPixel == 32);
-    if (info.bmBitsPixel != 32)
+    // ASSERT(bitmapBits.bitsPerPixel() == 32);
+    if (pixelData.bitsPerPixel() != 32)
         return 0;
 
     CGBitmapInfo bitmapInfo = kCGBitmapByteOrder32Little | (hasAlpha ? kCGImageAlphaPremultipliedFirst : kCGImageAlphaNoneSkipFirst);
-    CGContextRef context = CGBitmapContextCreate(info.bmBits, info.bmWidth, info.bmHeight, 8,
-                                                 info.bmWidthBytes, deviceRGBColorSpaceRef(), bitmapInfo);
+    CGContextRef context = CGBitmapContextCreate(pixelData.buffer(), pixelData.size().width(), pixelData.size().height(), 8,
+                                                 pixelData.bytesPerRow(), deviceRGBColorSpaceRef(), bitmapInfo);
 
     // Flip coords
-    CGContextTranslateCTM(context, 0, info.bmHeight);
+    CGContextTranslateCTM(context, 0, pixelData.size().height());
     CGContextScaleCTM(context, 1, -1);
     
     // Put the HDC In advanced mode so it will honor affine transforms.
@@ -99,16 +98,14 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     if (dstRect.isEmpty())
         return;
 
-    HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+    OwnPtr<HBITMAP> bitmap = adoptPtr(static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP)));
+
+    DIBPixelData pixelData(bitmap.get());
 
-    // Need to make a CGImage out of the bitmap's pixel buffer and then draw
-    // it into our context.
-    BITMAP info;
-    GetObject(bitmap, sizeof(info), &info);
-    ASSERT(info.bmBitsPixel == 32);
+    ASSERT(pixelData.bitsPerPixel() == 32);
 
-    CGContextRef bitmapContext = CGBitmapContextCreate(info.bmBits, info.bmWidth, info.bmHeight, 8,
-                                                       info.bmWidthBytes, deviceRGBColorSpaceRef(), kCGBitmapByteOrder32Little |
+    CGContextRef bitmapContext = CGBitmapContextCreate(pixelData.buffer(), pixelData.size().width(), pixelData.size().height(), 8,
+                                                       pixelData.bytesPerRow(), deviceRGBColorSpaceRef(), kCGBitmapByteOrder32Little |
                                                        (supportAlphaBlend ? kCGImageAlphaPremultipliedFirst : kCGImageAlphaNoneSkipFirst));
 
     CGImageRef image = CGBitmapContextCreateImage(bitmapContext);
@@ -118,7 +115,6 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     CGImageRelease(image);
     CGContextRelease(bitmapContext);
     ::DeleteDC(hdc);
-    ::DeleteObject(bitmap);
 }
 
 void GraphicsContext::drawWindowsBitmap(WindowsBitmap* image, const IntPoint& point)
diff --git a/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
index 7ce7ee9..9f7aece 100644
--- a/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -78,7 +78,7 @@ void GraphicsContext::platformInit(HDC dc, bool hasAlpha)
     else
         setPaintingDisabled(true);
 
-    m_data = new GraphicsContextPlatformPrivateTopLevel(new PlatformContextCairo(cr));
+    m_data = new GraphicsContextPlatformPrivateToplevel(new PlatformContextCairo(cr));
     m_data->m_hdc = dc;
     if (platformContext()->cr()) {
         // Make sure the context starts in sync with our state.
@@ -93,6 +93,33 @@ static void setRGBABitmapAlpha(unsigned char* bytes, size_t length, unsigned cha
         bytes[i + 3] = level;
 }
 
+static void drawBitmapToContext(GraphicsContextPlatformPrivate* context, cairo_t* cr, const DIBPixelData& pixelData, const IntSize& translate)
+{
+    // Need to make a cairo_surface_t out of the bitmap's pixel buffer and then draw
+    // it into our context.
+    cairo_surface_t* surface = cairo_image_surface_create_for_data(pixelData.buffer(),
+                                                                   CAIRO_FORMAT_ARGB32,
+                                                                   pixelData.size().width(),
+                                                                   pixelData.size().height(),
+                                                                   pixelData.bytesPerRow());
+
+    // Flip the target surface so that when we set the srcImage as
+    // the surface it will draw right-side-up.
+    cairo_save(cr);
+    cairo_translate(cr, static_cast<double>(translate.width()), static_cast<double>(translate.height()));
+    cairo_scale(cr, 1, -1);
+    cairo_set_source_surface(cr, surface, 0, 0);
+
+    if (context->layers.size())
+        cairo_paint_with_alpha(cr, context->layers.last());
+    else
+        cairo_paint(cr);
+     
+    // Delete all our junk.
+    cairo_surface_destroy(surface);
+    cairo_restore(cr);
+}
+
 void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
 {
     bool createdBitmap = mayCreateBitmap && (!m_data->m_hdc || inTransparencyLayer());
@@ -104,46 +131,26 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     if (dstRect.isEmpty())
         return;
 
-    HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+    OwnPtr<HBITMAP> bitmap = adoptPtr(static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP)));
 
-    BITMAP info;
-    GetObject(bitmap, sizeof(info), &info);
-    ASSERT(info.bmBitsPixel == 32);
+    DIBPixelData pixelData(bitmap.get());
+    ASSERT(pixelData.bitsPerPixel() == 32);
 
     // If this context does not support alpha blending, then it may have
     // been drawn with GDI functions which always set the alpha channel
     // to zero. We need to manually set the bitmap to be fully opaque.
-    unsigned char* bytes = reinterpret_cast<unsigned char*>(info.bmBits);
+    unsigned char* bytes = reinterpret_cast<unsigned char*>(pixelData.buffer());
     if (!supportAlphaBlend)
-        setRGBABitmapAlpha(bytes, info.bmHeight * info.bmWidthBytes, 255);
+        setRGBABitmapAlpha(bytes, pixelData.size().height() * pixelData.bytesPerRow(), 255);
 
-    // Need to make a cairo_surface_t out of the bitmap's pixel buffer and then draw
-    // it into our context.
-    cairo_surface_t* image = cairo_image_surface_create_for_data(bytes,
-                                            CAIRO_FORMAT_ARGB32,
-                                            info.bmWidth,
-                                            info.bmHeight,
-                                            info.bmWidthBytes);
-
-    // Scale the target surface to the new image size, and flip it
-    // so that when we set the srcImage as the surface it will draw
-    // right-side-up.
-    cairo_t* cr = platformContext()->cr();
-    cairo_save(cr);
-    cairo_translate(cr, dstRect.x(), dstRect.height() + dstRect.y());
-    cairo_scale(cr, 1, -1);
-    cairo_set_source_surface(cr, image, 0, 0);
+    drawBitmapToContext(m_data, platformContext()->cr(), pixelData, IntSize(dstRect.x(), dstRect.height() + dstRect.y()));
 
-    if (m_data->layers.size())
-        cairo_paint_with_alpha(cr, m_data->layers.last());
-    else
-        cairo_paint(cr);
-     
-    // Delete all our junk.
-    cairo_surface_destroy(image);
     ::DeleteDC(hdc);
-    ::DeleteObject(bitmap);
-    cairo_restore(cr);
+}
+
+void GraphicsContext::drawWindowsBitmap(WindowsBitmap* bitmap, const IntPoint& point)
+{
+    drawBitmapToContext(m_data, platformContext()->cr(), bitmap->windowsDIB(), IntSize(point.x(), bitmap->size().height() + point.y()));
 }
 
 void GraphicsContextPlatformPrivate::syncContext(cairo_t* cr)
diff --git a/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp b/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
index f2850e4..28ce55a 100644
--- a/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
+++ b/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
@@ -26,9 +26,9 @@
 #include "config.h"
 #include "GraphicsContext.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include "GraphicsContextPlatformPrivateCG.h"
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 #include "GraphicsContextPlatformPrivateCairo.h"
 #endif
 
@@ -65,21 +65,20 @@ bool GraphicsContext::shouldIncludeChildWindows() const
 
 GraphicsContext::WindowsBitmap::WindowsBitmap(HDC hdc, IntSize size)
     : m_hdc(0)
-    , m_size(size)
 {
-    BitmapInfo bitmapInfo = BitmapInfo::create(m_size);
+    BitmapInfo bitmapInfo = BitmapInfo::create(size);
 
-    m_bitmap = CreateDIBSection(0, &bitmapInfo, DIB_RGB_COLORS, reinterpret_cast<void**>(&m_bitmapBuffer), 0, 0);
+    void* storage = 0;
+    m_bitmap = CreateDIBSection(0, &bitmapInfo, DIB_RGB_COLORS, &storage, 0, 0);
     if (!m_bitmap)
         return;
 
     m_hdc = CreateCompatibleDC(hdc);
     SelectObject(m_hdc, m_bitmap);
 
-    BITMAP bmpInfo;
-    GetObject(m_bitmap, sizeof(bmpInfo), &bmpInfo);
-    m_bytesPerRow = bmpInfo.bmWidthBytes;
-    m_bitmapBufferLength = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+    m_pixelData.initialize(m_bitmap);
+
+    ASSERT(storage == m_pixelData.buffer());
 
     SetGraphicsMode(m_hdc, GM_ADVANCED);
 }
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
index dd3cd32..588146a 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
@@ -30,7 +30,7 @@
 #include "WebCoreInstanceHandle.h"
 #include <windows.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGColor.h>
 #endif
 
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
index 323ff73..db730ca 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp
@@ -39,7 +39,7 @@
 #include <winsock2.h>
 #include <wtf/MathExtras.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <ApplicationServices/ApplicationServices.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #endif
diff --git a/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp b/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
index 19683df..e501621 100644
--- a/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
@@ -1300,7 +1300,7 @@ void GraphicsContext::drawRoundCorner(bool needsNewClip, RECT clipRect, RECT rec
 }
 
 
-FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect, RoundingMode)
 {
     notImplemented();
     return frect;
diff --git a/Source/WebCore/platform/graphics/wince/ImageBufferData.h b/Source/WebCore/platform/graphics/wince/ImageBufferDataWince.h
index cbd49dc..dd46d38 100644
--- a/Source/WebCore/platform/graphics/wince/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/wince/ImageBufferDataWince.h
@@ -17,9 +17,6 @@
  *  Boston, MA 02110-1301, USA.
  */
 
-#ifndef ImageBufferData_h
-#define ImageBufferData_h
-
 #include "SharedBitmap.h"
 
 namespace WebCore {
@@ -33,5 +30,3 @@ public:
 };
 
 } // namespace WebCore
-
-#endif // ImageBufferData_h
diff --git a/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp b/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
index 830cd05..3d98aeb 100644
--- a/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
@@ -99,12 +99,14 @@ FontPlatformData::FontPlatformData(const FontDescription& desc, const AtomicStri
                             )
                         )); 
 #endif
-#if OS(DARWIN) && !defined(wxOSX_USE_CORE_TEXT)
+#if OS(DARWIN)
+#if !wxOSX_USE_CORE_TEXT
 #if wxCHECK_VERSION(2,9,0)
     m_atsuFontID = m_font->font()->OSXGetATSUFontID();
 #else
     m_atsuFontID = m_font->font()->MacGetATSUFontID();
 #endif
+#endif
     m_nsFont = 0;
     cacheNSFont();
 #endif
diff --git a/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index 47f3211..071df47 100644
--- a/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -416,7 +416,7 @@ void GraphicsContext::scale(const FloatSize& scale)
 }
 
 
-FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect, RoundingMode)
 {
     FloatRect result;
 
diff --git a/Source/WebCore/platform/graphics/wx/ImageBufferData.h b/Source/WebCore/platform/graphics/wx/ImageBufferDataWx.h
index d4a6114..9961fee 100644
--- a/Source/WebCore/platform/graphics/wx/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/wx/ImageBufferDataWx.h
@@ -23,10 +23,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ImageBufferData_h
-#define ImageBufferData_h
-
-
 #include "OwnPtr.h"
 
 namespace WebCore {
@@ -38,6 +34,4 @@ public:
     ImageBufferData(const IntSize&);
 };
 
-}  // namespace WebCore
-
-#endif  // ImageBufferData_h
+} // namespace WebCore
diff --git a/Source/WebCore/platform/gtk/GtkVersioning.c b/Source/WebCore/platform/gtk/GtkVersioning.c
index c3407ea..1138d56 100644
--- a/Source/WebCore/platform/gtk/GtkVersioning.c
+++ b/Source/WebCore/platform/gtk/GtkVersioning.c
@@ -271,3 +271,13 @@ gboolean g_signal_accumulator_first_wins(GSignalInvocationHint *invocationHint,
 }
 #endif
 
+#if !GTK_CHECK_VERSION(2, 22, 0)
+cairo_surface_t *gdk_window_create_similar_surface(GdkWindow *window, cairo_content_t content, int width, int height)
+{
+    cairo_t *cairoContext = gdk_cairo_create(window);
+    cairo_surface_t *cairoSurface = cairo_get_target(cairoContext);
+    cairo_surface_t *newSurface = cairo_surface_create_similar(cairoSurface, content, width, height);
+    cairo_destroy(cairoContext);
+    return newSurface;
+}
+#endif // GTK_CHECK_VERSION(2, 22, 0)
diff --git a/Source/WebCore/platform/gtk/GtkVersioning.h b/Source/WebCore/platform/gtk/GtkVersioning.h
index 70e1bbe..b44fc38 100644
--- a/Source/WebCore/platform/gtk/GtkVersioning.h
+++ b/Source/WebCore/platform/gtk/GtkVersioning.h
@@ -46,6 +46,10 @@ GdkPixbuf* gdk_pixbuf_get_from_surface(cairo_surface_t* surface, int srcX, int s
 #define gdk_window_get_visual gdk_drawable_get_visual
 #endif // GTK_CHECK_VERSION(2, 23, 0)
 
+#if !GTK_CHECK_VERSION(2, 22, 0)
+cairo_surface_t* gdk_window_create_similar_surface(GdkWindow* window, cairo_content_t content, int width, int height);
+#endif // GTK_CHECK_VERSION(2, 22, 0)
+
 #if !GTK_CHECK_VERSION(2, 21, 2)
 #define gdk_visual_get_depth(visual) (visual)->depth
 #define gdk_visual_get_bits_per_rgb(visual) (visual)->bits_per_rgb
diff --git a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index 02f6c47..13c46fc 100644
--- a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -642,4 +642,9 @@ String validationMessageStepMismatchText(const String&, const String&)
     return String::fromUTF8(_("step mismatch"));
 }
 
+String localizedString(const char* key)
+{
+    return String::fromUTF8(key, strlen(key));
+}
+
 }
diff --git a/Source/WebCore/platform/gtk/KeyEventGtk.cpp b/Source/WebCore/platform/gtk/PlatformKeyboardEventGtk.cpp
index d010b37..d010b37 100644
--- a/Source/WebCore/platform/gtk/KeyEventGtk.cpp
+++ b/Source/WebCore/platform/gtk/PlatformKeyboardEventGtk.cpp
diff --git a/Source/WebCore/platform/gtk/MouseEventGtk.cpp b/Source/WebCore/platform/gtk/PlatformMouseEventGtk.cpp
index 69f938f..69f938f 100644
--- a/Source/WebCore/platform/gtk/MouseEventGtk.cpp
+++ b/Source/WebCore/platform/gtk/PlatformMouseEventGtk.cpp
diff --git a/Source/WebCore/platform/gtk/WheelEventGtk.cpp b/Source/WebCore/platform/gtk/PlatformWheelEventGtk.cpp
index fc6206f..fc6206f 100644
--- a/Source/WebCore/platform/gtk/WheelEventGtk.cpp
+++ b/Source/WebCore/platform/gtk/PlatformWheelEventGtk.cpp
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.h b/Source/WebCore/platform/gtk/RenderThemeGtk.h
index 191a34b..09eb1df 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.h
@@ -147,6 +147,7 @@ protected:
     void initMediaColors();
     void initMediaButtons();
     void adjustMediaSliderThumbSize(RenderObject*) const;
+    virtual bool hasOwnDisabledStateHandlingFor(ControlPart) const { return true; }
     virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
index 527de1a..6e2c94c 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
@@ -34,6 +34,7 @@
 #include "MediaControlElements.h"
 #include "Page.h"
 #include "PaintInfo.h"
+#include "PlatformContextCairo.h"
 #include "RenderObject.h"
 #include "TextDirection.h"
 #include "UserAgentStyleSheets.h"
@@ -216,16 +217,16 @@ static void paintToggle(const RenderThemeGtk* theme, GType widgetType, RenderObj
     gtk_style_context_set_state(context, static_cast<GtkStateFlags>(flags));
 
     if (widgetType == GTK_TYPE_CHECK_BUTTON)
-        gtk_render_check(context, paintInfo.context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
+        gtk_render_check(context, paintInfo.context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height());
     else
-        gtk_render_option(context, paintInfo.context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
+        gtk_render_option(context, paintInfo.context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height());
 
     if (theme->isFocused(renderObject)) {
         IntRect indicatorRect(rect);
         gint indicatorSpacing;
         gtk_style_context_get_style(context, "indicator-spacing", &indicatorSpacing, NULL);
         indicatorRect.inflate(indicatorSpacing);
-        gtk_render_focus(context, paintInfo.context->platformContext(), indicatorRect.x(), indicatorRect.y(),
+        gtk_render_focus(context, paintInfo.context->platformContext()->cr(), indicatorRect.x(), indicatorRect.y(),
                          indicatorRect.width(), indicatorRect.height());
     }
 
@@ -284,8 +285,8 @@ static void renderButton(RenderTheme* theme, GtkStyleContext* context, RenderObj
         gtk_style_context_add_class(context, GTK_STYLE_CLASS_DEFAULT);
     }
 
-    gtk_render_background(context, paintInfo.context->platformContext(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
-    gtk_render_frame(context, paintInfo.context->platformContext(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
+    gtk_render_background(context, paintInfo.context->platformContext()->cr(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
+    gtk_render_frame(context, paintInfo.context->platformContext()->cr(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
 
     if (theme->isFocused(renderObject)) {
         gint focusWidth, focusPad;
@@ -317,7 +318,7 @@ static void renderButton(RenderTheme* theme, GtkStyleContext* context, RenderObj
             buttonRect.move(childDisplacementX, childDisplacementY);
         }
 
-        gtk_render_focus(context, paintInfo.context->platformContext(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
+        gtk_render_focus(context, paintInfo.context->platformContext()->cr(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
     }
 }
 bool RenderThemeGtk::paintButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
@@ -423,7 +424,7 @@ int RenderThemeGtk::popupInternalPaddingBottom(RenderStyle* style) const
 
 bool RenderThemeGtk::paintMenuList(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
 {
-    cairo_t* cairoContext = paintInfo.context->platformContext();
+    cairo_t* cairoContext = paintInfo.context->platformContext()->cr();
     GtkTextDirection direction = static_cast<GtkTextDirection>(gtkTextDirection(renderObject->style()->direction()));
 
     // Paint the button.
@@ -568,8 +569,8 @@ bool RenderThemeGtk::paintTextField(RenderObject* renderObject, const PaintInfo&
         flags |= GTK_STATE_FLAG_FOCUSED;
     gtk_style_context_set_state(context, static_cast<GtkStateFlags>(flags));
 
-    gtk_render_background(context, paintInfo.context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
-    gtk_render_frame(context, paintInfo.context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
+    gtk_render_background(context, paintInfo.context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height());
+    gtk_render_frame(context, paintInfo.context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height());
 
     if (isFocused(renderObject) && isEnabled(renderObject)) {
         gboolean interiorFocus;
@@ -582,7 +583,7 @@ bool RenderThemeGtk::paintTextField(RenderObject* renderObject, const PaintInfo&
         if (!interiorFocus) {
             IntRect focusRect(rect);
             focusRect.inflate(focusWidth + focusPad);
-            gtk_render_focus(context, paintInfo.context->platformContext(),
+            gtk_render_focus(context, paintInfo.context->platformContext()->cr(),
                              focusRect.x(), focusRect.y(), focusRect.width(), focusRect.height());
         }
     }
@@ -607,9 +608,9 @@ bool RenderThemeGtk::paintSliderTrack(RenderObject* renderObject, const PaintInf
     if (!isEnabled(renderObject) || isReadOnlyControl(renderObject))
         gtk_style_context_set_state(context, GTK_STATE_FLAG_INSENSITIVE);
 
-    gtk_render_background(context, paintInfo.context->platformContext(),
+    gtk_render_background(context, paintInfo.context->platformContext()->cr(),
                           rect.x(), rect.y(), rect.width(), rect.height());
-    gtk_render_frame(context, paintInfo.context->platformContext(),
+    gtk_render_frame(context, paintInfo.context->platformContext()->cr(),
                      rect.x(), rect.y(), rect.width(), rect.height());
 
     if (isFocused(renderObject)) {
@@ -619,7 +620,7 @@ bool RenderThemeGtk::paintSliderTrack(RenderObject* renderObject, const PaintInf
                                     "focus-padding", &focusPad, NULL);
         IntRect focusRect(rect);
         focusRect.inflate(focusWidth + focusPad);
-        gtk_render_focus(context, paintInfo.context->platformContext(),
+        gtk_render_focus(context, paintInfo.context->platformContext()->cr(),
                          focusRect.x(), focusRect.y(), focusRect.width(), focusRect.height());
     }
 
@@ -654,7 +655,7 @@ bool RenderThemeGtk::paintSliderThumb(RenderObject* renderObject, const PaintInf
         flags |= GTK_STATE_FLAG_ACTIVE;
     gtk_style_context_set_state(context, static_cast<GtkStateFlags>(flags));
 
-    gtk_render_slider(context, paintInfo.context->platformContext(), sliderRect.x(), sliderRect.y(), sliderRect.width(), sliderRect.height(),
+    gtk_render_slider(context, paintInfo.context->platformContext()->cr(), sliderRect.x(), sliderRect.y(), sliderRect.width(), sliderRect.height(),
                       part == SliderThumbHorizontalPart ? GTK_ORIENTATION_HORIZONTAL : GTK_ORIENTATION_VERTICAL);
 
     gtk_style_context_restore(context);
@@ -698,8 +699,8 @@ bool RenderThemeGtk::paintProgressBar(RenderObject* renderObject, const PaintInf
 
     gtk_style_context_add_class(context, GTK_STYLE_CLASS_TROUGH);
 
-    gtk_render_background(context, paintInfo.context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
-    gtk_render_frame(context, paintInfo.context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
+    gtk_render_background(context, paintInfo.context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height());
+    gtk_render_frame(context, paintInfo.context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height());
 
     gtk_style_context_restore(context);
 
@@ -715,7 +716,7 @@ bool RenderThemeGtk::paintProgressBar(RenderObject* renderObject, const PaintInf
     progressRect = RenderThemeGtk::calculateProgressRect(renderObject, progressRect);
 
     if (!progressRect.isEmpty())
-        gtk_render_activity(context, paintInfo.context->platformContext(), progressRect.x(), progressRect.y(), progressRect.width(), progressRect.height());
+        gtk_render_activity(context, paintInfo.context->platformContext()->cr(), progressRect.x(), progressRect.y(), progressRect.width(), progressRect.height());
 
     gtk_style_context_restore(context);
     return false;
@@ -777,8 +778,8 @@ static void paintSpinArrowButton(RenderTheme* theme, GtkStyleContext* context, R
     buttonRect.setHeight(rect.height() / 2);
     gtk_style_context_set_junction_sides(context, static_cast<GtkJunctionSides>(junction));
 
-    gtk_render_background(context, paintInfo.context->platformContext(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
-    gtk_render_frame(context, paintInfo.context->platformContext(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
+    gtk_render_background(context, paintInfo.context->platformContext()->cr(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
+    gtk_render_frame(context, paintInfo.context->platformContext()->cr(), buttonRect.x(), buttonRect.y(), buttonRect.width(), buttonRect.height());
 
     // Paint arrow centered inside button.
     // This code is based on gtkspinbutton.c code.
@@ -804,7 +805,7 @@ static void paintSpinArrowButton(RenderTheme* theme, GtkStyleContext* context, R
     gint height = (width + 1) / 2;
 
     arrowRect.move((arrowRect.width() - width) / 2, (arrowRect.height() - height) / 2);
-    gtk_render_arrow(context, paintInfo.context->platformContext(), angle, arrowRect.x(), arrowRect.y(), width);
+    gtk_render_arrow(context, paintInfo.context->platformContext()->cr(), angle, arrowRect.x(), arrowRect.y(), width);
 
     gtk_style_context_restore(context);
 }
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
index b0b5146..f854037 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
@@ -28,6 +28,7 @@
 
 #ifndef GTK_API_VERSION_2
 
+#include "PlatformContextCairo.h"
 #include "PlatformMouseEvent.h"
 #include "RenderThemeGtk.h"
 #include "ScrollView.h"
@@ -77,9 +78,9 @@ void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar
     gtk_style_context_add_class(m_context, GTK_STYLE_CLASS_SCROLLBAR);
     gtk_style_context_add_class(m_context, GTK_STYLE_CLASS_TROUGH);
 
-    gtk_render_background(m_context, context->platformContext(),
+    gtk_render_background(m_context, context->platformContext()->cr(),
                           fullScrollbarRect.x(), fullScrollbarRect.y(), fullScrollbarRect.width(), fullScrollbarRect.height());
-    gtk_render_frame(m_context, context->platformContext(),
+    gtk_render_frame(m_context, context->platformContext()->cr(),
                      fullScrollbarRect.x(), fullScrollbarRect.y(), fullScrollbarRect.width(), fullScrollbarRect.height());
 
     gtk_style_context_restore(m_context);
@@ -91,7 +92,7 @@ void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrol
 
     gtk_style_context_add_class(m_context, GTK_STYLE_CLASS_SCROLLBAR);
     gtk_style_context_add_class(m_context, "scrolled-window");
-    gtk_render_frame(m_context, context->platformContext(), scrollbar->x(), scrollbar->y(), scrollbar->width(), scrollbar->height());
+    gtk_render_frame(m_context, context->platformContext()->cr(), scrollbar->x(), scrollbar->y(), scrollbar->width(), scrollbar->height());
 
     gtk_style_context_restore(m_context);
 }
@@ -110,7 +111,7 @@ void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollba
         flags |= GTK_STATE_FLAG_PRELIGHT;
     gtk_style_context_set_state(m_context, static_cast<GtkStateFlags>(flags));
 
-    gtk_render_slider(m_context, context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height(),
+    gtk_render_slider(m_context, context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height(),
                       scrollbar->orientation() == VerticalScrollbar ? GTK_ORIENTATION_VERTICAL : GTK_ORIENTATION_HORIZONTAL);
 
     gtk_style_context_restore(m_context);
@@ -136,8 +137,8 @@ void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollb
     gtk_style_context_set_state(m_context, static_cast<GtkStateFlags>(flags));
 
     gtk_style_context_add_class(m_context, GTK_STYLE_CLASS_BUTTON);
-    gtk_render_background(m_context, context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
-    gtk_render_frame(m_context, context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
+    gtk_render_background(m_context, context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height());
+    gtk_render_frame(m_context, context->platformContext()->cr(), rect.x(), rect.y(), rect.width(), rect.height());
 
     gfloat arrowScaling;
     gtk_style_context_get_style(m_context, "arrow-scaling", &arrowScaling, NULL);
@@ -162,7 +163,7 @@ void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollb
         angle = (part == ForwardButtonEndPart || part == ForwardButtonStartPart) ? G_PI / 2 : 3 * (G_PI / 2);
     }
 
-    gtk_render_arrow(m_context, context->platformContext(), angle, arrowPoint.x(), arrowPoint.y(), arrowSize);
+    gtk_render_arrow(m_context, context->platformContext()->cr(), angle, arrowPoint.x(), arrowPoint.y(), arrowSize);
 
     gtk_style_context_restore(m_context);
 }
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
index e59d461..24a9f90 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -172,7 +172,7 @@ void ImageFrame::zeroFillPixelData()
     m_hasAlpha = true;
 }
 
-#if !PLATFORM(CG)
+#if !USE(CG)
 
 void ImageFrame::copyReferenceToBitmapData(const ImageFrame& other)
 {
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 801daf3..f45d708 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -147,7 +147,7 @@ namespace WebCore {
 #endif
 
     private:
-#if PLATFORM(CG)
+#if USE(CG)
         typedef RetainPtr<CFMutableDataRef> NativeBackingStore;
 #else
         typedef Vector<PixelData> NativeBackingStore;
diff --git a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
index 060c62a..eacfd29 100644
--- a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
@@ -38,6 +38,8 @@ namespace WebCore {
 WEBPImageDecoder::WEBPImageDecoder(ImageSource::AlphaOption alphaOption,
                                    ImageSource::GammaAndColorProfileOption gammaAndColorProfileOption)
     : ImageDecoder(alphaOption, gammaAndColorProfileOption)
+    , m_decoder(0)
+    , m_lastVisibleRow(0)
 {
 }
 
@@ -79,12 +81,13 @@ bool WEBPImageDecoder::decode(bool onlySize)
 
     if (failed())
         return false;
+
     const size_t dataSize = m_data->size();
-    const uint8_t* dataBytes =
-        reinterpret_cast<const uint8_t*>(m_data->data());
-    int width, height;
     if (dataSize < sizeOfHeader)
         return true;
+
+    int width, height;
+    const uint8_t* dataBytes = reinterpret_cast<const uint8_t*>(m_data->data());
     if (!WebPGetInfo(dataBytes, dataSize, &width, &height))
         return setFailed();
     if (!ImageDecoder::isSizeAvailable() && !setSize(width, height))
@@ -92,9 +95,8 @@ bool WEBPImageDecoder::decode(bool onlySize)
     if (onlySize)
         return true;
 
-    // FIXME: Add support for progressive decoding.
-    if (!isAllDataReceived())
-        return true;
+    bool allDataReceived = isAllDataReceived();
+    int stride = width * bytesPerPixel;
     ASSERT(!m_frameBufferCache.isEmpty());
     ImageFrame& buffer = m_frameBufferCache[0];
     if (buffer.status() == ImageFrame::FrameEmpty) {
@@ -102,22 +104,41 @@ bool WEBPImageDecoder::decode(bool onlySize)
         ASSERT(height == size().height());
         if (!buffer.setSize(width, height))
             return setFailed();
+        buffer.setStatus(allDataReceived ? ImageFrame::FrameComplete : ImageFrame::FramePartial);
+        // FIXME: We currently hard code false below because libwebp doesn't support alpha yet.
+        buffer.setHasAlpha(false);
+        buffer.setOriginalFrameRect(IntRect(IntPoint(), size()));
+        m_rgbOutput.resize(height * stride);
+    }
+    int newLastVisibleRow = 0; // Last completed row.
+    if (allDataReceived) {
+        if (!WebPDecodeRGBInto(dataBytes, dataSize, m_rgbOutput.data(), m_rgbOutput.size(), stride))
+            return setFailed();
+        newLastVisibleRow = height;
+    } else {
+        if (!m_decoder) {
+            m_decoder = WebPINewRGB(MODE_RGB, m_rgbOutput.data(), m_rgbOutput.size(), stride);
+            if (!m_decoder)
+                return setFailed();
+        }
+        const VP8StatusCode status = WebPIUpdate(m_decoder, dataBytes, dataSize);
+        if (status != VP8_STATUS_OK && status != VP8_STATUS_SUSPENDED)
+            return setFailed();
+        if (!WebPIDecGetRGB(m_decoder, &newLastVisibleRow, 0, 0, 0))
+            return setFailed();
+        ASSERT(newLastVisibleRow >= 0);
+        ASSERT(newLastVisibleRow <= height);
     }
-    const int stride = width * bytesPerPixel;
-    Vector<uint8_t> rgb;
-    rgb.resize(height * stride);
-    if (!WebPDecodeBGRInto(dataBytes, dataSize, rgb.data(), rgb.size(), stride))
-        return setFailed();
     // FIXME: remove this data copy.
-    for (int y = 0; y < height; ++y) {
-        const uint8_t* const src = &rgb[y * stride];
+    for (int y = m_lastVisibleRow; y < newLastVisibleRow; ++y) {
+        const uint8_t* const src = &m_rgbOutput[y * stride];
         for (int x = 0; x < width; ++x)
-            buffer.setRGBA(x, y, src[bytesPerPixel * x + 2], src[bytesPerPixel * x + 1], src[bytesPerPixel * x + 0], 0xff);
+            buffer.setRGBA(x, y, src[bytesPerPixel * x + 0], src[bytesPerPixel * x + 1], src[bytesPerPixel * x + 2], 0xff);
     }
-    buffer.setStatus(ImageFrame::FrameComplete);
-    buffer.setHasAlpha(false);
-    buffer.setOriginalFrameRect(IntRect(IntPoint(), size()));
-    return true;
+    m_lastVisibleRow = newLastVisibleRow;
+    if (m_lastVisibleRow == height)
+         buffer.setStatus(ImageFrame::FrameComplete);
+    return m_lastVisibleRow == height;
 }
 
 }
diff --git a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h
index c32e047..53da91f 100644
--- a/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h
@@ -33,6 +33,9 @@
 
 #if USE(WEBP)
 
+// Forward declaration of libwebp's structure. Must be outside the WebCore scope.
+typedef struct WebPIDecoder WebPIDecoder;
+
 namespace WebCore {
 
 class WEBPImageDecoder : public ImageDecoder {
@@ -46,6 +49,10 @@ public:
 private:
     // Returns false in case of decoding failure.
     bool decode(bool onlySize);
+
+    WebPIDecoder* m_decoder; // This is only used when we want to decode() but not all data is available yet.
+    int m_lastVisibleRow;
+    Vector<uint8_t> m_rgbOutput;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/leveldb/LevelDBComparator.h b/Source/WebCore/platform/leveldb/LevelDBComparator.h
new file mode 100644
index 0000000..08ac261
--- /dev/null
+++ b/Source/WebCore/platform/leveldb/LevelDBComparator.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LevelDBComparator_h
+#define LevelDBComparator_h
+
+#if ENABLE(LEVELDB)
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class LevelDBSlice;
+
+class LevelDBComparator {
+public:
+    virtual ~LevelDBComparator() {}
+
+    virtual int compare(const LevelDBSlice&, const LevelDBSlice&) const = 0;
+    virtual const char* name() const = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(LEVELDB)
+#endif // LevelDBComparator_h
diff --git a/Source/WebCore/platform/leveldb/LevelDBDatabase.cpp b/Source/WebCore/platform/leveldb/LevelDBDatabase.cpp
new file mode 100644
index 0000000..4587631
--- /dev/null
+++ b/Source/WebCore/platform/leveldb/LevelDBDatabase.cpp
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LevelDBDatabase.h"
+
+#if ENABLE(LEVELDB)
+
+#include "LevelDBComparator.h"
+#include "LevelDBIterator.h"
+#include "LevelDBSlice.h"
+#include <leveldb/comparator.h>
+#include <leveldb/db.h>
+#include <leveldb/slice.h>
+#include <string>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+static leveldb::Slice makeSlice(const Vector<char>& value)
+{
+    return leveldb::Slice(value.data(), value.size());
+}
+
+static leveldb::Slice makeSlice(const LevelDBSlice& s)
+{
+    return leveldb::Slice(s.begin(), s.end() - s.begin());
+}
+
+static LevelDBSlice makeLevelDBSlice(const leveldb::Slice& s)
+{
+    return LevelDBSlice(s.data(), s.data() + s.size());
+}
+
+static Vector<char> makeVector(const std::string& s)
+{
+    Vector<char> res;
+    res.append(s.c_str(), s.length());
+    return res;
+}
+
+namespace {
+class ComparatorAdapter : public leveldb::Comparator {
+public:
+    ComparatorAdapter(const LevelDBComparator* comparator)
+        : m_comparator(comparator)
+    {
+    }
+
+    virtual int Compare(const leveldb::Slice& a, const leveldb::Slice& b) const
+    {
+        return m_comparator->compare(makeLevelDBSlice(a), makeLevelDBSlice(b));
+    }
+
+    virtual const char* Name() const { return m_comparator->name(); }
+
+    // FIXME: Support the methods below in the future.
+    virtual void FindShortestSeparator(std::string* start, const leveldb::Slice& limit) const { }
+    virtual void FindShortSuccessor(std::string* key) const { }
+
+private:
+    const LevelDBComparator* m_comparator;
+};
+}
+
+LevelDBDatabase::LevelDBDatabase()
+    : m_db(0)
+{
+}
+
+LevelDBDatabase::~LevelDBDatabase()
+{
+}
+
+LevelDBDatabase* LevelDBDatabase::open(const String& fileName, const LevelDBComparator* comparator)
+{
+    OwnPtr<ComparatorAdapter> comparatorAdapter(new ComparatorAdapter(comparator));
+
+    LevelDBDatabase* result = new LevelDBDatabase();
+
+    leveldb::Options options;
+    options.comparator = comparatorAdapter.get();
+    options.create_if_missing = true;
+    leveldb::DB* db;
+    leveldb::Status s = leveldb::DB::Open(options, fileName.utf8().data(), &db);
+
+    if (!s.ok()) {
+        delete result;
+        return 0;
+    }
+
+    result->m_db = WTF::adoptPtr(db);
+    result->m_comparatorAdapter = comparatorAdapter.release();
+
+    return result;
+}
+
+
+bool LevelDBDatabase::put(const LevelDBSlice& key, const Vector<char>& value)
+{
+    leveldb::WriteOptions writeOptions;
+    writeOptions.sync = false;
+
+    return m_db->Put(writeOptions, makeSlice(key), makeSlice(value)).ok();
+}
+
+bool LevelDBDatabase::remove(const LevelDBSlice& key)
+{
+    leveldb::WriteOptions writeOptions;
+    writeOptions.sync = false;
+
+    return m_db->Delete(writeOptions, makeSlice(key)).ok();
+}
+
+bool LevelDBDatabase::get(const LevelDBSlice& key, Vector<char>& value)
+{
+    std::string result;
+    if (!m_db->Get(leveldb::ReadOptions(), makeSlice(key), &result).ok())
+        return false;
+
+    value = makeVector(result);
+    return true;
+}
+
+LevelDBIterator* LevelDBDatabase::newIterator()
+{
+    leveldb::Iterator* i = m_db->NewIterator(leveldb::ReadOptions());
+    if (!i) // FIXME: Double check if we actually need to check this.
+        return 0;
+    return new LevelDBIterator(i);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(LEVELDB)
diff --git a/Source/WebCore/platform/leveldb/LevelDBDatabase.h b/Source/WebCore/platform/leveldb/LevelDBDatabase.h
new file mode 100644
index 0000000..471f335
--- /dev/null
+++ b/Source/WebCore/platform/leveldb/LevelDBDatabase.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LevelDBDatabase_h
+#define LevelDBDatabase_h
+
+#if ENABLE(LEVELDB)
+
+#include "PlatformString.h"
+#include <OwnPtr.h>
+#include <Vector.h>
+
+namespace leveldb {
+class Comparator;
+class DB;
+}
+
+namespace WebCore {
+
+class LevelDBComparator;
+class LevelDBIterator;
+class LevelDBSlice;
+
+class LevelDBDatabase {
+public:
+    static LevelDBDatabase* open(const String& fileName, const LevelDBComparator*);
+    ~LevelDBDatabase();
+
+    bool put(const LevelDBSlice& key, const Vector<char>& value);
+    bool remove(const LevelDBSlice& key);
+    bool get(const LevelDBSlice& key, Vector<char>& value);
+    LevelDBIterator* newIterator();
+
+private:
+    LevelDBDatabase();
+
+    OwnPtr<leveldb::DB> m_db;
+    OwnPtr<leveldb::Comparator> m_comparatorAdapter;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(LEVELDB)
+#endif // LevelDBDatabase_h
diff --git a/Source/WebCore/platform/mac/RuntimeApplicationChecks.mm b/Source/WebCore/platform/leveldb/LevelDBIterator.cpp
index 7fe8378..de0f286 100644
--- a/Source/WebCore/platform/mac/RuntimeApplicationChecks.mm
+++ b/Source/WebCore/platform/leveldb/LevelDBIterator.cpp
@@ -1,15 +1,15 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -23,46 +23,72 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import "config.h"
-#import "RuntimeApplicationChecks.h"
+#include "config.h"
+#include "LevelDBIterator.h"
 
+#if ENABLE(LEVELDB)
+
+#include <leveldb/iterator.h>
+#include <leveldb/slice.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
-bool applicationIsAppleMail()
+LevelDBIterator::~LevelDBIterator()
+{
+}
+
+LevelDBIterator::LevelDBIterator(leveldb::Iterator* it)
+    : m_iterator(it)
+{
+}
+
+static leveldb::Slice makeSlice(const Vector<char>& value)
+{
+    return leveldb::Slice(value.data(), value.size());
+}
+
+static LevelDBSlice makeLevelDBSlice(leveldb::Slice s)
 {
-    static const bool isAppleMail = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.apple.mail"];
-    return isAppleMail;
+    return LevelDBSlice(s.data(), s.data() + s.size());
 }
 
-bool applicationIsSafari()
+bool LevelDBIterator::isValid() const
 {
-    static const bool isSafari = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.apple.Safari"];
-    return isSafari;
+    return m_iterator->Valid();
 }
 
-bool applicationIsMicrosoftMessenger()
+void LevelDBIterator::seekToLast()
 {
-    static bool isMicrosoftMessenger = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.microsoft.Messenger"];
-    return isMicrosoftMessenger;
+    m_iterator->SeekToLast();
 }
 
-bool applicationIsAdobeInstaller()
+void LevelDBIterator::seek(const Vector<char>& target)
 {
-    static bool isAdobeInstaller = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.adobe.Installers.Setup"];
-    return isAdobeInstaller;
+    m_iterator->Seek(makeSlice(target));
 }
-    
-bool applicationIsAOLInstantMessenger()
+
+void LevelDBIterator::next()
+{
+    m_iterator->Next();
+}
+
+void LevelDBIterator::prev()
 {
-    static bool isAOLInstantMessenger = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.aol.aim.desktop"];
-    return isAOLInstantMessenger;
+    m_iterator->Prev();
 }
 
-bool applicationIsMicrosoftMyDay()
+LevelDBSlice LevelDBIterator::key() const
 {
-    static bool isMicrosoftMyDay = [[[NSBundle mainBundle] bundleIdentifier] isEqualToString:@"com.microsoft.myday"];
-    return isMicrosoftMyDay;
+    return makeLevelDBSlice(m_iterator->key());
+}
+
+LevelDBSlice LevelDBIterator::value() const
+{
+    return makeLevelDBSlice(m_iterator->value());
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(LEVELDB)
diff --git a/Source/WebCore/platform/leveldb/LevelDBIterator.h b/Source/WebCore/platform/leveldb/LevelDBIterator.h
new file mode 100644
index 0000000..ff9cbca
--- /dev/null
+++ b/Source/WebCore/platform/leveldb/LevelDBIterator.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LevelDBIterator_h
+#define LevelDBIterator_h
+
+#if ENABLE(LEVELDB)
+
+#include "LevelDBSlice.h"
+#include "PlatformString.h"
+#include <OwnPtr.h>
+#include <Vector.h>
+
+namespace leveldb {
+class Iterator;
+}
+
+namespace WebCore {
+
+class LevelDBIterator {
+public:
+    ~LevelDBIterator();
+
+    bool isValid() const;
+    void seekToLast();
+    void seek(const Vector<char>& target);
+    void next();
+    void prev();
+    LevelDBSlice key() const;
+    LevelDBSlice value() const;
+
+private:
+    LevelDBIterator(leveldb::Iterator*);
+    friend class LevelDBDatabase;
+
+    OwnPtr<leveldb::Iterator> m_iterator;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(LEVELDB)
+#endif // LevelDBIterator_h
diff --git a/Source/WebCore/platform/leveldb/LevelDBSlice.h b/Source/WebCore/platform/leveldb/LevelDBSlice.h
new file mode 100644
index 0000000..15c576c
--- /dev/null
+++ b/Source/WebCore/platform/leveldb/LevelDBSlice.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LevelDBSlice_h
+#define LevelDBSlice_h
+
+#if ENABLE(LEVELDB)
+
+#include "PlatformString.h"
+#include <Vector.h>
+
+namespace WebCore {
+
+class LevelDBSlice {
+public:
+    LevelDBSlice(const char* begin, const char* end)
+        : m_begin(begin)
+        , m_end(end)
+    {
+        ASSERT(m_end >= m_begin);
+    }
+
+    LevelDBSlice(const Vector<char>& v)
+        : m_begin(v.data())
+        , m_end(m_begin + v.size())
+    {
+        ASSERT(m_end >= m_begin);
+    }
+
+    ~LevelDBSlice()
+    {
+    }
+
+    const char* begin() const { return m_begin; }
+    const char* end() const { return m_end; }
+
+private:
+    const char* m_begin;
+    const char* m_end;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(LEVELDB)
+#endif // LevelDBSlice_h
diff --git a/Source/WebCore/platform/mac/ClipboardMac.mm b/Source/WebCore/platform/mac/ClipboardMac.mm
index a41982a..a5005eb 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.mm
+++ b/Source/WebCore/platform/mac/ClipboardMac.mm
@@ -49,7 +49,7 @@ namespace WebCore {
 
 PassRefPtr<Clipboard> Clipboard::create(ClipboardAccessPolicy policy, DragData* dragData, Frame* frame)
 {
-    return ClipboardMac::create(DragAndDrop, [dragData->platformData() draggingPasteboard], policy, frame);
+    return ClipboardMac::create(DragAndDrop, dragData->pasteboard(), policy, frame);
 }
 
 ClipboardMac::ClipboardMac(ClipboardType clipboardType, NSPasteboard *pasteboard, ClipboardAccessPolicy policy, Frame *frame)
diff --git a/Source/WebCore/platform/mac/DragDataMac.mm b/Source/WebCore/platform/mac/DragDataMac.mm
index 64376b1..41d23db 100644
--- a/Source/WebCore/platform/mac/DragDataMac.mm
+++ b/Source/WebCore/platform/mac/DragDataMac.mm
@@ -104,7 +104,7 @@ String DragData::asPlainText(Frame *frame) const
 
 Color DragData::asColor() const
 {
-    NSColor *color = [NSColor colorFromPasteboard:[m_platformDragData draggingPasteboard]];
+    NSColor *color = [NSColor colorFromPasteboard:m_pasteboard.get()];
     return makeRGBA((int)([color redComponent] * 255.0 + 0.5), (int)([color greenComponent] * 255.0 + 0.5), 
                     (int)([color blueComponent] * 255.0 + 0.5), (int)([color alphaComponent] * 255.0 + 0.5));
 }
@@ -141,7 +141,7 @@ String DragData::asURL(Frame* frame, FilenameConversionPolicy filenamePolicy, St
     (void)filenamePolicy;
 
     if (title) {
-        if (NSString *URLTitleString = [[m_platformDragData draggingPasteboard] stringForType:WebURLNamePboardType])
+        if (NSString *URLTitleString = [m_pasteboard.get() stringForType:WebURLNamePboardType])
             *title = URLTitleString;
     }
     Pasteboard pasteboard(m_pasteboard.get());
diff --git a/Source/WebCore/platform/mac/HTMLConverter.h b/Source/WebCore/platform/mac/HTMLConverter.h
index 645c1d7..3250769 100644
--- a/Source/WebCore/platform/mac/HTMLConverter.h
+++ b/Source/WebCore/platform/mac/HTMLConverter.h
@@ -23,12 +23,12 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import "DOM.h"
-#import "DOMDocument.h"
-#import "DOMRange.h"
+@class DOMDocument;
+@class DOMRange;
 
 namespace WebCore {
-class DocumentLoader;
+    class DocumentLoader;
+    class Range;
 }
 
 @interface WebHTMLConverter : NSObject {
@@ -79,10 +79,13 @@ class DocumentLoader;
     } _flags;
 }
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 - (id)init;
 - (id)initWithDOMRange:(DOMRange *)domRange;
 
 - (NSAttributedString *)attributedString;
+#endif
 
++ (NSAttributedString *)editingAttributedStringFromRange:(WebCore::Range*)range;
 @end
 
diff --git a/Source/WebCore/platform/mac/HTMLConverter.mm b/Source/WebCore/platform/mac/HTMLConverter.mm
index a4864c2..c0b0ba2 100644
--- a/Source/WebCore/platform/mac/HTMLConverter.mm
+++ b/Source/WebCore/platform/mac/HTMLConverter.mm
@@ -27,26 +27,35 @@
 #import "HTMLConverter.h"
 
 #import "ArchiveResource.h"
+#import "ColorMac.h"
 #import "Document.h"
 #import "DocumentLoader.h"
 #import "DOMDocumentInternal.h"
 #import "DOMElementInternal.h"
 #import "DOMHTMLTableCellElement.h"
 #import "DOMPrivate.h"
+#import "DOMRangeInternal.h"
 #import "Element.h"
 #import "Frame.h"
 #import "HTMLNames.h"
 #import "HTMLParserIdioms.h"
+#import "LoaderNSURLExtras.h"
+#import "RenderImage.h"
+#import "TextIterator.h"
 #import <wtf/ASCIICType.h>
 
 using namespace WebCore;
 using namespace HTMLNames;
 
+static NSFileWrapper *fileWrapperForURL(DocumentLoader *, NSURL *);
+static NSFileWrapper *fileWrapperForElement(Element*);
+
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
 // Additional control Unicode characters
 const unichar WebNextLineCharacter = 0x0085;
 
-@interface NSTextList (TextListPrivate)
+@interface NSTextList (WebCoreNSTextListDetails)
 + (NSDictionary *)_standardMarkerAttributesForAttributes:(NSDictionary *)attrs;
 @end
 
@@ -55,14 +64,12 @@ const unichar WebNextLineCharacter = 0x0085;
 - (BOOL)ignoresOrientation;
 @end
 
-@interface NSURL (WebDataURL)
-+ (NSURL *)_web_uniqueWebDataURL;
-+ (NSURL *)_web_uniqueWebDataURLWithRelativeString:(NSString *)string;
+@interface NSURL (WebCoreNSURLDetails)
+// FIXME: What is the reason to use this Foundation method, and not +[NSURL URLWithString:relativeToURL:]?
 + (NSURL *)_web_URLWithString:(NSString *)string relativeToURL:(NSURL *)baseURL;
-- (NSString *)_web_suggestedFilenameWithMIMEType:(NSString *)MIMEType;
 @end
 
-@interface WebHTMLConverter(WebHTMLConverterPrivate)
+@interface WebHTMLConverter(WebHTMLConverterInternal)
 
 - (NSString *)_stringForNode:(DOMNode *)node property:(NSString *)key;
 - (NSColor *)_colorForNode:(DOMNode *)node property:(NSString *)key;
@@ -89,8 +96,12 @@ static NSFont *WebDefaultFont()
     return defaultFont;
 }
 
+#endif
+
 @implementation WebHTMLConverter
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
 static NSFont *_fontForNameAndSize(NSString *fontName, CGFloat size, NSMutableDictionary *cache)
 {
     NSFontManager *fontManager = [NSFontManager sharedFontManager];
@@ -769,39 +780,6 @@ static inline NSShadow *_shadowForShadowStyle(NSString *shadowStyle)
     [string release];
     _flags.isSoft = YES;
 }
-
-static NSFileWrapper *fileWrapperForURL(DocumentLoader *dataSource, NSURL *URL)
-{
-    if ([URL isFileURL]) {
-        NSString *path = [[URL path] stringByResolvingSymlinksInPath];
-        return [[[NSFileWrapper alloc] initWithPath:path] autorelease];
-    }
-    
-    RefPtr<ArchiveResource> resource = dataSource->subresource(URL);
-    if (resource) {
-        NSFileWrapper *wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[resource->data()->createNSData() autorelease]] autorelease];
-        NSString *filename = resource->response().suggestedFilename();
-        if (!filename || ![filename length]) {
-            NSURL *URL = resource->url();
-            filename = [URL _web_suggestedFilenameWithMIMEType:resource->mimeType()];
-        }
-        [wrapper setPreferredFilename:filename];
-        return wrapper;
-    }
-    
-    NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:URL];
-
-    NSCachedURLResponse *cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
-    [request release];
-    
-    if (cachedResponse) {
-        NSFileWrapper *wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[cachedResponse data]] autorelease];
-        [wrapper setPreferredFilename:[[cachedResponse response] suggestedFilename]];
-        return wrapper;
-    }
-    
-    return nil;
-}
     
 - (BOOL)_addAttachmentForElement:(DOMElement *)element URL:(NSURL *)url needsParagraph:(BOOL)needsParagraph usePlaceholder:(BOOL)flag
 {
@@ -823,7 +801,7 @@ static NSFileWrapper *fileWrapperForURL(DocumentLoader *dataSource, NSURL *URL)
         if (flag && resource && [@"text/html" isEqual:resource->mimeType()]) notFound = YES;
         if (resource && !notFound) {
             fileWrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[resource->data()->createNSData() autorelease]] autorelease];
-            [fileWrapper setPreferredFilename:[url _web_suggestedFilenameWithMIMEType:resource->mimeType()]];
+            [fileWrapper setPreferredFilename:suggestedFilenameWithMIMEType(url, resource->mimeType())];
         }
     }
     if (!fileWrapper && !notFound) {
@@ -1672,11 +1650,119 @@ static NSInteger _colCompare(id block1, id block2, void *)
     return self;
 }
 
+// This function supports more HTML features than the editing variant below, such as tables.
 - (NSAttributedString *)attributedString
 {
     [self _loadFromDOMRange];
     return (0 == _errorCode) ? [[_attrStr retain] autorelease] : nil;
 }
 
+#endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+// This function uses TextIterator, which makes offsets in its result compatible with HTML editing.
++ (NSAttributedString *)editingAttributedStringFromRange:(Range*)range
+{
+    NSMutableAttributedString *string = [[NSMutableAttributedString alloc] init];
+    NSUInteger stringLength = 0;
+    RetainPtr<NSMutableDictionary> attrs(AdoptNS, [[NSMutableDictionary alloc] init]);
+
+    for (TextIterator it(range); !it.atEnd(); it.advance()) {
+        RefPtr<Range> currentTextRange = it.range();
+        ExceptionCode ec = 0;
+        Node* startContainer = currentTextRange->startContainer(ec);
+        Node* endContainer = currentTextRange->endContainer(ec);
+        int startOffset = currentTextRange->startOffset(ec);
+        int endOffset = currentTextRange->endOffset(ec);
+        
+        if (startContainer == endContainer && (startOffset == endOffset - 1)) {
+            Node* node = startContainer->childNode(startOffset);
+            if (node && node->hasTagName(imgTag)) {
+                NSFileWrapper *fileWrapper = fileWrapperForElement(static_cast<Element*>(node));
+                NSTextAttachment *attachment = [[NSTextAttachment alloc] initWithFileWrapper:fileWrapper];
+                [string appendAttributedString:[NSAttributedString attributedStringWithAttachment:attachment]];
+                [attachment release];
+            }
+        }
+
+        int currentTextLength = it.length();
+        if (!currentTextLength)
+            continue;
+
+        RenderObject* renderer = startContainer->renderer();
+        ASSERT(renderer);
+        if (!renderer)
+            continue;
+        RenderStyle* style = renderer->style();
+        NSFont *font = style->font().primaryFont()->getNSFont();
+        [attrs.get() setObject:font forKey:NSFontAttributeName];
+        if (style->visitedDependentColor(CSSPropertyColor).alpha())
+            [attrs.get() setObject:nsColor(style->visitedDependentColor(CSSPropertyColor)) forKey:NSForegroundColorAttributeName];
+        else
+            [attrs.get() removeObjectForKey:NSForegroundColorAttributeName];
+        if (style->visitedDependentColor(CSSPropertyBackgroundColor).alpha())
+            [attrs.get() setObject:nsColor(style->visitedDependentColor(CSSPropertyBackgroundColor)) forKey:NSBackgroundColorAttributeName];
+        else
+            [attrs.get() removeObjectForKey:NSBackgroundColorAttributeName];
+
+        RetainPtr<NSString> substring(AdoptNS, [[NSString alloc] initWithCharactersNoCopy:const_cast<UChar*>(it.characters()) length:currentTextLength freeWhenDone:NO]);
+        [string replaceCharactersInRange:NSMakeRange(stringLength, 0) withString:substring.get()];
+        [string setAttributes:attrs.get() range:NSMakeRange(stringLength, currentTextLength)];
+        stringLength += currentTextLength;
+    }
+
+    return [string autorelease];
+}
+
 @end
-#endif
+
+static NSFileWrapper *fileWrapperForURL(DocumentLoader *dataSource, NSURL *URL)
+{
+    if ([URL isFileURL]) {
+        NSString *path = [[URL path] stringByResolvingSymlinksInPath];
+        return [[[NSFileWrapper alloc] initWithPath:path] autorelease];
+    }
+    
+    RefPtr<ArchiveResource> resource = dataSource->subresource(URL);
+    if (resource) {
+        NSFileWrapper *wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[resource->data()->createNSData() autorelease]] autorelease];
+        NSString *filename = resource->response().suggestedFilename();
+        if (!filename || ![filename length])
+            filename = suggestedFilenameWithMIMEType(resource->url(), resource->mimeType());
+        [wrapper setPreferredFilename:filename];
+        return wrapper;
+    }
+    
+    NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:URL];
+
+    NSCachedURLResponse *cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
+    [request release];
+    
+    if (cachedResponse) {
+        NSFileWrapper *wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[cachedResponse data]] autorelease];
+        [wrapper setPreferredFilename:[[cachedResponse response] suggestedFilename]];
+        return wrapper;
+    }
+    
+    return nil;
+}
+
+static NSFileWrapper *fileWrapperForElement(Element* element)
+{
+    NSFileWrapper *wrapper = nil;
+    
+    const AtomicString& attr = element->getAttribute(srcAttr);
+    if (!attr.isEmpty()) {
+        NSURL *URL = element->document()->completeURL(attr);
+        wrapper = fileWrapperForURL(element->document()->loader(), URL);
+    }
+    if (!wrapper) {
+        RenderImage* renderer = toRenderImage(element->renderer());
+        if (renderer->cachedImage() && !renderer->cachedImage()->errorOccurred()) {
+            wrapper = [[NSFileWrapper alloc] initRegularFileWithContents:(NSData *)(renderer->cachedImage()->image()->getTIFFRepresentation())];
+            [wrapper setPreferredFilename:@"image.tiff"];
+            [wrapper autorelease];
+        }
+    }
+
+    return wrapper;
+}
diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
index da06606..69782ab 100644
--- a/Source/WebCore/platform/mac/PasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
@@ -38,9 +38,7 @@
 #import "FrameLoaderClient.h"
 #import "HitTestResult.h"
 #import "HTMLAnchorElement.h"
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 #import "HTMLConverter.h"
-#endif
 #import "htmlediting.h"
 #import "HTMLNames.h"
 #import "Image.h"
@@ -52,6 +50,7 @@
 #import "RenderImage.h"
 #import "Text.h"
 #import "WebCoreNSStringExtras.h"
+#import "WebNSAttributedStringExtras.h"
 #import "markup.h"
 #import <wtf/StdLibExtras.h>
 #import <wtf/RetainPtr.h>
@@ -129,19 +128,6 @@ void Pasteboard::clear()
     [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
 }
 
-static NSAttributedString *stripAttachmentCharacters(NSAttributedString *string)
-{
-    const unichar attachmentCharacter = NSAttachmentCharacter;
-    DEFINE_STATIC_LOCAL(RetainPtr<NSString>, attachmentCharacterString, ([NSString stringWithCharacters:&attachmentCharacter length:1]));
-    NSMutableAttributedString *result = [[string mutableCopy] autorelease];
-    NSRange attachmentRange = [[result string] rangeOfString:attachmentCharacterString.get()];
-    while (attachmentRange.location != NSNotFound) {
-        [result replaceCharactersInRange:attachmentRange withString:@""];
-        attachmentRange = [[result string] rangeOfString:attachmentCharacterString.get()];
-    }
-    return result;
-}
-
 void Pasteboard::writeSelection(NSPasteboard* pasteboard, NSArray* pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     if (!WebArchivePboardType)
@@ -207,7 +193,7 @@ void Pasteboard::writeSelection(NSPasteboard* pasteboard, NSArray* pasteboardTyp
     }
     if ([types containsObject:NSRTFPboardType]) {
         if ([attributedString containsAttachments])
-            attributedString = stripAttachmentCharacters(attributedString);
+            attributedString = attributedStringByStrippingAttachmentCharacters(attributedString);
         NSData *RTFData = [attributedString RTFFromRange:NSMakeRange(0, [attributedString length]) documentAttributes:nil];
         [pasteboard setData:RTFData forType:NSRTFPboardType];
     }
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.h b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
index f7b6332..382052e 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.h
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
@@ -106,6 +106,8 @@ private:
     virtual void willEndLiveResize();
     virtual void contentAreaDidShow() const;
     virtual void contentAreaDidHide() const;
+    void didBeginScrollGesture() const;
+    void didEndScrollGesture() const;
 
     virtual void didAddVerticalScrollbar(Scrollbar*);
     virtual void willRemoveVerticalScrollbar(Scrollbar*);
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 5725880..321ef0f 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -100,6 +100,11 @@ static NSSize abs(NSSize size)
     _animator->immediateScrollToPoint(newPosition);
 }
 
+- (NSPoint)_pixelAlignProposedScrollPosition:(NSPoint)newOrigin
+{
+    return newOrigin;
+}
+
 - (NSSize)convertSizeToBase:(NSSize)size
 {
     return abs(size);
@@ -322,9 +327,9 @@ static NSSize abs(NSSize size)
 
     // Invalidate the scrollbars so that they paint the animation
     if (WebCore::Scrollbar* verticalScrollbar = _animator->scrollableArea()->verticalScrollbar())
-        _animator->scrollableArea()->invalidateScrollbarRect(verticalScrollbar, WebCore::IntRect(0, 0, verticalScrollbar->width(), verticalScrollbar->height()));
+        verticalScrollbar->invalidateRect(WebCore::IntRect(0, 0, verticalScrollbar->width(), verticalScrollbar->height()));
     if (WebCore::Scrollbar* horizontalScrollbar = _animator->scrollableArea()->horizontalScrollbar())
-        _animator->scrollableArea()->invalidateScrollbarRect(horizontalScrollbar, WebCore::IntRect(0, 0, horizontalScrollbar->width(), horizontalScrollbar->height()));
+        horizontalScrollbar->invalidateRect(WebCore::IntRect(0, 0, horizontalScrollbar->width(), horizontalScrollbar->height()));
 }
 
 - (void)scrollAnimatorDestroyed
@@ -575,6 +580,9 @@ void ScrollAnimatorMac::immediateScrollToPoint(const FloatPoint& newPosition)
 {
     FloatPoint adjustedPosition = adjustScrollPositionIfNecessary(newPosition);
  
+    if (adjustedPosition.x() == m_currentPosX && adjustedPosition.y() == m_currentPosY)
+        return;
+    
     m_currentPosX = adjustedPosition.x();
     m_currentPosY = adjustedPosition.y();
     notityPositionChanged();
@@ -582,13 +590,23 @@ void ScrollAnimatorMac::immediateScrollToPoint(const FloatPoint& newPosition)
 
 void ScrollAnimatorMac::immediateScrollByDeltaX(float deltaX)
 {
-    m_currentPosX = adjustScrollXPositionIfNecessary(m_currentPosX + deltaX);
+    float newPosX = adjustScrollXPositionIfNecessary(m_currentPosX + deltaX);
+    
+    if (newPosX == m_currentPosX)
+        return;
+    
+    m_currentPosX = newPosX;
     notityPositionChanged();
 }
 
 void ScrollAnimatorMac::immediateScrollByDeltaY(float deltaY)
 {
-    m_currentPosY = adjustScrollYPositionIfNecessary(m_currentPosY + deltaY);
+    float newPosY = adjustScrollYPositionIfNecessary(m_currentPosY + deltaY);
+    
+    if (newPosY == m_currentPosY)
+        return;
+    
+    m_currentPosY = newPosY;
     notityPositionChanged();
 }
 
@@ -663,6 +681,20 @@ void ScrollAnimatorMac::contentAreaDidHide() const
 #endif
 }
 
+void ScrollAnimatorMac::didBeginScrollGesture() const
+{
+#if USE(WK_SCROLLBAR_PAINTER)
+    wkDidBeginScrollGesture(m_scrollbarPainterController.get());
+#endif
+}
+
+void ScrollAnimatorMac::didEndScrollGesture() const
+{
+#if USE(WK_SCROLLBAR_PAINTER)
+    wkDidEndScrollGesture(m_scrollbarPainterController.get());
+#endif
+}
+
 void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 {
 #if USE(WK_SCROLLBAR_PAINTER)
@@ -771,6 +803,22 @@ void ScrollAnimatorMac::handleWheelEvent(PlatformWheelEvent& wheelEvent)
         return;
     }
 
+    // FIXME: This is somewhat roundabout hack to allow forwarding wheel events
+    // up to the parent scrollable area. It takes advantage of the fact that
+    // the base class implemenatation of handleWheelEvent will not accept the
+    // wheel event if there is nowhere to scroll.
+    if (fabsf(wheelEvent.deltaY()) >= fabsf(wheelEvent.deltaX())) {
+        if (!allowsVerticalStretching()) {
+            ScrollAnimator::handleWheelEvent(wheelEvent);
+            return;
+        }
+    } else {
+        if (!allowsHorizontalStretching()) {
+            ScrollAnimator::handleWheelEvent(wheelEvent);
+            return;
+        }
+    }
+
     wheelEvent.accept();
 
     bool isMometumScrollEvent = (wheelEvent.momentumPhase() != PlatformWheelEventPhaseNone);
@@ -819,21 +867,37 @@ bool ScrollAnimatorMac::pinnedInDirection(float deltaX, float deltaY)
 
 bool ScrollAnimatorMac::allowsVerticalStretching() const
 {
-    Scrollbar* hScroller = m_scrollableArea->horizontalScrollbar();
-    Scrollbar* vScroller = m_scrollableArea->verticalScrollbar();
-    if (((vScroller && vScroller->enabled()) || (!hScroller || !hScroller->enabled())))
+    switch (m_scrollableArea->verticalScrollElasticity()) {
+    case ScrollElasticityAutomatic: {
+        Scrollbar* hScroller = m_scrollableArea->horizontalScrollbar();
+        Scrollbar* vScroller = m_scrollableArea->verticalScrollbar();
+        return (((vScroller && vScroller->enabled()) || (!hScroller || !hScroller->enabled())));
+    }
+    case ScrollElasticityNone:
+        return false;
+    case ScrollElasticityAllowed:
         return true;
+    }
 
+    ASSERT_NOT_REACHED();
     return false;
 }
 
 bool ScrollAnimatorMac::allowsHorizontalStretching() const
 {
-    Scrollbar* hScroller = m_scrollableArea->horizontalScrollbar();
-    Scrollbar* vScroller = m_scrollableArea->verticalScrollbar();
-    if (((hScroller && hScroller->enabled()) || (!vScroller || !vScroller->enabled())))
+    switch (m_scrollableArea->horizontalScrollElasticity()) {
+    case ScrollElasticityAutomatic: {
+        Scrollbar* hScroller = m_scrollableArea->horizontalScrollbar();
+        Scrollbar* vScroller = m_scrollableArea->verticalScrollbar();
+        return (((hScroller && hScroller->enabled()) || (!vScroller || !vScroller->enabled())));
+    }
+    case ScrollElasticityNone:
+        return false;
+    case ScrollElasticityAllowed:
         return true;
+    }
 
+    ASSERT_NOT_REACHED();
     return false;
 }
 
@@ -858,7 +922,7 @@ void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
         deltaX = 0;
     else
         deltaY = 0;
-    
+
     bool isVerticallyStretched = false;
     bool isHorizontallyStretched = false;
     bool shouldStretch = false;
@@ -993,6 +1057,8 @@ void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
 
 void ScrollAnimatorMac::beginScrollGesture()
 {
+    didBeginScrollGesture();
+
     m_haveScrolledSincePageLoad = true;
     m_inScrollGesture = true;
     m_momentumScrollInProgress = false;
@@ -1012,6 +1078,8 @@ void ScrollAnimatorMac::beginScrollGesture()
 
 void ScrollAnimatorMac::endScrollGesture()
 {
+    didEndScrollGesture();
+
     snapRubberBand();
 }
 
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.h b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
index 308a551..3c9850b 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -29,7 +29,7 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include <objc/objc.h>
 
-#if PLATFORM(MAC) && PLATFORM(CA) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if PLATFORM(MAC) && USE(CA) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 #include <IOSurface/IOSurface.h>
 #endif
 
@@ -155,11 +155,12 @@ extern void (*wkSignalCFReadStreamError)(CFReadStreamRef stream, CFStreamError *
 extern void (*wkSignalCFReadStreamHasBytes)(CFReadStreamRef stream);
 extern unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
 extern int (*wkGetHTTPPipeliningPriority)(NSURLRequest *);
+extern void (*wkSetHTTPPipeliningMaximumPriority)(int maximumPriority);
 extern void (*wkSetHTTPPipeliningPriority)(NSMutableURLRequest *, int priority);
+extern void (*wkSetHTTPPipeliningMinimumFastLanePriority)(int priority);
 extern void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
 extern void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
 extern CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
-extern BOOL (*wkIsLatchingWheelEvent)(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
 extern void (*wkGetGlyphsForCharacters)(CGFontRef, const UniChar[], CGGlyph[], size_t);
@@ -187,6 +188,15 @@ extern BOOL (*wkUseSharedMediaUI)();
 extern void* wkGetHyphenationLocationBeforeIndex;
 #else
 extern CFIndex (*wkGetHyphenationLocationBeforeIndex)(CFStringRef string, CFIndex index);
+
+typedef enum {
+    wkEventPhaseNone = 0,
+    wkEventPhaseBegan = 1,
+    wkEventPhaseChanged = 2,
+    wkEventPhaseEnded = 3,
+} wkEventPhase;
+
+extern int (*wkGetNSEventMomentumPhase)(NSEvent *);
 #endif
 
 extern CTLineRef (*wkCreateCTLineWithUniCharProvider)(const UniChar* (*provide)(CFIndex stringIndex, CFIndex* charCount, CFDictionaryRef* attributes, void*), void (*dispose)(const UniChar* chars, void*), void*);
@@ -229,6 +239,8 @@ extern void (*wkContentAreaResized)(WKScrollbarPainterControllerRef);
 extern void (*wkWillEndLiveResize)(WKScrollbarPainterControllerRef);
 extern void (*wkContentAreaDidShow)(WKScrollbarPainterControllerRef);
 extern void (*wkContentAreaDidHide)(WKScrollbarPainterControllerRef);
+extern void (*wkDidBeginScrollGesture)(WKScrollbarPainterControllerRef);
+extern void (*wkDidEndScrollGesture)(WKScrollbarPainterControllerRef);
 
 extern bool (*wkScrollbarPainterUsesOverlayScrollers)(void);
 #endif
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
index ab059bd..6a78ff6 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -91,11 +91,12 @@ void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
 id (*wkCreateNSURLConnectionDelegateProxy)(void);
 unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
 int (*wkGetHTTPPipeliningPriority)(NSURLRequest *);
+void (*wkSetHTTPPipeliningMaximumPriority)(int priority);
 void (*wkSetHTTPPipeliningPriority)(NSMutableURLRequest *, int priority);
+void (*wkSetHTTPPipeliningMinimumFastLanePriority)(int priority);
 void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
 void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
 CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
-BOOL (*wkIsLatchingWheelEvent)(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
 void (*wkGetGlyphsForCharacters)(CGFontRef, const UniChar[], CGGlyph[], size_t);
@@ -120,6 +121,7 @@ BOOL (*wkSupportsMultipartXMixedReplace)(NSMutableURLRequest *);
 void* wkGetHyphenationLocationBeforeIndex;
 #else
 CFIndex (*wkGetHyphenationLocationBeforeIndex)(CFStringRef string, CFIndex index);
+int (*wkGetNSEventMomentumPhase)(NSEvent *);
 #endif
 
 CTLineRef (*wkCreateCTLineWithUniCharProvider)(const UniChar* (*provide)(CFIndex stringIndex, CFIndex* charCount, CFDictionaryRef* attributes, void*), void (*dispose)(const UniChar* chars, void*), void*);
@@ -159,6 +161,8 @@ void (*wkContentAreaResized)(WKScrollbarPainterControllerRef);
 void (*wkWillEndLiveResize)(WKScrollbarPainterControllerRef);
 void (*wkContentAreaDidShow)(WKScrollbarPainterControllerRef);
 void (*wkContentAreaDidHide)(WKScrollbarPainterControllerRef);
+void (*wkDidBeginScrollGesture)(WKScrollbarPainterControllerRef);
+void (*wkDidEndScrollGesture)(WKScrollbarPainterControllerRef);
 
 bool (*wkScrollbarPainterUsesOverlayScrollers)(void);
 #endif
diff --git a/Source/WebCore/platform/mac/WebNSAttributedStringExtras.h b/Source/WebCore/platform/mac/WebNSAttributedStringExtras.h
new file mode 100644
index 0000000..ce4cfe4
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebNSAttributedStringExtras.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2005, 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace WebCore {
+
+NSAttributedString *attributedStringByStrippingAttachmentCharacters(NSAttributedString *);
+
+}
diff --git a/Source/WebCore/platform/mac/WebNSAttributedStringExtras.mm b/Source/WebCore/platform/mac/WebNSAttributedStringExtras.mm
new file mode 100644
index 0000000..f64e24d
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebNSAttributedStringExtras.mm
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2005, 2007, 2008, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebNSAttributedStringExtras.h"
+
+namespace WebCore {
+
+NSAttributedString *attributedStringByStrippingAttachmentCharacters(NSAttributedString *attributedString)
+{
+    NSRange attachmentRange;
+    NSString *originalString = [attributedString string];
+    static NSString *attachmentCharString = nil;
+    
+    if (!attachmentCharString) {
+        unichar chars[2];
+        if (!attachmentCharString) {
+            chars[0] = NSAttachmentCharacter;
+            chars[1] = 0;
+            attachmentCharString = [[NSString alloc] initWithCharacters:chars length:1];
+        }
+    }
+    
+    attachmentRange = [originalString rangeOfString:attachmentCharString];
+    if (attachmentRange.location != NSNotFound && attachmentRange.length > 0) {
+        NSMutableAttributedString *newAttributedString = [[attributedString mutableCopyWithZone:NULL] autorelease];
+        
+        while (attachmentRange.location != NSNotFound && attachmentRange.length > 0) {
+            [newAttributedString replaceCharactersInRange:attachmentRange withString:@""];
+            attachmentRange = [[newAttributedString string] rangeOfString:attachmentCharString];
+        }
+        return newAttributedString;
+    }
+    
+    return attributedString;
+}
+
+}
diff --git a/Source/WebCore/platform/mac/WheelEventMac.mm b/Source/WebCore/platform/mac/WheelEventMac.mm
index 4e9a8b7..2494e69 100644
--- a/Source/WebCore/platform/mac/WheelEventMac.mm
+++ b/Source/WebCore/platform/mac/WheelEventMac.mm
@@ -35,8 +35,9 @@ namespace WebCore {
 
 static PlatformWheelEventPhase momentumPhaseForEvent(NSEvent *event)
 {
+    uint32_t phase = PlatformWheelEventPhaseNone;
+
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    uint32_t phase = PlatformWheelEventPhaseNone; 
     if ([event momentumPhase] & NSEventPhaseBegan)
         phase |= PlatformWheelEventPhaseBegan;
     if ([event momentumPhase] & NSEventPhaseStationary)
@@ -47,11 +48,24 @@ static PlatformWheelEventPhase momentumPhaseForEvent(NSEvent *event)
         phase |= PlatformWheelEventPhaseEnded;
     if ([event momentumPhase] & NSEventPhaseCancelled)
         phase |= PlatformWheelEventPhaseCancelled;
-    return static_cast<PlatformWheelEventPhase>(phase);
 #else
-    UNUSED_PARAM(event);
-    return PlatformWheelEventPhaseNone;
+    switch (wkGetNSEventMomentumPhase(event)) {
+    case wkEventPhaseNone:
+        phase = PlatformWheelEventPhaseNone;
+        break;
+    case wkEventPhaseBegan:
+        phase = PlatformWheelEventPhaseBegan;
+        break;
+    case wkEventPhaseChanged:
+        phase = PlatformWheelEventPhaseChanged;
+        break;
+    case wkEventPhaseEnded:
+        phase = PlatformWheelEventPhaseEnded;
+        break;
+    }
 #endif
+
+    return static_cast<PlatformWheelEventPhase>(phase);
 }
 
 static PlatformWheelEventPhase phaseForEvent(NSEvent *event)
diff --git a/Source/WebCore/platform/network/BlobResourceHandle.cpp b/Source/WebCore/platform/network/BlobResourceHandle.cpp
index 24c9088..d4cf452 100644
--- a/Source/WebCore/platform/network/BlobResourceHandle.cpp
+++ b/Source/WebCore/platform/network/BlobResourceHandle.cpp
@@ -79,7 +79,7 @@ public:
     BlobResourceSynchronousLoader(ResourceError&, ResourceResponse&, Vector<char>&);
 
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int, int /*lengthReceived*/);
+    virtual void didReceiveData(ResourceHandle*, const char*, int, int /*encodedDataLength*/);
     virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/);
     virtual void didFail(ResourceHandle*, const ResourceError&);
 
diff --git a/Source/WebCore/platform/network/MIMESniffing.cpp b/Source/WebCore/platform/network/MIMESniffing.cpp
new file mode 100644
index 0000000..f9868c1
--- /dev/null
+++ b/Source/WebCore/platform/network/MIMESniffing.cpp
@@ -0,0 +1,495 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "MIMESniffing.h"
+
+#include <cstring>
+#include <stdint.h>
+
+// MIME type sniffing implementation based on http://tools.ietf.org/html/draft-abarth-mime-sniff-06
+
+namespace {
+
+static inline bool isTextInList(const char* text, size_t size, const char** data)
+{
+    for (size_t i = 0; i < size; ++i) {
+        if (!strcmp(text, data[i]))
+            return true;
+    }
+    return false;
+
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-6
+const char* textTypes[] = {
+    "text/plain",
+    "text/plain; charset=ISO-8859-1",
+    "text/plain; charset=iso-8859-1",
+    "text/plain; charset=UTF-8"
+};
+const size_t textTypesSize = sizeof(textTypes) / sizeof(textTypes[0]);
+
+static inline bool isTextOrBinaryType(const char* type)
+{
+    return isTextInList(type, textTypesSize, textTypes);
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-6
+const char* unknownTypes[] = {
+    "",
+    "unknown/unknown",
+    "application/unknown",
+    "*/*"
+};
+const size_t unknownTypesSize = sizeof(unknownTypes) / sizeof(unknownTypes[0]);
+
+static inline bool isUnknownType(const char* type)
+{
+    return isTextInList(type, unknownTypesSize, unknownTypes);
+}
+
+const char* xmlTypes[] = {
+    "text/xml",
+    "application/xml"
+};
+const size_t xmlTypesSize = sizeof(xmlTypes) / sizeof(xmlTypes[0]);
+
+const char xmlSuffix[] = "+xml";
+
+static inline bool isXMLType(const char* type)
+{
+    const size_t xmlSuffixSize = sizeof(xmlSuffix) - 1;
+    size_t typeSize = strlen(type);
+    if (typeSize >= xmlSuffixSize && !memcmp(type + typeSize - xmlSuffixSize, xmlSuffix, xmlSuffixSize))
+        return true;
+
+    return isTextInList(type, xmlTypesSize, xmlTypes);
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-8
+const char binaryFlags[256] = {
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1,
+    1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+static inline bool isBinaryChar(unsigned char data)
+{
+    return binaryFlags[data];
+}
+
+static inline bool isBinaryData(const char* data, size_t size)
+{
+    for (size_t i = 0; i < size; ++i) {
+        if (isBinaryChar(data[i]))
+            return true;
+    }
+    return false;
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-11
+const char whiteSpaceChars[256] = {
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+static inline bool isWhiteSpace(unsigned char data)
+{
+    return whiteSpaceChars[data];
+}
+
+static inline void skipWhiteSpace(const char* data, size_t& pos, size_t dataSize)
+{
+    while (pos < dataSize && isWhiteSpace(data[pos]))
+        ++pos;
+}
+
+enum {
+    SkipWhiteSpace = 1,
+    TrailingSpaceOrBracket = 2
+};
+
+struct MagicNumbers {
+    const char* pattern;
+    const char* mask;
+    const char* mimeType;
+    size_t size;
+    int flags;
+};
+
+#define MAGIC_NUMBERS_MASKED(pattern, mask, mimeType, flags) {(pattern), (mask), (mimeType), sizeof(pattern) - 1, (flags)}
+#define MAGIC_NUMBERS_SIMPLE(pattern, mimeType) {(pattern), 0, (mimeType), sizeof(pattern) - 1, 0}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-12
+const MagicNumbers securityConstrainedTypes[] = {
+    MAGIC_NUMBERS_MASKED("<!DOCTYPE HTML", "\xFF\xFF\xDF\xDF\xDF\xDF\xDF\xDF\xDF\xFF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<HTML", "\xFF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<HEAD", "\xFF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<SCRIPT", "\xFF\xDF\xDF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<IFRAME", "\xFF\xDF\xDF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<H1", "\xFF\xDF\xFF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<DIV", "\xFF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<FONT", "\xFF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<TABLE", "\xFF\xDF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<A", "\xFF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<STYLE", "\xFF\xDF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<TITLE", "\xFF\xDF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<B", "\xFF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<BODY", "\xFF\xDF\xDF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<BR", "\xFF\xDF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<P", "\xFF\xDF", "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<!--", 0, "text/html", SkipWhiteSpace | TrailingSpaceOrBracket),
+    MAGIC_NUMBERS_MASKED("<?xml", 0, "text/xml", SkipWhiteSpace),
+    MAGIC_NUMBERS_SIMPLE("%PDF-", "application/pdf")
+};
+const size_t securityConstrainedTypesSize = sizeof(securityConstrainedTypes) / sizeof(securityConstrainedTypes[0]);
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-8
+const MagicNumbers bomTypes[] = {
+    MAGIC_NUMBERS_SIMPLE("\xFE\xFF", "text/plain"), // UTF-16BE BOM
+    MAGIC_NUMBERS_SIMPLE("\xFF\xFE", "text/plain"), // UTF-16LE BOM
+    MAGIC_NUMBERS_SIMPLE("\xEF\xBB\xBF", "text/plain") // UTF-8 BOM
+};
+const size_t bomTypesSize = sizeof(bomTypes) / sizeof(bomTypes[0]);
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-13
+const MagicNumbers safeTypes[] = {
+    MAGIC_NUMBERS_SIMPLE("%!PS-Adobe-", "application/postscript"),
+    MAGIC_NUMBERS_SIMPLE("\x4F\x67\x67\x53\x00", "application/ogg"), // An Ogg Vorbis audio or video signature.
+    MAGIC_NUMBERS_MASKED("RIFF\x00\x00\x00\x00WAVE", "\xFF\xFF\xFF\xFF\x00\x00\x00\x00\xFF\xFF\xFF\xFF", "audio/x-wave", 0), // "RIFF" followed by four bytes, followed by "WAVE".
+    MAGIC_NUMBERS_SIMPLE("\x1A\x45\xDF\xA3", "video/webm"), // The WebM signature.
+    MAGIC_NUMBERS_SIMPLE("Rar!\x1A\x07\x00", "application/x-rar-compressed"), // A RAR archive.
+    MAGIC_NUMBERS_SIMPLE("\x50\x4B\x03\x04", "application/zip"), // A ZIP archive.
+    MAGIC_NUMBERS_SIMPLE("\x1F\x8B\x08", "application/x-gzip") // A GZIP archive.
+};
+const size_t safeTypesSize = sizeof(safeTypes) / sizeof(safeTypes[0]);
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-16
+const MagicNumbers imageTypes[] = {
+    MAGIC_NUMBERS_MASKED("RIFF\x00\x00\x00\x00WEBPVP", "\xFF\xFF\xFF\xFF\x00\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF", "image/webp", 0), // "RIFF" followed by four bytes, followed by "WEBPVP".
+    MAGIC_NUMBERS_SIMPLE("GIF87a", "image/gif"),
+    MAGIC_NUMBERS_SIMPLE("GIF89a", "image/gif"),
+    MAGIC_NUMBERS_SIMPLE("\x89\x50\x4E\x47\x0D\x0A\x1A\x0A", "image/png"),
+    MAGIC_NUMBERS_SIMPLE("\xFF\xD8\xFF", "image/jpeg"),
+    MAGIC_NUMBERS_SIMPLE("BM", "image/bmp"),
+    MAGIC_NUMBERS_SIMPLE("\x00\x00\x01\x00", "image/vnd.microsoft.icon") // A Windows Icon signature.
+};
+const size_t imageTypesSize = sizeof(imageTypes) / sizeof(imageTypes[0]);
+
+static inline size_t dataSizeNeededForImageSniffing()
+{
+    size_t result = 0;
+    for (int i = 0; i < imageTypesSize; ++i) {
+        if (imageTypes[i].size > result)
+            result = imageTypes[i].size;
+    }
+    return result;
+}
+
+static inline bool maskedCompare(const MagicNumbers& info, const char* data, size_t dataSize)
+{
+    if (dataSize < info.size)
+        return false;
+
+    const uint32_t* pattern32 = reinterpret_cast<const uint32_t*>(info.pattern);
+    const uint32_t* mask32 = reinterpret_cast<const uint32_t*>(info.mask);
+    const uint32_t* data32 = reinterpret_cast<const uint32_t*>(data);
+
+    size_t count = info.size >> 2;
+
+    for (size_t i = 0; i < count; ++i) {
+        if ((*data32++ & *mask32++) != *pattern32++)
+            return false;
+    }
+
+    const char* p = reinterpret_cast<const char*>(pattern32);
+    const char* m = reinterpret_cast<const char*>(mask32);
+    const char* d = reinterpret_cast<const char*>(data32);
+
+    count = info.size & 3;
+
+    for (size_t i = 0; i < count; ++i) {
+        if ((*d++ & *m++) != *p++)
+            return false;
+    }
+
+    return true;
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-11
+static inline bool checkSpaceOrBracket(const char* data)
+{
+    return isWhiteSpace(*data) || *data == 0x3E;
+}
+
+static inline bool compare(const MagicNumbers& info, const char* data, size_t dataSize)
+{
+    if (info.flags & SkipWhiteSpace) {
+        size_t pos = 0;
+        skipWhiteSpace(data, pos, dataSize);
+        data += pos;
+        dataSize -= pos;
+    }
+
+    bool result;
+    if (info.mask)
+        result = maskedCompare(info, data, info.size);
+    else
+        result = dataSize >= info.size && !memcmp(data, info.pattern, info.size);
+
+    return result && (!(info.flags & TrailingSpaceOrBracket) || checkSpaceOrBracket(data + info.size));
+}
+
+static inline const char* findMIMEType(const char* data, size_t dataSize, const MagicNumbers* types, size_t typesCount)
+{
+    for (size_t i = 0; i < typesCount; ++i) {
+        if (compare(types[i], data, dataSize))
+            return types[i].mimeType;
+    }
+    return 0;
+}
+
+static inline const char* findSimpleMIMEType(const char* data, size_t dataSize, const MagicNumbers* types, size_t typesCount)
+{
+    for (size_t i = 0; i < typesCount; ++i) {
+        ASSERT(!types[i].mask);
+        ASSERT(!types[i].flags);
+
+        if (dataSize >= types[i].size && !memcmp(data, types[i].pattern, types[i].size))
+            return types[i].mimeType;
+    }
+    return 0;
+}
+
+bool isTypeInList(const char* type, const MagicNumbers* types, size_t typesCount)
+{
+    for (size_t i = 0; i < typesCount; ++i) {
+        if (!strcmp(type, types[i].mimeType))
+            return true;
+    }
+    return false;
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-8
+static const char* internalTextOrBinaryTypeSniffingProcedure(const char* data, size_t dataSize)
+{
+    const char* mimeType = 0;
+
+    mimeType = findSimpleMIMEType(data, dataSize, bomTypes, bomTypesSize);
+    if (mimeType)
+        return mimeType;
+
+    if (!isBinaryData(data, dataSize))
+        return "text/plain";
+
+    mimeType = findMIMEType(data, dataSize, safeTypes, safeTypesSize);
+    if (mimeType)
+        return mimeType;
+
+    mimeType = findMIMEType(data, dataSize, imageTypes, imageTypesSize);
+    if (mimeType)
+        return mimeType;
+
+    return "application/octet-stream";
+}
+
+static const char* textOrBinaryTypeSniffingProcedure(const char* data, size_t dataSize)
+{
+    const char* result = internalTextOrBinaryTypeSniffingProcedure(data, dataSize);
+    ASSERT(!isTypeInList(result, securityConstrainedTypes, securityConstrainedTypesSize));
+    return result;
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-10
+static const char* unknownTypeSniffingProcedure(const char* data, size_t dataSize)
+{
+    const char* mimeType = 0;
+
+    mimeType = findMIMEType(data, dataSize, securityConstrainedTypes, securityConstrainedTypesSize);
+    if (mimeType)
+        return mimeType;
+
+    mimeType = findSimpleMIMEType(data, dataSize, bomTypes, bomTypesSize);
+    if (mimeType)
+        return mimeType;
+
+    mimeType = findMIMEType(data, dataSize, safeTypes, safeTypesSize);
+    if (mimeType)
+        return mimeType;
+
+    mimeType = findMIMEType(data, dataSize, imageTypes, imageTypesSize);
+    if (mimeType)
+        return mimeType;
+
+    if (!isBinaryData(data, dataSize))
+        return "text/plain";
+
+    return "application/octet-stream";
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-16
+static const char* imageTypeSniffingProcedure(const char* data, size_t dataSize)
+{
+    return findMIMEType(data, dataSize, imageTypes, imageTypesSize);
+}
+
+static inline bool checkText(const char* data, size_t& pos, size_t dataSize, const char* text, size_t textSize)
+{
+    if (dataSize - pos < textSize || memcmp(data + pos, text, textSize))
+        return false;
+
+    pos += textSize;
+    return true;
+}
+
+const char rssUrl[] = "http://purl.org/rss/1.0";
+const char rdfUrl[] = "http://www.w3.org/1999/02/22-rdf-syntax-ns#";
+
+static inline const char* checkRDF(const char* data, size_t pos, size_t dataSize)
+{
+    bool isRDF = false;
+    bool isRSS = false;
+
+    while (pos <= dataSize) {
+        if (checkText(data, pos, dataSize, rssUrl, sizeof(rssUrl) - 1)) {
+            isRSS = true;
+            continue;
+        }
+
+        if (checkText(data, pos, dataSize, rdfUrl, sizeof(rdfUrl) - 1)) {
+            isRDF = true;
+            continue;
+        }
+
+        ++pos;
+
+        if (isRSS && isRDF)
+            return "application/rdf+xml";
+    }
+
+    return 0;
+}
+
+static inline bool skipTag(const char*& data, size_t& pos, size_t dataSize, const char* tag, size_t tagSize, const char* tagEnd, size_t tagEndSize)
+{
+    if (!checkText(data, pos, dataSize, tag, tagSize))
+        return false;
+
+    while (pos < dataSize && !checkText(data, pos, dataSize, tagEnd, tagEndSize))
+        ++pos;
+
+    return true;
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-17
+static const char* feedTypeSniffingProcedure(const char* data, size_t dataSize)
+{
+    size_t pos = 0;
+
+    if (dataSize >= 3 && !memcmp(data, "\xEF\xBB\xBF", 3))
+        pos += 3;
+
+    while (pos < dataSize) {
+        skipWhiteSpace(data, pos, dataSize);
+
+        if (!skipTag(data, pos, dataSize, "<!--", 4, "-->", 3) && !skipTag(data, pos, dataSize, "<!", 2, "!>", 2) && !skipTag(data, pos, dataSize, "<?", 2, "?>", 2))
+            break;
+    }
+
+    if (checkText(data, pos, dataSize, "<rss", 4))
+        return "application/rss+xml";
+
+    if (checkText(data, pos, dataSize, "<feed", 5))
+        return "application/atom+xml";
+
+    if (checkText(data, pos, dataSize, "<rdf:RDF", 8))
+        return checkRDF(data, pos, dataSize);
+
+    return 0;
+}
+
+}
+
+// http://tools.ietf.org/html/draft-abarth-mime-sniff-06#page-6
+MIMESniffer::MIMESniffer(const char* advertisedMIMEType, bool isSupportedImageType)
+    : m_dataSize(0)
+    , m_function(0)
+{
+    if (!advertisedMIMEType) {
+        m_dataSize = 512;
+        m_function = &unknownTypeSniffingProcedure;
+        return;
+    }
+
+    if (isTextOrBinaryType(advertisedMIMEType)) {
+        m_dataSize = 512;
+        m_function = &textOrBinaryTypeSniffingProcedure;
+        return;
+    }
+
+    if (isUnknownType(advertisedMIMEType)) {
+        m_dataSize = 512;
+        m_function = &unknownTypeSniffingProcedure;
+        return;
+    }
+
+    if (isXMLType(advertisedMIMEType))
+        return;
+
+    if (isSupportedImageType) {
+        static const size_t dataSize = dataSizeNeededForImageSniffing();
+        m_dataSize = dataSize;
+        m_function = &imageTypeSniffingProcedure;
+        return;
+    }
+
+    if (!strcmp(advertisedMIMEType, "text/html")) {
+        m_dataSize = 512;
+        m_function = &feedTypeSniffingProcedure;
+        return;
+    }
+}
diff --git a/Source/WebCore/platform/network/MIMESniffing.h b/Source/WebCore/platform/network/MIMESniffing.h
new file mode 100644
index 0000000..cd1c52b
--- /dev/null
+++ b/Source/WebCore/platform/network/MIMESniffing.h
@@ -0,0 +1,41 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef MIMESniffing_h
+#define MIMESniffing_h
+
+#include <stddef.h>
+
+// MIME type sniffing implementation based on http://tools.ietf.org/html/draft-abarth-mime-sniff-06
+
+class MIMESniffer {
+public:
+    MIMESniffer(const char* advertisedMIMEType, bool isSupportedImageType);
+
+    size_t dataSize() const { return m_dataSize; }
+    const char* sniff(const char* data, size_t size) const { return m_function ?  m_function(data, size) : 0; }
+    bool isValid() const { return m_dataSize > 0; }
+
+private:
+    typedef const char* (*SniffFunction)(const char*, size_t);
+    size_t m_dataSize;
+    SniffFunction m_function;
+};
+
+#endif // MIMESniffing_h
diff --git a/Source/WebCore/platform/network/NetworkingContext.h b/Source/WebCore/platform/network/NetworkingContext.h
index e8a3776..134394e 100644
--- a/Source/WebCore/platform/network/NetworkingContext.h
+++ b/Source/WebCore/platform/network/NetworkingContext.h
@@ -58,6 +58,7 @@ public:
 #if PLATFORM(QT)
     virtual QObject* originatingObject() const = 0;
     virtual QNetworkAccessManager* networkAccessManager() const = 0;
+    virtual bool mimeSniffingEnabled() const = 0;
 #endif
 
 #if PLATFORM(WIN)
diff --git a/Source/WebCore/platform/network/ProtectionSpaceHash.h b/Source/WebCore/platform/network/ProtectionSpaceHash.h
index 40eb9b6..edd95db 100644
--- a/Source/WebCore/platform/network/ProtectionSpaceHash.h
+++ b/Source/WebCore/platform/network/ProtectionSpaceHash.h
@@ -57,12 +57,7 @@ struct ProtectionSpaceHash {
 
 namespace WTF {
 
-    // WebCore::ProtectionSpaceHash is the default hash for ProtectionSpace
-    template<> struct HashTraits<WebCore::ProtectionSpace> : GenericHashTraits<WebCore::ProtectionSpace> {
-        static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(WebCore::ProtectionSpace& slot) { new (&slot) WebCore::ProtectionSpace(HashTableDeletedValue); }
-        static bool isDeletedValue(const WebCore::ProtectionSpace& slot) { return slot.isHashTableDeletedValue(); }
-    };
+    template<> struct HashTraits<WebCore::ProtectionSpace> : SimpleClassHashTraits<WebCore::ProtectionSpace> { };
 
     template<typename T> struct DefaultHash;
     template<> struct DefaultHash<WebCore::ProtectionSpace> {
diff --git a/Source/WebCore/platform/network/ResourceHandleClient.h b/Source/WebCore/platform/network/ResourceHandleClient.h
index e92b376..8b064c5 100644
--- a/Source/WebCore/platform/network/ResourceHandleClient.h
+++ b/Source/WebCore/platform/network/ResourceHandleClient.h
@@ -71,7 +71,7 @@ namespace WebCore {
         virtual void didSendData(ResourceHandle*, unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
 
         virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&) { }
-        virtual void didReceiveData(ResourceHandle*, const char*, int, int /*lengthReceived*/) { }
+        virtual void didReceiveData(ResourceHandle*, const char*, int, int /*encodedDataLength*/) { }
         virtual void didReceiveCachedMetadata(ResourceHandle*, const char*, int) { }
         virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/) { }
         virtual void didFail(ResourceHandle*, const ResourceError&) { }
diff --git a/Source/WebCore/platform/network/ResourceHandleInternal.h b/Source/WebCore/platform/network/ResourceHandleInternal.h
index b622801..bd24d22 100644
--- a/Source/WebCore/platform/network/ResourceHandleInternal.h
+++ b/Source/WebCore/platform/network/ResourceHandleInternal.h
@@ -116,7 +116,6 @@ namespace WebCore {
             , m_buffer(0)
             , m_bodySize(0)
             , m_bodyDataSent(0)
-            , m_idleHandler(0)
             , m_gotChunkHandler(0)
 #endif
 #if PLATFORM(QT)
@@ -195,7 +194,6 @@ namespace WebCore {
         char* m_buffer;
         unsigned long m_bodySize;
         unsigned long m_bodyDataSent;
-        guint m_idleHandler;
         RefPtr<NetworkingContext> m_context;
         gulong m_gotChunkHandler;
 #endif
diff --git a/Source/WebCore/platform/network/ResourceLoadInfo.h b/Source/WebCore/platform/network/ResourceLoadInfo.h
index a1b958c..94c5f24 100644
--- a/Source/WebCore/platform/network/ResourceLoadInfo.h
+++ b/Source/WebCore/platform/network/ResourceLoadInfo.h
@@ -33,12 +33,16 @@ namespace WebCore {
 
 struct ResourceLoadInfo : RefCounted<ResourceLoadInfo> {
     ResourceLoadInfo()
-        : httpStatusCode(0) { }
+        : httpStatusCode(0)
+        , encodedDataLength(-1) { }
 
     int httpStatusCode;
     String httpStatusText;
+    long long encodedDataLength;
     HTTPHeaderMap requestHeaders;
     HTTPHeaderMap responseHeaders;
+    String requestHeadersText;
+    String responseHeadersText;
 };
 
 }
diff --git a/Source/WebCore/platform/network/ResourceLoadPriority.h b/Source/WebCore/platform/network/ResourceLoadPriority.h
index 1c9d5d2..45238d7 100644
--- a/Source/WebCore/platform/network/ResourceLoadPriority.h
+++ b/Source/WebCore/platform/network/ResourceLoadPriority.h
@@ -28,15 +28,15 @@
 
 namespace WebCore {
 
-enum ResourceLoadPriority { 
-    ResourceLoadPriorityVeryLow, 
-    ResourceLoadPriorityLow, 
-    ResourceLoadPriorityMedium, 
-    ResourceLoadPriorityHigh, 
-    ResourceLoadPriorityLowest = ResourceLoadPriorityVeryLow, 
-    ResourceLoadPriorityHighest = ResourceLoadPriorityHigh, 
+enum ResourceLoadPriority {
     // The unresolved priority is here for the convenience of the clients. It should not be passed to the ResourceLoadScheduler.
-    ResourceLoadPriorityUnresolved,
+    ResourceLoadPriorityUnresolved = -1,
+    ResourceLoadPriorityVeryLow = 0,
+    ResourceLoadPriorityLow,
+    ResourceLoadPriorityMedium,
+    ResourceLoadPriorityHigh,
+    ResourceLoadPriorityLowest = ResourceLoadPriorityVeryLow,
+    ResourceLoadPriorityHighest = ResourceLoadPriorityHigh,
 };
 
 }
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.h b/Source/WebCore/platform/network/ResourceRequestBase.h
index 31a1e69..53e1160 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.h
+++ b/Source/WebCore/platform/network/ResourceRequestBase.h
@@ -65,6 +65,7 @@ namespace WebCore {
             TargetIsWorker,
             TargetIsSharedWorker,
             TargetIsPrefetch,
+            TargetIsFavicon,
         };
 
         static PassOwnPtr<ResourceRequest> adopt(PassOwnPtr<CrossThreadResourceRequestData>);
@@ -240,14 +241,6 @@ namespace WebCore {
     
     unsigned initializeMaximumHTTPConnectionCountPerHost();
 
-#if USE(CF)
-    bool isHTTPPipeliningEnabled();
-    bool shouldForceHTTPPipeliningPriorityHigh();
-#else
-    inline bool isHTTPPipeliningEnabled() { return false; }
-    inline bool shouldForceHTTPPipeliningPriorityHigh() { return false; }
-#endif
-
 } // namespace WebCore
 
 #endif // ResourceRequestBase_h
diff --git a/Source/WebCore/platform/network/ResourceResponseBase.cpp b/Source/WebCore/platform/network/ResourceResponseBase.cpp
index 55eac76..5fcc328 100644
--- a/Source/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/Source/WebCore/platform/network/ResourceResponseBase.cpp
@@ -108,7 +108,7 @@ PassOwnPtr<ResourceResponse> ResourceResponseBase::adopt(PassOwnPtr<CrossThreadR
     response->setHTTPStatusCode(data->m_httpStatusCode);
     response->setHTTPStatusText(data->m_httpStatusText);
 
-    response->lazyInit();
+    response->lazyInit(AllFields);
     response->m_httpHeaderFields.adopt(data->m_httpHeaders.release());
     response->setLastModifiedDate(data->m_lastModifiedDate);
     response->setResourceLoadTiming(data->m_resourceLoadTiming.release());
@@ -135,7 +135,7 @@ PassOwnPtr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() con
 
 bool ResourceResponseBase::isHTTP() const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     String protocol = m_url.protocol();
 
@@ -144,126 +144,140 @@ bool ResourceResponseBase::isHTTP() const
 
 const KURL& ResourceResponseBase::url() const
 {
-    lazyInit();
-    
+    lazyInit(CommonFieldsOnly);
+
     return m_url; 
 }
 
 void ResourceResponseBase::setURL(const KURL& url)
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
     m_isNull = false;
-    
+
     m_url = url; 
 }
 
 const String& ResourceResponseBase::mimeType() const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     return m_mimeType; 
 }
 
 void ResourceResponseBase::setMimeType(const String& mimeType)
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
     m_isNull = false;
-    
+
     m_mimeType = mimeType; 
 }
 
 long long ResourceResponseBase::expectedContentLength() const 
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     return m_expectedContentLength;
 }
 
 void ResourceResponseBase::setExpectedContentLength(long long expectedContentLength)
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
     m_isNull = false;
-    
+
     m_expectedContentLength = expectedContentLength; 
 }
 
 const String& ResourceResponseBase::textEncodingName() const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     return m_textEncodingName;
 }
 
 void ResourceResponseBase::setTextEncodingName(const String& encodingName)
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
     m_isNull = false;
-    
+
     m_textEncodingName = encodingName; 
 }
 
 // FIXME should compute this on the fly
 const String& ResourceResponseBase::suggestedFilename() const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     return m_suggestedFilename;
 }
 
 void ResourceResponseBase::setSuggestedFilename(const String& suggestedName)
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
     m_isNull = false;
-    
+
     m_suggestedFilename = suggestedName; 
 }
 
 int ResourceResponseBase::httpStatusCode() const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     return m_httpStatusCode;
 }
 
 void ResourceResponseBase::setHTTPStatusCode(int statusCode)
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     m_httpStatusCode = statusCode;
 }
 
 const String& ResourceResponseBase::httpStatusText() const 
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     return m_httpStatusText; 
 }
 
 void ResourceResponseBase::setHTTPStatusText(const String& statusText) 
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     m_httpStatusText = statusText; 
 }
 
 String ResourceResponseBase::httpHeaderField(const AtomicString& name) const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
+
+    // If we already have the header, just return it instead of consuming memory by grabing all headers.
+    String value = m_httpHeaderFields.get(name);
+    if (!value.isEmpty())        
+        return value;
+
+    lazyInit(AllFields);
 
     return m_httpHeaderFields.get(name); 
 }
 
 String ResourceResponseBase::httpHeaderField(const char* name) const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
+
+    // If we already have the header, just return it instead of consuming memory by grabing all headers.
+    String value = m_httpHeaderFields.get(name);
+    if (!value.isEmpty())
+        return value;
+
+    lazyInit(AllFields);
 
     return m_httpHeaderFields.get(name); 
 }
 
 void ResourceResponseBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
-    lazyInit();
-    
+    lazyInit(AllFields);
+
     DEFINE_STATIC_LOCAL(const AtomicString, ageHeader, ("age"));
     DEFINE_STATIC_LOCAL(const AtomicString, cacheControlHeader, ("cache-control"));
     DEFINE_STATIC_LOCAL(const AtomicString, dateHeader, ("date"));
@@ -286,7 +300,7 @@ void ResourceResponseBase::setHTTPHeaderField(const AtomicString& name, const St
 
 const HTTPHeaderMap& ResourceResponseBase::httpHeaderFields() const
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     return m_httpHeaderFields;
 }
@@ -295,7 +309,7 @@ void ResourceResponseBase::parseCacheControlDirectives() const
 {
     ASSERT(!m_haveParsedCacheControlHeader);
 
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     m_haveParsedCacheControlHeader = true;
 
@@ -332,13 +346,14 @@ void ResourceResponseBase::parseCacheControlDirectives() const
             }
         }
     }
-        
+
     if (!m_cacheControlContainsNoCache) {
         // Handle Pragma: no-cache
         // This is deprecated and equivalent to Cache-control: no-cache
         // Don't bother tokenizing the value, it is not important
         DEFINE_STATIC_LOCAL(const AtomicString, pragmaHeader, ("pragma"));
         String pragmaValue = m_httpHeaderFields.get(pragmaHeader);
+
         m_cacheControlContainsNoCache = pragmaValue.lower().contains(noCacheDirective);
     }
 }
@@ -364,6 +379,15 @@ bool ResourceResponseBase::cacheControlContainsMustRevalidate() const
     return m_cacheControlContainsMustRevalidate;
 }
 
+bool ResourceResponseBase::hasCacheValidatorFields() const
+{
+    lazyInit(CommonFieldsOnly);
+
+    DEFINE_STATIC_LOCAL(const AtomicString, lastModifiedHeader, ("last-modified"));
+    DEFINE_STATIC_LOCAL(const AtomicString, eTagHeader, ("etag"));
+    return !m_httpHeaderFields.get(lastModifiedHeader).isEmpty() || !m_httpHeaderFields.get(eTagHeader).isEmpty();
+}
+
 double ResourceResponseBase::cacheControlMaxAge() const
 {
     if (!m_haveParsedCacheControlHeader)
@@ -388,7 +412,7 @@ static double parseDateValueInHeader(const HTTPHeaderMap& headers, const AtomicS
 
 double ResourceResponseBase::date() const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     if (!m_haveParsedDateHeader) {
         DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("date"));
@@ -400,8 +424,8 @@ double ResourceResponseBase::date() const
 
 double ResourceResponseBase::age() const
 {
-    lazyInit();
-    
+    lazyInit(CommonFieldsOnly);
+
     if (!m_haveParsedAgeHeader) {
         DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("age"));
         String headerValue = m_httpHeaderFields.get(headerName);
@@ -416,7 +440,7 @@ double ResourceResponseBase::age() const
 
 double ResourceResponseBase::expires() const
 {
-    lazyInit();
+    lazyInit(CommonFieldsOnly);
 
     if (!m_haveParsedExpiresHeader) {
         DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("expires"));
@@ -428,8 +452,8 @@ double ResourceResponseBase::expires() const
 
 double ResourceResponseBase::lastModified() const
 {
-    lazyInit();
-    
+    lazyInit(CommonFieldsOnly);
+
     if (!m_haveParsedLastModifiedHeader) {
         DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("last-modified"));
         m_lastModified = parseDateValueInHeader(m_httpHeaderFields, headerName);
@@ -440,7 +464,7 @@ double ResourceResponseBase::lastModified() const
 
 bool ResourceResponseBase::isAttachment() const
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     DEFINE_STATIC_LOCAL(const AtomicString, headerName, ("content-disposition"));
     String value = m_httpHeaderFields.get(headerName);
@@ -454,21 +478,21 @@ bool ResourceResponseBase::isAttachment() const
   
 void ResourceResponseBase::setLastModifiedDate(time_t lastModifiedDate)
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     m_lastModifiedDate = lastModifiedDate;
 }
 
 time_t ResourceResponseBase::lastModifiedDate() const
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     return m_lastModifiedDate;
 }
 
 bool ResourceResponseBase::wasCached() const
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     return m_wasCached;
 }
@@ -480,65 +504,65 @@ void ResourceResponseBase::setWasCached(bool value)
 
 bool ResourceResponseBase::connectionReused() const
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     return m_connectionReused;
 }
 
 void ResourceResponseBase::setConnectionReused(bool connectionReused)
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     m_connectionReused = connectionReused;
 }
 
 unsigned ResourceResponseBase::connectionID() const
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     return m_connectionID;
 }
 
 void ResourceResponseBase::setConnectionID(unsigned connectionID)
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     m_connectionID = connectionID;
 }
 
 ResourceLoadTiming* ResourceResponseBase::resourceLoadTiming() const
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     return m_resourceLoadTiming.get();
 }
 
 void ResourceResponseBase::setResourceLoadTiming(PassRefPtr<ResourceLoadTiming> resourceLoadTiming)
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     m_resourceLoadTiming = resourceLoadTiming;
 }
 
 PassRefPtr<ResourceLoadInfo> ResourceResponseBase::resourceLoadInfo() const
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     return m_resourceLoadInfo.get();
 }
 
 void ResourceResponseBase::setResourceLoadInfo(PassRefPtr<ResourceLoadInfo> loadInfo)
 {
-    lazyInit();
+    lazyInit(AllFields);
 
     m_resourceLoadInfo = loadInfo;
 }
 
-void ResourceResponseBase::lazyInit() const
+void ResourceResponseBase::lazyInit(InitLevel initLevel) const
 {
-    const_cast<ResourceResponse*>(static_cast<const ResourceResponse*>(this))->platformLazyInit();
+    const_cast<ResourceResponse*>(static_cast<const ResourceResponse*>(this))->platformLazyInit(initLevel);
 }
-
+    
 bool ResourceResponseBase::compare(const ResourceResponse& a, const ResourceResponse& b)
 {
     if (a.isNull() != b.isNull())
diff --git a/Source/WebCore/platform/network/ResourceResponseBase.h b/Source/WebCore/platform/network/ResourceResponseBase.h
index e0774c2..250411c 100644
--- a/Source/WebCore/platform/network/ResourceResponseBase.h
+++ b/Source/WebCore/platform/network/ResourceResponseBase.h
@@ -35,6 +35,10 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 
+#if OS(SOLARIS)
+#include <sys/time.h> // For time_t structure.
+#endif
+
 namespace WebCore {
 
 class ResourceResponse;
@@ -93,6 +97,7 @@ public:
     bool cacheControlContainsNoCache() const;
     bool cacheControlContainsNoStore() const;
     bool cacheControlContainsMustRevalidate() const;
+    bool hasCacheValidatorFields() const;
     double cacheControlMaxAge() const;
     double date() const;
     double age() const;
@@ -124,13 +129,19 @@ public:
     static bool compare(const ResourceResponse&, const ResourceResponse&);
 
 protected:
+    enum InitLevel {
+        Uninitialized,
+        CommonFieldsOnly,
+        AllFields
+    };
+
     ResourceResponseBase();
     ResourceResponseBase(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename);
 
-    void lazyInit() const;
+    void lazyInit(InitLevel) const;
 
     // The ResourceResponse subclass may "shadow" this method to lazily initialize platform specific fields
-    void platformLazyInit() { }
+    void platformLazyInit(InitLevel) { }
 
     // The ResourceResponse subclass may "shadow" this method to compare platform specific fields
     static bool platformCompare(const ResourceResponse&, const ResourceResponse&) { return true; }
diff --git a/Source/WebCore/platform/network/android/ResourceHandleAndroid.cpp b/Source/WebCore/platform/network/android/ResourceHandleAndroid.cpp
index 8837cf8..13a26f0 100644
--- a/Source/WebCore/platform/network/android/ResourceHandleAndroid.cpp
+++ b/Source/WebCore/platform/network/android/ResourceHandleAndroid.cpp
@@ -131,7 +131,7 @@ public:
         *m_response = response;
     }
 
-    virtual void didReceiveData(ResourceHandle*, const char* data, int len, int lengthReceived)
+    virtual void didReceiveData(ResourceHandle*, const char* data, int len, int encodedDataLength)
     {
         m_data->append(data, len);
     }
diff --git a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index f840b04..83cd793 100644
--- a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -93,7 +93,7 @@ private:
     virtual bool shouldUseCredentialStorage(ResourceHandle*);
     virtual void didReceiveAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge&);
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int, int /*lengthReceived*/);
+    virtual void didReceiveData(ResourceHandle*, const char*, int, int /*encodedDataLength*/);
     virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/);
     virtual void didFail(ResourceHandle*, const ResourceError&);
 
@@ -757,7 +757,7 @@ void WebCoreSynchronousLoaderClient::didReceiveResponse(ResourceHandle*, const R
     m_response = response;
 }
 
-void WebCoreSynchronousLoaderClient::didReceiveData(ResourceHandle*, const char* data, int length, int /*lengthReceived*/)
+void WebCoreSynchronousLoaderClient::didReceiveData(ResourceHandle*, const char* data, int length, int /*encodedDataLength*/)
 {
     if (!m_data)
         m_data.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, 0));
diff --git a/Source/WebCore/platform/network/cf/ResourceRequest.h b/Source/WebCore/platform/network/cf/ResourceRequest.h
index 2da5026..5a14342 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequest.h
+++ b/Source/WebCore/platform/network/cf/ResourceRequest.h
@@ -88,6 +88,9 @@ namespace WebCore {
         void setStorageSession(CFURLStorageSessionRef);
 #endif
 
+        static bool httpPipeliningEnabled();
+        static void setHTTPPipeliningEnabled(bool);
+
     private:
         friend class ResourceRequestBase;
 
@@ -102,6 +105,8 @@ namespace WebCore {
 #else
         RetainPtr<NSURLRequest> m_nsRequest;
 #endif
+
+        static bool s_httpPipeliningEnabled;
     };
 
     struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
index fdccc11..d0ef1f9 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
@@ -29,6 +29,7 @@
 #include "ResourceRequest.h"
 
 #if PLATFORM(MAC)
+#include "ResourceLoadPriority.h"
 #include "WebCoreSystemInterface.h"
 #endif
 
@@ -40,6 +41,8 @@
 
 namespace WebCore {
 
+bool ResourceRequest::s_httpPipeliningEnabled = false;
+
 #if USE(CFNETWORK)
 
 typedef void (*CFURLRequestSetContentDispositionEncodingFallbackArrayFunction)(CFMutableURLRequestRef, CFArrayRef);
@@ -208,6 +211,16 @@ void ResourceRequest::setStorageSession(CFURLStorageSessionRef storageSession)
 
 #endif // USE(CFNETWORK)
 
+bool ResourceRequest::httpPipeliningEnabled()
+{
+    return s_httpPipeliningEnabled;
+}
+
+void ResourceRequest::setHTTPPipeliningEnabled(bool flag)
+{
+    s_httpPipeliningEnabled = flag;
+}
+
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     static const unsigned preferredConnectionCount = 6;
@@ -217,7 +230,9 @@ unsigned initializeMaximumHTTPConnectionCountPerHost()
     unsigned maximumHTTPConnectionCountPerHost = wkInitializeMaximumHTTPConnectionCountPerHost(preferredConnectionCount);
 
 #if PLATFORM(MAC)
-    if (isHTTPPipeliningEnabled()) {
+    if (ResourceRequest::httpPipeliningEnabled()) {
+        wkSetHTTPPipeliningMaximumPriority(ResourceLoadPriorityHighest);
+        wkSetHTTPPipeliningMinimumFastLanePriority(ResourceLoadPriorityMedium);
         // When pipelining do not rate-limit requests sent from WebCore since CFNetwork handles that.
         return unlimitedConnectionCount;
     }
@@ -226,23 +241,4 @@ unsigned initializeMaximumHTTPConnectionCountPerHost()
     return maximumHTTPConnectionCountPerHost;
 }
 
-static inline bool readBooleanPreference(CFStringRef key)
-{
-    Boolean keyExistsAndHasValidFormat;
-    Boolean result = CFPreferencesGetAppBooleanValue(key, kCFPreferencesCurrentApplication, &keyExistsAndHasValidFormat);
-    return keyExistsAndHasValidFormat ? result : false;
-}
-
-bool isHTTPPipeliningEnabled()
-{
-    static bool isEnabled = readBooleanPreference(CFSTR("WebKitEnableHTTPPipelining"));
-    return isEnabled;
-}
-
-bool shouldForceHTTPPipeliningPriorityHigh()
-{
-    static bool shouldForcePriorityHigh = readBooleanPreference(CFSTR("WebKitForceHTTPPipeliningPriorityHigh"));
-    return shouldForcePriorityHigh;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
index 271dcd2..987508f 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
@@ -41,34 +41,37 @@ void getResourceRequest(ResourceRequest&, CFURLRequestRef);
 CFURLRequestRef cfURLRequest(const ResourceRequest&);
 #endif
 
-inline ResourceLoadPriority mapHTTPPipeliningPriorityToResourceLoadPriority(int priority)
+inline ResourceLoadPriority toResourceLoadPriority(int priority)
 {
     switch (priority) {
+    case -1:
+        return ResourceLoadPriorityUnresolved;
     case 0:
-        return ResourceLoadPriorityLow;
+        return ResourceLoadPriorityVeryLow;
     case 1:
-        return ResourceLoadPriorityMedium;
+        return ResourceLoadPriorityLow;
     case 2:
-        return ResourceLoadPriorityHigh;
+        return ResourceLoadPriorityMedium;
     case 3:
-        return ResourceLoadPriorityUnresolved;
+        return ResourceLoadPriorityHigh;
     default:
         ASSERT_NOT_REACHED();
         return ResourceLoadPriorityLowest;
     }
 }
 
-inline int mapResourceLoadPriorityToHTTPPipeliningPriority(ResourceLoadPriority priority)
+inline int toHTTPPipeliningPriority(ResourceLoadPriority priority)
 {
     switch (priority) {
+    case ResourceLoadPriorityUnresolved:
+        return -1;
     case ResourceLoadPriorityVeryLow:
-    case ResourceLoadPriorityLow:
         return 0;
-    case ResourceLoadPriorityMedium:
+    case ResourceLoadPriorityLow:
         return 1;
-    case ResourceLoadPriorityHigh:
+    case ResourceLoadPriorityMedium:
         return 2;
-    case ResourceLoadPriorityUnresolved:
+    case ResourceLoadPriorityHigh:
         return 3;
     }
 
diff --git a/Source/WebCore/platform/network/cf/ResourceResponse.h b/Source/WebCore/platform/network/cf/ResourceResponse.h
index 0551ede..675d431 100644
--- a/Source/WebCore/platform/network/cf/ResourceResponse.h
+++ b/Source/WebCore/platform/network/cf/ResourceResponse.h
@@ -44,21 +44,21 @@ namespace WebCore {
 class ResourceResponse : public ResourceResponseBase {
 public:
     ResourceResponse()
-        : m_isUpToDate(true)
+        : m_initLevel(AllFields)
     {
     }
 
 #if USE(CFNETWORK)
     ResourceResponse(CFURLResponseRef cfResponse)
         : m_cfResponse(cfResponse)
-        , m_isUpToDate(false)
+        , m_initLevel(Uninitialized)
     {
         m_isNull = !cfResponse;
     }
 #else
     ResourceResponse(NSURLResponse* nsResponse)
         : m_nsResponse(nsResponse)
-        , m_isUpToDate(false)
+        , m_initLevel(Uninitialized)
     {
         m_isNull = !nsResponse;
     }
@@ -66,15 +66,15 @@ public:
 
     ResourceResponse(const KURL& url, const String& mimeType, long long expectedLength, const String& textEncodingName, const String& filename)
         : ResourceResponseBase(url, mimeType, expectedLength, textEncodingName, filename)
-        , m_isUpToDate(true)
+        , m_initLevel(AllFields)
     {
     }
 
     unsigned memoryUsage() const
     {
         // FIXME: Find some programmatic lighweight way to calculate ResourceResponse and associated classes.
-        // This is a rough estimate of resource overhead based on stats collected from the stress test.
-        return 3072;
+        // This is a rough estimate of resource overhead based on stats collected from memory usage tests.
+        return 3800;
         /*  1280 * 2 +                // average size of ResourceResponse. Doubled to account for the WebCore copy and the CF copy.
                                       // Mostly due to the size of the hash maps, the Header Map strings and the URL.
             256 * 2                   // Overhead from ResourceRequest, doubled to account for WebCore copy and CF copy.
@@ -91,7 +91,7 @@ public:
 private:
     friend class ResourceResponseBase;
 
-    void platformLazyInit();
+    void platformLazyInit(InitLevel);
     PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const { return data; }
     void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>) { }
 
@@ -102,7 +102,7 @@ private:
 #else
     mutable RetainPtr<NSURLResponse> m_nsResponse;
 #endif
-    bool m_isUpToDate;
+    InitLevel m_initLevel;
 };
 
 struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
diff --git a/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
index d4a0b31..06cc706 100644
--- a/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
@@ -42,6 +42,11 @@ using namespace std;
 
 namespace WebCore {
 
+static CFStringRef const commonHeaderFields[] = {
+    CFSTR("Age"), CFSTR("Cache-Control"), CFSTR("Date"), CFSTR("Etag"), CFSTR("Expires"), CFSTR("Last-Modified"), CFSTR("Pragma")
+};
+static const int numCommonHeaderFields = sizeof(commonHeaderFields) / sizeof(CFStringRef);
+
 CFURLResponseRef ResourceResponse::cfURLResponse() const
 {
     if (!m_cfResponse && !m_isNull) {
@@ -70,52 +75,66 @@ static time_t toTimeT(CFAbsoluteTime time)
     return min(max(minTimeAsDouble, time + kCFAbsoluteTimeIntervalSince1970), maxTimeAsDouble);
 }
 
-void ResourceResponse::platformLazyInit()
+void ResourceResponse::platformLazyInit(InitLevel initLevel)
 {
-    if (m_isUpToDate)
+    if (m_initLevel > initLevel)
         return;
-    m_isUpToDate = true;
 
     if (m_isNull) {
         ASSERT(!m_cfResponse.get());
         return;
     }
 
-    // FIXME: We may need to do MIME type sniffing here (unless that is done in CFURLResponseGetMIMEType).
-
-    m_url = CFURLResponseGetURL(m_cfResponse.get());
-    m_mimeType = CFURLResponseGetMIMEType(m_cfResponse.get());
-    m_expectedContentLength = CFURLResponseGetExpectedContentLength(m_cfResponse.get());
-    m_textEncodingName = CFURLResponseGetTextEncodingName(m_cfResponse.get());
-
-    // Workaround for <rdar://problem/8757088>, can be removed once that is fixed.
-    unsigned textEncodingNameLength = m_textEncodingName.length();
-    if (textEncodingNameLength >= 2 && m_textEncodingName[0U] == '"' && m_textEncodingName[textEncodingNameLength - 1] == '"')
-        m_textEncodingName = m_textEncodingName.substring(1, textEncodingNameLength - 2);
-
-    m_lastModifiedDate = toTimeT(CFURLResponseGetLastModifiedDate(m_cfResponse.get()));
-
-    RetainPtr<CFStringRef> suggestedFilename(AdoptCF, CFURLResponseCopySuggestedFilename(m_cfResponse.get()));
-    m_suggestedFilename = suggestedFilename.get();
-
-    CFHTTPMessageRef httpResponse = CFURLResponseGetHTTPResponse(m_cfResponse.get());
-    if (httpResponse) {
-        m_httpStatusCode = CFHTTPMessageGetResponseStatusCode(httpResponse);
+    if (m_initLevel < CommonFieldsOnly && initLevel >= CommonFieldsOnly) {
+        m_url = CFURLResponseGetURL(m_cfResponse.get());
+        m_mimeType = CFURLResponseGetMIMEType(m_cfResponse.get());
+        m_expectedContentLength = CFURLResponseGetExpectedContentLength(m_cfResponse.get());
+        m_textEncodingName = CFURLResponseGetTextEncodingName(m_cfResponse.get());
+
+        // Workaround for <rdar://problem/8757088>, can be removed once that is fixed.
+        unsigned textEncodingNameLength = m_textEncodingName.length();
+        if (textEncodingNameLength >= 2 && m_textEncodingName[0U] == '"' && m_textEncodingName[textEncodingNameLength - 1] == '"')
+            m_textEncodingName = m_textEncodingName.substring(1, textEncodingNameLength - 2);
+
+        m_lastModifiedDate = toTimeT(CFURLResponseGetLastModifiedDate(m_cfResponse.get()));
+
+        RetainPtr<CFStringRef> suggestedFilename(AdoptCF, CFURLResponseCopySuggestedFilename(m_cfResponse.get()));
+        m_suggestedFilename = suggestedFilename.get();
+
+        CFHTTPMessageRef httpResponse = CFURLResponseGetHTTPResponse(m_cfResponse.get());
+        if (httpResponse) {
+            m_httpStatusCode = CFHTTPMessageGetResponseStatusCode(httpResponse);
+            
+            RetainPtr<CFDictionaryRef> headers(AdoptCF, CFHTTPMessageCopyAllHeaderFields(httpResponse));
+            
+            for (int i = 0; i < numCommonHeaderFields; i++) {
+                CFStringRef value;
+                if (CFDictionaryGetValueIfPresent(headers.get(), commonHeaderFields[i], (const void **)&value))
+                    m_httpHeaderFields.set(commonHeaderFields[i], value);
+            }
+        } else
+            m_httpStatusCode = 0;
+    }
 
-        RetainPtr<CFStringRef> statusLine(AdoptCF, CFHTTPMessageCopyResponseStatusLine(httpResponse));
-        m_httpStatusText = extractReasonPhraseFromHTTPStatusLine(statusLine.get());
+    if (m_initLevel < AllFields && initLevel >= AllFields) {
+        CFHTTPMessageRef httpResponse = CFURLResponseGetHTTPResponse(m_cfResponse.get());
+        if (httpResponse) {
+            RetainPtr<CFStringRef> statusLine(AdoptCF, CFHTTPMessageCopyResponseStatusLine(httpResponse));
+            m_httpStatusText = extractReasonPhraseFromHTTPStatusLine(statusLine.get());
+
+            RetainPtr<CFDictionaryRef> headers(AdoptCF, CFHTTPMessageCopyAllHeaderFields(httpResponse));
+            CFIndex headerCount = CFDictionaryGetCount(headers.get());
+            Vector<const void*, 128> keys(headerCount);
+            Vector<const void*, 128> values(headerCount);
+            CFDictionaryGetKeysAndValues(headers.get(), keys.data(), values.data());
+            for (int i = 0; i < headerCount; ++i)
+                m_httpHeaderFields.set((CFStringRef)keys[i], (CFStringRef)values[i]);
+        }
+    }
 
-        RetainPtr<CFDictionaryRef> headers(AdoptCF, CFHTTPMessageCopyAllHeaderFields(httpResponse));
-        CFIndex headerCount = CFDictionaryGetCount(headers.get());
-        Vector<const void*, 128> keys(headerCount);
-        Vector<const void*, 128> values(headerCount);
-        CFDictionaryGetKeysAndValues(headers.get(), keys.data(), values.data());
-        for (int i = 0; i < headerCount; ++i)
-            m_httpHeaderFields.set((CFStringRef)keys[i], (CFStringRef)values[i]);
-    } else
-        m_httpStatusCode = 0;
+    m_initLevel = initLevel;
 }
-
+    
 bool ResourceResponse::platformCompare(const ResourceResponse& a, const ResourceResponse& b)
 {
     return CFEqual(a.cfURLResponse(), b.cfURLResponse());
diff --git a/Source/WebCore/platform/network/curl/ResourceHandleCurl.cpp b/Source/WebCore/platform/network/curl/ResourceHandleCurl.cpp
index 1d276aa..d982186 100644
--- a/Source/WebCore/platform/network/curl/ResourceHandleCurl.cpp
+++ b/Source/WebCore/platform/network/curl/ResourceHandleCurl.cpp
@@ -46,7 +46,7 @@ public:
     WebCoreSynchronousLoader();
 
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
+    virtual void didReceiveData(ResourceHandle*, const char*, int, int encodedDataLength);
     virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/);
     virtual void didFail(ResourceHandle*, const ResourceError&);
 
diff --git a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
index b2a89f0..c0a49d7 100644
--- a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -117,7 +117,7 @@ private:
     virtual bool shouldUseCredentialStorage(ResourceHandle*);
     virtual void didReceiveAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge&);
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int, int /*lengthReceived*/);
+    virtual void didReceiveData(ResourceHandle*, const char*, int, int /*encodedDataLength*/);
     virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/);
     virtual void didFail(ResourceHandle*, const ResourceError&);
 #if USE(PROTECTION_SPACE_AUTH_CALLBACK)
@@ -1127,7 +1127,7 @@ void WebCoreSynchronousLoaderClient::didReceiveResponse(ResourceHandle*, const R
     m_response = [response.nsURLResponse() copy];
 }
 
-void WebCoreSynchronousLoaderClient::didReceiveData(ResourceHandle*, const char* data, int length, int /*lengthReceived*/)
+void WebCoreSynchronousLoaderClient::didReceiveData(ResourceHandle*, const char* data, int length, int /*encodedDataLength*/)
 {
     if (!m_data)
         m_data = [[NSMutableData alloc] init];
diff --git a/Source/WebCore/platform/network/mac/ResourceRequestMac.mm b/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
index 8446782..d99e1b7 100644
--- a/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceRequestMac.mm
@@ -70,8 +70,8 @@ void ResourceRequest::doUpdateResourceRequest()
     m_allowCookies = [m_nsRequest.get() HTTPShouldHandleCookies];
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    if (isHTTPPipeliningEnabled() && !shouldForceHTTPPipeliningPriorityHigh())
-        m_priority = mapHTTPPipeliningPriorityToResourceLoadPriority(wkGetHTTPPipeliningPriority(m_nsRequest.get()));
+    if (ResourceRequest::httpPipeliningEnabled())
+        m_priority = toResourceLoadPriority(wkGetHTTPPipeliningPriority(m_nsRequest.get()));
 #endif
 
     NSDictionary *headers = [m_nsRequest.get() allHTTPHeaderFields];
@@ -120,10 +120,8 @@ void ResourceRequest::doUpdatePlatformRequest()
 #endif
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    if (isHTTPPipeliningEnabled()) {
-        int priority = mapResourceLoadPriorityToHTTPPipeliningPriority(m_priority);
-        wkSetHTTPPipeliningPriority(nsRequest, shouldForceHTTPPipeliningPriorityHigh() ? 2 : priority);
-    }
+    if (ResourceRequest::httpPipeliningEnabled())
+        wkSetHTTPPipeliningPriority(nsRequest, toHTTPPipeliningPriority(m_priority));
 #endif
 
     [nsRequest setCachePolicy:(NSURLRequestCachePolicy)cachePolicy()];
diff --git a/Source/WebCore/platform/network/mac/ResourceResponseMac.mm b/Source/WebCore/platform/network/mac/ResourceResponseMac.mm
index 58c3641..704592a 100644
--- a/Source/WebCore/platform/network/mac/ResourceResponseMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceResponseMac.mm
@@ -34,6 +34,7 @@
 #import <Foundation/Foundation.h>
 #import <wtf/StdLibExtras.h>
 #import <limits>
+#include <wtf/text/CString.h>
 
 @interface NSURLResponse (FoundationSecretsWebCoreKnowsAbout)
 - (NSTimeInterval)_calculatedExpiration;
@@ -45,6 +46,11 @@ typedef int NSInteger;
 
 namespace WebCore {
 
+static NSString* const commonHeaderFields[] = {
+    @"Age", @"Cache-Control", @"Date", @"Etag", @"Expires", @"Last-Modified", @"Pragma"
+};
+static const int numCommonHeaderFields = sizeof(commonHeaderFields) / sizeof(AtomicString*);
+
 NSURLResponse *ResourceResponse::nsURLResponse() const
 {
     if (!m_nsResponse && !m_isNull) {
@@ -61,48 +67,72 @@ NSURLResponse *ResourceResponse::nsURLResponse() const
     return m_nsResponse.get();
 }
 
-void ResourceResponse::platformLazyInit()
+void ResourceResponse::platformLazyInit(InitLevel initLevel)
 {
-    if (m_isUpToDate)
+    if (m_initLevel >= initLevel)
         return;
-    m_isUpToDate = true;
 
     if (m_isNull) {
         ASSERT(!m_nsResponse);
         return;
     }
-    
-    m_url = [m_nsResponse.get() URL];
-    m_mimeType = [m_nsResponse.get() MIMEType];
-    m_expectedContentLength = [m_nsResponse.get() expectedContentLength];
-    m_textEncodingName = [m_nsResponse.get() textEncodingName];
 
-    // Workaround for <rdar://problem/8757088>, can be removed once that is fixed.
-    unsigned textEncodingNameLength = m_textEncodingName.length();
-    if (textEncodingNameLength >= 2 && m_textEncodingName[0U] == '"' && m_textEncodingName[textEncodingNameLength - 1] == '"')
-        m_textEncodingName = m_textEncodingName.substring(1, textEncodingNameLength - 2);
+    if (m_initLevel < CommonFieldsOnly && initLevel >= CommonFieldsOnly) {
+        NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
 
-    m_suggestedFilename = [m_nsResponse.get() suggestedFilename];
-    
-    if ([m_nsResponse.get() isKindOfClass:[NSHTTPURLResponse class]]) {
-        NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)m_nsResponse.get();
+        m_httpHeaderFields.clear();
+        m_url = [m_nsResponse.get() URL];
+        m_mimeType = [m_nsResponse.get() MIMEType];
+        m_expectedContentLength = [m_nsResponse.get() expectedContentLength];
+        m_textEncodingName = [m_nsResponse.get() textEncodingName];
+
+        // Workaround for <rdar://problem/8757088>, can be removed once that is fixed.
+        unsigned textEncodingNameLength = m_textEncodingName.length();
+        if (textEncodingNameLength >= 2 && m_textEncodingName[0U] == '"' && m_textEncodingName[textEncodingNameLength - 1] == '"')
+            m_textEncodingName = m_textEncodingName.substring(1, textEncodingNameLength - 2);
+
+        m_suggestedFilename = [m_nsResponse.get() suggestedFilename];
+
+        if ([m_nsResponse.get() isKindOfClass:[NSHTTPURLResponse class]]) {
+            NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)m_nsResponse.get();
+
+            m_httpStatusCode = [httpResponse statusCode];
+
+            NSDictionary *headers = [httpResponse allHeaderFields];
+            
+            for (int i = 0; i < numCommonHeaderFields; i++) {
+                if (NSString* headerValue = [headers objectForKey:commonHeaderFields[i]])
+                    m_httpHeaderFields.set([commonHeaderFields[i] UTF8String], headerValue);
+            }
+        } else
+            m_httpStatusCode = 0;
         
-        m_httpStatusCode = [httpResponse statusCode];
+        [pool drain];
+    }
+
+    if (m_initLevel < AllFields && initLevel >= AllFields && [m_nsResponse.get() isKindOfClass:[NSHTTPURLResponse class]]) {
+        NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
+
+        NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)m_nsResponse.get();
 
         RetainPtr<NSString> httpStatusLine(AdoptNS, wkCopyNSURLResponseStatusLine(m_nsResponse.get()));
         if (httpStatusLine)
             m_httpStatusText = extractReasonPhraseFromHTTPStatusLine(httpStatusLine.get());
         else
             m_httpStatusText = "OK";
-        
+
         NSDictionary *headers = [httpResponse allHeaderFields];
         NSEnumerator *e = [headers keyEnumerator];
         while (NSString *name = [e nextObject])
             m_httpHeaderFields.set(name, [headers objectForKey:name]);
-    } else
-        m_httpStatusCode = 0;
+        
+        [pool drain];
+    }
+
+    m_initLevel = initLevel;
 }
 
+    
 bool ResourceResponse::platformCompare(const ResourceResponse& a, const ResourceResponse& b)
 {
     return a.nsURLResponse() == b.nsURLResponse();
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 6e63145..b27c8f4 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -149,13 +149,72 @@ bool FormDataIODevice::isSequential() const
     return true;
 }
 
-QNetworkReplyWrapper::QNetworkReplyWrapper(QNetworkReply* reply, QObject* parent)
+QNetworkReplyHandlerCallQueue::QNetworkReplyHandlerCallQueue(QNetworkReplyHandler* handler, bool deferSignals)
+    : m_replyHandler(handler)
+    , m_locks(0)
+    , m_deferSignals(deferSignals)
+    , m_flushing(false)
+{
+    Q_ASSERT(handler);
+}
+
+void QNetworkReplyHandlerCallQueue::push(EnqueuedCall method)
+{
+    m_enqueuedCalls.append(method);
+    flush();
+}
+
+void QNetworkReplyHandlerCallQueue::lock()
+{
+    ++m_locks;
+}
+
+void QNetworkReplyHandlerCallQueue::unlock()
+{
+    if (!m_locks)
+        return;
+
+    --m_locks;
+    flush();
+}
+
+void QNetworkReplyHandlerCallQueue::setDeferSignals(bool defer)
+{
+    m_deferSignals = defer;
+    flush();
+}
+
+void QNetworkReplyHandlerCallQueue::flush()
+{
+    if (m_flushing)
+        return;
+
+    m_flushing = true;
+
+    while (!m_deferSignals && !m_locks && !m_enqueuedCalls.isEmpty())
+        (m_replyHandler->*(m_enqueuedCalls.takeFirst()))();
+
+    m_flushing = false;
+}
+
+class QueueLocker {
+public:
+    QueueLocker(QNetworkReplyHandlerCallQueue* queue) : m_queue(queue) { m_queue->lock(); }
+    ~QueueLocker() { m_queue->unlock(); }
+private:
+    QNetworkReplyHandlerCallQueue* m_queue;
+};
+
+QNetworkReplyWrapper::QNetworkReplyWrapper(QNetworkReplyHandlerCallQueue* queue, QNetworkReply* reply, bool sniffMIMETypes, QObject* parent)
     : QObject(parent)
     , m_reply(reply)
+    , m_queue(queue)
+    , m_responseContainsData(false)
+    , m_sniffer(0)
+    , m_sniffMIMETypes(sniffMIMETypes)
 {
     Q_ASSERT(m_reply);
 
-    connect(m_reply, SIGNAL(metaDataChanged()), this, SLOT(receiveMetaData()));
     connect(m_reply, SIGNAL(readyRead()), this, SLOT(receiveMetaData()));
     connect(m_reply, SIGNAL(finished()), this, SLOT(receiveMetaData()));
 }
@@ -164,6 +223,7 @@ QNetworkReplyWrapper::~QNetworkReplyWrapper()
 {
     if (m_reply)
         m_reply->deleteLater();
+    m_queue->clear();
 }
 
 QNetworkReply* QNetworkReplyWrapper::release()
@@ -174,6 +234,8 @@ QNetworkReply* QNetworkReplyWrapper::release()
     resetConnections();
     QNetworkReply* reply = m_reply;
     m_reply = 0;
+    m_sniffer = 0;
+
     reply->setParent(0);
     return reply;
 }
@@ -190,43 +252,80 @@ void QNetworkReplyWrapper::receiveMetaData()
     // This slot is only used to receive the first signal from the QNetworkReply object.
     resetConnections();
 
+
+    WTF::String contentType = m_reply->header(QNetworkRequest::ContentTypeHeader).toString();
+    m_encoding = extractCharsetFromMediaType(contentType);
+    m_advertisedMIMEType = extractMIMETypeFromMediaType(contentType);
+
     m_redirectionTargetUrl = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (m_redirectionTargetUrl.isValid()) {
-        emit metaDataChanged();
-        emit finished();
+        QueueLocker lock(m_queue);
+        m_queue->push(&QNetworkReplyHandler::sendResponseIfNeeded);
+        m_queue->push(&QNetworkReplyHandler::finish);
         return;
     }
 
-    WTF::String contentType = m_reply->header(QNetworkRequest::ContentTypeHeader).toString();
-    m_encoding = extractCharsetFromMediaType(contentType);
-    m_advertisedMimeType = extractMIMETypeFromMediaType(contentType);
+    if (!m_sniffMIMETypes) {
+        emitMetaDataChanged();
+        return;
+    }
+
+    bool isSupportedImageType = MIMETypeRegistry::isSupportedImageMIMEType(m_advertisedMIMEType);
 
-    bool hasData = m_reply->bytesAvailable();
-    bool isFinished = m_reply->isFinished();
+    Q_ASSERT(!m_sniffer);
 
-    if (!isFinished) {
-        // If not finished, connect to the slots that will be used from this point on.
-        connect(m_reply, SIGNAL(readyRead()), this, SIGNAL(readyRead()));
-        connect(m_reply, SIGNAL(finished()), this, SLOT(didReceiveFinished()));
+    m_sniffer = new QtMIMETypeSniffer(m_reply, m_advertisedMIMEType, isSupportedImageType);
+
+    if (m_sniffer->isFinished()) {
+        receiveSniffedMIMEType();
+        return;
     }
 
-    emit metaDataChanged();
+    connect(m_sniffer.get(), SIGNAL(finished()), this, SLOT(receiveSniffedMIMEType()));
+}
+
+void QNetworkReplyWrapper::receiveSniffedMIMEType()
+{
+    Q_ASSERT(m_sniffer);
+
+    m_sniffedMIMEType = m_sniffer->mimeType();
+    m_sniffer = 0;
+
+    emitMetaDataChanged();
+}
 
-    if (hasData)
-        emit readyRead();
+void QNetworkReplyWrapper::emitMetaDataChanged()
+{
+    QueueLocker lock(m_queue);
+    m_queue->push(&QNetworkReplyHandler::sendResponseIfNeeded);
 
-    if (isFinished) {
-        emit finished();
+    if (m_reply->bytesAvailable()) {
+        m_responseContainsData = true;
+        m_queue->push(&QNetworkReplyHandler::forwardData);
+    }
+
+    if (m_reply->isFinished()) {
+        m_queue->push(&QNetworkReplyHandler::finish);
         return;
     }
 
+    // If not finished, connect to the slots that will be used from this point on.
+    connect(m_reply, SIGNAL(readyRead()), this, SLOT(didReceiveReadyRead()));
+    connect(m_reply, SIGNAL(finished()), this, SLOT(didReceiveFinished()));
+}
+
+void QNetworkReplyWrapper::didReceiveReadyRead()
+{
+    if (m_reply->bytesAvailable())
+        m_responseContainsData = true;
+    m_queue->push(&QNetworkReplyHandler::forwardData);
 }
 
 void QNetworkReplyWrapper::didReceiveFinished()
 {
     // Disconnecting will make sure that nothing will happen after emitting the finished signal.
     resetConnections();
-    emit finished();
+    m_queue->push(&QNetworkReplyHandler::finish);
 }
 
 String QNetworkReplyHandler::httpMethod() const
@@ -255,11 +354,9 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadType load
     , m_replyWrapper(0)
     , m_resourceHandle(handle)
     , m_loadType(loadType)
-    , m_deferred(deferred)
     , m_redirectionTries(gMaxRedirections)
+    , m_queue(this, deferred)
 {
-    resetState();
-
     const ResourceRequest &r = m_resourceHandle->firstRequest();
 
     if (r.httpMethod() == "GET")
@@ -281,52 +378,7 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadType load
 
     m_request = r.toNetworkRequest(originatingObject);
 
-    if (!m_deferred)
-        start();
-}
-
-void QNetworkReplyHandler::resetState()
-{
-    m_redirected = false;
-    m_responseSent = false;
-    m_responseContainsData = false;
-    m_hasStarted = false;
-    m_callFinishOnResume = false;
-    m_callSendResponseIfNeededOnResume = false;
-    m_callForwardDataOnResume = false;
-
-    if (m_replyWrapper) {
-        m_replyWrapper->deleteLater();
-        m_replyWrapper = 0;
-    }
-}
-
-void QNetworkReplyHandler::setLoadingDeferred(bool deferred)
-{
-    m_deferred = deferred;
-
-    if (!deferred)
-        resumeDeferredLoad();
-}
-
-void QNetworkReplyHandler::resumeDeferredLoad()
-{
-    if (!m_hasStarted) {
-        ASSERT(!m_callSendResponseIfNeededOnResume);
-        ASSERT(!m_callForwardDataOnResume);
-        ASSERT(!m_callFinishOnResume);
-        start();
-        return;
-    }
-
-    if (m_callSendResponseIfNeededOnResume)
-        sendResponseIfNeeded();
-
-    if (m_callForwardDataOnResume)
-        forwardData();
-
-    if (m_callFinishOnResume)
-        finish();
+    m_queue.push(&QNetworkReplyHandler::start);
 }
 
 void QNetworkReplyHandler::abort()
@@ -345,7 +397,6 @@ QNetworkReply* QNetworkReplyHandler::release()
         return 0;
 
     QNetworkReply* reply = m_replyWrapper->release();
-    m_replyWrapper->deleteLater();
     m_replyWrapper = 0;
     return reply;
 }
@@ -365,35 +416,21 @@ static bool shouldIgnoreHttpError(QNetworkReply* reply, bool receivedData)
 
 void QNetworkReplyHandler::finish()
 {
-    ASSERT(m_hasStarted);
-
-    m_callFinishOnResume = m_deferred;
-    if (m_deferred)
-        return;
-
-    if (!m_replyWrapper || !m_replyWrapper->reply())
-        return;
-
-
-    sendResponseIfNeeded();
-
-    if (wasAborted())
-        return;
+    ASSERT(m_replyWrapper && m_replyWrapper->reply() && !wasAborted());
 
     ResourceHandleClient* client = m_resourceHandle->client();
     if (!client) {
-        m_replyWrapper->deleteLater();
         m_replyWrapper = 0;
         return;
     }
 
-    if (m_redirected) {
-        resetState();
-        start();
+    if (m_replyWrapper->wasRedirected()) {
+        m_replyWrapper = 0;
+        m_queue.push(&QNetworkReplyHandler::start);
         return;
     }
 
-    if (!m_replyWrapper->reply()->error() || shouldIgnoreHttpError(m_replyWrapper->reply(), m_responseContainsData))
+    if (!m_replyWrapper->reply()->error() || shouldIgnoreHttpError(m_replyWrapper->reply(), m_replyWrapper->responseContainsData()))
         client->didFinishLoading(m_resourceHandle, 0);
     else {
         QUrl url = m_replyWrapper->reply()->url();
@@ -408,40 +445,21 @@ void QNetworkReplyHandler::finish()
         }
     }
 
-    if (m_replyWrapper) {
-        m_replyWrapper->deleteLater();
-        m_replyWrapper = 0;
-    }
+    m_replyWrapper = 0;
 }
 
 void QNetworkReplyHandler::sendResponseIfNeeded()
 {
-    ASSERT(m_hasStarted);
+    ASSERT(m_replyWrapper && m_replyWrapper->reply() && !wasAborted());
 
-    m_callSendResponseIfNeededOnResume = m_deferred;
-    if (m_deferred)
+    if (m_replyWrapper->reply()->error() && m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).isNull())
         return;
 
-    if (!m_replyWrapper || !m_replyWrapper->reply())
-        return;
-
-    if (m_replyWrapper->reply()->error() && !shouldIgnoreHttpError(m_replyWrapper->reply(), m_responseContainsData))
-        return;
-
-    if (wasAborted())
-        return;
-
-    if (m_responseSent)
-        return;
-    m_responseSent = true;
-
     ResourceHandleClient* client = m_resourceHandle->client();
     if (!client)
         return;
 
-    WTF::String contentType = m_replyWrapper->reply()->header(QNetworkRequest::ContentTypeHeader).toString();
-    WTF::String encoding = extractCharsetFromMediaType(contentType);
-    WTF::String mimeType = extractMIMETypeFromMediaType(contentType);
+    WTF::String mimeType = m_replyWrapper->mimeType();
 
     if (mimeType.isEmpty()) {
         // let's try to guess from the extension
@@ -451,7 +469,7 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     KURL url(m_replyWrapper->reply()->url());
     ResourceResponse response(url, mimeType.lower(),
                               m_replyWrapper->reply()->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
-                              encoding, String());
+                              m_replyWrapper->encoding(), String());
 
     if (url.isLocalFile()) {
         client->didReceiveResponse(m_resourceHandle, response);
@@ -501,9 +519,9 @@ void QNetworkReplyHandler::redirect(ResourceResponse& response, const QUrl& redi
                             newUrl.toString(),
                             QCoreApplication::translate("QWebPage", "Redirection limit reached"));
         client->didFail(m_resourceHandle, error);
+        m_replyWrapper = 0;
         return;
     }
-    m_redirected = true;
 
     //  Status Code 301 (Moved Permanently), 302 (Moved Temporarily), 303 (See Other):
     //    - If original request is POST convert to GET and redirect automatically
@@ -533,26 +551,7 @@ void QNetworkReplyHandler::redirect(ResourceResponse& response, const QUrl& redi
 
 void QNetworkReplyHandler::forwardData()
 {
-    ASSERT(m_hasStarted);
-
-    m_callForwardDataOnResume = m_deferred;
-    if (m_deferred)
-        return;
-
-    if (!m_replyWrapper || !m_replyWrapper->reply())
-        return;
-
-    if (m_replyWrapper->reply()->bytesAvailable())
-        m_responseContainsData = true;
-
-    sendResponseIfNeeded();
-
-    // don't emit the "Document has moved here" type of HTML
-    if (m_redirected)
-        return;
-
-    if (wasAborted())
-        return;
+    ASSERT(m_replyWrapper && m_replyWrapper->reply() && !wasAborted() && !m_replyWrapper->wasRedirected());
 
     QByteArray data = m_replyWrapper->reply()->read(m_replyWrapper->reply()->bytesAvailable());
 
@@ -579,17 +578,11 @@ void QNetworkReplyHandler::uploadProgress(qint64 bytesSent, qint64 bytesTotal)
     client->didSendData(m_resourceHandle, bytesSent, bytesTotal);
 }
 
-QNetworkReply* QNetworkReplyHandler::sendNetworkRequest()
+QNetworkReply* QNetworkReplyHandler::sendNetworkRequest(QNetworkAccessManager* manager, const ResourceRequest& request)
 {
     if (m_loadType == SynchronousLoad)
         m_request.setAttribute(gSynchronousNetworkRequestAttribute, true);
 
-    ResourceHandleInternal* d = m_resourceHandle->getInternal();
-
-    QNetworkAccessManager* manager = 0;
-    if (d->m_context)
-        manager = d->m_context->networkAccessManager();
-
     if (!manager)
         return 0;
 
@@ -606,7 +599,7 @@ QNetworkReply* QNetworkReplyHandler::sendNetworkRequest()
         case QNetworkAccessManager::GetOperation:
             return manager->get(m_request);
         case QNetworkAccessManager::PostOperation: {
-            FormDataIODevice* postDevice = new FormDataIODevice(d->m_firstRequest.httpBody());
+            FormDataIODevice* postDevice = new FormDataIODevice(request.httpBody());
             // We may be uploading files so prevent QNR from buffering data
             m_request.setHeader(QNetworkRequest::ContentLengthHeader, postDevice->getFormDataSize());
             m_request.setAttribute(QNetworkRequest::DoNotBufferUploadDataAttribute, QVariant(true));
@@ -617,7 +610,7 @@ QNetworkReply* QNetworkReplyHandler::sendNetworkRequest()
         case QNetworkAccessManager::HeadOperation:
             return manager->head(m_request);
         case QNetworkAccessManager::PutOperation: {
-            FormDataIODevice* putDevice = new FormDataIODevice(d->m_firstRequest.httpBody());
+            FormDataIODevice* putDevice = new FormDataIODevice(request.httpBody());
             // We may be uploading files so prevent QNR from buffering data
             m_request.setHeader(QNetworkRequest::ContentLengthHeader, putDevice->getFormDataSize());
             m_request.setAttribute(QNetworkRequest::DoNotBufferUploadDataAttribute, QVariant(true));
@@ -639,24 +632,22 @@ QNetworkReply* QNetworkReplyHandler::sendNetworkRequest()
 
 void QNetworkReplyHandler::start()
 {
-    ASSERT(!m_hasStarted);
-    m_hasStarted = true;
+    ResourceHandleInternal* d = m_resourceHandle->getInternal();
+    if (!d || !d->m_context)
+        return;
 
-    QNetworkReply* reply = sendNetworkRequest();
+    QNetworkReply* reply = sendNetworkRequest(d->m_context->networkAccessManager(), d->m_firstRequest);
     if (!reply)
         return;
 
-    m_replyWrapper = new QNetworkReplyWrapper(reply, this);
+    m_replyWrapper = new QNetworkReplyWrapper(&m_queue, reply, m_resourceHandle->shouldContentSniff() && d->m_context->mimeSniffingEnabled(), this);
 
     if (m_loadType == SynchronousLoad && m_replyWrapper->reply()->isFinished()) {
+        m_replyWrapper->synchronousLoad();
         // If supported, a synchronous request will be finished at this point, no need to hook up the signals.
         return;
     }
 
-    connect(m_replyWrapper, SIGNAL(finished()), this, SLOT(finish()));
-    connect(m_replyWrapper, SIGNAL(metaDataChanged()), this, SLOT(sendResponseIfNeeded()));
-    connect(m_replyWrapper, SIGNAL(readyRead()), this, SLOT(forwardData()));
-
     if (m_resourceHandle->firstRequest().reportUploadProgress())
         connect(m_replyWrapper->reply(), SIGNAL(uploadProgress(qint64, qint64)), this, SLOT(uploadProgress(qint64, qint64)));
 }
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 61694d6..ec4e65a 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -25,6 +25,7 @@
 #include <QNetworkAccessManager>
 
 #include "FormData.h"
+#include "QtMIMETypeSniffer.h"
 
 QT_BEGIN_NAMESPACE
 class QFile;
@@ -34,39 +35,73 @@ QT_END_NAMESPACE
 namespace WebCore {
 
 class ResourceHandle;
+class ResourceRequest;
 class ResourceResponse;
+class QNetworkReplyHandler;
+
+class QNetworkReplyHandlerCallQueue {
+public:
+    QNetworkReplyHandlerCallQueue(QNetworkReplyHandler*, bool deferSignals);
+    bool deferSignals() const { return m_deferSignals; }
+    void setDeferSignals(bool);
+
+    typedef void (QNetworkReplyHandler::*EnqueuedCall)();
+    void push(EnqueuedCall method);
+    void clear() { m_enqueuedCalls.clear(); }
+
+    void lock();
+    void unlock();
+private:
+    QNetworkReplyHandler* m_replyHandler;
+    int m_locks;
+    bool m_deferSignals;
+    bool m_flushing;
+    QList<EnqueuedCall> m_enqueuedCalls;
+
+    void flush();
+};
 
 class QNetworkReplyWrapper : public QObject {
     Q_OBJECT
 public:
-    QNetworkReplyWrapper(QNetworkReply*, QObject* parent = 0);
+    QNetworkReplyWrapper(QNetworkReplyHandlerCallQueue*, QNetworkReply*, bool sniffMIMETypes, QObject* parent = 0);
     ~QNetworkReplyWrapper();
 
     QNetworkReply* reply() const { return m_reply; }
     QNetworkReply* release();
 
+    void synchronousLoad() { receiveMetaData(); }
+
     QUrl redirectionTargetUrl() const { return m_redirectionTargetUrl; }
     QString encoding() const { return m_encoding; }
-    QString advertisedMimeType() const { return m_advertisedMimeType; }
+    QString advertisedMIMEType() const { return m_advertisedMIMEType; }
+    QString mimeType() const { return m_sniffedMIMEType.isEmpty() ? m_advertisedMIMEType : m_sniffedMIMEType; }
 
-Q_SIGNALS:
-    void finished();
-    void metaDataChanged();
-    void readyRead();
-    void uploadProgress(qint64 bytesSent, qint64 bytesTotal);
+    bool responseContainsData() const { return m_responseContainsData; }
+    bool wasRedirected() const { return m_redirectionTargetUrl.isValid(); }
 
 private Q_SLOTS:
     void receiveMetaData();
     void didReceiveFinished();
+    void didReceiveReadyRead();
+    void receiveSniffedMIMEType();
 
 private:
     void resetConnections();
+    void emitMetaDataChanged();
 
     QNetworkReply* m_reply;
     QUrl m_redirectionTargetUrl;
 
     QString m_encoding;
-    QString m_advertisedMimeType;
+    QNetworkReplyHandlerCallQueue* m_queue;
+    bool m_responseContainsData;
+
+    QString m_advertisedMIMEType;
+
+    QString m_sniffedMIMEType;
+    OwnPtr<QtMIMETypeSniffer> m_sniffer;
+    bool m_sniffMIMETypes;
 };
 
 class QNetworkReplyHandler : public QObject
@@ -79,7 +114,7 @@ public:
     };
 
     QNetworkReplyHandler(ResourceHandle*, LoadType, bool deferred = false);
-    void setLoadingDeferred(bool);
+    void setLoadingDeferred(bool deferred) { m_queue.setDeferSignals(deferred); }
 
     QNetworkReply* reply() const { return m_replyWrapper ? m_replyWrapper->reply() : 0; }
 
@@ -87,38 +122,30 @@ public:
 
     QNetworkReply* release();
 
-public slots:
     void finish();
-    void sendResponseIfNeeded();
     void forwardData();
+    void sendResponseIfNeeded();
+
+private slots:
     void uploadProgress(qint64 bytesSent, qint64 bytesTotal);
 
 private:
     void start();
-    void resetState();
     String httpMethod() const;
-    void resumeDeferredLoad();
     void redirect(ResourceResponse&, const QUrl&);
     bool wasAborted() const { return !m_resourceHandle; }
-    QNetworkReply* sendNetworkRequest();
+    QNetworkReply* sendNetworkRequest(QNetworkAccessManager*, const ResourceRequest&);
 
-    QNetworkReplyWrapper* m_replyWrapper;
+    OwnPtr<QNetworkReplyWrapper> m_replyWrapper;
     ResourceHandle* m_resourceHandle;
-    bool m_redirected;
-    bool m_responseSent;
-    bool m_responseContainsData;
     LoadType m_loadType;
     QNetworkAccessManager::Operation m_method;
     QNetworkRequest m_request;
 
-    bool m_deferred;
-
     // defer state holding
-    bool m_hasStarted;
-    bool m_callFinishOnResume;
-    bool m_callSendResponseIfNeededOnResume;
-    bool m_callForwardDataOnResume;
     int m_redirectionTries;
+
+    QNetworkReplyHandlerCallQueue m_queue;
 };
 
 // Self destructing QIODevice for FormData
diff --git a/Source/WebCore/platform/network/qt/QtMIMETypeSniffer.cpp b/Source/WebCore/platform/network/qt/QtMIMETypeSniffer.cpp
new file mode 100644
index 0000000..e719b80
--- /dev/null
+++ b/Source/WebCore/platform/network/qt/QtMIMETypeSniffer.cpp
@@ -0,0 +1,63 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "QtMIMETypeSniffer.h"
+
+#include "MIMESniffing.h"
+#include <QCoreApplication>
+#include <QNetworkReply>
+
+QtMIMETypeSniffer::QtMIMETypeSniffer(QNetworkReply* reply, const QString& advertisedMimeType, bool isSupportedImageType)
+    : QObject(0)
+    , m_reply(reply)
+    , m_mimeType(advertisedMimeType)
+    , m_sniffer(advertisedMimeType.toLatin1().constData(), isSupportedImageType)
+    , m_isFinished(false)
+{
+    m_isFinished = !m_sniffer.isValid() || sniff();
+    if (m_isFinished)
+        return;
+
+    connect(m_reply, SIGNAL(readyRead()), this, SLOT(trySniffing()));
+    connect(m_reply, SIGNAL(finished()), this, SLOT(trySniffing()));
+}
+
+bool QtMIMETypeSniffer::sniff()
+{
+    if (!m_reply->isFinished() && m_reply->bytesAvailable() < m_sniffer.dataSize())
+        return false;
+
+    QByteArray data = m_reply->peek(m_sniffer.dataSize());
+    const char* sniffedMimeType = m_sniffer.sniff(data.constData(), data.size());
+    if (sniffedMimeType)
+        m_mimeType = QString::fromLatin1(sniffedMimeType);
+    return true;
+}
+
+void QtMIMETypeSniffer::trySniffing()
+{
+    if (!sniff())
+        return;
+
+    m_reply->disconnect(this);
+    QCoreApplication::removePostedEvents(this, QEvent::MetaCall);
+    m_isFinished = true;
+    emit finished();
+}
diff --git a/Source/WebCore/platform/network/qt/QtMIMETypeSniffer.h b/Source/WebCore/platform/network/qt/QtMIMETypeSniffer.h
new file mode 100644
index 0000000..5424906
--- /dev/null
+++ b/Source/WebCore/platform/network/qt/QtMIMETypeSniffer.h
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef QtMIMETypeSniffer_h
+#define QtMIMETypeSniffer_h
+
+#include "MIMESniffing.h"
+#include <QObject>
+
+class QNetworkReply;
+
+class QtMIMETypeSniffer : public QObject {
+    Q_OBJECT
+public:
+    QtMIMETypeSniffer(QNetworkReply*, const QString& advertisedMimeType, bool isSupportedImageType);
+    QString mimeType() const { return m_mimeType; }
+    bool isFinished() const { return m_isFinished; }
+
+signals:
+    void finished();
+
+private slots:
+    void trySniffing();
+
+private:
+    bool sniff();
+
+    QNetworkReply* m_reply;
+    QString m_mimeType;
+    MIMESniffer m_sniffer;
+    bool m_isFinished;
+};
+
+#endif // QtMIMETypeSniffer_h
diff --git a/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp b/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
index a6da432..642d0a6 100644
--- a/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -53,62 +53,22 @@ namespace WebCore {
 
 class WebCoreSynchronousLoader : public ResourceHandleClient {
 public:
-    WebCoreSynchronousLoader();
-
-    void waitForCompletion();
-
-    virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
-    virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/);
-    virtual void didFail(ResourceHandle*, const ResourceError&);
-
-    ResourceResponse resourceResponse() const { return m_response; }
-    ResourceError resourceError() const { return m_error; }
-    Vector<char> data() const { return m_data; }
-
-    void setReplyFinished(bool finished) { m_replyFinished = finished; }
-
+    WebCoreSynchronousLoader(ResourceError& error, ResourceResponse& response, Vector<char>& data)
+        : m_error(error)
+        , m_response(response)
+        , m_data(data)
+    {}
+
+    virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse& response) { m_response = response; }
+    virtual void didReceiveData(ResourceHandle*, const char* data, int length, int) { m_data.append(data, length); }
+    virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/) {}
+    virtual void didFail(ResourceHandle*, const ResourceError& error) { m_error = error; }
 private:
-    ResourceResponse m_response;
-    ResourceError m_error;
-    Vector<char> m_data;
-    QEventLoop m_eventLoop;
-    bool m_replyFinished;
+    ResourceError& m_error;
+    ResourceResponse& m_response;
+    Vector<char>& m_data;
 };
 
-WebCoreSynchronousLoader::WebCoreSynchronousLoader()
-        : m_replyFinished(false)
-{
-}
-
-void WebCoreSynchronousLoader::didReceiveResponse(ResourceHandle*, const ResourceResponse& response)
-{
-    m_response = response;
-}
-
-void WebCoreSynchronousLoader::didReceiveData(ResourceHandle*, const char* data, int length, int)
-{
-    m_data.append(data, length);
-}
-
-void WebCoreSynchronousLoader::didFinishLoading(ResourceHandle*, double)
-{
-    if (!m_replyFinished)
-        m_eventLoop.exit();
-}
-
-void WebCoreSynchronousLoader::didFail(ResourceHandle*, const ResourceError& error)
-{
-    m_error = error;
-    if (!m_replyFinished)
-        m_eventLoop.exit();
-}
-
-void WebCoreSynchronousLoader::waitForCompletion()
-{
-    m_eventLoop.exec(QEventLoop::ExcludeUserInputEvents);
-}
-
 ResourceHandleInternal::~ResourceHandleInternal()
 {
 }
@@ -191,7 +151,7 @@ PassRefPtr<SharedBuffer> ResourceHandle::bufferedData()
 
 void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const ResourceRequest& request, StoredCredentials /*storedCredentials*/, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
-    WebCoreSynchronousLoader syncLoader;
+    WebCoreSynchronousLoader syncLoader(error, response, data);
     RefPtr<ResourceHandle> handle = adoptRef(new ResourceHandle(request, &syncLoader, true, false));
 
     ResourceHandleInternal* d = handle->getInternal();
@@ -204,20 +164,10 @@ void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const
         d->m_firstRequest.setURL(urlWithCredentials);
     }
     d->m_context = context;
-    d->m_job = new QNetworkReplyHandler(handle.get(), QNetworkReplyHandler::SynchronousLoad);
-
-    QNetworkReply* reply = d->m_job->reply();
-    // When using synchronous calls, we are finished when reaching this point.
-    if (reply->isFinished()) {
-        syncLoader.setReplyFinished(true);
-        d->m_job->forwardData();
-        d->m_job->finish();
-    } else
-        syncLoader.waitForCompletion();
-
-    error = syncLoader.resourceError();
-    data = syncLoader.data();
-    response = syncLoader.resourceResponse();
+
+    // starting in deferred mode gives d->m_job the chance of being set before sending the request.
+    d->m_job = new QNetworkReplyHandler(handle.get(), QNetworkReplyHandler::SynchronousLoad, true);
+    d->m_job->setLoadingDeferred(false);
 }
 
 void ResourceHandle::platformSetDefersLoading(bool defers)
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index e5da0e3..dc22fca 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -69,7 +69,7 @@ public:
     ~WebCoreSynchronousLoader();
 
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
+    virtual void didReceiveData(ResourceHandle*, const char*, int, int encodedDataLength);
     virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/);
     virtual void didFail(ResourceHandle*, const ResourceError&);
 
@@ -135,11 +135,6 @@ ResourceHandleInternal::~ResourceHandleInternal()
 {
     if (m_soupRequest)
         g_object_set_data(G_OBJECT(m_soupRequest.get()), "webkit-resource", 0);
-
-    if (m_idleHandler) {
-        g_source_remove(m_idleHandler);
-        m_idleHandler = 0;
-    }
 }
 
 ResourceHandle::~ResourceHandle()
diff --git a/Source/WebCore/platform/network/win/ResourceHandleWin.cpp b/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
index dc5adc8..3e596be 100644
--- a/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
+++ b/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
@@ -85,7 +85,7 @@ public:
     HINTERNET internetHandle() const { return m_internetHandle; }
 
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
+    virtual void didReceiveData(ResourceHandle*, const char*, int, int encodedDataLength);
     virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/);
     virtual void didFail(ResourceHandle*, const ResourceError&);
 
diff --git a/Source/WebCore/platform/qt/ClipboardQt.cpp b/Source/WebCore/platform/qt/ClipboardQt.cpp
index c14d362..723cdd4 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.cpp
+++ b/Source/WebCore/platform/qt/ClipboardQt.cpp
@@ -299,6 +299,7 @@ void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, co
 
     m_writableData->setText(title);
     m_writableData->setUrls(urls);
+    m_writableData->setHtml(createMarkup(element, IncludeNode, 0, AbsoluteURLs));
 #ifndef QT_NO_CLIPBOARD
     if (isForCopyAndPaste())
         QApplication::clipboard()->setMimeData(m_writableData);
diff --git a/Source/WebCore/platform/qt/QtMobileWebStyle.cpp b/Source/WebCore/platform/qt/QtMobileWebStyle.cpp
index 240faa5..6ca1817 100644
--- a/Source/WebCore/platform/qt/QtMobileWebStyle.cpp
+++ b/Source/WebCore/platform/qt/QtMobileWebStyle.cpp
@@ -34,12 +34,13 @@ static inline void drawRectangularControlBackground(QPainter* painter, const QPe
 {
     QPen oldPen = painter->pen();
     QBrush oldBrush = painter->brush();
+    painter->setRenderHint(QPainter::Antialiasing, true);
     painter->setPen(pen);
     painter->setBrush(brush);
 
     int line = 1;
-    painter->drawRect(rect.adjusted(line, line, -line, -line));
-
+    painter->drawRoundedRect(rect.adjusted(line, line, -line, -line),
+            /* xRadius */ 5.0, /* yRadious */ 5.0);
     painter->setPen(oldPen);
     painter->setBrush(oldBrush);
 }
@@ -71,8 +72,8 @@ QPixmap QtMobileWebStyle::findChecker(const QRect& rect, bool disabled) const
 {
     int size = qMin(rect.width(), rect.height());
     QPixmap result;
-    static const QString prefix = "$qt-maemo5-" + QLatin1String(metaObject()->className()) + "-checker-";
-    QString key = prefix + QString::number(size) + "-" + (disabled ? "disabled" : "enabled");
+    static const QString prefix = QLatin1String("$qt-maemo5-") + QLatin1String(metaObject()->className())+ QLatin1String("-checker-");
+    QString key = prefix + QString::number(size) + QLatin1String("-") + (disabled ? QLatin1String("disabled") : QLatin1String("enabled"));
     if (!QPixmapCache::find(key, result)) {
         result = QPixmap(size, size);
         result.fill(Qt::transparent);
@@ -87,8 +88,10 @@ void QtMobileWebStyle::drawRadio(QPainter* painter, const QSize& size, bool chec
 {
     painter->setRenderHint(QPainter::Antialiasing, true);
 
+    // get minor size to do not paint a wide elipse
+    qreal squareSize = qMin(size.width(), size.height());
     // deflate one pixel
-    QRect rect = QRect(QPoint(1, 1), QSize(size.width() - 2, size.height() - 2));
+    QRect rect = QRect(QPoint(1, 1), QSize(squareSize - 2, squareSize - 2));
     const QPoint centerGradient(rect.bottomRight() * 0.7);
 
     QRadialGradient radialGradient(centerGradient, centerGradient.x() - 1);
@@ -115,9 +118,9 @@ void QtMobileWebStyle::drawRadio(QPainter* painter, const QSize& size, bool chec
 QPixmap QtMobileWebStyle::findRadio(const QSize& size, bool checked, bool disabled) const
 {
     QPixmap result;
-    static const QString prefix = "$qt-maemo5-" + QLatin1String(metaObject()->className()) + "-radio-";
-    QString key = prefix + QString::number(size.width()) + "-" + QString::number(size.height()) +
-                   + "-" + (disabled ? "disabled" : "enabled") + (checked ? "-checked" : "");
+    static const QString prefix = QLatin1String("$qt-maemo5-") + QLatin1String(metaObject()->className()) + QLatin1String("-radio-");
+    QString key = prefix + QString::number(size.width()) + QLatin1String("-") + QString::number(size.height()) + QLatin1String("-")
+        + (disabled ? QLatin1String("disabled") : QLatin1String("enabled")) + (checked ? QLatin1String("-checked") : QLatin1String(""));
     if (!QPixmapCache::find(key, result)) {
         result = QPixmap(size);
         result.fill(Qt::transparent);
@@ -144,7 +147,9 @@ void QtMobileWebStyle::drawControl(ControlElement element, const QStyleOption* o
             linearGradient.setColorAt(0.5, Qt::white);
         }
 
-        drawRectangularControlBackground(painter, QPen(disabled ? Qt::lightGray : Qt::darkGray), rect, linearGradient);
+        painter->setPen(QPen(disabled ? Qt::lightGray : Qt::darkGray));
+        painter->setBrush(linearGradient);
+        painter->drawRect(rect);
         rect.adjust(1, 1, -1, -1);
 
         if (option->state & State_Off)
@@ -167,10 +172,75 @@ void QtMobileWebStyle::drawControl(ControlElement element, const QStyleOption* o
         painter->drawPixmap(option->rect.x(), option->rect.y(), radio);
         break;
     }
+    case CE_PushButton: {
+        const bool disabled = !(option->state & State_Enabled);
+        QRect rect = option->rect;
+        QPen pen(Qt::darkGray, 1.0, Qt::SolidLine, Qt::RoundCap, Qt::RoundJoin);
+        painter->setPen(pen);
+
+        const bool sunken = (option->state & State_Sunken);
+        if (sunken) {
+            drawRectangularControlBackground(painter, pen, rect, QBrush(Qt::darkGray));
+            break;
+        }
+
+        QLinearGradient linearGradient;
+        if (disabled) {
+            linearGradient.setStart(rect.bottomLeft());
+            linearGradient.setFinalStop(rect.topLeft());
+            linearGradient.setColorAt(0.0, Qt::gray);
+            linearGradient.setColorAt(1.0, Qt::white);
+        } else {
+            linearGradient.setStart(rect.bottomLeft());
+            linearGradient.setFinalStop(QPoint(rect.bottomLeft().x(),
+                        rect.bottomLeft().y() - /* offset limit for gradient */ 20));
+            linearGradient.setColorAt(0.0, Qt::gray);
+            linearGradient.setColorAt(0.4, Qt::white);
+        }
+
+        drawRectangularControlBackground(painter, pen, rect, linearGradient);
+        break;
+    }
     default:
         QWindowsStyle::drawControl(element, option, painter, widget);
     }
 }
+void QtMobileWebStyle::drawPrimitive(PrimitiveElement element, const QStyleOption* option, QPainter* painter, const QWidget* widget) const
+{
+    switch (element) {
+    case QStyle::PE_PanelLineEdit: {
+        const bool disabled = !(option->state & State_Enabled);
+        const bool sunken = (option->state & State_Sunken);
+        QRect rect = option->rect;
+        QPen pen(Qt::darkGray, 1.0, Qt::SolidLine, Qt::RoundCap, Qt::RoundJoin);
+        painter->setPen(pen);
+
+        if (sunken) {
+            drawRectangularControlBackground(painter, pen, rect, QBrush(Qt::darkGray));
+            break;
+        }
+
+        QLinearGradient linearGradient;
+        if (disabled) {
+            linearGradient.setStart(rect.topLeft());
+            linearGradient.setFinalStop(rect.bottomLeft());
+            linearGradient.setColorAt(0.0, Qt::lightGray);
+            linearGradient.setColorAt(1.0, Qt::white);
+        } else {
+            linearGradient.setStart(rect.topLeft());
+            linearGradient.setFinalStop(QPoint(rect.topLeft().x(),
+                        rect.topLeft().y() + /* offset limit for gradient */ 20));
+            linearGradient.setColorAt(0.0, Qt::darkGray);
+            linearGradient.setColorAt(0.35, Qt::white);
+        }
+
+        drawRectangularControlBackground(painter, pen, rect, linearGradient);
+        break;
+    }
+    default:
+        QWindowsStyle::drawPrimitive(element, option, painter, widget);
+    }
+}
 
 void QtMobileWebStyle::drawMultipleComboButton(QPainter* painter, const QSize& size, QColor color) const
 {
@@ -230,10 +300,10 @@ QPixmap QtMobileWebStyle::findComboButton(const QSize& size, bool multiple, bool
 
     if (imageSize.isNull())
         return QPixmap();
-    static const QString prefix = "$qt-maemo5-" + QLatin1String(metaObject()->className()) + "-combo-";
-    QString key = prefix + (multiple ? "multiple-" : "simple-") +
-                  QString::number(imageSize.width()) + "-" + QString::number(imageSize.height()) +
-                   + "-" + (disabled ? "disabled" : "enabled");
+    static const QString prefix = QLatin1String("$qt-maemo5-") + QLatin1String(metaObject()->className()) + QLatin1String("-combo-");
+    QString key = prefix + (multiple ? QLatin1String("multiple-") : QLatin1String("simple-"))
+        + QString::number(imageSize.width()) + QLatin1String("-") + QString::number(imageSize.height())
+        + QLatin1String("-") + (disabled ? QLatin1String("disabled") : QLatin1String("enabled"));
     if (!QPixmapCache::find(key, result)) {
         result = QPixmap(imageSize);
         result.fill(Qt::transparent);
@@ -251,7 +321,6 @@ void QtMobileWebStyle::drawComplexControl(ComplexControl control, const QStyleOp
 {
     switch (control) {
     case CC_ComboBox: {
-
         bool multiple = false;
         const bool disabled = !(option->state & State_Enabled);
 
@@ -272,7 +341,25 @@ void QtMobileWebStyle::drawComplexControl(ComplexControl control, const QStyleOp
         if (!(cmb->subControls & SC_ComboBoxArrow))
             break;
 
-        QRect rect = subControlRect(CC_ComboBox, cmb, SC_ComboBoxArrow, widget);
+        QRect rect = option->rect;
+        QPen pen(Qt::darkGray, 1.0, Qt::SolidLine, Qt::RoundCap, Qt::RoundJoin);
+        QLinearGradient linearGradient;
+        if (disabled) {
+            linearGradient.setStart(rect.bottomLeft());
+            linearGradient.setFinalStop(rect.topLeft());
+            linearGradient.setColorAt(0.0, Qt::gray);
+            linearGradient.setColorAt(1.0, Qt::white);
+        } else {
+            linearGradient.setStart(rect.bottomLeft());
+            linearGradient.setFinalStop(QPoint(rect.bottomLeft().x(),
+                        rect.bottomLeft().y() - /* offset limit for gradient */ 20));
+            linearGradient.setColorAt(0.0, Qt::gray);
+            linearGradient.setColorAt(0.4, Qt::white);
+        }
+
+        drawRectangularControlBackground(painter, pen, rect, linearGradient);
+
+        rect = subControlRect(CC_ComboBox, cmb, SC_ComboBoxArrow, widget);
         QPixmap pic = findComboButton(rect.size(), multiple, disabled);
 
         if (pic.isNull())
@@ -291,3 +378,4 @@ void QtMobileWebStyle::drawComplexControl(ComplexControl control, const QStyleOp
         QWindowsStyle::drawComplexControl(control, option, painter, widget);
     }
 }
+
diff --git a/Source/WebCore/platform/qt/QtMobileWebStyle.h b/Source/WebCore/platform/qt/QtMobileWebStyle.h
index 779bd26..1b99d2b 100644
--- a/Source/WebCore/platform/qt/QtMobileWebStyle.h
+++ b/Source/WebCore/platform/qt/QtMobileWebStyle.h
@@ -27,8 +27,9 @@ class QtMobileWebStyle : public QWindowsStyle {
 public:
     QtMobileWebStyle();
 
-    void drawControl(ControlElement element, const QStyleOption* option, QPainter* painter, const QWidget* widget = 0) const;
-    void drawComplexControl(ComplexControl cc, const QStyleOptionComplex* option, QPainter* painter, const QWidget* widget = 0) const;
+    void drawControl(ControlElement, const QStyleOption*, QPainter*, const QWidget*) const;
+    void drawComplexControl(ComplexControl, const QStyleOptionComplex*, QPainter*, const QWidget*) const;
+    void drawPrimitive(PrimitiveElement, const QStyleOption*, QPainter*, const QWidget*) const;
 
 private:
     void drawChecker(QPainter* painter, int size, QColor color) const;
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index cc654d5..8cb59c1 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -46,6 +46,9 @@
 #if USE(QT_MOBILE_THEME)
 #include "QtMobileWebStyle.h"
 #endif
+#if ENABLE(VIDEO)
+#include "MediaControlElements.h"
+#endif
 #include "NotImplemented.h"
 #include "PaintInfo.h"
 #include "Page.h"
@@ -78,7 +81,6 @@
 #include <QStyleOptionSlider>
 #include <QWidget>
 
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -105,6 +107,16 @@ static const float minSearchFieldResultsDecorationSize = 9;
 static const float maxSearchFieldResultsDecorationSize = 30;
 static const float defaultSearchFieldResultsButtonWidth = 18;
 
+#if USE(QT_MOBILE_THEME)
+namespace {
+    float buttonPaddingLeft = 18;
+    float buttonPaddingRight = 18;
+    float buttonPaddingTop = 2;
+    float buttonPaddingBottom = 3;
+    float menuListPadding = 9;
+    float textFieldPadding = 5;
+}
+#endif
 
 StylePainter::StylePainter(RenderThemeQt* theme, const PaintInfo& paintInfo)
 {
@@ -198,10 +210,13 @@ bool RenderThemeQt::isControlStyled(const RenderStyle* style, const BorderData&
     case PushButtonPart:
     case ButtonPart:
     case MenulistPart:
-    // FIXME: Need to add SearchFieldPart if it should be style-able.
+    case SearchFieldPart:
     case TextFieldPart:
     case TextAreaPart:
-        return true;
+        // Test the style to see if the UA border and background match.
+        return (style->border() != border
+                || *style->backgroundLayers() != fill
+                || style->visitedDependentColor(CSSPropertyBackgroundColor) != backgroundColor);
     case CheckboxPart:
     case RadioPart:
         return false;
@@ -258,9 +273,6 @@ String RenderThemeQt::extraDefaultStyleSheet()
 #if ENABLE(NO_LISTBOX_RENDERING)
     result += String(themeQtNoListboxesUserAgentStyleSheet, sizeof(themeQtNoListboxesUserAgentStyleSheet));
 #endif
-#if USE(QT_MOBILE_THEME)
-    result += String(themeQtMobileUserAgentStyleSheet, sizeof(themeQtMobileUserAgentStyleSheet));
-#endif
     return result;
 }
 
@@ -448,7 +460,6 @@ void RenderThemeQt::computeSizeBasedOnStyle(RenderStyle* renderStyle) const
     case SearchFieldPart:
     case TextFieldPart: {
         int padding = findFrameLineWidth(style);
-
         renderStyle->setPaddingLeft(Length(padding, Fixed));
         renderStyle->setPaddingRight(Length(padding, Fixed));
         renderStyle->setPaddingTop(Length(padding, Fixed));
@@ -458,7 +469,6 @@ void RenderThemeQt::computeSizeBasedOnStyle(RenderStyle* renderStyle) const
     default:
         break;
     }
-
     // If the width and height are both specified, then we have nothing to do.
     if (!renderStyle->width().isIntrinsicOrAuto() && !renderStyle->height().isAuto())
         return;
@@ -480,6 +490,7 @@ void RenderThemeQt::computeSizeBasedOnStyle(RenderStyle* renderStyle) const
         size = QSize(radioWidth, radioWidth);
         break;
     }
+#if !USE(QT_MOBILE_THEME)
     case PushButtonPart:
     case ButtonPart: {
         QStyleOptionButton styleOption;
@@ -509,6 +520,7 @@ void RenderThemeQt::computeSizeBasedOnStyle(RenderStyle* renderStyle) const
         size.setHeight(menuListSize.height());
         break;
     }
+#endif
     default:
         break;
     }
@@ -564,13 +576,14 @@ void RenderThemeQt::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* s
     fontDescription.setComputedSize(style->fontSize());
 #endif
 
+#if !USE(QT_MOBILE_THEME)
     FontFamily fontFamily;
     fontFamily.setFamily(m_buttonFontFamily);
     fontDescription.setFamily(fontFamily);
     style->setFontDescription(fontDescription);
     style->font().update(selector->fontSelector());
+#endif
     style->setLineHeight(RenderStyle::initialLineHeight());
-
     setButtonSize(style);
     setButtonPadding(style);
 }
@@ -580,6 +593,7 @@ void RenderThemeQt::setButtonSize(RenderStyle* style) const
     computeSizeBasedOnStyle(style);
 }
 
+#if !USE(QT_MOBILE_THEME)
 void RenderThemeQt::setButtonPadding(RenderStyle* style) const
 {
     QStyleOptionButton styleOption;
@@ -609,12 +623,22 @@ void RenderThemeQt::setButtonPadding(RenderStyle* style) const
         // Can't use this right now because we don't have the baseline to compensate
         // paddingBottom = layoutRect.bottom() - contentsRect.bottom();
     }
-
     style->setPaddingLeft(Length(paddingLeft, Fixed));
     style->setPaddingRight(Length(paddingRight, Fixed));
     style->setPaddingTop(Length(paddingTop, Fixed));
     style->setPaddingBottom(Length(paddingBottom, Fixed));
 }
+#else
+void RenderThemeQt::setButtonPadding(RenderStyle* style) const
+{
+    if (!style)
+        return;
+    style->setPaddingLeft(Length(buttonPaddingLeft, Fixed));
+    style->setPaddingRight(Length(buttonPaddingRight, Fixed));
+    style->setPaddingTop(Length(buttonPaddingTop, Fixed));
+    style->setPaddingBottom(Length(buttonPaddingBottom, Fixed));
+}
+#endif
 
 bool RenderThemeQt::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
@@ -650,6 +674,10 @@ void RenderThemeQt::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style,
     style->resetBorder();
     style->resetPadding();
     computeSizeBasedOnStyle(style);
+#if USE(QT_MOBILE_THEME)
+    style->setPaddingLeft(Length(textFieldPadding, Fixed));
+    style->setPaddingRight(Length(textFieldPadding, Fixed));
+#endif
 }
 
 bool RenderThemeQt::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& r)
@@ -662,7 +690,12 @@ bool RenderThemeQt::paintTextField(RenderObject* o, const PaintInfo& i, const In
     initStyleOption(p.widget, panel);
     panel.rect = r;
     panel.lineWidth = findFrameLineWidth(qStyle());
+#if USE(QT_MOBILE_THEME)
+    if (isPressed(o))
+        panel.state |= QStyle::State_Sunken;
+#else
     panel.state |= QStyle::State_Sunken;
+#endif
     panel.features = QStyleOptionFrameV2::None;
 
     // Get the correct theme data for a text field
@@ -675,7 +708,6 @@ bool RenderThemeQt::paintTextField(RenderObject* o, const PaintInfo& i, const In
 
     // Now paint the text field.
     p.drawPrimitive(QStyle::PE_PanelLineEdit, panel);
-
     return false;
 }
 
@@ -703,6 +735,9 @@ void RenderThemeQt::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, E
 
     // Add in the padding that we'd like to use.
     setPopupPadding(style);
+#if USE(QT_MOBILE_THEME)
+    style->setPaddingLeft(Length(menuListPadding, Fixed));
+#endif
 }
 
 void RenderThemeQt::setPopupPadding(RenderStyle* style) const
@@ -1076,9 +1111,6 @@ ControlPart RenderThemeQt::initializeCommonQStyleOptions(QStyleOption& option, R
     // Default bits: no focus, no mouse over
     option.state &= ~(QStyle::State_HasFocus | QStyle::State_MouseOver);
 
-    if (!isEnabled(o))
-        option.state &= ~QStyle::State_Enabled;
-
     if (isReadOnlyControl(o))
         // Readonly is supported on textfields.
         option.state |= QStyle::State_ReadOnly;
@@ -1089,6 +1121,12 @@ ControlPart RenderThemeQt::initializeCommonQStyleOptions(QStyleOption& option, R
         option.state |= QStyle::State_MouseOver;
 
     setPaletteFromPageClientIfExists(option.palette);
+
+    if (!isEnabled(o)) {
+        option.palette.setCurrentColorGroup(QPalette::Disabled);
+        option.state &= ~QStyle::State_Enabled;
+    }
+
     RenderStyle* style = o->style();
     if (!style)
         return NoControlPart;
@@ -1156,16 +1194,6 @@ private:
     QTransform m_originalTransform;
 };
 
-HTMLMediaElement* RenderThemeQt::getMediaElementFromRenderObject(RenderObject* o) const
-{
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-
 double RenderThemeQt::mediaControlsBaselineOpacity() const
 {
     return 0.4;
@@ -1189,7 +1217,7 @@ QColor RenderThemeQt::getMediaControlForegroundColor(RenderObject* o) const
 
 bool RenderThemeQt::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
-    HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
+    HTMLMediaElement* mediaElement = toParentMediaElement(o);
     if (!mediaElement)
         return false;
 
@@ -1213,7 +1241,7 @@ bool RenderThemeQt::paintMediaFullscreenButton(RenderObject* o, const PaintInfo&
 
 bool RenderThemeQt::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
-    HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
+    HTMLMediaElement* mediaElement = toParentMediaElement(o);
     if (!mediaElement)
         return false;
 
@@ -1237,7 +1265,7 @@ bool RenderThemeQt::paintMediaMuteButton(RenderObject* o, const PaintInfo& paint
 
 bool RenderThemeQt::paintMediaPlayButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
-    HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
+    HTMLMediaElement* mediaElement = toParentMediaElement(o);
     if (!mediaElement)
         return false;
 
@@ -1356,7 +1384,7 @@ bool RenderThemeQt::paintMediaVolumeSliderThumb(RenderObject *o, const PaintInfo
 
 bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
-    HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
+    HTMLMediaElement* mediaElement = toParentMediaElement(o);
     if (!mediaElement)
         return false;
 
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.h b/Source/WebCore/platform/qt/RenderThemeQt.h
index 6981641..b436a03 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.h
+++ b/Source/WebCore/platform/qt/RenderThemeQt.h
@@ -158,8 +158,8 @@ protected:
     virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     virtual String formatMediaControlsCurrentTime(float currentTime, float duration) const;
     virtual String formatMediaControlsRemainingTime(float currentTime, float duration) const;
+    virtual bool hasOwnDisabledStateHandlingFor(ControlPart) const { return true; }
 private:
-    HTMLMediaElement* getMediaElementFromRenderObject(RenderObject* o) const;
     void paintMediaBackground(QPainter* painter, const IntRect& r) const;
     double mediaControlsBaselineOpacity() const;
     QColor getMediaControlForegroundColor(RenderObject* o = 0) const;
diff --git a/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp b/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
index 67226b0..079c676 100644
--- a/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
+++ b/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
@@ -110,8 +110,12 @@ static QStyleOptionSlider* styleOptionSlider(Scrollbar* scrollbar, QWidget* widg
     if (scrollbar->controlSize() != RegularScrollbar)
         opt.state |= QStyle::State_Mini;
     opt.orientation = (scrollbar->orientation() == VerticalScrollbar) ? Qt::Vertical : Qt::Horizontal;
+
     if (scrollbar->orientation() == HorizontalScrollbar)
         opt.state |= QStyle::State_Horizontal;
+    else
+        opt.state &= ~QStyle::State_Horizontal;
+
     opt.sliderValue = scrollbar->value();
     opt.sliderPosition = opt.sliderValue;
     opt.pageStep = scrollbar->pageStep();
@@ -190,6 +194,9 @@ void ScrollbarThemeQt::invalidatePart(Scrollbar* scrollbar, ScrollbarPart)
 
 int ScrollbarThemeQt::scrollbarThickness(ScrollbarControlSize controlSize)
 {
+#if USE(QT_MOBILE_THEME)
+    return 0;
+#endif
     QStyleOptionSlider o;
     o.orientation = Qt::Vertical;
     o.state &= ~QStyle::State_Horizontal;
diff --git a/Source/WebCore/platform/text/BidiResolver.h b/Source/WebCore/platform/text/BidiResolver.h
index 5b92ee2..c6efdd8 100644
--- a/Source/WebCore/platform/text/BidiResolver.h
+++ b/Source/WebCore/platform/text/BidiResolver.h
@@ -23,6 +23,7 @@
 #define BidiResolver_h
 
 #include "BidiContext.h"
+#include "BidiRunList.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
@@ -147,17 +148,15 @@ enum VisualDirectionOverride {
     VisualRightToLeftOverride
 };
 
+// BidiResolver is WebKit's implementation of the Unicode Bidi Algorithm
+// http://unicode.org/reports/tr9
 template <class Iterator, class Run> class BidiResolver {
     WTF_MAKE_NONCOPYABLE(BidiResolver);
 public:
     BidiResolver()
         : m_direction(WTF::Unicode::OtherNeutral)
         , m_reachedEndOfLine(false)
-        , emptyRun(true)
-        , m_firstRun(0)
-        , m_lastRun(0)
-        , m_logicallyLastRun(0)
-        , m_runCount(0)
+        , m_emptyRun(true)
     {
     }
 
@@ -186,22 +185,16 @@ public:
 
     void createBidiRunsForLine(const Iterator& end, VisualDirectionOverride = NoVisualOverride, bool hardLineBreak = false);
 
-    Run* firstRun() const { return m_firstRun; }
-    Run* lastRun() const { return m_lastRun; }
-    Run* logicallyLastRun() const { return m_logicallyLastRun; }
-    unsigned runCount() const { return m_runCount; }
+    BidiRunList<Run>& runs() { return m_runs; }
 
-    void addRun(Run*);
-    void prependRun(Run*);
-
-    void moveRunToEnd(Run*);
-    void moveRunToBeginning(Run*);
-
-    void deleteRuns();
+    // FIXME: This used to be part of deleteRuns() but was a layering violation.
+    // It's unclear if this is still needed.
+    void markCurrentRunEmpty() { m_emptyRun = true; }
 
 protected:
+    // FIXME: Instead of InlineBidiResolvers subclassing this method, we should
+    // pass in some sort of Traits object which knows how to create runs for appending.
     void appendRun();
-    void reverseRuns(unsigned start, unsigned end);
 
     Iterator m_current;
     // sor and eor are "start of run" and "end of run" respectively and correpond
@@ -213,13 +206,13 @@ protected:
     WTF::Unicode::Direction m_direction;
     Iterator endOfLine;
     bool m_reachedEndOfLine;
-    Iterator lastBeforeET;
-    bool emptyRun;
+    Iterator m_lastBeforeET; // Before a EuropeanNumberTerminator
+    bool m_emptyRun;
+
+    // FIXME: This should not belong to the resolver, but rather be passed
+    // into createBidiRunsForLine by the caller.
+    BidiRunList<Run> m_runs;
 
-    Run* m_firstRun;
-    Run* m_lastRun;
-    Run* m_logicallyLastRun;
-    unsigned m_runCount;
     MidpointState<Iterator> m_midpointState;
 
 private:
@@ -234,79 +227,9 @@ private:
 };
 
 template <class Iterator, class Run>
-inline void BidiResolver<Iterator, Run>::addRun(Run* run)
-{
-    if (!m_firstRun)
-        m_firstRun = run;
-    else
-        m_lastRun->m_next = run;
-    m_lastRun = run;
-    m_runCount++;
-}
-
-template <class Iterator, class Run>
-inline void BidiResolver<Iterator, Run>::prependRun(Run* run)
-{
-    ASSERT(!run->m_next);
-
-    if (!m_lastRun)
-        m_lastRun = run;
-    else
-        run->m_next = m_firstRun;
-    m_firstRun = run;
-    m_runCount++;
-}
-
-template <class Iterator, class Run>
-inline void BidiResolver<Iterator, Run>::moveRunToEnd(Run* run)
-{
-    ASSERT(m_firstRun);
-    ASSERT(m_lastRun);
-    ASSERT(run->m_next);
-
-    Run* current = 0;
-    Run* next = m_firstRun;
-    while (next != run) {
-        current = next;
-        next = current->next();
-    }
-
-    if (!current)
-        m_firstRun = run->next();
-    else
-        current->m_next = run->m_next;
-
-    run->m_next = 0;
-    m_lastRun->m_next = run;
-    m_lastRun = run;
-}
-
-template <class Iterator, class Run>
-inline void BidiResolver<Iterator, Run>::moveRunToBeginning(Run* run)
-{
-    ASSERT(m_firstRun);
-    ASSERT(m_lastRun);
-    ASSERT(run != m_firstRun);
-
-    Run* current = m_firstRun;
-    Run* next = current->next();
-    while (next != run) {
-        current = next;
-        next = current->next();
-    }
-
-    current->m_next = run->m_next;
-    if (run == m_lastRun)
-        m_lastRun = current;
-
-    run->m_next = m_firstRun;
-    m_firstRun = run;
-}
-
-template <class Iterator, class Run>
 void BidiResolver<Iterator, Run>::appendRun()
 {
-    if (!emptyRun && !m_eor.atEnd()) {
+    if (!m_emptyRun && !m_eor.atEnd()) {
         unsigned startOffset = m_sor.offset();
         unsigned endOffset = m_eor.offset();
 
@@ -316,7 +239,7 @@ void BidiResolver<Iterator, Run>::appendRun()
         }
 
         if (endOffset >= startOffset)
-            addRun(new Run(startOffset, endOffset + 1, context(), m_direction));
+            m_runs.addRun(new Run(startOffset, endOffset + 1, context(), m_direction));
 
         m_eor.increment();
         m_sor = m_eor;
@@ -357,7 +280,7 @@ void BidiResolver<Iterator, Run>::lowerExplicitEmbeddingLevel(WTF::Unicode::Dire
 {
     using namespace WTF::Unicode;
 
-    if (!emptyRun && m_eor != m_last) {
+    if (!m_emptyRun && m_eor != m_last) {
         checkDirectionInLowerRaiseEmbeddingLevel();
         // bidi.sor ... bidi.eor ... bidi.last eor; need to append the bidi.sor-bidi.eor run or extend it through bidi.last
         if (from == LeftToRight) {
@@ -380,8 +303,10 @@ void BidiResolver<Iterator, Run>::lowerExplicitEmbeddingLevel(WTF::Unicode::Dire
         }
         m_eor = m_last;
     }
+
     appendRun();
-    emptyRun = true;
+    m_emptyRun = true;
+
     // sor for the new run is determined by the higher level (rule X10)
     setLastDir(from);
     setLastStrongDir(from);
@@ -393,7 +318,7 @@ void BidiResolver<Iterator, Run>::raiseExplicitEmbeddingLevel(WTF::Unicode::Dire
 {
     using namespace WTF::Unicode;
 
-    if (!emptyRun && m_eor != m_last) {
+    if (!m_emptyRun && m_eor != m_last) {
         checkDirectionInLowerRaiseEmbeddingLevel();
         // bidi.sor ... bidi.eor ... bidi.last eor; need to append the bidi.sor-bidi.eor run or extend it through bidi.last
         if (to == LeftToRight) {
@@ -418,8 +343,10 @@ void BidiResolver<Iterator, Run>::raiseExplicitEmbeddingLevel(WTF::Unicode::Dire
         }
         m_eor = m_last;
     }
+
     appendRun();
-    emptyRun = true;
+    m_emptyRun = true;
+
     setLastDir(to);
     setLastStrongDir(to);
     m_eor = Iterator();
@@ -466,75 +393,6 @@ bool BidiResolver<Iterator, Run>::commitExplicitEmbedding()
 }
 
 template <class Iterator, class Run>
-void BidiResolver<Iterator, Run>::deleteRuns()
-{
-    emptyRun = true;
-    if (!m_firstRun)
-        return;
-
-    Run* curr = m_firstRun;
-    while (curr) {
-        Run* s = curr->next();
-        curr->destroy();
-        curr = s;
-    }
-
-    m_firstRun = 0;
-    m_lastRun = 0;
-    m_runCount = 0;
-}
-
-template <class Iterator, class Run>
-void BidiResolver<Iterator, Run>::reverseRuns(unsigned start, unsigned end)
-{
-    if (start >= end)
-        return;
-
-    ASSERT(end < m_runCount);
-    
-    // Get the item before the start of the runs to reverse and put it in
-    // |beforeStart|.  |curr| should point to the first run to reverse.
-    Run* curr = m_firstRun;
-    Run* beforeStart = 0;
-    unsigned i = 0;
-    while (i < start) {
-        i++;
-        beforeStart = curr;
-        curr = curr->next();
-    }
-
-    Run* startRun = curr;
-    while (i < end) {
-        i++;
-        curr = curr->next();
-    }
-    Run* endRun = curr;
-    Run* afterEnd = curr->next();
-
-    i = start;
-    curr = startRun;
-    Run* newNext = afterEnd;
-    while (i <= end) {
-        // Do the reversal.
-        Run* next = curr->next();
-        curr->m_next = newNext;
-        newNext = curr;
-        curr = next;
-        i++;
-    }
-
-    // Now hook up beforeStart and afterEnd to the startRun and endRun.
-    if (beforeStart)
-        beforeStart->m_next = endRun;
-    else
-        m_firstRun = endRun;
-
-    startRun->m_next = afterEnd;
-    if (!afterEnd)
-        m_lastRun = startRun;
-}
-
-template <class Iterator, class Run>
 inline void BidiResolver<Iterator, Run>::updateStatusLastFromCurrentDirection(WTF::Unicode::Direction dirCurrent)
 {
     using namespace WTF::Unicode;
@@ -581,7 +439,7 @@ inline void BidiResolver<Iterator, Run>::reorderRunsFromLevels()
 {
     unsigned char levelLow = 128;
     unsigned char levelHigh = 0;
-    for (Run* run = firstRun(); run; run = run->next()) {
+    for (Run* run = m_runs.firstRun(); run; run = run->next()) {
         levelHigh = std::max(run->level(), levelHigh);
         levelLow = std::min(run->level(), levelLow);
     }
@@ -595,11 +453,11 @@ inline void BidiResolver<Iterator, Run>::reorderRunsFromLevels()
     if (!(levelLow % 2))
         levelLow++;
 
-    unsigned count = runCount() - 1;
+    unsigned count = m_runs.runCount() - 1;
 
     while (levelHigh >= levelLow) {
         unsigned i = 0;
-        Run* run = firstRun();
+        Run* run = m_runs.firstRun();
         while (i < count) {
             for (;i < count && run && run->level() < levelHigh; i++)
                 run = run->next();
@@ -607,7 +465,7 @@ inline void BidiResolver<Iterator, Run>::reorderRunsFromLevels()
             for (;i <= count && run && run->level() >= levelHigh; i++)
                 run = run->next();
             unsigned end = i - 1;
-            reverseRuns(start, end);
+            m_runs.reverseRuns(start, end);
         }
         levelHigh--;
     }
@@ -621,7 +479,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
     ASSERT(m_direction == OtherNeutral);
 
     if (override != NoVisualOverride) {
-        emptyRun = false;
+        m_emptyRun = false;
         m_sor = m_current;
         m_eor = Iterator();
         while (m_current != end && !m_current.atEnd()) {
@@ -630,13 +488,13 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
         }
         m_direction = override == VisualLeftToRightOverride ? LeftToRight : RightToLeft;
         appendRun();
-        m_logicallyLastRun = m_lastRun;
+        m_runs.setLogicallyLastRun(m_runs.lastRun());
         if (override == VisualRightToLeftOverride)
-            reverseRuns(0, runCount() - 1);
+            m_runs.reverseRuns(0, m_runs.runCount() - 1);
         return;
     }
 
-    emptyRun = true;
+    m_emptyRun = true;
 
     m_eor = Iterator();
 
@@ -818,7 +676,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                                 // Terminate the EN run.
                                 appendRun();
                                 // Make an R run.
-                                m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
+                                m_eor = m_status.last == EuropeanNumberTerminator ? m_lastBeforeET : m_last;
                                 m_direction = RightToLeft;
                                 appendRun();
                                 // Begin a new EN run.
@@ -829,7 +687,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                             appendRun();
                             if (m_status.lastStrong == RightToLeft || context()->dir() == RightToLeft) {
                                 // Make an R run.
-                                m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
+                                m_eor = m_status.last == EuropeanNumberTerminator ? m_lastBeforeET : m_last;
                                 m_direction = RightToLeft;
                                 appendRun();
                                 // Begin a new EN run.
@@ -837,7 +695,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                             }
                         } else if (m_status.lastStrong == RightToLeft) {
                             // Extend the R run to include the neutrals.
-                            m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
+                            m_eor = m_status.last == EuropeanNumberTerminator ? m_lastBeforeET : m_last;
                             m_direction = RightToLeft;
                             appendRun();
                             // Begin a new EN run.
@@ -905,7 +763,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 m_eor = m_current;
                 m_status.eor = dirCurrent;
             } else if (m_status.last != EuropeanNumberTerminator)
-                lastBeforeET = emptyRun ? m_eor : m_last;
+                m_lastBeforeET = m_emptyRun ? m_eor : m_last;
             break;
 
         // boundary neutrals should be ignored
@@ -951,8 +809,8 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
             m_eor = stateAtEnd.m_eor;
             m_last = stateAtEnd.m_last;
             m_reachedEndOfLine = stateAtEnd.m_reachedEndOfLine;
-            lastBeforeET = stateAtEnd.lastBeforeET;
-            emptyRun = stateAtEnd.emptyRun;
+            m_lastBeforeET = stateAtEnd.m_lastBeforeET;
+            m_emptyRun = stateAtEnd.m_emptyRun;
             m_direction = OtherNeutral;
             break;
         }
@@ -960,9 +818,9 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
         updateStatusLastFromCurrentDirection(dirCurrent);
         m_last = m_current;
 
-        if (emptyRun) {
+        if (m_emptyRun) {
             m_sor = m_current;
-            emptyRun = false;
+            m_emptyRun = false;
         }
 
         increment();
@@ -975,29 +833,29 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 m_eor = stateAtEnd.m_eor;
                 m_last = stateAtEnd.m_last;
                 m_reachedEndOfLine = stateAtEnd.m_reachedEndOfLine;
-                lastBeforeET = stateAtEnd.lastBeforeET;
-                emptyRun = stateAtEnd.emptyRun;
+                m_lastBeforeET = stateAtEnd.m_lastBeforeET;
+                m_emptyRun = stateAtEnd.m_emptyRun;
                 m_direction = OtherNeutral;
                 break;
             }
         }
 
         if (!pastEnd && (m_current == end || m_current.atEnd())) {
-            if (emptyRun)
+            if (m_emptyRun)
                 break;
             stateAtEnd.m_status = m_status;
             stateAtEnd.m_sor = m_sor;
             stateAtEnd.m_eor = m_eor;
             stateAtEnd.m_last = m_last;
             stateAtEnd.m_reachedEndOfLine = m_reachedEndOfLine;
-            stateAtEnd.lastBeforeET = lastBeforeET;
-            stateAtEnd.emptyRun = emptyRun;
+            stateAtEnd.m_lastBeforeET = m_lastBeforeET;
+            stateAtEnd.m_emptyRun = m_emptyRun;
             endOfLine = m_last;
             pastEnd = true;
         }
     }
 
-    m_logicallyLastRun = m_lastRun;
+    m_runs.setLogicallyLastRun(m_runs.lastRun());
     reorderRunsFromLevels();
     endOfLine = Iterator();
 }
diff --git a/Source/WebCore/platform/text/BidiRunList.h b/Source/WebCore/platform/text/BidiRunList.h
new file mode 100644
index 0000000..a4aa3c2
--- /dev/null
+++ b/Source/WebCore/platform/text/BidiRunList.h
@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
+ * Copyright (C) 2003, 2004, 2006, 2007, 2008 Apple Inc.  All right reserved.
+ * Copyright (C) 2011 Google, Inc.  All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef BidiRunList_h
+#define BidiRunList_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+template <class Run>
+class BidiRunList {
+    WTF_MAKE_NONCOPYABLE(BidiRunList);
+public:
+    BidiRunList()
+        : m_firstRun(0)
+        , m_lastRun(0)
+        , m_logicallyLastRun(0)
+        , m_runCount(0)
+    {
+    }
+
+    // FIXME: Once BidiResolver no longer owns the BidiRunList,
+    // then ~BidiRunList should call deleteRuns() automatically.
+
+    Run* firstRun() const { return m_firstRun; }
+    Run* lastRun() const { return m_lastRun; }
+    Run* logicallyLastRun() const { return m_logicallyLastRun; }
+    unsigned runCount() const { return m_runCount; }
+
+    void addRun(Run*);
+    void prependRun(Run*);
+
+    void moveRunToEnd(Run*);
+    void moveRunToBeginning(Run*);
+
+    void deleteRuns();
+    void reverseRuns(unsigned start, unsigned end);
+    void reorderRunsFromLevels();
+
+    void setLogicallyLastRun(Run* run) { m_logicallyLastRun = run; }
+
+private:
+    Run* m_firstRun;
+    Run* m_lastRun;
+    Run* m_logicallyLastRun;
+    unsigned m_runCount;
+};
+
+template <class Run>
+inline void BidiRunList<Run>::addRun(Run* run)
+{
+    if (!m_firstRun)
+        m_firstRun = run;
+    else
+        m_lastRun->m_next = run;
+    m_lastRun = run;
+    m_runCount++;
+}
+
+template <class Run>
+inline void BidiRunList<Run>::prependRun(Run* run)
+{
+    ASSERT(!run->m_next);
+
+    if (!m_lastRun)
+        m_lastRun = run;
+    else
+        run->m_next = m_firstRun;
+    m_firstRun = run;
+    m_runCount++;
+}
+
+template <class Run>
+inline void BidiRunList<Run>::moveRunToEnd(Run* run)
+{
+    ASSERT(m_firstRun);
+    ASSERT(m_lastRun);
+    ASSERT(run->m_next);
+
+    Run* current = 0;
+    Run* next = m_firstRun;
+    while (next != run) {
+        current = next;
+        next = current->next();
+    }
+
+    if (!current)
+        m_firstRun = run->next();
+    else
+        current->m_next = run->m_next;
+
+    run->m_next = 0;
+    m_lastRun->m_next = run;
+    m_lastRun = run;
+}
+
+template <class Run>
+inline void BidiRunList<Run>::moveRunToBeginning(Run* run)
+{
+    ASSERT(m_firstRun);
+    ASSERT(m_lastRun);
+    ASSERT(run != m_firstRun);
+
+    Run* current = m_firstRun;
+    Run* next = current->next();
+    while (next != run) {
+        current = next;
+        next = current->next();
+    }
+
+    current->m_next = run->m_next;
+    if (run == m_lastRun)
+        m_lastRun = current;
+
+    run->m_next = m_firstRun;
+    m_firstRun = run;
+}
+
+template <class Run>
+void BidiRunList<Run>::deleteRuns()
+{
+    if (!m_firstRun)
+        return;
+
+    Run* curr = m_firstRun;
+    while (curr) {
+        Run* s = curr->next();
+        curr->destroy();
+        curr = s;
+    }
+
+    m_firstRun = 0;
+    m_lastRun = 0;
+    m_runCount = 0;
+}
+
+template <class Run>
+void BidiRunList<Run>::reverseRuns(unsigned start, unsigned end)
+{
+    if (start >= end)
+        return;
+
+    ASSERT(end < m_runCount);
+
+    // Get the item before the start of the runs to reverse and put it in
+    // |beforeStart|. |curr| should point to the first run to reverse.
+    Run* curr = m_firstRun;
+    Run* beforeStart = 0;
+    unsigned i = 0;
+    while (i < start) {
+        i++;
+        beforeStart = curr;
+        curr = curr->next();
+    }
+
+    Run* startRun = curr;
+    while (i < end) {
+        i++;
+        curr = curr->next();
+    }
+    Run* endRun = curr;
+    Run* afterEnd = curr->next();
+
+    i = start;
+    curr = startRun;
+    Run* newNext = afterEnd;
+    while (i <= end) {
+        // Do the reversal.
+        Run* next = curr->next();
+        curr->m_next = newNext;
+        newNext = curr;
+        curr = next;
+        i++;
+    }
+
+    // Now hook up beforeStart and afterEnd to the startRun and endRun.
+    if (beforeStart)
+        beforeStart->m_next = endRun;
+    else
+        m_firstRun = endRun;
+
+    startRun->m_next = afterEnd;
+    if (!afterEnd)
+        m_lastRun = startRun;
+}
+
+} // namespace WebCore
+
+#endif // BidiRunList
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.cpp b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
index 7c4b1cb..da16262 100644
--- a/Source/WebCore/platform/text/LocalizedNumberICU.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
@@ -37,6 +37,7 @@
 #include <wtf/MathExtras.h>
 #include <wtf/PassOwnPtr.h>
 
+using namespace icu;
 using namespace std;
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/text/StringWithDirection.h b/Source/WebCore/platform/text/StringWithDirection.h
new file mode 100644
index 0000000..3302f81
--- /dev/null
+++ b/Source/WebCore/platform/text/StringWithDirection.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StringWithDirection_h
+#define StringWithDirection_h
+
+#include "PlatformString.h"
+#include "TextDirection.h"
+
+namespace WebCore {
+
+// In some circumstances we want to store a String along with the TextDirection
+// of the String as learned from the context of the String. For example,
+// consider storing the title derived from <title dir='rtl'>some title</title>
+// in the history.
+//
+// Note that is explicitly *not* the direction of the string as learned
+// from the characters of the string; it's extra metadata we have external
+// to the string.
+class StringWithDirection {
+public:
+    StringWithDirection()
+        : m_direction(LTR)
+    {
+    }
+
+    StringWithDirection(const String& string, TextDirection dir)
+        : m_string(string)
+        , m_direction(dir)
+    {
+    }
+
+    const String& string() const { return m_string; }
+    TextDirection direction() const { return m_direction; }
+
+    bool isEmpty() const { return m_string.isEmpty(); }
+    bool isNull() const { return m_string.isNull(); }
+
+    bool operator==(const StringWithDirection& other) const
+    {
+        return other.m_string == m_string && other.m_direction == m_direction;
+    }
+    bool operator!=(const StringWithDirection& other) const { return !((*this) == other); }
+
+private:
+    String m_string;
+    TextDirection m_direction;
+};
+
+}
+
+#endif // StringWithDirection_h
diff --git a/Source/WebCore/platform/text/TextCheckerClient.h b/Source/WebCore/platform/text/TextCheckerClient.h
index 8abbed4..d16ade1 100644
--- a/Source/WebCore/platform/text/TextCheckerClient.h
+++ b/Source/WebCore/platform/text/TextCheckerClient.h
@@ -45,16 +45,6 @@ struct GrammarDetail {
     String userDescription;
 };
 
-enum TextCheckingType {
-    TextCheckingTypeSpelling    = 1 << 1,
-    TextCheckingTypeGrammar     = 1 << 2,
-    TextCheckingTypeLink        = 1 << 5,
-    TextCheckingTypeQuote       = 1 << 6,
-    TextCheckingTypeDash        = 1 << 7,
-    TextCheckingTypeReplacement = 1 << 8,
-    TextCheckingTypeCorrection  = 1 << 9
-};
-
 struct TextCheckingResult {
     TextCheckingType type;
     int location;
@@ -72,15 +62,16 @@ public:
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength) = 0;
     virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord) = 0;
     virtual void checkGrammarOfString(const UChar*, int length, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength) = 0;
+
 #if USE(UNIFIED_TEXT_CHECKING)
-    virtual void checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<TextCheckingResult>& results) = 0;
+    virtual void checkTextOfParagraph(const UChar* text, int length, TextCheckingTypeMask checkingTypes, Vector<TextCheckingResult>& results) = 0;
 #endif
 
     // For spellcheckers that support multiple languages, it's often important to be able to identify the language in order to
     // provide more accurate correction suggestions. Caller can pass in more text in "context" to aid such spellcheckers on language
     // identification. Noramlly it's the text surrounding the "word" for which we are getting correction suggestions.
     virtual void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses) = 0;
-    virtual void requestCheckingOfString(SpellChecker*, int, const String&) = 0;
+    virtual void requestCheckingOfString(SpellChecker*, int, TextCheckingTypeMask, const String&) = 0;
 };
 
 }
diff --git a/Source/WebCore/platform/text/TextChecking.h b/Source/WebCore/platform/text/TextChecking.h
index 022fb82..d2040d5 100644
--- a/Source/WebCore/platform/text/TextChecking.h
+++ b/Source/WebCore/platform/text/TextChecking.h
@@ -42,6 +42,18 @@ namespace WebCore {
 #define WTF_USE_AUTOMATIC_TEXT_REPLACEMENT 1
 #endif
 
+enum TextCheckingType {
+    TextCheckingTypeSpelling    = 1 << 1,
+    TextCheckingTypeGrammar     = 1 << 2,
+    TextCheckingTypeLink        = 1 << 5,
+    TextCheckingTypeQuote       = 1 << 6,
+    TextCheckingTypeDash        = 1 << 7,
+    TextCheckingTypeReplacement = 1 << 8,
+    TextCheckingTypeCorrection  = 1 << 9
+};
+
+typedef unsigned TextCheckingTypeMask;
+
 }
 
 #endif // TextChecking_h
diff --git a/Source/WebCore/platform/text/UnicodeBidi.h b/Source/WebCore/platform/text/UnicodeBidi.h
new file mode 100644
index 0000000..8e0d86e
--- /dev/null
+++ b/Source/WebCore/platform/text/UnicodeBidi.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2011 Google, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef UnicodeBidi_h
+#define UnicodeBidi_h
+
+namespace WebCore {
+
+enum EUnicodeBidi {
+    UBNormal,
+    Embed,
+    Override,
+    Isolate
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index 33d8ccd..7bd97d6 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -444,7 +444,7 @@ String getURL(const DragDataMap* data, DragData::FilenameConversionPolicy filena
 
     if (stringData.isEmpty() || (!PathFileExists(stringData.charactersWithNullTermination()) && !PathIsUNC(stringData.charactersWithNullTermination())))
         return url;
-    RetainPtr<CFStringRef> pathAsCFString(AdoptCF, CFStringCreateWithCharacters(kCFAllocatorDefault, (const UniChar *)stringData.charactersWithNullTermination(), stringData.length()));
+    RetainPtr<CFStringRef> pathAsCFString(AdoptCF, CFStringCreateWithCharacters(kCFAllocatorDefault, (const UniChar *)stringData.charactersWithNullTermination(), wcslen(stringData.charactersWithNullTermination())));
     if (urlFromPath(pathAsCFString.get(), url) && title)
         *title = url;
 #endif
diff --git a/Source/WebCore/platform/win/ClipboardWin.cpp b/Source/WebCore/platform/win/ClipboardWin.cpp
index 791ec86..0b5a3d3 100644
--- a/Source/WebCore/platform/win/ClipboardWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardWin.cpp
@@ -703,7 +703,6 @@ void ClipboardWin::declareAndWriteDragImage(Element* element, const KURL& url, c
         return;
     STGMEDIUM medium = {0};
     medium.tymed = TYMED_HGLOBAL;
-    ExceptionCode ec = 0;
 
     // Put img tag on the clipboard referencing the image
     Vector<char> data;
@@ -791,7 +790,6 @@ void ClipboardWin::writePlainText(const String& text)
     
     STGMEDIUM medium = {0};
     medium.tymed = TYMED_HGLOBAL;
-    ExceptionCode ec = 0;
     
     String str = text;
     replaceNewlinesWithWindowsStyleNewlines(str);
diff --git a/Source/WebCore/platform/win/DragImageCairoWin.cpp b/Source/WebCore/platform/win/DragImageCairoWin.cpp
index e356575..a67a82c 100644
--- a/Source/WebCore/platform/win/DragImageCairoWin.cpp
+++ b/Source/WebCore/platform/win/DragImageCairoWin.cpp
@@ -29,26 +29,20 @@
 #include "BitmapInfo.h"
 #include "CachedImage.h"
 #include "GraphicsContext.h"
+#include "GraphicsContextPlatformPrivateCairo.h"
 #include "Image.h"
 #include "RetainPtr.h"
-
 #include <cairo-win32.h>
-#include "GraphicsContextPlatformPrivateCairo.h"
-
 #include <windows.h>
 
-extern "C" {
-typedef struct _cairo* CairoContextRef;
-}
-
 namespace WebCore {
 
-void deallocContext(CairoContextRef target)
+void deallocContext(PlatformContextCairo* target)
 {
-    cairo_destroy(target);
+    delete target;
 }
 
-HBITMAP allocImage(HDC dc, IntSize size, CairoContextRef* targetRef)
+HBITMAP allocImage(HDC dc, IntSize size, PlatformContextCairo** targetRef)
 {
     BitmapInfo bmpInfo = BitmapInfo::create(size);
 
@@ -72,8 +66,8 @@ HBITMAP allocImage(HDC dc, IntSize size, CairoContextRef* targetRef)
         return 0;
     }
 
-    *targetRef = cairo_create (bitmapContext);
-    cairo_surface_destroy (bitmapContext);
+    cairo_t* cr = cairo_create(bitmapContext);
+    cairo_surface_destroy(bitmapContext);
 
     // At this point, we have a Cairo surface that points to a Windows DIB.  The DIB interprets
     // with the opposite meaning of positive Y axis, so everything we draw into this cairo
@@ -83,7 +77,10 @@ HBITMAP allocImage(HDC dc, IntSize size, CairoContextRef* targetRef)
     // before they get written to the internal buffer.
     cairo_matrix_t matrix;
     cairo_matrix_init(&matrix, 1.0, 0.0, 0.0, -1.0, 0.0, size.height());
-    cairo_set_matrix(*targetRef, &matrix);
+    cairo_set_matrix(cr, &matrix);
+
+    *targetRef = new PlatformGraphicsContext(cr);
+    cairo_destroy(cr);
 
     return hbmp;
 }
@@ -121,7 +118,7 @@ DragImageRef scaleDragImage(DragImageRef image, FloatSize scale)
     if (!dstDC)
         goto exit;
 
-    CairoContextRef targetContext;
+    PlatformContextCairo* targetContext;
     hbmp = allocImage(dstDC, dstSize, &targetContext);
     if (!hbmp)
         goto exit;
@@ -131,15 +128,16 @@ DragImageRef scaleDragImage(DragImageRef image, FloatSize scale)
     // Scale the target surface to the new image size, and flip it
     // so that when we set the srcImage as the surface it will draw
     // right-side-up.
-    cairo_translate(targetContext, 0, dstSize.height());
-    cairo_scale(targetContext, scale.width(), -scale.height());
-    cairo_set_source_surface (targetContext, srcImage, 0.0, 0.0);
+    cairo_t* cr = targetContext->cr();
+    cairo_translate(cr, 0, dstSize.height());
+    cairo_scale(cr, scale.width(), -scale.height());
+    cairo_set_source_surface(cr, srcImage, 0.0, 0.0);
 
     // Now we can paint and get the correct result
-    cairo_paint(targetContext);
+    cairo_paint(cr);
 
-    cairo_surface_destroy (srcImage);
-    cairo_destroy(targetContext);
+    cairo_surface_destroy(srcImage);
+    deallocContext(targetContext);
     ::DeleteObject(image);
     image = 0;
 
@@ -160,7 +158,7 @@ DragImageRef createDragImageFromImage(Image* img)
     if (!workingDC)
         goto exit;
 
-    CairoContextRef drawContext = 0;
+    PlatformContextCairo* drawContext = 0;
     hbmp = allocImage(workingDC, img->size(), &drawContext);
     if (!hbmp)
         goto exit;
@@ -170,16 +168,17 @@ DragImageRef createDragImageFromImage(Image* img)
         hbmp = 0;
     }
 
-    cairo_set_source_rgb (drawContext, 1.0, 0.0, 1.0);
-    cairo_fill_preserve (drawContext);
+    cairo_t* cr = drawContext->cr();
+    cairo_set_source_rgb(cr, 1.0, 0.0, 1.0);
+    cairo_fill_preserve(cr);
 
     cairo_surface_t* srcImage = img->nativeImageForCurrentFrame();
 
     // Draw the image.
-    cairo_set_source_surface(drawContext, srcImage, 0.0, 0.0);
-    cairo_paint(drawContext);
+    cairo_set_source_surface(cr, srcImage, 0.0, 0.0);
+    cairo_paint(cr);
 
-    cairo_destroy (drawContext);
+    deallocContext(drawContext);
 
 exit:
     if (workingDC)
diff --git a/Source/WebCore/platform/win/FileSystemWin.cpp b/Source/WebCore/platform/win/FileSystemWin.cpp
index 03a2eaf..7d1c8f2 100644
--- a/Source/WebCore/platform/win/FileSystemWin.cpp
+++ b/Source/WebCore/platform/win/FileSystemWin.cpp
@@ -136,7 +136,12 @@ String pathGetFileName(const String& path)
 
 String directoryName(const String& path)
 {
-    return path.left(path.length() - pathGetFileName(path).length());
+    String name = path.left(path.length() - pathGetFileName(path).length());
+    if (name.characterStartingAt(name.length() - 1) == '\\') {
+        // Remove any trailing "\".
+        name.truncate(name.length() - 1);
+    }
+    return name;
 }
 
 static String bundleName()
@@ -241,9 +246,11 @@ PlatformFileHandle openFile(const String& path, FileOpenMode mode)
     case OpenForRead:
         desiredAccess = GENERIC_READ;
         creationDisposition = OPEN_EXISTING;
+        break;
     case OpenForWrite:
         desiredAccess = GENERIC_WRITE;
         creationDisposition = CREATE_ALWAYS;
+        break;
     default:
         ASSERT_NOT_REACHED();
     }
diff --git a/Source/WebCore/platform/win/LocalizedStringsWin.cpp b/Source/WebCore/platform/win/LocalizedStringsWin.cpp
index 67de0fc..c079441 100644
--- a/Source/WebCore/platform/win/LocalizedStringsWin.cpp
+++ b/Source/WebCore/platform/win/LocalizedStringsWin.cpp
@@ -26,14 +26,66 @@
 #include "config.h"
 #include "LocalizedStrings.h"
 
+#include "WebCoreInstanceHandle.h"
+#include <wtf/Assertions.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Threading.h>
 #include <wtf/text/WTFString.h>
 
+#if USE(CF)
+#include <CoreFoundation/CFBundle.h>
+#include <wtf/RetainPtr.h>
+#endif
+
 namespace WebCore {
 
+#if USE(CF)
+
+static CFBundleRef createWebKitBundle()
+{
+    if (CFBundleRef existingBundle = CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebKit"))) {
+        CFRetain(existingBundle);
+        return existingBundle;
+    }
+
+    wchar_t dllPathBuffer[MAX_PATH];
+    DWORD length = ::GetModuleFileNameW(instanceHandle(), dllPathBuffer, WTF_ARRAY_LENGTH(dllPathBuffer));
+    ASSERT(length);
+    ASSERT(length < WTF_ARRAY_LENGTH(dllPathBuffer));
+
+    RetainPtr<CFStringRef> dllPath(AdoptCF, CFStringCreateWithCharactersNoCopy(0, reinterpret_cast<const UniChar*>(dllPathBuffer), length, kCFAllocatorNull));
+    RetainPtr<CFURLRef> dllURL(AdoptCF, CFURLCreateWithFileSystemPath(0, dllPath.get(), kCFURLWindowsPathStyle, false));
+    RetainPtr<CFURLRef> dllDirectoryURL(AdoptCF, CFURLCreateCopyDeletingLastPathComponent(0, dllURL.get()));
+    RetainPtr<CFURLRef> resourcesDirectoryURL(AdoptCF, CFURLCreateCopyAppendingPathComponent(0, dllDirectoryURL.get(), CFSTR("WebKit.resources"), true));
+
+    return CFBundleCreate(0, resourcesDirectoryURL.get());
+}
+
+static CFBundleRef webKitBundle()
+{
+    static CFBundleRef bundle = createWebKitBundle();
+    ASSERT(bundle);
+    return bundle;
+}
+
+#endif // USE(CF)
+
 String localizedString(const char* key)
 {
-    // FIXME: <rdar://problem/9119405> Win: WebKit2 needs to be made localizable
+    ASSERT(isMainThread());
+
+#if USE(CF)
+    static CFStringRef notFound = CFSTR("localized string not found");
+
+    RetainPtr<CFStringRef> keyString(AdoptCF, CFStringCreateWithCStringNoCopy(NULL, key, kCFStringEncodingUTF8, kCFAllocatorNull));
+    RetainPtr<CFStringRef> result(AdoptCF, CFCopyLocalizedStringWithDefaultValue(keyString.get(), 0, webKitBundle(), notFound, 0));
+    ASSERT_WITH_MESSAGE(result.get() != notFound, "could not find localizable string %s in bundle", key);
+
+    return result.get();
+#else
+    // FIXME: Implement localizedString() for !USE(CF).
     return String::fromUTF8(key, strlen(key));
+#endif
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/win/LoggingWin.cpp b/Source/WebCore/platform/win/LoggingWin.cpp
index 1d051ae..5e9fbda 100644
--- a/Source/WebCore/platform/win/LoggingWin.cpp
+++ b/Source/WebCore/platform/win/LoggingWin.cpp
@@ -88,6 +88,7 @@ void InitializeLoggingChannelsIfNecessary()
     initializeWithUserDefault(LogHistory);
     initializeWithUserDefault(LogPageCache);
     initializeWithUserDefault(LogPlatformLeaks);
+    initializeWithUserDefault(LogResourceLoading);
     initializeWithUserDefault(LogNetwork);
     initializeWithUserDefault(LogFTP);
     initializeWithUserDefault(LogThreading);
@@ -95,6 +96,8 @@ void InitializeLoggingChannelsIfNecessary()
     initializeWithUserDefault(LogMedia);
     initializeWithUserDefault(LogPlugins);
     initializeWithUserDefault(LogArchives);
+    initializeWithUserDefault(LogProgress);
+    initializeWithUserDefault(LogFileAPI);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/win/PopupMenuWin.h b/Source/WebCore/platform/win/PopupMenuWin.h
index 05edb07..0684424 100644
--- a/Source/WebCore/platform/win/PopupMenuWin.h
+++ b/Source/WebCore/platform/win/PopupMenuWin.h
@@ -95,8 +95,10 @@ private:
     virtual int scrollPosition(Scrollbar*) const;
     virtual void setScrollOffset(const IntPoint&);
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
+    virtual void invalidateScrollCornerRect(const WebCore::IntRect&) { }
     virtual bool isActive() const { return true; }
-    virtual bool scrollbarCornerPresent() const { return false; }
+    virtual bool isScrollCornerVisible() const { return false; }
+    virtual WebCore::IntRect scrollCornerRect() const { return WebCore::IntRect(); }
     virtual Scrollbar* verticalScrollbar() const { return m_scrollbar.get(); }
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
diff --git a/Source/WebKit/win/WindowsTouch.h b/Source/WebCore/platform/win/WindowsTouch.h
index 9048103..9048103 100644
--- a/Source/WebKit/win/WindowsTouch.h
+++ b/Source/WebCore/platform/win/WindowsTouch.h
diff --git a/Source/WebCore/platform/wx/FileSystemWx.cpp b/Source/WebCore/platform/wx/FileSystemWx.cpp
index 3c2b453..3644a42 100644
--- a/Source/WebCore/platform/wx/FileSystemWx.cpp
+++ b/Source/WebCore/platform/wx/FileSystemWx.cpp
@@ -78,8 +78,11 @@ bool getFileSize(const String& path, long long& resultSize)
 
 bool getFileModificationTime(const String& path, time_t& t)
 {
-    t = wxFileName(path).GetModificationTime().GetTicks();
-    return true;
+    if (wxFileExists(path)) {
+        t = wxFileName(path).GetModificationTime().GetTicks();
+        return true;
+    }
+    return false;
 }
 
 bool makeAllDirectories(const String& path)
@@ -107,22 +110,26 @@ String directoryName(const String& path)
     return wxFileName(path).GetPath();
 }
 
-String openTemporaryFile(const String&, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
-    notImplemented();
-    handle = invalidPlatformFileHandle;
-    return String();
+    wxString sFilename = wxFileName::CreateTempFileName(prefix);
+    wxFile* temp = new wxFile();
+    temp->Open(sFilename.c_str(), wxFile::read_write);
+    handle = temp;
+    return String(sFilename);
 }
 
-void closeFile(PlatformFileHandle&)
+void closeFile(PlatformFileHandle& handle)
 {
-    notImplemented();
+    if (handle)
+        delete handle;
 }
 
-int writeToFile(PlatformFileHandle, const char* data, int length)
+int writeToFile(PlatformFileHandle handle, const char* data, int length)
 {
-    notImplemented();
-    return 0;
+    if (handle)
+        return static_cast<wxFile*>(handle)->Write(data, length);
+    return -1;
 }
 
 bool unloadModule(PlatformModule mod)
diff --git a/Source/WebCore/platform/wx/WidgetWx.cpp b/Source/WebCore/platform/wx/WidgetWx.cpp
index 9de4c3d..e9a3c98 100644
--- a/Source/WebCore/platform/wx/WidgetWx.cpp
+++ b/Source/WebCore/platform/wx/WidgetWx.cpp
@@ -27,8 +27,10 @@
 
 #include "Cursor.h"
 #include "GraphicsContext.h"
+#include "HostWindow.h"
 #include "IntRect.h"
 #include "NotImplemented.h"
+#include "ScrollView.h"
 
 #include <wx/defs.h>
 #include <wx/scrolwin.h>
@@ -54,8 +56,10 @@ void Widget::setFocus(bool focused)
 
 void Widget::setCursor(const Cursor& cursor)
 {
-    if (platformWidget() && cursor.impl())
-        platformWidget()->SetCursor(*cursor.impl());
+    ScrollView* view = root();
+    if (!view)
+        return;
+    view->hostWindow()->setCursor(cursor);
 }
 
 void Widget::show()
diff --git a/Source/WebCore/plugins/PluginView.cpp b/Source/WebCore/plugins/PluginView.cpp
index 59d01fa..c39ceac 100644
--- a/Source/WebCore/plugins/PluginView.cpp
+++ b/Source/WebCore/plugins/PluginView.cpp
@@ -365,7 +365,7 @@ void PluginView::stop()
 #endif
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-#ifdef XP_WIN
+#if defined(XP_WIN) && !PLATFORM(GTK)
     // Unsubclass the window
     if (m_isWindowed) {
 #if OS(WINCE)
@@ -380,7 +380,7 @@ void PluginView::stop()
             SetWindowLongPtr(platformPluginWidget(), GWLP_WNDPROC, (LONG_PTR)m_pluginWndProc);
 #endif
     }
-#endif // XP_WIN
+#endif // !defined(XP_WIN) || PLATFORM(GTK)
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
 
 #if !defined(XP_MACOSX)
diff --git a/Source/WebCore/plugins/PluginView.h b/Source/WebCore/plugins/PluginView.h
index 9321a86..e2dbb49 100644
--- a/Source/WebCore/plugins/PluginView.h
+++ b/Source/WebCore/plugins/PluginView.h
@@ -438,7 +438,11 @@ public:
 
 private:
 
+<<<<<<< HEAD
 #if defined(XP_UNIX) || OS(SYMBIAN) || defined(ANDROID_PLUGINS)
+=======
+#if defined(XP_UNIX) || OS(SYMBIAN) || PLATFORM(GTK)
+>>>>>>> WebKit.org at r84325
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
diff --git a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
index 21d3c9e..ab8eb57 100644
--- a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
@@ -119,6 +119,17 @@ static int webkitgtkXError(Display* xdisplay, XErrorEvent* error)
 }
 #endif
 
+static bool moduleMixesGtkSymbols(GModule* module)
+{
+    gpointer symbol;
+#ifdef GTK_API_VERSION_2
+    return g_module_symbol(module, "gtk_application_get_type", &symbol);
+#else
+    return g_module_symbol(module, "gtk_object_get_type", &symbol);
+#endif
+}
+
+
 bool PluginPackage::load()
 {
     if (m_isLoaded) {
@@ -150,6 +161,12 @@ bool PluginPackage::load()
         return false;
     }
 
+    if (moduleMixesGtkSymbols(m_module)) {
+        LOG(Plugins, "Module '%s' mixes GTK+ 2 and GTK+ 3 symbols, ignoring plugin.\n", m_path.utf8().data());
+        g_module_close(m_module);
+        return false;
+    }
+
     m_isLoaded = true;
 
 #if defined(XP_UNIX)
diff --git a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
index 58a4f2c..8d48800 100644
--- a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -47,6 +47,7 @@
 #include "Image.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformContextCairo.h"
 #include "PlatformKeyboardEvent.h"
@@ -560,30 +561,32 @@ void PluginView::setParentVisible(bool visible)
     }
 }
 
-NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32_t len, const char* buf)
+NPError PluginView::handlePostReadFile(Vector<char>& outputBuffer, uint32_t filenameLength, const char* filenameBuffer)
 {
-    WTF::String filename(buf, len);
+    // There doesn't seem to be any documentation about what encoding the filename
+    // is in, but most ports seem to assume UTF-8 here and the test plugin is definitely
+    // sending the path in UTF-8 encoding.
+    CString filename(filenameBuffer, filenameLength);
 
-    if (filename.startsWith("file:///"))
-        filename = filename.substring(8);
-
-    // Get file info
-    if (!g_file_test ((filename.utf8()).data(), (GFileTest)(G_FILE_TEST_EXISTS | G_FILE_TEST_IS_REGULAR)))
+    GRefPtr<GFile> file = adoptGRef(g_file_new_for_commandline_arg(filename.data()));
+    if (g_file_query_file_type(file.get(), G_FILE_QUERY_INFO_NONE, 0) != G_FILE_TYPE_REGULAR)
         return NPERR_FILE_NOT_FOUND;
 
-    //FIXME - read the file data into buffer
-    FILE* fileHandle = fopen((filename.utf8()).data(), "r");
-    
-    if (fileHandle == 0)
+    GRefPtr<GFileInfo> fileInfo = adoptGRef(g_file_query_info(file.get(),
+                                                              G_FILE_ATTRIBUTE_STANDARD_SIZE,
+                                                              G_FILE_QUERY_INFO_NONE,
+                                                              0, 0));
+    if (!fileInfo)
         return NPERR_FILE_NOT_FOUND;
 
-    //buffer.resize();
-
-    int bytesRead = fread(buffer.data(), 1, 0, fileHandle);
-
-    fclose(fileHandle);
+    GRefPtr<GFileInputStream> inputStream = adoptGRef(g_file_read(file.get(), 0, 0));
+    if (!inputStream)
+        return NPERR_FILE_NOT_FOUND;
 
-    if (bytesRead <= 0)
+    outputBuffer.resize(g_file_info_get_size(fileInfo.get()));
+    gsize bytesRead = 0;
+    if (!g_input_stream_read_all(G_INPUT_STREAM(inputStream.get()),
+                                 outputBuffer.data(), outputBuffer.size(), &bytesRead, 0, 0))
         return NPERR_FILE_NOT_FOUND;
 
     return NPERR_NO_ERROR;
@@ -660,7 +663,7 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
 #if defined(XP_UNIX)
             *static_cast<Window*>(value) = GDK_WINDOW_XWINDOW(gdk_window_get_toplevel(gdkWindow));
 #elif defined(GDK_WINDOWING_WIN32)
-            *static_cast<HGIOBJ*>(value) = GDK_WINDOW_HWND(gdkWindow);
+            *static_cast<HGDIOBJ*>(value) = GDK_WINDOW_HWND(gdkWindow);
 #endif
             *result = NPERR_NO_ERROR;
             return true;
@@ -706,6 +709,7 @@ void PluginView::forceRedraw()
         gtk_widget_queue_draw(m_parentFrame->view()->hostWindow()->platformPageClient());
 }
 
+#ifndef GDK_WINDOWING_WIN32
 static Display* getPluginDisplay()
 {
     // The plugin toolkit might have a different X connection open.  Since we're
@@ -719,6 +723,7 @@ static Display* getPluginDisplay()
     return 0;
 #endif
 }
+#endif
 
 #if defined(XP_UNIX)
 static void getVisualAndColormap(int depth, Visual** visual, Colormap* colormap)
@@ -783,6 +788,7 @@ bool PluginView::platformStart()
     ASSERT(m_isStarted);
     ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
+#if defined(XP_UNIX)
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
         JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
@@ -791,11 +797,11 @@ bool PluginView::platformStart()
         setCallingPlugin(false);
         PluginView::setCurrentPluginView(0);
     }
+#endif
 
     if (m_isWindowed) {
-#if defined(XP_UNIX)
         GtkWidget* pageClient = m_parentFrame->view()->hostWindow()->platformPageClient();
-
+#if defined(XP_UNIX)
         if (m_needsXEmbed) {
             // If our parent is not anchored the startup process will
             // fail miserably for XEmbed plugins a bit later on when
@@ -817,7 +823,9 @@ bool PluginView::platformStart()
 #endif
     } else {
         setPlatformWidget(0);
+#if defined(XP_UNIX)
         m_pluginDisplay = getPluginDisplay();
+#endif
     }
 
     show();
diff --git a/Source/WebCore/plugins/npapi.cpp b/Source/WebCore/plugins/npapi.cpp
index bc64901..fe27d0f 100644
--- a/Source/WebCore/plugins/npapi.cpp
+++ b/Source/WebCore/plugins/npapi.cpp
@@ -171,9 +171,11 @@ void NPN_PopPopupsEnabledState(NPP instance)
     pluginViewForInstance(instance)->popPopupsEnabledState();
 }
 
-void NPN_PluginThreadAsyncCall(NPP instance, void (*func) (void *), void *userData)
+extern "C" typedef void PluginThreadAsyncCallFunction(void*);
+void NPN_PluginThreadAsyncCall(NPP instance, PluginThreadAsyncCallFunction func, void* userData)
 {
-    PluginMainThreadScheduler::scheduler().scheduleCall(instance, func, userData);
+    // Callback function type only differs from MainThreadFunction by being extern "C", which doesn't affect calling convention on any compilers we use.
+    PluginMainThreadScheduler::scheduler().scheduleCall(instance, reinterpret_cast<PluginMainThreadScheduler::MainThreadFunction*>(func), userData);
 }
 
 NPError NPN_GetValueForURL(NPP instance, NPNURLVariable variable, const char* url, char** value, uint32_t* len)
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index dcb805a..f39da85 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -182,7 +182,7 @@ void PluginView::updatePluginWidget()
         // Note that we don't invalidate the frameRect() here. This is because QWebFrame::renderRelativeCoords()
         // imitates ScrollView and adds the scroll offset back on to the rect we damage here (making the co-ordinates absolute
         // to the frame again) before passing it to FrameView.
-        frameView->invalidateRect(m_windowRect);
+        invalidate();
     }
 }
 
@@ -812,8 +812,12 @@ void PluginView::invalidateRect(const IntRect& rect)
 #endif
 
     if (m_isWindowed) {
-        if (platformWidget())
+        if (platformWidget()) {
+            // update() will schedule a repaint of the widget so ensure
+            // its knowledge of its position on the page is up to date.
+            platformWidget()->setGeometry(m_windowRect);
             platformWidget()->update(rect);
+        }
         return;
     }
 
diff --git a/Source/WebCore/plugins/symbian/PluginViewSymbian.cpp b/Source/WebCore/plugins/symbian/PluginViewSymbian.cpp
index 1a9a9ca..13aa60f 100644
--- a/Source/WebCore/plugins/symbian/PluginViewSymbian.cpp
+++ b/Source/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -102,12 +102,7 @@ void PluginView::updatePluginWidget()
     if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
         return;
 
-    // in order to move/resize the plugin window at the same time as the rest of frame
-    // during e.g. scrolling, we set the mask and geometry in the paint() function, but
-    // as paint() isn't called when the plugin window is outside the frame which can
-    // be caused by a scroll, we need to move/resize immediately.
-    if (!m_windowRect.intersects(frameView->frameRect()))
-        setNPWindowIfNeeded();
+    setNPWindowIfNeeded();
 }
 
 void PluginView::setFocus(bool focused)
diff --git a/Source/WebCore/plugins/win/PluginViewWin.cpp b/Source/WebCore/plugins/win/PluginViewWin.cpp
index f575709..2723c2c 100644
--- a/Source/WebCore/plugins/win/PluginViewWin.cpp
+++ b/Source/WebCore/plugins/win/PluginViewWin.cpp
@@ -82,7 +82,7 @@
 #define LOG_PLUGIN_NET_ERROR()
 #endif
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 #include "PlatformContextCairo.h"
 #include <cairo-win32.h>
 #endif
@@ -569,7 +569,7 @@ void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const
 
     LocalWindowsContext windowsContext(context, frameRect(), false);
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     // Must flush drawings up to this point to the backing metafile, otherwise the
     // plugin region will be overwritten with any clear regions specified in the
     // cairo-controlled portions of the rendering.
diff --git a/Source/WebCore/rendering/EllipsisBox.cpp b/Source/WebCore/rendering/EllipsisBox.cpp
index db66b43..1641ee5 100644
--- a/Source/WebCore/rendering/EllipsisBox.cpp
+++ b/Source/WebCore/rendering/EllipsisBox.cpp
@@ -29,7 +29,7 @@
 
 namespace WebCore {
 
-void EllipsisBox::paint(PaintInfo& paintInfo, int tx, int ty)
+void EllipsisBox::paint(PaintInfo& paintInfo, int tx, int ty, int lineTop, int lineBottom)
 {
     GraphicsContext* context = paintInfo.context;
     RenderStyle* style = m_renderer->style(m_firstLine);
@@ -66,7 +66,7 @@ void EllipsisBox::paint(PaintInfo& paintInfo, int tx, int ty)
         // Paint the markup box
         tx += m_x + m_logicalWidth - m_markupBox->x();
         ty += m_y + style->fontMetrics().ascent() - (m_markupBox->y() + m_markupBox->renderer()->style(m_firstLine)->fontMetrics().ascent());
-        m_markupBox->paint(paintInfo, tx, ty);
+        m_markupBox->paint(paintInfo, tx, ty, lineTop, lineBottom);
     }
 }
 
@@ -99,7 +99,7 @@ void EllipsisBox::paintSelection(GraphicsContext* context, int tx, int ty, Rende
     context->restore();
 }
 
-bool EllipsisBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
+bool EllipsisBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, int lineTop, int lineBottom)
 {
     tx += m_x;
     ty += m_y;
@@ -109,7 +109,7 @@ bool EllipsisBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
         RenderStyle* style = m_renderer->style(m_firstLine);
         int mtx = tx + m_logicalWidth - m_markupBox->x();
         int mty = ty + style->fontMetrics().ascent() - (m_markupBox->y() + m_markupBox->renderer()->style(m_firstLine)->fontMetrics().ascent());
-        if (m_markupBox->nodeAtPoint(request, result, x, y, mtx, mty)) {
+        if (m_markupBox->nodeAtPoint(request, result, x, y, mtx, mty, lineTop, lineBottom)) {
             renderer()->updateHitTestResult(result, IntPoint(x - mtx, y - mty));
             return true;
         }
diff --git a/Source/WebCore/rendering/EllipsisBox.h b/Source/WebCore/rendering/EllipsisBox.h
index ec1b00b..c178cba 100644
--- a/Source/WebCore/rendering/EllipsisBox.h
+++ b/Source/WebCore/rendering/EllipsisBox.h
@@ -39,8 +39,8 @@ public:
     {
     }
 
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty, int lineTop, int lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, int lineTop, int lineBottom);
     void setSelectionState(RenderObject::SelectionState s) { m_selectionState = s; }
     IntRect selectionRect(int tx, int ty);
 
diff --git a/Source/WebCore/rendering/HitTestResult.cpp b/Source/WebCore/rendering/HitTestResult.cpp
index e5638c9..77ccc4b 100644
--- a/Source/WebCore/rendering/HitTestResult.cpp
+++ b/Source/WebCore/rendering/HitTestResult.cpp
@@ -32,6 +32,7 @@
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "RenderImage.h"
+#include "RenderInline.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
 
@@ -544,6 +545,20 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const
     node = node->shadowAncestorNode();
     mutableRectBasedTestResult().add(node);
 
+    if (node->renderer()->isInline()) {
+        for (RenderObject* curr = node->renderer()->parent(); curr; curr = curr->parent()) {
+            if (!curr->isRenderInline())
+                break;
+            
+            // We need to make sure the nodes for culled inlines get included.
+            RenderInline* currInline = toRenderInline(curr);
+            if (currInline->alwaysCreateLineBoxes())
+                break;
+            
+            if (currInline->visibleToHitTesting() && currInline->node())
+                mutableRectBasedTestResult().add(currInline->node()->shadowAncestorNode());
+        }
+    }
     return !rect.contains(rectForPoint(x, y));
 }
 
@@ -561,6 +576,20 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const
     node = node->shadowAncestorNode();
     mutableRectBasedTestResult().add(node);
 
+    if (node->renderer()->isInline()) {
+        for (RenderObject* curr = node->renderer()->parent(); curr; curr = curr->parent()) {
+            if (!curr->isRenderInline())
+                break;
+            
+            // We need to make sure the nodes for culled inlines get included.
+            RenderInline* currInline = toRenderInline(curr);
+            if (currInline->alwaysCreateLineBoxes())
+                break;
+            
+            if (currInline->visibleToHitTesting() && currInline->node())
+                mutableRectBasedTestResult().add(currInline->node()->shadowAncestorNode());
+        }
+    }
     return !rect.contains(rectForPoint(x, y));
 }
 
diff --git a/Source/WebCore/rendering/InlineBox.cpp b/Source/WebCore/rendering/InlineBox.cpp
index 930071e..f3d3a2d 100644
--- a/Source/WebCore/rendering/InlineBox.cpp
+++ b/Source/WebCore/rendering/InlineBox.cpp
@@ -159,7 +159,7 @@ void InlineBox::adjustPosition(float dx, float dy)
         toRenderBox(m_renderer)->move(dx, dy); 
 }
 
-void InlineBox::paint(PaintInfo& paintInfo, int tx, int ty)
+void InlineBox::paint(PaintInfo& paintInfo, int tx, int ty, int /* lineTop */, int /*lineBottom*/)
 {
     if (!paintInfo.shouldPaintWithinRoot(renderer()) || (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection))
         return;
@@ -187,7 +187,7 @@ void InlineBox::paint(PaintInfo& paintInfo, int tx, int ty)
     }
 }
 
-bool InlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
+bool InlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, int /* lineTop */, int /*lineBottom*/)
 {
     // Hit test all phases of replaced elements atomically, as though the replaced element established its
     // own stacking context.  (See Appendix E.2, section 6.4 on inline block/table elements in the CSS2.1
@@ -283,6 +283,13 @@ float InlineBox::placeEllipsisBox(bool, float, float, float, bool&)
     return -1;
 }
 
+void InlineBox::clearKnownToHaveNoOverflow()
+{ 
+    m_knownToHaveNoOverflow = false;
+    if (parent() && parent()->knownToHaveNoOverflow())
+        parent()->clearKnownToHaveNoOverflow();
+}
+
 FloatPoint InlineBox::locationIncludingFlipping()
 {
     if (!renderer()->style()->isFlippedBlocksWritingMode())
diff --git a/Source/WebCore/rendering/InlineBox.h b/Source/WebCore/rendering/InlineBox.h
index 9335970..8989a77 100644
--- a/Source/WebCore/rendering/InlineBox.h
+++ b/Source/WebCore/rendering/InlineBox.h
@@ -54,6 +54,7 @@ public:
         , m_isHorizontal(true)
         , m_endsWithBreak(false)
         , m_hasSelectedChildrenOrCanHaveLeadingExpansion(false)
+        , m_knownToHaveNoOverflow(true)
         , m_hasEllipsisBoxOrHyphen(false)
         , m_dirOverride(false)
         , m_isText(false)
@@ -87,7 +88,8 @@ public:
 #endif
         , m_isHorizontal(isHorizontal)
         , m_endsWithBreak(false)
-        , m_hasSelectedChildrenOrCanHaveLeadingExpansion(false)   
+        , m_hasSelectedChildrenOrCanHaveLeadingExpansion(false)
+        , m_knownToHaveNoOverflow(true)  
         , m_hasEllipsisBoxOrHyphen(false)
         , m_dirOverride(false)
         , m_isText(false)
@@ -128,8 +130,8 @@ public:
             adjustPosition(delta, 0);
     }
 
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty, int lineTop, int lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, int lineTop, int lineBottom);
 
     InlineBox* next() const { return m_next; }
 
@@ -261,6 +263,8 @@ public:
     // The logical height is our extent in the block flow direction, i.e., height for horizontal text and width for vertical text.
     int logicalHeight() const;
 
+    FloatRect logicalFrameRect() const { return isHorizontal() ? IntRect(m_x, m_y, m_logicalWidth, logicalHeight()) : IntRect(m_y, m_x, m_logicalWidth, logicalHeight()); }
+
     virtual int baselinePosition(FontBaseline baselineType) const { return boxModelObject()->baselinePosition(baselineType, m_firstLine, isHorizontal() ? HorizontalLine : VerticalLine, PositionOnContainingLine); }
     virtual int lineHeight() const { return boxModelObject()->lineHeight(m_firstLine, isHorizontal() ? HorizontalLine : VerticalLine, PositionOnContainingLine); }
     
@@ -310,6 +314,9 @@ public:
     void flipForWritingMode(IntRect&);
     IntPoint flipForWritingMode(const IntPoint&);
 
+    bool knownToHaveNoOverflow() const { return m_knownToHaveNoOverflow; }
+    void clearKnownToHaveNoOverflow();
+
 private:
     InlineBox* m_next; // The next element on the same line as us.
     InlineBox* m_prev; // The previous element on the same line as us.
@@ -342,6 +349,7 @@ protected:
     bool m_endsWithBreak : 1;  // Whether the line ends with a <br>.
     // shared between RootInlineBox and InlineTextBox
     bool m_hasSelectedChildrenOrCanHaveLeadingExpansion : 1; // Whether we have any children selected (this bit will also be set if the <br> that terminates our line is selected).
+    bool m_knownToHaveNoOverflow : 1;
     bool m_hasEllipsisBoxOrHyphen : 1;
 
     // for InlineTextBox
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index b58a30e..045edff 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -97,7 +97,8 @@ void InlineFlowBox::addToLine(InlineBox* child)
     child->setFirstLineStyleBit(m_firstLine);
     child->setIsHorizontal(isHorizontal());
     if (child->isText()) {
-        m_hasTextChildren = true;
+        if (child->renderer()->parent() == renderer())
+            m_hasTextChildren = true;
         m_hasTextDescendants = true;
     } else if (child->isInlineFlowBox()) {
         if (static_cast<InlineFlowBox*>(child)->hasTextDescendants())
@@ -111,12 +112,13 @@ void InlineFlowBox::addToLine(InlineBox* child)
         if (child->renderer()->isReplaced())
             shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
         else if (child->isText()) {
-            if (child->renderer()->isBR()) {
-                if (parentStyle->font().fontMetrics().ascent() != childStyle->font().fontMetrics().ascent()
-                    || parentStyle->font().fontMetrics().descent() != childStyle->font().fontMetrics().descent() || parentStyle->lineHeight() != childStyle->lineHeight()
+            if (child->renderer()->isBR() || child->renderer()->parent() != renderer()) {
+                if (!parentStyle->font().fontMetrics().hasIdenticalAscentDescentAndLineGap(childStyle->font().fontMetrics())
+                    || parentStyle->lineHeight() != childStyle->lineHeight()
                     || (parentStyle->verticalAlign() != BASELINE && !isRootInlineBox()) || childStyle->verticalAlign() != BASELINE)
                     shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
-            } else if (childStyle->hasTextCombine() || childStyle->textEmphasisMark() != TextEmphasisMarkNone)
+            }
+            if (childStyle->hasTextCombine() || childStyle->textEmphasisMark() != TextEmphasisMarkNone)
                 shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
         } else {
             if (child->renderer()->isBR()) {
@@ -127,8 +129,9 @@ void InlineFlowBox::addToLine(InlineBox* child)
                 ASSERT(isInlineFlowBox());
                 InlineFlowBox* childFlowBox = static_cast<InlineFlowBox*>(child);
                 // Check the child's bit, and then also check for differences in font, line-height, vertical-align
-                if (!childFlowBox->descendantsHaveSameLineHeightAndBaseline() || parentStyle->font().fontMetrics().ascent() != childStyle->font().fontMetrics().ascent()
-                    || parentStyle->font().fontMetrics().descent() != childStyle->font().fontMetrics().descent() || parentStyle->lineHeight() != childStyle->lineHeight()
+                if (!childFlowBox->descendantsHaveSameLineHeightAndBaseline()
+                    || !parentStyle->font().fontMetrics().hasIdenticalAscentDescentAndLineGap(childStyle->font().fontMetrics())
+                    || parentStyle->lineHeight() != childStyle->lineHeight()
                     || (parentStyle->verticalAlign() != BASELINE && !isRootInlineBox()) || childStyle->verticalAlign() != BASELINE
                     || childStyle->hasBorder() || childStyle->hasPadding() || childStyle->hasTextCombine())
                     shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
@@ -139,6 +142,23 @@ void InlineFlowBox::addToLine(InlineBox* child)
             clearDescendantsHaveSameLineHeightAndBaseline();
     }
 
+    if (!child->renderer()->isPositioned()) {
+        if (child->isText()) {
+            RenderStyle* childStyle = child->renderer()->style(m_firstLine);
+            if (childStyle->letterSpacing() < 0 || childStyle->textShadow() || childStyle->textEmphasisMark() != TextEmphasisMarkNone || childStyle->textStrokeWidth())
+                child->clearKnownToHaveNoOverflow();
+        } else if (child->renderer()->isReplaced()) {
+            RenderBox* box = toRenderBox(child->renderer());
+            if (box->hasRenderOverflow() || box->hasSelfPaintingLayer())
+                child->clearKnownToHaveNoOverflow();
+        } else if (!child->renderer()->isBR() && (child->renderer()->style(m_firstLine)->boxShadow() || child->boxModelObject()->hasSelfPaintingLayer()
+                   || (child->renderer()->isListMarker() && !toRenderListMarker(child->renderer())->isInside())))
+            child->clearKnownToHaveNoOverflow();
+        
+        if (knownToHaveNoOverflow() && child->isInlineFlowBox() && !static_cast<InlineFlowBox*>(child)->knownToHaveNoOverflow())
+            clearKnownToHaveNoOverflow();
+    }
+
     checkConsistency();
 }
 
@@ -232,19 +252,21 @@ RenderLineBoxList* InlineFlowBox::rendererLineBoxes() const
     return toRenderInline(renderer())->lineBoxes();
 }
 
-bool InlineFlowBox::onEndChain(RenderObject* endObject)
+static inline bool isLastChildForRenderer(RenderObject* ancestor, RenderObject* child)
 {
-    if (!endObject)
+    if (!child)
         return false;
     
-    if (endObject == renderer())
+    if (child == ancestor)
         return true;
 
-    RenderObject* curr = endObject;
+    RenderObject* curr = child;
     RenderObject* parent = curr->parent();
-    while (parent && !parent->isRenderBlock()) {
-        if (parent->lastChild() != curr || parent == renderer())
+    while (parent && (!parent->isRenderBlock() || parent->isInline())) {
+        if (parent->lastChild() != curr)
             return false;
+        if (parent == ancestor)
+            return true;
             
         curr = parent;
         parent = curr->parent();
@@ -256,7 +278,7 @@ bool InlineFlowBox::onEndChain(RenderObject* endObject)
 static bool isAnsectorAndWithinBlock(RenderObject* ancestor, RenderObject* child)
 {
     RenderObject* object = child;
-    while (object && !object->isRenderBlock()) {
+    while (object && (!object->isRenderBlock() || object->isInline())) {
         if (object == ancestor)
             return true;
         object = object->parent();
@@ -264,7 +286,7 @@ static bool isAnsectorAndWithinBlock(RenderObject* ancestor, RenderObject* child
     return false;
 }
 
-void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer)
+void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, bool isLogicallyLastRunWrapped, RenderObject* logicallyLastRunRenderer)
 {
     // All boxes start off open.  They will not apply any margins/border/padding on
     // any side.
@@ -287,8 +309,13 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
 
         if (!lineBoxList->lastLineBox()->isConstructed()) {
             RenderInline* inlineFlow = toRenderInline(renderer());
-            bool isLastObjectOnLine = (endObject && endObject->isText()) ? !isAnsectorAndWithinBlock(renderer(), logicallyLastRunRenderer->parent()) : onEndChain(logicallyLastRunRenderer);
+            bool isLastObjectOnLine = !isAnsectorAndWithinBlock(renderer(), logicallyLastRunRenderer) || (isLastChildForRenderer(renderer(), logicallyLastRunRenderer) && !isLogicallyLastRunWrapped);
 
+            // We include the border under these conditions:
+            // (1) The next line was not created, or it is constructed. We check the previous line for rtl.
+            // (2) The logicallyLastRun is not a descendant of this renderer.
+            // (3) The logicallyLastRun is a descendant of this renderer, but it is the last child of this renderer and it does not wrap to the next line.
+            
             if (ltr) {
                 if (!nextLineBox()
                     && ((lastLine || isLastObjectOnLine) && !inlineFlow->continuation()))
@@ -307,7 +334,7 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     for (InlineBox* currChild = firstChild(); currChild; currChild = currChild->nextOnLine()) {
         if (currChild->isInlineFlowBox()) {
             InlineFlowBox* currFlow = static_cast<InlineFlowBox*>(currChild);
-            currFlow->determineSpacingForFlowBoxes(lastLine, endObject, logicallyLastRunRenderer);
+            currFlow->determineSpacingForFlowBoxes(lastLine, isLogicallyLastRunWrapped, logicallyLastRunRenderer);
         }
     }
 }
@@ -319,7 +346,10 @@ float InlineFlowBox::placeBoxesInInlineDirection(float logicalLeft, bool& needsW
   
     float startLogicalLeft = logicalLeft;
     logicalLeft += borderLogicalLeft() + paddingLogicalLeft();
-    
+
+    float minLogicalLeft = startLogicalLeft;
+    float maxLogicalRight = logicalLeft;
+
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isText()) {
             InlineTextBox* text = static_cast<InlineTextBox*>(curr);
@@ -330,7 +360,11 @@ float InlineFlowBox::placeBoxesInInlineDirection(float logicalLeft, bool& needsW
                 needsWordSpacing = !isSpaceOrNewline(rt->characters()[text->end()]);
             }
             text->setLogicalLeft(logicalLeft);
+            if (knownToHaveNoOverflow())
+                minLogicalLeft = min(logicalLeft, minLogicalLeft);
             logicalLeft += text->logicalWidth();
+            if (knownToHaveNoOverflow())
+                maxLogicalRight = max(logicalLeft, maxLogicalRight);
         } else {
             if (curr->renderer()->isPositioned()) {
                 if (curr->renderer()->parent()->style()->isLeftToRightDirection())
@@ -345,7 +379,11 @@ float InlineFlowBox::placeBoxesInInlineDirection(float logicalLeft, bool& needsW
             if (curr->renderer()->isRenderInline()) {
                 InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
                 logicalLeft += flow->marginLogicalLeft();
+                if (knownToHaveNoOverflow())
+                    minLogicalLeft = min(logicalLeft, minLogicalLeft);
                 logicalLeft = flow->placeBoxesInInlineDirection(logicalLeft, needsWordSpacing, textBoxDataMap);
+                if (knownToHaveNoOverflow())
+                    maxLogicalRight = max(logicalLeft, maxLogicalRight);
                 logicalLeft += flow->marginLogicalRight();
             } else if (!curr->renderer()->isListMarker() || toRenderListMarker(curr->renderer())->isInside()) {
                 // The box can have a different writing-mode than the overall line, so this is a bit complicated.
@@ -355,13 +393,20 @@ float InlineFlowBox::placeBoxesInInlineDirection(float logicalLeft, bool& needsW
                 
                 logicalLeft += logicalLeftMargin;
                 curr->setLogicalLeft(logicalLeft);
-                logicalLeft += curr->logicalWidth() + logicalRightMargin;
+                if (knownToHaveNoOverflow())
+                    minLogicalLeft = min(logicalLeft, minLogicalLeft);
+                logicalLeft += curr->logicalWidth();
+                if (knownToHaveNoOverflow())
+                    maxLogicalRight = max(logicalLeft, maxLogicalRight);
+                logicalLeft += logicalRightMargin;
             }
         }
     }
 
     logicalLeft += borderLogicalRight() + paddingLogicalRight();
     setLogicalWidth(logicalLeft - startLogicalLeft);
+    if (knownToHaveNoOverflow() && (minLogicalLeft < startLogicalLeft || maxLogicalRight > logicalLeft))
+        clearKnownToHaveNoOverflow();
     return logicalLeft;
 }
 
@@ -631,7 +676,7 @@ void InlineFlowBox::placeBoxesInBlockDirection(int top, int maxHeight, int maxAs
             lineBottom = max(lineBottom, newLogicalTop + boxHeight);
             lineBottomIncludingMargins = max(lineBottom, max(lineBottomIncludingMargins, newLogicalTopIncludingMargins + boxHeightIncludingMargins));
         }
-        
+
         // Adjust boxes to use their real box y/height and not the logical height (as dictated by
         // line-height).
         if (inlineFlowBox)
@@ -674,7 +719,7 @@ void InlineFlowBox::flipLinesInBlockDirection(int lineTop, int lineBottom)
     }
 }
 
-void InlineFlowBox::addBoxShadowVisualOverflow(IntRect& logicalVisualOverflow)
+inline void InlineFlowBox::addBoxShadowVisualOverflow(IntRect& logicalVisualOverflow)
 {
     if (!parent())
         return; // Box-shadow doesn't apply to root line boxes.
@@ -697,14 +742,15 @@ void InlineFlowBox::addBoxShadowVisualOverflow(IntRect& logicalVisualOverflow)
                                     logicalRightVisualOverflow - logicalLeftVisualOverflow, logicalBottomVisualOverflow - logicalTopVisualOverflow);
 }
 
-void InlineFlowBox::addTextBoxVisualOverflow(const InlineTextBox* textBox, GlyphOverflowAndFallbackFontsMap& textBoxDataMap, IntRect& logicalVisualOverflow)
+inline void InlineFlowBox::addTextBoxVisualOverflow(InlineTextBox* textBox, GlyphOverflowAndFallbackFontsMap& textBoxDataMap, IntRect& logicalVisualOverflow)
 {
-    RenderStyle* style = renderer()->style(m_firstLine);
-    int strokeOverflow = static_cast<int>(ceilf(style->textStrokeWidth() / 2.0f));
+    if (textBox->knownToHaveNoOverflow())
+        return;
 
+    RenderStyle* style = textBox->renderer()->style(m_firstLine);
+    
     GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.find(textBox);
     GlyphOverflow* glyphOverflow = it == textBoxDataMap.end() ? 0 : &it->second.second;
-
     bool isFlippedLine = style->isFlippedLinesWritingMode();
 
     int topGlyphEdge = glyphOverflow ? (isFlippedLine ? glyphOverflow->bottom : glyphOverflow->top) : 0;
@@ -712,6 +758,7 @@ void InlineFlowBox::addTextBoxVisualOverflow(const InlineTextBox* textBox, Glyph
     int leftGlyphEdge = glyphOverflow ? glyphOverflow->left : 0;
     int rightGlyphEdge = glyphOverflow ? glyphOverflow->right : 0;
 
+    int strokeOverflow = static_cast<int>(ceilf(style->textStrokeWidth() / 2.0f));
     int topGlyphOverflow = -strokeOverflow - topGlyphEdge;
     int bottomGlyphOverflow = strokeOverflow + bottomGlyphEdge;
     int leftGlyphOverflow = -strokeOverflow - leftGlyphEdge;
@@ -728,8 +775,7 @@ void InlineFlowBox::addTextBoxVisualOverflow(const InlineTextBox* textBox, Glyph
 
     // If letter-spacing is negative, we should factor that into right layout overflow. (Even in RTL, letter-spacing is
     // applied to the right, so this is not an issue with left overflow.
-    int letterSpacing = min(0, (int)style->font().letterSpacing());
-    rightGlyphOverflow -= letterSpacing;
+    rightGlyphOverflow -= min(0, (int)style->font().letterSpacing());
 
     int textShadowLogicalTop;
     int textShadowLogicalBottom;
@@ -752,9 +798,11 @@ void InlineFlowBox::addTextBoxVisualOverflow(const InlineTextBox* textBox, Glyph
     
     logicalVisualOverflow = IntRect(logicalLeftVisualOverflow, logicalTopVisualOverflow,
                                     logicalRightVisualOverflow - logicalLeftVisualOverflow, logicalBottomVisualOverflow - logicalTopVisualOverflow);
+                                    
+    textBox->setLogicalOverflowRect(logicalVisualOverflow);
 }
 
-void InlineFlowBox::addReplacedChildOverflow(const InlineBox* inlineBox, IntRect& logicalLayoutOverflow, IntRect& logicalVisualOverflow)
+inline void InlineFlowBox::addReplacedChildOverflow(const InlineBox* inlineBox, IntRect& logicalLayoutOverflow, IntRect& logicalVisualOverflow)
 {
     RenderBox* box = toRenderBox(inlineBox->renderer());
     
@@ -775,17 +823,16 @@ void InlineFlowBox::addReplacedChildOverflow(const InlineBox* inlineBox, IntRect
     logicalLayoutOverflow.unite(childLogicalLayoutOverflow);
 }
 
-void InlineFlowBox::computeOverflow(int lineTop, int lineBottom, bool strictMode, GlyphOverflowAndFallbackFontsMap& textBoxDataMap)
+void InlineFlowBox::computeOverflow(int lineTop, int lineBottom, GlyphOverflowAndFallbackFontsMap& textBoxDataMap)
 {
-    // Any spillage outside of the line top and bottom is not considered overflow.  We just ignore this, since it only happens
-    // from the "your ascent/descent don't affect the line" quirk.
-    int topOverflow = max(logicalTop(), lineTop);
-    int bottomOverflow = min(logicalBottom(), lineBottom);
-    
+    // If we know we have no overflow, we can just bail.
+    if (knownToHaveNoOverflow())
+        return;
+
     // Visual overflow just includes overflow for stuff we need to repaint ourselves.  Self-painting layers are ignored.
     // Layout overflow is used to determine scrolling extent, so it still includes child layers and also factors in
     // transforms, relative positioning, etc.
-    IntRect logicalLayoutOverflow(enclosingIntRect(FloatRect(logicalLeft(), topOverflow, logicalWidth(), bottomOverflow - topOverflow)));
+    IntRect logicalLayoutOverflow(enclosingIntRect(logicalFrameRectIncludingLineHeight(lineTop, lineBottom)));
     IntRect logicalVisualOverflow(logicalLayoutOverflow);
   
     // box-shadow on root line boxes is applying to the block and not to the lines.
@@ -800,50 +847,40 @@ void InlineFlowBox::computeOverflow(int lineTop, int lineBottom, bool strictMode
             RenderText* rt = toRenderText(text->renderer());
             if (rt->isBR())
                 continue;
-            addTextBoxVisualOverflow(text, textBoxDataMap, logicalVisualOverflow);
+            IntRect textBoxOverflow(enclosingIntRect(text->logicalFrameRect()));
+            addTextBoxVisualOverflow(text, textBoxDataMap, textBoxOverflow);
+            logicalVisualOverflow.unite(textBoxOverflow);
         } else  if (curr->renderer()->isRenderInline()) {
             InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
-            flow->computeOverflow(lineTop, lineBottom, strictMode, textBoxDataMap);
+            flow->computeOverflow(lineTop, lineBottom, textBoxDataMap);
             if (!flow->boxModelObject()->hasSelfPaintingLayer())
-                logicalVisualOverflow.unite(flow->logicalVisualOverflowRect());
-            IntRect childLayoutOverflow = flow->logicalLayoutOverflowRect();
+                logicalVisualOverflow.unite(flow->logicalVisualOverflowRect(lineTop, lineBottom));
+            IntRect childLayoutOverflow = flow->logicalLayoutOverflowRect(lineTop, lineBottom);
             childLayoutOverflow.move(flow->boxModelObject()->relativePositionLogicalOffset());
             logicalLayoutOverflow.unite(childLayoutOverflow);
         } else
             addReplacedChildOverflow(curr, logicalLayoutOverflow, logicalVisualOverflow);
     }
     
-    setOverflowFromLogicalRects(logicalLayoutOverflow, logicalVisualOverflow);
+    setOverflowFromLogicalRects(logicalLayoutOverflow, logicalVisualOverflow, lineTop, lineBottom);
 }
 
-// FIXME: You will notice there is no contains() check here.  If the rect is smaller than the frame box it actually
-// becomes the new overflow.  The reason for this is that in quirks mode we don't let inline flow boxes paint
-// outside of the root line box's lineTop and lineBottom values.  We accomplish this visual clamping by actually
-// insetting the overflow rect so that it's smaller than the frame rect.
-//
-// The reason we don't just mutate the frameRect in quirks mode is that we'd have to put the m_height member variable
-// back into InlineBox.  Basically the tradeoff is 4 bytes in all modes (for m_height) added to InlineFlowBox, or
-// the allocation of a RenderOverflow struct for InlineFlowBoxes in quirks mode only.  For now, we're opting to award
-// the smaller memory consumption to strict mode pages.
-//
-// It might be possible to hash a custom height, or to require that lineTop and lineBottom be passed in to
-// all functions that query overflow.   
-void InlineFlowBox::setLayoutOverflow(const IntRect& rect)
+void InlineFlowBox::setLayoutOverflow(const IntRect& rect, int lineTop, int lineBottom)
 {
-    IntRect frameBox = enclosingIntRect(FloatRect(x(), y(), width(), height()));
-    if (frameBox == rect || rect.isEmpty())
+    IntRect frameBox = enclosingIntRect(frameRectIncludingLineHeight(lineTop, lineBottom));
+    if (frameBox.contains(rect) || rect.isEmpty())
         return;
-        
+
     if (!m_overflow)
         m_overflow.set(new RenderOverflow(frameBox, frameBox));
     
     m_overflow->setLayoutOverflow(rect);
 }
 
-void InlineFlowBox::setVisualOverflow(const IntRect& rect)
+void InlineFlowBox::setVisualOverflow(const IntRect& rect, int lineTop, int lineBottom)
 {
-    IntRect frameBox = enclosingIntRect(FloatRect(x(), y(), width(), height()));
-    if (frameBox == rect || rect.isEmpty())
+    IntRect frameBox = enclosingIntRect(frameRectIncludingLineHeight(lineTop, lineBottom));
+    if (frameBox.contains(rect) || rect.isEmpty())
         return;
         
     if (!m_overflow)
@@ -852,18 +889,18 @@ void InlineFlowBox::setVisualOverflow(const IntRect& rect)
     m_overflow->setVisualOverflow(rect);
 }
 
-void InlineFlowBox::setOverflowFromLogicalRects(const IntRect& logicalLayoutOverflow, const IntRect& logicalVisualOverflow)
+void InlineFlowBox::setOverflowFromLogicalRects(const IntRect& logicalLayoutOverflow, const IntRect& logicalVisualOverflow, int lineTop, int lineBottom)
 {
     IntRect layoutOverflow(isHorizontal() ? logicalLayoutOverflow : logicalLayoutOverflow.transposedRect());
-    setLayoutOverflow(layoutOverflow);
+    setLayoutOverflow(layoutOverflow, lineTop, lineBottom);
     
     IntRect visualOverflow(isHorizontal() ? logicalVisualOverflow : logicalVisualOverflow.transposedRect());
-    setVisualOverflow(visualOverflow);
+    setVisualOverflow(visualOverflow, lineTop, lineBottom);
 }
 
-bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
+bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, int lineTop, int lineBottom)
 {
-    IntRect overflowRect(visualOverflowRect());
+    IntRect overflowRect(visualOverflowRect(lineTop, lineBottom));
     flipForWritingMode(overflowRect);
     overflowRect.move(tx, ty);
     if (!overflowRect.intersects(result.rectForPoint(x, y)))
@@ -871,7 +908,7 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 
     // Check children first.
     for (InlineBox* curr = lastChild(); curr; curr = curr->prevOnLine()) {
-        if ((curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer()) && curr->nodeAtPoint(request, result, x, y, tx, ty)) {
+        if ((curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer()) && curr->nodeAtPoint(request, result, x, y, tx, ty, lineTop, lineBottom)) {
             renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
             return true;
         }
@@ -909,9 +946,9 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
     return false;
 }
 
-void InlineFlowBox::paint(PaintInfo& paintInfo, int tx, int ty)
+void InlineFlowBox::paint(PaintInfo& paintInfo, int tx, int ty, int lineTop, int lineBottom)
 {
-    IntRect overflowRect(visualOverflowRect());
+    IntRect overflowRect(visualOverflowRect(lineTop, lineBottom));
     overflowRect.inflate(renderer()->maximalOutlineSize(paintInfo.phase));
     flipForWritingMode(overflowRect);
     overflowRect.move(tx, ty);
@@ -974,7 +1011,7 @@ void InlineFlowBox::paint(PaintInfo& paintInfo, int tx, int ty)
     if (paintPhase != PaintPhaseSelfOutline) {
         for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
             if (curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer())
-                curr->paint(childInfo, tx, ty);
+                curr->paint(childInfo, tx, ty, lineTop, lineBottom);
         }
     }
 }
@@ -992,7 +1029,7 @@ void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, c
     StyleImage* img = fillLayer->image();
     bool hasFillImage = img && img->canRender(renderer()->style()->effectiveZoom());
     if ((!hasFillImage && !renderer()->style()->hasBorderRadius()) || (!prevLineBox() && !nextLineBox()) || !parent())
-        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, w, h, this, op);
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, w, h, this, w, h, op);
     else {
         // We have a fill image that spans multiple lines.
         // We need to adjust tx and ty by the width of all previous lines.
@@ -1021,7 +1058,7 @@ void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, c
         int stripHeight = isHorizontal() ? height() : totalLogicalWidth;
         paintInfo.context->save();
         paintInfo.context->clip(IntRect(tx, ty, width(), height()));
-        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, stripX, stripY, stripWidth, stripHeight, this, op);
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, stripX, stripY, stripWidth, stripHeight, this, w, h, op);
         paintInfo.context->restore();
     }
 }
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 9b6f8e4..9b34e9d 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -105,8 +105,8 @@ public:
     void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
     void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(GraphicsContext*, RenderStyle*, ShadowStyle, int tx, int ty, int w, int h);
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty, int lineTop, int lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, int lineTop, int lineBottom);
 
     virtual RenderLineBoxList* rendererLineBoxes() const;
 
@@ -159,9 +159,8 @@ public:
     }
 
     // Helper functions used during line construction and placement.
-    void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer);
+    void determineSpacingForFlowBoxes(bool lastLine, bool isLogicallyLastRunWrapped, RenderObject* logicallyLastRunRenderer);
     int getFlowSpacingLogicalWidth();
-    bool onEndChain(RenderObject* endObject);
     float placeBoxesInInlineDirection(float logicalLeft, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap&);
     void computeLogicalBoxHeights(RootInlineBox*, int& maxPositionTop, int& maxPositionBottom,
                                   int& maxAscent, int& maxDescent, bool& setMaxAscent, bool& setMaxDescent,
@@ -176,7 +175,7 @@ public:
     int computeOverAnnotationAdjustment(int allowedPosition) const;
     int computeUnderAnnotationAdjustment(int allowedPosition) const;
 
-    void computeOverflow(int lineTop, int lineBottom, bool strictMode, GlyphOverflowAndFallbackFontsMap&);
+    void computeOverflow(int lineTop, int lineBottom, GlyphOverflowAndFallbackFontsMap&);
     
     void removeChild(InlineBox* child);
 
@@ -194,44 +193,74 @@ public:
     // Line visual and layout overflow are in the coordinate space of the block.  This means that they aren't purely physical directions.
     // For horizontal-tb and vertical-lr they will match physical directions, but for horizontal-bt and vertical-rl, the top/bottom and left/right
     // respectively are flipped when compared to their physical counterparts.  For example minX is on the left in vertical-lr, but it is on the right in vertical-rl.
-    int minYLayoutOverflow() const { return m_overflow ? m_overflow->minYLayoutOverflow() : m_y; }
-    int maxYLayoutOverflow() const { return m_overflow ? m_overflow->maxYLayoutOverflow() : ceilf(m_y + height()); }
-    int minXLayoutOverflow() const { return m_overflow ? m_overflow->minXLayoutOverflow() : m_x; }
-    int maxXLayoutOverflow() const { return m_overflow ? m_overflow->maxXLayoutOverflow() : ceilf(m_x + width()); }
-    IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : enclosingIntRect(FloatRect(m_x, m_y, width(), height())); }
-    int logicalLeftLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? minXLayoutOverflow() : minYLayoutOverflow(); }
-    int logicalRightLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? maxXLayoutOverflow() : maxYLayoutOverflow(); }
-    int logicalTopLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? minYVisualOverflow() : minXVisualOverflow(); }
-    int logicalBottomLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? maxYLayoutOverflow() : maxXLayoutOverflow(); }
-    IntRect logicalLayoutOverflowRect() const
+    IntRect layoutOverflowRect(int lineTop, int lineBottom) const
+    { 
+        return m_overflow ? m_overflow->layoutOverflowRect() : enclosingIntRect(frameRectIncludingLineHeight(lineTop, lineBottom));
+    }
+    int logicalLeftLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXLayoutOverflow() : m_overflow->minYLayoutOverflow()) : logicalLeft(); }
+    int logicalRightLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXLayoutOverflow() : m_overflow->maxYLayoutOverflow()) : ceilf(logicalRight()); }
+    int logicalTopLayoutOverflow(int lineTop) const
     {
-        IntRect result = layoutOverflowRect();
-        if (!renderer()->style()->isHorizontalWritingMode())
+        if (m_overflow)
+            return isHorizontal() ? m_overflow->minYLayoutOverflow() : m_overflow->minXLayoutOverflow();
+        return lineTop;
+    }
+    int logicalBottomLayoutOverflow(int lineBottom) const
+    {
+        if (m_overflow)
+            return isHorizontal() ? m_overflow->maxYLayoutOverflow() : m_overflow->maxXLayoutOverflow();
+        return lineBottom;
+    }
+    IntRect logicalLayoutOverflowRect(int lineTop, int lineBottom) const
+    {
+        IntRect result = layoutOverflowRect(lineTop, lineBottom);
+        if (!renderer()->isHorizontalWritingMode())
             result = result.transposedRect();
         return result;
     }
 
-    int minYVisualOverflow() const { return m_overflow ? m_overflow->minYVisualOverflow() : m_y; }
-    int maxYVisualOverflow() const { return m_overflow ? m_overflow->maxYVisualOverflow() : ceilf(m_y + height()); }
-    int minXVisualOverflow() const { return m_overflow ? m_overflow->minXVisualOverflow() : m_x; }
-    int maxXVisualOverflow() const { return m_overflow ? m_overflow->maxXVisualOverflow() : ceilf(m_x + width()); }
-    IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : enclosingIntRect(FloatRect(m_x, m_y, width(), height())); }
-    int logicalLeftVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? minXVisualOverflow() : minYVisualOverflow(); }
-    int logicalRightVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? maxXVisualOverflow() : maxYVisualOverflow(); }
-    int logicalTopVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? minYVisualOverflow() : minXVisualOverflow(); }
-    int logicalBottomVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? maxYVisualOverflow() : maxXVisualOverflow(); }
-    IntRect logicalVisualOverflowRect() const
+    IntRect visualOverflowRect(int lineTop, int lineBottom) const
+    { 
+        return m_overflow ? m_overflow->visualOverflowRect() : enclosingIntRect(frameRectIncludingLineHeight(lineTop, lineBottom));
+    }
+    int logicalLeftVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXVisualOverflow() : m_overflow->minYVisualOverflow()) : logicalLeft(); }
+    int logicalRightVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXVisualOverflow() : m_overflow->maxYVisualOverflow()) : ceilf(logicalRight()); }
+    int logicalTopVisualOverflow(int lineTop) const
+    {
+        if (m_overflow)
+            return isHorizontal() ? m_overflow->minYVisualOverflow() : m_overflow->minXVisualOverflow();
+        return lineTop;
+    }
+    int logicalBottomVisualOverflow(int lineBottom) const
+    {
+        if (m_overflow)
+            return isHorizontal() ? m_overflow->maxYVisualOverflow() : m_overflow->maxXVisualOverflow();
+        return lineBottom;
+    }
+    IntRect logicalVisualOverflowRect(int lineTop, int lineBottom) const
     {
-        IntRect result = visualOverflowRect();
-        if (!renderer()->style()->isHorizontalWritingMode())
+        IntRect result = visualOverflowRect(lineTop, lineBottom);
+        if (!renderer()->isHorizontalWritingMode())
             result = result.transposedRect();
         return result;
     }
 
-    void setOverflowFromLogicalRects(const IntRect& logicalLayoutOverflow, const IntRect& logicalVisualOverflow);
-    void setLayoutOverflow(const IntRect&);
-    void setVisualOverflow(const IntRect&);
+    void setOverflowFromLogicalRects(const IntRect& logicalLayoutOverflow, const IntRect& logicalVisualOverflow, int lineTop, int lineBottom);
+    void setLayoutOverflow(const IntRect&, int lineTop, int lineBottom);
+    void setVisualOverflow(const IntRect&, int lineTop, int lineBottom);
 
+    FloatRect frameRectIncludingLineHeight(int lineTop, int lineBottom) const
+    {
+        if (isHorizontal())
+            return FloatRect(m_x, lineTop, width(), lineBottom - lineTop);
+        return FloatRect(lineTop, m_y, lineBottom - lineTop, height());
+    }
+    
+    FloatRect logicalFrameRectIncludingLineHeight(int lineTop, int lineBottom) const
+    {
+        return FloatRect(logicalLeft(), lineTop, logicalWidth(), lineBottom - lineTop);
+    }
+    
     bool descendantsHaveSameLineHeightAndBaseline() const { return m_descendantsHaveSameLineHeightAndBaseline; }
     void clearDescendantsHaveSameLineHeightAndBaseline()
     { 
@@ -242,7 +271,7 @@ public:
 
 private:
     void addBoxShadowVisualOverflow(IntRect& logicalVisualOverflow);
-    void addTextBoxVisualOverflow(const InlineTextBox*, GlyphOverflowAndFallbackFontsMap&, IntRect& logicalVisualOverflow);
+    void addTextBoxVisualOverflow(InlineTextBox*, GlyphOverflowAndFallbackFontsMap&, IntRect& logicalVisualOverflow);
     void addReplacedChildOverflow(const InlineBox*, IntRect& logicalLayoutOverflow, IntRect& logicalVisualOverflow);
 
 protected:
diff --git a/Source/WebCore/rendering/InlineIterator.h b/Source/WebCore/rendering/InlineIterator.h
index 75d9763..1f6b21c 100644
--- a/Source/WebCore/rendering/InlineIterator.h
+++ b/Source/WebCore/rendering/InlineIterator.h
@@ -34,15 +34,15 @@ namespace WebCore {
 class InlineIterator {
 public:
     InlineIterator()
-        : m_block(0)
+        : m_root(0)
         , m_obj(0)
         , m_pos(0)
         , m_nextBreakablePosition(-1)
     {
     }
 
-    InlineIterator(RenderBlock* b, RenderObject* o, unsigned p)
-        : m_block(b)
+    InlineIterator(RenderObject* root, RenderObject* o, unsigned p)
+        : m_root(root)
         , m_obj(o)
         , m_pos(p)
         , m_nextBreakablePosition(-1)
@@ -63,13 +63,30 @@ public:
         m_nextBreakablePosition = nextBreak;
     }
 
-    void increment(InlineBidiResolver* resolver = 0);
+    RenderObject* root() const { return m_root; }
+
+    void increment(InlineBidiResolver* = 0);
     bool atEnd() const;
 
+    inline bool atTextParagraphSeparator()
+    {
+        return m_obj && m_obj->preservesNewline() && m_obj->isText() && toRenderText(m_obj)->textLength()
+            && !toRenderText(m_obj)->isWordBreak() && toRenderText(m_obj)->characters()[m_pos] == '\n';
+    }
+    
+    inline bool atParagraphSeparator()
+    {
+        return (m_obj && m_obj->isBR()) || atTextParagraphSeparator();
+    }
+
     UChar current() const;
     ALWAYS_INLINE WTF::Unicode::Direction direction() const;
 
-    RenderBlock* m_block;
+private:
+    RenderObject* m_root;
+
+    // FIXME: These should be private.
+public:
     RenderObject* m_obj;
     unsigned m_pos;
     int m_nextBreakablePosition;
@@ -117,7 +134,7 @@ static inline void notifyResolverWillExitObject(InlineBidiResolver* resolver, Re
 // FIXME: This function is misleadingly named. It has little to do with bidi.
 // This function will iterate over inlines within a block, optionally notifying
 // a bidi resolver as it enters/exits inlines (so it can push/pop embedding levels).
-static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current, InlineBidiResolver* resolver = 0, bool skipInlines = true, bool* endOfInlinePtr = 0)
+static inline RenderObject* bidiNext(RenderObject* root, RenderObject* current, InlineBidiResolver* resolver = 0, bool skipInlines = true, bool* endOfInlinePtr = 0)
 {
     RenderObject* next = 0;
     bool oldEndOfInline = endOfInlinePtr ? *endOfInlinePtr : false;
@@ -137,7 +154,7 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
                 break;
             }
 
-            while (current && current != block) {
+            while (current && current != root) {
                 notifyResolverWillExitObject(resolver, current);
 
                 next = current->nextSibling();
@@ -147,7 +164,7 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
                 }
 
                 current = current->parent();
-                if (!skipInlines && current && current != block && current->isRenderInline()) {
+                if (!skipInlines && current && current != root && current->isRenderInline()) {
                     next = current;
                     endOfInline = true;
                     break;
@@ -171,16 +188,16 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
     return next;
 }
 
-static inline RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* resolver, bool skipInlines = true)
+static inline RenderObject* bidiFirst(RenderObject* root, InlineBidiResolver* resolver, bool skipInlines = true)
 {
-    if (!block->firstChild())
+    if (!root->firstChild())
         return 0;
 
-    RenderObject* o = block->firstChild();
+    RenderObject* o = root->firstChild();
     if (o->isRenderInline()) {
         notifyResolverEnteredObject(resolver, o);
         if (skipInlines && o->firstChild())
-            o = bidiNext(block, o, resolver, skipInlines);
+            o = bidiNext(root, o, resolver, skipInlines);
         else {
             // Never skip empty inlines.
             if (resolver)
@@ -190,7 +207,7 @@ static inline RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* re
     }
 
     if (o && !o->isText() && !o->isReplaced() && !o->isFloating() && !o->isPositioned())
-        o = bidiNext(block, o, resolver, skipInlines);
+        o = bidiNext(root, o, resolver, skipInlines);
 
     if (resolver)
         resolver->commitExplicitEmbedding();
@@ -207,7 +224,7 @@ inline void InlineIterator::increment(InlineBidiResolver* resolver)
             return;
     }
     // bidiNext can return 0, so use moveTo instead of moveToStartOf
-    moveTo(bidiNext(m_block, m_obj, resolver), 0);
+    moveTo(bidiNext(m_root, m_obj, resolver), 0);
 }
 
 inline bool InlineIterator::atEnd() const
@@ -247,13 +264,13 @@ inline void InlineBidiResolver::increment()
 template <>
 inline void InlineBidiResolver::appendRun()
 {
-    if (!emptyRun && !m_eor.atEnd()) {
+    if (!m_emptyRun && !m_eor.atEnd()) {
         int start = m_sor.m_pos;
         RenderObject* obj = m_sor.m_obj;
         while (obj && obj != m_eor.m_obj && obj != endOfLine.m_obj) {
-            RenderBlock::appendRunsForObject(start, obj->length(), obj, *this);        
+            RenderBlock::appendRunsForObject(m_runs, start, obj->length(), obj, *this);
             start = 0;
-            obj = bidiNext(m_sor.m_block, obj);
+            obj = bidiNext(m_sor.root(), obj);
         }
         if (obj) {
             unsigned pos = obj == m_eor.m_obj ? m_eor.m_pos : UINT_MAX;
@@ -263,9 +280,9 @@ inline void InlineBidiResolver::appendRun()
             }
             // It's OK to add runs for zero-length RenderObjects, just don't make the run larger than it should be
             int end = obj->length() ? pos + 1 : 0;
-            RenderBlock::appendRunsForObject(start, end, obj, *this);
+            RenderBlock::appendRunsForObject(m_runs, start, end, obj, *this);
         }
-        
+
         m_eor.increment();
         m_sor = m_eor;
     }
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index b614f0f..5815b8b 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -48,20 +48,49 @@ using namespace std;
 
 namespace WebCore {
 
+typedef WTF::HashMap<const InlineTextBox*, IntRect> InlineTextBoxOverflowMap;
+static InlineTextBoxOverflowMap* gTextBoxesWithOverflow;
+
+void InlineTextBox::destroy(RenderArena* arena)
+{
+    if (!m_knownToHaveNoOverflow && gTextBoxesWithOverflow)
+        gTextBoxesWithOverflow->remove(this);
+    InlineBox::destroy(arena);
+}
+
+IntRect InlineTextBox::logicalOverflowRect() const
+{
+    if (m_knownToHaveNoOverflow || !gTextBoxesWithOverflow)
+        return enclosingIntRect(logicalFrameRect());
+    return gTextBoxesWithOverflow->get(this);
+}
+
+void InlineTextBox::setLogicalOverflowRect(const IntRect& rect)
+{
+    ASSERT(!m_knownToHaveNoOverflow);
+    if (!gTextBoxesWithOverflow)
+        gTextBoxesWithOverflow = new InlineTextBoxOverflowMap;
+    gTextBoxesWithOverflow->add(this, rect);
+}
+
 int InlineTextBox::baselinePosition(FontBaseline baselineType) const
 {
     if (!isText() || !parent())
         return 0;
-    return parent()->baselinePosition(baselineType);
+    if (parent()->renderer() == renderer()->parent())
+        return parent()->baselinePosition(baselineType);
+    return toRenderBoxModelObject(renderer()->parent())->baselinePosition(baselineType, m_firstLine, isHorizontal() ? HorizontalLine : VerticalLine, PositionOnContainingLine);
 }
     
 int InlineTextBox::lineHeight() const
 {
-    if (!isText() || !parent())
+    if (!isText() || !renderer()->parent())
         return 0;
     if (m_renderer->isBR())
         return toRenderBR(m_renderer)->lineHeight(m_firstLine);
-    return parent()->lineHeight();
+    if (parent()->renderer() == renderer()->parent())
+        return parent()->lineHeight();
+    return toRenderBoxModelObject(renderer()->parent())->lineHeight(m_firstLine, isHorizontal() ? HorizontalLine : VerticalLine, PositionOnContainingLine);
 }
 
 int InlineTextBox::selectionTop()
@@ -314,7 +343,7 @@ bool InlineTextBox::isLineBreak() const
     return renderer()->isBR() || (renderer()->style()->preserveNewline() && len() == 1 && (*textRenderer()->text())[start()] == '\n');
 }
 
-bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, int x, int y, int tx, int ty)
+bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, int x, int y, int tx, int ty, int /* lineTop */, int /*lineBottom*/)
 {
     if (isLineBreak())
         return false;
@@ -435,7 +464,7 @@ static inline AffineTransform rotation(const FloatRect& boxRect, RotationDirecti
         : AffineTransform(0, -1, 1, 0, boxRect.x() - boxRect.maxY(), boxRect.x() + boxRect.maxY());
 }
 
-void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
+void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty, int /*lineTop*/, int /*lineBottom*/)
 {
     if (isLineBreak() || !paintInfo.shouldPaintWithinRoot(renderer()) || renderer()->style()->visibility() != VISIBLE ||
         m_truncation == cFullTruncation || paintInfo.phase == PaintPhaseOutline || !m_len)
@@ -443,12 +472,10 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
 
     ASSERT(paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines);
 
-    // FIXME: Technically we're potentially incorporating other visual overflow that had nothing to do with us.
-    // Would it be simpler to just check our own shadow and stroke overflow by hand here?
-    int logicalLeftOverflow = parent()->logicalLeft() - parent()->logicalLeftVisualOverflow();
-    int logicalRightOverflow = parent()->logicalRightVisualOverflow() - (parent()->logicalLeft() + parent()->logicalWidth());
-    int logicalStart = logicalLeft() - logicalLeftOverflow + (isHorizontal() ? tx : ty);
-    int logicalExtent = logicalWidth() + logicalLeftOverflow + logicalRightOverflow;
+    int logicalLeftSide = logicalLeftVisualOverflow();
+    int logicalRightSide = logicalRightVisualOverflow();
+    int logicalStart = logicalLeftSide + (isHorizontal() ? tx : ty);
+    int logicalExtent = logicalRightSide - logicalLeftSide;
     
     int paintEnd = isHorizontal() ? paintInfo.rect.maxX() : paintInfo.rect.maxY();
     int paintStart = isHorizontal() ? paintInfo.rect.x() : paintInfo.rect.y();
diff --git a/Source/WebCore/rendering/InlineTextBox.h b/Source/WebCore/rendering/InlineTextBox.h
index 98a1b78..1878c9f 100644
--- a/Source/WebCore/rendering/InlineTextBox.h
+++ b/Source/WebCore/rendering/InlineTextBox.h
@@ -51,6 +51,8 @@ public:
     {
     }
 
+    virtual void destroy(RenderArena*);
+
     InlineTextBox* prevTextBox() const { return m_prevTextBox; }
     InlineTextBox* nextTextBox() const { return m_nextTextBox; }
     void setNextTextBox(InlineTextBox* n) { m_nextTextBox = n; }
@@ -80,6 +82,13 @@ public:
 
     bool getEmphasisMarkPosition(RenderStyle*, TextEmphasisPosition&) const;
 
+    IntRect logicalOverflowRect() const;
+    void setLogicalOverflowRect(const IntRect&);
+    int logicalTopVisualOverflow() const { return logicalOverflowRect().y(); }
+    int logicalBottomVisualOverflow() const { return logicalOverflowRect().maxY(); }
+    int logicalLeftVisualOverflow() const { return logicalOverflowRect().x(); }
+    int logicalRightVisualOverflow() const { return logicalOverflowRect().maxX(); }
+    
 private:
     int selectionTop();
     int selectionBottom();
@@ -93,8 +102,8 @@ public:
     void selectionStartEnd(int& sPos, int& ePos);
 
 protected:
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty, int lineTop, int lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, int lineTop, int lineBottom);
 
 public:
     RenderText* textRenderer() const;
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 919e23b..de3af60 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -52,7 +52,6 @@
 #include "Settings.h"
 #include "TextRun.h"
 #include "TransformState.h"
-#include "visible_units.h"
 #include <wtf/StdLibExtras.h>
 
 #ifdef ANDROID_LAYOUT
@@ -1550,8 +1549,9 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
         runInChild = nextSibling;
     }
 
-    // Now insert the new child under |currBlock|.
-    currBlock->children()->insertChildNode(currBlock, inlineRunIn, currBlock->firstChild());
+    // Now insert the new child under |currBlock|. Use addChild instead of insertChildNode since it handles correct placement of the children, esp where we cannot insert
+    // anything before the first child. e.g. details tag. See https://bugs.webkit.org/show_bug.cgi?id=58228.
+    currBlock->addChild(inlineRunIn, currBlock->firstChild());
     
     // If the run-in had an element, we need to set the new renderer.
     if (runInNode)
@@ -2106,7 +2106,7 @@ void RenderBlock::simplifiedNormalFlowLayout()
         GlyphOverflowAndFallbackFontsMap textBoxDataMap;                  
         for (ListHashSet<RootInlineBox*>::const_iterator it = lineBoxes.begin(); it != lineBoxes.end(); ++it) {
             RootInlineBox* box = *it;
-            box->computeOverflow(box->lineTop(), box->lineBottom(), document()->inNoQuirksMode(), textBoxDataMap);
+            box->computeOverflow(box->lineTop(), box->lineBottom(), textBoxDataMap);
         }
     } else {
         for (RenderBox* box = firstChildBox(); box; box = box->nextSiblingBox()) {
@@ -2123,11 +2123,8 @@ bool RenderBlock::simplifiedLayout()
 
     LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
     
-    if (needsPositionedMovementLayout()) {
-        tryLayoutDoingPositionedMovementOnly();
-        if (needsLayout())
-            return false;
-    }
+    if (needsPositionedMovementLayout() && !tryLayoutDoingPositionedMovementOnly())
+        return false;
 
     // Lay out positioned descendants or objects that just need to recompute overflow.
     if (needsSimplifiedNormalFlowLayout())
@@ -2190,8 +2187,8 @@ void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
 
         // We don't have to do a full layout.  We just have to update our position. Try that first. If we have shrink-to-fit width
         // and we hit the available width constraint, the layoutIfNeeded() will catch it and do a full layout.
-        if (r->needsPositionedMovementLayoutOnly())
-            r->tryLayoutDoingPositionedMovementOnly();
+        if (r->needsPositionedMovementLayoutOnly() && r->tryLayoutDoingPositionedMovementOnly())
+            r->setNeedsLayout(false);
         r->layoutIfNeeded();
     }
     
@@ -2376,7 +2373,7 @@ void RenderBlock::paintContents(PaintInfo& paintInfo, int tx, int ty)
     // Avoid painting descendants of the root element when stylesheets haven't loaded.  This eliminates FOUC.
     // It's ok not to draw, because later on, when all the stylesheets do load, updateStyleSelector on the Document
     // will do a full repaint().
-    if (document()->mayCauseFlashOfUnstyledContent() && !isRenderView())
+    if (document()->didLayoutWithPendingStylesheets() && !isRenderView())
         return;
 
     if (childrenInline())
@@ -2606,7 +2603,7 @@ void RenderBlock::paintEllipsisBoxes(PaintInfo& paintInfo, int tx, int ty)
             yPos = ty + curr->y();
             h = curr->logicalHeight();
             if (curr->ellipsisBox() && yPos < paintInfo.rect.maxY() && yPos + h > paintInfo.rect.y())
-                curr->paintEllipsisBox(paintInfo, tx, ty);
+                curr->paintEllipsisBox(paintInfo, tx, ty, curr->lineTop(), curr->lineBottom());
         }
     }
 }
@@ -3336,59 +3333,6 @@ bool RenderBlock::positionNewFloats()
     return true;
 }
 
-bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, bool firstLine, int& lineLeftOffset, int& lineRightOffset)
-{
-    bool didPosition = positionNewFloats();
-    if (!didPosition)
-        return didPosition;
-
-    int blockOffset = logicalHeight();
-    if (blockOffset >= logicalTopForFloat(newFloat) && blockOffset < logicalBottomForFloat(newFloat)) {
-        if (newFloat->type() == FloatingObject::FloatLeft)
-            lineLeftOffset = logicalRightForFloat(newFloat);
-        else
-            lineRightOffset = logicalLeftForFloat(newFloat);
-    }
-    
-    if (!newFloat->m_paginationStrut)
-        return didPosition;
-     
-    FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-    ASSERT(floatingObjectSet.last() == newFloat);
-
-    int floatLogicalTop = logicalTopForFloat(newFloat);
-    int paginationStrut = newFloat->m_paginationStrut;
-    
-    if (floatLogicalTop - paginationStrut != logicalHeight())
-        return didPosition;
-
-    FloatingObjectSetIterator it = floatingObjectSet.end();
-    --it; // Last float is newFloat, skip that one.
-    FloatingObjectSetIterator begin = floatingObjectSet.begin();
-    while (it != begin) {
-        --it;
-        FloatingObject* f = *it;
-        if (f == lastFloatFromPreviousLine)
-            break;
-        if (logicalTopForFloat(f) == logicalHeight()) {
-            ASSERT(!f->m_paginationStrut);
-            f->m_paginationStrut = paginationStrut;
-            RenderBox* o = f->m_renderer;
-            setLogicalTopForChild(o, logicalTopForChild(o) + marginBeforeForChild(o) + paginationStrut);
-            if (o->isRenderBlock())
-                toRenderBlock(o)->setChildNeedsLayout(true, false);
-            o->layoutIfNeeded();
-            setLogicalTopForFloat(f, logicalTopForFloat(f) + f->m_paginationStrut);
-        }
-    }
-        
-    setLogicalHeight(blockOffset + paginationStrut);
-    lineLeftOffset = logicalLeftOffsetForLine(logicalHeight(), firstLine);
-    lineRightOffset = logicalRightOffsetForLine(logicalHeight(), firstLine);
-
-    return didPosition;
-}
-
 void RenderBlock::newLine(EClear clear)
 {
     positionNewFloats();
@@ -3721,6 +3665,7 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int logicalLeftOffset,
     if (child->hasOverflowClip() || !child->containsFloats() || child->isRoot() || child->hasColumns() || child->isWritingModeRoot())
         return 0;
 
+    int childLogicalTop = child->logicalTop();
     int lowestFloatLogicalBottom = 0;
 
     // Floats that will remain the child's responsibility to paint should factor into its
@@ -3728,7 +3673,8 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int logicalLeftOffset,
     FloatingObjectSetIterator childEnd = child->m_floatingObjects->set().end();
     for (FloatingObjectSetIterator childIt = child->m_floatingObjects->set().begin(); childIt != childEnd; ++childIt) {
         FloatingObject* r = *childIt;
-        int logicalBottom = child->logicalTop() + logicalBottomForFloat(r);
+        int logicalBottomForFloat = min(this->logicalBottomForFloat(r), numeric_limits<int>::max() - childLogicalTop);
+        int logicalBottom = childLogicalTop + logicalBottomForFloat;
         lowestFloatLogicalBottom = max(lowestFloatLogicalBottom, logicalBottom);
 
         if (logicalBottom > logicalHeight()) {
@@ -4277,34 +4223,15 @@ void RenderBlock::calcColumnWidth()
     int colWidth = max(1, static_cast<int>(style()->columnWidth()));
     int colCount = max(1, static_cast<int>(style()->columnCount()));
 
-    if (style()->hasAutoColumnWidth()) {
-        if ((colCount - 1) * colGap < availWidth) {
-            desiredColumnCount = colCount;
-            desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
-        } else if (colGap < availWidth) {
-            desiredColumnCount = availWidth / colGap;
-            if (desiredColumnCount < 1)
-                desiredColumnCount = 1;
-            desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
-        }
-    } else if (style()->hasAutoColumnCount()) {
-        if (colWidth < availWidth) {
-            desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
-            if (desiredColumnCount < 1)
-                desiredColumnCount = 1;
-            desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
-        }
+    if (style()->hasAutoColumnWidth() && !style()->hasAutoColumnCount()) {
+        desiredColumnCount = colCount;
+        desiredColumnWidth = max<int>(0, (availWidth - ((desiredColumnCount - 1) * colGap)) / desiredColumnCount);
+    } else if (!style()->hasAutoColumnWidth() && style()->hasAutoColumnCount()) {
+        desiredColumnCount = max<int>(1, (float)(availWidth + colGap) / (colWidth + colGap));
+        desiredColumnWidth = ((availWidth + colGap) / desiredColumnCount) - colGap;
     } else {
-        // Both are set.
-        if (colCount * colWidth + (colCount - 1) * colGap <= availWidth) {
-            desiredColumnCount = colCount;
-            desiredColumnWidth = colWidth;
-        } else if (colWidth < availWidth) {
-            desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
-            if (desiredColumnCount < 1)
-                desiredColumnCount = 1;
-            desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
-        }
+        desiredColumnCount = max(min<int>(colCount, (float)(availWidth + colGap) / (colWidth + colGap)), 1);
+        desiredColumnWidth = ((availWidth + colGap) / desiredColumnCount) - colGap;
     }
     setDesiredColumnCountAndWidth(desiredColumnCount, desiredColumnWidth);
 }
@@ -5395,7 +5322,7 @@ void RenderBlock::updateFirstLetter()
             view()->disableLayoutState();
             while (RenderObject* child = firstLetter->firstChild()) {
                 if (child->isText())
-                    toRenderText(child)->dirtyLineBoxes(true);
+                    toRenderText(child)->removeAndDestroyTextBoxes();
                 firstLetter->removeChild(child);
                 newFirstLetter->addChild(child, 0);
             }
@@ -6081,8 +6008,9 @@ void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, int& d
     // line and all following lines.
     LayoutState* layoutState = view()->layoutState();
     int pageLogicalHeight = layoutState->m_pageLogicalHeight;
-    int logicalOffset = lineBox->logicalTopVisualOverflow();
-    int lineHeight = lineBox->logicalBottomVisualOverflow() - logicalOffset;
+    IntRect logicalVisualOverflow = lineBox->logicalVisualOverflowRect(lineBox->lineTop(), lineBox->lineBottom());
+    int logicalOffset = logicalVisualOverflow.y();
+    int lineHeight = logicalVisualOverflow.maxY() - logicalOffset;
     if (layoutState->m_columnInfo)
         layoutState->m_columnInfo->updateMinimumColumnHeight(lineHeight);
     logicalOffset += delta;
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 74751e1..75d93e9 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -32,16 +32,19 @@
 
 namespace WebCore {
 
+class BidiContext;
 class ColumnInfo;
 class InlineIterator;
 class LayoutStateMaintainer;
 class LazyLineBreakIterator;
+class LineWidth;
 class RenderInline;
 
 struct BidiRun;
 struct PaintInfo;
 
 template <class Iterator, class Run> class BidiResolver;
+template <class Run> class BidiRunList;
 template <class Iterator> struct MidpointState;
 typedef BidiResolver<InlineIterator, BidiRun> InlineBidiResolver;
 typedef MidpointState<InlineIterator> LineMidpointState;
@@ -151,7 +154,7 @@ public:
     RenderBlock* createAnonymousColumnSpanBlock() const;
     RenderBlock* createAnonymousBlockWithSameTypeAs(RenderBlock* otherAnonymousBlock) const;
     
-    static void appendRunsForObject(int start, int end, RenderObject*, InlineBidiResolver&);    
+    static void appendRunsForObject(BidiRunList<BidiRun>&, int start, int end, RenderObject*, InlineBidiResolver&);
     static bool requiresLineBox(const InlineIterator&, bool isLineEmpty = true, bool previousLineBrokeCleanly = true);
 
     ColumnInfo* columnInfo() const;
@@ -349,6 +352,7 @@ private:
 
     void layoutBlockChildren(bool relayoutChildren, int& maxFloatLogicalBottom);
     void layoutInlineChildren(bool relayoutChildren, int& repaintLogicalTop, int& repaintLogicalBottom);
+    BidiRun* handleTrailingSpaces(BidiRunList<BidiRun>&, BidiContext*);
 
     virtual void borderFitAdjust(int& x, int& w) const; // Shrink the box in which the border paints if border-fit is set.
 
@@ -492,22 +496,23 @@ private:
                         RootInlineBox*& endLine, int& endYPos, int& repaintBottom, int& repaintTop);
 
     void skipTrailingWhitespace(InlineIterator&, bool isLineEmpty, bool previousLineBrokeCleanly);
-    void skipLeadingWhitespace(InlineBidiResolver&, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly, FloatingObject* lastFloatFromPreviousLine, int& lineLeftOffset, int& lineRightOffset);
-    void fitBelowFloats(float widthToFit, bool firstLine, float& availableWidth);
+    void skipLeadingWhitespace(InlineBidiResolver&, bool isLineEmpty, bool previousLineBrokeCleanly, FloatingObject* lastFloatFromPreviousLine, LineWidth&);
     typedef std::pair<RenderText*, LazyLineBreakIterator> LineBreakIteratorInfo;
     InlineIterator findNextLineBreak(InlineBidiResolver&, bool firstLine, bool& isLineEmpty, LineBreakIteratorInfo&, bool& previousLineBrokeCleanly, bool& hyphenated,
                                      EClear*, FloatingObject* lastFloatFromPreviousLine, Vector<RenderBox*>& positionedObjects);
-    RootInlineBox* constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer);
+    RootInlineBox* constructLine(BidiRunList<BidiRun>&, bool firstLine, bool lastLine);
     InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine, InlineBox* childBox);
 
     void computeInlineDirectionPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap&, VerticalPositionCache&);
     void computeBlockDirectionPositionsForLine(RootInlineBox*, BidiRun*, GlyphOverflowAndFallbackFontsMap&, VerticalPositionCache&);
     void deleteEllipsisLineBoxes();
     void checkLinesForTextOverflow();
-    int beforeSideVisualOverflowForLine(RootInlineBox*) const;
-    int afterSideVisualOverflowForLine(RootInlineBox*) const;
-    int beforeSideLayoutOverflowForLine(RootInlineBox*) const;
-    int afterSideLayoutOverflowForLine(RootInlineBox*) const;
+
+    // Positions new floats and also adjust all floats encountered on the line if any of them
+    // have to move to the next page/column.
+    bool positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, LineWidth&);
+    void appendFloatingObjectToLastLine(FloatingObject*);
+
     // End of functions defined in RenderBlockLineLayout.cpp.
 
     void paintFloats(PaintInfo&, int tx, int ty, bool preservePhase = false);
@@ -526,10 +531,6 @@ private:
     // Called from lineWidth, to position the floats added in the last line.
     // Returns true if and only if it has positioned any floats.
     bool positionNewFloats();
-    
-    // Positions new floats and also adjust all floats encountered on the line if any of them
-    // have to move to the next page/column.
-    bool positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, bool firstLine, int& lineLeftOffset, int& lineRightOffset);
 
     void clearFloats();
     int getClearDelta(RenderBox* child, int yPos);
@@ -785,6 +786,7 @@ private:
     // RenderRubyBase objects need to be able to split and merge, moving their children around
     // (calling moveChildTo, moveAllChildrenTo, and makeChildrenNonInline).
     friend class RenderRubyBase;
+    friend class LineWidth; // Needs to know FloatingObject
 };
 
 inline RenderBlock* toRenderBlock(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 3a0f016..06cbf90 100644
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -32,6 +32,7 @@
 #include "RenderInline.h"
 #include "RenderLayer.h"
 #include "RenderListMarker.h"
+#include "RenderRubyRun.h"
 #include "RenderView.h"
 #include "Settings.h"
 #include "TextBreakIterator.h"
@@ -67,23 +68,27 @@ namespace WebCore {
 // We don't let our line box tree for a single line get any deeper than this.
 const unsigned cMaxLineDepth = 200;
 
-static int getBorderPaddingMargin(RenderBoxModelObject* child, bool endOfInline)
+static inline int borderPaddingMarginStart(RenderInline* child)
 {
-    if (endOfInline)
-        return child->marginEnd() + child->paddingEnd() + child->borderEnd();
     return child->marginStart() + child->paddingStart() + child->borderStart();
 }
 
+static inline int borderPaddingMarginEnd(RenderInline* child)
+{
+    return child->marginEnd() + child->paddingEnd() + child->borderEnd();
+}
+
 static int inlineLogicalWidth(RenderObject* child, bool start = true, bool end = true)
 {
     unsigned lineDepth = 1;
     int extraWidth = 0;
     RenderObject* parent = child->parent();
-    while (parent->isInline() && !parent->isInlineBlockOrInlineTable() && lineDepth++ < cMaxLineDepth) {
+    while (parent->isRenderInline() && lineDepth++ < cMaxLineDepth) {
+        RenderInline* parentAsRenderInline = toRenderInline(parent);
         if (start && !child->previousSibling())
-            extraWidth += getBorderPaddingMargin(toRenderBoxModelObject(parent), false);
+            extraWidth += borderPaddingMarginStart(parentAsRenderInline);
         if (end && !child->nextSibling())
-            extraWidth += getBorderPaddingMargin(toRenderBoxModelObject(parent), true);
+            extraWidth += borderPaddingMarginEnd(parentAsRenderInline);
         child = parent;
         parent = child->parent();
     }
@@ -120,10 +125,15 @@ static void addMidpoint(LineMidpointState& lineMidpointState, const InlineIterat
     midpoints[lineMidpointState.numMidpoints++] = midpoint;
 }
 
-void RenderBlock::appendRunsForObject(int start, int end, RenderObject* obj, InlineBidiResolver& resolver)
+static inline BidiRun* createRun(int start, int end, RenderObject* obj, InlineBidiResolver& resolver)
+{
+    return new (obj->renderArena()) BidiRun(start, end, obj, resolver.context(), resolver.dir());
+}
+
+void RenderBlock::appendRunsForObject(BidiRunList<BidiRun>& runs, int start, int end, RenderObject* obj, InlineBidiResolver& resolver)
 {
     if (start > end || obj->isFloating() ||
-        (obj->isPositioned() && !obj->style()->hasAutoLeftAndRight() && !obj->style()->hasAutoTopAndBottom() && !obj->container()->isRenderInline()))
+        (obj->isPositioned() && !obj->style()->isOriginalDisplayInlineType() && !obj->container()->isRenderInline()))
         return;
 
     LineMidpointState& lineMidpointState = resolver.midpointState();
@@ -140,10 +150,10 @@ void RenderBlock::appendRunsForObject(int start, int end, RenderObject* obj, Inl
         start = nextMidpoint.m_pos;
         lineMidpointState.currentMidpoint++;
         if (start < end)
-            return appendRunsForObject(start, end, obj, resolver);
+            return appendRunsForObject(runs, start, end, obj, resolver);
     } else {
         if (!haveNextMidpoint || (obj != nextMidpoint.m_obj)) {
-            resolver.addRun(new (obj->renderArena()) BidiRun(start, end, obj, resolver.context(), resolver.dir()));
+            runs.addRun(createRun(start, end, obj, resolver));
             return;
         }
 
@@ -154,12 +164,11 @@ void RenderBlock::appendRunsForObject(int start, int end, RenderObject* obj, Inl
             lineMidpointState.currentMidpoint++;
             if (nextMidpoint.m_pos != UINT_MAX) { // UINT_MAX means stop at the object and don't include any of it.
                 if (static_cast<int>(nextMidpoint.m_pos + 1) > start)
-                    resolver.addRun(new (obj->renderArena())
-                        BidiRun(start, nextMidpoint.m_pos + 1, obj, resolver.context(), resolver.dir()));
-                return appendRunsForObject(nextMidpoint.m_pos + 1, end, obj, resolver);
+                    runs.addRun(createRun(start, nextMidpoint.m_pos + 1, obj, resolver));
+                return appendRunsForObject(runs, nextMidpoint.m_pos + 1, end, obj, resolver);
             }
         } else
-           resolver.addRun(new (obj->renderArena()) BidiRun(start, end, obj, resolver.context(), resolver.dir()));
+           runs.addRun(createRun(start, end, obj, resolver));
     }
 }
 
@@ -214,8 +223,10 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine, I
     do {
         ASSERT(obj->isRenderInline() || obj == this);
         
+        RenderInline* inlineFlow = (obj != this) ? toRenderInline(obj) : 0;
+
         // Get the last box we made for this render object.
-        parentBox = obj->isRenderInline() ? toRenderInline(obj)->lastLineBox() : toRenderBlock(obj)->lastLineBox();
+        parentBox = inlineFlow ? inlineFlow->lastLineBox() : toRenderBlock(obj)->lastLineBox();
 
         // If this box or its ancestor is constructed then it is from a previous line, and we need
         // to make a new box for our line.  If this box or its ancestor is unconstructed but it has
@@ -223,7 +234,9 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine, I
         // as well.  In this situation our inline has actually been split in two on
         // the same line (this can happen with very fancy language mixtures).
         bool constructedNewBox = false;
-        if (!parentBox || parentIsConstructedOrHaveNext(parentBox)) {
+        bool allowedToConstructNewBox = !hasDefaultLineBoxContain || !inlineFlow || inlineFlow->alwaysCreateLineBoxes();
+        bool canUseExistingParentBox = parentBox && !parentIsConstructedOrHaveNext(parentBox);
+        if (allowedToConstructNewBox && !canUseExistingParentBox) {
             // We need to make a new box for this render object.  Once
             // made, we need to place it at the end of the current line.
             InlineBox* newBox = createInlineBoxForRenderer(obj, obj == this);
@@ -236,19 +249,21 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine, I
             constructedNewBox = true;
         }
 
-        if (!result)
-            result = parentBox;
+        if (constructedNewBox || canUseExistingParentBox) {
+            if (!result)
+                result = parentBox;
 
-        // If we have hit the block itself, then |box| represents the root
-        // inline box for the line, and it doesn't have to be appended to any parent
-        // inline.
-        if (childBox)
-            parentBox->addToLine(childBox);
+            // If we have hit the block itself, then |box| represents the root
+            // inline box for the line, and it doesn't have to be appended to any parent
+            // inline.
+            if (childBox)
+                parentBox->addToLine(childBox);
 
-        if (!constructedNewBox || obj == this)
-            break;
+            if (!constructedNewBox || obj == this)
+                break;
 
-        childBox = parentBox;        
+            childBox = parentBox;        
+        }
 
         // If we've exceeded our line depth, then jump straight to the root and skip all the remaining
         // intermediate inline flows.
@@ -259,17 +274,38 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine, I
     return result;
 }
 
-RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer)
+static bool reachedEndOfTextRenderer(const BidiRunList<BidiRun>& bidiRuns)
+{
+    BidiRun* run = bidiRuns.logicallyLastRun();
+    if (!run)
+        return true;
+    unsigned int pos = run->stop();
+    RenderObject* r = run->m_object;
+    if (!r->isText() || r->isBR())
+        return false;
+    RenderText* renderText = toRenderText(r);
+    if (pos >= renderText->textLength())
+        return true;
+
+    while (isASCIISpace(renderText->characters()[pos])) {
+        pos++;
+        if (pos >= renderText->textLength())
+            return true;
+    }
+    return false;
+}
+
+RootInlineBox* RenderBlock::constructLine(BidiRunList<BidiRun>& bidiRuns, bool firstLine, bool lastLine)
 {
-    ASSERT(firstRun);
+    ASSERT(bidiRuns.firstRun());
 
     bool rootHasSelectedChildren = false;
     InlineFlowBox* parentBox = 0;
-    for (BidiRun* r = firstRun; r; r = r->next()) {
+    for (BidiRun* r = bidiRuns.firstRun(); r; r = r->next()) {
         // Create a box for our object.
-        bool isOnlyRun = (runCount == 1);
-        if (runCount == 2 && !r->m_object->isListMarker())
-            isOnlyRun = (!style()->isLeftToRightDirection() ? lastRun : firstRun)->m_object->isListMarker();
+        bool isOnlyRun = (bidiRuns.runCount() == 1);
+        if (bidiRuns.runCount() == 2 && !r->m_object->isListMarker())
+            isOnlyRun = (!style()->isLeftToRightDirection() ? bidiRuns.lastRun() : bidiRuns.firstRun())->m_object->isListMarker();
 
         InlineBox* box = createInlineBoxForRenderer(r->m_object, false, isOnlyRun);
         r->m_box = box;
@@ -318,7 +354,8 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
     // paint borders/margins/padding.  This knowledge will ultimately be used when
     // we determine the horizontal positions and widths of all the inline boxes on
     // the line.
-    lastLineBox()->determineSpacingForFlowBoxes(lastLine, endObject, logicallyLastRunRenderer);
+    bool isLogicallyLastRunWrapped = bidiRuns.logicallyLastRun()->m_object && bidiRuns.logicallyLastRun()->m_object->isText() ? !reachedEndOfTextRenderer(bidiRuns) : true;
+    lastLineBox()->determineSpacingForFlowBoxes(lastLine, isLogicallyLastRunWrapped, bidiRuns.logicallyLastRun()->m_object);
 
     // Now mark the line boxes as being constructed.
     lastLineBox()->setConstructed();
@@ -400,6 +437,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
     unsigned expansionOpportunityCount = 0;
     bool isAfterExpansion = true;
     Vector<unsigned, 16> expansionOpportunities;
+    RenderObject* previousObject = 0;
 
     for (BidiRun* r = firstRun; r; r = r->next()) {
         if (!r->m_box || r->m_object->isPositioned() || r->m_box->isLineBreak())
@@ -456,18 +494,33 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
                 ASSERT(r->m_box->isText());
                 GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(static_cast<InlineTextBox*>(r->m_box), make_pair(Vector<const SimpleFontData*>(), GlyphOverflow())).first;
                 it->second.second = glyphOverflow;
+                r->m_box->clearKnownToHaveNoOverflow();
             }
         } else {
             isAfterExpansion = false;
             if (!r->m_object->isRenderInline()) {
                 RenderBox* renderBox = toRenderBox(r->m_object);
-                renderBox->computeLogicalWidth();
+                if (renderBox->isRubyRun()) {
+                    int startOverhang;
+                    int endOverhang;
+                    RenderObject* nextObject = 0;
+                    for (BidiRun* runWithNextObject = r->next(); runWithNextObject; runWithNextObject = runWithNextObject->next()) {
+                        if (!runWithNextObject->m_object->isPositioned() && !runWithNextObject->m_box->isLineBreak()) {
+                            nextObject = runWithNextObject->m_object;
+                            break;
+                        }
+                    }
+                    toRenderRubyRun(renderBox)->getOverhang(firstLine, renderBox->style()->isLeftToRightDirection() ? previousObject : nextObject, renderBox->style()->isLeftToRightDirection() ? nextObject : previousObject, startOverhang, endOverhang);
+                    setMarginStartForChild(renderBox, -startOverhang);
+                    setMarginEndForChild(renderBox, -endOverhang);
+                }
                 r->m_box->setLogicalWidth(logicalWidthForChild(renderBox));
                 totalLogicalWidth += marginStartForChild(renderBox) + marginEndForChild(renderBox);
             }
         }
 
         totalLogicalWidth += r->m_box->logicalWidth();
+        previousObject = r->m_object;
     }
 
     if (isAfterExpansion && !expansionOpportunities.isEmpty()) {
@@ -616,27 +669,70 @@ static void setStaticPositions(RenderBlock* block, RenderBox* child)
     child->layer()->setStaticBlockPosition(blockHeight);
 }
 
-static bool reachedEndOfTextRenderer(InlineBidiResolver& resolver)
+inline BidiRun* RenderBlock::handleTrailingSpaces(BidiRunList<BidiRun>& bidiRuns, BidiContext* currentContext)
 {
-    BidiRun* run = resolver.logicallyLastRun();
-    if (!run)
-        return true;
-    unsigned int pos = run->stop();
-    RenderObject* r = run->m_object;
-    if (!r->isText() || r->isBR())
-        return false;
-    RenderText* renderText = toRenderText(r);
-    if (pos >= renderText->textLength())
-        return true;
+    if (!bidiRuns.runCount()
+        || !bidiRuns.logicallyLastRun()->m_object->style()->breakOnlyAfterWhiteSpace()
+        || !bidiRuns.logicallyLastRun()->m_object->style()->autoWrap())
+        return 0;
 
-    while (isASCIISpace(renderText->characters()[pos])) {
-        pos++;
-        if (pos >= renderText->textLength())
-            return true;
+    BidiRun* trailingSpaceRun = bidiRuns.logicallyLastRun();
+    RenderObject* lastObject = trailingSpaceRun->m_object;
+    if (!lastObject->isText())
+        return 0;
+
+    RenderText* lastText = toRenderText(lastObject);
+    const UChar* characters = lastText->characters();
+    int firstSpace = trailingSpaceRun->stop();
+    while (firstSpace > trailingSpaceRun->start()) {
+        UChar current = characters[firstSpace - 1];
+        if (!isCollapsibleSpace(current, lastText))
+            break;
+        firstSpace--;
     }
-    return false;
+    if (firstSpace == trailingSpaceRun->stop())
+        return 0;
+
+    TextDirection direction = style()->direction();
+    bool shouldReorder = trailingSpaceRun != (direction == LTR ? bidiRuns.lastRun() : bidiRuns.firstRun());
+    if (firstSpace != trailingSpaceRun->start()) {
+        BidiContext* baseContext = currentContext;
+        while (BidiContext* parent = baseContext->parent())
+            baseContext = parent;
+
+        BidiRun* newTrailingRun = new (renderArena()) BidiRun(firstSpace, trailingSpaceRun->m_stop, trailingSpaceRun->m_object, baseContext, OtherNeutral);
+        trailingSpaceRun->m_stop = firstSpace;
+        if (direction == LTR)
+            bidiRuns.addRun(newTrailingRun);
+        else
+            bidiRuns.prependRun(newTrailingRun);
+        trailingSpaceRun = newTrailingRun;
+        return trailingSpaceRun;
+    }
+    if (!shouldReorder)
+        return trailingSpaceRun;
+
+    if (direction == LTR) {
+        bidiRuns.moveRunToEnd(trailingSpaceRun);
+        trailingSpaceRun->m_level = 0;
+    } else {
+        bidiRuns.moveRunToBeginning(trailingSpaceRun);
+        trailingSpaceRun->m_level = 1;
+    }
+    return trailingSpaceRun;
 }
-    
+
+void RenderBlock::appendFloatingObjectToLastLine(FloatingObject* floatingObject)
+{
+    // Ensure that the float touches the line.
+    if (RootInlineBox* previousLine = lastRootBox()->prevRootBox()) {
+        if (logicalBottomForFloat(floatingObject) < previousLine->blockLogicalHeight())
+            setLogicalHeightForFloat(floatingObject, previousLine->blockLogicalHeight() - logicalTopForFloat(floatingObject));
+    }
+
+    lastRootBox()->appendFloat(floatingObject->renderer());
+}
+
 void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogicalTop, int& repaintLogicalBottom)
 {
     bool useRepaintBounds = false;
@@ -741,6 +837,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                 }
 #endif // PLATFORM(ANDROID)
             } else if (o->isText() || (o->isRenderInline() && !endOfInline)) {
+                if (!o->isText())
+                    toRenderInline(o)->updateAlwaysCreateLineBoxes();
                 if (fullLayout || o->selfNeedsLayout())
                     dirtyLineBoxesForRenderer(o, fullLayout);
                 o->setNeedsLayout(false);
@@ -853,8 +951,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
             RenderArena* arena = renderArena();
             RootInlineBox* box = startLine;
             while (box) {
-                repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(box));
-                repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(box));
+                repaintLogicalTop = min(repaintLogicalTop, box->logicalTopVisualOverflow());
+                repaintLogicalBottom = max(repaintLogicalBottom, box->logicalBottomVisualOverflow());
                 RootInlineBox* next = box->nextRootBox();
                 box->deleteLine(arena);
                 box = next;
@@ -906,7 +1004,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
             FloatingObject* lastFloatFromPreviousLine = (m_floatingObjects && !m_floatingObjects->set().isEmpty()) ? m_floatingObjects->set().last() : 0;
             end = findNextLineBreak(resolver, firstLine, isLineEmpty, lineBreakIteratorInfo, previousLineBrokeCleanly, hyphenated, &clear, lastFloatFromPreviousLine, positionedObjects);
             if (resolver.position().atEnd()) {
-                resolver.deleteRuns();
+                // FIXME: We shouldn't be creating any runs in findNextLineBreak to begin with!
+                // Once BidiRunList is separated from BidiResolver this will not be needed.
+                resolver.runs().deleteRuns();
+                resolver.markCurrentRunEmpty(); // FIXME: This can probably be replaced by an ASSERT (or just removed).
                 checkForFloatsFromLastLine = true;
                 break;
             }
@@ -917,56 +1018,12 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                     lastRootBox()->setLineBreakInfo(end.m_obj, end.m_pos, resolver.status());
             } else {
                 VisualDirectionOverride override = (style()->visuallyOrdered() ? (style()->direction() == LTR ? VisualLeftToRightOverride : VisualRightToLeftOverride) : NoVisualOverride);
+                // FIXME: This ownership is reversed. We should own the BidiRunList and pass it to createBidiRunsForLine.
+                BidiRunList<BidiRun>& bidiRuns = resolver.runs();
                 resolver.createBidiRunsForLine(end, override, previousLineBrokeCleanly);
                 ASSERT(resolver.position() == end);
 
-                BidiRun* trailingSpaceRun = 0;
-                if (!previousLineBrokeCleanly && resolver.runCount() && resolver.logicallyLastRun()->m_object->style()->breakOnlyAfterWhiteSpace()
-                        && resolver.logicallyLastRun()->m_object->style()->autoWrap()) {
-                    trailingSpaceRun = resolver.logicallyLastRun();
-                    RenderObject* lastObject = trailingSpaceRun->m_object;
-                    if (lastObject->isText()) {
-                        RenderText* lastText = toRenderText(lastObject);
-                        const UChar* characters = lastText->characters();
-                        int firstSpace = trailingSpaceRun->stop();
-                        while (firstSpace > trailingSpaceRun->start()) {
-                            UChar current = characters[firstSpace - 1];
-                            if (!isCollapsibleSpace(current, lastText))
-                                break;
-                            firstSpace--;
-                        }
-                        if (firstSpace == trailingSpaceRun->stop())
-                            trailingSpaceRun = 0;
-                        else {
-                            TextDirection direction = style()->direction();
-                            bool shouldReorder = trailingSpaceRun != (direction == LTR ? resolver.lastRun() : resolver.firstRun());
-                            if (firstSpace != trailingSpaceRun->start()) {
-                                BidiContext* baseContext = resolver.context();
-                                while (BidiContext* parent = baseContext->parent())
-                                    baseContext = parent;
-
-                                BidiRun* newTrailingRun = new (renderArena()) BidiRun(firstSpace, trailingSpaceRun->m_stop, trailingSpaceRun->m_object, baseContext, OtherNeutral);
-                                trailingSpaceRun->m_stop = firstSpace;
-                                if (direction == LTR)
-                                    resolver.addRun(newTrailingRun);
-                                else
-                                    resolver.prependRun(newTrailingRun);
-                                trailingSpaceRun = newTrailingRun;
-                                shouldReorder = false;
-                            }
-                            if (shouldReorder) {
-                                if (direction == LTR) {
-                                    resolver.moveRunToEnd(trailingSpaceRun);
-                                    trailingSpaceRun->m_level = 0;
-                                } else {
-                                    resolver.moveRunToBeginning(trailingSpaceRun);
-                                    trailingSpaceRun->m_level = 1;
-                                }
-                            }
-                        }
-                    } else
-                        trailingSpaceRun = 0;
-                }
+                BidiRun* trailingSpaceRun = !previousLineBrokeCleanly ? handleTrailingSpaces(bidiRuns, resolver.context()) : 0;
 
                 // Now that the runs have been ordered, we create the line boxes.
                 // At the same time we figure out where border/padding/margin should be applied for
@@ -974,11 +1031,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
 
                 RootInlineBox* lineBox = 0;
                 int oldLogicalHeight = logicalHeight();
-                if (resolver.runCount()) {
+                if (bidiRuns.runCount()) {
                     if (hyphenated)
-                        resolver.logicallyLastRun()->m_hasHyphen = true;
-                    bool lastLine = end.m_obj && end.m_obj->isText() ? reachedEndOfTextRenderer(resolver) : !end.m_obj;
-                    lineBox = constructLine(resolver.runCount(), resolver.firstRun(), resolver.lastRun(), firstLine, lastLine, end.m_obj && !end.m_pos ? end.m_obj : 0, resolver.logicallyLastRun()->m_object);
+                        bidiRuns.logicallyLastRun()->m_hasHyphen = true;
+                    lineBox = constructLine(bidiRuns, firstLine, !end.m_obj);
                     if (lineBox) {
                         lineBox->setEndsWithBreak(previousLineBrokeCleanly);
 
@@ -992,10 +1048,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                     
                         // Now we position all of our text runs horizontally.
                         if (!isSVGRootInlineBox)
-                            computeInlineDirectionPositionsForLine(lineBox, firstLine, resolver.firstRun(), trailingSpaceRun, end.atEnd(), textBoxDataMap, verticalPositionCache);
+                            computeInlineDirectionPositionsForLine(lineBox, firstLine, bidiRuns.firstRun(), trailingSpaceRun, end.atEnd(), textBoxDataMap, verticalPositionCache);
 
                         // Now position our text runs vertically.
-                        computeBlockDirectionPositionsForLine(lineBox, resolver.firstRun(), textBoxDataMap, verticalPositionCache);
+                        computeBlockDirectionPositionsForLine(lineBox, bidiRuns.firstRun(), textBoxDataMap, verticalPositionCache);
 
 #if ENABLE(SVG)
                         // SVG text layout code computes vertical & horizontal positions on its own.
@@ -1010,7 +1066,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
 #endif
 
                         // Compute our overflow now.
-                        lineBox->computeOverflow(lineBox->lineTop(), lineBox->lineBottom(), document()->inNoQuirksMode(), textBoxDataMap);
+                        lineBox->computeOverflow(lineBox->lineTop(), lineBox->lineBottom(), textBoxDataMap);
     
 #if PLATFORM(MAC)
                         // Highlight acts as an overflow inflation.
@@ -1020,13 +1076,14 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                     }
                 }
 
-                resolver.deleteRuns();
+                bidiRuns.deleteRuns();
+                resolver.markCurrentRunEmpty(); // FIXME: This can probably be replaced by an ASSERT (or just removed).
 
                 if (lineBox) {
                     lineBox->setLineBreakInfo(end.m_obj, end.m_pos, resolver.status());
                     if (useRepaintBounds) {
-                        repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(lineBox));
-                        repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(lineBox));
+                        repaintLogicalTop = min(repaintLogicalTop, lineBox->logicalTopVisualOverflow());
+                        repaintLogicalBottom = max(repaintLogicalBottom, lineBox->logicalBottomVisualOverflow());
                     }
                     
                     if (paginated) {
@@ -1036,7 +1093,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                             int oldLineWidth = availableLogicalWidthForLine(oldLogicalHeight, firstLine);
                             lineBox->adjustBlockDirectionPosition(adjustment);
                             if (useRepaintBounds) // This can only be a positive adjustment, so no need to update repaintTop.
-                                repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(lineBox));
+                                repaintLogicalBottom = max(repaintLogicalBottom, lineBox->logicalBottomVisualOverflow());
                                 
                             if (availableLogicalWidthForLine(oldLogicalHeight + adjustment, firstLine) != oldLineWidth) {
                                 // We have to delete this line, remove all floats that got added, and let line layout re-run.
@@ -1072,7 +1129,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                 }
                 for (; it != end; ++it) {
                     FloatingObject* f = *it;
-                    lastRootBox()->floats().append(f->m_renderer);
+                    appendFloatingObjectToLastLine(f);
                     ASSERT(f->m_renderer == floats[floatIndex].object);
                     // If a float's geometry has changed, give up on syncing with clean lines.
                     if (floats[floatIndex].rect != f->frameRect())
@@ -1097,8 +1154,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                         adjustLinePositionForPagination(line, delta);
                     }
                     if (delta) {
-                        repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(line) + min(delta, 0));
-                        repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(line) + max(delta, 0));
+                        repaintLogicalTop = min(repaintLogicalTop, line->logicalTopVisualOverflow() + min(delta, 0));
+                        repaintLogicalBottom = max(repaintLogicalBottom, line->logicalBottomVisualOverflow() + max(delta, 0));
                         line->adjustBlockDirectionPosition(delta);
                     }
                     if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
@@ -1116,8 +1173,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                 RootInlineBox* line = endLine;
                 RenderArena* arena = renderArena();
                 while (line) {
-                    repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(line));
-                    repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(line));
+                    repaintLogicalTop = min(repaintLogicalTop, line->logicalTopVisualOverflow());
+                    repaintLogicalBottom = max(repaintLogicalBottom, line->logicalBottomVisualOverflow());
                     RootInlineBox* next = line->nextRootBox();
                     line->deleteLine(arena);
                     line = next;
@@ -1129,17 +1186,18 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
             // This has to be done before adding in the bottom border/padding, or the float will
             // include the padding incorrectly. -dwh
             if (checkForFloatsFromLastLine) {
-                int bottomVisualOverflow = afterSideVisualOverflowForLine(lastRootBox());
-                int bottomLayoutOverflow = afterSideLayoutOverflowForLine(lastRootBox());
+                int bottomVisualOverflow = lastRootBox()->logicalBottomVisualOverflow();
+                int bottomLayoutOverflow = lastRootBox()->logicalBottomLayoutOverflow();
                 TrailingFloatsRootInlineBox* trailingFloatsLineBox = new (renderArena()) TrailingFloatsRootInlineBox(this);
                 m_lineBoxes.appendLineBox(trailingFloatsLineBox);
                 trailingFloatsLineBox->setConstructed();
                 GlyphOverflowAndFallbackFontsMap textBoxDataMap;
                 VerticalPositionCache verticalPositionCache;
                 trailingFloatsLineBox->alignBoxesInBlockDirection(logicalHeight(), textBoxDataMap, verticalPositionCache);
-                IntRect logicalLayoutOverflow(0, logicalHeight(), 1, bottomLayoutOverflow);
-                IntRect logicalVisualOverflow(0, logicalHeight(), 1, bottomVisualOverflow);
-                trailingFloatsLineBox->setOverflowFromLogicalRects(logicalLayoutOverflow, logicalVisualOverflow);
+                int blockLogicalHeight = logicalHeight();
+                IntRect logicalLayoutOverflow(0, blockLogicalHeight, 1, bottomLayoutOverflow - blockLogicalHeight);
+                IntRect logicalVisualOverflow(0, blockLogicalHeight, 1, bottomVisualOverflow - blockLogicalHeight);
+                trailingFloatsLineBox->setOverflowFromLogicalRects(logicalLayoutOverflow, logicalVisualOverflow, trailingFloatsLineBox->lineTop(), trailingFloatsLineBox->lineBottom());
                 trailingFloatsLineBox->setBlockLogicalHeight(logicalHeight());
             }
 
@@ -1153,7 +1211,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                 it = lastFloatIterator;
             }
             for (; it != end; ++it)
-                lastRootBox()->floats().append((*it)->m_renderer);
+                appendFloatingObjectToLastLine(*it);
             lastFloat = !floatingObjectSet.isEmpty() ? floatingObjectSet.last() : 0;
         }
         size_t floatCount = floats.size();
@@ -1211,6 +1269,7 @@ void RenderBlock::checkFloatsInCleanLine(RootInlineBox* line, Vector<FloatWithRe
             int floatTop = isHorizontalWritingMode() ? floats[floatIndex].rect.y() : floats[floatIndex].rect.x();
             int floatHeight = isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height()) 
                                                                  : max(floats[floatIndex].rect.width(), newSize.width());
+            floatHeight = min(floatHeight, numeric_limits<int>::max() - floatTop);
             line->markDirty();
             markLinesDirtyInBlockRange(line->blockLogicalHeight(), floatTop + floatHeight, line);
             floats[floatIndex].rect.setSize(newSize);
@@ -1247,8 +1306,8 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
                     if (!useRepaintBounds)
                         useRepaintBounds = true;
                         
-                    repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(curr) + min(paginationDelta, 0));
-                    repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(curr) + max(paginationDelta, 0));
+                    repaintLogicalTop = min(repaintLogicalTop, curr->logicalTopVisualOverflow() + min(paginationDelta, 0));
+                    repaintLogicalBottom = max(repaintLogicalBottom, curr->logicalBottomVisualOverflow() + max(paginationDelta, 0));
                     curr->adjustBlockDirectionPosition(paginationDelta);
                 }                
             }
@@ -1448,8 +1507,8 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
             RootInlineBox* boxToDelete = endLine;
             RenderArena* arena = renderArena();
             while (boxToDelete && boxToDelete != result) {
-                repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(boxToDelete));
-                repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(boxToDelete));
+                repaintLogicalTop = min(repaintLogicalTop, boxToDelete->logicalTopVisualOverflow());
+                repaintLogicalBottom = max(repaintLogicalBottom, boxToDelete->logicalBottomVisualOverflow());
                 RootInlineBox* next = boxToDelete->nextRootBox();
                 boxToDelete->deleteLine(arena);
                 boxToDelete = next;
@@ -1484,16 +1543,6 @@ static inline bool shouldCollapseWhiteSpace(const RenderStyle* style, bool isLin
     return style->collapseWhiteSpace() || (style->whiteSpace() == PRE_WRAP && (!isLineEmpty || !previousLineBrokeCleanly));
 }
 
-static inline bool shouldPreserveNewline(RenderObject* object)
-{
-#if ENABLE(SVG)
-    if (object->isSVGInlineText())
-        return false;
-#endif
-
-    return object->style()->preserveNewline();
-}
-
 static bool inlineFlowRequiresLineBox(RenderInline* flow)
 {
     // FIXME: Right now, we only allow line boxes for inlines that are truly empty.
@@ -1514,7 +1563,7 @@ bool RenderBlock::requiresLineBox(const InlineIterator& it, bool isLineEmpty, bo
         return true;
 
     UChar current = it.current();
-    return current != ' ' && current != '\t' && current != softHyphen && (current != '\n' || shouldPreserveNewline(it.m_obj)) 
+    return current != ' ' && current != '\t' && current != softHyphen && (current != '\n' || it.m_obj->preservesNewline()) 
             && !skipNonBreakingSpace(it, isLineEmpty, previousLineBrokeCleanly);
 }
 
@@ -1547,13 +1596,13 @@ void RenderBlock::skipTrailingWhitespace(InlineIterator& iterator, bool isLineEm
     }
 }
 
-void RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly,
-                                       FloatingObject* lastFloatFromPreviousLine, int& lineLeftOffset, int& lineRightOffset)
+void RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool isLineEmpty, bool previousLineBrokeCleanly,
+    FloatingObject* lastFloatFromPreviousLine, LineWidth& width)
 {
     while (!resolver.position().atEnd() && !requiresLineBox(resolver.position(), isLineEmpty, previousLineBrokeCleanly)) {
         RenderObject* object = resolver.position().m_obj;
         if (object->isFloating())
-            positionNewFloatOnLine(insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine, firstLine, lineLeftOffset, lineRightOffset);
+            positionNewFloatOnLine(insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine, width);
         else if (object->isPositioned())
             setStaticPositions(this, toRenderBox(object));
         resolver.increment();
@@ -1578,30 +1627,6 @@ static bool shouldSkipWhitespaceAfterStartObject(RenderBlock* block, RenderObjec
     return false;
 }
 
-void RenderBlock::fitBelowFloats(float widthToFit, bool firstLine, float& availableWidth)
-{
-    ASSERT(widthToFit > availableWidth);
-
-    int floatLogicalBottom;
-    int lastFloatLogicalBottom = logicalHeight();
-    float newLineWidth = availableWidth;
-    while (true) {
-        floatLogicalBottom = nextFloatLogicalBottomBelow(lastFloatLogicalBottom);
-        if (!floatLogicalBottom)
-            break;
-
-        newLineWidth = availableLogicalWidthForLine(floatLogicalBottom, firstLine);
-        lastFloatLogicalBottom = floatLogicalBottom;
-        if (newLineWidth >= widthToFit)
-            break;
-    }
-
-    if (newLineWidth > availableWidth) {
-        setLogicalHeight(lastFloatLogicalBottom);
-        availableWidth = newLineWidth;
-    }
-}
-
 static inline float textWidth(RenderText* text, unsigned from, unsigned len, const Font& font, float xPos, bool isFixedPitch, bool collapseWhiteSpace)
 {
     if (isFixedPitch || (!from && len == text->textLength()) || text->style()->hasTextCombine())
@@ -1654,23 +1679,131 @@ static void tryHyphenating(RenderText* text, const Font& font, const AtomicStrin
     hyphenated = true;
 }
 
+class LineWidth {
+public:
+    LineWidth(RenderBlock* block, bool isFirstLine)
+        : m_block(block)
+        , m_uncommittedWidth(0)
+        , m_committedWidth(0)
+        , m_overhangWidth(0)
+        , m_left(0)
+        , m_right(0)
+        , m_availableWidth(0)
+        , m_isFirstLine(isFirstLine)
+    {
+        ASSERT(block);
+        updateAvailableWidth();
+    }
+    bool fitsOnLine() const { return currentWidth() <= m_availableWidth; }
+    bool fitsOnLine(float extra) const { return currentWidth() + extra <= m_availableWidth; }
+    float currentWidth() const { return m_committedWidth + m_uncommittedWidth; }
+
+    // FIXME: We should eventually replace these three functions by ones that work on a higher abstraction.
+    float uncommittedWidth() const { return m_uncommittedWidth; }
+    float committedWidth() const { return m_committedWidth; }
+    float availableWidth() const { return m_availableWidth; }
+
+    void updateAvailableWidth();
+    void shrinkAvailableWidthForNewFloatIfNeeded(RenderBlock::FloatingObject*);
+    void addUncommittedWidth(float delta) { m_uncommittedWidth += delta; }
+    void commit()
+    {
+        m_committedWidth += m_uncommittedWidth;
+        m_uncommittedWidth = 0;
+    }
+    void applyOverhang(RenderRubyRun*, RenderObject* startRenderer, RenderObject* endRenderer);
+    void fitBelowFloats();
+
+private:
+    void computeAvailableWidthFromLeftAndRight()
+    {
+        m_availableWidth = max(0, m_right - m_left) + m_overhangWidth;
+    }
+
+private:
+    RenderBlock* m_block;
+    float m_uncommittedWidth;
+    float m_committedWidth;
+    float m_overhangWidth; // The amount by which |m_availableWidth| has been inflated to account for possible contraction due to ruby overhang.
+    int m_left;
+    int m_right;
+    float m_availableWidth;
+    bool m_isFirstLine;
+};
+
+inline void LineWidth::updateAvailableWidth()
+{
+    int height = m_block->logicalHeight();
+    m_left = m_block->logicalLeftOffsetForLine(height, m_isFirstLine);
+    m_right = m_block->logicalRightOffsetForLine(height, m_isFirstLine);
+
+    computeAvailableWidthFromLeftAndRight();
+}
+
+inline void LineWidth::shrinkAvailableWidthForNewFloatIfNeeded(RenderBlock::FloatingObject* newFloat)
+{
+    int height = m_block->logicalHeight();
+    if (height < m_block->logicalTopForFloat(newFloat) || height >= m_block->logicalBottomForFloat(newFloat))
+        return;
+
+    if (newFloat->type() == RenderBlock::FloatingObject::FloatLeft)
+        m_left = m_block->logicalRightForFloat(newFloat);
+    else
+        m_right = m_block->logicalLeftForFloat(newFloat);
+
+    computeAvailableWidthFromLeftAndRight();
+}
+
+void LineWidth::applyOverhang(RenderRubyRun* rubyRun, RenderObject* startRenderer, RenderObject* endRenderer)
+{
+    int startOverhang;
+    int endOverhang;
+    rubyRun->getOverhang(m_isFirstLine, startRenderer, endRenderer, startOverhang, endOverhang);
+
+    startOverhang = min<int>(startOverhang, m_committedWidth);
+    m_availableWidth += startOverhang;
+
+    endOverhang = max(min<int>(endOverhang, m_availableWidth - currentWidth()), 0);
+    m_availableWidth += endOverhang;
+    m_overhangWidth += startOverhang + endOverhang;
+}
+
+void LineWidth::fitBelowFloats()
+{
+    ASSERT(!m_committedWidth);
+    ASSERT(!fitsOnLine());
+
+    int floatLogicalBottom;
+    int lastFloatLogicalBottom = m_block->logicalHeight();
+    float newLineWidth = m_availableWidth;
+    while (true) {
+        floatLogicalBottom = m_block->nextFloatLogicalBottomBelow(lastFloatLogicalBottom);
+        if (!floatLogicalBottom)
+            break;
+
+        newLineWidth = m_block->availableLogicalWidthForLine(floatLogicalBottom, m_isFirstLine);
+        lastFloatLogicalBottom = floatLogicalBottom;
+        if (newLineWidth >= m_uncommittedWidth)
+            break;
+    }
+
+    if (newLineWidth > m_availableWidth) {
+        m_block->setLogicalHeight(lastFloatLogicalBottom);
+        m_availableWidth = newLineWidth + m_overhangWidth;
+    }
+}
+
 InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool firstLine, bool& isLineEmpty, LineBreakIteratorInfo& lineBreakIteratorInfo, bool& previousLineBrokeCleanly, 
                                               bool& hyphenated, EClear* clear, FloatingObject* lastFloatFromPreviousLine, Vector<RenderBox*>& positionedBoxes)
 {
-    ASSERT(resolver.position().m_block == this);
+    ASSERT(resolver.position().root() == this);
 
     bool appliedStartWidth = resolver.position().m_pos > 0;
     LineMidpointState& lineMidpointState = resolver.midpointState();
-    
-    int blockOffset = logicalHeight();
-    int lineLeftOffset = logicalLeftOffsetForLine(blockOffset, firstLine);
-    int lineRightOffset = logicalRightOffsetForLine(blockOffset, firstLine);
-    
-    skipLeadingWhitespace(resolver, firstLine, isLineEmpty, previousLineBrokeCleanly, lastFloatFromPreviousLine, lineLeftOffset, lineRightOffset);
 
-    float width = max(0, lineRightOffset - lineLeftOffset);
-    float w = 0;
-    float tmpW = 0;
+    LineWidth width(this, firstLine);
+
+    skipLeadingWhitespace(resolver, isLineEmpty, previousLineBrokeCleanly, lastFloatFromPreviousLine, width);
 
     if (resolver.position().atEnd())
         return resolver.position();
@@ -1714,6 +1847,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     EWhiteSpace currWS = style()->whiteSpace();
     EWhiteSpace lastWS = currWS;
     while (o) {
+        RenderObject* next = bidiNext(this, o);
+
         currWS = o->isReplaced() ? o->parent()->style()->whiteSpace() : o->style()->whiteSpace();
         lastWS = last->isReplaced() ? last->parent()->style()->whiteSpace() : last->style()->whiteSpace();
         
@@ -1729,7 +1864,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
         bool collapseWhiteSpace = RenderStyle::collapseWhiteSpace(currWS);
             
         if (o->isBR()) {
-            if (w + tmpW <= width) {
+            if (width.fitsOnLine()) {
                 lBreak.moveToStartOf(o);
                 lBreak.increment();
 
@@ -1757,9 +1892,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 // check if it fits in the current line.
                 // If it does, position it now, otherwise, position
                 // it after moving to next line (in newLine() func)
-                if (floatsFitOnLine && logicalWidthForFloat(f) + w + tmpW <= width) {
-                    positionNewFloatOnLine(f, lastFloatFromPreviousLine, firstLine, lineLeftOffset, lineRightOffset);
-                    width = max(0, lineRightOffset - lineLeftOffset);
+                if (floatsFitOnLine && width.fitsOnLine(logicalWidthForFloat(f))) {
+                    positionNewFloatOnLine(f, lastFloatFromPreviousLine, width);
                     if (lBreak.m_obj == o) {
                         ASSERT(!lBreak.m_pos);
                         lBreak.increment();
@@ -1820,15 +1954,13 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 }
             }
 
-            tmpW += flowBox->marginStart() + flowBox->borderStart() + flowBox->paddingStart() +
-                    flowBox->marginEnd() + flowBox->borderEnd() + flowBox->paddingEnd();
+            width.addUncommittedWidth(borderPaddingMarginStart(flowBox) + borderPaddingMarginEnd(flowBox));
         } else if (o->isReplaced()) {
             RenderBox* replacedBox = toRenderBox(o);
 
             // Break on replaced elements if either has normal white-space.
             if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!o->isImage() || allowImagesToBreak)) {
-                w += tmpW;
-                tmpW = 0;
+                width.commit();
                 lBreak.moveToStartOf(o);
             }
 
@@ -1854,9 +1986,11 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     ignoringSpaces = true;
                 }
                 if (toRenderListMarker(o)->isInside())
-                    tmpW += replacedLogicalWidth;
+                    width.addUncommittedWidth(replacedLogicalWidth);
             } else
-                tmpW += replacedLogicalWidth;
+                width.addUncommittedWidth(replacedLogicalWidth);
+            if (o->isRubyRun())
+                width.applyOverhang(toRenderRubyRun(o), last, next);
         } else if (o->isText()) {
             if (!pos)
                 appliedStartWidth = false;
@@ -1887,19 +2021,18 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             // space, then subtract its width.
             float wordTrailingSpaceWidth = f.typesettingFeatures() & Kerning ? f.width(TextRun(&space, 1)) + wordSpacing : 0;
 
-            float wrapW = tmpW + inlineLogicalWidth(o, !appliedStartWidth, true);
+            float wrapW = width.uncommittedWidth() + inlineLogicalWidth(o, !appliedStartWidth, true);
             float charWidth = 0;
             bool breakNBSP = autoWrap && o->style()->nbspMode() == SPACE;
             // Auto-wrapping text should wrap in the middle of a word only if it could not wrap before the word,
             // which is only possible if the word is the first thing on the line, that is, if |w| is zero.
-            bool breakWords = o->style()->breakWords() && ((autoWrap && !w) || currWS == PRE);
+            bool breakWords = o->style()->breakWords() && ((autoWrap && !width.committedWidth()) || currWS == PRE);
             bool midWordBreak = false;
             bool breakAll = o->style()->wordBreak() == BreakAllWordBreak && autoWrap;
             float hyphenWidth = 0;
 
             if (t->isWordBreak()) {
-                w += tmpW;
-                tmpW = 0;
+                width.commit();
                 lBreak.moveToStartOf(o);
                 ASSERT(!len);
             }
@@ -1916,29 +2049,17 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 if (c == softHyphen && autoWrap && !hyphenWidth && style->hyphens() != HyphensNone) {
                     const AtomicString& hyphenString = style->hyphenString();
                     hyphenWidth = f.width(TextRun(hyphenString.characters(), hyphenString.length()));
-                    tmpW += hyphenWidth;
+                    width.addUncommittedWidth(hyphenWidth);
                 }
 
-#if ENABLE(SVG)
-                if (isSVGText) {
-                    RenderSVGInlineText* svgInlineText = static_cast<RenderSVGInlineText*>(t);
-                    if (pos > 0) {
-                        if (svgInlineText->characterStartsNewTextChunk(pos)) {
-                            addMidpoint(lineMidpointState, InlineIterator(0, o, pos - 1));
-                            addMidpoint(lineMidpointState, InlineIterator(0, o, pos));
-                        }
-                    }
-                }
-#endif
-
                 bool applyWordSpacing = false;
                 
                 currentCharacterIsWS = currentCharacterIsSpace || (breakNBSP && c == noBreakSpace);
 
                 if ((breakAll || breakWords) && !midWordBreak) {
                     wrapW += charWidth;
-                    charWidth = textWidth(t, pos, 1, f, w + wrapW, isFixedPitch, collapseWhiteSpace);
-                    midWordBreak = w + wrapW + charWidth > width;
+                    charWidth = textWidth(t, pos, 1, f, width.committedWidth() + wrapW, isFixedPitch, collapseWhiteSpace);
+                    midWordBreak = width.committedWidth() + wrapW + charWidth > width.availableWidth();
                 }
 
                 if (lineBreakIteratorInfo.first != t) {
@@ -1969,44 +2090,44 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
 
                     float additionalTmpW;
                     if (wordTrailingSpaceWidth && currentCharacterIsSpace)
-                        additionalTmpW = textWidth(t, lastSpace, pos + 1 - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) - wordTrailingSpaceWidth + lastSpaceWordSpacing;
+                        additionalTmpW = textWidth(t, lastSpace, pos + 1 - lastSpace, f, width.currentWidth(), isFixedPitch, collapseWhiteSpace) - wordTrailingSpaceWidth + lastSpaceWordSpacing;
                     else
-                        additionalTmpW = textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
-                    tmpW += additionalTmpW;
+                        additionalTmpW = textWidth(t, lastSpace, pos - lastSpace, f, width.currentWidth(), isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
+                    width.addUncommittedWidth(additionalTmpW);
                     if (!appliedStartWidth) {
-                        tmpW += inlineLogicalWidth(o, true, false);
+                        width.addUncommittedWidth(inlineLogicalWidth(o, true, false));
                         appliedStartWidth = true;
                     }
                     
                     applyWordSpacing =  wordSpacing && currentCharacterIsSpace && !previousCharacterIsSpace;
 
-                    if (!w && autoWrap && tmpW > width)
-                        fitBelowFloats(tmpW, firstLine, width);
+                    if (!width.committedWidth() && autoWrap && !width.fitsOnLine())
+                        width.fitBelowFloats();
 
                     if (autoWrap || breakWords) {
                         // If we break only after white-space, consider the current character
                         // as candidate width for this line.
                         bool lineWasTooWide = false;
-                        if (w + tmpW <= width && currentCharacterIsWS && o->style()->breakOnlyAfterWhiteSpace() && !midWordBreak) {
-                            int charWidth = textWidth(t, pos, 1, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + (applyWordSpacing ? wordSpacing : 0);
+                        if (width.fitsOnLine() && currentCharacterIsWS && o->style()->breakOnlyAfterWhiteSpace() && !midWordBreak) {
+                            int charWidth = textWidth(t, pos, 1, f, width.currentWidth(), isFixedPitch, collapseWhiteSpace) + (applyWordSpacing ? wordSpacing : 0);
                             // Check if line is too big even without the extra space
                             // at the end of the line. If it is not, do nothing. 
                             // If the line needs the extra whitespace to be too long, 
                             // then move the line break to the space and skip all 
                             // additional whitespace.
-                            if (w + tmpW + charWidth > width) {
+                            if (!width.fitsOnLine(charWidth)) {
                                 lineWasTooWide = true;
                                 lBreak.moveTo(o, pos, nextBreakable);
                                 skipTrailingWhitespace(lBreak, isLineEmpty, previousLineBrokeCleanly);
                             }
                         }
-                        if (lineWasTooWide || w + tmpW > width) {
-                            if (canHyphenate && w + tmpW > width) {
-                                tryHyphenating(t, f, style->locale(), style->hyphenationLimitBefore(), style->hyphenationLimitAfter(), lastSpace, pos, w + tmpW - additionalTmpW, width, isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
+                        if (lineWasTooWide || !width.fitsOnLine()) {
+                            if (canHyphenate && !width.fitsOnLine()) {
+                                tryHyphenating(t, f, style->locale(), style->hyphenationLimitBefore(), style->hyphenationLimitAfter(), lastSpace, pos, width.currentWidth() - additionalTmpW, width.availableWidth(), isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
                                 if (hyphenated)
                                     goto end;
                             }
-                            if (lBreak.m_obj && shouldPreserveNewline(lBreak.m_obj) && lBreak.m_obj->isText() && toRenderText(lBreak.m_obj)->textLength() && !toRenderText(lBreak.m_obj)->isWordBreak() && toRenderText(lBreak.m_obj)->characters()[lBreak.m_pos] == '\n') {
+                            if (lBreak.atTextParagraphSeparator()) {
                                 if (!stoppedIgnoringSpaces && pos > 0) {
                                     // We need to stop right before the newline and then start up again.
                                     addMidpoint(lineMidpointState, InlineIterator(0, o, pos - 1)); // Stop
@@ -2020,10 +2141,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                             goto end; // Didn't fit. Jump to the end.
                         } else {
                             if (!betweenWords || (midWordBreak && !autoWrap))
-                                tmpW -= additionalTmpW;
+                                width.addUncommittedWidth(-additionalTmpW);
                             if (hyphenWidth) {
                                 // Subtract the width of the soft hyphen out since we fit on a line.
-                                tmpW -= hyphenWidth;
+                                width.addUncommittedWidth(-hyphenWidth);
                                 hyphenWidth = 0;
                             }
                         }
@@ -2042,9 +2163,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     }
 
                     if (autoWrap && betweenWords) {
-                        w += tmpW;
+                        width.commit();
                         wrapW = 0;
-                        tmpW = 0;
                         lBreak.moveTo(o, pos, nextBreakable);
                         // Auto-wrapping text should not wrap in the middle of a word once it has had an
                         // opportunity to break after a word.
@@ -2085,6 +2205,16 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     addMidpoint(lineMidpointState, InlineIterator(0, o, pos));
                 }
 
+#if ENABLE(SVG)
+                if (isSVGText && pos > 0) {
+                    // Force creation of new InlineBoxes for each absolute positioned character (those that start new text chunks).
+                    if (static_cast<RenderSVGInlineText*>(t)->characterStartsNewTextChunk(pos)) {
+                        addMidpoint(lineMidpointState, InlineIterator(0, o, pos - 1));
+                        addMidpoint(lineMidpointState, InlineIterator(0, o, pos));
+                    }
+                }
+#endif
+
                 if (currentCharacterIsSpace && !previousCharacterIsSpace) {
                     ignoreStart.m_obj = o;
                     ignoreStart.m_pos = pos;
@@ -2108,26 +2238,24 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             }
 
             // IMPORTANT: pos is > length here!
-            float additionalTmpW = ignoringSpaces ? 0 : textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
-            tmpW += additionalTmpW;
-            tmpW += inlineLogicalWidth(o, !appliedStartWidth, true);
+            float additionalTmpW = ignoringSpaces ? 0 : textWidth(t, lastSpace, pos - lastSpace, f, width.currentWidth(), isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
+            width.addUncommittedWidth(additionalTmpW + inlineLogicalWidth(o, !appliedStartWidth, true));
 
-            if (w + tmpW > width) {
+            if (!width.fitsOnLine()) {
                 if (canHyphenate)
-                    tryHyphenating(t, f, style->locale(), style->hyphenationLimitBefore(), style->hyphenationLimitAfter(), lastSpace, pos, w + tmpW - additionalTmpW, width, isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
-                
+                    tryHyphenating(t, f, style->locale(), style->hyphenationLimitBefore(), style->hyphenationLimitAfter(), lastSpace, pos, width.currentWidth() - additionalTmpW, width.availableWidth(), isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
+
                 if (!hyphenated && lBreak.m_obj && lBreak.m_pos && lBreak.m_obj->isText() && toRenderText(lBreak.m_obj)->textLength() && toRenderText(lBreak.m_obj)->characters()[lBreak.m_pos - 1] == softHyphen && style->hyphens() != HyphensNone)
                     hyphenated = true;
-                
+
                 if (hyphenated)
                     goto end;
             }
         } else
             ASSERT_NOT_REACHED();
 
-        RenderObject* next = bidiNext(this, o);
         bool checkForBreak = autoWrap;
-        if (w && w + tmpW > width && lBreak.m_obj && currWS == NOWRAP)
+        if (width.committedWidth() && !width.fitsOnLine() && lBreak.m_obj && currWS == NOWRAP)
             checkForBreak = true;
         else if (next && o->isText() && next->isText() && !next->isBR()) {
             if (autoWrap || (next->style()->autoWrap())) {
@@ -2138,52 +2266,49 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     RenderText* nextText = toRenderText(next);
                     if (nextText->textLength()) {
                         UChar c = nextText->characters()[0];
-                        if (c == ' ' || c == '\t' || (c == '\n' && !shouldPreserveNewline(next)))
+                        if (c == ' ' || c == '\t' || (c == '\n' && !next->preservesNewline()))
                             // If the next item on the line is text, and if we did not end with
                             // a space, then the next text run continues our word (and so it needs to
                             // keep adding to |tmpW|.  Just update and continue.
                             checkForBreak = true;
                     } else if (nextText->isWordBreak())
                         checkForBreak = true;
-                    bool willFitOnLine = w + tmpW <= width;
-                    if (!willFitOnLine && !w) {
-                        fitBelowFloats(tmpW, firstLine, width);
-                        willFitOnLine = tmpW <= width;
-                    }
-                    bool canPlaceOnLine = willFitOnLine || !autoWrapWasEverTrueOnLine;
+
+                    if (!width.fitsOnLine() && !width.committedWidth())
+                        width.fitBelowFloats();
+
+                    bool canPlaceOnLine = width.fitsOnLine() || !autoWrapWasEverTrueOnLine;
                     if (canPlaceOnLine && checkForBreak) {
-                        w += tmpW;
-                        tmpW = 0;
+                        width.commit();
                         lBreak.moveToStartOf(next);
                     }
                 }
             }
         }
 
-        if (checkForBreak && (w + tmpW > width)) {
+        if (checkForBreak && !width.fitsOnLine()) {
             // if we have floats, try to get below them.
             if (currentCharacterIsSpace && !ignoringSpaces && o->style()->collapseWhiteSpace()) {
                 trailingSpaceObject = 0;
                 trailingPositionedBoxes.clear();
             }
 
-            if (w)
+            if (width.committedWidth())
                 goto end;
 
-            fitBelowFloats(tmpW, firstLine, width);
+            width.fitBelowFloats();
 
             // |width| may have been adjusted because we got shoved down past a float (thus
             // giving us more room), so we need to retest, and only jump to
             // the end label if we still don't fit on the line. -dwh
-            if (w + tmpW > width)
+            if (!width.fitsOnLine())
                 goto end;
         }
 
         if (!o->isFloatingOrPositioned()) {
             last = o;
             if (last->isReplaced() && autoWrap && (!last->isImage() || allowImagesToBreak) && (!last->isListMarker() || toRenderListMarker(last)->isInside())) {
-                w += tmpW;
-                tmpW = 0;
+                width.commit();
                 lBreak.moveToStartOf(next);
             }
         }
@@ -2199,9 +2324,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
         pos = 0;
         atStart = false;
     }
-
     
-    if (w + tmpW <= width || lastWS == NOWRAP)
+    if (width.fitsOnLine() || lastWS == NOWRAP)
         lBreak.clear();
 
  end:
@@ -2294,42 +2418,10 @@ void RenderBlock::addOverflowFromInlineChildren()
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
         addLayoutOverflow(curr->paddedLayoutOverflowRect(endPadding));
         if (!hasOverflowClip())
-            addVisualOverflow(curr->visualOverflowRect());
+            addVisualOverflow(curr->visualOverflowRect(curr->lineTop(), curr->lineBottom()));
     }
 }
 
-int RenderBlock::beforeSideVisualOverflowForLine(RootInlineBox* line) const
-{
-    // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (isHorizontalWritingMode())
-        return line->minYVisualOverflow();
-    return line->minXVisualOverflow();
-}
-
-int RenderBlock::afterSideVisualOverflowForLine(RootInlineBox* line) const
-{
-    // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (isHorizontalWritingMode())
-        return line->maxYVisualOverflow();
-    return line->maxXVisualOverflow();
-}
-
-int RenderBlock::beforeSideLayoutOverflowForLine(RootInlineBox* line) const
-{
-    // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (isHorizontalWritingMode())
-        return line->minYLayoutOverflow();
-    return line->minXLayoutOverflow();
-}
-
-int RenderBlock::afterSideLayoutOverflowForLine(RootInlineBox* line) const
-{
-    // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (isHorizontalWritingMode())
-        return line->maxYLayoutOverflow();
-    return line->maxXLayoutOverflow();
-}
-
 void RenderBlock::deleteEllipsisLineBoxes()
 {
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox())
@@ -2369,4 +2461,49 @@ void RenderBlock::checkLinesForTextOverflow()
     }
 }
 
+bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, LineWidth& width)
+{
+    if (!positionNewFloats())
+        return false;
+
+    width.shrinkAvailableWidthForNewFloatIfNeeded(newFloat);
+
+    if (!newFloat->m_paginationStrut)
+        return true;
+
+    FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+    ASSERT(floatingObjectSet.last() == newFloat);
+
+    int floatLogicalTop = logicalTopForFloat(newFloat);
+    int paginationStrut = newFloat->m_paginationStrut;
+
+    if (floatLogicalTop - paginationStrut != logicalHeight())
+        return true;
+
+    FloatingObjectSetIterator it = floatingObjectSet.end();
+    --it; // Last float is newFloat, skip that one.
+    FloatingObjectSetIterator begin = floatingObjectSet.begin();
+    while (it != begin) {
+        --it;
+        FloatingObject* f = *it;
+        if (f == lastFloatFromPreviousLine)
+            break;
+        if (logicalTopForFloat(f) == logicalHeight()) {
+            ASSERT(!f->m_paginationStrut);
+            f->m_paginationStrut = paginationStrut;
+            RenderBox* o = f->m_renderer;
+            setLogicalTopForChild(o, logicalTopForChild(o) + marginBeforeForChild(o) + paginationStrut);
+            if (o->isRenderBlock())
+                toRenderBlock(o)->setChildNeedsLayout(true, false);
+            o->layoutIfNeeded();
+            setLogicalTopForFloat(f, logicalTopForFloat(f) + f->m_paginationStrut);
+        }
+    }
+
+    setLogicalHeight(logicalHeight() + paginationStrut);
+    width.updateAvailableWidth();
+
+    return true;
+}
+
 }
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index 7b32f07..11c0306 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -966,7 +966,7 @@ void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, cons
 
 void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op, RenderObject* backgroundObject)
 {
-    paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, width, height, 0, op, backgroundObject);
+    paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, width, height, 0, 0, 0, op, backgroundObject);
 }
 
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index ccedc66..f8aee06 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -350,15 +350,15 @@ public:
 
     // Called when a positioned object moves but doesn't necessarily change size.  A simplified layout is attempted
     // that just updates the object's position. If the size does change, the object remains dirty.
-    void tryLayoutDoingPositionedMovementOnly()
+    bool tryLayoutDoingPositionedMovementOnly()
     {
         int oldWidth = width();
         computeLogicalWidth();
         // If we shrink to fit our width may have changed, so we still need full layout.
         if (oldWidth != width())
-            return;
+            return false;
         computeLogicalHeight();
-        setNeedsLayout(false);
+        return true;
     }
 
     IntRect maskClipRect();
@@ -398,9 +398,13 @@ public:
     IntRect logicalLayoutOverflowRectForPropagation(RenderStyle*) const;
     IntRect layoutOverflowRectForPropagation(RenderStyle*) const;
 
+<<<<<<< HEAD
 #ifdef ANDROID_LAYOUT
     int getVisibleWidth() const { return m_visibleWidth; }
 #endif
+=======
+    RenderOverflow* hasRenderOverflow() const { return m_overflow.get(); }
+>>>>>>> WebKit.org at r84325
 
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index 3e2974d..52196e3 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -559,7 +559,20 @@ int RenderBoxModelObject::paddingEnd(bool) const
     return padding.calcMinValue(w);
 }
 
-void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op, RenderObject* backgroundObject)
+RoundedIntRect RenderBoxModelObject::getBackgroundRoundedRect(const IntRect& borderRect, InlineFlowBox* box, int inlineBoxWidth, int inlineBoxHeight,
+    bool includeLogicalLeftEdge, bool includeLogicalRightEdge)
+{
+    RoundedIntRect border = style()->getRoundedBorderFor(borderRect, includeLogicalLeftEdge, includeLogicalRightEdge);
+    if (box && (box->nextLineBox() || box->prevLineBox())) {
+        RoundedIntRect segmentBorder = style()->getRoundedBorderFor(IntRect(0, 0, inlineBoxWidth, inlineBoxHeight), includeLogicalLeftEdge, includeLogicalRightEdge);
+        border.setRadii(segmentBorder.radii());
+    }
+
+    return border;
+}
+
+void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& color, const FillLayer* bgLayer, int tx, int ty, int w, int h,
+    InlineFlowBox* box, int inlineBoxWidth, int inlineBoxHeight, CompositeOperator op, RenderObject* backgroundObject)
 {
     GraphicsContext* context = paintInfo.context;
     if (context->paintingDisabled())
@@ -567,13 +580,53 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
     bool includeLeftEdge = box ? box->includeLogicalLeftEdge() : true;
     bool includeRightEdge = box ? box->includeLogicalRightEdge() : true;
-    int bLeft = includeLeftEdge ? borderLeft() : 0;
-    int bRight = includeRightEdge ? borderRight() : 0;
-    int pLeft = includeLeftEdge ? paddingLeft() : 0;
-    int pRight = includeRightEdge ? paddingRight() : 0;
+
+    bool hasRoundedBorder = style()->hasBorderRadius() && (includeLeftEdge || includeRightEdge);
+    bool clippedWithLocalScrolling = hasOverflowClip() && bgLayer->attachment() == LocalBackgroundAttachment;
+    bool isBorderFill = bgLayer->clip() == BorderFillBox;
+    bool isRoot = this->isRoot();
+
+    Color bgColor = color;
+    StyleImage* bgImage = bgLayer->image();
+    bool shouldPaintBackgroundImage = bgImage && bgImage->canRender(style()->effectiveZoom());
+    
+    // When this style flag is set, change existing background colors and images to a solid white background.
+    // If there's no bg color or image, leave it untouched to avoid affecting transparency.
+    // We don't try to avoid loading the background images, because this style flag is only set
+    // when printing, and at that point we've already loaded the background images anyway. (To avoid
+    // loading the background images we'd have to do this check when applying styles rather than
+    // while rendering.)
+    if (style()->forceBackgroundsToWhite()) {
+        // Note that we can't reuse this variable below because the bgColor might be changed
+        bool shouldPaintBackgroundColor = !bgLayer->next() && bgColor.isValid() && bgColor.alpha() > 0;
+        if (shouldPaintBackgroundImage || shouldPaintBackgroundColor) {
+            bgColor = Color::white;
+            shouldPaintBackgroundImage = false;
+        }
+    }
+
+    bool colorVisible = bgColor.isValid() && bgColor.alpha() > 0;
+    
+    // Fast path for drawing simple color backgrounds.
+    if (!isRoot && !clippedWithLocalScrolling && !shouldPaintBackgroundImage && isBorderFill) {
+        if (!colorVisible)
+            return;
+
+        IntRect borderRect(tx, ty, w, h);
+        if (borderRect.isEmpty())
+            return;
+
+        if (hasRoundedBorder) {
+            RoundedIntRect border = getBackgroundRoundedRect(borderRect, box, inlineBoxWidth, inlineBoxHeight, includeLeftEdge, includeRightEdge);
+            context->fillRoundedRect(border, bgColor, style()->colorSpace());
+        } else
+            context->fillRect(borderRect, bgColor, style()->colorSpace());
+        
+        return;
+    }
 
     bool clippedToBorderRadius = false;
-    if (style()->hasBorderRadius() && (includeLeftEdge || includeRightEdge)) {
+    if (hasRoundedBorder) {
         IntRect borderRect(tx, ty, w, h);
 
         if (borderRect.isEmpty())
@@ -581,13 +634,16 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
         context->save();
 
-        RoundedIntRect border = style()->getRoundedBorderFor(borderRect);
-        border.excludeLogicalEdges(box && box->isHorizontal(), !includeLeftEdge, !includeRightEdge);
+        RoundedIntRect border = getBackgroundRoundedRect(borderRect, box, inlineBoxWidth, inlineBoxHeight, includeLeftEdge, includeRightEdge);
         context->addRoundedRectClip(border);
         clippedToBorderRadius = true;
     }
+    
+    int bLeft = includeLeftEdge ? borderLeft() : 0;
+    int bRight = includeRightEdge ? borderRight() : 0;
+    int pLeft = includeLeftEdge ? paddingLeft() : 0;
+    int pRight = includeRightEdge ? paddingRight() : 0;
 
-    bool clippedWithLocalScrolling = hasOverflowClip() && bgLayer->attachment() == LocalBackgroundAttachment;
     if (clippedWithLocalScrolling) {
         // Clip to the overflow area.
         context->save();
@@ -628,9 +684,10 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         // Now add the text to the clip.  We do this by painting using a special paint phase that signals to
         // InlineTextBoxes that they should just add their contents to the clip.
         PaintInfo info(maskImageContext, maskRect, PaintPhaseTextClip, true, 0, 0);
-        if (box)
-            box->paint(info, tx - box->x(), ty - box->y());
-        else {
+        if (box) {
+            RootInlineBox* root = box->root();
+            box->paint(info, tx - box->x(), ty - box->y(), root->lineTop(), root->lineBottom());
+        } else {
             int x = isBox() ? toRenderBox(this)->x() : 0;
             int y = isBox() ? toRenderBox(this)->y() : 0;
             paint(info, tx - x, ty - y);
@@ -641,27 +698,6 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         context->clipToImageBuffer(maskImage.get(), maskRect);
     }
     
-    StyleImage* bg = bgLayer->image();
-    bool shouldPaintBackgroundImage = bg && bg->canRender(style()->effectiveZoom());
-    Color bgColor = c;
-
-    // When this style flag is set, change existing background colors and images to a solid white background.
-    // If there's no bg color or image, leave it untouched to avoid affecting transparency.
-    // We don't try to avoid loading the background images, because this style flag is only set
-    // when printing, and at that point we've already loaded the background images anyway. (To avoid
-    // loading the background images we'd have to do this check when applying styles rather than
-    // while rendering.)
-    if (style()->forceBackgroundsToWhite()) {
-        // Note that we can't reuse this variable below because the bgColor might be changed
-        bool shouldPaintBackgroundColor = !bgLayer->next() && bgColor.isValid() && bgColor.alpha() > 0;
-        if (shouldPaintBackgroundImage || shouldPaintBackgroundColor) {
-            bgColor = Color::white;
-            shouldPaintBackgroundImage = false;
-        }
-    }
-
-    bool isRoot = this->isRoot();
-
     // Only fill with a base color (e.g., white) if we're the root document, since iframes/frames with
     // no background in the child document should show the parent's background.
     bool isOpaqueRoot = false;
@@ -726,18 +762,16 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
             phase += destRect.location() - destOrigin;
             CompositeOperator compositeOp = op == CompositeSourceOver ? bgLayer->composite() : op;
             RenderObject* clientForBackgroundImage = backgroundObject ? backgroundObject : this;
-            RefPtr<Image> image = bg->image(clientForBackgroundImage, tileSize);
+            RefPtr<Image> image = bgImage->image(clientForBackgroundImage, tileSize);
             bool useLowQualityScaling = shouldPaintAtLowQuality(context, image.get(), bgLayer, tileSize);
             context->drawTiledImage(image.get(), style()->colorSpace(), destRect, phase, tileSize, compositeOp, useLowQualityScaling);
         }
     }
 
-    if (bgLayer->clip() != BorderFillBox)
-        // Undo the background clip
+    if (!isBorderFill) // Undo the background clip
         context->restore();
 
-    if (clippedToBorderRadius)
-        // Undo the border radius clip
+    if (clippedToBorderRadius) // Undo the border radius clip
         context->restore();
         
     if (clippedWithLocalScrolling) // Undo the clip for local background attachments.
@@ -1001,170 +1035,560 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
 }
 
 #if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
-static bool borderWillArcInnerEdge(const IntSize& firstRadius, const IntSize& secondRadius, int firstBorderWidth, int secondBorderWidth, int middleBorderWidth)
+static bool borderWillArcInnerEdge(const IntSize& firstRadius, const IntSize& secondRadius)
 {
-    // FIXME: This test is insufficient. We need to take border style into account.
-    return (!firstRadius.width() || firstRadius.width() >= firstBorderWidth)
-            && (!firstRadius.height() || firstRadius.height() >= middleBorderWidth)
-            && (!secondRadius.width() || secondRadius.width() >= secondBorderWidth)
-            && (!secondRadius.height() || secondRadius.height() >= middleBorderWidth);
+    return !firstRadius.isZero() || !secondRadius.isZero();
 }
 
-void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
-                                       const RenderStyle* style, bool includeLogicalLeftEdge, bool includeLogicalRightEdge)
+enum BorderEdgeFlag {
+    TopBorderEdge = 1 << BSTop,
+    RightBorderEdge = 1 << BSRight,
+    BottomBorderEdge = 1 << BSBottom,
+    LeftBorderEdge = 1 << BSLeft,
+    AllBorderEdges = TopBorderEdge | BottomBorderEdge | LeftBorderEdge | RightBorderEdge
+};
+
+static inline BorderEdgeFlag edgeFlagForSide(BoxSide side)
 {
-    if (paintNinePieceImage(graphicsContext, tx, ty, w, h, style, style->borderImage()))
-        return;
+    return static_cast<BorderEdgeFlag>(1 << side);
+}
 
-    if (graphicsContext->paintingDisabled())
-        return;
+static inline bool includesEdge(BorderEdgeFlags flags, BoxSide side)
+{
+    return flags & edgeFlagForSide(side);
+}
 
-    const Color& topColor = style->visitedDependentColor(CSSPropertyBorderTopColor);
-    const Color& bottomColor = style->visitedDependentColor(CSSPropertyBorderBottomColor);
-    const Color& leftColor = style->visitedDependentColor(CSSPropertyBorderLeftColor);
-    const Color& rightColor = style->visitedDependentColor(CSSPropertyBorderRightColor);
+class BorderEdge {
+public:
+    BorderEdge(int edgeWidth, const Color& edgeColor, EBorderStyle edgeStyle, bool edgeIsTransparent, bool edgeIsPresent)
+        : width(edgeWidth)
+        , color(edgeColor)
+        , style(edgeStyle)
+        , isTransparent(edgeIsTransparent)
+        , isPresent(edgeIsPresent)
+    {
+        if (style == DOUBLE && edgeWidth < 3)
+            style = SOLID;
+    }
+    
+    bool hasVisibleColorAndStyle() const { return style > BHIDDEN && !isTransparent; }
+    bool shouldRender() const { return isPresent && hasVisibleColorAndStyle(); }
+    bool presentButInvisible() const { return usedWidth() && !hasVisibleColorAndStyle(); }
 
-    bool topTransparent = style->borderTopIsTransparent();
-    bool bottomTransparent = style->borderBottomIsTransparent();
-    bool rightTransparent = style->borderRightIsTransparent();
-    bool leftTransparent = style->borderLeftIsTransparent();
+    int usedWidth() const { return isPresent ? width : 0; }
+    
+    void getDoubleBorderStripeWidths(int& outerWidth, int& innerWidth) const
+    {
+        int fullWidth = usedWidth();
+        outerWidth = fullWidth / 3;
+        innerWidth = fullWidth * 2 / 3;
+
+        // We need certain integer rounding results
+        if (fullWidth % 3 == 2)
+            outerWidth += 1;
+
+        if (fullWidth % 3 == 1)
+            innerWidth += 1;
+    }
+    
+    int width;
+    Color color;
+    EBorderStyle style;
+    bool isTransparent;
+    bool isPresent;
+};
 
-    EBorderStyle topStyle = style->borderTopStyle();
-    EBorderStyle bottomStyle = style->borderBottomStyle();
-    EBorderStyle leftStyle = style->borderLeftStyle();
-    EBorderStyle rightStyle = style->borderRightStyle();
+inline bool edgesShareColor(const BorderEdge& firstEdge, const BorderEdge& secondEdge)
+{
+    return firstEdge.color == secondEdge.color;
+}
 
-    bool horizontal = style->isHorizontalWritingMode();
+inline bool styleRequiresClipPolygon(EBorderStyle style)
+{
+    return style == DOTTED || style == DASHED; // These are drawn with a stroke, so we have to clip to get corner miters.
+}
 
-    bool renderTop = topStyle > BHIDDEN && !topTransparent && (horizontal || includeLogicalLeftEdge);
-    bool renderLeft = leftStyle > BHIDDEN && !leftTransparent && (!horizontal || includeLogicalLeftEdge);
-    bool renderRight = rightStyle > BHIDDEN && !rightTransparent && (!horizontal || includeLogicalRightEdge);
-    bool renderBottom = bottomStyle > BHIDDEN && !bottomTransparent && (horizontal || includeLogicalRightEdge);
+static bool borderStyleFillsBorderArea(EBorderStyle style)
+{
+    return !(style == DOTTED || style == DASHED || style == DOUBLE);
+}
 
-    Path roundedPath;
-    RoundedIntRect border(tx, ty, w, h);
+static bool borderStyleHasInnerDetail(EBorderStyle style)
+{
+    return style == GROOVE || style == RIDGE || style == DOUBLE;
+}
 
-    if (style->hasBorderRadius()) {
-        border.includeLogicalEdges(style->getRoundedBorderFor(border.rect()).radii(),
-                                   horizontal, includeLogicalLeftEdge, includeLogicalRightEdge);
+static bool borderStyleIsDottedOrDashed(EBorderStyle style)
+{
+    return style == DOTTED || style == DASHED;
+}
 
-        int leftWidth = (!horizontal || includeLogicalLeftEdge) ? style->borderLeftWidth() : 0;
-        int rightWidth = (!horizontal || includeLogicalRightEdge) ? style->borderRightWidth() : 0;
-        int topWidth = (horizontal || includeLogicalLeftEdge) ? style->borderTopWidth() : 0;
-        int bottomWidth = (horizontal || includeLogicalRightEdge) ? style->borderBottomWidth() : 0;
+// OUTSET darkens the bottom and right (and maybe lightens the top and left)
+// INSET darkens the top and left (and maybe lightens the bottom and right)
+static inline bool borderStyleHasUnmatchedColorsAtCorner(EBorderStyle style, BoxSide side, BoxSide adjacentSide)
+{
+    // These styles match at the top/left and bottom/right.
+    if (style == INSET || style == GROOVE || style == RIDGE || style == OUTSET) {
+        const BorderEdgeFlags topRightFlags = edgeFlagForSide(BSTop) | edgeFlagForSide(BSRight);
+        const BorderEdgeFlags bottomLeftFlags = edgeFlagForSide(BSBottom) | edgeFlagForSide(BSLeft);
 
-        RoundedIntRect inner(borderInnerRect(border.rect(), topWidth, bottomWidth, leftWidth, rightWidth));
-        inner.includeLogicalEdges(style->getRoundedInnerBorderWithBorderWidths(inner.rect(), topWidth, bottomWidth, leftWidth, rightWidth).radii(),
-                                  horizontal, includeLogicalLeftEdge, includeLogicalRightEdge);
+        BorderEdgeFlags flags = edgeFlagForSide(side) | edgeFlagForSide(adjacentSide);
+        return flags == topRightFlags || flags == bottomLeftFlags;
+    }
+    return false;
+}
 
-        if (border.isRounded()) {
-            // Clip to the inner and outer radii rects.
-            graphicsContext->save();
-            graphicsContext->addRoundedRectClip(border);
-            graphicsContext->clipOutRoundedRect(inner);
-            roundedPath.addRoundedRect(border.rect(), border.radii().topLeft(), border.radii().topRight(), border.radii().bottomLeft(), border.radii().bottomRight());
-        }
+static inline bool colorsMatchAtCorner(BoxSide side, BoxSide adjacentSide, const BorderEdge edges[])
+{
+    if (edges[side].shouldRender() != edges[adjacentSide].shouldRender())
+        return false;
+
+    if (!edgesShareColor(edges[side], edges[adjacentSide]))
+        return false;
+
+    return !borderStyleHasUnmatchedColorsAtCorner(edges[side].style, side, adjacentSide);
+}
+
+// This assumes that we draw in order: top, bottom, left, right.
+static inline bool willBeOverdrawn(BoxSide side, BoxSide adjacentSide, const BorderEdge edges[])
+{
+    switch (side) {
+    case BSTop:
+    case BSBottom:
+        if (edges[adjacentSide].presentButInvisible())
+            return false;
+
+        if (!edgesShareColor(edges[side], edges[adjacentSide]) && edges[adjacentSide].color.hasAlpha())
+            return false;
+        
+        if (!borderStyleFillsBorderArea(edges[adjacentSide].style))
+            return false;
+
+        return true;
+
+    case BSLeft:
+    case BSRight:
+        // These draw last, so are never overdrawn.
+        return false;
     }
+    return false;
+}
 
-    bool renderRadii = border.isRounded();
-    bool upperLeftBorderStylesMatch = renderLeft && (topStyle == leftStyle) && (topColor == leftColor);
-    bool upperRightBorderStylesMatch = renderRight && (topStyle == rightStyle) && (topColor == rightColor) && (topStyle != OUTSET) && (topStyle != RIDGE) && (topStyle != INSET) && (topStyle != GROOVE);
-    bool lowerLeftBorderStylesMatch = renderLeft && (bottomStyle == leftStyle) && (bottomColor == leftColor) && (bottomStyle != OUTSET) && (bottomStyle != RIDGE) && (bottomStyle != INSET) && (bottomStyle != GROOVE);
-    bool lowerRightBorderStylesMatch = renderRight && (bottomStyle == rightStyle) && (bottomColor == rightColor);
+static inline bool borderStylesRequireMitre(BoxSide side, BoxSide adjacentSide, EBorderStyle style, EBorderStyle adjacentStyle)
+{
+    if (style == DOUBLE || adjacentStyle == DOUBLE || adjacentStyle == GROOVE || adjacentStyle == RIDGE)
+        return true;
 
-    if (renderTop) {
-        int x = tx;
-        int x2 = tx + w;
+    if (borderStyleIsDottedOrDashed(style) != borderStyleIsDottedOrDashed(adjacentStyle))
+        return true;
+
+    if (style != adjacentStyle)
+        return true;
 
-        if (renderRadii && borderWillArcInnerEdge(border.radii().topLeft(), border.radii().topRight(), style->borderLeftWidth(), style->borderRightWidth(), style->borderTopWidth())) {
+    return borderStyleHasUnmatchedColorsAtCorner(style, side, adjacentSide);
+}
+
+static bool joinRequiresMitre(BoxSide side, BoxSide adjacentSide, const BorderEdge edges[], bool allowOverdraw)
+{
+    if ((edges[side].isTransparent && edges[adjacentSide].isTransparent) || !edges[adjacentSide].isPresent)
+        return false;
+
+    if (allowOverdraw && willBeOverdrawn(side, adjacentSide, edges))
+        return false;
+
+    if (!edgesShareColor(edges[side], edges[adjacentSide]))
+        return true;
+
+    if (borderStylesRequireMitre(side, adjacentSide, edges[side].style, edges[adjacentSide].style))
+        return true;
+    
+    return false;
+}
+
+void RenderBoxModelObject::paintOneBorderSide(GraphicsContext* graphicsContext, const RenderStyle* style, const RoundedIntRect& outerBorder, const RoundedIntRect& innerBorder,
+    const IntRect& sideRect, BoxSide side, BoxSide adjacentSide1, BoxSide adjacentSide2, const BorderEdge edges[], const Path* path, 
+    bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias, const Color* overrideColor)
+{
+    const BorderEdge& edgeToRender = edges[side];
+    const BorderEdge& adjacentEdge1 = edges[adjacentSide1];
+    const BorderEdge& adjacentEdge2 = edges[adjacentSide2];
+
+    bool mitreAdjacentSide1 = joinRequiresMitre(side, adjacentSide1, edges, !antialias);
+    bool mitreAdjacentSide2 = joinRequiresMitre(side, adjacentSide2, edges, !antialias);
+    
+    bool adjacentSide1StylesMatch = colorsMatchAtCorner(side, adjacentSide1, edges);
+    bool adjacentSide2StylesMatch = colorsMatchAtCorner(side, adjacentSide2, edges);
+
+    const Color& colorToPaint = overrideColor ? *overrideColor : edgeToRender.color;
+
+    if (path) {
+        graphicsContext->save();
+        clipBorderSidePolygon(graphicsContext, outerBorder, innerBorder, side, adjacentSide1StylesMatch, adjacentSide2StylesMatch);
+        float thickness = max(max(edgeToRender.width, adjacentEdge1.width), adjacentEdge2.width);
+        drawBoxSideFromPath(graphicsContext, outerBorder.rect(), *path, edges, edgeToRender.width, thickness, side, style, colorToPaint, edgeToRender.style, includeLogicalLeftEdge, includeLogicalRightEdge);
+        graphicsContext->restore();
+    } else {
+        bool didClip = false;
+        
+        if (styleRequiresClipPolygon(edgeToRender.style) && (mitreAdjacentSide1 || mitreAdjacentSide2)) {
             graphicsContext->save();
-            clipBorderSidePolygon(graphicsContext, border, BSTop, upperLeftBorderStylesMatch, upperRightBorderStylesMatch, style, includeLogicalLeftEdge, includeLogicalRightEdge);
-            float thickness = max(max(style->borderTopWidth(), style->borderLeftWidth()), style->borderRightWidth());
-            drawBoxSideFromPath(graphicsContext, border.rect(), roundedPath, style->borderTopWidth(), thickness, BSTop, style, topColor, topStyle);
+            clipBorderSidePolygon(graphicsContext, outerBorder, innerBorder, side, !mitreAdjacentSide1, !mitreAdjacentSide2);
+            didClip = true;
+            // Since we clipped, no need to draw with a mitre.
+            mitreAdjacentSide1 = false;
+            mitreAdjacentSide2 = false;
+        }
+        
+        drawLineForBoxSide(graphicsContext, sideRect.x(), sideRect.y(), sideRect.maxX(), sideRect.maxY(), side, colorToPaint, edgeToRender.style,
+                mitreAdjacentSide1 ? adjacentEdge1.width : 0, mitreAdjacentSide2 ? adjacentEdge2.width : 0, antialias);
+        
+        if (didClip)
             graphicsContext->restore();
-        } else {
-            bool ignoreLeft = (topColor == leftColor && topTransparent == leftTransparent && topStyle >= OUTSET
-                && (leftStyle == DOTTED || leftStyle == DASHED || leftStyle == SOLID || leftStyle == OUTSET));
-            bool ignoreRight = (topColor == rightColor && topTransparent == rightTransparent && topStyle >= OUTSET
-                && (rightStyle == DOTTED || rightStyle == DASHED || rightStyle == SOLID || rightStyle == INSET));
+    }
+}
 
-            drawLineForBoxSide(graphicsContext, x, ty, x2, ty + style->borderTopWidth(), BSTop, topColor, topStyle,
-                    ignoreLeft ? 0 : style->borderLeftWidth(), ignoreRight ? 0 : style->borderRightWidth());               
-        }
+void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, const RenderStyle* style, const RoundedIntRect& outerBorder, const RoundedIntRect& innerBorder,
+                                            const BorderEdge edges[], BorderEdgeFlags edgeSet, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias, const Color* overrideColor)
+{
+    bool renderRadii = outerBorder.isRounded();
+
+    Path roundedPath;
+    if (renderRadii)
+        roundedPath.addRoundedRect(outerBorder);
+    
+    if (edges[BSTop].shouldRender() && includesEdge(edgeSet, BSTop)) {
+        IntRect sideRect = outerBorder.rect();
+        sideRect.setHeight(edges[BSTop].width);
+
+        bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSTop].style) || borderWillArcInnerEdge(innerBorder.radii().topLeft(), innerBorder.radii().topRight()));
+        paintOneBorderSide(graphicsContext, style, outerBorder, innerBorder, sideRect, BSTop, BSLeft, BSRight, edges, usePath ? &roundedPath : 0, includeLogicalLeftEdge, includeLogicalRightEdge, antialias, overrideColor);
     }
 
-    if (renderBottom) {
-        int x = tx;
-        int x2 = tx + w;
+    if (edges[BSBottom].shouldRender() && includesEdge(edgeSet, BSBottom)) {
+        IntRect sideRect = outerBorder.rect();
+        sideRect.shiftYEdgeTo(sideRect.maxY() - edges[BSBottom].width);
 
-        if (renderRadii && borderWillArcInnerEdge(border.radii().bottomLeft(), border.radii().bottomRight(), style->borderLeftWidth(), style->borderRightWidth(), style->borderBottomWidth())) {
-            graphicsContext->save();
-            clipBorderSidePolygon(graphicsContext, border, BSBottom, lowerLeftBorderStylesMatch, lowerRightBorderStylesMatch, style, includeLogicalLeftEdge, includeLogicalRightEdge);
-            float thickness = max(max(style->borderBottomWidth(), style->borderLeftWidth()), style->borderRightWidth());
-            drawBoxSideFromPath(graphicsContext, border.rect(), roundedPath, style->borderBottomWidth(), thickness, BSBottom, style, bottomColor, bottomStyle);
-            graphicsContext->restore();
-        } else {
-            bool ignoreLeft = (bottomColor == leftColor && bottomTransparent == leftTransparent && bottomStyle >= OUTSET
-                && (leftStyle == DOTTED || leftStyle == DASHED || leftStyle == SOLID || leftStyle == OUTSET));
+        bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSBottom].style) || borderWillArcInnerEdge(innerBorder.radii().bottomLeft(), innerBorder.radii().bottomRight()));
+        paintOneBorderSide(graphicsContext, style, outerBorder, innerBorder, sideRect, BSBottom, BSLeft, BSRight, edges, usePath ? &roundedPath : 0, includeLogicalLeftEdge, includeLogicalRightEdge, antialias, overrideColor);
+    }
 
-            bool ignoreRight = (bottomColor == rightColor && bottomTransparent == rightTransparent && bottomStyle >= OUTSET
-                && (rightStyle == DOTTED || rightStyle == DASHED || rightStyle == SOLID || rightStyle == INSET));
+    if (edges[BSLeft].shouldRender() && includesEdge(edgeSet, BSLeft)) {
+        IntRect sideRect = outerBorder.rect();
+        sideRect.setWidth(edges[BSLeft].width);
+
+        bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSLeft].style) || borderWillArcInnerEdge(innerBorder.radii().bottomLeft(), innerBorder.radii().topLeft()));
+        paintOneBorderSide(graphicsContext, style, outerBorder, innerBorder, sideRect, BSLeft, BSTop, BSBottom, edges, usePath ? &roundedPath : 0, includeLogicalLeftEdge, includeLogicalRightEdge, antialias, overrideColor);
+    }
+
+    if (edges[BSRight].shouldRender() && includesEdge(edgeSet, BSRight)) {
+        IntRect sideRect = outerBorder.rect();
+        sideRect.shiftXEdgeTo(sideRect.maxX() - edges[BSRight].width);
+
+        bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSRight].style) || borderWillArcInnerEdge(innerBorder.radii().bottomRight(), innerBorder.radii().topRight()));
+        paintOneBorderSide(graphicsContext, style, outerBorder, innerBorder, sideRect, BSRight, BSTop, BSBottom, edges, usePath ? &roundedPath : 0, includeLogicalLeftEdge, includeLogicalRightEdge, antialias, overrideColor);
+    }
+}
 
-            drawLineForBoxSide(graphicsContext, x, ty + h - style->borderBottomWidth(), x2, ty + h, BSBottom, bottomColor, 
-                        bottomStyle, ignoreLeft ? 0 : style->borderLeftWidth(), 
-                        ignoreRight ? 0 : style->borderRightWidth());
+void RenderBoxModelObject::paintTranslucentBorderSides(GraphicsContext* graphicsContext, const RenderStyle* style, const RoundedIntRect& outerBorder, const RoundedIntRect& innerBorder,
+                                                       const BorderEdge edges[], bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias)
+{
+    BorderEdgeFlags edgesToDraw = AllBorderEdges;
+    while (edgesToDraw) {
+        // Find undrawn edges sharing a color.
+        Color commonColor;
+        
+        BorderEdgeFlags commonColorEdgeSet = 0;
+        for (int i = BSTop; i <= BSLeft; ++i) {
+            BoxSide currSide = static_cast<BoxSide>(i);
+            if (!includesEdge(edgesToDraw, currSide))
+                continue;
+
+            bool includeEdge;
+            if (!commonColorEdgeSet) {
+                commonColor = edges[currSide].color;
+                includeEdge = true;
+            } else
+                includeEdge = edges[currSide].color == commonColor;
+
+            if (includeEdge)
+                commonColorEdgeSet |= edgeFlagForSide(currSide);
         }
+
+        bool useTransparencyLayer = commonColor.hasAlpha();
+        if (useTransparencyLayer) {
+            graphicsContext->beginTransparencyLayer(static_cast<float>(commonColor.alpha()) / 255);
+            commonColor = Color(commonColor.red(), commonColor.green(), commonColor.blue());
+        }
+
+        paintBorderSides(graphicsContext, style, outerBorder, innerBorder, edges, commonColorEdgeSet, includeLogicalLeftEdge, includeLogicalRightEdge, antialias, &commonColor);
+            
+        if (useTransparencyLayer)
+            graphicsContext->endTransparencyLayer();
+        
+        edgesToDraw &= ~commonColorEdgeSet;
     }
+}
 
-    if (renderLeft) {
-        int y = ty;
-        int y2 = ty + h;
+void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
+                                       const RenderStyle* style, bool includeLogicalLeftEdge, bool includeLogicalRightEdge)
+{
+    if (paintNinePieceImage(graphicsContext, tx, ty, w, h, style, style->borderImage()))
+        return;
 
-        if (renderRadii && borderWillArcInnerEdge(border.radii().bottomLeft(), border.radii().topLeft(), style->borderBottomWidth(), style->borderTopWidth(), style->borderLeftWidth())) {
-            graphicsContext->save();
-            clipBorderSidePolygon(graphicsContext, border, BSLeft, upperLeftBorderStylesMatch, lowerLeftBorderStylesMatch, style, includeLogicalLeftEdge, includeLogicalRightEdge);
-            float thickness = max(max(style->borderLeftWidth(), style->borderTopWidth()), style->borderBottomWidth());
-            drawBoxSideFromPath(graphicsContext, border.rect(), roundedPath, style->borderLeftWidth(), thickness, BSLeft, style, leftColor, leftStyle);
-            graphicsContext->restore();
-        } else {
-            bool ignoreTop = (topColor == leftColor && topTransparent == leftTransparent && leftStyle >= OUTSET
-                && (topStyle == DOTTED || topStyle == DASHED || topStyle == SOLID || topStyle == OUTSET));
+    if (graphicsContext->paintingDisabled())
+        return;
 
-            bool ignoreBottom = (bottomColor == leftColor && bottomTransparent == leftTransparent && leftStyle >= OUTSET
-                && (bottomStyle == DOTTED || bottomStyle == DASHED || bottomStyle == SOLID || bottomStyle == INSET));
+    bool horizontal = style->isHorizontalWritingMode();
 
-            drawLineForBoxSide(graphicsContext, tx, y, tx + style->borderLeftWidth(), y2, BSLeft, leftColor,
-                        leftStyle, ignoreTop ? 0 : style->borderTopWidth(), ignoreBottom ? 0 : style->borderBottomWidth());
+    BorderEdge edges[4] = {
+        // BSTop
+        BorderEdge(style->borderTopWidth(),
+                    style->visitedDependentColor(CSSPropertyBorderTopColor),
+                    style->borderTopStyle(),
+                    style->borderTopIsTransparent(),
+                    horizontal || includeLogicalLeftEdge),
+        // BSRight
+        BorderEdge(style->borderRightWidth(),
+                    style->visitedDependentColor(CSSPropertyBorderRightColor),
+                    style->borderRightStyle(),
+                    style->borderRightIsTransparent(),
+                    !horizontal || includeLogicalRightEdge),
+        // BSBottom
+        BorderEdge(style->borderBottomWidth(),
+                    style->visitedDependentColor(CSSPropertyBorderBottomColor),
+                    style->borderBottomStyle(),
+                    style->borderBottomIsTransparent(),
+                    horizontal || includeLogicalRightEdge),
+        // BSLeft
+        BorderEdge(style->borderLeftWidth(),
+                    style->visitedDependentColor(CSSPropertyBorderLeftColor),
+                    style->borderLeftStyle(),
+                    style->borderLeftIsTransparent(),
+                    !horizontal || includeLogicalLeftEdge)
+    };
+
+    IntRect borderRect(tx, ty, w, h);
+    RoundedIntRect outerBorder = style->getRoundedBorderFor(borderRect, includeLogicalLeftEdge, includeLogicalRightEdge);
+    RoundedIntRect innerBorder = style->getRoundedInnerBorderFor(borderRect, includeLogicalLeftEdge, includeLogicalRightEdge);
+
+    const AffineTransform& currentCTM = graphicsContext->getCTM();
+    // FIXME: this isn't quite correct. We may want to antialias when scaled by a non-integral value, or when the translation is non-integral.
+    bool antialias = !currentCTM.isIdentityOrTranslationOrFlipped();
+    
+    bool haveAlphaColor = false;
+    bool haveAllSolidEdges = true;
+    bool allEdgesVisible = true;
+    bool allEdgesShareColor = true;
+    int firstVisibleEdge = -1;
+
+    for (int i = BSTop; i <= BSLeft; ++i) {
+        const BorderEdge& currEdge = edges[i];
+        if (currEdge.presentButInvisible()) {
+            allEdgesVisible = false;
+            continue;
         }
+        
+        if (!currEdge.width)
+            continue;
+
+        if (firstVisibleEdge == -1)
+            firstVisibleEdge = i;
+        else if (currEdge.color != edges[firstVisibleEdge].color)
+            allEdgesShareColor = false;
+
+        if (currEdge.color.hasAlpha())
+            haveAlphaColor = true;
+        
+        if (currEdge.style != SOLID)
+            haveAllSolidEdges = false;
     }
+    
+    // isRenderable() check avoids issue described in https://bugs.webkit.org/show_bug.cgi?id=38787
+    if (haveAllSolidEdges && allEdgesVisible && allEdgesShareColor && innerBorder.isRenderable()) {
+        // Fast path for drawing all solid edges.
+        if (outerBorder.isRounded() || haveAlphaColor) {
+            Path path;
+            
+            // FIXME: Path should take a RoundedIntRect directly.
+            if (outerBorder.isRounded())
+                path.addRoundedRect(outerBorder);
+            else
+                path.addRect(outerBorder.rect());
 
-    if (renderRight) {
-        if (renderRadii && borderWillArcInnerEdge(border.radii().bottomRight(), border.radii().topRight(), style->borderBottomWidth(), style->borderTopWidth(), style->borderRightWidth())) {
-            graphicsContext->save();
-            clipBorderSidePolygon(graphicsContext, border, BSRight, upperRightBorderStylesMatch, lowerRightBorderStylesMatch, style, includeLogicalLeftEdge, includeLogicalRightEdge);
-            float thickness = max(max(style->borderRightWidth(), style->borderTopWidth()), style->borderBottomWidth());
-            drawBoxSideFromPath(graphicsContext, border.rect(), roundedPath, style->borderRightWidth(), thickness, BSRight, style, rightColor, rightStyle);
-            graphicsContext->restore();
-        } else {
-            bool ignoreTop = ((topColor == rightColor) && (topTransparent == rightTransparent)
-                && (rightStyle >= DOTTED || rightStyle == INSET)
-                && (topStyle == DOTTED || topStyle == DASHED || topStyle == SOLID || topStyle == OUTSET));
+            if (innerBorder.isRounded())
+                path.addRoundedRect(innerBorder);
+            else
+                path.addRect(innerBorder.rect());
+            
+            graphicsContext->setFillRule(RULE_EVENODD);
+            graphicsContext->setFillColor(edges[firstVisibleEdge].color, style->colorSpace());
+            graphicsContext->fillPath(path);
+        } else
+            paintBorderSides(graphicsContext, style, outerBorder, innerBorder, edges, AllBorderEdges, includeLogicalLeftEdge, includeLogicalRightEdge, antialias);
+    
+        return;
+    }
 
-            bool ignoreBottom = ((bottomColor == rightColor) && (bottomTransparent == rightTransparent)
-                && (rightStyle >= DOTTED || rightStyle == INSET)
-                && (bottomStyle == DOTTED || bottomStyle == DASHED || bottomStyle == SOLID || bottomStyle == INSET));
+    if (outerBorder.isRounded()) {
+        // Clip to the inner and outer radii rects.
+        graphicsContext->save();
+        graphicsContext->addRoundedRectClip(outerBorder);
+        graphicsContext->clipOutRoundedRect(innerBorder);
+    }
+
+    if (haveAlphaColor)
+        paintTranslucentBorderSides(graphicsContext, style, outerBorder, innerBorder, edges, includeLogicalLeftEdge, includeLogicalRightEdge, antialias);
+    else
+        paintBorderSides(graphicsContext, style, outerBorder, innerBorder, edges, AllBorderEdges, includeLogicalLeftEdge, includeLogicalRightEdge, antialias);
+
+    if (outerBorder.isRounded()) 
+        graphicsContext->restore();
+}
+
+void RenderBoxModelObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, const IntRect& borderRect, const Path& borderPath, const BorderEdge edges[],
+                                    float thickness, float drawThickness, BoxSide side, const RenderStyle* style, 
+                                    Color color, EBorderStyle borderStyle, bool includeLogicalLeftEdge, bool includeLogicalRightEdge)
+{
+    if (thickness <= 0)
+        return;
 
-            int y = ty;
-            int y2 = ty + h;
+    if (borderStyle == DOUBLE && thickness < 3)
+        borderStyle = SOLID;
 
-            drawLineForBoxSide(graphicsContext, tx + w - style->borderRightWidth(), y, tx + w, y2, BSRight, rightColor, 
-                rightStyle, ignoreTop ? 0 : style->borderTopWidth(), 
-                ignoreBottom ? 0 : style->borderBottomWidth());
+    switch (borderStyle) {
+    case BNONE:
+    case BHIDDEN:
+        return;
+    case DOTTED:
+    case DASHED: {
+        graphicsContext->setStrokeColor(color, style->colorSpace());
+
+        // The stroke is doubled here because the provided path is the 
+        // outside edge of the border so half the stroke is clipped off. 
+        // The extra multiplier is so that the clipping mask can antialias
+        // the edges to prevent jaggies.
+        graphicsContext->setStrokeThickness(drawThickness * 2 * 1.1f);
+        graphicsContext->setStrokeStyle(borderStyle == DASHED ? DashedStroke : DottedStroke);
+
+        // If the number of dashes that fit in the path is odd and non-integral then we
+        // will have an awkwardly-sized dash at the end of the path. To try to avoid that
+        // here, we simply make the whitespace dashes ever so slightly bigger.
+        // FIXME: This could be even better if we tried to manipulate the dash offset
+        // and possibly the gapLength to get the corners dash-symmetrical.
+        float dashLength = thickness * ((borderStyle == DASHED) ? 3.0f : 1.0f);
+        float gapLength = dashLength;
+        float numberOfDashes = borderPath.length() / dashLength;
+        // Don't try to show dashes if we have less than 2 dashes + 2 gaps.
+        // FIXME: should do this test per side.
+        if (numberOfDashes >= 4) {
+            bool evenNumberOfFullDashes = !((int)numberOfDashes % 2);
+            bool integralNumberOfDashes = !(numberOfDashes - (int)numberOfDashes);
+            if (!evenNumberOfFullDashes && !integralNumberOfDashes) {
+                float numberOfGaps = numberOfDashes / 2;
+                gapLength += (dashLength  / numberOfGaps);
+            }
+
+            DashArray lineDash;
+            lineDash.append(dashLength);
+            lineDash.append(gapLength);
+            graphicsContext->setLineDash(lineDash, dashLength);
         }
+        
+        // FIXME: stroking the border path causes issues with tight corners:
+        // https://bugs.webkit.org/show_bug.cgi?id=58711
+        // Also, to get the best appearance we should stroke a path between the two borders.
+        graphicsContext->strokePath(borderPath);
+        return;
     }
+    case DOUBLE: {
+        // Get the inner border rects for both the outer border line and the inner border line
+        int outerBorderTopWidth;
+        int innerBorderTopWidth;
+        edges[BSTop].getDoubleBorderStripeWidths(outerBorderTopWidth, innerBorderTopWidth);
+
+        int outerBorderRightWidth;
+        int innerBorderRightWidth;
+        edges[BSRight].getDoubleBorderStripeWidths(outerBorderRightWidth, innerBorderRightWidth);
+
+        int outerBorderBottomWidth;
+        int innerBorderBottomWidth;
+        edges[BSBottom].getDoubleBorderStripeWidths(outerBorderBottomWidth, innerBorderBottomWidth);
+
+        int outerBorderLeftWidth;
+        int innerBorderLeftWidth;
+        edges[BSLeft].getDoubleBorderStripeWidths(outerBorderLeftWidth, innerBorderLeftWidth);
+
+        // Draw inner border line
+        graphicsContext->save();
+        
+        RoundedIntRect innerClip = style->getRoundedInnerBorderFor(borderRect,
+            innerBorderTopWidth, innerBorderBottomWidth, innerBorderLeftWidth, innerBorderRightWidth,
+            includeLogicalLeftEdge, includeLogicalRightEdge);
+        
+        graphicsContext->addRoundedRectClip(innerClip);
+        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, edges, thickness, drawThickness, side, style, color, SOLID, includeLogicalLeftEdge, includeLogicalRightEdge);
+        graphicsContext->restore();
 
-    if (renderRadii)
+        // Draw outer border line
+        graphicsContext->save();
+        
+        RoundedIntRect outerClip = style->getRoundedInnerBorderFor(borderRect,
+            outerBorderTopWidth, outerBorderBottomWidth, outerBorderLeftWidth, outerBorderRightWidth,
+            includeLogicalLeftEdge, includeLogicalRightEdge);
+        
+        graphicsContext->clipOutRoundedRect(outerClip);
+        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, edges, thickness, drawThickness, side, style, color, SOLID, includeLogicalLeftEdge, includeLogicalRightEdge);
+        graphicsContext->restore();
+        return;
+    }
+    case RIDGE:
+    case GROOVE:
+    {
+        EBorderStyle s1;
+        EBorderStyle s2;
+        if (borderStyle == GROOVE) {
+            s1 = INSET;
+            s2 = OUTSET;
+        } else {
+            s1 = OUTSET;
+            s2 = INSET;
+        }
+        
+        // Paint full border
+        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, edges, thickness, drawThickness, side, style, color, s1, includeLogicalLeftEdge, includeLogicalRightEdge);
+
+        // Paint inner only
+        graphicsContext->save();
+
+        int topWidth = edges[BSTop].usedWidth() / 2;
+        int bottomWidth = edges[BSBottom].usedWidth() / 2;
+        int leftWidth = edges[BSLeft].usedWidth() / 2;
+        int rightWidth = edges[BSRight].usedWidth() / 2;
+
+        RoundedIntRect clipRect = style->getRoundedInnerBorderFor(borderRect,
+            topWidth, bottomWidth, leftWidth, rightWidth,
+            includeLogicalLeftEdge, includeLogicalRightEdge);
+
+        graphicsContext->addRoundedRectClip(clipRect);
+        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, edges, thickness, drawThickness, side, style, color, s2, includeLogicalLeftEdge, includeLogicalRightEdge);
         graphicsContext->restore();
+        return;
+    }
+    case INSET:
+        if (side == BSTop || side == BSLeft)
+            color = color.dark();
+        break;
+    case OUTSET:
+        if (side == BSBottom || side == BSRight)
+            color = color.dark();
+        break;
+    default:
+        break;
+    }
+
+    graphicsContext->setStrokeStyle(NoStroke);
+    graphicsContext->setFillColor(color, style->colorSpace());
+    graphicsContext->drawRect(borderRect);
 }
 #else
 void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
@@ -1507,50 +1931,92 @@ void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx,
 }
 #endif
 
-void RenderBoxModelObject::clipBorderSidePolygon(GraphicsContext* graphicsContext, const RoundedIntRect& border,
-                                                 const BoxSide side, bool firstEdgeMatches, bool secondEdgeMatches, const RenderStyle* style,
-                                                 bool includeLogicalLeftEdge, bool includeLogicalRightEdge)
+static void findInnerVertex(const FloatPoint& outerCorner, const FloatPoint& innerCorner, const FloatPoint& centerPoint, FloatPoint& result)
 {
-    FloatPoint quad[4];
-    int tx = border.rect().x();
-    int ty = border.rect().y();
-    int w = border.rect().width();
-    int h = border.rect().height();
+    // If the line between outer and inner corner is towards the horizontal, intersect with a vertical line through the center,
+    // otherwise with a horizontal line through the center. The points that form this line are arbitrary (we use 0, 100).
+    // Note that if findIntersection fails, it will leave result untouched.
+    if (fabs(outerCorner.x() - innerCorner.x()) > fabs(outerCorner.y() - innerCorner.y()))
+        findIntersection(outerCorner, innerCorner, FloatPoint(centerPoint.x(), 0), FloatPoint(centerPoint.x(), 100), result);
+    else
+        findIntersection(outerCorner, innerCorner, FloatPoint(0, centerPoint.y()), FloatPoint(100, centerPoint.y()), result);
+}
 
-    bool horizontal = style->isHorizontalWritingMode();
-    int leftWidth = (!horizontal || includeLogicalLeftEdge) ? style->borderLeftWidth() : 0;
-    int rightWidth = (!horizontal || includeLogicalRightEdge) ? style->borderRightWidth() : 0;
-    int topWidth = (horizontal || includeLogicalLeftEdge) ? style->borderTopWidth() : 0;
-    int bottomWidth = (horizontal || includeLogicalRightEdge) ? style->borderBottomWidth() : 0;
+void RenderBoxModelObject::clipBorderSidePolygon(GraphicsContext* graphicsContext, const RoundedIntRect& outerBorder, const RoundedIntRect& innerBorder,
+                                                 BoxSide side, bool firstEdgeMatches, bool secondEdgeMatches)
+{
+    FloatPoint quad[4];
 
-    // For each side, create an array of FloatPoints where each point is based on whichever value in each corner
-    // is larger -- the radius width/height or the border width/height -- as appropriate.
+    const IntRect& outerRect = outerBorder.rect();
+    const IntRect& innerRect = innerBorder.rect();
+
+    FloatPoint centerPoint(innerRect.location().x() + static_cast<float>(innerRect.width()) / 2, innerRect.location().y() + static_cast<float>(innerRect.height()) / 2);
+
+    // For each side, create a quad that encompasses all parts of that side that may draw,
+    // including areas inside the innerBorder.
+    //
+    //         0----------------3
+    //       0  \              /  0
+    //       |\  1----------- 2  /|
+    //       | 1                1 |   
+    //       | |                | |
+    //       | |                | |  
+    //       | 2                2 |  
+    //       |/  1------------2  \| 
+    //       3  /              \  3   
+    //         0----------------3
+    //
     switch (side) {
     case BSTop:
-        quad[0] = FloatPoint(tx, ty);
-        quad[1] = FloatPoint(tx + max(border.radii().topLeft().width(), leftWidth), ty + max(border.radii().topLeft().height(), topWidth));
-        quad[2] = FloatPoint(tx + w - max(border.radii().topRight().width(), rightWidth), ty + max(border.radii().topRight().height(), topWidth));
-        quad[3] = FloatPoint(tx + w, ty);
+        quad[0] = outerRect.minXMinYCorner();
+        quad[1] = innerRect.minXMinYCorner();
+        quad[2] = innerRect.maxXMinYCorner();
+        quad[3] = outerRect.maxXMinYCorner();
+
+        if (!innerBorder.radii().topLeft().isZero())
+            findInnerVertex(outerRect.minXMinYCorner(), innerRect.minXMinYCorner(), centerPoint, quad[1]);
+
+        if (!innerBorder.radii().topRight().isZero())
+            findInnerVertex(outerRect.maxXMinYCorner(), innerRect.maxXMinYCorner(), centerPoint, quad[2]);
         break;
+
     case BSLeft:
-        quad[0] = FloatPoint(tx, ty);
-        quad[1] = FloatPoint(tx + max(border.radii().topLeft().width(), leftWidth), ty + max(border.radii().topLeft().height(), topWidth));
-        quad[2] = FloatPoint(tx + max(border.radii().bottomLeft().width(), leftWidth), ty + h - max(border.radii().bottomLeft().height(), bottomWidth));
-        quad[3] = FloatPoint(tx, ty + h);
+        quad[0] = outerRect.minXMinYCorner();
+        quad[1] = innerRect.minXMinYCorner();
+        quad[2] = innerRect.minXMaxYCorner();
+        quad[3] = outerRect.minXMaxYCorner();
+
+        if (!innerBorder.radii().topLeft().isZero())
+            findInnerVertex(outerRect.minXMinYCorner(), innerRect.minXMinYCorner(), centerPoint, quad[1]);
+
+        if (!innerBorder.radii().bottomLeft().isZero())
+            findInnerVertex(outerRect.minXMaxYCorner(), innerRect.minXMaxYCorner(), centerPoint, quad[2]);
         break;
+
     case BSBottom:
-        quad[0] = FloatPoint(tx, ty + h);
-        quad[1] = FloatPoint(tx + max(border.radii().bottomLeft().width(), leftWidth), ty + h - max(border.radii().bottomLeft().height(), bottomWidth));
-        quad[2] = FloatPoint(tx + w - max(border.radii().bottomRight().width(), rightWidth), ty + h - max(border.radii().bottomRight().height(), bottomWidth));
-        quad[3] = FloatPoint(tx + w, ty + h);
+        quad[0] = outerRect.minXMaxYCorner();
+        quad[1] = innerRect.minXMaxYCorner();
+        quad[2] = innerRect.maxXMaxYCorner();
+        quad[3] = outerRect.maxXMaxYCorner();
+
+        if (!innerBorder.radii().bottomLeft().isZero())
+            findInnerVertex(outerRect.minXMaxYCorner(), innerRect.minXMaxYCorner(), centerPoint, quad[1]);
+
+        if (!innerBorder.radii().bottomRight().isZero())
+            findInnerVertex(outerRect.maxXMaxYCorner(), innerRect.maxXMaxYCorner(), centerPoint, quad[2]);
         break;
+
     case BSRight:
-        quad[0] = FloatPoint(tx + w, ty);
-        quad[1] = FloatPoint(tx + w - max(border.radii().topRight().width(), rightWidth), ty + max(border.radii().topRight().height(), topWidth));
-        quad[2] = FloatPoint(tx + w - max(border.radii().bottomRight().width(), rightWidth), ty + h - max(border.radii().bottomRight().height(), bottomWidth));
-        quad[3] = FloatPoint(tx + w, ty + h);
-        break;
-    default:
+        quad[0] = outerRect.maxXMinYCorner();
+        quad[1] = innerRect.maxXMinYCorner();
+        quad[2] = innerRect.maxXMaxYCorner();
+        quad[3] = outerRect.maxXMaxYCorner();
+
+        if (!innerBorder.radii().topRight().isZero())
+            findInnerVertex(outerRect.maxXMinYCorner(), innerRect.maxXMinYCorner(), centerPoint, quad[1]);
+
+        if (!innerBorder.radii().bottomRight().isZero())
+            findInnerVertex(outerRect.maxXMaxYCorner(), innerRect.maxXMaxYCorner(), centerPoint, quad[2]);
         break;
     }
 
@@ -1561,6 +2027,7 @@ void RenderBoxModelObject::clipBorderSidePolygon(GraphicsContext* graphicsContex
         return;
     }
 
+    // Square off the end which shouldn't be affected by antialiasing, and clip.
     FloatPoint firstQuad[4];
     firstQuad[0] = quad[0];
     firstQuad[1] = quad[1];
@@ -1575,6 +2042,7 @@ void RenderBoxModelObject::clipBorderSidePolygon(GraphicsContext* graphicsContex
         : FloatPoint(quad[1].x(), quad[0].y());
     secondQuad[2] = quad[2];
     secondQuad[3] = quad[3];
+    // Antialiasing affects the second side.
     graphicsContext->clipConvexPolygon(4, secondQuad, !secondEdgeMatches);
 }
 
@@ -1599,21 +2067,13 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
     if (context->paintingDisabled() || !s->boxShadow())
         return;
 
-    RoundedIntRect border(tx, ty, w, h);
+    IntRect borderRect(tx, ty, w, h);
+    RoundedIntRect border = (shadowStyle == Inset) ? s->getRoundedInnerBorderFor(borderRect, includeLogicalLeftEdge, includeLogicalRightEdge)
+                                                   : s->getRoundedBorderFor(borderRect, includeLogicalLeftEdge, includeLogicalRightEdge);
+
     bool hasBorderRadius = s->hasBorderRadius();
     bool isHorizontal = s->isHorizontalWritingMode();
-
-    if (shadowStyle == Inset)
-        border.setRect(IntRect(border.rect().x() + (includeLogicalLeftEdge || !isHorizontal ? borderLeft() : 0),
-                               border.rect().y() + (includeLogicalLeftEdge || isHorizontal ? borderTop() : 0),
-                               border.rect().width() - ((includeLogicalLeftEdge || !isHorizontal) ? borderLeft() : 0) - ((includeLogicalRightEdge || !isHorizontal) ? borderRight() : 0),
-                               border.rect().height() - ((includeLogicalLeftEdge || isHorizontal) ? borderTop() : 0) - ((includeLogicalRightEdge || isHorizontal) ? borderBottom() : 0)));
-
-    if (hasBorderRadius && (includeLogicalLeftEdge || includeLogicalRightEdge)) {
-        RoundedIntRect::Radii radii = ((shadowStyle == Inset) ? s->getRoundedInnerBorderWithBorderWidths(border.rect(), borderTop(), borderBottom(), borderLeft(), borderRight()) : s->getRoundedBorderFor(border.rect())).radii();
-        border.includeLogicalEdges(radii, isHorizontal, includeLogicalLeftEdge, includeLogicalRightEdge);
-    }
-
+    
     bool hasOpaqueBackground = s->visitedDependentColor(CSSPropertyBackgroundColor).isValid() && s->visitedDependentColor(CSSPropertyBackgroundColor).alpha() == 255;
     for (const ShadowData* shadow = s->boxShadow(); shadow; shadow = shadow->next()) {
         if (shadow->style() != shadowStyle)
@@ -1661,9 +2121,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
                 if (!rectToClipOut.isEmpty())
                     context->clipOutRoundedRect(rectToClipOut);
 
-                if (shadowSpread < 0)
-                    fillRect.expandRadii(shadowSpread);
-
+                fillRect.expandRadii(shadowSpread);
                 context->fillRoundedRect(fillRect, Color::black, s->colorSpace());
             } else {
                 IntRect rectToClipOut = border.rect();
@@ -1717,13 +2175,15 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
             Color fillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), 255);
 
             IntRect outerRect = areaCastingShadowInHole(border.rect(), shadowBlur, shadowSpread, shadowOffset);
+            RoundedIntRect roundedHole(holeRect, border.radii());
+
             context->save();
 
-            Path path;
             if (hasBorderRadius) {
                 Path path;
-                path.addRoundedRect(border.rect(), border.radii().topLeft(), border.radii().topRight(), border.radii().bottomLeft(), border.radii().bottomRight());
+                path.addRoundedRect(border);
                 context->clip(path);
+                roundedHole.shrinkRadii(shadowSpread);
             } else
                 context->clip(border.rect());
 
@@ -1731,15 +2191,11 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
             context->translate(extraOffset.width(), extraOffset.height());
             shadowOffset -= extraOffset;
 
-            if (hasBorderRadius && shadowSpread > 0)
-                border.shrinkRadii(shadowSpread);
-            
             if (shadow->isWebkitBoxShadow())
                 context->setLegacyShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
             else
                 context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
 
-            RoundedIntRect roundedHole(holeRect, border.radii());
             context->fillRectWithRoundedHole(outerRect, roundedHole, fillColor, s->colorSpace());
 
             context->restore();
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.h b/Source/WebCore/rendering/RenderBoxModelObject.h
index 2e0bdda..d2f5972 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.h
+++ b/Source/WebCore/rendering/RenderBoxModelObject.h
@@ -32,6 +32,7 @@ namespace WebCore {
 // Modes for some of the line-related functions.
 enum LinePositionMode { PositionOnContainingLine, PositionOfInteriorLineBoxes };
 enum LineDirectionMode { HorizontalLine, VerticalLine };
+typedef unsigned BorderEdgeFlags;
 
 // This class is the base for all objects that adhere to the CSS box model as described
 // at http://www.w3.org/TR/CSS21/box.html
@@ -114,7 +115,7 @@ public:
     void paintBorder(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool includeLogicalLeftEdge = true, bool includeLogicalRightEdge = true);
     bool paintNinePieceImage(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, const NinePieceImage&, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, ShadowStyle, bool includeLogicalLeftEdge = true, bool includeLogicalRightEdge = true);
-    void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver, RenderObject* backgroundObject = 0);
+    void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, InlineFlowBox* = 0, int inlineBoxWidth = 0, int inlineBoxHeight = 0, CompositeOperator = CompositeSourceOver, RenderObject* backgroundObject = 0);
     
     // Overridden by subclasses to determine line height and baseline position.
     virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const = 0;
@@ -133,15 +134,27 @@ protected:
 
     RenderBoxModelObject* continuation() const;
     void setContinuation(RenderBoxModelObject*);
-
+    
 private:
     virtual bool isBoxModelObject() const { return true; }
 
     IntSize calculateFillTileSize(const FillLayer*, IntSize scaledSize) const;
 
-    void clipBorderSidePolygon(GraphicsContext*, const RoundedIntRect& border,
-                               const BoxSide, bool firstEdgeMatches, bool secondEdgeMatches, const RenderStyle*,
-                               bool includeLogicalLeftEdge, bool includeLogicalRightEdge);
+    RoundedIntRect getBackgroundRoundedRect(const IntRect&, InlineFlowBox*, int inlineBoxWidth, int inlineBoxHeight,
+        bool includeLogicalLeftEdge, bool includeLogicalRightEdge);
+
+    void clipBorderSidePolygon(GraphicsContext*, const RoundedIntRect& outerBorder, const RoundedIntRect& innerBorder,
+                               BoxSide, bool firstEdgeMatches, bool secondEdgeMatches);
+    void paintOneBorderSide(GraphicsContext*, const RenderStyle*, const RoundedIntRect& outerBorder, const RoundedIntRect& innerBorder,
+                                const IntRect& sideRect, BoxSide, BoxSide adjacentSide1, BoxSide adjacentSide2, const class BorderEdge[],
+                                const Path*, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias, const Color* overrideColor = 0);
+    void paintTranslucentBorderSides(GraphicsContext*, const RenderStyle*, const RoundedIntRect& outerBorder, const RoundedIntRect& innerBorder,
+                          const class BorderEdge[], bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias = false);
+    void paintBorderSides(GraphicsContext*, const RenderStyle*, const RoundedIntRect& outerBorder, const RoundedIntRect& innerBorder,
+                          const class BorderEdge[], BorderEdgeFlags, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias = false, const Color* overrideColor = 0);
+    void drawBoxSideFromPath(GraphicsContext*, const IntRect&, const Path&, const class BorderEdge[],
+                            float thickness, float drawThickness, BoxSide, const RenderStyle*, 
+                            Color, EBorderStyle, bool includeLogicalLeftEdge, bool includeLogicalRightEdge);
 
     friend class RenderView;
 
diff --git a/Source/WebCore/rendering/RenderDetails.cpp b/Source/WebCore/rendering/RenderDetails.cpp
index be2b435..6b5a1b2 100644
--- a/Source/WebCore/rendering/RenderDetails.cpp
+++ b/Source/WebCore/rendering/RenderDetails.cpp
@@ -24,10 +24,6 @@
 #include "CSSStyleSelector.h"
 #include "HTMLDetailsElement.h"
 #include "HTMLNames.h"
-#include "LocalizedStrings.h"
-#include "RenderDetailsMarker.h"
-#include "RenderTextFragment.h"
-#include "RenderView.h"
 
 namespace WebCore {
 
@@ -37,23 +33,10 @@ RenderDetails::RenderDetails(Node* node)
     : RenderBlock(node)
     , m_summaryBlock(0)
     , m_contentBlock(0)
-    , m_defaultSummaryBlock(0)
-    , m_defaultSummaryText(0)
-    , m_marker(0)
     , m_mainSummary(0)
 {
 }
 
-void RenderDetails::destroy()
-{
-    if (m_marker) {
-        m_marker->destroy();
-        m_marker = 0;
-    }
-
-    RenderBlock::destroy();
-}
-
 RenderBlock* RenderDetails::summaryBlock()
 {
     if (!m_summaryBlock) {
@@ -106,26 +89,9 @@ void RenderDetails::removeChild(RenderObject* oldChild)
     ASSERT_NOT_REACHED();
 }
 
-void RenderDetails::setMarkerStyle()
-{
-    if (m_marker) {
-        RefPtr<RenderStyle> markerStyle = RenderStyle::create();
-        markerStyle->inheritFrom(style());
-        m_marker->setStyle(markerStyle.release());
-    }
-}
-
 void RenderDetails::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
-
-    if (m_defaultSummaryBlock) {
-        m_defaultSummaryBlock->setStyle(createSummaryStyle());
-        m_defaultSummaryText->setStyle(m_defaultSummaryBlock->style());
-    }
-
-    setMarkerStyle();
-
     // Ensure that if we ended up being inline that we set our replaced flag
     // so that we're treated like an inline-block.
     setReplaced(isInline());
@@ -144,11 +110,6 @@ RenderObject* RenderDetails::getRenderPosition(RenderObject* object)
     return element ? element->renderer() : 0;
 }
 
-void RenderDetails::markerDestroyed()
-{
-    m_marker = 0;
-}
-
 void RenderDetails::summaryDestroyed(RenderObject* summary)
 {
     if (summary == m_mainSummary)
@@ -157,14 +118,6 @@ void RenderDetails::summaryDestroyed(RenderObject* summary)
 
 void RenderDetails::moveSummaryToContents()
 {
-    if (m_defaultSummaryBlock) {
-        ASSERT(!m_mainSummary);
-        m_defaultSummaryBlock->destroy();
-        m_defaultSummaryBlock = 0;
-        m_defaultSummaryText = 0;
-        return;
-    }
-
     if (!m_mainSummary)
         return;
 
@@ -173,12 +126,6 @@ void RenderDetails::moveSummaryToContents()
     m_mainSummary = 0;
 }
 
-PassRefPtr<RenderStyle> RenderDetails::createSummaryStyle()
-{
-    RefPtr<HTMLElement> summary(HTMLElement::create(summaryTag, document()));
-    return document()->styleSelector()->styleForElement(summary.get(), style(), true);
-}
-
 void RenderDetails::replaceMainSummary(RenderObject* newSummary)
 {
     ASSERT(newSummary);
@@ -191,68 +138,20 @@ void RenderDetails::replaceMainSummary(RenderObject* newSummary)
     m_mainSummary = newSummary;
 }
 
-void RenderDetails::createDefaultSummary()
-{
-    if (m_defaultSummaryBlock)
-        return;
-
-    moveSummaryToContents();
-
-    m_defaultSummaryBlock = summaryBlock()->createAnonymousBlock();
-    m_defaultSummaryBlock->setStyle(createSummaryStyle());
-
-    m_defaultSummaryText = new (renderArena()) RenderTextFragment(document(), defaultDetailsSummaryText().impl());
-    m_defaultSummaryText->setStyle(m_defaultSummaryBlock->style());
-    m_defaultSummaryBlock->addChild(m_defaultSummaryText);
-
-    summaryBlock()->addChild(m_defaultSummaryBlock);
-}
-
 void RenderDetails::checkMainSummary()
 {
     if (!node() || !node()->hasTagName(detailsTag))
         return;
 
     Node* mainSummaryNode = static_cast<HTMLDetailsElement*>(node())->mainSummary();
-
-    if (!mainSummaryNode || !mainSummaryNode->renderer() || mainSummaryNode->renderer()->isFloatingOrPositioned())
-        createDefaultSummary();
-    else
+    if (mainSummaryNode && mainSummaryNode->renderer())
         replaceMainSummary(mainSummaryNode->renderer());
-
 }
 
 void RenderDetails::layout()
 {
-    ASSERT(needsLayout());
-
     checkMainSummary();
-    ASSERT(m_summaryBlock);
-
-    if (!m_marker) {
-        m_marker = new (renderArena()) RenderDetailsMarker(this);
-        setMarkerStyle();
-    }
-    updateMarkerLocation();
-
     RenderBlock::layout();
-
-    m_interactiveArea = m_summaryBlock->frameRect();
-
-    // FIXME: the following code will not be needed once absoluteToLocal get patched to handle flipped blocks writing modes.
-    switch (style()->writingMode()) {
-    case TopToBottomWritingMode:
-    case LeftToRightWritingMode:
-        break;
-    case RightToLeftWritingMode: {
-        m_interactiveArea.setX(width() - m_interactiveArea.x() - m_interactiveArea.width());
-        break;
-    }
-    case BottomToTopWritingMode: {
-        m_interactiveArea.setY(height() - m_interactiveArea.y() - m_interactiveArea.height());
-        break;
-    }
-    }
 }
 
 bool RenderDetails::isOpen() const
@@ -260,77 +159,4 @@ bool RenderDetails::isOpen() const
     return node() && node()->isElementNode() ? !static_cast<Element*>(node())->getAttribute(openAttr).isNull() : false;
 }
 
-RenderObject* RenderDetails::getParentOfFirstLineBox(RenderBlock* curr)
-{
-    RenderObject* firstChild = curr->firstChild();
-    if (!firstChild)
-        return 0;
-
-    for (RenderObject* currChild = firstChild; currChild; currChild = currChild->nextSibling()) {
-        if (currChild == m_marker)
-            continue;
-
-        if (currChild->isInline() && (!currChild->isRenderInline() || curr->generatesLineBoxesForInlineChild(currChild)))
-            return curr;
-
-        if (currChild->isFloating() || currChild->isPositioned())
-            continue;
-
-        if (currChild->isTable() || !currChild->isRenderBlock() || (currChild->isBox() && toRenderBox(currChild)->isWritingModeRoot()))
-            break;
-
-        if (currChild->isDetails())
-            break;
-
-        RenderObject* lineBox = getParentOfFirstLineBox(toRenderBlock(currChild));
-        if (lineBox)
-            return lineBox;
-    }
-
-    return 0;
-}
-
-RenderObject* RenderDetails::firstNonMarkerChild(RenderObject* parent)
-{
-    RenderObject* result = parent->firstChild();
-    while (result && result->isDetailsMarker())
-        result = result->nextSibling();
-    return result;
-}
-
-void RenderDetails::updateMarkerLocation()
-{
-    // Sanity check the location of our marker.
-    if (m_marker) {
-        RenderObject* markerPar = m_marker->parent();
-        RenderObject* lineBoxParent = getParentOfFirstLineBox(m_summaryBlock);
-        if (!lineBoxParent) {
-            // If the marker is currently contained inside an anonymous box,
-            // then we are the only item in that anonymous box (since no line box
-            // parent was found). It's ok to just leave the marker where it is
-            // in this case.
-            if (markerPar && markerPar->isAnonymousBlock())
-                lineBoxParent = markerPar;
-            else
-                lineBoxParent = m_summaryBlock;
-        }
-
-        if (markerPar != lineBoxParent || m_marker->preferredLogicalWidthsDirty()) {
-            // Removing and adding the marker can trigger repainting in
-            // containers other than ourselves, so we need to disable LayoutState.
-            view()->disableLayoutState();
-            m_marker->remove();
-            if (!lineBoxParent)
-                lineBoxParent = m_summaryBlock;
-            lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
-
-            if (m_marker->preferredLogicalWidthsDirty())
-                m_marker->computePreferredLogicalWidths();
-
-            view()->enableLayoutState();
-        }
-    }
-}
-
 } // namespace WebCore
-
diff --git a/Source/WebCore/rendering/RenderDetails.h b/Source/WebCore/rendering/RenderDetails.h
index 0b56c13..974c174 100644
--- a/Source/WebCore/rendering/RenderDetails.h
+++ b/Source/WebCore/rendering/RenderDetails.h
@@ -27,21 +27,17 @@
 
 namespace WebCore {
 
-class RenderDetailsMarker;
-
 class RenderDetails : public RenderBlock {
 public:
     explicit RenderDetails(Node*);
 
-    virtual const char* renderName() const { return "RenderDetails"; }
-    virtual bool isDetails() const { return true; }
-
     bool isOpen() const;
-    IntRect interactiveArea() const { return m_interactiveArea; }
-    void markerDestroyed();
     void summaryDestroyed(RenderObject*);
 
 private:
+    virtual const char* renderName() const { return "RenderDetails"; }
+    virtual bool isDetails() const { return true; }
+
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     virtual void addChild(RenderObject* newChild, RenderObject *beforeChild = 0);
@@ -52,33 +48,18 @@ private:
     virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
 
     virtual void layout();
-    virtual void destroy();
 
-    void createDefaultSummary();
     void replaceMainSummary(RenderObject*);
     void moveSummaryToContents();
     void checkMainSummary();
     RenderObject* getRenderPosition(RenderObject*);
-    PassRefPtr<RenderStyle> createSummaryStyle();
-    void setMarkerStyle();
 
     RenderBlock* summaryBlock();
     RenderBlock* contentBlock();
 
-    RenderObject* getParentOfFirstLineBox(RenderBlock* curr);
-    RenderObject* firstNonMarkerChild(RenderObject* parent);
-    void updateMarkerLocation();
-
     RenderBlock* m_summaryBlock;
     RenderBlock* m_contentBlock;
 
-    RenderObject* m_defaultSummaryBlock;
-    RenderObject* m_defaultSummaryText;
-
-    IntRect m_interactiveArea;
-
-    RenderDetailsMarker* m_marker;
-
     RenderObject* m_mainSummary;
 };
 
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.cpp b/Source/WebCore/rendering/RenderDetailsMarker.cpp
index e040eb3..0347e7f 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.cpp
+++ b/Source/WebCore/rendering/RenderDetailsMarker.cpp
@@ -25,79 +25,21 @@
 #include "HTMLNames.h"
 #include "PaintInfo.h"
 #include "RenderDetails.h"
-#include "RenderSummary.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-RenderDetailsMarker::RenderDetailsMarker(RenderDetails* item)
-    : RenderBox(item->document())
-    , m_details(item)
+RenderDetailsMarker::RenderDetailsMarker(Node* node)
+    : RenderBlock(node)
 {
-    setInline(true);
-    setReplaced(true);
-}
-
-void RenderDetailsMarker::destroy()
-{
-    if (m_details)
-        m_details->markerDestroyed();
-
-    RenderBox::destroy();
-}
-
-int RenderDetailsMarker::lineHeight(bool firstLine, LineDirectionMode direction, LinePositionMode) const
-{
-    return m_details->lineHeight(firstLine, direction, PositionOfInteriorLineBoxes);
-}
-
-int RenderDetailsMarker::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode) const
-{
-    return m_details->baselinePosition(baselineType, firstLine, direction, PositionOfInteriorLineBoxes);
-}
-
-void RenderDetailsMarker::computePreferredLogicalWidths()
-{
-    ASSERT(preferredLogicalWidthsDirty());
-
-    m_minPreferredLogicalWidth = 2 * style()->fontMetrics().ascent() / 3;
-    m_maxPreferredLogicalWidth = m_minPreferredLogicalWidth;
-
-    setPreferredLogicalWidthsDirty(false);
-}
-
-void RenderDetailsMarker::layout()
-{
-    ASSERT(needsLayout());
-
-    setLogicalWidth(minPreferredLogicalWidth());
-    setLogicalHeight(style()->fontMetrics().height());
-
-    setMarginStart(0);
-    setMarginEnd(style()->fontMetrics().ascent() - minPreferredLogicalWidth() + 1);
-
-    setNeedsLayout(false);
-}
-
-IntRect RenderDetailsMarker::getRelativeMarkerRect() const
-{
-    IntRect relativeRect;
-
-    int bulletWidth = minPreferredLogicalWidth();
-    relativeRect = IntRect((logicalWidth() - bulletWidth) / 2, (logicalHeight() - bulletWidth) / 2, bulletWidth, bulletWidth);
-
-    if (!style()->isHorizontalWritingMode()) {
-        relativeRect = relativeRect.transposedRect();
-        relativeRect.setX(width() - relativeRect.x() - relativeRect.width());
-    }
-
-    return relativeRect;
 }
 
 bool RenderDetailsMarker::isOpen() const
 {
-    return m_details && m_details->isOpen();
+    if (RenderDetails* owner = details())
+        return owner->isOpen();
+    return false;
 }
 
 static Path createPath(const FloatPoint* path)
@@ -170,17 +112,18 @@ Path RenderDetailsMarker::getCanonicalPath() const
 
 Path RenderDetailsMarker::getPath(const IntPoint& origin) const
 {
-    IntRect rect = getRelativeMarkerRect();
     Path result = getCanonicalPath();
-    result.transform(AffineTransform().scale(rect.width()));
-    result.translate(FloatSize(origin.x() + rect.x(), origin.y() + rect.y()));
+    result.transform(AffineTransform().scale(logicalHeight()));
+    result.translate(FloatSize(origin.x(), origin.y()));
     return result;
 }
 
 void RenderDetailsMarker::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (paintInfo.phase != PaintPhaseForeground || style()->visibility() != VISIBLE)
+    if (paintInfo.phase != PaintPhaseForeground || style()->visibility() != VISIBLE) {
+        RenderBlock::paint(paintInfo, tx, ty);
         return;
+    }
 
     IntPoint boxOrigin(tx + x(), ty + y());
     IntRect overflowRect(visualOverflowRect());
@@ -199,4 +142,14 @@ void RenderDetailsMarker::paint(PaintInfo& paintInfo, int tx, int ty)
     paintInfo.context->fillPath(getPath(boxOrigin));
 }
 
+RenderDetails* RenderDetailsMarker::details() const
+{
+    for (RenderObject* renderer = parent(); renderer; renderer = renderer->parent()) {
+        if (renderer->isDetails())
+            return toRenderDetails(renderer);
+    }
+
+    return 0;
+}
+
 }
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.h b/Source/WebCore/rendering/RenderDetailsMarker.h
index de8f60b..f53a0c3 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.h
+++ b/Source/WebCore/rendering/RenderDetailsMarker.h
@@ -21,38 +21,29 @@
 #ifndef RenderDetailsMarker_h
 #define RenderDetailsMarker_h
 
-#include "RenderBox.h"
+#include "RenderBlock.h"
 
 namespace WebCore {
 
 class RenderDetails;
 
-class RenderDetailsMarker : public RenderBox {
+class RenderDetailsMarker : public RenderBlock {
 public:
-    RenderDetailsMarker(RenderDetails*);
+    RenderDetailsMarker(Node*);
 
     enum Orientation { Up, Down, Left, Right };
 
     Orientation orientation() const;
 
-    virtual void computePreferredLogicalWidths();
-    virtual void destroy();
-
 private:
     virtual const char* renderName() const { return "RenderDetailsMarker"; }
     virtual bool isDetailsMarker() const { return true; }
     virtual void paint(PaintInfo&, int tx, int ty);
-    virtual void layout();
-    virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
-    virtual int baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
-
-    IntRect getRelativeMarkerRect() const;
 
     bool isOpen() const;
     Path getCanonicalPath() const;
     Path getPath(const IntPoint& origin) const;
-
-    RenderDetails* m_details;
+    RenderDetails* details() const;
 };
 
 inline RenderDetailsMarker* toRenderDetailsMarker(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.cpp b/Source/WebCore/rendering/RenderFileUploadControl.cpp
index b50b2ad..8056662 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/Source/WebCore/rendering/RenderFileUploadControl.cpp
@@ -109,6 +109,12 @@ bool RenderFileUploadControl::allowsDirectoryUpload()
     HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
     return input->fastHasAttribute(webkitdirectoryAttr);
 }
+
+void RenderFileUploadControl::receiveDropForDirectoryUpload(const Vector<String>& paths)
+{
+    if (Chrome* chromePointer = chrome())
+        chromePointer->enumerateChosenDirectory(paths[0], m_fileChooser.get());
+}
 #endif
 
 String RenderFileUploadControl::acceptTypes()
@@ -304,6 +310,13 @@ VisiblePosition RenderFileUploadControl::positionForPoint(const IntPoint&)
 
 void RenderFileUploadControl::receiveDroppedFiles(const Vector<String>& paths)
 {
+#if ENABLE(DIRECTORY_UPLOAD)
+    if (allowsDirectoryUpload()) {
+        receiveDropForDirectoryUpload(paths);
+        return;
+    }
+#endif
+
     if (allowsMultipleFiles())
         m_fileChooser->chooseFiles(paths);
     else
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.h b/Source/WebCore/rendering/RenderFileUploadControl.h
index 22974fe..e9fb7f0 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.h
+++ b/Source/WebCore/rendering/RenderFileUploadControl.h
@@ -64,6 +64,7 @@ private:
     bool allowsMultipleFiles();
 #if ENABLE(DIRECTORY_UPLOAD)
     bool allowsDirectoryUpload();
+    void receiveDropForDirectoryUpload(const Vector<String>&);
 #endif
     String acceptTypes();
     void chooseIconForFiles(FileChooser*, const Vector<String>&);
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index 4d97da0..dc5c171 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -978,7 +978,7 @@ void RenderFlexibleBox::applyLineClamp(FlexBoxIterator& iterator, bool relayoutC
         // Get ellipsis width, and if the last child is an anchor, it will go after the ellipsis, so add in a space and the anchor width too 
         int totalWidth;
         InlineBox* anchorBox = lastLine->lastChild();
-        if (anchorBox && anchorBox->renderer()->node() && anchorBox->renderer()->node()->isLink())
+        if (anchorBox && anchorBox->renderer()->style()->isLink())
             totalWidth = anchorBox->logicalWidth() + font.width(TextRun(ellipsisAndSpace, 2));
         else {
             anchorBox = 0;
diff --git a/Source/WebCore/rendering/RenderFullScreen.cpp b/Source/WebCore/rendering/RenderFullScreen.cpp
index a685064..476727d 100644
--- a/Source/WebCore/rendering/RenderFullScreen.cpp
+++ b/Source/WebCore/rendering/RenderFullScreen.cpp
@@ -46,7 +46,7 @@ PassRefPtr<RenderStyle> RenderFullScreen::createFullScreenStyle()
     RefPtr<RenderStyle> fullscreenStyle = RenderStyle::createDefaultStyle();
 
     // Create a stacking context:
-    fullscreenStyle->setZIndex(0);
+    fullscreenStyle->setZIndex(INT_MAX);
 
     fullscreenStyle->setFontDescription(FontDescription());
     fullscreenStyle->font().update(0);
@@ -54,7 +54,7 @@ PassRefPtr<RenderStyle> RenderFullScreen::createFullScreenStyle()
     fullscreenStyle->setDisplay(BOX);
     fullscreenStyle->setBoxPack(BCENTER);
     fullscreenStyle->setBoxAlign(BCENTER);
-    fullscreenStyle->setBoxOrient(HORIZONTAL);
+    fullscreenStyle->setBoxOrient(VERTICAL);
     
     fullscreenStyle->setPosition(FixedPosition);
     fullscreenStyle->setWidth(Length(100.0, Percent));
diff --git a/Source/WebCore/rendering/RenderIFrame.cpp b/Source/WebCore/rendering/RenderIFrame.cpp
index 01b8a17..1468acd 100644
--- a/Source/WebCore/rendering/RenderIFrame.cpp
+++ b/Source/WebCore/rendering/RenderIFrame.cpp
@@ -124,6 +124,7 @@ void RenderIFrame::layout()
     setNeedsLayout(false);
 }
 
+<<<<<<< HEAD
 #if USE(ACCELERATED_COMPOSITING)
 bool RenderIFrame::requiresLayer() const
 {
@@ -156,4 +157,6 @@ bool RenderIFrame::requiresAcceleratedCompositing() const
 }
 #endif
 
+=======
+>>>>>>> WebKit.org at r84325
 }
diff --git a/Source/WebCore/rendering/RenderIFrame.h b/Source/WebCore/rendering/RenderIFrame.h
index 0bb3182..b6b30c9 100644
--- a/Source/WebCore/rendering/RenderIFrame.h
+++ b/Source/WebCore/rendering/RenderIFrame.h
@@ -34,19 +34,12 @@ class RenderIFrame : public RenderFrameBase {
 public:
     explicit RenderIFrame(Element*);
 
-#if USE(ACCELERATED_COMPOSITING)
-    bool requiresAcceleratedCompositing() const;
-#endif
-
 private:
     virtual void computeLogicalHeight();
     virtual void computeLogicalWidth();
 
     virtual void layout();
 
-#if USE(ACCELERATED_COMPOSITING)
-    virtual bool requiresLayer() const;
-#endif
     virtual bool isRenderIFrame() const { return true; }
 
     virtual const char* renderName() const { return "RenderPartObject"; } // Lying for now to avoid breaking tests
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 9500aeb..1ea4e09 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -362,7 +362,12 @@ void RenderImage::paintAreaElementFocusRing(PaintInfo& paintInfo)
     // FIXME: Do we need additional code to clip the path to the image's bounding box?
 
     RenderStyle* areaElementStyle = areaElement->computedStyle();
-    paintInfo.context->drawFocusRing(path, areaElementStyle->outlineWidth(), areaElementStyle->outlineOffset(),
+    unsigned short outlineWidth = areaElementStyle->outlineWidth();
+    if (!outlineWidth)
+        return;
+
+    paintInfo.context->drawFocusRing(path, outlineWidth,
+        areaElementStyle->outlineOffset(),
         areaElementStyle->visitedDependentColor(CSSPropertyOutlineColor));
 }
 
diff --git a/Source/WebCore/rendering/RenderIndicator.cpp b/Source/WebCore/rendering/RenderIndicator.cpp
deleted file mode 100644
index 8f34a40..0000000
--- a/Source/WebCore/rendering/RenderIndicator.cpp
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-
-#if ENABLE(PROGRESS_TAG) || ENABLE(METER_TAG)
-
-#include "RenderIndicator.h"
-
-#include "RenderTheme.h"
-#include "RenderView.h"
-
-using namespace std;
-
-namespace WebCore {
-
-RenderIndicatorPart::RenderIndicatorPart(Node* node)
-    : RenderBlock(node)
-    , m_originalVisibility(HIDDEN)
-{
-}
-
-RenderIndicatorPart::~RenderIndicatorPart()
-{
-}
-
-void RenderIndicatorPart::layout()
-{
-    RenderBox* parentRenderer = toRenderBox(parent());
-    IntRect oldRect = frameRect();
-    IntRect newRect = preferredFrameRect();
-
-    LayoutStateMaintainer statePusher(parentRenderer->view(), parentRenderer, parentRenderer->size(), parentRenderer->style()->isFlippedBlocksWritingMode());
-
-    if (oldRect.size() != newRect.size())
-        setChildNeedsLayout(true, false);
-    if (needsLayout())
-        RenderBlock::layout();
-    setFrameRect(newRect);
-
-    if (checkForRepaintDuringLayout())
-        repaintDuringLayoutIfMoved(oldRect);
-        
-    statePusher.pop();
-    parentRenderer->addOverflowFromChild(this);
-    style()->setVisibility(shouldBeHidden() ? HIDDEN : originalVisibility());
-}
-
-void RenderIndicatorPart::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
-{
-    m_originalVisibility = style()->visibility();
-    RenderBlock::styleDidChange(diff, oldStyle);
-}
-
-
-RenderIndicator::RenderIndicator(Node* node)
-    : RenderBlock(node)
-{
-}
-
-RenderIndicator::~RenderIndicator()
-{
-}
-
-void RenderIndicator::layout()
-{
-    ASSERT(needsLayout());
-
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
-    computeLogicalWidth();
-    computeLogicalHeight();
-    layoutParts();
-    repainter.repaintAfterLayout();
-    setNeedsLayout(false);
-}
-
-void RenderIndicator::updateFromElement()
-{
-    setNeedsLayout(true);
-    repaint();
-}
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/rendering/RenderIndicator.h b/Source/WebCore/rendering/RenderIndicator.h
deleted file mode 100644
index 7c2a346..0000000
--- a/Source/WebCore/rendering/RenderIndicator.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef RenderIndicator_h
-#define RenderIndicator_h
-
-#if ENABLE(PROGRESS_TAG) || ENABLE(METER_TAG)
-#include "RenderBlock.h"
-
-namespace WebCore {
-
-class RenderIndicatorPart : public RenderBlock {
-public:
-    RenderIndicatorPart(Node*);
-    virtual ~RenderIndicatorPart();
-
-protected:
-    EVisibility originalVisibility() const { return m_originalVisibility; }
-    virtual IntRect preferredFrameRect() = 0;
-    virtual bool shouldBeHidden() = 0;
-private:
-    virtual void layout();
-    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
-    virtual bool canHaveChildren() const { return false; }
-    virtual void styleDidChange(StyleDifference, const RenderStyle*);
-
-    EVisibility m_originalVisibility;
-};
-
-class RenderIndicator : public RenderBlock {
-public:
-    RenderIndicator(Node*);
-    virtual ~RenderIndicator();
-
-protected:
-    virtual void layout();
-    virtual void updateFromElement();
-    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
-    virtual bool canHaveChildren() const { return false; }
-
-    virtual void layoutParts() = 0;
-};
-
-} // namespace WebCore
-
-#endif
-
-#endif // RenderIndicator_h
-
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 3a27307..ae18514 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -27,6 +27,7 @@
 #include "FloatQuad.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
+#include "InlineTextBox.h"
 #include "Page.h"
 #include "RenderArena.h"
 #include "RenderBlock.h"
@@ -47,6 +48,7 @@ namespace WebCore {
 RenderInline::RenderInline(Node* node)
     : RenderBoxModelObject(node)
     , m_lineHeight(-1)
+    , m_alwaysCreateLineBoxes(false)
 {
     setChildrenInline(true);
 }
@@ -144,6 +146,15 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
 
     m_lineHeight = -1;
 
+    if (!m_alwaysCreateLineBoxes) {
+        bool alwaysCreateLineBoxes = hasSelfPaintingLayer() || hasBoxDecorations() || style()->hasPadding() || style()->hasMargin() || style()->hasOutline();
+        if (oldStyle && alwaysCreateLineBoxes) {
+            dirtyLineBoxes(false);
+            setNeedsLayout(true);
+        }
+        m_alwaysCreateLineBoxes = alwaysCreateLineBoxes;
+    }
+
     // Update pseudos for :before and :after now.
     if (!isAnonymous() && document()->usesBeforeAfterRules()) {
         children()->updateBeforeAfterContent(this, BEFORE);
@@ -151,6 +162,38 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
+void RenderInline::updateAlwaysCreateLineBoxes()
+{
+    // Once we have been tainted once, just assume it will happen again. This way effects like hover highlighting that change the
+    // background color will only cause a layout on the first rollover.
+    if (m_alwaysCreateLineBoxes)
+        return;
+
+    RenderStyle* parentStyle = parent()->style();
+    RenderInline* parentRenderInline = parent()->isRenderInline() ? toRenderInline(parent()) : 0;
+    bool checkFonts = document()->inNoQuirksMode();
+    bool alwaysCreateLineBoxes = (parentRenderInline && parentRenderInline->alwaysCreateLineBoxes())
+        || (parentRenderInline && parentStyle->verticalAlign() != BASELINE)
+        || style()->verticalAlign() != BASELINE
+        || style()->textEmphasisMark() != TextEmphasisMarkNone
+        || (checkFonts && (!parentStyle->font().fontMetrics().hasIdenticalAscentDescentAndLineGap(style()->font().fontMetrics())
+        || parentStyle->lineHeight() != style()->lineHeight()));
+
+    if (!alwaysCreateLineBoxes && checkFonts && document()->usesFirstLineRules()) {
+        // Have to check the first line style as well.
+        parentStyle = parent()->style(true);
+        RenderStyle* childStyle = style(true);
+        alwaysCreateLineBoxes = !parentStyle->font().fontMetrics().hasIdenticalAscentDescentAndLineGap(childStyle->font().fontMetrics())
+        || childStyle->verticalAlign() != BASELINE
+        || parentStyle->lineHeight() != childStyle->lineHeight();
+    }
+
+    if (alwaysCreateLineBoxes) {
+        dirtyLineBoxes(false);
+        m_alwaysCreateLineBoxes = true;
+    }
+}
+
 void RenderInline::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     if (continuation())
@@ -424,9 +467,11 @@ void RenderInline::paint(PaintInfo& paintInfo, int tx, int ty)
 
 void RenderInline::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
-    if (InlineFlowBox* curr = firstLineBox()) {
+    if (!alwaysCreateLineBoxes())
+        culledInlineAbsoluteRects(this, rects, IntSize(tx, ty));
+    else if (InlineFlowBox* curr = firstLineBox()) {
         for (; curr; curr = curr->nextLineBox())
-            rects.append(IntRect(tx + curr->x(), ty + curr->y(), curr->logicalWidth(), curr->logicalHeight()));
+            rects.append(enclosingIntRect(FloatRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height())));
     } else
         rects.append(IntRect(tx, ty, 0, 0));
 
@@ -441,11 +486,76 @@ void RenderInline::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
     }
 }
 
+void RenderInline::culledInlineAbsoluteRects(const RenderInline* container, Vector<IntRect>& rects, const IntSize& offset)
+{
+    bool isHorizontal = style()->isHorizontalWritingMode();
+    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (curr->isFloatingOrPositioned())
+            continue;
+            
+        // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
+        // direction (aligned to the root box's baseline).
+        if (curr->isBox()) {
+            RenderBox* currBox = toRenderBox(curr);
+            if (currBox->inlineBoxWrapper()) {
+                RootInlineBox* rootBox = currBox->inlineBoxWrapper()->root();
+                int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                FloatRect result;
+                if (isHorizontal)
+                    result = FloatRect(offset.width() + currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), offset.height() + logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight);
+                else
+                    result = FloatRect(offset.width() + logicalTop, offset.height() + currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom());
+                rects.append(enclosingIntRect(result));
+            }
+        } else if (curr->isRenderInline()) {
+            // If the child doesn't need line boxes either, then we can recur.
+            RenderInline* currInline = toRenderInline(curr);
+            if (!currInline->alwaysCreateLineBoxes())
+                currInline->culledInlineAbsoluteRects(container, rects, offset);
+            else {
+                for (InlineFlowBox* childLine = currInline->firstLineBox(); childLine; childLine = childLine->nextLineBox()) {
+                    RootInlineBox* rootBox = childLine->root();
+                    int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                    int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                    FloatRect result;
+                    if (isHorizontal)
+                        result = FloatRect(offset.width() + childLine->x() - childLine->marginLogicalLeft(),
+                            offset.height() + logicalTop,
+                            childLine->logicalWidth() + childLine->marginLogicalLeft() + childLine->marginLogicalRight(),
+                            logicalHeight);
+                    else
+                        result = FloatRect(offset.width() + logicalTop,
+                            offset.height() + childLine->y() - childLine->marginLogicalLeft(),
+                            logicalHeight,
+                            childLine->logicalWidth() + childLine->marginLogicalLeft() + childLine->marginLogicalRight());
+                    rects.append(enclosingIntRect(result));
+                }
+            }
+        } else if (curr->isText()) {
+            RenderText* currText = toRenderText(curr);
+            for (InlineTextBox* childText = currText->firstTextBox(); childText; childText = childText->nextTextBox()) {
+                RootInlineBox* rootBox = childText->root();
+                int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                FloatRect result;
+                if (isHorizontal)
+                    result = FloatRect(offset.width() + childText->x(), offset.height() + logicalTop, childText->logicalWidth(), logicalHeight);
+                else
+                    result = FloatRect(offset.width() + logicalTop, offset.height() + childText->y(), logicalHeight, childText->logicalWidth());
+                rects.append(enclosingIntRect(result));
+            }
+        }
+    }
+}
+
 void RenderInline::absoluteQuads(Vector<FloatQuad>& quads)
 {
-    if (InlineFlowBox* curr = firstLineBox()) {
+    if (!alwaysCreateLineBoxes())
+        culledInlineAbsoluteQuads(this, quads);
+    else if (InlineFlowBox* curr = firstLineBox()) {
         for (; curr; curr = curr->nextLineBox()) {
-            FloatRect localRect(curr->x(), curr->y(), curr->logicalWidth(), curr->logicalHeight());
+            FloatRect localRect(curr->x(), curr->y(), curr->width(), curr->height());
             quads.append(localToAbsoluteQuad(localRect));
         }
     } else
@@ -455,19 +565,82 @@ void RenderInline::absoluteQuads(Vector<FloatQuad>& quads)
         continuation()->absoluteQuads(quads);
 }
 
+void RenderInline::culledInlineAbsoluteQuads(const RenderInline* container, Vector<FloatQuad>& quads)
+{
+    bool isHorizontal = style()->isHorizontalWritingMode();
+    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (curr->isFloatingOrPositioned())
+            continue;
+            
+        // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
+        // direction (aligned to the root box's baseline).
+        if (curr->isBox()) {
+            RenderBox* currBox = toRenderBox(curr);
+            if (currBox->inlineBoxWrapper()) {
+                RootInlineBox* rootBox = currBox->inlineBoxWrapper()->root();
+                int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                FloatRect result;
+                if (isHorizontal)
+                    result = FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight);
+                else
+                    result = FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom());
+                quads.append(localToAbsoluteQuad(result));
+            }
+        } else if (curr->isRenderInline()) {
+            // If the child doesn't need line boxes either, then we can recur.
+            RenderInline* currInline = toRenderInline(curr);
+            if (!currInline->alwaysCreateLineBoxes())
+                currInline->culledInlineAbsoluteQuads(container, quads);
+            else {
+                for (InlineFlowBox* childLine = currInline->firstLineBox(); childLine; childLine = childLine->nextLineBox()) {
+                    RootInlineBox* rootBox = childLine->root();
+                    int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                    int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                    FloatRect result;
+                    if (isHorizontal)
+                        result = FloatRect(childLine->x() - childLine->marginLogicalLeft(),
+                            logicalTop,
+                            childLine->logicalWidth() + childLine->marginLogicalLeft() + childLine->marginLogicalRight(),
+                            logicalHeight);
+                    else
+                        result = FloatRect(logicalTop,
+                            childLine->y() - childLine->marginLogicalLeft(),
+                            logicalHeight,
+                            childLine->logicalWidth() + childLine->marginLogicalLeft() + childLine->marginLogicalRight());
+                    quads.append(localToAbsoluteQuad(result));
+                }
+            }
+        } else if (curr->isText()) {
+            RenderText* currText = toRenderText(curr);
+            for (InlineTextBox* childText = currText->firstTextBox(); childText; childText = childText->nextTextBox()) {
+                RootInlineBox* rootBox = childText->root();
+                int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                FloatRect result;
+                if (isHorizontal)
+                    result = FloatRect(childText->x(), logicalTop, childText->logicalWidth(), logicalHeight);
+                else
+                    result = FloatRect(logicalTop, childText->y(), logicalHeight, childText->logicalWidth());
+                quads.append(localToAbsoluteQuad(result));
+            }
+        }
+    }
+}
+
 int RenderInline::offsetLeft() const
 {
     int x = RenderBoxModelObject::offsetLeft();
-    if (firstLineBox())
-        x += firstLineBox()->x();
+    if (InlineBox* firstBox = firstLineBoxIncludingCulling())
+        x += firstBox->x();
     return x;
 }
 
 int RenderInline::offsetTop() const
 {
     int y = RenderBoxModelObject::offsetTop();
-    if (firstLineBox())
-        y += firstLineBox()->y();
+    if (InlineBox* firstBox = firstLineBoxIncludingCulling())
+        y += firstBox->y();
     return y;
 }
 
@@ -565,6 +738,11 @@ VisiblePosition RenderInline::positionForPoint(const IntPoint& point)
 
 IntRect RenderInline::linesBoundingBox() const
 {
+    if (!alwaysCreateLineBoxes()) {
+        ASSERT(!firstLineBox());
+        return enclosingIntRect(culledInlineBoundingBox(this));
+    }
+
     IntRect result;
     
     // See <rdar://problem/5289721>, for an unknown reason the linked list here is sometimes inconsistent, first is non-zero and last is zero.  We have been
@@ -594,26 +772,183 @@ IntRect RenderInline::linesBoundingBox() const
     return result;
 }
 
+FloatRect RenderInline::culledInlineBoundingBox(const RenderInline* container) const
+{
+    FloatRect result;
+    bool isHorizontal = style()->isHorizontalWritingMode();
+    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (curr->isFloatingOrPositioned())
+            continue;
+            
+        // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
+        // direction (aligned to the root box's baseline).
+        if (curr->isBox()) {
+            RenderBox* currBox = toRenderBox(curr);
+            if (currBox->inlineBoxWrapper()) {
+                RootInlineBox* rootBox = currBox->inlineBoxWrapper()->root();
+                int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                if (isHorizontal)
+                    result.uniteIfNonZero(FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight));
+                else
+                    result.uniteIfNonZero(FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom()));
+            }
+        } else if (curr->isRenderInline()) {
+            // If the child doesn't need line boxes either, then we can recur.
+            RenderInline* currInline = toRenderInline(curr);
+            if (!currInline->alwaysCreateLineBoxes())
+                result.uniteIfNonZero(currInline->culledInlineBoundingBox(container));
+            else {
+                for (InlineFlowBox* childLine = currInline->firstLineBox(); childLine; childLine = childLine->nextLineBox()) {
+                    RootInlineBox* rootBox = childLine->root();
+                    int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                    int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                    if (isHorizontal)
+                        result.uniteIfNonZero(FloatRect(childLine->x() - childLine->marginLogicalLeft(),
+                            logicalTop,
+                            childLine->logicalWidth() + childLine->marginLogicalLeft() + childLine->marginLogicalRight(),
+                            logicalHeight));
+                    else
+                        result.uniteIfNonZero(FloatRect(logicalTop,
+                            childLine->y() - childLine->marginLogicalLeft(),
+                            logicalHeight,
+                            childLine->logicalWidth() + childLine->marginLogicalLeft() + childLine->marginLogicalRight()));
+                                     
+                }
+            }
+        } else if (curr->isText()) {
+            RenderText* currText = toRenderText(curr);
+            for (InlineTextBox* childText = currText->firstTextBox(); childText; childText = childText->nextTextBox()) {
+                RootInlineBox* rootBox = childText->root();
+                int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
+                int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
+                if (isHorizontal)
+                    result.uniteIfNonZero(FloatRect(childText->x(), logicalTop, childText->logicalWidth(), logicalHeight));
+                else
+                    result.uniteIfNonZero(FloatRect(logicalTop, childText->y(), logicalHeight, childText->logicalWidth()));
+            }
+        }
+    }
+    return enclosingIntRect(result);
+}
+
+InlineBox* RenderInline::culledInlineFirstLineBox() const
+{
+    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (curr->isFloatingOrPositioned())
+            continue;
+            
+        // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
+        // direction (aligned to the root box's baseline).
+        if (curr->isBox()) {
+            RenderBox* currBox = toRenderBox(curr);
+            if (currBox->inlineBoxWrapper())
+                return currBox->inlineBoxWrapper();
+        } else if (curr->isRenderInline()) {
+            RenderInline* currInline = toRenderInline(curr);
+            InlineBox* result = currInline->firstLineBoxIncludingCulling();
+            if (result)
+                return result;
+        } else if (curr->isText()) {
+            RenderText* currText = toRenderText(curr);
+            if (currText->firstTextBox())
+                return currText->firstTextBox();
+        }
+    }
+    return 0;
+}
+
+InlineBox* RenderInline::culledInlineLastLineBox() const
+{
+    for (RenderObject* curr = lastChild(); curr; curr = curr->previousSibling()) {
+        if (curr->isFloatingOrPositioned())
+            continue;
+            
+        // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
+        // direction (aligned to the root box's baseline).
+        if (curr->isBox()) {
+            RenderBox* currBox = toRenderBox(curr);
+            if (currBox->inlineBoxWrapper())
+                return currBox->inlineBoxWrapper();
+        } else if (curr->isRenderInline()) {
+            RenderInline* currInline = toRenderInline(curr);
+            InlineBox* result = currInline->lastLineBoxIncludingCulling();
+            if (result)
+                return result;
+        } else if (curr->isText()) {
+            RenderText* currText = toRenderText(curr);
+            if (currText->lastTextBox())
+                return currText->lastTextBox();
+        }
+    }
+    return 0;
+}
+
+IntRect RenderInline::culledInlineVisualOverflowBoundingBox() const
+{
+    IntRect result(culledInlineBoundingBox(this));
+    bool isHorizontal = style()->isHorizontalWritingMode();
+    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+        if (curr->isFloatingOrPositioned())
+            continue;
+            
+        // For overflow we just have to propagate by hand and recompute it all.
+        if (curr->isBox()) {
+            RenderBox* currBox = toRenderBox(curr);
+            if (!currBox->hasSelfPaintingLayer() && currBox->inlineBoxWrapper()) {
+                IntRect logicalRect = currBox->logicalVisualOverflowRectForPropagation(style());
+                if (isHorizontal) {
+                    logicalRect.move(currBox->x(), currBox->y());
+                    result.uniteIfNonZero(logicalRect);
+                } else {
+                    logicalRect.move(currBox->y(), currBox->x());
+                    result.uniteIfNonZero(logicalRect.transposedRect());
+                }
+            }
+        } else if (curr->isRenderInline()) {
+            // If the child doesn't need line boxes either, then we can recur.
+            RenderInline* currInline = toRenderInline(curr);
+            if (!currInline->alwaysCreateLineBoxes())
+                result.uniteIfNonZero(currInline->culledInlineVisualOverflowBoundingBox());
+            else if (!currInline->hasSelfPaintingLayer())
+                result.uniteIfNonZero(currInline->linesVisualOverflowBoundingBox());
+        } else if (curr->isText()) {
+            // FIXME; Overflow from text boxes is lost. We will need to cache this information in
+            // InlineTextBoxes.
+            RenderText* currText = toRenderText(curr);
+            result.uniteIfNonZero(currText->linesVisualOverflowBoundingBox());
+        }
+    }
+    return result;
+}
+
 IntRect RenderInline::linesVisualOverflowBoundingBox() const
 {
+    if (!alwaysCreateLineBoxes())
+        return culledInlineVisualOverflowBoundingBox();
+
     if (!firstLineBox() || !lastLineBox())
         return IntRect();
 
     // Return the width of the minimal left side and the maximal right side.
-    float logicalLeftSide = numeric_limits<int>::max();
-    float logicalRightSide = numeric_limits<int>::min();
+    int logicalLeftSide = numeric_limits<int>::max();
+    int logicalRightSide = numeric_limits<int>::min();
     for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
-        logicalLeftSide = min(logicalLeftSide, static_cast<float>(curr->logicalLeftVisualOverflow()));
-        logicalRightSide = max(logicalRightSide, static_cast<float>(curr->logicalRightVisualOverflow()));
+        logicalLeftSide = min(logicalLeftSide, curr->logicalLeftVisualOverflow());
+        logicalRightSide = max(logicalRightSide, curr->logicalRightVisualOverflow());
     }
 
-    bool isHorizontal = style()->isHorizontalWritingMode();
-        
-    float x = isHorizontal ? logicalLeftSide : firstLineBox()->minXVisualOverflow();
-    float y = isHorizontal ? firstLineBox()->minYVisualOverflow() : logicalLeftSide;
-    float width = isHorizontal ? logicalRightSide - logicalLeftSide : lastLineBox()->maxXVisualOverflow() - firstLineBox()->minXVisualOverflow();
-    float height = isHorizontal ? lastLineBox()->maxYVisualOverflow() - firstLineBox()->minYVisualOverflow() : logicalRightSide - logicalLeftSide;
-    return enclosingIntRect(FloatRect(x, y, width, height));
+    RootInlineBox* firstRootBox = firstLineBox()->root();
+    RootInlineBox* lastRootBox = lastLineBox()->root();
+    
+    int logicalTop = firstLineBox()->logicalTopVisualOverflow(firstRootBox->lineTop());
+    int logicalWidth = logicalRightSide - logicalLeftSide;
+    int logicalHeight = lastLineBox()->logicalBottomVisualOverflow(lastRootBox->lineBottom()) - logicalTop;
+    
+    IntRect rect(logicalLeftSide, logicalTop, logicalWidth, logicalHeight);
+    if (!style()->isHorizontalWritingMode())
+        rect = rect.transposedRect();
+    return rect;
 }
 
 IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
@@ -621,7 +956,7 @@ IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repain
     // Only run-ins are allowed in here during layout.
     ASSERT(!view() || !view()->layoutStateEnabled() || isRunIn());
 
-    if (!firstLineBox() && !continuation())
+    if (!firstLineBoxIncludingCulling() && !continuation())
         return IntRect();
 
     // Find our leftmost position.
@@ -889,9 +1224,33 @@ void RenderInline::updateHitTestResult(HitTestResult& result, const IntPoint& po
 
 void RenderInline::dirtyLineBoxes(bool fullLayout)
 {
-    if (fullLayout)
+    if (fullLayout) {
         m_lineBoxes.deleteLineBoxes(renderArena());
-    else
+        return;
+    }
+
+    if (!alwaysCreateLineBoxes()) {
+        // We have to grovel into our children in order to dirty the appropriate lines.
+        for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
+            if (curr->isFloatingOrPositioned())
+                continue;
+            if (curr->isBox() && !curr->needsLayout()) {
+                RenderBox* currBox = toRenderBox(curr);
+                if (currBox->inlineBoxWrapper())
+                    currBox->inlineBoxWrapper()->root()->markDirty();
+            } else if (!curr->selfNeedsLayout()) {
+                if (curr->isRenderInline()) {
+                    RenderInline* currInline = toRenderInline(curr);
+                    for (InlineFlowBox* childLine = currInline->firstLineBox(); childLine; childLine = childLine->nextLineBox())
+                        childLine->root()->markDirty();
+                } else if (curr->isText()) {
+                    RenderText* currText = toRenderText(curr);
+                    for (InlineTextBox* childText = currText->firstTextBox(); childText; childText = childText->nextTextBox())
+                        childText->root()->markDirty();
+                }
+            }
+        }
+    } else
         m_lineBoxes.dirtyLineBoxes();
 }
 
@@ -902,6 +1261,7 @@ InlineFlowBox* RenderInline::createInlineFlowBox()
 
 InlineFlowBox* RenderInline::createAndAppendInlineFlowBox()
 {
+    setAlwaysCreateLineBoxes();
     InlineFlowBox* flowBox = createInlineFlowBox();
     m_lineBoxes.appendLineBox(flowBox);
     return flowBox;
@@ -978,13 +1338,11 @@ void RenderInline::imageChanged(WrappedImagePtr, const IntRect*)
 
 void RenderInline::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
 {
-    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
-        RootInlineBox* root = curr->root();
-        int top = max(root->lineTop(), curr->logicalTop());
-        int bottom = min(root->lineBottom(), curr->logicalBottom());
-        IntRect rect(tx + curr->x(), ty + top, curr->logicalWidth(), bottom - top);
-        if (!rect.isEmpty())
-            rects.append(rect);
+    if (!alwaysCreateLineBoxes())
+        culledInlineAbsoluteRects(this, rects, IntSize(tx, ty));
+    else {
+        for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
+            rects.append(enclosingIntRect(FloatRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height())));
     }
 
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
@@ -995,7 +1353,7 @@ void RenderInline::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
                 pos = curr->localToAbsolute();
             else if (curr->isBox())
                 pos.move(toRenderBox(curr)->x(), toRenderBox(curr)->y());
-           curr->addFocusRingRects(rects, pos.x(), pos.y());
+            curr->addFocusRingRects(rects, pos.x(), pos.y());
         }
     }
 
diff --git a/Source/WebCore/rendering/RenderInline.h b/Source/WebCore/rendering/RenderInline.h
index 08ac002..dc3eaea 100644
--- a/Source/WebCore/rendering/RenderInline.h
+++ b/Source/WebCore/rendering/RenderInline.h
@@ -23,6 +23,7 @@
 #ifndef RenderInline_h
 #define RenderInline_h
 
+#include "InlineFlowBox.h"
 #include "RenderBoxModelObject.h"
 #include "RenderLineBoxList.h"
 
@@ -64,6 +65,8 @@ public:
 
     InlineFlowBox* firstLineBox() const { return m_lineBoxes.firstLineBox(); }
     InlineFlowBox* lastLineBox() const { return m_lineBoxes.lastLineBox(); }
+    InlineBox* firstLineBoxIncludingCulling() const { return alwaysCreateLineBoxes() ? firstLineBox() : culledInlineFirstLineBox(); }
+    InlineBox* lastLineBoxIncludingCulling() const { return alwaysCreateLineBoxes() ? lastLineBox() : culledInlineLastLineBox(); }
 
     virtual RenderBoxModelObject* virtualContinuation() const { return continuation(); }
     RenderInline* inlineElementContinuation() const;
@@ -78,6 +81,10 @@ public:
     using RenderBoxModelObject::continuation;
     using RenderBoxModelObject::setContinuation;
 
+    bool alwaysCreateLineBoxes() const { return m_alwaysCreateLineBoxes; }
+    void setAlwaysCreateLineBoxes() { m_alwaysCreateLineBoxes = true; }
+    void updateAlwaysCreateLineBoxes();
+
 protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
@@ -91,6 +98,13 @@ private:
 
     virtual bool isRenderInline() const { return true; }
 
+    FloatRect culledInlineBoundingBox(const RenderInline* container) const;
+    IntRect culledInlineVisualOverflowBoundingBox() const;
+    InlineBox* culledInlineFirstLineBox() const;
+    InlineBox* culledInlineLastLineBox() const;
+    void culledInlineAbsoluteRects(const RenderInline* container, Vector<IntRect>&, const IntSize&);
+    void culledInlineAbsoluteQuads(const RenderInline* container, Vector<FloatQuad>&);
+
     void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
     virtual void addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild = 0);
 
@@ -154,7 +168,8 @@ private:
     RenderObjectChildList m_children;
     RenderLineBoxList m_lineBoxes;   // All of the line boxes created for this inline flow.  For example, <i>Hello<br>world.</i> will have two <i> line boxes.
 
-    mutable int m_lineHeight;
+    mutable int m_lineHeight : 31;
+    bool m_alwaysCreateLineBoxes : 1;
 };
 
 inline RenderInline* toRenderInline(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderInputSpeech.cpp b/Source/WebCore/rendering/RenderInputSpeech.cpp
index 8a1e73f..e5dba78 100644
--- a/Source/WebCore/rendering/RenderInputSpeech.cpp
+++ b/Source/WebCore/rendering/RenderInputSpeech.cpp
@@ -57,6 +57,10 @@ void RenderInputSpeech::adjustInputFieldSpeechButtonStyle(CSSStyleSelector*, Ren
 
 bool RenderInputSpeech::paintInputFieldSpeechButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
+    Element* element = object->node()->isElementNode() ? toElement(object->node()) : 0;
+    if (!element || !element->isInputFieldSpeechButtonElement())
+        return false;
+
     // Get the renderer of <input> element.
     Node* input = object->node()->shadowAncestorNode();
     if (!input->renderer()->isBox())
@@ -84,7 +88,7 @@ bool RenderInputSpeech::paintInputFieldSpeechButton(RenderObject* object, const
     DEFINE_STATIC_LOCAL(RefPtr<Image>, imageStateRecording, (Image::loadPlatformResource("inputSpeechRecording")));
     DEFINE_STATIC_LOCAL(RefPtr<Image>, imageStateWaiting, (Image::loadPlatformResource("inputSpeechWaiting")));
 
-    InputFieldSpeechButtonElement* speechButton = reinterpret_cast<InputFieldSpeechButtonElement*>(object->node());
+    InputFieldSpeechButtonElement* speechButton = toInputFieldSpeechButtonElement(element);
     Image* image = imageStateNormal.get();
     if (speechButton->state() == InputFieldSpeechButtonElement::Recording)
         image = imageStateRecording.get();
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 3c6bc31..da82996 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -1420,7 +1420,7 @@ void RenderLayer::scrollTo(int x, int y)
         renderer()->repaintUsingContainer(repaintContainer, rectForRepaint);
 
     // Schedule the scroll DOM event.
-    renderer()->node()->document()->eventQueue()->enqueueScrollEvent(renderer()->node(), EventQueue::ScrollEventElementTarget);
+    renderer()->node()->document()->eventQueue()->enqueueOrDispatchScrollEvent(renderer()->node(), EventQueue::ScrollEventElementTarget);
 }
 
 void RenderLayer::scrollRectToVisible(const IntRect& rect, bool scrollToAnchor, const ScrollAlignment& alignX, const ScrollAlignment& alignY)
@@ -1716,17 +1716,17 @@ static IntRect cornerRect(const RenderLayer* layer, const IntRect& bounds)
                    horizontalThickness, verticalThickness);
 }
 
-static IntRect scrollCornerRect(const RenderLayer* layer, const IntRect& bounds)
+IntRect RenderLayer::scrollCornerRect() const
 {
     // We have a scrollbar corner when a scrollbar is visible and not filling the entire length of the box.
     // This happens when:
     // (a) A resizer is present and at least one scrollbar is present
     // (b) Both scrollbars are present.
-    bool hasHorizontalBar = layer->horizontalScrollbar();
-    bool hasVerticalBar = layer->verticalScrollbar();
-    bool hasResizer = layer->renderer()->style()->resize() != RESIZE_NONE;
+    bool hasHorizontalBar = horizontalScrollbar();
+    bool hasVerticalBar = verticalScrollbar();
+    bool hasResizer = renderer()->style()->resize() != RESIZE_NONE;
     if ((hasHorizontalBar && hasVerticalBar) || (hasResizer && (hasHorizontalBar || hasVerticalBar)))
-        return cornerRect(layer, bounds);
+        return cornerRect(this, renderBox()->borderBoxRect());
     return IntRect();
 }
 
@@ -1738,10 +1738,21 @@ static IntRect resizerCornerRect(const RenderLayer* layer, const IntRect& bounds
     return cornerRect(layer, bounds);
 }
 
-bool RenderLayer::scrollbarCornerPresent() const
+IntRect RenderLayer::scrollCornerAndResizerRect() const
+{
+    RenderBox* box = renderBox();
+    if (!box)
+        return IntRect();
+    IntRect scrollCornerAndResizer = scrollCornerRect();
+    if (scrollCornerAndResizer.isEmpty())
+        scrollCornerAndResizer = resizerCornerRect(this, box->borderBoxRect());
+    return scrollCornerAndResizer;
+}
+
+bool RenderLayer::isScrollCornerVisible() const
 {
     ASSERT(renderer()->isBox());
-    return !scrollCornerRect(this, renderBox()->borderBoxRect()).isEmpty();
+    return !scrollCornerRect().isEmpty();
 }
 
 IntRect RenderLayer::convertFromScrollbarToContainingView(const Scrollbar* scrollbar, const IntRect& scrollbarRect) const
@@ -1834,6 +1845,19 @@ IntSize RenderLayer::scrollbarOffset(const Scrollbar* scrollbar) const
 
 void RenderLayer::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
 {
+#if USE(ACCELERATED_COMPOSITING)
+    if (scrollbar == m_vBar.get()) {
+        if (GraphicsLayer* layer = layerForVerticalScrollbar()) {
+            layer->setNeedsDisplayInRect(rect);
+            return;
+        }
+    } else {
+        if (GraphicsLayer* layer = layerForHorizontalScrollbar()) {
+            layer->setNeedsDisplayInRect(rect);
+            return;
+        }
+    }
+#endif
     IntRect scrollRect = rect;
     RenderBox* box = renderBox();
     ASSERT(box);
@@ -1844,6 +1868,20 @@ void RenderLayer::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& r
     renderer()->repaintRectangle(scrollRect);
 }
 
+void RenderLayer::invalidateScrollCornerRect(const IntRect& rect)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (GraphicsLayer* layer = layerForScrollCorner()) {
+        layer->setNeedsDisplayInRect(rect);
+        return;
+    }
+#endif
+    if (m_scrollCorner)
+        m_scrollCorner->repaintRectangle(rect);
+    if (m_resizer)
+        m_resizer->repaintRectangle(rect);
+}
+
 PassRefPtr<Scrollbar> RenderLayer::createScrollbar(ScrollbarOrientation orientation)
 {
     RefPtr<Scrollbar> widget;
@@ -1972,8 +2010,8 @@ void RenderLayer::positionOverflowControls(int tx, int ty)
     if (!box)
         return;
 
-    IntRect borderBox = box->borderBoxRect();
-    IntRect scrollCorner(scrollCornerRect(this, borderBox));
+    const IntRect& borderBox = box->borderBoxRect();
+    const IntRect& scrollCorner = scrollCornerRect();
     IntRect absBounds(borderBox.x() + tx, borderBox.y() + ty, borderBox.width(), borderBox.height());
     if (m_vBar)
         m_vBar->setFrameRect(IntRect(absBounds.maxX() - box->borderRight() - m_vBar->width(),
@@ -1986,7 +2024,31 @@ void RenderLayer::positionOverflowControls(int tx, int ty)
                                      absBounds.maxY() - box->borderBottom() - m_hBar->height(),
                                      absBounds.width() - (box->borderLeft() + box->borderRight()) - scrollCorner.width(),
                                      m_hBar->height()));
-    
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (GraphicsLayer* layer = layerForHorizontalScrollbar()) {
+        if (m_hBar) {
+            layer->setPosition(IntPoint(m_hBar->frameRect().x() - tx, m_hBar->frameRect().y() - ty));
+            layer->setSize(m_hBar->frameRect().size());
+        }
+        layer->setDrawsContent(m_hBar);
+    }
+    if (GraphicsLayer* layer = layerForVerticalScrollbar()) {
+        if (m_vBar) {
+            layer->setPosition(IntPoint(m_vBar->frameRect().x() - tx, m_vBar->frameRect().y() - ty));
+            layer->setSize(m_vBar->frameRect().size());
+        }
+        layer->setDrawsContent(m_vBar);
+    }
+
+    if (GraphicsLayer* layer = layerForScrollCorner()) {
+        const IntRect& scrollCornerAndResizer = scrollCornerAndResizerRect();
+        layer->setPosition(scrollCornerAndResizer.location());
+        layer->setSize(scrollCornerAndResizer.size());
+        layer->setDrawsContent(!scrollCornerAndResizer.isEmpty());
+    }
+#endif
+
     if (m_scrollCorner)
         m_scrollCorner->setFrameRect(scrollCorner);
     if (m_resizer)
@@ -2239,9 +2301,10 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty
     // and we'll paint the scrollbars then. In the meantime, cache tx and ty so that the 
     // second pass doesn't need to re-enter the RenderTree to get it right.
     if (hasOverlayScrollbars() && !paintingOverlayControls) {
-        RenderLayer* rootLayer = renderer()->view()->layer();
-        rootLayer->setContainsDirtyOverlayScrollbars(true);
+        RenderView* renderView = renderer()->view();
+        renderView->layer()->setContainsDirtyOverlayScrollbars(true);
         m_cachedOverlayScrollbarOffset = IntPoint(tx, ty);
+        renderView->frameView()->setContainsScrollableAreaWithOverlayScrollbars(true);
         return;
     }
 
@@ -2258,11 +2321,24 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty
     positionOverflowControls(offsetX, offsetY);
 
     // Now that we're sure the scrollbars are in the right place, paint them.
-    if (m_hBar)
+    if (m_hBar
+#if USE(ACCELERATED_COMPOSITING)
+        && !layerForHorizontalScrollbar()
+#endif
+              )
         m_hBar->paint(context, damageRect);
-    if (m_vBar)
+    if (m_vBar
+#if USE(ACCELERATED_COMPOSITING)
+        && !layerForVerticalScrollbar()
+#endif
+              )
         m_vBar->paint(context, damageRect);
 
+#if USE(ACCELERATED_COMPOSITING)
+    if (layerForScrollCorner())
+        return;
+#endif
+
     // We fill our scroll corner with white if we have a scrollbar that doesn't run all the way up to the
     // edge of the box.
     paintScrollCorner(context, offsetX, offsetY, damageRect);
@@ -2276,7 +2352,7 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, co
     RenderBox* box = renderBox();
     ASSERT(box);
 
-    IntRect cornerRect = scrollCornerRect(this, box->borderBoxRect());
+    IntRect cornerRect = scrollCornerRect();
     IntRect absRect = IntRect(cornerRect.x() + tx, cornerRect.y() + ty, cornerRect.width(), cornerRect.height());
     if (!absRect.intersects(damageRect))
         return;
@@ -2327,7 +2403,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
 
     // Draw a frame around the resizer (1px grey line) if there are any scrollbars present.
     // Clipping will exclude the right and bottom edges of this frame.
-    if (m_hBar || m_vBar) {
+    if (!hasOverlayScrollbars() && (m_vBar || m_hBar)) {
         context->save();
         context->clip(absRect);
         IntRect largerCorner = absRect;
@@ -2479,7 +2555,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Avoid painting layers when stylesheets haven't loaded.  This eliminates FOUC.
     // It's ok not to draw, because later on, when all the stylesheets do load, updateStyleSelector on the Document
     // will do a full repaint().
-    if (renderer()->document()->mayCauseFlashOfUnstyledContent() && !renderer()->isRenderView() && !renderer()->isRoot())
+    if (renderer()->document()->didLayoutWithPendingStylesheets() && !renderer()->isRenderView() && !renderer()->isRoot())
         return;
     
     // If this layer is totally invisible then there is nothing to paint.
@@ -2921,6 +2997,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
 #if USE(ACCELERATED_COMPOSITING)
     useTemporaryClipRects = compositor()->inCompositingMode();
 #endif
+    useTemporaryClipRects |= renderer()->view()->frameView()->containsScrollableAreaWithOverlayScrollbars();
 
     IntRect hitTestArea = result.rectForPoint(hitTestPoint);
 
@@ -2928,7 +3005,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     if (transform() && !appliedTransform) {
         // Make sure the parent's clip rects have been calculated.
         if (parent()) {
-            IntRect clipRect = backgroundClipRect(rootLayer, useTemporaryClipRects);
+            IntRect clipRect = backgroundClipRect(rootLayer, useTemporaryClipRects, IncludeOverlayScrollbarSize);
             // Go ahead and test the enclosing clip now.
             if (!clipRect.intersects(hitTestArea))
                 return 0;
@@ -2996,7 +3073,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     IntRect bgRect;
     IntRect fgRect;
     IntRect outlineRect;
-    calculateRects(rootLayer, hitTestRect, layerBounds, bgRect, fgRect, outlineRect, useTemporaryClipRects);
+    calculateRects(rootLayer, hitTestRect, layerBounds, bgRect, fgRect, outlineRect, useTemporaryClipRects, IncludeOverlayScrollbarSize);
     
     // The following are used for keeping track of the z-depth of the hit point of 3d-transformed
     // descendants.
@@ -3265,7 +3342,7 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
     return 0;
 }
 
-void RenderLayer::updateClipRects(const RenderLayer* rootLayer)
+void RenderLayer::updateClipRects(const RenderLayer* rootLayer, OverlayScrollbarSizeRelevancy relevancy)
 {
     if (m_clipRects) {
         ASSERT(rootLayer == m_clipRectsRoot);
@@ -3276,10 +3353,10 @@ void RenderLayer::updateClipRects(const RenderLayer* rootLayer)
     // examine the parent.  We want to cache clip rects with us as the root.
     RenderLayer* parentLayer = rootLayer != this ? parent() : 0;
     if (parentLayer)
-        parentLayer->updateClipRects(rootLayer);
+        parentLayer->updateClipRects(rootLayer, relevancy);
 
     ClipRects clipRects;
-    calculateClipRects(rootLayer, clipRects, true);
+    calculateClipRects(rootLayer, clipRects, true, relevancy);
 
     if (parentLayer && parentLayer->clipRects() && clipRects == *parentLayer->clipRects())
         m_clipRects = parentLayer->clipRects();
@@ -3291,7 +3368,7 @@ void RenderLayer::updateClipRects(const RenderLayer* rootLayer)
 #endif
 }
 
-void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& clipRects, bool useCached) const
+void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& clipRects, bool useCached, OverlayScrollbarSizeRelevancy relevancy) const
 {
     if (!parent()) {
         // The root layer's clip rect is always infinite.
@@ -3339,6 +3416,7 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& cl
         }
         
         if (renderer()->hasOverflowClip()) {
+<<<<<<< HEAD
             IntRect newOverflowClip = toRenderBox(renderer())->overflowClipRect(x, y);
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
             clipRects.setHitTestClip(intersection(clipRects.fixed() ? clipRects.fixedClipRect()
@@ -3350,6 +3428,9 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& cl
                             m_scrollWidth, m_scrollHeight);
             }
 #endif
+=======
+            IntRect newOverflowClip = toRenderBox(renderer())->overflowClipRect(x, y, relevancy);
+>>>>>>> WebKit.org at r84325
             clipRects.setOverflowClipRect(intersection(newOverflowClip, clipRects.overflowClipRect()));
             if (renderer()->isPositioned() || renderer()->isRelPositioned())
                 clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
@@ -3363,24 +3444,24 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, ClipRects& cl
     }
 }
 
-void RenderLayer::parentClipRects(const RenderLayer* rootLayer, ClipRects& clipRects, bool temporaryClipRects) const
+void RenderLayer::parentClipRects(const RenderLayer* rootLayer, ClipRects& clipRects, bool temporaryClipRects, OverlayScrollbarSizeRelevancy relevancy) const
 {
     ASSERT(parent());
     if (temporaryClipRects) {
-        parent()->calculateClipRects(rootLayer, clipRects);
+        parent()->calculateClipRects(rootLayer, clipRects, false, relevancy);
         return;
     }
 
-    parent()->updateClipRects(rootLayer);
+    parent()->updateClipRects(rootLayer, relevancy);
     clipRects = *parent()->clipRects();
 }
 
-IntRect RenderLayer::backgroundClipRect(const RenderLayer* rootLayer, bool temporaryClipRects) const
+IntRect RenderLayer::backgroundClipRect(const RenderLayer* rootLayer, bool temporaryClipRects, OverlayScrollbarSizeRelevancy relevancy) const
 {
     IntRect backgroundRect;
     if (parent()) {
         ClipRects parentRects;
-        parentClipRects(rootLayer, parentRects, temporaryClipRects);
+        parentClipRects(rootLayer, parentRects, temporaryClipRects, relevancy);
         backgroundRect = renderer()->style()->position() == FixedPosition ? parentRects.fixedClipRect() :
                          (renderer()->isPositioned() ? parentRects.posClipRect() : 
                                                        parentRects.overflowClipRect());
@@ -3393,10 +3474,11 @@ IntRect RenderLayer::backgroundClipRect(const RenderLayer* rootLayer, bool tempo
 }
 
 void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& paintDirtyRect, IntRect& layerBounds,
-                                 IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects) const
+                                 IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects,
+                                 OverlayScrollbarSizeRelevancy relevancy) const
 {
     if (rootLayer != this && parent()) {
-        backgroundRect = backgroundClipRect(rootLayer, temporaryClipRects);
+        backgroundRect = backgroundClipRect(rootLayer, temporaryClipRects, relevancy);
         backgroundRect.intersect(paintDirtyRect);
     } else
         backgroundRect = paintDirtyRect;
@@ -3422,7 +3504,7 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
         } else
 #endif
         if (renderer()->hasOverflowClip())
-            foregroundRect.intersect(toRenderBox(renderer())->overflowClipRect(x, y));
+            foregroundRect.intersect(toRenderBox(renderer())->overflowClipRect(x, y, relevancy));
         if (renderer()->hasClip()) {
             // Clip applies to *us* as well, so go ahead and update the damageRect.
             IntRect newPosClip = toRenderBox(renderer())->clipRect(x, y);
@@ -3629,6 +3711,21 @@ bool RenderLayer::hasCompositedMask() const
 {
     return m_backing && m_backing->hasMaskLayer();
 }
+
+GraphicsLayer* RenderLayer::layerForHorizontalScrollbar() const
+{
+    return m_backing ? m_backing->layerForHorizontalScrollbar() : 0;
+}
+
+GraphicsLayer* RenderLayer::layerForVerticalScrollbar() const
+{
+    return m_backing ? m_backing->layerForVerticalScrollbar() : 0;
+}
+
+GraphicsLayer* RenderLayer::layerForScrollCorner() const
+{
+    return m_backing ? m_backing->layerForScrollCorner() : 0;
+}
 #endif
 
 bool RenderLayer::paintsWithTransform(PaintBehavior paintBehavior) const
@@ -3957,7 +4054,7 @@ bool RenderLayer::isSelfPaintingLayer() const
         || renderer()->isRenderIFrame();
 }
 
-void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
+void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle* oldStyle)
 {
     bool isNormalFlowOnly = shouldBeNormalFlowOnly();
     if (isNormalFlowOnly != m_isNormalFlowOnly) {
@@ -4002,7 +4099,11 @@ void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
         compositor()->setCompositingLayersNeedRebuild();
     else if (m_backing)
         m_backing->updateGraphicsLayerGeometry();
-
+    else if (oldStyle && oldStyle->overflowX() != renderer()->style()->overflowX()) {
+        if (stackingContext()->hasCompositingDescendant())
+            compositor()->setCompositingLayersNeedRebuild();
+    }
+    
     if (m_backing && diff >= StyleDifferenceRepaint)
         m_backing->setContentsNeedDisplay();
 #else
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 17ba99e..4cf96ce 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -207,7 +207,7 @@ public:
     void repaintIncludingNonCompositingDescendants(RenderBoxModelObject* repaintContainer);
 #endif
 
-    void styleChanged(StyleDifference, const RenderStyle*);
+    void styleChanged(StyleDifference, const RenderStyle* oldStyle);
 
     RenderMarquee* marquee() const { return m_marquee; }
 
@@ -279,18 +279,22 @@ public:
     PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
     void destroyScrollbar(ScrollbarOrientation);
 
-    Scrollbar* horizontalScrollbar() const { return m_hBar.get(); }
-    Scrollbar* verticalScrollbar() const { return m_vBar.get(); }
+    // ScrollableArea overrides
+    virtual Scrollbar* horizontalScrollbar() const { return m_hBar.get(); }
+    virtual Scrollbar* verticalScrollbar() const { return m_vBar.get(); }
 
-    int verticalScrollbarWidth(OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize) const;
-    int horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize) const;
+    int verticalScrollbarWidth(OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
+    int horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
 
     bool hasOverflowControls() const;
+<<<<<<< HEAD
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
     bool hasOverflowScroll() const { return m_hasOverflowScroll; }
     bool hasOverflowParent() const;
 #endif
     void positionOverflowControls(int tx, int ty);
+=======
+>>>>>>> WebKit.org at r84325
     bool isPointInResizeControl(const IntPoint& absolutePoint) const;
     bool hitTestOverflowControls(HitTestResult&, const IntPoint& localPoint);
     IntSize offsetFromResizeCorner(const IntPoint& absolutePoint) const;
@@ -414,13 +418,14 @@ public:
     // |rootLayer}.  It also computes our background and foreground clip rects
     // for painting/event handling.
     void calculateRects(const RenderLayer* rootLayer, const IntRect& paintDirtyRect, IntRect& layerBounds,
-                        IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects = false) const;
+                        IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects = false,
+                        OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
 
     // Compute and cache clip rects computed with the given layer as the root
-    void updateClipRects(const RenderLayer* rootLayer);
+    void updateClipRects(const RenderLayer* rootLayer, OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize);
     // Compute and return the clip rects. If useCached is true, will used previously computed clip rects on ancestors
     // (rather than computing them all from scratch up the parent chain).
-    void calculateClipRects(const RenderLayer* rootLayer, ClipRects&, bool useCached = false) const;
+    void calculateClipRects(const RenderLayer* rootLayer, ClipRects&, bool useCached = false, OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
     ClipRects* clipRects() const { return m_clipRects; }
 
     IntRect childrenClipRect() const; // Returns the foreground clip rect of the layer in the document's coordinate space.
@@ -479,6 +484,9 @@ public:
     RenderLayerBacking* backing() const { return m_backing.get(); }
     RenderLayerBacking* ensureBacking();
     void clearBacking();
+    virtual GraphicsLayer* layerForHorizontalScrollbar() const;
+    virtual GraphicsLayer* layerForVerticalScrollbar() const;
+    virtual GraphicsLayer* layerForScrollCorner() const;
 #else
     bool isComposited() const { return false; }
     bool hasCompositedMask() const { return false; }
@@ -568,8 +576,10 @@ private:
     virtual void setScrollOffset(const IntPoint&);
     virtual int scrollPosition(Scrollbar*) const;
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
+    virtual void invalidateScrollCornerRect(const IntRect&);
     virtual bool isActive() const;
-    virtual bool scrollbarCornerPresent() const;
+    virtual bool isScrollCornerVisible() const;
+    virtual IntRect scrollCornerRect() const;
     virtual IntRect convertFromScrollbarToContainingView(const Scrollbar*, const IntRect&) const;
     virtual IntRect convertFromContainingViewToScrollbar(const Scrollbar*, const IntRect&) const;
     virtual IntPoint convertFromScrollbarToContainingView(const Scrollbar*, const IntPoint&) const;
@@ -580,6 +590,9 @@ private:
     virtual IntPoint currentMousePosition() const;
     virtual bool shouldSuspendScrollAnimations() const;
 
+    // Rectangle encompassing the scroll corner and resizer rect.
+    IntRect scrollCornerAndResizerRect() const;
+
     virtual void disconnectFromPage() { m_page = 0; }
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
@@ -610,14 +623,15 @@ private:
     bool paintingInsideReflection() const { return m_paintingInsideReflection; }
     void setPaintingInsideReflection(bool b) { m_paintingInsideReflection = b; }
     
-    void parentClipRects(const RenderLayer* rootLayer, ClipRects&, bool temporaryClipRects = false) const;
-    IntRect backgroundClipRect(const RenderLayer* rootLayer, bool temporaryClipRects) const;
+    void parentClipRects(const RenderLayer* rootLayer, ClipRects&, bool temporaryClipRects = false, OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
+    IntRect backgroundClipRect(const RenderLayer* rootLayer, bool temporaryClipRects, OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
 
     RenderLayer* enclosingTransformedAncestor() const;
 
     // Convert a point in absolute coords into layer coords, taking transforms into account
     IntPoint absoluteToContents(const IntPoint&) const;
 
+    void positionOverflowControls(int tx, int ty);
     void updateScrollCornerStyle();
     void updateResizerStyle();
 
@@ -730,7 +744,7 @@ protected:
     bool m_has3DTransformedDescendant : 1;  // Set on a stacking context layer that has 3D descendants anywhere
                                             // in a preserves3D hierarchy. Hint to do 3D-aware hit testing.
 #if USE(ACCELERATED_COMPOSITING)
-    bool m_hasCompositingDescendant : 1;
+    bool m_hasCompositingDescendant : 1; // In the z-order tree.
     bool m_mustOverlapCompositedLayers : 1;
 #endif
 
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index 26a10dd..63b1d20 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -94,6 +94,7 @@ RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
 RenderLayerBacking::~RenderLayerBacking()
 {
     updateClippingLayers(false, false);
+    updateOverflowControlsLayers(false, false, false);
     updateForegroundLayer(false);
     updateMaskLayer(false);
     destroyGraphicsLayer();
@@ -225,9 +226,11 @@ void RenderLayerBacking::updateCompositedBounds()
 
 void RenderLayerBacking::updateAfterWidgetResize()
 {
-    if (renderer()->isRenderIFrame()) {
-        if (RenderLayerCompositor* innerCompositor = RenderLayerCompositor::iframeContentsCompositor(toRenderIFrame(renderer())))
-            innerCompositor->frameViewDidChangeSize(contentsBox().location());
+    if (renderer()->isRenderPart()) {
+        if (RenderLayerCompositor* innerCompositor = RenderLayerCompositor::frameContentsCompositor(toRenderPart(renderer()))) {
+            innerCompositor->frameViewDidChangeSize();
+            innerCompositor->frameViewDidChangeLocation(contentsBox().location());
+        }
     }
 }
 
@@ -264,6 +267,12 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     if (updateClippingLayers(compositor->clippedByAncestor(m_owningLayer), compositor->clipsCompositingDescendants(m_owningLayer)))
         layerConfigChanged = true;
 
+    if (updateOverflowControlsLayers(requiresHorizontalScrollbarLayer(), requiresVerticalScrollbarLayer(), requiresScrollCornerLayer()))
+        layerConfigChanged = true;
+
+    if (layerConfigChanged)
+        updateInternalHierarchy();
+
     if (updateMaskLayer(renderer->hasMask()))
         m_graphicsLayer->setMaskLayer(m_maskLayer.get());
 
@@ -298,8 +307,8 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     }
 #endif
 
-    if (renderer->isRenderIFrame())
-        layerConfigChanged = RenderLayerCompositor::parentIFrameContentLayers(toRenderIFrame(renderer));
+    if (renderer->isRenderPart())
+        layerConfigChanged = RenderLayerCompositor::parentFrameContentLayers(toRenderPart(renderer));
 
     return layerConfigChanged;
 }
@@ -365,6 +374,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         // layer. Note that we call it with temporaryClipRects = true because normally when computing clip rects
         // for a compositing layer, rootLayer is the layer itself.
         IntRect parentClipRect = m_owningLayer->backgroundClipRect(compAncestor, true);
+        ASSERT(parentClipRect != PaintInfo::infiniteRect());
         m_ancestorClippingLayer->setPosition(FloatPoint() + (parentClipRect.location() - graphicsLayerParentLocation));
         m_ancestorClippingLayer->setSize(parentClipRect.size());
 
@@ -491,6 +501,22 @@ void RenderLayerBacking::updateInternalHierarchy()
     if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
         m_graphicsLayer->addChild(m_clippingLayer.get());
+
+        // The clip for child layers does not include space for overflow controls, so they exist as
+        // siblings of the clipping layer if we have one. Normal children of this layer are set as
+        // children of the clipping layer.
+        if (m_layerForHorizontalScrollbar) {
+            m_layerForHorizontalScrollbar->removeFromParent();
+            m_graphicsLayer->addChild(m_layerForHorizontalScrollbar.get());
+        }
+        if (m_layerForVerticalScrollbar) {
+            m_layerForVerticalScrollbar->removeFromParent();
+            m_graphicsLayer->addChild(m_layerForVerticalScrollbar.get());
+        }
+        if (m_layerForScrollCorner) {
+            m_layerForScrollCorner->removeFromParent();
+            m_graphicsLayer->addChild(m_layerForScrollCorner.get());
+        }
     }
 }
 
@@ -534,8 +560,77 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         layersChanged = true;
     }
     
-    if (layersChanged)
-        updateInternalHierarchy();
+    return layersChanged;
+}
+
+bool RenderLayerBacking::requiresHorizontalScrollbarLayer() const
+{
+#if !PLATFORM(CHROMIUM)
+    if (!m_owningLayer->hasOverlayScrollbars())
+        return false;
+#endif
+    return m_owningLayer->horizontalScrollbar();
+}
+
+bool RenderLayerBacking::requiresVerticalScrollbarLayer() const
+{
+#if !PLATFORM(CHROMIUM)
+    if (!m_owningLayer->hasOverlayScrollbars())
+        return false;
+#endif
+    return m_owningLayer->verticalScrollbar();
+}
+
+bool RenderLayerBacking::requiresScrollCornerLayer() const
+{
+#if !PLATFORM(CHROMIUM)
+    if (!m_owningLayer->hasOverlayScrollbars())
+        return false;
+#endif
+    return !m_owningLayer->scrollCornerAndResizerRect().isEmpty();
+}
+
+bool RenderLayerBacking::updateOverflowControlsLayers(bool needsHorizontalScrollbarLayer, bool needsVerticalScrollbarLayer, bool needsScrollCornerLayer)
+{
+    bool layersChanged = false;
+    if (needsHorizontalScrollbarLayer) {
+        if (!m_layerForHorizontalScrollbar) {
+            m_layerForHorizontalScrollbar = GraphicsLayer::create(this);
+#ifndef NDEBUG
+            m_layerForHorizontalScrollbar ->setName("horizontal scrollbar");
+#endif
+            layersChanged = true;
+        }
+    } else if (m_layerForHorizontalScrollbar) {
+        m_layerForHorizontalScrollbar.clear();
+        layersChanged = true;
+    }
+
+    if (needsVerticalScrollbarLayer) {
+        if (!m_layerForVerticalScrollbar) {
+            m_layerForVerticalScrollbar = GraphicsLayer::create(this);
+#ifndef NDEBUG
+            m_layerForVerticalScrollbar->setName("vertical scrollbar");
+#endif
+            layersChanged = true;
+        }
+    } else if (m_layerForVerticalScrollbar) {
+        m_layerForVerticalScrollbar.clear();
+        layersChanged = true;
+    }
+
+    if (needsScrollCornerLayer) {
+        if (!m_layerForScrollCorner) {
+            m_layerForScrollCorner = GraphicsLayer::create(this);
+#ifndef NDEBUG
+            m_layerForScrollCorner->setName("scroll corner");
+#endif
+            layersChanged = true;
+        }
+    } else if (m_layerForScrollCorner) {
+        m_layerForScrollCorner.clear();
+        layersChanged = true;
+    }
 
     return layersChanged;
 }
@@ -804,7 +899,7 @@ bool RenderLayerBacking::containsPaintedContent() const
     if (renderer()->isVideo() && toRenderVideo(renderer())->shouldDisplayVideo())
         return hasBoxDecorationsOrBackground(renderer());
 #endif
-#if PLATFORM(MAC) && PLATFORM(CA) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if PLATFORM(MAC) && USE(CA) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 #elif ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)
     if (isAcceleratedCanvas(renderer()))
         return hasBoxDecorationsOrBackground(renderer());
@@ -933,7 +1028,7 @@ IntRect RenderLayerBacking::contentsBox() const
 bool RenderLayerBacking::paintingGoesToWindow() const
 {
     if (m_owningLayer->isRootLayer())
-        return compositor()->rootLayerAttachment() != RenderLayerCompositor::RootLayerAttachedViaEnclosingIframe;
+        return compositor()->rootLayerAttachment() != RenderLayerCompositor::RootLayerAttachedViaEnclosingFrame;
     
     return false;
 }
@@ -1110,9 +1205,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     ASSERT(!m_owningLayer->m_usedTransparency);
 }
 
-// Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
+static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const IntRect& clip)
 {
+<<<<<<< HEAD
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), clip);
 
     IntSize offset = graphicsLayer->offsetFromRenderer();
@@ -1130,11 +1225,54 @@ void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, Graph
         dirtyRect.setSize(clip.size());
 #endif
     dirtyRect.intersect(clipRect);
+=======
+    if (!scrollbar)
+        return;
+>>>>>>> WebKit.org at r84325
 
-    // We have to use the same root as for hit testing, because both methods can compute and cache clipRects.
-    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
+    context.save();
+    const IntRect& scrollbarRect = scrollbar->frameRect();
+    context.translate(-scrollbarRect.x(), -scrollbarRect.y());
+    IntRect transformedClip = clip;
+    transformedClip.move(scrollbarRect.x(), scrollbarRect.y());
+    scrollbar->paint(&context, transformedClip);
+    context.restore();
+}
 
-    InspectorInstrumentation::didPaint(cookie);
+// Up-call from compositing layer drawing callback.
+void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
+{
+    if (graphicsLayer == m_graphicsLayer.get() || graphicsLayer == m_foregroundLayer.get() || graphicsLayer == m_maskLayer.get()) {
+        InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), clip);
+
+        IntSize offset = graphicsLayer->offsetFromRenderer();
+        context.translate(-offset);
+
+        IntRect clipRect(clip);
+        clipRect.move(offset);
+
+        // The dirtyRect is in the coords of the painting root.
+        IntRect dirtyRect = compositedBounds();
+        dirtyRect.intersect(clipRect);
+
+        // We have to use the same root as for hit testing, because both methods can compute and cache clipRects.
+        paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
+
+        InspectorInstrumentation::didPaint(cookie);
+    } else if (graphicsLayer == layerForHorizontalScrollbar()) {
+        paintScrollbar(m_owningLayer->horizontalScrollbar(), context, clip);
+    } else if (graphicsLayer == layerForVerticalScrollbar()) {
+        paintScrollbar(m_owningLayer->verticalScrollbar(), context, clip);
+    } else if (graphicsLayer == layerForScrollCorner()) {
+        const IntRect& scrollCornerAndResizer = m_owningLayer->scrollCornerAndResizerRect();
+        context.save();
+        context.translate(-scrollCornerAndResizer.x(), -scrollCornerAndResizer.y());
+        IntRect transformedClip = clip;
+        transformedClip.move(scrollCornerAndResizer.x(), scrollCornerAndResizer.y());
+        m_owningLayer->paintScrollCorner(&context, 0, 0, transformedClip);
+        m_owningLayer->paintResizer(&context, 0, 0, transformedClip);
+        context.restore();
+    }
 }
 
 bool RenderLayerBacking::showDebugBorders() const
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index 8f0927d..f1b8972 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -69,7 +69,6 @@ public:
     // Update graphics layer position and bounds.
     void updateGraphicsLayerGeometry(); // make private
     // Update contents and clipping structure.
-    void updateInternalHierarchy(); // make private
     void updateDrawsContent();
     
     GraphicsLayer* graphicsLayer() const { return m_graphicsLayer.get(); }
@@ -139,6 +138,10 @@ public:
     
     void updateContentsScale(float);
 
+    GraphicsLayer* layerForHorizontalScrollbar() const { return m_layerForHorizontalScrollbar.get(); }
+    GraphicsLayer* layerForVerticalScrollbar() const { return m_layerForVerticalScrollbar.get(); }
+    GraphicsLayer* layerForScrollCorner() const { return m_layerForScrollCorner.get(); }
+
 private:
     void createGraphicsLayer();
     void destroyGraphicsLayer();
@@ -146,9 +149,14 @@ private:
     RenderBoxModelObject* renderer() const { return m_owningLayer->renderer(); }
     RenderLayerCompositor* compositor() const { return m_owningLayer->compositor(); }
 
+    void updateInternalHierarchy();
     bool updateClippingLayers(bool needsAncestorClip, bool needsDescendantClip);
+    bool updateOverflowControlsLayers(bool needsHorizontalScrollbarLayer, bool needsVerticalScrollbarLayer, bool needsScrollCornerLayer);
     bool updateForegroundLayer(bool needsForegroundLayer);
     bool updateMaskLayer(bool needsMaskLayer);
+    bool requiresHorizontalScrollbarLayer() const;
+    bool requiresVerticalScrollbarLayer() const;
+    bool requiresScrollCornerLayer() const;
 
     GraphicsLayerPaintingPhase paintingPhaseForPrimaryLayer() const;
     
@@ -196,6 +204,10 @@ private:
     OwnPtr<GraphicsLayer> m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
     OwnPtr<GraphicsLayer> m_maskLayer;             // only used if we have a mask
 
+    OwnPtr<GraphicsLayer> m_layerForHorizontalScrollbar;
+    OwnPtr<GraphicsLayer> m_layerForVerticalScrollbar;
+    OwnPtr<GraphicsLayer> m_layerForScrollCorner;
+
     IntRect m_compositedBounds;
 
     bool m_artificiallyInflatedBounds;      // bounds had to be made non-zero to make transform-origin work
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 6542ffd..03ae579 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -253,7 +253,7 @@ void RenderLayerCompositor::updateCompositingLayers(CompositingUpdateType update
 
     bool checkForHierarchyUpdate = m_compositingDependsOnGeometry;
     bool needGeometryUpdate = false;
-    
+
     switch (updateType) {
     case CompositingUpdateAfterLayoutOrStyleChange:
     case CompositingUpdateOnPaitingOrHitTest:
@@ -354,7 +354,7 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
 
             layer->ensureBacking();
 
-#if PLATFORM(MAC) && PLATFORM(CA)
+#if PLATFORM(MAC) && USE(CA)
             if (m_renderView->document()->settings()->acceleratedDrawingEnabled())
                 layer->backing()->graphicsLayer()->setAcceleratesDrawing(true);
             else if (layer->renderer()->isCanvas()) {
@@ -399,8 +399,8 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
     }
 #endif
 
-    if (layerChanged && layer->renderer()->isRenderIFrame()) {
-        RenderLayerCompositor* innerCompositor = iframeContentsCompositor(toRenderIFrame(layer->renderer()));
+    if (layerChanged && layer->renderer()->isRenderPart()) {
+        RenderLayerCompositor* innerCompositor = frameContentsCompositor(toRenderPart(layer->renderer()));
         if (innerCompositor && innerCompositor->inCompositingMode())
             innerCompositor->updateRootLayerAttachment();
     }
@@ -915,9 +915,28 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, cons
 
     if (layerBacking) {
         bool parented = false;
-        if (layer->renderer()->isRenderIFrame())
-            parented = parentIFrameContentLayers(toRenderIFrame(layer->renderer()));
-        
+        if (layer->renderer()->isRenderPart())
+            parented = parentFrameContentLayers(toRenderPart(layer->renderer()));
+
+        // If the layer has a clipping layer the overflow controls layers will be siblings of the clipping layer.
+        // Otherwise, the overflow control layers are normal children.
+        if (!layerBacking->hasClippingLayer()) {
+            if (GraphicsLayer* overflowControlLayer = layerBacking->layerForHorizontalScrollbar()) {
+                overflowControlLayer->removeFromParent();
+                layerChildren.append(overflowControlLayer);
+            }
+
+            if (GraphicsLayer* overflowControlLayer = layerBacking->layerForVerticalScrollbar()) {
+                overflowControlLayer->removeFromParent();
+                layerChildren.append(overflowControlLayer);
+            }
+
+            if (GraphicsLayer* overflowControlLayer = layerBacking->layerForScrollCorner()) {
+                overflowControlLayer->removeFromParent();
+                layerChildren.append(overflowControlLayer);
+            }
+        }
+
         if (!parented)
             layerBacking->parentForSublayers()->setChildren(layerChildren);
 
@@ -932,15 +951,21 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, cons
     }
 }
 
-void RenderLayerCompositor::frameViewDidChangeSize(const IntPoint& contentsOffset)
+void RenderLayerCompositor::frameViewDidChangeLocation(const IntPoint& contentsOffset)
+{
+    if (m_overflowControlsHostLayer)
+        m_overflowControlsHostLayer->setPosition(contentsOffset);
+}
+
+void RenderLayerCompositor::frameViewDidChangeSize()
 {
     if (m_clipLayer) {
         FrameView* frameView = m_renderView->frameView();
-        m_clipLayer->setPosition(contentsOffset);
-        m_clipLayer->setSize(FloatSize(frameView->layoutWidth(), frameView->layoutHeight()));
+        m_clipLayer->setSize(frameView->visibleContentRect(false /* exclude scrollbars */).size());
 
         IntPoint scrollPosition = frameView->scrollPosition();
         m_scrollLayer->setPosition(FloatPoint(-scrollPosition.x(), -scrollPosition.y()));
+        updateOverflowControlsLayers();
     }
 }
 
@@ -963,9 +988,12 @@ String RenderLayerCompositor::layerTreeAsText(bool showDebugInfo)
     return m_rootPlatformLayer->layerTreeAsText(showDebugInfo ? LayerTreeAsTextDebug : LayerTreeAsTextBehaviorNormal);
 }
 
-RenderLayerCompositor* RenderLayerCompositor::iframeContentsCompositor(RenderIFrame* renderer)
+RenderLayerCompositor* RenderLayerCompositor::frameContentsCompositor(RenderPart* renderer)
 {
-    HTMLIFrameElement* element = static_cast<HTMLIFrameElement*>(renderer->node());
+    if (!renderer->node()->isFrameOwnerElement())
+        return 0;
+        
+    HTMLFrameOwnerElement* element = static_cast<HTMLFrameOwnerElement*>(renderer->node());
     if (Document* contentDocument = element->contentDocument()) {
         if (RenderView* view = contentDocument->renderView())
             return view->compositor();
@@ -973,10 +1001,10 @@ RenderLayerCompositor* RenderLayerCompositor::iframeContentsCompositor(RenderIFr
     return 0;
 }
 
-bool RenderLayerCompositor::parentIFrameContentLayers(RenderIFrame* renderer)
+bool RenderLayerCompositor::parentFrameContentLayers(RenderPart* renderer)
 {
-    RenderLayerCompositor* innerCompositor = iframeContentsCompositor(renderer);
-    if (!innerCompositor || !innerCompositor->inCompositingMode() || innerCompositor->rootLayerAttachment() != RootLayerAttachedViaEnclosingIframe)
+    RenderLayerCompositor* innerCompositor = frameContentsCompositor(renderer);
+    if (!innerCompositor || !innerCompositor->inCompositingMode() || innerCompositor->rootLayerAttachment() != RootLayerAttachedViaEnclosingFrame)
         return false;
     
     RenderLayer* layer = renderer->layer();
@@ -1146,7 +1174,9 @@ RenderLayer* RenderLayerCompositor::rootRenderLayer() const
 
 GraphicsLayer* RenderLayerCompositor::rootPlatformLayer() const
 {
-    return m_clipLayer ? m_clipLayer.get() : m_rootPlatformLayer.get();
+    if (m_overflowControlsHostLayer)
+        return m_overflowControlsHostLayer.get();
+    return m_rootPlatformLayer.get();
 }
 
 void RenderLayerCompositor::didMoveOnscreen()
@@ -1154,7 +1184,7 @@ void RenderLayerCompositor::didMoveOnscreen()
     if (!inCompositingMode() || m_rootLayerAttachment != RootLayerUnattached)
         return;
 
-    RootLayerAttachment attachment = shouldPropagateCompositingToEnclosingIFrame() ? RootLayerAttachedViaEnclosingIframe : RootLayerAttachedViaChromeClient;
+    RootLayerAttachment attachment = shouldPropagateCompositingToEnclosingFrame() ? RootLayerAttachedViaEnclosingFrame : RootLayerAttachedViaChromeClient;
     attachRootPlatformLayer(attachment);
 }
 
@@ -1174,7 +1204,7 @@ void RenderLayerCompositor::updateRootLayerPosition()
     }
     if (m_clipLayer) {
         FrameView* frameView = m_renderView->frameView();
-        m_clipLayer->setSize(FloatSize(frameView->layoutWidth(), frameView->layoutHeight()));
+        m_clipLayer->setSize(frameView->visibleContentRect(false /* exclude scrollbars */).size());
     }
 }
 
@@ -1192,43 +1222,52 @@ bool RenderLayerCompositor::has3DContent() const
     return layerHas3DContent(rootRenderLayer());
 }
 
-bool RenderLayerCompositor::allowsIndependentlyCompositedIFrames(const FrameView* view)
+bool RenderLayerCompositor::allowsIndependentlyCompositedFrames(const FrameView* view)
 {
 #if PLATFORM(MAC)
-    // iframes are only independently composited in Mac pre-WebKit2.
+    // frames are only independently composited in Mac pre-WebKit2.
     return view->platformWidget();
 #endif
     return false;
 }
 
-bool RenderLayerCompositor::shouldPropagateCompositingToEnclosingIFrame() const
+bool RenderLayerCompositor::shouldPropagateCompositingToEnclosingFrame() const
 {
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     if (enclosingIFrameElement() && !allowsIndependentlyCompositedIFrames(m_renderView->frameView()))
         return true;
 #endif
     // Parent document content needs to be able to render on top of a composited iframe, so correct behavior
+=======
+    // Parent document content needs to be able to render on top of a composited frame, so correct behavior
+>>>>>>> WebKit.org at r84325
     // is to have the parent document become composited too. However, this can cause problems on platforms that
     // use native views for frames (like Mac), so disable that behavior on those platforms for now.
-    HTMLFrameOwnerElement* ownerElement = enclosingIFrameElement();
+    HTMLFrameOwnerElement* ownerElement = enclosingFrameElement();
     RenderObject* renderer = ownerElement ? ownerElement->renderer() : 0;
-    if (!renderer || !renderer->isRenderIFrame())
+
+    // If we are the top-level frame, don't propagate.
+    if (!ownerElement)
         return false;
 
-    if (!allowsIndependentlyCompositedIFrames(m_renderView->frameView()))
+    if (!allowsIndependentlyCompositedFrames(m_renderView->frameView()))
         return true;
 
-    // On Mac, only propagate compositing if the iframe is overlapped in the parent
+    if (!renderer || !renderer->isRenderPart())
+        return false;
+
+    // On Mac, only propagate compositing if the frame is overlapped in the parent
     // document, or the parent is already compositing, or the main frame is scaled.
     Frame* frame = m_renderView->frameView()->frame();
     Page* page = frame ? frame->page() : 0;
     if (page->mainFrame()->pageScaleFactor() != 1)
         return true;
     
-    RenderIFrame* iframeRenderer = toRenderIFrame(renderer);
-    if (iframeRenderer->widget()) {
-        ASSERT(iframeRenderer->widget()->isFrameView());
-        FrameView* view = static_cast<FrameView*>(iframeRenderer->widget());
+    RenderPart* frameRenderer = toRenderPart(renderer);
+    if (frameRenderer->widget()) {
+        ASSERT(frameRenderer->widget()->isFrameView());
+        FrameView* view = static_cast<FrameView*>(frameRenderer->widget());
         if (view->isOverlappedIncludingAncestors() || view->hasCompositingAncestor())
             return true;
     }
@@ -1236,10 +1275,10 @@ bool RenderLayerCompositor::shouldPropagateCompositingToEnclosingIFrame() const
     return false;
 }
 
-HTMLFrameOwnerElement* RenderLayerCompositor::enclosingIFrameElement() const
+HTMLFrameOwnerElement* RenderLayerCompositor::enclosingFrameElement() const
 {
     if (HTMLFrameOwnerElement* ownerElement = m_renderView->document()->ownerElement())
-        return ownerElement->hasTagName(iframeTag) ? ownerElement : 0;
+        return (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag) || ownerElement->hasTagName(objectTag)) ? ownerElement : 0;
 
     return 0;
 }
@@ -1290,7 +1329,7 @@ bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) c
              || requiresCompositingForVideo(renderer)
              || requiresCompositingForCanvas(renderer)
              || requiresCompositingForPlugin(renderer)
-             || requiresCompositingForIFrame(renderer)
+             || requiresCompositingForFrame(renderer)
              || (canRender3DTransforms() && renderer->style()->backfaceVisibility() == BackfaceVisibilityHidden)
              || clipsCompositingDescendants(layer)
              || requiresCompositingForAnimation(renderer)
@@ -1423,28 +1462,28 @@ bool RenderLayerCompositor::requiresCompositingForPlugin(RenderObject* renderer)
     return contentBox.height() * contentBox.width() > 1;
 }
 
-bool RenderLayerCompositor::requiresCompositingForIFrame(RenderObject* renderer) const
+bool RenderLayerCompositor::requiresCompositingForFrame(RenderObject* renderer) const
 {
-    if (!renderer->isRenderIFrame())
+    if (!renderer->isRenderPart())
         return false;
     
-    RenderIFrame* iframeRenderer = toRenderIFrame(renderer);
+    RenderPart* frameRenderer = toRenderPart(renderer);
 
-    if (!iframeRenderer->requiresAcceleratedCompositing())
+    if (!frameRenderer->requiresAcceleratedCompositing())
         return false;
 
     m_compositingDependsOnGeometry = true;
 
-    RenderLayerCompositor* innerCompositor = iframeContentsCompositor(iframeRenderer);
-    if (!innerCompositor->shouldPropagateCompositingToEnclosingIFrame())
+    RenderLayerCompositor* innerCompositor = frameContentsCompositor(frameRenderer);
+    if (!innerCompositor || !innerCompositor->shouldPropagateCompositingToEnclosingFrame())
         return false;
 
     // If we can't reliably know the size of the iframe yet, don't change compositing state.
     if (renderer->needsLayout())
-        return iframeRenderer->hasLayer() && iframeRenderer->layer()->isComposited();
+        return frameRenderer->hasLayer() && frameRenderer->layer()->isComposited();
     
     // Don't go into compositing mode if height or width are zero.
-    IntRect contentBox = iframeRenderer->contentBoxRect();
+    IntRect contentBox = frameRenderer->contentBoxRect();
     return contentBox.height() * contentBox.width() > 0;
 }
 
@@ -1487,12 +1526,119 @@ bool RenderLayerCompositor::requiresScrollLayer(RootLayerAttachment attachment)
 {
     // We need to handle our own scrolling if we're:
     return !m_renderView->frameView()->platformWidget() // viewless (i.e. non-Mac, or Mac in WebKit2)
-        || attachment == RootLayerAttachedViaEnclosingIframe; // a composited iframe on Mac
+        || attachment == RootLayerAttachedViaEnclosingFrame; // a composited frame on Mac
+}
+
+static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const IntRect& clip)
+{
+    if (!scrollbar)
+        return;
+
+    context.save();
+    const IntRect& scrollbarRect = scrollbar->frameRect();
+    context.translate(-scrollbarRect.x(), -scrollbarRect.y());
+    IntRect transformedClip = clip;
+    transformedClip.move(scrollbarRect.x(), scrollbarRect.y());
+    scrollbar->paint(&context, transformedClip);
+    context.restore();
+}
+
+void RenderLayerCompositor::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase, const IntRect& clip)
+{
+    if (graphicsLayer == layerForHorizontalScrollbar())
+        paintScrollbar(m_renderView->frameView()->horizontalScrollbar(), context, clip);
+    else if (graphicsLayer == layerForVerticalScrollbar())
+        paintScrollbar(m_renderView->frameView()->verticalScrollbar(), context, clip);
+    else if (graphicsLayer == layerForScrollCorner()) {
+        const IntRect& scrollCorner = m_renderView->frameView()->scrollCornerRect();
+        context.save();
+        context.translate(-scrollCorner.x(), -scrollCorner.y());
+        IntRect transformedClip = clip;
+        transformedClip.move(scrollCorner.x(), scrollCorner.y());
+        m_renderView->frameView()->paintScrollCorner(&context, transformedClip);
+        context.restore();
+    }
+}
+
+static bool shouldCompositeOverflowControls(ScrollView* view)
+{
+    if (view->platformWidget())
+        return false;
+#if !PLATFORM(CHROMIUM)
+    if (!view->hasOverlayScrollbars())
+        return false;
+#endif
+    return true;
+}
+
+bool RenderLayerCompositor::requiresHorizontalScrollbarLayer() const
+{
+    ScrollView* view = m_renderView->frameView();
+    return shouldCompositeOverflowControls(view) && view->horizontalScrollbar();
+}
+
+bool RenderLayerCompositor::requiresVerticalScrollbarLayer() const
+{
+    ScrollView* view = m_renderView->frameView();
+    return shouldCompositeOverflowControls(view) && view->verticalScrollbar();
+}
+
+bool RenderLayerCompositor::requiresScrollCornerLayer() const
+{
+    ScrollView* view = m_renderView->frameView();
+    return shouldCompositeOverflowControls(view) && view->isScrollCornerVisible();
+}
+
+void RenderLayerCompositor::updateOverflowControlsLayers()
+{
+    bool layersChanged = false;
+
+    if (requiresHorizontalScrollbarLayer()) {
+        m_layerForHorizontalScrollbar = GraphicsLayer::create(this);
+#ifndef NDEBUG
+        m_layerForHorizontalScrollbar->setName("horizontal scrollbar");
+#endif
+        m_overflowControlsHostLayer->addChild(m_layerForHorizontalScrollbar.get());
+        layersChanged = true;
+    } else if (m_layerForHorizontalScrollbar) {
+        m_layerForHorizontalScrollbar->removeFromParent();
+        m_layerForHorizontalScrollbar = 0;
+        layersChanged = true;
+    }
+
+    if (requiresVerticalScrollbarLayer()) {
+        m_layerForVerticalScrollbar = GraphicsLayer::create(this);
+#ifndef NDEBUG
+        m_layerForVerticalScrollbar->setName("vertical scrollbar");
+#endif
+        m_overflowControlsHostLayer->addChild(m_layerForVerticalScrollbar.get());
+        layersChanged = true;
+    } else if (m_layerForVerticalScrollbar) {
+        m_layerForVerticalScrollbar->removeFromParent();
+        m_layerForVerticalScrollbar = 0;
+        layersChanged = true;
+    }
+
+    if (requiresScrollCornerLayer()) {
+        m_layerForScrollCorner = GraphicsLayer::create(this);
+#ifndef NDEBUG
+        m_layerForScrollCorner->setName("scroll corner");
+#endif
+        m_overflowControlsHostLayer->addChild(m_layerForScrollCorner.get());
+        layersChanged = true;
+    } else if (m_layerForScrollCorner) {
+        m_layerForScrollCorner->removeFromParent();
+        m_layerForScrollCorner = 0;
+        layersChanged = true;
+    }
+
+    if (layersChanged)
+        m_renderView->frameView()->positionScrollbarLayers();
 }
 
 void RenderLayerCompositor::ensureRootPlatformLayer()
 {
-    RootLayerAttachment expectedAttachment = shouldPropagateCompositingToEnclosingIFrame() ? RootLayerAttachedViaEnclosingIframe : RootLayerAttachedViaChromeClient;
+    RootLayerAttachment expectedAttachment = shouldPropagateCompositingToEnclosingFrame() ? RootLayerAttachedViaEnclosingFrame : RootLayerAttachedViaChromeClient;
     if (expectedAttachment == m_rootLayerAttachment)
          return;
 
@@ -1509,8 +1655,16 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
     }
 
     if (requiresScrollLayer(expectedAttachment)) {
-        if (!m_clipLayer) {
+        if (!m_overflowControlsHostLayer) {
             ASSERT(!m_scrollLayer);
+            ASSERT(!m_clipLayer);
+
+            // Create a layer to host the clipping layer and the overflow controls layers.
+            m_overflowControlsHostLayer = GraphicsLayer::create(0);
+#ifndef NDEBUG
+            m_overflowControlsHostLayer->setName("overflow controls host");
+#endif
+
             // Create a clipping layer if this is an iframe
             m_clipLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
@@ -1522,20 +1676,19 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
 #ifndef NDEBUG
             m_scrollLayer->setName("iframe scrolling");
 #endif
+
             // Hook them up
+            m_overflowControlsHostLayer->addChild(m_clipLayer.get());
             m_clipLayer->addChild(m_scrollLayer.get());
             m_scrollLayer->addChild(m_rootPlatformLayer.get());
-            
+
             frameViewDidChangeSize();
             frameViewDidScroll(m_renderView->frameView()->scrollPosition());
         }
     } else {
-        if (m_clipLayer) {
-            m_clipLayer->removeAllChildren();
-            m_clipLayer->removeFromParent();
+        if (m_overflowControlsHostLayer) {
+            m_overflowControlsHostLayer = 0;
             m_clipLayer = 0;
-            
-            m_scrollLayer->removeAllChildren();
             m_scrollLayer = 0;
         }
     }
@@ -1553,11 +1706,29 @@ void RenderLayerCompositor::destroyRootPlatformLayer()
         return;
 
     detachRootPlatformLayer();
-    if (m_clipLayer) {
-        m_clipLayer->removeAllChildren();
+
+    if (m_layerForHorizontalScrollbar) {
+        m_layerForHorizontalScrollbar->removeFromParent();
+        m_layerForHorizontalScrollbar = 0;
+        if (Scrollbar* horizontalScrollbar = m_renderView->frameView()->verticalScrollbar())
+            m_renderView->frameView()->invalidateScrollbar(horizontalScrollbar, IntRect(IntPoint(0, 0), horizontalScrollbar->frameRect().size()));
+    }
+
+    if (m_layerForVerticalScrollbar) {
+        m_layerForVerticalScrollbar->removeFromParent();
+        m_layerForVerticalScrollbar = 0;
+        if (Scrollbar* verticalScrollbar = m_renderView->frameView()->verticalScrollbar())
+            m_renderView->frameView()->invalidateScrollbar(verticalScrollbar, IntRect(IntPoint(0, 0), verticalScrollbar->frameRect().size()));
+    }
+
+    if (m_layerForScrollCorner) {
+        m_layerForScrollCorner = 0;
+        m_renderView->frameView()->invalidateScrollCorner();
+    }
+
+    if (m_overflowControlsHostLayer) {
+        m_overflowControlsHostLayer = 0;
         m_clipLayer = 0;
-        
-        m_scrollLayer->removeAllChildren();
         m_scrollLayer = 0;
     }
     ASSERT(!m_scrollLayer);
@@ -1582,9 +1753,9 @@ void RenderLayerCompositor::attachRootPlatformLayer(RootLayerAttachment attachme
             page->chrome()->client()->attachRootGraphicsLayer(frame, rootPlatformLayer());
             break;
         }
-        case RootLayerAttachedViaEnclosingIframe: {
+        case RootLayerAttachedViaEnclosingFrame: {
             // The layer will get hooked up via RenderLayerBacking::updateGraphicsLayerConfiguration()
-            // for the iframe's renderer in the parent document.
+            // for the frame's renderer in the parent document.
             scheduleNeedsStyleRecalc(m_renderView->document()->ownerElement());
             break;
         }
@@ -1600,29 +1771,29 @@ void RenderLayerCompositor::detachRootPlatformLayer()
         return;
 
     switch (m_rootLayerAttachment) {
-        case RootLayerAttachedViaEnclosingIframe: {
-            // The layer will get unhooked up via RenderLayerBacking::updateGraphicsLayerConfiguration()
-            // for the iframe's renderer in the parent document.
-            if (m_clipLayer)
-                m_clipLayer->removeFromParent();
-            else
-                m_rootPlatformLayer->removeFromParent();
-
-            if (HTMLFrameOwnerElement* ownerElement = m_renderView->document()->ownerElement())
-                scheduleNeedsStyleRecalc(ownerElement);
-            break;
-        }
-        case RootLayerAttachedViaChromeClient: {
-            Frame* frame = m_renderView->frameView()->frame();
-            Page* page = frame ? frame->page() : 0;
-            if (!page)
-                return;
+    case RootLayerAttachedViaEnclosingFrame: {
+        // The layer will get unhooked up via RenderLayerBacking::updateGraphicsLayerConfiguration()
+        // for the frame's renderer in the parent document.
+        if (m_overflowControlsHostLayer)
+            m_overflowControlsHostLayer->removeFromParent();
+        else
+            m_rootPlatformLayer->removeFromParent();
+
+        if (HTMLFrameOwnerElement* ownerElement = m_renderView->document()->ownerElement())
+            scheduleNeedsStyleRecalc(ownerElement);
+        break;
+    }
+    case RootLayerAttachedViaChromeClient: {
+        Frame* frame = m_renderView->frameView()->frame();
+        Page* page = frame ? frame->page() : 0;
+        if (!page)
+            return;
 
-            page->chrome()->client()->attachRootGraphicsLayer(frame, 0);
-        }
+        page->chrome()->client()->attachRootGraphicsLayer(frame, 0);
+    }
+    break;
+    case RootLayerUnattached:
         break;
-        case RootLayerUnattached:
-            break;
     }
 
     m_rootLayerAttachment = RootLayerUnattached;
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index c3deb3f..0315050 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -36,7 +36,7 @@ namespace WebCore {
 
 class GraphicsLayer;
 class RenderEmbeddedObject;
-class RenderIFrame;
+class RenderPart;
 #if ENABLE(VIDEO)
 class RenderVideo;
 #endif
@@ -138,7 +138,7 @@ public:
     enum RootLayerAttachment {
         RootLayerUnattached,
         RootLayerAttachedViaChromeClient,
-        RootLayerAttachedViaEnclosingIframe
+        RootLayerAttachedViaEnclosingFrame
     };
 
     RootLayerAttachment rootLayerAttachment() const { return m_rootLayerAttachment; }
@@ -161,18 +161,18 @@ public:
     
     // Most platforms connect compositing layer trees between iframes and their parent document.
     // Some (currently just Mac) allow iframes to do their own compositing.
-    static bool allowsIndependentlyCompositedIFrames(const FrameView*);
-    bool shouldPropagateCompositingToEnclosingIFrame() const;
+    static bool allowsIndependentlyCompositedFrames(const FrameView*);
+    bool shouldPropagateCompositingToEnclosingFrame() const;
 
-    // FIXME: This should be a RenderIFrame*
-    HTMLFrameOwnerElement* enclosingIFrameElement() const;
+    HTMLFrameOwnerElement* enclosingFrameElement() const;
 
-    static RenderLayerCompositor* iframeContentsCompositor(RenderIFrame*);
+    static RenderLayerCompositor* frameContentsCompositor(RenderPart*);
     // Return true if the layers changed.
-    static bool parentIFrameContentLayers(RenderIFrame*);
+    static bool parentFrameContentLayers(RenderPart*);
 
     // Update the geometry of the layers used for clipping and scrolling in frames.
-    void frameViewDidChangeSize(const IntPoint& contentsOffset = IntPoint());
+    void frameViewDidChangeLocation(const IntPoint& contentsOffset);
+    void frameViewDidChangeSize();
     void frameViewDidScroll(const IntPoint& = IntPoint());
 
     String layerTreeAsText(bool showDebugInfo = false);
@@ -184,11 +184,15 @@ public:
 
     void updateContentsScale(float, RenderLayer* = 0);
 
+    GraphicsLayer* layerForHorizontalScrollbar() const { return m_layerForHorizontalScrollbar.get(); }
+    GraphicsLayer* layerForVerticalScrollbar() const { return m_layerForVerticalScrollbar.get(); }
+    GraphicsLayer* layerForScrollCorner() const { return m_layerForScrollCorner.get(); }
+
 private:
     // GraphicsLayerClient Implementation
     virtual void notifyAnimationStarted(const GraphicsLayer*, double) { }
     virtual void notifySyncRequired(const GraphicsLayer*) { scheduleLayerFlush(); }
-    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect&) { }
+    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect&);
 
     // These calls return false always. They are saying that the layers associated with this client
     // (the clipLayer and scrollLayer) should never show debugging info.
@@ -236,7 +240,9 @@ private:
     void detachRootPlatformLayer();
     
     void rootLayerAttachmentChanged();
-    
+
+    void updateOverflowControlsLayers();
+
     void scheduleNeedsStyleRecalc(Element*);
     void notifyIFramesOfCompositingChange();
 
@@ -246,7 +252,7 @@ private:
     bool requiresCompositingForVideo(RenderObject*) const;
     bool requiresCompositingForCanvas(RenderObject*) const;
     bool requiresCompositingForPlugin(RenderObject*) const;
-    bool requiresCompositingForIFrame(RenderObject*) const;
+    bool requiresCompositingForFrame(RenderObject*) const;
     bool requiresCompositingWhenDescendantsAreCompositing(RenderObject*) const;
     bool requiresCompositingForFullScreen(RenderObject*) const;
 
@@ -256,7 +262,10 @@ private:
 #endif
 
     bool requiresScrollLayer(RootLayerAttachment) const;
-    
+    bool requiresHorizontalScrollbarLayer() const;
+    bool requiresVerticalScrollbarLayer() const;
+    bool requiresScrollCornerLayer() const;
+
 private:
     RenderView* m_renderView;
     OwnPtr<GraphicsLayer> m_rootPlatformLayer;
@@ -284,7 +293,14 @@ private:
     // Enclosing clipping layer for iframe content
     OwnPtr<GraphicsLayer> m_clipLayer;
     OwnPtr<GraphicsLayer> m_scrollLayer;
-    
+
+    // Enclosing layer for overflow controls and the clipping layer
+    OwnPtr<GraphicsLayer> m_overflowControlsHostLayer;
+
+    // Layers for overflow controls
+    OwnPtr<GraphicsLayer> m_layerForHorizontalScrollbar;
+    OwnPtr<GraphicsLayer> m_layerForVerticalScrollbar;
+    OwnPtr<GraphicsLayer> m_layerForScrollCorner;
 #if PROFILE_LAYER_REBUILD
     int m_rootLayerUpdateCount;
 #endif
diff --git a/Source/WebCore/rendering/RenderLineBoxList.cpp b/Source/WebCore/rendering/RenderLineBoxList.cpp
index 9a40baf..32f133c 100644
--- a/Source/WebCore/rendering/RenderLineBoxList.cpp
+++ b/Source/WebCore/rendering/RenderLineBoxList.cpp
@@ -177,10 +177,12 @@ bool RenderLineBoxList::anyLineIntersectsRect(RenderBoxModelObject* renderer, co
     // intersect.  This is a quick short-circuit that we can take to avoid walking any lines.
     // FIXME: This check is flawed in the following extremely obscure way:
     // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    int firstLineTop = firstLineBox()->logicalTopVisualOverflow();
+    RootInlineBox* firstRootBox = firstLineBox()->root();
+    RootInlineBox* lastRootBox = lastLineBox()->root();
+    int firstLineTop = firstLineBox()->logicalTopVisualOverflow(firstRootBox->lineTop());
     if (usePrintRect && !firstLineBox()->parent())
         firstLineTop = min(firstLineTop, firstLineBox()->root()->lineTop());
-    int lastLineBottom = lastLineBox()->logicalBottomVisualOverflow();
+    int lastLineBottom = lastLineBox()->logicalBottomVisualOverflow(lastRootBox->lineBottom());
     if (usePrintRect && !lastLineBox()->parent())
         lastLineBottom = max(lastLineBottom, lastLineBox()->root()->lineBottom());
     int logicalTop = firstLineTop - outlineSize;
@@ -191,8 +193,9 @@ bool RenderLineBoxList::anyLineIntersectsRect(RenderBoxModelObject* renderer, co
 
 bool RenderLineBoxList::lineIntersectsDirtyRect(RenderBoxModelObject* renderer, InlineFlowBox* box, const PaintInfo& paintInfo, int tx, int ty) const
 {
-    int logicalTop = min(box->logicalTopVisualOverflow(), box->root()->selectionTop()) - renderer->maximalOutlineSize(paintInfo.phase);
-    int logicalBottom = box->logicalBottomVisualOverflow() + renderer->maximalOutlineSize(paintInfo.phase);
+    RootInlineBox* root = box->root();
+    int logicalTop = min(box->logicalTopVisualOverflow(root->lineTop()), root->selectionTop()) - renderer->maximalOutlineSize(paintInfo.phase);
+    int logicalBottom = box->logicalBottomVisualOverflow(root->lineBottom()) + renderer->maximalOutlineSize(paintInfo.phase);
     
     return rangeIntersectsRect(renderer, logicalTop, logicalBottom, paintInfo.rect, tx, ty);
 }
@@ -231,17 +234,18 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, PaintInfo& paintIn
             // FIXME: This is the deprecated pagination model that is still needed
             // for embedded views inside AppKit.  AppKit is incapable of paginating vertical
             // text pages, so we don't have to deal with vertical lines at all here.
-            int topForPaginationCheck = curr->minYVisualOverflow();
-            int bottomForPaginationCheck = curr->maxYVisualOverflow();
+            RootInlineBox* root = curr->root();
+            int topForPaginationCheck = curr->logicalTopVisualOverflow(root->lineTop());
+            int bottomForPaginationCheck = curr->logicalLeftVisualOverflow();
             if (!curr->parent()) {
                 // We're a root box.  Use lineTop and lineBottom as well here.
-                topForPaginationCheck = min(topForPaginationCheck, curr->root()->lineTop());
-                bottomForPaginationCheck = max(bottomForPaginationCheck, curr->root()->lineBottom());
+                topForPaginationCheck = min(topForPaginationCheck, root->lineTop());
+                bottomForPaginationCheck = max(bottomForPaginationCheck, root->lineBottom());
             }
             if (bottomForPaginationCheck - topForPaginationCheck <= v->printRect().height()) {
                 if (ty + bottomForPaginationCheck > v->printRect().maxY()) {
                     if (RootInlineBox* nextRootBox = curr->root()->nextRootBox())
-                        bottomForPaginationCheck = min(bottomForPaginationCheck, min(nextRootBox->minYVisualOverflow(), nextRootBox->lineTop()));
+                        bottomForPaginationCheck = min(bottomForPaginationCheck, min(nextRootBox->logicalTopVisualOverflow(), nextRootBox->lineTop()));
                 }
                 if (ty + bottomForPaginationCheck > v->printRect().maxY()) {
                     if (ty + topForPaginationCheck < v->truncatedAt())
@@ -253,8 +257,10 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, PaintInfo& paintIn
             }
         }
 
-        if (lineIntersectsDirtyRect(renderer, curr, info, tx, ty))
-            curr->paint(info, tx, ty);
+        if (lineIntersectsDirtyRect(renderer, curr, info, tx, ty)) {
+            RootInlineBox* root = curr->root();
+            curr->paint(info, tx, ty, root->lineTop(), root->lineBottom());
+        }
     }
 
     if (info.phase == PaintPhaseOutline || info.phase == PaintPhaseSelfOutline || info.phase == PaintPhaseChildOutlines) {
@@ -293,8 +299,9 @@ bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestReq
     // them further.  Note that boxes can easily overlap, so we can't make any assumptions
     // based off positions of our first line box or our last line box.
     for (InlineFlowBox* curr = lastLineBox(); curr; curr = curr->prevLineBox()) {
-        if (rangeIntersectsRect(renderer, curr->logicalTopVisualOverflow(), curr->logicalBottomVisualOverflow(), rect, tx, ty)) {
-            bool inside = curr->nodeAtPoint(request, result, x, y, tx, ty);
+        RootInlineBox* root = curr->root();
+        if (rangeIntersectsRect(renderer, curr->logicalTopVisualOverflow(root->lineTop()), curr->logicalBottomVisualOverflow(root->lineBottom()), rect, tx, ty)) {
+            bool inside = curr->nodeAtPoint(request, result, x, y, tx, ty, root->lineTop(), root->lineBottom());
             if (inside) {
                 renderer->updateHitTestResult(result, IntPoint(x - tx, y - ty));
                 return true;
@@ -310,8 +317,11 @@ void RenderLineBoxList::dirtyLinesFromChangedChild(RenderObject* container, Rend
     if (!container->parent() || (container->isRenderBlock() && (container->selfNeedsLayout() || !container->isBlockFlow())))
         return;
 
+    RenderInline* inlineContainer = container->isRenderInline() ? toRenderInline(container) : 0;
+    InlineBox* firstBox = inlineContainer ? inlineContainer->firstLineBoxIncludingCulling() : firstLineBox();
+
     // If we have no first line box, then just bail early.
-    if (!firstLineBox()) {
+    if (!firstBox) {
         // For an empty inline, go ahead and propagate the check up to our parent, unless the parent
         // is already dirty.
         if (container->isInline() && !container->parent()->selfNeedsLayout())
@@ -337,16 +347,16 @@ void RenderLineBoxList::dirtyLinesFromChangedChild(RenderObject* container, Rend
             if (textBox)
                 box = textBox->root();
         } else if (curr->isRenderInline()) {
-            InlineFlowBox* flowBox = toRenderInline(curr)->lastLineBox();
-            if (flowBox)
-                box = flowBox->root();
+            InlineBox* lastSiblingBox = toRenderInline(curr)->lastLineBoxIncludingCulling();
+            if (lastSiblingBox)
+                box = lastSiblingBox->root();
         }
 
         if (box)
             break;
     }
     if (!box)
-        box = firstLineBox()->root();
+        box = firstBox->root();
 
     // If we found a line box, then dirty it.
     if (box) {
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index ab3a832..d7798d5 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -273,14 +273,28 @@ void RenderListBox::paintObject(PaintInfo& paintInfo, int tx, int ty)
     // Paint the children.
     RenderBlock::paintObject(paintInfo, tx, ty);
 
-    if (paintInfo.phase == PaintPhaseBlockBackground)
-        paintScrollbar(paintInfo, tx, ty);
-    else if (paintInfo.phase == PaintPhaseChildBlockBackground || paintInfo.phase == PaintPhaseChildBlockBackgrounds) {
+    switch (paintInfo.phase) {
+    // Depending on whether we have overlay scrollbars they
+    // get rendered in the foreground or background phases
+    case PaintPhaseForeground:
+        if (m_vBar->isOverlayScrollbar())
+            paintScrollbar(paintInfo, tx, ty);
+        break;
+    case PaintPhaseBlockBackground:
+        if (!m_vBar->isOverlayScrollbar())
+            paintScrollbar(paintInfo, tx, ty);
+        break;
+    case PaintPhaseChildBlockBackground:
+    case PaintPhaseChildBlockBackgrounds: {
         int index = m_indexOffset;
         while (index < listItemsSize && index <= m_indexOffset + numVisibleItems()) {
             paintItemBackground(paintInfo, tx, ty, index);
             index++;
         }
+        break;
+    }
+    default:
+        break;
     }
 }
 
@@ -599,7 +613,7 @@ void RenderListBox::scrollTo(int newOffset)
 
     m_indexOffset = newOffset;
     repaint();
-    node()->document()->eventQueue()->enqueueScrollEvent(node(), EventQueue::ScrollEventElementTarget);
+    node()->document()->eventQueue()->enqueueOrDispatchScrollEvent(node(), EventQueue::ScrollEventElementTarget);
 }
 
 int RenderListBox::itemHeight() const
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index 0e2cfd6..d2de4a5 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -53,6 +53,8 @@ public:
 
     int scrollToward(const IntPoint&); // Returns the new index or -1 if no scroll occurred
 
+    int size() const;
+
 private:
     virtual const char* renderName() const { return "RenderListBox"; }
 
@@ -102,7 +104,9 @@ private:
     virtual void setScrollOffset(const IntPoint&);
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
     virtual bool isActive() const;
-    virtual bool scrollbarCornerPresent() const { return false; } // We don't support resize on list boxes yet.  If we did this would have to change.
+    virtual bool isScrollCornerVisible() const { return false; } // We don't support resize on list boxes yet. If we did these would have to change.
+    virtual IntRect scrollCornerRect() const { return IntRect(); }
+    virtual void invalidateScrollCornerRect(const IntRect&) { }
     virtual IntRect convertFromScrollbarToContainingView(const Scrollbar*, const IntRect&) const;
     virtual IntRect convertFromContainingViewToScrollbar(const Scrollbar*, const IntRect&) const;
     virtual IntPoint convertFromScrollbarToContainingView(const Scrollbar*, const IntPoint&) const;
@@ -125,7 +129,6 @@ private:
     
     int itemHeight() const;
     void valueChanged(unsigned listIndex);
-    int size() const;
     int numVisibleItems() const;
     int numItems() const;
     int listHeight() const;
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index 5cfb522..eaf68e6 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -264,6 +264,10 @@ void RenderListItem::positionListMarker()
         int markerLogicalLeft;
         RootInlineBox* root = m_marker->inlineBoxWrapper()->root();
         bool hitSelfPaintingLayer = false;
+        
+        RootInlineBox* rootBox = m_marker->inlineBoxWrapper()->root();
+        int lineTop = rootBox->lineTop();
+        int lineBottom = rootBox->lineBottom();
 
         // FIXME: Need to account for relative positioning in the layout overflow.
         if (style()->isLeftToRightDirection()) {
@@ -271,21 +275,21 @@ void RenderListItem::positionListMarker()
             markerLogicalLeft = leftLineOffset - lineOffset - paddingStart() - borderStart() + m_marker->marginStart();
             m_marker->inlineBoxWrapper()->adjustLineDirectionPosition(markerLogicalLeft - markerOldLogicalLeft);
             for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
-                IntRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect();
-                IntRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect();
+                IntRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect(lineTop, lineBottom);
+                IntRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect(lineTop, lineBottom);
                 if (markerLogicalLeft < newLogicalVisualOverflowRect.x() && !hitSelfPaintingLayer) {
+                    newLogicalVisualOverflowRect.setWidth(newLogicalVisualOverflowRect.maxX() - markerLogicalLeft);
                     newLogicalVisualOverflowRect.setX(markerLogicalLeft);
-                    newLogicalVisualOverflowRect.setWidth(box->logicalRightVisualOverflow() - newLogicalVisualOverflowRect.x());
                     if (box == root)
                         adjustOverflow = true;
                 }
                 if (markerLogicalLeft < newLogicalLayoutOverflowRect.x()) {
+                    newLogicalLayoutOverflowRect.setWidth(newLogicalLayoutOverflowRect.maxX() - markerLogicalLeft);
                     newLogicalLayoutOverflowRect.setX(markerLogicalLeft);
-                    newLogicalLayoutOverflowRect.setWidth(box->logicalRightLayoutOverflow() - newLogicalLayoutOverflowRect.x());
                     if (box == root)
                         adjustOverflow = true;
                 }
-                box->setOverflowFromLogicalRects(newLogicalLayoutOverflowRect, newLogicalVisualOverflowRect);
+                box->setOverflowFromLogicalRects(newLogicalLayoutOverflowRect, newLogicalVisualOverflowRect, lineTop, lineBottom);
                 if (box->boxModelObject()->hasSelfPaintingLayer())
                     hitSelfPaintingLayer = true;
             }
@@ -295,19 +299,19 @@ void RenderListItem::positionListMarker()
             markerLogicalLeft = rightLineOffset - lineOffset + paddingStart() + borderStart() + m_marker->marginEnd();
             m_marker->inlineBoxWrapper()->adjustLineDirectionPosition(markerLogicalLeft - markerOldLogicalLeft);
             for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
-                IntRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect();
-                IntRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect();
+                IntRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect(lineTop, lineBottom);
+                IntRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect(lineTop, lineBottom);
                 if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalVisualOverflowRect.maxX() && !hitSelfPaintingLayer) {
-                    newLogicalVisualOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - box->logicalLeftVisualOverflow());
+                    newLogicalVisualOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - newLogicalVisualOverflowRect.x());
                     if (box == root)
                         adjustOverflow = true;
                 }
                 if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalLayoutOverflowRect.maxX()) {
-                    newLogicalLayoutOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - box->logicalLeftLayoutOverflow());
+                    newLogicalLayoutOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - newLogicalLayoutOverflowRect.x());
                     if (box == root)
                         adjustOverflow = true;
                 }
-                box->setOverflowFromLogicalRects(newLogicalLayoutOverflowRect, newLogicalVisualOverflowRect);
+                box->setOverflowFromLogicalRects(newLogicalLayoutOverflowRect, newLogicalVisualOverflowRect, lineTop, lineBottom);
                 
                 if (box->boxModelObject()->hasSelfPaintingLayer())
                     hitSelfPaintingLayer = true;
diff --git a/Source/WebCore/rendering/RenderMedia.cpp b/Source/WebCore/rendering/RenderMedia.cpp
index 69d71ec..3f56865 100644
--- a/Source/WebCore/rendering/RenderMedia.cpp
+++ b/Source/WebCore/rendering/RenderMedia.cpp
@@ -29,22 +29,18 @@
 #include "RenderMedia.h"
 
 #include "HTMLMediaElement.h"
-#include "MediaControlElements.h"
-#include "MediaControls.h"
 #include "RenderView.h"
 
 namespace WebCore {
 
 RenderMedia::RenderMedia(HTMLMediaElement* video)
     : RenderImage(video)
-    , m_controls(new MediaControls(video))
 {
     setImageResource(RenderImageResource::create());
 }
 
 RenderMedia::RenderMedia(HTMLMediaElement* video, const IntSize& intrinsicSize)
     : RenderImage(video)
-    , m_controls(new MediaControls(video))
 {
     setImageResource(RenderImageResource::create());
     setIntrinsicSize(intrinsicSize);
@@ -54,32 +50,21 @@ RenderMedia::~RenderMedia()
 {
 }
 
-void RenderMedia::destroy()
-{
-    m_controls->destroy();
-    RenderImage::destroy();
-}
-
 HTMLMediaElement* RenderMedia::mediaElement() const
 { 
     return static_cast<HTMLMediaElement*>(node()); 
 }
 
-void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
-{
-    RenderImage::styleDidChange(diff, oldStyle);
-    m_controls->updateStyle();
-}
-
 void RenderMedia::layout()
 {
     IntSize oldSize = contentBoxRect().size();
 
     RenderImage::layout();
 
-    RenderBox* controlsRenderer = m_controls->renderBox();
+    RenderBox* controlsRenderer = toRenderBox(m_children.firstChild());
     if (!controlsRenderer)
         return;
+
     IntSize newSize = contentBoxRect().size();
     if (newSize == oldSize && !controlsRenderer->needsLayout())
         return;
@@ -99,11 +84,6 @@ void RenderMedia::layout()
     statePusher.pop();
 }
 
-void RenderMedia::updateFromElement()
-{
-    m_controls->update();
-}
-
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/rendering/RenderMedia.h b/Source/WebCore/rendering/RenderMedia.h
index 7658ef6..78e36c4 100644
--- a/Source/WebCore/rendering/RenderMedia.h
+++ b/Source/WebCore/rendering/RenderMedia.h
@@ -33,7 +33,6 @@
 namespace WebCore {
 
 class HTMLMediaElement;
-class MediaControls;
 
 class RenderMedia : public RenderImage {
 public:
@@ -45,9 +44,6 @@ public:
     RenderObjectChildList* children() { return &m_children; }
 
     HTMLMediaElement* mediaElement() const;
-    MediaControls* controls() const;
-
-    virtual void updateFromElement();
 
 protected:
     virtual void layout();
@@ -56,18 +52,12 @@ private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
 
-    virtual void destroy();
-    
     virtual const char* renderName() const { return "RenderMedia"; }
     virtual bool isMedia() const { return true; }
     virtual bool isImage() const { return false; }
 
-
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-
     virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
 
-    OwnPtr<MediaControls> m_controls;
     RenderObjectChildList m_children;
 };
 
@@ -77,11 +67,6 @@ inline RenderMedia* toRenderMedia(RenderObject* object)
     return static_cast<RenderMedia*>(object);
 }
 
-inline MediaControls* RenderMedia::controls() const
-{
-    return m_controls.get();
-}
-
 // This will catch anyone doing an unnecessary cast.
 void toRenderMedia(const RenderMedia*);
 
diff --git a/Source/WebCore/rendering/RenderMediaControls.cpp b/Source/WebCore/rendering/RenderMediaControls.cpp
index dd58cd2..928b5b8 100644
--- a/Source/WebCore/rendering/RenderMediaControls.cpp
+++ b/Source/WebCore/rendering/RenderMediaControls.cpp
@@ -32,6 +32,7 @@
 #include "GraphicsContext.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "PaintInfo.h"
 #include "RenderTheme.h"
 
 // FIXME: Unify more of the code for Mac and Win.
diff --git a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
index 71fca91..40ee9b0 100644
--- a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -242,28 +242,6 @@ static bool paintMediaTimelineContainer(RenderObject* object, const PaintInfo& p
     return true;
 }
 
-bool RenderMediaControlsChromium::shouldRenderMediaControlPart(ControlPart part, Element* e)
-{
-    UNUSED_PARAM(e);
-
-    switch (part) {
-    case MediaMuteButtonPart:
-    case MediaPlayButtonPart:
-    case MediaSliderPart:
-    case MediaSliderThumbPart:
-    case MediaVolumeSliderContainerPart:
-    case MediaVolumeSliderPart:
-    case MediaVolumeSliderThumbPart:
-    case MediaControlsBackgroundPart:
-    case MediaCurrentTimePart:
-    case MediaTimeRemainingPart:
-        return true;
-    default:
-        ;
-    }
-    return false;
-}
-
 bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     switch (part) {
diff --git a/Source/WebCore/rendering/RenderMediaControlsChromium.h b/Source/WebCore/rendering/RenderMediaControlsChromium.h
index 060a9d4..895ac43 100644
--- a/Source/WebCore/rendering/RenderMediaControlsChromium.h
+++ b/Source/WebCore/rendering/RenderMediaControlsChromium.h
@@ -36,7 +36,6 @@ namespace WebCore {
 class HTMLMediaElement;
 class RenderMediaControlsChromium {
 public:
-    static bool shouldRenderMediaControlPart(ControlPart, Element*);
     static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const PaintInfo&, const IntRect&);
     static void adjustMediaSliderThumbSize(RenderObject*);
 };
diff --git a/Source/WebCore/rendering/RenderMeter.cpp b/Source/WebCore/rendering/RenderMeter.cpp
index f3ada0b..683bcc4 100644
--- a/Source/WebCore/rendering/RenderMeter.cpp
+++ b/Source/WebCore/rendering/RenderMeter.cpp
@@ -35,98 +35,13 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-class MeterPartElement : public ShadowBlockElement {
-public:
-    static PassRefPtr<MeterPartElement> createForPart(HTMLElement*, PseudoId);
-
-    void hide();
-    void restoreVisibility();
-
-    virtual void updateStyleForPart(PseudoId);
-
-private:
-    MeterPartElement(HTMLElement*);
-    void saveVisibility();
-
-    EVisibility m_originalVisibility;
-};
-
-MeterPartElement::MeterPartElement(HTMLElement* shadowParent)
-    : ShadowBlockElement(shadowParent)
-{
-}
-
-PassRefPtr<MeterPartElement> MeterPartElement::createForPart(HTMLElement* shadowParent, PseudoId pseudoId)
-{
-    RefPtr<MeterPartElement> ret = adoptRef(new MeterPartElement(shadowParent));
-    ret->initAsPart(pseudoId);
-    ret->saveVisibility();
-    return ret;
-}
-
-void MeterPartElement::hide()
-{
-    if (renderer())
-        renderer()->style()->setVisibility(HIDDEN);
-}
-
-void MeterPartElement::restoreVisibility()
-{
-    if (renderer())
-        renderer()->style()->setVisibility(m_originalVisibility);
-}
-
-void MeterPartElement::updateStyleForPart(PseudoId pseudoId)
-{
-    if (renderer()->style()->styleType() == pseudoId)
-        return;
-
-    ShadowBlockElement::updateStyleForPart(pseudoId);
-    saveVisibility();
-}
-
-void MeterPartElement::saveVisibility()
-{
-    m_originalVisibility = renderer()->style()->visibility();
-}
-
 RenderMeter::RenderMeter(HTMLMeterElement* element)
-    : RenderIndicator(element)
+    : RenderBlock(element)
 {
 }
 
 RenderMeter::~RenderMeter()
 {
-    if (shadowAttached()) {
-        m_verticalValuePart->detach();
-        m_verticalBarPart->detach();
-        m_horizontalValuePart->detach();
-        m_horizontalBarPart->detach();
-    }
-}
-
-PassRefPtr<MeterPartElement> RenderMeter::createPart(PseudoId pseudoId)
-{
-    RefPtr<MeterPartElement> element = MeterPartElement::createForPart(toHTMLElement(node()), pseudoId);
-    if (element->renderer())
-        addChild(element->renderer());
-    return element;
-}
-
-void RenderMeter::updateFromElement()
-{
-    if (!shadowAttached()) {
-        m_horizontalBarPart = createPart(barPseudoId(HORIZONTAL));
-        m_horizontalValuePart = createPart(valuePseudoId(HORIZONTAL));
-        m_verticalBarPart = createPart(barPseudoId(VERTICAL));
-        m_verticalValuePart = createPart(valuePseudoId(VERTICAL));
-    }
-
-    m_horizontalBarPart->updateStyleForPart(barPseudoId(HORIZONTAL));
-    m_horizontalValuePart->updateStyleForPart(valuePseudoId(HORIZONTAL));
-    m_verticalBarPart->updateStyleForPart(barPseudoId(VERTICAL));
-    m_verticalValuePart->updateStyleForPart(valuePseudoId(VERTICAL));
-    RenderIndicator::updateFromElement();
 }
 
 void RenderMeter::computeLogicalWidth()
@@ -141,119 +56,9 @@ void RenderMeter::computeLogicalHeight()
     setHeight(theme()->meterSizeForBounds(this, frameRect()).height());
 }
 
-void RenderMeter::layoutParts()
-{
-    m_horizontalBarPart->layoutAsPart(barPartRect());
-    m_horizontalValuePart->layoutAsPart(valuePartRect(HORIZONTAL));
-    m_verticalBarPart->layoutAsPart(barPartRect());
-    m_verticalValuePart->layoutAsPart(valuePartRect(VERTICAL));
-
-    if (shouldHaveParts()) {
-        if (HORIZONTAL == orientation()) {
-            m_verticalBarPart->hide();
-            m_verticalValuePart->hide();
-            m_horizontalBarPart->restoreVisibility();
-            m_horizontalValuePart->restoreVisibility();
-        } else {
-            m_verticalBarPart->restoreVisibility();
-            m_verticalValuePart->restoreVisibility();
-            m_horizontalBarPart->hide();
-            m_horizontalValuePart->hide();
-        }
-    } else {
-        m_verticalBarPart->hide();
-        m_verticalValuePart->hide();
-        m_horizontalBarPart->hide();
-        m_horizontalValuePart->hide();
-    }
-}
-
-bool RenderMeter::shouldHaveParts() const
-{
-    EBoxOrient currentOrientation = orientation();
-    bool hasTheme = theme()->supportsMeter(style()->appearance(), HORIZONTAL == currentOrientation);
-    if (!hasTheme)
-        return true;
-    bool shadowsHaveStyle = ShadowBlockElement::partShouldHaveStyle(this, barPseudoId(currentOrientation)) || ShadowBlockElement::partShouldHaveStyle(this, valuePseudoId(currentOrientation));
-    if (shadowsHaveStyle)
-        return true;
-    return false;
-}
-
 double RenderMeter::valueRatio() const
 {
-    HTMLMeterElement* element = static_cast<HTMLMeterElement*>(node());
-    double min = element->min();
-    double max = element->max();
-    double value = element->value();
-
-    if (max <= min)
-        return 0;
-    return (value - min) / (max - min);
-}
-
-IntRect RenderMeter::barPartRect() const
-{
-    return IntRect(borderLeft() + paddingLeft(), borderTop() + paddingTop(), lround(width() - borderLeft() - paddingLeft() - borderRight() - paddingRight()), height()  - borderTop() - paddingTop() - borderBottom() - paddingBottom());
-}
-
-IntRect RenderMeter::valuePartRect(EBoxOrient asOrientation) const
-{
-    IntRect rect = barPartRect();
-    
-    if (HORIZONTAL == asOrientation) {
-        int width = static_cast<int>(rect.width()*valueRatio());
-        if (!style()->isLeftToRightDirection()) {
-            rect.setX(rect.x() + (rect.width() - width));
-            rect.setWidth(width);
-        } else
-            rect.setWidth(width);
-    } else {
-        int height = static_cast<int>(rect.height()*valueRatio());
-        rect.setY(rect.y() + (rect.height() - height));
-        rect.setHeight(height);
-    }
-
-    return rect;
-}
-
-EBoxOrient RenderMeter::orientation() const
-{
-    IntRect rect = barPartRect();
-    return rect.height() <= rect.width() ? HORIZONTAL : VERTICAL;
-}
-
-PseudoId RenderMeter::valuePseudoId(EBoxOrient asOrientation) const
-{
-    HTMLMeterElement* element = static_cast<HTMLMeterElement*>(node());
-
-    if (HORIZONTAL == asOrientation) {
-        switch (element->gaugeRegion()) {
-        case HTMLMeterElement::GaugeRegionOptimum:
-            return METER_HORIZONTAL_OPTIMUM;
-        case HTMLMeterElement::GaugeRegionSuboptimal:
-            return METER_HORIZONTAL_SUBOPTIMAL;
-        case HTMLMeterElement::GaugeRegionEvenLessGood:
-            return METER_HORIZONTAL_EVEN_LESS_GOOD;
-        }
-    } else {
-        switch (element->gaugeRegion()) {
-        case HTMLMeterElement::GaugeRegionOptimum:
-            return METER_VERTICAL_OPTIMUM;
-        case HTMLMeterElement::GaugeRegionSuboptimal:
-            return METER_VERTICAL_SUBOPTIMAL;
-        case HTMLMeterElement::GaugeRegionEvenLessGood:
-            return METER_VERTICAL_EVEN_LESS_GOOD;
-        }
-    }
-
-    ASSERT_NOT_REACHED();
-    return NOPSEUDO;
-}
-
-PseudoId RenderMeter::barPseudoId(EBoxOrient asOrientation) const
-{
-    return HORIZONTAL == asOrientation ? METER_HORIZONTAL_BAR : METER_VERTICAL_BAR;
+    return static_cast<HTMLMeterElement*>(node())->valueRatio();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderMeter.h b/Source/WebCore/rendering/RenderMeter.h
index 2f5f5f5..12ab6ba 100644
--- a/Source/WebCore/rendering/RenderMeter.h
+++ b/Source/WebCore/rendering/RenderMeter.h
@@ -23,44 +23,28 @@
 
 #if ENABLE(METER_TAG)
 #include "RenderBlock.h"
-#include "RenderIndicator.h"
 #include "RenderWidget.h"
 
 
 namespace WebCore {
 
 class HTMLMeterElement;
-class MeterPartElement;
 
-class RenderMeter : public RenderIndicator {
+class RenderMeter : public RenderBlock {
 public:
     RenderMeter(HTMLMeterElement*);
     virtual ~RenderMeter();
 
 private:
-    virtual const char* renderName() const { return "RenderMeter"; }
-    virtual bool isMeter() const { return true; }
-    virtual void updateFromElement();
     virtual void computeLogicalWidth();
     virtual void computeLogicalHeight();
 
-    virtual void layoutParts();
-
-    bool shadowAttached() const { return m_horizontalBarPart; }
-    IntRect valuePartRect(EBoxOrient) const;
-    PseudoId valuePseudoId(EBoxOrient) const;
-    IntRect barPartRect() const;
-    PseudoId barPseudoId(EBoxOrient) const;
-    EBoxOrient orientation() const;
+    virtual const char* renderName() const { return "RenderMeter"; }
+    virtual bool isMeter() const { return true; }
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+    virtual bool canHaveChildren() const { return false; }
 
     double valueRatio() const;
-    bool shouldHaveParts() const;
-    PassRefPtr<MeterPartElement> createPart(PseudoId);
-
-    RefPtr<MeterPartElement> m_horizontalBarPart;
-    RefPtr<MeterPartElement> m_horizontalValuePart;
-    RefPtr<MeterPartElement> m_verticalBarPart;
-    RefPtr<MeterPartElement> m_verticalValuePart;
 };
 
 inline RenderMeter* toRenderMeter(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index 7cc6f1f..b050539 100644
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -707,10 +707,10 @@ bool RenderObject::mustRepaintBackgroundOrBorder() const
 }
 
 void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1, int y1, int x2, int y2,
-                                      BoxSide s, Color c, EBorderStyle style,
-                                      int adjbw1, int adjbw2)
+                                      BoxSide side, Color color, EBorderStyle style,
+                                      int adjacentWidth1, int adjacentWidth2, bool antialias)
 {
-    int width = (s == BSTop || s == BSBottom ? y2 - y1 : x2 - x1);
+    int width = (side == BSTop || side == BSBottom ? y2 - y1 : x2 - x1);
 
     if (style == DOUBLE && width < 3)
         style = SOLID;
@@ -721,12 +721,15 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             return;
         case DOTTED:
         case DASHED:
-            graphicsContext->setStrokeColor(c, m_style->colorSpace());
+            graphicsContext->setStrokeColor(color, m_style->colorSpace());
             graphicsContext->setStrokeThickness(width);
             graphicsContext->setStrokeStyle(style == DASHED ? DashedStroke : DottedStroke);
 
-            if (width > 0)
-                switch (s) {
+            if (width > 0) {
+                bool wasAntialiased = graphicsContext->shouldAntialias();
+                graphicsContext->setShouldAntialias(antialias);
+
+                switch (side) {
                     case BSBottom:
                     case BSTop:
                         graphicsContext->drawLine(IntPoint(x1, (y1 + y2) / 2), IntPoint(x2, (y1 + y2) / 2));
@@ -736,14 +739,20 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
                         graphicsContext->drawLine(IntPoint((x1 + x2) / 2, y1), IntPoint((x1 + x2) / 2, y2));
                         break;
                 }
+                graphicsContext->setShouldAntialias(wasAntialiased);
+            }
             break;
         case DOUBLE: {
             int third = (width + 1) / 3;
 
-            if (adjbw1 == 0 && adjbw2 == 0) {
+            if (adjacentWidth1 == 0 && adjacentWidth2 == 0) {
                 graphicsContext->setStrokeStyle(NoStroke);
-                graphicsContext->setFillColor(c, m_style->colorSpace());
-                switch (s) {
+                graphicsContext->setFillColor(color, m_style->colorSpace());
+                
+                bool wasAntialiased = graphicsContext->shouldAntialias();
+                graphicsContext->setShouldAntialias(antialias);
+
+                switch (side) {
                     case BSTop:
                     case BSBottom:
                         graphicsContext->drawRect(IntRect(x1, y1, x2 - x1, third));
@@ -758,42 +767,44 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
                         graphicsContext->drawRect(IntRect(x2 - third, y1 + 1, third, y2 - y1 - 1));
                         break;
                 }
+
+                graphicsContext->setShouldAntialias(wasAntialiased);
             } else {
-                int adjbw1bigthird = ((adjbw1 > 0) ? adjbw1 + 1 : adjbw1 - 1) / 3;
-                int adjbw2bigthird = ((adjbw2 > 0) ? adjbw2 + 1 : adjbw2 - 1) / 3;
+                int adjacent1BigThird = ((adjacentWidth1 > 0) ? adjacentWidth1 + 1 : adjacentWidth1 - 1) / 3;
+                int adjacent2BigThird = ((adjacentWidth2 > 0) ? adjacentWidth2 + 1 : adjacentWidth2 - 1) / 3;
 
-                switch (s) {
+                switch (side) {
                     case BSTop:
-                        drawLineForBoxSide(graphicsContext, x1 + max((-adjbw1 * 2 + 1) / 3, 0),
-                                   y1, x2 - max((-adjbw2 * 2 + 1) / 3, 0), y1 + third,
-                                   s, c, SOLID, adjbw1bigthird, adjbw2bigthird);
-                        drawLineForBoxSide(graphicsContext, x1 + max((adjbw1 * 2 + 1) / 3, 0),
-                                   y2 - third, x2 - max((adjbw2 * 2 + 1) / 3, 0), y2,
-                                   s, c, SOLID, adjbw1bigthird, adjbw2bigthird);
+                        drawLineForBoxSide(graphicsContext, x1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
+                                   y1, x2 - max((-adjacentWidth2 * 2 + 1) / 3, 0), y1 + third,
+                                   side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
+                        drawLineForBoxSide(graphicsContext, x1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
+                                   y2 - third, x2 - max((adjacentWidth2 * 2 + 1) / 3, 0), y2,
+                                   side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         break;
                     case BSLeft:
-                        drawLineForBoxSide(graphicsContext, x1, y1 + max((-adjbw1 * 2 + 1) / 3, 0),
-                                   x1 + third, y2 - max((-adjbw2 * 2 + 1) / 3, 0),
-                                   s, c, SOLID, adjbw1bigthird, adjbw2bigthird);
-                        drawLineForBoxSide(graphicsContext, x2 - third, y1 + max((adjbw1 * 2 + 1) / 3, 0),
-                                   x2, y2 - max((adjbw2 * 2 + 1) / 3, 0),
-                                   s, c, SOLID, adjbw1bigthird, adjbw2bigthird);
+                        drawLineForBoxSide(graphicsContext, x1, y1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
+                                   x1 + third, y2 - max((-adjacentWidth2 * 2 + 1) / 3, 0),
+                                   side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
+                        drawLineForBoxSide(graphicsContext, x2 - third, y1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
+                                   x2, y2 - max((adjacentWidth2 * 2 + 1) / 3, 0),
+                                   side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         break;
                     case BSBottom:
-                        drawLineForBoxSide(graphicsContext, x1 + max((adjbw1 * 2 + 1) / 3, 0),
-                                   y1, x2 - max((adjbw2 * 2 + 1) / 3, 0), y1 + third,
-                                   s, c, SOLID, adjbw1bigthird, adjbw2bigthird);
-                        drawLineForBoxSide(graphicsContext, x1 + max((-adjbw1 * 2 + 1) / 3, 0),
-                                   y2 - third, x2 - max((-adjbw2 * 2 + 1) / 3, 0), y2,
-                                   s, c, SOLID, adjbw1bigthird, adjbw2bigthird);
+                        drawLineForBoxSide(graphicsContext, x1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
+                                   y1, x2 - max((adjacentWidth2 * 2 + 1) / 3, 0), y1 + third,
+                                   side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
+                        drawLineForBoxSide(graphicsContext, x1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
+                                   y2 - third, x2 - max((-adjacentWidth2 * 2 + 1) / 3, 0), y2,
+                                   side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         break;
                     case BSRight:
-                        drawLineForBoxSide(graphicsContext, x1, y1 + max((adjbw1 * 2 + 1) / 3, 0),
-                                   x1 + third, y2 - max((adjbw2 * 2 + 1) / 3, 0),
-                                   s, c, SOLID, adjbw1bigthird, adjbw2bigthird);
-                        drawLineForBoxSide(graphicsContext, x2 - third, y1 + max((-adjbw1 * 2 + 1) / 3, 0),
-                                   x2, y2 - max((-adjbw2 * 2 + 1) / 3, 0),
-                                   s, c, SOLID, adjbw1bigthird, adjbw2bigthird);
+                        drawLineForBoxSide(graphicsContext, x1, y1 + max((adjacentWidth1 * 2 + 1) / 3, 0),
+                                   x1 + third, y2 - max((adjacentWidth2 * 2 + 1) / 3, 0),
+                                   side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
+                        drawLineForBoxSide(graphicsContext, x2 - third, y1 + max((-adjacentWidth1 * 2 + 1) / 3, 0),
+                                   x2, y2 - max((-adjacentWidth2 * 2 + 1) / 3, 0),
+                                   side, color, SOLID, adjacent1BigThird, adjacent2BigThird, antialias);
                         break;
                     default:
                         break;
@@ -802,8 +813,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             break;
         }
         case RIDGE:
-        case GROOVE:
-        {
+        case GROOVE: {
             EBorderStyle s1;
             EBorderStyle s2;
             if (style == GROOVE) {
@@ -814,82 +824,90 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
                 s2 = INSET;
             }
 
-            int adjbw1bighalf = ((adjbw1 > 0) ? adjbw1 + 1 : adjbw1 - 1) / 2;
-            int adjbw2bighalf = ((adjbw2 > 0) ? adjbw2 + 1 : adjbw2 - 1) / 2;
+            int adjacent1BigHalf = ((adjacentWidth1 > 0) ? adjacentWidth1 + 1 : adjacentWidth1 - 1) / 2;
+            int adjacent2BigHalf = ((adjacentWidth2 > 0) ? adjacentWidth2 + 1 : adjacentWidth2 - 1) / 2;
 
-            switch (s) {
+            switch (side) {
                 case BSTop:
-                    drawLineForBoxSide(graphicsContext, x1 + max(-adjbw1, 0) / 2, y1, x2 - max(-adjbw2, 0) / 2, (y1 + y2 + 1) / 2,
-                               s, c, s1, adjbw1bighalf, adjbw2bighalf);
-                    drawLineForBoxSide(graphicsContext, x1 + max(adjbw1 + 1, 0) / 2, (y1 + y2 + 1) / 2, x2 - max(adjbw2 + 1, 0) / 2, y2,
-                               s, c, s2, adjbw1 / 2, adjbw2 / 2);
+                    drawLineForBoxSide(graphicsContext, x1 + max(-adjacentWidth1, 0) / 2, y1, x2 - max(-adjacentWidth2, 0) / 2, (y1 + y2 + 1) / 2,
+                               side, color, s1, adjacent1BigHalf, adjacent2BigHalf, antialias);
+                    drawLineForBoxSide(graphicsContext, x1 + max(adjacentWidth1 + 1, 0) / 2, (y1 + y2 + 1) / 2, x2 - max(adjacentWidth2 + 1, 0) / 2, y2,
+                               side, color, s2, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
                     break;
                 case BSLeft:
-                    drawLineForBoxSide(graphicsContext, x1, y1 + max(-adjbw1, 0) / 2, (x1 + x2 + 1) / 2, y2 - max(-adjbw2, 0) / 2,
-                               s, c, s1, adjbw1bighalf, adjbw2bighalf);
-                    drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2, y1 + max(adjbw1 + 1, 0) / 2, x2, y2 - max(adjbw2 + 1, 0) / 2,
-                               s, c, s2, adjbw1 / 2, adjbw2 / 2);
+                    drawLineForBoxSide(graphicsContext, x1, y1 + max(-adjacentWidth1, 0) / 2, (x1 + x2 + 1) / 2, y2 - max(-adjacentWidth2, 0) / 2,
+                               side, color, s1, adjacent1BigHalf, adjacent2BigHalf, antialias);
+                    drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2, y1 + max(adjacentWidth1 + 1, 0) / 2, x2, y2 - max(adjacentWidth2 + 1, 0) / 2,
+                               side, color, s2, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
                     break;
                 case BSBottom:
-                    drawLineForBoxSide(graphicsContext, x1 + max(adjbw1, 0) / 2, y1, x2 - max(adjbw2, 0) / 2, (y1 + y2 + 1) / 2,
-                               s, c, s2, adjbw1bighalf, adjbw2bighalf);
-                    drawLineForBoxSide(graphicsContext, x1 + max(-adjbw1 + 1, 0) / 2, (y1 + y2 + 1) / 2, x2 - max(-adjbw2 + 1, 0) / 2, y2,
-                               s, c, s1, adjbw1 / 2, adjbw2 / 2);
+                    drawLineForBoxSide(graphicsContext, x1 + max(adjacentWidth1, 0) / 2, y1, x2 - max(adjacentWidth2, 0) / 2, (y1 + y2 + 1) / 2,
+                               side, color, s2, adjacent1BigHalf, adjacent2BigHalf, antialias);
+                    drawLineForBoxSide(graphicsContext, x1 + max(-adjacentWidth1 + 1, 0) / 2, (y1 + y2 + 1) / 2, x2 - max(-adjacentWidth2 + 1, 0) / 2, y2,
+                               side, color, s1, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
                     break;
                 case BSRight:
-                    drawLineForBoxSide(graphicsContext, x1, y1 + max(adjbw1, 0) / 2, (x1 + x2 + 1) / 2, y2 - max(adjbw2, 0) / 2,
-                               s, c, s2, adjbw1bighalf, adjbw2bighalf);
-                    drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2, y1 + max(-adjbw1 + 1, 0) / 2, x2, y2 - max(-adjbw2 + 1, 0) / 2,
-                               s, c, s1, adjbw1 / 2, adjbw2 / 2);
+                    drawLineForBoxSide(graphicsContext, x1, y1 + max(adjacentWidth1, 0) / 2, (x1 + x2 + 1) / 2, y2 - max(adjacentWidth2, 0) / 2,
+                               side, color, s2, adjacent1BigHalf, adjacent2BigHalf, antialias);
+                    drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2, y1 + max(-adjacentWidth1 + 1, 0) / 2, x2, y2 - max(-adjacentWidth2 + 1, 0) / 2,
+                               side, color, s1, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
                     break;
             }
             break;
         }
         case INSET:
-            if (s == BSTop || s == BSLeft)
-                c = c.dark();
+            // FIXME: Maybe we should lighten the colors on one side like Firefox.
+            // https://bugs.webkit.org/show_bug.cgi?id=58608
+            if (side == BSTop || side == BSLeft)
+                color = color.dark();
             // fall through
         case OUTSET:
-            if (style == OUTSET && (s == BSBottom || s == BSRight))
-                c = c.dark();
+            if (style == OUTSET && (side == BSBottom || side == BSRight))
+                color = color.dark();
             // fall through
         case SOLID: {
             graphicsContext->setStrokeStyle(NoStroke);
-            graphicsContext->setFillColor(c, m_style->colorSpace());
+            graphicsContext->setFillColor(color, m_style->colorSpace());
             ASSERT(x2 >= x1);
             ASSERT(y2 >= y1);
-            if (!adjbw1 && !adjbw2) {
+            if (!adjacentWidth1 && !adjacentWidth2) {
+                // Turn off antialiasing to match the behavior of drawConvexPolygon();
+                // this matters for rects in transformed contexts.
+                bool wasAntialiased = graphicsContext->shouldAntialias();
+                graphicsContext->setShouldAntialias(antialias);
                 graphicsContext->drawRect(IntRect(x1, y1, x2 - x1, y2 - y1));
+                graphicsContext->setShouldAntialias(wasAntialiased);
                 return;
             }
             FloatPoint quad[4];
-            switch (s) {
+            switch (side) {
                 case BSTop:
-                    quad[0] = FloatPoint(x1 + max(-adjbw1, 0), y1);
-                    quad[1] = FloatPoint(x1 + max(adjbw1, 0), y2);
-                    quad[2] = FloatPoint(x2 - max(adjbw2, 0), y2);
-                    quad[3] = FloatPoint(x2 - max(-adjbw2, 0), y1);
+                    quad[0] = FloatPoint(x1 + max(-adjacentWidth1, 0), y1);
+                    quad[1] = FloatPoint(x1 + max(adjacentWidth1, 0), y2);
+                    quad[2] = FloatPoint(x2 - max(adjacentWidth2, 0), y2);
+                    quad[3] = FloatPoint(x2 - max(-adjacentWidth2, 0), y1);
                     break;
                 case BSBottom:
-                    quad[0] = FloatPoint(x1 + max(adjbw1, 0), y1);
-                    quad[1] = FloatPoint(x1 + max(-adjbw1, 0), y2);
-                    quad[2] = FloatPoint(x2 - max(-adjbw2, 0), y2);
-                    quad[3] = FloatPoint(x2 - max(adjbw2, 0), y1);
+                    quad[0] = FloatPoint(x1 + max(adjacentWidth1, 0), y1);
+                    quad[1] = FloatPoint(x1 + max(-adjacentWidth1, 0), y2);
+                    quad[2] = FloatPoint(x2 - max(-adjacentWidth2, 0), y2);
+                    quad[3] = FloatPoint(x2 - max(adjacentWidth2, 0), y1);
                     break;
                 case BSLeft:
-                    quad[0] = FloatPoint(x1, y1 + max(-adjbw1, 0));
-                    quad[1] = FloatPoint(x1, y2 - max(-adjbw2, 0));
-                    quad[2] = FloatPoint(x2, y2 - max(adjbw2, 0));
-                    quad[3] = FloatPoint(x2, y1 + max(adjbw1, 0));
+                    quad[0] = FloatPoint(x1, y1 + max(-adjacentWidth1, 0));
+                    quad[1] = FloatPoint(x1, y2 - max(-adjacentWidth2, 0));
+                    quad[2] = FloatPoint(x2, y2 - max(adjacentWidth2, 0));
+                    quad[3] = FloatPoint(x2, y1 + max(adjacentWidth1, 0));
                     break;
                 case BSRight:
-                    quad[0] = FloatPoint(x1, y1 + max(adjbw1, 0));
-                    quad[1] = FloatPoint(x1, y2 - max(adjbw2, 0));
-                    quad[2] = FloatPoint(x2, y2 - max(-adjbw2, 0));
-                    quad[3] = FloatPoint(x2, y1 + max(-adjbw1, 0));
+                    quad[0] = FloatPoint(x1, y1 + max(adjacentWidth1, 0));
+                    quad[1] = FloatPoint(x1, y2 - max(adjacentWidth2, 0));
+                    quad[2] = FloatPoint(x2, y2 - max(-adjacentWidth2, 0));
+                    quad[3] = FloatPoint(x2, y1 + max(-adjacentWidth1, 0));
                     break;
             }
-            graphicsContext->drawConvexPolygon(4, quad);
+
+            graphicsContext->drawConvexPolygon(4, quad, antialias);
             break;
         }
     }
@@ -904,156 +922,9 @@ IntRect RenderObject::borderInnerRect(const IntRect& borderRect, unsigned short
             borderRect.height() - topWidth - bottomWidth);
 }
 
-#if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
-void RenderObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, const IntRect& borderRect, const Path& borderPath,
-                                    float thickness, float drawThickness, BoxSide s, const RenderStyle* style, 
-                                    Color c, EBorderStyle borderStyle)
-{
-    if (thickness <= 0)
-        return;
-
-    if (borderStyle == DOUBLE && thickness < 3)
-        borderStyle = SOLID;
-
-    switch (borderStyle) {
-    case BNONE:
-    case BHIDDEN:
-        return;
-    case DOTTED:
-    case DASHED: {
-        graphicsContext->setStrokeColor(c, style->colorSpace());
-
-        // The stroke is doubled here because the provided path is the 
-        // outside edge of the border so half the stroke is clipped off. 
-        // The extra multiplier is so that the clipping mask can antialias
-        // the edges to prevent jaggies.
-        graphicsContext->setStrokeThickness(drawThickness * 2 * 1.1f);
-        graphicsContext->setStrokeStyle(borderStyle == DASHED ? DashedStroke : DottedStroke);
-
-        // If the number of dashes that fit in the path is odd and non-integral then we
-        // will have an awkwardly-sized dash at the end of the path. To try to avoid that
-        // here, we simply make the whitespace dashes ever so slightly bigger.
-        // FIXME: This could be even better if we tried to manipulate the dash offset
-        // and possibly the whiteSpaceWidth to get the corners dash-symmetrical.
-        float patWidth = thickness * ((borderStyle == DASHED) ? 3.0f : 1.0f);
-        float whiteSpaceWidth = patWidth;
-        float numberOfDashes = borderPath.length() / patWidth;
-        bool evenNumberOfFullDashes = !((int)numberOfDashes % 2);
-        bool integralNumberOfDashes = !(numberOfDashes - (int)numberOfDashes);
-        if (!evenNumberOfFullDashes && !integralNumberOfDashes) {
-            float numberOfWhitespaceDashes = numberOfDashes / 2;
-            whiteSpaceWidth += (patWidth  / numberOfWhitespaceDashes);
-        }
-
-        DashArray lineDash;
-        lineDash.append(patWidth);
-        lineDash.append(whiteSpaceWidth);
-        graphicsContext->setLineDash(lineDash, patWidth);
-        graphicsContext->strokePath(borderPath);
-        return;
-    }
-    case DOUBLE: {
-        int outerBorderTopWidth = style->borderTopWidth() / 3;
-        int outerBorderRightWidth = style->borderRightWidth() / 3;
-        int outerBorderBottomWidth = style->borderBottomWidth() / 3;
-        int outerBorderLeftWidth = style->borderLeftWidth() / 3;
-
-        int innerBorderTopWidth = style->borderTopWidth() * 2 / 3;
-        int innerBorderRightWidth = style->borderRightWidth() * 2 / 3;
-        int innerBorderBottomWidth = style->borderBottomWidth() * 2 / 3;
-        int innerBorderLeftWidth = style->borderLeftWidth() * 2 / 3;
-
-        // We need certain integer rounding results
-        if (style->borderTopWidth() % 3 == 2)
-            outerBorderTopWidth += 1;
-        if (style->borderRightWidth() % 3 == 2)
-            outerBorderRightWidth += 1;
-        if (style->borderBottomWidth() % 3 == 2)
-            outerBorderBottomWidth += 1;
-        if (style->borderLeftWidth() % 3 == 2)
-            outerBorderLeftWidth += 1;
-
-        if (style->borderTopWidth() % 3 == 1)
-            innerBorderTopWidth += 1;
-        if (style->borderRightWidth() % 3 == 1)
-            innerBorderRightWidth += 1;
-        if (style->borderBottomWidth() % 3 == 1)
-            innerBorderBottomWidth += 1;
-        if (style->borderLeftWidth() % 3 == 1)
-            innerBorderLeftWidth += 1;
-
-        // Get the inner border rects for both the outer border line and the inner border line
-
-        // Draw inner border line
-        graphicsContext->save();
-        IntRect innerBorderInnerRect = borderInnerRect(borderRect, innerBorderTopWidth, innerBorderBottomWidth, 
-                                                       innerBorderLeftWidth, innerBorderRightWidth);
-        RoundedIntRect innerClip = style->getRoundedInnerBorderWithBorderWidths(innerBorderInnerRect, innerBorderTopWidth, innerBorderBottomWidth,
-                                                                                innerBorderLeftWidth, innerBorderRightWidth);
-        graphicsContext->addRoundedRectClip(innerClip);
-        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, thickness, drawThickness, s, style, c, SOLID);
-        graphicsContext->restore();
-
-        // Draw outer border line
-        graphicsContext->save();
-        IntRect outerBorderInnerRect = borderInnerRect(borderRect, outerBorderTopWidth, outerBorderBottomWidth, 
-                                                       outerBorderLeftWidth, outerBorderRightWidth);
-        RoundedIntRect outerClip = style->getRoundedInnerBorderWithBorderWidths(outerBorderInnerRect, outerBorderTopWidth, outerBorderBottomWidth, 
-                                                                                outerBorderLeftWidth, outerBorderRightWidth);
-        graphicsContext->clipOutRoundedRect(outerClip);
-        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, thickness, drawThickness, s, style, c, SOLID);
-        graphicsContext->restore();
-
-        return;
-    }
-    case RIDGE:
-    case GROOVE:
-    {
-        EBorderStyle s1;
-        EBorderStyle s2;
-        if (borderStyle == GROOVE) {
-            s1 = INSET;
-            s2 = OUTSET;
-        } else {
-            s1 = OUTSET;
-            s2 = INSET;
-        }
-
-        IntRect halfBorderRect = borderInnerRect(borderRect, style->borderLeftWidth() / 2, style->borderBottomWidth() / 2, 
-            style->borderLeftWidth() / 2, style->borderRightWidth() / 2);
-
-        // Paint full border
-        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, thickness, drawThickness, s, style, c, s1);
-
-        // Paint inner only
-        graphicsContext->save();
-        RoundedIntRect clipRect = style->getRoundedInnerBorderWithBorderWidths(halfBorderRect, style->borderLeftWidth() / 2, style->borderBottomWidth() / 2, 
-                                                                               style->borderLeftWidth() / 2, style->borderRightWidth() / 2);
-        graphicsContext->addRoundedRectClip(clipRect);
-        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, thickness, drawThickness, s, style, c, s2);
-        graphicsContext->restore();
-
-        return;
-    }
-    case INSET:
-        if (s == BSTop || s == BSLeft)
-            c = c.dark();
-        break;
-    case OUTSET:
-        if (s == BSBottom || s == BSRight)
-            c = c.dark();
-        break;
-    default:
-        break;
-    }
-
-    graphicsContext->setStrokeStyle(NoStroke);
-    graphicsContext->setFillColor(c, style->colorSpace());
-    graphicsContext->drawRect(borderRect);
-}
-#else
+#if !HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
 void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, int y, float thickness, const IntSize& radius,
-                                     int angleStart, int angleSpan, BoxSide s, Color c,
+                                     int angleStart, int angleSpan, BoxSide s, Color color,
                                      EBorderStyle style, bool firstCorner)
 {
     // FIXME: This function should be removed when all ports implement GraphicsContext::clipConvexPolygon()!!
@@ -1067,7 +938,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             return;
         case DOTTED:
         case DASHED:
-            graphicsContext->setStrokeColor(c, m_style->colorSpace());
+            graphicsContext->setStrokeColor(color, m_style->colorSpace());
             graphicsContext->setStrokeStyle(style == DOTTED ? DottedStroke : DashedStroke);
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
@@ -1089,7 +960,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             }
 
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c, m_style->colorSpace());
+            graphicsContext->setStrokeColor(color, m_style->colorSpace());
             graphicsContext->setStrokeThickness(third);
             graphicsContext->strokeArc(IntRect(x, outerY, radius.width() * 2, outerHeight), angleStart, angleSpan);
             graphicsContext->setStrokeThickness(innerThird > 2 ? innerThird - 1 : innerThird);
@@ -1101,14 +972,14 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             Color c2;
             if ((style == RIDGE && (s == BSTop || s == BSLeft)) ||
                     (style == GROOVE && (s == BSBottom || s == BSRight)))
-                c2 = c.dark();
+                c2 = color.dark();
             else {
-                c2 = c;
-                c = c.dark();
+                c2 = color;
+                color = color.dark();
             }
 
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c, m_style->colorSpace());
+            graphicsContext->setStrokeColor(color, m_style->colorSpace());
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
 
@@ -1122,13 +993,13 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
         }
         case INSET:
             if (s == BSTop || s == BSLeft)
-                c = c.dark();
+                color = color.dark();
         case OUTSET:
             if (style == OUTSET && (s == BSBottom || s == BSRight))
-                c = c.dark();
+                color = color.dark();
         case SOLID:
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c, m_style->colorSpace());
+            graphicsContext->setStrokeColor(color, m_style->colorSpace());
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
             break;
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 41564dd..cf4d61b 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -37,7 +37,7 @@
 #include "TransformationMatrix.h"
 #include <wtf/UnusedParam.h>
 
-#if PLATFORM(CG) || PLATFORM(CAIRO) || PLATFORM(QT)
+#if USE(CG) || USE(CAIRO) || PLATFORM(QT)
 #define HAVE_PATH_BASED_BORDER_RADIUS_DRAWING 1
 #endif
 
@@ -79,13 +79,12 @@ enum HitTestAction {
     HitTestForeground
 };
 
-// Sides used when drawing borders and outlines.  This is in RenderObject rather than RenderBoxModelObject since outlines can
-// be drawn by SVG around bounding boxes.
+// Sides used when drawing borders and outlines. The values should run clockwise from top.
 enum BoxSide {
     BSTop,
+    BSRight,
     BSBottom,
-    BSLeft,
-    BSRight
+    BSLeft
 };
 
 const int caretWidth = 1;
@@ -433,13 +432,9 @@ public:
     bool hasTransform() const { return m_hasTransform; }
     bool hasMask() const { return style() && style()->hasMask(); }
 
-    void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
-                            Color, EBorderStyle, int adjbw1, int adjbw2);
-#if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
-    void drawBoxSideFromPath(GraphicsContext*, const IntRect&, const Path&,
-                            float thickness, float drawThickness, BoxSide, const RenderStyle*, 
-                            Color, EBorderStyle);
-#else
+    inline bool preservesNewline() const;
+
+#if !HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
     // FIXME: This function should be removed when all ports implement GraphicsContext::clipConvexPolygon()!!
     // At that time, everyone can use RenderObject::drawBoxSideFromPath() instead. This should happen soon.
     void drawArcForBoxSide(GraphicsContext*, int x, int y, float thickness, const IntSize& radius, int angleStart,
@@ -782,6 +777,9 @@ protected:
     // Overrides should call the superclass at the start
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
+                            Color, EBorderStyle, int adjbw1, int adjbw2, bool antialias = false);
+
     void paintFocusRing(GraphicsContext*, int tx, int ty, RenderStyle*);
     void paintOutline(GraphicsContext*, int tx, int ty, int w, int h);
     void addPDFURLRect(GraphicsContext*, const IntRect&);
@@ -958,8 +956,9 @@ inline void RenderObject::setChildNeedsLayout(bool b, bool markParents)
 
 inline void RenderObject::setNeedsPositionedMovementLayout()
 {
-    bool alreadyNeededLayout = needsLayout();
+    bool alreadyNeededLayout = m_needsPositionedMovementLayout;
     m_needsPositionedMovementLayout = true;
+    ASSERT(!isSetNeedsLayoutForbidden());
     if (!alreadyNeededLayout) {
         markContainingBlocksForLayout();
         if (hasLayer())
@@ -969,8 +968,9 @@ inline void RenderObject::setNeedsPositionedMovementLayout()
 
 inline void RenderObject::setNeedsSimplifiedNormalFlowLayout()
 {
-    bool alreadyNeededLayout = needsLayout();
+    bool alreadyNeededLayout = m_needsSimplifiedNormalFlowLayout;
     m_needsSimplifiedNormalFlowLayout = true;
+    ASSERT(!isSetNeedsLayoutForbidden());
     if (!alreadyNeededLayout) {
         markContainingBlocksForLayout();
         if (hasLayer())
@@ -1037,6 +1037,16 @@ inline void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, R
         last->scheduleRelayout();
 }
 
+inline bool RenderObject::preservesNewline() const
+{
+#if ENABLE(SVG)
+    if (isSVGInlineText())
+        return false;
+#endif
+        
+    return style()->preserveNewline();
+}
+
 inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)
 {
 #if !ENABLE(3D_RENDERING)
@@ -1079,6 +1089,33 @@ inline void adjustFloatRectForAbsoluteZoom(FloatRect& rect, RenderObject* render
     rect.setHeight(adjustFloatForAbsoluteZoom(rect.height(), style));
 }
 
+inline FloatPoint adjustFloatPointForPageScale(const FloatPoint& point, float pageScale)
+{
+    if (pageScale == 1)
+        return point;
+    return FloatPoint(point.x() / pageScale, point.y() / pageScale);
+}
+
+inline void adjustFloatQuadForPageScale(FloatQuad& quad, float pageScale)
+{
+    if (pageScale == 1)
+        return;
+    quad.setP1(adjustFloatPointForPageScale(quad.p1(), pageScale));
+    quad.setP2(adjustFloatPointForPageScale(quad.p2(), pageScale));
+    quad.setP3(adjustFloatPointForPageScale(quad.p3(), pageScale));
+    quad.setP4(adjustFloatPointForPageScale(quad.p4(), pageScale));
+}
+
+inline void adjustFloatRectForPageScale(FloatRect& rect, float pageScale)
+{
+    if (pageScale == 1)
+        return;
+    rect.setX(rect.x() / pageScale);
+    rect.setY(rect.y() / pageScale);
+    rect.setWidth(rect.width() / pageScale);
+    rect.setHeight(rect.height() / pageScale);
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index 617067a..e26f221 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -456,6 +456,12 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                 ASSERT(styledObject->node()); // The styled object cannot be anonymous or else it could not have ':before' or ':after' pseudo elements.
                 generatedContentContainer->setNode(styledObject->node()); // This allows access to the generatingNode.
                 generatedContentContainer->setStyle(pseudoElementStyle);
+                if (!owner->isChildAllowed(generatedContentContainer, pseudoElementStyle)) {
+                    // The generated content container is not allowed here -> abort.
+                    generatedContentContainer->destroy();
+                    renderer->destroy();
+                    return;
+                }
                 owner->addChild(generatedContentContainer, insertBefore);
             }
             if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))
diff --git a/Source/WebCore/rendering/RenderPart.cpp b/Source/WebCore/rendering/RenderPart.cpp
index 3262961..59b9795 100644
--- a/Source/WebCore/rendering/RenderPart.cpp
+++ b/Source/WebCore/rendering/RenderPart.cpp
@@ -24,10 +24,11 @@
 #include "config.h"
 #include "RenderPart.h"
 
-#include "RenderView.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "HTMLFrameElementBase.h"
+#include "PluginViewBase.h"
+#include "RenderView.h"
 
 namespace WebCore {
 
@@ -58,4 +59,35 @@ void RenderPart::viewCleared()
 {
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+bool RenderPart::requiresLayer() const
+{
+    if (RenderWidget::requiresLayer())
+        return true;
+    
+    return requiresAcceleratedCompositing();
+}
+
+bool RenderPart::requiresAcceleratedCompositing() const
+{
+    // There are two general cases in which we can return true. First, if this is a plugin 
+    // renderer and the plugin has a layer, then we need a layer. Second, if this is 
+    // a renderer with a contentDocument and that document needs a layer, then we need
+    // a layer.
+    if (widget() && widget()->isPluginViewBase() && static_cast<PluginViewBase*>(widget())->platformLayer())
+        return true;
+
+    if (!node() || !node()->isFrameOwnerElement())
+        return false;
+
+    HTMLFrameOwnerElement* element = static_cast<HTMLFrameOwnerElement*>(node());
+    if (Document* contentDocument = element->contentDocument()) {
+        if (RenderView* view = contentDocument->renderView())
+            return view->usesCompositing();
+    }
+
+    return false;
+}
+#endif
+
 }
diff --git a/Source/WebCore/rendering/RenderPart.h b/Source/WebCore/rendering/RenderPart.h
index 18f2346..9a22b30 100644
--- a/Source/WebCore/rendering/RenderPart.h
+++ b/Source/WebCore/rendering/RenderPart.h
@@ -36,6 +36,15 @@ public:
     virtual void setWidget(PassRefPtr<Widget>);
     virtual void viewCleared();
 
+#if USE(ACCELERATED_COMPOSITING)
+    bool requiresAcceleratedCompositing() const;
+#endif
+
+protected:
+#if USE(ACCELERATED_COMPOSITING)
+    virtual bool requiresLayer() const;
+#endif
+
 private:
     virtual bool isRenderPart() const { return true; }
     virtual const char* renderName() const { return "RenderPart"; }
diff --git a/Source/WebCore/rendering/RenderProgress.cpp b/Source/WebCore/rendering/RenderProgress.cpp
index 2a8e6f3..f687589 100644
--- a/Source/WebCore/rendering/RenderProgress.cpp
+++ b/Source/WebCore/rendering/RenderProgress.cpp
@@ -36,19 +36,9 @@ using namespace std;
 
 namespace WebCore {
 
-IntRect RenderProgressBarValuePart::preferredFrameRect()
-{
-    return toRenderProgress(parent())->valuePartRect();
-}
-
-bool RenderProgressBarValuePart::shouldBeHidden()
-{
-    return !toRenderProgress(parent())->shouldHaveParts();
-}
-
 RenderProgress::RenderProgress(HTMLProgressElement* element)
-    : RenderIndicator(element)
-    , m_position(-1)
+    : RenderBlock(element)
+    , m_position(HTMLProgressElement::InvalidPosition)
     , m_animationStartTime(0)
     , m_animationRepeatInterval(0)
     , m_animationDuration(0)
@@ -69,7 +59,7 @@ void RenderProgress::updateFromElement()
     m_position = element->position();
 
     updateAnimationState();
-    RenderIndicator::updateFromElement();
+    RenderBlock::updateFromElement();
 }
 
 double RenderProgress::animationProgress() const
@@ -79,36 +69,15 @@ double RenderProgress::animationProgress() const
 
 bool RenderProgress::isDeterminate() const
 {
-    return 0 <= position();
+    return (HTMLProgressElement::IndeterminatePosition != position()
+            && HTMLProgressElement::InvalidPosition != position());
 }
 
 void RenderProgress::animationTimerFired(Timer<RenderProgress>*)
 {
     repaint();
-}
-
-void RenderProgress::paint(PaintInfo& paintInfo, int tx, int ty)
-{
-    if (paintInfo.phase == PaintPhaseBlockBackground) {
-        if (!m_animationTimer.isActive() && m_animating)
-            m_animationTimer.startOneShot(m_animationRepeatInterval);
-    }
-
-    RenderIndicator::paint(paintInfo, tx, ty);
-}
-
-void RenderProgress::layoutParts()
-{
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling())
-        child->layout();
-    updateAnimationState();
-}
-
-bool RenderProgress::shouldHaveParts() const
-{
-    if (!style()->hasAppearance())
-        return true;
-    return false;
+    if (!m_animationTimer.isActive() && m_animating)
+        m_animationTimer.startOneShot(m_animationRepeatInterval);
 }
 
 void RenderProgress::updateAnimationState()
@@ -128,14 +97,6 @@ void RenderProgress::updateAnimationState()
         m_animationTimer.stop();
 }
 
-IntRect RenderProgress::valuePartRect() const
-{
-    IntRect rect(borderLeft() + paddingLeft(), borderTop() + paddingTop(), lround((width() - borderLeft() - paddingLeft() - borderRight() - paddingRight()) * position()), height()  - borderTop() - paddingTop() - borderBottom() - paddingBottom());
-    if (!style()->isLeftToRightDirection())
-        rect.setX(width() - borderRight() - paddingRight() - rect.width());
-    return rect;
-}
-
 HTMLProgressElement* RenderProgress::progressElement() const
 {
     return static_cast<HTMLProgressElement*>(node());
diff --git a/Source/WebCore/rendering/RenderProgress.h b/Source/WebCore/rendering/RenderProgress.h
index 78cf359..62436fd 100644
--- a/Source/WebCore/rendering/RenderProgress.h
+++ b/Source/WebCore/rendering/RenderProgress.h
@@ -23,21 +23,12 @@
 
 #if ENABLE(PROGRESS_TAG)
 #include "RenderBlock.h"
-#include "RenderIndicator.h"
 
 namespace WebCore {
 
 class HTMLProgressElement;
 
-class RenderProgressBarValuePart : public RenderIndicatorPart {
-public:
-    RenderProgressBarValuePart(Node* node) : RenderIndicatorPart(node) {}
-private:
-    virtual IntRect preferredFrameRect();
-    virtual bool shouldBeHidden();
-};
-
-class RenderProgress : public RenderIndicator {
+class RenderProgress : public RenderBlock {
 public:
     RenderProgress(HTMLProgressElement*);
     virtual ~RenderProgress();
@@ -47,17 +38,15 @@ public:
     double animationStartTime() const { return m_animationStartTime; }
 
     bool isDeterminate() const;
-    IntRect valuePartRect() const;
-    bool shouldHaveParts() const;
 
     HTMLProgressElement* progressElement() const;
 
 private:
     virtual const char* renderName() const { return "RenderProgress"; }
     virtual bool isProgress() const { return true; }
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+    virtual bool canHaveChildren() const { return false; }
     virtual void updateFromElement();
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual void layoutParts();
 
     void animationTimerFired(Timer<RenderProgress>*);
     void updateAnimationState();
diff --git a/Source/WebCore/rendering/RenderRuby.cpp b/Source/WebCore/rendering/RenderRuby.cpp
index 1c5cfaf..0b51384 100644
--- a/Source/WebCore/rendering/RenderRuby.cpp
+++ b/Source/WebCore/rendering/RenderRuby.cpp
@@ -33,17 +33,51 @@
 #include "RenderRuby.h"
 
 #include "RenderRubyRun.h"
+#include "RenderStyle.h"
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
 //=== generic helper functions to avoid excessive code duplication ===
 
+static inline bool isAnonymousRubyInlineBlock(RenderObject* object)
+{
+    ASSERT(!object->parent()->isRuby()
+        || object->isRubyRun()
+        || (object->isInline() && (object->isBeforeContent() || object->isAfterContent()))
+        || (object->isAnonymous() && object->isRenderBlock() && object->style()->display() == INLINE_BLOCK));
+    return object->parent()->isRuby() && object->isRenderBlock() && !object->isRubyRun();
+}
+
+static inline RenderBlock* rubyBeforeBlock(const RenderObject* ruby)
+{
+    RenderObject* child = ruby->firstChild();
+    return child && !child->isRubyRun() && child->isRenderBlock() && child->style()->styleType() == BEFORE ? static_cast<RenderBlock*>(child) : 0;
+}
+
+static inline RenderBlock* rubyAfterBlock(const RenderObject* ruby)
+{
+    RenderObject* child = ruby->lastChild();
+    return child && !child->isRubyRun() && child->isRenderBlock() && child->style()->styleType() == AFTER ? static_cast<RenderBlock*>(child) : 0;
+}
+
+static RenderBlock* createAnonymousRubyInlineBlock(RenderObject* ruby, PseudoId styleType)
+{
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(ruby->style());
+    newStyle->setDisplay(INLINE_BLOCK);
+    newStyle->setStyleType(styleType);
+    
+    RenderBlock* newBlock = new (ruby->renderArena()) RenderBlock(ruby->document() /* anonymous box */);
+    newBlock->setStyle(newStyle.release());
+    return newBlock;
+}
+
 static RenderRubyRun* lastRubyRun(const RenderObject* ruby)
 {
     RenderObject* child = ruby->lastChild();
-    if (child && ruby->isAfterContent(child))
+    if (child && !child->isRubyRun())
         child = child->previousSibling();
-    ASSERT(!child || child->isRubyRun() || child->isBeforeContent());
+    ASSERT(!child || child->isRubyRun() || child->isBeforeContent() || child == rubyBeforeBlock(ruby));
     return child && child->isRubyRun() ? static_cast<RenderRubyRun*>(child) : 0;
 }
 
@@ -65,18 +99,37 @@ RenderRubyAsInline::~RenderRubyAsInline()
 {
 }
 
-bool RenderRubyAsInline::isChildAllowed(RenderObject* child, RenderStyle*) const
-{
-    return child->isRubyText()
-        || child->isRubyRun()
-        || child->isInline();
-}
-
 void RenderRubyAsInline::addChild(RenderObject* child, RenderObject* beforeChild)
 {
-    // Insert :before and :after content outside of ruby runs.
-    if (child->isBeforeContent() || child->isAfterContent()) {
-        RenderInline::addChild(child, beforeChild);
+    // Insert :before and :after content before/after the RenderRubyRun(s)
+    if (child->isBeforeContent()) {
+        if (child->isInline()) {
+            // Add generated inline content normally
+            RenderInline::addChild(child, firstChild());
+        } else {
+            // Wrap non-inline content with an anonymous inline-block.
+            RenderBlock* beforeBlock = rubyBeforeBlock(this);
+            if (!beforeBlock) {
+                beforeBlock = createAnonymousRubyInlineBlock(this, BEFORE);
+                RenderInline::addChild(beforeBlock, firstChild());
+            }
+            beforeBlock->addChild(child);
+        }
+        return;
+    }
+    if (child->isAfterContent()) {
+        if (child->isInline()) {
+            // Add generated inline content normally
+            RenderInline::addChild(child);
+        } else {
+            // Wrap non-inline content with an anonymous inline-block.
+            RenderBlock* afterBlock = rubyAfterBlock(this);
+            if (!afterBlock) {
+                afterBlock = createAnonymousRubyInlineBlock(this, AFTER);
+                RenderInline::addChild(afterBlock);
+            }
+            afterBlock->addChild(child);
+        }
         return;
     }
 
@@ -113,15 +166,23 @@ void RenderRubyAsInline::addChild(RenderObject* child, RenderObject* beforeChild
 
 void RenderRubyAsInline::removeChild(RenderObject* child)
 {
-    // If the child's parent is *this (a ruby run or :before or :after content),
+    // If the child's parent is *this (must be a ruby run or generated content or anonymous block),
     // just use the normal remove method.
-    if (child->isRubyRun() || child->isBeforeContent() || child->isAfterContent()) {
+    if (child->parent() == this) {
+        ASSERT(child->isRubyRun() || child->isBeforeContent() || child->isAfterContent() || isAnonymousRubyInlineBlock(child));
         RenderInline::removeChild(child);
         return;
     }
+    // If the child's parent is an anoymous block (must be generated :before/:after content)
+    // just use the block's remove method.
+    if (isAnonymousRubyInlineBlock(child->parent())) {
+        ASSERT(child->isBeforeContent() || child->isAfterContent());
+        child->parent()->removeChild(child);
+        removeChild(child->parent());
+        return;
+    }
 
     // Otherwise find the containing run and remove it from there.
-    ASSERT(child->parent() != this);
     RenderRubyRun* run = findRubyRunParent(child);
     ASSERT(run);
     run->removeChild(child);
@@ -139,18 +200,37 @@ RenderRubyAsBlock::~RenderRubyAsBlock()
 {
 }
 
-bool RenderRubyAsBlock::isChildAllowed(RenderObject* child, RenderStyle*) const
-{
-    return child->isRubyText()
-        || child->isRubyRun()
-        || child->isInline();
-}
-
 void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
 {
-    // Insert :before and :after content outside of ruby runs.
-    if (child->isBeforeContent() || child->isAfterContent()) {
-        RenderBlock::addChild(child, beforeChild);
+    // Insert :before and :after content before/after the RenderRubyRun(s)
+    if (child->isBeforeContent()) {
+        if (child->isInline()) {
+            // Add generated inline content normally
+            RenderBlock::addChild(child, firstChild());
+        } else {
+            // Wrap non-inline content with an anonymous inline-block.
+            RenderBlock* beforeBlock = rubyBeforeBlock(this);
+            if (!beforeBlock) {
+                beforeBlock = createAnonymousRubyInlineBlock(this, BEFORE);
+                RenderBlock::addChild(beforeBlock, firstChild());
+            }
+            beforeBlock->addChild(child);
+        }
+        return;
+    }
+    if (child->isAfterContent()) {
+        if (child->isInline()) {
+            // Add generated inline content normally
+            RenderBlock::addChild(child);
+        } else {
+            // Wrap non-inline content with an anonymous inline-block.
+            RenderBlock* afterBlock = rubyAfterBlock(this);
+            if (!afterBlock) {
+                afterBlock = createAnonymousRubyInlineBlock(this, AFTER);
+                RenderBlock::addChild(afterBlock);
+            }
+            afterBlock->addChild(child);
+        }
         return;
     }
 
@@ -187,15 +267,23 @@ void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
 
 void RenderRubyAsBlock::removeChild(RenderObject* child)
 {
-    // If the child's parent is *this (a ruby run or :before or :after content),
+    // If the child's parent is *this (must be a ruby run or generated content or anonymous block),
     // just use the normal remove method.
-    if (child->isRubyRun() || child->isBeforeContent() || child->isAfterContent()) {
+    if (child->parent() == this) {
+        ASSERT(child->isRubyRun() || child->isBeforeContent() || child->isAfterContent() || isAnonymousRubyInlineBlock(child));
         RenderBlock::removeChild(child);
         return;
     }
+    // If the child's parent is an anoymous block (must be generated :before/:after content)
+    // just use the block's remove method.
+    if (isAnonymousRubyInlineBlock(child->parent())) {
+        ASSERT(child->isBeforeContent() || child->isAfterContent());
+        child->parent()->removeChild(child);
+        removeChild(child->parent());
+        return;
+    }
 
     // Otherwise find the containing run and remove it from there.
-    ASSERT(child->parent() != this);
     RenderRubyRun* run = findRubyRunParent(child);
     ASSERT(run);
     run->removeChild(child);
diff --git a/Source/WebCore/rendering/RenderRuby.h b/Source/WebCore/rendering/RenderRuby.h
index 49a84d8..24ac0db 100644
--- a/Source/WebCore/rendering/RenderRuby.h
+++ b/Source/WebCore/rendering/RenderRuby.h
@@ -47,6 +47,8 @@ namespace WebCore {
 //              1-n inline object(s)
 //
 // Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+//
+// Generated :before/:after content is shunted into anonymous inline blocks
 
 // <ruby> when used as 'display:inline'
 class RenderRubyAsInline : public RenderInline {
@@ -54,7 +56,6 @@ public:
     RenderRubyAsInline(Node*);
     virtual ~RenderRubyAsInline();
 
-    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject* child);
 
@@ -71,7 +72,6 @@ public:
     RenderRubyAsBlock(Node*);
     virtual ~RenderRubyAsBlock();
 
-    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject* child);
 
diff --git a/Source/WebCore/rendering/RenderRubyRun.cpp b/Source/WebCore/rendering/RenderRubyRun.cpp
index 3504ccf..1329d65 100644
--- a/Source/WebCore/rendering/RenderRubyRun.cpp
+++ b/Source/WebCore/rendering/RenderRubyRun.cpp
@@ -268,4 +268,41 @@ void RenderRubyRun::layout()
     computeOverflow(clientLogicalBottom());
 }
 
+void RenderRubyRun::getOverhang(bool firstLine, RenderObject* startRenderer, RenderObject* endRenderer, int& startOverhang, int& endOverhang) const
+{
+    ASSERT(!needsLayout());
+
+    startOverhang = 0;
+    endOverhang = 0;
+
+    RenderRubyBase* rubyBase = this->rubyBase();
+    RenderRubyText* rubyText = this->rubyText();
+
+    if (!rubyBase || !rubyText)
+        return;
+
+    if (!rubyBase->firstRootBox())
+        return;
+
+    int logicalWidth = this->logicalWidth();
+
+    // No more than half a ruby is allowed to overhang.
+    int logicalLeftOverhang = rubyText->style(firstLine)->fontSize() / 2;
+    int logicalRightOverhang = logicalLeftOverhang;
+
+    for (RootInlineBox* rootInlineBox = rubyBase->firstRootBox(); rootInlineBox; rootInlineBox = rootInlineBox->nextRootBox()) {
+        logicalLeftOverhang = min<int>(logicalLeftOverhang, rootInlineBox->logicalLeft());
+        logicalRightOverhang = min<int>(logicalRightOverhang, logicalWidth - rootInlineBox->logicalRight());
+    }
+
+    startOverhang = style()->isLeftToRightDirection() ? logicalLeftOverhang : logicalRightOverhang;
+    endOverhang = style()->isLeftToRightDirection() ? logicalRightOverhang : logicalLeftOverhang;
+
+    if (!startRenderer || !startRenderer->isText() || startRenderer->style(firstLine)->fontSize() > rubyBase->style(firstLine)->fontSize())
+        startOverhang = 0;
+
+    if (!endRenderer || !endRenderer->isText() || endRenderer->style(firstLine)->fontSize() > rubyBase->style(firstLine)->fontSize())
+        endOverhang = 0;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderRubyRun.h b/Source/WebCore/rendering/RenderRubyRun.h
index 53209bc..f65ad86 100644
--- a/Source/WebCore/rendering/RenderRubyRun.h
+++ b/Source/WebCore/rendering/RenderRubyRun.h
@@ -63,6 +63,8 @@ public:
     virtual RenderBlock* firstLineBlock() const;
     virtual void updateFirstLetter();
 
+    void getOverhang(bool firstLine, RenderObject* startRenderer, RenderObject* endRenderer, int& startOverhang, int& endOverhang) const;
+
     static RenderRubyRun* staticCreateRubyRun(const RenderObject* parentRuby);
 
 protected:
@@ -75,6 +77,20 @@ private:
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
 };
 
+inline RenderRubyRun* toRenderRubyRun(RenderObject* object)
+{
+    ASSERT(!object || object->isRubyRun());
+    return static_cast<RenderRubyRun*>(object);
+}
+
+inline const RenderRubyRun* toRenderRubyRun(const RenderObject* object)
+{
+    ASSERT(!object || object->isBox());
+    return static_cast<const RenderRubyRun*>(object);
+}
+
+void toRenderRubyRun(const RenderRubyRun*);
+
 } // namespace WebCore
 
 #endif // RenderRubyRun_h
diff --git a/Source/WebCore/rendering/RenderSlider.cpp b/Source/WebCore/rendering/RenderSlider.cpp
index 1661b7a..ad5ab1a 100644
--- a/Source/WebCore/rendering/RenderSlider.cpp
+++ b/Source/WebCore/rendering/RenderSlider.cpp
@@ -33,6 +33,7 @@
 #include "HTMLParserIdioms.h"
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
+#include "Node.h"
 #include "RenderLayer.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
@@ -101,7 +102,7 @@ void RenderSlider::computePreferredLogicalWidths()
 
 IntRect RenderSlider::thumbRect()
 {
-    SliderThumbElement* thumbElement = sliderThumbElement();
+    SliderThumbElement* thumbElement = shadowSliderThumb();
     if (!thumbElement)
         return IntRect();
 
@@ -128,7 +129,7 @@ void RenderSlider::layout()
 {
     ASSERT(needsLayout());
 
-    SliderThumbElement* thumbElement = sliderThumbElement();
+    SliderThumbElement* thumbElement = shadowSliderThumb();
     RenderBox* thumb = thumbElement ? toRenderBox(thumbElement->renderer()) : 0;
 
     IntSize baseSize(borderAndPaddingWidth(), borderAndPaddingHeight());
@@ -176,14 +177,15 @@ void RenderSlider::layout()
     setNeedsLayout(false);
 }
 
-SliderThumbElement* RenderSlider::sliderThumbElement() const
+SliderThumbElement* RenderSlider::shadowSliderThumb() const
 {
-    return toSliderThumbElement(static_cast<Element*>(node())->shadowRoot());
+    Node* shadow = static_cast<Element*>(node())->shadowRoot();
+    return shadow ? toSliderThumbElement(shadow->firstChild()) : 0;
 }
 
 bool RenderSlider::inDragMode() const
 {
-    SliderThumbElement* thumbElement = sliderThumbElement();
+    SliderThumbElement* thumbElement = shadowSliderThumb();
     return thumbElement && thumbElement->inDragMode();
 }
 
diff --git a/Source/WebCore/rendering/RenderSlider.h b/Source/WebCore/rendering/RenderSlider.h
index 0162b71..4e17f30 100644
--- a/Source/WebCore/rendering/RenderSlider.h
+++ b/Source/WebCore/rendering/RenderSlider.h
@@ -46,8 +46,8 @@ namespace WebCore {
         virtual void layout();
 
         // FIXME: Eventually, the logic of manipulating slider thumb should move to
-        // SliderThumbElement and accessing sliderThumbElement should not be necessary in this class.
-        SliderThumbElement* sliderThumbElement() const;
+        // SliderThumbElement and accessing shadowSliderThumb should not be necessary in this class.
+        SliderThumbElement* shadowSliderThumb() const;
 
         virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
     };
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index a29f218..2edcfc4 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -63,17 +63,23 @@ void RenderTableRow::styleWillChange(StyleDifference diff, const RenderStyle* ne
     RenderBox::styleWillChange(diff, newStyle);
 }
 
-void RenderTableRow::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+void RenderTableRow::updateBeforeAndAfterContent()
 {
-    RenderBox::styleDidChange(diff, oldStyle);
-
-    // Update pseudos for :before and :after now.
     if (!isAnonymous() && document()->usesBeforeAfterRules()) {
         children()->updateBeforeAfterContent(this, BEFORE);
         children()->updateBeforeAfterContent(this, AFTER);
     }
 }
 
+void RenderTableRow::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBox::styleDidChange(diff, oldStyle);
+
+    if (parent())
+        updateBeforeAndAfterContent();
+
+}
+
 void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     // Make sure we don't append things after :after-generated content if we have it.
diff --git a/Source/WebCore/rendering/RenderTableRow.h b/Source/WebCore/rendering/RenderTableRow.h
index 2af8dcb..570a7f2 100644
--- a/Source/WebCore/rendering/RenderTableRow.h
+++ b/Source/WebCore/rendering/RenderTableRow.h
@@ -39,6 +39,8 @@ public:
     RenderTableSection* section() const { return toRenderTableSection(parent()); }
     RenderTable* table() const { return toRenderTable(parent()->parent()); }
 
+    void updateBeforeAndAfterContent();
+
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 7c0a768..06d326f 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -148,6 +148,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
 
     ASSERT(!beforeChild || beforeChild->isTableRow());
     RenderBox::addChild(child, beforeChild);
+    toRenderTableRow(child)->updateBeforeAndAfterContent();
 }
 
 void RenderTableSection::removeChild(RenderObject* oldChild)
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index e660875..b35820a 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -177,7 +177,7 @@ void RenderText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyl
     }
 }
 
-void RenderText::destroy()
+void RenderText::removeAndDestroyTextBoxes()
 {
     if (!documentBeingDestroyed()) {
         if (firstTextBox()) {
@@ -192,6 +192,11 @@ void RenderText::destroy()
             parent()->dirtyLinesFromChangedChild(this);
     }
     deleteTextBoxes();
+}
+
+void RenderText::destroy()
+{
+    removeAndDestroyTextBoxes();
     RenderObject::destroy();
 }
 
@@ -268,7 +273,7 @@ PassRefPtr<StringImpl> RenderText::originalText() const
 void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
 {
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
-        rects.append(IntRect(tx + box->x(), ty + box->y(), box->logicalWidth(), box->logicalHeight()));
+        rects.append(enclosingIntRect(FloatRect(tx + box->x(), ty + box->y(), box->width(), box->height())));
 }
 
 void RenderText::absoluteRectsForRange(Vector<IntRect>& rects, unsigned start, unsigned end, bool useSelectionHeight)
@@ -1300,15 +1305,38 @@ IntRect RenderText::linesBoundingBox() const
     return result;
 }
 
-IntRect RenderText::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
+IntRect RenderText::linesVisualOverflowBoundingBox() const
 {
-    RenderObject* cb = containingBlock();
-    // The containing block may be an ancestor of repaintContainer, but we need to do a repaintContainer-relative repaint.
-    if (repaintContainer && repaintContainer != cb) {
-        if (!cb->isDescendantOf(repaintContainer))
-            return repaintContainer->clippedOverflowRectForRepaint(repaintContainer);
+    if (!firstTextBox())
+        return IntRect();
+
+    // Return the width of the minimal left side and the maximal right side.
+    int logicalLeftSide = numeric_limits<int>::max();
+    int logicalRightSide = numeric_limits<int>::min();
+    for (InlineTextBox* curr = firstTextBox(); curr; curr = curr->nextTextBox()) {
+        logicalLeftSide = min(logicalLeftSide, curr->logicalLeftVisualOverflow());
+        logicalRightSide = max(logicalRightSide, curr->logicalRightVisualOverflow());
     }
-    return cb->clippedOverflowRectForRepaint(repaintContainer);
+    
+    int logicalTop = firstTextBox()->logicalTopVisualOverflow();
+    int logicalWidth = logicalRightSide - logicalLeftSide;
+    int logicalHeight = lastTextBox()->logicalBottomVisualOverflow() - logicalTop;
+    
+    IntRect rect(logicalLeftSide, logicalTop, logicalWidth, logicalHeight);
+    if (!style()->isHorizontalWritingMode())
+        rect = rect.transposedRect();
+    return rect;
+}
+
+IntRect RenderText::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
+{
+    bool repaintContainerSkipped;
+    RenderObject* container = this->container(repaintContainer, &repaintContainerSkipped);
+    // The container may be an ancestor of repaintContainer, but we need to do a repaintContainer-relative repaint.
+    if (repaintContainerSkipped)
+        return repaintContainer->clippedOverflowRectForRepaint(repaintContainer);
+
+    return container->clippedOverflowRectForRepaint(repaintContainer);
 }
 
 IntRect RenderText::selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent)
diff --git a/Source/WebCore/rendering/RenderText.h b/Source/WebCore/rendering/RenderText.h
index 7fa3518..2008dad 100644
--- a/Source/WebCore/rendering/RenderText.h
+++ b/Source/WebCore/rendering/RenderText.h
@@ -85,6 +85,7 @@ public:
                            float& minW, float& maxW, bool& stripFrontSpaces);
 
     virtual IntRect linesBoundingBox() const;
+    IntRect linesVisualOverflowBoundingBox() const;
 
     FloatPoint firstRunOrigin() const;
     float firstRunX() const;
@@ -127,6 +128,8 @@ public:
     
     bool knownToHaveNoOverflowAndNoFallbackFonts() const { return m_knownToHaveNoOverflowAndNoFallbackFonts; }
 
+    void removeAndDestroyTextBoxes();
+
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle*) { }
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index b9697ff..c5a47fb 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -424,10 +424,6 @@ void RenderTextControlSingleLine::forwardEvent(Event* event)
         m_resultsButton->defaultEventHandler(event);
     else if (m_cancelButton && localPoint.x() > textRight)
         m_cancelButton->defaultEventHandler(event);
-    else if (m_innerSpinButton && localPoint.x() > textRight && m_innerSpinButton->renderBox() && localPoint.x() < textRight + m_innerSpinButton->renderBox()->width())
-        m_innerSpinButton->defaultEventHandler(event);
-    else if (m_outerSpinButton && localPoint.x() > textRight)
-        m_outerSpinButton->defaultEventHandler(event);
     else
         RenderTextControl::forwardEvent(event);
 }
diff --git a/Source/WebCore/rendering/RenderTheme.cpp b/Source/WebCore/rendering/RenderTheme.cpp
index f254c99..6617d18 100644
--- a/Source/WebCore/rendering/RenderTheme.cpp
+++ b/Source/WebCore/rendering/RenderTheme.cpp
@@ -485,33 +485,6 @@ bool RenderTheme::paintDecorations(RenderObject* o, const PaintInfo& paintInfo,
 }
 
 #if ENABLE(VIDEO)
-bool RenderTheme::hitTestMediaControlPart(RenderObject* o, const IntPoint& absPoint)
-{
-    if (!o->isBox())
-        return false;
-
-    FloatPoint localPoint = o->absoluteToLocal(absPoint, false, true);  // respect transforms
-    return toRenderBox(o)->borderBoxRect().contains(roundedIntPoint(localPoint));
-}
-
-bool RenderTheme::shouldRenderMediaControlPart(ControlPart part, Element* e)
-{
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(e);
-    switch (part) {
-    case MediaMuteButtonPart:
-        return mediaElement->hasAudio();
-    case MediaRewindButtonPart:
-        return mediaElement->movieLoadType() != MediaPlayer::LiveStream;
-    case MediaReturnToRealtimeButtonPart:
-        return mediaElement->movieLoadType() == MediaPlayer::LiveStream;
-    case MediaFullscreenButtonPart:
-        return mediaElement->supportsFullscreen();
-    case MediaToggleClosedCaptionsButtonPart:
-        return mediaElement->hasClosedCaptions();
-    default:
-        return true;
-    }
-}
 
 String RenderTheme::formatMediaControlsTime(float time) const
 {
@@ -968,7 +941,7 @@ IntSize RenderTheme::meterSizeForBounds(const RenderMeter*, const IntRect& bound
     return bounds.size();
 }
 
-bool RenderTheme::supportsMeter(ControlPart, bool) const
+bool RenderTheme::supportsMeter(ControlPart) const
 {
     return false;
 }
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index 53c23e3..f18e247 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -181,9 +181,10 @@ public:
 
 #if ENABLE(VIDEO)
     // Media controls
-    virtual bool hitTestMediaControlPart(RenderObject*, const IntPoint& absPoint);
-    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+    virtual bool supportsClosedCaptioning() const { return false; }
+    virtual bool hasOwnDisabledStateHandlingFor(ControlPart) const { return false; }
     virtual bool usesMediaControlStatusDisplay() { return false; }
+    virtual bool usesMediaControlVolumeSlider() const { return true; }
     virtual double mediaControlsFadeInDuration() { return 0.1; }
     virtual double mediaControlsFadeOutDuration() { return 0.3; }
     virtual String formatMediaControlsTime(float time) const;
@@ -196,7 +197,7 @@ public:
 
 #if ENABLE(METER_TAG)
     virtual IntSize meterSizeForBounds(const RenderMeter*, const IntRect&) const;
-    virtual bool supportsMeter(ControlPart, bool isHorizontal) const;
+    virtual bool supportsMeter(ControlPart) const;
 #endif
     
     virtual bool shouldShowPlaceholderWhenFocused() const { return false; }
diff --git a/Source/WebCore/rendering/RenderThemeChromiumLinux.cpp b/Source/WebCore/rendering/RenderThemeChromiumLinux.cpp
index 72ea7cb..c3f15c8 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -274,7 +274,8 @@ bool RenderThemeChromiumLinux::paintMenuList(RenderObject* o, const PaintInfo& i
     // Match Chromium Win behaviour of showing all borders if any are shown.
     extraParams.menuList.hasBorder = box->borderRight() || box->borderLeft() || box->borderTop() || box->borderBottom();
     extraParams.menuList.hasBorderRadius = o->style()->hasBorderRadius();
-    extraParams.menuList.backgroundColor = SkColorSetRGB(0xdd, 0xdd, 0xdd);
+    // Fallback to transparent if the specified color object is invalid.
+    extraParams.menuList.backgroundColor = Color::transparent;
     if (o->hasBackground())
         extraParams.menuList.backgroundColor = o->style()->visitedDependentColor(CSSPropertyBackgroundColor).rgb();
 
diff --git a/Source/WebCore/rendering/RenderThemeChromiumMac.h b/Source/WebCore/rendering/RenderThemeChromiumMac.h
index 4fd371f..dcb23dd 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumMac.h
@@ -38,16 +38,18 @@ protected:
     virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaControlsBackground(RenderObject*, const PaintInfo&, const IntRect&);
-    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual String extraMediaControlsStyleSheet();
-
+#if ENABLE(FULLSCREEN_API)
+    virtual String extraFullScreenStyleSheet();
+#endif
+  
     virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaVolumeSliderContainer(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     virtual IntPoint volumeSliderOffsetFromMuteButton(RenderBox*, const IntSize&) const;
     virtual bool usesMediaControlStatusDisplay() { return false; }
-
+    virtual bool hasOwnDisabledStateHandlingFor(ControlPart) const { return true; }
 #endif
 
     virtual bool usesTestModeFocusRingColor() const;
diff --git a/Source/WebCore/rendering/RenderThemeChromiumMac.mm b/Source/WebCore/rendering/RenderThemeChromiumMac.mm
index a7d59a9..e4a10ae 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/Source/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -105,11 +105,6 @@ void RenderThemeChromiumMac::adjustMediaSliderThumbSize(RenderObject* o) const
     RenderMediaControlsChromium::adjustMediaSliderThumbSize(o);
 }
 
-bool RenderThemeChromiumMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
-{
-    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
-}
-
 bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
@@ -135,6 +130,14 @@ String RenderThemeChromiumMac::extraMediaControlsStyleSheet()
     return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
 }
 
+#if ENABLE(FULLSCREEN_API)
+String RenderThemeChromiumMac::extraFullScreenStyleSheet()
+{
+    // FIXME: Chromium may wish to style its default media controls differently in fullscreen.
+    return String();
+}
+#endif
+
 bool RenderThemeChromiumMac::paintMediaVolumeSliderContainer(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     return true;
diff --git a/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp b/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 9691876..cafc34d 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -501,13 +501,6 @@ int RenderThemeChromiumSkia::popupInternalPaddingBottom(RenderStyle* style) cons
     return menuListInternalPadding(style, BottomPadding);
 }
 
-#if ENABLE(VIDEO)
-bool RenderThemeChromiumSkia::shouldRenderMediaControlPart(ControlPart part, Element* e)
-{
-    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
-}
-#endif
-
 // static
 void RenderThemeChromiumSkia::setDefaultFontSize(int fontSize)
 {
diff --git a/Source/WebCore/rendering/RenderThemeChromiumSkia.h b/Source/WebCore/rendering/RenderThemeChromiumSkia.h
index bf0af34..2faf064 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -123,7 +123,7 @@ class RenderThemeChromiumSkia : public RenderTheme {
 
 #if ENABLE(VIDEO)
         // Media controls
-        virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+        virtual bool hasOwnDisabledStateHandlingFor(ControlPart) const { return true; }
 #endif
 
         // Provide a way to pass the default font size from the Settings object
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index d64944b..8a17acf 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -83,7 +83,7 @@ public:
 #if ENABLE(METER_TAG)
     virtual IntSize meterSizeForBounds(const RenderMeter*, const IntRect&) const;
     virtual bool paintMeter(RenderObject*, const PaintInfo&, const IntRect&);
-    virtual bool supportsMeter(ControlPart, bool isHorizontal) const;
+    virtual bool supportsMeter(ControlPart) const;
 #endif
 
 #if ENABLE(PROGRESS_TAG)
@@ -166,8 +166,10 @@ protected:
     virtual String extraFullScreenStyleSheet();
 #endif
 
-    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+    virtual bool supportsClosedCaptioning() const { return true; }
+    virtual bool hasOwnDisabledStateHandlingFor(ControlPart) const;
     virtual bool usesMediaControlStatusDisplay();
+    virtual bool usesMediaControlVolumeSlider() const;
     virtual void adjustMediaSliderThumbSize(RenderObject*) const;
     virtual IntPoint volumeSliderOffsetFromMuteButton(RenderBox*, const IntSize&) const;
 #endif
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index 0e23c89..a6f999a 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -830,10 +830,6 @@ bool RenderThemeMac::paintMeter(RenderObject* renderObject, const PaintInfo& pai
 
     LocalCurrentGraphicsContext localContext(paintInfo.context);
 
-    // Becaue NSLevelIndicatorCell doesn't support vertical gauge, we use a portable version 
-    if (rect.width() < rect.height())
-        return RenderTheme::paintMeter(renderObject, paintInfo, rect);
-
     NSLevelIndicatorCell* cell = levelIndicatorFor(toRenderMeter(renderObject));
     paintInfo.context->save();
     [cell drawWithFrame:rect inView:documentViewFor(renderObject)];
@@ -843,7 +839,7 @@ bool RenderThemeMac::paintMeter(RenderObject* renderObject, const PaintInfo& pai
     return false;
 }
 
-bool RenderThemeMac::supportsMeter(ControlPart part, bool isHorizontal) const
+bool RenderThemeMac::supportsMeter(ControlPart part) const
 {
     switch (part) {
     case RelevancyLevelIndicatorPart:
@@ -851,7 +847,7 @@ bool RenderThemeMac::supportsMeter(ControlPart part, bool isHorizontal) const
     case RatingLevelIndicatorPart:
     case MeterPart:
     case ContinuousCapacityLevelIndicatorPart:
-        return isHorizontal;
+        return true;
     default:
         return false;
     }
@@ -1976,35 +1972,12 @@ String RenderThemeMac::extraFullScreenStyleSheet()
 }
 #endif
 
-bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* element)
+bool RenderThemeMac::hasOwnDisabledStateHandlingFor(ControlPart part) const
 {
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(element);
-    switch (part) {
-    case MediaVolumeSliderContainerPart:
-    case MediaVolumeSliderPart:
-    case MediaVolumeSliderMuteButtonPart:
-    case MediaVolumeSliderThumbPart: {
-        return mediaControllerTheme() == MediaControllerThemeQuickTime && mediaElement->hasAudio();
-    }
-    case MediaToggleClosedCaptionsButtonPart:
-        // We rely on QTKit to render captions so don't enable the button unless it will be able to do so.
-        if (!element->hasTagName(videoTag))
-            return false;
-        break;
-    case MediaRewindButtonPart:
-        if (mediaElement->isFullscreen())
-            return mediaElement->movieLoadType() == MediaPlayer::LiveStream 
-                || mediaElement->movieLoadType() == MediaPlayer::StoredStream;
-    case MediaSeekForwardButtonPart:
-    case MediaSeekBackButtonPart:
-        if (mediaElement->isFullscreen())
-            return mediaElement->movieLoadType() != MediaPlayer::StoredStream 
-                && mediaElement->movieLoadType() != MediaPlayer::LiveStream;
-    default:
-        break;
-    }
+    if (part == MediaMuteButtonPart)
+        return false;
 
-    return RenderTheme::shouldRenderMediaControlPart(part, element);
+    return mediaControllerTheme() == MediaControllerThemeClassic;
 }
 
 bool RenderThemeMac::usesMediaControlStatusDisplay()
@@ -2012,6 +1985,11 @@ bool RenderThemeMac::usesMediaControlStatusDisplay()
     return mediaControllerTheme() == MediaControllerThemeQuickTime;
 }
 
+bool RenderThemeMac::usesMediaControlVolumeSlider() const
+{
+    return mediaControllerTheme() == MediaControllerThemeQuickTime;
+}
+
 IntPoint RenderThemeMac::volumeSliderOffsetFromMuteButton(RenderBox* muteButtonBox, const IntSize& size) const
 {
     return RenderMediaControls::volumeSliderOffsetFromMuteButton(muteButtonBox, size);
diff --git a/Source/WebCore/rendering/RenderThemeWin.cpp b/Source/WebCore/rendering/RenderThemeWin.cpp
index af100b7..15f64c5 100644
--- a/Source/WebCore/rendering/RenderThemeWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeWin.cpp
@@ -1029,22 +1029,16 @@ String RenderThemeWin::extraMediaControlsStyleSheet()
     return String(mediaControlsQuickTimeUserAgentStyleSheet, sizeof(mediaControlsQuickTimeUserAgentStyleSheet));
 }
 
-bool RenderThemeWin::shouldRenderMediaControlPart(ControlPart part, Element* element)
+bool RenderThemeWin::supportsClosedCaptioning() const
 {
-    if (part == MediaToggleClosedCaptionsButtonPart) {
         // We rely on QuickTime to render captions so only enable the button for a video element.
 #if SAFARI_THEME_VERSION >= 4
-        if (!element->hasTagName(videoTag))
-            return false;
+    return true;
 #else
-        return false;
+    return false;
 #endif
-    }
-
-    return RenderTheme::shouldRenderMediaControlPart(part, element);
 }
 
-
 bool RenderThemeWin::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
diff --git a/Source/WebCore/rendering/RenderThemeWin.h b/Source/WebCore/rendering/RenderThemeWin.h
index 7e0223a..7e8a491 100644
--- a/Source/WebCore/rendering/RenderThemeWin.h
+++ b/Source/WebCore/rendering/RenderThemeWin.h
@@ -124,7 +124,7 @@ public:
 
 #if ENABLE(VIDEO)
     virtual String extraMediaControlsStyleSheet();
-    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+    virtual bool supportsClosedCaptioning() const;
     virtual bool paintMediaControlsBackground(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
index 8857391..2f5bd74 100644
--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
@@ -722,7 +722,10 @@ static String nodePosition(Node* node)
                 result += "body";
                 break;
             }
-            result += "child " + String::number(n->nodeIndex()) + " {" + getTagName(n) + "}";
+            if (n->isShadowBoundary())
+                result += "{" + getTagName(n) + "}";
+            else
+                result += "child " + String::number(n->nodeIndex()) + " {" + getTagName(n) + "}";
         } else
             result += "document";
     }
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index d25240b..20afefa 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -226,13 +226,17 @@ void RenderView::paintBoxDecorations(PaintInfo& paintInfo, int, int)
         RenderBox* rootBox = rootRenderer->isBox() ? toRenderBox(rootRenderer) : 0;
         rootFillsViewport = rootBox && !rootBox->x() && !rootBox->y() && rootBox->width() >= width() && rootBox->height() >= height();
     }
-    
+
+    float pageScaleFactor = 1;
+    if (Frame* frame = m_frameView->frame())
+        pageScaleFactor = frame->pageScaleFactor();
+
     // If painting will entirely fill the view, no need to fill the background.
-    if (rootFillsViewport && rendererObscuresBackground(firstChild()))
+    if (rootFillsViewport && rendererObscuresBackground(firstChild()) && pageScaleFactor >= 1)
         return;
 
     // This code typically only executes if the root element's visibility has been set to hidden,
-    // or there is a transform on the <html>.
+    // if there is a transform on the <html>, or if there is a page scale factor less than 1.
     // Only fill with the base background color (typically white) if we're the root document, 
     // since iframes/frames with no background in the child document should show the parent's background.
     if (frameView()->isTransparent()) // FIXME: This needs to be dynamic.  We should be able to go back to blitting if we ever stop being transparent.
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index 33f6436..894d689 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -207,8 +207,10 @@ void RenderWidget::setWidget(PassRefPtr<Widget> widget)
                 setWidgetGeometry(IntRect(localToAbsoluteQuad(FloatQuad(contentBoxRect())).boundingBox()), contentBoxRect().size());
             if (style()->visibility() != VISIBLE)
                 m_widget->hide();
-            else
+            else {
                 m_widget->show();
+                repaint();
+            }
         }
         moveWidgetToParentSoon(m_widget.get(), m_frameView);
     }
diff --git a/Source/WebCore/rendering/RenderingAllInOne.cpp b/Source/WebCore/rendering/RenderingAllInOne.cpp
index c9f6707..d0bb843 100644
--- a/Source/WebCore/rendering/RenderingAllInOne.cpp
+++ b/Source/WebCore/rendering/RenderingAllInOne.cpp
@@ -35,7 +35,6 @@
 #include "InlineFlowBox.cpp"
 #include "InlineTextBox.cpp"
 #include "LayoutState.cpp"
-#include "MediaControlElements.cpp"
 #include "PointerEventsHitRules.cpp"
 #include "RenderApplet.cpp"
 #include "RenderArena.cpp"
@@ -62,7 +61,6 @@
 #include "RenderImage.cpp"
 #include "RenderImageResource.cpp"
 #include "RenderImageResourceStyleImage.cpp"
-#include "RenderIndicator.cpp"
 #include "RenderInline.cpp"
 #include "RenderLayer.cpp"
 #include "RenderLayerCompositor.cpp"
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index c6f1bd8..b504684 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -133,11 +133,11 @@ float RootInlineBox::placeEllipsisBox(bool ltr, float blockLeftEdge, float block
     return result;
 }
 
-void RootInlineBox::paintEllipsisBox(PaintInfo& paintInfo, int tx, int ty) const
+void RootInlineBox::paintEllipsisBox(PaintInfo& paintInfo, int tx, int ty, int lineTop, int lineBottom) const
 {
     if (hasEllipsisBox() && paintInfo.shouldPaintWithinRoot(renderer()) && renderer()->style()->visibility() == VISIBLE
             && paintInfo.phase == PaintPhaseForeground)
-        ellipsisBox()->paint(paintInfo, tx, ty);
+        ellipsisBox()->paint(paintInfo, tx, ty, lineTop, lineBottom);
 }
 
 #if PLATFORM(MAC)
@@ -154,7 +154,7 @@ void RootInlineBox::addHighlightOverflow()
     // Highlight acts as a selection inflation.
     FloatRect rootRect(0, selectionTop(), logicalWidth(), selectionHeight());
     IntRect inflatedRect = enclosingIntRect(page->chrome()->client()->customHighlightRect(renderer()->node(), renderer()->style()->highlight(), rootRect));
-    setOverflowFromLogicalRects(inflatedRect, inflatedRect);
+    setOverflowFromLogicalRects(inflatedRect, inflatedRect, lineTop(), lineBottom());
 }
 
 void RootInlineBox::paintCustomHighlight(PaintInfo& paintInfo, int tx, int ty, const AtomicString& highlightType)
@@ -178,10 +178,10 @@ void RootInlineBox::paintCustomHighlight(PaintInfo& paintInfo, int tx, int ty, c
 
 #endif
 
-void RootInlineBox::paint(PaintInfo& paintInfo, int tx, int ty)
+void RootInlineBox::paint(PaintInfo& paintInfo, int tx, int ty, int lineTop, int lineBottom)
 {
-    InlineFlowBox::paint(paintInfo, tx, ty);
-    paintEllipsisBox(paintInfo, tx, ty);
+    InlineFlowBox::paint(paintInfo, tx, ty, lineTop, lineBottom);
+    paintEllipsisBox(paintInfo, tx, ty, lineTop, lineBottom);
 #if PLATFORM(MAC)
     RenderStyle* styleToUse = renderer()->style(m_firstLine);
     if (styleToUse->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
@@ -189,15 +189,15 @@ void RootInlineBox::paint(PaintInfo& paintInfo, int tx, int ty)
 #endif
 }
 
-bool RootInlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
+bool RootInlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, int lineTop, int lineBottom)
 {
     if (hasEllipsisBox() && visibleToHitTesting()) {
-        if (ellipsisBox()->nodeAtPoint(request, result, x, y, tx, ty)) {
+        if (ellipsisBox()->nodeAtPoint(request, result, x, y, tx, ty, lineTop, lineBottom)) {
             renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
             return true;
         }
     }
-    return InlineFlowBox::nodeAtPoint(request, result, x, y, tx, ty);
+    return InlineFlowBox::nodeAtPoint(request, result, x, y, tx, ty, lineTop, lineBottom);
 }
 
 void RootInlineBox::adjustPosition(float dx, float dy)
@@ -529,7 +529,7 @@ void RootInlineBox::attachLineBoxToRenderObject()
 
 IntRect RootInlineBox::paddedLayoutOverflowRect(int endPadding) const
 {
-    IntRect lineLayoutOverflow = layoutOverflowRect();
+    IntRect lineLayoutOverflow = layoutOverflowRect(lineTop(), lineBottom());
     if (!endPadding)
         return lineLayoutOverflow;
     
@@ -785,7 +785,7 @@ bool RootInlineBox::includesRootLineBoxFontOrLeading() const
     return (lineBoxContain & LineBoxContainBlock) || (lineBoxContain & LineBoxContainInline) || (lineBoxContain & LineBoxContainFont);
 }
 
-Node* RootInlineBox::getLogicalStartBoxWithNode(InlineBox*& startBox)
+Node* RootInlineBox::getLogicalStartBoxWithNode(InlineBox*& startBox) const
 {
     Vector<InlineBox*> leafBoxesInLogicalOrder;
     collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder);
@@ -799,7 +799,7 @@ Node* RootInlineBox::getLogicalStartBoxWithNode(InlineBox*& startBox)
     return 0;
 }
     
-Node* RootInlineBox::getLogicalEndBoxWithNode(InlineBox*& endBox)
+Node* RootInlineBox::getLogicalEndBoxWithNode(InlineBox*& endBox) const
 {
     Vector<InlineBox*> leafBoxesInLogicalOrder;
     collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder);
diff --git a/Source/WebCore/rendering/RootInlineBox.h b/Source/WebCore/rendering/RootInlineBox.h
index 0ff5704..2564d85 100644
--- a/Source/WebCore/rendering/RootInlineBox.h
+++ b/Source/WebCore/rendering/RootInlineBox.h
@@ -83,8 +83,7 @@ public:
 
     EllipsisBox* ellipsisBox() const;
 
-    void paintEllipsisBox(PaintInfo&, int tx, int ty) const;
-    bool hitTestEllipsisBox(HitTestResult&, int x, int y, int tx, int ty, HitTestAction, bool);
+    void paintEllipsisBox(PaintInfo&, int tx, int ty, int lineTop, int lineBottom) const;
 
     virtual void clearTruncation();
 
@@ -96,8 +95,8 @@ public:
     void paintCustomHighlight(PaintInfo&, int tx, int ty, const AtomicString& highlightType);
 #endif
 
-    virtual void paint(PaintInfo&, int tx, int ty);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int);
+    virtual void paint(PaintInfo&, int tx, int ty, int lineTop, int lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, int lineTop, int lineBottom);
 
     bool hasSelectedChildren() const { return m_hasSelectedChildrenOrCanHaveLeadingExpansion; }
     void setHasSelectedChildren(bool hasSelectedChildren) { m_hasSelectedChildrenOrCanHaveLeadingExpansion = hasSelectedChildren; }
@@ -112,12 +111,13 @@ public:
 
     InlineBox* closestLeafChildForLogicalLeftPosition(int, bool onlyEditableLeaves = false);
 
-    Vector<RenderBox*>& floats()
+    void appendFloat(RenderBox* floatingBox)
     {
         ASSERT(!isDirty());
-        if (!m_floats)
-            m_floats= adoptPtr(new Vector<RenderBox*>);
-        return *m_floats;
+        if (m_floats)
+            m_floats->append(floatingBox);
+        else
+            m_floats= adoptPtr(new Vector<RenderBox*>(1, floatingBox));
     }
 
     Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_floats.get(); }
@@ -141,9 +141,26 @@ public:
     bool includeMarginForBox(InlineBox*) const;
     bool fitsToGlyphs() const;
     bool includesRootLineBoxFontOrLeading() const;
+    
+    int logicalTopVisualOverflow() const
+    {
+        return InlineFlowBox::logicalTopVisualOverflow(lineTop());
+    }
+    int logicalBottomVisualOverflow() const
+    {
+        return InlineFlowBox::logicalBottomVisualOverflow(lineBottom());
+    }
+    int logicalTopLayoutOverflow() const
+    {
+        return InlineFlowBox::logicalTopLayoutOverflow(lineTop());
+    }
+    int logicalBottomLayoutOverflow() const
+    {
+        return InlineFlowBox::logicalBottomLayoutOverflow(lineBottom());
+    }
 
-    Node* getLogicalStartBoxWithNode(InlineBox*&);
-    Node* getLogicalEndBoxWithNode(InlineBox*&);
+    Node* getLogicalStartBoxWithNode(InlineBox*&) const;
+    Node* getLogicalEndBoxWithNode(InlineBox*&) const;
 private:
     bool hasEllipsisBox() const { return m_hasEllipsisBoxOrHyphen; }
     void setHasEllipsisBox(bool hasEllipsisBox) { m_hasEllipsisBoxOrHyphen = hasEllipsisBox; }
diff --git a/Source/WebCore/rendering/ShadowElement.cpp b/Source/WebCore/rendering/ShadowElement.cpp
index 5b1a962..955384a 100644
--- a/Source/WebCore/rendering/ShadowElement.cpp
+++ b/Source/WebCore/rendering/ShadowElement.cpp
@@ -29,85 +29,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-PassRefPtr<ShadowBlockElement> ShadowBlockElement::create(HTMLElement* shadowParent)
-{
-    return adoptRef(new ShadowBlockElement(shadowParent));
-}
-
-ShadowBlockElement::ShadowBlockElement(HTMLElement* shadowParent)
-    : ShadowElement<HTMLDivElement>(divTag, shadowParent)
-{
-}
-
-void ShadowBlockElement::layoutAsPart(const IntRect& partRect)
-{
-    RenderBox* parentRenderer = toRenderBox(renderer()->parent());
-    RenderBox* selfRenderer = toRenderBox(renderer());
-    IntRect oldRect = selfRenderer->frameRect();
-
-    LayoutStateMaintainer statePusher(parentRenderer->view(), parentRenderer, parentRenderer->size(), parentRenderer->style()->isFlippedBlocksWritingMode());
-
-    if (oldRect.size() != partRect.size())
-        selfRenderer->setChildNeedsLayout(true, false);
-
-    selfRenderer->layoutIfNeeded();
-    selfRenderer->setFrameRect(partRect);
-
-    if (selfRenderer->checkForRepaintDuringLayout())
-        selfRenderer->repaintDuringLayoutIfMoved(oldRect);
-        
-    statePusher.pop();
-    parentRenderer->addOverflowFromChild(selfRenderer);
-}
-
-void ShadowBlockElement::updateStyleForPart(PseudoId pseudoId)
-{
-    if (renderer()->style()->styleType() != pseudoId)
-        renderer()->setStyle(createStyleForPart(renderer()->parent(), pseudoId));
-}
-
-PassRefPtr<ShadowBlockElement> ShadowBlockElement::createForPart(HTMLElement* shadowParent, PseudoId pseudoId)
-{
-    RefPtr<ShadowBlockElement> part = create(shadowParent);
-    part->initAsPart(pseudoId);
-    return part.release();
-}
-
-void ShadowBlockElement::initAsPart(PseudoId pseudoId)
-{
-    RenderObject* parentRenderer = shadowHost()->renderer();
-    RefPtr<RenderStyle> styleForPart = createStyleForPart(parentRenderer, pseudoId);
-    setRenderer(createRenderer(parentRenderer->renderArena(), styleForPart.get()));
-    renderer()->setStyle(styleForPart.release());
-    setAttached();
-    setInDocument();
-}
-
-PassRefPtr<RenderStyle> ShadowBlockElement::createStyleForPart(RenderObject* parentRenderer, PseudoId pseudoId)
-{
-    RefPtr<RenderStyle> styleForPart;
-    RenderStyle* pseudoStyle = parentRenderer->getCachedPseudoStyle(pseudoId);
-    if (pseudoStyle)
-        styleForPart = RenderStyle::clone(pseudoStyle);
-    else
-        styleForPart = RenderStyle::create();
-    
-    styleForPart->inheritFrom(parentRenderer->style());
-    styleForPart->setDisplay(BLOCK);
-    styleForPart->setAppearance(NoControlPart);
-    return styleForPart.release();
-}
-
-bool ShadowBlockElement::partShouldHaveStyle(const RenderObject* parentRenderer, PseudoId pseudoId)
-{
-    // We have some -webkit-appearance values for default styles of parts and
-    // that appearance get turned off during RenderStyle creation 
-    // if they have background styles specified.
-    // So !hasAppearance() implies that there are something to be styled.
-    RenderStyle* pseudoStyle = parentRenderer->getCachedPseudoStyle(pseudoId);
-    return !(pseudoStyle && pseudoStyle->hasAppearance());
-}
-
 PassRefPtr<ShadowInputElement> ShadowInputElement::create(HTMLElement* shadowParent)
 {
     return adoptRef(new ShadowInputElement(shadowParent));
diff --git a/Source/WebCore/rendering/ShadowElement.h b/Source/WebCore/rendering/ShadowElement.h
index 9a5d118..0db6a83 100644
--- a/Source/WebCore/rendering/ShadowElement.h
+++ b/Source/WebCore/rendering/ShadowElement.h
@@ -61,21 +61,6 @@ void ShadowElement<BaseElement>::detach()
     BaseElement::setShadowHost(0);
 }
 
-class ShadowBlockElement : public ShadowElement<HTMLDivElement> {
-public:
-    static PassRefPtr<ShadowBlockElement> create(HTMLElement*);
-    static PassRefPtr<ShadowBlockElement> createForPart(HTMLElement*, PseudoId);
-    static bool partShouldHaveStyle(const RenderObject* parentRenderer, PseudoId pseudoId);
-    void layoutAsPart(const IntRect& partRect);
-    virtual void updateStyleForPart(PseudoId);
-
-protected:
-    ShadowBlockElement(HTMLElement*);
-    void initAsPart(PseudoId pasuedId);
-private:
-    static PassRefPtr<RenderStyle> createStyleForPart(RenderObject*, PseudoId);
-};
-
 class ShadowInputElement : public ShadowElement<HTMLInputElement> {
 public:
     static PassRefPtr<ShadowInputElement> create(HTMLElement*);
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 34e972d..60518f7 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -176,17 +176,17 @@ RenderStyle::~RenderStyle()
 bool RenderStyle::operator==(const RenderStyle& o) const
 {
     // compare everything except the pseudoStyle pointer
-    return inherited_flags == o.inherited_flags &&
-            noninherited_flags == o.noninherited_flags &&
-            m_box == o.m_box &&
-            visual == o.visual &&
-            m_background == o.m_background &&
-            surround == o.surround &&
-            rareNonInheritedData == o.rareNonInheritedData &&
-            rareInheritedData == o.rareInheritedData &&
-            inherited == o.inherited
+    return inherited_flags == o.inherited_flags
+        && noninherited_flags == o.noninherited_flags
+        && m_box == o.m_box
+        && visual == o.visual
+        && m_background == o.m_background
+        && surround == o.surround
+        && rareNonInheritedData == o.rareNonInheritedData
+        && rareInheritedData == o.rareInheritedData
+        && inherited == o.inherited
 #if ENABLE(SVG)
-            && m_svgStyle == o.m_svgStyle
+        && m_svgStyle == o.m_svgStyle
 #endif
             ;
 }
@@ -272,22 +272,22 @@ void RenderStyle::removeCachedPseudoStyle(PseudoId pid)
 
 bool RenderStyle::inheritedNotEqual(const RenderStyle* other) const
 {
-    return inherited_flags != other->inherited_flags ||
-           inherited != other->inherited ||
+    return inherited_flags != other->inherited_flags
+           || inherited != other->inherited
 #if ENABLE(SVG)
-           m_svgStyle->inheritedNotEqual(other->m_svgStyle.get()) ||
+           || m_svgStyle->inheritedNotEqual(other->m_svgStyle.get())
 #endif
-           rareInheritedData != other->rareInheritedData;
+           || rareInheritedData != other->rareInheritedData;
 }
 
 static bool positionedObjectMoved(const LengthBox& a, const LengthBox& b)
 {
     // If any unit types are different, then we can't guarantee
     // that this was just a movement.
-    if (a.left().type() != b.left().type() ||
-        a.right().type() != b.right().type() ||
-        a.top().type() != b.top().type() ||
-        a.bottom().type() != b.bottom().type())
+    if (a.left().type() != b.left().type()
+        || a.right().type() != b.right().type()
+        || a.top().type() != b.top().type()
+        || a.bottom().type() != b.bottom().type())
         return false;
 
     // Only one unit can be non-auto in the horizontal direction and
@@ -316,12 +316,12 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     }
 #endif
 
-    if (m_box->width() != other->m_box->width() ||
-        m_box->minWidth() != other->m_box->minWidth() ||
-        m_box->maxWidth() != other->m_box->maxWidth() ||
-        m_box->height() != other->m_box->height() ||
-        m_box->minHeight() != other->m_box->minHeight() ||
-        m_box->maxHeight() != other->m_box->maxHeight())
+    if (m_box->width() != other->m_box->width()
+        || m_box->minWidth() != other->m_box->minWidth()
+        || m_box->maxWidth() != other->m_box->maxWidth()
+        || m_box->height() != other->m_box->height()
+        || m_box->minHeight() != other->m_box->minHeight()
+        || m_box->maxHeight() != other->m_box->maxHeight())
         return StyleDifferenceLayout;
 
     if (m_box->verticalAlign() != other->m_box->verticalAlign() || noninherited_flags._vertical_align != other->noninherited_flags._vertical_align)
@@ -337,15 +337,15 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         return StyleDifferenceLayout;
 
     if (rareNonInheritedData.get() != other->rareNonInheritedData.get()) {
-        if (rareNonInheritedData->m_appearance != other->rareNonInheritedData->m_appearance ||
-            rareNonInheritedData->marginBeforeCollapse != other->rareNonInheritedData->marginBeforeCollapse ||
-            rareNonInheritedData->marginAfterCollapse != other->rareNonInheritedData->marginAfterCollapse ||
-            rareNonInheritedData->lineClamp != other->rareNonInheritedData->lineClamp ||
-            rareNonInheritedData->textOverflow != other->rareNonInheritedData->textOverflow)
+        if (rareNonInheritedData->m_appearance != other->rareNonInheritedData->m_appearance 
+            || rareNonInheritedData->marginBeforeCollapse != other->rareNonInheritedData->marginBeforeCollapse
+            || rareNonInheritedData->marginAfterCollapse != other->rareNonInheritedData->marginAfterCollapse
+            || rareNonInheritedData->lineClamp != other->rareNonInheritedData->lineClamp
+            || rareNonInheritedData->textOverflow != other->rareNonInheritedData->textOverflow)
             return StyleDifferenceLayout;
 
-        if (rareNonInheritedData->flexibleBox.get() != other->rareNonInheritedData->flexibleBox.get() &&
-            *rareNonInheritedData->flexibleBox.get() != *other->rareNonInheritedData->flexibleBox.get())
+        if (rareNonInheritedData->flexibleBox.get() != other->rareNonInheritedData->flexibleBox.get()
+            && *rareNonInheritedData->flexibleBox.get() != *other->rareNonInheritedData->flexibleBox.get())
             return StyleDifferenceLayout;
 
         // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
@@ -355,12 +355,12 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         if (!rareNonInheritedData->reflectionDataEquivalent(*other->rareNonInheritedData.get()))
             return StyleDifferenceLayout;
 
-        if (rareNonInheritedData->m_multiCol.get() != other->rareNonInheritedData->m_multiCol.get() &&
-            *rareNonInheritedData->m_multiCol.get() != *other->rareNonInheritedData->m_multiCol.get())
+        if (rareNonInheritedData->m_multiCol.get() != other->rareNonInheritedData->m_multiCol.get()
+            && *rareNonInheritedData->m_multiCol.get() != *other->rareNonInheritedData->m_multiCol.get())
             return StyleDifferenceLayout;
 
-        if (rareNonInheritedData->m_transform.get() != other->rareNonInheritedData->m_transform.get() &&
-            *rareNonInheritedData->m_transform.get() != *other->rareNonInheritedData->m_transform.get()) {
+        if (rareNonInheritedData->m_transform.get() != other->rareNonInheritedData->m_transform.get()
+            && *rareNonInheritedData->m_transform.get() != *other->rareNonInheritedData->m_transform.get()) {
 #if USE(ACCELERATED_COMPOSITING)
             changedContextSensitiveProperties |= ContextSensitivePropertyTransform;
             // Don't return; keep looking for another change
@@ -371,11 +371,11 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
 
 #if !USE(ACCELERATED_COMPOSITING)
         if (rareNonInheritedData.get() != other->rareNonInheritedData.get()) {
-            if (rareNonInheritedData->m_transformStyle3D != other->rareNonInheritedData->m_transformStyle3D ||
-                rareNonInheritedData->m_backfaceVisibility != other->rareNonInheritedData->m_backfaceVisibility ||
-                rareNonInheritedData->m_perspective != other->rareNonInheritedData->m_perspective ||
-                rareNonInheritedData->m_perspectiveOriginX != other->rareNonInheritedData->m_perspectiveOriginX ||
-                rareNonInheritedData->m_perspectiveOriginY != other->rareNonInheritedData->m_perspectiveOriginY)
+            if (rareNonInheritedData->m_transformStyle3D != other->rareNonInheritedData->m_transformStyle3D
+                || rareNonInheritedData->m_backfaceVisibility != other->rareNonInheritedData->m_backfaceVisibility
+                || rareNonInheritedData->m_perspective != other->rareNonInheritedData->m_perspective
+                || rareNonInheritedData->m_perspectiveOriginX != other->rareNonInheritedData->m_perspectiveOriginX
+                || rareNonInheritedData->m_perspectiveOriginY != other->rareNonInheritedData->m_perspectiveOriginY)
                 return StyleDifferenceLayout;
         }
 #endif
@@ -388,24 +388,24 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     }
 
     if (rareInheritedData.get() != other->rareInheritedData.get()) {
-        if (rareInheritedData->highlight != other->rareInheritedData->highlight ||
-            rareInheritedData->indent != other->rareInheritedData->indent ||
-            rareInheritedData->m_effectiveZoom != other->rareInheritedData->m_effectiveZoom ||
-            rareInheritedData->textSizeAdjust != other->rareInheritedData->textSizeAdjust ||
-            rareInheritedData->wordBreak != other->rareInheritedData->wordBreak ||
-            rareInheritedData->wordWrap != other->rareInheritedData->wordWrap ||
-            rareInheritedData->nbspMode != other->rareInheritedData->nbspMode ||
-            rareInheritedData->khtmlLineBreak != other->rareInheritedData->khtmlLineBreak ||
-            rareInheritedData->textSecurity != other->rareInheritedData->textSecurity ||
-            rareInheritedData->hyphens != other->rareInheritedData->hyphens ||
-            rareInheritedData->hyphenationLimitBefore != other->rareInheritedData->hyphenationLimitBefore ||
-            rareInheritedData->hyphenationLimitAfter != other->rareInheritedData->hyphenationLimitAfter ||
-            rareInheritedData->hyphenationString != other->rareInheritedData->hyphenationString ||
-            rareInheritedData->locale != other->rareInheritedData->locale ||
-            rareInheritedData->textEmphasisMark != other->rareInheritedData->textEmphasisMark ||
-            rareInheritedData->textEmphasisPosition != other->rareInheritedData->textEmphasisPosition ||
-            rareInheritedData->textEmphasisCustomMark != other->rareInheritedData->textEmphasisCustomMark ||
-            rareInheritedData->m_lineBoxContain != other->rareInheritedData->m_lineBoxContain)
+        if (rareInheritedData->highlight != other->rareInheritedData->highlight
+            || rareInheritedData->indent != other->rareInheritedData->indent
+            || rareInheritedData->m_effectiveZoom != other->rareInheritedData->m_effectiveZoom
+            || rareInheritedData->textSizeAdjust != other->rareInheritedData->textSizeAdjust
+            || rareInheritedData->wordBreak != other->rareInheritedData->wordBreak
+            || rareInheritedData->wordWrap != other->rareInheritedData->wordWrap
+            || rareInheritedData->nbspMode != other->rareInheritedData->nbspMode
+            || rareInheritedData->khtmlLineBreak != other->rareInheritedData->khtmlLineBreak
+            || rareInheritedData->textSecurity != other->rareInheritedData->textSecurity
+            || rareInheritedData->hyphens != other->rareInheritedData->hyphens
+            || rareInheritedData->hyphenationLimitBefore != other->rareInheritedData->hyphenationLimitBefore
+            || rareInheritedData->hyphenationLimitAfter != other->rareInheritedData->hyphenationLimitAfter
+            || rareInheritedData->hyphenationString != other->rareInheritedData->hyphenationString
+            || rareInheritedData->locale != other->rareInheritedData->locale
+            || rareInheritedData->textEmphasisMark != other->rareInheritedData->textEmphasisMark
+            || rareInheritedData->textEmphasisPosition != other->rareInheritedData->textEmphasisPosition
+            || rareInheritedData->textEmphasisCustomMark != other->rareInheritedData->textEmphasisCustomMark
+            || rareInheritedData->m_lineBoxContain != other->rareInheritedData->m_lineBoxContain)
             return StyleDifferenceLayout;
 
         if (!rareInheritedData->shadowDataEquivalent(*other->rareInheritedData.get()))
@@ -415,52 +415,52 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             return StyleDifferenceLayout;
     }
 
-    if (inherited->line_height != other->inherited->line_height ||
-        inherited->list_style_image != other->inherited->list_style_image ||
-        inherited->font != other->inherited->font ||
-        inherited->horizontal_border_spacing != other->inherited->horizontal_border_spacing ||
-        inherited->vertical_border_spacing != other->inherited->vertical_border_spacing ||
-        inherited_flags._box_direction != other->inherited_flags._box_direction ||
-        inherited_flags._visuallyOrdered != other->inherited_flags._visuallyOrdered ||
-        noninherited_flags._position != other->noninherited_flags._position ||
-        noninherited_flags._floating != other->noninherited_flags._floating ||
-        noninherited_flags._originalDisplay != other->noninherited_flags._originalDisplay)
+    if (inherited->line_height != other->inherited->line_height
+        || inherited->list_style_image != other->inherited->list_style_image
+        || inherited->font != other->inherited->font
+        || inherited->horizontal_border_spacing != other->inherited->horizontal_border_spacing
+        || inherited->vertical_border_spacing != other->inherited->vertical_border_spacing
+        || inherited_flags._box_direction != other->inherited_flags._box_direction
+        || inherited_flags._visuallyOrdered != other->inherited_flags._visuallyOrdered
+        || noninherited_flags._position != other->noninherited_flags._position
+        || noninherited_flags._floating != other->noninherited_flags._floating
+        || noninherited_flags._originalDisplay != other->noninherited_flags._originalDisplay)
         return StyleDifferenceLayout;
 
 
     if (((int)noninherited_flags._effectiveDisplay) >= TABLE) {
-        if (inherited_flags._border_collapse != other->inherited_flags._border_collapse ||
-            inherited_flags._empty_cells != other->inherited_flags._empty_cells ||
-            inherited_flags._caption_side != other->inherited_flags._caption_side ||
-            noninherited_flags._table_layout != other->noninherited_flags._table_layout)
+        if (inherited_flags._border_collapse != other->inherited_flags._border_collapse
+            || inherited_flags._empty_cells != other->inherited_flags._empty_cells
+            || inherited_flags._caption_side != other->inherited_flags._caption_side
+            || noninherited_flags._table_layout != other->noninherited_flags._table_layout)
             return StyleDifferenceLayout;
 
         // In the collapsing border model, 'hidden' suppresses other borders, while 'none'
         // does not, so these style differences can be width differences.
-        if (inherited_flags._border_collapse &&
-            ((borderTopStyle() == BHIDDEN && other->borderTopStyle() == BNONE) ||
-             (borderTopStyle() == BNONE && other->borderTopStyle() == BHIDDEN) ||
-             (borderBottomStyle() == BHIDDEN && other->borderBottomStyle() == BNONE) ||
-             (borderBottomStyle() == BNONE && other->borderBottomStyle() == BHIDDEN) ||
-             (borderLeftStyle() == BHIDDEN && other->borderLeftStyle() == BNONE) ||
-             (borderLeftStyle() == BNONE && other->borderLeftStyle() == BHIDDEN) ||
-             (borderRightStyle() == BHIDDEN && other->borderRightStyle() == BNONE) ||
-             (borderRightStyle() == BNONE && other->borderRightStyle() == BHIDDEN)))
+        if (inherited_flags._border_collapse
+            && ((borderTopStyle() == BHIDDEN && other->borderTopStyle() == BNONE)
+                || (borderTopStyle() == BNONE && other->borderTopStyle() == BHIDDEN)
+                || (borderBottomStyle() == BHIDDEN && other->borderBottomStyle() == BNONE)
+                || (borderBottomStyle() == BNONE && other->borderBottomStyle() == BHIDDEN)
+                || (borderLeftStyle() == BHIDDEN && other->borderLeftStyle() == BNONE)
+                || (borderLeftStyle() == BNONE && other->borderLeftStyle() == BHIDDEN)
+                || (borderRightStyle() == BHIDDEN && other->borderRightStyle() == BNONE)
+                || (borderRightStyle() == BNONE && other->borderRightStyle() == BHIDDEN)))
             return StyleDifferenceLayout;
     }
 
     if (noninherited_flags._effectiveDisplay == LIST_ITEM) {
-        if (inherited_flags._list_style_type != other->inherited_flags._list_style_type ||
-            inherited_flags._list_style_position != other->inherited_flags._list_style_position)
+        if (inherited_flags._list_style_type != other->inherited_flags._list_style_type
+            || inherited_flags._list_style_position != other->inherited_flags._list_style_position)
             return StyleDifferenceLayout;
     }
 
-    if (inherited_flags._text_align != other->inherited_flags._text_align ||
-        inherited_flags._text_transform != other->inherited_flags._text_transform ||
-        inherited_flags._direction != other->inherited_flags._direction ||
-        inherited_flags._white_space != other->inherited_flags._white_space ||
-        noninherited_flags._clear != other->noninherited_flags._clear ||
-        noninherited_flags._unicodeBidi != other->noninherited_flags._unicodeBidi)
+    if (inherited_flags._text_align != other->inherited_flags._text_align
+        || inherited_flags._text_transform != other->inherited_flags._text_transform
+        || inherited_flags._direction != other->inherited_flags._direction
+        || inherited_flags._white_space != other->inherited_flags._white_space
+        || noninherited_flags._clear != other->noninherited_flags._clear
+        || noninherited_flags._unicodeBidi != other->noninherited_flags._unicodeBidi)
         return StyleDifferenceLayout;
 
     // Check block flow direction.
@@ -472,16 +472,16 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         return StyleDifferenceLayout;
 
     // Overflow returns a layout hint.
-    if (noninherited_flags._overflowX != other->noninherited_flags._overflowX ||
-        noninherited_flags._overflowY != other->noninherited_flags._overflowY)
+    if (noninherited_flags._overflowX != other->noninherited_flags._overflowX
+        || noninherited_flags._overflowY != other->noninherited_flags._overflowY)
         return StyleDifferenceLayout;
 
     // If our border widths change, then we need to layout.  Other changes to borders
     // only necessitate a repaint.
-    if (borderLeftWidth() != other->borderLeftWidth() ||
-        borderTopWidth() != other->borderTopWidth() ||
-        borderBottomWidth() != other->borderBottomWidth() ||
-        borderRightWidth() != other->borderRightWidth())
+    if (borderLeftWidth() != other->borderLeftWidth()
+        || borderTopWidth() != other->borderTopWidth()
+        || borderBottomWidth() != other->borderBottomWidth()
+        || borderRightWidth() != other->borderRightWidth())
         return StyleDifferenceLayout;
 
     // If the counter directives change, trigger a relayout to re-calculate counter values and rebuild the counter node tree.
@@ -489,15 +489,15 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     const CounterDirectiveMap* mapB = other->rareNonInheritedData->m_counterDirectives.get();
     if (!(mapA == mapB || (mapA && mapB && *mapA == *mapB)))
         return StyleDifferenceLayout;
-    if (rareNonInheritedData->m_counterIncrement != other->rareNonInheritedData->m_counterIncrement ||
-        rareNonInheritedData->m_counterReset != other->rareNonInheritedData->m_counterReset)
+    if (rareNonInheritedData->m_counterIncrement != other->rareNonInheritedData->m_counterIncrement
+        || rareNonInheritedData->m_counterReset != other->rareNonInheritedData->m_counterReset)
         return StyleDifferenceLayout;
 
     if ((visibility() == COLLAPSE) != (other->visibility() == COLLAPSE))
         return StyleDifferenceLayout;
 
-    if ((rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1) ||
-        (rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1)) {
+    if ((rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1)
+        || (rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1)) {
         // FIXME: We would like to use SimplifiedLayout here, but we can't quite do that yet.
         // We need to make sure SimplifiedLayout can operate correctly on RenderInlines (we will need
         // to add a selfNeedsSimplifiedLayout bit in order to not get confused and taint every line).
@@ -527,8 +527,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             // We need to make sure SimplifiedLayout can operate correctly on RenderInlines (we will need
             // to add a selfNeedsSimplifiedLayout bit in order to not get confused and taint every line).
             return StyleDifferenceLayout;
-        } else if (m_box->zIndex() != other->m_box->zIndex() || m_box->hasAutoZIndex() != other->m_box->hasAutoZIndex() ||
-                 visual->clip != other->visual->clip || visual->hasClip != other->visual->hasClip)
+        } else if (m_box->zIndex() != other->m_box->zIndex() || m_box->hasAutoZIndex() != other->m_box->hasAutoZIndex()
+                 || visual->clip != other->visual->clip || visual->hasClip != other->visual->hasClip)
             return StyleDifferenceRepaintLayer;
     }
 
@@ -541,35 +541,35 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
 #endif
     }
 
-    if (rareNonInheritedData->m_mask != other->rareNonInheritedData->m_mask ||
-        rareNonInheritedData->m_maskBoxImage != other->rareNonInheritedData->m_maskBoxImage)
+    if (rareNonInheritedData->m_mask != other->rareNonInheritedData->m_mask
+        || rareNonInheritedData->m_maskBoxImage != other->rareNonInheritedData->m_maskBoxImage)
         return StyleDifferenceRepaintLayer;
 
-    if (inherited->color != other->inherited->color ||
-        inherited_flags._visibility != other->inherited_flags._visibility ||
-        inherited_flags._text_decorations != other->inherited_flags._text_decorations ||
-        inherited_flags._force_backgrounds_to_white != other->inherited_flags._force_backgrounds_to_white ||
-        inherited_flags._insideLink != other->inherited_flags._insideLink ||
-        surround->border != other->surround->border ||
-        *m_background.get() != *other->m_background.get() ||
-        visual->textDecoration != other->visual->textDecoration ||
-        rareInheritedData->userModify != other->rareInheritedData->userModify ||
-        rareInheritedData->userSelect != other->rareInheritedData->userSelect ||
-        rareNonInheritedData->userDrag != other->rareNonInheritedData->userDrag ||
-        rareNonInheritedData->m_borderFit != other->rareNonInheritedData->m_borderFit ||
-        rareInheritedData->textFillColor != other->rareInheritedData->textFillColor ||
-        rareInheritedData->textStrokeColor != other->rareInheritedData->textStrokeColor ||
-        rareInheritedData->textEmphasisColor != other->rareInheritedData->textEmphasisColor ||
-        rareInheritedData->textEmphasisFill != other->rareInheritedData->textEmphasisFill)
+    if (inherited->color != other->inherited->color
+        || inherited_flags._visibility != other->inherited_flags._visibility
+        || inherited_flags._text_decorations != other->inherited_flags._text_decorations
+        || inherited_flags._force_backgrounds_to_white != other->inherited_flags._force_backgrounds_to_white
+        || inherited_flags._insideLink != other->inherited_flags._insideLink
+        || surround->border != other->surround->border
+        || *m_background.get() != *other->m_background.get()
+        || visual->textDecoration != other->visual->textDecoration
+        || rareInheritedData->userModify != other->rareInheritedData->userModify
+        || rareInheritedData->userSelect != other->rareInheritedData->userSelect
+        || rareNonInheritedData->userDrag != other->rareNonInheritedData->userDrag
+        || rareNonInheritedData->m_borderFit != other->rareNonInheritedData->m_borderFit
+        || rareInheritedData->textFillColor != other->rareInheritedData->textFillColor
+        || rareInheritedData->textStrokeColor != other->rareInheritedData->textStrokeColor
+        || rareInheritedData->textEmphasisColor != other->rareInheritedData->textEmphasisColor
+        || rareInheritedData->textEmphasisFill != other->rareInheritedData->textEmphasisFill)
         return StyleDifferenceRepaint;
 
 #if USE(ACCELERATED_COMPOSITING)
     if (rareNonInheritedData.get() != other->rareNonInheritedData.get()) {
-        if (rareNonInheritedData->m_transformStyle3D != other->rareNonInheritedData->m_transformStyle3D ||
-            rareNonInheritedData->m_backfaceVisibility != other->rareNonInheritedData->m_backfaceVisibility ||
-            rareNonInheritedData->m_perspective != other->rareNonInheritedData->m_perspective ||
-            rareNonInheritedData->m_perspectiveOriginX != other->rareNonInheritedData->m_perspectiveOriginX ||
-            rareNonInheritedData->m_perspectiveOriginY != other->rareNonInheritedData->m_perspectiveOriginY)
+        if (rareNonInheritedData->m_transformStyle3D != other->rareNonInheritedData->m_transformStyle3D
+            || rareNonInheritedData->m_backfaceVisibility != other->rareNonInheritedData->m_backfaceVisibility
+            || rareNonInheritedData->m_perspective != other->rareNonInheritedData->m_perspective
+            || rareNonInheritedData->m_perspectiveOriginX != other->rareNonInheritedData->m_perspectiveOriginX
+            || rareNonInheritedData->m_perspectiveOriginY != other->rareNonInheritedData->m_perspectiveOriginY)
             return StyleDifferenceRecompositeLayer;
     }
 #endif
@@ -693,11 +693,11 @@ void RenderStyle::applyTransform(TransformationMatrix& transform, const IntSize&
     if (applyOrigin == IncludeTransformOrigin) {
         for (i = 0; i < s; i++) {
             TransformOperation::OperationType type = rareNonInheritedData->m_transform->m_operations.operations()[i]->getOperationType();
-            if (type != TransformOperation::TRANSLATE_X &&
-                    type != TransformOperation::TRANSLATE_Y &&
-                    type != TransformOperation::TRANSLATE && 
-                    type != TransformOperation::TRANSLATE_Z && 
-                    type != TransformOperation::TRANSLATE_3D
+            if (type != TransformOperation::TRANSLATE_X
+                    && type != TransformOperation::TRANSLATE_Y
+                    && type != TransformOperation::TRANSLATE 
+                    && type != TransformOperation::TRANSLATE_Z
+                    && type != TransformOperation::TRANSLATE_3D
                     ) {
                 applyTransformOrigin = true;
                 break;
@@ -778,41 +778,66 @@ static float calcConstraintScaleFor(const IntRect& rect, const RoundedIntRect::R
     // top
     radiiSum = static_cast<unsigned>(radii.topLeft().width()) + static_cast<unsigned>(radii.topRight().width()); // Casts to avoid integer overflow.
     if (radiiSum > static_cast<unsigned>(rect.width()))
-        factor = std::min(static_cast<float>(rect.width()) / radiiSum, factor);
+        factor = min(static_cast<float>(rect.width()) / radiiSum, factor);
 
     // bottom
     radiiSum = static_cast<unsigned>(radii.bottomLeft().width()) + static_cast<unsigned>(radii.bottomRight().width());
     if (radiiSum > static_cast<unsigned>(rect.width()))
-        factor = std::min(static_cast<float>(rect.width()) / radiiSum, factor);
+        factor = min(static_cast<float>(rect.width()) / radiiSum, factor);
     
     // left
     radiiSum = static_cast<unsigned>(radii.topLeft().height()) + static_cast<unsigned>(radii.bottomLeft().height());
     if (radiiSum > static_cast<unsigned>(rect.height()))
-        factor = std::min(static_cast<float>(rect.height()) / radiiSum, factor);
+        factor = min(static_cast<float>(rect.height()) / radiiSum, factor);
     
     // right
     radiiSum = static_cast<unsigned>(radii.topRight().height()) + static_cast<unsigned>(radii.bottomRight().height());
     if (radiiSum > static_cast<unsigned>(rect.height()))
-        factor = std::min(static_cast<float>(rect.height()) / radiiSum, factor);
+        factor = min(static_cast<float>(rect.height()) / radiiSum, factor);
     
     ASSERT(factor <= 1);
     return factor;
 }
 
-RoundedIntRect RenderStyle::getRoundedBorderFor(const IntRect& rect) const
+RoundedIntRect RenderStyle::getRoundedBorderFor(const IntRect& borderRect, bool includeLogicalLeftEdge, bool includeLogicalRightEdge) const
 {
-    RoundedIntRect::Radii radii = calcRadiiFor(surround->border, rect.width(), rect.height());
-    radii.scale(calcConstraintScaleFor(rect, radii));
-    return RoundedIntRect(rect, radii);
+    RoundedIntRect roundedRect(borderRect);
+    if (hasBorderRadius()) {
+        RoundedIntRect::Radii radii = calcRadiiFor(surround->border, borderRect.width(), borderRect.height());
+        radii.scale(calcConstraintScaleFor(borderRect, radii));
+        roundedRect.includeLogicalEdges(radii, isHorizontalWritingMode(), includeLogicalLeftEdge, includeLogicalRightEdge);
+    }
+    return roundedRect;
 }
 
-RoundedIntRect RenderStyle::getRoundedInnerBorderWithBorderWidths(const IntRect& innerRect, unsigned short topWidth, 
-                                                                  unsigned short bottomWidth, unsigned short leftWidth, unsigned short rightWidth) const
+RoundedIntRect RenderStyle::getRoundedInnerBorderFor(const IntRect& borderRect, bool includeLogicalLeftEdge, bool includeLogicalRightEdge) const
 {
-    RoundedIntRect::Radii radii = calcRadiiFor(surround->border, innerRect.width(), innerRect.height());
-    radii.shrink(topWidth, bottomWidth, leftWidth, rightWidth);
-    radii.scale(calcConstraintScaleFor(innerRect, radii));
-    return RoundedIntRect(innerRect, radii);
+    bool horizontal = isHorizontalWritingMode();
+
+    int leftWidth = (!horizontal || includeLogicalLeftEdge) ? borderLeftWidth() : 0;
+    int rightWidth = (!horizontal || includeLogicalRightEdge) ? borderRightWidth() : 0;
+    int topWidth = (horizontal || includeLogicalLeftEdge) ? borderTopWidth() : 0;
+    int bottomWidth = (horizontal || includeLogicalRightEdge) ? borderBottomWidth() : 0;
+
+    return getRoundedInnerBorderFor(borderRect, topWidth, bottomWidth, leftWidth, rightWidth, includeLogicalLeftEdge, includeLogicalRightEdge);
+}
+
+RoundedIntRect RenderStyle::getRoundedInnerBorderFor(const IntRect& borderRect,
+    int topWidth, int bottomWidth, int leftWidth, int rightWidth, bool includeLogicalLeftEdge, bool includeLogicalRightEdge) const
+{
+    IntRect innerRect(borderRect.x() + leftWidth, 
+            borderRect.y() + topWidth, 
+            borderRect.width() - leftWidth - rightWidth, 
+            borderRect.height() - topWidth - bottomWidth);
+
+    RoundedIntRect roundedRect(innerRect);
+
+    if (hasBorderRadius()) {
+        RoundedIntRect::Radii radii = getRoundedBorderFor(borderRect).radii();
+        radii.shrink(topWidth, bottomWidth, leftWidth, rightWidth);
+        roundedRect.includeLogicalEdges(radii, isHorizontalWritingMode(), includeLogicalLeftEdge, includeLogicalRightEdge);
+    }
+    return roundedRect;
 }
 
 const CounterDirectiveMap* RenderStyle::counterDirectives() const
@@ -1146,6 +1171,14 @@ const Color RenderStyle::visitedDependentColor(int colorProperty) const
         return unvisitedColor;
     Color visitedColor = visitedStyle->colorIncludingFallback(colorProperty, borderStyle);
 
+    // FIXME: Technically someone could explicitly specify the color transparent, but for now we'll just
+    // assume that if the background color is transparent that it wasn't set. Note that it's weird that
+    // we're returning unvisited info for a visited link, but given our restriction that the alpha values
+    // have to match, it makes more sense to return the unvisited background color if specified than it
+    // does to return black. This behavior matches what Firefox 4 does as well.
+    if (colorProperty == CSSPropertyBackgroundColor && visitedColor == Color::transparent)
+        return unvisitedColor;
+
     // Take the alpha from the unvisited color, but get the RGB values from the visited color.
     return Color(visitedColor.red(), visitedColor.green(), visitedColor.blue(), unvisitedColor.alpha());
 }
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 859348f..fad5a7b 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -62,6 +62,7 @@
 #include "TextOrientation.h"
 #include "ThemeTypes.h"
 #include "TransformOperations.h"
+#include "UnicodeBidi.h"
 #include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
@@ -160,24 +161,24 @@ protected:
     struct InheritedFlags {
         bool operator==(const InheritedFlags& other) const
         {
-            return (_empty_cells == other._empty_cells) &&
-                   (_caption_side == other._caption_side) &&
-                   (_list_style_type == other._list_style_type) &&
-                   (_list_style_position == other._list_style_position) &&
-                   (_visibility == other._visibility) &&
-                   (_text_align == other._text_align) &&
-                   (_text_transform == other._text_transform) &&
-                   (_text_decorations == other._text_decorations) &&
-                   (_cursor_style == other._cursor_style) &&
-                   (_direction == other._direction) &&
-                   (_border_collapse == other._border_collapse) &&
-                   (_white_space == other._white_space) &&
-                   (_box_direction == other._box_direction) &&
-                   (_visuallyOrdered == other._visuallyOrdered) &&
-                   (_force_backgrounds_to_white == other._force_backgrounds_to_white) &&
-                   (_pointerEvents == other._pointerEvents) &&
-                   (_insideLink == other._insideLink) &&
-                   (m_writingMode == other.m_writingMode);
+            return (_empty_cells == other._empty_cells)
+                && (_caption_side == other._caption_side)
+                && (_list_style_type == other._list_style_type)
+                && (_list_style_position == other._list_style_position)
+                && (_visibility == other._visibility)
+                && (_text_align == other._text_align)
+                && (_text_transform == other._text_transform)
+                && (_text_decorations == other._text_decorations)
+                && (_cursor_style == other._cursor_style)
+                && (_direction == other._direction)
+                && (_border_collapse == other._border_collapse)
+                && (_white_space == other._white_space)
+                && (_box_direction == other._box_direction)
+                && (_visuallyOrdered == other._visuallyOrdered)
+                && (_force_backgrounds_to_white == other._force_backgrounds_to_white)
+                && (_pointerEvents == other._pointerEvents)
+                && (_insideLink == other._insideLink)
+                && (m_writingMode == other.m_writingMode);
         }
 
         bool operator!=(const InheritedFlags& other) const { return !(*this == other); }
@@ -563,7 +564,6 @@ public:
         return wordBreak() == BreakWordBreak || wordWrap() == BreakWordWrap;
     }
 
-    StyleImage* backgroundImage() const { return m_background->background().image(); }
     EFillRepeat backgroundRepeatX() const { return static_cast<EFillRepeat>(m_background->background().repeatX()); }
     EFillRepeat backgroundRepeatY() const { return static_cast<EFillRepeat>(m_background->background().repeatY()); }
     CompositeOperator backgroundComposite() const { return static_cast<CompositeOperator>(m_background->background().composite()); }
@@ -881,9 +881,11 @@ public:
         setBorderRadius(LengthSize(Length(s.width(), Fixed), Length(s.height(), Fixed)));
     }
     
-    RoundedIntRect getRoundedBorderFor(const IntRect&) const;
-    RoundedIntRect getRoundedInnerBorderWithBorderWidths(const IntRect&, unsigned short topWidth, 
-                                                         unsigned short bottomWidth, unsigned short leftWidth, unsigned short rightWidth) const;
+    RoundedIntRect getRoundedBorderFor(const IntRect& borderRect, bool includeLogicalLeftEdge = true, bool includeLogicalRightEdge = true) const;
+    RoundedIntRect getRoundedInnerBorderFor(const IntRect& borderRect, bool includeLogicalLeftEdge = true, bool includeLogicalRightEdge = true) const;
+
+    RoundedIntRect getRoundedInnerBorderFor(const IntRect& borderRect,
+        int topWidth, int bottomWidth, int leftWidth, int rightWidth, bool includeLogicalLeftEdge, bool includeLogicalRightEdge) const;
 
     void setBorderLeftWidth(unsigned short v) { SET_VAR(surround, border.m_left.m_width, v) }
     void setBorderLeftStyle(EBorderStyle v) { SET_VAR(surround, border.m_left.m_style, v) }
@@ -1205,8 +1207,8 @@ public:
 
     bool isOriginalDisplayInlineType() const
     {
-        return originalDisplay() == INLINE || originalDisplay() == INLINE_BLOCK ||
-               originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE;
+        return originalDisplay() == INLINE || originalDisplay() == INLINE_BLOCK
+            || originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE;
     }
 
     void setWritingMode(WritingMode v) { inherited_flags.m_writingMode = v; }
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 08f2c15..5ad42ce 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -72,8 +72,7 @@ enum PseudoId {
     SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON,
     SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
     INPUT_LIST_BUTTON, INPUT_SPEECH_BUTTON, INNER_SPIN_BUTTON, OUTER_SPIN_BUTTON, VISITED_LINK,
-    METER_HORIZONTAL_BAR, METER_HORIZONTAL_OPTIMUM, METER_HORIZONTAL_SUBOPTIMAL, METER_HORIZONTAL_EVEN_LESS_GOOD,
-    METER_VERTICAL_BAR, METER_VERTICAL_OPTIMUM, METER_VERTICAL_SUBOPTIMAL, METER_VERTICAL_EVEN_LESS_GOOD, 
+    METER_BAR, METER_OPTIMUM, METER_SUBOPTIMAL, METER_EVEN_LESS_GOOD,
     AFTER_LAST_INTERNAL_PSEUDOID,
     FULL_SCREEN, FULL_SCREEN_DOCUMENT,
     FIRST_PUBLIC_PSEUDOID = FIRST_LINE,
@@ -120,10 +119,6 @@ enum ETableLayout {
     TAUTO, TFIXED
 };
 
-enum EUnicodeBidi {
-    UBNormal, Embed, Override, Isolate
-};
-
 // CSS Text Layout Module Level 3: Vertical writing support
 enum WritingMode {
     TopToBottomWritingMode, RightToLeftWritingMode, LeftToRightWritingMode, BottomToTopWritingMode
diff --git a/Source/WebCore/rendering/svg/RenderSVGInline.cpp b/Source/WebCore/rendering/svg/RenderSVGInline.cpp
index 543d14b..02a85ce 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInline.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGInline.cpp
@@ -33,6 +33,7 @@ namespace WebCore {
 RenderSVGInline::RenderSVGInline(Node* n)
     : RenderInline(n)
 {
+    setAlwaysCreateLineBoxes();
 }
 
 InlineFlowBox* RenderSVGInline::createInlineFlowBox()
diff --git a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
index a8aa0c8..c8539c6 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
@@ -179,8 +179,11 @@ VisiblePosition RenderSVGInlineText::positionForPoint(const IntPoint& point)
     const SVGTextFragment* closestDistanceFragment = 0;
     SVGInlineTextBox* closestDistanceBox = 0;
 
+    AffineTransform fragmentTransform;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
-        ASSERT(box->isSVGInlineTextBox());
+        if (!box->isSVGInlineTextBox())
+            continue;
+
         SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(box);
         Vector<SVGTextFragment>& fragments = textBox->textFragments();
 
@@ -188,8 +191,9 @@ VisiblePosition RenderSVGInlineText::positionForPoint(const IntPoint& point)
         for (unsigned i = 0; i < textFragmentsSize; ++i) {
             const SVGTextFragment& fragment = fragments.at(i);
             FloatRect fragmentRect(fragment.x, fragment.y - baseline, fragment.width, fragment.height);
-            if (!fragment.transform.isIdentity())
-                fragmentRect = fragment.transform.mapRect(fragmentRect);
+            fragment.buildFragmentTransform(fragmentTransform);
+            if (!fragmentTransform.isIdentity())
+                fragmentRect = fragmentTransform.mapRect(fragmentRect);
 
             float distance = powf(fragmentRect.x() - absolutePoint.x(), 2) +
                              powf(fragmentRect.y() + fragmentRect.height() / 2 - absolutePoint.y(), 2);
diff --git a/Source/WebCore/rendering/svg/RenderSVGPath.cpp b/Source/WebCore/rendering/svg/RenderSVGPath.cpp
index 1d9eca1..cc7c86e 100644
--- a/Source/WebCore/rendering/svg/RenderSVGPath.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGPath.cpp
@@ -128,8 +128,10 @@ void RenderSVGPath::layout()
         updateCachedBoundariesInParents = true;
 
     // Invalidate all resources of this client if our layout changed.
-    if (m_everHadLayout && selfNeedsLayout())
+    if (m_everHadLayout && selfNeedsLayout()) {
         SVGResourcesCache::clientLayoutChanged(this);
+        m_markerLayoutInfo.clear();
+    }
 
     // At this point LayoutRepainter already grabbed the old bounds,
     // recalculate them now so repaintAfterLayout() uses the new bounds.
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
index 96514af..09195f5 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
@@ -278,7 +278,7 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
 
         context = filterData->savedContext;
         filterData->savedContext = 0;
-#if !PLATFORM(CG)
+#if !USE(CG)
         if (filterData->sourceGraphicBuffer)
             filterData->sourceGraphicBuffer->transformColorSpace(ColorSpaceDeviceRGB, ColorSpaceLinearRGB);
 #endif
@@ -296,7 +296,7 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
         // Always true if filterData is just built (filterData->builded is false).
         if (!lastEffect->hasResult()) {
             lastEffect->apply();
-#if !PLATFORM(CG)
+#if !USE(CG)
             ImageBuffer* resultImage = lastEffect->asImageBuffer();
             if (resultImage)
                 resultImage->transformColorSpace(ColorSpaceLinearRGB, ColorSpaceDeviceRGB);
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp
index 64df700..f077bfd 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2010 University of Szeged
  * Copyright (C) 2010 Zoltan Herczeg
+ * Copyright (C) 2011 Renata Hodovan (reni@webkit.org)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,9 +33,35 @@
 #include "RenderSVGResource.h"
 #include "SVGFEImage.h"
 #include "SVGFilter.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
+
+void RenderSVGResourceFilterPrimitive::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderSVGHiddenContainer::styleDidChange(diff, oldStyle);
+
+    RenderObject* filter = parent();
+    if (!filter)
+        return;
+    ASSERT(filter->isSVGResourceFilter());
+
+    if (diff == StyleDifferenceEqual || !oldStyle)
+        return;
+
+    const SVGRenderStyle* newStyle = this->style()->svgStyle();
+    if (node()->hasTagName(SVGNames::feFloodTag)) {
+        if (newStyle->floodColor() != oldStyle->svgStyle()->floodColor())
+            static_cast<RenderSVGResourceFilter*>(filter)->primitiveAttributeChanged(this, SVGNames::flood_colorAttr);
+        if (newStyle->floodOpacity() != oldStyle->svgStyle()->floodOpacity())
+            static_cast<RenderSVGResourceFilter*>(filter)->primitiveAttributeChanged(this, SVGNames::flood_opacityAttr);
+    } else if (node()->hasTagName(SVGNames::feDiffuseLightingTag) || node()->hasTagName(SVGNames::feSpecularLightingTag)) {
+        if (newStyle->lightingColor() != oldStyle->svgStyle()->lightingColor())
+            static_cast<RenderSVGResourceFilter*>(filter)->primitiveAttributeChanged(this, SVGNames::lighting_colorAttr);
+    }
+}
+
 FloatRect RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion(FilterEffect* effect)
 {
     FloatRect uniteRect;
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h b/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h
index 8176d29..e8e4efc 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilterPrimitive.h
@@ -43,6 +43,8 @@ public:
     {
     }
 
+    virtual void styleDidChange(StyleDifference, const RenderStyle*);
+
     virtual const char* renderName() const { return "RenderSVGResourceFilterPrimitive"; }
     virtual bool isSVGResourceFilterPrimitive() const { return true; }
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceGradient.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceGradient.cpp
index 9f2bb8d..a42a227 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceGradient.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceGradient.cpp
@@ -37,7 +37,7 @@ namespace WebCore {
 RenderSVGResourceGradient::RenderSVGResourceGradient(SVGGradientElement* node)
     : RenderSVGResourceContainer(node)
     , m_shouldCollectGradientAttributes(true)
-#if PLATFORM(CG)
+#if USE(CG)
     , m_savedContext(0)
 #endif
 {
@@ -73,7 +73,7 @@ void RenderSVGResourceGradient::removeClientFromCache(RenderObject* client, bool
     markClientForInvalidation(client, markForInvalidation ? RepaintInvalidation : ParentOnlyInvalidation);
 }
 
-#if PLATFORM(CG)
+#if USE(CG)
 static inline bool createMaskAndSwapContextForTextGradient(GraphicsContext*& context,
                                                            GraphicsContext*& savedContext,
                                                            OwnPtr<ImageBuffer>& imageBuffer,
@@ -178,7 +178,7 @@ bool RenderSVGResourceGradient::applyResource(RenderObject* object, RenderStyle*
         // CG platforms will handle the gradient space transform for text after applying the
         // resource, so don't apply it here. For non-CG platforms, we want the text bounding
         // box applied to the gradient space transform now, so the gradient shader can use it.
-#if PLATFORM(CG)
+#if USE(CG)
         if (boundingBoxMode() && !objectBoundingBox.isEmpty() && !isPaintingText) {
 #else
         if (boundingBoxMode() && !objectBoundingBox.isEmpty()) {
@@ -201,7 +201,7 @@ bool RenderSVGResourceGradient::applyResource(RenderObject* object, RenderStyle*
     context->save();
 
     if (isPaintingText) {
-#if PLATFORM(CG)
+#if USE(CG)
         if (!createMaskAndSwapContextForTextGradient(context, m_savedContext, m_imageBuffer, object)) {
             context->restore();
             return false;
@@ -235,7 +235,7 @@ void RenderSVGResourceGradient::postApplyResource(RenderObject* object, Graphics
     ASSERT(resourceMode != ApplyToDefaultMode);
 
     if (resourceMode & ApplyToTextMode) {
-#if PLATFORM(CG)
+#if USE(CG)
         // CG requires special handling for gradient on text
         if (m_savedContext && m_gradient.contains(object)) {
             GradientData* gradientData = m_gradient.get(object);
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceGradient.h b/Source/WebCore/rendering/svg/RenderSVGResourceGradient.h
index ad40b53..a71b6c5 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceGradient.h
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceGradient.h
@@ -65,7 +65,7 @@ private:
     bool m_shouldCollectGradientAttributes : 1;
     HashMap<RenderObject*, GradientData*> m_gradient;
 
-#if PLATFORM(CG)
+#if USE(CG)
     GraphicsContext* m_savedContext;
     OwnPtr<ImageBuffer> m_imageBuffer;
 #endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp
index 7b24248..dc0df08 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp
@@ -154,7 +154,7 @@ void RenderSVGResourceMasker::drawContentIntoMaskImage(MaskerData* maskerData, c
 
     maskImageContext->restore();
 
-#if !PLATFORM(CG)
+#if !USE(CG)
     maskerData->maskImage->transformColorSpace(ColorSpaceDeviceRGB, ColorSpaceLinearRGB);
 #endif
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp b/Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp
index b82be1b..fc26978 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp
@@ -166,13 +166,13 @@ bool RenderSVGResourcePattern::applyResource(RenderObject* object, RenderStyle*
         if (resourceMode & ApplyToFillMode) {
             context->setTextDrawingMode(TextModeFill);
 
-#if PLATFORM(CG)
+#if USE(CG)
             context->applyFillPattern();
 #endif
         } else if (resourceMode & ApplyToStrokeMode) {
             context->setTextDrawingMode(TextModeStroke);
 
-#if PLATFORM(CG)
+#if USE(CG)
             context->applyStrokePattern();
 #endif
         }
diff --git a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp
index 5736333..d2a1103 100644
--- a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp
@@ -38,7 +38,7 @@ RenderSVGShadowTreeRootContainer::~RenderSVGShadowTreeRootContainer()
 {
     if (m_shadowRoot && m_shadowRoot->attached()) {
         m_shadowRoot->detach();
-        m_shadowRoot->clearShadowHost();
+        m_shadowRoot->clearSVGShadowHost();
     }
 }
 
@@ -59,7 +59,7 @@ void RenderSVGShadowTreeRootContainer::updateFromElement()
         useElement->buildPendingResource();
     }
 
-    ASSERT(m_shadowRoot->shadowHost() == useElement);
+    ASSERT(m_shadowRoot->svgShadowHost() == useElement);
 
     bool shouldRecreateTree = m_recreateTree;
     if (m_recreateTree) {
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index 8ca3d58..7af6cc6 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -57,6 +57,11 @@ RenderSVGText::RenderSVGText(SVGTextElement* node)
 {
 }
 
+bool RenderSVGText::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isInline();
+}
+
 RenderSVGText* RenderSVGText::locateRenderSVGTextAncestor(RenderObject* start)
 {
     ASSERT(start);
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index 93fc5f8..15ace2b 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -36,6 +36,8 @@ class RenderSVGText : public RenderSVGBlock {
 public:
     RenderSVGText(SVGTextElement*);
 
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+
     void setNeedsPositioningValuesUpdate() { m_needsPositioningValuesUpdate = true; }
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
     virtual FloatRect repaintRectInLocalCoordinates() const;
diff --git a/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp b/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
index 10735f6..85707da 100644
--- a/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
@@ -48,7 +48,7 @@ void SVGInlineFlowBox::paintSelectionBackground(PaintInfo& paintInfo)
     }
 }
 
-void SVGInlineFlowBox::paint(PaintInfo& paintInfo, int, int)
+void SVGInlineFlowBox::paint(PaintInfo& paintInfo, int, int, int, int)
 {
     ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
     ASSERT(!paintInfo.context->paintingDisabled());
@@ -64,7 +64,7 @@ void SVGInlineFlowBox::paint(PaintInfo& paintInfo, int, int)
             if (child->isSVGInlineTextBox())
                 computeTextMatchMarkerRectForRenderer(toRenderSVGInlineText(static_cast<SVGInlineTextBox*>(child)->textRenderer()));
 
-            child->paint(childPaintInfo, 0, 0);
+            child->paint(childPaintInfo, 0, 0, 0, 0);
         }
     }
 
@@ -91,6 +91,7 @@ void SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(RenderSVGInlineText
     RenderStyle* style = textRenderer->style();
     ASSERT(style);
 
+    AffineTransform fragmentTransform;
     Document* document = textRenderer->document();
     Vector<DocumentMarker> markers = document->markers()->markersForNode(textRenderer->node());
 
@@ -104,7 +105,9 @@ void SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(RenderSVGInlineText
 
         FloatRect markerRect;
         for (InlineTextBox* box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
-            ASSERT(box->isSVGInlineTextBox());
+            if (!box->isSVGInlineTextBox())
+                continue;
+
             SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(box);
 
             int markerStartPosition = max<int>(marker.startOffset - textBox->start(), 0);
@@ -127,8 +130,9 @@ void SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(RenderSVGInlineText
                     continue;
 
                 FloatRect fragmentRect = textBox->selectionRectForTextFragment(fragment, fragmentStartPosition, fragmentEndPosition, style);
-                if (!fragment.transform.isIdentity())
-                    fragmentRect = fragment.transform.mapRect(fragmentRect);
+                fragment.buildFragmentTransform(fragmentTransform);
+                if (!fragmentTransform.isIdentity())
+                    fragmentRect = fragmentTransform.mapRect(fragmentRect);
 
                 markerRect.unite(fragmentRect);
             }
diff --git a/Source/WebCore/rendering/svg/SVGInlineFlowBox.h b/Source/WebCore/rendering/svg/SVGInlineFlowBox.h
index 0e56c9f..304c616 100644
--- a/Source/WebCore/rendering/svg/SVGInlineFlowBox.h
+++ b/Source/WebCore/rendering/svg/SVGInlineFlowBox.h
@@ -41,7 +41,7 @@ public:
     void setLogicalHeight(int h) { m_logicalHeight = h; }
 
     void paintSelectionBackground(PaintInfo&);
-    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty, int lineTop, int lineBottom);
 
     virtual IntRect calculateBoundaries() const;
 
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
index 17bbfaa..bc550a6 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
@@ -70,8 +70,10 @@ int SVGInlineTextBox::offsetForPositionInFragment(const SVGTextFragment& fragmen
 
     // Eventually handle lengthAdjust="spacingAndGlyphs".
     // FIXME: Handle vertical text.
-    if (!fragment.transform.isIdentity())
-        textRun.setHorizontalGlyphStretch(narrowPrecisionToFloat(fragment.transform.xScale()));
+    AffineTransform fragmentTransform;
+    fragment.buildFragmentTransform(fragmentTransform);
+    if (!fragmentTransform.isIdentity())
+        textRun.setHorizontalGlyphStretch(narrowPrecisionToFloat(fragmentTransform.xScale()));
 
     return fragment.characterOffset - start() + textRenderer->scaledFont().offsetForPosition(textRun, position * scalingFactor, includePartialGlyphs);
 }
@@ -124,6 +126,7 @@ IntRect SVGInlineTextBox::selectionRect(int, int, int startPosition, int endPosi
     RenderStyle* style = text->style();
     ASSERT(style);
 
+    AffineTransform fragmentTransform;
     FloatRect selectionRect;
     int fragmentStartPosition = 0;
     int fragmentEndPosition = 0;
@@ -138,8 +141,9 @@ IntRect SVGInlineTextBox::selectionRect(int, int, int startPosition, int endPosi
             continue;
 
         FloatRect fragmentRect = selectionRectForTextFragment(fragment, fragmentStartPosition, fragmentEndPosition, style);
-        if (!fragment.transform.isIdentity())
-            fragmentRect = fragment.transform.mapRect(fragmentRect);
+        fragment.buildFragmentTransform(fragmentTransform);
+        if (!fragmentTransform.isIdentity())
+            fragmentRect = fragmentTransform.mapRect(fragmentRect);
 
         selectionRect.unite(fragmentRect);
     }
@@ -211,6 +215,7 @@ void SVGInlineTextBox::paintSelectionBackground(PaintInfo& paintInfo)
 
     int fragmentStartPosition = 0;
     int fragmentEndPosition = 0;
+    AffineTransform fragmentTransform;
     unsigned textFragmentsSize = m_textFragments.size();
     for (unsigned i = 0; i < textFragmentsSize; ++i) {
         SVGTextFragment& fragment = m_textFragments.at(i);
@@ -222,9 +227,9 @@ void SVGInlineTextBox::paintSelectionBackground(PaintInfo& paintInfo)
             continue;
 
         paintInfo.context->save();
-
-        if (!fragment.transform.isIdentity())
-            paintInfo.context->concatCTM(fragment.transform);
+        fragment.buildFragmentTransform(fragmentTransform);
+        if (!fragmentTransform.isIdentity())
+            paintInfo.context->concatCTM(fragmentTransform);
 
         paintInfo.context->setFillColor(backgroundColor, style->colorSpace());
         paintInfo.context->fillRect(selectionRectForTextFragment(fragment, fragmentStartPosition, fragmentEndPosition, style), backgroundColor, style->colorSpace());
@@ -236,7 +241,7 @@ void SVGInlineTextBox::paintSelectionBackground(PaintInfo& paintInfo)
     ASSERT(!m_paintingResource);
 }
 
-void SVGInlineTextBox::paint(PaintInfo& paintInfo, int, int)
+void SVGInlineTextBox::paint(PaintInfo& paintInfo, int, int, int, int)
 {
     ASSERT(paintInfo.shouldPaintWithinRoot(renderer()));
     ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
@@ -285,15 +290,16 @@ void SVGInlineTextBox::paint(PaintInfo& paintInfo, int, int)
             selectionStyle = style;
     }
 
+    AffineTransform fragmentTransform;
     unsigned textFragmentsSize = m_textFragments.size();
     for (unsigned i = 0; i < textFragmentsSize; ++i) {
         SVGTextFragment& fragment = m_textFragments.at(i);
         ASSERT(!m_paintingResource);
 
         paintInfo.context->save();
-
-        if (!fragment.transform.isIdentity())
-            paintInfo.context->concatCTM(fragment.transform);
+        fragment.buildFragmentTransform(fragmentTransform);
+        if (!fragmentTransform.isIdentity())
+            paintInfo.context->concatCTM(fragmentTransform);
 
         // Spec: All text decorations except line-through should be drawn before the text is filled and stroked; thus, the text is rendered on top of these decorations.
         int decorations = style->textDecorationsInEffect();
@@ -694,13 +700,14 @@ IntRect SVGInlineTextBox::calculateBoundaries() const
 
     float baseline = textRenderer->scaledFont().fontMetrics().floatAscent() / scalingFactor;
 
+    AffineTransform fragmentTransform;
     unsigned textFragmentsSize = m_textFragments.size();
     for (unsigned i = 0; i < textFragmentsSize; ++i) {
         const SVGTextFragment& fragment = m_textFragments.at(i);
         FloatRect fragmentRect(fragment.x, fragment.y - baseline, fragment.width, fragment.height);
-
-        if (!fragment.transform.isIdentity())
-            fragmentRect = fragment.transform.mapRect(fragmentRect);
+        fragment.buildFragmentTransform(fragmentTransform);
+        if (!fragmentTransform.isIdentity())
+            fragmentRect = fragmentTransform.mapRect(fragmentRect);
 
         textRect.unite(fragmentRect);
     }
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.h b/Source/WebCore/rendering/svg/SVGInlineTextBox.h
index 79c836f..ce48019 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.h
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.h
@@ -46,7 +46,7 @@ public:
     virtual float positionForOffset(int offset) const;
 
     void paintSelectionBackground(PaintInfo&);
-    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty, int lineTop, int lineBottom);
     virtual IntRect selectionRect(int absx, int absy, int startPosition, int endPosition);
 
     bool mapStartEndPositionsIntoFragmentCoordinates(const SVGTextFragment&, int& startPosition, int& endPosition) const;
diff --git a/Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.cpp b/Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.cpp
index dea5a0c..27b37f1 100644
--- a/Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.cpp
+++ b/Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.cpp
@@ -98,6 +98,15 @@ FloatRect SVGMarkerLayoutInfo::calculateBoundaries(RenderSVGResourceMarker* star
     return bounds;
 }
 
+void SVGMarkerLayoutInfo::clear()
+{
+    m_midMarker = 0;
+    m_elementIndex = 0;
+    m_strokeWidth = 0;
+    m_markerData.updateTypeAndMarker(SVGMarkerData::Unknown, 0);
+    m_layout.clear();
+}
+
 void SVGMarkerLayoutInfo::drawMarkers(PaintInfo& paintInfo)
 {
     if (m_layout.isEmpty())
diff --git a/Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.h b/Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.h
index 32317b9..c2301cc 100644
--- a/Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.h
+++ b/Source/WebCore/rendering/svg/SVGMarkerLayoutInfo.h
@@ -57,6 +57,7 @@ public:
     RenderSVGResourceMarker* midMarker() const { return m_midMarker; }
     int& elementIndex() { return m_elementIndex; }
     void addLayoutedMarker(RenderSVGResourceMarker*, const FloatPoint& origin, float angle);
+    void clear();
 
 private:
     RenderSVGResourceMarker* m_midMarker;
diff --git a/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp b/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
index a099f87..7d3f909 100644
--- a/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
@@ -506,8 +506,12 @@ static inline void writeSVGInlineTextBox(TextStream& ts, SVGInlineTextBox* textB
 
 static inline void writeSVGInlineTextBoxes(TextStream& ts, const RenderText& text, int indent)
 {
-    for (InlineTextBox* box = text.firstTextBox(); box; box = box->nextTextBox())
+    for (InlineTextBox* box = text.firstTextBox(); box; box = box->nextTextBox()) {
+        if (!box->isSVGInlineTextBox())
+            continue;
+
         writeSVGInlineTextBox(ts, static_cast<SVGInlineTextBox*>(box), indent);
+    }
 }
 
 static void writeStandardPrefix(TextStream& ts, const RenderObject& object, int indent)
diff --git a/Source/WebCore/rendering/svg/SVGResourcesCache.cpp b/Source/WebCore/rendering/svg/SVGResourcesCache.cpp
index 886f76a..74d2950 100644
--- a/Source/WebCore/rendering/svg/SVGResourcesCache.cpp
+++ b/Source/WebCore/rendering/svg/SVGResourcesCache.cpp
@@ -126,6 +126,10 @@ void SVGResourcesCache::clientStyleChanged(RenderObject* renderer, StyleDifferen
     if (diff == StyleDifferenceEqual)
         return;
 
+    // In this case the proper SVGFE*Element will imply whether the modifided CSS properties implies a relayout or repaint.
+    if (renderer->isSVGResourceFilterPrimitive() && diff == StyleDifferenceRepaint)
+        return;
+
     clientUpdatedFromElement(renderer, newStyle);
     RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer, false);
 }
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
index ddbd3ea..cc6cb75 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-void SVGRootInlineBox::paint(PaintInfo& paintInfo, int, int)
+void SVGRootInlineBox::paint(PaintInfo& paintInfo, int, int, int, int)
 {
     ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
     ASSERT(!paintInfo.context->paintingDisabled());
@@ -63,7 +63,7 @@ void SVGRootInlineBox::paint(PaintInfo& paintInfo, int, int)
             if (child->isSVGInlineTextBox())
                 SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(toRenderSVGInlineText(static_cast<SVGInlineTextBox*>(child)->textRenderer()));
 
-            child->paint(childPaintInfo, 0, 0);
+            child->paint(childPaintInfo, 0, 0, 0, 0);
         }
     }
 
@@ -103,13 +103,13 @@ void SVGRootInlineBox::layoutCharactersInTextBoxes(InlineFlowBox* start, SVGText
             SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(child);
             characterLayout.layoutInlineTextBox(textBox);
         } else {
-            ASSERT(child->isInlineFlowBox());
-
             // Skip generated content.
             Node* node = child->renderer()->node();
             if (!node)
                 continue;
 
+            ASSERT(child->isInlineFlowBox());
+
             SVGInlineFlowBox* flowBox = static_cast<SVGInlineFlowBox*>(child);
             bool isTextPath = node->hasTagName(SVGNames::textPathTag);
             if (isTextPath) {
@@ -146,12 +146,12 @@ void SVGRootInlineBox::layoutChildBoxes(InlineFlowBox* start)
             textBox->setLogicalWidth(boxRect.width());
             textBox->setLogicalHeight(boxRect.height());
         } else {
-            ASSERT(child->isInlineFlowBox());
-
             // Skip generated content.
             if (!child->renderer()->node())
                 continue;
 
+            ASSERT(child->isInlineFlowBox());
+
             SVGInlineFlowBox* flowBox = static_cast<SVGInlineFlowBox*>(child);
             layoutChildBoxes(flowBox);
 
@@ -214,6 +214,8 @@ InlineBox* SVGRootInlineBox::closestLeafChildForPosition(const IntPoint& point)
     // FIXME: Check for vertical text!
     InlineBox* closestLeaf = 0;
     for (InlineBox* leaf = firstLeaf; leaf; leaf = leaf->nextLeafChild()) {
+        if (!leaf->isSVGInlineTextBox())
+            continue;
         if (point.y() < leaf->m_y)
             continue;
         if (point.y() > leaf->m_y + leaf->virtualLogicalHeight())
@@ -274,8 +276,13 @@ static inline void reverseInlineBoxRangeAndValueListsIfNeeded(void* userData, Ve
         if (first == last || first == --last)
             return;
 
-        ASSERT((*first)->isSVGInlineTextBox());
-        ASSERT((*last)->isSVGInlineTextBox());
+        if (!(*last)->isSVGInlineTextBox() || !(*first)->isSVGInlineTextBox()) {
+            InlineBox* temp = *first;
+            *first = *last;
+            *last = temp;
+            ++first;
+            continue;
+        }
 
         SVGInlineTextBox* firstTextBox = static_cast<SVGInlineTextBox*>(*first);
         SVGInlineTextBox* lastTextBox = static_cast<SVGInlineTextBox*>(*last);
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.h b/Source/WebCore/rendering/svg/SVGRootInlineBox.h
index 39612e7..a83af64 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.h
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.h
@@ -45,7 +45,7 @@ public:
     virtual int virtualLogicalHeight() const { return m_logicalHeight; }
     void setLogicalHeight(int height) { m_logicalHeight = height; }
 
-    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty, int lineTop, int lineBottom);
 
     void computePerCharacterLayoutInformation();
 
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp b/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
index 9ccdef0..ac4a63e 100644
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
+++ b/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
@@ -53,21 +53,21 @@ PassRefPtr<Element> SVGShadowTreeContainerElement::cloneElementWithoutAttributes
 }
 // SVGShadowTreeRootElement
 
-inline SVGShadowTreeRootElement::SVGShadowTreeRootElement(Document* document, SVGUseElement* shadowParent)
+inline SVGShadowTreeRootElement::SVGShadowTreeRootElement(Document* document, SVGUseElement* host)
     : SVGShadowTreeContainerElement(document)
 {
-    setShadowHost(shadowParent);
+    setParent(host);
     setInDocument();
 }
 
-PassRefPtr<SVGShadowTreeRootElement> SVGShadowTreeRootElement::create(Document* document, SVGUseElement* shadowParent)
+PassRefPtr<SVGShadowTreeRootElement> SVGShadowTreeRootElement::create(Document* document, SVGUseElement* host)
 {
-    return adoptRef(new SVGShadowTreeRootElement(document, shadowParent));
+    return adoptRef(new SVGShadowTreeRootElement(document, host));
 }
 
 void SVGShadowTreeRootElement::attachElement(PassRefPtr<RenderStyle> style, RenderArena* arena)
 {
-    ASSERT(shadowHost());
+    ASSERT(svgShadowHost());
 
     // Create the renderer with the specified style
     RenderObject* renderer = createRenderer(arena, style.get());
@@ -81,12 +81,12 @@ void SVGShadowTreeRootElement::attachElement(PassRefPtr<RenderStyle> style, Rend
 
     // Add the renderer to the render tree
     if (renderer)
-        shadowHost()->renderer()->addChild(renderer);
+        svgShadowHost()->renderer()->addChild(renderer);
 }
 
-void SVGShadowTreeRootElement::clearShadowHost()
+void SVGShadowTreeRootElement::clearSVGShadowHost()
 {
-    setShadowHost(0);
+    setParent(0);
 }
 
 }
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h b/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
index 2952e35..8cbd4b7 100644
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
+++ b/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
@@ -53,13 +53,15 @@ private:
 
 class SVGShadowTreeRootElement : public SVGShadowTreeContainerElement {
 public:
-    static PassRefPtr<SVGShadowTreeRootElement> create(Document*, SVGUseElement* shadowParent);
+    static PassRefPtr<SVGShadowTreeRootElement> create(Document*, SVGUseElement* host);
 
     void attachElement(PassRefPtr<RenderStyle>, RenderArena*);
-    void clearShadowHost();
+    void clearSVGShadowHost();
+
+    virtual bool isSVGShadowRoot() const { return true; }
 
 private:
-    SVGShadowTreeRootElement(Document*, SVGUseElement* shadowParent);
+    SVGShadowTreeRootElement(Document*, SVGUseElement* host);
 };
 
 }
diff --git a/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
index 47311bd..4391013 100644
--- a/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
@@ -53,7 +53,7 @@ void SVGTextChunkBuilder::buildTextChunks(Vector<SVGInlineTextBox*>& lineLayoutB
     unsigned boxPosition = 0;
     unsigned boxCount = lineLayoutBoxes.size();
     for (; boxPosition < boxCount; ++boxPosition) {
-        SVGInlineTextBox* textBox = lineLayoutBoxes.at(boxPosition);
+        SVGInlineTextBox* textBox = lineLayoutBoxes[boxPosition];
         if (!textBox->startsNewTextChunk())
             continue;
 
@@ -82,14 +82,14 @@ void SVGTextChunkBuilder::layoutTextChunks(Vector<SVGInlineTextBox*>& lineLayout
 
     unsigned chunkCount = m_textChunks.size();
     for (unsigned i = 0; i < chunkCount; ++i)
-        processTextChunk(m_textChunks.at(i));
+        processTextChunk(m_textChunks[i]);
 
     m_textChunks.clear();
 }
 
 void SVGTextChunkBuilder::addTextChunk(Vector<SVGInlineTextBox*>& lineLayoutBoxes, unsigned boxStart, unsigned boxCount)
 {
-    SVGInlineTextBox* textBox = lineLayoutBoxes.at(boxStart);
+    SVGInlineTextBox* textBox = lineLayoutBoxes[boxStart];
     ASSERT(textBox);
 
     RenderSVGInlineText* textRenderer = toRenderSVGInlineText(textBox->textRenderer());
@@ -127,7 +127,7 @@ void SVGTextChunkBuilder::addTextChunk(Vector<SVGInlineTextBox*>& lineLayoutBoxe
     // Handle 'lengthAdjust' property.
     float desiredTextLength = 0;
     if (SVGTextContentElement* textContentElement = SVGTextContentElement::elementFromRenderer(textRenderer->parent())) {
-        desiredTextLength = textContentElement->textLength().value(textContentElement);
+        desiredTextLength = textContentElement->specifiedTextLength().value(textContentElement);
 
         switch (static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust())) {
         case SVGTextContentElement::LENGTHADJUST_UNKNOWN:
@@ -145,7 +145,7 @@ void SVGTextChunkBuilder::addTextChunk(Vector<SVGInlineTextBox*>& lineLayoutBoxe
 
     Vector<SVGInlineTextBox*>& boxes = chunk.boxes();
     for (unsigned i = boxStart; i < boxStart + boxCount; ++i)
-        boxes.append(lineLayoutBoxes.at(i));
+        boxes.append(lineLayoutBoxes[i]);
 
     m_textChunks.append(chunk);
 }
@@ -173,26 +173,26 @@ void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
             float textLengthShift = (chunk.desiredTextLength() - chunkLength) / chunkCharacters;
             unsigned atCharacter = 0;
             for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
-                Vector<SVGTextFragment>& fragments = boxes.at(boxPosition)->textFragments();
+                Vector<SVGTextFragment>& fragments = boxes[boxPosition]->textFragments();
                 if (fragments.isEmpty())
-                    continue;    
+                    continue;
                 processTextLengthSpacingCorrection(isVerticalText, textLengthShift, fragments, atCharacter);
             }
         } else {
             ASSERT(chunk.hasLengthAdjustSpacingAndGlyphs());
-            float scale = chunk.desiredTextLength() / chunkLength;
+            float textLengthScale = chunk.desiredTextLength() / chunkLength;
             AffineTransform spacingAndGlyphsTransform;
 
             bool foundFirstFragment = false;
             for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
-                SVGInlineTextBox* textBox = boxes.at(boxPosition);
+                SVGInlineTextBox* textBox = boxes[boxPosition];
                 Vector<SVGTextFragment>& fragments = textBox->textFragments();
                 if (fragments.isEmpty())
                     continue;
-    
+
                 if (!foundFirstFragment) {
                     foundFirstFragment = true;
-                    buildSpacingAndGlyphsTransform(isVerticalText, scale, fragments.first(), spacingAndGlyphsTransform);
+                    buildSpacingAndGlyphsTransform(isVerticalText, textLengthScale, fragments.first(), spacingAndGlyphsTransform);
                 }
 
                 m_textBoxTransformations.set(textBox, spacingAndGlyphsTransform);
@@ -212,7 +212,7 @@ void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
 
     float textAnchorShift = chunk.calculateTextAnchorShift(chunkLength);
     for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
-        Vector<SVGTextFragment>& fragments = boxes.at(boxPosition)->textFragments();
+        Vector<SVGTextFragment>& fragments = boxes[boxPosition]->textFragments();
         if (fragments.isEmpty())
             continue;
         processTextAnchorCorrection(isVerticalText, textAnchorShift, fragments);
@@ -223,7 +223,7 @@ void SVGTextChunkBuilder::processTextLengthSpacingCorrection(bool isVerticalText
 {
     unsigned fragmentCount = fragments.size();
     for (unsigned i = 0; i < fragmentCount; ++i) {
-        SVGTextFragment& fragment = fragments.at(i);
+        SVGTextFragment& fragment = fragments[i];
 
         if (isVerticalText)
             fragment.y += textLengthShift * atCharacter;
@@ -238,7 +238,7 @@ void SVGTextChunkBuilder::processTextAnchorCorrection(bool isVerticalText, float
 {
     unsigned fragmentCount = fragments.size();
     for (unsigned i = 0; i < fragmentCount; ++i) {
-        SVGTextFragment& fragment = fragments.at(i);
+        SVGTextFragment& fragment = fragments[i];
 
         if (isVerticalText)
             fragment.y += textAnchorShift;
diff --git a/Source/WebCore/rendering/svg/SVGTextFragment.h b/Source/WebCore/rendering/svg/SVGTextFragment.h
index b5b3c57..a44d0fa 100644
--- a/Source/WebCore/rendering/svg/SVGTextFragment.h
+++ b/Source/WebCore/rendering/svg/SVGTextFragment.h
@@ -31,6 +31,7 @@ struct SVGTextFragment {
         : characterOffset(0)
         , metricsListOffset(0)
         , length(0)
+        , isTextOnPath(false)
         , x(0)
         , y(0)
         , width(0)
@@ -38,19 +39,74 @@ struct SVGTextFragment {
     {
     }
 
+    enum TransformType {
+        TransformRespectingTextLength,
+        TransformIgnoringTextLength
+    };
+
+    void buildFragmentTransform(AffineTransform& result, TransformType type = TransformRespectingTextLength) const
+    {
+        if (type == TransformIgnoringTextLength) {
+            result = transform;
+            transformAroundOrigin(result);
+            return;
+        }
+
+        if (isTextOnPath)
+            buildTransformForTextOnPath(result);
+        else
+            buildTransformForTextOnLine(result);
+    }
+
     // The first rendered character starts at RenderSVGInlineText::characters() + characterOffset.
     unsigned characterOffset;
     unsigned metricsListOffset;
-    unsigned length;
+    unsigned length : 31;
+    bool isTextOnPath : 1;
 
     float x;
     float y;
     float width;
     float height;
 
-    // Includes rotation/glyph-orientation-(horizontal|vertical) transforms, lengthAdjust="spacingAndGlyphs" (for textPath only),
-    // as well as orientation related shifts (see SVGTextLayoutEngine, which builds this transformation).
+    // Includes rotation/glyph-orientation-(horizontal|vertical) transforms, as well as orientation related shifts
+    // (see SVGTextLayoutEngine, which builds this transformation).
     AffineTransform transform;
+
+    // Contains lengthAdjust related transformations, which are not allowd to influence the SVGTextQuery code.
+    AffineTransform lengthAdjustTransform;
+
+private:
+    void transformAroundOrigin(AffineTransform& result) const
+    {
+        // Returns (translate(x, y) * result) * translate(-x, -y).
+        result.setE(result.e() + x);
+        result.setF(result.f() + y);
+        result.translate(-x, -y);
+    }
+
+    void buildTransformForTextOnPath(AffineTransform& result) const
+    {
+        // For text-on-path layout, multiply the transform with the lengthAdjustTransform before orienting the resulting transform.
+        result = lengthAdjustTransform.isIdentity() ? transform : transform * lengthAdjustTransform;
+        if (!result.isIdentity())
+            transformAroundOrigin(result);
+    }
+
+    void buildTransformForTextOnLine(AffineTransform& result) const
+    {
+        // For text-on-line layout, orient the transform first, then multiply the lengthAdjustTransform with the oriented transform.
+        if (transform.isIdentity()) {
+            result = lengthAdjustTransform;
+            return;
+        }
+
+        result = transform;
+        transformAroundOrigin(result);
+
+        if (!lengthAdjustTransform.isIdentity())
+            result = lengthAdjustTransform * result;
+    }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
index 4c227b4..df2cffe 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
@@ -34,11 +34,44 @@ SVGTextLayoutAttributes::SVGTextLayoutAttributes(RenderSVGInlineText* context)
 
 void SVGTextLayoutAttributes::reserveCapacity(unsigned length)
 {
-    m_xValues.reserveCapacity(length);
-    m_yValues.reserveCapacity(length);
-    m_dxValues.reserveCapacity(length);
-    m_dyValues.reserveCapacity(length);
-    m_rotateValues.reserveCapacity(length);
+    m_positioningLists.xValues.reserveCapacity(length);
+    m_positioningLists.yValues.reserveCapacity(length);
+    m_positioningLists.dxValues.reserveCapacity(length);
+    m_positioningLists.dyValues.reserveCapacity(length);
+    m_positioningLists.rotateValues.reserveCapacity(length);
+    m_textMetricsValues.reserveCapacity(length);
+}
+
+void SVGTextLayoutAttributes::PositioningLists::fillWithEmptyValues(unsigned length)
+{
+    xValues.fill(SVGTextLayoutAttributes::emptyValue(), length);
+    yValues.fill(SVGTextLayoutAttributes::emptyValue(), length);
+    dxValues.fill(SVGTextLayoutAttributes::emptyValue(), length);
+    dyValues.fill(SVGTextLayoutAttributes::emptyValue(), length);
+    rotateValues.fill(SVGTextLayoutAttributes::emptyValue(), length);
+}
+
+void SVGTextLayoutAttributes::PositioningLists::appendEmptyValues()
+{
+    xValues.append(SVGTextLayoutAttributes::emptyValue());
+    yValues.append(SVGTextLayoutAttributes::emptyValue());
+    dxValues.append(SVGTextLayoutAttributes::emptyValue());
+    dyValues.append(SVGTextLayoutAttributes::emptyValue());
+    rotateValues.append(SVGTextLayoutAttributes::emptyValue());
+}
+
+static inline float safeValueAtPosition(const Vector<float>& values, unsigned position)
+{
+    return position < values.size() ? values[position] : SVGTextLayoutAttributes::emptyValue();
+}
+
+void SVGTextLayoutAttributes::PositioningLists::appendValuesFromPosition(const PositioningLists& source, unsigned position)
+{
+    xValues.append(safeValueAtPosition(source.xValues, position));
+    yValues.append(safeValueAtPosition(source.yValues, position));
+    dxValues.append(safeValueAtPosition(source.dxValues, position));
+    dyValues.append(safeValueAtPosition(source.dyValues, position));
+    rotateValues.append(safeValueAtPosition(source.rotateValues, position));
 }
 
 float SVGTextLayoutAttributes::emptyValue()
@@ -69,23 +102,23 @@ void SVGTextLayoutAttributes::dump() const
     fprintf(stderr, "context: %p\n", m_context);
 
     fprintf(stderr, "x values: ");
-    dumpLayoutVector(m_xValues);
+    dumpLayoutVector(m_positioningLists.xValues);
     fprintf(stderr, "\n");
 
     fprintf(stderr, "y values: ");
-    dumpLayoutVector(m_yValues);
+    dumpLayoutVector(m_positioningLists.yValues);
     fprintf(stderr, "\n");
 
     fprintf(stderr, "dx values: ");
-    dumpLayoutVector(m_dxValues);
+    dumpLayoutVector(m_positioningLists.dxValues);
     fprintf(stderr, "\n");
 
     fprintf(stderr, "dy values: ");
-    dumpLayoutVector(m_dyValues);
+    dumpLayoutVector(m_positioningLists.dyValues);
     fprintf(stderr, "\n");
 
     fprintf(stderr, "rotate values: ");
-    dumpLayoutVector(m_rotateValues);
+    dumpLayoutVector(m_positioningLists.rotateValues);
     fprintf(stderr, "\n");
 
     fprintf(stderr, "character data values:\n");
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
index fc6bd10..8b45d3d 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
@@ -31,6 +31,18 @@ class RenderSVGInlineText;
 
 class SVGTextLayoutAttributes {
 public:
+    struct PositioningLists {
+        void fillWithEmptyValues(unsigned length);
+        void appendEmptyValues();
+        void appendValuesFromPosition(const PositioningLists&, unsigned position);
+
+        Vector<float> xValues;
+        Vector<float> yValues;
+        Vector<float> dxValues;
+        Vector<float> dyValues;
+        Vector<float> rotateValues;
+    };
+
     SVGTextLayoutAttributes(RenderSVGInlineText* context = 0);
 
     void reserveCapacity(unsigned length);
@@ -40,31 +52,30 @@ public:
 
     RenderSVGInlineText* context() const { return m_context; }
 
-    Vector<float>& xValues() { return m_xValues; }
-    const Vector<float>& xValues() const { return m_xValues; }
+    PositioningLists& positioningLists() { return m_positioningLists; }
+    const PositioningLists& positioningLists() const { return m_positioningLists; }
+
+    Vector<float>& xValues() { return m_positioningLists.xValues; }
+    const Vector<float>& xValues() const { return m_positioningLists.xValues; }
 
-    Vector<float>& yValues() { return m_yValues; }
-    const Vector<float>& yValues() const { return m_yValues; }
+    Vector<float>& yValues() { return m_positioningLists.yValues; }
+    const Vector<float>& yValues() const { return m_positioningLists.yValues; }
 
-    Vector<float>& dxValues() { return m_dxValues; }
-    const Vector<float>& dxValues() const { return m_dxValues; }
+    Vector<float>& dxValues() { return m_positioningLists.dxValues; }
+    const Vector<float>& dxValues() const { return m_positioningLists.dxValues; }
 
-    Vector<float>& dyValues() { return m_dyValues; }
-    const Vector<float>& dyValues() const { return m_dyValues; }
+    Vector<float>& dyValues() { return m_positioningLists.dyValues; }
+    const Vector<float>& dyValues() const { return m_positioningLists.dyValues; }
 
-    Vector<float>& rotateValues() { return m_rotateValues; }
-    const Vector<float>& rotateValues() const { return m_rotateValues; }
+    Vector<float>& rotateValues() { return m_positioningLists.rotateValues; }
+    const Vector<float>& rotateValues() const { return m_positioningLists.rotateValues; }
 
     Vector<SVGTextMetrics>& textMetricsValues() { return m_textMetricsValues; }
     const Vector<SVGTextMetrics>& textMetricsValues() const { return m_textMetricsValues; }
 
 private:
     RenderSVGInlineText* m_context;
-    Vector<float> m_xValues;
-    Vector<float> m_yValues;
-    Vector<float> m_dxValues;
-    Vector<float> m_dyValues;
-    Vector<float> m_rotateValues;
+    PositioningLists m_positioningLists;
     Vector<SVGTextMetrics> m_textMetricsValues;
 };
 
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
index 86be424..42eb8e8 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,20 +38,19 @@ SVGTextLayoutAttributesBuilder::SVGTextLayoutAttributesBuilder()
 void SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree(RenderSVGText* textRoot)
 {
     ASSERT(textRoot);
-    m_scopes.clear();
 
     // Build list of x/y/dx/dy/rotate values for each subtree element that may define these values (tspan/textPath etc).
     unsigned atCharacter = 0;
     UChar lastCharacter = '\0';
-    buildLayoutScopes(textRoot, atCharacter, lastCharacter);
+    collectTextPositioningElements(textRoot, atCharacter, lastCharacter);
 
     if (!atCharacter)
         return;
 
-    // Build list of x/y/dx/dy/rotate values for the outermost <text> element.
-    buildOutermostLayoutScope(textRoot, atCharacter);
+    // Collect x/y/dx/dy/rotate values for each character, stored in the m_positioningLists.xValues()/etc. lists.
+    buildLayoutAttributesForAllCharacters(textRoot, atCharacter);
 
-    // Propagate layout attributes to each RenderSVGInlineText object.
+    // Propagate layout attributes to each RenderSVGInlineText object, and the whole list to the RenderSVGText root.
     Vector<SVGTextLayoutAttributes>& allAttributes = textRoot->layoutAttributes();
     allAttributes.clear();
     atCharacter = 0;
@@ -85,40 +84,6 @@ static inline void extractFloatValuesFromSVGNumberList(const SVGNumberList& list
         floatValues.append(list.at(i));
 }
 
-void SVGTextLayoutAttributesBuilder::buildLayoutScope(LayoutScope& scope, RenderObject* renderer, unsigned textContentStart, unsigned textContentLength) const
-{
-    ASSERT(renderer);
-    ASSERT(renderer->style());
-
-    scope.textContentStart = textContentStart;
-    scope.textContentLength = textContentLength;
-
-    SVGTextPositioningElement* element = SVGTextPositioningElement::elementFromRenderer(renderer);
-    if (!element)
-        return;
-
-    SVGTextLayoutAttributes& attributes = scope.attributes;
-    extractFloatValuesFromSVGLengthList(element, element->x(), attributes.xValues(), textContentLength);
-    extractFloatValuesFromSVGLengthList(element, element->y(), attributes.yValues(), textContentLength);
-    extractFloatValuesFromSVGLengthList(element, element->dx(), attributes.dxValues(), textContentLength);
-    extractFloatValuesFromSVGLengthList(element, element->dy(), attributes.dyValues(), textContentLength);
-    extractFloatValuesFromSVGNumberList(element->rotate(), attributes.rotateValues(), textContentLength);
-
-    // The last rotation value spans the whole scope.
-    Vector<float>& rotateValues = attributes.rotateValues();
-    if (rotateValues.isEmpty())
-        return;
-
-    unsigned rotateValuesSize = rotateValues.size();
-    if (rotateValuesSize == textContentLength)
-        return;
-
-    float lastRotation = rotateValues.last();
-
-    rotateValues.resize(textContentLength);
-    for (unsigned i = rotateValuesSize; i < textContentLength; ++i)
-        rotateValues.at(i) = lastRotation;
-}
 
 static inline bool characterIsSpace(const UChar& character)
 {
@@ -136,56 +101,84 @@ static inline bool shouldPreserveAllWhiteSpace(RenderStyle* style)
     return style->whiteSpace() == PRE;
 }
  
-void SVGTextLayoutAttributesBuilder::buildLayoutScopes(RenderObject* start, unsigned& atCharacter, UChar& lastCharacter)
+static inline void processRenderSVGInlineText(RenderSVGInlineText* text, unsigned& atCharacter, UChar& lastCharacter)
 {
-    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) { 
-        if (child->isSVGInlineText()) {
-            RenderSVGInlineText* text = toRenderSVGInlineText(child);
+    if (shouldPreserveAllWhiteSpace(text->style())) {
+        atCharacter += text->textLength();
+        return;
+    }
 
-            if (!shouldPreserveAllWhiteSpace(text->style())) {
-                const UChar* characters = text->characters();
-                unsigned textLength = text->textLength();    
-                for (unsigned textPosition = 0; textPosition < textLength; ++textPosition) {
-                    const UChar& currentCharacter = characters[textPosition];
-                    if (characterIsSpace(currentCharacter) && characterIsSpaceOrNull(lastCharacter))
-                        continue;
+    const UChar* characters = text->characters();
+    unsigned textLength = text->textLength();    
+    for (unsigned textPosition = 0; textPosition < textLength; ++textPosition) {
+        const UChar& currentCharacter = characters[textPosition];
+        if (characterIsSpace(currentCharacter) && characterIsSpaceOrNull(lastCharacter))
+            continue;
 
-                    lastCharacter = currentCharacter;
-                    ++atCharacter;
-                }
-            } else
-                atCharacter += text->textLength();
+        lastCharacter = currentCharacter;
+        ++atCharacter;
+    }
+}
+
+void SVGTextLayoutAttributesBuilder::collectTextPositioningElements(RenderObject* start, unsigned& atCharacter, UChar& lastCharacter)
+{
+    ASSERT(!start->isSVGText() || m_textPositions.isEmpty());
 
+    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) { 
+        if (child->isSVGInlineText()) {
+            processRenderSVGInlineText(toRenderSVGInlineText(child), atCharacter, lastCharacter);
             continue;
         }
 
         if (!child->isSVGInline())
             continue;
 
-        unsigned textContentStart = atCharacter;
-        buildLayoutScopes(child, atCharacter, lastCharacter);
+        SVGTextPositioningElement* element = SVGTextPositioningElement::elementFromRenderer(child);
+        unsigned atPosition = m_textPositions.size();
+        if (element)
+            m_textPositions.append(TextPosition(element, atCharacter));
+
+        collectTextPositioningElements(child, atCharacter, lastCharacter);
+
+        if (!element)
+            continue;
 
-        LayoutScope scope;
-        buildLayoutScope(scope, child, textContentStart, atCharacter - textContentStart);
-        m_scopes.append(scope);
+        // Update text position, after we're back from recursion.
+        TextPosition& position = m_textPositions[atPosition];
+        ASSERT(!position.length);
+        position.length = atCharacter - position.start;
     }
 }
 
-void SVGTextLayoutAttributesBuilder::buildOutermostLayoutScope(RenderSVGText* textRoot, unsigned textLength)
+void SVGTextLayoutAttributesBuilder::buildLayoutAttributesForAllCharacters(RenderSVGText* textRoot, unsigned textLength)
 {
-    LayoutScope scope;
-    buildLayoutScope(scope, textRoot, 0, textLength);
+    ASSERT(textLength);
 
-    // Handle <text> x/y default attributes.
-    Vector<float>& xValues = scope.attributes.xValues();
-    if (xValues.isEmpty())
-        xValues.append(0);
+    SVGTextPositioningElement* outermostTextElement = SVGTextPositioningElement::elementFromRenderer(textRoot);
+    ASSERT(outermostTextElement);
 
-    Vector<float>& yValues = scope.attributes.yValues();
-    if (yValues.isEmpty())
-        yValues.append(0);
+    // Fill the lists with the special emptyValue marker.
+    m_positioningLists.fillWithEmptyValues(textLength);
 
-    m_scopes.prepend(scope);
+    // Grab outermost <text> element value lists and insert them in the m_positioningLists.
+    TextPosition wholeTextPosition(outermostTextElement, 0, textLength);
+    fillAttributesAtPosition(wholeTextPosition);
+
+    // Handle x/y default attributes.
+    float& xFirst = m_positioningLists.xValues.first();
+    if (xFirst == SVGTextLayoutAttributes::emptyValue())
+        xFirst = 0;
+
+    float& yFirst = m_positioningLists.yValues.first();
+    if (yFirst == SVGTextLayoutAttributes::emptyValue())
+        yFirst = 0;
+
+    // Fill m_positioningLists using child text positioning elements in top-down order. 
+    unsigned size = m_textPositions.size();
+    for (unsigned i = 0; i < size; ++i)
+        fillAttributesAtPosition(m_textPositions[i]);
+
+    // Now m_positioningLists.contains a x/y/dx/dy/rotate value for each character in the <text> subtree.
 }
 
 void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* start, Vector<SVGTextLayoutAttributes>& allAttributes, unsigned& atCharacter, UChar& lastCharacter) const
@@ -222,16 +215,19 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
                 metricsLength = currentMetrics.length();
 
                 if (!preserveWhiteSpace && characterIsSpace(currentCharacter) && characterIsSpaceOrNull(lastCharacter)) {
-                    assignEmptyLayoutAttributesForCharacter(attributes);
+                    attributes.positioningLists().appendEmptyValues();
                     attributes.textMetricsValues().append(SVGTextMetrics::emptyMetrics());
                     continue;
                 }
 
-                assignLayoutAttributesForCharacter(attributes, currentMetrics, valueListPosition);
+                SVGTextLayoutAttributes::PositioningLists& positioningLists = attributes.positioningLists();
+                positioningLists.appendValuesFromPosition(m_positioningLists, valueListPosition);
+                attributes.textMetricsValues().append(currentMetrics);
 
+                // Pad x/y/dx/dy/rotate value lists with empty values, if the metrics span more than one character.
                 if (metricsLength > 1) {
                     for (unsigned i = 0; i < metricsLength - 1; ++i)
-                        assignEmptyLayoutAttributesForCharacter(attributes);
+                        positioningLists.appendEmptyValues();
                 }
 
                 lastCharacter = currentCharacter;
@@ -257,67 +253,42 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
     }
 }
 
-float SVGTextLayoutAttributesBuilder::nextLayoutValue(LayoutValueType type, unsigned atCharacter) const
+static inline void fillListAtPosition(Vector<float>& allValues, Vector<float>& values, unsigned start)
 {
-    for (int i = m_scopes.size() - 1; i >= 0; --i) {
-        const LayoutScope& scope = m_scopes.at(i);
-        if (scope.textContentStart > atCharacter || scope.textContentStart + scope.textContentLength < atCharacter)
-            continue;
+    unsigned valuesSize = values.size();
+    for (unsigned i = 0; i < valuesSize; ++i)
+        allValues[start + i] = values[i];
+}
 
-        const Vector<float>* valuesPointer = 0;
-        switch (type) {
-        case XValueAttribute:
-            valuesPointer = &scope.attributes.xValues();
-            break;
-        case YValueAttribute:
-            valuesPointer = &scope.attributes.yValues();
-            break;
-        case DxValueAttribute:
-            valuesPointer = &scope.attributes.dxValues();
-            break;
-        case DyValueAttribute:
-            valuesPointer = &scope.attributes.dyValues();
-            break;
-        case RotateValueAttribute:
-            valuesPointer = &scope.attributes.rotateValues();
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-        }
+void SVGTextLayoutAttributesBuilder::fillAttributesAtPosition(const TextPosition& position)
+{
+    Vector<float> values;
+    extractFloatValuesFromSVGLengthList(position.element, position.element->x(), values, position.length);
+    fillListAtPosition(m_positioningLists.xValues, values, position.start);
 
-        ASSERT(valuesPointer);
-        const Vector<float>& values = *valuesPointer;
-        if (values.isEmpty())
-            continue;
+    values.clear();
+    extractFloatValuesFromSVGLengthList(position.element, position.element->y(), values, position.length);
+    fillListAtPosition(m_positioningLists.yValues, values, position.start);
 
-        unsigned position = atCharacter - scope.textContentStart;
-        if (position >= values.size())
-            continue;
+    values.clear();
+    extractFloatValuesFromSVGLengthList(position.element, position.element->dx(), values, position.length);
+    fillListAtPosition(m_positioningLists.dxValues, values, position.start);
 
-        return values.at(position);
-    }
+    values.clear();
+    extractFloatValuesFromSVGLengthList(position.element, position.element->dy(), values, position.length);
+    fillListAtPosition(m_positioningLists.dyValues, values, position.start);
 
-    return SVGTextLayoutAttributes::emptyValue();
-}
+    values.clear();
+    extractFloatValuesFromSVGNumberList(position.element->rotate(), values, position.length);
+    fillListAtPosition(m_positioningLists.rotateValues, values, position.start);
 
-void SVGTextLayoutAttributesBuilder::assignLayoutAttributesForCharacter(SVGTextLayoutAttributes& attributes, SVGTextMetrics& metrics, unsigned valueListPosition) const
-{
-    attributes.xValues().append(nextLayoutValue(XValueAttribute, valueListPosition));
-    attributes.yValues().append(nextLayoutValue(YValueAttribute, valueListPosition));
-    attributes.dxValues().append(nextLayoutValue(DxValueAttribute, valueListPosition));
-    attributes.dyValues().append(nextLayoutValue(DyValueAttribute, valueListPosition));
-    attributes.rotateValues().append(nextLayoutValue(RotateValueAttribute, valueListPosition));
-    attributes.textMetricsValues().append(metrics);
-}
+    // The last rotation value always spans the whole scope.
+    if (values.isEmpty())
+        return;
 
-void SVGTextLayoutAttributesBuilder::assignEmptyLayoutAttributesForCharacter(SVGTextLayoutAttributes& attributes) const
-{
-    attributes.xValues().append(SVGTextLayoutAttributes::emptyValue());
-    attributes.yValues().append(SVGTextLayoutAttributes::emptyValue());
-    attributes.dxValues().append(SVGTextLayoutAttributes::emptyValue());
-    attributes.dyValues().append(SVGTextLayoutAttributes::emptyValue());
-    attributes.rotateValues().append(SVGTextLayoutAttributes::emptyValue());
-    // This doesn't add an empty value to textMetricsValues() on purpose!
+    float lastValue = values.last();
+    for (unsigned i = values.size(); i < position.length; ++i)
+        m_positioningLists.rotateValues[position.start + i] = lastValue;
 }
 
 }
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
index b368c51..a5995c0 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,6 +28,7 @@ namespace WebCore {
 
 class RenderObject;
 class RenderSVGText;
+class SVGTextPositioningElement;
 
 // SVGTextLayoutAttributesBuilder performs the first layout phase for SVG text.
 //
@@ -45,37 +46,27 @@ public:
     void buildLayoutAttributesForTextSubtree(RenderSVGText*);
 
 private:
-    struct LayoutScope {
-        LayoutScope()
-            : textContentStart(0)
-            , textContentLength(0)
+    struct TextPosition {
+        TextPosition(SVGTextPositioningElement* newElement = 0, unsigned newStart = 0, unsigned newLength = 0)
+            : element(newElement)
+            , start(newStart)
+            , length(newLength)
         {
         }
 
-        unsigned textContentStart;
-        unsigned textContentLength;
-        SVGTextLayoutAttributes attributes;
+        SVGTextPositioningElement* element;
+        unsigned start;
+        unsigned length;
     };
 
-    void buildLayoutScope(LayoutScope&, RenderObject*, unsigned textContentStart, unsigned textContentLength) const;
-    void buildLayoutScopes(RenderObject*, unsigned& atCharacter, UChar& lastCharacter);
-    void buildOutermostLayoutScope(RenderSVGText*, unsigned textLength);
+    void collectTextPositioningElements(RenderObject*, unsigned& atCharacter, UChar& lastCharacter);
+    void buildLayoutAttributesForAllCharacters(RenderSVGText*, unsigned textLength);
     void propagateLayoutAttributes(RenderObject*, Vector<SVGTextLayoutAttributes>& allAttributes, unsigned& atCharacter, UChar& lastCharacter) const;
-
-    enum LayoutValueType {
-        XValueAttribute,
-        YValueAttribute,
-        DxValueAttribute,
-        DyValueAttribute,
-        RotateValueAttribute
-    };
-
-    float nextLayoutValue(LayoutValueType, unsigned atCharacter) const;
-    void assignLayoutAttributesForCharacter(SVGTextLayoutAttributes&, SVGTextMetrics&, unsigned valueListPosition) const;
-    void assignEmptyLayoutAttributesForCharacter(SVGTextLayoutAttributes&) const;
+    void fillAttributesAtPosition(const TextPosition&);
 
 private:
-    Vector<LayoutScope> m_scopes;
+    Vector<TextPosition> m_textPositions;
+    SVGTextLayoutAttributes::PositioningLists m_positioningLists;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
index 71db2ea..2bc7e32 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
@@ -157,7 +157,7 @@ bool SVGTextLayoutEngine::parentDefinesTextLength(RenderObject* parent) const
         SVGTextContentElement* textContentElement = SVGTextContentElement::elementFromRenderer(currentParent);
         if (textContentElement) {
             SVGTextContentElement::SVGLengthAdjustType lengthAdjust = static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust());
-            if (lengthAdjust == SVGTextContentElement::LENGTHADJUST_SPACING && textContentElement->textLength().value(textContentElement) > 0)
+            if (lengthAdjust == SVGTextContentElement::LENGTHADJUST_SPACING && textContentElement->specifiedTextLength().value(textContentElement) > 0)
                 return true;
         }
 
@@ -213,7 +213,7 @@ void SVGTextLayoutEngine::beginTextPathLayout(RenderObject* object, SVGTextLayou
 
     if (SVGTextContentElement* textContentElement = SVGTextContentElement::elementFromRenderer(textPath)) {
         lengthAdjust = static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust());
-        desiredTextLength = textContentElement->textLength().value(textContentElement);
+        desiredTextLength = textContentElement->specifiedTextLength().value(textContentElement);
     }
 
     if (!desiredTextLength)
@@ -261,34 +261,10 @@ void SVGTextLayoutEngine::layoutInlineTextBox(SVGInlineTextBox* textBox)
     m_lineLayoutBoxes.append(textBox);
 }
 
-void SVGTextLayoutEngine::finishLayout()
-{
-    // After all text fragments are stored in their correpsonding SVGInlineTextBoxes, we can layout individual text chunks.
-    // Chunk layouting is only performed for line layout boxes, not for path layout, where it has already been done.
-    m_chunkLayoutBuilder.layoutTextChunks(m_lineLayoutBoxes);
-
-    // Finalize transform matrices, after the chunk layout corrections have been applied, and all fragment x/y positions are finalized.
-    if (!m_lineLayoutBoxes.isEmpty()) {
-#if DUMP_TEXT_FRAGMENTS > 0
-        fprintf(stderr, "Line layout: ");
-#endif
-
-        finalizeTransformMatrices(m_lineLayoutBoxes);
-    }
-
-    if (!m_pathLayoutBoxes.isEmpty()) {
 #if DUMP_TEXT_FRAGMENTS > 0
-        fprintf(stderr, "Path layout: ");
-#endif
-        finalizeTransformMatrices(m_pathLayoutBoxes);
-    }
-}
-
-void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& boxes)
+static inline void dumpTextBoxes(Vector<SVGInlineTextBox*>& boxes)
 {
     unsigned boxCount = boxes.size();
-
-#if DUMP_TEXT_FRAGMENTS > 0
     fprintf(stderr, "Dumping all text fragments in text sub tree, %i boxes\n", boxCount);
 
     for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
@@ -308,9 +284,12 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
                           , i, fragment.x, fragment.y, fragment.width, fragment.height, fragment.characterOffset, fragment.length, fragmentString.utf8().data());
         }
     }
+}
 #endif
 
-
+void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& boxes)
+{
+    unsigned boxCount = boxes.size();
     if (!boxCount)
         return;
 
@@ -321,29 +300,48 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
 
         unsigned fragmentCount = fragments.size();
         for (unsigned i = 0; i < fragmentCount; ++i) {
-            SVGTextFragment& fragment = fragments.at(i);
-            AffineTransform& transform = fragment.transform;
-            if (!transform.isIdentity()) {
-                transform = AffineTransform::translation(fragment.x, fragment.y) * transform;
-                transform.translate(-fragment.x, -fragment.y);
-            }
-
             m_chunkLayoutBuilder.transformationForTextBox(textBox, textBoxTransformation);
             if (textBoxTransformation.isIdentity())
                 continue;
-
-            if (transform.isIdentity())
-                transform = textBoxTransformation;
-            else
-                transform = textBoxTransformation * transform;
+            ASSERT(fragments[i].lengthAdjustTransform.isIdentity());
+            fragments[i].lengthAdjustTransform = textBoxTransformation;
         }
     }
 
     boxes.clear();
 }
 
+void SVGTextLayoutEngine::finishLayout()
+{
+    // After all text fragments are stored in their correpsonding SVGInlineTextBoxes, we can layout individual text chunks.
+    // Chunk layouting is only performed for line layout boxes, not for path layout, where it has already been done.
+    m_chunkLayoutBuilder.layoutTextChunks(m_lineLayoutBoxes);
+
+    // Finalize transform matrices, after the chunk layout corrections have been applied, and all fragment x/y positions are finalized.
+    if (!m_lineLayoutBoxes.isEmpty()) {
+#if DUMP_TEXT_FRAGMENTS > 0
+        fprintf(stderr, "Line layout: ");
+        dumpTextBoxes(m_lineLayoutBoxes);
+#endif
+
+        finalizeTransformMatrices(m_lineLayoutBoxes);
+    }
+
+    if (!m_pathLayoutBoxes.isEmpty()) {
+#if DUMP_TEXT_FRAGMENTS > 0
+        fprintf(stderr, "Path layout: ");
+        dumpTextBoxes(m_pathLayoutBoxes);
+#endif
+
+        finalizeTransformMatrices(m_pathLayoutBoxes);
+    }
+}
+
 bool SVGTextLayoutEngine::currentLogicalCharacterAttributes(SVGTextLayoutAttributes& logicalAttributes)
 {
+    if (m_layoutAttributes.isEmpty())
+        return false;
+
     logicalAttributes = m_layoutAttributes.first();
     if (m_logicalCharacterOffset != logicalAttributes.xValues().size())
         return true;
@@ -374,6 +372,8 @@ bool SVGTextLayoutEngine::currentLogicalCharacterMetrics(SVGTextLayoutAttributes
             continue;
         }
 
+        ASSERT(textMetricsSize);
+        ASSERT(m_logicalMetricsListOffset < textMetricsSize);
         logicalMetrics = textMetricsValues.at(m_logicalMetricsListOffset);
         if (logicalMetrics == SVGTextMetrics::emptyMetrics() || (!logicalMetrics.width() && !logicalMetrics.height())) {
             advanceToNextLogicalCharacter(logicalMetrics);
@@ -634,11 +634,12 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
             if (orientationAngle)
                 m_currentTextFragment.transform.rotate(orientationAngle);
 
-            if (m_inPathLayout && m_textPathScaling != 1) {
+            m_currentTextFragment.isTextOnPath = m_inPathLayout && m_textPathScaling != 1;
+            if (m_currentTextFragment.isTextOnPath) {
                 if (m_isVerticalText)
-                    m_currentTextFragment.transform.scaleNonUniform(1, m_textPathScaling);
+                    m_currentTextFragment.lengthAdjustTransform.scaleNonUniform(1, m_textPathScaling);
                 else
-                    m_currentTextFragment.transform.scaleNonUniform(m_textPathScaling, 1);
+                    m_currentTextFragment.lengthAdjustTransform.scaleNonUniform(m_textPathScaling, 1);
             }
         }
 
diff --git a/Source/WebCore/rendering/svg/SVGTextQuery.cpp b/Source/WebCore/rendering/svg/SVGTextQuery.cpp
index 5f3523e..c141c11 100644
--- a/Source/WebCore/rendering/svg/SVGTextQuery.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextQuery.cpp
@@ -80,17 +80,6 @@ static inline InlineFlowBox* flowBoxForRenderer(RenderObject* renderer)
     return 0;
 }
 
-static inline float mapLengthThroughFragmentTransformation(const SVGTextFragment& fragment, bool isVerticalText, float length)
-{
-    if (fragment.transform.isIdentity())
-        return length;
-
-    if (isVerticalText)
-        return narrowPrecisionToFloat(static_cast<double>(length) * fragment.transform.yScale());
-
-    return narrowPrecisionToFloat(static_cast<double>(length) * fragment.transform.xScale());
-}
-
 SVGTextQuery::SVGTextQuery(RenderObject* renderer)
 {
     collectTextBoxesInFlowBox(flowBoxForRenderer(renderer));
@@ -111,8 +100,8 @@ void SVGTextQuery::collectTextBoxesInFlowBox(InlineFlowBox* flowBox)
             continue;
         }
 
-        ASSERT(child->isSVGInlineTextBox());
-        m_textBoxes.append(static_cast<SVGInlineTextBox*>(child));
+        if (child->isSVGInlineTextBox())
+            m_textBoxes.append(static_cast<SVGInlineTextBox*>(child));
     }
 }
 
@@ -273,9 +262,7 @@ struct TextLengthData : SVGTextQuery::Data {
 bool SVGTextQuery::textLengthCallback(Data* queryData, const SVGTextFragment& fragment) const
 {
     TextLengthData* data = static_cast<TextLengthData*>(queryData);
-
-    float fragmentLength = queryData->isVerticalText ? fragment.height : fragment.width;
-    data->textLength += mapLengthThroughFragmentTransformation(fragment, queryData->isVerticalText, fragmentLength);
+    data->textLength += queryData->isVerticalText ? fragment.height : fragment.width;
     return false;
 }
 
@@ -314,9 +301,7 @@ bool SVGTextQuery::subStringLengthCallback(Data* queryData, const SVGTextFragmen
         return false;
 
     SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset + startPosition, endPosition - startPosition);
-    float fragmentLength = queryData->isVerticalText ? metrics.height() : metrics.width();
-
-    data->subStringLength += mapLengthThroughFragmentTransformation(fragment, queryData->isVerticalText, fragmentLength);
+    data->subStringLength += queryData->isVerticalText ? metrics.height() : metrics.width();
     return false;
 }
 
@@ -360,10 +345,12 @@ bool SVGTextQuery::startPositionOfCharacterCallback(Data* queryData, const SVGTe
             data->startPosition.move(metrics.width(), 0);
     }
 
-    if (fragment.transform.isIdentity())
+    AffineTransform fragmentTransform;
+    fragment.buildFragmentTransform(fragmentTransform, SVGTextFragment::TransformIgnoringTextLength);
+    if (fragmentTransform.isIdentity())
         return true;
 
-    data->startPosition = fragment.transform.mapPoint(data->startPosition);
+    data->startPosition = fragmentTransform.mapPoint(data->startPosition);
     return true;
 }
 
@@ -405,10 +392,12 @@ bool SVGTextQuery::endPositionOfCharacterCallback(Data* queryData, const SVGText
     else
         data->endPosition.move(metrics.width(), 0);
 
-    if (fragment.transform.isIdentity())
+    AffineTransform fragmentTransform;
+    fragment.buildFragmentTransform(fragmentTransform, SVGTextFragment::TransformIgnoringTextLength);
+    if (fragmentTransform.isIdentity())
         return true;
 
-    data->endPosition = fragment.transform.mapPoint(data->endPosition);
+    data->endPosition = fragmentTransform.mapPoint(data->endPosition);
     return true;
 }
 
@@ -443,9 +432,15 @@ bool SVGTextQuery::rotationOfCharacterCallback(Data* queryData, const SVGTextFra
     if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
         return false;
 
-    AffineTransform newTransform(fragment.transform);
-    newTransform.scale(1 / fragment.transform.xScale(), 1 / fragment.transform.yScale());
-    data->rotation = narrowPrecisionToFloat(rad2deg(atan2(newTransform.b(), newTransform.a())));
+    AffineTransform fragmentTransform;
+    fragment.buildFragmentTransform(fragmentTransform, SVGTextFragment::TransformIgnoringTextLength);
+    if (fragmentTransform.isIdentity())
+        data->rotation = 0;
+    else {
+        fragmentTransform.scale(1 / fragmentTransform.xScale(), 1 / fragmentTransform.yScale());
+        data->rotation = narrowPrecisionToFloat(rad2deg(atan2(fragmentTransform.b(), fragmentTransform.a())));
+    }
+
     return true;
 }
 
@@ -488,10 +483,12 @@ static inline void calculateGlyphBoundaries(SVGTextQuery::Data* queryData, const
     SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset + startPosition, 1);
     extent.setSize(FloatSize(metrics.width(), metrics.height()));
 
-    if (fragment.transform.isIdentity())
+    AffineTransform fragmentTransform;
+    fragment.buildFragmentTransform(fragmentTransform, SVGTextFragment::TransformIgnoringTextLength);
+    if (fragmentTransform.isIdentity())
         return;
 
-    extent = fragment.transform.mapRect(extent);
+    extent = fragmentTransform.mapRect(extent);
 }
 
 bool SVGTextQuery::extentOfCharacterCallback(Data* queryData, const SVGTextFragment& fragment) const
diff --git a/Source/WebCore/storage/IDBBackingStore.h b/Source/WebCore/storage/IDBBackingStore.h
index 29523a2..4b96442 100644
--- a/Source/WebCore/storage/IDBBackingStore.h
+++ b/Source/WebCore/storage/IDBBackingStore.h
@@ -50,30 +50,38 @@ public:
     virtual bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId) = 0;
 
     virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags) = 0;
-    virtual bool createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId) = 0;
-    virtual void deleteObjectStore(int64_t objectStoreId) = 0;
-    virtual String getObjectStoreRecord(int64_t objectStoreId, const IDBKey&) = 0;
-    virtual bool putObjectStoreRecord(int64_t objectStoreId, const IDBKey&, const String& value, int64_t& rowId, bool invalidRowId) = 0;
-    virtual void clearObjectStore(int64_t objectStoreId) = 0;
-    virtual void deleteObjectStoreRecord(int64_t objectStoreId, int64_t objectStoreDataId) = 0;
-    virtual double nextAutoIncrementNumber(int64_t objectStoreId) = 0;
-    virtual bool keyExistsInObjectStore(int64_t objectStoreId, const IDBKey&, int64_t& foundObjectStoreDataId) = 0;
+    virtual bool createObjectStore(int64_t databaseId, const String& name, const String& keyPath, bool autoIncrement, int64_t& assignedObjectStoreId) = 0;
+    virtual void deleteObjectStore(int64_t databaseId, int64_t objectStoreId) = 0;
+
+    class ObjectStoreRecordIdentifier : public RefCounted<ObjectStoreRecordIdentifier> {
+    public:
+        virtual bool isValid() const = 0;
+        virtual ~ObjectStoreRecordIdentifier() {}
+    };
+    virtual PassRefPtr<ObjectStoreRecordIdentifier> createInvalidRecordIdentifier() = 0;
+
+    virtual String getObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey&) = 0;
+    virtual bool putObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey&, const String& value, ObjectStoreRecordIdentifier*) = 0;
+    virtual void clearObjectStore(int64_t databaseId, int64_t objectStoreId) = 0;
+    virtual void deleteObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const ObjectStoreRecordIdentifier*) = 0;
+    virtual double nextAutoIncrementNumber(int64_t databaseId, int64_t objectStoreId) = 0;
+    virtual bool keyExistsInObjectStore(int64_t databaseId, int64_t objectStoreId, const IDBKey&, ObjectStoreRecordIdentifier* foundRecordIdentifier) = 0;
 
     class ObjectStoreRecordCallback {
     public:
-         virtual bool callback(int64_t objectStoreDataId, const String& value) = 0;
+         virtual bool callback(const ObjectStoreRecordIdentifier*, const String& value) = 0;
          virtual ~ObjectStoreRecordCallback() {};
     };
-    virtual bool forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback&) = 0;
+    virtual bool forEachObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, ObjectStoreRecordCallback&) = 0;
 
-    virtual void getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags) = 0;
-    virtual bool createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId) = 0;
-    virtual void deleteIndex(int64_t indexId) = 0;
-    virtual bool putIndexDataForRecord(int64_t indexId, const IDBKey&, int64_t objectStoreDataId) = 0;
-    virtual bool deleteIndexDataForRecord(int64_t objectStoreDataId) = 0;
-    virtual String getObjectViaIndex(int64_t indexId, const IDBKey&) = 0;
-    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t indexId, const IDBKey&) = 0;
-    virtual bool keyExistsInIndex(int64_t indexId, const IDBKey&) = 0;
+    virtual void getIndexes(int64_t databaseId, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags) = 0;
+    virtual bool createIndex(int64_t databaseId, int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId) = 0;
+    virtual void deleteIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId) = 0;
+    virtual bool putIndexDataForRecord(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&, const ObjectStoreRecordIdentifier*) = 0;
+    virtual bool deleteIndexDataForRecord(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const ObjectStoreRecordIdentifier*) = 0;
+    virtual String getObjectViaIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&) = 0;
+    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&) = 0;
+    virtual bool keyExistsInIndex(int64_t databaseid, int64_t objectStoreId, int64_t indexId, const IDBKey&) = 0;
 
     class Cursor : public RefCounted<Cursor> {
     public:
@@ -81,14 +89,14 @@ public:
         virtual PassRefPtr<IDBKey> key() = 0;
         virtual PassRefPtr<IDBKey> primaryKey() = 0;
         virtual String value() = 0;
-        virtual int64_t objectStoreDataId() = 0;
+        virtual PassRefPtr<ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() = 0;
         virtual int64_t indexDataId() = 0;
         virtual ~Cursor() {};
     };
 
-    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction) = 0;
-    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) = 0;
-    virtual PassRefPtr<Cursor> openIndexCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) = 0;
+    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t databaseId, int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction) = 0;
+    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) = 0;
+    virtual PassRefPtr<Cursor> openIndexCursor(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) = 0;
 
     class Transaction : public RefCounted<Transaction> {
     public:
diff --git a/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp b/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp
index 94e305b..8fe971a 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -97,7 +97,7 @@ PassRefPtr<DOMStringList> IDBDatabaseBackendImpl::objectStoreNames() const
     return objectStoreNames.release();
 }
 
-PassRefPtr<IDBObjectStoreBackendInterface>  IDBDatabaseBackendImpl::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseBackendImpl::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
     ASSERT(transactionPtr->mode() == IDBTransaction::VERSION_CHANGE);
 
@@ -106,7 +106,7 @@ PassRefPtr<IDBObjectStoreBackendInterface>  IDBDatabaseBackendImpl::createObject
         return 0;
     }
 
-    RefPtr<IDBObjectStoreBackendImpl> objectStore = IDBObjectStoreBackendImpl::create(m_backingStore.get(), name, keyPath, autoIncrement);
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = IDBObjectStoreBackendImpl::create(m_backingStore.get(), m_id, name, keyPath, autoIncrement);
     ASSERT(objectStore->name() == name);
 
     RefPtr<IDBDatabaseBackendImpl> database = this;
@@ -125,7 +125,7 @@ void IDBDatabaseBackendImpl::createObjectStoreInternal(ScriptExecutionContext*,
 {
     int64_t objectStoreId;
 
-    if (!database->m_backingStore->createObjectStore(objectStore->name(), objectStore->keyPath(), objectStore->autoIncrement(), database->id(), objectStoreId)) {
+    if (!database->m_backingStore->createObjectStore(database->id(), objectStore->name(), objectStore->keyPath(), objectStore->autoIncrement(), objectStoreId)) {
         transaction->abort();
         return;
     }
@@ -158,7 +158,7 @@ void IDBDatabaseBackendImpl::deleteObjectStore(const String& name, IDBTransactio
 
 void IDBDatabaseBackendImpl::deleteObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
-    database->m_backingStore->deleteObjectStore(objectStore->id());
+    database->m_backingStore->deleteObjectStore(database->id(), objectStore->id());
     transaction->didCompleteTaskEvents();
 }
 
@@ -250,7 +250,7 @@ void IDBDatabaseBackendImpl::loadObjectStores()
     ASSERT(autoIncrementFlags.size() == ids.size());
 
     for (size_t i = 0; i < ids.size(); i++)
-        m_objectStores.set(names[i], IDBObjectStoreBackendImpl::create(m_backingStore.get(), ids[i], names[i], keyPaths[i], autoIncrementFlags[i]));
+        m_objectStores.set(names[i], IDBObjectStoreBackendImpl::create(m_backingStore.get(), m_id, ids[i], names[i], keyPaths[i], autoIncrementFlags[i]));
 }
 
 void IDBDatabaseBackendImpl::removeObjectStoreFromMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> objectStore)
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp b/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
index 461e930..4768b3e 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,6 +32,7 @@
 #include "DOMStringList.h"
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBDatabaseException.h"
+#include "IDBLevelDBBackingStore.h"
 #include "IDBSQLiteBackingStore.h"
 #include "IDBTransactionCoordinator.h"
 #include "SecurityOrigin.h"
@@ -69,7 +70,7 @@ void IDBFactoryBackendImpl::removeIDBBackingStore(const String& uniqueIdentifier
     m_backingStoreMap.remove(uniqueIdentifier);
 }
 
-void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> securityOrigin, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType)
+void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> securityOrigin, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType backingStoreType)
 {
     String fileIdentifier = securityOrigin->databaseIdentifier();
     String uniqueIdentifier = fileIdentifier + "@" + name;
@@ -86,7 +87,12 @@ void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> ca
     if (it2 != m_backingStoreMap.end())
         backingStore = it2->second;
     else {
-        backingStore = IDBSQLiteBackingStore::open(securityOrigin.get(), dataDir, maximumSize, fileIdentifier, this);
+        if (backingStoreType == DefaultBackingStore)
+            backingStore = IDBSQLiteBackingStore::open(securityOrigin.get(), dataDir, maximumSize, fileIdentifier, this);
+#if ENABLE(LEVELDB)
+        else if (backingStoreType == LevelDBBackingStore)
+            backingStore = IDBLevelDBBackingStore::open(securityOrigin.get(), dataDir, maximumSize, fileIdentifier, this);
+#endif
         if (!backingStore) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
             return;
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.cpp b/Source/WebCore/storage/IDBIndexBackendImpl.cpp
index 62e5364..38f95f1 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBIndexBackendImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,8 +40,10 @@
 
 namespace WebCore {
 
-IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique)
+IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, int64_t databaseId, const IDBObjectStoreBackendImpl* objectStoreBackend, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique)
     : m_backingStore(backingStore)
+    , m_databaseId(databaseId)
+    , m_objectStoreBackend(objectStoreBackend)
     , m_id(id)
     , m_name(name)
     , m_storeName(storeName)
@@ -50,8 +52,10 @@ IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, int64_t
 {
 }
 
-IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, const String& name, const String& storeName, const String& keyPath, bool unique)
+IDBIndexBackendImpl::IDBIndexBackendImpl(IDBBackingStore* backingStore, int64_t databaseId, const IDBObjectStoreBackendImpl* objectStoreBackend, const String& name, const String& storeName, const String& keyPath, bool unique)
     : m_backingStore(backingStore)
+    , m_databaseId(databaseId)
+    , m_objectStoreBackend(objectStoreBackend)
     , m_id(InvalidId)
     , m_name(name)
     , m_storeName(storeName)
@@ -72,10 +76,10 @@ void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr
 
     switch (cursorType) {
     case IDBCursorBackendInterface::IndexKeyCursor:
-        backingStoreCursor = index->m_backingStore->openIndexKeyCursor(index->id(), range.get(), direction);
+        backingStoreCursor = index->m_backingStore->openIndexKeyCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), range.get(), direction);
         break;
     case IDBCursorBackendInterface::IndexCursor:
-        backingStoreCursor = index->m_backingStore->openIndexCursor(index->id(), range.get(), direction);
+        backingStoreCursor = index->m_backingStore->openIndexCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), range.get(), direction);
         break;
     case IDBCursorBackendInterface::ObjectStoreCursor:
     case IDBCursorBackendInterface::InvalidCursorType:
@@ -120,14 +124,14 @@ void IDBIndexBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBInd
 {
     // FIXME: Split getInternal into two functions, getting rid off |getObject|.
     if (getObject) {
-        String value = index->m_backingStore->getObjectViaIndex(index->id(), *key);
+        String value = index->m_backingStore->getObjectViaIndex(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), *key);
         if (value.isNull()) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_FOUND_ERR, "Key does not exist in the index."));
             return;
         }
         callbacks->onSuccess(SerializedScriptValue::createFromWire(value));
     } else {
-        RefPtr<IDBKey> keyResult = index->m_backingStore->getPrimaryKeyViaIndex(index->id(), *key);
+        RefPtr<IDBKey> keyResult = index->m_backingStore->getPrimaryKeyViaIndex(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), *key);
         if (!keyResult) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_FOUND_ERR, "Key does not exist in the index."));
             return;
@@ -159,7 +163,7 @@ bool IDBIndexBackendImpl::addingKeyAllowed(IDBKey* key)
     if (!m_unique)
         return true;
 
-    return !m_backingStore->keyExistsInIndex(m_id, *key);
+    return !m_backingStore->keyExistsInIndex(m_databaseId, m_objectStoreBackend->id(), m_id, *key);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.h b/Source/WebCore/storage/IDBIndexBackendImpl.h
index e2a06b8..2d42a08 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.h
+++ b/Source/WebCore/storage/IDBIndexBackendImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,13 +40,13 @@ class ScriptExecutionContext;
 
 class IDBIndexBackendImpl : public IDBIndexBackendInterface {
 public:
-    static PassRefPtr<IDBIndexBackendImpl> create(IDBBackingStore* backingStore, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique)
+    static PassRefPtr<IDBIndexBackendImpl> create(IDBBackingStore* backingStore, int64_t databaseId, const IDBObjectStoreBackendImpl* objectStoreBackend, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique)
     {
-        return adoptRef(new IDBIndexBackendImpl(backingStore, id, name, storeName, keyPath, unique));
+        return adoptRef(new IDBIndexBackendImpl(backingStore, databaseId, objectStoreBackend, id, name, storeName, keyPath, unique));
     }
-    static PassRefPtr<IDBIndexBackendImpl> create(IDBBackingStore* backingStore, const String& name, const String& storeName, const String& keyPath, bool unique)
+    static PassRefPtr<IDBIndexBackendImpl> create(IDBBackingStore* backingStore, int64_t databaseId, const IDBObjectStoreBackendImpl* objectStoreBackend, const String& name, const String& storeName, const String& keyPath, bool unique)
     {
-        return adoptRef(new IDBIndexBackendImpl(backingStore, name, storeName, keyPath, unique));
+        return adoptRef(new IDBIndexBackendImpl(backingStore, databaseId, objectStoreBackend, name, storeName, keyPath, unique));
     }
     virtual ~IDBIndexBackendImpl();
 
@@ -72,8 +72,8 @@ public:
     virtual void getKey(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
 private:
-    IDBIndexBackendImpl(IDBBackingStore*, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique);
-    IDBIndexBackendImpl(IDBBackingStore*, const String& name, const String& storeName, const String& keyPath, bool unique);
+    IDBIndexBackendImpl(IDBBackingStore*, int64_t databaseId, const IDBObjectStoreBackendImpl*, int64_t id, const String& name, const String& storeName, const String& keyPath, bool unique);
+    IDBIndexBackendImpl(IDBBackingStore*, int64_t databaseId, const IDBObjectStoreBackendImpl*, const String& name, const String& storeName, const String& keyPath, bool unique);
 
     static void openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, unsigned short direction, IDBCursorBackendInterface::CursorType, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
     static void getInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKey>, bool getObject, PassRefPtr<IDBCallbacks>);
@@ -82,6 +82,8 @@ private:
 
     RefPtr<IDBBackingStore> m_backingStore;
 
+    int64_t m_databaseId;
+    const IDBObjectStoreBackendImpl* m_objectStoreBackend;
     int64_t m_id;
     String m_name;
     String m_storeName;
diff --git a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp b/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
new file mode 100644
index 0000000..09d667f
--- /dev/null
+++ b/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
@@ -0,0 +1,2613 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IDBLevelDBBackingStore.h"
+
+#if ENABLE(INDEXED_DATABASE)
+#if ENABLE(LEVELDB)
+
+#include "Assertions.h"
+#include "FileSystem.h"
+#include "IDBFactoryBackendImpl.h"
+#include "IDBKeyRange.h"
+#include "LevelDBComparator.h"
+#include "LevelDBDatabase.h"
+#include "LevelDBIterator.h"
+#include "LevelDBSlice.h"
+#include "SecurityOrigin.h"
+
+#ifndef INT64_MAX
+// FIXME: We shouldn't need to rely on these macros.
+#define INT64_MAX 0x7fffffffffffffffLL
+#endif
+#ifndef INT32_MAX
+#define INT32_MAX 0x7fffffffL
+#endif
+
+// LevelDB stores key/value pairs. Keys and values are strings of bytes, normally of type Vector<char>.
+//
+// The keys in the backing store are variable-length tuples with different types
+// of fields. Each key in the backing store starts with a ternary prefix: (database id, object store id, index id). For each, 0 is reserved for meta-data.
+// The prefix makes sure that data for a specific database, object store, and index are grouped together. The locality is important for performance: common
+// operations should only need a minimal number of seek operations. For example, all the meta-data for a database is grouped together so that reading that
+// meta-data only requires one seek.
+//
+// Each key type has a class (in square brackets below) which knows how to encode, decode, and compare that key type.
+//
+// Global meta-data have keys with prefix (0,0,0), followed by a type byte:
+//
+//     <0, 0, 0, 0>                                           => IndexedDB/LevelDB schema version (0 for now) [SchemaVersionKey]
+//     <0, 0, 0, 1>                                           => The maximum database id ever allocated [MaxDatabaseIdKey]
+//     <0, 0, 0, 100, database id>                            => Existence implies the database id is in the free list [DatabaseFreeListKey]
+//     <0, 0, 0, 201, utf16 origin name, utf16 database name> => Database id [DatabaseNameKey]
+//
+//
+// Database meta-data:
+//
+//     Again, the prefix is followed by a type byte.
+//
+//     <database id, 0, 0, 0> => utf16 origin name [DatabaseMetaDataKey]
+//     <database id, 0, 0, 1> => utf16 database name [DatabaseMetaDataKey]
+//     <database id, 0, 0, 2> => utf16 user version data [DatabaseMetaDataKey]
+//     <database id, 0, 0, 3> => maximum object store id ever allocated [DatabaseMetaDataKey]
+//
+//
+// Object store meta-data:
+//
+//     The prefix is followed by a type byte, then a variable-length integer, and then another variable-length integer (FIXME: this should be a byte).
+//
+//     <database id, 0, 0, 50, object store id, 0> => utf16 object store name [ObjectStoreMetaDataKey]
+//     <database id, 0, 0, 50, object store id, 1> => utf16 key path [ObjectStoreMetaDataKey]
+//     <database id, 0, 0, 50, object store id, 2> => has auto increment [ObjectStoreMetaDataKey]
+//     <database id, 0, 0, 50, object store id, 3> => is evictable [ObjectStoreMetaDataKey]
+//     <database id, 0, 0, 50, object store id, 4> => last "version" number [ObjectStoreMetaDataKey]
+//     <database id, 0, 0, 50, object store id, 5> => maximum index id ever allocated [ObjectStoreMetaDataKey]
+//
+//
+// Index meta-data:
+//
+//     The prefix is followed by a type byte, then two variable-length integers, and then another type byte.
+//
+//     <database id, 0, 0, 100, object store id, index id, 0> => utf16 index name [IndexMetaDataKey]
+//     <database id, 0, 0, 100, object store id, index id, 1> => are index keys unique [IndexMetaDataKey]
+//     <database id, 0, 0, 100, object store id, index id, 2> => utf16 key path [IndexMetaDataKey]
+//
+//
+// Other object store and index meta-data:
+//
+//     The prefix is followed by a type byte. The object store and index id are variable length integers, the utf16 strings are variable length strings.
+//
+//     <database id, 0, 0, 150, object store id>                   => existence implies the object store id is in the free list [ObjectStoreFreeListKey]
+//     <database id, 0, 0, 151, object store id, index id>         => existence implies the index id is in the free list [IndexFreeListKey]
+//     <database id, 0, 0, 200, utf16 object store name>           => object store id [ObjectStoreNamesKey]
+//     <database id, 0, 0, 201, object store id, utf16 index name> => index id [IndexNamesKey]
+//
+//
+// Object store data:
+//
+//     The prefix is followed by a type byte. The user key is an encoded IDBKey.
+//
+//     <database id, object store id, 1, user key> => "version", serialized script value [ObjectStoreDataKey]
+//
+//
+// "Exists" entry:
+//
+//     The prefix is followed by a type byte. The user key is an encoded IDBKey.
+//
+//     <database id, object store id, 2, user key> => "version" [ExistsEntryKey]
+//
+//
+// Index data:
+//
+//     The prefix is followed by a type byte. The user key is an encoded IDBKey. The sequence number is a variable length integer.
+//
+//     <database id, object store id, index id, user key, sequence number> => "version", user key [IndexDataKey]
+//
+//     (The sequence number is used to allow two entries with the same user key
+//     in non-unique indexes. The "version" field is used to weed out stale
+//     index data. Whenever new object store data is inserted, it gets a new
+//     "version" number, and new index data is written with this number. When
+//     the index is used for look-ups, entries are validated against the
+//     "exists" entries, and records with old "version" numbers are deleted
+//     when they are encountered in getPrimaryKeyViaIndex,
+//     IndexCursorImpl::loadCurrentRow, and IndexKeyCursorImpl::loadCurrentRow).
+
+static const unsigned char kIDBKeyNullTypeByte = 0;
+static const unsigned char kIDBKeyStringTypeByte = 1;
+static const unsigned char kIDBKeyDateTypeByte = 2;
+static const unsigned char kIDBKeyNumberTypeByte = 3;
+static const unsigned char kIDBKeyMinKeyTypeByte = 4;
+
+static const unsigned char kMinimumIndexId = 30;
+static const unsigned char kObjectStoreDataIndexId = 1;
+static const unsigned char kExistsEntryIndexId = 2;
+
+static const unsigned char kSchemaVersionTypeByte = 0;
+static const unsigned char kMaxDatabaseIdTypeByte = 1;
+static const unsigned char kDatabaseFreeListTypeByte = 100;
+static const unsigned char kDatabaseNameTypeByte = 201;
+
+static const unsigned char kObjectStoreMetaDataTypeByte = 50;
+static const unsigned char kIndexMetaDataTypeByte = 100;
+static const unsigned char kObjectStoreFreeListTypeByte = 150;
+static const unsigned char kIndexFreeListTypeByte = 151;
+static const unsigned char kObjectStoreNamesTypeByte = 200;
+static const unsigned char kIndexNamesKeyTypeByte = 201;
+
+namespace WebCore {
+
+static Vector<char> encodeByte(unsigned char c)
+{
+    Vector<char> v;
+    v.append(c);
+    return v;
+}
+
+static Vector<char> maxIDBKey()
+{
+    return encodeByte(kIDBKeyNullTypeByte);
+}
+
+static Vector<char> minIDBKey()
+{
+    return encodeByte(kIDBKeyMinKeyTypeByte);
+}
+
+static Vector<char> encodeInt(int64_t n)
+{
+    ASSERT(n >= 0);
+    Vector<char> ret; // FIXME: Size this at creation.
+
+    do {
+        unsigned char c = n;
+        ret.append(c);
+        n >>= 8;
+    } while (n);
+
+    return ret;
+}
+
+static int64_t decodeInt(const char* begin, const char* end)
+{
+    ASSERT(begin <= end);
+    int64_t ret = 0;
+
+    while (begin < end) {
+        unsigned char c = *begin++;
+        ret = (ret << 8) | c;
+    }
+
+    return ret;
+}
+
+static Vector<char> encodeVarInt(int64_t n)
+{
+    Vector<char> ret; // FIXME: Size this at creation.
+
+    do {
+        unsigned char c = n & 0x7f;
+        n >>= 7;
+        if (n)
+            c |= 128;
+        ret.append(c);
+    } while (n);
+
+    return ret;
+}
+
+static const char* decodeVarInt(const char *p, const char* limit, int64_t& foundInt)
+{
+    ASSERT(limit >= p);
+    foundInt = 0;
+
+    do {
+        if (p >= limit)
+            return 0;
+
+        foundInt = (foundInt << 7) | (*p & 0x7f);
+    } while (*p++ & 128);
+    return p;
+}
+
+static Vector<char> encodeString(const String& s)
+{
+    Vector<char> ret; // FIXME: Size this at creation.
+
+    for (unsigned i = 0; i < s.length(); ++i) {
+        UChar u = s[i];
+        unsigned char hi = u >> 8;
+        unsigned char lo = u;
+        ret.append(hi);
+        ret.append(lo);
+    }
+
+    return ret;
+}
+
+static String decodeString(const char* p, const char* end)
+{
+    ASSERT(end >= p);
+    ASSERT(!((end - p) % 2));
+
+    size_t len = (end - p) / 2;
+    Vector<UChar> vector(len);
+
+    for (size_t i = 0; i < len; ++i) {
+        unsigned char hi = *p++;
+        unsigned char lo = *p++;
+
+        vector[i] = (hi << 8) | lo;
+    }
+
+    return String::adopt(vector);
+}
+
+static Vector<char> encodeStringWithLength(const String& s)
+{
+    Vector<char> ret = encodeVarInt(s.length());
+    ret.append(encodeString(s));
+    return ret;
+}
+
+static const char* decodeStringWithLength(const char* p, const char* limit, String& foundString)
+{
+    ASSERT(limit >= p);
+    int64_t len;
+    p = decodeVarInt(p, limit, len);
+    if (!p)
+        return 0;
+    if (p + len * 2 > limit)
+        return 0;
+
+    foundString = decodeString(p, p + len * 2);
+    p += len * 2;
+    return p;
+}
+
+static Vector<char> encodeDouble(double x)
+{
+    // FIXME: It would be nice if we could be byte order independent.
+    const char* p = reinterpret_cast<char*>(&x);
+    Vector<char> v;
+    v.append(p, sizeof(x));
+    ASSERT(v.size() == sizeof(x));
+    return v;
+}
+
+static const char* decodeDouble(const char* p, const char* limit, double* d)
+{
+    if (p + sizeof(*d) > limit)
+        return 0;
+
+    char* x = reinterpret_cast<char*>(d);
+    for (size_t i = 0; i < sizeof(*d); ++i)
+        *x++ = *p++;
+    return p;
+}
+
+static Vector<char> encodeIDBKey(const IDBKey& key)
+{
+    Vector<char> ret;
+
+    switch (key.type()) {
+    case IDBKey::NullType:
+        return encodeByte(kIDBKeyNullTypeByte);
+    case IDBKey::StringType:
+        ret = encodeByte(kIDBKeyStringTypeByte);
+        ret.append(encodeStringWithLength(key.string()));
+        return ret;
+    case IDBKey::DateType:
+        ret = encodeByte(kIDBKeyDateTypeByte);
+        ret.append(encodeDouble(key.date()));
+        ASSERT(ret.size() == 9);
+        return ret;
+    case IDBKey::NumberType:
+        ret = encodeByte(kIDBKeyNumberTypeByte);
+        ret.append(encodeDouble(key.number()));
+        ASSERT(ret.size() == 9);
+        return ret;
+    }
+
+    ASSERT_NOT_REACHED();
+    return Vector<char>();
+}
+
+static const char* decodeIDBKey(const char* p, const char* limit, RefPtr<IDBKey>& foundKey)
+{
+    ASSERT(limit >= p);
+    if (p >= limit)
+        return 0;
+
+    unsigned char type = *p++;
+    String s;
+    double d;
+
+    switch (type) {
+    case kIDBKeyNullTypeByte:
+        // Null.
+        foundKey = IDBKey::createNull();
+        return p;
+    case kIDBKeyStringTypeByte:
+        // String.
+        p = decodeStringWithLength(p, limit, s);
+        if (!p)
+            return 0;
+        foundKey = IDBKey::createString(s);
+        return p;
+    case kIDBKeyDateTypeByte:
+        // Date.
+        p = decodeDouble(p, limit, &d);
+        if (!p)
+            return 0;
+        foundKey = IDBKey::createDate(d);
+        return p;
+    case kIDBKeyNumberTypeByte:
+        // Number.
+        p = decodeDouble(p, limit, &d);
+        if (!p)
+            return 0;
+        foundKey = IDBKey::createNumber(d);
+        return p;
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static const char* extractEncodedIDBKey(const char* start, const char* limit, Vector<char>* result)
+{
+    const char* p = start;
+    if (p >= limit)
+        return 0;
+
+    unsigned char type = *p++;
+
+    int64_t stringLen;
+
+    switch (type) {
+    case kIDBKeyNullTypeByte:
+    case kIDBKeyMinKeyTypeByte:
+        *result = encodeByte(type);
+        return p;
+    case kIDBKeyStringTypeByte:
+        // String.
+        p = decodeVarInt(p, limit, stringLen);
+        if (!p)
+            return 0;
+        if (p + stringLen * 2 > limit)
+            return 0;
+        result->clear();
+        result->append(start, p - start + stringLen * 2);
+        return p + stringLen * 2;
+    case kIDBKeyDateTypeByte:
+    case kIDBKeyNumberTypeByte:
+        // Date or number.
+        if (p + sizeof(double) > limit)
+            return 0;
+        result->clear();
+        result->append(start, 1 + sizeof(double));
+        return p + sizeof(double);
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static int compareEncodedIDBKeys(const Vector<char>& keyA, const Vector<char>& keyB)
+{
+    ASSERT(keyA.size() >= 1);
+    ASSERT(keyB.size() >= 1);
+
+    const char* p = keyA.data();
+    const char* limitA = p + keyA.size();
+    const char* q = keyB.data();
+    const char* limitB = q + keyB.size();
+
+    unsigned char typeA = *p++;
+    unsigned char typeB = *q++;
+
+    String s, t;
+    double d, e;
+
+    if (int x = typeB - typeA) // FIXME: Note the subtleness!
+        return x;
+
+    switch (typeA) {
+    case kIDBKeyNullTypeByte:
+    case kIDBKeyMinKeyTypeByte:
+        // Null type or max type; no payload to compare.
+        return 0;
+    case kIDBKeyStringTypeByte:
+        // String type.
+        p = decodeStringWithLength(p, limitA, s); // FIXME: Compare without actually decoding the String!
+        ASSERT(p);
+        q = decodeStringWithLength(q, limitB, t);
+        ASSERT(q);
+        return codePointCompare(s, t);
+    case kIDBKeyDateTypeByte:
+    case kIDBKeyNumberTypeByte:
+        // Date or number.
+        p = decodeDouble(p, limitA, &d);
+        ASSERT(p);
+        q = decodeDouble(q, limitB, &e);
+        ASSERT(q);
+        if (d < e)
+            return -1;
+        if (d > e)
+            return 1;
+        return 0;
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static bool getInt(LevelDBDatabase* db, const Vector<char>& key, int64_t& foundInt)
+{
+    Vector<char> result;
+    if (!db->get(key, result))
+        return false;
+
+    foundInt = decodeInt(result.begin(), result.end());
+    return true;
+}
+
+static bool putInt(LevelDBDatabase* db, const Vector<char>& key, int64_t value)
+{
+    return db->put(key, encodeInt(value));
+}
+
+static bool getString(LevelDBDatabase* db, const Vector<char>& key, String& foundString)
+{
+    Vector<char> result;
+    if (!db->get(key, result))
+        return false;
+
+    foundString = decodeString(result.begin(), result.end());
+    return true;
+}
+
+static bool putString(LevelDBDatabase* db, const Vector<char> key, const String& value)
+{
+    if (!db->put(key, encodeString(value)))
+        return false;
+    return true;
+}
+
+namespace {
+class KeyPrefix {
+public:
+    KeyPrefix()
+        : m_databaseId(kInvalidType)
+        , m_objectStoreId(kInvalidType)
+        , m_indexId(kInvalidType)
+    {
+    }
+
+    KeyPrefix(int64_t databaseId, int64_t objectStoreId, int64_t indexId)
+        : m_databaseId(databaseId)
+        , m_objectStoreId(objectStoreId)
+        , m_indexId(indexId)
+    {
+    }
+
+    static const char* decode(const char* start, const char* limit, KeyPrefix* result)
+    {
+        if (start == limit)
+            return 0;
+
+        unsigned char firstByte = *start++;
+
+        int databaseIdBytes = ((firstByte >> 5) & 0x7) + 1;
+        int objectStoreIdBytes = ((firstByte >> 2) & 0x7) + 1;
+        int indexIdBytes = (firstByte & 0x3) + 1;
+
+        if (start + databaseIdBytes + objectStoreIdBytes + indexIdBytes > limit)
+            return 0;
+
+        result->m_databaseId = decodeInt(start, start + databaseIdBytes);
+        start += databaseIdBytes;
+        result->m_objectStoreId = decodeInt(start, start + objectStoreIdBytes);
+        start += objectStoreIdBytes;
+        result->m_indexId = decodeInt(start, start + indexIdBytes);
+        start += indexIdBytes;
+
+        return start;
+    }
+
+    Vector<char> encode() const
+    {
+        ASSERT(m_databaseId != kInvalidId);
+        ASSERT(m_objectStoreId != kInvalidId);
+        ASSERT(m_indexId != kInvalidId);
+
+        Vector<char> databaseIdString = encodeInt(m_databaseId);
+        Vector<char> objectStoreIdString = encodeInt(m_objectStoreId);
+        Vector<char> indexIdString = encodeInt(m_indexId);
+
+        ASSERT(databaseIdString.size() <= 8);
+        ASSERT(objectStoreIdString.size() <= 8);
+        ASSERT(indexIdString.size() <= 4);
+
+
+        unsigned char firstByte = (databaseIdString.size() - 1) << 5 | (objectStoreIdString.size() - 1) << 2 | (indexIdString.size() - 1);
+        Vector<char> ret;
+        ret.append(firstByte);
+        ret.append(databaseIdString);
+        ret.append(objectStoreIdString);
+        ret.append(indexIdString);
+
+        return ret;
+    }
+
+    int compare(const KeyPrefix& other) const
+    {
+        ASSERT(m_databaseId != kInvalidId);
+        ASSERT(m_objectStoreId != kInvalidId);
+        ASSERT(m_indexId != kInvalidId);
+
+        if (m_databaseId != other.m_databaseId)
+            return m_databaseId - other.m_databaseId;
+        if (m_objectStoreId != other.m_objectStoreId)
+            return m_objectStoreId - other.m_objectStoreId;
+        if (m_indexId != other.m_indexId)
+            return m_indexId - other.m_indexId;
+        return 0;
+    }
+
+    enum Type {
+        kGlobalMetaData,
+        kDatabaseMetaData,
+        kObjectStoreData,
+        kExistsEntry,
+        kIndexData,
+        kInvalidType
+    };
+
+    Type type() const
+    {
+        ASSERT(m_databaseId != kInvalidId);
+        ASSERT(m_objectStoreId != kInvalidId);
+        ASSERT(m_indexId != kInvalidId);
+
+        if (!m_databaseId)
+            return kGlobalMetaData;
+        if (!m_objectStoreId)
+            return kDatabaseMetaData;
+        if (m_indexId == kObjectStoreDataIndexId)
+            return kObjectStoreData;
+        if (m_indexId == kExistsEntryIndexId)
+            return kExistsEntry;
+        if (m_indexId >= kMinimumIndexId)
+            return kIndexData;
+
+        ASSERT_NOT_REACHED();
+        return kInvalidType;
+    }
+
+    int64_t m_databaseId;
+    int64_t m_objectStoreId;
+    int64_t m_indexId;
+
+    static const int64_t kInvalidId = -1;
+};
+
+class SchemaVersionKey {
+public:
+    static Vector<char> encode()
+    {
+        KeyPrefix prefix(0, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kSchemaVersionTypeByte));
+        return ret;
+    }
+};
+
+class MaxDatabaseIdKey {
+public:
+    static Vector<char> encode()
+    {
+        KeyPrefix prefix(0, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kMaxDatabaseIdTypeByte));
+        return ret;
+    }
+};
+
+class DatabaseFreeListKey {
+public:
+    DatabaseFreeListKey()
+        : m_databaseId(-1)
+    {
+    }
+
+    static const char* decode(const char* start, const char* limit, DatabaseFreeListKey* result)
+    {
+        KeyPrefix prefix;
+        const char *p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(!prefix.m_databaseId);
+        ASSERT(!prefix.m_objectStoreId);
+        ASSERT(!prefix.m_indexId);
+        if (p == limit)
+            return 0;
+        unsigned char typeByte = *p++;
+        ASSERT_UNUSED(typeByte, typeByte == kDatabaseFreeListTypeByte);
+        if (p == limit)
+            return 0;
+        return decodeVarInt(p, limit, result->m_databaseId);
+    }
+
+    static Vector<char> encode(int64_t databaseId)
+    {
+        KeyPrefix prefix(0, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kDatabaseFreeListTypeByte));
+        ret.append(encodeVarInt(databaseId));
+        return ret;
+    }
+
+    int64_t databaseId() const
+    {
+        ASSERT(m_databaseId >= 0);
+        return m_databaseId;
+    }
+
+    int compare(const DatabaseFreeListKey& other) const
+    {
+        ASSERT(m_databaseId >= 0);
+        return m_databaseId - other.m_databaseId;
+    }
+
+private:
+    int64_t m_databaseId;
+};
+
+class DatabaseNameKey {
+public:
+    static const char* decode(const char* start, const char* limit, DatabaseNameKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return p;
+        ASSERT(!prefix.m_databaseId);
+        ASSERT(!prefix.m_objectStoreId);
+        ASSERT(!prefix.m_indexId);
+        if (p == limit)
+            return 0;
+        unsigned char typeByte = *p++;
+        ASSERT_UNUSED(typeByte, typeByte == kDatabaseNameTypeByte);
+        if (p == limit)
+            return 0;
+        p = decodeStringWithLength(p, limit, result->m_origin);
+        if (!p)
+            return 0;
+        return decodeStringWithLength(p, limit, result->m_databaseName);
+    }
+
+    static Vector<char> encode(const String& origin, const String& databaseName)
+    {
+        KeyPrefix prefix(0, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kDatabaseNameTypeByte));
+        ret.append(encodeStringWithLength(origin));
+        ret.append(encodeStringWithLength(databaseName));
+        return ret;
+    }
+
+    String origin() const { return m_origin; }
+    String databaseName() const { return m_databaseName; }
+
+    int compare(const DatabaseNameKey& other)
+    {
+        if (int x = codePointCompare(m_origin, other.m_origin))
+            return x;
+        return codePointCompare(m_databaseName, other.m_databaseName);
+    }
+
+private:
+    String m_origin; // FIXME: Store encoded strings, or just pointers.
+    String m_databaseName;
+};
+
+class DatabaseMetaDataKey {
+public:
+    enum MetaDataType {
+        kOriginName = 0,
+        kDatabaseName = 1,
+        kUserVersion = 2,
+        kMaxObjectStoreId = 3
+    };
+
+    static Vector<char> encode(int64_t databaseId, MetaDataType metaDataType)
+    {
+        KeyPrefix prefix(databaseId, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(metaDataType));
+        return ret;
+    }
+};
+
+class ObjectStoreMetaDataKey {
+public:
+    ObjectStoreMetaDataKey()
+        : m_objectStoreId(-1)
+        , m_metaDataType(-1)
+    {
+    }
+
+    static const char* decode(const char* start, const char* limit, ObjectStoreMetaDataKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(!prefix.m_objectStoreId);
+        ASSERT(!prefix.m_indexId);
+        if (p == limit)
+            return 0;
+        unsigned char typeByte = *p++;
+        ASSERT_UNUSED(typeByte, typeByte == kObjectStoreMetaDataTypeByte);
+        if (p == limit)
+            return 0;
+        p = decodeVarInt(p, limit, result->m_objectStoreId);
+        if (!p)
+            return 0;
+        ASSERT(result->m_objectStoreId);
+        if (p == limit)
+            return 0;
+        return decodeVarInt(p, limit, result->m_metaDataType);
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, int64_t metaDataType)
+    {
+        KeyPrefix prefix(databaseId, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kObjectStoreMetaDataTypeByte));
+        ret.append(encodeVarInt(objectStoreId));
+        ret.append(encodeVarInt(metaDataType));
+        return ret;
+    }
+
+    int64_t objectStoreId() const
+    {
+        ASSERT(m_objectStoreId >= 0);
+        return m_objectStoreId;
+    }
+    int64_t metaDataType() const
+    {
+        ASSERT(m_metaDataType >= 0);
+        return m_metaDataType;
+    }
+
+    int compare(const ObjectStoreMetaDataKey& other)
+    {
+        ASSERT(m_objectStoreId >= 0);
+        ASSERT(m_metaDataType >= 0);
+        if (int x = m_objectStoreId - other.m_objectStoreId)
+            return x; // FIXME: Is this cast safe? I.e., will it preserve the sign?
+        return m_metaDataType - other.m_metaDataType;
+    }
+
+private:
+    int64_t m_objectStoreId;
+    int64_t m_metaDataType; // FIXME: Make this a byte.
+};
+
+class IndexMetaDataKey {
+public:
+    IndexMetaDataKey()
+        : m_objectStoreId(-1)
+        , m_indexId(-1)
+        , m_metaDataType(0)
+    {
+    }
+
+    static const char* decode(const char* start, const char* limit, IndexMetaDataKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(!prefix.m_objectStoreId);
+        ASSERT(!prefix.m_indexId);
+        if (p == limit)
+            return 0;
+        unsigned char typeByte = *p++;
+        ASSERT_UNUSED(typeByte, typeByte == kIndexMetaDataTypeByte);
+        if (p == limit)
+            return 0;
+        p = decodeVarInt(p, limit, result->m_objectStoreId);
+        if (!p)
+            return 0;
+        p = decodeVarInt(p, limit, result->m_indexId);
+        if (!p)
+            return 0;
+        if (p == limit)
+            return 0;
+        result->m_metaDataType = *p++;
+        return p;
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, int64_t indexId, unsigned char metaDataType)
+    {
+        KeyPrefix prefix(databaseId, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kIndexMetaDataTypeByte));
+        ret.append(encodeVarInt(objectStoreId));
+        ret.append(encodeVarInt(indexId));
+        ret.append(encodeByte(metaDataType));
+        return ret;
+    }
+
+    int compare(const IndexMetaDataKey& other)
+    {
+        ASSERT(m_objectStoreId >= 0);
+        ASSERT(m_indexId >= 0);
+
+        if (int x = m_objectStoreId - other.m_objectStoreId)
+            return x;
+        if (int x = m_indexId - other.m_indexId)
+            return x;
+        return m_metaDataType - other.m_metaDataType;
+    }
+
+    int64_t indexId() const
+    {
+        ASSERT(m_indexId >= 0);
+        return m_indexId;
+    }
+
+    unsigned char metaDataType() const { return m_metaDataType; }
+
+private:
+    int64_t m_objectStoreId;
+    int64_t m_indexId;
+    unsigned char m_metaDataType;
+};
+
+class ObjectStoreFreeListKey {
+public:
+    ObjectStoreFreeListKey()
+        : m_objectStoreId(-1)
+    {
+    }
+
+    static const char* decode(const char* start, const char* limit, ObjectStoreFreeListKey* result)
+    {
+        KeyPrefix prefix;
+        const char *p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(!prefix.m_objectStoreId);
+        ASSERT(!prefix.m_indexId);
+        if (p == limit)
+            return 0;
+        unsigned char typeByte = *p++;
+        ASSERT_UNUSED(typeByte, typeByte == kObjectStoreFreeListTypeByte);
+        if (p == limit)
+            return 0;
+        return decodeVarInt(p, limit, result->m_objectStoreId);
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId)
+    {
+        KeyPrefix prefix(databaseId, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kObjectStoreFreeListTypeByte));
+        ret.append(encodeVarInt(objectStoreId));
+        return ret;
+    }
+
+    int64_t objectStoreId() const
+    {
+        ASSERT(m_objectStoreId >= 0);
+        return m_objectStoreId;
+    }
+
+    int compare(const ObjectStoreFreeListKey& other)
+    {
+        // FIXME: It may seem strange that we're not comparing database id's,
+        // but that comparison will have been made earlier.
+        // We should probably make this more clear, though...
+        ASSERT(m_objectStoreId >= 0);
+        return m_objectStoreId - other.m_objectStoreId;
+    }
+
+private:
+    int64_t m_objectStoreId;
+};
+
+class IndexFreeListKey {
+public:
+    IndexFreeListKey()
+        : m_objectStoreId(-1)
+        , m_indexId(-1)
+    {
+    }
+
+    static const char* decode(const char* start, const char* limit, IndexFreeListKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(!prefix.m_objectStoreId);
+        ASSERT(!prefix.m_indexId);
+        if (p == limit)
+            return 0;
+        unsigned char typeByte = *p++;
+        ASSERT_UNUSED(typeByte, typeByte == kIndexFreeListTypeByte);
+        if (p == limit)
+            return 0;
+        p = decodeVarInt(p, limit, result->m_objectStoreId);
+        if (!p)
+            return 0;
+        return decodeVarInt(p, limit, result->m_indexId);
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, int64_t indexId)
+    {
+        KeyPrefix prefix(databaseId, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kIndexFreeListTypeByte));
+        ret.append(encodeVarInt(objectStoreId));
+        ret.append(encodeVarInt(indexId));
+        return ret;
+    }
+
+    int compare(const IndexFreeListKey& other)
+    {
+        ASSERT(m_objectStoreId >= 0);
+        ASSERT(m_indexId >= 0);
+        if (int x = m_objectStoreId - other.m_objectStoreId)
+            return x;
+        return m_indexId - other.m_indexId;
+    }
+
+    int64_t objectStoreId() const
+    {
+        ASSERT(m_objectStoreId >= 0);
+        return m_objectStoreId;
+    }
+
+    int64_t indexId() const
+    {
+        ASSERT(m_indexId >= 0);
+        return m_indexId;
+    }
+
+private:
+    int64_t m_objectStoreId;
+    int64_t m_indexId;
+};
+
+class ObjectStoreNamesKey {
+public:
+    // FIXME: We never use this to look up object store ids, because a mapping
+    // is kept in the IDBDatabaseBackendImpl. Can the mapping become unreliable?
+    // Can we remove this?
+    static const char* decode(const char* start, const char* limit, ObjectStoreNamesKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(!prefix.m_objectStoreId);
+        ASSERT(!prefix.m_indexId);
+        if (p == limit)
+            return 0;
+        unsigned char typeByte = *p++;
+        ASSERT_UNUSED(typeByte, typeByte == kObjectStoreNamesTypeByte);
+        return decodeStringWithLength(p, limit, result->m_objectStoreName);
+    }
+
+    static Vector<char> encode(int64_t databaseId, const String& objectStoreName)
+    {
+        KeyPrefix prefix(databaseId, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kSchemaVersionTypeByte));
+        ret.append(encodeByte(kObjectStoreNamesTypeByte));
+        ret.append(encodeStringWithLength(objectStoreName));
+        return ret;
+    }
+
+    int compare(const ObjectStoreNamesKey& other)
+    {
+        return codePointCompare(m_objectStoreName, other.m_objectStoreName);
+    }
+
+    String objectStoreName() const { return m_objectStoreName; }
+
+private:
+    String m_objectStoreName; // FIXME: Store the encoded string, or just pointers to it.
+};
+
+class IndexNamesKey {
+public:
+    IndexNamesKey()
+        : m_objectStoreId(-1)
+    {
+    }
+
+    // FIXME: We never use this to look up index ids, because a mapping
+    // is kept at a higher level.
+    static const char* decode(const char* start, const char* limit, IndexNamesKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(!prefix.m_objectStoreId);
+        ASSERT(!prefix.m_indexId);
+        if (p == limit)
+            return 0;
+        unsigned char typeByte = *p++;
+        ASSERT_UNUSED(typeByte, typeByte == kIndexNamesKeyTypeByte);
+        if (p == limit)
+            return 0;
+        p = decodeVarInt(p, limit, result->m_objectStoreId);
+        if (!p)
+            return 0;
+        return decodeStringWithLength(p, limit, result->m_indexName);
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, const String& indexName)
+    {
+        KeyPrefix prefix(databaseId, 0, 0);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodeByte(kIndexNamesKeyTypeByte));
+        ret.append(encodeVarInt(objectStoreId));
+        ret.append(encodeStringWithLength(indexName));
+        return ret;
+    }
+
+    int compare(const IndexNamesKey& other)
+    {
+        ASSERT(m_objectStoreId >= 0);
+        if (int x = m_objectStoreId - other.m_objectStoreId)
+            return x;
+        return codePointCompare(m_indexName, other.m_indexName);
+    }
+
+    String indexName() const { return m_indexName; }
+
+private:
+    int64_t m_objectStoreId;
+    String m_indexName;
+};
+
+class ObjectStoreDataKey {
+public:
+    static const char* decode(const char* start, const char* end, ObjectStoreDataKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, end, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(prefix.m_objectStoreId);
+        ASSERT(prefix.m_indexId == kSpecialIndexNumber);
+        if (p == end)
+            return 0;
+        return extractEncodedIDBKey(p, end, &result->m_encodedUserKey);
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, const Vector<char> encodedUserKey)
+    {
+        KeyPrefix prefix(databaseId, objectStoreId, kSpecialIndexNumber);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodedUserKey);
+
+        return ret;
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, const IDBKey& userKey)
+    {
+        return encode(databaseId, objectStoreId, encodeIDBKey(userKey));
+    }
+
+    int compare(const ObjectStoreDataKey& other)
+    {
+        return compareEncodedIDBKeys(m_encodedUserKey, other.m_encodedUserKey);
+    }
+
+    PassRefPtr<IDBKey> userKey() const
+    {
+        RefPtr<IDBKey> key;
+        decodeIDBKey(m_encodedUserKey.begin(), m_encodedUserKey.end(), key);
+        return key;
+    }
+
+    static const int64_t kSpecialIndexNumber = kObjectStoreDataIndexId;
+
+private:
+    Vector<char> m_encodedUserKey;
+};
+
+class ExistsEntryKey {
+public:
+    static const char* decode(const char* start, const char* end, ExistsEntryKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, end, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(prefix.m_objectStoreId);
+        ASSERT(prefix.m_indexId == kSpecialIndexNumber);
+        if (p == end)
+            return 0;
+        return extractEncodedIDBKey(p, end, &result->m_encodedUserKey);
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, const Vector<char>& encodedKey)
+    {
+        KeyPrefix prefix(databaseId, objectStoreId, kSpecialIndexNumber);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodedKey);
+        return ret;
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, const IDBKey& userKey)
+    {
+        return encode(databaseId, objectStoreId, encodeIDBKey(userKey));
+    }
+
+    int compare(const ExistsEntryKey& other)
+    {
+        return compareEncodedIDBKeys(m_encodedUserKey, other.m_encodedUserKey);
+    }
+
+    PassRefPtr<IDBKey> userKey() const
+    {
+        RefPtr<IDBKey> key;
+        decodeIDBKey(m_encodedUserKey.begin(), m_encodedUserKey.end(), key);
+        return key;
+    }
+
+    static const int64_t kSpecialIndexNumber = kExistsEntryIndexId;
+
+private:
+    Vector<char> m_encodedUserKey;
+};
+
+class IndexDataKey {
+public:
+    IndexDataKey()
+        : m_databaseId(-1)
+        , m_objectStoreId(-1)
+        , m_indexId(-1)
+        , m_sequenceNumber(-1)
+    {
+    }
+
+    static const char* decode(const char* start, const char* limit, IndexDataKey* result)
+    {
+        KeyPrefix prefix;
+        const char* p = KeyPrefix::decode(start, limit, &prefix);
+        if (!p)
+            return 0;
+        ASSERT(prefix.m_databaseId);
+        ASSERT(prefix.m_objectStoreId);
+        ASSERT(prefix.m_indexId >= kMinimumIndexId);
+        result->m_databaseId = prefix.m_databaseId;
+        result->m_objectStoreId = prefix.m_objectStoreId;
+        result->m_indexId = prefix.m_indexId;
+        p = extractEncodedIDBKey(p, limit, &result->m_encodedUserKey);
+        if (!p)
+            return 0;
+        if (p == limit) {
+            result->m_sequenceNumber = -1; // FIXME: We should change it so that all keys have a sequence number. Shouldn't need to handle this case.
+            return p;
+        }
+        return decodeVarInt(p, limit, result->m_sequenceNumber);
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const Vector<char>& encodedUserKey, int64_t sequenceNumber)
+    {
+        KeyPrefix prefix(databaseId, objectStoreId, indexId);
+        Vector<char> ret = prefix.encode();
+        ret.append(encodedUserKey);
+        ret.append(encodeVarInt(sequenceNumber));
+        return ret;
+    }
+
+    static Vector<char> encode(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey& userKey, int64_t sequenceNumber)
+    {
+        return encode(databaseId, objectStoreId, indexId, encodeIDBKey(userKey), sequenceNumber);
+    }
+
+    static Vector<char> encodeMaxKey(int64_t databaseId, int64_t objectStoreId)
+    {
+        return encode(databaseId, objectStoreId, INT32_MAX, maxIDBKey(), INT64_MAX);
+    }
+
+    int compare(const IndexDataKey& other, bool ignoreSequenceNumber)
+    {
+        ASSERT(m_databaseId >= 0);
+        ASSERT(m_objectStoreId >= 0);
+        ASSERT(m_indexId >= 0);
+        if (int x = compareEncodedIDBKeys(m_encodedUserKey, other.m_encodedUserKey))
+            return x;
+        if (ignoreSequenceNumber)
+            return 0;
+        return m_sequenceNumber - other.m_sequenceNumber;
+    }
+
+    int64_t databaseId() const
+    {
+        ASSERT(m_databaseId >= 0);
+        return m_databaseId;
+    }
+
+    int64_t objectStoreId() const
+    {
+        ASSERT(m_objectStoreId >= 0);
+        return m_objectStoreId;
+    }
+
+    int64_t indexId() const
+    {
+        ASSERT(m_indexId >= 0);
+        return m_indexId;
+    }
+
+    PassRefPtr<IDBKey> userKey() const
+    {
+        RefPtr<IDBKey> key;
+        decodeIDBKey(m_encodedUserKey.begin(), m_encodedUserKey.end(), key);
+        return key;
+    }
+
+private:
+    int64_t m_databaseId;
+    int64_t m_objectStoreId;
+    int64_t m_indexId;
+    Vector<char> m_encodedUserKey;
+    int64_t m_sequenceNumber;
+};
+
+namespace {
+template<typename KeyType>
+int decodeAndCompare(const LevelDBSlice& a, const LevelDBSlice& b)
+{
+    KeyType keyA;
+    KeyType keyB;
+
+    const char* ptrA = KeyType::decode(a.begin(), a.end(), &keyA);
+    ASSERT_UNUSED(ptrA, ptrA);
+    const char* ptrB = KeyType::decode(b.begin(), b.end(), &keyB);
+    ASSERT_UNUSED(ptrB, ptrB);
+
+    return keyA.compare(keyB);
+}
+}
+
+static int realCompare(const LevelDBSlice& a, const LevelDBSlice& b, bool indexKeys = false)
+{
+    const char* ptrA = a.begin();
+    const char* ptrB = b.begin();
+    const char* endA = a.end();
+    const char* endB = b.end();
+
+    KeyPrefix prefixA;
+    KeyPrefix prefixB;
+
+    ptrA = KeyPrefix::decode(ptrA, endA, &prefixA);
+    ptrB = KeyPrefix::decode(ptrB, endB, &prefixB);
+    ASSERT(ptrA);
+    ASSERT(ptrB);
+
+    if (int x = prefixA.compare(prefixB))
+        return x;
+
+    if (prefixA.type() == KeyPrefix::kGlobalMetaData) {
+        ASSERT(ptrA != endA);
+        ASSERT(ptrB != endB);
+
+        unsigned char typeByteA = *ptrA++;
+        unsigned char typeByteB = *ptrB++;
+
+        if (int x = typeByteA - typeByteB)
+            return x;
+
+        if (typeByteA <= 1)
+            return 0;
+        if (typeByteA == kDatabaseFreeListTypeByte)
+            return decodeAndCompare<DatabaseFreeListKey>(a, b);
+        if (typeByteA == kDatabaseNameTypeByte)
+            return decodeAndCompare<DatabaseNameKey>(a, b);
+    }
+
+    if (prefixA.type() == KeyPrefix::kDatabaseMetaData) {
+        ASSERT(ptrA != endA);
+        ASSERT(ptrB != endB);
+
+        unsigned char typeByteA = *ptrA++;
+        unsigned char typeByteB = *ptrB++;
+
+        if (int x = typeByteA - typeByteB)
+            return x;
+
+        if (typeByteA <= 3)
+            return 0;
+
+        if (typeByteA == kObjectStoreMetaDataTypeByte)
+            return decodeAndCompare<ObjectStoreMetaDataKey>(a, b);
+        if (typeByteA == kIndexMetaDataTypeByte)
+            return decodeAndCompare<IndexMetaDataKey>(a, b);
+        if (typeByteA == kObjectStoreFreeListTypeByte)
+            return decodeAndCompare<ObjectStoreFreeListKey>(a, b);
+        if (typeByteA == kIndexFreeListTypeByte)
+            return decodeAndCompare<IndexFreeListKey>(a, b);
+        if (typeByteA == kObjectStoreNamesTypeByte)
+            return decodeAndCompare<ObjectStoreNamesKey>(a, b);
+        if (typeByteA == kIndexNamesKeyTypeByte)
+            return decodeAndCompare<IndexNamesKey>(a, b);
+
+        return 0;
+        ASSERT_NOT_REACHED();
+    }
+
+    if (prefixA.type() == KeyPrefix::kObjectStoreData) {
+        if (ptrA == endA && ptrB == endB)
+            return 0;
+        if (ptrA == endA)
+            return -1;
+        if (ptrB == endB)
+            return 1; // FIXME: This case of non-existing user keys should not have to be handled this way.
+
+        return decodeAndCompare<ObjectStoreDataKey>(a, b);
+    }
+    if (prefixA.type() == KeyPrefix::kExistsEntry) {
+        if (ptrA == endA && ptrB == endB)
+            return 0;
+        if (ptrA == endA)
+            return -1;
+        if (ptrB == endB)
+            return 1; // FIXME: This case of non-existing user keys should not have to be handled this way.
+
+        return decodeAndCompare<ExistsEntryKey>(a, b);
+    }
+    if (prefixA.type() == KeyPrefix::kIndexData) {
+        if (ptrA == endA && ptrB == endB)
+            return 0;
+        if (ptrA == endA)
+            return -1;
+        if (ptrB == endB)
+            return 1; // FIXME: This case of non-existing user keys should not have to be handled this way.
+
+        IndexDataKey indexDataKeyA;
+        IndexDataKey indexDataKeyB;
+
+        ptrA = IndexDataKey::decode(a.begin(), endA, &indexDataKeyA);
+        ptrB = IndexDataKey::decode(b.begin(), endB, &indexDataKeyB);
+        ASSERT(ptrA);
+        ASSERT(ptrB);
+
+        bool ignoreSequenceNumber = indexKeys;
+        return indexDataKeyA.compare(indexDataKeyB, ignoreSequenceNumber);
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static int compareKeys(const LevelDBSlice& a, const LevelDBSlice& b)
+{
+    return realCompare(a, b);
+}
+
+static int compareIndexKeys(const LevelDBSlice& a, const LevelDBSlice& b)
+{
+    return realCompare(a, b, true);
+}
+
+class Comparator : public LevelDBComparator {
+public:
+    virtual int compare(const LevelDBSlice& a, const LevelDBSlice& b) const { return realCompare(a, b); }
+    virtual const char* name() const { return "idb_cmp1"; }
+};
+}
+
+static bool setUpMetadata(LevelDBDatabase* db)
+{
+    const Vector<char> metaDataKey = SchemaVersionKey::encode();
+
+    int64_t schemaVersion;
+    if (!getInt(db, metaDataKey, schemaVersion)) {
+        schemaVersion = 0;
+        if (!putInt(db, metaDataKey, schemaVersion))
+            return false;
+    }
+
+    // FIXME: Eventually, we'll need to be able to transition between schemas.
+    if (schemaVersion)
+        return false; // Don't know what to do with this version.
+
+    return true;
+}
+
+IDBLevelDBBackingStore::IDBLevelDBBackingStore(String identifier, IDBFactoryBackendImpl* factory, LevelDBDatabase* db)
+    : m_identifier(identifier)
+    , m_factory(factory)
+    , m_db(db)
+{
+    m_factory->addIDBBackingStore(identifier, this);
+}
+
+IDBLevelDBBackingStore::~IDBLevelDBBackingStore()
+{
+    m_factory->removeIDBBackingStore(m_identifier);
+}
+
+PassRefPtr<IDBBackingStore> IDBLevelDBBackingStore::open(SecurityOrigin* securityOrigin, const String& pathBaseArg, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl* factory)
+{
+    String pathBase = pathBaseArg;
+
+    if (pathBase.isEmpty()) {
+        ASSERT_NOT_REACHED(); // FIXME: We need to handle this case for incognito and DumpRenderTree.
+        return 0;
+    }
+
+    if (!makeAllDirectories(pathBase)) {
+        LOG_ERROR("Unable to create IndexedDB database path %s", pathBase.utf8().data());
+        return 0;
+    }
+    // FIXME: We should eventually use the same LevelDB database for all origins.
+    String path = pathByAppendingComponent(pathBase, securityOrigin->databaseIdentifier() + ".indexeddb.leveldb");
+
+    OwnPtr<LevelDBComparator> comparator(new Comparator());
+    LevelDBDatabase* db = LevelDBDatabase::open(path, comparator.get());
+    if (!db)
+        return 0;
+
+    // FIXME: Handle comparator name changes.
+
+    RefPtr<IDBLevelDBBackingStore> backingStore(adoptRef(new IDBLevelDBBackingStore(fileIdentifier, factory, db)));
+    backingStore->m_comparator = comparator.release();
+
+    if (!setUpMetadata(backingStore->m_db.get()))
+        return 0;
+
+    return backingStore.release();
+}
+
+bool IDBLevelDBBackingStore::extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId)
+{
+    const Vector<char> key = DatabaseNameKey::encode(m_identifier, name);
+
+    bool ok = getInt(m_db.get(), key, foundId);
+    if (!ok)
+        return false;
+
+    ok = getString(m_db.get(), DatabaseMetaDataKey::encode(foundId, DatabaseMetaDataKey::kUserVersion), foundVersion);
+    if (!ok)
+        return false;
+
+    return true;
+}
+
+static int64_t getNewDatabaseId(LevelDBDatabase* db)
+{
+    const Vector<char> freeListStartKey = DatabaseFreeListKey::encode(0);
+    const Vector<char> freeListStopKey = DatabaseFreeListKey::encode(INT64_MAX);
+
+    OwnPtr<LevelDBIterator> it(db->newIterator());
+    for (it->seek(freeListStartKey); it->isValid() && compareKeys(it->key(), freeListStopKey) < 0; it->next()) {
+        const char *p = it->key().begin();
+        const char *limit = it->key().end();
+
+        DatabaseFreeListKey freeListKey;
+        p = DatabaseFreeListKey::decode(p, limit, &freeListKey);
+        ASSERT(p);
+
+        bool ok = db->remove(it->key());
+        ASSERT_UNUSED(ok, ok);
+
+        return freeListKey.databaseId();
+    }
+
+    // If we got here, there was no free-list.
+    int64_t maxDatabaseId = -1;
+    if (!getInt(db, MaxDatabaseIdKey::encode(), maxDatabaseId))
+        maxDatabaseId = 0;
+
+    ASSERT(maxDatabaseId >= 0);
+
+    int64_t databaseId = maxDatabaseId + 1;
+    bool ok = putInt(db, MaxDatabaseIdKey::encode(), databaseId);
+    ASSERT_UNUSED(ok, ok);
+
+    return databaseId;
+
+}
+
+bool IDBLevelDBBackingStore::setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId)
+{
+    if (invalidRowId) {
+        rowId = getNewDatabaseId(m_db.get());
+
+        const Vector<char> key = DatabaseNameKey::encode(m_identifier, name);
+        if (!putInt(m_db.get(), key, rowId))
+            return false;
+    }
+
+    if (!putString(m_db.get(), DatabaseMetaDataKey::encode(rowId, DatabaseMetaDataKey::kUserVersion), version))
+        return false;
+
+    return true;
+}
+
+void IDBLevelDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags)
+{
+    const Vector<char> startKey = ObjectStoreMetaDataKey::encode(databaseId, 1, 0);
+    const Vector<char> stopKey = ObjectStoreMetaDataKey::encode(databaseId, INT64_MAX, 0);
+
+    OwnPtr<LevelDBIterator> it(m_db->newIterator());
+    for (it->seek(startKey); it->isValid() && compareKeys(it->key(), stopKey) < 0; it->next()) {
+        const char *p = it->key().begin();
+        const char *limit = it->key().end();
+
+        ObjectStoreMetaDataKey metaDataKey;
+        p = ObjectStoreMetaDataKey::decode(p, limit, &metaDataKey);
+        ASSERT(p);
+
+        int64_t objectStoreId = metaDataKey.objectStoreId();
+
+        String objectStoreName = decodeString(it->value().begin(), it->value().end());
+
+        it->next();
+        if (!it->isValid()) {
+            LOG_ERROR("Internal Indexed DB error.");
+            return;
+        }
+        String keyPath = decodeString(it->value().begin(), it->value().end());
+
+        it->next();
+        if (!it->isValid()) {
+            LOG_ERROR("Internal Indexed DB error.");
+            return;
+        }
+        bool autoIncrement = *it->value().begin();
+
+        it->next(); // Is evicatble.
+        if (!it->isValid()) {
+            LOG_ERROR("Internal Indexed DB error.");
+            return;
+        }
+
+        it->next(); // Last version.
+        if (!it->isValid()) {
+            LOG_ERROR("Internal Indexed DB error.");
+            return;
+        }
+
+        it->next(); // Maxium index id allocated.
+        if (!it->isValid()) {
+            LOG_ERROR("Internal Indexed DB error.");
+            return;
+        }
+
+        foundIds.append(objectStoreId);
+        foundNames.append(objectStoreName);
+        foundKeyPaths.append(keyPath);
+        foundAutoIncrementFlags.append(autoIncrement);
+    }
+}
+
+static int64_t getNewObjectStoreId(LevelDBDatabase* db, int64_t databaseId)
+{
+    const Vector<char> freeListStartKey = ObjectStoreFreeListKey::encode(databaseId, 0);
+    const Vector<char> freeListStopKey = ObjectStoreFreeListKey::encode(databaseId, INT64_MAX);
+
+    OwnPtr<LevelDBIterator> it(db->newIterator());
+    for (it->seek(freeListStartKey); it->isValid() && compareKeys(it->key(), freeListStopKey) < 0; it->next()) {
+        const char* p = it->key().begin();
+        const char* limit = it->key().end();
+
+        ObjectStoreFreeListKey freeListKey;
+        p = ObjectStoreFreeListKey::decode(p, limit, &freeListKey);
+        ASSERT(p);
+
+        bool ok = db->remove(it->key());
+        ASSERT_UNUSED(ok, ok);
+
+        return freeListKey.objectStoreId();
+    }
+
+    int64_t maxObjectStoreId;
+    const Vector<char> maxObjectStoreIdKey = DatabaseMetaDataKey::encode(databaseId, DatabaseMetaDataKey::kMaxObjectStoreId);
+    if (!getInt(db, maxObjectStoreIdKey, maxObjectStoreId))
+        maxObjectStoreId = 0;
+
+    int64_t objectStoreId = maxObjectStoreId + 1;
+    bool ok = putInt(db, maxObjectStoreIdKey, objectStoreId);
+    ASSERT_UNUSED(ok, ok);
+
+    return objectStoreId;
+}
+
+bool IDBLevelDBBackingStore::createObjectStore(int64_t databaseId, const String& name, const String& keyPath, bool autoIncrement, int64_t& assignedObjectStoreId)
+{
+    int64_t objectStoreId = getNewObjectStoreId(m_db.get(), databaseId);
+
+    const Vector<char> nameKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 0);
+    const Vector<char> keyPathKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 1);
+    const Vector<char> autoIncrementKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 2);
+    const Vector<char> evictableKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 3);
+    const Vector<char> lastVersionKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 4);
+    const Vector<char> maxIndexIdKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 5);
+    const Vector<char> namesKey = ObjectStoreNamesKey::encode(databaseId, name);
+
+    bool ok = putString(m_db.get(), nameKey, name);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    ok = putString(m_db.get(), keyPathKey, keyPath);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    ok = putInt(m_db.get(), autoIncrementKey, autoIncrement);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    ok = putInt(m_db.get(), evictableKey, false);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    ok = putInt(m_db.get(), lastVersionKey, 1);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    ok = putInt(m_db.get(), maxIndexIdKey, kMinimumIndexId);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    ok = putInt(m_db.get(), namesKey, objectStoreId);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    assignedObjectStoreId = objectStoreId;
+
+    return true;
+}
+
+static bool deleteRange(LevelDBDatabase* db, const Vector<char>& begin, const Vector<char>& end)
+{
+    // FIXME: LevelDB may be able to provide a bulk operation that we can do first.
+    OwnPtr<LevelDBIterator> it(db->newIterator());
+    for (it->seek(begin); it->isValid() && compareKeys(it->key(), end) < 0; it->next()) {
+        if (!db->remove(it->key()))
+            return false;
+    }
+
+    return true;
+}
+
+void IDBLevelDBBackingStore::deleteObjectStore(int64_t databaseId, int64_t objectStoreId)
+{
+    String objectStoreName;
+    getString(m_db.get(), ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 0), objectStoreName);
+
+    if (!deleteRange(m_db.get(), ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 0), ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 6)))
+        return; // FIXME: Report error.
+
+    putString(m_db.get(), ObjectStoreFreeListKey::encode(databaseId, objectStoreId), "");
+    m_db->remove(ObjectStoreNamesKey::encode(databaseId, objectStoreName));
+
+    if (!deleteRange(m_db.get(), IndexFreeListKey::encode(databaseId, objectStoreId, 0), IndexFreeListKey::encode(databaseId, objectStoreId, INT64_MAX)))
+        return; // FIXME: Report error.
+    if (!deleteRange(m_db.get(), IndexMetaDataKey::encode(databaseId, objectStoreId, 0, 0), IndexMetaDataKey::encode(databaseId, objectStoreId, INT64_MAX, 0)))
+        return; // FIXME: Report error.
+
+    clearObjectStore(databaseId, objectStoreId);
+}
+
+String IDBLevelDBBackingStore::getObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey& key)
+{
+    const Vector<char> leveldbKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, key);
+    Vector<char> data;
+
+    if (!m_db->get(leveldbKey, data))
+        return String();
+
+    int64_t version;
+    const char* p = decodeVarInt(data.begin(), data.end(), version);
+    if (!p)
+        return String();
+    (void) version;
+
+    return decodeString(p, data.end());
+}
+
+namespace {
+class LevelDBRecordIdentifier : public IDBBackingStore::ObjectStoreRecordIdentifier {
+public:
+    static PassRefPtr<LevelDBRecordIdentifier> create(const Vector<char>& primaryKey, int64_t version) { return adoptRef(new LevelDBRecordIdentifier(primaryKey, version)); }
+    static PassRefPtr<LevelDBRecordIdentifier> create() { return adoptRef(new LevelDBRecordIdentifier()); }
+
+    virtual bool isValid() const { return m_primaryKey.isEmpty(); }
+    Vector<char> primaryKey() const { return m_primaryKey; }
+    void setPrimaryKey(const Vector<char>& primaryKey) { m_primaryKey = primaryKey; }
+    int64_t version() const { return m_version; }
+    void setVersion(int64_t version) { m_version = version; }
+
+private:
+    LevelDBRecordIdentifier(const Vector<char>& primaryKey, int64_t version) : m_primaryKey(primaryKey), m_version(version) { ASSERT(!primaryKey.isEmpty()); }
+    LevelDBRecordIdentifier() : m_primaryKey(), m_version(-1) {}
+
+    Vector<char> m_primaryKey; // FIXME: Make it more clear that this is the *encoded* version of the key.
+    int64_t m_version;
+};
+}
+
+static int64_t getNewVersionNumber(LevelDBDatabase* db, int64_t databaseId, int64_t objectStoreId)
+{
+    const Vector<char> lastVersionKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 4);
+
+    int64_t lastVersion = -1;
+    if (!getInt(db, lastVersionKey, lastVersion))
+        lastVersion = 0;
+
+    ASSERT(lastVersion >= 0);
+
+    int64_t version = lastVersion + 1;
+    bool ok = putInt(db, lastVersionKey, version);
+    ASSERT_UNUSED(ok, ok);
+
+    ASSERT(version > lastVersion); // FIXME: Think about how we want to handle the overflow scenario.
+
+    return version;
+}
+
+bool IDBLevelDBBackingStore::putObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey& key, const String& value, ObjectStoreRecordIdentifier* recordIdentifier)
+{
+    int64_t version = getNewVersionNumber(m_db.get(), databaseId, objectStoreId);
+    const Vector<char> objectStoredataKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, key);
+
+    Vector<char> v;
+    v.append(encodeVarInt(version));
+    v.append(encodeString(value));
+
+    if (!m_db->put(objectStoredataKey, v))
+        return false;
+
+    const Vector<char> existsEntryKey = ExistsEntryKey::encode(databaseId, objectStoreId, key);
+    if (!m_db->put(existsEntryKey, encodeInt(version)))
+        return false;
+
+    LevelDBRecordIdentifier* levelDBRecordIdentifier = static_cast<LevelDBRecordIdentifier*>(recordIdentifier);
+    levelDBRecordIdentifier->setPrimaryKey(encodeIDBKey(key));
+    levelDBRecordIdentifier->setVersion(version);
+    return true;
+}
+
+void IDBLevelDBBackingStore::clearObjectStore(int64_t databaseId, int64_t objectStoreId)
+{
+    const Vector<char> startKey = KeyPrefix(databaseId, objectStoreId, 0).encode();
+    const Vector<char> stopKey = KeyPrefix(databaseId, objectStoreId + 1, 0).encode();
+
+    deleteRange(m_db.get(), startKey, stopKey);
+}
+
+PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> IDBLevelDBBackingStore::createInvalidRecordIdentifier()
+{
+    return LevelDBRecordIdentifier::create();
+}
+
+void IDBLevelDBBackingStore::deleteObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const ObjectStoreRecordIdentifier* recordIdentifier)
+{
+    const LevelDBRecordIdentifier* levelDBRecordIdentifier = static_cast<const LevelDBRecordIdentifier*>(recordIdentifier);
+    const Vector<char> key = ObjectStoreDataKey::encode(databaseId, objectStoreId, levelDBRecordIdentifier->primaryKey());
+    m_db->remove(key);
+}
+
+double IDBLevelDBBackingStore::nextAutoIncrementNumber(int64_t databaseId, int64_t objectStoreId)
+{
+    const Vector<char> startKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, minIDBKey());
+    const Vector<char> stopKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, maxIDBKey());
+
+    OwnPtr<LevelDBIterator> it(m_db->newIterator());
+
+    int maxNumericKey = 0;
+
+    // FIXME: Be more efficient: seek to something after the object store data, then reverse.
+
+    for (it->seek(startKey); it->isValid() && compareKeys(it->key(), stopKey) < 0; it->next()) {
+        const char *p = it->key().begin();
+        const char *limit = it->key().end();
+
+        ObjectStoreDataKey dataKey;
+        p = ObjectStoreDataKey::decode(p, limit, &dataKey);
+        ASSERT(p);
+
+        if (dataKey.userKey()->type() == IDBKey::NumberType) {
+            int64_t n = static_cast<int64_t>(dataKey.userKey()->number());
+            if (n > maxNumericKey)
+                maxNumericKey = n;
+        }
+    }
+
+    return maxNumericKey + 1;
+}
+
+bool IDBLevelDBBackingStore::keyExistsInObjectStore(int64_t databaseId, int64_t objectStoreId, const IDBKey& key, ObjectStoreRecordIdentifier* foundRecordIdentifier)
+{
+    const Vector<char> leveldbKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, key);
+    Vector<char> data;
+
+    if (!m_db->get(leveldbKey, data))
+        return false;
+
+    int64_t version;
+    if (!decodeVarInt(data.begin(), data.end(), version))
+        return false;
+
+    LevelDBRecordIdentifier* levelDBRecordIdentifier = static_cast<LevelDBRecordIdentifier*>(foundRecordIdentifier);
+    levelDBRecordIdentifier->setPrimaryKey(encodeIDBKey(key));
+    levelDBRecordIdentifier->setVersion(version);
+    return true;
+}
+
+bool IDBLevelDBBackingStore::forEachObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, ObjectStoreRecordCallback& callback)
+{
+    const Vector<char> startKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, minIDBKey());
+    const Vector<char> stopKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, maxIDBKey());
+
+    OwnPtr<LevelDBIterator> it(m_db->newIterator());
+    for (it->seek(startKey); it->isValid() && compareKeys(it->key(), stopKey) < 0; it->next()) {
+        const char *p = it->key().begin();
+        const char *limit = it->key().end();
+        ObjectStoreDataKey dataKey;
+        p = ObjectStoreDataKey::decode(p, limit, &dataKey);
+        ASSERT(p);
+
+        RefPtr<IDBKey> primaryKey = dataKey.userKey();
+
+        int64_t version;
+        const char* q = decodeVarInt(it->value().begin(), it->value().end(), version);
+        if (!q)
+            return false;
+
+        RefPtr<LevelDBRecordIdentifier> ri = LevelDBRecordIdentifier::create(encodeIDBKey(*primaryKey), version);
+        String idbValue = decodeString(q, it->value().end());
+
+        callback.callback(ri.get(), idbValue);
+    }
+
+    return true;
+}
+
+void IDBLevelDBBackingStore::getIndexes(int64_t databaseId, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags)
+{
+    const Vector<char> startKey = IndexMetaDataKey::encode(databaseId, objectStoreId, 0, 0);
+    const Vector<char> stopKey = IndexMetaDataKey::encode(databaseId, objectStoreId + 1, 0, 0);
+
+    OwnPtr<LevelDBIterator> it(m_db->newIterator());
+    for (it->seek(startKey); it->isValid() && compareKeys(it->key(), stopKey) < 0; it->next()) {
+        const char* p = it->key().begin();
+        const char* limit = it->key().end();
+
+        IndexMetaDataKey metaDataKey;
+        p = IndexMetaDataKey::decode(p, limit, &metaDataKey);
+        ASSERT(p);
+
+        int64_t indexId = metaDataKey.indexId();
+        ASSERT(!metaDataKey.metaDataType());
+
+        String indexName = decodeString(it->value().begin(), it->value().end());
+        it->next();
+        if (!it->isValid()) {
+            LOG_ERROR("Internal Indexed DB error.");
+            return;
+        }
+
+        bool indexUnique = *it->value().begin();
+        it->next();
+        if (!it->isValid()) {
+            LOG_ERROR("Internal Indexed DB error.");
+            return;
+        }
+
+        String keyPath = decodeString(it->value().begin(), it->value().end());
+
+        foundIds.append(indexId);
+        foundNames.append(indexName);
+        foundKeyPaths.append(keyPath);
+        foundUniqueFlags.append(indexUnique);
+    }
+}
+
+static int64_t getNewIndexId(LevelDBDatabase* db, int64_t databaseId, int64_t objectStoreId)
+{
+    const Vector<char> startKey = IndexFreeListKey::encode(databaseId, objectStoreId, 0);
+    const Vector<char> stopKey = IndexFreeListKey::encode(databaseId, objectStoreId, INT64_MAX);
+
+    OwnPtr<LevelDBIterator> it(db->newIterator());
+    for (it->seek(startKey); it->isValid() && compareKeys(it->key(), stopKey) < 0; it->next()) {
+        const char* p = it->key().begin();
+        const char* limit = it->key().end();
+
+        IndexFreeListKey freeListKey;
+        p = IndexFreeListKey::decode(p, limit, &freeListKey);
+        ASSERT(p);
+
+        bool ok = db->remove(it->key());
+        ASSERT_UNUSED(ok, ok);
+
+        ASSERT(freeListKey.indexId() >= kMinimumIndexId);
+        return freeListKey.indexId();
+    }
+
+    int64_t maxIndexId;
+    const Vector<char> maxIndexIdKey = ObjectStoreMetaDataKey::encode(databaseId, objectStoreId, 5);
+    if (!getInt(db, maxIndexIdKey, maxIndexId))
+        maxIndexId = kMinimumIndexId;
+
+    int64_t indexId = maxIndexId + 1;
+    bool ok = putInt(db, maxIndexIdKey, indexId);
+    if (!ok)
+        return false;
+
+    return indexId;
+}
+
+bool IDBLevelDBBackingStore::createIndex(int64_t databaseId, int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId)
+{
+    indexId = getNewIndexId(m_db.get(), databaseId, objectStoreId);
+
+    const Vector<char> nameKey = IndexMetaDataKey::encode(databaseId, objectStoreId, indexId, 0);
+    const Vector<char> uniqueKey = IndexMetaDataKey::encode(databaseId, objectStoreId, indexId, 1);
+    const Vector<char> keyPathKey = IndexMetaDataKey::encode(databaseId, objectStoreId, indexId, 2);
+
+    bool ok = putString(m_db.get(), nameKey, name);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    ok = putInt(m_db.get(), uniqueKey, isUnique);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    ok = putString(m_db.get(), keyPathKey, keyPath);
+    if (!ok) {
+        LOG_ERROR("Internal Indexed DB error.");
+        return false;
+    }
+
+    return true;
+}
+
+void IDBLevelDBBackingStore::deleteIndex(int64_t, int64_t, int64_t)
+{
+    ASSERT_NOT_REACHED(); // FIXME: Implement and add layout test.
+    return;
+}
+
+bool IDBLevelDBBackingStore::putIndexDataForRecord(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey& key, const ObjectStoreRecordIdentifier* recordIdentifier)
+{
+    ASSERT(indexId >= kMinimumIndexId);
+    const LevelDBRecordIdentifier* levelDBRecordIdentifier = static_cast<const LevelDBRecordIdentifier*>(recordIdentifier);
+
+    const int64_t globalSequenceNumber = getNewVersionNumber(m_db.get(), databaseId, objectStoreId);
+    const Vector<char> indexDataKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, key, globalSequenceNumber);
+
+    Vector<char> data;
+    data.append(encodeVarInt(levelDBRecordIdentifier->version()));
+    data.append(levelDBRecordIdentifier->primaryKey());
+
+    return m_db->put(indexDataKey, data);
+}
+
+static bool findGreatestKeyLessThan(LevelDBDatabase* db, const Vector<char>& target, Vector<char>& foundKey)
+{
+    OwnPtr<LevelDBIterator> it(db->newIterator());
+    it->seek(target);
+
+    if (!it->isValid()) {
+        it->seekToLast();
+        if (!it->isValid())
+            return false;
+    }
+
+    while (compareIndexKeys(it->key(), target) >= 0) {
+        it->prev();
+        if (!it->isValid())
+            return false;
+    }
+
+    foundKey.clear();
+    foundKey.append(it->key().begin(), it->key().end() - it->key().begin());
+    return true;
+}
+
+bool IDBLevelDBBackingStore::deleteIndexDataForRecord(int64_t, int64_t, int64_t, const ObjectStoreRecordIdentifier*)
+{
+    // FIXME: This isn't needed since we invalidate index data via the version number mechanism.
+    return true;
+}
+
+String IDBLevelDBBackingStore::getObjectViaIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey& key)
+{
+    RefPtr<IDBKey> primaryKey = getPrimaryKeyViaIndex(databaseId, objectStoreId, indexId, key);
+    if (!primaryKey)
+        return String();
+
+    return getObjectStoreRecord(databaseId, objectStoreId, *primaryKey);
+}
+
+static bool versionExists(LevelDBDatabase* db, int64_t databaseId, int64_t objectStoreId, int64_t version, const Vector<char>& encodedPrimaryKey)
+{
+    const Vector<char> key = ExistsEntryKey::encode(databaseId, objectStoreId, encodedPrimaryKey);
+    Vector<char> data;
+
+    if (!db->get(key, data))
+        return false;
+
+    return decodeInt(data.begin(), data.end()) == version;
+}
+
+PassRefPtr<IDBKey> IDBLevelDBBackingStore::getPrimaryKeyViaIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey& key)
+{
+    const Vector<char> leveldbKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, key, 0);
+    OwnPtr<LevelDBIterator> it(m_db->newIterator());
+    it->seek(leveldbKey);
+
+    for (;;) {
+        if (!it->isValid())
+            return 0;
+        if (compareIndexKeys(it->key(), leveldbKey) > 0)
+            return 0;
+
+        int64_t version;
+        const char* p = decodeVarInt(it->value().begin(), it->value().end(), version);
+        if (!p)
+            return 0;
+        Vector<char> encodedPrimaryKey;
+        encodedPrimaryKey.append(p, it->value().end() - p);
+
+        if (!versionExists(m_db.get(), databaseId, objectStoreId, version, encodedPrimaryKey)) {
+            // Delete stale index data entry and continue.
+            m_db->remove(it->key());
+            it->next();
+            continue;
+        }
+
+        RefPtr<IDBKey> primaryKey;
+        decodeIDBKey(encodedPrimaryKey.begin(), encodedPrimaryKey.end(), primaryKey);
+        return primaryKey.release();
+    }
+}
+
+bool IDBLevelDBBackingStore::keyExistsInIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey& key)
+{
+    const Vector<char> levelDBKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, key, 0);
+    OwnPtr<LevelDBIterator> it(m_db->newIterator());
+
+    bool found = false;
+
+    it->seek(levelDBKey);
+    if (it->isValid() && !compareIndexKeys(it->key(), levelDBKey))
+        found = true;
+
+    return found;
+}
+
+namespace {
+class CursorImplCommon : public IDBBackingStore::Cursor {
+public:
+    // IDBBackingStore::Cursor
+    virtual bool continueFunction(const IDBKey*);
+    virtual PassRefPtr<IDBKey> key() { return m_currentKey; }
+    virtual PassRefPtr<IDBKey> primaryKey() { return m_currentKey; }
+    virtual String value() = 0;
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() = 0; // FIXME: I don't think this is actually used, so drop it.
+    virtual int64_t indexDataId() = 0;
+
+    virtual bool loadCurrentRow() = 0;
+    bool firstSeek();
+
+protected:
+    CursorImplCommon(LevelDBDatabase* db, const Vector<char>& lowKey, bool lowOpen, const Vector<char>& highKey, bool highOpen, bool forward)
+        : m_db(db)
+        , m_lowKey(lowKey)
+        , m_lowOpen(lowOpen)
+        , m_highKey(highKey)
+        , m_highOpen(highOpen)
+        , m_forward(forward)
+    {
+    }
+    virtual ~CursorImplCommon() {}
+
+    LevelDBDatabase* m_db;
+    OwnPtr<LevelDBIterator> m_iterator;
+    Vector<char> m_lowKey;
+    bool m_lowOpen;
+    Vector<char> m_highKey;
+    bool m_highOpen;
+    bool m_forward;
+    RefPtr<IDBKey> m_currentKey;
+};
+
+bool CursorImplCommon::firstSeek()
+{
+    m_iterator = m_db->newIterator();
+
+    if (m_forward)
+        m_iterator->seek(m_lowKey);
+    else
+        m_iterator->seek(m_highKey);
+
+    for (;;) {
+        if (!m_iterator->isValid())
+            return false;
+
+        if (m_forward && m_highOpen && compareIndexKeys(m_iterator->key(), m_highKey) >= 0)
+            return false;
+        if (m_forward && !m_highOpen && compareIndexKeys(m_iterator->key(), m_highKey) > 0)
+            return false;
+        if (!m_forward && m_lowOpen && compareIndexKeys(m_iterator->key(), m_lowKey) <= 0)
+            return false;
+        if (!m_forward && !m_lowOpen && compareIndexKeys(m_iterator->key(), m_lowKey) < 0)
+            return false;
+
+        if (m_forward && m_lowOpen) {
+            // lowKey not included in the range.
+            if (compareIndexKeys(m_iterator->key(), m_lowKey) <= 0) {
+                m_iterator->next();
+                continue;
+            }
+        }
+        if (!m_forward && m_highOpen) {
+            // highKey not included in the range.
+            if (compareIndexKeys(m_iterator->key(), m_highKey) >= 0) {
+                m_iterator->prev();
+                continue;
+            }
+        }
+
+        if (!loadCurrentRow()) {
+            if (m_forward)
+                m_iterator->next();
+            else
+                m_iterator->prev();
+            continue;
+        }
+
+        return true;
+    }
+}
+
+bool CursorImplCommon::continueFunction(const IDBKey* key)
+{
+    // FIXME: This shares a lot of code with firstSeek.
+
+    for (;;) {
+        if (m_forward)
+            m_iterator->next();
+        else
+            m_iterator->prev();
+
+        if (!m_iterator->isValid())
+            return false;
+
+        Vector<char> trash;
+        if (!m_db->get(m_iterator->key(), trash))
+             continue;
+
+        if (m_forward && m_highOpen && compareIndexKeys(m_iterator->key(), m_highKey) >= 0) // high key not included in range
+            return false;
+        if (m_forward && !m_highOpen && compareIndexKeys(m_iterator->key(), m_highKey) > 0)
+            return false;
+        if (!m_forward && m_lowOpen && compareIndexKeys(m_iterator->key(), m_lowKey) <= 0) // low key not included in range
+            return false;
+        if (!m_forward && !m_lowOpen && compareIndexKeys(m_iterator->key(), m_lowKey) < 0)
+            return false;
+
+        if (!loadCurrentRow())
+            continue;
+
+        if (key) {
+            if (m_forward) {
+                if (m_currentKey->isLessThan(key))
+                    continue;
+            } else {
+                if (key->isLessThan(m_currentKey.get()))
+                    continue;
+            }
+        }
+
+        // FIXME: Obey the uniqueness constraint (and test for it!)
+
+        break;
+    }
+
+    return true;
+}
+
+class ObjectStoreCursorImpl : public CursorImplCommon {
+public:
+    static PassRefPtr<ObjectStoreCursorImpl> create(LevelDBDatabase* db, const Vector<char>& lowKey, bool lowOpen, const Vector<char>& highKey, bool highOpen, bool forward)
+    {
+        return adoptRef(new ObjectStoreCursorImpl(db, lowKey, lowOpen, highKey, highOpen, forward));
+    }
+
+    // CursorImplCommon
+    virtual String value() { return m_currentValue; }
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() { ASSERT_NOT_REACHED(); return 0; }
+    virtual int64_t indexDataId() { ASSERT_NOT_REACHED(); return 0; }
+    virtual bool loadCurrentRow();
+
+private:
+    ObjectStoreCursorImpl(LevelDBDatabase* db, const Vector<char>& lowKey, bool lowOpen, const Vector<char>& highKey, bool highOpen, bool forward)
+        : CursorImplCommon(db, lowKey, lowOpen, highKey, highOpen, forward)
+    {
+    }
+
+    String m_currentValue;
+};
+
+bool ObjectStoreCursorImpl::loadCurrentRow()
+{
+    const char* p = m_iterator->key().begin();
+    const char* keyLimit = m_iterator->key().end();
+
+    ObjectStoreDataKey objectStoreDataKey;
+    p = ObjectStoreDataKey::decode(p, keyLimit, &objectStoreDataKey);
+    ASSERT(p);
+    if (!p)
+        return false;
+
+    m_currentKey = objectStoreDataKey.userKey();
+
+    int64_t version;
+    const char* q = decodeVarInt(m_iterator->value().begin(), m_iterator->value().end(), version);
+    ASSERT(q);
+    if (!q)
+        return false;
+    (void) version;
+
+    m_currentValue = decodeString(q, m_iterator->value().end());
+
+    return true;
+}
+
+class IndexKeyCursorImpl : public CursorImplCommon {
+public:
+    static PassRefPtr<IndexKeyCursorImpl> create(LevelDBDatabase* db, const Vector<char>& lowKey, bool lowOpen, const Vector<char>& highKey, bool highOpen, bool forward)
+    {
+        return adoptRef(new IndexKeyCursorImpl(db, lowKey, lowOpen, highKey, highOpen, forward));
+    }
+
+    // CursorImplCommon
+    virtual String value() { ASSERT_NOT_REACHED(); return String(); }
+    virtual PassRefPtr<IDBKey> primaryKey() { return m_primaryKey; }
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() { ASSERT_NOT_REACHED(); return 0; }
+    virtual int64_t indexDataId() { ASSERT_NOT_REACHED(); return 0; }
+    virtual bool loadCurrentRow();
+
+private:
+    IndexKeyCursorImpl(LevelDBDatabase* db, const Vector<char>& lowKey, bool lowOpen, const Vector<char>& highKey, bool highOpen, bool forward)
+        : CursorImplCommon(db, lowKey, lowOpen, highKey, highOpen, forward)
+    {
+    }
+
+    RefPtr<IDBKey> m_primaryKey;
+};
+
+bool IndexKeyCursorImpl::loadCurrentRow()
+{
+    const char* p = m_iterator->key().begin();
+    const char* keyLimit = m_iterator->key().end();
+    IndexDataKey indexDataKey;
+    p = IndexDataKey::decode(p, keyLimit, &indexDataKey);
+
+    m_currentKey = indexDataKey.userKey();
+
+    int64_t indexDataVersion;
+    const char* q = decodeVarInt(m_iterator->value().begin(), m_iterator->value().end(), indexDataVersion);
+    ASSERT(q);
+    if (!q)
+        return false;
+
+    q = decodeIDBKey(q, m_iterator->value().end(), m_primaryKey);
+    ASSERT(q);
+    if (!q)
+        return false;
+
+    Vector<char> primaryLevelDBKey = ObjectStoreDataKey::encode(indexDataKey.databaseId(), indexDataKey.objectStoreId(), *m_primaryKey);
+
+    Vector<char> result;
+    if (!m_db->get(primaryLevelDBKey, result))
+        return false;
+
+    int64_t objectStoreDataVersion;
+    const char* t = decodeVarInt(result.begin(), result.end(), objectStoreDataVersion);
+    ASSERT(t);
+    if (!t)
+        return false;
+
+    if (objectStoreDataVersion != indexDataVersion) { // FIXME: This is probably not very well covered by the layout tests.
+        m_db->remove(m_iterator->key());
+        return false;
+    }
+
+    return true;
+}
+
+class IndexCursorImpl : public CursorImplCommon {
+public:
+    static PassRefPtr<IndexCursorImpl> create(LevelDBDatabase* db, const Vector<char>& lowKey, bool lowOpen, const Vector<char>& highKey, bool highOpen, bool forward)
+    {
+        return adoptRef(new IndexCursorImpl(db, lowKey, lowOpen, highKey, highOpen, forward));
+    }
+
+    // CursorImplCommon
+    virtual String value() { return m_value; }
+    virtual PassRefPtr<IDBKey> primaryKey() { return m_primaryKey; }
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() { ASSERT_NOT_REACHED(); return 0; }
+    virtual int64_t indexDataId() { ASSERT_NOT_REACHED(); return 0; }
+    bool loadCurrentRow();
+
+private:
+    IndexCursorImpl(LevelDBDatabase* db, const Vector<char>& lowKey, bool lowOpen, const Vector<char>& highKey, bool highOpen, bool forward)
+        : CursorImplCommon(db, lowKey, lowOpen, highKey, highOpen, forward)
+    {
+    }
+
+    RefPtr<IDBKey> m_primaryKey;
+    String m_value;
+    Vector<char> m_primaryLevelDBKey;
+};
+
+bool IndexCursorImpl::loadCurrentRow()
+{
+    const char *p = m_iterator->key().begin();
+    const char *limit = m_iterator->key().end();
+
+    IndexDataKey indexDataKey;
+    p = IndexDataKey::decode(p, limit, &indexDataKey);
+
+    m_currentKey = indexDataKey.userKey();
+
+    const char *q = m_iterator->value().begin();
+    const char *valueLimit = m_iterator->value().end();
+
+    int64_t indexDataVersion;
+    q = decodeVarInt(q, valueLimit, indexDataVersion);
+    ASSERT(q);
+    if (!q)
+        return false;
+    q = decodeIDBKey(q, valueLimit, m_primaryKey);
+    ASSERT(q);
+    if (!q)
+        return false;
+
+    m_primaryLevelDBKey = ObjectStoreDataKey::encode(indexDataKey.databaseId(), indexDataKey.objectStoreId(), *m_primaryKey);
+
+    Vector<char> result;
+    if (!m_db->get(m_primaryLevelDBKey, result))
+        return false;
+
+    int64_t objectStoreDataVersion;
+    const char* t = decodeVarInt(result.begin(), result.end(), objectStoreDataVersion);
+    ASSERT(t);
+    if (!t)
+        return false;
+
+    if (objectStoreDataVersion != indexDataVersion) {
+        m_db->remove(m_iterator->key());
+        return false;
+    }
+
+    m_value = decodeString(t, result.end());
+    return true;
+}
+
+}
+
+static bool findLastIndexKeyEqualTo(LevelDBDatabase* db, const Vector<char>& target, Vector<char>& foundKey)
+{
+    OwnPtr<LevelDBIterator> it(db->newIterator());
+    it->seek(target);
+
+    if (!it->isValid())
+        return false;
+
+    while (it->isValid() && !compareIndexKeys(it->key(), target)) {
+        foundKey.clear();
+        foundKey.append(it->key().begin(), it->key().end() - it->key().begin());
+        it->next();
+    }
+
+    return true;
+}
+
+PassRefPtr<IDBBackingStore::Cursor> IDBLevelDBBackingStore::openObjectStoreCursor(int64_t databaseId, int64_t objectStoreId, const IDBKeyRange* range, IDBCursor::Direction direction)
+{
+    bool lowerBound = range && range->lower();
+    bool upperBound = range && range->upper();
+    bool forward = (direction == IDBCursor::NEXT_NO_DUPLICATE || direction == IDBCursor::NEXT);
+
+    bool lowerOpen, upperOpen;
+    Vector<char> startKey, stopKey;
+
+    if (!lowerBound) {
+        startKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, minIDBKey());
+        lowerOpen = true; // Not included.
+    } else {
+        startKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, *range->lower());
+        lowerOpen = range->lowerOpen();
+    }
+
+    if (!upperBound) {
+        stopKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, maxIDBKey());
+        upperOpen = true; // Not included.
+
+        if (!forward) { // We need a key that exists.
+            if (!findGreatestKeyLessThan(m_db.get(), stopKey, stopKey))
+                return 0;
+            upperOpen = false;
+        }
+    } else {
+        stopKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, *range->upper());
+        upperOpen = range->upperOpen();
+    }
+
+    RefPtr<ObjectStoreCursorImpl> cursor = ObjectStoreCursorImpl::create(m_db.get(), startKey, lowerOpen, stopKey, upperOpen, forward);
+    if (!cursor->firstSeek())
+        return 0;
+
+    return cursor.release();
+}
+
+PassRefPtr<IDBBackingStore::Cursor> IDBLevelDBBackingStore::openIndexKeyCursor(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
+{
+    bool lowerBound = range && range->lower();
+    bool upperBound = range && range->upper();
+    bool forward = (direction == IDBCursor::NEXT_NO_DUPLICATE || direction == IDBCursor::NEXT);
+
+    bool lowerOpen, upperOpen;
+    Vector<char> startKey, stopKey;
+
+    if (!lowerBound) {
+        startKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, minIDBKey(), 0);
+        lowerOpen = false; // Included.
+    } else {
+        startKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, *range->lower(), 0);
+        lowerOpen = range->lowerOpen();
+    }
+
+    if (!upperBound) {
+        stopKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, maxIDBKey(), 0);
+        upperOpen = false; // Included.
+
+        if (!forward) { // We need a key that exists.
+            if (!findGreatestKeyLessThan(m_db.get(), stopKey, stopKey))
+                return 0;
+            upperOpen = false;
+        }
+    } else {
+        stopKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, *range->upper(), 0);
+        if (!findLastIndexKeyEqualTo(m_db.get(), stopKey, stopKey)) // Seek to the *last* key in the set of non-unique keys.
+            return 0;
+        upperOpen = range->upperOpen();
+    }
+
+    RefPtr<IndexKeyCursorImpl> cursor = IndexKeyCursorImpl::create(m_db.get(), startKey, lowerOpen, stopKey, upperOpen, forward);
+    if (!cursor->firstSeek())
+        return 0;
+
+    return cursor.release();
+}
+
+PassRefPtr<IDBBackingStore::Cursor> IDBLevelDBBackingStore::openIndexCursor(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
+{
+    bool lowerBound = range && range->lower();
+    bool upperBound = range && range->upper();
+    bool forward = (direction == IDBCursor::NEXT_NO_DUPLICATE || direction == IDBCursor::NEXT);
+
+    bool lowerOpen, upperOpen;
+    Vector<char> startKey, stopKey;
+
+    if (!lowerBound) {
+        startKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, minIDBKey(), 0);
+        lowerOpen = false; // Included.
+    } else {
+        startKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, *range->lower(), 0);
+        lowerOpen = range->lowerOpen();
+    }
+
+    if (!upperBound) {
+        stopKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, maxIDBKey(), 0);
+        upperOpen = false; // Included.
+
+        if (!forward) { // We need a key that exists.
+            if (!findGreatestKeyLessThan(m_db.get(), stopKey, stopKey))
+                return 0;
+            upperOpen = false;
+        }
+    } else {
+        stopKey = IndexDataKey::encode(databaseId, objectStoreId, indexId, *range->upper(), 0);
+        if (!findLastIndexKeyEqualTo(m_db.get(), stopKey, stopKey)) // Seek to the *last* key in the set of non-unique keys.
+            return 0;
+        upperOpen = range->upperOpen();
+    }
+
+    RefPtr<IndexCursorImpl> cursor = IndexCursorImpl::create(m_db.get(), startKey, lowerOpen, stopKey, upperOpen, forward);
+    if (!cursor->firstSeek())
+        return 0;
+
+    return cursor.release();
+}
+
+namespace {
+class DummyTransaction : public IDBBackingStore::Transaction {
+public:
+    virtual void begin() {}
+    virtual void commit() {}
+    virtual void rollback() {}
+};
+}
+
+PassRefPtr<IDBBackingStore::Transaction> IDBLevelDBBackingStore::createTransaction()
+{
+    // FIXME: We need to implement a transaction abstraction that allows for roll-backs, and write tests for it.
+    return adoptRef(new DummyTransaction());
+}
+
+// FIXME: deleteDatabase should be part of IDBBackingStore.
+
+} // namespace WebCore
+
+#endif // ENABLE(LEVELDB)
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/storage/IDBLevelDBBackingStore.h b/Source/WebCore/storage/IDBLevelDBBackingStore.h
new file mode 100644
index 0000000..a8647da
--- /dev/null
+++ b/Source/WebCore/storage/IDBLevelDBBackingStore.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBLevelDBBackingStore_h
+#define IDBLevelDBBackingStore_h
+
+#if ENABLE(INDEXED_DATABASE)
+#if ENABLE(LEVELDB)
+
+#include "IDBBackingStore.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+class LevelDBComparator;
+class LevelDBDatabase;
+
+class IDBLevelDBBackingStore : public IDBBackingStore {
+public:
+    static PassRefPtr<IDBBackingStore> open(SecurityOrigin*, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl*);
+    virtual ~IDBLevelDBBackingStore();
+
+    virtual bool extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId);
+    virtual bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId);
+
+    virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags);
+    virtual bool createObjectStore(int64_t databaseId, const String& name, const String& keyPath, bool autoIncrement, int64_t& assignedObjectStoreId);
+    virtual void deleteObjectStore(int64_t databaseId, int64_t objectStoreId);
+    virtual PassRefPtr<ObjectStoreRecordIdentifier> createInvalidRecordIdentifier();
+    virtual String getObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey&);
+    virtual bool putObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey&, const String& value, ObjectStoreRecordIdentifier*);
+    virtual void clearObjectStore(int64_t databaseId, int64_t objectStoreId);
+    virtual void deleteObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const ObjectStoreRecordIdentifier*);
+    virtual double nextAutoIncrementNumber(int64_t databaseId, int64_t objectStoreId);
+    virtual bool keyExistsInObjectStore(int64_t databaseId, int64_t objectStoreId, const IDBKey&, ObjectStoreRecordIdentifier* foundRecordIdentifier);
+
+    virtual bool forEachObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, ObjectStoreRecordCallback&);
+
+    virtual void getIndexes(int64_t databaseId, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags);
+    virtual bool createIndex(int64_t databaseId, int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId);
+    virtual void deleteIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId);
+    virtual bool putIndexDataForRecord(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&, const ObjectStoreRecordIdentifier*);
+    virtual bool deleteIndexDataForRecord(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const ObjectStoreRecordIdentifier*);
+    virtual String getObjectViaIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&);
+    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&);
+    virtual bool keyExistsInIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&);
+
+    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t databaseId, int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openIndexCursor(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+
+    virtual PassRefPtr<Transaction> createTransaction();
+
+private:
+    IDBLevelDBBackingStore(String identifier, IDBFactoryBackendImpl*, LevelDBDatabase*);
+
+    String m_identifier;
+    RefPtr<IDBFactoryBackendImpl> m_factory;
+    OwnPtr<LevelDBDatabase> m_db;
+    OwnPtr<LevelDBComparator> m_comparator;
+};
+
+} // namespace WebCore
+
+
+#endif // ENABLE(LEVELDB)
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBLevelDBBackingStore_h
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
index 0433ed7..cb6b0da 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,8 +50,9 @@ IDBObjectStoreBackendImpl::~IDBObjectStoreBackendImpl()
 {
 }
 
-IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(IDBBackingStore* backingStore, int64_t id, const String& name, const String& keyPath, bool autoIncrement)
+IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(IDBBackingStore* backingStore, int64_t databaseId, int64_t id, const String& name, const String& keyPath, bool autoIncrement)
     : m_backingStore(backingStore)
+    , m_databaseId(databaseId)
     , m_id(id)
     , m_name(name)
     , m_keyPath(keyPath)
@@ -61,8 +62,9 @@ IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(IDBBackingStore* backingSto
     loadIndexes();
 }
 
-IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(IDBBackingStore* backingStore, const String& name, const String& keyPath, bool autoIncrement)
+IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(IDBBackingStore* backingStore, int64_t databaseId, const String& name, const String& keyPath, bool autoIncrement)
     : m_backingStore(backingStore)
+    , m_databaseId(databaseId)
     , m_id(InvalidId)
     , m_name(name)
     , m_keyPath(keyPath)
@@ -90,7 +92,7 @@ void IDBObjectStoreBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCal
 
 void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
-    String wireData = objectStore->m_backingStore->getObjectStoreRecord(objectStore->id(), *key);
+    String wireData = objectStore->m_backingStore->getObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), *key);
     if (wireData.isNull()) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
         return;
@@ -227,8 +229,8 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
         indexKeys.append(key.release());
     }
 
-    int64_t dataRowId = InvalidId;
-    bool isExistingValue = objectStore->m_backingStore->keyExistsInObjectStore(objectStore->id(), *key, dataRowId);
+    RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier = objectStore->m_backingStore->createInvalidRecordIdentifier();
+    bool isExistingValue = objectStore->m_backingStore->keyExistsInObjectStore(objectStore->m_databaseId, objectStore->id(), *key, recordIdentifier.get());
 
     if (putMode == AddOnly && isExistingValue) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::CONSTRAINT_ERR, "Key already exists in the object store."));
@@ -237,14 +239,7 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
 
     // Before this point, don't do any mutation.  After this point, rollback the transaction in case of error.
 
-    if (!objectStore->m_backingStore->putObjectStoreRecord(objectStore->id(), *key, value->toWireString(), dataRowId, dataRowId == InvalidId)) {
-        // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
-        transaction->abort();
-        return;
-    }
-
-    if (!objectStore->m_backingStore->deleteIndexDataForRecord(dataRowId)) {
+    if (!objectStore->m_backingStore->putObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), *key, value->toWireString(), recordIdentifier.get())) {
         // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
         transaction->abort();
@@ -255,7 +250,15 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
     for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it, ++i) {
         if (!it->second->hasValidId())
             continue; // The index object has been created, but does not exist in the database yet.
-        if (!objectStore->m_backingStore->putIndexDataForRecord(it->second->id(), *indexKeys[i], dataRowId)) {
+
+        if (!objectStore->m_backingStore->deleteIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), it->second->id(), recordIdentifier.get())) {
+            // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
+            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
+            transaction->abort();
+            return;
+        }
+
+        if (!objectStore->m_backingStore->putIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), it->second->id(), *indexKeys[i], recordIdentifier.get())) {
             // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
             transaction->abort();
@@ -283,13 +286,21 @@ void IDBObjectStoreBackendImpl::deleteFunction(PassRefPtr<IDBKey> prpKey, PassRe
 
 void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
-    int64_t id;
-    if (!objectStore->m_backingStore->keyExistsInObjectStore(objectStore->id(), *key, id)) {
+    RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier = objectStore->m_backingStore->createInvalidRecordIdentifier();
+    if (!objectStore->m_backingStore->keyExistsInObjectStore(objectStore->m_databaseId, objectStore->id(), *key, recordIdentifier.get())) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_FOUND_ERR, "Key does not exist in the object store."));
         return;
     }
 
-    objectStore->m_backingStore->deleteObjectStoreRecord(objectStore->id(), id);
+    for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it) {
+        if (!it->second->hasValidId())
+            continue; // The index object has been created, but does not exist in the database yet.
+
+        if (!objectStore->m_backingStore->deleteIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), it->second->id(), recordIdentifier.get()))
+            ASSERT_NOT_REACHED();
+    }
+
+    objectStore->m_backingStore->deleteObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), recordIdentifier.get());
     callbacks->onSuccess(SerializedScriptValue::nullValue());
 }
 
@@ -309,26 +320,28 @@ void IDBObjectStoreBackendImpl::clear(PassRefPtr<IDBCallbacks> prpCallbacks, IDB
 
 void IDBObjectStoreBackendImpl::clearInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBCallbacks> callbacks)
 {
-    objectStore->m_backingStore->clearObjectStore(objectStore->id());
+    objectStore->m_backingStore->clearObjectStore(objectStore->m_databaseId, objectStore->id());
     callbacks->onSuccess(SerializedScriptValue::undefinedValue());
 }
 
 namespace {
 class PopulateIndexCallback : public IDBBackingStore::ObjectStoreRecordCallback {
 public:
-    PopulateIndexCallback(IDBBackingStore& backingStore, const String& indexKeyPath, int64_t indexId)
+    PopulateIndexCallback(IDBBackingStore& backingStore, const String& indexKeyPath, int64_t databaseId, int64_t objectStoreId, int64_t indexId)
         : m_backingStore(backingStore)
         , m_indexKeyPath(indexKeyPath)
+        , m_databaseId(databaseId)
+        , m_objectStoreId(objectStoreId)
         , m_indexId(indexId)
     {
     }
 
-    virtual bool callback(int64_t objectStoreDataId, const String& value)
+    virtual bool callback(const IDBBackingStore::ObjectStoreRecordIdentifier* recordIdentifier, const String& value)
     {
         RefPtr<SerializedScriptValue> objectValue = SerializedScriptValue::createFromWire(value);
         RefPtr<IDBKey> indexKey = fetchKeyFromKeyPath(objectValue.get(), m_indexKeyPath);
 
-        if (!m_backingStore.putIndexDataForRecord(m_indexId, *indexKey, objectStoreDataId))
+        if (!m_backingStore.putIndexDataForRecord(m_databaseId, m_objectStoreId, m_indexId, *indexKey, recordIdentifier))
             return false;
 
         return true;
@@ -337,14 +350,16 @@ public:
 private:
     IDBBackingStore& m_backingStore;
     const String& m_indexKeyPath;
+    int64_t m_databaseId;
+    int64_t m_objectStoreId;
     int64_t m_indexId;
 };
 }
 
-static bool populateIndex(IDBBackingStore& backingStore, int64_t objectStoreId, int64_t indexId, const String& indexKeyPath)
+static bool populateIndex(IDBBackingStore& backingStore, int64_t databaseId, int64_t objectStoreId, int64_t indexId, const String& indexKeyPath)
 {
-    PopulateIndexCallback callback(backingStore, indexKeyPath, indexId);
-    if (!backingStore.forEachObjectStoreRecord(objectStoreId, callback))
+    PopulateIndexCallback callback(backingStore, indexKeyPath, databaseId, objectStoreId, indexId);
+    if (!backingStore.forEachObjectStoreRecord(databaseId, objectStoreId, callback))
         return false;
     return true;
 }
@@ -360,7 +375,7 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::createIndex(cons
         return 0;
     }
 
-    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(m_backingStore.get(), name, m_name, keyPath, unique);
+    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(m_backingStore.get(), m_databaseId, this, name, m_name, keyPath, unique);
     ASSERT(index->name() == name);
 
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
@@ -378,14 +393,14 @@ PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::createIndex(cons
 void IDBObjectStoreBackendImpl::createIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
     int64_t id;
-    if (!objectStore->m_backingStore->createIndex(objectStore->m_id, index->name(), index->keyPath(), index->unique(), id)) {
+    if (!objectStore->m_backingStore->createIndex(objectStore->m_databaseId, objectStore->id(), index->name(), index->keyPath(), index->unique(), id)) {
         transaction->abort();
         return;
     }
 
     index->setId(id);
 
-    if (!populateIndex(*objectStore->m_backingStore, objectStore->m_id, id, index->keyPath())) {
+    if (!populateIndex(*objectStore->m_backingStore, objectStore->m_databaseId, objectStore->m_id, id, index->keyPath())) {
         transaction->abort();
         return;
     }
@@ -428,7 +443,7 @@ void IDBObjectStoreBackendImpl::deleteIndex(const String& name, IDBTransactionBa
 
 void IDBObjectStoreBackendImpl::deleteIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
-    objectStore->m_backingStore->deleteIndex(index->id());
+    objectStore->m_backingStore->deleteIndex(objectStore->m_databaseId, objectStore->id(), index->id());
     transaction->didCompleteTaskEvents();
 }
 
@@ -446,7 +461,7 @@ void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, Pass
 {
     IDBCursor::Direction direction = static_cast<IDBCursor::Direction>(tmpDirection);
 
-    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->id(), range.get(), direction);
+    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), range.get(), direction);
     if (!backingStoreCursor) {
         callbacks->onSuccess(SerializedScriptValue::nullValue());
         return;
@@ -462,14 +477,14 @@ void IDBObjectStoreBackendImpl::loadIndexes()
     Vector<String> names;
     Vector<String> keyPaths;
     Vector<bool> uniqueFlags;
-    m_backingStore->getIndexes(m_id, ids, names, keyPaths, uniqueFlags);
+    m_backingStore->getIndexes(m_databaseId, m_id, ids, names, keyPaths, uniqueFlags);
 
     ASSERT(names.size() == ids.size());
     ASSERT(keyPaths.size() == ids.size());
     ASSERT(uniqueFlags.size() == ids.size());
 
     for (size_t i = 0; i < ids.size(); i++)
-        m_indexes.set(names[i], IDBIndexBackendImpl::create(m_backingStore.get(), ids[i], names[i], m_name, keyPaths[i], uniqueFlags[i]));
+        m_indexes.set(names[i], IDBIndexBackendImpl::create(m_backingStore.get(), m_databaseId, this, ids[i], names[i], m_name, keyPaths[i], uniqueFlags[i]));
 }
 
 void IDBObjectStoreBackendImpl::removeIndexFromMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index)
@@ -490,7 +505,7 @@ PassRefPtr<IDBKey> IDBObjectStoreBackendImpl::genAutoIncrementKey()
     if (m_autoIncrementNumber > 0)
         return IDBKey::createNumber(m_autoIncrementNumber++);
 
-    m_autoIncrementNumber = static_cast<int>(m_backingStore->nextAutoIncrementNumber(id()));
+    m_autoIncrementNumber = static_cast<int>(m_backingStore->nextAutoIncrementNumber(m_databaseId, id()));
     return IDBKey::createNumber(m_autoIncrementNumber++);
 }
 
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h b/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
index 4479d1e..6bf95cd 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,13 +42,13 @@ class ScriptExecutionContext;
 
 class IDBObjectStoreBackendImpl : public IDBObjectStoreBackendInterface {
 public:
-    static PassRefPtr<IDBObjectStoreBackendImpl> create(IDBBackingStore* backingStore, int64_t id, const String& name, const String& keyPath, bool autoIncrement)
+    static PassRefPtr<IDBObjectStoreBackendImpl> create(IDBBackingStore* backingStore, int64_t databaseId, int64_t id, const String& name, const String& keyPath, bool autoIncrement)
     {
-        return adoptRef(new IDBObjectStoreBackendImpl(backingStore, id, name, keyPath, autoIncrement));
+        return adoptRef(new IDBObjectStoreBackendImpl(backingStore, databaseId, id, name, keyPath, autoIncrement));
     }
-    static PassRefPtr<IDBObjectStoreBackendImpl> create(IDBBackingStore* backingStore, const String& name, const String& keyPath, bool autoIncrement)
+    static PassRefPtr<IDBObjectStoreBackendImpl> create(IDBBackingStore* backingStore, int64_t databaseId, const String& name, const String& keyPath, bool autoIncrement)
     {
-        return adoptRef(new IDBObjectStoreBackendImpl(backingStore, name, keyPath, autoIncrement));
+        return adoptRef(new IDBObjectStoreBackendImpl(backingStore, databaseId, name, keyPath, autoIncrement));
     }
     virtual ~IDBObjectStoreBackendImpl();
 
@@ -59,6 +59,7 @@ public:
         return m_id;
     }
     void setId(int64_t id) { m_id = id; }
+    int64_t databaseId() const { return m_databaseId; }
 
     virtual String name() const { return m_name; }
     virtual String keyPath() const { return m_keyPath; }
@@ -77,8 +78,8 @@ public:
     virtual void openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
 private:
-    IDBObjectStoreBackendImpl(IDBBackingStore*, int64_t id, const String& name, const String& keyPath, bool autoIncrement);
-    IDBObjectStoreBackendImpl(IDBBackingStore*, const String& name, const String& keyPath, bool autoIncrement);
+    IDBObjectStoreBackendImpl(IDBBackingStore*, int64_t databaseId, int64_t id, const String& name, const String& keyPath, bool autoIncrement);
+    IDBObjectStoreBackendImpl(IDBBackingStore*, int64_t databaseId, const String& name, const String& keyPath, bool autoIncrement);
 
     void loadIndexes();
     PassRefPtr<IDBKey> genAutoIncrementKey();
@@ -99,6 +100,7 @@ private:
 
     RefPtr<IDBBackingStore> m_backingStore;
 
+    int64_t m_databaseId;
     int64_t m_id;
     String m_name;
     String m_keyPath;
diff --git a/Source/WebCore/storage/IDBSQLiteBackingStore.cpp b/Source/WebCore/storage/IDBSQLiteBackingStore.cpp
index e43b7a3..f42a1e1 100644
--- a/Source/WebCore/storage/IDBSQLiteBackingStore.cpp
+++ b/Source/WebCore/storage/IDBSQLiteBackingStore.cpp
@@ -173,7 +173,7 @@ PassRefPtr<IDBBackingStore> IDBSQLiteBackingStore::open(SecurityOrigin* security
     if (!pathBase.isEmpty()) {
         if (!makeAllDirectories(pathBase)) {
             // FIXME: Is there any other thing we could possibly do to recover at this point? If so, do it rather than just erroring out.
-            LOG_ERROR("Unabled to create LocalStorage database path %s", pathBase.utf8().data());
+            LOG_ERROR("Unable to create Indexed DB database path %s", pathBase.utf8().data());
             return 0;
         }
         path = pathByAppendingComponent(pathBase, securityOrigin->databaseIdentifier() + ".indexeddb");
@@ -263,7 +263,7 @@ void IDBSQLiteBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>&
     }
 }
 
-bool IDBSQLiteBackingStore::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId)
+bool IDBSQLiteBackingStore::createObjectStore(int64_t databaseId, const String& name, const String& keyPath, bool autoIncrement, int64_t& assignedObjectStoreId)
 {
     SQLiteStatement query(m_db, "INSERT INTO ObjectStores (name, keyPath, doAutoIncrement, databaseId) VALUES (?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
@@ -291,7 +291,7 @@ static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
 }
 
-void IDBSQLiteBackingStore::deleteObjectStore(int64_t objectStoreId)
+void IDBSQLiteBackingStore::deleteObjectStore(int64_t, int64_t objectStoreId)
 {
     doDelete(m_db, "DELETE FROM ObjectStores WHERE id = ?", objectStoreId);
     doDelete(m_db, "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStoreId);
@@ -299,6 +299,26 @@ void IDBSQLiteBackingStore::deleteObjectStore(int64_t objectStoreId)
     doDelete(m_db, "DELETE FROM Indexes WHERE objectStoreId = ?", objectStoreId);
 }
 
+namespace {
+class SQLiteRecordIdentifier : public IDBBackingStore::ObjectStoreRecordIdentifier {
+public:
+    static PassRefPtr<SQLiteRecordIdentifier> create() { return adoptRef(new SQLiteRecordIdentifier()); }
+    static PassRefPtr<SQLiteRecordIdentifier> create(int64_t id) { return adoptRef(new SQLiteRecordIdentifier(id)); }
+    virtual bool isValid() const { return m_id != -1; }
+    int64_t id() const { return m_id; }
+    void setId(int64_t id) { m_id = id; }
+private:
+    SQLiteRecordIdentifier() : m_id(-1) { }
+    SQLiteRecordIdentifier(int64_t id) : m_id(id) { }
+    int64_t m_id;
+};
+}
+
+PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> IDBSQLiteBackingStore::createInvalidRecordIdentifier()
+{
+    return SQLiteRecordIdentifier::create();
+}
+
 static String whereSyntaxForKey(const IDBKey& key, String qualifiedTableName = "")
 {
     switch (key.type()) {
@@ -373,7 +393,7 @@ static String upperCursorWhereFragment(const IDBKey& key, String comparisonOpera
     return "";
 }
 
-String IDBSQLiteBackingStore::getObjectStoreRecord(int64_t objectStoreId, const IDBKey& key)
+String IDBSQLiteBackingStore::getObjectStoreRecord(int64_t, int64_t objectStoreId, const IDBKey& key)
 {
     SQLiteStatement query(m_db, "SELECT keyString, keyDate, keyNumber, value FROM ObjectStoreData WHERE objectStoreId = ? AND " + whereSyntaxForKey(key));
     bool ok = query.prepare() == SQLResultOk;
@@ -422,58 +442,54 @@ static void bindKeyToQueryWithNulls(SQLiteStatement& query, int baseColumn, cons
     }
 }
 
-bool IDBSQLiteBackingStore::putObjectStoreRecord(int64_t objectStoreId, const IDBKey& key, const String& value, int64_t& rowId, bool invalidRowId)
+bool IDBSQLiteBackingStore::putObjectStoreRecord(int64_t, int64_t objectStoreId, const IDBKey& key, const String& value, ObjectStoreRecordIdentifier* recordIdentifier)
 {
-    String sql = !invalidRowId ? "UPDATE ObjectStoreData SET keyString = ?, keyDate = ?, keyNumber = ?, value = ? WHERE id = ?"
-                               : "INSERT INTO ObjectStoreData (keyString, keyDate, keyNumber, value, objectStoreId) VALUES (?, ?, ?, ?, ?)";
+    SQLiteRecordIdentifier* sqliteRecordIdentifier = static_cast<SQLiteRecordIdentifier*>(recordIdentifier);
+
+    String sql = sqliteRecordIdentifier->isValid() ? "UPDATE ObjectStoreData SET keyString = ?, keyDate = ?, keyNumber = ?, value = ? WHERE id = ?"
+                                                   : "INSERT INTO ObjectStoreData (keyString, keyDate, keyNumber, value, objectStoreId) VALUES (?, ?, ?, ?, ?)";
     SQLiteStatement query(m_db, sql);
     if (query.prepare() != SQLResultOk)
         return false;
 
     bindKeyToQueryWithNulls(query, 1, key);
     query.bindBlob(4, value);
-    if (!invalidRowId)
-        query.bindInt64(5, rowId);
+    if (sqliteRecordIdentifier->isValid())
+        query.bindInt64(5, sqliteRecordIdentifier->id());
     else
         query.bindInt64(5, objectStoreId);
 
     if (query.step() != SQLResultDone)
         return false;
 
-    if (invalidRowId)
-        rowId = m_db.lastInsertRowID();
+    if (!sqliteRecordIdentifier->isValid())
+        sqliteRecordIdentifier->setId(m_db.lastInsertRowID());
 
     return true;
 }
 
-void IDBSQLiteBackingStore::clearObjectStore(int64_t objectStoreId)
+void IDBSQLiteBackingStore::clearObjectStore(int64_t, int64_t objectStoreId)
 {
     doDelete(m_db, "DELETE FROM IndexData WHERE objectStoreDataId IN (SELECT id FROM ObjectStoreData WHERE objectStoreId = ?)", objectStoreId);
     doDelete(m_db, "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStoreId);
 }
 
-void IDBSQLiteBackingStore::deleteObjectStoreRecord(int64_t, int64_t objectStoreDataId)
+void IDBSQLiteBackingStore::deleteObjectStoreRecord(int64_t, int64_t objectStoreId, const ObjectStoreRecordIdentifier* recordIdentifier)
 {
+    const SQLiteRecordIdentifier* sqliteRecordIdentifier = static_cast<const SQLiteRecordIdentifier*>(recordIdentifier);
+    ASSERT(sqliteRecordIdentifier->isValid());
+
     SQLiteStatement osQuery(m_db, "DELETE FROM ObjectStoreData WHERE id = ?");
     bool ok = osQuery.prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
 
-    osQuery.bindInt64(1, objectStoreDataId);
+    osQuery.bindInt64(1, sqliteRecordIdentifier->id());
 
     ok = osQuery.step() == SQLResultDone;
     ASSERT_UNUSED(ok, ok);
-
-    SQLiteStatement indexQuery(m_db, "DELETE FROM IndexData WHERE objectStoreDataId = ?");
-    ok = indexQuery.prepare() == SQLResultOk;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
-
-    indexQuery.bindInt64(1, objectStoreDataId);
-
-    ok = indexQuery.step() == SQLResultDone;
-    ASSERT_UNUSED(ok, ok);
 }
 
-double IDBSQLiteBackingStore::nextAutoIncrementNumber(int64_t objectStoreId)
+double IDBSQLiteBackingStore::nextAutoIncrementNumber(int64_t, int64_t objectStoreId)
 {
     SQLiteStatement query(m_db, "SELECT max(keyNumber) + 1 FROM ObjectStoreData WHERE objectStoreId = ? AND keyString IS NULL AND keyDate IS NULL");
     bool ok = query.prepare() == SQLResultOk;
@@ -487,8 +503,10 @@ double IDBSQLiteBackingStore::nextAutoIncrementNumber(int64_t objectStoreId)
     return query.getColumnDouble(0);
 }
 
-bool IDBSQLiteBackingStore::keyExistsInObjectStore(int64_t objectStoreId, const IDBKey& key, int64_t& foundObjectStoreDataId)
+bool IDBSQLiteBackingStore::keyExistsInObjectStore(int64_t, int64_t objectStoreId, const IDBKey& key, ObjectStoreRecordIdentifier* foundRecordIdentifier)
 {
+    SQLiteRecordIdentifier* sqliteRecordIdentifier = static_cast<SQLiteRecordIdentifier*>(foundRecordIdentifier);
+
     String sql = String("SELECT id FROM ObjectStoreData WHERE objectStoreId = ? AND ") + whereSyntaxForKey(key);
     SQLiteStatement query(m_db, sql);
     bool ok = query.prepare() == SQLResultOk;
@@ -500,11 +518,11 @@ bool IDBSQLiteBackingStore::keyExistsInObjectStore(int64_t objectStoreId, const
     if (query.step() != SQLResultRow)
         return false;
 
-    foundObjectStoreDataId = query.getColumnInt64(0);
+    sqliteRecordIdentifier->setId(query.getColumnInt64(0));
     return true;
 }
 
-bool IDBSQLiteBackingStore::forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback& callback)
+bool IDBSQLiteBackingStore::forEachObjectStoreRecord(int64_t, int64_t objectStoreId, ObjectStoreRecordCallback& callback)
 {
     SQLiteStatement query(m_db, "SELECT id, value FROM ObjectStoreData WHERE objectStoreId = ?");
     if (query.prepare() != SQLResultOk)
@@ -515,14 +533,15 @@ bool IDBSQLiteBackingStore::forEachObjectStoreRecord(int64_t objectStoreId, Obje
     while (query.step() == SQLResultRow) {
         int64_t objectStoreDataId = query.getColumnInt64(0);
         String value = query.getColumnBlobAsString(1);
-        if (!callback.callback(objectStoreDataId, value))
+        RefPtr<SQLiteRecordIdentifier> recordIdentifier = SQLiteRecordIdentifier::create(objectStoreDataId);
+        if (!callback.callback(recordIdentifier.get(), value))
             return false;
     }
 
     return true;
 }
 
-void IDBSQLiteBackingStore::getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags)
+void IDBSQLiteBackingStore::getIndexes(int64_t, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags)
 {
     SQLiteStatement query(m_db, "SELECT id, name, keyPath, isUnique FROM Indexes WHERE objectStoreId = ?");
     bool ok = query.prepare() == SQLResultOk;
@@ -543,7 +562,7 @@ void IDBSQLiteBackingStore::getIndexes(int64_t objectStoreId, Vector<int64_t>& f
     }
 }
 
-bool IDBSQLiteBackingStore::createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId)
+bool IDBSQLiteBackingStore::createIndex(int64_t, int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId)
 {
     SQLiteStatement query(m_db, "INSERT INTO Indexes (objectStoreId, name, keyPath, isUnique) VALUES (?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
@@ -561,36 +580,41 @@ bool IDBSQLiteBackingStore::createIndex(int64_t objectStoreId, const String& nam
     return true;
 }
 
-void IDBSQLiteBackingStore::deleteIndex(int64_t indexId)
+void IDBSQLiteBackingStore::deleteIndex(int64_t, int64_t, int64_t indexId)
 {
     doDelete(m_db, "DELETE FROM Indexes WHERE id = ?", indexId);
     doDelete(m_db, "DELETE FROM IndexData WHERE indexId = ?", indexId);
 }
 
-bool IDBSQLiteBackingStore::putIndexDataForRecord(int64_t indexId, const IDBKey& key, int64_t objectStoreDataId)
+bool IDBSQLiteBackingStore::putIndexDataForRecord(int64_t, int64_t, int64_t indexId, const IDBKey& key, const ObjectStoreRecordIdentifier* recordIdentifier)
 {
+    const SQLiteRecordIdentifier* sqliteRecordIdentifier = static_cast<const SQLiteRecordIdentifier*>(recordIdentifier);
+
     SQLiteStatement query(m_db, "INSERT INTO IndexData (keyString, keyDate, keyNumber, indexId, objectStoreDataId) VALUES (?, ?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
         return false;
 
     bindKeyToQueryWithNulls(query, 1, key);
     query.bindInt64(4, indexId);
-    query.bindInt64(5, objectStoreDataId);
+    query.bindInt64(5, sqliteRecordIdentifier->id());
 
     return query.step() == SQLResultDone;
 }
 
-bool IDBSQLiteBackingStore::deleteIndexDataForRecord(int64_t objectStoreDataId)
+bool IDBSQLiteBackingStore::deleteIndexDataForRecord(int64_t, int64_t, int64_t indexId, const ObjectStoreRecordIdentifier* recordIdentifier)
 {
-    SQLiteStatement query(m_db, "DELETE FROM IndexData WHERE objectStoreDataId = ?");
+    const SQLiteRecordIdentifier* sqliteRecordIdentifier = static_cast<const SQLiteRecordIdentifier*>(recordIdentifier);
+
+    SQLiteStatement query(m_db, "DELETE FROM IndexData WHERE objectStoreDataId = ? AND indexId = ?");
     if (query.prepare() != SQLResultOk)
         return false;
 
-    query.bindInt64(1, objectStoreDataId);
+    query.bindInt64(1, sqliteRecordIdentifier->id());
+    query.bindInt64(2, indexId);
     return query.step() == SQLResultDone;
 }
 
-String IDBSQLiteBackingStore::getObjectViaIndex(int64_t indexId, const IDBKey& key)
+String IDBSQLiteBackingStore::getObjectViaIndex(int64_t, int64_t, int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT ")
                  + "ObjectStoreData.value "
@@ -629,7 +653,7 @@ static PassRefPtr<IDBKey> keyFromQuery(SQLiteStatement& query, int baseColumn)
     return IDBKey::createNull();
 }
 
-PassRefPtr<IDBKey> IDBSQLiteBackingStore::getPrimaryKeyViaIndex(int64_t indexId, const IDBKey& key)
+PassRefPtr<IDBKey> IDBSQLiteBackingStore::getPrimaryKeyViaIndex(int64_t, int64_t, int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT ")
                  + "ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber "
@@ -651,7 +675,7 @@ PassRefPtr<IDBKey> IDBSQLiteBackingStore::getPrimaryKeyViaIndex(int64_t indexId,
     return foundKey.release();
 }
 
-bool IDBSQLiteBackingStore::keyExistsInIndex(int64_t indexId, const IDBKey& key)
+bool IDBSQLiteBackingStore::keyExistsInIndex(int64_t, int64_t, int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT id FROM IndexData WHERE indexId = ? AND ") + whereSyntaxForKey(key);
     SQLiteStatement query(m_db, sql);
@@ -682,7 +706,7 @@ public:
     virtual PassRefPtr<IDBKey> key() { return m_currentKey; }
     virtual PassRefPtr<IDBKey> primaryKey() { return m_currentKey; }
     virtual String value() = 0;
-    virtual int64_t objectStoreDataId() = 0;
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() = 0;
     virtual int64_t indexDataId() = 0;
 
     virtual void loadCurrentRow() = 0;
@@ -741,7 +765,7 @@ public:
 
     // CursorImplCommon.
     virtual String value() { return m_currentValue; }
-    virtual int64_t objectStoreDataId() { return m_currentId; }
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() { return SQLiteRecordIdentifier::create(m_currentId); }
     virtual int64_t indexDataId() { ASSERT_NOT_REACHED(); return 0; }
     virtual void loadCurrentRow();
     virtual bool currentRowExists();
@@ -779,7 +803,7 @@ public:
     // CursorImplCommon
     virtual PassRefPtr<IDBKey> primaryKey() { return m_currentPrimaryKey; }
     virtual String value() { ASSERT_NOT_REACHED(); return String(); }
-    virtual int64_t objectStoreDataId() { ASSERT_NOT_REACHED(); return 0; }
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() { ASSERT_NOT_REACHED(); return 0; }
     virtual int64_t indexDataId() { return m_currentId; }
     virtual void loadCurrentRow();
     virtual bool currentRowExists();
@@ -817,7 +841,7 @@ public:
     // CursorImplCommon
     virtual PassRefPtr<IDBKey> primaryKey() { return m_currentPrimaryKey; }
     virtual String value() { return m_currentValue; }
-    virtual int64_t objectStoreDataId() { ASSERT_NOT_REACHED(); return 0; }
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() { ASSERT_NOT_REACHED(); return 0; }
     virtual int64_t indexDataId() { return m_currentId; }
     virtual void loadCurrentRow();
     virtual bool currentRowExists();
@@ -849,7 +873,7 @@ bool IndexCursorImpl::currentRowExists()
 
 } // namespace
 
-PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openObjectStoreCursor(int64_t, int64_t objectStoreId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     bool lowerBound = range && range->lower();
     bool upperBound = range && range->upper();
@@ -886,7 +910,7 @@ PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openObjectStoreCursor
     return cursor.release();
 }
 
-PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexKeyCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexKeyCursor(int64_t, int64_t, int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     String sql = String("SELECT IndexData.id, IndexData.keyString, IndexData.keyDate, IndexData.keyNumber, ")
                  + ("ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber ")
@@ -926,7 +950,7 @@ PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexKeyCursor(in
     return cursor.release();
 }
 
-PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexCursor(int64_t, int64_t, int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     String sql = String("SELECT IndexData.id, IndexData.keyString, IndexData.keyDate, IndexData.keyNumber, ")
                  + ("ObjectStoreData.value, ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber ")
diff --git a/Source/WebCore/storage/IDBSQLiteBackingStore.h b/Source/WebCore/storage/IDBSQLiteBackingStore.h
index fe0c6c1..9efa060 100644
--- a/Source/WebCore/storage/IDBSQLiteBackingStore.h
+++ b/Source/WebCore/storage/IDBSQLiteBackingStore.h
@@ -41,29 +41,30 @@ public:
     virtual bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId);
 
     virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags);
-    virtual bool createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId);
-    virtual void deleteObjectStore(int64_t objectStoreId);
-    virtual String getObjectStoreRecord(int64_t objectStoreId, const IDBKey&);
-    virtual bool putObjectStoreRecord(int64_t objectStoreId, const IDBKey&, const String& value, int64_t& rowId, bool invalidRowId);
-    virtual void clearObjectStore(int64_t objectStoreId);
-    virtual void deleteObjectStoreRecord(int64_t objectStoreId, int64_t objectStoreDataId);
-    virtual double nextAutoIncrementNumber(int64_t objectStoreId);
-    virtual bool keyExistsInObjectStore(int64_t objectStoreId, const IDBKey&, int64_t& foundObjectStoreDataId);
-
-    virtual bool forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback&);
-
-    virtual void getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags);
-    virtual bool createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId);
-    virtual void deleteIndex(int64_t indexId);
-    virtual bool putIndexDataForRecord(int64_t indexId, const IDBKey&, int64_t objectStoreDataId);
-    virtual bool deleteIndexDataForRecord(int64_t objectStoreDataId);
-    virtual String getObjectViaIndex(int64_t indexId, const IDBKey&);
-    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t indexId, const IDBKey&);
-    virtual bool keyExistsInIndex(int64_t indexId, const IDBKey&);
-
-    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction);
-    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
-    virtual PassRefPtr<Cursor> openIndexCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual bool createObjectStore(int64_t databaseId, const String& name, const String& keyPath, bool autoIncrement, int64_t& assignedObjectStoreId);
+    virtual void deleteObjectStore(int64_t databaseId, int64_t objectStoreId);
+    virtual PassRefPtr<ObjectStoreRecordIdentifier> createInvalidRecordIdentifier();
+    virtual String getObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey&);
+    virtual bool putObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey&, const String& value, ObjectStoreRecordIdentifier*);
+    virtual void clearObjectStore(int64_t databaseId, int64_t objectStoreId);
+    virtual void deleteObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const ObjectStoreRecordIdentifier*);
+    virtual double nextAutoIncrementNumber(int64_t databaseId, int64_t objectStoreId);
+    virtual bool keyExistsInObjectStore(int64_t databaseId, int64_t objectStoreId, const IDBKey&, ObjectStoreRecordIdentifier* foundRecordIdentifier);
+
+    virtual bool forEachObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, ObjectStoreRecordCallback&);
+
+    virtual void getIndexes(int64_t databaseId, int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags);
+    virtual bool createIndex(int64_t databaseId, int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId);
+    virtual void deleteIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId);
+    virtual bool putIndexDataForRecord(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&, const ObjectStoreRecordIdentifier*);
+    virtual bool deleteIndexDataForRecord(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const ObjectStoreRecordIdentifier*);
+    virtual String getObjectViaIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&);
+    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&);
+    virtual bool keyExistsInIndex(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey&);
+
+    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t databaseId, int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openIndexCursor(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
 
     virtual PassRefPtr<Transaction> createTransaction();
 
diff --git a/Source/WebCore/storage/StorageInfo.cpp b/Source/WebCore/storage/StorageInfo.cpp
new file mode 100644
index 0000000..f3b3d08
--- /dev/null
+++ b/Source/WebCore/storage/StorageInfo.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(QUOTA)
+
+#include "StorageInfo.h"
+
+#include "NotImplemented.h"
+#include "StorageInfoErrorCallback.h"
+#include "StorageInfoQuotaCallback.h"
+#include "StorageInfoUsageCallback.h"
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+StorageInfo::StorageInfo()
+{
+}
+
+StorageInfo::~StorageInfo()
+{
+}
+
+#if !PLATFORM(CHROMIUM)
+void StorageInfo::queryUsageAndQuota(ScriptExecutionContext*, int, PassRefPtr<StorageInfoUsageCallback>, PassRefPtr<StorageInfoErrorCallback>)
+{
+    notImplemented();
+}
+
+void StorageInfo::requestQuota(ScriptExecutionContext*, int, unsigned long long, PassRefPtr<StorageInfoQuotaCallback>, PassRefPtr<StorageInfoErrorCallback>)
+{
+    notImplemented();
+}
+#endif
+
+} // namespace WebCore
+
+#endif // ENABLE(QUOTA)
diff --git a/Source/WebCore/storage/StorageInfo.h b/Source/WebCore/storage/StorageInfo.h
new file mode 100644
index 0000000..b908bd8
--- /dev/null
+++ b/Source/WebCore/storage/StorageInfo.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageInfo_h
+#define StorageInfo_h
+
+#if ENABLE(QUOTA)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+class StorageInfoErrorCallback;
+class StorageInfoQuotaCallback;
+class StorageInfoUsageCallback;
+
+class StorageInfo : public RefCounted<StorageInfo> {
+public:
+    enum {
+        TEMPORARY,
+        PERSISTENT,
+    };
+
+    static PassRefPtr<StorageInfo> create()
+    {
+        return adoptRef(new StorageInfo());
+    }
+
+    void queryUsageAndQuota(ScriptExecutionContext*, int storageType, PassRefPtr<StorageInfoUsageCallback>, PassRefPtr<StorageInfoErrorCallback>);
+
+    void requestQuota(ScriptExecutionContext*, int storageType, unsigned long long newQuotaInBytes, PassRefPtr<StorageInfoQuotaCallback>, PassRefPtr<StorageInfoErrorCallback>);
+
+    ~StorageInfo();
+
+private:
+    StorageInfo();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(QUOTA)
+
+#endif // StorageInfo_h
diff --git a/Source/WebCore/storage/StorageInfo.idl b/Source/WebCore/storage/StorageInfo.idl
new file mode 100644
index 0000000..c75b72b
--- /dev/null
+++ b/Source/WebCore/storage/StorageInfo.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module storage {
+    interface [
+        Conditional=QUOTA,
+        OmitConstructor,
+        GenerateNativeConverter
+    ] StorageInfo {
+        const unsigned short TEMPORARY = 0;
+        const unsigned short PERSISTENT = 1;
+
+        [CallWith=ScriptExecutionContext] void queryUsageAndQuota(in unsigned short storageType, in [Callback, Optional] StorageInfoUsageCallback usageCallback, in [Callback, Optional] StorageInfoErrorCallback errorCallback);
+    };
+}
diff --git a/Source/WebCore/storage/StorageInfoErrorCallback.h b/Source/WebCore/storage/StorageInfoErrorCallback.h
new file mode 100644
index 0000000..6e3d75e
--- /dev/null
+++ b/Source/WebCore/storage/StorageInfoErrorCallback.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageInfoErrorCallback_h
+#define StorageInfoErrorCallback_h
+
+#if ENABLE(QUOTA)
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DOMCoreException;
+
+class StorageInfoErrorCallback : public RefCounted<StorageInfoErrorCallback> {
+public:
+    virtual ~StorageInfoErrorCallback() { }
+    virtual bool handleEvent(DOMCoreException*) = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(QUOTA)
+
+#endif // StorageInfoErrorCallback_h
diff --git a/Source/WebCore/storage/StorageInfoErrorCallback.idl b/Source/WebCore/storage/StorageInfoErrorCallback.idl
new file mode 100644
index 0000000..66c3316
--- /dev/null
+++ b/Source/WebCore/storage/StorageInfoErrorCallback.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+    interface [
+        Conditional=QUOTA,
+        Callback
+    ] StorageInfoErrorCallback {
+        boolean handleEvent(in DOMCoreException error);
+    };
+}
diff --git a/Source/WebCore/storage/StorageInfoQuotaCallback.h b/Source/WebCore/storage/StorageInfoQuotaCallback.h
new file mode 100644
index 0000000..f6fde99
--- /dev/null
+++ b/Source/WebCore/storage/StorageInfoQuotaCallback.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageInfoQuotaCallback_h
+#define StorageInfoQuotaCallback_h
+
+#if ENABLE(QUOTA)
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class StorageInfoQuotaCallback : public RefCounted<StorageInfoQuotaCallback> {
+public:
+    virtual ~StorageInfoQuotaCallback() { }
+    virtual bool handleEvent(unsigned long long grantedQuotaInBytes) = 0;
+};
+
+} // namespace
+
+#endif // ENABLE(QUOTA)
+
+#endif // StorageInfoQuotaCallback_h
diff --git a/Source/WebCore/storage/StorageInfoUsageCallback.h b/Source/WebCore/storage/StorageInfoUsageCallback.h
new file mode 100644
index 0000000..8382611
--- /dev/null
+++ b/Source/WebCore/storage/StorageInfoUsageCallback.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageInfoUsageCallback_h
+#define StorageInfoUsageCallback_h
+
+#if ENABLE(QUOTA)
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class StorageInfoUsageCallback : public RefCounted<StorageInfoUsageCallback> {
+public:
+    virtual ~StorageInfoUsageCallback() { }
+    virtual bool handleEvent(unsigned long long currentUsageInBytes, unsigned long long currentQuotaInBytes) = 0;
+};
+
+} // namespace
+
+#endif // ENABLE(QUOTA)
+
+#endif // StorageInfoUsageCallback_h
diff --git a/Source/WebCore/storage/StorageInfoUsageCallback.idl b/Source/WebCore/storage/StorageInfoUsageCallback.idl
new file mode 100644
index 0000000..dfa58e6
--- /dev/null
+++ b/Source/WebCore/storage/StorageInfoUsageCallback.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+    interface [
+        Conditional=QUOTA,
+        Callback
+    ] StorageInfoUsageCallback {
+        boolean handleEvent(in unsigned long long currentUsageInBytes, in unsigned long long currentQuotaInBytes);
+    };
+}
+
diff --git a/Source/WebCore/storage/StorageTracker.cpp b/Source/WebCore/storage/StorageTracker.cpp
index e18b4b8..b9ce65f 100644
--- a/Source/WebCore/storage/StorageTracker.cpp
+++ b/Source/WebCore/storage/StorageTracker.cpp
@@ -232,8 +232,10 @@ void StorageTracker::syncFileSystemAndTrackerDatabase()
     // Delete stale StorageTracker records.
     OriginSet::const_iterator setEnd = originSetCopy.end();
     for (OriginSet::const_iterator it = originSetCopy.begin(); it != setEnd; ++it) {
-        if (!foundOrigins.contains(*it))
-            syncDeleteOrigin(*it);
+        if (!foundOrigins.contains(*it)) {
+            RefPtr<StringImpl> originIdentifier = (*it).threadsafeCopy().impl();
+            callOnMainThread(deleteOriginOnMainThread, originIdentifier.release().leakRef());
+        }
     }
 }
 
@@ -376,10 +378,33 @@ void StorageTracker::syncDeleteAllOrigins()
     if (m_database.isOpen())
         m_database.close();
     
-    SQLiteFileSystem::deleteDatabaseFile(trackerDatabasePath());
+    if (!SQLiteFileSystem::deleteDatabaseFile(trackerDatabasePath())) {
+        // In the case where it is not possible to delete the database file (e.g some other program
+        // like a virus scanner is accessing it), make sure to remove all entries.
+        openTrackerDatabase(false);
+        if (!m_database.isOpen())
+            return;
+        SQLiteStatement deleteStatement(m_database, "DELETE FROM Origins");
+        if (deleteStatement.prepare() != SQLResultOk) {
+            LOG_ERROR("Unable to prepare deletion of all origins");
+            return;
+        }
+        if (!deleteStatement.executeCommand()) {
+            LOG_ERROR("Unable to execute deletion of all origins");
+            return;
+        }
+    }
     SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_storageDirectoryPath);
 }
 
+void StorageTracker::deleteOriginOnMainThread(void* originIdentifier)
+{
+    ASSERT(isMainThread());
+
+    String identifier = adoptRef(reinterpret_cast<StringImpl*>(originIdentifier));
+    tracker().deleteOrigin(identifier);
+}
+
 void StorageTracker::deleteOrigin(const String& originIdentifier)
 {
     deleteOrigin(SecurityOrigin::createFromDatabaseIdentifier(originIdentifier).get());
diff --git a/Source/WebCore/storage/StorageTracker.h b/Source/WebCore/storage/StorageTracker.h
index 04a821b..714576d 100644
--- a/Source/WebCore/storage/StorageTracker.h
+++ b/Source/WebCore/storage/StorageTracker.h
@@ -86,6 +86,7 @@ private:
     bool canDeleteOrigin(const String& originIdentifier);
     void willDeleteOrigin(const String& originIdentifier);
     void willDeleteAllOrigins();
+    static void deleteOriginOnMainThread(void* originIdentifier);
 
     void originFilePaths(Vector<String>& paths);
     
diff --git a/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index a4c2a6b..f58be8f 100644
--- a/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -87,14 +87,17 @@ void SVGFEDiffuseLightingElement::parseMappedAttribute(Attribute* attr)
 bool SVGFEDiffuseLightingElement::setFilterEffectAttribute(FilterEffect* effect, const QualifiedName& attrName)
 {
     FEDiffuseLighting* diffuseLighting = static_cast<FEDiffuseLighting*>(effect);
+
+    if (attrName == SVGNames::lighting_colorAttr) {
+        RenderObject* renderer = this->renderer();
+        ASSERT(renderer);
+        ASSERT(renderer->style());
+        return diffuseLighting->setLightingColor(renderer->style()->svgStyle()->lightingColor());
+    }
     if (attrName == SVGNames::surfaceScaleAttr)
         return diffuseLighting->setSurfaceScale(surfaceScale());
     if (attrName == SVGNames::diffuseConstantAttr)
         return diffuseLighting->setDiffuseConstant(diffuseConstant());
-    if (attrName == SVGNames::lighting_colorAttr) {
-        RefPtr<RenderStyle> filterStyle = styleForRenderer();
-        return diffuseLighting->setLightingColor(filterStyle->svgStyle()->lightingColor());
-    }
 
     LightSource* lightSource = const_cast<LightSource*>(diffuseLighting->lightSource());
     const SVGFELightElement* lightElement = SVGFELightElement::findLightElement(this);
diff --git a/Source/WebCore/svg/SVGFEFloodElement.cpp b/Source/WebCore/svg/SVGFEFloodElement.cpp
index eb20927..bb676a9 100644
--- a/Source/WebCore/svg/SVGFEFloodElement.cpp
+++ b/Source/WebCore/svg/SVGFEFloodElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Attribute.h"
 #include "RenderStyle.h"
+#include "SVGNames.h"
 #include "SVGRenderStyle.h"
 
 namespace WebCore {
@@ -39,6 +40,24 @@ PassRefPtr<SVGFEFloodElement> SVGFEFloodElement::create(const QualifiedName& tag
     return adoptRef(new SVGFEFloodElement(tagName, document));
 }
 
+
+bool SVGFEFloodElement::setFilterEffectAttribute(FilterEffect* effect, const QualifiedName& attrName)
+{
+    RenderObject* renderer = this->renderer();
+    ASSERT(renderer);
+    RenderStyle* style = renderer->style();
+    ASSERT(style);
+    FEFlood* flood = static_cast<FEFlood*>(effect);
+
+    if (attrName == SVGNames::flood_colorAttr)
+        return flood->setFloodColor(style->svgStyle()->floodColor());
+    if (attrName == SVGNames::flood_opacityAttr)
+        return flood->setFloodOpacity(style->svgStyle()->floodOpacity());
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 PassRefPtr<FilterEffect> SVGFEFloodElement::build(SVGFilterBuilder*, Filter* filter)
 {
     RefPtr<RenderStyle> filterStyle = styleForRenderer();
diff --git a/Source/WebCore/svg/SVGFEFloodElement.h b/Source/WebCore/svg/SVGFEFloodElement.h
index f7c7987..e98e7b3 100644
--- a/Source/WebCore/svg/SVGFEFloodElement.h
+++ b/Source/WebCore/svg/SVGFEFloodElement.h
@@ -36,6 +36,7 @@ private:
 
     virtual void fillAttributeToPropertyTypeMap();
     virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
+    virtual bool setFilterEffectAttribute(FilterEffect*, const QualifiedName& attrName);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*, Filter*);
 };
 
diff --git a/Source/WebCore/svg/SVGFESpecularLightingElement.cpp b/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
index 60684ed..bdc75b1 100644
--- a/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
+++ b/Source/WebCore/svg/SVGFESpecularLightingElement.cpp
@@ -92,6 +92,13 @@ void SVGFESpecularLightingElement::parseMappedAttribute(Attribute* attr)
 bool SVGFESpecularLightingElement::setFilterEffectAttribute(FilterEffect* effect, const QualifiedName& attrName)
 {
     FESpecularLighting* specularLighting = static_cast<FESpecularLighting*>(effect);
+
+    if (attrName == SVGNames::lighting_colorAttr) {
+        RenderObject* renderer = this->renderer();
+        ASSERT(renderer);
+        ASSERT(renderer->style());
+        return specularLighting->setLightingColor(renderer->style()->svgStyle()->lightingColor());
+    }
     if (attrName == SVGNames::surfaceScaleAttr)
         return specularLighting->setSurfaceScale(surfaceScale());
     if (attrName == SVGNames::specularConstantAttr)
diff --git a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index d34a130..fe5d09c 100644
--- a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -168,6 +168,14 @@ RenderObject* SVGFilterPrimitiveStandardAttributes::createRenderer(RenderArena*
     return new (arena) RenderSVGResourceFilterPrimitive(this);
 }
 
+bool SVGFilterPrimitiveStandardAttributes::rendererIsNeeded(RenderStyle* style)
+{
+    if (parentNode() && (parentNode()->hasTagName(SVGNames::filterTag)))
+        return SVGStyledElement::rendererIsNeeded(style);
+
+    return false;
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index 526592a..795bc11 100644
--- a/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/Source/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -70,6 +70,7 @@ private:
     virtual bool isFilterEffect() const { return true; }
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool rendererIsNeeded(RenderStyle*);
 
     // Animated property declarations
     DECLARE_ANIMATED_LENGTH(X, x)
diff --git a/Source/WebCore/svg/SVGFontFaceUriElement.cpp b/Source/WebCore/svg/SVGFontFaceUriElement.cpp
index 58a22c7..b017143 100644
--- a/Source/WebCore/svg/SVGFontFaceUriElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceUriElement.cpp
@@ -97,7 +97,6 @@ void SVGFontFaceUriElement::loadFont()
         CachedResourceLoader* cachedResourceLoader = document()->cachedResourceLoader();
         m_cachedFont = cachedResourceLoader->requestFont(href);
         if (m_cachedFont) {
-            m_cachedFont->setSVGFont(true);
             m_cachedFont->addClient(this);
             m_cachedFont->beginLoadIfNeeded(cachedResourceLoader);
         }
diff --git a/Source/WebCore/svg/SVGImageLoader.cpp b/Source/WebCore/svg/SVGImageLoader.cpp
index 7c60191..944da1a 100644
--- a/Source/WebCore/svg/SVGImageLoader.cpp
+++ b/Source/WebCore/svg/SVGImageLoader.cpp
@@ -49,6 +49,9 @@ void SVGImageLoader::dispatchLoadEvent()
 
 String SVGImageLoader::sourceURI(const AtomicString& attr) const
 {
+    KURL base = element()->baseURI();
+    if (base.isValid())
+        return KURL(base, stripLeadingAndTrailingHTMLSpaces(attr)).string();
     return element()->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(attr));
 }
 
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index 5740b05..79e1633 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -81,13 +81,13 @@ String SVGStyledElement::title() const
     // Walk up the tree, to find out whether we're inside a <use> shadow tree, to find the right title.
     Node* parent = const_cast<SVGStyledElement*>(this);
     while (parent) {
-        if (!parent->isShadowRoot()) {
+        if (!parent->isSVGShadowRoot()) {
             parent = parent->parentNodeGuaranteedHostFree();
             continue;
         }
         
         // Get the <use> element.
-        Element* shadowParent = parent->shadowHost();
+        Element* shadowParent = parent->svgShadowHost();
         if (shadowParent && shadowParent->isSVGElement() && shadowParent->hasTagName(SVGNames::useTag)) {
             SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowParent);
             // If the <use> title is not empty we found the title to use.
diff --git a/Source/WebCore/svg/SVGTextContentElement.cpp b/Source/WebCore/svg/SVGTextContentElement.cpp
index a719c28..4021b4f 100644
--- a/Source/WebCore/svg/SVGTextContentElement.cpp
+++ b/Source/WebCore/svg/SVGTextContentElement.cpp
@@ -27,6 +27,7 @@
 #include "CSSValueKeywords.h"
 #include "Frame.h"
 #include "RenderObject.h"
+#include "RenderSVGResource.h"
 #include "SVGDocumentExtensions.h"
 #include "SVGNames.h"
 #include "SVGTextQuery.h"
@@ -36,17 +37,38 @@
 namespace WebCore {
 
 // Animated property definitions
-DEFINE_ANIMATED_LENGTH(SVGTextContentElement, SVGNames::textLengthAttr, TextLength, textLength)
 DEFINE_ANIMATED_ENUMERATION(SVGTextContentElement, SVGNames::lengthAdjustAttr, LengthAdjust, lengthAdjust)
 DEFINE_ANIMATED_BOOLEAN(SVGTextContentElement, SVGNames::externalResourcesRequiredAttr, ExternalResourcesRequired, externalResourcesRequired)
 
 SVGTextContentElement::SVGTextContentElement(const QualifiedName& tagName, Document* document)
     : SVGStyledElement(tagName, document)
+    , m_specifiedTextLength(LengthModeOther)
     , m_textLength(LengthModeOther)
     , m_lengthAdjust(LENGTHADJUST_SPACING)
 {
 }
 
+void SVGTextContentElement::synchronizeTextLength()
+{
+    if (!m_textLength.shouldSynchronize)
+        return;
+    AtomicString value(SVGPropertyTraits<SVGLength>::toString(m_specifiedTextLength));
+    SVGAnimatedPropertySynchronizer<true>::synchronize(this, SVGNames::textLengthAttr, value);
+}
+
+PassRefPtr<SVGAnimatedLength> SVGTextContentElement::textLengthAnimated()
+{
+    DEFINE_STATIC_LOCAL(SVGLength, defaultTextLength, (LengthModeOther));
+    if (m_specifiedTextLength == defaultTextLength) {
+        ExceptionCode ec = 0;
+        m_textLength.value.newValueSpecifiedUnits(LengthTypeNumber, getComputedTextLength(), ec);
+        ASSERT(!ec);
+    }
+
+    m_textLength.shouldSynchronize = true;
+    return SVGAnimatedProperty::lookupOrCreateWrapper<SVGAnimatedLength, SVGLength>(this, SVGNames::textLengthAttr, SVGNames::textLengthAttr.localName(), m_textLength.value);
+}
+
 unsigned SVGTextContentElement::getNumberOfChars() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
@@ -165,8 +187,8 @@ void SVGTextContentElement::parseMappedAttribute(Attribute* attr)
         else if (attr->value() == "spacingAndGlyphs")
             setLengthAdjustBaseValue(LENGTHADJUST_SPACINGANDGLYPHS);
     } else if (attr->name() == SVGNames::textLengthAttr) {
-        setTextLengthBaseValue(SVGLength(LengthModeOther, attr->value()));
-        if (textLengthBaseValue().value(this) < 0.0)
+        m_textLength.value = SVGLength(LengthModeOther, attr->value());
+        if (m_textLength.value.value(this) < 0)
             document()->accessSVGExtensions()->reportError("A negative value for text attribute <textLength> is not allowed");
     } else {
         if (SVGTests::parseMappedAttribute(attr))
@@ -218,7 +240,16 @@ void SVGTextContentElement::svgAttributeChanged(const QualifiedName& attrName)
     if (SVGTests::handleAttributeChange(this, attrName))
         return;
 
-    // FIXME: also handle attribute changes for lengthAdjust and textLength
+    if (attrName == SVGNames::textLengthAttr)
+        m_specifiedTextLength = m_textLength.value;
+
+    RenderObject* renderer = this->renderer();
+    if (!renderer)
+        return;
+
+    if (attrName == SVGNames::textLengthAttr
+        || attrName == SVGNames::lengthAdjustAttr)
+        RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
 }
 
 void SVGTextContentElement::fillPassedAttributeToPropertyTypeMap(AttributeToPropertyTypeMap& attributeToPropertyTypeMap)
@@ -229,15 +260,6 @@ void SVGTextContentElement::fillPassedAttributeToPropertyTypeMap(AttributeToProp
     attributeToPropertyTypeMap.set(SVGNames::lengthAdjustAttr, AnimatedEnumeration);
 }
 
-bool SVGTextContentElement::isKnownAttribute(const QualifiedName& attrName)
-{
-    return attrName.matches(SVGNames::lengthAdjustAttr)
-            || attrName.matches(SVGNames::textLengthAttr)
-            || SVGLangSpace::isKnownAttribute(attrName)
-            || SVGExternalResourcesRequired::isKnownAttribute(attrName)
-            || SVGStyledElement::isKnownAttribute(attrName);
-}
-
 bool SVGTextContentElement::selfHasRelativeLengths() const
 {
     // Any element of the <text> subtree is advertized as using relative lengths.
diff --git a/Source/WebCore/svg/SVGTextContentElement.h b/Source/WebCore/svg/SVGTextContentElement.h
index 7abffd8..94bba70 100644
--- a/Source/WebCore/svg/SVGTextContentElement.h
+++ b/Source/WebCore/svg/SVGTextContentElement.h
@@ -53,10 +53,13 @@ public:
     int getCharNumAtPosition(const FloatPoint&) const;
     void selectSubString(unsigned charnum, unsigned nchars, ExceptionCode&) const;
 
-    bool isKnownAttribute(const QualifiedName&);
-
     static SVGTextContentElement* elementFromRenderer(RenderObject*);
 
+    // textLength is not declared using the standard DECLARE_ANIMATED_LENGTH macro
+    // as its getter needs special handling (return getComputedTextLength(), instead of m_textLength).
+    SVGLength& specifiedTextLength() { return m_specifiedTextLength; }
+    PassRefPtr<SVGAnimatedLength> textLengthAnimated();
+
 protected:
     SVGTextContentElement(const QualifiedName&, Document*);
 
@@ -73,7 +76,9 @@ private:
     virtual bool isTextContent() const { return true; }
 
     // Animated property declarations
-    DECLARE_ANIMATED_LENGTH(TextLength, textLength)
+    void synchronizeTextLength();
+    SVGLength m_specifiedTextLength;
+    mutable SVGSynchronizableAnimatedProperty<SVGLength> m_textLength;
     DECLARE_ANIMATED_ENUMERATION(LengthAdjust, lengthAdjust)
 
     // SVGExternalResourcesRequired
diff --git a/Source/WebCore/svg/SVGTextPathElement.cpp b/Source/WebCore/svg/SVGTextPathElement.cpp
index 1bfc12c..3f232e5 100644
--- a/Source/WebCore/svg/SVGTextPathElement.cpp
+++ b/Source/WebCore/svg/SVGTextPathElement.cpp
@@ -83,7 +83,6 @@ void SVGTextPathElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
 
     if (attrName == SVGNames::startOffsetAttr
-        || SVGTextContentElement::isKnownAttribute(attrName)
         || SVGURIReference::isKnownAttribute(attrName))
         RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer());
 }
diff --git a/Source/WebCore/svg/SVGTextPositioningElement.cpp b/Source/WebCore/svg/SVGTextPositioningElement.cpp
index a96f0cb..cd714c3 100644
--- a/Source/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/Source/WebCore/svg/SVGTextPositioningElement.cpp
@@ -120,9 +120,6 @@ void SVGTextPositioningElement::svgAttributeChanged(const QualifiedName& attrNam
         RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
         return;
     }
-
-    if (SVGTextContentElement::isKnownAttribute(attrName))
-        RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
 }
 
 void SVGTextPositioningElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
diff --git a/Source/WebCore/svg/SVGTitleElement.cpp b/Source/WebCore/svg/SVGTitleElement.cpp
index ebcddb4..d925603 100644
--- a/Source/WebCore/svg/SVGTitleElement.cpp
+++ b/Source/WebCore/svg/SVGTitleElement.cpp
@@ -40,7 +40,8 @@ void SVGTitleElement::insertedIntoDocument()
 {
     SVGStyledElement::insertedIntoDocument();
     if (firstChild())
-        document()->setTitleElement(textContent(), this);
+        // FIXME: does SVG have a title text direction?
+        document()->setTitleElement(StringWithDirection(textContent(), LTR), this);
 }
 
 void SVGTitleElement::removedFromDocument()
@@ -53,7 +54,8 @@ void SVGTitleElement::childrenChanged(bool changedByParser, Node* beforeChange,
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     if (inDocument())
-        document()->setTitleElement(textContent(), this);
+        // FIXME: does SVG have title text direction?
+        document()->setTitleElement(StringWithDirection(textContent(), LTR), this);
 }
 
 AttributeToPropertyTypeMap& SVGTitleElement::attributeToPropertyTypeMap()
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index 21f0954..981bc9c 100644
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -475,6 +475,7 @@ void SVGUseElement::buildPendingResource()
     if (m_isPendingResource) {
         ASSERT(!m_targetElementInstance);
         m_isPendingResource = false;    
+        m_resourceId = String();
         invalidateShadowTree();
     }
 }
diff --git a/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h b/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
index 5fbaf9e..610fb14 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
@@ -80,19 +80,7 @@ struct SVGAnimatedPropertyDescriptionHash {
     static const bool safeToCompareToEmptyOrDeleted = true;
 };
 
-struct SVGAnimatedPropertyDescriptionHashTraits : WTF::GenericHashTraits<SVGAnimatedPropertyDescription> {
-    static const bool emptyValueIsZero = true;
-
-    static void constructDeletedValue(SVGAnimatedPropertyDescription& slot)
-    {
-        new (&slot) SVGAnimatedPropertyDescription(WTF::HashTableDeletedValue);
-    }
-
-    static bool isDeletedValue(const SVGAnimatedPropertyDescription& value)
-    {
-        return value.isHashTableDeletedValue();
-    }
-};
+struct SVGAnimatedPropertyDescriptionHashTraits : WTF::SimpleClassHashTraits<SVGAnimatedPropertyDescription> { };
  
 }
 
diff --git a/Source/WebCore/thirdparty/README.txt b/Source/WebCore/thirdparty/README.txt
deleted file mode 100644
index 311e10a..0000000
--- a/Source/WebCore/thirdparty/README.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-This directory is intended to contain copies of third-party libraries used
-by WebCore, in particular those which may require some modification in
-order to incorporate.
-
-The current convention is to fully scope the include paths of headers, in
-order to avoid collisions with other WebCore headers. For example, a file
-in WebCore using the GLU tessellator sources would use
-
-#include "thirdparty/glu/internal_glu.h"
-
-Header references in source files in this directory need to be similarly
-modified.
diff --git a/Source/WebCore/thirdparty/glu/LICENSE.txt b/Source/WebCore/thirdparty/glu/LICENSE.txt
deleted file mode 100644
index e58ae38..0000000
--- a/Source/WebCore/thirdparty/glu/LICENSE.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-SGI FREE SOFTWARE LICENSE B (Version 2.0, Sept. 18, 2008) 
-
-Copyright (C) [dates of first publication] Silicon Graphics, Inc. All
-Rights Reserved.
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice including the dates of first publication
-and either this permission notice or a reference to HYPERLINK
-"http://oss.sgi.com/projects/FreeB/"http://oss.sgi.com/projects/FreeB/
-shall be included in all copies or substantial portions of the
-Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL SILICON GRAPHICS, INC. BE LIABLE
-FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
-CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-Except as contained in this notice, the name of Silicon Graphics,
-Inc. shall not be used in advertising or otherwise to promote the
-sale, use or other dealings in this Software without prior written
-authorization from Silicon Graphics, Inc.
diff --git a/Source/WebCore/thirdparty/glu/README.webkit b/Source/WebCore/thirdparty/glu/README.webkit
deleted file mode 100644
index 57c4772..0000000
--- a/Source/WebCore/thirdparty/glu/README.webkit
+++ /dev/null
@@ -1,42 +0,0 @@
-This is a nearly verbatim copy of the GLU tessellator source code from
-SGI's OpenGL Sample Implementation at
-http://oss.sgi.com/projects/ogl-sample/ . Per
-http://oss.sgi.com/projects/FreeB/ , the code is covered under the SGI
-Free Software License B, version 2.0, a copy of which is in
-LICENSE.txt in this directory.
-
-The following changes were made in order to incorporate this code:
-
-  - The addition of a simplified gluos.h to eliminate operating system
-    dependencies.
-
-  - The removal of inclusion of GL/glu.h and replacement with an
-    include of internal_glu.h.
-
-  - Includes were modified to be scoped within thirdparty/glu/ and
-    thirdparty/glu/libtess/.
-
-  - The entry points to the tessellator were prefixed with internal_
-    to avoid symbol collisions with any host OS version of GLU.
-
-  - In tess.c, the obsolete entry points gluBeginPolygon,
-    gluNextContour and gluEndPolygon in tess.c were #if 0'd out.
-    Default branches were added to the switch statements in GotoState.
-
-  - In memalloc.h, the include of malloc.h was changed to an include
-    of stdlib.h.
-
-  - In normal.c, an unused variable "w" was removed from
-    __gl_projectPolygon. #if guards were placed around the definition
-    of the unused Normalize function.
-
-  - In priorityq-heap.c, an #include of <limits.h> was added.
-
-  - In sweep.c, IsWindingInside() was given a return value to silence a
-    warning-as-error in release builds.
-
-  - In sweep.c, DoneEdgeDict()'s fixedEdges was wrapped in #indef NDEBUG, to
-    silence a warning-as-error in release builds.
-
-  - In priorityq.c, render.c, and others:  the construct "if(1)...else" was
-  replaced with "do{...}while(1)" to silence a warning-as-error in Mac builds.
diff --git a/Source/WebCore/thirdparty/glu/internal_glu.h b/Source/WebCore/thirdparty/glu/internal_glu.h
deleted file mode 100644
index d695b0b..0000000
--- a/Source/WebCore/thirdparty/glu/internal_glu.h
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright 2010, Google Inc.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-// This header is a skeleton substitute for GL/glu.h which contains
-// only the definitions, constants and function declarations necessary
-// to compile the GLU tessellator.
-
-#ifndef INTERNAL_GLU_H_
-#define INTERNAL_GLU_H_
-
-#include "thirdparty/glu/gluos.h"
-
-/* Primitives */
-#define GL_LINE_LOOP                            0x0002
-#define GL_TRIANGLES                            0x0004
-#define GL_TRIANGLE_STRIP                       0x0005
-#define GL_TRIANGLE_FAN                         0x0006
-
-/* ErrorCode */
-#define GLU_INVALID_ENUM                     100900
-#define GLU_INVALID_VALUE                    100901
-#define GLU_OUT_OF_MEMORY                    100902
-
-/* TessCallback */
-#define GLU_TESS_BEGIN                       100100
-#define GLU_BEGIN                            100100
-#define GLU_TESS_VERTEX                      100101
-#define GLU_VERTEX                           100101
-#define GLU_TESS_END                         100102
-#define GLU_END                              100102
-#define GLU_TESS_ERROR                       100103
-#define GLU_TESS_EDGE_FLAG                   100104
-#define GLU_EDGE_FLAG                        100104
-#define GLU_TESS_COMBINE                     100105
-#define GLU_TESS_BEGIN_DATA                  100106
-#define GLU_TESS_VERTEX_DATA                 100107
-#define GLU_TESS_END_DATA                    100108
-#define GLU_TESS_ERROR_DATA                  100109
-#define GLU_TESS_EDGE_FLAG_DATA              100110
-#define GLU_TESS_COMBINE_DATA                100111
-
-/* TessContour */
-#define GLU_CW                               100120
-#define GLU_CCW                              100121
-#define GLU_INTERIOR                         100122
-#define GLU_EXTERIOR                         100123
-#define GLU_UNKNOWN                          100124
-
-/* TessProperty */
-#define GLU_TESS_WINDING_RULE                100140
-#define GLU_TESS_BOUNDARY_ONLY               100141
-#define GLU_TESS_TOLERANCE                   100142
-
-/* TessError */
-#define GLU_TESS_ERROR1                      100151
-#define GLU_TESS_ERROR2                      100152
-#define GLU_TESS_ERROR3                      100153
-#define GLU_TESS_ERROR4                      100154
-#define GLU_TESS_ERROR5                      100155
-#define GLU_TESS_ERROR6                      100156
-#define GLU_TESS_ERROR7                      100157
-#define GLU_TESS_ERROR8                      100158
-#define GLU_TESS_MISSING_BEGIN_POLYGON       100151
-#define GLU_TESS_MISSING_BEGIN_CONTOUR       100152
-#define GLU_TESS_MISSING_END_POLYGON         100153
-#define GLU_TESS_MISSING_END_CONTOUR         100154
-#define GLU_TESS_COORD_TOO_LARGE             100155
-#define GLU_TESS_NEED_COMBINE_CALLBACK       100156
-
-/* TessWinding */
-#define GLU_TESS_WINDING_ODD                 100130
-#define GLU_TESS_WINDING_NONZERO             100131
-#define GLU_TESS_WINDING_POSITIVE            100132
-#define GLU_TESS_WINDING_NEGATIVE            100133
-#define GLU_TESS_WINDING_ABS_GEQ_TWO         100134
-
-#define GLU_TESS_MAX_COORD 1.0e150
-
-typedef struct GLUtesselator GLUtesselator;
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-extern GLUtesselator * GLAPIENTRY internal_gluNewTess(void);
-extern void GLAPIENTRY internal_gluDeleteTess(GLUtesselator *tess);
-extern void GLAPIENTRY internal_gluTessProperty(GLUtesselator *tess,
-                                                GLenum which,
-                                                GLdouble value);
-extern void GLAPIENTRY internal_gluGetTessProperty(GLUtesselator *tess,
-                                                   GLenum which,
-                                                   GLdouble *value);
-extern void GLAPIENTRY internal_gluTessNormal(GLUtesselator *tess,
-                                              GLdouble x,
-                                              GLdouble y,
-                                              GLdouble z);
-extern void GLAPIENTRY internal_gluTessCallback(GLUtesselator *tess,
-                                                GLenum which,
-                                                void (GLAPIENTRY *fn)());
-extern void GLAPIENTRY internal_gluTessVertex(GLUtesselator *tess,
-                                              GLdouble coords[3],
-                                              void *data);
-extern void GLAPIENTRY internal_gluTessBeginPolygon(GLUtesselator *tess,
-                                                    void *data);
-extern void GLAPIENTRY internal_gluTessBeginContour(GLUtesselator *tess);
-extern void GLAPIENTRY internal_gluTessEndContour(GLUtesselator *tess);
-extern void GLAPIENTRY internal_gluTessEndPolygon(GLUtesselator *tess);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif  // INTERNAL_GLU_H_
diff --git a/Source/WebCore/thirdparty/glu/libtess/GNUmakefile b/Source/WebCore/thirdparty/glu/libtess/GNUmakefile
deleted file mode 100644
index 0ae859f..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/GNUmakefile
+++ /dev/null
@@ -1,110 +0,0 @@
-#!gmake
-#
-# License Applicability. Except to the extent portions of this file are
-# made subject to an alternative license as permitted in the SGI Free
-# Software License B, Version 1.1 (the "License"), the contents of this
-# file are subject only to the provisions of the License. You may not use
-# this file except in compliance with the License. You may obtain a copy
-# of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-# Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-#
-# http://oss.sgi.com/projects/FreeB
-#
-# Note that, as provided in the License, the Software is distributed on an
-# "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-# DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-# CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-# PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-#
-# Original Code. The Original Code is: OpenGL Sample Implementation,
-# Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-# Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-# Copyright in any portions created by third parties is as indicated
-# elsewhere herein. All Rights Reserved.
-#
-# Additional Notice Provisions: The application programming interfaces
-# established by SGI in conjunction with the Original Code are The
-# OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-# April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-# 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-# Window System(R) (Version 1.3), released October 19, 1998. This software
-# was created using the OpenGL(R) version 1.2.1 Sample Implementation
-# published by SGI, but has not been independently verified as being
-# compliant with the OpenGL(R) version 1.2.1 Specification.
-#
-# $Date$ $Revision$
-# $Header: //depot/main/gfx/lib/glu/libtess/GNUmakefile#9 $
-
-OBJECT_STYLE = N32
-
-include $(ROOT)/usr/include/make/commondefs
-
-TARGET = libtess.a
-
-TARGETS = $(TARGET)
-
-LCINCS = -I../include
-
-# Compilation flags:
-#
-# -DNDEBUG is for the production code; it removes all assertion checks
-#    (note that <assert.h> looks at this symbol).
-#
-# -DNO_MALLOPT uses regular malloc instead of the mallopt() version.
-#   ***** Unless you use this flag, you must use "-lmalloc" to link
-#   ***** your application!
-#
-# -DMEMORY_DEBUG turns on the M_DEBUG option of mallopt; this can
-#    increase the running time a LOT.
-#
-# -DGLU_TESS_API_FLOAT compiles a single-precision version of the library.
-#
-# -float prevents automatic promotion to double precision; this will produce
-#    faster code when compiled with -DGLU_TESS_API_FLOAT.
-#
-# -DNO_BRANCH_CONDITIONS uses & and | instead of && and || on a couple
-#    of heavily-used tests (VertEq and VertLeq); some compilers can generate
-#    better code with these (use special instructions to avoid branching).
-#
-# -DFOR_TRITE_TEST_PROGRAM is *only* for use with the test program called
-#    "trite".  It uses some variables which are defined by the test program,
-#    so you won't be able to link it with anything else.
-
-HFILES = \
-	dict.h \
-	dict-list.h \
-	geom.h \
-	memalloc.h \
-	mesh.h \
-	normal.h \
-	priorityq-heap.h \
-	priorityq-heap.c \
-	priorityq-sort.h \
-	priorityq.h \
-	render.h \
-	sweep.h \
-	tess.h \
-	tessmono.h \
-	$(NULL)
-
-CFILES = \
-	dict.c \
-	geom.c \
-	memalloc.c \
-	mesh.c \
-	normal.c \
-	priorityq.c \
-	render.c \
-	sweep.c \
-	tess.c \
-	tessmono.c \
-	$(NULL)
-
-default libs libs_install install: $(TARGET)
-
-headers headers_install apps:
-
-$(TARGET): $(OBJECTS)
-	$(AR) crl $@ $(OBJECTS);
-
-include $(COMMONRULES)
diff --git a/Source/WebCore/thirdparty/glu/libtess/Imakefile b/Source/WebCore/thirdparty/glu/libtess/Imakefile
deleted file mode 100644
index fb99ce2..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/Imakefile
+++ /dev/null
@@ -1,61 +0,0 @@
-XCOMM License Applicability. Except to the extent portions of this file are
-XCOMM made subject to an alternative license as permitted in the SGI Free
-XCOMM Software License B, Version 1.1 (the "License"), the contents of this
-XCOMM file are subject only to the provisions of the License. You may not use
-XCOMM this file except in compliance with the License. You may obtain a copy
-XCOMM of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-XCOMM Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-XCOMM 
-XCOMM http://oss.sgi.com/projects/FreeB
-XCOMM 
-XCOMM Note that, as provided in the License, the Software is distributed on an
-XCOMM "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-XCOMM DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-XCOMM CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-XCOMM PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-XCOMM 
-XCOMM Original Code. The Original Code is: OpenGL Sample Implementation,
-XCOMM Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-XCOMM Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-XCOMM Copyright in any portions created by third parties is as indicated
-XCOMM elsewhere herein. All Rights Reserved.
-XCOMM 
-XCOMM Additional Notice Provisions: The application programming interfaces
-XCOMM established by SGI in conjunction with the Original Code are The
-XCOMM OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-XCOMM April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-XCOMM 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-XCOMM Window System(R) (Version 1.3), released October 19, 1998. This software
-XCOMM was created using the OpenGL(R) version 1.2.1 Sample Implementation
-XCOMM published by SGI, but has not been independently verified as being
-XCOMM compliant with the OpenGL(R) version 1.2.1 Specification.
-XCOMM
-
-#include <Library.tmpl>
-
-OBJS = \
-	dict.o \
-	geom.o \
-	memalloc.o \
-	mesh.o \
-	normal.o \
-	priorityq.o \
-	render.o \
-	sweep.o \
-	tess.o \
-	tessmono.o
-
-INCLUDES = \
-	-I../include \
-	-I$(TOP)/include \
-	-I$(TOP)/include/GL
-
-DEFINES = \
-	-DNDEBUG
-
-NormalLibraryObjectRule()
-
-NormalLibraryTarget(tess, $(OBJS))
-
-DependTarget()
-CleanTarget()
diff --git a/Source/WebCore/thirdparty/glu/libtess/README b/Source/WebCore/thirdparty/glu/libtess/README
deleted file mode 100644
index 59f4ff2..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/README
+++ /dev/null
@@ -1,447 +0,0 @@
-/*
-** $Header: /cvs/projects/ogl-sample/main/gfx/lib/glu/libtess/README,v 1.1 2000/04/26 05:53:59 ljp Exp $
-*/
-
-General Polygon Tesselation
----------------------------
-
-  This note describes a tesselator for polygons consisting of one or
-  more closed contours.  It is backward-compatible with the current
-  OpenGL Utilities tesselator, and is intended to replace it.  Here is
-  a summary of the major differences:
-
-   - input contours can be intersecting, self-intersecting, or degenerate.
-  
-   - supports a choice of several winding rules for determining which parts
-     of the polygon are on the "interior".  This makes it possible to do
-     CSG operations on polygons.
-  
-   - boundary extraction: instead of tesselating the polygon, returns a
-     set of closed contours which separate the interior from the exterior.
-  
-   - returns the output as a small number of triangle fans and strips,
-     rather than a list of independent triangles (when possible).
-  
-   - output is available as an explicit mesh (a quad-edge structure),
-     in addition to the normal callback interface.
-  
-   - the algorithm used is extremely robust.
-
-
-The interface
--------------
-
-  The tesselator state is maintained in a "tesselator object".
-  These are allocated and destroyed using
-
-     GLUtesselator *gluNewTess( void );
-     void gluDeleteTess( GLUtesselator *tess );
-
-  Several tesselator objects may be used simultaneously.
-
-  Inputs
-  ------
-  
-  The input contours are specified with the following routines:
-
-     void gluTessBeginPolygon( GLUtesselator *tess );
-     void gluTessBeginContour( GLUtesselator *tess );
-     void gluTessVertex( GLUtesselator *tess, GLUcoord coords[3], void *data );
-     void gluTessEndContour( GLUtesselator *tess );
-     void gluTessEndPolygon( GLUtesselator *tess );
-
-  Within each BeginPolygon/EndPolygon pair, there can be zero or more
-  calls to BeginContour/EndContour.  Within each contour, there are zero
-  or more calls to gluTessVertex().  The vertices specify a closed
-  contour (the last vertex of each contour is automatically linked to
-  the first).
-
-  "coords" give the coordinates of the vertex in 3-space.  For useful
-  results, all vertices should lie in some plane, since the vertices
-  are projected onto a plane before tesselation.  "data" is a pointer
-  to a user-defined vertex structure, which typically contains other
-  information such as color, texture coordinates, normal, etc.  It is
-  used to refer to the vertex during rendering.
-
-  The library can be compiled in single- or double-precision; the type
-  GLUcoord represents either "float" or "double" accordingly.  The GLU
-  version will be available in double-precision only.  Compile with
-  GLU_TESS_API_FLOAT defined to get the single-precision version.
-
-  When EndPolygon is called, the tesselation algorithm determines
-  which regions are interior to the given contours, according to one
-  of several "winding rules" described below.  The interior regions
-  are then tesselated, and the output is provided as callbacks.
-
-
-  Rendering Callbacks
-  -------------------
-
-  Callbacks are specified by the client using
-
-     void gluTessCallback( GLUtesselator *tess, GLenum which, void (*fn)());
-
-  If "fn" is NULL, any previously defined callback is discarded.
-  
-  The callbacks used to provide output are:	/* which == */
-
-     void begin( GLenum type );			/* GLU_TESS_BEGIN */
-     void edgeFlag( GLboolean flag );		/* GLU_TESS_EDGE_FLAG */
-     void vertex( void *data );			/* GLU_TESS_VERTEX */
-     void end( void );				/* GLU_TESS_END */
-
-  Any of the callbacks may be left undefined; if so, the corresponding
-  information will not be supplied during rendering.
-
-  The "begin" callback indicates the start of a primitive; type is one
-  of GL_TRIANGLE_STRIP, GL_TRIANGLE_FAN, or GL_TRIANGLES (but see the
-  notes on "boundary extraction" below).
-  
-  It is followed by any number of "vertex" callbacks, which supply the
-  vertices in the same order as expected by the corresponding glBegin()
-  call.  After the last vertex of a given primitive, there is a callback
-  to "end".
-
-  If the "edgeFlag" callback is provided, no triangle fans or strips
-  will be used.  When edgeFlag is called, if "flag" is GL_TRUE then each
-  vertex which follows begins an edge which lies on the polygon boundary
-  (ie. an edge which separates an interior region from an exterior one).
-  If "flag" is GL_FALSE, each vertex which follows begins an edge which lies
-  in the polygon interior.  "edgeFlag" will be called before the first
-  call to "vertex".
-
-  Other Callbacks
-  ---------------
-
-   void mesh( GLUmesh *mesh );			/* GLU_TESS_MESH */
-
-   - Returns an explicit mesh, represented using the quad-edge structure
-     (Guibas/Stolfi '85).  Other implementations of this interface might
-     use a different mesh structure, so this is available only only as an
-     SGI extension.  When the mesh is no longer needed, it should be freed
-     using
-
-	void gluDeleteMesh( GLUmesh *mesh );
-
-     There is a brief description of this data structure in the include
-     file "mesh.h".  For the full details, see L. Guibas and J. Stolfi,
-     Primitives for the manipulation of general subdivisions and the
-     computation of Voronoi diagrams, ACM Transactions on Graphics,
-     4(2):74-123, April 1985.  For an introduction, see the course notes
-     for CS348a, "Mathematical Foundations of Computer Graphics",
-     available at the Stanford bookstore (and taught during the fall
-     quarter).
-
-   void error( GLenum errno );			/* GLU_TESS_ERROR */
-
-   - errno is one of	GLU_TESS_MISSING_BEGIN_POLYGON,
-			GLU_TESS_MISSING_END_POLYGON,
-			GLU_TESS_MISSING_BEGIN_CONTOUR,
-			GLU_TESS_MISSING_END_CONTOUR,
-			GLU_TESS_COORD_TOO_LARGE,
-			GLU_TESS_NEED_COMBINE_CALLBACK
-
-     The first four are obvious.  The interface recovers from these
-     errors by inserting the missing call(s).
-  
-     GLU_TESS_COORD_TOO_LARGE says that some vertex coordinate exceeded
-     the predefined constant GLU_TESS_MAX_COORD in absolute value, and
-     that the value has been clamped.  (Coordinate values must be small
-     enough so that two can be multiplied together without overflow.)
-
-     GLU_TESS_NEED_COMBINE_CALLBACK says that the algorithm detected an
-     intersection between two edges in the input data, and the "combine"
-     callback (below) was not provided.  No output will be generated.
-
-
-   void combine( GLUcoord coords[3], void *data[4],	/* GLU_TESS_COMBINE */
-		 GLUcoord weight[4], void **outData );
-
-   - When the algorithm detects an intersection, or wishes to merge
-     features, it needs to create a new vertex.  The vertex is defined
-     as a linear combination of up to 4 existing vertices, referenced
-     by data[0..3].  The coefficients of the linear combination are
-     given by weight[0..3]; these weights always sum to 1.0.  All vertex
-     pointers are valid even when some of the weights are zero.
-     "coords" gives the location of the new vertex.
-
-     The user must allocate another vertex, interpolate parameters
-     using "data" and "weights", and return the new vertex pointer in
-     "outData".  This handle is supplied during rendering callbacks.
-     For example, if the polygon lies in an arbitrary plane in 3-space,
-     and we associate a color with each vertex, the combine callback might
-     look like this:
-    
-     void myCombine( GLUcoord coords[3], VERTEX *d[4],
-                     GLUcoord w[4], VERTEX **dataOut )
-     {
-        VERTEX *new = new_vertex();
-       
-        new->x = coords[0];
-        new->y = coords[1];
-        new->z = coords[2];
-        new->r = w[0]*d[0]->r + w[1]*d[1]->r + w[2]*d[2]->r + w[3]*d[3]->r;
-        new->g = w[0]*d[0]->g + w[1]*d[1]->g + w[2]*d[2]->g + w[3]*d[3]->g;
-        new->b = w[0]*d[0]->b + w[1]*d[1]->b + w[2]*d[2]->b + w[3]*d[3]->b;
-        new->a = w[0]*d[0]->a + w[1]*d[1]->a + w[2]*d[2]->a + w[3]*d[3]->a;
-        *dataOut = new;
-     }
-
-     If the algorithm detects an intersection, then the "combine" callback
-     must be defined, and must write a non-NULL pointer into "dataOut".
-     Otherwise the GLU_TESS_NEED_COMBINE_CALLBACK error occurs, and no
-     output is generated.  This is the only error that can occur during
-     tesselation and rendering.
-
-
-  Control over Tesselation
-  ------------------------
-  
-   void gluTessProperty( GLUtesselator *tess, GLenum which, GLUcoord value );
-
-   Properties defined:
-
-    - GLU_TESS_WINDING_RULE.  Possible values:
-
-	  GLU_TESS_WINDING_ODD
-	  GLU_TESS_WINDING_NONZERO
-	  GLU_TESS_WINDING_POSITIVE
-	  GLU_TESS_WINDING_NEGATIVE
-	  GLU_TESS_WINDING_ABS_GEQ_TWO
-
-      The input contours parition the plane into regions.  A winding
-      rule determines which of these regions are inside the polygon.
-      
-      For a single contour C, the winding number of a point x is simply
-      the signed number of revolutions we make around x as we travel
-      once around C (where CCW is positive).  When there are several
-      contours, the individual winding numbers are summed.  This
-      procedure associates a signed integer value with each point x in
-      the plane.  Note that the winding number is the same for all
-      points in a single region.
-
-      The winding rule classifies a region as "inside" if its winding
-      number belongs to the chosen category (odd, nonzero, positive,
-      negative, or absolute value of at least two).  The current GLU
-      tesselator implements the "odd" rule.  The "nonzero" rule is another
-      common way to define the interior.  The other three rules are
-      useful for polygon CSG operations (see below).
-
-    - GLU_TESS_BOUNDARY_ONLY.  Values: TRUE (non-zero) or FALSE (zero).
-
-      If TRUE, returns a set of closed contours which separate the
-      polygon interior and exterior (rather than a tesselation).
-      Exterior contours are oriented CCW with respect to the normal,
-      interior contours are oriented CW.  The GLU_TESS_BEGIN callback
-      uses the type GL_LINE_LOOP for each contour.
-      
-    - GLU_TESS_TOLERANCE.  Value: a real number between 0.0 and 1.0.
-
-      This specifies a tolerance for merging features to reduce the size
-      of the output.  For example, two vertices which are very close to
-      each other might be replaced by a single vertex.  The tolerance
-      is multiplied by the largest coordinate magnitude of any input vertex;
-      this specifies the maximum distance that any feature can move as the
-      result of a single merge operation.  If a single feature takes part
-      in several merge operations, the total distance moved could be larger.
-
-      Feature merging is completely optional; the tolerance is only a hint.
-      The implementation is free to merge in some cases and not in others,
-      or to never merge features at all.  The default tolerance is zero.
-      
-      The current implementation merges vertices only if they are exactly
-      coincident, regardless of the current tolerance.  A vertex is
-      spliced into an edge only if the implementation is unable to
-      distinguish which side of the edge the vertex lies on.
-      Two edges are merged only when both endpoints are identical.
-
-
-   void gluTessNormal( GLUtesselator *tess,
-		      GLUcoord x, GLUcoord y, GLUcoord z )
-
-    - Lets the user supply the polygon normal, if known.  All input data
-      is projected into a plane perpendicular to the normal before
-      tesselation.  All output triangles are oriented CCW with
-      respect to the normal (CW orientation can be obtained by
-      reversing the sign of the supplied normal).  For example, if
-      you know that all polygons lie in the x-y plane, call
-      "gluTessNormal(tess, 0.0, 0.0, 1.0)" before rendering any polygons.
-      
-    - If the supplied normal is (0,0,0) (the default value), the
-      normal is determined as follows.  The direction of the normal,
-      up to its sign, is found by fitting a plane to the vertices,
-      without regard to how the vertices are connected.  It is
-      expected that the input data lies approximately in plane;
-      otherwise projection perpendicular to the computed normal may
-      substantially change the geometry.  The sign of the normal is
-      chosen so that the sum of the signed areas of all input contours
-      is non-negative (where a CCW contour has positive area).
-    
-    - The supplied normal persists until it is changed by another
-      call to gluTessNormal.
-
-
-  Backward compatibility with the GLU tesselator
-  ----------------------------------------------
-
-  The preferred interface is the one described above.  The following
-  routines are obsolete, and are provided only for backward compatibility:
-
-    typedef GLUtesselator GLUtriangulatorObj;	/* obsolete name */
-
-    void gluBeginPolygon( GLUtesselator *tess );
-    void gluNextContour( GLUtesselator *tess, GLenum type );
-    void gluEndPolygon( GLUtesselator *tess );
-  
-  "type" is one of GLU_EXTERIOR, GLU_INTERIOR, GLU_CCW, GLU_CW, or
-  GLU_UNKNOWN.  It is ignored by the current GLU tesselator.
-  
-  GLU_BEGIN, GLU_VERTEX, GLU_END, GLU_ERROR, and GLU_EDGE_FLAG are defined
-  as synonyms for GLU_TESS_BEGIN, GLU_TESS_VERTEX, GLU_TESS_END,
-  GLU_TESS_ERROR, and GLU_TESS_EDGE_FLAG.
-
-
-Polygon CSG operations
-----------------------
-
-  The features of the tesselator make it easy to find the union, difference,
-  or intersection of several polygons.
-
-  First, assume that each polygon is defined so that the winding number
-  is 0 for each exterior region, and 1 for each interior region.  Under
-  this model, CCW contours define the outer boundary of the polygon, and
-  CW contours define holes.  Contours may be nested, but a nested
-  contour must be oriented oppositely from the contour that contains it.
-
-  If the original polygons do not satisfy this description, they can be
-  converted to this form by first running the tesselator with the
-  GLU_TESS_BOUNDARY_ONLY property turned on.  This returns a list of
-  contours satisfying the restriction above.  By allocating two
-  tesselator objects, the callbacks from one tesselator can be fed
-  directly to the input of another.
-
-  Given two or more polygons of the form above, CSG operations can be
-  implemented as follows:
-
-  Union
-     Draw all the input contours as a single polygon.  The winding number
-     of each resulting region is the number of original polygons
-     which cover it.  The union can be extracted using the
-     GLU_TESS_WINDING_NONZERO or GLU_TESS_WINDING_POSITIVE winding rules.
-     Note that with the nonzero rule, we would get the same result if
-     all contour orientations were reversed.
-
-  Intersection (two polygons at a time only)
-     Draw a single polygon using the contours from both input polygons.
-     Extract the result using GLU_TESS_WINDING_ABS_GEQ_TWO.  (Since this
-     winding rule looks at the absolute value, reversing all contour
-     orientations does not change the result.)
-
-  Difference
-  
-     Suppose we want to compute A \ (B union C union D).  Draw a single
-     polygon consisting of the unmodified contours from A, followed by
-     the contours of B,C,D with the vertex order reversed (this changes
-     the winding number of the interior regions to -1).  To extract the
-     result, use the GLU_TESS_WINDING_POSITIVE rule.
-   
-     If B,C,D are the result of a GLU_TESS_BOUNDARY_ONLY call, an
-     alternative to reversing the vertex order is to reverse the sign of
-     the supplied normal.  For example in the x-y plane, call
-     gluTessNormal( tess, 0.0, 0.0, -1.0 ).
- 
-
-Performance
------------
-
-  The tesselator is not intended for immediate-mode rendering; when
-  possible the output should be cached in a user structure or display
-  list.  General polygon tesselation is an inherently difficult problem,
-  especially given the goal of extreme robustness.
-
-  The implementation makes an effort to output a small number of fans
-  and strips; this should improve the rendering performance when the
-  output is used in a display list.
-
-  Single-contour input polygons are first tested to see whether they can
-  be rendered as a triangle fan with respect to the first vertex (to
-  avoid running the full decomposition algorithm on convex polygons).
-  Non-convex polygons may be rendered by this "fast path" as well, if
-  the algorithm gets lucky in its choice of a starting vertex.
-
-  For best performance follow these guidelines:
-
-   - supply the polygon normal, if available, using gluTessNormal().
-     This represents about 10% of the computation time.  For example,
-     if all polygons lie in the x-y plane, use gluTessNormal(tess,0,0,1).
-
-   - render many polygons using the same tesselator object, rather than
-     allocating a new tesselator for each one.  (In a multi-threaded,
-     multi-processor environment you may get better performance using
-     several tesselators.)
-
-
-Comparison with the GLU tesselator
-----------------------------------
-
-  On polygons which make it through the "fast path", the tesselator is
-  3 to 5 times faster than the GLU tesselator.
-
-  On polygons which don't make it through the fast path (but which don't
-  have self-intersections or degeneracies), it is about 2 times slower.
-
-  On polygons with self-intersections or degeneraces, there is nothing
-  to compare against.
-
-  The new tesselator generates many more fans and strips, reducing the
-  number of vertices that need to be sent to the hardware.
-
-  Key to the statistics:
-
-	vert		number of input vertices on all contours
-	cntr		number of input contours
-	tri		number of triangles in all output primitives
-	strip		number of triangle strips
-	fan		number of triangle fans
-	ind		number of independent triangles
-	ms		number of milliseconds for tesselation
-			(on a 150MHz R4400 Indy)
-
-  Convex polygon examples:
-
-New:     3 vert,   1 cntr,     1 tri,   0 strip,   0 fan,     1 ind,  0.0459 ms
-Old:     3 vert,   1 cntr,     1 tri,   0 strip,   0 fan,     1 ind,   0.149 ms
-New:     4 vert,   1 cntr,     2 tri,   0 strip,   1 fan,     0 ind,  0.0459 ms
-Old:     4 vert,   1 cntr,     2 tri,   0 strip,   0 fan,     2 ind,   0.161 ms
-New:    36 vert,   1 cntr,    34 tri,   0 strip,   1 fan,     0 ind,   0.153 ms
-Old:    36 vert,   1 cntr,    34 tri,   0 strip,   0 fan,    34 ind,   0.621 ms
-
-  Concave single-contour polygons:
-
-New:     5 vert,   1 cntr,     3 tri,   0 strip,   1 fan,     0 ind,   0.052 ms
-Old:     5 vert,   1 cntr,     3 tri,   0 strip,   0 fan,     3 ind,   0.252 ms
-New:    19 vert,   1 cntr,    17 tri,   2 strip,   2 fan,     1 ind,   0.911 ms
-Old:    19 vert,   1 cntr,    17 tri,   0 strip,   0 fan,    17 ind,   0.529 ms
-New:   151 vert,   1 cntr,   149 tri,  13 strip,  18 fan,     3 ind,    6.82 ms
-Old:   151 vert,   1 cntr,   149 tri,   0 strip,   3 fan,   143 ind,     2.7 ms
-New:   574 vert,   1 cntr,   572 tri,  59 strip,  54 fan,    11 ind,    26.6 ms
-Old:   574 vert,   1 cntr,   572 tri,   0 strip,  31 fan,   499 ind,    12.4 ms
-
-  Multiple contours, but no intersections:
-
-New:     7 vert,   2 cntr,     7 tri,   1 strip,   0 fan,     0 ind,   0.527 ms
-Old:     7 vert,   2 cntr,     7 tri,   0 strip,   0 fan,     7 ind,   0.274 ms
-New:    81 vert,   6 cntr,    89 tri,   9 strip,   7 fan,     6 ind,    3.88 ms
-Old:    81 vert,   6 cntr,    89 tri,   0 strip,  13 fan,    61 ind,     2.2 ms
-New:   391 vert,  19 cntr,   413 tri,  37 strip,  32 fan,    26 ind,    20.2 ms
-Old:   391 vert,  19 cntr,   413 tri,   0 strip,  25 fan,   363 ind,    8.68 ms
-
-  Self-intersecting and degenerate examples:
-
-Bowtie:  4 vert,   1 cntr,     2 tri,   0 strip,   0 fan,     2 ind,   0.483 ms
-Star:    5 vert,   1 cntr,     5 tri,   0 strip,   0 fan,     5 ind,    0.91 ms
-Random: 24 vert,   7 cntr,    46 tri,   2 strip,  12 fan,     7 ind,    5.32 ms
-Font:  333 vert,   2 cntr,   331 tri,  32 strip,  16 fan,     3 ind,    14.1 ms
-:      167 vert,  35 cntr,   254 tri,   8 strip,  56 fan,    52 ind,    46.3 ms
-:       78 vert,   1 cntr,  2675 tri, 148 strip, 207 fan,   180 ind,     243 ms
-:    12480 vert,   2 cntr, 12478 tri, 736 strip,1275 fan,     5 ind,    1010 ms
diff --git a/Source/WebCore/thirdparty/glu/libtess/alg-outline b/Source/WebCore/thirdparty/glu/libtess/alg-outline
deleted file mode 100644
index 91ed7f3..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/alg-outline
+++ /dev/null
@@ -1,229 +0,0 @@
-/*
-** $Header: /cvs/projects/ogl-sample/main/gfx/lib/glu/libtess/alg-outline,v 1.1 2000/04/26 05:53:59 ljp Exp $
-*/
-
-This is only a very brief overview.  There is quite a bit of
-additional documentation in the source code itself.
-
-
-Goals of robust tesselation
----------------------------
-
-The tesselation algorithm is fundamentally a 2D algorithm.  We
-initially project all data into a plane; our goal is to robustly
-tesselate the projected data.  The same topological tesselation is
-then applied to the input data.
-
-Topologically, the output should always be a tesselation.  If the
-input is even slightly non-planar, then some triangles will
-necessarily be back-facing when viewed from some angles, but the goal
-is to minimize this effect.
-
-The algorithm needs some capability of cleaning up the input data as
-well as the numerical errors in its own calculations.  One way to do
-this is to specify a tolerance as defined above, and clean up the
-input and output during the line sweep process.  At the very least,
-the algorithm must handle coincident vertices, vertices incident to an
-edge, and coincident edges.
-
-
-Phases of the algorithm
------------------------
-
-1. Find the polygon normal N.
-2. Project the vertex data onto a plane.  It does not need to be
-   perpendicular to the normal, eg. we can project onto the plane
-   perpendicular to the coordinate axis whose dot product with N
-   is largest.
-3. Using a line-sweep algorithm, partition the plane into x-monotone
-   regions.  Any vertical line intersects an x-monotone region in
-   at most one interval.
-4. Triangulate the x-monotone regions.
-5. Group the triangles into strips and fans.
-
-
-Finding the normal vector
--------------------------
-
-A common way to find a polygon normal is to compute the signed area
-when the polygon is projected along the three coordinate axes.  We
-can't do this, since contours can have zero area without being
-degenerate (eg. a bowtie).
-
-We fit a plane to the vertex data, ignoring how they are connected
-into contours.  Ideally this would be a least-squares fit; however for
-our purpose the accuracy of the normal is not important.  Instead we
-find three vertices which are widely separated, and compute the normal
-to the triangle they form.  The vertices are chosen so that the
-triangle has an area at least 1/sqrt(3) times the largest area of any
-triangle formed using the input vertices.  
-
-The contours do affect the orientation of the normal; after computing
-the normal, we check that the sum of the signed contour areas is
-non-negative, and reverse the normal if necessary.
-
-
-Projecting the vertices
------------------------
-
-We project the vertices onto a plane perpendicular to one of the three
-coordinate axes.  This helps numerical accuracy by removing a
-transformation step between the original input data and the data
-processed by the algorithm.  The projection also compresses the input
-data; the 2D distance between vertices after projection may be smaller
-than the original 2D distance.  However by choosing the coordinate
-axis whose dot product with the normal is greatest, the compression
-factor is at most 1/sqrt(3).
-
-Even though the *accuracy* of the normal is not that important (since
-we are projecting perpendicular to a coordinate axis anyway), the
-*robustness* of the computation is important.  For example, if there
-are many vertices which lie almost along a line, and one vertex V
-which is well-separated from the line, then our normal computation
-should involve V otherwise the results will be garbage.
-
-The advantage of projecting perpendicular to the polygon normal is
-that computed intersection points will be as close as possible to
-their ideal locations.  To get this behavior, define TRUE_PROJECT.
-
-
-The Line Sweep
---------------
-
-There are three data structures: the mesh, the event queue, and the
-edge dictionary.
-
-The mesh is a "quad-edge" data structure which records the topology of
-the current decomposition; for details see the include file "mesh.h".
-
-The event queue simply holds all vertices (both original and computed
-ones), organized so that we can quickly extract the vertex with the
-minimum x-coord (and among those, the one with the minimum y-coord).
-
-The edge dictionary describes the current intersection of the sweep
-line with the regions of the polygon.  This is just an ordering of the
-edges which intersect the sweep line, sorted by their current order of
-intersection.  For each pair of edges, we store some information about
-the monotone region between them -- these are call "active regions"
-(since they are crossed by the current sweep line).
-
-The basic algorithm is to sweep from left to right, processing each
-vertex.  The processed portion of the mesh (left of the sweep line) is
-a planar decomposition.  As we cross each vertex, we update the mesh
-and the edge dictionary, then we check any newly adjacent pairs of
-edges to see if they intersect.
-
-A vertex can have any number of edges.  Vertices with many edges can
-be created as vertices are merged and intersection points are
-computed.  For unprocessed vertices (right of the sweep line), these
-edges are in no particular order around the vertex; for processed
-vertices, the topological ordering should match the geometric ordering.
-
-The vertex processing happens in two phases: first we process are the
-left-going edges (all these edges are currently in the edge
-dictionary).  This involves:
-
- - deleting the left-going edges from the dictionary;
- - relinking the mesh if necessary, so that the order of these edges around
-   the event vertex matches the order in the dictionary;
- - marking any terminated regions (regions which lie between two left-going
-   edges) as either "inside" or "outside" according to their winding number.
-
-When there are no left-going edges, and the event vertex is in an
-"interior" region, we need to add an edge (to split the region into
-monotone pieces).  To do this we simply join the event vertex to the
-rightmost left endpoint of the upper or lower edge of the containing
-region.
-
-Then we process the right-going edges.  This involves:
-
- - inserting the edges in the edge dictionary;
- - computing the winding number of any newly created active regions.
-   We can compute this incrementally using the winding of each edge
-   that we cross as we walk through the dictionary.
- - relinking the mesh if necessary, so that the order of these edges around
-   the event vertex matches the order in the dictionary;
- - checking any newly adjacent edges for intersection and/or merging.
-
-If there are no right-going edges, again we need to add one to split
-the containing region into monotone pieces.  In our case it is most
-convenient to add an edge to the leftmost right endpoint of either
-containing edge; however we may need to change this later (see the
-code for details).
-
-
-Invariants
-----------
-
-These are the most important invariants maintained during the sweep.
-We define a function VertLeq(v1,v2) which defines the order in which
-vertices cross the sweep line, and a function EdgeLeq(e1,e2; loc)
-which says whether e1 is below e2 at the sweep event location "loc".
-This function is defined only at sweep event locations which lie
-between the rightmost left endpoint of {e1,e2}, and the leftmost right
-endpoint of {e1,e2}.
-
-Invariants for the Edge Dictionary.
-
- - Each pair of adjacent edges e2=Succ(e1) satisfies EdgeLeq(e1,e2)
-   at any valid location of the sweep event.
- - If EdgeLeq(e2,e1) as well (at any valid sweep event), then e1 and e2
-   share a common endpoint.
- - For each e in the dictionary, e->Dst has been processed but not e->Org.
- - Each edge e satisfies VertLeq(e->Dst,event) && VertLeq(event,e->Org)
-   where "event" is the current sweep line event.
- - No edge e has zero length.
- - No two edges have identical left and right endpoints.
- 
-Invariants for the Mesh (the processed portion).
-
- - The portion of the mesh left of the sweep line is a planar graph,
-   ie. there is *some* way to embed it in the plane.
- - No processed edge has zero length.
- - No two processed vertices have identical coordinates.
- - Each "inside" region is monotone, ie. can be broken into two chains
-   of monotonically increasing vertices according to VertLeq(v1,v2)
-   - a non-invariant: these chains may intersect (slightly) due to
-     numerical errors, but this does not affect the algorithm's operation.
-
-Invariants for the Sweep.
-
- - If a vertex has any left-going edges, then these must be in the edge
-   dictionary at the time the vertex is processed.
- - If an edge is marked "fixUpperEdge" (it is a temporary edge introduced
-   by ConnectRightVertex), then it is the only right-going edge from
-   its associated vertex.  (This says that these edges exist only
-   when it is necessary.)
-
-
-Robustness
-----------
-
-The key to the robustness of the algorithm is maintaining the
-invariants above, especially the correct ordering of the edge
-dictionary.  We achieve this by:
-
-  1. Writing the numerical computations for maximum precision rather
-     than maximum speed.
-     
-  2. Making no assumptions at all about the results of the edge
-     intersection calculations -- for sufficiently degenerate inputs,
-     the computed location is not much better than a random number.
-     
-  3. When numerical errors violate the invariants, restore them
-     by making *topological* changes when necessary (ie. relinking
-     the mesh structure).
-     
-     
-Triangulation and Grouping
---------------------------
-
-We finish the line sweep before doing any triangulation.  This is
-because even after a monotone region is complete, there can be further
-changes to its vertex data because of further vertex merging.
-
-After triangulating all monotone regions, we want to group the
-triangles into fans and strips.  We do this using a greedy approach.
-The triangulation itself is not optimized to reduce the number of
-primitives; we just try to get a reasonable decomposition of the
-computed triangulation.
diff --git a/Source/WebCore/thirdparty/glu/libtess/dict-list.h b/Source/WebCore/thirdparty/glu/libtess/dict-list.h
deleted file mode 100644
index 9c67c49..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/dict-list.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/dict-list.h#5 $
-*/
-
-#ifndef __dict_list_h_
-#define __dict_list_h_
-
-/* Use #define's so that another heap implementation can use this one */
-
-#define DictKey		DictListKey
-#define Dict		DictList
-#define DictNode	DictListNode
-
-#define dictNewDict(frame,leq)		__gl_dictListNewDict(frame,leq)
-#define dictDeleteDict(dict)		__gl_dictListDeleteDict(dict)
-
-#define dictSearch(dict,key)		__gl_dictListSearch(dict,key)
-#define dictInsert(dict,key)		__gl_dictListInsert(dict,key)
-#define dictInsertBefore(dict,node,key)	__gl_dictListInsertBefore(dict,node,key)
-#define dictDelete(dict,node)		__gl_dictListDelete(dict,node)
-
-#define dictKey(n)			__gl_dictListKey(n)
-#define dictSucc(n)			__gl_dictListSucc(n)
-#define dictPred(n)			__gl_dictListPred(n)
-#define dictMin(d)			__gl_dictListMin(d)
-#define dictMax(d)			__gl_dictListMax(d)
-
-
-
-typedef void *DictKey;
-typedef struct Dict Dict;
-typedef struct DictNode DictNode;
-
-Dict		*dictNewDict(
-			void *frame,
-			int (*leq)(void *frame, DictKey key1, DictKey key2) );
-			
-void		dictDeleteDict( Dict *dict );
-
-/* Search returns the node with the smallest key greater than or equal
- * to the given key.  If there is no such key, returns a node whose
- * key is NULL.  Similarly, Succ(Max(d)) has a NULL key, etc.
- */
-DictNode	*dictSearch( Dict *dict, DictKey key );
-DictNode	*dictInsertBefore( Dict *dict, DictNode *node, DictKey key );
-void		dictDelete( Dict *dict, DictNode *node );
-
-#define		__gl_dictListKey(n)	((n)->key)
-#define		__gl_dictListSucc(n)	((n)->next)
-#define		__gl_dictListPred(n)	((n)->prev)
-#define		__gl_dictListMin(d)	((d)->head.next)
-#define		__gl_dictListMax(d)	((d)->head.prev)
-#define	       __gl_dictListInsert(d,k) (dictInsertBefore((d),&(d)->head,(k)))
-
-
-/*** Private data structures ***/
-
-struct DictNode {
-  DictKey	key;
-  DictNode	*next;
-  DictNode	*prev;
-};
-
-struct Dict {
-  DictNode	head;
-  void		*frame;
-  int		(*leq)(void *frame, DictKey key1, DictKey key2);
-};
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/dict.c b/Source/WebCore/thirdparty/glu/libtess/dict.c
deleted file mode 100644
index 6c3b27a..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/dict.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/dict.c#5 $
-*/
-
-#include <stddef.h>
-#include "thirdparty/glu/libtess/dict-list.h"
-#include "thirdparty/glu/libtess/memalloc.h"
-
-/* really __gl_dictListNewDict */
-Dict *dictNewDict( void *frame,
-		   int (*leq)(void *frame, DictKey key1, DictKey key2) )
-{
-  Dict *dict = (Dict *) memAlloc( sizeof( Dict ));
-  DictNode *head;
-
-  if (dict == NULL) return NULL;
-
-  head = &dict->head;
-
-  head->key = NULL;
-  head->next = head;
-  head->prev = head;
-
-  dict->frame = frame;
-  dict->leq = leq;
-
-  return dict;
-}
-
-/* really __gl_dictListDeleteDict */
-void dictDeleteDict( Dict *dict )
-{
-  DictNode *node;
-
-  for( node = dict->head.next; node != &dict->head; node = node->next ) {
-    memFree( node );
-  }
-  memFree( dict );
-}
-
-/* really __gl_dictListInsertBefore */
-DictNode *dictInsertBefore( Dict *dict, DictNode *node, DictKey key )
-{
-  DictNode *newNode;
-
-  do {
-    node = node->prev;
-  } while( node->key != NULL && ! (*dict->leq)(dict->frame, node->key, key));
-
-  newNode = (DictNode *) memAlloc( sizeof( DictNode ));
-  if (newNode == NULL) return NULL;
-
-  newNode->key = key;
-  newNode->next = node->next;
-  node->next->prev = newNode;
-  newNode->prev = node;
-  node->next = newNode;
-
-  return newNode;
-}
-
-/* really __gl_dictListDelete */
-void dictDelete( Dict *dict, DictNode *node ) /*ARGSUSED*/
-{
-  node->next->prev = node->prev;
-  node->prev->next = node->next;
-  memFree( node );
-}
-
-/* really __gl_dictListSearch */
-DictNode *dictSearch( Dict *dict, DictKey key )
-{
-  DictNode *node = &dict->head;
-
-  do {
-    node = node->next;
-  } while( node->key != NULL && ! (*dict->leq)(dict->frame, key, node->key));
-
-  return node;
-}
diff --git a/Source/WebCore/thirdparty/glu/libtess/dict.h b/Source/WebCore/thirdparty/glu/libtess/dict.h
deleted file mode 100644
index 7851bac..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/dict.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/dict.h#5 $
-*/
-
-#ifndef __dict_list_h_
-#define __dict_list_h_
-
-/* Use #define's so that another heap implementation can use this one */
-
-#define DictKey		DictListKey
-#define Dict		DictList
-#define DictNode	DictListNode
-
-#define dictNewDict(frame,leq)		__gl_dictListNewDict(frame,leq)
-#define dictDeleteDict(dict)		__gl_dictListDeleteDict(dict)
-
-#define dictSearch(dict,key)		__gl_dictListSearch(dict,key)
-#define dictInsert(dict,key)		__gl_dictListInsert(dict,key)
-#define dictInsertBefore(dict,node,key)	__gl_dictListInsertBefore(dict,node,key)
-#define dictDelete(dict,node)		__gl_dictListDelete(dict,node)
-
-#define dictKey(n)			__gl_dictListKey(n)
-#define dictSucc(n)			__gl_dictListSucc(n)
-#define dictPred(n)			__gl_dictListPred(n)
-#define dictMin(d)			__gl_dictListMin(d)
-#define dictMax(d)			__gl_dictListMax(d)
-
-
-
-typedef void *DictKey;
-typedef struct Dict Dict;
-typedef struct DictNode DictNode;
-
-Dict		*dictNewDict(
-			void *frame,
-			int (*leq)(void *frame, DictKey key1, DictKey key2) );
-			
-void		dictDeleteDict( Dict *dict );
-
-/* Search returns the node with the smallest key greater than or equal
- * to the given key.  If there is no such key, returns a node whose
- * key is NULL.  Similarly, Succ(Max(d)) has a NULL key, etc.
- */
-DictNode	*dictSearch( Dict *dict, DictKey key );
-DictNode	*dictInsertBefore( Dict *dict, DictNode *node, DictKey key );
-void		dictDelete( Dict *dict, DictNode *node );
-
-#define		__gl_dictListKey(n)	((n)->key)
-#define		__gl_dictListSucc(n)	((n)->next)
-#define		__gl_dictListPred(n)	((n)->prev)
-#define		__gl_dictListMin(d)	((d)->head.next)
-#define		__gl_dictListMax(d)	((d)->head.prev)
-#define	       __gl_dictListInsert(d,k) (dictInsertBefore((d),&(d)->head,(k)))
-
-
-/*** Private data structures ***/
-
-struct DictNode {
-  DictKey	key;
-  DictNode	*next;
-  DictNode	*prev;
-};
-
-struct Dict {
-  DictNode	head;
-  void		*frame;
-  int		(*leq)(void *frame, DictKey key1, DictKey key2);
-};
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/geom.c b/Source/WebCore/thirdparty/glu/libtess/geom.c
deleted file mode 100644
index ce578dd..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/geom.c
+++ /dev/null
@@ -1,271 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/geom.c#5 $
-*/
-
-#include <assert.h>
-#include "thirdparty/glu/gluos.h"
-#include "thirdparty/glu/libtess/mesh.h"
-#include "thirdparty/glu/libtess/geom.h"
-
-int __gl_vertLeq( GLUvertex *u, GLUvertex *v )
-{
-  /* Returns TRUE if u is lexicographically <= v. */
-
-  return VertLeq( u, v );
-}
-
-GLdouble __gl_edgeEval( GLUvertex *u, GLUvertex *v, GLUvertex *w )
-{
-  /* Given three vertices u,v,w such that VertLeq(u,v) && VertLeq(v,w),
-   * evaluates the t-coord of the edge uw at the s-coord of the vertex v.
-   * Returns v->t - (uw)(v->s), ie. the signed distance from uw to v.
-   * If uw is vertical (and thus passes thru v), the result is zero.
-   *
-   * The calculation is extremely accurate and stable, even when v
-   * is very close to u or w.  In particular if we set v->t = 0 and
-   * let r be the negated result (this evaluates (uw)(v->s)), then
-   * r is guaranteed to satisfy MIN(u->t,w->t) <= r <= MAX(u->t,w->t).
-   */
-  GLdouble gapL, gapR;
-
-  assert( VertLeq( u, v ) && VertLeq( v, w ));
-  
-  gapL = v->s - u->s;
-  gapR = w->s - v->s;
-
-  if( gapL + gapR > 0 ) {
-    if( gapL < gapR ) {
-      return (v->t - u->t) + (u->t - w->t) * (gapL / (gapL + gapR));
-    } else {
-      return (v->t - w->t) + (w->t - u->t) * (gapR / (gapL + gapR));
-    }
-  }
-  /* vertical line */
-  return 0;
-}
-
-GLdouble __gl_edgeSign( GLUvertex *u, GLUvertex *v, GLUvertex *w )
-{
-  /* Returns a number whose sign matches EdgeEval(u,v,w) but which
-   * is cheaper to evaluate.  Returns > 0, == 0 , or < 0
-   * as v is above, on, or below the edge uw.
-   */
-  GLdouble gapL, gapR;
-
-  assert( VertLeq( u, v ) && VertLeq( v, w ));
-  
-  gapL = v->s - u->s;
-  gapR = w->s - v->s;
-
-  if( gapL + gapR > 0 ) {
-    return (v->t - w->t) * gapL + (v->t - u->t) * gapR;
-  }
-  /* vertical line */
-  return 0;
-}
-
-
-/***********************************************************************
- * Define versions of EdgeSign, EdgeEval with s and t transposed.
- */
-
-GLdouble __gl_transEval( GLUvertex *u, GLUvertex *v, GLUvertex *w )
-{
-  /* Given three vertices u,v,w such that TransLeq(u,v) && TransLeq(v,w),
-   * evaluates the t-coord of the edge uw at the s-coord of the vertex v.
-   * Returns v->s - (uw)(v->t), ie. the signed distance from uw to v.
-   * If uw is vertical (and thus passes thru v), the result is zero.
-   *
-   * The calculation is extremely accurate and stable, even when v
-   * is very close to u or w.  In particular if we set v->s = 0 and
-   * let r be the negated result (this evaluates (uw)(v->t)), then
-   * r is guaranteed to satisfy MIN(u->s,w->s) <= r <= MAX(u->s,w->s).
-   */
-  GLdouble gapL, gapR;
-
-  assert( TransLeq( u, v ) && TransLeq( v, w ));
-  
-  gapL = v->t - u->t;
-  gapR = w->t - v->t;
-
-  if( gapL + gapR > 0 ) {
-    if( gapL < gapR ) {
-      return (v->s - u->s) + (u->s - w->s) * (gapL / (gapL + gapR));
-    } else {
-      return (v->s - w->s) + (w->s - u->s) * (gapR / (gapL + gapR));
-    }
-  }
-  /* vertical line */
-  return 0;
-}
-
-GLdouble __gl_transSign( GLUvertex *u, GLUvertex *v, GLUvertex *w )
-{
-  /* Returns a number whose sign matches TransEval(u,v,w) but which
-   * is cheaper to evaluate.  Returns > 0, == 0 , or < 0
-   * as v is above, on, or below the edge uw.
-   */
-  GLdouble gapL, gapR;
-
-  assert( TransLeq( u, v ) && TransLeq( v, w ));
-  
-  gapL = v->t - u->t;
-  gapR = w->t - v->t;
-
-  if( gapL + gapR > 0 ) {
-    return (v->s - w->s) * gapL + (v->s - u->s) * gapR;
-  }
-  /* vertical line */
-  return 0;
-}
-
-
-int __gl_vertCCW( GLUvertex *u, GLUvertex *v, GLUvertex *w )
-{
-  /* For almost-degenerate situations, the results are not reliable.
-   * Unless the floating-point arithmetic can be performed without
-   * rounding errors, *any* implementation will give incorrect results
-   * on some degenerate inputs, so the client must have some way to
-   * handle this situation.
-   */
-  return (u->s*(v->t - w->t) + v->s*(w->t - u->t) + w->s*(u->t - v->t)) >= 0;
-}
-
-/* Given parameters a,x,b,y returns the value (b*x+a*y)/(a+b),
- * or (x+y)/2 if a==b==0.  It requires that a,b >= 0, and enforces
- * this in the rare case that one argument is slightly negative.
- * The implementation is extremely stable numerically.
- * In particular it guarantees that the result r satisfies
- * MIN(x,y) <= r <= MAX(x,y), and the results are very accurate
- * even when a and b differ greatly in magnitude.
- */
-#define RealInterpolate(a,x,b,y)			\
-  (a = (a < 0) ? 0 : a, b = (b < 0) ? 0 : b,		\
-  ((a <= b) ? ((b == 0) ? ((x+y) / 2)			\
-                        : (x + (y-x) * (a/(a+b))))	\
-            : (y + (x-y) * (b/(a+b)))))
-
-#ifndef FOR_TRITE_TEST_PROGRAM
-#define Interpolate(a,x,b,y)	RealInterpolate(a,x,b,y)
-#else
-
-/* Claim: the ONLY property the sweep algorithm relies on is that
- * MIN(x,y) <= r <= MAX(x,y).  This is a nasty way to test that.
- */
-#include <stdlib.h>
-extern int RandomInterpolate;
-
-GLdouble Interpolate( GLdouble a, GLdouble x, GLdouble b, GLdouble y)
-{
-printf("*********************%d\n",RandomInterpolate);
-  if( RandomInterpolate ) {
-    a = 1.2 * drand48() - 0.1;
-    a = (a < 0) ? 0 : ((a > 1) ? 1 : a);
-    b = 1.0 - a;
-  }
-  return RealInterpolate(a,x,b,y);
-}
-
-#endif
-
-#define Swap(a,b)	do { GLUvertex *t = a; a = b; b = t; } while(0)
-
-void __gl_edgeIntersect( GLUvertex *o1, GLUvertex *d1,
-			 GLUvertex *o2, GLUvertex *d2,
-			 GLUvertex *v )
-/* Given edges (o1,d1) and (o2,d2), compute their point of intersection.
- * The computed point is guaranteed to lie in the intersection of the
- * bounding rectangles defined by each edge.
- */
-{
-  GLdouble z1, z2;
-
-  /* This is certainly not the most efficient way to find the intersection
-   * of two line segments, but it is very numerically stable.
-   *
-   * Strategy: find the two middle vertices in the VertLeq ordering,
-   * and interpolate the intersection s-value from these.  Then repeat
-   * using the TransLeq ordering to find the intersection t-value.
-   */
-
-  if( ! VertLeq( o1, d1 )) { Swap( o1, d1 ); }
-  if( ! VertLeq( o2, d2 )) { Swap( o2, d2 ); }
-  if( ! VertLeq( o1, o2 )) { Swap( o1, o2 ); Swap( d1, d2 ); }
-
-  if( ! VertLeq( o2, d1 )) {
-    /* Technically, no intersection -- do our best */
-    v->s = (o2->s + d1->s) / 2;
-  } else if( VertLeq( d1, d2 )) {
-    /* Interpolate between o2 and d1 */
-    z1 = EdgeEval( o1, o2, d1 );
-    z2 = EdgeEval( o2, d1, d2 );
-    if( z1+z2 < 0 ) { z1 = -z1; z2 = -z2; }
-    v->s = Interpolate( z1, o2->s, z2, d1->s );
-  } else {
-    /* Interpolate between o2 and d2 */
-    z1 = EdgeSign( o1, o2, d1 );
-    z2 = -EdgeSign( o1, d2, d1 );
-    if( z1+z2 < 0 ) { z1 = -z1; z2 = -z2; }
-    v->s = Interpolate( z1, o2->s, z2, d2->s );
-  }
-
-  /* Now repeat the process for t */
-
-  if( ! TransLeq( o1, d1 )) { Swap( o1, d1 ); }
-  if( ! TransLeq( o2, d2 )) { Swap( o2, d2 ); }
-  if( ! TransLeq( o1, o2 )) { Swap( o1, o2 ); Swap( d1, d2 ); }
-
-  if( ! TransLeq( o2, d1 )) {
-    /* Technically, no intersection -- do our best */
-    v->t = (o2->t + d1->t) / 2;
-  } else if( TransLeq( d1, d2 )) {
-    /* Interpolate between o2 and d1 */
-    z1 = TransEval( o1, o2, d1 );
-    z2 = TransEval( o2, d1, d2 );
-    if( z1+z2 < 0 ) { z1 = -z1; z2 = -z2; }
-    v->t = Interpolate( z1, o2->t, z2, d1->t );
-  } else {
-    /* Interpolate between o2 and d2 */
-    z1 = TransSign( o1, o2, d1 );
-    z2 = -TransSign( o1, d2, d1 );
-    if( z1+z2 < 0 ) { z1 = -z1; z2 = -z2; }
-    v->t = Interpolate( z1, o2->t, z2, d2->t );
-  }
-}
diff --git a/Source/WebCore/thirdparty/glu/libtess/geom.h b/Source/WebCore/thirdparty/glu/libtess/geom.h
deleted file mode 100644
index 97b7b30..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/geom.h
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/geom.h#5 $
-*/
-
-#ifndef __geom_h_
-#define __geom_h_
-
-#include "thirdparty/glu/libtess/mesh.h"
-
-#ifdef NO_BRANCH_CONDITIONS
-/* MIPS architecture has special instructions to evaluate boolean
- * conditions -- more efficient than branching, IF you can get the
- * compiler to generate the right instructions (SGI compiler doesn't)
- */
-#define VertEq(u,v)	(((u)->s == (v)->s) & ((u)->t == (v)->t))
-#define VertLeq(u,v)	(((u)->s < (v)->s) | \
-                         ((u)->s == (v)->s & (u)->t <= (v)->t))
-#else
-#define VertEq(u,v)	((u)->s == (v)->s && (u)->t == (v)->t)
-#define VertLeq(u,v)	(((u)->s < (v)->s) || \
-                         ((u)->s == (v)->s && (u)->t <= (v)->t))
-#endif
-
-#define EdgeEval(u,v,w)	__gl_edgeEval(u,v,w)
-#define EdgeSign(u,v,w)	__gl_edgeSign(u,v,w)
-
-/* Versions of VertLeq, EdgeSign, EdgeEval with s and t transposed. */
-
-#define TransLeq(u,v)	(((u)->t < (v)->t) || \
-                         ((u)->t == (v)->t && (u)->s <= (v)->s))
-#define TransEval(u,v,w)	__gl_transEval(u,v,w)
-#define TransSign(u,v,w)	__gl_transSign(u,v,w)
-
-
-#define EdgeGoesLeft(e)		VertLeq( (e)->Dst, (e)->Org )
-#define EdgeGoesRight(e)	VertLeq( (e)->Org, (e)->Dst )
-
-#define ABS(x)	((x) < 0 ? -(x) : (x))
-#define VertL1dist(u,v)	(ABS(u->s - v->s) + ABS(u->t - v->t))
-
-#define VertCCW(u,v,w)	__gl_vertCCW(u,v,w)
-
-int		__gl_vertLeq( GLUvertex *u, GLUvertex *v );
-GLdouble	__gl_edgeEval( GLUvertex *u, GLUvertex *v, GLUvertex *w );
-GLdouble	__gl_edgeSign( GLUvertex *u, GLUvertex *v, GLUvertex *w );
-GLdouble	__gl_transEval( GLUvertex *u, GLUvertex *v, GLUvertex *w );
-GLdouble	__gl_transSign( GLUvertex *u, GLUvertex *v, GLUvertex *w );
-int		__gl_vertCCW( GLUvertex *u, GLUvertex *v, GLUvertex *w );
-void		__gl_edgeIntersect( GLUvertex *o1, GLUvertex *d1,
-				    GLUvertex *o2, GLUvertex *d2,
-				    GLUvertex *v );
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/memalloc.c b/Source/WebCore/thirdparty/glu/libtess/memalloc.c
deleted file mode 100644
index b422b66..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/memalloc.c
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/memalloc.c#5 $
-*/
-
-#include "string.h"
-#include "thirdparty/glu/libtess/memalloc.h"
-
-int __gl_memInit( size_t maxFast )
-{
-#ifndef NO_MALLOPT
-/*  mallopt( M_MXFAST, maxFast );*/
-#ifdef MEMORY_DEBUG
-  mallopt( M_DEBUG, 1 );
-#endif
-#endif
-   return 1;
-}
-
-#ifdef MEMORY_DEBUG
-void *__gl_memAlloc( size_t n )
-{
-  return memset( malloc( n ), 0xa5, n );
-}
-#endif
-
diff --git a/Source/WebCore/thirdparty/glu/libtess/memalloc.h b/Source/WebCore/thirdparty/glu/libtess/memalloc.h
deleted file mode 100644
index 1e37f7a..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/memalloc.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/memalloc.h#5 $
-*/
-
-#ifndef __memalloc_simple_h_
-#define __memalloc_simple_h_
-
-#include <stdlib.h>
-
-#define memRealloc	realloc
-#define memFree		free
-
-#define memInit		__gl_memInit
-/*extern void		__gl_memInit( size_t );*/
-extern int		__gl_memInit( size_t );
-
-#ifndef MEMORY_DEBUG
-#define memAlloc	malloc
-#else
-#define memAlloc	__gl_memAlloc
-extern void *		__gl_memAlloc( size_t );
-#endif
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/mesh.c b/Source/WebCore/thirdparty/glu/libtess/mesh.c
deleted file mode 100644
index 62ff469..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/mesh.c
+++ /dev/null
@@ -1,796 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/mesh.c#6 $
-*/
-
-#include <assert.h>
-#include <stddef.h>
-#include "thirdparty/glu/gluos.h"
-#include "thirdparty/glu/libtess/memalloc.h"
-#include "thirdparty/glu/libtess/mesh.h"
-
-#define TRUE 1
-#define FALSE 0
-
-static GLUvertex *allocVertex()
-{
-   return (GLUvertex *)memAlloc( sizeof( GLUvertex ));
-}
-
-static GLUface *allocFace()
-{
-   return (GLUface *)memAlloc( sizeof( GLUface ));
-}
-
-/************************ Utility Routines ************************/
-
-/* Allocate and free half-edges in pairs for efficiency.
- * The *only* place that should use this fact is allocation/free.
- */
-typedef struct { GLUhalfEdge e, eSym; } EdgePair;
-
-/* MakeEdge creates a new pair of half-edges which form their own loop.
- * No vertex or face structures are allocated, but these must be assigned
- * before the current edge operation is completed.
- */
-static GLUhalfEdge *MakeEdge( GLUhalfEdge *eNext )
-{
-  GLUhalfEdge *e;
-  GLUhalfEdge *eSym;
-  GLUhalfEdge *ePrev;
-  EdgePair *pair = (EdgePair *)memAlloc( sizeof( EdgePair ));
-  if (pair == NULL) return NULL;
-
-  e = &pair->e;
-  eSym = &pair->eSym;
-
-  /* Make sure eNext points to the first edge of the edge pair */
-  if( eNext->Sym < eNext ) { eNext = eNext->Sym; }
-
-  /* Insert in circular doubly-linked list before eNext.
-   * Note that the prev pointer is stored in Sym->next.
-   */
-  ePrev = eNext->Sym->next;
-  eSym->next = ePrev;
-  ePrev->Sym->next = e;
-  e->next = eNext;
-  eNext->Sym->next = eSym;
-
-  e->Sym = eSym;
-  e->Onext = e;
-  e->Lnext = eSym;
-  e->Org = NULL;
-  e->Lface = NULL;
-  e->winding = 0;
-  e->activeRegion = NULL;
-
-  eSym->Sym = e;
-  eSym->Onext = eSym;
-  eSym->Lnext = e;
-  eSym->Org = NULL;
-  eSym->Lface = NULL;
-  eSym->winding = 0;
-  eSym->activeRegion = NULL;
-
-  return e;
-}
-
-/* Splice( a, b ) is best described by the Guibas/Stolfi paper or the
- * CS348a notes (see mesh.h).  Basically it modifies the mesh so that
- * a->Onext and b->Onext are exchanged.  This can have various effects
- * depending on whether a and b belong to different face or vertex rings.
- * For more explanation see __gl_meshSplice() below.
- */
-static void Splice( GLUhalfEdge *a, GLUhalfEdge *b )
-{
-  GLUhalfEdge *aOnext = a->Onext;
-  GLUhalfEdge *bOnext = b->Onext;
-
-  aOnext->Sym->Lnext = b;
-  bOnext->Sym->Lnext = a;
-  a->Onext = bOnext;
-  b->Onext = aOnext;
-}
-
-/* MakeVertex( newVertex, eOrig, vNext ) attaches a new vertex and makes it the
- * origin of all edges in the vertex loop to which eOrig belongs. "vNext" gives
- * a place to insert the new vertex in the global vertex list.  We insert
- * the new vertex *before* vNext so that algorithms which walk the vertex
- * list will not see the newly created vertices.
- */
-static void MakeVertex( GLUvertex *newVertex, 
-			GLUhalfEdge *eOrig, GLUvertex *vNext )
-{
-  GLUhalfEdge *e;
-  GLUvertex *vPrev;
-  GLUvertex *vNew = newVertex;
-
-  assert(vNew != NULL);
-
-  /* insert in circular doubly-linked list before vNext */
-  vPrev = vNext->prev;
-  vNew->prev = vPrev;
-  vPrev->next = vNew;
-  vNew->next = vNext;
-  vNext->prev = vNew;
-
-  vNew->anEdge = eOrig;
-  vNew->data = NULL;
-  /* leave coords, s, t undefined */
-
-  /* fix other edges on this vertex loop */
-  e = eOrig;
-  do {
-    e->Org = vNew;
-    e = e->Onext;
-  } while( e != eOrig );
-}
-
-/* MakeFace( newFace, eOrig, fNext ) attaches a new face and makes it the left
- * face of all edges in the face loop to which eOrig belongs.  "fNext" gives
- * a place to insert the new face in the global face list.  We insert
- * the new face *before* fNext so that algorithms which walk the face
- * list will not see the newly created faces.
- */
-static void MakeFace( GLUface *newFace, GLUhalfEdge *eOrig, GLUface *fNext )
-{
-  GLUhalfEdge *e;
-  GLUface *fPrev;
-  GLUface *fNew = newFace;
-
-  assert(fNew != NULL); 
-
-  /* insert in circular doubly-linked list before fNext */
-  fPrev = fNext->prev;
-  fNew->prev = fPrev;
-  fPrev->next = fNew;
-  fNew->next = fNext;
-  fNext->prev = fNew;
-
-  fNew->anEdge = eOrig;
-  fNew->data = NULL;
-  fNew->trail = NULL;
-  fNew->marked = FALSE;
-
-  /* The new face is marked "inside" if the old one was.  This is a
-   * convenience for the common case where a face has been split in two.
-   */
-  fNew->inside = fNext->inside;
-
-  /* fix other edges on this face loop */
-  e = eOrig;
-  do {
-    e->Lface = fNew;
-    e = e->Lnext;
-  } while( e != eOrig );
-}
-
-/* KillEdge( eDel ) destroys an edge (the half-edges eDel and eDel->Sym),
- * and removes from the global edge list.
- */
-static void KillEdge( GLUhalfEdge *eDel )
-{
-  GLUhalfEdge *ePrev, *eNext;
-
-  /* Half-edges are allocated in pairs, see EdgePair above */
-  if( eDel->Sym < eDel ) { eDel = eDel->Sym; }
-
-  /* delete from circular doubly-linked list */
-  eNext = eDel->next;
-  ePrev = eDel->Sym->next;
-  eNext->Sym->next = ePrev;
-  ePrev->Sym->next = eNext;
-
-  memFree( eDel );
-}
-
-
-/* KillVertex( vDel ) destroys a vertex and removes it from the global
- * vertex list.  It updates the vertex loop to point to a given new vertex.
- */
-static void KillVertex( GLUvertex *vDel, GLUvertex *newOrg )
-{
-  GLUhalfEdge *e, *eStart = vDel->anEdge;
-  GLUvertex *vPrev, *vNext;
-
-  /* change the origin of all affected edges */
-  e = eStart;
-  do {
-    e->Org = newOrg;
-    e = e->Onext;
-  } while( e != eStart );
-
-  /* delete from circular doubly-linked list */
-  vPrev = vDel->prev;
-  vNext = vDel->next;
-  vNext->prev = vPrev;
-  vPrev->next = vNext;
-
-  memFree( vDel );
-}
-
-/* KillFace( fDel ) destroys a face and removes it from the global face
- * list.  It updates the face loop to point to a given new face.
- */
-static void KillFace( GLUface *fDel, GLUface *newLface )
-{
-  GLUhalfEdge *e, *eStart = fDel->anEdge;
-  GLUface *fPrev, *fNext;
-
-  /* change the left face of all affected edges */
-  e = eStart;
-  do {
-    e->Lface = newLface;
-    e = e->Lnext;
-  } while( e != eStart );
-
-  /* delete from circular doubly-linked list */
-  fPrev = fDel->prev;
-  fNext = fDel->next;
-  fNext->prev = fPrev;
-  fPrev->next = fNext;
-
-  memFree( fDel );
-}
-
-
-/****************** Basic Edge Operations **********************/
-
-/* __gl_meshMakeEdge creates one edge, two vertices, and a loop (face).
- * The loop consists of the two new half-edges.
- */
-GLUhalfEdge *__gl_meshMakeEdge( GLUmesh *mesh )
-{
-  GLUvertex *newVertex1= allocVertex();
-  GLUvertex *newVertex2= allocVertex();
-  GLUface *newFace= allocFace();
-  GLUhalfEdge *e;
-
-  /* if any one is null then all get freed */
-  if (newVertex1 == NULL || newVertex2 == NULL || newFace == NULL) {
-     if (newVertex1 != NULL) memFree(newVertex1);
-     if (newVertex2 != NULL) memFree(newVertex2);
-     if (newFace != NULL) memFree(newFace);     
-     return NULL;
-  } 
-
-  e = MakeEdge( &mesh->eHead );
-  if (e == NULL) return NULL;
-
-  MakeVertex( newVertex1, e, &mesh->vHead );
-  MakeVertex( newVertex2, e->Sym, &mesh->vHead );
-  MakeFace( newFace, e, &mesh->fHead );
-  return e;
-}
-  
-
-/* __gl_meshSplice( eOrg, eDst ) is the basic operation for changing the
- * mesh connectivity and topology.  It changes the mesh so that
- *	eOrg->Onext <- OLD( eDst->Onext )
- *	eDst->Onext <- OLD( eOrg->Onext )
- * where OLD(...) means the value before the meshSplice operation.
- *
- * This can have two effects on the vertex structure:
- *  - if eOrg->Org != eDst->Org, the two vertices are merged together
- *  - if eOrg->Org == eDst->Org, the origin is split into two vertices
- * In both cases, eDst->Org is changed and eOrg->Org is untouched.
- *
- * Similarly (and independently) for the face structure,
- *  - if eOrg->Lface == eDst->Lface, one loop is split into two
- *  - if eOrg->Lface != eDst->Lface, two distinct loops are joined into one
- * In both cases, eDst->Lface is changed and eOrg->Lface is unaffected.
- *
- * Some special cases:
- * If eDst == eOrg, the operation has no effect.
- * If eDst == eOrg->Lnext, the new face will have a single edge.
- * If eDst == eOrg->Lprev, the old face will have a single edge.
- * If eDst == eOrg->Onext, the new vertex will have a single edge.
- * If eDst == eOrg->Oprev, the old vertex will have a single edge.
- */
-int __gl_meshSplice( GLUhalfEdge *eOrg, GLUhalfEdge *eDst )
-{
-  int joiningLoops = FALSE;
-  int joiningVertices = FALSE;
-
-  if( eOrg == eDst ) return 1;
-
-  if( eDst->Org != eOrg->Org ) {
-    /* We are merging two disjoint vertices -- destroy eDst->Org */
-    joiningVertices = TRUE;
-    KillVertex( eDst->Org, eOrg->Org );
-  }
-  if( eDst->Lface != eOrg->Lface ) {
-    /* We are connecting two disjoint loops -- destroy eDst->Lface */
-    joiningLoops = TRUE;
-    KillFace( eDst->Lface, eOrg->Lface );
-  }
-
-  /* Change the edge structure */
-  Splice( eDst, eOrg );
-
-  if( ! joiningVertices ) {
-    GLUvertex *newVertex= allocVertex();
-    if (newVertex == NULL) return 0;
-
-    /* We split one vertex into two -- the new vertex is eDst->Org.
-     * Make sure the old vertex points to a valid half-edge.
-     */
-    MakeVertex( newVertex, eDst, eOrg->Org );
-    eOrg->Org->anEdge = eOrg;
-  }
-  if( ! joiningLoops ) {
-    GLUface *newFace= allocFace();  
-    if (newFace == NULL) return 0;
-
-    /* We split one loop into two -- the new loop is eDst->Lface.
-     * Make sure the old face points to a valid half-edge.
-     */
-    MakeFace( newFace, eDst, eOrg->Lface );
-    eOrg->Lface->anEdge = eOrg;
-  }
-
-  return 1;
-}
-
-
-/* __gl_meshDelete( eDel ) removes the edge eDel.  There are several cases:
- * if (eDel->Lface != eDel->Rface), we join two loops into one; the loop
- * eDel->Lface is deleted.  Otherwise, we are splitting one loop into two;
- * the newly created loop will contain eDel->Dst.  If the deletion of eDel
- * would create isolated vertices, those are deleted as well.
- *
- * This function could be implemented as two calls to __gl_meshSplice
- * plus a few calls to memFree, but this would allocate and delete
- * unnecessary vertices and faces.
- */
-int __gl_meshDelete( GLUhalfEdge *eDel )
-{
-  GLUhalfEdge *eDelSym = eDel->Sym;
-  int joiningLoops = FALSE;
-
-  /* First step: disconnect the origin vertex eDel->Org.  We make all
-   * changes to get a consistent mesh in this "intermediate" state.
-   */
-  if( eDel->Lface != eDel->Rface ) {
-    /* We are joining two loops into one -- remove the left face */
-    joiningLoops = TRUE;
-    KillFace( eDel->Lface, eDel->Rface );
-  }
-
-  if( eDel->Onext == eDel ) {
-    KillVertex( eDel->Org, NULL );
-  } else {
-    /* Make sure that eDel->Org and eDel->Rface point to valid half-edges */
-    eDel->Rface->anEdge = eDel->Oprev;
-    eDel->Org->anEdge = eDel->Onext;
-
-    Splice( eDel, eDel->Oprev );
-    if( ! joiningLoops ) {
-      GLUface *newFace= allocFace();
-      if (newFace == NULL) return 0; 
-
-      /* We are splitting one loop into two -- create a new loop for eDel. */
-      MakeFace( newFace, eDel, eDel->Lface );
-    }
-  }
-
-  /* Claim: the mesh is now in a consistent state, except that eDel->Org
-   * may have been deleted.  Now we disconnect eDel->Dst.
-   */
-  if( eDelSym->Onext == eDelSym ) {
-    KillVertex( eDelSym->Org, NULL );
-    KillFace( eDelSym->Lface, NULL );
-  } else {
-    /* Make sure that eDel->Dst and eDel->Lface point to valid half-edges */
-    eDel->Lface->anEdge = eDelSym->Oprev;
-    eDelSym->Org->anEdge = eDelSym->Onext;
-    Splice( eDelSym, eDelSym->Oprev );
-  }
-
-  /* Any isolated vertices or faces have already been freed. */
-  KillEdge( eDel );
-
-  return 1;
-}
-
-
-/******************** Other Edge Operations **********************/
-
-/* All these routines can be implemented with the basic edge
- * operations above.  They are provided for convenience and efficiency.
- */
-
-
-/* __gl_meshAddEdgeVertex( eOrg ) creates a new edge eNew such that
- * eNew == eOrg->Lnext, and eNew->Dst is a newly created vertex.
- * eOrg and eNew will have the same left face.
- */
-GLUhalfEdge *__gl_meshAddEdgeVertex( GLUhalfEdge *eOrg )
-{
-  GLUhalfEdge *eNewSym;
-  GLUhalfEdge *eNew = MakeEdge( eOrg );
-  if (eNew == NULL) return NULL;
-
-  eNewSym = eNew->Sym;
-
-  /* Connect the new edge appropriately */
-  Splice( eNew, eOrg->Lnext );
-
-  /* Set the vertex and face information */
-  eNew->Org = eOrg->Dst;
-  {
-    GLUvertex *newVertex= allocVertex();
-    if (newVertex == NULL) return NULL;
-
-    MakeVertex( newVertex, eNewSym, eNew->Org );
-  }
-  eNew->Lface = eNewSym->Lface = eOrg->Lface;
-
-  return eNew;
-}
-
-
-/* __gl_meshSplitEdge( eOrg ) splits eOrg into two edges eOrg and eNew,
- * such that eNew == eOrg->Lnext.  The new vertex is eOrg->Dst == eNew->Org.
- * eOrg and eNew will have the same left face.
- */
-GLUhalfEdge *__gl_meshSplitEdge( GLUhalfEdge *eOrg )
-{
-  GLUhalfEdge *eNew;
-  GLUhalfEdge *tempHalfEdge= __gl_meshAddEdgeVertex( eOrg );
-  if (tempHalfEdge == NULL) return NULL;
-
-  eNew = tempHalfEdge->Sym;
-
-  /* Disconnect eOrg from eOrg->Dst and connect it to eNew->Org */
-  Splice( eOrg->Sym, eOrg->Sym->Oprev );
-  Splice( eOrg->Sym, eNew );
-
-  /* Set the vertex and face information */
-  eOrg->Dst = eNew->Org;
-  eNew->Dst->anEdge = eNew->Sym;	/* may have pointed to eOrg->Sym */
-  eNew->Rface = eOrg->Rface;
-  eNew->winding = eOrg->winding;	/* copy old winding information */
-  eNew->Sym->winding = eOrg->Sym->winding;
-
-  return eNew;
-}
-
-
-/* __gl_meshConnect( eOrg, eDst ) creates a new edge from eOrg->Dst
- * to eDst->Org, and returns the corresponding half-edge eNew.
- * If eOrg->Lface == eDst->Lface, this splits one loop into two,
- * and the newly created loop is eNew->Lface.  Otherwise, two disjoint
- * loops are merged into one, and the loop eDst->Lface is destroyed.
- *
- * If (eOrg == eDst), the new face will have only two edges.
- * If (eOrg->Lnext == eDst), the old face is reduced to a single edge.
- * If (eOrg->Lnext->Lnext == eDst), the old face is reduced to two edges.
- */
-GLUhalfEdge *__gl_meshConnect( GLUhalfEdge *eOrg, GLUhalfEdge *eDst )
-{
-  GLUhalfEdge *eNewSym;
-  int joiningLoops = FALSE;  
-  GLUhalfEdge *eNew = MakeEdge( eOrg );
-  if (eNew == NULL) return NULL;
-
-  eNewSym = eNew->Sym;
-
-  if( eDst->Lface != eOrg->Lface ) {
-    /* We are connecting two disjoint loops -- destroy eDst->Lface */
-    joiningLoops = TRUE;
-    KillFace( eDst->Lface, eOrg->Lface );
-  }
-
-  /* Connect the new edge appropriately */
-  Splice( eNew, eOrg->Lnext );
-  Splice( eNewSym, eDst );
-
-  /* Set the vertex and face information */
-  eNew->Org = eOrg->Dst;
-  eNewSym->Org = eDst->Org;
-  eNew->Lface = eNewSym->Lface = eOrg->Lface;
-
-  /* Make sure the old face points to a valid half-edge */
-  eOrg->Lface->anEdge = eNewSym;
-
-  if( ! joiningLoops ) {
-    GLUface *newFace= allocFace();
-    if (newFace == NULL) return NULL;
-
-    /* We split one loop into two -- the new loop is eNew->Lface */
-    MakeFace( newFace, eNew, eOrg->Lface );
-  }
-  return eNew;
-}
-
-
-/******************** Other Operations **********************/
-
-/* __gl_meshZapFace( fZap ) destroys a face and removes it from the
- * global face list.  All edges of fZap will have a NULL pointer as their
- * left face.  Any edges which also have a NULL pointer as their right face
- * are deleted entirely (along with any isolated vertices this produces).
- * An entire mesh can be deleted by zapping its faces, one at a time,
- * in any order.  Zapped faces cannot be used in further mesh operations!
- */
-void __gl_meshZapFace( GLUface *fZap )
-{
-  GLUhalfEdge *eStart = fZap->anEdge;
-  GLUhalfEdge *e, *eNext, *eSym;
-  GLUface *fPrev, *fNext;
-
-  /* walk around face, deleting edges whose right face is also NULL */
-  eNext = eStart->Lnext;
-  do {
-    e = eNext;
-    eNext = e->Lnext;
-
-    e->Lface = NULL;
-    if( e->Rface == NULL ) {
-      /* delete the edge -- see __gl_MeshDelete above */
-
-      if( e->Onext == e ) {
-	KillVertex( e->Org, NULL );
-      } else {
-	/* Make sure that e->Org points to a valid half-edge */
-	e->Org->anEdge = e->Onext;
-	Splice( e, e->Oprev );
-      }
-      eSym = e->Sym;
-      if( eSym->Onext == eSym ) {
-	KillVertex( eSym->Org, NULL );
-      } else {
-	/* Make sure that eSym->Org points to a valid half-edge */
-	eSym->Org->anEdge = eSym->Onext;
-	Splice( eSym, eSym->Oprev );
-      }
-      KillEdge( e );
-    }
-  } while( e != eStart );
-
-  /* delete from circular doubly-linked list */
-  fPrev = fZap->prev;
-  fNext = fZap->next;
-  fNext->prev = fPrev;
-  fPrev->next = fNext;
-
-  memFree( fZap );
-}
-
-
-/* __gl_meshNewMesh() creates a new mesh with no edges, no vertices,
- * and no loops (what we usually call a "face").
- */
-GLUmesh *__gl_meshNewMesh( void )
-{
-  GLUvertex *v;
-  GLUface *f;
-  GLUhalfEdge *e;
-  GLUhalfEdge *eSym;
-  GLUmesh *mesh = (GLUmesh *)memAlloc( sizeof( GLUmesh ));
-  if (mesh == NULL) {
-     return NULL;
-  }
-  
-  v = &mesh->vHead;
-  f = &mesh->fHead;
-  e = &mesh->eHead;
-  eSym = &mesh->eHeadSym;
-
-  v->next = v->prev = v;
-  v->anEdge = NULL;
-  v->data = NULL;
-
-  f->next = f->prev = f;
-  f->anEdge = NULL;
-  f->data = NULL;
-  f->trail = NULL;
-  f->marked = FALSE;
-  f->inside = FALSE;
-
-  e->next = e;
-  e->Sym = eSym;
-  e->Onext = NULL;
-  e->Lnext = NULL;
-  e->Org = NULL;
-  e->Lface = NULL;
-  e->winding = 0;
-  e->activeRegion = NULL;
-
-  eSym->next = eSym;
-  eSym->Sym = e;
-  eSym->Onext = NULL;
-  eSym->Lnext = NULL;
-  eSym->Org = NULL;
-  eSym->Lface = NULL;
-  eSym->winding = 0;
-  eSym->activeRegion = NULL;
-
-  return mesh;
-}
-
-
-/* __gl_meshUnion( mesh1, mesh2 ) forms the union of all structures in
- * both meshes, and returns the new mesh (the old meshes are destroyed).
- */
-GLUmesh *__gl_meshUnion( GLUmesh *mesh1, GLUmesh *mesh2 )
-{
-  GLUface *f1 = &mesh1->fHead;
-  GLUvertex *v1 = &mesh1->vHead;
-  GLUhalfEdge *e1 = &mesh1->eHead;
-  GLUface *f2 = &mesh2->fHead;
-  GLUvertex *v2 = &mesh2->vHead;
-  GLUhalfEdge *e2 = &mesh2->eHead;
-
-  /* Add the faces, vertices, and edges of mesh2 to those of mesh1 */
-  if( f2->next != f2 ) {
-    f1->prev->next = f2->next;
-    f2->next->prev = f1->prev;
-    f2->prev->next = f1;
-    f1->prev = f2->prev;
-  }
-
-  if( v2->next != v2 ) {
-    v1->prev->next = v2->next;
-    v2->next->prev = v1->prev;
-    v2->prev->next = v1;
-    v1->prev = v2->prev;
-  }
-
-  if( e2->next != e2 ) {
-    e1->Sym->next->Sym->next = e2->next;
-    e2->next->Sym->next = e1->Sym->next;
-    e2->Sym->next->Sym->next = e1;
-    e1->Sym->next = e2->Sym->next;
-  }
-
-  memFree( mesh2 );
-  return mesh1;
-}
-
-
-#ifdef DELETE_BY_ZAPPING
-
-/* __gl_meshDeleteMesh( mesh ) will free all storage for any valid mesh.
- */
-void __gl_meshDeleteMesh( GLUmesh *mesh )
-{
-  GLUface *fHead = &mesh->fHead;
-
-  while( fHead->next != fHead ) {
-    __gl_meshZapFace( fHead->next );
-  }
-  assert( mesh->vHead.next == &mesh->vHead );
-
-  memFree( mesh );
-}
-
-#else
-
-/* __gl_meshDeleteMesh( mesh ) will free all storage for any valid mesh.
- */
-void __gl_meshDeleteMesh( GLUmesh *mesh )
-{
-  GLUface *f, *fNext;
-  GLUvertex *v, *vNext;
-  GLUhalfEdge *e, *eNext;
-
-  for( f = mesh->fHead.next; f != &mesh->fHead; f = fNext ) {
-    fNext = f->next;
-    memFree( f );
-  }
-
-  for( v = mesh->vHead.next; v != &mesh->vHead; v = vNext ) {
-    vNext = v->next;
-    memFree( v );
-  }
-
-  for( e = mesh->eHead.next; e != &mesh->eHead; e = eNext ) {
-    /* One call frees both e and e->Sym (see EdgePair above) */
-    eNext = e->next;
-    memFree( e );
-  }
-
-  memFree( mesh );
-}
-
-#endif
-
-#ifndef NDEBUG
-
-/* __gl_meshCheckMesh( mesh ) checks a mesh for self-consistency.
- */
-void __gl_meshCheckMesh( GLUmesh *mesh )
-{
-  GLUface *fHead = &mesh->fHead;
-  GLUvertex *vHead = &mesh->vHead;
-  GLUhalfEdge *eHead = &mesh->eHead;
-  GLUface *f, *fPrev;
-  GLUvertex *v, *vPrev;
-  GLUhalfEdge *e, *ePrev;
-
-  fPrev = fHead;
-  for( fPrev = fHead ; (f = fPrev->next) != fHead; fPrev = f) {
-    assert( f->prev == fPrev );
-    e = f->anEdge;
-    do {
-      assert( e->Sym != e );
-      assert( e->Sym->Sym == e );
-      assert( e->Lnext->Onext->Sym == e );
-      assert( e->Onext->Sym->Lnext == e );
-      assert( e->Lface == f );
-      e = e->Lnext;
-    } while( e != f->anEdge );
-  }
-  assert( f->prev == fPrev && f->anEdge == NULL && f->data == NULL );
-
-  vPrev = vHead;
-  for( vPrev = vHead ; (v = vPrev->next) != vHead; vPrev = v) {
-    assert( v->prev == vPrev );
-    e = v->anEdge;
-    do {
-      assert( e->Sym != e );
-      assert( e->Sym->Sym == e );
-      assert( e->Lnext->Onext->Sym == e );
-      assert( e->Onext->Sym->Lnext == e );
-      assert( e->Org == v );
-      e = e->Onext;
-    } while( e != v->anEdge );
-  }
-  assert( v->prev == vPrev && v->anEdge == NULL && v->data == NULL );
-
-  ePrev = eHead;
-  for( ePrev = eHead ; (e = ePrev->next) != eHead; ePrev = e) {
-    assert( e->Sym->next == ePrev->Sym );
-    assert( e->Sym != e );
-    assert( e->Sym->Sym == e );
-    assert( e->Org != NULL );
-    assert( e->Dst != NULL );
-    assert( e->Lnext->Onext->Sym == e );
-    assert( e->Onext->Sym->Lnext == e );
-  }
-  assert( e->Sym->next == ePrev->Sym
-       && e->Sym == &mesh->eHeadSym
-       && e->Sym->Sym == e
-       && e->Org == NULL && e->Dst == NULL
-       && e->Lface == NULL && e->Rface == NULL );
-}
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/mesh.h b/Source/WebCore/thirdparty/glu/libtess/mesh.h
deleted file mode 100644
index 4d2bcd1..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/mesh.h
+++ /dev/null
@@ -1,273 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/mesh.h#5 $
-*/
-
-#ifndef __mesh_h_
-#define __mesh_h_
-
-#include "thirdparty/glu/internal_glu.h"
-
-typedef struct GLUmesh GLUmesh; 
-
-typedef struct GLUvertex GLUvertex;
-typedef struct GLUface GLUface;
-typedef struct GLUhalfEdge GLUhalfEdge;
-
-typedef struct ActiveRegion ActiveRegion;	/* Internal data */
-
-/* The mesh structure is similar in spirit, notation, and operations
- * to the "quad-edge" structure (see L. Guibas and J. Stolfi, Primitives
- * for the manipulation of general subdivisions and the computation of
- * Voronoi diagrams, ACM Transactions on Graphics, 4(2):74-123, April 1985).
- * For a simplified description, see the course notes for CS348a,
- * "Mathematical Foundations of Computer Graphics", available at the
- * Stanford bookstore (and taught during the fall quarter).
- * The implementation also borrows a tiny subset of the graph-based approach
- * use in Mantyla's Geometric Work Bench (see M. Mantyla, An Introduction
- * to Sold Modeling, Computer Science Press, Rockville, Maryland, 1988).
- *
- * The fundamental data structure is the "half-edge".  Two half-edges
- * go together to make an edge, but they point in opposite directions.
- * Each half-edge has a pointer to its mate (the "symmetric" half-edge Sym),
- * its origin vertex (Org), the face on its left side (Lface), and the
- * adjacent half-edges in the CCW direction around the origin vertex
- * (Onext) and around the left face (Lnext).  There is also a "next"
- * pointer for the global edge list (see below).
- *
- * The notation used for mesh navigation:
- *	Sym   = the mate of a half-edge (same edge, but opposite direction)
- *	Onext = edge CCW around origin vertex (keep same origin)
- *	Dnext = edge CCW around destination vertex (keep same dest)
- *	Lnext = edge CCW around left face (dest becomes new origin)
- *	Rnext = edge CCW around right face (origin becomes new dest)
- *
- * "prev" means to substitute CW for CCW in the definitions above.
- *
- * The mesh keeps global lists of all vertices, faces, and edges,
- * stored as doubly-linked circular lists with a dummy header node.
- * The mesh stores pointers to these dummy headers (vHead, fHead, eHead).
- *
- * The circular edge list is special; since half-edges always occur
- * in pairs (e and e->Sym), each half-edge stores a pointer in only
- * one direction.  Starting at eHead and following the e->next pointers
- * will visit each *edge* once (ie. e or e->Sym, but not both).
- * e->Sym stores a pointer in the opposite direction, thus it is
- * always true that e->Sym->next->Sym->next == e.
- *
- * Each vertex has a pointer to next and previous vertices in the
- * circular list, and a pointer to a half-edge with this vertex as
- * the origin (NULL if this is the dummy header).  There is also a
- * field "data" for client data.
- *
- * Each face has a pointer to the next and previous faces in the
- * circular list, and a pointer to a half-edge with this face as
- * the left face (NULL if this is the dummy header).  There is also
- * a field "data" for client data.
- *
- * Note that what we call a "face" is really a loop; faces may consist
- * of more than one loop (ie. not simply connected), but there is no
- * record of this in the data structure.  The mesh may consist of
- * several disconnected regions, so it may not be possible to visit
- * the entire mesh by starting at a half-edge and traversing the edge
- * structure.
- *
- * The mesh does NOT support isolated vertices; a vertex is deleted along
- * with its last edge.  Similarly when two faces are merged, one of the
- * faces is deleted (see __gl_meshDelete below).  For mesh operations,
- * all face (loop) and vertex pointers must not be NULL.  However, once
- * mesh manipulation is finished, __gl_MeshZapFace can be used to delete
- * faces of the mesh, one at a time.  All external faces can be "zapped"
- * before the mesh is returned to the client; then a NULL face indicates
- * a region which is not part of the output polygon.
- */
-
-struct GLUvertex {
-  GLUvertex	*next;		/* next vertex (never NULL) */
-  GLUvertex	*prev;		/* previous vertex (never NULL) */
-  GLUhalfEdge	*anEdge;	/* a half-edge with this origin */
-  void		*data;		/* client's data */
-
-  /* Internal data (keep hidden) */
-  GLdouble	coords[3];	/* vertex location in 3D */
-  GLdouble	s, t;		/* projection onto the sweep plane */
-  long		pqHandle;	/* to allow deletion from priority queue */
-};
-
-struct GLUface {
-  GLUface	*next;		/* next face (never NULL) */
-  GLUface	*prev;		/* previous face (never NULL) */
-  GLUhalfEdge	*anEdge;	/* a half edge with this left face */
-  void		*data;		/* room for client's data */
-
-  /* Internal data (keep hidden) */
-  GLUface	*trail;		/* "stack" for conversion to strips */
-  GLboolean	marked;		/* flag for conversion to strips */
-  GLboolean	inside;		/* this face is in the polygon interior */
-};
-
-struct GLUhalfEdge {
-  GLUhalfEdge	*next;		/* doubly-linked list (prev==Sym->next) */
-  GLUhalfEdge	*Sym;		/* same edge, opposite direction */
-  GLUhalfEdge	*Onext;		/* next edge CCW around origin */
-  GLUhalfEdge	*Lnext;		/* next edge CCW around left face */
-  GLUvertex	*Org;		/* origin vertex (Overtex too long) */
-  GLUface	*Lface;		/* left face */
-
-  /* Internal data (keep hidden) */
-  ActiveRegion	*activeRegion;	/* a region with this upper edge (sweep.c) */
-  int		winding;	/* change in winding number when crossing
-                                   from the right face to the left face */
-};
-
-#define	Rface	Sym->Lface
-#define Dst	Sym->Org
-
-#define Oprev	Sym->Lnext
-#define Lprev   Onext->Sym
-#define Dprev	Lnext->Sym
-#define Rprev	Sym->Onext
-#define Dnext	Rprev->Sym	/* 3 pointers */
-#define Rnext	Oprev->Sym	/* 3 pointers */
-
-
-struct GLUmesh {
-  GLUvertex	vHead;		/* dummy header for vertex list */
-  GLUface	fHead;		/* dummy header for face list */
-  GLUhalfEdge	eHead;		/* dummy header for edge list */
-  GLUhalfEdge	eHeadSym;	/* and its symmetric counterpart */
-};
-
-/* The mesh operations below have three motivations: completeness,
- * convenience, and efficiency.  The basic mesh operations are MakeEdge,
- * Splice, and Delete.  All the other edge operations can be implemented
- * in terms of these.  The other operations are provided for convenience
- * and/or efficiency.
- *
- * When a face is split or a vertex is added, they are inserted into the
- * global list *before* the existing vertex or face (ie. e->Org or e->Lface).
- * This makes it easier to process all vertices or faces in the global lists
- * without worrying about processing the same data twice.  As a convenience,
- * when a face is split, the "inside" flag is copied from the old face.
- * Other internal data (v->data, v->activeRegion, f->data, f->marked,
- * f->trail, e->winding) is set to zero.
- *
- * ********************** Basic Edge Operations **************************
- *
- * __gl_meshMakeEdge( mesh ) creates one edge, two vertices, and a loop.
- * The loop (face) consists of the two new half-edges.
- *
- * __gl_meshSplice( eOrg, eDst ) is the basic operation for changing the
- * mesh connectivity and topology.  It changes the mesh so that
- *	eOrg->Onext <- OLD( eDst->Onext )
- *	eDst->Onext <- OLD( eOrg->Onext )
- * where OLD(...) means the value before the meshSplice operation.
- *
- * This can have two effects on the vertex structure:
- *  - if eOrg->Org != eDst->Org, the two vertices are merged together
- *  - if eOrg->Org == eDst->Org, the origin is split into two vertices
- * In both cases, eDst->Org is changed and eOrg->Org is untouched.
- *
- * Similarly (and independently) for the face structure,
- *  - if eOrg->Lface == eDst->Lface, one loop is split into two
- *  - if eOrg->Lface != eDst->Lface, two distinct loops are joined into one
- * In both cases, eDst->Lface is changed and eOrg->Lface is unaffected.
- *
- * __gl_meshDelete( eDel ) removes the edge eDel.  There are several cases:
- * if (eDel->Lface != eDel->Rface), we join two loops into one; the loop
- * eDel->Lface is deleted.  Otherwise, we are splitting one loop into two;
- * the newly created loop will contain eDel->Dst.  If the deletion of eDel
- * would create isolated vertices, those are deleted as well.
- *
- * ********************** Other Edge Operations **************************
- *
- * __gl_meshAddEdgeVertex( eOrg ) creates a new edge eNew such that
- * eNew == eOrg->Lnext, and eNew->Dst is a newly created vertex.
- * eOrg and eNew will have the same left face.
- *
- * __gl_meshSplitEdge( eOrg ) splits eOrg into two edges eOrg and eNew,
- * such that eNew == eOrg->Lnext.  The new vertex is eOrg->Dst == eNew->Org.
- * eOrg and eNew will have the same left face.
- *
- * __gl_meshConnect( eOrg, eDst ) creates a new edge from eOrg->Dst
- * to eDst->Org, and returns the corresponding half-edge eNew.
- * If eOrg->Lface == eDst->Lface, this splits one loop into two,
- * and the newly created loop is eNew->Lface.  Otherwise, two disjoint
- * loops are merged into one, and the loop eDst->Lface is destroyed.
- *
- * ************************ Other Operations *****************************
- *
- * __gl_meshNewMesh() creates a new mesh with no edges, no vertices,
- * and no loops (what we usually call a "face").
- *
- * __gl_meshUnion( mesh1, mesh2 ) forms the union of all structures in
- * both meshes, and returns the new mesh (the old meshes are destroyed).
- *
- * __gl_meshDeleteMesh( mesh ) will free all storage for any valid mesh.
- *
- * __gl_meshZapFace( fZap ) destroys a face and removes it from the
- * global face list.  All edges of fZap will have a NULL pointer as their
- * left face.  Any edges which also have a NULL pointer as their right face
- * are deleted entirely (along with any isolated vertices this produces).
- * An entire mesh can be deleted by zapping its faces, one at a time,
- * in any order.  Zapped faces cannot be used in further mesh operations!
- *
- * __gl_meshCheckMesh( mesh ) checks a mesh for self-consistency.
- */
-
-GLUhalfEdge	*__gl_meshMakeEdge( GLUmesh *mesh );
-int		__gl_meshSplice( GLUhalfEdge *eOrg, GLUhalfEdge *eDst );
-int		__gl_meshDelete( GLUhalfEdge *eDel );
-
-GLUhalfEdge	*__gl_meshAddEdgeVertex( GLUhalfEdge *eOrg );
-GLUhalfEdge	*__gl_meshSplitEdge( GLUhalfEdge *eOrg );
-GLUhalfEdge	*__gl_meshConnect( GLUhalfEdge *eOrg, GLUhalfEdge *eDst );
-
-GLUmesh		*__gl_meshNewMesh( void );
-GLUmesh		*__gl_meshUnion( GLUmesh *mesh1, GLUmesh *mesh2 );
-void		__gl_meshDeleteMesh( GLUmesh *mesh );
-void		__gl_meshZapFace( GLUface *fZap );
-
-#ifdef NDEBUG
-#define		__gl_meshCheckMesh( mesh )
-#else
-void		__gl_meshCheckMesh( GLUmesh *mesh );
-#endif
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/normal.c b/Source/WebCore/thirdparty/glu/libtess/normal.c
deleted file mode 100644
index 18fd6ac..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/normal.c
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/normal.c#5 $
-*/
-
-#include <assert.h>
-#include <math.h>
-#include "thirdparty/glu/gluos.h"
-#include "thirdparty/glu/libtess/mesh.h"
-#include "thirdparty/glu/libtess/normal.h"
-#include "thirdparty/glu/libtess/tess.h"
-
-#define TRUE 1
-#define FALSE 0
-
-#define Dot(u,v)	(u[0]*v[0] + u[1]*v[1] + u[2]*v[2])
-
-#if defined(FOR_TRITE_TEST_PROGRAM) || defined(TRUE_PROJECT)
-static void Normalize( GLdouble v[3] )
-{
-  GLdouble len = v[0]*v[0] + v[1]*v[1] + v[2]*v[2];
-
-  assert( len > 0 );
-  len = sqrt( len );
-  v[0] /= len;
-  v[1] /= len;
-  v[2] /= len;
-}
-#endif
-
-#define ABS(x)	((x) < 0 ? -(x) : (x))
-
-static int LongAxis( GLdouble v[3] )
-{
-  int i = 0;
-
-  if( ABS(v[1]) > ABS(v[0]) ) { i = 1; }
-  if( ABS(v[2]) > ABS(v[i]) ) { i = 2; }
-  return i;
-}
-
-static void ComputeNormal( GLUtesselator *tess, GLdouble norm[3] )
-{
-  GLUvertex *v, *v1, *v2;
-  GLdouble c, tLen2, maxLen2;
-  GLdouble maxVal[3], minVal[3], d1[3], d2[3], tNorm[3];
-  GLUvertex *maxVert[3], *minVert[3];
-  GLUvertex *vHead = &tess->mesh->vHead;
-  int i;
-
-  maxVal[0] = maxVal[1] = maxVal[2] = -2 * GLU_TESS_MAX_COORD;
-  minVal[0] = minVal[1] = minVal[2] = 2 * GLU_TESS_MAX_COORD;
-
-  for( v = vHead->next; v != vHead; v = v->next ) {
-    for( i = 0; i < 3; ++i ) {
-      c = v->coords[i];
-      if( c < minVal[i] ) { minVal[i] = c; minVert[i] = v; }
-      if( c > maxVal[i] ) { maxVal[i] = c; maxVert[i] = v; }
-    }
-  }
-
-  /* Find two vertices separated by at least 1/sqrt(3) of the maximum
-   * distance between any two vertices
-   */
-  i = 0;
-  if( maxVal[1] - minVal[1] > maxVal[0] - minVal[0] ) { i = 1; }
-  if( maxVal[2] - minVal[2] > maxVal[i] - minVal[i] ) { i = 2; }
-  if( minVal[i] >= maxVal[i] ) {
-    /* All vertices are the same -- normal doesn't matter */
-    norm[0] = 0; norm[1] = 0; norm[2] = 1;
-    return;
-  }
-
-  /* Look for a third vertex which forms the triangle with maximum area
-   * (Length of normal == twice the triangle area)
-   */
-  maxLen2 = 0;
-  v1 = minVert[i];
-  v2 = maxVert[i];
-  d1[0] = v1->coords[0] - v2->coords[0];
-  d1[1] = v1->coords[1] - v2->coords[1];
-  d1[2] = v1->coords[2] - v2->coords[2];
-  for( v = vHead->next; v != vHead; v = v->next ) {
-    d2[0] = v->coords[0] - v2->coords[0];
-    d2[1] = v->coords[1] - v2->coords[1];
-    d2[2] = v->coords[2] - v2->coords[2];
-    tNorm[0] = d1[1]*d2[2] - d1[2]*d2[1];
-    tNorm[1] = d1[2]*d2[0] - d1[0]*d2[2];
-    tNorm[2] = d1[0]*d2[1] - d1[1]*d2[0];
-    tLen2 = tNorm[0]*tNorm[0] + tNorm[1]*tNorm[1] + tNorm[2]*tNorm[2];
-    if( tLen2 > maxLen2 ) {
-      maxLen2 = tLen2;
-      norm[0] = tNorm[0];
-      norm[1] = tNorm[1];
-      norm[2] = tNorm[2];
-    }
-  }
-
-  if( maxLen2 <= 0 ) {
-    /* All points lie on a single line -- any decent normal will do */
-    norm[0] = norm[1] = norm[2] = 0;
-    norm[LongAxis(d1)] = 1;
-  }
-}
-  
-
-static void CheckOrientation( GLUtesselator *tess )
-{
-  GLdouble area;
-  GLUface *f, *fHead = &tess->mesh->fHead;
-  GLUvertex *v, *vHead = &tess->mesh->vHead;
-  GLUhalfEdge *e;
-
-  /* When we compute the normal automatically, we choose the orientation
-   * so that the the sum of the signed areas of all contours is non-negative.
-   */
-  area = 0;
-  for( f = fHead->next; f != fHead; f = f->next ) {
-    e = f->anEdge;
-    if( e->winding <= 0 ) continue;
-    do {
-      area += (e->Org->s - e->Dst->s) * (e->Org->t + e->Dst->t);
-      e = e->Lnext;
-    } while( e != f->anEdge );
-  }
-  if( area < 0 ) {
-    /* Reverse the orientation by flipping all the t-coordinates */
-    for( v = vHead->next; v != vHead; v = v->next ) {
-      v->t = - v->t;
-    }
-    tess->tUnit[0] = - tess->tUnit[0];
-    tess->tUnit[1] = - tess->tUnit[1];
-    tess->tUnit[2] = - tess->tUnit[2];
-  }
-}
-
-#ifdef FOR_TRITE_TEST_PROGRAM
-#include <stdlib.h>
-extern int RandomSweep;
-#define S_UNIT_X	(RandomSweep ? (2*drand48()-1) : 1.0)
-#define S_UNIT_Y	(RandomSweep ? (2*drand48()-1) : 0.0)
-#else
-#if defined(SLANTED_SWEEP) 
-/* The "feature merging" is not intended to be complete.  There are
- * special cases where edges are nearly parallel to the sweep line
- * which are not implemented.  The algorithm should still behave
- * robustly (ie. produce a reasonable tesselation) in the presence
- * of such edges, however it may miss features which could have been
- * merged.  We could minimize this effect by choosing the sweep line
- * direction to be something unusual (ie. not parallel to one of the
- * coordinate axes).
- */
-#define S_UNIT_X	0.50941539564955385	/* Pre-normalized */
-#define S_UNIT_Y	0.86052074622010633
-#else
-#define S_UNIT_X	1.0
-#define S_UNIT_Y	0.0
-#endif
-#endif
-
-/* Determine the polygon normal and project vertices onto the plane
- * of the polygon.
- */
-void __gl_projectPolygon( GLUtesselator *tess )
-{
-  GLUvertex *v, *vHead = &tess->mesh->vHead;
-  GLdouble norm[3];
-  GLdouble *sUnit, *tUnit;
-  int i, computedNormal = FALSE;
-
-  norm[0] = tess->normal[0];
-  norm[1] = tess->normal[1];
-  norm[2] = tess->normal[2];
-  if( norm[0] == 0 && norm[1] == 0 && norm[2] == 0 ) {
-    ComputeNormal( tess, norm );
-    computedNormal = TRUE;
-  }
-  sUnit = tess->sUnit;
-  tUnit = tess->tUnit;
-  i = LongAxis( norm );
-
-#if defined(FOR_TRITE_TEST_PROGRAM) || defined(TRUE_PROJECT)
-  /* Choose the initial sUnit vector to be approximately perpendicular
-   * to the normal.
-   */
-  Normalize( norm );
-
-  sUnit[i] = 0;
-  sUnit[(i+1)%3] = S_UNIT_X;
-  sUnit[(i+2)%3] = S_UNIT_Y;
-
-  /* Now make it exactly perpendicular */
-  w = Dot( sUnit, norm );
-  sUnit[0] -= w * norm[0];
-  sUnit[1] -= w * norm[1];
-  sUnit[2] -= w * norm[2];
-  Normalize( sUnit );
-
-  /* Choose tUnit so that (sUnit,tUnit,norm) form a right-handed frame */
-  tUnit[0] = norm[1]*sUnit[2] - norm[2]*sUnit[1];
-  tUnit[1] = norm[2]*sUnit[0] - norm[0]*sUnit[2];
-  tUnit[2] = norm[0]*sUnit[1] - norm[1]*sUnit[0];
-  Normalize( tUnit );
-#else
-  /* Project perpendicular to a coordinate axis -- better numerically */
-  sUnit[i] = 0;
-  sUnit[(i+1)%3] = S_UNIT_X;
-  sUnit[(i+2)%3] = S_UNIT_Y;
-  
-  tUnit[i] = 0;
-  tUnit[(i+1)%3] = (norm[i] > 0) ? -S_UNIT_Y : S_UNIT_Y;
-  tUnit[(i+2)%3] = (norm[i] > 0) ? S_UNIT_X : -S_UNIT_X;
-#endif
-
-  /* Project the vertices onto the sweep plane */
-  for( v = vHead->next; v != vHead; v = v->next ) {
-    v->s = Dot( v->coords, sUnit );
-    v->t = Dot( v->coords, tUnit );
-  }
-  if( computedNormal ) {
-    CheckOrientation( tess );
-  }
-}
diff --git a/Source/WebCore/thirdparty/glu/libtess/normal.h b/Source/WebCore/thirdparty/glu/libtess/normal.h
deleted file mode 100644
index 5e74db2..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/normal.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/normal.h#5 $
-*/
-
-#ifndef __normal_h_
-#define __normal_h_
-
-#include "thirdparty/glu/libtess/tess.h"
-
-/* __gl_projectPolygon( tess ) determines the polygon normal
- * and project vertices onto the plane of the polygon.
- */
-void __gl_projectPolygon( GLUtesselator *tess );
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/priorityq-heap.c b/Source/WebCore/thirdparty/glu/libtess/priorityq-heap.c
deleted file mode 100644
index 5d60ae7..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/priorityq-heap.c
+++ /dev/null
@@ -1,260 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/priorityq-heap.c#5 $
-*/
-
-#include <assert.h>
-#include <limits.h>
-#include <stddef.h>
-#include "thirdparty/glu/libtess/memalloc.h"
-#include "thirdparty/glu/libtess/priorityq-heap.h"
-
-#define INIT_SIZE	32
-
-#define TRUE 1
-#define FALSE 0
-
-#ifdef FOR_TRITE_TEST_PROGRAM
-#define LEQ(x,y)	(*pq->leq)(x,y)
-#else
-/* Violates modularity, but a little faster */
-#include "geom.h"
-#define LEQ(x,y)	VertLeq((GLUvertex *)x, (GLUvertex *)y)
-#endif
-
-/* really __gl_pqHeapNewPriorityQ */
-PriorityQ *pqNewPriorityQ( int (*leq)(PQkey key1, PQkey key2) )
-{
-  PriorityQ *pq = (PriorityQ *)memAlloc( sizeof( PriorityQ ));
-  if (pq == NULL) return NULL;
-
-  pq->size = 0;
-  pq->max = INIT_SIZE;
-  pq->nodes = (PQnode *)memAlloc( (INIT_SIZE + 1) * sizeof(pq->nodes[0]) );
-  if (pq->nodes == NULL) {
-     memFree(pq);
-     return NULL;
-  }
-
-  pq->handles = (PQhandleElem *)memAlloc( (INIT_SIZE + 1) * sizeof(pq->handles[0]) );
-  if (pq->handles == NULL) {
-     memFree(pq->nodes);
-     memFree(pq);
-     return NULL;
-  }
-
-  pq->initialized = FALSE;
-  pq->freeList = 0;
-  pq->leq = leq;
-
-  pq->nodes[1].handle = 1;	/* so that Minimum() returns NULL */
-  pq->handles[1].key = NULL;
-  return pq;
-}
-
-/* really __gl_pqHeapDeletePriorityQ */
-void pqDeletePriorityQ( PriorityQ *pq )
-{
-  memFree( pq->handles );
-  memFree( pq->nodes );
-  memFree( pq );
-}
-
-
-static void FloatDown( PriorityQ *pq, long curr )
-{
-  PQnode *n = pq->nodes;
-  PQhandleElem *h = pq->handles;
-  PQhandle hCurr, hChild;
-  long child;
-
-  hCurr = n[curr].handle;
-  for( ;; ) {
-    child = curr << 1;
-    if( child < pq->size && LEQ( h[n[child+1].handle].key,
-				 h[n[child].handle].key )) {
-      ++child;
-    }
-
-    assert(child <= pq->max);
-
-    hChild = n[child].handle;
-    if( child > pq->size || LEQ( h[hCurr].key, h[hChild].key )) {
-      n[curr].handle = hCurr;
-      h[hCurr].node = curr;
-      break;
-    }
-    n[curr].handle = hChild;
-    h[hChild].node = curr;
-    curr = child;
-  }
-}
-
-
-static void FloatUp( PriorityQ *pq, long curr )
-{
-  PQnode *n = pq->nodes;
-  PQhandleElem *h = pq->handles;
-  PQhandle hCurr, hParent;
-  long parent;
-
-  hCurr = n[curr].handle;
-  for( ;; ) {
-    parent = curr >> 1;
-    hParent = n[parent].handle;
-    if( parent == 0 || LEQ( h[hParent].key, h[hCurr].key )) {
-      n[curr].handle = hCurr;
-      h[hCurr].node = curr;
-      break;
-    }
-    n[curr].handle = hParent;
-    h[hParent].node = curr;
-    curr = parent;
-  }
-}
-
-/* really __gl_pqHeapInit */
-void pqInit( PriorityQ *pq )
-{
-  long i;
-
-  /* This method of building a heap is O(n), rather than O(n lg n). */
-
-  for( i = pq->size; i >= 1; --i ) {
-    FloatDown( pq, i );
-  }
-  pq->initialized = TRUE;
-}
-
-/* really __gl_pqHeapInsert */
-/* returns LONG_MAX iff out of memory */
-PQhandle pqInsert( PriorityQ *pq, PQkey keyNew )
-{
-  long curr;
-  PQhandle free;
-
-  curr = ++ pq->size;
-  if( (curr*2) > pq->max ) {
-    PQnode *saveNodes= pq->nodes;
-    PQhandleElem *saveHandles= pq->handles;
-
-    /* If the heap overflows, double its size. */
-    pq->max <<= 1;
-    pq->nodes = (PQnode *)memRealloc( pq->nodes, 
-				     (size_t) 
-				     ((pq->max + 1) * sizeof( pq->nodes[0] )));
-    if (pq->nodes == NULL) {
-       pq->nodes = saveNodes;	/* restore ptr to free upon return */
-       return LONG_MAX;
-    }
-    pq->handles = (PQhandleElem *)memRealloc( pq->handles,
-			                     (size_t)
-			                      ((pq->max + 1) * 
-					       sizeof( pq->handles[0] )));
-    if (pq->handles == NULL) {
-       pq->handles = saveHandles; /* restore ptr to free upon return */
-       return LONG_MAX;
-    }
-  }
-
-  if( pq->freeList == 0 ) {
-    free = curr;
-  } else {
-    free = pq->freeList;
-    pq->freeList = pq->handles[free].node;
-  }
-
-  pq->nodes[curr].handle = free;
-  pq->handles[free].node = curr;
-  pq->handles[free].key = keyNew;
-
-  if( pq->initialized ) {
-    FloatUp( pq, curr );
-  }
-  assert(free != LONG_MAX);
-  return free;
-}
-
-/* really __gl_pqHeapExtractMin */
-PQkey pqExtractMin( PriorityQ *pq )
-{
-  PQnode *n = pq->nodes;
-  PQhandleElem *h = pq->handles;
-  PQhandle hMin = n[1].handle;
-  PQkey min = h[hMin].key;
-
-  if( pq->size > 0 ) {
-    n[1].handle = n[pq->size].handle;
-    h[n[1].handle].node = 1;
-
-    h[hMin].key = NULL;
-    h[hMin].node = pq->freeList;
-    pq->freeList = hMin;
-
-    if( -- pq->size > 0 ) {
-      FloatDown( pq, 1 );
-    }
-  }
-  return min;
-}
-
-/* really __gl_pqHeapDelete */
-void pqDelete( PriorityQ *pq, PQhandle hCurr )
-{
-  PQnode *n = pq->nodes;
-  PQhandleElem *h = pq->handles;
-  long curr;
-
-  assert( hCurr >= 1 && hCurr <= pq->max && h[hCurr].key != NULL );
-
-  curr = h[hCurr].node;
-  n[curr].handle = n[pq->size].handle;
-  h[n[curr].handle].node = curr;
-
-  if( curr <= -- pq->size ) {
-    if( curr <= 1 || LEQ( h[n[curr>>1].handle].key, h[n[curr].handle].key )) {
-      FloatDown( pq, curr );
-    } else {
-      FloatUp( pq, curr );
-    }
-  }
-  h[hCurr].key = NULL;
-  h[hCurr].node = pq->freeList;
-  pq->freeList = hCurr;
-}
diff --git a/Source/WebCore/thirdparty/glu/libtess/priorityq-heap.h b/Source/WebCore/thirdparty/glu/libtess/priorityq-heap.h
deleted file mode 100644
index 02e4434..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/priorityq-heap.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/priorityq-heap.h#5 $
-*/
-
-#ifndef __priorityq_heap_h_
-#define __priorityq_heap_h_
-
-/* Use #define's so that another heap implementation can use this one */
-
-#define PQkey			PQHeapKey
-#define PQhandle		PQHeapHandle
-#define PriorityQ		PriorityQHeap
-
-#define pqNewPriorityQ(leq)	__gl_pqHeapNewPriorityQ(leq)
-#define pqDeletePriorityQ(pq)	__gl_pqHeapDeletePriorityQ(pq)
-
-/* The basic operations are insertion of a new key (pqInsert),
- * and examination/extraction of a key whose value is minimum
- * (pqMinimum/pqExtractMin).  Deletion is also allowed (pqDelete);
- * for this purpose pqInsert returns a "handle" which is supplied
- * as the argument.
- *
- * An initial heap may be created efficiently by calling pqInsert
- * repeatedly, then calling pqInit.  In any case pqInit must be called
- * before any operations other than pqInsert are used.
- *
- * If the heap is empty, pqMinimum/pqExtractMin will return a NULL key.
- * This may also be tested with pqIsEmpty.
- */
-#define pqInit(pq)		__gl_pqHeapInit(pq)
-#define pqInsert(pq,key)	__gl_pqHeapInsert(pq,key)
-#define pqMinimum(pq)		__gl_pqHeapMinimum(pq)
-#define pqExtractMin(pq)	__gl_pqHeapExtractMin(pq)
-#define pqDelete(pq,handle)	__gl_pqHeapDelete(pq,handle)
-#define pqIsEmpty(pq)		__gl_pqHeapIsEmpty(pq)
-
-
-/* Since we support deletion the data structure is a little more
- * complicated than an ordinary heap.  "nodes" is the heap itself;
- * active nodes are stored in the range 1..pq->size.  When the
- * heap exceeds its allocated size (pq->max), its size doubles.
- * The children of node i are nodes 2i and 2i+1.
- *
- * Each node stores an index into an array "handles".  Each handle
- * stores a key, plus a pointer back to the node which currently
- * represents that key (ie. nodes[handles[i].node].handle == i).
- */
-
-typedef void *PQkey;
-typedef long PQhandle;
-typedef struct PriorityQ PriorityQ;
-
-typedef struct { PQhandle handle; } PQnode;
-typedef struct { PQkey key; PQhandle node; } PQhandleElem;
-
-struct PriorityQ {
-  PQnode	*nodes;
-  PQhandleElem	*handles;
-  long		size, max;
-  PQhandle	freeList;
-  int		initialized;
-  int		(*leq)(PQkey key1, PQkey key2);
-};
-  
-PriorityQ	*pqNewPriorityQ( int (*leq)(PQkey key1, PQkey key2) );
-void		pqDeletePriorityQ( PriorityQ *pq );
-
-void		pqInit( PriorityQ *pq );
-PQhandle	pqInsert( PriorityQ *pq, PQkey key );
-PQkey		pqExtractMin( PriorityQ *pq );
-void		pqDelete( PriorityQ *pq, PQhandle handle );
-
-
-#define __gl_pqHeapMinimum(pq)	((pq)->handles[(pq)->nodes[1].handle].key)
-#define __gl_pqHeapIsEmpty(pq)	((pq)->size == 0)
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/priorityq-sort.h b/Source/WebCore/thirdparty/glu/libtess/priorityq-sort.h
deleted file mode 100644
index fc289d6..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/priorityq-sort.h
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/priorityq-sort.h#5 $
-*/
-
-#ifndef __priorityq_sort_h_
-#define __priorityq_sort_h_
-
-#include "thirdparty/glu/libtess/priorityq-heap.h"
-
-#undef PQkey
-#undef PQhandle
-#undef PriorityQ
-#undef pqNewPriorityQ
-#undef pqDeletePriorityQ
-#undef pqInit
-#undef pqInsert
-#undef pqMinimum
-#undef pqExtractMin
-#undef pqDelete
-#undef pqIsEmpty
-
-/* Use #define's so that another heap implementation can use this one */
-
-#define PQkey			PQSortKey
-#define PQhandle		PQSortHandle
-#define PriorityQ		PriorityQSort
-
-#define pqNewPriorityQ(leq)	__gl_pqSortNewPriorityQ(leq)
-#define pqDeletePriorityQ(pq)	__gl_pqSortDeletePriorityQ(pq)
-
-/* The basic operations are insertion of a new key (pqInsert),
- * and examination/extraction of a key whose value is minimum
- * (pqMinimum/pqExtractMin).  Deletion is also allowed (pqDelete);
- * for this purpose pqInsert returns a "handle" which is supplied
- * as the argument.
- *
- * An initial heap may be created efficiently by calling pqInsert
- * repeatedly, then calling pqInit.  In any case pqInit must be called
- * before any operations other than pqInsert are used.
- *
- * If the heap is empty, pqMinimum/pqExtractMin will return a NULL key.
- * This may also be tested with pqIsEmpty.
- */
-#define pqInit(pq)		__gl_pqSortInit(pq)
-#define pqInsert(pq,key)	__gl_pqSortInsert(pq,key)
-#define pqMinimum(pq)		__gl_pqSortMinimum(pq)
-#define pqExtractMin(pq)	__gl_pqSortExtractMin(pq)
-#define pqDelete(pq,handle)	__gl_pqSortDelete(pq,handle)
-#define pqIsEmpty(pq)		__gl_pqSortIsEmpty(pq)
-
-
-/* Since we support deletion the data structure is a little more
- * complicated than an ordinary heap.  "nodes" is the heap itself;
- * active nodes are stored in the range 1..pq->size.  When the
- * heap exceeds its allocated size (pq->max), its size doubles.
- * The children of node i are nodes 2i and 2i+1.
- *
- * Each node stores an index into an array "handles".  Each handle
- * stores a key, plus a pointer back to the node which currently
- * represents that key (ie. nodes[handles[i].node].handle == i).
- */
-
-typedef PQHeapKey PQkey;
-typedef PQHeapHandle PQhandle;
-typedef struct PriorityQ PriorityQ;
-
-struct PriorityQ {
-  PriorityQHeap	*heap;
-  PQkey		*keys;
-  PQkey		**order;
-  PQhandle	size, max;
-  int		initialized;
-  int		(*leq)(PQkey key1, PQkey key2);
-};
-  
-PriorityQ	*pqNewPriorityQ( int (*leq)(PQkey key1, PQkey key2) );
-void		pqDeletePriorityQ( PriorityQ *pq );
-
-int		pqInit( PriorityQ *pq );
-PQhandle	pqInsert( PriorityQ *pq, PQkey key );
-PQkey		pqExtractMin( PriorityQ *pq );
-void		pqDelete( PriorityQ *pq, PQhandle handle );
-
-PQkey		pqMinimum( PriorityQ *pq );
-int		pqIsEmpty( PriorityQ *pq );
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/priorityq.c b/Source/WebCore/thirdparty/glu/libtess/priorityq.c
deleted file mode 100644
index 6614db0..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/priorityq.c
+++ /dev/null
@@ -1,267 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/priorityq.c#5 $
-*/
-
-#include <assert.h>
-#include <limits.h>		/* LONG_MAX */
-#include <stddef.h>
-#include "thirdparty/glu/gluos.h"
-#include "thirdparty/glu/libtess/memalloc.h"
-
-/* Include all the code for the regular heap-based queue here. */
-
-#include "thirdparty/glu/libtess/priorityq-heap.c"
-
-/* Now redefine all the function names to map to their "Sort" versions. */
-
-#include "thirdparty/glu/libtess/priorityq-sort.h"
-
-/* really __gl_pqSortNewPriorityQ */
-PriorityQ *pqNewPriorityQ( int (*leq)(PQkey key1, PQkey key2) )
-{
-  PriorityQ *pq = (PriorityQ *)memAlloc( sizeof( PriorityQ ));
-  if (pq == NULL) return NULL;
-
-  pq->heap = __gl_pqHeapNewPriorityQ( leq );
-  if (pq->heap == NULL) {
-     memFree(pq);
-     return NULL;
-  }
-
-  pq->keys = (PQHeapKey *)memAlloc( INIT_SIZE * sizeof(pq->keys[0]) );
-  if (pq->keys == NULL) {
-     __gl_pqHeapDeletePriorityQ(pq->heap);
-     memFree(pq);
-     return NULL;
-  }
-
-  pq->size = 0;
-  pq->max = INIT_SIZE;
-  pq->initialized = FALSE;
-  pq->leq = leq;
-  return pq;
-}
-
-/* really __gl_pqSortDeletePriorityQ */
-void pqDeletePriorityQ( PriorityQ *pq )
-{
-  assert(pq != NULL); 
-  if (pq->heap != NULL) __gl_pqHeapDeletePriorityQ( pq->heap );
-  if (pq->order != NULL) memFree( pq->order );
-  if (pq->keys != NULL) memFree( pq->keys );
-  memFree( pq );
-}
-
-
-#define LT(x,y)		(! LEQ(y,x))
-#define GT(x,y)		(! LEQ(x,y))
-#define Swap(a,b)	do{PQkey *tmp = *a; *a = *b; *b = tmp;}while(0)
-
-/* really __gl_pqSortInit */
-int pqInit( PriorityQ *pq )
-{
-  PQkey **p, **r, **i, **j, *piv;
-  struct { PQkey **p, **r; } Stack[50], *top = Stack;
-  unsigned long seed = 2016473283;
-
-  /* Create an array of indirect pointers to the keys, so that we
-   * the handles we have returned are still valid.
-   */
-/*
-  pq->order = (PQHeapKey **)memAlloc( (size_t)
-                                  (pq->size * sizeof(pq->order[0])) );
-*/
-  pq->order = (PQHeapKey **)memAlloc( (size_t)
-                                  ((pq->size+1) * sizeof(pq->order[0])) );
-/* the previous line is a patch to compensate for the fact that IBM */
-/* machines return a null on a malloc of zero bytes (unlike SGI),   */
-/* so we have to put in this defense to guard against a memory      */
-/* fault four lines down. from fossum@austin.ibm.com.               */
-  if (pq->order == NULL) return 0;
-
-  p = pq->order;
-  r = p + pq->size - 1;
-  for( piv = pq->keys, i = p; i <= r; ++piv, ++i ) {
-    *i = piv;
-  }
-
-  /* Sort the indirect pointers in descending order,
-   * using randomized Quicksort
-   */
-  top->p = p; top->r = r; ++top;
-  while( --top >= Stack ) {
-    p = top->p;
-    r = top->r;
-    while( r > p + 10 ) {
-      seed = seed * 1539415821 + 1;
-      i = p + seed % (r - p + 1);
-      piv = *i;
-      *i = *p;
-      *p = piv;
-      i = p - 1;
-      j = r + 1;
-      do {
-	do { ++i; } while( GT( **i, *piv ));
-	do { --j; } while( LT( **j, *piv ));
-	Swap( i, j );
-      } while( i < j );
-      Swap( i, j );	/* Undo last swap */
-      if( i - p < r - j ) {
-	top->p = j+1; top->r = r; ++top;
-	r = i-1;
-      } else {
-	top->p = p; top->r = i-1; ++top;
-	p = j+1;
-      }
-    }
-    /* Insertion sort small lists */
-    for( i = p+1; i <= r; ++i ) {
-      piv = *i;
-      for( j = i; j > p && LT( **(j-1), *piv ); --j ) {
-	*j = *(j-1);
-      }
-      *j = piv;
-    }
-  }
-  pq->max = pq->size;
-  pq->initialized = TRUE;
-  __gl_pqHeapInit( pq->heap );	/* always succeeds */
-
-#ifndef NDEBUG
-  p = pq->order;
-  r = p + pq->size - 1;
-  for( i = p; i < r; ++i ) {
-    assert( LEQ( **(i+1), **i ));
-  }
-#endif
-
-  return 1;
-}
-
-/* really __gl_pqSortInsert */
-/* returns LONG_MAX iff out of memory */ 
-PQhandle pqInsert( PriorityQ *pq, PQkey keyNew )
-{
-  long curr;
-
-  if( pq->initialized ) {
-    return __gl_pqHeapInsert( pq->heap, keyNew );
-  }
-  curr = pq->size;
-  if( ++ pq->size >= pq->max ) {
-    PQkey *saveKey= pq->keys;
-
-    /* If the heap overflows, double its size. */
-    pq->max <<= 1;
-    pq->keys = (PQHeapKey *)memRealloc( pq->keys, 
-	 	                        (size_t)
-	                                 (pq->max * sizeof( pq->keys[0] )));
-    if (pq->keys == NULL) {	
-       pq->keys = saveKey;	/* restore ptr to free upon return */
-       return LONG_MAX;
-    }
-  }
-  assert(curr != LONG_MAX);	
-  pq->keys[curr] = keyNew;
-
-  /* Negative handles index the sorted array. */
-  return -(curr+1);
-}
-
-/* really __gl_pqSortExtractMin */
-PQkey pqExtractMin( PriorityQ *pq )
-{
-  PQkey sortMin, heapMin;
-
-  if( pq->size == 0 ) {
-    return __gl_pqHeapExtractMin( pq->heap );
-  }
-  sortMin = *(pq->order[pq->size-1]);
-  if( ! __gl_pqHeapIsEmpty( pq->heap )) {
-    heapMin = __gl_pqHeapMinimum( pq->heap );
-    if( LEQ( heapMin, sortMin )) {
-      return __gl_pqHeapExtractMin( pq->heap );
-    }
-  }
-  do {
-    -- pq->size;
-  } while( pq->size > 0 && *(pq->order[pq->size-1]) == NULL );
-  return sortMin;
-}
-
-/* really __gl_pqSortMinimum */
-PQkey pqMinimum( PriorityQ *pq )
-{
-  PQkey sortMin, heapMin;
-
-  if( pq->size == 0 ) {
-    return __gl_pqHeapMinimum( pq->heap );
-  }
-  sortMin = *(pq->order[pq->size-1]);
-  if( ! __gl_pqHeapIsEmpty( pq->heap )) {
-    heapMin = __gl_pqHeapMinimum( pq->heap );
-    if( LEQ( heapMin, sortMin )) {
-      return heapMin;
-    }
-  }
-  return sortMin;
-}
-
-/* really __gl_pqSortIsEmpty */
-int pqIsEmpty( PriorityQ *pq )
-{
-  return (pq->size == 0) && __gl_pqHeapIsEmpty( pq->heap );
-}
-
-/* really __gl_pqSortDelete */
-void pqDelete( PriorityQ *pq, PQhandle curr )
-{
-  if( curr >= 0 ) {
-    __gl_pqHeapDelete( pq->heap, curr );
-    return;
-  }
-  curr = -(curr+1);
-  assert( curr < pq->max && pq->keys[curr] != NULL );
-
-  pq->keys[curr] = NULL;
-  while( pq->size > 0 && *(pq->order[pq->size-1]) == NULL ) {
-    -- pq->size;
-  }
-}
diff --git a/Source/WebCore/thirdparty/glu/libtess/priorityq.h b/Source/WebCore/thirdparty/glu/libtess/priorityq.h
deleted file mode 100644
index 77aa70b..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/priorityq.h
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/priorityq.h#5 $
-*/
-
-#ifndef __priorityq_sort_h_
-#define __priorityq_sort_h_
-
-#include "thirdparty/glu/libtess/priorityq-heap.h"
-
-#undef PQkey
-#undef PQhandle
-#undef PriorityQ
-#undef pqNewPriorityQ
-#undef pqDeletePriorityQ
-#undef pqInit
-#undef pqInsert
-#undef pqMinimum
-#undef pqExtractMin
-#undef pqDelete
-#undef pqIsEmpty
-
-/* Use #define's so that another heap implementation can use this one */
-
-#define PQkey			PQSortKey
-#define PQhandle		PQSortHandle
-#define PriorityQ		PriorityQSort
-
-#define pqNewPriorityQ(leq)	__gl_pqSortNewPriorityQ(leq)
-#define pqDeletePriorityQ(pq)	__gl_pqSortDeletePriorityQ(pq)
-
-/* The basic operations are insertion of a new key (pqInsert),
- * and examination/extraction of a key whose value is minimum
- * (pqMinimum/pqExtractMin).  Deletion is also allowed (pqDelete);
- * for this purpose pqInsert returns a "handle" which is supplied
- * as the argument.
- *
- * An initial heap may be created efficiently by calling pqInsert
- * repeatedly, then calling pqInit.  In any case pqInit must be called
- * before any operations other than pqInsert are used.
- *
- * If the heap is empty, pqMinimum/pqExtractMin will return a NULL key.
- * This may also be tested with pqIsEmpty.
- */
-#define pqInit(pq)		__gl_pqSortInit(pq)
-#define pqInsert(pq,key)	__gl_pqSortInsert(pq,key)
-#define pqMinimum(pq)		__gl_pqSortMinimum(pq)
-#define pqExtractMin(pq)	__gl_pqSortExtractMin(pq)
-#define pqDelete(pq,handle)	__gl_pqSortDelete(pq,handle)
-#define pqIsEmpty(pq)		__gl_pqSortIsEmpty(pq)
-
-
-/* Since we support deletion the data structure is a little more
- * complicated than an ordinary heap.  "nodes" is the heap itself;
- * active nodes are stored in the range 1..pq->size.  When the
- * heap exceeds its allocated size (pq->max), its size doubles.
- * The children of node i are nodes 2i and 2i+1.
- *
- * Each node stores an index into an array "handles".  Each handle
- * stores a key, plus a pointer back to the node which currently
- * represents that key (ie. nodes[handles[i].node].handle == i).
- */
-
-typedef PQHeapKey PQkey;
-typedef PQHeapHandle PQhandle;
-typedef struct PriorityQ PriorityQ;
-
-struct PriorityQ {
-  PriorityQHeap	*heap;
-  PQkey		*keys;
-  PQkey		**order;
-  PQhandle	size, max;
-  int		initialized;
-  int		(*leq)(PQkey key1, PQkey key2);
-};
-  
-PriorityQ	*pqNewPriorityQ( int (*leq)(PQkey key1, PQkey key2) );
-void		pqDeletePriorityQ( PriorityQ *pq );
-
-int		pqInit( PriorityQ *pq );
-PQhandle	pqInsert( PriorityQ *pq, PQkey key );
-PQkey		pqExtractMin( PriorityQ *pq );
-void		pqDelete( PriorityQ *pq, PQhandle handle );
-
-PQkey		pqMinimum( PriorityQ *pq );
-int		pqIsEmpty( PriorityQ *pq );
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/render.c b/Source/WebCore/thirdparty/glu/libtess/render.c
deleted file mode 100644
index 79386e8..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/render.c
+++ /dev/null
@@ -1,505 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/render.c#5 $
-*/
-
-#include <assert.h>
-#include <stddef.h>
-#include "thirdparty/glu/gluos.h"
-#include "thirdparty/glu/libtess/mesh.h"
-#include "thirdparty/glu/libtess/render.h"
-#include "thirdparty/glu/libtess/tess.h"
-
-#define TRUE 1
-#define FALSE 0
-
-/* This structure remembers the information we need about a primitive
- * to be able to render it later, once we have determined which
- * primitive is able to use the most triangles.
- */
-struct FaceCount {
-  long		size;		/* number of triangles used */
-  GLUhalfEdge	*eStart;	/* edge where this primitive starts */
-  void		(*render)(GLUtesselator *, GLUhalfEdge *, long);
-                                /* routine to render this primitive */
-};
-
-static struct FaceCount MaximumFan( GLUhalfEdge *eOrig );
-static struct FaceCount MaximumStrip( GLUhalfEdge *eOrig );
-
-static void RenderFan( GLUtesselator *tess, GLUhalfEdge *eStart, long size );
-static void RenderStrip( GLUtesselator *tess, GLUhalfEdge *eStart, long size );
-static void RenderTriangle( GLUtesselator *tess, GLUhalfEdge *eStart,
-			    long size );
-
-static void RenderMaximumFaceGroup( GLUtesselator *tess, GLUface *fOrig );
-static void RenderLonelyTriangles( GLUtesselator *tess, GLUface *head );
-
-
-
-/************************ Strips and Fans decomposition ******************/
-
-/* __gl_renderMesh( tess, mesh ) takes a mesh and breaks it into triangle
- * fans, strips, and separate triangles.  A substantial effort is made
- * to use as few rendering primitives as possible (ie. to make the fans
- * and strips as large as possible).
- *
- * The rendering output is provided as callbacks (see the api).
- */
-void __gl_renderMesh( GLUtesselator *tess, GLUmesh *mesh )
-{
-  GLUface *f;
-
-  /* Make a list of separate triangles so we can render them all at once */
-  tess->lonelyTriList = NULL;
-
-  for( f = mesh->fHead.next; f != &mesh->fHead; f = f->next ) {
-    f->marked = FALSE;
-  }
-  for( f = mesh->fHead.next; f != &mesh->fHead; f = f->next ) {
-
-    /* We examine all faces in an arbitrary order.  Whenever we find
-     * an unprocessed face F, we output a group of faces including F
-     * whose size is maximum.
-     */
-    if( f->inside && ! f->marked ) {
-      RenderMaximumFaceGroup( tess, f );
-      assert( f->marked );
-    }
-  }
-  if( tess->lonelyTriList != NULL ) {
-    RenderLonelyTriangles( tess, tess->lonelyTriList );
-    tess->lonelyTriList = NULL;
-  }
-}
-
-
-static void RenderMaximumFaceGroup( GLUtesselator *tess, GLUface *fOrig )
-{
-  /* We want to find the largest triangle fan or strip of unmarked faces
-   * which includes the given face fOrig.  There are 3 possible fans
-   * passing through fOrig (one centered at each vertex), and 3 possible
-   * strips (one for each CCW permutation of the vertices).  Our strategy
-   * is to try all of these, and take the primitive which uses the most
-   * triangles (a greedy approach).
-   */
-  GLUhalfEdge *e = fOrig->anEdge;
-  struct FaceCount max, newFace;
-
-  max.size = 1;
-  max.eStart = e;
-  max.render = &RenderTriangle;
-
-  if( ! tess->flagBoundary ) {
-    newFace = MaximumFan( e ); if( newFace.size > max.size ) { max = newFace; }
-    newFace = MaximumFan( e->Lnext ); if( newFace.size > max.size ) { max = newFace; }
-    newFace = MaximumFan( e->Lprev ); if( newFace.size > max.size ) { max = newFace; }
-
-    newFace = MaximumStrip( e ); if( newFace.size > max.size ) { max = newFace; }
-    newFace = MaximumStrip( e->Lnext ); if( newFace.size > max.size ) { max = newFace; }
-    newFace = MaximumStrip( e->Lprev ); if( newFace.size > max.size ) { max = newFace; }
-  }
-  (*(max.render))( tess, max.eStart, max.size );
-}
-
-
-/* Macros which keep track of faces we have marked temporarily, and allow
- * us to backtrack when necessary.  With triangle fans, this is not
- * really necessary, since the only awkward case is a loop of triangles
- * around a single origin vertex.  However with strips the situation is
- * more complicated, and we need a general tracking method like the
- * one here.
- */
-#define Marked(f)	(! (f)->inside || (f)->marked)
-
-#define AddToTrail(f,t)	((f)->trail = (t), (t) = (f), (f)->marked = TRUE)
-
-#define FreeTrail(t)	do { \
-			  while( (t) != NULL ) { \
-			    (t)->marked = FALSE; t = (t)->trail; \
-			  } \
-			} while(0) /* absorb trailing semicolon */
-
-
-
-static struct FaceCount MaximumFan( GLUhalfEdge *eOrig )
-{
-  /* eOrig->Lface is the face we want to render.  We want to find the size
-   * of a maximal fan around eOrig->Org.  To do this we just walk around
-   * the origin vertex as far as possible in both directions.
-   */
-  struct FaceCount newFace = { 0, NULL, &RenderFan };
-  GLUface *trail = NULL;
-  GLUhalfEdge *e;
-
-  for( e = eOrig; ! Marked( e->Lface ); e = e->Onext ) {
-    AddToTrail( e->Lface, trail );
-    ++newFace.size;
-  }
-  for( e = eOrig; ! Marked( e->Rface ); e = e->Oprev ) {
-    AddToTrail( e->Rface, trail );
-    ++newFace.size;
-  }
-  newFace.eStart = e;
-  /*LINTED*/
-  FreeTrail( trail );
-  return newFace;
-}
-
-
-#define IsEven(n)	(((n) & 1) == 0)
-
-static struct FaceCount MaximumStrip( GLUhalfEdge *eOrig )
-{
-  /* Here we are looking for a maximal strip that contains the vertices
-   * eOrig->Org, eOrig->Dst, eOrig->Lnext->Dst (in that order or the
-   * reverse, such that all triangles are oriented CCW).
-   *
-   * Again we walk forward and backward as far as possible.  However for
-   * strips there is a twist: to get CCW orientations, there must be
-   * an *even* number of triangles in the strip on one side of eOrig.
-   * We walk the strip starting on a side with an even number of triangles;
-   * if both side have an odd number, we are forced to shorten one side.
-   */
-  struct FaceCount newFace = { 0, NULL, &RenderStrip };
-  long headSize = 0, tailSize = 0;
-  GLUface *trail = NULL;
-  GLUhalfEdge *e, *eTail, *eHead;
-
-  for( e = eOrig; ! Marked( e->Lface ); ++tailSize, e = e->Onext ) {
-    AddToTrail( e->Lface, trail );
-    ++tailSize;
-    e = e->Dprev;
-    if( Marked( e->Lface )) break;
-    AddToTrail( e->Lface, trail );
-  }
-  eTail = e;
-
-  for( e = eOrig; ! Marked( e->Rface ); ++headSize, e = e->Dnext ) {
-    AddToTrail( e->Rface, trail );
-    ++headSize;
-    e = e->Oprev;
-    if( Marked( e->Rface )) break;
-    AddToTrail( e->Rface, trail );
-  }
-  eHead = e;
-
-  newFace.size = tailSize + headSize;
-  if( IsEven( tailSize )) {
-    newFace.eStart = eTail->Sym;
-  } else if( IsEven( headSize )) {
-    newFace.eStart = eHead;
-  } else {
-    /* Both sides have odd length, we must shorten one of them.  In fact,
-     * we must start from eHead to guarantee inclusion of eOrig->Lface.
-     */
-    --newFace.size;
-    newFace.eStart = eHead->Onext;
-  }
-  /*LINTED*/
-  FreeTrail( trail );
-  return newFace;
-}
-
-
-static void RenderTriangle( GLUtesselator *tess, GLUhalfEdge *e, long size )
-{
-  /* Just add the triangle to a triangle list, so we can render all
-   * the separate triangles at once.
-   */
-  assert( size == 1 );
-  AddToTrail( e->Lface, tess->lonelyTriList );
-}
-
-
-static void RenderLonelyTriangles( GLUtesselator *tess, GLUface *f )
-{
-  /* Now we render all the separate triangles which could not be
-   * grouped into a triangle fan or strip.
-   */
-  GLUhalfEdge *e;
-  int newState;
-  int edgeState = -1;	/* force edge state output for first vertex */
-
-  CALL_BEGIN_OR_BEGIN_DATA( GL_TRIANGLES );
-
-  for( ; f != NULL; f = f->trail ) {
-    /* Loop once for each edge (there will always be 3 edges) */
-
-    e = f->anEdge;
-    do {
-      if( tess->flagBoundary ) {
-	/* Set the "edge state" to TRUE just before we output the
-	 * first vertex of each edge on the polygon boundary.
-	 */
-	newState = ! e->Rface->inside;
-	if( edgeState != newState ) {
-	  edgeState = newState;
-          CALL_EDGE_FLAG_OR_EDGE_FLAG_DATA( edgeState );
-	}
-      }
-      CALL_VERTEX_OR_VERTEX_DATA( e->Org->data );
-
-      e = e->Lnext;
-    } while( e != f->anEdge );
-  }
-  CALL_END_OR_END_DATA();
-}
-
-
-static void RenderFan( GLUtesselator *tess, GLUhalfEdge *e, long size )
-{
-  /* Render as many CCW triangles as possible in a fan starting from
-   * edge "e".  The fan *should* contain exactly "size" triangles
-   * (otherwise we've goofed up somewhere).
-   */
-  CALL_BEGIN_OR_BEGIN_DATA( GL_TRIANGLE_FAN ); 
-  CALL_VERTEX_OR_VERTEX_DATA( e->Org->data ); 
-  CALL_VERTEX_OR_VERTEX_DATA( e->Dst->data ); 
-
-  while( ! Marked( e->Lface )) {
-    e->Lface->marked = TRUE;
-    --size;
-    e = e->Onext;
-    CALL_VERTEX_OR_VERTEX_DATA( e->Dst->data ); 
-  }
-
-  assert( size == 0 );
-  CALL_END_OR_END_DATA();
-}
-
-
-static void RenderStrip( GLUtesselator *tess, GLUhalfEdge *e, long size )
-{
-  /* Render as many CCW triangles as possible in a strip starting from
-   * edge "e".  The strip *should* contain exactly "size" triangles
-   * (otherwise we've goofed up somewhere).
-   */
-  CALL_BEGIN_OR_BEGIN_DATA( GL_TRIANGLE_STRIP );
-  CALL_VERTEX_OR_VERTEX_DATA( e->Org->data ); 
-  CALL_VERTEX_OR_VERTEX_DATA( e->Dst->data ); 
-
-  while( ! Marked( e->Lface )) {
-    e->Lface->marked = TRUE;
-    --size;
-    e = e->Dprev;
-    CALL_VERTEX_OR_VERTEX_DATA( e->Org->data ); 
-    if( Marked( e->Lface )) break;
-
-    e->Lface->marked = TRUE;
-    --size;
-    e = e->Onext;
-    CALL_VERTEX_OR_VERTEX_DATA( e->Dst->data ); 
-  }
-
-  assert( size == 0 );
-  CALL_END_OR_END_DATA();
-}
-
-
-/************************ Boundary contour decomposition ******************/
-
-/* __gl_renderBoundary( tess, mesh ) takes a mesh, and outputs one
- * contour for each face marked "inside".  The rendering output is
- * provided as callbacks (see the api).
- */
-void __gl_renderBoundary( GLUtesselator *tess, GLUmesh *mesh )
-{
-  GLUface *f;
-  GLUhalfEdge *e;
-
-  for( f = mesh->fHead.next; f != &mesh->fHead; f = f->next ) {
-    if( f->inside ) {
-      CALL_BEGIN_OR_BEGIN_DATA( GL_LINE_LOOP );
-      e = f->anEdge;
-      do {
-        CALL_VERTEX_OR_VERTEX_DATA( e->Org->data ); 
-	e = e->Lnext;
-      } while( e != f->anEdge );
-      CALL_END_OR_END_DATA();
-    }
-  }
-}
-
-
-/************************ Quick-and-dirty decomposition ******************/
-
-#define SIGN_INCONSISTENT 2
-
-static int ComputeNormal( GLUtesselator *tess, GLdouble norm[3], int check )
-/*
- * If check==FALSE, we compute the polygon normal and place it in norm[].
- * If check==TRUE, we check that each triangle in the fan from v0 has a
- * consistent orientation with respect to norm[].  If triangles are
- * consistently oriented CCW, return 1; if CW, return -1; if all triangles
- * are degenerate return 0; otherwise (no consistent orientation) return
- * SIGN_INCONSISTENT.
- */
-{
-  CachedVertex *v0 = tess->cache;
-  CachedVertex *vn = v0 + tess->cacheCount;
-  CachedVertex *vc;
-  GLdouble dot, xc, yc, zc, xp, yp, zp, n[3];
-  int sign = 0;
-
-  /* Find the polygon normal.  It is important to get a reasonable
-   * normal even when the polygon is self-intersecting (eg. a bowtie).
-   * Otherwise, the computed normal could be very tiny, but perpendicular
-   * to the true plane of the polygon due to numerical noise.  Then all
-   * the triangles would appear to be degenerate and we would incorrectly
-   * decompose the polygon as a fan (or simply not render it at all).
-   *
-   * We use a sum-of-triangles normal algorithm rather than the more
-   * efficient sum-of-trapezoids method (used in CheckOrientation()
-   * in normal.c).  This lets us explicitly reverse the signed area
-   * of some triangles to get a reasonable normal in the self-intersecting
-   * case.
-   */
-  if( ! check ) {
-    norm[0] = norm[1] = norm[2] = 0.0;
-  }
-
-  vc = v0 + 1;
-  xc = vc->coords[0] - v0->coords[0];
-  yc = vc->coords[1] - v0->coords[1];
-  zc = vc->coords[2] - v0->coords[2];
-  while( ++vc < vn ) {
-    xp = xc; yp = yc; zp = zc;
-    xc = vc->coords[0] - v0->coords[0];
-    yc = vc->coords[1] - v0->coords[1];
-    zc = vc->coords[2] - v0->coords[2];
-
-    /* Compute (vp - v0) cross (vc - v0) */
-    n[0] = yp*zc - zp*yc;
-    n[1] = zp*xc - xp*zc;
-    n[2] = xp*yc - yp*xc;
-
-    dot = n[0]*norm[0] + n[1]*norm[1] + n[2]*norm[2];
-    if( ! check ) {
-      /* Reverse the contribution of back-facing triangles to get
-       * a reasonable normal for self-intersecting polygons (see above)
-       */
-      if( dot >= 0 ) {
-	norm[0] += n[0]; norm[1] += n[1]; norm[2] += n[2];
-      } else {
-	norm[0] -= n[0]; norm[1] -= n[1]; norm[2] -= n[2];
-      }
-    } else if( dot != 0 ) {
-      /* Check the new orientation for consistency with previous triangles */
-      if( dot > 0 ) {
-	if( sign < 0 ) return SIGN_INCONSISTENT;
-	sign = 1;
-      } else {
-	if( sign > 0 ) return SIGN_INCONSISTENT;
-	sign = -1;
-      }
-    }
-  }
-  return sign;
-}
-
-/* __gl_renderCache( tess ) takes a single contour and tries to render it
- * as a triangle fan.  This handles convex polygons, as well as some
- * non-convex polygons if we get lucky.
- *
- * Returns TRUE if the polygon was successfully rendered.  The rendering
- * output is provided as callbacks (see the api).
- */
-GLboolean __gl_renderCache( GLUtesselator *tess )
-{
-  CachedVertex *v0 = tess->cache;
-  CachedVertex *vn = v0 + tess->cacheCount;
-  CachedVertex *vc;
-  GLdouble norm[3];
-  int sign;
-
-  if( tess->cacheCount < 3 ) {
-    /* Degenerate contour -- no output */
-    return TRUE;
-  }
-
-  norm[0] = tess->normal[0];
-  norm[1] = tess->normal[1];
-  norm[2] = tess->normal[2];
-  if( norm[0] == 0 && norm[1] == 0 && norm[2] == 0 ) {
-    ComputeNormal( tess, norm, FALSE );
-  }
-
-  sign = ComputeNormal( tess, norm, TRUE );
-  if( sign == SIGN_INCONSISTENT ) {
-    /* Fan triangles did not have a consistent orientation */
-    return FALSE;
-  }
-  if( sign == 0 ) {
-    /* All triangles were degenerate */
-    return TRUE;
-  }
-
-  /* Make sure we do the right thing for each winding rule */
-  switch( tess->windingRule ) {
-  case GLU_TESS_WINDING_ODD:
-  case GLU_TESS_WINDING_NONZERO:
-    break;
-  case GLU_TESS_WINDING_POSITIVE:
-    if( sign < 0 ) return TRUE;
-    break;
-  case GLU_TESS_WINDING_NEGATIVE:
-    if( sign > 0 ) return TRUE;
-    break;
-  case GLU_TESS_WINDING_ABS_GEQ_TWO:
-    return TRUE;
-  }
-
-  CALL_BEGIN_OR_BEGIN_DATA( tess->boundaryOnly ? GL_LINE_LOOP
-			  : (tess->cacheCount > 3) ? GL_TRIANGLE_FAN
-			  : GL_TRIANGLES );
-
-  CALL_VERTEX_OR_VERTEX_DATA( v0->data ); 
-  if( sign > 0 ) {
-    for( vc = v0+1; vc < vn; ++vc ) {
-      CALL_VERTEX_OR_VERTEX_DATA( vc->data ); 
-    }
-  } else {
-    for( vc = vn-1; vc > v0; --vc ) {
-      CALL_VERTEX_OR_VERTEX_DATA( vc->data ); 
-    }
-  }
-  CALL_END_OR_END_DATA();
-  return TRUE;
-}
diff --git a/Source/WebCore/thirdparty/glu/libtess/render.h b/Source/WebCore/thirdparty/glu/libtess/render.h
deleted file mode 100644
index d8ef914..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/render.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/render.h#5 $
-*/
-
-#ifndef __render_h_
-#define __render_h_
-
-#include "thirdparty/glu/libtess/mesh.h"
-
-/* __gl_renderMesh( tess, mesh ) takes a mesh and breaks it into triangle
- * fans, strips, and separate triangles.  A substantial effort is made
- * to use as few rendering primitives as possible (ie. to make the fans
- * and strips as large as possible).
- *
- * The rendering output is provided as callbacks (see the api).
- */
-void __gl_renderMesh( GLUtesselator *tess, GLUmesh *mesh );
-void __gl_renderBoundary( GLUtesselator *tess, GLUmesh *mesh );
-
-GLboolean __gl_renderCache( GLUtesselator *tess );
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/sweep.c b/Source/WebCore/thirdparty/glu/libtess/sweep.c
deleted file mode 100644
index 233b2da..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/sweep.c
+++ /dev/null
@@ -1,1362 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/sweep.c#5 $
-*/
-
-#include <assert.h>
-#include <setjmp.h>		/* longjmp */
-#include <limits.h>		/* LONG_MAX */
-#include <stddef.h>
-
-#include "thirdparty/glu/gluos.h"
-#include "thirdparty/glu/libtess/dict.h"
-#include "thirdparty/glu/libtess/geom.h"
-#include "thirdparty/glu/libtess/memalloc.h"
-#include "thirdparty/glu/libtess/mesh.h"
-#include "thirdparty/glu/libtess/priorityq.h"
-#include "thirdparty/glu/libtess/sweep.h"
-#include "thirdparty/glu/libtess/tess.h"
-
-#define TRUE 1
-#define FALSE 0
-
-#ifdef FOR_TRITE_TEST_PROGRAM
-extern void DebugEvent( GLUtesselator *tess );
-#else
-#define DebugEvent( tess )
-#endif
-
-/*
- * Invariants for the Edge Dictionary.
- * - each pair of adjacent edges e2=Succ(e1) satisfies EdgeLeq(e1,e2)
- *   at any valid location of the sweep event
- * - if EdgeLeq(e2,e1) as well (at any valid sweep event), then e1 and e2
- *   share a common endpoint
- * - for each e, e->Dst has been processed, but not e->Org
- * - each edge e satisfies VertLeq(e->Dst,event) && VertLeq(event,e->Org)
- *   where "event" is the current sweep line event.
- * - no edge e has zero length
- *
- * Invariants for the Mesh (the processed portion).
- * - the portion of the mesh left of the sweep line is a planar graph,
- *   ie. there is *some* way to embed it in the plane
- * - no processed edge has zero length
- * - no two processed vertices have identical coordinates
- * - each "inside" region is monotone, ie. can be broken into two chains
- *   of monotonically increasing vertices according to VertLeq(v1,v2)
- *   - a non-invariant: these chains may intersect (very slightly)
- *
- * Invariants for the Sweep.
- * - if none of the edges incident to the event vertex have an activeRegion
- *   (ie. none of these edges are in the edge dictionary), then the vertex
- *   has only right-going edges.
- * - if an edge is marked "fixUpperEdge" (it is a temporary edge introduced
- *   by ConnectRightVertex), then it is the only right-going edge from
- *   its associated vertex.  (This says that these edges exist only
- *   when it is necessary.)
- */
-
-#define MAX(x,y)	((x) >= (y) ? (x) : (y))
-#define MIN(x,y)	((x) <= (y) ? (x) : (y))
-
-/* When we merge two edges into one, we need to compute the combined
- * winding of the new edge.
- */
-#define AddWinding(eDst,eSrc)	(eDst->winding += eSrc->winding, \
-				 eDst->Sym->winding += eSrc->Sym->winding)
-
-static void SweepEvent( GLUtesselator *tess, GLUvertex *vEvent );
-static void WalkDirtyRegions( GLUtesselator *tess, ActiveRegion *regUp );
-static int CheckForRightSplice( GLUtesselator *tess, ActiveRegion *regUp );
-
-static int EdgeLeq( GLUtesselator *tess, ActiveRegion *reg1,
-		    ActiveRegion *reg2 )
-/*
- * Both edges must be directed from right to left (this is the canonical
- * direction for the upper edge of each region).
- *
- * The strategy is to evaluate a "t" value for each edge at the
- * current sweep line position, given by tess->event.  The calculations
- * are designed to be very stable, but of course they are not perfect.
- *
- * Special case: if both edge destinations are at the sweep event,
- * we sort the edges by slope (they would otherwise compare equally).
- */
-{
-  GLUvertex *event = tess->event;
-  GLUhalfEdge *e1, *e2;
-  GLdouble t1, t2;
-
-  e1 = reg1->eUp;
-  e2 = reg2->eUp;
-
-  if( e1->Dst == event ) {
-    if( e2->Dst == event ) {
-      /* Two edges right of the sweep line which meet at the sweep event.
-       * Sort them by slope.
-       */
-      if( VertLeq( e1->Org, e2->Org )) {
-	return EdgeSign( e2->Dst, e1->Org, e2->Org ) <= 0;
-      }
-      return EdgeSign( e1->Dst, e2->Org, e1->Org ) >= 0;
-    }
-    return EdgeSign( e2->Dst, event, e2->Org ) <= 0;
-  }
-  if( e2->Dst == event ) {
-    return EdgeSign( e1->Dst, event, e1->Org ) >= 0;
-  }
-
-  /* General case - compute signed distance *from* e1, e2 to event */
-  t1 = EdgeEval( e1->Dst, event, e1->Org );
-  t2 = EdgeEval( e2->Dst, event, e2->Org );
-  return (t1 >= t2);
-}
-
-
-static void DeleteRegion( GLUtesselator *tess, ActiveRegion *reg )
-{
-  if( reg->fixUpperEdge ) {
-    /* It was created with zero winding number, so it better be
-     * deleted with zero winding number (ie. it better not get merged
-     * with a real edge).
-     */
-    assert( reg->eUp->winding == 0 );
-  }
-  reg->eUp->activeRegion = NULL;
-  dictDelete( tess->dict, reg->nodeUp ); /* __gl_dictListDelete */
-  memFree( reg );
-}
-
-
-static int FixUpperEdge( ActiveRegion *reg, GLUhalfEdge *newEdge )
-/*
- * Replace an upper edge which needs fixing (see ConnectRightVertex).
- */
-{
-  assert( reg->fixUpperEdge );
-  if ( !__gl_meshDelete( reg->eUp ) ) return 0;
-  reg->fixUpperEdge = FALSE;
-  reg->eUp = newEdge;
-  newEdge->activeRegion = reg;
-
-  return 1; 
-}
-
-static ActiveRegion *TopLeftRegion( ActiveRegion *reg )
-{
-  GLUvertex *org = reg->eUp->Org;
-  GLUhalfEdge *e;
-
-  /* Find the region above the uppermost edge with the same origin */
-  do {
-    reg = RegionAbove( reg );
-  } while( reg->eUp->Org == org );
-
-  /* If the edge above was a temporary edge introduced by ConnectRightVertex,
-   * now is the time to fix it.
-   */
-  if( reg->fixUpperEdge ) {
-    e = __gl_meshConnect( RegionBelow(reg)->eUp->Sym, reg->eUp->Lnext );
-    if (e == NULL) return NULL;
-    if ( !FixUpperEdge( reg, e ) ) return NULL;
-    reg = RegionAbove( reg );
-  }
-  return reg;
-}
-
-static ActiveRegion *TopRightRegion( ActiveRegion *reg )
-{
-  GLUvertex *dst = reg->eUp->Dst;
-
-  /* Find the region above the uppermost edge with the same destination */
-  do {
-    reg = RegionAbove( reg );
-  } while( reg->eUp->Dst == dst );
-  return reg;
-}
-
-static ActiveRegion *AddRegionBelow( GLUtesselator *tess,
-				     ActiveRegion *regAbove,
-				     GLUhalfEdge *eNewUp )
-/*
- * Add a new active region to the sweep line, *somewhere* below "regAbove"
- * (according to where the new edge belongs in the sweep-line dictionary).
- * The upper edge of the new region will be "eNewUp".
- * Winding number and "inside" flag are not updated.
- */
-{
-  ActiveRegion *regNew = (ActiveRegion *)memAlloc( sizeof( ActiveRegion ));
-  if (regNew == NULL) longjmp(tess->env,1);
-
-  regNew->eUp = eNewUp;
-  /* __gl_dictListInsertBefore */ 
-  regNew->nodeUp = dictInsertBefore( tess->dict, regAbove->nodeUp, regNew );
-  if (regNew->nodeUp == NULL) longjmp(tess->env,1);
-  regNew->fixUpperEdge = FALSE;
-  regNew->sentinel = FALSE;
-  regNew->dirty = FALSE;
-
-  eNewUp->activeRegion = regNew;
-  return regNew;
-}
-
-static GLboolean IsWindingInside( GLUtesselator *tess, int n )
-{
-  switch( tess->windingRule ) {
-  case GLU_TESS_WINDING_ODD:
-    return (n & 1);
-  case GLU_TESS_WINDING_NONZERO:
-    return (n != 0);
-  case GLU_TESS_WINDING_POSITIVE:
-    return (n > 0);
-  case GLU_TESS_WINDING_NEGATIVE:
-    return (n < 0);
-  case GLU_TESS_WINDING_ABS_GEQ_TWO:
-    return (n >= 2) || (n <= -2);
-  }
-  /*LINTED*/
-  assert( FALSE );
-  /*NOTREACHED*/
-  return 0;
-}
-
-
-static void ComputeWinding( GLUtesselator *tess, ActiveRegion *reg )
-{
-  reg->windingNumber = RegionAbove(reg)->windingNumber + reg->eUp->winding;
-  reg->inside = IsWindingInside( tess, reg->windingNumber );
-}
-
-
-static void FinishRegion( GLUtesselator *tess, ActiveRegion *reg )
-/*
- * Delete a region from the sweep line.  This happens when the upper
- * and lower chains of a region meet (at a vertex on the sweep line).
- * The "inside" flag is copied to the appropriate mesh face (we could
- * not do this before -- since the structure of the mesh is always
- * changing, this face may not have even existed until now).
- */
-{
-  GLUhalfEdge *e = reg->eUp;
-  GLUface *f = e->Lface;
-
-  f->inside = reg->inside;
-  f->anEdge = e;   /* optimization for __gl_meshTessellateMonoRegion() */
-  DeleteRegion( tess, reg );
-}
-
-
-static GLUhalfEdge *FinishLeftRegions( GLUtesselator *tess,
-	       ActiveRegion *regFirst, ActiveRegion *regLast )
-/*
- * We are given a vertex with one or more left-going edges.  All affected
- * edges should be in the edge dictionary.  Starting at regFirst->eUp,
- * we walk down deleting all regions where both edges have the same
- * origin vOrg.  At the same time we copy the "inside" flag from the
- * active region to the face, since at this point each face will belong
- * to at most one region (this was not necessarily true until this point
- * in the sweep).  The walk stops at the region above regLast; if regLast
- * is NULL we walk as far as possible.  At the same time we relink the
- * mesh if necessary, so that the ordering of edges around vOrg is the
- * same as in the dictionary.
- */
-{
-  ActiveRegion *reg, *regPrev;
-  GLUhalfEdge *e, *ePrev;
-
-  regPrev = regFirst;
-  ePrev = regFirst->eUp;
-  while( regPrev != regLast ) {
-    regPrev->fixUpperEdge = FALSE;	/* placement was OK */
-    reg = RegionBelow( regPrev );
-    e = reg->eUp;
-    if( e->Org != ePrev->Org ) {
-      if( ! reg->fixUpperEdge ) {
-	/* Remove the last left-going edge.  Even though there are no further
-	 * edges in the dictionary with this origin, there may be further
-	 * such edges in the mesh (if we are adding left edges to a vertex
-	 * that has already been processed).  Thus it is important to call
-	 * FinishRegion rather than just DeleteRegion.
-	 */
-	FinishRegion( tess, regPrev );
-	break;
-      }
-      /* If the edge below was a temporary edge introduced by
-       * ConnectRightVertex, now is the time to fix it.
-       */
-      e = __gl_meshConnect( ePrev->Lprev, e->Sym );
-      if (e == NULL) longjmp(tess->env,1);
-      if ( !FixUpperEdge( reg, e ) ) longjmp(tess->env,1);
-    }
-
-    /* Relink edges so that ePrev->Onext == e */
-    if( ePrev->Onext != e ) {
-      if ( !__gl_meshSplice( e->Oprev, e ) ) longjmp(tess->env,1);
-      if ( !__gl_meshSplice( ePrev, e ) ) longjmp(tess->env,1);
-    }
-    FinishRegion( tess, regPrev );	/* may change reg->eUp */
-    ePrev = reg->eUp;
-    regPrev = reg;
-  }
-  return ePrev;
-}
-
-
-static void AddRightEdges( GLUtesselator *tess, ActiveRegion *regUp,
-       GLUhalfEdge *eFirst, GLUhalfEdge *eLast, GLUhalfEdge *eTopLeft,
-       GLboolean cleanUp )
-/*
- * Purpose: insert right-going edges into the edge dictionary, and update
- * winding numbers and mesh connectivity appropriately.  All right-going
- * edges share a common origin vOrg.  Edges are inserted CCW starting at
- * eFirst; the last edge inserted is eLast->Oprev.  If vOrg has any
- * left-going edges already processed, then eTopLeft must be the edge
- * such that an imaginary upward vertical segment from vOrg would be
- * contained between eTopLeft->Oprev and eTopLeft; otherwise eTopLeft
- * should be NULL.
- */
-{
-  ActiveRegion *reg, *regPrev;
-  GLUhalfEdge *e, *ePrev;
-  int firstTime = TRUE;
-
-  /* Insert the new right-going edges in the dictionary */
-  e = eFirst;
-  do {
-    assert( VertLeq( e->Org, e->Dst ));
-    AddRegionBelow( tess, regUp, e->Sym );
-    e = e->Onext;
-  } while ( e != eLast );
-
-  /* Walk *all* right-going edges from e->Org, in the dictionary order,
-   * updating the winding numbers of each region, and re-linking the mesh
-   * edges to match the dictionary ordering (if necessary).
-   */
-  if( eTopLeft == NULL ) {
-    eTopLeft = RegionBelow( regUp )->eUp->Rprev;
-  }
-  regPrev = regUp;
-  ePrev = eTopLeft;
-  for( ;; ) {
-    reg = RegionBelow( regPrev );
-    e = reg->eUp->Sym;
-    if( e->Org != ePrev->Org ) break;
-
-    if( e->Onext != ePrev ) {
-      /* Unlink e from its current position, and relink below ePrev */
-      if ( !__gl_meshSplice( e->Oprev, e ) ) longjmp(tess->env,1);
-      if ( !__gl_meshSplice( ePrev->Oprev, e ) ) longjmp(tess->env,1);
-    }
-    /* Compute the winding number and "inside" flag for the new regions */
-    reg->windingNumber = regPrev->windingNumber - e->winding;
-    reg->inside = IsWindingInside( tess, reg->windingNumber );
-
-    /* Check for two outgoing edges with same slope -- process these
-     * before any intersection tests (see example in __gl_computeInterior).
-     */
-    regPrev->dirty = TRUE;
-    if( ! firstTime && CheckForRightSplice( tess, regPrev )) {
-      AddWinding( e, ePrev );
-      DeleteRegion( tess, regPrev );
-      if ( !__gl_meshDelete( ePrev ) ) longjmp(tess->env,1);
-    }
-    firstTime = FALSE;
-    regPrev = reg;
-    ePrev = e;
-  }
-  regPrev->dirty = TRUE;
-  assert( regPrev->windingNumber - e->winding == reg->windingNumber );
-
-  if( cleanUp ) {
-    /* Check for intersections between newly adjacent edges. */
-    WalkDirtyRegions( tess, regPrev );
-  }
-}
-
-
-static void CallCombine( GLUtesselator *tess, GLUvertex *isect,
-			 void *data[4], GLfloat weights[4], int needed )
-{
-  GLdouble coords[3];
-
-  /* Copy coord data in case the callback changes it. */
-  coords[0] = isect->coords[0];
-  coords[1] = isect->coords[1];
-  coords[2] = isect->coords[2];
-
-  isect->data = NULL;
-  CALL_COMBINE_OR_COMBINE_DATA( coords, data, weights, &isect->data );
-  if( isect->data == NULL ) {
-    if( ! needed ) {
-      isect->data = data[0];
-    } else if( ! tess->fatalError ) {
-      /* The only way fatal error is when two edges are found to intersect,
-       * but the user has not provided the callback necessary to handle
-       * generated intersection points.
-       */
-      CALL_ERROR_OR_ERROR_DATA( GLU_TESS_NEED_COMBINE_CALLBACK );
-      tess->fatalError = TRUE;
-    }
-  }
-}
-
-static void SpliceMergeVertices( GLUtesselator *tess, GLUhalfEdge *e1,
-				 GLUhalfEdge *e2 )
-/*
- * Two vertices with idential coordinates are combined into one.
- * e1->Org is kept, while e2->Org is discarded.
- */
-{
-  void *data[4] = { NULL, NULL, NULL, NULL };
-  GLfloat weights[4] = { 0.5, 0.5, 0.0, 0.0 };
-
-  data[0] = e1->Org->data;
-  data[1] = e2->Org->data;
-  CallCombine( tess, e1->Org, data, weights, FALSE );
-  if ( !__gl_meshSplice( e1, e2 ) ) longjmp(tess->env,1); 
-}
-
-static void VertexWeights( GLUvertex *isect, GLUvertex *org, GLUvertex *dst,
-                           GLfloat *weights )
-/*
- * Find some weights which describe how the intersection vertex is
- * a linear combination of "org" and "dest".  Each of the two edges
- * which generated "isect" is allocated 50% of the weight; each edge
- * splits the weight between its org and dst according to the
- * relative distance to "isect".
- */
-{
-  GLdouble t1 = VertL1dist( org, isect );
-  GLdouble t2 = VertL1dist( dst, isect );
-
-  weights[0] = 0.5 * t2 / (t1 + t2);
-  weights[1] = 0.5 * t1 / (t1 + t2);
-  isect->coords[0] += weights[0]*org->coords[0] + weights[1]*dst->coords[0];
-  isect->coords[1] += weights[0]*org->coords[1] + weights[1]*dst->coords[1];
-  isect->coords[2] += weights[0]*org->coords[2] + weights[1]*dst->coords[2];
-}
-
-
-static void GetIntersectData( GLUtesselator *tess, GLUvertex *isect,
-       GLUvertex *orgUp, GLUvertex *dstUp,
-       GLUvertex *orgLo, GLUvertex *dstLo )
-/*
- * We've computed a new intersection point, now we need a "data" pointer
- * from the user so that we can refer to this new vertex in the
- * rendering callbacks.
- */
-{
-  void *data[4];
-  GLfloat weights[4];
-
-  data[0] = orgUp->data;
-  data[1] = dstUp->data;
-  data[2] = orgLo->data;
-  data[3] = dstLo->data;
-
-  isect->coords[0] = isect->coords[1] = isect->coords[2] = 0;
-  VertexWeights( isect, orgUp, dstUp, &weights[0] );
-  VertexWeights( isect, orgLo, dstLo, &weights[2] );
-
-  CallCombine( tess, isect, data, weights, TRUE );
-}
-
-static int CheckForRightSplice( GLUtesselator *tess, ActiveRegion *regUp )
-/*
- * Check the upper and lower edge of "regUp", to make sure that the
- * eUp->Org is above eLo, or eLo->Org is below eUp (depending on which
- * origin is leftmost).
- *
- * The main purpose is to splice right-going edges with the same
- * dest vertex and nearly identical slopes (ie. we can't distinguish
- * the slopes numerically).  However the splicing can also help us
- * to recover from numerical errors.  For example, suppose at one
- * point we checked eUp and eLo, and decided that eUp->Org is barely
- * above eLo.  Then later, we split eLo into two edges (eg. from
- * a splice operation like this one).  This can change the result of
- * our test so that now eUp->Org is incident to eLo, or barely below it.
- * We must correct this condition to maintain the dictionary invariants.
- *
- * One possibility is to check these edges for intersection again
- * (ie. CheckForIntersect).  This is what we do if possible.  However
- * CheckForIntersect requires that tess->event lies between eUp and eLo,
- * so that it has something to fall back on when the intersection
- * calculation gives us an unusable answer.  So, for those cases where
- * we can't check for intersection, this routine fixes the problem
- * by just splicing the offending vertex into the other edge.
- * This is a guaranteed solution, no matter how degenerate things get.
- * Basically this is a combinatorial solution to a numerical problem.
- */
-{
-  ActiveRegion *regLo = RegionBelow(regUp);
-  GLUhalfEdge *eUp = regUp->eUp;
-  GLUhalfEdge *eLo = regLo->eUp;
-
-  if( VertLeq( eUp->Org, eLo->Org )) {
-    if( EdgeSign( eLo->Dst, eUp->Org, eLo->Org ) > 0 ) return FALSE;
-
-    /* eUp->Org appears to be below eLo */
-    if( ! VertEq( eUp->Org, eLo->Org )) {
-      /* Splice eUp->Org into eLo */
-      if ( __gl_meshSplitEdge( eLo->Sym ) == NULL) longjmp(tess->env,1);
-      if ( !__gl_meshSplice( eUp, eLo->Oprev ) ) longjmp(tess->env,1);
-      regUp->dirty = regLo->dirty = TRUE;
-
-    } else if( eUp->Org != eLo->Org ) {
-      /* merge the two vertices, discarding eUp->Org */
-      pqDelete( tess->pq, eUp->Org->pqHandle ); /* __gl_pqSortDelete */
-      SpliceMergeVertices( tess, eLo->Oprev, eUp );
-    }
-  } else {
-    if( EdgeSign( eUp->Dst, eLo->Org, eUp->Org ) < 0 ) return FALSE;
-
-    /* eLo->Org appears to be above eUp, so splice eLo->Org into eUp */
-    RegionAbove(regUp)->dirty = regUp->dirty = TRUE;
-    if (__gl_meshSplitEdge( eUp->Sym ) == NULL) longjmp(tess->env,1);
-    if ( !__gl_meshSplice( eLo->Oprev, eUp ) ) longjmp(tess->env,1);
-  }
-  return TRUE;
-}
-
-static int CheckForLeftSplice( GLUtesselator *tess, ActiveRegion *regUp )
-/*
- * Check the upper and lower edge of "regUp", to make sure that the
- * eUp->Dst is above eLo, or eLo->Dst is below eUp (depending on which
- * destination is rightmost).
- *
- * Theoretically, this should always be true.  However, splitting an edge
- * into two pieces can change the results of previous tests.  For example,
- * suppose at one point we checked eUp and eLo, and decided that eUp->Dst
- * is barely above eLo.  Then later, we split eLo into two edges (eg. from
- * a splice operation like this one).  This can change the result of
- * the test so that now eUp->Dst is incident to eLo, or barely below it.
- * We must correct this condition to maintain the dictionary invariants
- * (otherwise new edges might get inserted in the wrong place in the
- * dictionary, and bad stuff will happen).
- *
- * We fix the problem by just splicing the offending vertex into the
- * other edge.
- */
-{
-  ActiveRegion *regLo = RegionBelow(regUp);
-  GLUhalfEdge *eUp = regUp->eUp;
-  GLUhalfEdge *eLo = regLo->eUp;
-  GLUhalfEdge *e;
-
-  assert( ! VertEq( eUp->Dst, eLo->Dst ));
-
-  if( VertLeq( eUp->Dst, eLo->Dst )) {
-    if( EdgeSign( eUp->Dst, eLo->Dst, eUp->Org ) < 0 ) return FALSE;
-
-    /* eLo->Dst is above eUp, so splice eLo->Dst into eUp */
-    RegionAbove(regUp)->dirty = regUp->dirty = TRUE;
-    e = __gl_meshSplitEdge( eUp );
-    if (e == NULL) longjmp(tess->env,1);
-    if ( !__gl_meshSplice( eLo->Sym, e ) ) longjmp(tess->env,1);
-    e->Lface->inside = regUp->inside;
-  } else {
-    if( EdgeSign( eLo->Dst, eUp->Dst, eLo->Org ) > 0 ) return FALSE;
-
-    /* eUp->Dst is below eLo, so splice eUp->Dst into eLo */
-    regUp->dirty = regLo->dirty = TRUE;
-    e = __gl_meshSplitEdge( eLo );
-    if (e == NULL) longjmp(tess->env,1);    
-    if ( !__gl_meshSplice( eUp->Lnext, eLo->Sym ) ) longjmp(tess->env,1);
-    e->Rface->inside = regUp->inside;
-  }
-  return TRUE;
-}
-
-
-static int CheckForIntersect( GLUtesselator *tess, ActiveRegion *regUp )
-/*
- * Check the upper and lower edges of the given region to see if
- * they intersect.  If so, create the intersection and add it
- * to the data structures.
- *
- * Returns TRUE if adding the new intersection resulted in a recursive
- * call to AddRightEdges(); in this case all "dirty" regions have been
- * checked for intersections, and possibly regUp has been deleted.
- */
-{
-  ActiveRegion *regLo = RegionBelow(regUp);
-  GLUhalfEdge *eUp = regUp->eUp;
-  GLUhalfEdge *eLo = regLo->eUp;
-  GLUvertex *orgUp = eUp->Org;
-  GLUvertex *orgLo = eLo->Org;
-  GLUvertex *dstUp = eUp->Dst;
-  GLUvertex *dstLo = eLo->Dst;
-  GLdouble tMinUp, tMaxLo;
-  GLUvertex isect, *orgMin;
-  GLUhalfEdge *e;
-
-  assert( ! VertEq( dstLo, dstUp ));
-  assert( EdgeSign( dstUp, tess->event, orgUp ) <= 0 );
-  assert( EdgeSign( dstLo, tess->event, orgLo ) >= 0 );
-  assert( orgUp != tess->event && orgLo != tess->event );
-  assert( ! regUp->fixUpperEdge && ! regLo->fixUpperEdge );
-
-  if( orgUp == orgLo ) return FALSE;	/* right endpoints are the same */
-
-  tMinUp = MIN( orgUp->t, dstUp->t );
-  tMaxLo = MAX( orgLo->t, dstLo->t );
-  if( tMinUp > tMaxLo ) return FALSE;	/* t ranges do not overlap */
-
-  if( VertLeq( orgUp, orgLo )) {
-    if( EdgeSign( dstLo, orgUp, orgLo ) > 0 ) return FALSE;
-  } else {
-    if( EdgeSign( dstUp, orgLo, orgUp ) < 0 ) return FALSE;
-  }
-
-  /* At this point the edges intersect, at least marginally */
-  DebugEvent( tess );
-
-  __gl_edgeIntersect( dstUp, orgUp, dstLo, orgLo, &isect );
-  /* The following properties are guaranteed: */
-  assert( MIN( orgUp->t, dstUp->t ) <= isect.t );
-  assert( isect.t <= MAX( orgLo->t, dstLo->t ));
-  assert( MIN( dstLo->s, dstUp->s ) <= isect.s );
-  assert( isect.s <= MAX( orgLo->s, orgUp->s ));
-
-  if( VertLeq( &isect, tess->event )) {
-    /* The intersection point lies slightly to the left of the sweep line,
-     * so move it until it''s slightly to the right of the sweep line.
-     * (If we had perfect numerical precision, this would never happen
-     * in the first place).  The easiest and safest thing to do is
-     * replace the intersection by tess->event.
-     */
-    isect.s = tess->event->s;
-    isect.t = tess->event->t;
-  }
-  /* Similarly, if the computed intersection lies to the right of the
-   * rightmost origin (which should rarely happen), it can cause
-   * unbelievable inefficiency on sufficiently degenerate inputs.
-   * (If you have the test program, try running test54.d with the
-   * "X zoom" option turned on).
-   */
-  orgMin = VertLeq( orgUp, orgLo ) ? orgUp : orgLo;
-  if( VertLeq( orgMin, &isect )) {
-    isect.s = orgMin->s;
-    isect.t = orgMin->t;
-  }
-
-  if( VertEq( &isect, orgUp ) || VertEq( &isect, orgLo )) {
-    /* Easy case -- intersection at one of the right endpoints */
-    (void) CheckForRightSplice( tess, regUp );
-    return FALSE;
-  }
-
-  if(    (! VertEq( dstUp, tess->event )
-	  && EdgeSign( dstUp, tess->event, &isect ) >= 0)
-      || (! VertEq( dstLo, tess->event )
-	  && EdgeSign( dstLo, tess->event, &isect ) <= 0 ))
-  {
-    /* Very unusual -- the new upper or lower edge would pass on the
-     * wrong side of the sweep event, or through it.  This can happen
-     * due to very small numerical errors in the intersection calculation.
-     */
-    if( dstLo == tess->event ) {
-      /* Splice dstLo into eUp, and process the new region(s) */
-      if (__gl_meshSplitEdge( eUp->Sym ) == NULL) longjmp(tess->env,1);
-      if ( !__gl_meshSplice( eLo->Sym, eUp ) ) longjmp(tess->env,1);
-      regUp = TopLeftRegion( regUp );
-      if (regUp == NULL) longjmp(tess->env,1);
-      eUp = RegionBelow(regUp)->eUp;
-      FinishLeftRegions( tess, RegionBelow(regUp), regLo );
-      AddRightEdges( tess, regUp, eUp->Oprev, eUp, eUp, TRUE );
-      return TRUE;
-    }
-    if( dstUp == tess->event ) {
-      /* Splice dstUp into eLo, and process the new region(s) */
-      if (__gl_meshSplitEdge( eLo->Sym ) == NULL) longjmp(tess->env,1);
-      if ( !__gl_meshSplice( eUp->Lnext, eLo->Oprev ) ) longjmp(tess->env,1); 
-      regLo = regUp;
-      regUp = TopRightRegion( regUp );
-      e = RegionBelow(regUp)->eUp->Rprev;
-      regLo->eUp = eLo->Oprev;
-      eLo = FinishLeftRegions( tess, regLo, NULL );
-      AddRightEdges( tess, regUp, eLo->Onext, eUp->Rprev, e, TRUE );
-      return TRUE;
-    }
-    /* Special case: called from ConnectRightVertex.  If either
-     * edge passes on the wrong side of tess->event, split it
-     * (and wait for ConnectRightVertex to splice it appropriately).
-     */
-    if( EdgeSign( dstUp, tess->event, &isect ) >= 0 ) {
-      RegionAbove(regUp)->dirty = regUp->dirty = TRUE;
-      if (__gl_meshSplitEdge( eUp->Sym ) == NULL) longjmp(tess->env,1);
-      eUp->Org->s = tess->event->s;
-      eUp->Org->t = tess->event->t;
-    }
-    if( EdgeSign( dstLo, tess->event, &isect ) <= 0 ) {
-      regUp->dirty = regLo->dirty = TRUE;
-      if (__gl_meshSplitEdge( eLo->Sym ) == NULL) longjmp(tess->env,1);
-      eLo->Org->s = tess->event->s;
-      eLo->Org->t = tess->event->t;
-    }
-    /* leave the rest for ConnectRightVertex */
-    return FALSE;
-  }
-
-  /* General case -- split both edges, splice into new vertex.
-   * When we do the splice operation, the order of the arguments is
-   * arbitrary as far as correctness goes.  However, when the operation
-   * creates a new face, the work done is proportional to the size of
-   * the new face.  We expect the faces in the processed part of
-   * the mesh (ie. eUp->Lface) to be smaller than the faces in the
-   * unprocessed original contours (which will be eLo->Oprev->Lface).
-   */
-  if (__gl_meshSplitEdge( eUp->Sym ) == NULL) longjmp(tess->env,1);
-  if (__gl_meshSplitEdge( eLo->Sym ) == NULL) longjmp(tess->env,1);
-  if ( !__gl_meshSplice( eLo->Oprev, eUp ) ) longjmp(tess->env,1);
-  eUp->Org->s = isect.s;
-  eUp->Org->t = isect.t;
-  eUp->Org->pqHandle = pqInsert( tess->pq, eUp->Org ); /* __gl_pqSortInsert */
-  if (eUp->Org->pqHandle == LONG_MAX) {
-     pqDeletePriorityQ(tess->pq);	/* __gl_pqSortDeletePriorityQ */
-     tess->pq = NULL;
-     longjmp(tess->env,1);
-  }
-  GetIntersectData( tess, eUp->Org, orgUp, dstUp, orgLo, dstLo );
-  RegionAbove(regUp)->dirty = regUp->dirty = regLo->dirty = TRUE;
-  return FALSE;
-}
-
-static void WalkDirtyRegions( GLUtesselator *tess, ActiveRegion *regUp )
-/*
- * When the upper or lower edge of any region changes, the region is
- * marked "dirty".  This routine walks through all the dirty regions
- * and makes sure that the dictionary invariants are satisfied
- * (see the comments at the beginning of this file).  Of course
- * new dirty regions can be created as we make changes to restore
- * the invariants.
- */
-{
-  ActiveRegion *regLo = RegionBelow(regUp);
-  GLUhalfEdge *eUp, *eLo;
-
-  for( ;; ) {
-    /* Find the lowest dirty region (we walk from the bottom up). */
-    while( regLo->dirty ) {
-      regUp = regLo;
-      regLo = RegionBelow(regLo);
-    }
-    if( ! regUp->dirty ) {
-      regLo = regUp;
-      regUp = RegionAbove( regUp );
-      if( regUp == NULL || ! regUp->dirty ) {
-	/* We've walked all the dirty regions */
-	return;
-      }
-    }
-    regUp->dirty = FALSE;
-    eUp = regUp->eUp;
-    eLo = regLo->eUp;
-
-    if( eUp->Dst != eLo->Dst ) {
-      /* Check that the edge ordering is obeyed at the Dst vertices. */
-      if( CheckForLeftSplice( tess, regUp )) {
-
-	/* If the upper or lower edge was marked fixUpperEdge, then
-	 * we no longer need it (since these edges are needed only for
-	 * vertices which otherwise have no right-going edges).
-	 */
-	if( regLo->fixUpperEdge ) {
-	  DeleteRegion( tess, regLo );
-	  if ( !__gl_meshDelete( eLo ) ) longjmp(tess->env,1);
-	  regLo = RegionBelow( regUp );
-	  eLo = regLo->eUp;
-	} else if( regUp->fixUpperEdge ) {
-	  DeleteRegion( tess, regUp );
-	  if ( !__gl_meshDelete( eUp ) ) longjmp(tess->env,1);
-	  regUp = RegionAbove( regLo );
-	  eUp = regUp->eUp;
-	}
-      }
-    }
-    if( eUp->Org != eLo->Org ) {
-      if(    eUp->Dst != eLo->Dst
-	  && ! regUp->fixUpperEdge && ! regLo->fixUpperEdge
-          && (eUp->Dst == tess->event || eLo->Dst == tess->event) )
-      {
-	/* When all else fails in CheckForIntersect(), it uses tess->event
-	 * as the intersection location.  To make this possible, it requires
-	 * that tess->event lie between the upper and lower edges, and also
-	 * that neither of these is marked fixUpperEdge (since in the worst
-	 * case it might splice one of these edges into tess->event, and
-	 * violate the invariant that fixable edges are the only right-going
-	 * edge from their associated vertex).
-         */
-	if( CheckForIntersect( tess, regUp )) {
-	  /* WalkDirtyRegions() was called recursively; we're done */
-	  return;
-	}
-      } else {
-	/* Even though we can't use CheckForIntersect(), the Org vertices
-	 * may violate the dictionary edge ordering.  Check and correct this.
-	 */
-	(void) CheckForRightSplice( tess, regUp );
-      }
-    }
-    if( eUp->Org == eLo->Org && eUp->Dst == eLo->Dst ) {
-      /* A degenerate loop consisting of only two edges -- delete it. */
-      AddWinding( eLo, eUp );
-      DeleteRegion( tess, regUp );
-      if ( !__gl_meshDelete( eUp ) ) longjmp(tess->env,1);
-      regUp = RegionAbove( regLo );
-    }
-  }
-}
-
-
-static void ConnectRightVertex( GLUtesselator *tess, ActiveRegion *regUp,
-			        GLUhalfEdge *eBottomLeft )
-/*
- * Purpose: connect a "right" vertex vEvent (one where all edges go left)
- * to the unprocessed portion of the mesh.  Since there are no right-going
- * edges, two regions (one above vEvent and one below) are being merged
- * into one.  "regUp" is the upper of these two regions.
- *
- * There are two reasons for doing this (adding a right-going edge):
- *  - if the two regions being merged are "inside", we must add an edge
- *    to keep them separated (the combined region would not be monotone).
- *  - in any case, we must leave some record of vEvent in the dictionary,
- *    so that we can merge vEvent with features that we have not seen yet.
- *    For example, maybe there is a vertical edge which passes just to
- *    the right of vEvent; we would like to splice vEvent into this edge.
- *
- * However, we don't want to connect vEvent to just any vertex.  We don''t
- * want the new edge to cross any other edges; otherwise we will create
- * intersection vertices even when the input data had no self-intersections.
- * (This is a bad thing; if the user's input data has no intersections,
- * we don't want to generate any false intersections ourselves.)
- *
- * Our eventual goal is to connect vEvent to the leftmost unprocessed
- * vertex of the combined region (the union of regUp and regLo).
- * But because of unseen vertices with all right-going edges, and also
- * new vertices which may be created by edge intersections, we don''t
- * know where that leftmost unprocessed vertex is.  In the meantime, we
- * connect vEvent to the closest vertex of either chain, and mark the region
- * as "fixUpperEdge".  This flag says to delete and reconnect this edge
- * to the next processed vertex on the boundary of the combined region.
- * Quite possibly the vertex we connected to will turn out to be the
- * closest one, in which case we won''t need to make any changes.
- */
-{
-  GLUhalfEdge *eNew;
-  GLUhalfEdge *eTopLeft = eBottomLeft->Onext;
-  ActiveRegion *regLo = RegionBelow(regUp);
-  GLUhalfEdge *eUp = regUp->eUp;
-  GLUhalfEdge *eLo = regLo->eUp;
-  int degenerate = FALSE;
-
-  if( eUp->Dst != eLo->Dst ) {
-    (void) CheckForIntersect( tess, regUp );
-  }
-
-  /* Possible new degeneracies: upper or lower edge of regUp may pass
-   * through vEvent, or may coincide with new intersection vertex
-   */
-  if( VertEq( eUp->Org, tess->event )) {
-    if ( !__gl_meshSplice( eTopLeft->Oprev, eUp ) ) longjmp(tess->env,1);
-    regUp = TopLeftRegion( regUp );
-    if (regUp == NULL) longjmp(tess->env,1);
-    eTopLeft = RegionBelow( regUp )->eUp;
-    FinishLeftRegions( tess, RegionBelow(regUp), regLo );
-    degenerate = TRUE;
-  }
-  if( VertEq( eLo->Org, tess->event )) {
-    if ( !__gl_meshSplice( eBottomLeft, eLo->Oprev ) ) longjmp(tess->env,1);
-    eBottomLeft = FinishLeftRegions( tess, regLo, NULL );
-    degenerate = TRUE;
-  }
-  if( degenerate ) {
-    AddRightEdges( tess, regUp, eBottomLeft->Onext, eTopLeft, eTopLeft, TRUE );
-    return;
-  }
-
-  /* Non-degenerate situation -- need to add a temporary, fixable edge.
-   * Connect to the closer of eLo->Org, eUp->Org.
-   */
-  if( VertLeq( eLo->Org, eUp->Org )) {
-    eNew = eLo->Oprev;
-  } else {
-    eNew = eUp;
-  }
-  eNew = __gl_meshConnect( eBottomLeft->Lprev, eNew );
-  if (eNew == NULL) longjmp(tess->env,1);
-
-  /* Prevent cleanup, otherwise eNew might disappear before we've even
-   * had a chance to mark it as a temporary edge.
-   */
-  AddRightEdges( tess, regUp, eNew, eNew->Onext, eNew->Onext, FALSE );
-  eNew->Sym->activeRegion->fixUpperEdge = TRUE;
-  WalkDirtyRegions( tess, regUp );
-}
-
-/* Because vertices at exactly the same location are merged together
- * before we process the sweep event, some degenerate cases can't occur.
- * However if someone eventually makes the modifications required to
- * merge features which are close together, the cases below marked
- * TOLERANCE_NONZERO will be useful.  They were debugged before the
- * code to merge identical vertices in the main loop was added.
- */
-#define TOLERANCE_NONZERO	FALSE
-
-static void ConnectLeftDegenerate( GLUtesselator *tess,
-				   ActiveRegion *regUp, GLUvertex *vEvent )
-/*
- * The event vertex lies exacty on an already-processed edge or vertex.
- * Adding the new vertex involves splicing it into the already-processed
- * part of the mesh.
- */
-{
-  GLUhalfEdge *e, *eTopLeft, *eTopRight, *eLast;
-  ActiveRegion *reg;
-
-  e = regUp->eUp;
-  if( VertEq( e->Org, vEvent )) {
-    /* e->Org is an unprocessed vertex - just combine them, and wait
-     * for e->Org to be pulled from the queue
-     */
-    assert( TOLERANCE_NONZERO );
-    SpliceMergeVertices( tess, e, vEvent->anEdge );
-    return;
-  }
-  
-  if( ! VertEq( e->Dst, vEvent )) {
-    /* General case -- splice vEvent into edge e which passes through it */
-    if (__gl_meshSplitEdge( e->Sym ) == NULL) longjmp(tess->env,1);
-    if( regUp->fixUpperEdge ) {
-      /* This edge was fixable -- delete unused portion of original edge */
-      if ( !__gl_meshDelete( e->Onext ) ) longjmp(tess->env,1);
-      regUp->fixUpperEdge = FALSE;
-    }
-    if ( !__gl_meshSplice( vEvent->anEdge, e ) ) longjmp(tess->env,1);
-    SweepEvent( tess, vEvent );	/* recurse */
-    return;
-  }
-
-  /* vEvent coincides with e->Dst, which has already been processed.
-   * Splice in the additional right-going edges.
-   */
-  assert( TOLERANCE_NONZERO );
-  regUp = TopRightRegion( regUp );
-  reg = RegionBelow( regUp );
-  eTopRight = reg->eUp->Sym;
-  eTopLeft = eLast = eTopRight->Onext;
-  if( reg->fixUpperEdge ) {
-    /* Here e->Dst has only a single fixable edge going right.
-     * We can delete it since now we have some real right-going edges.
-     */
-    assert( eTopLeft != eTopRight );   /* there are some left edges too */
-    DeleteRegion( tess, reg );
-    if ( !__gl_meshDelete( eTopRight ) ) longjmp(tess->env,1);
-    eTopRight = eTopLeft->Oprev;
-  }
-  if ( !__gl_meshSplice( vEvent->anEdge, eTopRight ) ) longjmp(tess->env,1);
-  if( ! EdgeGoesLeft( eTopLeft )) {
-    /* e->Dst had no left-going edges -- indicate this to AddRightEdges() */
-    eTopLeft = NULL;
-  }
-  AddRightEdges( tess, regUp, eTopRight->Onext, eLast, eTopLeft, TRUE );
-}
-
-
-static void ConnectLeftVertex( GLUtesselator *tess, GLUvertex *vEvent )
-/*
- * Purpose: connect a "left" vertex (one where both edges go right)
- * to the processed portion of the mesh.  Let R be the active region
- * containing vEvent, and let U and L be the upper and lower edge
- * chains of R.  There are two possibilities:
- *
- * - the normal case: split R into two regions, by connecting vEvent to
- *   the rightmost vertex of U or L lying to the left of the sweep line
- *
- * - the degenerate case: if vEvent is close enough to U or L, we
- *   merge vEvent into that edge chain.  The subcases are:
- *	- merging with the rightmost vertex of U or L
- *	- merging with the active edge of U or L
- *	- merging with an already-processed portion of U or L
- */
-{
-  ActiveRegion *regUp, *regLo, *reg;
-  GLUhalfEdge *eUp, *eLo, *eNew;
-  ActiveRegion tmp;
-
-  /* assert( vEvent->anEdge->Onext->Onext == vEvent->anEdge ); */
-
-  /* Get a pointer to the active region containing vEvent */
-  tmp.eUp = vEvent->anEdge->Sym;
-  /* __GL_DICTLISTKEY */ /* __gl_dictListSearch */
-  regUp = (ActiveRegion *)dictKey( dictSearch( tess->dict, &tmp ));
-  regLo = RegionBelow( regUp );
-  eUp = regUp->eUp;
-  eLo = regLo->eUp;
-
-  /* Try merging with U or L first */
-  if( EdgeSign( eUp->Dst, vEvent, eUp->Org ) == 0 ) {
-    ConnectLeftDegenerate( tess, regUp, vEvent );
-    return;
-  }
-
-  /* Connect vEvent to rightmost processed vertex of either chain.
-   * e->Dst is the vertex that we will connect to vEvent.
-   */
-  reg = VertLeq( eLo->Dst, eUp->Dst ) ? regUp : regLo;
-
-  if( regUp->inside || reg->fixUpperEdge) {
-    if( reg == regUp ) {
-      eNew = __gl_meshConnect( vEvent->anEdge->Sym, eUp->Lnext );
-      if (eNew == NULL) longjmp(tess->env,1);
-    } else {
-      GLUhalfEdge *tempHalfEdge= __gl_meshConnect( eLo->Dnext, vEvent->anEdge);
-      if (tempHalfEdge == NULL) longjmp(tess->env,1);
-
-      eNew = tempHalfEdge->Sym;
-    }
-    if( reg->fixUpperEdge ) {
-      if ( !FixUpperEdge( reg, eNew ) ) longjmp(tess->env,1);
-    } else {
-      ComputeWinding( tess, AddRegionBelow( tess, regUp, eNew ));
-    }
-    SweepEvent( tess, vEvent );
-  } else {
-    /* The new vertex is in a region which does not belong to the polygon.
-     * We don''t need to connect this vertex to the rest of the mesh.
-     */
-    AddRightEdges( tess, regUp, vEvent->anEdge, vEvent->anEdge, NULL, TRUE );
-  }
-}
-
-
-static void SweepEvent( GLUtesselator *tess, GLUvertex *vEvent )
-/*
- * Does everything necessary when the sweep line crosses a vertex.
- * Updates the mesh and the edge dictionary.
- */
-{
-  ActiveRegion *regUp, *reg;
-  GLUhalfEdge *e, *eTopLeft, *eBottomLeft;
-
-  tess->event = vEvent;		/* for access in EdgeLeq() */
-  DebugEvent( tess );
-  
-  /* Check if this vertex is the right endpoint of an edge that is
-   * already in the dictionary.  In this case we don't need to waste
-   * time searching for the location to insert new edges.
-   */
-  e = vEvent->anEdge;
-  while( e->activeRegion == NULL ) {
-    e = e->Onext;
-    if( e == vEvent->anEdge ) {
-      /* All edges go right -- not incident to any processed edges */
-      ConnectLeftVertex( tess, vEvent );
-      return;
-    }
-  }
-
-  /* Processing consists of two phases: first we "finish" all the
-   * active regions where both the upper and lower edges terminate
-   * at vEvent (ie. vEvent is closing off these regions).
-   * We mark these faces "inside" or "outside" the polygon according
-   * to their winding number, and delete the edges from the dictionary.
-   * This takes care of all the left-going edges from vEvent.
-   */
-  regUp = TopLeftRegion( e->activeRegion );
-  if (regUp == NULL) longjmp(tess->env,1);
-  reg = RegionBelow( regUp );
-  eTopLeft = reg->eUp;
-  eBottomLeft = FinishLeftRegions( tess, reg, NULL );
-
-  /* Next we process all the right-going edges from vEvent.  This
-   * involves adding the edges to the dictionary, and creating the
-   * associated "active regions" which record information about the
-   * regions between adjacent dictionary edges.
-   */
-  if( eBottomLeft->Onext == eTopLeft ) {
-    /* No right-going edges -- add a temporary "fixable" edge */
-    ConnectRightVertex( tess, regUp, eBottomLeft );
-  } else {
-    AddRightEdges( tess, regUp, eBottomLeft->Onext, eTopLeft, eTopLeft, TRUE );
-  }
-}
-
-
-/* Make the sentinel coordinates big enough that they will never be
- * merged with real input features.  (Even with the largest possible
- * input contour and the maximum tolerance of 1.0, no merging will be
- * done with coordinates larger than 3 * GLU_TESS_MAX_COORD).
- */
-#define SENTINEL_COORD	(4 * GLU_TESS_MAX_COORD)
-
-static void AddSentinel( GLUtesselator *tess, GLdouble t )
-/*
- * We add two sentinel edges above and below all other edges,
- * to avoid special cases at the top and bottom.
- */
-{
-  GLUhalfEdge *e;
-  ActiveRegion *reg = (ActiveRegion *)memAlloc( sizeof( ActiveRegion ));
-  if (reg == NULL) longjmp(tess->env,1);
-
-  e = __gl_meshMakeEdge( tess->mesh );
-  if (e == NULL) longjmp(tess->env,1);
-
-  e->Org->s = SENTINEL_COORD;
-  e->Org->t = t;
-  e->Dst->s = -SENTINEL_COORD;
-  e->Dst->t = t;
-  tess->event = e->Dst;		/* initialize it */
-
-  reg->eUp = e;
-  reg->windingNumber = 0;
-  reg->inside = FALSE;
-  reg->fixUpperEdge = FALSE;
-  reg->sentinel = TRUE;
-  reg->dirty = FALSE;
-  reg->nodeUp = dictInsert( tess->dict, reg ); /* __gl_dictListInsertBefore */
-  if (reg->nodeUp == NULL) longjmp(tess->env,1);
-}
-
-
-static void InitEdgeDict( GLUtesselator *tess )
-/*
- * We maintain an ordering of edge intersections with the sweep line.
- * This order is maintained in a dynamic dictionary.
- */
-{
-  /* __gl_dictListNewDict */
-  tess->dict = dictNewDict( tess, (int (*)(void *, DictKey, DictKey)) EdgeLeq );
-  if (tess->dict == NULL) longjmp(tess->env,1);
-
-  AddSentinel( tess, -SENTINEL_COORD );
-  AddSentinel( tess, SENTINEL_COORD );
-}
-
-
-static void DoneEdgeDict( GLUtesselator *tess )
-{
-  ActiveRegion *reg;
-#ifndef NDEBUG
-  int fixedEdges = 0;
-#endif
-
-  /* __GL_DICTLISTKEY */ /* __GL_DICTLISTMIN */
-  while( (reg = (ActiveRegion *)dictKey( dictMin( tess->dict ))) != NULL ) {
-    /*
-     * At the end of all processing, the dictionary should contain
-     * only the two sentinel edges, plus at most one "fixable" edge
-     * created by ConnectRightVertex().
-     */
-    if( ! reg->sentinel ) {
-      assert( reg->fixUpperEdge );
-      assert( ++fixedEdges == 1 );
-    }
-    assert( reg->windingNumber == 0 );
-    DeleteRegion( tess, reg );
-/*    __gl_meshDelete( reg->eUp );*/
-  }
-  dictDeleteDict( tess->dict );	/* __gl_dictListDeleteDict */
-}
-
-
-static void RemoveDegenerateEdges( GLUtesselator *tess )
-/*
- * Remove zero-length edges, and contours with fewer than 3 vertices.
- */
-{
-  GLUhalfEdge *e, *eNext, *eLnext;
-  GLUhalfEdge *eHead = &tess->mesh->eHead;
-
-  /*LINTED*/
-  for( e = eHead->next; e != eHead; e = eNext ) {
-    eNext = e->next;
-    eLnext = e->Lnext;
-    
-    if( VertEq( e->Org, e->Dst ) && e->Lnext->Lnext != e ) {
-      /* Zero-length edge, contour has at least 3 edges */
-      
-      SpliceMergeVertices( tess, eLnext, e );	/* deletes e->Org */
-      if ( !__gl_meshDelete( e ) ) longjmp(tess->env,1); /* e is a self-loop */
-      e = eLnext;
-      eLnext = e->Lnext;
-    }
-    if( eLnext->Lnext == e ) {
-      /* Degenerate contour (one or two edges) */
-      
-      if( eLnext != e ) {
-	if( eLnext == eNext || eLnext == eNext->Sym ) { eNext = eNext->next; }
-	if ( !__gl_meshDelete( eLnext ) ) longjmp(tess->env,1);
-      }
-      if( e == eNext || e == eNext->Sym ) { eNext = eNext->next; }
-      if ( !__gl_meshDelete( e ) ) longjmp(tess->env,1);
-    }
-  }
-}
-
-static int InitPriorityQ( GLUtesselator *tess )
-/*
- * Insert all vertices into the priority queue which determines the
- * order in which vertices cross the sweep line.
- */
-{
-  PriorityQ *pq;
-  GLUvertex *v, *vHead;
-
-  /* __gl_pqSortNewPriorityQ */
-  pq = tess->pq = pqNewPriorityQ( (int (*)(PQkey, PQkey)) __gl_vertLeq );
-  if (pq == NULL) return 0;
-
-  vHead = &tess->mesh->vHead;
-  for( v = vHead->next; v != vHead; v = v->next ) {
-    v->pqHandle = pqInsert( pq, v ); /* __gl_pqSortInsert */
-    if (v->pqHandle == LONG_MAX) break;
-  }
-  if (v != vHead || !pqInit( pq ) ) { /* __gl_pqSortInit */
-    pqDeletePriorityQ(tess->pq);	/* __gl_pqSortDeletePriorityQ */
-    tess->pq = NULL;
-    return 0;
-  }
-
-  return 1;
-}
-
-
-static void DonePriorityQ( GLUtesselator *tess )
-{
-  pqDeletePriorityQ( tess->pq ); /* __gl_pqSortDeletePriorityQ */
-}
-
-
-static int RemoveDegenerateFaces( GLUmesh *mesh )
-/*
- * Delete any degenerate faces with only two edges.  WalkDirtyRegions()
- * will catch almost all of these, but it won't catch degenerate faces
- * produced by splice operations on already-processed edges.
- * The two places this can happen are in FinishLeftRegions(), when
- * we splice in a "temporary" edge produced by ConnectRightVertex(),
- * and in CheckForLeftSplice(), where we splice already-processed
- * edges to ensure that our dictionary invariants are not violated
- * by numerical errors.
- *
- * In both these cases it is *very* dangerous to delete the offending
- * edge at the time, since one of the routines further up the stack
- * will sometimes be keeping a pointer to that edge.
- */
-{
-  GLUface *f, *fNext;
-  GLUhalfEdge *e;
-
-  /*LINTED*/
-  for( f = mesh->fHead.next; f != &mesh->fHead; f = fNext ) {
-    fNext = f->next;
-    e = f->anEdge;
-    assert( e->Lnext != e );
-
-    if( e->Lnext->Lnext == e ) {
-      /* A face with only two edges */
-      AddWinding( e->Onext, e );
-      if ( !__gl_meshDelete( e ) ) return 0;
-    }
-  }
-  return 1;
-}
-
-int __gl_computeInterior( GLUtesselator *tess )
-/*
- * __gl_computeInterior( tess ) computes the planar arrangement specified
- * by the given contours, and further subdivides this arrangement
- * into regions.  Each region is marked "inside" if it belongs
- * to the polygon, according to the rule given by tess->windingRule.
- * Each interior region is guaranteed be monotone.
- */
-{
-  GLUvertex *v, *vNext;
-
-  tess->fatalError = FALSE;
-
-  /* Each vertex defines an event for our sweep line.  Start by inserting
-   * all the vertices in a priority queue.  Events are processed in
-   * lexicographic order, ie.
-   *
-   *	e1 < e2  iff  e1.x < e2.x || (e1.x == e2.x && e1.y < e2.y)
-   */
-  RemoveDegenerateEdges( tess );
-  if ( !InitPriorityQ( tess ) ) return 0; /* if error */
-  InitEdgeDict( tess );
-
-  /* __gl_pqSortExtractMin */
-  while( (v = (GLUvertex *)pqExtractMin( tess->pq )) != NULL ) {
-    for( ;; ) {
-      vNext = (GLUvertex *)pqMinimum( tess->pq ); /* __gl_pqSortMinimum */
-      if( vNext == NULL || ! VertEq( vNext, v )) break;
-      
-      /* Merge together all vertices at exactly the same location.
-       * This is more efficient than processing them one at a time,
-       * simplifies the code (see ConnectLeftDegenerate), and is also
-       * important for correct handling of certain degenerate cases.
-       * For example, suppose there are two identical edges A and B
-       * that belong to different contours (so without this code they would
-       * be processed by separate sweep events).  Suppose another edge C
-       * crosses A and B from above.  When A is processed, we split it
-       * at its intersection point with C.  However this also splits C,
-       * so when we insert B we may compute a slightly different
-       * intersection point.  This might leave two edges with a small
-       * gap between them.  This kind of error is especially obvious
-       * when using boundary extraction (GLU_TESS_BOUNDARY_ONLY).
-       */
-      vNext = (GLUvertex *)pqExtractMin( tess->pq ); /* __gl_pqSortExtractMin*/
-      SpliceMergeVertices( tess, v->anEdge, vNext->anEdge );
-    }
-    SweepEvent( tess, v );
-  }
-
-  /* Set tess->event for debugging purposes */
-  /* __GL_DICTLISTKEY */ /* __GL_DICTLISTMIN */ 
-  tess->event = ((ActiveRegion *) dictKey( dictMin( tess->dict )))->eUp->Org;
-  DebugEvent( tess );
-  DoneEdgeDict( tess );
-  DonePriorityQ( tess );
-
-  if ( !RemoveDegenerateFaces( tess->mesh ) ) return 0;
-  __gl_meshCheckMesh( tess->mesh );
-
-  return 1;
-}
diff --git a/Source/WebCore/thirdparty/glu/libtess/sweep.h b/Source/WebCore/thirdparty/glu/libtess/sweep.h
deleted file mode 100644
index c099450..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/sweep.h
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/sweep.h#5 $
-*/
-
-#ifndef __sweep_h_
-#define __sweep_h_
-
-#include "thirdparty/glu/libtess/mesh.h"
-
-/* __gl_computeInterior( tess ) computes the planar arrangement specified
- * by the given contours, and further subdivides this arrangement
- * into regions.  Each region is marked "inside" if it belongs
- * to the polygon, according to the rule given by tess->windingRule.
- * Each interior region is guaranteed be monotone.
- */
-int __gl_computeInterior( GLUtesselator *tess );
-
-
-/* The following is here *only* for access by debugging routines */
-
-#include "dict.h"
-
-/* For each pair of adjacent edges crossing the sweep line, there is
- * an ActiveRegion to represent the region between them.  The active
- * regions are kept in sorted order in a dynamic dictionary.  As the
- * sweep line crosses each vertex, we update the affected regions.
- */
-
-struct ActiveRegion {
-  GLUhalfEdge	*eUp;		/* upper edge, directed right to left */
-  DictNode	*nodeUp;	/* dictionary node corresponding to eUp */
-  int		windingNumber;	/* used to determine which regions are
-                                 * inside the polygon */
-  GLboolean	inside;		/* is this region inside the polygon? */
-  GLboolean	sentinel;	/* marks fake edges at t = +/-infinity */
-  GLboolean	dirty;		/* marks regions where the upper or lower
-                                 * edge has changed, but we haven't checked
-                                 * whether they intersect yet */
-  GLboolean	fixUpperEdge;	/* marks temporary edges introduced when
-                                 * we process a "right vertex" (one without
-                                 * any edges leaving to the right) */
-};
-
-#define RegionBelow(r)	((ActiveRegion *) dictKey(dictPred((r)->nodeUp)))
-#define RegionAbove(r)	((ActiveRegion *) dictKey(dictSucc((r)->nodeUp)))
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/tess.c b/Source/WebCore/thirdparty/glu/libtess/tess.c
deleted file mode 100644
index 5cba586..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/tess.c
+++ /dev/null
@@ -1,639 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/tess.c#7 $
-*/
-
-#include <assert.h>
-#include <setjmp.h>
-#include <stddef.h>
-
-#include "thirdparty/glu/gluos.h"
-#include "thirdparty/glu/libtess/memalloc.h"
-#include "thirdparty/glu/libtess/mesh.h"
-#include "thirdparty/glu/libtess/normal.h"
-#include "thirdparty/glu/libtess/render.h"
-#include "thirdparty/glu/libtess/sweep.h"
-#include "thirdparty/glu/libtess/tess.h"
-#include "thirdparty/glu/libtess/tessmono.h"
-
-#define GLU_TESS_DEFAULT_TOLERANCE 0.0
-#define GLU_TESS_MESH		100112	/* void (*)(GLUmesh *mesh)	    */
-
-#define TRUE 1
-#define FALSE 0
-
-/*ARGSUSED*/ static void GLAPIENTRY noBegin( GLenum type ) {}
-/*ARGSUSED*/ static void GLAPIENTRY noEdgeFlag( GLboolean boundaryEdge ) {}
-/*ARGSUSED*/ static void GLAPIENTRY noVertex( void *data ) {}
-/*ARGSUSED*/ static void GLAPIENTRY noEnd( void ) {}
-/*ARGSUSED*/ static void GLAPIENTRY noError( GLenum errnum ) {}
-/*ARGSUSED*/ static void GLAPIENTRY noCombine( GLdouble coords[3], void *data[4],
-                                    GLfloat weight[4], void **dataOut ) {}
-/*ARGSUSED*/ static void GLAPIENTRY noMesh( GLUmesh *mesh ) {}
-
-
-/*ARGSUSED*/ void GLAPIENTRY __gl_noBeginData( GLenum type,
-					     void *polygonData ) {}
-/*ARGSUSED*/ void GLAPIENTRY __gl_noEdgeFlagData( GLboolean boundaryEdge, 
-				       void *polygonData ) {}
-/*ARGSUSED*/ void GLAPIENTRY __gl_noVertexData( void *data,
-					      void *polygonData ) {}
-/*ARGSUSED*/ void GLAPIENTRY __gl_noEndData( void *polygonData ) {}
-/*ARGSUSED*/ void GLAPIENTRY __gl_noErrorData( GLenum errnum,
-					     void *polygonData ) {}
-/*ARGSUSED*/ void GLAPIENTRY __gl_noCombineData( GLdouble coords[3],
-					       void *data[4],
-					       GLfloat weight[4],
-					       void **outData,
-					       void *polygonData ) {}
-
-/* Half-edges are allocated in pairs (see mesh.c) */
-typedef struct { GLUhalfEdge e, eSym; } EdgePair;
-
-#define MAX(a,b)	((a) > (b) ? (a) : (b))
-#define MAX_FAST_ALLOC	(MAX(sizeof(EdgePair), \
-			 MAX(sizeof(GLUvertex),sizeof(GLUface))))
-
-
-GLUtesselator * GLAPIENTRY
-internal_gluNewTess( void )
-{
-  GLUtesselator *tess;
-
-  /* Only initialize fields which can be changed by the api.  Other fields
-   * are initialized where they are used.
-   */
-
-  if (memInit( MAX_FAST_ALLOC ) == 0) {
-     return 0;			/* out of memory */
-  }
-  tess = (GLUtesselator *)memAlloc( sizeof( GLUtesselator ));
-  if (tess == NULL) {
-     return 0;			/* out of memory */
-  }
-
-  tess->state = T_DORMANT;
-
-  tess->normal[0] = 0;
-  tess->normal[1] = 0;
-  tess->normal[2] = 0;
-
-  tess->relTolerance = GLU_TESS_DEFAULT_TOLERANCE;
-  tess->windingRule = GLU_TESS_WINDING_ODD;
-  tess->flagBoundary = FALSE;
-  tess->boundaryOnly = FALSE;
-
-  tess->callBegin = &noBegin;
-  tess->callEdgeFlag = &noEdgeFlag;
-  tess->callVertex = &noVertex;
-  tess->callEnd = &noEnd;
-
-  tess->callError = &noError;
-  tess->callCombine = &noCombine;
-  tess->callMesh = &noMesh;
-
-  tess->callBeginData= &__gl_noBeginData;
-  tess->callEdgeFlagData= &__gl_noEdgeFlagData;
-  tess->callVertexData= &__gl_noVertexData;
-  tess->callEndData= &__gl_noEndData;
-  tess->callErrorData= &__gl_noErrorData;
-  tess->callCombineData= &__gl_noCombineData;
-
-  tess->polygonData= NULL;
-
-  return tess;
-}
-
-static void MakeDormant( GLUtesselator *tess )
-{
-  /* Return the tessellator to its original dormant state. */
-
-  if( tess->mesh != NULL ) {
-    __gl_meshDeleteMesh( tess->mesh );
-  }
-  tess->state = T_DORMANT;
-  tess->lastEdge = NULL;
-  tess->mesh = NULL;
-}
-
-#define RequireState( tess, s )   if( tess->state != s ) GotoState(tess,s)
-
-static void GotoState( GLUtesselator *tess, enum TessState newState )
-{
-  while( tess->state != newState ) {
-    /* We change the current state one level at a time, to get to
-     * the desired state.
-     */
-    if( tess->state < newState ) {
-      switch( tess->state ) {
-      case T_DORMANT:
-	CALL_ERROR_OR_ERROR_DATA( GLU_TESS_MISSING_BEGIN_POLYGON );
-	internal_gluTessBeginPolygon( tess, NULL );
-	break;
-      case T_IN_POLYGON:
-	CALL_ERROR_OR_ERROR_DATA( GLU_TESS_MISSING_BEGIN_CONTOUR );
-	internal_gluTessBeginContour( tess );
-	break;
-      default:
-        assert(0);
-        break;
-      }
-    } else {
-      switch( tess->state ) {
-      case T_IN_CONTOUR:
-	CALL_ERROR_OR_ERROR_DATA( GLU_TESS_MISSING_END_CONTOUR );
-	internal_gluTessEndContour( tess );
-	break;
-      case T_IN_POLYGON:
-	CALL_ERROR_OR_ERROR_DATA( GLU_TESS_MISSING_END_POLYGON );
-	/* gluTessEndPolygon( tess ) is too much work! */
-	MakeDormant( tess );
-	break;
-      default:
-        assert(0);
-        break;
-      }
-    }
-  }
-}
-
-
-void GLAPIENTRY
-internal_gluDeleteTess( GLUtesselator *tess )
-{
-  RequireState( tess, T_DORMANT );
-  memFree( tess );
-}
-
-
-void GLAPIENTRY
-internal_gluTessProperty( GLUtesselator *tess, GLenum which, GLdouble value )
-{
-  GLenum windingRule;
-
-  switch( which ) {
-  case GLU_TESS_TOLERANCE:
-    if( value < 0.0 || value > 1.0 ) break;
-    tess->relTolerance = value;
-    return;
-
-  case GLU_TESS_WINDING_RULE:
-    windingRule = (GLenum) value;
-    if( windingRule != value ) break;	/* not an integer */
-
-    switch( windingRule ) {
-    case GLU_TESS_WINDING_ODD:
-    case GLU_TESS_WINDING_NONZERO:
-    case GLU_TESS_WINDING_POSITIVE:
-    case GLU_TESS_WINDING_NEGATIVE:
-    case GLU_TESS_WINDING_ABS_GEQ_TWO:
-      tess->windingRule = windingRule;
-      return;
-    default:
-      break;
-    }
-
-  case GLU_TESS_BOUNDARY_ONLY:
-    tess->boundaryOnly = (value != 0);
-    return;
-
-  default:
-    CALL_ERROR_OR_ERROR_DATA( GLU_INVALID_ENUM );
-    return;
-  }
-  CALL_ERROR_OR_ERROR_DATA( GLU_INVALID_VALUE );
-}
-
-/* Returns tessellator property */
-void GLAPIENTRY
-internal_gluGetTessProperty( GLUtesselator *tess, GLenum which, GLdouble *value )
-{
-   switch (which) {
-   case GLU_TESS_TOLERANCE:
-      /* tolerance should be in range [0..1] */
-      assert(0.0 <= tess->relTolerance && tess->relTolerance <= 1.0);
-      *value= tess->relTolerance;
-      break;    
-   case GLU_TESS_WINDING_RULE:
-      assert(tess->windingRule == GLU_TESS_WINDING_ODD ||
-	     tess->windingRule == GLU_TESS_WINDING_NONZERO ||
-	     tess->windingRule == GLU_TESS_WINDING_POSITIVE ||
-	     tess->windingRule == GLU_TESS_WINDING_NEGATIVE ||
-	     tess->windingRule == GLU_TESS_WINDING_ABS_GEQ_TWO);
-      *value= tess->windingRule;
-      break;
-   case GLU_TESS_BOUNDARY_ONLY:
-      assert(tess->boundaryOnly == TRUE || tess->boundaryOnly == FALSE);
-      *value= tess->boundaryOnly;
-      break;
-   default:
-      *value= 0.0;
-      CALL_ERROR_OR_ERROR_DATA( GLU_INVALID_ENUM );
-      break;
-   }
-} /* gluGetTessProperty() */
-
-void GLAPIENTRY
-internal_gluTessNormal( GLUtesselator *tess, GLdouble x, GLdouble y, GLdouble z )
-{
-  tess->normal[0] = x;
-  tess->normal[1] = y;
-  tess->normal[2] = z;
-}
-
-void GLAPIENTRY
-internal_gluTessCallback( GLUtesselator *tess, GLenum which, void (GLAPIENTRY *fn)())
-{
-  switch( which ) {
-  case GLU_TESS_BEGIN:
-    tess->callBegin = (fn == NULL) ? &noBegin : (void (GLAPIENTRY *)(GLenum)) fn;
-    return;
-  case GLU_TESS_BEGIN_DATA:
-    tess->callBeginData = (fn == NULL) ?
-	&__gl_noBeginData : (void (GLAPIENTRY *)(GLenum, void *)) fn;
-    return;
-  case GLU_TESS_EDGE_FLAG:
-    tess->callEdgeFlag = (fn == NULL) ? &noEdgeFlag :
-					(void (GLAPIENTRY *)(GLboolean)) fn;
-    /* If the client wants boundary edges to be flagged,
-     * we render everything as separate triangles (no strips or fans).
-     */
-    tess->flagBoundary = (fn != NULL);
-    return;
-  case GLU_TESS_EDGE_FLAG_DATA:
-    tess->callEdgeFlagData= (fn == NULL) ?
-	&__gl_noEdgeFlagData : (void (GLAPIENTRY *)(GLboolean, void *)) fn; 
-    /* If the client wants boundary edges to be flagged,
-     * we render everything as separate triangles (no strips or fans).
-     */
-    tess->flagBoundary = (fn != NULL);
-    return;
-  case GLU_TESS_VERTEX:
-    tess->callVertex = (fn == NULL) ? &noVertex :
-				      (void (GLAPIENTRY *)(void *)) fn;
-    return;
-  case GLU_TESS_VERTEX_DATA:
-    tess->callVertexData = (fn == NULL) ?
-	&__gl_noVertexData : (void (GLAPIENTRY *)(void *, void *)) fn;
-    return;
-  case GLU_TESS_END:
-    tess->callEnd = (fn == NULL) ? &noEnd : (void (GLAPIENTRY *)(void)) fn;
-    return;
-  case GLU_TESS_END_DATA:
-    tess->callEndData = (fn == NULL) ? &__gl_noEndData : 
-                                       (void (GLAPIENTRY *)(void *)) fn;
-    return;
-  case GLU_TESS_ERROR:
-    tess->callError = (fn == NULL) ? &noError : (void (GLAPIENTRY *)(GLenum)) fn;
-    return;
-  case GLU_TESS_ERROR_DATA:
-    tess->callErrorData = (fn == NULL) ?
-	&__gl_noErrorData : (void (GLAPIENTRY *)(GLenum, void *)) fn;
-    return;
-  case GLU_TESS_COMBINE:
-    tess->callCombine = (fn == NULL) ? &noCombine :
-	(void (GLAPIENTRY *)(GLdouble [3],void *[4], GLfloat [4], void ** )) fn;
-    return;
-  case GLU_TESS_COMBINE_DATA:
-    tess->callCombineData = (fn == NULL) ? &__gl_noCombineData :
-                                           (void (GLAPIENTRY *)(GLdouble [3],
-						     void *[4], 
-						     GLfloat [4], 
-						     void **,
-						     void *)) fn;
-    return;
-  case GLU_TESS_MESH:
-    tess->callMesh = (fn == NULL) ? &noMesh : (void (GLAPIENTRY *)(GLUmesh *)) fn;
-    return;
-  default:
-    CALL_ERROR_OR_ERROR_DATA( GLU_INVALID_ENUM );
-    return;
-  }
-}
-
-static int AddVertex( GLUtesselator *tess, GLdouble coords[3], void *data )
-{
-  GLUhalfEdge *e;
-
-  e = tess->lastEdge;
-  if( e == NULL ) {
-    /* Make a self-loop (one vertex, one edge). */
-
-    e = __gl_meshMakeEdge( tess->mesh );
-    if (e == NULL) return 0;
-    if ( !__gl_meshSplice( e, e->Sym ) ) return 0;
-  } else {
-    /* Create a new vertex and edge which immediately follow e
-     * in the ordering around the left face.
-     */
-    if (__gl_meshSplitEdge( e ) == NULL) return 0;
-    e = e->Lnext;
-  }
-
-  /* The new vertex is now e->Org. */
-  e->Org->data = data;
-  e->Org->coords[0] = coords[0];
-  e->Org->coords[1] = coords[1];
-  e->Org->coords[2] = coords[2];
-  
-  /* The winding of an edge says how the winding number changes as we
-   * cross from the edge''s right face to its left face.  We add the
-   * vertices in such an order that a CCW contour will add +1 to
-   * the winding number of the region inside the contour.
-   */
-  e->winding = 1;
-  e->Sym->winding = -1;
-
-  tess->lastEdge = e;
-
-  return 1;
-}
-
-
-static void CacheVertex( GLUtesselator *tess, GLdouble coords[3], void *data )
-{
-  CachedVertex *v = &tess->cache[tess->cacheCount];
-
-  v->data = data;
-  v->coords[0] = coords[0];
-  v->coords[1] = coords[1];
-  v->coords[2] = coords[2];
-  ++tess->cacheCount;
-}
-
-
-static int EmptyCache( GLUtesselator *tess )
-{
-  CachedVertex *v = tess->cache;
-  CachedVertex *vLast;
-
-  tess->mesh = __gl_meshNewMesh();
-  if (tess->mesh == NULL) return 0;
-
-  for( vLast = v + tess->cacheCount; v < vLast; ++v ) {
-    if ( !AddVertex( tess, v->coords, v->data ) ) return 0;
-  }
-  tess->cacheCount = 0;
-  tess->emptyCache = FALSE;
-
-  return 1;
-}
-
-
-void GLAPIENTRY
-internal_gluTessVertex( GLUtesselator *tess, GLdouble coords[3], void *data )
-{
-  int i, tooLarge = FALSE;
-  GLdouble x, clamped[3];
-
-  RequireState( tess, T_IN_CONTOUR );
-
-  if( tess->emptyCache ) {
-    if ( !EmptyCache( tess ) ) {
-       CALL_ERROR_OR_ERROR_DATA( GLU_OUT_OF_MEMORY );
-       return;
-    }
-    tess->lastEdge = NULL;
-  }
-  for( i = 0; i < 3; ++i ) {
-    x = coords[i];
-    if( x < - GLU_TESS_MAX_COORD ) {
-      x = - GLU_TESS_MAX_COORD;
-      tooLarge = TRUE;
-    }
-    if( x > GLU_TESS_MAX_COORD ) {
-      x = GLU_TESS_MAX_COORD;
-      tooLarge = TRUE;
-    }
-    clamped[i] = x;
-  }
-  if( tooLarge ) {
-    CALL_ERROR_OR_ERROR_DATA( GLU_TESS_COORD_TOO_LARGE );
-  }
-
-  if( tess->mesh == NULL ) {
-    if( tess->cacheCount < TESS_MAX_CACHE ) {
-      CacheVertex( tess, clamped, data );
-      return;
-    }
-    if ( !EmptyCache( tess ) ) {
-       CALL_ERROR_OR_ERROR_DATA( GLU_OUT_OF_MEMORY );
-       return;
-    }
-  }
-  if ( !AddVertex( tess, clamped, data ) ) {
-       CALL_ERROR_OR_ERROR_DATA( GLU_OUT_OF_MEMORY );
-  }
-}
-
-
-void GLAPIENTRY
-internal_gluTessBeginPolygon( GLUtesselator *tess, void *data )
-{
-  RequireState( tess, T_DORMANT );
-
-  tess->state = T_IN_POLYGON;
-  tess->cacheCount = 0;
-  tess->emptyCache = FALSE;
-  tess->mesh = NULL;
-
-  tess->polygonData= data;
-}
-
-
-void GLAPIENTRY
-internal_gluTessBeginContour( GLUtesselator *tess )
-{
-  RequireState( tess, T_IN_POLYGON );
-
-  tess->state = T_IN_CONTOUR;
-  tess->lastEdge = NULL;
-  if( tess->cacheCount > 0 ) {
-    /* Just set a flag so we don't get confused by empty contours
-     * -- these can be generated accidentally with the obsolete
-     * NextContour() interface.
-     */
-    tess->emptyCache = TRUE;
-  }
-}
-
-
-void GLAPIENTRY
-internal_gluTessEndContour( GLUtesselator *tess )
-{
-  RequireState( tess, T_IN_CONTOUR );
-  tess->state = T_IN_POLYGON;
-}
-
-void GLAPIENTRY
-internal_gluTessEndPolygon( GLUtesselator *tess )
-{
-  GLUmesh *mesh;
-
-  if (setjmp(tess->env) != 0) {	
-     /* come back here if out of memory */
-     CALL_ERROR_OR_ERROR_DATA( GLU_OUT_OF_MEMORY );
-     return;
-  }
-
-  RequireState( tess, T_IN_POLYGON );
-  tess->state = T_DORMANT;
-
-  if( tess->mesh == NULL ) {
-    if( ! tess->flagBoundary && tess->callMesh == &noMesh ) {
-
-      /* Try some special code to make the easy cases go quickly
-       * (eg. convex polygons).  This code does NOT handle multiple contours,
-       * intersections, edge flags, and of course it does not generate
-       * an explicit mesh either.
-       */
-      if( __gl_renderCache( tess )) {
-	tess->polygonData= NULL; 
-	return;
-      }
-    }
-    if ( !EmptyCache( tess ) ) longjmp(tess->env,1); /* could've used a label*/
-  }
-
-  /* Determine the polygon normal and project vertices onto the plane
-   * of the polygon.
-   */
-  __gl_projectPolygon( tess );
-
-  /* __gl_computeInterior( tess ) computes the planar arrangement specified
-   * by the given contours, and further subdivides this arrangement
-   * into regions.  Each region is marked "inside" if it belongs
-   * to the polygon, according to the rule given by tess->windingRule.
-   * Each interior region is guaranteed be monotone.
-   */
-  if ( !__gl_computeInterior( tess ) ) {
-     longjmp(tess->env,1);	/* could've used a label */
-  }
-
-  mesh = tess->mesh;
-  if( ! tess->fatalError ) {
-    int rc = 1;
-
-    /* If the user wants only the boundary contours, we throw away all edges
-     * except those which separate the interior from the exterior.
-     * Otherwise we tessellate all the regions marked "inside".
-     */
-    if( tess->boundaryOnly ) {
-      rc = __gl_meshSetWindingNumber( mesh, 1, TRUE );
-    } else {
-      rc = __gl_meshTessellateInterior( mesh ); 
-    }
-    if (rc == 0) longjmp(tess->env,1);	/* could've used a label */
-
-    __gl_meshCheckMesh( mesh );
-
-    if( tess->callBegin != &noBegin || tess->callEnd != &noEnd
-       || tess->callVertex != &noVertex || tess->callEdgeFlag != &noEdgeFlag 
-       || tess->callBeginData != &__gl_noBeginData 
-       || tess->callEndData != &__gl_noEndData
-       || tess->callVertexData != &__gl_noVertexData
-       || tess->callEdgeFlagData != &__gl_noEdgeFlagData )
-    {
-      if( tess->boundaryOnly ) {
-	__gl_renderBoundary( tess, mesh );  /* output boundary contours */
-      } else {
-	__gl_renderMesh( tess, mesh );	   /* output strips and fans */
-      }
-    }
-    if( tess->callMesh != &noMesh ) {
-
-      /* Throw away the exterior faces, so that all faces are interior.
-       * This way the user doesn't have to check the "inside" flag,
-       * and we don't need to even reveal its existence.  It also leaves
-       * the freedom for an implementation to not generate the exterior
-       * faces in the first place.
-       */
-      __gl_meshDiscardExterior( mesh );
-      (*tess->callMesh)( mesh );		/* user wants the mesh itself */
-      tess->mesh = NULL;
-      tess->polygonData= NULL;
-      return;
-    }
-  }
-  __gl_meshDeleteMesh( mesh );
-  tess->polygonData= NULL;
-  tess->mesh = NULL;
-}
-
-
-/*XXXblythe unused function*/
-#if 0
-void GLAPIENTRY
-gluDeleteMesh( GLUmesh *mesh )
-{
-  __gl_meshDeleteMesh( mesh );
-}
-#endif
-
-
-
-/*******************************************************/
-
-/* Obsolete calls -- for backward compatibility */
-
-#if 0
-void GLAPIENTRY
-gluBeginPolygon( GLUtesselator *tess )
-{
-  gluTessBeginPolygon( tess, NULL );
-  gluTessBeginContour( tess );
-}
-
-
-/*ARGSUSED*/
-void GLAPIENTRY
-gluNextContour( GLUtesselator *tess, GLenum type )
-{
-  gluTessEndContour( tess );
-  gluTessBeginContour( tess );
-}
-
-
-void GLAPIENTRY
-gluEndPolygon( GLUtesselator *tess )
-{
-  gluTessEndContour( tess );
-  gluTessEndPolygon( tess );
-}
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/tess.h b/Source/WebCore/thirdparty/glu/libtess/tess.h
deleted file mode 100644
index 8215223..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/tess.h
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/tess.h#6 $
-*/
-
-#ifndef __tess_h_
-#define __tess_h_
-
-#include <setjmp.h>
-
-#include "thirdparty/glu/internal_glu.h"
-#include "thirdparty/glu/libtess/dict.h"
-#include "thirdparty/glu/libtess/mesh.h"
-#include "thirdparty/glu/libtess/priorityq.h"
-
-/* The begin/end calls must be properly nested.  We keep track of
- * the current state to enforce the ordering.
- */
-enum TessState { T_DORMANT, T_IN_POLYGON, T_IN_CONTOUR };
-
-/* We cache vertex data for single-contour polygons so that we can
- * try a quick-and-dirty decomposition first.
- */
-#define TESS_MAX_CACHE	100
-
-typedef struct CachedVertex {
-  GLdouble	coords[3];
-  void		*data;
-} CachedVertex;
-
-struct GLUtesselator {
-
-  /*** state needed for collecting the input data ***/
-
-  enum TessState state;		/* what begin/end calls have we seen? */
-
-  GLUhalfEdge	*lastEdge;	/* lastEdge->Org is the most recent vertex */
-  GLUmesh	*mesh;		/* stores the input contours, and eventually
-                                   the tessellation itself */
-
-  void		(GLAPIENTRY *callError)( GLenum errnum );
-
-  /*** state needed for projecting onto the sweep plane ***/
-
-  GLdouble	normal[3];	/* user-specified normal (if provided) */
-  GLdouble	sUnit[3];	/* unit vector in s-direction (debugging) */
-  GLdouble	tUnit[3];	/* unit vector in t-direction (debugging) */
-
-  /*** state needed for the line sweep ***/
-
-  GLdouble	relTolerance;	/* tolerance for merging features */
-  GLenum	windingRule;	/* rule for determining polygon interior */
-  GLboolean	fatalError;	/* fatal error: needed combine callback */
-
-  Dict		*dict;		/* edge dictionary for sweep line */
-  PriorityQ	*pq;		/* priority queue of vertex events */
-  GLUvertex	*event;		/* current sweep event being processed */
-
-  void		(GLAPIENTRY *callCombine)( GLdouble coords[3], void *data[4],
-			        GLfloat weight[4], void **outData );
-
-  /*** state needed for rendering callbacks (see render.c) ***/
-
-  GLboolean	flagBoundary;	/* mark boundary edges (use EdgeFlag) */
-  GLboolean	boundaryOnly;	/* Extract contours, not triangles */
-  GLUface	*lonelyTriList;
-    /* list of triangles which could not be rendered as strips or fans */
-
-  void		(GLAPIENTRY *callBegin)( GLenum type );
-  void		(GLAPIENTRY *callEdgeFlag)( GLboolean boundaryEdge );
-  void		(GLAPIENTRY *callVertex)( void *data );
-  void		(GLAPIENTRY *callEnd)( void );
-  void		(GLAPIENTRY *callMesh)( GLUmesh *mesh );
-
-
-  /*** state needed to cache single-contour polygons for renderCache() */
-
-  GLboolean	emptyCache;		/* empty cache on next vertex() call */
-  int		cacheCount;		/* number of cached vertices */
-  CachedVertex	cache[TESS_MAX_CACHE];	/* the vertex data */
-
-  /*** rendering callbacks that also pass polygon data  ***/ 
-  void		(GLAPIENTRY *callBeginData)( GLenum type, void *polygonData );
-  void		(GLAPIENTRY *callEdgeFlagData)( GLboolean boundaryEdge, 
-				     void *polygonData );
-  void		(GLAPIENTRY *callVertexData)( void *data, void *polygonData );
-  void		(GLAPIENTRY *callEndData)( void *polygonData );
-  void		(GLAPIENTRY *callErrorData)( GLenum errnum, void *polygonData );
-  void		(GLAPIENTRY *callCombineData)( GLdouble coords[3], void *data[4],
-				    GLfloat weight[4], void **outData,
-				    void *polygonData );
-
-  jmp_buf env;			/* place to jump to when memAllocs fail */
-
-  void *polygonData;		/* client data for current polygon */
-};
-
-void GLAPIENTRY __gl_noBeginData( GLenum type, void *polygonData );
-void GLAPIENTRY __gl_noEdgeFlagData( GLboolean boundaryEdge, void *polygonData );
-void GLAPIENTRY __gl_noVertexData( void *data, void *polygonData );
-void GLAPIENTRY __gl_noEndData( void *polygonData );
-void GLAPIENTRY __gl_noErrorData( GLenum errnum, void *polygonData );
-void GLAPIENTRY __gl_noCombineData( GLdouble coords[3], void *data[4],
-			 GLfloat weight[4], void **outData,
-			 void *polygonData );
-
-#define CALL_BEGIN_OR_BEGIN_DATA(a) \
-   if (tess->callBeginData != &__gl_noBeginData) \
-      (*tess->callBeginData)((a),tess->polygonData); \
-   else (*tess->callBegin)((a));
-
-#define CALL_VERTEX_OR_VERTEX_DATA(a) \
-   if (tess->callVertexData != &__gl_noVertexData) \
-      (*tess->callVertexData)((a),tess->polygonData); \
-   else (*tess->callVertex)((a));
-
-#define CALL_EDGE_FLAG_OR_EDGE_FLAG_DATA(a) \
-   if (tess->callEdgeFlagData != &__gl_noEdgeFlagData) \
-      (*tess->callEdgeFlagData)((a),tess->polygonData); \
-   else (*tess->callEdgeFlag)((a));
-
-#define CALL_END_OR_END_DATA() \
-   if (tess->callEndData != &__gl_noEndData) \
-      (*tess->callEndData)(tess->polygonData); \
-   else (*tess->callEnd)();
-
-#define CALL_COMBINE_OR_COMBINE_DATA(a,b,c,d) \
-   if (tess->callCombineData != &__gl_noCombineData) \
-      (*tess->callCombineData)((a),(b),(c),(d),tess->polygonData); \
-   else (*tess->callCombine)((a),(b),(c),(d));
-
-#define CALL_ERROR_OR_ERROR_DATA(a) \
-   if (tess->callErrorData != &__gl_noErrorData) \
-      (*tess->callErrorData)((a),tess->polygonData); \
-   else (*tess->callError)((a));
-
-#endif
diff --git a/Source/WebCore/thirdparty/glu/libtess/tessmono.c b/Source/WebCore/thirdparty/glu/libtess/tessmono.c
deleted file mode 100644
index 3aaaaa1..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/tessmono.c
+++ /dev/null
@@ -1,209 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/tessmono.c#5 $
-*/
-
-#include <assert.h>
-#include <stdlib.h>
-
-#include "thirdparty/glu/gluos.h"
-#include "thirdparty/glu/libtess/geom.h"
-#include "thirdparty/glu/libtess/mesh.h"
-#include "thirdparty/glu/libtess/tessmono.h"
-
-#define AddWinding(eDst,eSrc)	(eDst->winding += eSrc->winding, \
-				 eDst->Sym->winding += eSrc->Sym->winding)
-
-/* __gl_meshTessellateMonoRegion( face ) tessellates a monotone region
- * (what else would it do??)  The region must consist of a single
- * loop of half-edges (see mesh.h) oriented CCW.  "Monotone" in this
- * case means that any vertical line intersects the interior of the
- * region in a single interval.  
- *
- * Tessellation consists of adding interior edges (actually pairs of
- * half-edges), to split the region into non-overlapping triangles.
- *
- * The basic idea is explained in Preparata and Shamos (which I don''t
- * have handy right now), although their implementation is more
- * complicated than this one.  The are two edge chains, an upper chain
- * and a lower chain.  We process all vertices from both chains in order,
- * from right to left.
- *
- * The algorithm ensures that the following invariant holds after each
- * vertex is processed: the untessellated region consists of two
- * chains, where one chain (say the upper) is a single edge, and
- * the other chain is concave.  The left vertex of the single edge
- * is always to the left of all vertices in the concave chain.
- *
- * Each step consists of adding the rightmost unprocessed vertex to one
- * of the two chains, and forming a fan of triangles from the rightmost
- * of two chain endpoints.  Determining whether we can add each triangle
- * to the fan is a simple orientation test.  By making the fan as large
- * as possible, we restore the invariant (check it yourself).
- */
-int __gl_meshTessellateMonoRegion( GLUface *face )
-{
-  GLUhalfEdge *up, *lo;
-
-  /* All edges are oriented CCW around the boundary of the region.
-   * First, find the half-edge whose origin vertex is rightmost.
-   * Since the sweep goes from left to right, face->anEdge should
-   * be close to the edge we want.
-   */
-  up = face->anEdge;
-  assert( up->Lnext != up && up->Lnext->Lnext != up );
-
-  for( ; VertLeq( up->Dst, up->Org ); up = up->Lprev )
-    ;
-  for( ; VertLeq( up->Org, up->Dst ); up = up->Lnext )
-    ;
-  lo = up->Lprev;
-
-  while( up->Lnext != lo ) {
-    if( VertLeq( up->Dst, lo->Org )) {
-      /* up->Dst is on the left.  It is safe to form triangles from lo->Org.
-       * The EdgeGoesLeft test guarantees progress even when some triangles
-       * are CW, given that the upper and lower chains are truly monotone.
-       */
-      while( lo->Lnext != up && (EdgeGoesLeft( lo->Lnext )
-	     || EdgeSign( lo->Org, lo->Dst, lo->Lnext->Dst ) <= 0 )) {
-	GLUhalfEdge *tempHalfEdge= __gl_meshConnect( lo->Lnext, lo );
-	if (tempHalfEdge == NULL) return 0;
-	lo = tempHalfEdge->Sym;
-      }
-      lo = lo->Lprev;
-    } else {
-      /* lo->Org is on the left.  We can make CCW triangles from up->Dst. */
-      while( lo->Lnext != up && (EdgeGoesRight( up->Lprev )
-	     || EdgeSign( up->Dst, up->Org, up->Lprev->Org ) >= 0 )) {
-	GLUhalfEdge *tempHalfEdge= __gl_meshConnect( up, up->Lprev );
-	if (tempHalfEdge == NULL) return 0;
-	up = tempHalfEdge->Sym;
-      }
-      up = up->Lnext;
-    }
-  }
-
-  /* Now lo->Org == up->Dst == the leftmost vertex.  The remaining region
-   * can be tessellated in a fan from this leftmost vertex.
-   */
-  assert( lo->Lnext != up );
-  while( lo->Lnext->Lnext != up ) {
-    GLUhalfEdge *tempHalfEdge= __gl_meshConnect( lo->Lnext, lo );
-    if (tempHalfEdge == NULL) return 0;
-    lo = tempHalfEdge->Sym;
-  }
-
-  return 1;
-}
-
-
-/* __gl_meshTessellateInterior( mesh ) tessellates each region of
- * the mesh which is marked "inside" the polygon.  Each such region
- * must be monotone.
- */
-int __gl_meshTessellateInterior( GLUmesh *mesh )
-{
-  GLUface *f, *next;
-
-  /*LINTED*/
-  for( f = mesh->fHead.next; f != &mesh->fHead; f = next ) {
-    /* Make sure we don''t try to tessellate the new triangles. */
-    next = f->next;
-    if( f->inside ) {
-      if ( !__gl_meshTessellateMonoRegion( f ) ) return 0;
-    }
-  }
-
-  return 1;
-}
-
-
-/* __gl_meshDiscardExterior( mesh ) zaps (ie. sets to NULL) all faces
- * which are not marked "inside" the polygon.  Since further mesh operations
- * on NULL faces are not allowed, the main purpose is to clean up the
- * mesh so that exterior loops are not represented in the data structure.
- */
-void __gl_meshDiscardExterior( GLUmesh *mesh )
-{
-  GLUface *f, *next;
-
-  /*LINTED*/
-  for( f = mesh->fHead.next; f != &mesh->fHead; f = next ) {
-    /* Since f will be destroyed, save its next pointer. */
-    next = f->next;
-    if( ! f->inside ) {
-      __gl_meshZapFace( f );
-    }
-  }
-}
-
-#define MARKED_FOR_DELETION	0x7fffffff
-
-/* __gl_meshSetWindingNumber( mesh, value, keepOnlyBoundary ) resets the
- * winding numbers on all edges so that regions marked "inside" the
- * polygon have a winding number of "value", and regions outside
- * have a winding number of 0.
- *
- * If keepOnlyBoundary is TRUE, it also deletes all edges which do not
- * separate an interior region from an exterior one.
- */
-int __gl_meshSetWindingNumber( GLUmesh *mesh, int value,
-			        GLboolean keepOnlyBoundary )
-{
-  GLUhalfEdge *e, *eNext;
-
-  for( e = mesh->eHead.next; e != &mesh->eHead; e = eNext ) {
-    eNext = e->next;
-    if( e->Rface->inside != e->Lface->inside ) {
-
-      /* This is a boundary edge (one side is interior, one is exterior). */
-      e->winding = (e->Lface->inside) ? value : -value;
-    } else {
-
-      /* Both regions are interior, or both are exterior. */
-      if( ! keepOnlyBoundary ) {
-	e->winding = 0;
-      } else {
-	if ( !__gl_meshDelete( e ) ) return 0;
-      }
-    }
-  }
-  return 1;
-}
diff --git a/Source/WebCore/thirdparty/glu/libtess/tessmono.h b/Source/WebCore/thirdparty/glu/libtess/tessmono.h
deleted file mode 100644
index 6a71ee8..0000000
--- a/Source/WebCore/thirdparty/glu/libtess/tessmono.h
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
-** License Applicability. Except to the extent portions of this file are
-** made subject to an alternative license as permitted in the SGI Free
-** Software License B, Version 1.1 (the "License"), the contents of this
-** file are subject only to the provisions of the License. You may not use
-** this file except in compliance with the License. You may obtain a copy
-** of the License at Silicon Graphics, Inc., attn: Legal Services, 1600
-** Amphitheatre Parkway, Mountain View, CA 94043-1351, or at:
-** 
-** http://oss.sgi.com/projects/FreeB
-** 
-** Note that, as provided in the License, the Software is distributed on an
-** "AS IS" basis, with ALL EXPRESS AND IMPLIED WARRANTIES AND CONDITIONS
-** DISCLAIMED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES AND
-** CONDITIONS OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A
-** PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-** 
-** Original Code. The Original Code is: OpenGL Sample Implementation,
-** Version 1.2.1, released January 26, 2000, developed by Silicon Graphics,
-** Inc. The Original Code is Copyright (c) 1991-2000 Silicon Graphics, Inc.
-** Copyright in any portions created by third parties is as indicated
-** elsewhere herein. All Rights Reserved.
-** 
-** Additional Notice Provisions: The application programming interfaces
-** established by SGI in conjunction with the Original Code are The
-** OpenGL(R) Graphics System: A Specification (Version 1.2.1), released
-** April 1, 1999; The OpenGL(R) Graphics System Utility Library (Version
-** 1.3), released November 4, 1998; and OpenGL(R) Graphics with the X
-** Window System(R) (Version 1.3), released October 19, 1998. This software
-** was created using the OpenGL(R) version 1.2.1 Sample Implementation
-** published by SGI, but has not been independently verified as being
-** compliant with the OpenGL(R) version 1.2.1 Specification.
-**
-*/
-/*
-** Author: Eric Veach, July 1994.
-**
-** $Date$ $Revision$
-** $Header: //depot/main/gfx/lib/glu/libtess/tessmono.h#5 $
-*/
-
-#ifndef __tessmono_h_
-#define __tessmono_h_
-
-/* __gl_meshTessellateMonoRegion( face ) tessellates a monotone region
- * (what else would it do??)  The region must consist of a single
- * loop of half-edges (see mesh.h) oriented CCW.  "Monotone" in this
- * case means that any vertical line intersects the interior of the
- * region in a single interval.  
- *
- * Tessellation consists of adding interior edges (actually pairs of
- * half-edges), to split the region into non-overlapping triangles.
- *
- * __gl_meshTessellateInterior( mesh ) tessellates each region of
- * the mesh which is marked "inside" the polygon.  Each such region
- * must be monotone.
- *
- * __gl_meshDiscardExterior( mesh ) zaps (ie. sets to NULL) all faces
- * which are not marked "inside" the polygon.  Since further mesh operations
- * on NULL faces are not allowed, the main purpose is to clean up the
- * mesh so that exterior loops are not represented in the data structure.
- *
- * __gl_meshSetWindingNumber( mesh, value, keepOnlyBoundary ) resets the
- * winding numbers on all edges so that regions marked "inside" the
- * polygon have a winding number of "value", and regions outside
- * have a winding number of 0.
- *
- * If keepOnlyBoundary is TRUE, it also deletes all edges which do not
- * separate an interior region from an exterior one.
- */
-
-int __gl_meshTessellateMonoRegion( GLUface *face );
-int __gl_meshTessellateInterior( GLUmesh *mesh );
-void __gl_meshDiscardExterior( GLUmesh *mesh );
-int __gl_meshSetWindingNumber( GLUmesh *mesh, int value,
-			        GLboolean keepOnlyBoundary );
-
-#endif
diff --git a/Source/WebCore/webaudio/AudioContext.cpp b/Source/WebCore/webaudio/AudioContext.cpp
index f25b494..0d23cf5 100644
--- a/Source/WebCore/webaudio/AudioContext.cpp
+++ b/Source/WebCore/webaudio/AudioContext.cpp
@@ -39,6 +39,7 @@
 #include "AudioNodeOutput.h"
 #include "AudioPannerNode.h"
 #include "ConvolverNode.h"
+#include "DefaultAudioDestinationNode.h"
 #include "DelayNode.h"
 #include "Document.h"
 #include "FFTFrame.h"
@@ -47,9 +48,15 @@
 #include "HighPass2FilterNode.h"
 #include "JavaScriptAudioNode.h"
 #include "LowPass2FilterNode.h"
+#include "OfflineAudioCompletionEvent.h"
+#include "OfflineAudioDestinationNode.h"
 #include "PlatformString.h"
 #include "RealtimeAnalyserNode.h"
 
+#if DEBUG_AUDIONODE_REFERENCES
+#include <stdio.h>
+#endif
+
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
@@ -66,6 +73,12 @@ PassRefPtr<AudioContext> AudioContext::create(Document* document)
     return adoptRef(new AudioContext(document));
 }
 
+PassRefPtr<AudioContext> AudioContext::createOfflineContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, double sampleRate)
+{
+    return adoptRef(new AudioContext(document, numberOfChannels, numberOfFrames, sampleRate));
+}
+
+// Constructor for rendering to the audio hardware.
 AudioContext::AudioContext(Document* document)
     : ActiveDOMObject(document, this)
     , m_isInitialized(false)
@@ -75,6 +88,46 @@ AudioContext::AudioContext(Document* document)
     , m_connectionCount(0)
     , m_audioThread(0)
     , m_graphOwnerThread(UndefinedThreadIdentifier)
+    , m_isOfflineContext(false)
+{
+    constructCommon();
+
+    m_destinationNode = DefaultAudioDestinationNode::create(this);
+
+    // This sets in motion an asynchronous loading mechanism on another thread.
+    // We can check m_hrtfDatabaseLoader->isLoaded() to find out whether or not it has been fully loaded.
+    // It's not that useful to have a callback function for this since the audio thread automatically starts rendering on the graph
+    // when this has finished (see AudioDestinationNode).
+    m_hrtfDatabaseLoader = HRTFDatabaseLoader::createAndLoadAsynchronouslyIfNecessary(sampleRate());
+
+    // FIXME: for now default AudioContext does not need an explicit startRendering() call.
+    // We may want to consider requiring it for symmetry with OfflineAudioContext
+    m_destinationNode->startRendering();
+}
+
+// Constructor for offline (non-realtime) rendering.
+AudioContext::AudioContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, double sampleRate)
+    : ActiveDOMObject(document, this)
+    , m_isInitialized(false)
+    , m_isAudioThreadFinished(false)
+    , m_document(document)
+    , m_destinationNode(0)
+    , m_connectionCount(0)
+    , m_audioThread(0)
+    , m_graphOwnerThread(UndefinedThreadIdentifier)
+    , m_isOfflineContext(true)
+{
+    constructCommon();
+
+    // FIXME: the passed in sampleRate MUST match the hardware sample-rate since HRTFDatabaseLoader is a singleton.
+    m_hrtfDatabaseLoader = HRTFDatabaseLoader::createAndLoadAsynchronouslyIfNecessary(sampleRate);
+
+    // Create a new destination for offline rendering.
+    m_renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
+    m_destinationNode = OfflineAudioDestinationNode::create(this, m_renderTarget.get());
+}
+
+void AudioContext::constructCommon()
 {
     // Note: because adoptRef() won't be called until we leave this constructor, but code in this constructor needs to reference this context,
     // relax the check.
@@ -82,16 +135,9 @@ AudioContext::AudioContext(Document* document)
     
     FFTFrame::initialize();
     
-    m_destinationNode = AudioDestinationNode::create(this);
     m_listener = AudioListener::create();
     m_temporaryMonoBus = adoptPtr(new AudioBus(1, AudioNode::ProcessingSizeInFrames));
     m_temporaryStereoBus = adoptPtr(new AudioBus(2, AudioNode::ProcessingSizeInFrames));
-
-    // This sets in motion an asynchronous loading mechanism on another thread.
-    // We can check m_hrtfDatabaseLoader->isLoaded() to find out whether or not it has been fully loaded.
-    // It's not that useful to have a callback function for this since the audio thread automatically starts rendering on the graph
-    // when this has finished (see AudioDestinationNode).
-    m_hrtfDatabaseLoader = HRTFDatabaseLoader::createAndLoadAsynchronouslyIfNecessary(sampleRate());
 }
 
 AudioContext::~AudioContext()
@@ -167,7 +213,7 @@ void AudioContext::stop()
     uninitialize();
 }
 
-Document* AudioContext::document()
+Document* AudioContext::document() const
 {
     ASSERT(m_document);
     return m_document;
@@ -526,6 +572,39 @@ void AudioContext::handleDirtyAudioNodeOutputs()
     m_dirtyAudioNodeOutputs.clear();
 }
 
+ScriptExecutionContext* AudioContext::scriptExecutionContext() const
+{
+    return document();
+}
+
+AudioContext* AudioContext::toAudioContext()
+{
+    return this;
+}
+
+void AudioContext::startRendering()
+{
+    destination()->startRendering();
+}
+
+void AudioContext::fireCompletionEvent()
+{
+    ASSERT(isMainThread());
+    if (!isMainThread())
+        return;
+        
+    AudioBuffer* renderedBuffer = m_renderTarget.get();
+
+    ASSERT(renderedBuffer);
+    if (!renderedBuffer)
+        return;
+
+    // Avoid firing the event if the document has already gone away.
+    if (hasDocument()) {
+        // Call the offline rendering completion event listener.
+        dispatchEvent(OfflineAudioCompletionEvent::create(renderedBuffer));
+    }
+}
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/webaudio/AudioContext.h b/Source/WebCore/webaudio/AudioContext.h
index ddd474c..4f89091 100644
--- a/Source/WebCore/webaudio/AudioContext.h
+++ b/Source/WebCore/webaudio/AudioContext.h
@@ -28,6 +28,8 @@
 #include "ActiveDOMObject.h"
 #include "AudioBus.h"
 #include "AudioDestinationNode.h"
+#include "EventListener.h"
+#include "EventTarget.h"
 #include "HRTFDatabaseLoader.h"
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -59,13 +61,19 @@ class JavaScriptAudioNode;
 // AudioContext is the cornerstone of the web audio API and all AudioNodes are created from it.
 // For thread safety between the audio thread and the main thread, it has a rendering graph locking mechanism. 
 
-class AudioContext : public ActiveDOMObject, public RefCounted<AudioContext> {
+class AudioContext : public ActiveDOMObject, public RefCounted<AudioContext>, public EventTarget {
 public:
+    // Create an AudioContext for rendering to the audio hardware.
     static PassRefPtr<AudioContext> create(Document*);
 
+    // Create an AudioContext for offline (non-realtime) rendering.
+    static PassRefPtr<AudioContext> createOfflineContext(Document*, unsigned numberOfChannels, size_t numberOfFrames, double sampleRate);
+
     virtual ~AudioContext();
 
     bool isInitialized() const;
+    
+    bool isOfflineContext() { return m_isOfflineContext; }
 
     // Returns true when initialize() was called AND all asynchronous initialization has completed.
     bool isRunnable() const;
@@ -73,7 +81,7 @@ public:
     // Document notification
     virtual void stop();
 
-    Document* document(); // ASSERTs if document no longer exists.
+    Document* document() const; // ASSERTs if document no longer exists.
     bool hasDocument();
 
     AudioDestinationNode* destination() { return m_destinationNode.get(); }
@@ -180,9 +188,27 @@ public:
     // Only accessed when the graph lock is held.
     void markAudioNodeInputDirty(AudioNodeInput*);
     void markAudioNodeOutputDirty(AudioNodeOutput*);
+
+    // EventTarget
+    virtual ScriptExecutionContext* scriptExecutionContext() const;
+    virtual AudioContext* toAudioContext();
+    virtual EventTargetData* eventTargetData() { return &m_eventTargetData; }
+    virtual EventTargetData* ensureEventTargetData() { return &m_eventTargetData; }
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(complete);
+
+    // Reconcile ref/deref which are defined both in AudioNode and EventTarget.
+    using RefCounted<AudioContext>::ref;
+    using RefCounted<AudioContext>::deref;
+
+    void startRendering();
+    void fireCompletionEvent();
     
 private:
     AudioContext(Document*);
+    AudioContext(Document*, unsigned numberOfChannels, size_t numberOfFrames, double sampleRate);
+    void constructCommon();
+
     void lazyInitialize();
     void uninitialize();
     
@@ -252,6 +278,15 @@ private:
     
     // HRTF Database loader
     RefPtr<HRTFDatabaseLoader> m_hrtfDatabaseLoader;
+
+    // EventTarget
+    virtual void refEventTarget() { ref(); }
+    virtual void derefEventTarget() { deref(); }
+    EventTargetData m_eventTargetData;
+
+    RefPtr<AudioBuffer> m_renderTarget;
+    
+    bool m_isOfflineContext;
 };
 
 } // WebCore
diff --git a/Source/WebCore/webaudio/AudioContext.idl b/Source/WebCore/webaudio/AudioContext.idl
index 531774e..39b36c1 100644
--- a/Source/WebCore/webaudio/AudioContext.idl
+++ b/Source/WebCore/webaudio/AudioContext.idl
@@ -27,7 +27,10 @@ module webaudio {
         Conditional=WEB_AUDIO,
         CanBeConstructed,
         CustomConstructFunction,
-        V8CustomConstructor
+        V8CustomConstructor,
+#if defined(V8_BINDING) && V8_BINDING
+        EventTarget
+#endif        
     ] AudioContext {
         // All rendered audio ultimately connects to destination, which represents the audio hardware.
         readonly attribute AudioDestinationNode destination;
@@ -62,5 +65,11 @@ module webaudio {
         // Channel splitting and merging
         AudioChannelSplitter createChannelSplitter();
         AudioChannelMerger createChannelMerger();
+        
+        // Offline rendering
+        // void prepareOfflineBufferRendering(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
+        attribute EventListener oncomplete;
+        void startRendering();
+        
     };
 }
diff --git a/Source/WebCore/webaudio/AudioDestinationNode.cpp b/Source/WebCore/webaudio/AudioDestinationNode.cpp
index d2f4928..8c46b44 100644
--- a/Source/WebCore/webaudio/AudioDestinationNode.cpp
+++ b/Source/WebCore/webaudio/AudioDestinationNode.cpp
@@ -32,19 +32,16 @@
 #include "AudioContext.h"
 #include "AudioNodeInput.h"
 #include "AudioNodeOutput.h"
-#include <wtf/Threading.h>
 
 namespace WebCore {
-
-AudioDestinationNode::AudioDestinationNode(AudioContext* context)
-    : AudioNode(context, AudioDestination::hardwareSampleRate())
+    
+AudioDestinationNode::AudioDestinationNode(AudioContext* context, double sampleRate)
+    : AudioNode(context, sampleRate)
     , m_currentTime(0.0)
 {
     addInput(adoptPtr(new AudioNodeInput(this)));
     
     setType(NodeTypeDestination);
-    
-    initialize();
 }
 
 AudioDestinationNode::~AudioDestinationNode()
@@ -52,32 +49,6 @@ AudioDestinationNode::~AudioDestinationNode()
     uninitialize();
 }
 
-void AudioDestinationNode::initialize()
-{
-    if (isInitialized())
-        return;
-
-    double hardwareSampleRate = AudioDestination::hardwareSampleRate();
-#ifndef NDEBUG    
-    fprintf(stderr, ">>>> hardwareSampleRate = %f\n", hardwareSampleRate);
-#endif
-    
-    m_destination = AudioDestination::create(*this, hardwareSampleRate);
-    m_destination->start();
-    
-    AudioNode::initialize();
-}
-
-void AudioDestinationNode::uninitialize()
-{
-    if (!isInitialized())
-        return;
-
-    m_destination->stop();
-
-    AudioNode::uninitialize();
-}
-
 // The audio hardware calls us back here to gets its input stream.
 void AudioDestinationNode::provideInput(AudioBus* destinationBus, size_t numberOfFrames)
 {
diff --git a/Source/WebCore/webaudio/AudioDestinationNode.h b/Source/WebCore/webaudio/AudioDestinationNode.h
index 4c21bb8..5913205 100644
--- a/Source/WebCore/webaudio/AudioDestinationNode.h
+++ b/Source/WebCore/webaudio/AudioDestinationNode.h
@@ -25,11 +25,9 @@
 #ifndef AudioDestinationNode_h
 #define AudioDestinationNode_h
 
-#include "AudioDestination.h"
+#include "AudioBuffer.h"
 #include "AudioNode.h"
 #include "AudioSourceProvider.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
@@ -38,32 +36,25 @@ class AudioContext;
     
 class AudioDestinationNode : public AudioNode, public AudioSourceProvider {
 public:
-    static PassRefPtr<AudioDestinationNode> create(AudioContext* context)
-    {
-        return adoptRef(new AudioDestinationNode(context));        
-    }
-
+    AudioDestinationNode(AudioContext*, double sampleRate);
     virtual ~AudioDestinationNode();
     
     // AudioNode   
     virtual void process(size_t) { }; // we're pulled by hardware so this is never called
     virtual void reset() { m_currentTime = 0.0; };
-    virtual void initialize();
-    virtual void uninitialize();
     
     // The audio hardware calls here periodically to gets its input stream.
     virtual void provideInput(AudioBus*, size_t numberOfFrames);
 
     double currentTime() { return m_currentTime; }
 
-    double sampleRate() const { return m_destination->sampleRate(); }
+    virtual double sampleRate() const = 0;
 
-    unsigned numberOfChannels() const { return 2; } // FIXME: update when multi-channel (more than stereo) is supported
-    
-private:
-    AudioDestinationNode(AudioContext*);
+    virtual unsigned numberOfChannels() const { return 2; } // FIXME: update when multi-channel (more than stereo) is supported
 
-    OwnPtr<AudioDestination> m_destination;
+    virtual void startRendering() = 0;
+    
+protected:
     double m_currentTime;
 };
 
diff --git a/Source/WebCore/webaudio/ConvolverNode.cpp b/Source/WebCore/webaudio/ConvolverNode.cpp
index c778a41..91f6dc6 100644
--- a/Source/WebCore/webaudio/ConvolverNode.cpp
+++ b/Source/WebCore/webaudio/ConvolverNode.cpp
@@ -29,6 +29,7 @@
 #include "ConvolverNode.h"
 
 #include "AudioBuffer.h"
+#include "AudioContext.h"
 #include "AudioNodeInput.h"
 #include "AudioNodeOutput.h"
 #include "Reverb.h"
@@ -131,7 +132,8 @@ void ConvolverNode::setBuffer(AudioBuffer* buffer)
         bufferBus.setChannelMemory(i, buffer->getChannelData(i)->data(), bufferLength);
     
     // Create the reverb with the given impulse response.
-    OwnPtr<Reverb> reverb = adoptPtr(new Reverb(&bufferBus, AudioNode::ProcessingSizeInFrames, MaxFFTSize, 2, true));
+    bool useBackgroundThreads = !context()->isOfflineContext();
+    OwnPtr<Reverb> reverb = adoptPtr(new Reverb(&bufferBus, AudioNode::ProcessingSizeInFrames, MaxFFTSize, 2, useBackgroundThreads));
 
     {
         // Synchronize with process().
diff --git a/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp b/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp
new file mode 100644
index 0000000..f1a7263
--- /dev/null
+++ b/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "DefaultAudioDestinationNode.h"
+
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
+namespace WebCore {
+    
+DefaultAudioDestinationNode::DefaultAudioDestinationNode(AudioContext* context)
+    : AudioDestinationNode(context, AudioDestination::hardwareSampleRate())
+{
+    initialize();
+}
+
+DefaultAudioDestinationNode::~DefaultAudioDestinationNode()
+{
+    uninitialize();
+}
+
+void DefaultAudioDestinationNode::initialize()
+{
+    if (isInitialized())
+        return;
+
+    double hardwareSampleRate = AudioDestination::hardwareSampleRate();
+#ifndef NDEBUG    
+    fprintf(stderr, ">>>> hardwareSampleRate = %f\n", hardwareSampleRate);
+#endif
+    
+    m_destination = AudioDestination::create(*this, hardwareSampleRate);
+    
+    AudioNode::initialize();
+}
+
+void DefaultAudioDestinationNode::uninitialize()
+{
+    if (!isInitialized())
+        return;
+
+    m_destination->stop();
+
+    AudioNode::uninitialize();
+}
+
+void DefaultAudioDestinationNode::startRendering()
+{
+    ASSERT(isInitialized());
+    if (isInitialized())
+        m_destination->start();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/webaudio/DefaultAudioDestinationNode.h b/Source/WebCore/webaudio/DefaultAudioDestinationNode.h
new file mode 100644
index 0000000..f1d689d
--- /dev/null
+++ b/Source/WebCore/webaudio/DefaultAudioDestinationNode.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DefaultAudioDestinationNode_h
+#define DefaultAudioDestinationNode_h
+
+#include "AudioDestination.h"
+#include "AudioDestinationNode.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+class AudioContext;
+    
+class DefaultAudioDestinationNode : public AudioDestinationNode {
+public:
+    static PassRefPtr<DefaultAudioDestinationNode> create(AudioContext* context)
+    {
+        return adoptRef(new DefaultAudioDestinationNode(context));     
+    }
+
+    virtual ~DefaultAudioDestinationNode();
+    
+    // AudioNode   
+    virtual void initialize();
+    virtual void uninitialize();
+    
+    double sampleRate() const { return m_destination->sampleRate(); }
+
+    virtual void startRendering();
+    
+private:
+    DefaultAudioDestinationNode(AudioContext*);
+
+    OwnPtr<AudioDestination> m_destination;
+};
+
+} // namespace WebCore
+
+#endif // DefaultAudioDestinationNode_h
diff --git a/Source/WebCore/webaudio/OfflineAudioCompletionEvent.cpp b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.cpp
new file mode 100644
index 0000000..6160c82
--- /dev/null
+++ b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "OfflineAudioCompletionEvent.h"
+
+#include "AudioBuffer.h"
+#include "EventNames.h"
+
+namespace WebCore {
+
+PassRefPtr<OfflineAudioCompletionEvent> OfflineAudioCompletionEvent::create(PassRefPtr<AudioBuffer> renderedBuffer)
+{
+    return adoptRef(new OfflineAudioCompletionEvent(renderedBuffer));
+}
+
+OfflineAudioCompletionEvent::OfflineAudioCompletionEvent(PassRefPtr<AudioBuffer> renderedBuffer)
+    : Event(eventNames().completeEvent, true, false)
+    , m_renderedBuffer(renderedBuffer)
+{
+}
+
+OfflineAudioCompletionEvent::~OfflineAudioCompletionEvent()
+{
+}
+
+bool OfflineAudioCompletionEvent::isOfflineAudioCompletionEvent() const
+{
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/webaudio/OfflineAudioCompletionEvent.h b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.h
new file mode 100644
index 0000000..bd700e8
--- /dev/null
+++ b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef OfflineAudioCompletionEvent_h
+#define OfflineAudioCompletionEvent_h
+
+#include "AudioBuffer.h"
+#include "Event.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class AudioBuffer;
+    
+class OfflineAudioCompletionEvent : public Event {
+public:
+    static PassRefPtr<OfflineAudioCompletionEvent> create(PassRefPtr<AudioBuffer> renderedBuffer);
+    
+    virtual ~OfflineAudioCompletionEvent();
+
+    virtual bool isOfflineAudioCompletionEvent() const;
+
+    AudioBuffer* renderedBuffer() { return m_renderedBuffer.get(); }
+
+private:
+    OfflineAudioCompletionEvent(PassRefPtr<AudioBuffer> renderedBuffer);
+
+    RefPtr<AudioBuffer> m_renderedBuffer;
+};
+
+} // namespace WebCore
+
+#endif // OfflineAudioCompletionEvent_h
diff --git a/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl
new file mode 100644
index 0000000..cd5ccb0
--- /dev/null
+++ b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module audio {
+    interface [
+        Conditional=WEB_AUDIO,
+        GenerateToJS
+    ] OfflineAudioCompletionEvent : Event {
+        readonly attribute AudioBuffer renderedBuffer;
+    };
+}
diff --git a/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp b/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp
new file mode 100644
index 0000000..e3a0758
--- /dev/null
+++ b/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "OfflineAudioDestinationNode.h"
+
+#include "AudioBus.h"
+#include "AudioContext.h"
+#include "HRTFDatabaseLoader.h"
+#include <algorithm>
+#include <wtf/Threading.h>
+
+using namespace std;
+ 
+namespace WebCore {
+    
+const size_t renderQuantumSize = 128;    
+
+OfflineAudioDestinationNode::OfflineAudioDestinationNode(AudioContext* context, AudioBuffer* renderTarget)
+    : AudioDestinationNode(context, renderTarget->sampleRate())
+    , m_renderTarget(renderTarget)
+    , m_startedRendering(false)
+{
+    m_renderBus = adoptPtr(new AudioBus(renderTarget->numberOfChannels(), renderQuantumSize));
+    
+    initialize();
+}
+
+OfflineAudioDestinationNode::~OfflineAudioDestinationNode()
+{
+    uninitialize();
+}
+
+void OfflineAudioDestinationNode::initialize()
+{
+    if (isInitialized())
+        return;
+
+    AudioNode::initialize();
+}
+
+void OfflineAudioDestinationNode::uninitialize()
+{
+    if (!isInitialized())
+        return;
+
+    AudioNode::uninitialize();
+}
+
+void OfflineAudioDestinationNode::startRendering()
+{
+    ASSERT(isMainThread());
+    ASSERT(m_renderTarget.get());
+    if (!m_renderTarget.get())
+        return;
+    
+    if (!m_startedRendering) {
+        m_startedRendering = true;
+        m_renderThread = createThread(OfflineAudioDestinationNode::renderEntry, this, "offline renderer");
+    }
+}
+
+// Do offline rendering in this thread.
+void* OfflineAudioDestinationNode::renderEntry(void* threadData)
+{
+    OfflineAudioDestinationNode* destinationNode = reinterpret_cast<OfflineAudioDestinationNode*>(threadData);
+    ASSERT(destinationNode);
+    destinationNode->render();
+    
+    return 0;
+}
+
+void OfflineAudioDestinationNode::render()
+{
+    ASSERT(!isMainThread());
+    ASSERT(m_renderBus.get());
+    if (!m_renderBus.get())
+        return;
+    
+    bool channelsMatch = m_renderBus->numberOfChannels() == m_renderTarget->numberOfChannels();
+    ASSERT(channelsMatch);
+    if (!channelsMatch)
+        return;
+        
+    bool isRenderBusAllocated = m_renderBus->length() >= renderQuantumSize;
+    ASSERT(isRenderBusAllocated);
+    if (!isRenderBusAllocated)
+        return;
+        
+    // Synchronize with HRTFDatabaseLoader.
+    // The database must be loaded before we can proceed.
+    HRTFDatabaseLoader* loader = HRTFDatabaseLoader::loader();
+    ASSERT(loader);
+    if (!loader)
+        return;
+    
+    loader->waitForLoaderThreadCompletion();
+        
+    // Break up the render target into smaller "render quantize" sized pieces.
+    // Render until we're finished.
+    size_t framesToProcess = m_renderTarget->length();
+    unsigned numberOfChannels = m_renderTarget->numberOfChannels();
+
+    unsigned n = 0;
+    while (framesToProcess > 0) {
+        // Render one render quantum.
+        provideInput(m_renderBus.get(), renderQuantumSize);
+        
+        size_t framesAvailableToCopy = min(framesToProcess, renderQuantumSize);
+        
+        for (unsigned channelIndex = 0; channelIndex < numberOfChannels; ++channelIndex) {
+            float* source = m_renderBus->channel(channelIndex)->data();
+            float* destination = m_renderTarget->getChannelData(channelIndex)->data();
+            memcpy(destination + n, source, sizeof(float) * framesAvailableToCopy);
+        }
+        
+        n += framesAvailableToCopy;
+        framesToProcess -= framesAvailableToCopy;
+    }
+    
+    // Our work is done. Let the AudioContext know.
+    callOnMainThread(notifyCompleteDispatch, this);
+}
+
+void OfflineAudioDestinationNode::notifyCompleteDispatch(void* userData)
+{
+    OfflineAudioDestinationNode* destinationNode = static_cast<OfflineAudioDestinationNode*>(userData);
+    ASSERT(destinationNode);
+    if (!destinationNode)
+        return;
+
+    destinationNode->notifyComplete();
+}
+
+void OfflineAudioDestinationNode::notifyComplete()
+{
+    context()->fireCompletionEvent();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/webaudio/OfflineAudioDestinationNode.h b/Source/WebCore/webaudio/OfflineAudioDestinationNode.h
new file mode 100644
index 0000000..714c120
--- /dev/null
+++ b/Source/WebCore/webaudio/OfflineAudioDestinationNode.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef OfflineAudioDestinationNode_h
+#define OfflineAudioDestinationNode_h
+
+#include "AudioBuffer.h"
+#include "AudioDestinationNode.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+class AudioBus;
+class AudioContext;
+    
+class OfflineAudioDestinationNode : public AudioDestinationNode {
+public:
+    static PassRefPtr<OfflineAudioDestinationNode> create(AudioContext* context, AudioBuffer* renderTarget)
+    {
+        return adoptRef(new OfflineAudioDestinationNode(context, renderTarget));     
+    }
+
+    virtual ~OfflineAudioDestinationNode();
+    
+    // AudioNode   
+    virtual void initialize();
+    virtual void uninitialize();
+    
+    double sampleRate() const { return m_renderTarget->sampleRate(); }
+
+    void startRendering();
+    
+private:
+    OfflineAudioDestinationNode(AudioContext*, AudioBuffer* renderTarget);
+
+    // This AudioNode renders into this AudioBuffer.
+    RefPtr<AudioBuffer> m_renderTarget;
+    
+    // Temporary AudioBus for each render quantum.
+    OwnPtr<AudioBus> m_renderBus;
+    
+    // Rendering thread.
+    volatile ThreadIdentifier m_renderThread;
+    bool m_startedRendering;
+    static void* renderEntry(void* threadData);
+    void render();
+    
+    // For completion callback on main thread.
+    static void notifyCompleteDispatch(void* userData);
+    void notifyComplete();
+};
+
+} // namespace WebCore
+
+#endif // OfflineAudioDestinationNode_h
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index 3b14e59..c2fce5c 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -51,6 +51,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "SecurityOrigin.h"
+#include "WorkerInspectorController.h"
 #include "WorkerLocation.h"
 #include "WorkerNavigator.h"
 #include "WorkerObjectProxy.h"
@@ -106,6 +107,9 @@ WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThr
     , m_userAgent(userAgent)
     , m_script(new WorkerScriptController(this))
     , m_thread(thread)
+#if ENABLE(INSPECTOR)
+    , m_workerInspectorController(new WorkerInspectorController(this))
+#endif
     , m_closing(false)
 {
     setSecurityOrigin(SecurityOrigin::create(url));
@@ -167,9 +171,10 @@ void WorkerContext::close()
     if (m_closing)
         return;
 
-    m_closing = true;
     // Let current script run to completion but prevent future script evaluations.
-    m_script->forbidExecution(WorkerScriptController::LetRunningScriptFinish);
+    // After m_closing is set, all the tasks in the queue continue to be fetched but only
+    // tasks with isCleanupTask()==true will be executed.
+    m_closing = true;
     postTask(CloseWorkerContextTask::create());
 }
 
@@ -320,7 +325,7 @@ bool WorkerContext::isContextThread() const
     return currentThread() == thread()->threadID();
 }
 
-bool WorkerContext::isJSExecutionTerminated() const
+bool WorkerContext::isJSExecutionForbidden() const
 {
     return m_script->isExecutionForbidden();
 }
@@ -345,7 +350,7 @@ DOMURL* WorkerContext::webkitURL() const
 #endif
 
 #if ENABLE(FILE_SYSTEM)
-void WorkerContext::requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void WorkerContext::webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem()) {
         DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::SECURITY_ERR));
@@ -353,7 +358,7 @@ void WorkerContext::requestFileSystem(int type, long long size, PassRefPtr<FileS
     }
 
     AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (fileSystemType != AsyncFileSystem::Temporary && fileSystemType != AsyncFileSystem::Persistent) {
+    if (fileSystemType != AsyncFileSystem::Temporary && fileSystemType != AsyncFileSystem::Persistent && fileSystemType != AsyncFileSystem::External) {
         DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
         return;
     }
@@ -361,7 +366,7 @@ void WorkerContext::requestFileSystem(int type, long long size, PassRefPtr<FileS
     LocalFileSystem::localFileSystem().requestFileSystem(this, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, this), false);
 }
 
-PassRefPtr<DOMFileSystemSync> WorkerContext::requestFileSystemSync(int type, long long size, ExceptionCode& ec)
+PassRefPtr<DOMFileSystemSync> WorkerContext::webkitRequestFileSystemSync(int type, long long size, ExceptionCode& ec)
 {
     ec = 0;
     if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem()) {
@@ -370,7 +375,7 @@ PassRefPtr<DOMFileSystemSync> WorkerContext::requestFileSystemSync(int type, lon
     }
 
     AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (fileSystemType != AsyncFileSystem::Temporary && fileSystemType != AsyncFileSystem::Persistent) {
+    if (fileSystemType != AsyncFileSystem::Temporary && fileSystemType != AsyncFileSystem::Persistent && fileSystemType != AsyncFileSystem::External) {
         ec = FileException::INVALID_MODIFICATION_ERR;
         return 0;
     }
@@ -380,7 +385,7 @@ PassRefPtr<DOMFileSystemSync> WorkerContext::requestFileSystemSync(int type, lon
     return helper.getResult(ec);
 }
 
-void WorkerContext::resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void WorkerContext::webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     KURL completedURL = completeURL(url);
     if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
@@ -398,7 +403,7 @@ void WorkerContext::resolveLocalFileSystemURL(const String& url, PassRefPtr<Entr
     LocalFileSystem::localFileSystem().readFileSystem(this, type, ResolveURICallbacks::create(successCallback, errorCallback, this, filePath));
 }
 
-PassRefPtr<EntrySync> WorkerContext::resolveLocalFileSystemSyncURL(const String& url, ExceptionCode& ec)
+PassRefPtr<EntrySync> WorkerContext::webkitResolveLocalFileSystemSyncURL(const String& url, ExceptionCode& ec)
 {
     ec = 0;
     KURL completedURL = completeURL(url);
@@ -429,6 +434,7 @@ PassRefPtr<EntrySync> WorkerContext::resolveLocalFileSystemSyncURL(const String&
 
 COMPILE_ASSERT(static_cast<int>(WorkerContext::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
 COMPILE_ASSERT(static_cast<int>(WorkerContext::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
+COMPILE_ASSERT(static_cast<int>(WorkerContext::EXTERNAL) == static_cast<int>(AsyncFileSystem::External), enum_mismatch);
 #endif
 
 WorkerContext::Observer::Observer(WorkerContext* context)
diff --git a/Source/WebCore/workers/WorkerContext.h b/Source/WebCore/workers/WorkerContext.h
index d2ccb11..8237da1 100644
--- a/Source/WebCore/workers/WorkerContext.h
+++ b/Source/WebCore/workers/WorkerContext.h
@@ -56,6 +56,7 @@ namespace WebCore {
     class FileSystemCallback;
     class NotificationCenter;
     class ScheduledAction;
+    class WorkerInspectorController;
     class WorkerLocation;
     class WorkerNavigator;
     class WorkerThread;
@@ -120,7 +121,7 @@ namespace WebCore {
         virtual void databaseExceededQuota(const String&);
 #endif
         virtual bool isContextThread() const;
-        virtual bool isJSExecutionTerminated() const;
+        virtual bool isJSExecutionForbidden() const;
 
 #if ENABLE(BLOB)
         DOMURL* webkitURL() const;
@@ -130,13 +131,16 @@ namespace WebCore {
         enum FileSystemType {
             TEMPORARY,
             PERSISTENT,
+            EXTERNAL,
         };
-        void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback>);
-        PassRefPtr<DOMFileSystemSync> requestFileSystemSync(int type, long long size, ExceptionCode&);
-        void resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback>);
-        PassRefPtr<EntrySync> resolveLocalFileSystemSyncURL(const String& url, ExceptionCode&);
+        void webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback>);
+        PassRefPtr<DOMFileSystemSync> webkitRequestFileSystemSync(int type, long long size, ExceptionCode&);
+        void webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback>);
+        PassRefPtr<EntrySync> webkitResolveLocalFileSystemSyncURL(const String& url, ExceptionCode&);
+#endif
+#if ENABLE(INSPECTOR)
+        WorkerInspectorController* workerInspectorController() { return m_workerInspectorController.get(); }
 #endif
-
         // These methods are used for GC marking. See JSWorkerContext::markChildren(MarkStack&) in
         // JSWorkerContextCustom.cpp.
         WorkerNavigator* optionalNavigator() const { return m_navigator.get(); }
@@ -196,6 +200,9 @@ namespace WebCore {
 #if ENABLE(BLOB)
         mutable RefPtr<DOMURL> m_domURL;
 #endif
+#if ENABLE(INSPECTOR)
+        OwnPtr<WorkerInspectorController> m_workerInspectorController;
+#endif
         bool m_closing;
         EventTargetData m_eventTargetData;
 
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index 7b2af6b..e31f5ad 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -98,7 +98,7 @@ module threads {
 #endif
 
 #if defined(ENABLE_BLOB) && ENABLE_BLOB
-        attribute BlobBuilderConstructor BlobBuilder;
+        attribute WebKitBlobBuilderConstructor WebKitBlobBuilder;
         attribute FileReaderConstructor FileReader;
         attribute FileReaderSyncConstructor FileReaderSync;
 #endif
@@ -108,12 +108,12 @@ module threads {
 #if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
         const unsigned short TEMPORARY = 0;
         const unsigned short PERSISTENT = 1;
-        [EnabledAtRuntime=FileSystem] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [EnabledAtRuntime=FileSystem] DOMFileSystemSync requestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
-        [EnabledAtRuntime=FileSystem] void resolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [EnabledAtRuntime=FileSystem] EntrySync resolveLocalFileSystemSyncURL(in DOMString url) raises (FileException);
+        [EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] DOMFileSystemSync webkitRequestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
+        [EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] EntrySync webkitResolveLocalFileSystemSyncURL(in DOMString url) raises (FileException);
 
-                 attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
+                 attribute [EnabledAtRuntime=FileSystem] WebKitFlagsConstructor WebKitFlags;
                  attribute [EnabledAtRuntime=FileSystem] FileErrorConstructor FileError;
                  attribute [EnabledAtRuntime=FileSystem] FileExceptionConstructor FileException;
 #endif
diff --git a/Source/WebCore/workers/WorkerScriptLoader.h b/Source/WebCore/workers/WorkerScriptLoader.h
index 4f045b5..67f113a 100644
--- a/Source/WebCore/workers/WorkerScriptLoader.h
+++ b/Source/WebCore/workers/WorkerScriptLoader.h
@@ -58,7 +58,7 @@ namespace WebCore {
         unsigned long identifier() const { return m_identifier; }
 
         virtual void didReceiveResponse(const ResourceResponse&);
-        virtual void didReceiveData(const char* data, int lengthReceived);
+        virtual void didReceiveData(const char* data, int dataLength);
         virtual void didFinishLoading(unsigned long identifier, double);
         virtual void didFail(const ResourceError&);
         virtual void didFailRedirectCheck();
diff --git a/Source/WebCore/workers/WorkerThread.cpp b/Source/WebCore/workers/WorkerThread.cpp
index deafb0b..aef936f 100644
--- a/Source/WebCore/workers/WorkerThread.cpp
+++ b/Source/WebCore/workers/WorkerThread.cpp
@@ -127,7 +127,7 @@ void* WorkerThread::workerThread()
         if (m_runLoop.terminated()) {
             // The worker was terminated before the thread had a chance to run. Since the context didn't exist yet,
             // forbidExecution() couldn't be called from stop().
-           m_workerContext->script()->forbidExecution(WorkerScriptController::TerminateRunningScript);
+           m_workerContext->script()->forbidExecution();
         }
     }
 
@@ -228,7 +228,7 @@ void WorkerThread::stop()
 
     // Ensure that tasks are being handled by thread event loop. If script execution weren't forbidden, a while(1) loop in JS could keep the thread alive forever.
     if (m_workerContext) {
-        m_workerContext->script()->forbidExecution(WorkerScriptController::TerminateRunningScript);
+        m_workerContext->script()->scheduleExecutionTermination();
 
 #if ENABLE(DATABASE)
         DatabaseTracker::tracker().interruptAllDatabasesForContext(m_workerContext.get());
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index d6e6182..41d8afb 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -56,7 +56,7 @@
 #if USE(JSC)
 #include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <runtime/JSLock.h>
 #endif
 
@@ -271,7 +271,6 @@ Blob* XMLHttpRequest::responseBlob(ExceptionCode& ec) const
 }
 #endif
 
-#if ENABLE(WEBGL) || ENABLE(BLOB)
 ArrayBuffer* XMLHttpRequest::responseArrayBuffer(ExceptionCode& ec)
 {
     if (m_responseTypeCode != ResponseTypeArrayBuffer) {
@@ -292,7 +291,6 @@ ArrayBuffer* XMLHttpRequest::responseArrayBuffer(ExceptionCode& ec)
 
     return 0;
 }
-#endif
 
 void XMLHttpRequest::setResponseType(const String& responseType, ExceptionCode& ec)
 {
@@ -312,9 +310,7 @@ void XMLHttpRequest::setResponseType(const String& responseType, ExceptionCode&
         m_responseTypeCode = ResponseTypeBlob;
 #endif
     } else if (responseType == "arraybuffer") {
-#if ENABLE(WEBGL) || ENABLE(BLOB)
         m_responseTypeCode = ResponseTypeArrayBuffer;
-#endif
     } else
         ec = SYNTAX_ERR;
 }
@@ -586,7 +582,6 @@ void XMLHttpRequest::send(DOMFormData* body, ExceptionCode& ec)
     createRequest(ec);
 }
 
-#if ENABLE(WEBGL) || ENABLE(BLOB)
 void XMLHttpRequest::send(ArrayBuffer* body, ExceptionCode& ec)
 {
     if (!initSend(ec))
@@ -600,7 +595,6 @@ void XMLHttpRequest::send(ArrayBuffer* body, ExceptionCode& ec)
 
     createRequest(ec);
 }
-#endif
 
 void XMLHttpRequest::createRequest(ExceptionCode& ec)
 {
@@ -739,10 +733,8 @@ void XMLHttpRequest::clearResponseBuffers()
 #if ENABLE(XHR_RESPONSE_BLOB)
     m_responseBlob = 0;
 #endif
-#if ENABLE(WEBGL) || ENABLE(BLOB)
     m_binaryResponseBuilder.clear();
     m_responseArrayBuffer.clear();
-#endif
 }
 
 void XMLHttpRequest::clearRequest()
@@ -792,11 +784,9 @@ void XMLHttpRequest::dropProtection()
     // out. But it is protected from GC while loading, so this
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
+    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
     JSC::JSGlobalData* globalData = scriptExecutionContext()->globalData();
-    if (hasCachedDOMObjectWrapper(globalData, this)) {
-        JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-        globalData->heap.reportExtraMemoryCost(m_responseBuilder.length() * 2);
-    }
+    globalData->heap.reportExtraMemoryCost(m_responseBuilder.length() * 2);
 #endif
 
     unsetPendingActivity(this);
@@ -1076,14 +1066,12 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
 
     if (useDecoder)
         m_responseBuilder.append(m_decoder->decode(data, len));
-#if ENABLE(WEBGL) || ENABLE(BLOB)
     else if (responseTypeCode() == ResponseTypeArrayBuffer) {
         // Buffer binary data.
         if (!m_binaryResponseBuilder)
             m_binaryResponseBuilder = SharedBuffer::create();
         m_binaryResponseBuilder->append(data, len);
     }
-#endif
 
     if (!m_error) {
         long long expectedLength = m_response.expectedContentLength();
diff --git a/Source/WebCore/xml/XMLHttpRequest.h b/Source/WebCore/xml/XMLHttpRequest.h
index 0f461e1..cca8c36 100644
--- a/Source/WebCore/xml/XMLHttpRequest.h
+++ b/Source/WebCore/xml/XMLHttpRequest.h
@@ -95,9 +95,7 @@ public:
     void send(const String&, ExceptionCode&);
     void send(Blob*, ExceptionCode&);
     void send(DOMFormData*, ExceptionCode&);
-#if ENABLE(WEBGL) || ENABLE(BLOB)
     void send(ArrayBuffer*, ExceptionCode&);
-#endif
     void abort();
     void setRequestHeader(const AtomicString& name, const String& value, ExceptionCode&);
     void overrideMimeType(const String& override);
@@ -115,11 +113,9 @@ public:
     String responseType();
     ResponseTypeCode responseTypeCode() const { return m_responseTypeCode; }
     
-#if ENABLE(WEBGL) || ENABLE(BLOB)
     // response attribute has custom getter.
     ArrayBuffer* responseArrayBuffer(ExceptionCode&);
     ArrayBuffer* optionalResponseArrayBuffer() const { return m_responseArrayBuffer.get(); }
-#endif
 
     void setLastSendLineNumber(unsigned lineNumber) { m_lastSendLineNumber = lineNumber; }
     void setLastSendURL(const String& url) { m_lastSendURL = url; }
@@ -153,7 +149,7 @@ private:
 
     virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
     virtual void didReceiveResponse(const ResourceResponse&);
-    virtual void didReceiveData(const char* data, int lengthReceived);
+    virtual void didReceiveData(const char* data, int dataLength);
     virtual void didFinishLoading(unsigned long identifier, double finishTime);
     virtual void didFail(const ResourceError&);
     virtual void didFailRedirectCheck();
@@ -207,10 +203,8 @@ private:
     mutable bool m_createdDocument;
     mutable RefPtr<Document> m_responseXML;
     
-#if ENABLE(WEBGL) || ENABLE(BLOB)
     RefPtr<SharedBuffer> m_binaryResponseBuilder;
     mutable RefPtr<ArrayBuffer> m_responseArrayBuffer;
-#endif
 
     bool m_error;
 
diff --git a/Source/WebCore/xml/XMLTreeViewer.cpp b/Source/WebCore/xml/XMLTreeViewer.cpp
index f1e2c0f..a2110db 100644
--- a/Source/WebCore/xml/XMLTreeViewer.cpp
+++ b/Source/WebCore/xml/XMLTreeViewer.cpp
@@ -27,37 +27,20 @@
  */
 
 #include "config.h"
-
-#if ENABLE(XSLT)
 #include "XMLTreeViewer.h"
 
+#if ENABLE(XSLT)
 
-#include "Base64.h"
-#include "Element.h"
 #include "Document.h"
+#include "Element.h"
 #include "Frame.h"
-#include "HTMLNames.h"
 #include "Page.h"
-#include "ProcessingInstruction.h"
+#include "ScriptController.h"
+#include "ScriptSourceCode.h"
 #include "Settings.h"
-#include "TransformSource.h"
-#include "XLinkNames.h"
-#include "XMLViewerXSL.h"
-#include "XPathResult.h"
-#include "XSLStyleSheet.h"
-#include "XSLTProcessor.h"
-
-#include <libxslt/xslt.h>
-
-#if ENABLE(MATHML)
-#include "MathMLNames.h"
-#endif
-#if ENABLE(SVG)
-#include "SVGNames.h"
-#endif
-#if ENABLE(WML)
-#include "WMLNames.h"
-#endif
+#include "Text.h"
+#include "XMLViewerCSS.h"
+#include "XMLViewerJS.h"
 
 using namespace std;
 
@@ -82,39 +65,23 @@ bool XMLTreeViewer::hasNoStyleInformation() const
     if (m_document->frame()->tree()->parent(true))
         return false; // This document is not in a top frame
 
-    if (m_document->frame()->loader()->opener())
-        return false; // This document is not opened manually by user
     return true;
 }
 
 void XMLTreeViewer::transformDocumentToTreeView()
 {
-    String sheetString(reinterpret_cast<const char*>(XMLViewer_xsl), sizeof(XMLViewer_xsl));
-    RefPtr<XSLStyleSheet> styleSheet = XSLStyleSheet::createForXMLTreeViewer(m_document, sheetString);
-
-    RefPtr<XSLTProcessor> processor = XSLTProcessor::create();
-    processor->setXSLStyleSheet(styleSheet);
-
-    processor->setParameter("", "xml_has_no_style_message", "This XML file does not appear to have any style information associated with it. The document tree is shown below.");
-
-    String resultMIMEType;
-    String newSource;
-    String resultEncoding;
-
-    Frame* frame = m_document->frame();
-    // FIXME: We should introduce error handling
-    if (processor->transformToString(m_document, resultMIMEType, newSource, resultEncoding))
-        processor->createDocumentFromSource(newSource, resultEncoding, resultMIMEType, m_document, frame);
-
-    // Adding source xml for dealing with namespaces and CDATA issues and for extensions use.
-    Element* sourceXmlElement = frame->document()->getElementById(AtomicString("source-xml"));
-    if (sourceXmlElement)
-        m_document->cloneChildNodes(sourceXmlElement);
-
-    // New document should have been loaded in frame. Tell it to use view source styles.
-    frame->document()->setUsesViewSourceStyles(true);
-    frame->document()->styleSelectorChanged(RecalcStyleImmediately);
-
+    String scriptString(reinterpret_cast<const char*>(XMLViewer_js), sizeof(XMLViewer_js));
+    m_document->frame()->script()->evaluate(ScriptSourceCode(scriptString));
+    String noStyleMessage("This XML file does not appear to have any style information associated with it. The document tree is shown below.");
+    m_document->frame()->script()->evaluate(ScriptSourceCode("prepareWebKitXMLViewer('" + noStyleMessage + "');"));
+
+    String cssString(reinterpret_cast<const char*>(XMLViewer_css), sizeof(XMLViewer_css));
+    RefPtr<Text> text = m_document->createTextNode(cssString);
+    ExceptionCode exceptionCode;
+    m_document->getElementById("xml-viewer-style")->appendChild(text, exceptionCode);
+
+    m_document->setUsesViewSourceStyles(true);
+    m_document->styleSelectorChanged(RecalcStyleImmediately);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/xml/XMLViewer.css b/Source/WebCore/xml/XMLViewer.css
new file mode 100644
index 0000000..2a1d5fd
--- /dev/null
+++ b/Source/WebCore/xml/XMLViewer.css
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
+ * “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
+ * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+div.header {
+    border-bottom: 2px solid black;
+    padding-bottom: 5px;
+    margin: 10px;
+}
+
+div.collapsible > div.hidden {
+    display:none;
+}
+
+.pretty-print {
+    margin-top: 1em;
+    margin-left: 20px;
+    font-family: monospace;
+    font-size: 13px;
+}
+
+#webkit-xml-viewer-source-xml {
+    display: none;
+}
+
+.collapsible-content {
+    margin-left: 1em;
+}
+.comment {
+    whitespace: pre;
+}
+
+.button {
+    -webkit-user-select: none;
+    cursor: pointer;
+    display: inline-block;
+    margin-left: -10px;
+    width: 10px;
+    background-repeat: no-repeat;
+    background-position: left top;
+    vertical-align: bottom;
+}
+
+.collapse-button {
+    background-image: -webkit-canvas(arrowDown);
+    height: 10px;
+}
+
+.expand-button {
+    background-image: -webkit-canvas(arrowRight);
+    height: 11px;
+}
diff --git a/Source/WebCore/xml/XMLViewer.js b/Source/WebCore/xml/XMLViewer.js
new file mode 100644
index 0000000..22405e0
--- /dev/null
+++ b/Source/WebCore/xml/XMLViewer.js
@@ -0,0 +1,434 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
+ * “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
+ * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+var nodeParentPairs = [];
+
+// Script entry point.
+
+function prepareWebKitXMLViewer(noStyleMessage)
+{
+    var html = createHTMLElement('html');
+    var head = createHTMLElement('head');
+    html.appendChild(head);
+    var style = createHTMLElement('style');
+    style.id = 'xml-viewer-style';
+    head.appendChild(style);
+    var body = createHTMLElement('body');
+    html.appendChild(body);
+    var sourceXML = createHTMLElement('div');
+    sourceXML.id = 'webkit-xml-viewer-source-xml';
+    body.appendChild(sourceXML);
+
+    var child;
+    while (child = document.firstChild) {
+        document.removeChild(child);
+        if (child.nodeType != Node.DOCUMENT_TYPE_NODE)
+            sourceXML.appendChild(child);
+    }
+    document.appendChild(html);
+
+    var header = createHTMLElement('div');
+    body.appendChild(header);
+    header.classList.add('header');
+    var headerSpan = createHTMLElement('span');
+    header.appendChild(headerSpan);
+    headerSpan.textContent = noStyleMessage;
+    header.appendChild(createHTMLElement('br'));
+
+    var tree = createHTMLElement('div');
+    body.appendChild(tree);
+    tree.classList.add('pretty-print');
+    tree.id = 'tree';
+    window.onload = sourceXMLLoaded;
+}
+
+function sourceXMLLoaded()
+{
+    var sourceXML = document.getElementById('webkit-xml-viewer-source-xml');
+    if (!sourceXML)
+        return; // Stop if some XML tree extension is already processing this document
+    //var style = document.head.firstChild;
+    //document.head.removeChild(style);
+    //document.head.appendChild(style);
+    var root = document.getElementById('tree');
+
+    for (var child = sourceXML.firstChild; child; child = child.nextSibling)
+        nodeParentPairs.push({parentElement: root, node: child});
+
+    for (var i = 0; i < nodeParentPairs.length; i++)
+        processNode(nodeParentPairs[i].parentElement, nodeParentPairs[i].node);
+
+    drawArrows();
+    initButtons();
+
+    if (typeof(onAfterWebkitXMLViewerLoaded) == 'function')
+      onAfterWebkitXMLViewerLoaded();
+}
+
+// Tree processing.
+
+function processNode(parentElement, node)
+{
+    if (!processNode.processorsMap) {
+        processNode.processorsMap = {};
+        processNode.processorsMap[Node.PROCESSING_INSTRUCTION_NODE] = processProcessingInstruction;
+        processNode.processorsMap[Node.ELEMENT_NODE] = processElement;
+        processNode.processorsMap[Node.COMMENT_NODE] = processComment;
+        processNode.processorsMap[Node.TEXT_NODE] = processText;
+        processNode.processorsMap[Node.CDATA_SECTION_NODE] = processCDATA;
+    }
+    if (processNode.processorsMap[node.nodeType])
+        processNode.processorsMap[node.nodeType].call(this, parentElement, node);
+}
+
+function processElement(parentElement, node)
+{
+    if (!node.firstChild)
+        processEmptyElement(parentElement, node);
+    else {
+        var child = node.firstChild;
+        if (child.nodeType == Node.TEXT_NODE && isShort(child.nodeValue) && !child.nextSibling)
+            processShortTextOnlyElement(parentElement, node);
+        else
+            processComplexElement(parentElement, node);
+    }
+}
+
+function processEmptyElement(parentElement, node)
+{
+    var line = createLine();
+    line.appendChild(createTag(node, false, true));
+    parentElement.appendChild(line);
+}
+
+function processShortTextOnlyElement(parentElement, node)
+{
+    var line = createLine();
+    line.appendChild(createTag(node, false, false));
+    for (var child = node.firstChild; child; child = child.nextSibling)
+        line.appendChild(createText(child.nodeValue));
+    line.appendChild(createTag(node, true, false));
+    parentElement.appendChild(line);
+}
+
+function processComplexElement(parentElement, node)
+{
+    var collapsible = createCollapsible();
+
+    collapsible.expanded.start.appendChild(createTag(node, false, false));
+    for (var child = node.firstChild; child; child = child.nextSibling)
+        nodeParentPairs.push({parentElement: collapsible.expanded.content, node: child});
+    collapsible.expanded.end.appendChild(createTag(node, true, false));
+
+    collapsible.collapsed.content.appendChild(createTag(node, false, false));
+    collapsible.collapsed.content.appendChild(createText('...'));
+    collapsible.collapsed.content.appendChild(createTag(node, true, false));
+    parentElement.appendChild(collapsible);
+}
+
+function processComment(parentElement, node)
+{
+    if (isShort(node.nodeValue)) {
+        var line = createLine();
+        line.appendChild(createComment('<!-- ' + node.nodeValue + ' -->'));
+        parentElement.appendChild(line);
+    } else {
+        var collapsible = createCollapsible();
+
+        collapsible.expanded.start.appendChild(createComment('<!--'));
+        collapsible.expanded.content.appendChild(createComment(node.nodeValue));
+        collapsible.expanded.end.appendChild(createComment('-->'));
+
+        collapsible.collapsed.content.appendChild(createComment('<!--'));
+        collapsible.collapsed.content.appendChild(createComment('...'));
+        collapsible.collapsed.content.appendChild(createComment('-->'));
+        parentElement.appendChild(collapsible);
+    }
+}
+
+function processCDATA(parentElement, node)
+{
+    if (isShort(node.nodeValue)) {
+        var line = createLine();
+        line.appendChild(createText('<![CDATA[ ' + node.nodeValue + ' ]]>'));
+        parentElement.appendChild(line);
+    } else {
+        var collapsible = createCollapsible();
+
+        collapsible.expanded.start.appendChild(createText('<![CDATA['));
+        collapsible.expanded.content.appendChild(createText(node.nodeValue));
+        collapsible.expanded.end.appendChild(createText(']]>'));
+
+        collapsible.collapsed.content.appendChild(createText('<![CDATA['));
+        collapsible.collapsed.content.appendChild(createText('...'));
+        collapsible.collapsed.content.appendChild(createText(']]>'));
+        parentElement.appendChild(collapsible);
+    }
+}
+
+function processProcessingInstruction(parentElement, node)
+{
+    if (isShort(node.nodeValue)) {
+        var line = createLine();
+        line.appendChild(createComment('<?' + node.nodeName + ' ' + node.nodeValue + '?>'));
+        parentElement.appendChild(line);
+    } else {
+        var collapsible = createCollapsible();
+
+        collapsible.expanded.start.appendChild(createComment('<?' + node.nodeName));
+        collapsible.expanded.content.appendChild(createComment(node.nodeValue));
+        collapsible.expanded.end.appendChild(createComment('?>'));
+
+        collapsible.collapsed.content.appendChild(createComment('<?' + node.nodeName));
+        collapsible.collapsed.content.appendChild(createComment('...'));
+        collapsible.collapsed.content.appendChild(createComment('?>'));
+        parentElement.appendChild(collapsible);
+    }
+}
+
+function processText(parentElement, node)
+{
+    parentElement.appendChild(createText(node.nodeValue));
+}
+
+// Processing utils.
+
+function trim(value)
+{
+    return value.replace(/^\s\s*/, '').replace(/\s\s*$/, '');
+}
+
+function isShort(value)
+{
+    return trim(value).length <= 50;
+}
+
+// Tree rendering.
+
+function createHTMLElement(elementName)
+{
+    return document.createElementNS('http://www.w3.org/1999/xhtml', elementName)
+}
+
+function createCollapsible()
+{
+    var collapsible = createHTMLElement('div');
+    collapsible.classList.add('collapsible');
+    collapsible.expanded = createHTMLElement('div');
+    collapsible.expanded.classList.add('expanded');
+    collapsible.appendChild(collapsible.expanded);
+
+    collapsible.expanded.start = createLine();
+    collapsible.expanded.start.appendChild(createCollapseButton());
+    collapsible.expanded.appendChild(collapsible.expanded.start);
+
+    collapsible.expanded.content = createHTMLElement('div');
+    collapsible.expanded.content.classList.add('collapsible-content');
+    collapsible.expanded.appendChild(collapsible.expanded.content);
+
+    collapsible.expanded.end = createLine();
+    collapsible.expanded.appendChild(collapsible.expanded.end);
+
+    collapsible.collapsed = createHTMLElement('div');
+    collapsible.collapsed.classList.add('collapsed');
+    collapsible.collapsed.classList.add('hidden');
+    collapsible.appendChild(collapsible.collapsed);
+    collapsible.collapsed.content = createLine();
+    collapsible.collapsed.content.appendChild(createExpandButton());
+    collapsible.collapsed.appendChild(collapsible.collapsed.content);
+
+    return collapsible;
+}
+
+function createButton()
+{
+    var button = createHTMLElement('span');
+    button.classList.add('button');
+    return button;
+}
+
+function createCollapseButton(str)
+{
+    var button = createButton();
+    button.classList.add('collapse-button');
+    return button;
+}
+
+function createExpandButton(str)
+{
+    var button = createButton();
+    button.classList.add('expand-button');
+    return button;
+}
+
+function createComment(commentString)
+{
+    var comment = createHTMLElement('span');
+    comment.classList.add('webkit-html-comment');
+    comment.textContent = commentString;
+    return comment;
+}
+
+function createText(value)
+{
+    var text = createHTMLElement('span');
+    text.textContent = trim(value);
+    text.classList.add('text');
+    return text;
+}
+
+function createLine()
+{
+    var line = createHTMLElement('div');
+    line.classList.add('line');
+    return line;
+}
+
+function createTag(node, isClosing, isEmpty)
+{
+    var tag = createHTMLElement('span');
+    tag.classList.add('webkit-html-tag');
+
+    var stringBeforeAttrs = '<';
+    if (isClosing)
+        stringBeforeAttrs += '/';
+    stringBeforeAttrs += node.nodeName;
+    var textBeforeAttrs = document.createTextNode(stringBeforeAttrs);
+    tag.appendChild(textBeforeAttrs);
+
+    if (!isClosing) {
+        for (var i = 0; i < node.attributes.length; i++)
+            tag.appendChild(createAttribute(node.attributes[i]));
+    }
+
+    var stringAfterAttrs = '';
+    if (isEmpty)
+        stringAfterAttrs += '/';
+    stringAfterAttrs += '>';
+    var textAfterAttrs = document.createTextNode(stringAfterAttrs);
+    tag.appendChild(textAfterAttrs);
+
+    return tag;
+}
+
+function createAttribute(attributeNode)
+{
+    var attribute = createHTMLElement('span');
+    attribute.classList.add('webkit-html-attribute');
+
+    var attributeName = createHTMLElement('span');
+    attributeName.classList.add('webkit-html-attribute-name');
+    attributeName.textContent = attributeNode.name;
+
+    var textBefore = document.createTextNode(' ');
+    var textBetween = document.createTextNode('="');
+
+    var attributeValue = createHTMLElement('span');
+    attributeValue.classList.add('webkit-html-attribute-value');
+    attributeValue.textContent = attributeNode.value;
+
+    var textAfter = document.createTextNode('"');
+
+    attribute.appendChild(textBefore);
+    attribute.appendChild(attributeName);
+    attribute.appendChild(textBetween);
+    attribute.appendChild(attributeValue);
+    attribute.appendChild(textAfter);
+    return attribute;
+}
+
+// Tree behaviour.
+
+function drawArrows()
+{
+    var ctx = document.getCSSCanvasContext("2d", "arrowRight", 10, 11);
+
+    ctx.fillStyle = "rgb(90,90,90)";
+    ctx.beginPath();
+    ctx.moveTo(0, 0);
+    ctx.lineTo(0, 8);
+    ctx.lineTo(7, 4);
+    ctx.lineTo(0, 0);
+    ctx.fill();
+    ctx.closePath();
+
+    var ctx = document.getCSSCanvasContext("2d", "arrowDown", 10, 10);
+
+    ctx.fillStyle = "rgb(90,90,90)";
+    ctx.beginPath();
+    ctx.moveTo(0, 0);
+    ctx.lineTo(8, 0);
+    ctx.lineTo(4, 7);
+    ctx.lineTo(0, 0);
+    ctx.fill();
+    ctx.closePath();
+}
+
+function expandFunction(sectionId)
+{
+    return function()
+    {
+        document.querySelector('#' + sectionId + ' > .expanded').className = 'expanded';
+        document.querySelector('#' + sectionId + ' > .collapsed').className = 'collapsed hidden';
+    };
+}
+
+function collapseFunction(sectionId)
+{
+    return function()
+    {
+        document.querySelector('#' + sectionId + ' > .expanded').className = 'expanded hidden';
+        document.querySelector('#' + sectionId + ' > .collapsed').className = 'collapsed';
+    };
+}
+
+function initButtons()
+{
+    var sections = document.querySelectorAll('.collapsible');
+    for (var i = 0; i < sections.length; i++) {
+        var sectionId = 'collapsible' + i;
+        sections[i].id = sectionId;
+
+        var expandedPart = sections[i].querySelector('#' + sectionId + ' > .expanded');
+        var collapseButton = expandedPart.querySelector('.collapse-button');
+        collapseButton.onclick = collapseFunction(sectionId);
+        collapseButton.onmousedown = handleButtonMouseDown;
+
+        var collapsedPart = sections[i].querySelector('#' + sectionId + ' > .collapsed');
+        var expandButton = collapsedPart.querySelector('.expand-button');
+        expandButton.onclick = expandFunction(sectionId);
+        expandButton.onmousedown = handleButtonMouseDown;
+    }
+
+}
+
+function handleButtonMouseDown(e)
+{
+   // To prevent selection on double click
+   e.preventDefault();
+}
diff --git a/Source/WebCore/xml/XMLViewer.xsl b/Source/WebCore/xml/XMLViewer.xsl
deleted file mode 100644
index 4ee3ca8..0000000
--- a/Source/WebCore/xml/XMLViewer.xsl
+++ /dev/null
@@ -1,398 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!--
-   - Copyright (C) 2011 Google Inc. All rights reserved.
-   -
-   - Redistribution and use in source and binary forms, with or without
-   - modification, are permitted provided that the following conditions are
-   - met:
-   -
-   - 1. Redistributions of source code must retain the above copyright
-   - notice, this list of conditions and the following disclaimer.
-   -
-   - 2. Redistributions in binary form must reproduce the above
-   - copyright notice, this list of conditions and the following disclaimer
-   - in the documentation and/or other materials provided with the
-   - distribution.
-   -
-   - THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
-   - “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   - LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   - A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
-   - OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-   - SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-   - LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-   - DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-   - THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-   - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   - OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   -->
-
-<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'>
-    <xsl:output method="html"/>
-    <xsl:param name="xml_has_no_style_message"/>
-    <xsl:param name="downArrowBase64"/>
-    <xsl:param name="rightArrowBase64"/>
-
-    <xsl:template match="/">
-        <xsl:call-template name="main"/>
-    </xsl:template>
-
-    <!-- Empty element -->
-    <xsl:template match="*">
-        <div class="line">
-            <span class="webkit-html-tag">
-                <xsl:text>&lt;</xsl:text>
-                <xsl:value-of select="name()"/>
-                <xsl:apply-templates select="@*"/>
-                <xsl:text>/&gt;</xsl:text>
-            </span>
-        </div>
-    </xsl:template>
-
-    <!-- Element with short text only -->
-    <xsl:template match="*[node()]">
-        <div class="line">
-            <span class="webkit-html-tag">
-                <xsl:text>&lt;</xsl:text>
-                <xsl:value-of select="name()"/>
-                <xsl:apply-templates select="@*"/>
-                <xsl:text>&gt;</xsl:text>
-            </span>
-
-            <span class="text"><xsl:value-of select="."/></span>
-
-            <span class="webkit-html-tag">
-                <xsl:text>&lt;/</xsl:text>
-                <xsl:value-of select="name()"/>
-                <xsl:text>&gt;</xsl:text>
-            </span>
-        </div>
-    </xsl:template>
-
-    <!-- Collapsable element -->
-    <xsl:template match="*[* or processing-instruction() or comment() or string-length() &gt; 50]">
-        <div class="collapsable">
-            <div class="expanded">
-                <div class="line">
-                    <xsl:call-template name="collapse-button"/>
-                    <span class="webkit-html-tag">
-                        <xsl:text>&lt;</xsl:text>
-                        <xsl:value-of select="name()"/>
-                        <xsl:apply-templates select="@*"/>
-                        <xsl:text>&gt;</xsl:text>
-                    </span>
-                </div>
-
-                <div class="collapsable-content">
-                    <xsl:apply-templates/>
-                </div>
-
-                <div class="line">
-                    <span class="webkit-html-tag">
-                        <xsl:text>&lt;/</xsl:text>
-                        <xsl:value-of select="name()"/>
-                        <xsl:text>&gt;</xsl:text>
-                    </span>
-                </div>
-            </div>
-
-            <div class="collapsed hidden">
-                <div class="line">
-                    <xsl:call-template name="expand-button"/>
-                    <span class="webkit-html-tag">
-                        <xsl:text>&lt;</xsl:text>
-                        <xsl:value-of select="name()"/>
-                        <xsl:apply-templates select="@*"/>
-                        <xsl:text>&gt;</xsl:text>
-                        <xsl:text>...</xsl:text>
-                        <xsl:text>&lt;/</xsl:text>
-                        <xsl:value-of select="name()"/>
-                        <xsl:text>&gt;</xsl:text>
-                    </span>
-                </div>
-            </div>
-        </div>
-    </xsl:template>
-
-    <!-- Any attribute -->
-    <xsl:template match="@*">
-        <xsl:text> </xsl:text>
-        <span class="webkit-html-attribute-name"><xsl:value-of select="name()"/></span>
-        <xsl:text>=&quot;</xsl:text>
-        <span class="webkit-html-attribute-value"><xsl:value-of select="."/></span>
-        <xsl:text>&quot;</xsl:text>
-    </xsl:template>
-
-    <!-- Short comment -->
-    <xsl:template match="comment()">
-        <div class="line">
-            <span class="webkit-html-comment">
-                <xsl:text>&lt;!--</xsl:text>
-                <xsl:value-of select="."/>
-                <xsl:text>--&gt;</xsl:text>
-            </span>
-        </div>
-    </xsl:template>
-
-    <!-- Long comment -->
-    <xsl:template match="comment()[string-length() &gt; 50]">
-        <div class="collapsable">
-            <div class="expanded">
-                <div class="line">
-                    <xsl:call-template name="collapse-button"/>
-                    <span class="webkit-html-comment">
-                        <xsl:text>&lt;!--</xsl:text>
-                    </span>
-                </div>
-
-                <div class="collapsable-content comment">
-                    <span class="webkit-html-comment"><xsl:value-of select="."/></span>
-                </div>
-
-                <div class="line">
-                    <span class="webkit-html-comment">
-                        <xsl:text>--&gt;</xsl:text>
-                    </span>
-                </div>
-            </div>
-
-            <div class="collapsed hidden">
-                <div class="line">
-                    <xsl:call-template name="expand-button"/>
-                    <span class="webkit-html-comment">
-                        <xsl:text>&lt;!--</xsl:text>
-                    </span>
-
-                    <span class="webkit-html-comment"><xsl:text>...</xsl:text></span>
-
-                    <span class="webkit-html-comment">
-                        <xsl:text>--&gt;</xsl:text>
-                    </span>
-                </div>
-            </div>
-        </div>
-    </xsl:template>
-
-    <!-- Short processing instruction -->
-    <xsl:template match="processing-instruction()[name() != 'xml-stylesheet']">
-        <div class="line">
-            <span class="webkit-html-comment">
-                <xsl:text>&lt;?</xsl:text>
-                <xsl:value-of select="name()"/>
-                <xsl:text> </xsl:text>
-                <xsl:value-of select="."/>
-                <xsl:text>?&gt;</xsl:text>
-            </span>
-        </div>
-    </xsl:template>
-
-    <!-- Long processing instruction -->
-    <xsl:template match="processing-instruction()[(string-length() &gt; 50) and (name() != 'xml-stylesheet')]">
-        <div class="collapsable">
-            <div class="expanded">
-                <div class="line">
-                    <xsl:call-template name="collapse-button"/>
-                    <span class="webkit-html-comment">
-                        <xsl:text>&lt;?</xsl:text>
-                        <xsl:value-of select="name()"/>
-                        <xsl:text> </xsl:text>
-                    </span>
-                </div>
-
-                <div class="collapsable-content">
-                    <span class="webkit-html-comment"><xsl:value-of select="."/></span>
-                </div>
-
-                <div class="line">
-                    <span class="webkit-html-comment">
-                        <xsl:text>?&gt;</xsl:text>
-                    </span>
-                </div>
-            </div>
-            <div class="collapsed hidden">
-                <div class="line">
-                  <xsl:call-template name="expand-button"/>
-                    <span class="webkit-html-comment">
-                        <xsl:text>&lt;?</xsl:text>
-                        <xsl:value-of select="name()"/>
-                    </span>
-
-                    <span class="webkit-html-comment"><xsl:text>...</xsl:text></span>
-
-                    <span class="webkit-html-comment">
-                        <xsl:text>?&gt;</xsl:text>
-                    </span>
-                </div>
-            </div>
-        </div>
-    </xsl:template>
-
-    <!-- Text node -->
-    <xsl:template match="text()">
-        <xsl:value-of select="."/>
-    </xsl:template>
-
-    <xsl:template name="collapse-button">
-        <span class="button collapse-button">
-        </span>
-    </xsl:template>
-
-    <xsl:template name="expand-button">
-        <span class="button expand-button">
-        </span>
-    </xsl:template>
-
-    <xsl:template name="main">
-        <html>
-            <head>
-                <xsl:call-template name="style"/>
-                <xsl:call-template name="script"/>
-            </head>
-            <body onload="onWebKitXMLViewerLoad()">
-                <div class="header">
-                    <span> <xsl:value-of select="$xml_has_no_style_message"/> </span>
-                    <br/>
-                </div>
-
-                <div class="pretty-print">
-                    <xsl:apply-templates/>
-                </div>
-                <div id="source-xml"></div>
-            </body>
-        </html>
-    </xsl:template>
-
-    <xsl:template name="script">
-        <script type="text/javascript">
-            <xsl:text>
-                function onWebKitXMLViewerLoad()
-                {
-                    drawArrows();
-                    initButtons();
-                }
-
-                function drawArrows()
-                {
-                    var ctx = document.getCSSCanvasContext("2d", "arrowRight", 10, 11);
-
-                    ctx.fillStyle = "rgb(90,90,90)";
-                    ctx.beginPath();
-                    ctx.moveTo(0, 0);
-                    ctx.lineTo(0, 8);
-                    ctx.lineTo(7, 4);
-                    ctx.lineTo(0, 0);
-                    ctx.fill();
-                    ctx.closePath();
-
-                    var ctx = document.getCSSCanvasContext("2d", "arrowDown", 10, 10);
-
-                    ctx.fillStyle = "rgb(90,90,90)";
-                    ctx.beginPath();
-                    ctx.moveTo(0, 0);
-                    ctx.lineTo(8, 0);
-                    ctx.lineTo(4, 7);
-                    ctx.lineTo(0, 0);
-                    ctx.fill();
-                    ctx.closePath();
-                }
-
-                function expandFunction(sectionId)
-                {
-                    return function()
-                    {
-                        document.querySelector('#' + sectionId + ' > .expanded').className = 'expanded';
-                        document.querySelector('#' + sectionId + ' > .collapsed').className = 'collapsed hidden';
-                    };
-                }
-
-                function collapseFunction(sectionId)
-                {
-                    return function()
-                    {
-                        document.querySelector('#' + sectionId + ' > .expanded').className = 'expanded hidden';
-                        document.querySelector('#' + sectionId + ' > .collapsed').className = 'collapsed';
-                    };
-                }
-
-                function initButtons()
-                {
-                    var sections = document.querySelectorAll('.collapsable');
-                    for (var i = 0; i &lt; sections.length; i++) {
-                        var sectionId = 'collapsable' + i;
-                        sections[i].id = sectionId;
-
-                        var expandedPart = sections[i].querySelector('#' + sectionId + ' > .expanded');
-                        var collapseButton = expandedPart.querySelector('.collapse-button');
-                        collapseButton.onclick = collapseFunction(sectionId);
-                        collapseButton.onmousedown = handleButtonMouseDown;
-
-                        var collapsedPart = sections[i].querySelector('#' + sectionId + ' > .collapsed');
-                        var expandButton = collapsedPart.querySelector('.expand-button');
-                        expandButton.onclick = expandFunction(sectionId);
-                        expandButton.onmousedown = handleButtonMouseDown;
-                    }
-
-                }
-
-                function handleButtonMouseDown(e)
-                {
-                   // To prevent selection on double click
-                   e.preventDefault();
-                }
-            </xsl:text>
-        </script>
-    </xsl:template>
-
-    <xsl:template name="style">
-        <style type="text/css">
-            div.header {
-                border-bottom: 2px solid black;
-                padding-bottom: 5px;
-                margin: 10px;
-            }
-
-            div.collapsable > div.hidden {
-                display:none;
-            }
-
-            .pretty-print {
-                margin-top: 1em;
-                margin-left: 20px;
-                font-family: monospace;
-                font-size: 13px;
-            }
-
-            #source-xml {
-                display: none;
-            }
-
-            .collapsable-content {
-                margin-left: 1em;
-            }
-            .comment {
-                whitespace: pre;
-            }
-
-            .button {
-                -webkit-user-select: none;
-                cursor: pointer;
-                display: inline-block;
-                margin-left: -10px;
-                width: 10px;
-                background-repeat: no-repeat;
-                background-position: left top;
-                vertical-align: bottom;
-            }
-
-            .collapse-button {
-                background-image: -webkit-canvas(arrowDown);
-                height: 10px;
-            }
-
-            .expand-button {
-                background-image: -webkit-canvas(arrowRight);
-                height: 11px;
-            }
-        </style>
-    </xsl:template>
-</xsl:stylesheet>
diff --git a/Source/WebCore/xml/XSLStyleSheet.h b/Source/WebCore/xml/XSLStyleSheet.h
index dbe87b5..b36ac1d 100644
--- a/Source/WebCore/xml/XSLStyleSheet.h
+++ b/Source/WebCore/xml/XSLStyleSheet.h
@@ -63,14 +63,6 @@ public:
         return adoptRef(new XSLStyleSheet(parentNode, originalURL, finalURL, false));
     }
 
-    static PassRefPtr<XSLStyleSheet> createForXMLTreeViewer(Node* node, const String& sheetString)
-    {
-        RefPtr<XSLStyleSheet> sheet = adoptRef(new XSLStyleSheet(node, String(), KURL(), false));
-        sheet->parseString(sheetString);
-
-        return sheet.release();
-    }
-
     virtual ~XSLStyleSheet();
     
     virtual bool isXSLStyleSheet() const { return true; }
diff --git a/Source/WebKit.pri b/Source/WebKit.pri
index c76066f..c17d08a 100644
--- a/Source/WebKit.pri
+++ b/Source/WebKit.pri
@@ -1,5 +1,7 @@
 # Include file to make it easy to include WebKit into Qt projects
 
+contains(QT_CONFIG, qpa):CONFIG += embedded
+
 # Detect that we are building as a standalone package by the presence of
 # either the generated files directory or as part of the Qt package through
 # QTDIR_build
@@ -132,9 +134,12 @@ symbian|maemo5|maemo6 {
     CONFIG += include_webinspector
 }
 
+*sh4* {
+    CONFIG += disable_uitools
+}
 ####
 
-!contains(QT_CONFIG, uitools)|disable_uitools: DEFINES *= QT_NO_UITOOLS
+disable_uitools: DEFINES *= QT_NO_UITOOLS
 
 isEmpty(QT.phonon.includes) {
     QT.phonon.includes = $$QMAKE_INCDIR_QT/phonon
diff --git a/Source/WebKit/CMakeLists.txt b/Source/WebKit/CMakeLists.txt
index a5fd0ab..cee9456 100644
--- a/Source/WebKit/CMakeLists.txt
+++ b/Source/WebKit/CMakeLists.txt
@@ -36,7 +36,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/assembler"
     "${JAVASCRIPTCORE_DIR}/bytecode"
     "${JAVASCRIPTCORE_DIR}/bytecompiler"
-    "${JAVASCRIPTCORE_DIR}/collector/handles"
+    "${JAVASCRIPTCORE_DIR}/heap"
     "${JAVASCRIPTCORE_DIR}/debugger"
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
@@ -45,7 +45,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/runtime"
     "${JAVASCRIPTCORE_DIR}/wtf"
     "${JAVASCRIPTCORE_DIR}/wtf/unicode"
-    "${DERIVED_SOURCES_DIR}"
+    "${DERIVED_SOURCES_WEBCORE_DIR}"
     "${CMAKE_BINARY_DIR}"
 )
 
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index d786ce1..ac05a54 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,114 @@
+2011-04-18  Timothy Hatcher  <timothy@apple.com>
+
+        Make update-webkit-localizable-strings put WebKit/win strings in WebCore
+        now that all localized strings in WebKit/win use WEB_UI_STRING.
+
+        https://webkit.org/b/58747
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/Localizable.strings: Removed.
+
+2011-04-17  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Move WebNodeHighlighter into its own file
+        https://bugs.webkit.org/show_bug.cgi?id=58746
+
+        * WebKit.xcodeproj/project.pbxproj: Add WebNodeHighlighter.{h,mm}.
+
+2011-04-13  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMAKE] Separate DerivedSources.
+        https://bugs.webkit.org/show_bug.cgi?id=58427
+
+        * CMakeLists.txt: Change DERIVED_SOURCES_DIR to DERIVED_SOURCES_WEBCORE_DIR
+
+2011-04-11  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Unreviewed build fix for Mac.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2011-04-11  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define + initial HTMLTrackElement
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2011-04-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A few heap-related renames and file moves.
+        
+        WeakGCPtr<T> => Weak<T>
+        Global<T> => Strong<T>
+        collector/ => heap/
+        collector/* => heap/*
+        runtime/WeakGCPtr.h => heap/Weak.h
+        
+        (Eventually, even more files should move into the heap directory. Like
+        Heap.h and Heap.cpp, for example.)
+
+        * CMakeLists.txt:
+
+2011-04-08  Dan Bernstein  <mitz@apple.com>
+
+        No need to compile .js files, that is what the JIT is for.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define + initial HTMLTrackElement
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2011-04-07  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r64712): Microsoft Outlook 2011: original message contents
+        not included when replying to an email.
+        https://bugs.webkit.org/show_bug.cgi?id=57794
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2011-04-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Move attributedStringFromRange down to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=57905
+
+        * WebKit.xcodeproj/project.pbxproj: Removed WebNSAttributedStringExtras, which is now in WebCore.
+
 2011-03-29  Timothy Hatcher  <timothy@apple.com>
 
         Update WebKit Localizable.strings to only contain WebKit/win strings.
diff --git a/Source/WebKit/English.lproj/Localizable.strings b/Source/WebKit/English.lproj/Localizable.strings
deleted file mode 100644
index eebf03f..0000000
--- a/Source/WebKit/English.lproj/Localizable.strings
+++ /dev/null
diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
index 06a5566..e0dc140 100644
--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -81,6 +81,7 @@
 		226E9E6A09D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 226E9E6809D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.h */; };
 		226E9E6B09D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.c in Sources */ = {isa = PBXBuildFile; fileRef = 226E9E6909D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.c */; settings = {COMPILER_FLAGS = "-Wno-deprecated-declarations"; }; };
 		22F219CC08D236730030E078 /* WebBackForwardListPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 22F219CB08D236730030E078 /* WebBackForwardListPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		29AEF960134C76FB00FE5096 /* OutlookQuirksUserScript.js in Resources */ = {isa = PBXBuildFile; fileRef = 29AEF95D134C755400FE5096 /* OutlookQuirksUserScript.js */; };
 		37B6FB4E1063530C000FDB3B /* WebPDFDocumentExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 37B6FB4C1063530C000FDB3B /* WebPDFDocumentExtras.h */; };
 		37B6FB4F1063530C000FDB3B /* WebPDFDocumentExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37B6FB4D1063530C000FDB3B /* WebPDFDocumentExtras.mm */; };
 		37D1DCA81065928C0068F7EF /* WebJSPDFDoc.h in Headers */ = {isa = PBXBuildFile; fileRef = 37D1DCA61065928C0068F7EF /* WebJSPDFDoc.h */; };
@@ -327,6 +328,8 @@
 		93EB178D09F88D460091F8FF /* WebSystemInterface.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93EB178C09F88D460091F8FF /* WebSystemInterface.mm */; };
 		93EB178F09F88D510091F8FF /* WebSystemInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 93EB178E09F88D510091F8FF /* WebSystemInterface.h */; };
 		93FDE9330D79CAF30074F029 /* WebHistoryInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 93FDE9320D79CAF30074F029 /* WebHistoryInternal.h */; };
+		A5687BDA135B791A0074CBCB /* WebNodeHighlighter.h in Headers */ = {isa = PBXBuildFile; fileRef = A5687BD8135B791A0074CBCB /* WebNodeHighlighter.h */; };
+		A5687BDB135B791A0074CBCB /* WebNodeHighlighter.mm in Sources */ = {isa = PBXBuildFile; fileRef = A5687BD9135B791A0074CBCB /* WebNodeHighlighter.mm */; };
 		A57E2F24120749E600048DF3 /* WebQuotaManager.h in Headers */ = {isa = PBXBuildFile; fileRef = A57E2F22120749E600048DF3 /* WebQuotaManager.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A5DEFC0A11D5331C00885273 /* WebSecurityOrigin.mm in Sources */ = {isa = PBXBuildFile; fileRef = A5DEFC0711D5331C00885273 /* WebSecurityOrigin.mm */; };
 		A5DEFC0B11D5331C00885273 /* WebSecurityOriginInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = A5DEFC0811D5331C00885273 /* WebSecurityOriginInternal.h */; };
@@ -378,8 +381,6 @@
 		E169836211346D1B00894115 /* ProxyRuntimeObject.h in Headers */ = {isa = PBXBuildFile; fileRef = E169836111346D1B00894115 /* ProxyRuntimeObject.h */; };
 		E169836C11346D5600894115 /* ProxyRuntimeObject.mm in Sources */ = {isa = PBXBuildFile; fileRef = E169836B11346D5600894115 /* ProxyRuntimeObject.mm */; };
 		ED5B9524111B725A00472298 /* WebLocalizableStrings.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED5B9523111B725A00472298 /* WebLocalizableStrings.mm */; };
-		ED6BE2E7088C32B50044DEDC /* WebNSAttributedStringExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = ED6BE2E5088C32B50044DEDC /* WebNSAttributedStringExtras.h */; };
-		ED6BE2E8088C32B50044DEDC /* WebNSAttributedStringExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED6BE2E6088C32B50044DEDC /* WebNSAttributedStringExtras.mm */; };
 		ED7F6D8B0980683500C235ED /* WebNSDataExtrasPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = ED7F6D8A0980683500C235ED /* WebNSDataExtrasPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EDE983800BCDF5FE00FDAE28 /* WebNSArrayExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE9837E0BCDF5FE00FDAE28 /* WebNSArrayExtras.h */; };
 		EDE983810BCDF5FE00FDAE28 /* WebNSArrayExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = EDE9837F0BCDF5FE00FDAE28 /* WebNSArrayExtras.m */; };
@@ -466,6 +467,7 @@
 		226E9E6909D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = WebNetscapeDeprecatedFunctions.c; sourceTree = "<group>"; };
 		22F219CB08D236730030E078 /* WebBackForwardListPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebBackForwardListPrivate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		2568C72C0174912D0ECA149E /* WebKit.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebKit.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		29AEF95D134C755400FE5096 /* OutlookQuirksUserScript.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = OutlookQuirksUserScript.js; sourceTree = "<group>"; };
 		2D36FD5E03F78F9E00A80166 /* WebFormDelegatePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebFormDelegatePrivate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		2D81DAB203EB0B2D00A80166 /* WebFormDelegate.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebFormDelegate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		2D81DAB303EB0B2D00A80166 /* WebFormDelegate.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebFormDelegate.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -645,6 +647,8 @@
 		9CAE9D070252A4130ECA16EA /* WebPreferencesPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPreferencesPrivate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		9CE1F8A302A5C6F30ECA2ACD /* WebImageRendererFactory.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebImageRendererFactory.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		9CF0E249021361B00ECA16EA /* WebFramePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebFramePrivate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		A5687BD8135B791A0074CBCB /* WebNodeHighlighter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNodeHighlighter.h; sourceTree = "<group>"; };
+		A5687BD9135B791A0074CBCB /* WebNodeHighlighter.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNodeHighlighter.mm; sourceTree = "<group>"; };
 		A57E2F22120749E600048DF3 /* WebQuotaManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebQuotaManager.h; sourceTree = "<group>"; };
 		A5DEFC0711D5331C00885273 /* WebSecurityOrigin.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebSecurityOrigin.mm; sourceTree = "<group>"; };
 		A5DEFC0811D5331C00885273 /* WebSecurityOriginInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSecurityOriginInternal.h; sourceTree = "<group>"; };
@@ -711,8 +715,6 @@
 		ED2B2474033A2DA800C1A526 /* WebNSPasteboardExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebNSPasteboardExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		ED2B2475033A2DA800C1A526 /* WebNSPasteboardExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNSPasteboardExtras.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		ED5B9523111B725A00472298 /* WebLocalizableStrings.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebLocalizableStrings.mm; sourceTree = "<group>"; };
-		ED6BE2E5088C32B50044DEDC /* WebNSAttributedStringExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebNSAttributedStringExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		ED6BE2E6088C32B50044DEDC /* WebNSAttributedStringExtras.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNSAttributedStringExtras.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		ED7F6D8A0980683500C235ED /* WebNSDataExtrasPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNSDataExtrasPrivate.h; sourceTree = "<group>"; };
 		EDD1A5C605C83987008E3150 /* WebNSPrintOperationExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebNSPrintOperationExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		EDD1A5C705C83987008E3150 /* WebNSPrintOperationExtras.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebNSPrintOperationExtras.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -916,6 +918,8 @@
 				B804176E1217A83100466BAE /* WebInspectorFrontend.mm */,
 				1C68F663095B5FC100C2984E /* WebNodeHighlight.h */,
 				1C68F664095B5FC100C2984E /* WebNodeHighlight.mm */,
+				A5687BD8135B791A0074CBCB /* WebNodeHighlighter.h */,
+				A5687BD9135B791A0074CBCB /* WebNodeHighlighter.mm */,
 				1C68F665095B5FC100C2984E /* WebNodeHighlightView.h */,
 				1C68F666095B5FC100C2984E /* WebNodeHighlightView.mm */,
 			);
@@ -943,6 +947,7 @@
 		254DC334016E1D3F0ECA149E /* Misc */ = {
 			isa = PBXGroup;
 			children = (
+				29AEF95D134C755400FE5096 /* OutlookQuirksUserScript.js */,
 				A864B3E5123ED83D00C2A612 /* MailQuirksUserScript.js */,
 				1CCFFD120B1F81F2002EE926 /* OldWebAssertions.c */,
 				5DE92FEE0BD7017E0059A5FD /* WebAssertions.h */,
@@ -981,8 +986,6 @@
 				BC42D34C131ED3880075FA4B /* WebLocalizableStringsInternal.mm */,
 				EDE9837E0BCDF5FE00FDAE28 /* WebNSArrayExtras.h */,
 				EDE9837F0BCDF5FE00FDAE28 /* WebNSArrayExtras.m */,
-				ED6BE2E5088C32B50044DEDC /* WebNSAttributedStringExtras.h */,
-				ED6BE2E6088C32B50044DEDC /* WebNSAttributedStringExtras.mm */,
 				9345DDB20365FFD0008635CE /* WebNSControlExtras.h */,
 				9345DDB30365FFD0008635CE /* WebNSControlExtras.m */,
 				BECD14290565830A005BB09C /* WebNSDataExtras.h */,
@@ -1560,7 +1563,6 @@
 				1C68F66F095B5FC100C2984E /* WebNodeHighlight.h in Headers */,
 				1C68F671095B5FC100C2984E /* WebNodeHighlightView.h in Headers */,
 				EDE983800BCDF5FE00FDAE28 /* WebNSArrayExtras.h in Headers */,
-				ED6BE2E7088C32B50044DEDC /* WebNSAttributedStringExtras.h in Headers */,
 				939810210824BF01008DF038 /* WebNSControlExtras.h in Headers */,
 				939810820824BF01008DF038 /* WebNSDataExtras.h in Headers */,
 				ED7F6D8B0980683500C235ED /* WebNSDataExtrasPrivate.h in Headers */,
@@ -1652,6 +1654,7 @@
 				3ABB3C7A1309C3B500E93D94 /* WebStorageTrackerClient.h in Headers */,
 				BC42D324131ED1E00075FA4B /* WebLocalizableStringsInternal.h in Headers */,
 				B82958D3132707D0000D0E79 /* CorrectionPanel.h in Headers */,
+				A5687BDA135B791A0074CBCB /* WebNodeHighlighter.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1719,6 +1722,7 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				29AEF960134C76FB00FE5096 /* OutlookQuirksUserScript.js in Resources */,
 				A864B3F6123ED9FA00C2A612 /* MailQuirksUserScript.js in Resources */,
 				939810BA0824BF01008DF038 /* IDNScriptWhiteList.txt in Resources */,
 				939810B70824BF01008DF038 /* url_icon.tiff in Resources */,
@@ -1957,7 +1961,6 @@
 				1C68F670095B5FC100C2984E /* WebNodeHighlight.mm in Sources */,
 				1C68F672095B5FC100C2984E /* WebNodeHighlightView.mm in Sources */,
 				EDE983810BCDF5FE00FDAE28 /* WebNSArrayExtras.m in Sources */,
-				ED6BE2E8088C32B50044DEDC /* WebNSAttributedStringExtras.mm in Sources */,
 				939810C60824BF01008DF038 /* WebNSControlExtras.m in Sources */,
 				939811150824BF01008DF038 /* WebNSDataExtras.m in Sources */,
 				65488DA2084FBCCB00831AD0 /* WebNSDictionaryExtras.m in Sources */,
@@ -2023,6 +2026,7 @@
 				3ABB3C7B1309C3B500E93D94 /* WebStorageTrackerClient.mm in Sources */,
 				BC42D34D131ED3880075FA4B /* WebLocalizableStringsInternal.mm in Sources */,
 				B82958D4132707D0000D0E79 /* CorrectionPanel.mm in Sources */,
+				A5687BDB135B791A0074CBCB /* WebNodeHighlighter.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index 8becdba..dce7bf9 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,1452 @@
+2011-04-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] didReceiveTitle API signature should not change
+        https://bugs.webkit.org/show_bug.cgi?id=58909
+
+        My previous attempt at a temporary shim was wrong.
+        This second try should correctly work with older clients.
+
+        * public/WebFrameClient.h:
+        (WebKit::WebFrameClient::didReceiveTitle):
+
+2011-04-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Adam Barth
+
+        Fix the compile failure in UniscribeHelperTest.cpp due to
+        a change in UniscribeHelper made by the CL for bug 48860
+        (r84264)
+
+        http://bugs.webkit.org/show_bug.cgi?id=48860
+
+        * tests/UniscribeHelperTest.cpp:
+        (TEST_F):
+
+2011-04-19  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Clicking on plugin for first time blocks focus shift
+        https://bugs.webkit.org/show_bug.cgi?id=58419
+
+        Switched to using FocusController when moving focus to a plugin
+        so that cross-frame focus changes are handled correctly.
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::handleMouseEvent):
+
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename lengthReceived to encodedDataLength/dataLength
+        https://bugs.webkit.org/show_bug.cgi?id=58883
+
+        Renamed lengthReceived to encodedDataLength/dataLength.
+
+        * public/WebURLLoaderClient.h:
+        (WebKit::WebURLLoaderClient::didReceiveData):
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveCachedMetadata):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveContentLength):
+        * src/FrameLoaderClientImpl.h:
+        * src/ResourceHandle.cpp:
+        (WebCore::ResourceHandleInternal::didReceiveData):
+
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Chromium DevTools: Network panel timing test is flaky
+        https://bugs.webkit.org/show_bug.cgi?id=58699
+
+        Fixed network timing test flakiness.
+
+        * src/js/Tests.js:
+        (.TestSuite.prototype.testNetworkTiming.finishResource):
+
+2011-04-19  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: add chrome.devTools alias to webInspector namespace for chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=58894
+
+        * src/js/DevTools.js:
+        (WebInspector.platformExtensionAPI):
+
+2011-04-19  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Not reviewed; another build fix attempt.
+
+        * src/StorageInfoChromium.cpp:
+        (WebCore::StorageInfo::queryUsageAndQuota):
+        (WebCore::StorageInfo::requestQuota):
+        * src/WebStorageQuotaCallbacksImpl.cpp:
+        (WebKit::WebStorageQuotaCallbacksImpl::WebStorageQuotaCallbacksImpl):
+        * src/WebStorageQuotaCallbacksImpl.h:
+
+2011-04-19  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Enable QUOTA API at runtime if enable-quota flag is given
+        https://bugs.webkit.org/show_bug.cgi?id=58784
+
+        * features.gypi: Added ENABLE_QUOTA=1.
+        * public/WebRuntimeFeatures.h:
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableQuota): Added.
+        (WebKit::WebRuntimeFeatures::isQuotaEnabled): Added.
+
+2011-04-19  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Enable folder drag-n-drop when using a "webkitdirectory" file input
+        https://bugs.webkit.org/show_bug.cgi?id=58401
+
+        This uses a new ChromeClient API to enumerate the directory and 
+        return all the files, as if the user had selected that directory
+        by clicking the control in the normal way.
+
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::enumerateChosenDirectory):
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::enumerateChosenDirectory):
+        * src/ChromeClientImpl.h:
+
+2011-04-18  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] expose title direction to webkit client
+        https://bugs.webkit.org/show_bug.cgi?id=58823
+
+        * public/WebFrameClient.h:
+        (WebKit::WebFrameClient::didReceiveTitle):
+        Add new param to API.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveTitle):
+        Pass new param in API.
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CG) to USE(CG)
+        https://bugs.webkit.org/show_bug.cgi?id=58729
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::~GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3DInternal::reshape):
+        * src/GraphicsContext3DInternal.h:
+        * src/PlatformBridge.cpp:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::doPixelReadbackToCanvas):
+
+2011-04-15  John Bates  <jbates@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Change WebGraphicsContext3D virtuals to pure virtuals as intended
+        https://bugs.webkit.org/show_bug.cgi?id=58479
+
+        * public/WebGraphicsContext3D.h:
+
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
+
+        * features.gypi:
+
+2011-04-15  Charlie Reis  <creis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] fast/events/popup-allowed-from-gesture-initiated-form-submit.html causing debug ASSERT
+        https://bugs.webkit.org/show_bug.cgi?id=44079
+
+        Remove an assert whose invariant doesn't hold.
+
+        * src/FrameLoaderClientImpl.cpp:
+
+2011-04-15  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Expose unified Quota API if QUOTA build flag is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=58648
+
+        * src/AssertMatchingEnums.cpp: Added enum assertions.
+        * src/StorageInfoChromium.cpp: Made a build fix.
+
+2011-04-15  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename rawRequestHeadersText and RawResponseHeadersText to requestHeadersText and responseHeadersText
+        https://bugs.webkit.org/show_bug.cgi?id=58650
+
+        * public/WebHTTPLoadInfo.h:
+        * src/WebHTTPLoadInfo.cpp:
+        (WebKit::WebHTTPLoadInfo::requestHeadersText):
+        (WebKit::WebHTTPLoadInfo::setRequestHeadersText):
+        (WebKit::WebHTTPLoadInfo::responseHeadersText):
+        (WebKit::WebHTTPLoadInfo::setResponseHeadersText):
+
+2011-04-15  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Added enums for external file system type and exposed factory function
+        for creating File- and DirectoryEntry objects from Chromium side.
+        https://bugs.webkit.org/show_bug.cgi?id=58456
+
+        * public/WebFileSystem.h:
+        * public/WebFrame.h:
+        * src/AssertMatchingEnums.cpp:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::createFileSystem):
+        (WebKit::WebFrameImpl::createFileEntry):
+        * src/WebFrameImpl.h:
+
+2011-04-15  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Create tests for network panel timing, size and raw headers text
+        https://bugs.webkit.org/show_bug.cgi?id=58566
+
+        Added network timing, size and raw headers tests for Inspector
+        Since chromium used different version of network stack for layout
+        tests, these are interactive ui tests (DevToolsSanityTest.TestNetwork*)
+
+        * src/js/Tests.js:
+        (.TestSuite.prototype.testNetworkSize.finishResource):
+        (.TestSuite.prototype.testNetworkSyncSize.finishResource):
+        (.TestSuite.prototype.testNetworkRawHeadersText.finishResource):
+        (.TestSuite.prototype.testNetworkTiming.finishResource):
+
+2011-04-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Enable raw HTTP headers support
+        https://bugs.webkit.org/show_bug.cgi?id=58259
+
+        Added raw headers text support to inspector.
+
+        * public/WebHTTPLoadInfo.h:
+        * src/WebHTTPLoadInfo.cpp:
+        (WebKit::WebHTTPLoadInfo::rawRequestHeadersText):
+        (WebKit::WebHTTPLoadInfo::setRawRequestHeadersText):
+        (WebKit::WebHTTPLoadInfo::rawResponseHeadersText):
+        (WebKit::WebHTTPLoadInfo::setRawResponseHeadersText):
+
+2011-04-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: ResourceResponse should have encodedDataLength field for synchronous requests transfer size
+        https://bugs.webkit.org/show_bug.cgi?id=58447
+
+        FrameLoader now takes encoded data length for synchronous requests from the field with the same name.
+
+        * public/WebHTTPLoadInfo.h:
+        * src/WebHTTPLoadInfo.cpp:
+        (WebKit::WebHTTPLoadInfo::encodedDataLength):
+        (WebKit::WebHTTPLoadInfo::setEncodedDataLength):
+
+2011-04-14  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Remove dependency on chromium skia::PlatformCanvas
+        https://bugs.webkit.org/show_bug.cgi?id=57563
+
+        * public/WebCanvas.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::printPage):
+        * tests/TransparencyWinTest.cpp:
+        (WebCore::drawNativeRect):
+        (WebCore::getPixelAt):
+        (WebCore::clearTopLayerAlphaChannel):
+        (WebCore::clearTopLayerAlphaPixel):
+        (WebCore::TEST):
+
+2011-04-14  Brian Salomon  <bsalomon@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        In skia platform call SkBitmap::notifyPixelsChanged on WebGL readback
+        https://bugs.webkit.org/show_bug.cgi?id=58543
+
+        No new tests. Tested by fast/canvas/webgl/canvas-test.html
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DInternal::paintRenderingResultsToCanvas):
+
+2011-04-14  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] TilingData should return 1 tile if tile size is texture size.
+        https://bugs.webkit.org/show_bug.cgi?id=58364
+
+        Update test to properly handle this case.
+
+        * tests/TilingDataTest.cpp:
+        (WebCore::TEST):
+
+2011-04-14  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Make WebURLLoaderOptions disallow cross origin requests by default.
+        https://bugs.webkit.org/show_bug.cgi?id=58475
+
+        No new tests. Exposes no new functionality.
+
+        * public/WebURLLoaderOptions.h:
+        (WebKit::WebURLLoaderOptions::WebURLLoaderOptions):
+
+2011-04-13  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Allow setting composited backing stores for scrollbars and scroll corners
+        https://bugs.webkit.org/show_bug.cgi?id=57202
+
+        Remove a lot of scrollbar hacks from the chromium compositor implementation now that
+        scrollbars go to real layers.
+
+        * src/WebScrollbarImpl.cpp:
+        (WebKit::WebScrollbarImpl::invalidateScrollCornerRect):
+        (WebKit::WebScrollbarImpl::scrollCornerPresent):
+        * src/WebScrollbarImpl.h:
+        (WebKit::WebScrollbarImpl::scrollCornerRect):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::reallocateRenderer):
+
+2011-04-13  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Jian Li.
+
+        [chromium] Remove unnecessary #define now that chrome has rolled to the latest WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=58474
+
+        * DEPS:
+        * public/WebSpellCheckClient.h:
+
+2011-04-13  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Extension3D needs to provide a way to check if an extension is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=58410
+
+        Implement isEnabled() in chromium port.
+
+        * src/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::isEnabled):
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DInternal::isExtensionEnabled):
+        * src/GraphicsContext3DInternal.h:
+
+2011-04-13  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add mock implementation and plumbing code for unified Quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57927
+
+        Added plumbing code for the quota API, that is based on the
+        discussion on public-webapps:
+        http://lists.w3.org/Archives/Public/public-webapps/2011JanMar/0346.html
+
+        * WebKit.gyp: Added new file entries.
+        * src/StorageInfoChromium.cpp: Added.
+        * src/WebStorageQuotaCallbacksImpl.cpp: Added. An implementation of
+        WebStorageQuotaCallbacks.
+        * src/WebStorageQuotaCallbacksImpl.h: Added.
+
+2011-04-12  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Chromium: Set ENABLE_LEVELDB=1 and add leveldb and snappy to DEPS
+        https://bugs.webkit.org/show_bug.cgi?id=58343
+
+        Set ENABLE_LEVELDB=1 so that code gets compiled by the EWS bots.
+        Add the necessary dependencies to the DEPS file.
+
+        * DEPS:
+        * features.gypi:
+
+2011-04-12  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add WebSettings::setValidationMessageTimerMagnification()
+        https://bugs.webkit.org/show_bug.cgi?id=57426
+
+        * public/WebSettings.h: Declare new function.
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setValidationMessageTimerMagnification):
+         Passing the specified value to WebCore::Settings.
+        * src/WebSettingsImpl.h: Declare new function.
+
+2011-04-12  Antoine Labour  <piman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Allow WebView users to recreate dependent contexts after a context lost
+        event. Similarly to the startup case, a temporary context gets created,
+        that gets used by the layer renderer once it itself gets recreated.
+        https://bugs.webkit.org/show_bug.cgi?id=58385
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::reallocateRenderer): use the temporary context to
+        recreate the layer renderer if it's valid.
+        (WebKit::WebViewImpl::graphicsContext3D): create a temporary context if
+        the layer renderer's context is lost.
+
+2011-04-12  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] TilingData mishandles very small texture sizes
+        https://bugs.webkit.org/show_bug.cgi?id=58364
+
+        Update test to properly handle texture sizes of 0-3.
+
+        * tests/TilingDataTest.cpp:
+        (WebCore::TEST):
+
+2011-04-12  Jian Li  <jianli@chromium.org>
+
+        Unreviewed, rolling out r83649.
+        http://trac.webkit.org/changeset/83649
+        https://bugs.webkit.org/show_bug.cgi?id=57563
+
+        This patch causes compiling errors for chromium
+
+        * public/WebCanvas.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::printPage):
+        * tests/TransparencyWinTest.cpp:
+        (WebCore::drawNativeRect):
+        (WebCore::getPixelAt):
+        (WebCore::clearTopLayerAlphaChannel):
+        (WebCore::clearTopLayerAlphaPixel):
+        (WebCore::TEST):
+
+2011-04-12  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Jian Li.
+
+        [chromium] Fix spellcheck regression in context menus
+        https://bugs.webkit.org/show_bug.cgi?id=58386
+
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+
+2011-04-12  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Use new dragTargetDragEnter() function signature
+        https://bugs.webkit.org/show_bug.cgi?id=58303
+
+        After WebKit/chromium/DEPS rolls to chromium r80907, the drag identity
+        based version of dragTargetDragEnter() is no longer used; remove it.
+
+        * public/WebView.h:
+        * src/WebViewImpl.cpp:
+        * src/WebViewImpl.h:
+
+2011-04-12  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Remove dependency on chromium skia::PlatformCanvas
+        https://bugs.webkit.org/show_bug.cgi?id=57563
+
+        * public/WebCanvas.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::printPage):
+        * tests/TransparencyWinTest.cpp:
+        (WebCore::drawNativeRect):
+        (WebCore::getPixelAt):
+        (WebCore::clearTopLayerAlphaChannel):
+        (WebCore::clearTopLayerAlphaPixel):
+        (WebCore::TEST):
+
+2011-04-12  Adam Barth  <abarth@webkit.org>
+
+        Revert unintentional changes to WebKit.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        * src/WebSettingsImpl.h:
+
+2011-04-11  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium]: Get the list of misspelled words in the WebKit code insetad of in chromium's RenderView
+        https://bugs.webkit.org/show_bug.cgi?id=58260
+
+        * public/WebContextMenuData.h:
+        * public/WebSpellCheckClient.h:
+        (WebKit::WebSpellCheckClient::spellCheck):
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::checkSpellingOfString):
+
+2011-04-12  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Move the WebURLLoaderOptions struct into its own file and rename the CrossOriginRequestPolicy enum to conform to the WebKit coding standard.
+        https://bugs.webkit.org/show_bug.cgi?id=58287
+
+        No new tests. No new functionality exposed.
+
+        * WebKit.gyp:
+        * public/WebURLLoader.h:
+        * public/WebURLLoaderOptions.h: Added.
+        (WebKit::WebURLLoaderOptions::WebURLLoaderOptions):
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::AssociatedURLLoader):
+        * src/AssociatedURLLoader.h:
+
+2011-04-11  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [chromium] script formatting doesn't work when chromium is built with debug_devtools=1.
+        https://bugs.webkit.org/show_bug.cgi?id=58232
+
+        * WebKit.gyp:
+
+2011-04-11  John Bates  <jbates@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        chromium support for glSetLatch and glWaitLatch between 3D contexts
+        https://bugs.webkit.org/show_bug.cgi?id=58003
+
+        * public/WebGraphicsContext3D.h:
+        (WebKit::WebGraphicsContext3D::getParentToChildLatchCHROMIUM):
+        (WebKit::WebGraphicsContext3D::getChildToParentLatchCHROMIUM):
+        (WebKit::WebGraphicsContext3D::waitLatchCHROMIUM):
+        (WebKit::WebGraphicsContext3D::setLatchCHROMIUM):
+        * src/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::waitLatchCHROMIUM):
+        (WebCore::Extensions3DChromium::setLatchCHROMIUM):
+        * src/GraphicsContext3DChromium.cpp:
+        * src/GraphicsContext3DInternal.h:
+
+2011-04-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Crash in WebViewImpl::caretOrSelectionBounds
+        https://bugs.webkit.org/show_bug.cgi?id=58269
+
+        The bug was caused by caretOrSelectionBounds's incorrectly assuming
+        SelectionController::toNormalizedRange to always return a non-null Range.
+
+        Fixed the bug by adding a null pointer check. Also replaced calls to deprecatedNode
+        by containerNode() and calls to SelectionController::start() and SelectionController::end()
+        by calls to SelectionController::base() and SelectionController::extent() because
+        selection extends from base to extent, not from start to end.
+
+        Test: editing/selection/extend-over-file-input-by-drag-crash.html
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::caretOrSelectionBounds):
+
+2011-04-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Rename MediaControls to MediaControlRootElement.
+        https://bugs.webkit.org/show_bug.cgi?id=58250
+
+        Mechanical move using do-webcore-rename.
+
+2011-04-11  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        [chromium] Implement image/png support in DataTransferItems
+        https://bugs.webkit.org/show_bug.cgi?id=58106
+
+        Add glue for reading image data from clipboard.
+
+        * DEPS:
+        * src/PlatformBridge.cpp:
+        (WebCore::PlatformBridge::clipboardReadImage):
+
+2011-04-05  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Steve Block.
+
+        IndexedDB: Introduce skeleton for LevelDB backend
+        https://bugs.webkit.org/show_bug.cgi?id=57827
+
+        * features.gypi:
+            Add ENABLE_LEVELDB=0.
+        * public/WebIDBFactory.h:
+        (WebKit::WebIDBFactory::open):
+            Remove pre-roll open() function.
+
+2011-04-10  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Fix build errors on "Win Shared Builder (dbg)"
+
+        * WebKit.gyp: Exclude WebFrameTest.cpp for WEBKIT_DLL.
+
+2011-04-10  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, rolling out r83353.
+        http://trac.webkit.org/changeset/83353
+        https://bugs.webkit.org/show_bug.cgi?id=58106
+
+        The new test doesn't pass on all Chromium platforms.
+
+        * DEPS:
+        * src/PlatformBridge.cpp:
+
+2011-04-09  Sreeram Ramachandran  <sreeram@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        Gather data on modal dialogs shown during unload events
+        https://bugs.webkit.org/show_bug.cgi?id=58115
+
+        Implementation of the new API to receive notifications of modal dialogs
+        dispatched during unload events. Count the notifications through a histogram.
+
+        No tests because it's not clear how to test chromium histograms from webkit.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::willRunModalDialogDuringPageDismissal):
+        * src/ChromeClientImpl.h:
+
+2011-04-08  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Re-land http://trac.webkit.org/changeset/83007. This works
+        without changes after https://bugs.webkit.org/show_bug.cgi?id=58110.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58096
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrame::frameForContext):
+        * tests/WebFrameTest.cpp:
+        (WebKit::WebFrameTest::WebFrameTest):
+        (WebKit::WebFrameTest::registerMockedURLLoad):
+        (WebKit::WebFrameTest::loadFrame):
+        (WebKit::TEST_F):
+
+2011-04-08  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        [chromium] Implement image/png support in DataTransferItems
+        https://bugs.webkit.org/show_bug.cgi?id=58106
+
+        Add glue for reading image data from clipboard.
+
+        * DEPS:
+        * src/PlatformBridge.cpp:
+        (WebCore::PlatformBridge::clipboardReadImage):
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * features.gypi:
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * features.gypi:
+
+2011-04-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Remove unneeded usage of V8::Lockers in IDB tests.
+        https://bugs.webkit.org/show_bug.cgi?id=58110
+        Since they are simple one-thread tests.
+        This code parallels the code in Chromium's idb bindings that uses v8 Lockers in utility process,
+        which is equally not needed since there is only one thread running v8 in that process.
+
+        * tests/IDBBindingUtilitiesTest.cpp:
+
+2011-04-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: add test for script formatter worker.
+        https://bugs.webkit.org/show_bug.cgi?id=57447
+
+        * WebKit.gyp:
+
+2011-04-08  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] The second attempt of fixing for Windows (dbg)(shared) build.
+
+        * WebKit.gyp: webkit should not depend on webkit_support.
+
+2011-04-08  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Build fix for Windows (dbg)(shared).
+
+        * WebKit.gyp: Add webkit_support dependency, which is required for webkit_unittest_files.
+
+2011-04-07  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Add WebKit API to query and request unified offline-storage quota
+        https://bugs.webkit.org/show_bug.cgi?id=57849
+        Just adding the API, this does not do anything yet.
+
+        The API is based on the public discussion for unified quota API:
+        http://lists.w3.org/Archives/Public/public-webapps/2011JanMar/0346.html
+        (The detail is not yet fully specified and might be subject to change.)
+
+        * public/WebFrameClient.h:
+        (WebKit::WebFrameClient::queryStorageUsageAndQuota): Added.
+        (WebKit::WebFrameClient::requestStorageQuota): Added.
+        * public/WebStorageQuotaCallbacks.h: Added.
+        (WebKit::WebStorageQuotaCallbacks::~WebStorageQuotaCallbacks):
+        * public/WebStorageQuotaType.h: Added.
+
+2011-04-07  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Let shadow DOM have a list of nodes at the top level of a shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=57813
+
+        * src/WebElement.cpp:
+        (WebKit::WebElement::shadowRoot): shadow roots are ContainerNodes now
+
+2011-04-07  Magnus Danielsson  <public@fuzzac.com>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] WebPageSerializerImpl doesn't serialize sub-frames correctly
+        https://bugs.webkit.org/show_bug.cgi?id=53897
+
+        When serializing a web page using 'save page as', sub-frames and resources gets
+        saved in a sub-directory. However, frame elements didn't get updated to reference
+        these saved sub-frames, but were still referencing the original url. So when opening
+        a saved web page, any sub-frames would get pulled in from the original url rather than 
+        what was saved.
+
+        In addition to this, sub-frames in the sub-directory erroneously had the name of the
+        sub-directory prepended to the path of resources located in the same sub-directory.
+
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::openTagToStrne: Fixed resource paths in sub-frames. 
+        Also made sure sub-frames are referenced correctly from parent frame.
+        (WebKit::WebPageSerializerImpl::endTagToString): Removed constness from argument.
+        (WebKit::WebPageSerializerImpl::buildContentForNode): Ditto.
+        * src/WebPageSerializerImpl.h:
+
+2011-04-07  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Compositor thread infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=56131
+
+        Tests for chrome compositor thread and related infrastructure.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * tests/CCThreadTaskTest.cpp: Added.
+        (WebCore::TEST):
+        * tests/CCThreadTest.cpp: Added.
+        (WebCore::TEST):
+        (WebCore::PingPongUsingCondition::ping):
+        (WebCore::PingPongTestUsingTasks::ping):
+        (WebCore::PingPongTestUsingTasks::pong):
+        * tests/RunAllTests.cpp:
+        (main):
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * features.gypi:
+
+2011-04-07  Pavel Feldman  <pfeldman@google.com>
+
+        Not reviewed: rolling chromium DEPS 80421:80767.
+
+        * DEPS:
+
+2011-04-07  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Rename didReceiveData2 to didReceiveData as part of enabling transfer size support.
+        https://bugs.webkit.org/show_bug.cgi?id=58036
+
+        Renamed didReceiveData2 to didReceiveData.
+
+        * public/WebURLLoaderClient.h:
+        (WebKit::WebURLLoaderClient::didReceiveData):
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveData):
+        * src/ResourceHandle.cpp:
+        (WebCore::ResourceHandleInternal::didReceiveData):
+
+2011-04-07  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Migrate didReceiveData in upstream for plugins as part of enabling transfer size support.
+        https://bugs.webkit.org/show_bug.cgi?id=58034
+
+        Migrated didReceiveData to support new lengthReceived parameter.
+
+        * src/AssociatedURLLoader.cpp:
+        (WebKit::AssociatedURLLoader::ClientAdapter::didReceiveData):
+
+2011-04-06  Asanka Herath  <asanka@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add new TargetType: TargetIsFavicon
+
+        https://bugs.webkit.org/show_bug.cgi?id=57659
+
+        * public/WebURLRequest.h:
+
+2011-04-06  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Add settings API to enable accelerated drawing
+        https://bugs.webkit.org/show_bug.cgi?id=57863
+        
+        If accelerated drawing is enabled we try to render content and
+        root layers using GPU. Please note that this setting is ignored if
+        accelerated compositing is disabled.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setAcceleratedDrawingEnabled):
+        * src/WebSettingsImpl.h:
+
+2011-04-05  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by David Levin.
+
+        Added MediaTypeFile enum value to WebContextMenuData::MediaType.
+        https://bugs.webkit.org/show_bug.cgi?id=57566
+
+        * public/WebContextMenuData.h:
+
+2011-04-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r83007.
+        http://trac.webkit.org/changeset/83007
+        https://bugs.webkit.org/show_bug.cgi?id=57920
+
+        Broke WebFrameTest.FrameForEnteredContext on Chromium-win and
+        Chromium-mac (Requested by tkent on #webkit).
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        * tests/WebFrameTest.cpp:
+        (WebKit::WebFrameTest::WebFrameTest):
+        (WebKit::WebFrameTest::registerMockedURLLoad):
+        (WebKit::WebFrameTest::serveRequests):
+        (WebKit::TEST_F):
+
+2011-04-05  James Kozianski  <koz@chromium.org>
+
+        Unreviewed, rolling out r82976.
+        http://trac.webkit.org/changeset/82976
+        https://bugs.webkit.org/show_bug.cgi?id=57566
+
+        Breaks chromium canary build
+
+        * public/WebContextMenuData.h:
+
+2011-04-05  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add ability to get frame from v8 context to chromium WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=57516
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrame::frameForV8Context):
+
+2011-04-05  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Don't have 'using namespace' declarations in header files
+        https://bugs.webkit.org/show_bug.cgi?id=57882
+
+        * src/EventListenerWrapper.cpp:
+        * src/EventListenerWrapper.h:
+        * src/VideoFrameChromiumImpl.h:
+        * src/WebDOMEventListener.cpp:
+        * src/WebDOMEventListenerPrivate.cpp:
+        * src/WebDOMEventListenerPrivate.h:
+        (WebKit::WebDOMEventListenerPrivate::ListenerInfo::ListenerInfo):
+
+2011-04-05  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by David Levin.
+
+        Added MediaTypeFile enum value to WebContextMenuData::MediaType.
+        https://bugs.webkit.org/show_bug.cgi?id=57566
+
+        * public/WebContextMenuData.h:
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+
+        Followed the signature change.
+        
+        * src/EditorClientImpl.h:
+        * src/EditorClientImpl.cpp:
+        * src/WebTextCheckingCompletionImpl.cpp
+
+2011-04-05  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Adam Barth
+
+        Clean up IndexedDB WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=57507
+
+        Rename the backend proxy files that didn't have Backend in their name.
+        Everything in WebKit should be in the WebKit namespace.
+        Put everything behind the feature flag so we're consistient.
+        Put the feature flag #if above includes.
+
+        * WebKit.gyp:
+        * src/IDBCallbacksProxy.cpp:
+        (WebKit::IDBCallbacksProxy::create):
+        (WebKit::IDBCallbacksProxy::IDBCallbacksProxy):
+        (WebKit::IDBCallbacksProxy::onError):
+        (WebKit::IDBCallbacksProxy::onSuccess):
+        * src/IDBCallbacksProxy.h:
+        * src/IDBCursorBackendProxy.cpp:
+        (WebKit::IDBCursorBackendProxy::create):
+        (WebKit::IDBCursorBackendProxy::IDBCursorBackendProxy):
+        * src/IDBCursorBackendProxy.h:
+        * src/IDBDatabaseBackendProxy.cpp:
+        (WebKit::IDBDatabaseBackendProxy::create):
+        (WebKit::IDBDatabaseBackendProxy::IDBDatabaseBackendProxy):
+        (WebKit::IDBDatabaseBackendProxy::~IDBDatabaseBackendProxy):
+        (WebKit::IDBDatabaseBackendProxy::name):
+        (WebKit::IDBDatabaseBackendProxy::version):
+        (WebKit::IDBDatabaseBackendProxy::objectStoreNames):
+        (WebKit::IDBDatabaseBackendProxy::createObjectStore):
+        (WebKit::IDBDatabaseBackendProxy::deleteObjectStore):
+        (WebKit::IDBDatabaseBackendProxy::setVersion):
+        (WebKit::IDBDatabaseBackendProxy::transaction):
+        (WebKit::IDBDatabaseBackendProxy::close):
+        (WebKit::IDBDatabaseBackendProxy::open):
+        * src/IDBDatabaseCallbacksProxy.cpp:
+        (WebKit::IDBDatabaseCallbacksProxy::create):
+        (WebKit::IDBDatabaseCallbacksProxy::IDBDatabaseCallbacksProxy):
+        * src/IDBDatabaseCallbacksProxy.h:
+        * src/IDBFactoryBackendProxy.cpp:
+        (WebKit::IDBFactoryBackendProxy::IDBFactoryBackendProxy):
+        (WebKit::IDBFactoryBackendProxy::open):
+        * src/IDBFactoryBackendProxy.h:
+        * src/IDBIndexBackendProxy.cpp:
+        (WebKit::IDBIndexBackendProxy::create):
+        (WebKit::IDBIndexBackendProxy::IDBIndexBackendProxy):
+        * src/IDBIndexBackendProxy.h:
+        * src/IDBObjectStoreBackendProxy.cpp:
+        (WebKit::IDBObjectStoreBackendProxy::create):
+        (WebKit::IDBObjectStoreBackendProxy::IDBObjectStoreBackendProxy):
+        (WebKit::IDBObjectStoreBackendProxy::~IDBObjectStoreBackendProxy):
+        (WebKit::IDBObjectStoreBackendProxy::name):
+        (WebKit::IDBObjectStoreBackendProxy::keyPath):
+        (WebKit::IDBObjectStoreBackendProxy::indexNames):
+        (WebKit::IDBObjectStoreBackendProxy::get):
+        (WebKit::IDBObjectStoreBackendProxy::put):
+        (WebKit::IDBObjectStoreBackendProxy::deleteFunction):
+        (WebKit::IDBObjectStoreBackendProxy::clear):
+        (WebKit::IDBObjectStoreBackendProxy::createIndex):
+        (WebKit::IDBObjectStoreBackendProxy::index):
+        (WebKit::IDBObjectStoreBackendProxy::deleteIndex):
+        (WebKit::IDBObjectStoreBackendProxy::openCursor):
+        * src/IDBObjectStoreBackendProxy.h: Added.
+        * src/IDBObjectStoreProxy.h: Removed.
+        * src/IDBTransactionBackendProxy.cpp:
+        (WebKit::IDBTransactionBackendProxy::create):
+        (WebKit::IDBTransactionBackendProxy::IDBTransactionBackendProxy):
+        (WebKit::IDBTransactionBackendProxy::objectStore):
+        * src/IDBTransactionBackendProxy.h:
+        (WebKit::IDBTransactionBackendProxy::getWebIDBTransaction):
+        * src/IDBTransactionCallbacksProxy.cpp:
+        (WebKit::IDBTransactionCallbacksProxy::create):
+        (WebKit::IDBTransactionCallbacksProxy::IDBTransactionCallbacksProxy):
+        * src/IDBTransactionCallbacksProxy.h:
+        * src/WebIDBCallbacksImpl.cpp:
+        (WebKit::WebIDBCallbacksImpl::onError):
+        (WebKit::WebIDBCallbacksImpl::onSuccess):
+        * src/WebIDBCallbacksImpl.h:
+        * src/WebIDBCursorImpl.cpp:
+        * src/WebIDBCursorImpl.h:
+        * src/WebIDBDatabaseCallbacksImpl.cpp:
+        (WebKit::WebIDBDatabaseCallbacksImpl::onVersionChange):
+        * src/WebIDBDatabaseCallbacksImpl.h:
+        * src/WebIDBDatabaseError.cpp:
+        * src/WebIDBDatabaseImpl.cpp:
+        * src/WebIDBDatabaseImpl.h:
+        * src/WebIDBFactoryImpl.cpp:
+        (WebKit::WebIDBFactoryImpl::WebIDBFactoryImpl):
+        * src/WebIDBFactoryImpl.h:
+        * src/WebIDBIndexImpl.cpp:
+        * src/WebIDBIndexImpl.h:
+        * src/WebIDBKey.cpp:
+        (WebKit::WebIDBKey::createFromValueAndKeyPath):
+        (WebKit::WebIDBKey::injectIDBKeyIntoSerializedValue):
+        * src/WebIDBKeyPath.cpp:
+        (WebKit::WebIDBKeyPath::operator const WTF::Vector<IDBKeyPathElement, 0>&):
+        * src/WebIDBKeyRange.cpp:
+        * src/WebIDBObjectStoreImpl.cpp:
+        * src/WebIDBObjectStoreImpl.h:
+        * src/WebIDBTransactionCallbacksImpl.cpp:
+        * src/WebIDBTransactionCallbacksImpl.h:
+        * src/WebIDBTransactionImpl.cpp:
+        * src/WebIDBTransactionImpl.h:
+
+2011-04-05  Sailesh Agrawal  <sail@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Don't clear existing files if the user cancels the file chooser dialog.
+        https://bugs.webkit.org/show_bug.cgi?id=55200
+
+        * src/WebFileChooserCompletionImpl.cpp:
+        (WebKit::WebFileChooserCompletionImpl::didChooseFile):
+
+2011-04-05  John Mellor  <johnme@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Minor cleanup: simplify WebFrameImpl by using contentsToWindow instead of convertToContainingWindow.
+        https://bugs.webkit.org/show_bug.cgi?id=55681
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::find):
+        (WebKit::WebFrameImpl::scopeStringMatches):
+
+2011-04-05  Adam Barth  <abarth@webkit.org>
+
+        Roll Chromium DEPS.
+
+        * DEPS: Rolled!
+
+2011-04-04  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        setContentEditable with true/false/inherit string is not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=52058
+
+        Move isContentEditable from HTMLElement to Node. WebKit should only access isContentEditable
+        as rendererIsEditable is for WebCore internal use.
+
+        * src/WebNode.cpp:
+        (WebKit::WebNode::isContentEditable):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setFocus):
+        (WebKit::WebViewImpl::setComposition):
+        (WebKit::WebViewImpl::confirmComposition):
+
+2011-04-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (WebKit2): Caps-Lock indicator sometimes doesn't appear in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=51230
+        <rdar://problem/8780989>
+
+        * src/WebViewImpl.cpp: (WebKit::WebViewImpl::keyEvent): Moved Caps Lock handling from
+        WebKits to WebCore, because WebKit shouldn't be smart.
+
+2011-04-01  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Chromium build using the great and powerful git.
+        This patch should be the remaining part of reverting Jeremy's ill-fated
+        refactoring.
+
+        * src/IDBDatabaseProxy.cpp:
+        (WebCore::IDBDatabaseProxy::create):
+        (WebCore::IDBDatabaseProxy::IDBDatabaseProxy):
+        (WebCore::IDBDatabaseProxy::~IDBDatabaseProxy):
+        (WebCore::IDBDatabaseProxy::name):
+        (WebCore::IDBDatabaseProxy::version):
+        (WebCore::IDBDatabaseProxy::objectStoreNames):
+        (WebCore::IDBDatabaseProxy::createObjectStore):
+        (WebCore::IDBDatabaseProxy::deleteObjectStore):
+        (WebCore::IDBDatabaseProxy::setVersion):
+        (WebCore::IDBDatabaseProxy::transaction):
+        (WebCore::IDBDatabaseProxy::close):
+        (WebCore::IDBDatabaseProxy::open):
+        * src/IDBDatabaseProxy.h:
+        * src/IDBObjectStoreProxy.cpp:
+        (WebCore::IDBObjectStoreProxy::create):
+        (WebCore::IDBObjectStoreProxy::IDBObjectStoreProxy):
+        (WebCore::IDBObjectStoreProxy::~IDBObjectStoreProxy):
+        (WebCore::IDBObjectStoreProxy::name):
+        (WebCore::IDBObjectStoreProxy::keyPath):
+        (WebCore::IDBObjectStoreProxy::indexNames):
+        (WebCore::IDBObjectStoreProxy::get):
+        (WebCore::IDBObjectStoreProxy::put):
+        (WebCore::IDBObjectStoreProxy::deleteFunction):
+        (WebCore::IDBObjectStoreProxy::clear):
+        (WebCore::IDBObjectStoreProxy::createIndex):
+        (WebCore::IDBObjectStoreProxy::index):
+        (WebCore::IDBObjectStoreProxy::deleteIndex):
+        (WebCore::IDBObjectStoreProxy::openCursor):
+
+2011-04-01  Adam Barth  <abarth@webkit.org>
+
+        Move these files back to their old locations.  I'm not sure why the
+        rollout didn't move them properly.
+
+        * src/IDBDatabaseBackendProxy.cpp: Removed.
+        * src/IDBDatabaseBackendProxy.h: Removed.
+        * src/IDBDatabaseProxy.cpp: Copied from Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp.
+        * src/IDBDatabaseProxy.h: Copied from Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h.
+        * src/IDBObjectStoreBackendProxy.cpp: Removed.
+        * src/IDBObjectStoreProxy.cpp: Copied from Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp.
+
+2011-04-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82738.
+        http://trac.webkit.org/changeset/82738
+        https://bugs.webkit.org/show_bug.cgi?id=57684
+
+        Broke storage/indexeddb/objectstore-autoincrement.html and
+        InjectIDBKey (Requested by abarth|gardening on #webkit).
+
+        * WebKit.gyp:
+        * src/IDBCallbacksProxy.cpp:
+        (WebCore::IDBCallbacksProxy::create):
+        (WebCore::IDBCallbacksProxy::IDBCallbacksProxy):
+        (WebCore::IDBCallbacksProxy::onError):
+        (WebCore::IDBCallbacksProxy::onSuccess):
+        * src/IDBCallbacksProxy.h:
+        * src/IDBCursorBackendProxy.cpp:
+        (WebCore::IDBCursorBackendProxy::create):
+        (WebCore::IDBCursorBackendProxy::IDBCursorBackendProxy):
+        * src/IDBCursorBackendProxy.h:
+        * src/IDBDatabaseCallbacksProxy.cpp:
+        (WebCore::IDBDatabaseCallbacksProxy::create):
+        (WebCore::IDBDatabaseCallbacksProxy::IDBDatabaseCallbacksProxy):
+        * src/IDBDatabaseCallbacksProxy.h:
+        * src/IDBDatabaseProxy.cpp: Renamed from Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp.
+        (WebCore::IDBDatabaseProxy::create):
+        (WebCore::IDBDatabaseProxy::IDBDatabaseProxy):
+        (WebCore::IDBDatabaseProxy::~IDBDatabaseProxy):
+        (WebCore::IDBDatabaseProxy::name):
+        (WebCore::IDBDatabaseProxy::version):
+        (WebCore::IDBDatabaseProxy::objectStoreNames):
+        (WebCore::IDBDatabaseProxy::createObjectStore):
+        (WebCore::IDBDatabaseProxy::deleteObjectStore):
+        (WebCore::IDBDatabaseProxy::setVersion):
+        (WebCore::IDBDatabaseProxy::transaction):
+        (WebCore::IDBDatabaseProxy::close):
+        (WebCore::IDBDatabaseProxy::open):
+        * src/IDBDatabaseProxy.h: Renamed from Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h.
+        * src/IDBFactoryBackendProxy.cpp:
+        (WebCore::IDBFactoryBackendProxy::IDBFactoryBackendProxy):
+        (WebCore::IDBFactoryBackendProxy::open):
+        * src/IDBFactoryBackendProxy.h:
+        * src/IDBIndexBackendProxy.cpp:
+        (WebCore::IDBIndexBackendProxy::create):
+        (WebCore::IDBIndexBackendProxy::IDBIndexBackendProxy):
+        * src/IDBIndexBackendProxy.h:
+        * src/IDBObjectStoreBackendProxy.h: Removed.
+        * src/IDBObjectStoreProxy.cpp: Renamed from Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp.
+        (WebCore::IDBObjectStoreProxy::create):
+        (WebCore::IDBObjectStoreProxy::IDBObjectStoreProxy):
+        (WebCore::IDBObjectStoreProxy::~IDBObjectStoreProxy):
+        (WebCore::IDBObjectStoreProxy::name):
+        (WebCore::IDBObjectStoreProxy::keyPath):
+        (WebCore::IDBObjectStoreProxy::indexNames):
+        (WebCore::IDBObjectStoreProxy::get):
+        (WebCore::IDBObjectStoreProxy::put):
+        (WebCore::IDBObjectStoreProxy::deleteFunction):
+        (WebCore::IDBObjectStoreProxy::clear):
+        (WebCore::IDBObjectStoreProxy::createIndex):
+        (WebCore::IDBObjectStoreProxy::index):
+        (WebCore::IDBObjectStoreProxy::deleteIndex):
+        (WebCore::IDBObjectStoreProxy::openCursor):
+        * src/IDBObjectStoreProxy.h: Added.
+        * src/IDBTransactionBackendProxy.cpp:
+        (WebCore::IDBTransactionBackendProxy::create):
+        (WebCore::IDBTransactionBackendProxy::IDBTransactionBackendProxy):
+        (WebCore::IDBTransactionBackendProxy::objectStore):
+        * src/IDBTransactionBackendProxy.h:
+        (WebCore::IDBTransactionBackendProxy::getWebIDBTransaction):
+        * src/IDBTransactionCallbacksProxy.cpp:
+        (WebCore::IDBTransactionCallbacksProxy::create):
+        (WebCore::IDBTransactionCallbacksProxy::IDBTransactionCallbacksProxy):
+        * src/IDBTransactionCallbacksProxy.h:
+        * src/WebIDBCallbacksImpl.cpp:
+        (WebCore::WebIDBCallbacksImpl::onError):
+        (WebCore::WebIDBCallbacksImpl::onSuccess):
+        * src/WebIDBCallbacksImpl.h:
+        * src/WebIDBCursorImpl.cpp:
+        * src/WebIDBCursorImpl.h:
+        * src/WebIDBDatabaseCallbacksImpl.cpp:
+        (WebCore::WebIDBDatabaseCallbacksImpl::onVersionChange):
+        * src/WebIDBDatabaseCallbacksImpl.h:
+        * src/WebIDBDatabaseError.cpp:
+        * src/WebIDBDatabaseImpl.cpp:
+        * src/WebIDBDatabaseImpl.h:
+        * src/WebIDBFactoryImpl.cpp:
+        (WebKit::WebIDBFactoryImpl::WebIDBFactoryImpl):
+        * src/WebIDBFactoryImpl.h:
+        * src/WebIDBIndexImpl.cpp:
+        * src/WebIDBIndexImpl.h:
+        * src/WebIDBKey.cpp:
+        (WebKit::WebIDBKey::createFromValueAndKeyPath):
+        (WebKit::WebIDBKey::injectIDBKeyIntoSerializedValue):
+        * src/WebIDBKeyPath.cpp:
+        (WebKit::WebIDBKeyPath::operator const WTF::Vector<WebCore::IDBKeyPathElement, 0>&):
+        * src/WebIDBKeyRange.cpp:
+        * src/WebIDBObjectStoreImpl.cpp:
+        * src/WebIDBObjectStoreImpl.h:
+        * src/WebIDBTransactionCallbacksImpl.cpp:
+        * src/WebIDBTransactionCallbacksImpl.h:
+        * src/WebIDBTransactionImpl.cpp:
+        * src/WebIDBTransactionImpl.h:
+
+2011-03-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Clean up IndexedDB WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=57507
+
+        Rename the backend proxy files that didn't have Backend in their name.
+        Everything in WebKit should be in the WebKit namespace.
+        Put everything behind the feature flag so we're consistient.
+        Put the feature flag #if above includes.
+
+        * WebKit.gyp:
+        * src/IDBCallbacksProxy.cpp:
+        (WebKit::IDBCallbacksProxy::create):
+        (WebKit::IDBCallbacksProxy::IDBCallbacksProxy):
+        (WebKit::IDBCallbacksProxy::onError):
+        (WebKit::IDBCallbacksProxy::onSuccess):
+        * src/IDBCallbacksProxy.h:
+        * src/IDBCursorBackendProxy.cpp:
+        (WebKit::IDBCursorBackendProxy::create):
+        (WebKit::IDBCursorBackendProxy::IDBCursorBackendProxy):
+        * src/IDBCursorBackendProxy.h:
+        * src/IDBDatabaseBackendProxy.cpp:
+        (WebKit::IDBDatabaseBackendProxy::create):
+        (WebKit::IDBDatabaseBackendProxy::IDBDatabaseBackendProxy):
+        (WebKit::IDBDatabaseBackendProxy::~IDBDatabaseBackendProxy):
+        (WebKit::IDBDatabaseBackendProxy::name):
+        (WebKit::IDBDatabaseBackendProxy::version):
+        (WebKit::IDBDatabaseBackendProxy::objectStoreNames):
+        (WebKit::IDBDatabaseBackendProxy::createObjectStore):
+        (WebKit::IDBDatabaseBackendProxy::deleteObjectStore):
+        (WebKit::IDBDatabaseBackendProxy::setVersion):
+        (WebKit::IDBDatabaseBackendProxy::transaction):
+        (WebKit::IDBDatabaseBackendProxy::close):
+        (WebKit::IDBDatabaseBackendProxy::open):
+        * src/IDBDatabaseCallbacksProxy.cpp:
+        (WebKit::IDBDatabaseCallbacksProxy::create):
+        (WebKit::IDBDatabaseCallbacksProxy::IDBDatabaseCallbacksProxy):
+        * src/IDBDatabaseCallbacksProxy.h:
+        * src/IDBFactoryBackendProxy.cpp:
+        (WebKit::IDBFactoryBackendProxy::IDBFactoryBackendProxy):
+        (WebKit::IDBFactoryBackendProxy::open):
+        * src/IDBFactoryBackendProxy.h:
+        * src/IDBIndexBackendProxy.cpp:
+        (WebKit::IDBIndexBackendProxy::create):
+        (WebKit::IDBIndexBackendProxy::IDBIndexBackendProxy):
+        * src/IDBIndexBackendProxy.h:
+        * src/IDBObjectStoreBackendProxy.cpp:
+        (WebKit::IDBObjectStoreBackendProxy::create):
+        (WebKit::IDBObjectStoreBackendProxy::IDBObjectStoreBackendProxy):
+        (WebKit::IDBObjectStoreBackendProxy::~IDBObjectStoreBackendProxy):
+        (WebKit::IDBObjectStoreBackendProxy::name):
+        (WebKit::IDBObjectStoreBackendProxy::keyPath):
+        (WebKit::IDBObjectStoreBackendProxy::indexNames):
+        (WebKit::IDBObjectStoreBackendProxy::get):
+        (WebKit::IDBObjectStoreBackendProxy::put):
+        (WebKit::IDBObjectStoreBackendProxy::deleteFunction):
+        (WebKit::IDBObjectStoreBackendProxy::clear):
+        (WebKit::IDBObjectStoreBackendProxy::createIndex):
+        (WebKit::IDBObjectStoreBackendProxy::index):
+        (WebKit::IDBObjectStoreBackendProxy::deleteIndex):
+        (WebKit::IDBObjectStoreBackendProxy::openCursor):
+        * src/IDBObjectStoreBackendProxy.h: Added.
+        * src/IDBObjectStoreProxy.h: Removed.
+        * src/IDBTransactionBackendProxy.cpp:
+        (WebKit::IDBTransactionBackendProxy::create):
+        (WebKit::IDBTransactionBackendProxy::IDBTransactionBackendProxy):
+        (WebKit::IDBTransactionBackendProxy::objectStore):
+        * src/IDBTransactionBackendProxy.h:
+        (WebKit::IDBTransactionBackendProxy::getWebIDBTransaction):
+        * src/IDBTransactionCallbacksProxy.cpp:
+        (WebKit::IDBTransactionCallbacksProxy::create):
+        (WebKit::IDBTransactionCallbacksProxy::IDBTransactionCallbacksProxy):
+        * src/IDBTransactionCallbacksProxy.h:
+        * src/WebIDBCallbacksImpl.cpp:
+        (WebKit::WebIDBCallbacksImpl::onError):
+        (WebKit::WebIDBCallbacksImpl::onSuccess):
+        * src/WebIDBCallbacksImpl.h:
+        * src/WebIDBCursorImpl.cpp:
+        * src/WebIDBCursorImpl.h:
+        * src/WebIDBDatabaseCallbacksImpl.cpp:
+        (WebKit::WebIDBDatabaseCallbacksImpl::onVersionChange):
+        * src/WebIDBDatabaseCallbacksImpl.h:
+        * src/WebIDBDatabaseError.cpp:
+        * src/WebIDBDatabaseImpl.cpp:
+        * src/WebIDBDatabaseImpl.h:
+        * src/WebIDBFactoryImpl.cpp:
+        (WebKit::WebIDBFactoryImpl::WebIDBFactoryImpl):
+        * src/WebIDBFactoryImpl.h:
+        * src/WebIDBIndexImpl.cpp:
+        * src/WebIDBIndexImpl.h:
+        * src/WebIDBKey.cpp:
+        (WebKit::WebIDBKey::createFromValueAndKeyPath):
+        (WebKit::WebIDBKey::injectIDBKeyIntoSerializedValue):
+        * src/WebIDBKeyPath.cpp:
+        (WebKit::WebIDBKeyPath::operator const WTF::Vector<IDBKeyPathElement, 0>&):
+        * src/WebIDBKeyRange.cpp:
+        * src/WebIDBObjectStoreImpl.cpp:
+        * src/WebIDBObjectStoreImpl.h:
+        * src/WebIDBTransactionCallbacksImpl.cpp:
+        * src/WebIDBTransactionCallbacksImpl.h:
+        * src/WebIDBTransactionImpl.cpp:
+        * src/WebIDBTransactionImpl.h:
+
+2011-03-30  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [chromium] script formatting doesn't work when all scripts are concatenated.
+        https://bugs.webkit.org/show_bug.cgi?id=57446
+
+        * WebKit.gyp:
+        * scripts/inline_js_imports.py: Added.
+
+2011-03-31  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by Eric Carlson.
+
+        [chromium] Implement preload=none, setPreload hooks to media player
+        https://bugs.webkit.org/show_bug.cgi?id=56983
+
+        This patch implements preload=none in Chromium. It also replaces
+        the now-deprecated setAutobuffer method with setPreload.
+
+        * public/WebMediaPlayer.h:
+        (WebKit::WebMediaPlayer::setPreload):
+        * public/WebMediaPlayerClient.h:
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::preload):
+        (WebKit::WebMediaPlayerClientImpl::load):
+        (WebKit::WebMediaPlayerClientImpl::loadInternal):
+        (WebKit::WebMediaPlayerClientImpl::prepareToPlay):
+        (WebKit::WebMediaPlayerClientImpl::setPreload):
+        (WebKit::WebMediaPlayerClientImpl::startDelayedLoad):
+        (WebKit::WebMediaPlayerClientImpl::WebMediaPlayerClientImpl):
+        * src/WebMediaPlayerClientImpl.h:
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidReceiveTitle):
+        (WebKit::FrameLoaderClientImpl::setTitle):
+        * src/FrameLoaderClientImpl.h:
+        * src/WebDataSourceImpl.cpp:
+        (WebKit::WebDataSourceImpl::pageTitle):
+
+2011-03-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        UnlockNonLocked condition reached in WorkerFileSystemsCallbackBridge::mayPostTaskToWorker
+        https://bugs.webkit.org/show_bug.cgi?id=57382
+
+        There were two issues to address:
+        1. The use of a non-thread safe class (RefPtr) in a ThreadSafeRefCounted class.
+           The problem was that this RefPtr could be changed on either thread.
+        2. Keeping WorkerFileSystemCallbacksBridge alive for while it was being used
+           including while its mutex was in use.
+
+        * src/WorkerFileSystemCallbacksBridge.cpp:
+        (WebKit::WorkerFileSystemCallbacksBridge::runTaskOnMainThread):
+        Changed to take a PassRefPtr and leak the ref count as opposed to relying on
+        dispatchTaskToMainThread to store the pointer in m_selfRef.
+        (WebKit::WorkerFileSystemCallbacksBridge::dispatchTaskToMainThread): Remove the
+        m_selfRef and hand off a PassRefPtr instead.
+        (WebKit::WorkerFileSystemCallbacksBridge::mayPostTaskToWorker): Balance out the leaked ref
+        and ensure that WorkerFileSystemCallbacksBridge stays alive while the mutex is held.
+        * src/WorkerFileSystemCallbacksBridge.h: Removed m_selfRef and derefIfWorkerIsStopped which
+          was simply due to m_selfRef.
+
 2011-03-29  John Abd-El-Malek  <jam@chromium.org>
 
         Reviewed by Tony Chang.
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 3ab2e78..c0e5a6c 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '79759'
+  'chromium_rev': '81564'
 }
 
 deps = {
@@ -123,6 +123,10 @@ deps = {
     From('chromium_deps', 'src/third_party/yasm/source/patched-yasm'),
   'third_party/libjpeg_turbo':
     From('chromium_deps', 'src/third_party/libjpeg_turbo'),
+  'third_party/leveldb':
+    From('chromium_deps', 'src/third_party/leveldb'),
+  'third_party/snappy/src':
+    From('chromium_deps', 'src/third_party/snappy/src'),
   'third_party':
     Var('chromium_svn')+'/third_party@'+Var('chromium_rev'),
 }
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index d47248e..0ee5dd6 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -266,6 +266,8 @@
                 'public/WebSpeechInputResult.h',
                 'public/WebStorageArea.h',
                 'public/WebStorageEventDispatcher.h',
+                'public/WebStorageQuotaCallbacks.h',
+                'public/WebStorageQuotaType.h',
                 'public/WebStorageNamespace.h',
                 'public/WebString.h',
                 'public/WebTextAffinity.h',
@@ -279,6 +281,7 @@
                 'public/WebURL.h',
                 'public/WebURLError.h',
                 'public/WebURLLoader.h',
+                'public/WebURLLoaderOptions.h',
                 'public/WebURLLoadTiming.h',
                 'public/WebURLLoaderClient.h',
                 'public/WebURLRequest.h',
@@ -359,14 +362,14 @@
                 'src/IDBCursorBackendProxy.h',
                 'src/IDBDatabaseCallbacksProxy.cpp',
                 'src/IDBDatabaseCallbacksProxy.h',
-                'src/IDBDatabaseProxy.cpp',
-                'src/IDBDatabaseProxy.h',
+                'src/IDBDatabaseBackendProxy.cpp',
+                'src/IDBDatabaseBackendProxy.h',
                 'src/IDBFactoryBackendProxy.cpp',
                 'src/IDBFactoryBackendProxy.h',
                 'src/IDBIndexBackendProxy.cpp',
                 'src/IDBIndexBackendProxy.h',
-                'src/IDBObjectStoreProxy.cpp',
-                'src/IDBObjectStoreProxy.h',
+                'src/IDBObjectStoreBackendProxy.cpp',
+                'src/IDBObjectStoreBackendProxy.h',
                 'src/IDBTransactionBackendProxy.cpp',
                 'src/IDBTransactionBackendProxy.h',
                 'src/IDBTransactionCallbacksProxy.cpp',
@@ -400,6 +403,7 @@
                 'src/StorageEventDispatcherChromium.cpp',
                 'src/StorageEventDispatcherImpl.cpp',
                 'src/StorageEventDispatcherImpl.h',
+                'src/StorageInfoChromium.cpp',
                 'src/StorageNamespaceProxy.cpp',
                 'src/StorageNamespaceProxy.h',
                 'src/TemporaryGlue.h',
@@ -552,6 +556,8 @@
                 'src/WebStorageEventDispatcherImpl.h',
                 'src/WebStorageNamespaceImpl.cpp',
                 'src/WebStorageNamespaceImpl.h',
+                'src/WebStorageQuotaCallbacksImpl.cpp',
+                'src/WebStorageQuotaCallbacksImpl.h',
                 'src/WebString.cpp',
                 'src/WebTextRun.cpp',
                 'src/WebThreadSafeData.cpp',
@@ -597,6 +603,7 @@
                                 '<(chromium_src_dir)/base/base.gyp:test_support_base',
                                 '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
                                 '<(chromium_src_dir)/testing/gtest.gyp:gtest',
+                                '<(chromium_src_dir)/testing/gmock.gyp:gmock',
                                 '<(chromium_src_dir)/third_party/icu/icu.gyp:*',
                                 '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
                                 '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
@@ -607,6 +614,7 @@
                                 '<(chromium_src_dir)/third_party/ots/ots.gyp:ots',
                                 '<(chromium_src_dir)/third_party/zlib/zlib.gyp:zlib',
                                 '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
+                                # We must not add webkit_support here because of cyclic dependency.
                             ],
                             'direct_dependent_settings': {
                                 'defines': [
@@ -623,6 +631,13 @@
                                 'tests/TransparencyWinTest.cpp',
                                 'tests/UniscribeHelperTest.cpp',
                                 'tests/WebUnitTests.cpp'
+                            ],
+                            'sources!' : [
+                                # We should not include files dpending on webkit_support.
+                                'tests/CCThreadTest.cpp',
+                                # WebFrameTest.cpp depends on webkit_support and
+                                # functions defined only in !WEBKIT_IMPLEMENTATION.
+                                'tests/WebFrameTest.cpp',
                             ]
                         }],
                     ],
@@ -695,6 +710,7 @@
             'conditions': [
                 ['debug_devtools==0', {
                     'dependencies': ['concatenated_devtools_js',
+                                     'concatenated_script_formatter_worker_js',
                                      'concatenated_devtools_css'],
                 }],
             ],
@@ -713,6 +729,17 @@
                     ],
                 },
                 {
+                    'destination': '<(PRODUCT_DIR)/resources/inspector/UglifyJS',
+                    'files': [
+                        '<@(webinspector_uglifyjs_files)',
+                    ],
+                    'conditions': [
+                        ['debug_devtools==0', {
+                            'files/': [['exclude', '\\.(js|css|html)$']],
+                        }],
+                    ],
+                },
+                {
                     'destination': '<(PRODUCT_DIR)/resources/inspector/Images',
                     'files': [
                         '<@(webinspector_image_files)',
@@ -747,6 +774,7 @@
             'conditions': [
                 ['debug_devtools==0', {
                     'dependencies': ['concatenated_devtools_js',
+                                     'concatenated_script_formatter_worker_js',
                                      'concatenated_devtools_css'],
                 },{
                     # If we're not concatenating devtools files, we want to
@@ -761,6 +789,7 @@
                 'input_pages': [
                     '<(PRODUCT_DIR)/resources/inspector/devtools.html',
                     '<(PRODUCT_DIR)/resources/inspector/DevTools.js',
+                    '<(PRODUCT_DIR)/resources/inspector/ScriptFormatterWorker.js',
                     '<(PRODUCT_DIR)/resources/inspector/devTools.css',
                 ],
                 'images': [
@@ -788,6 +817,7 @@
                 'webkit',
                 '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
                 '<(chromium_src_dir)/testing/gtest.gyp:gtest',
+                '<(chromium_src_dir)/testing/gmock.gyp:gmock',
                 '<(chromium_src_dir)/base/base.gyp:base',
                 '<(chromium_src_dir)/base/base.gyp:base_i18n',
                 '<(chromium_src_dir)/base/base.gyp:test_support_base',
@@ -812,11 +842,10 @@
                     'conditions': [
                         ['OS=="win"', {
                             'sources': [
-                                # FIXME: Port PopupMenuTest and WebFrameTest to Linux and Mac.
+                                # FIXME: Port PopupMenuTest to Linux and Mac.
                                 'tests/PopupMenuTest.cpp',
                                 'tests/TransparencyWinTest.cpp',
                                 'tests/UniscribeHelperTest.cpp',
-                                'tests/WebFrameTest.cpp',
                                 'tests/WebPageSerializerTest.cpp',
                             ],
                         }],
@@ -1167,6 +1196,22 @@
                     }],
                 },
                 {
+                    'target_name': 'concatenated_script_formatter_worker_js',
+                    'type': 'none',
+                    'actions': [{
+                        'action_name': 'concatenate_script_formatter_worker_js',
+                        'script_name': 'scripts/inline_js_imports.py',
+                        'input_file': '../../WebCore/inspector/front-end/ScriptFormatterWorker.js',
+                        'inputs': [
+                            '<@(_script_name)',
+                            '<@(webinspector_uglifyjs_files)'
+                        ],
+                        'search_path': '../../WebCore/inspector/front-end',
+                        'outputs': ['<(PRODUCT_DIR)/resources/inspector/ScriptFormatterWorker.js'],
+                        'action': ['python', '<@(_script_name)', '<@(_input_file)', '<@(_search_path)', '<@(_outputs)'],
+                    }],
+                },
+                {
                     'target_name': 'concatenated_devtools_css',
                     'type': 'none',
                     'dependencies': [
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index 016cf1a..c23c9ed 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -53,6 +53,8 @@
         ],
         'webkit_unittest_files': [
             'tests/ArenaTestHelpers.h',
+            'tests/CCThreadTaskTest.cpp',
+            'tests/CCThreadTest.cpp',
             'tests/DragImageTest.cpp',
             'tests/IDBBindingUtilitiesTest.cpp',
             'tests/IDBKeyPathTest.cpp',
@@ -64,6 +66,7 @@
             'tests/TilingDataTest.cpp',
             'tests/TreeTestHelpers.cpp',
             'tests/TreeTestHelpers.h',
+            'tests/WebFrameTest.cpp',
         ],
     },
 }
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 7354eb8..01f5c78 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -65,6 +65,7 @@
         'ENABLE_INPUT_SPEECH=1',
         'ENABLE_JAVASCRIPT_DEBUGGER=1',
         'ENABLE_JSC_MULTIPLE_THREADS=0',
+        'ENABLE_LEVELDB=1',
         'ENABLE_LINK_PREFETCH=1',
         'ENABLE_MATHML=0',
         'ENABLE_MEDIA_STATISTICS=1',
@@ -74,7 +75,9 @@
         'ENABLE_OFFLINE_WEB_APPLICATIONS=1',
         'ENABLE_OPENTYPE_SANITIZER=1',
         'ENABLE_ORIENTATION_EVENTS=0',
+        'ENABLE_PAGE_VISIBILITY_API=0',
         'ENABLE_PROGRESS_TAG=1',
+        'ENABLE_QUOTA=1',
         'ENABLE_REGISTER_PROTOCOL_HANDLER=0',
         'ENABLE_REQUEST_ANIMATION_FRAME=1',
         'ENABLE_SHARED_WORKERS=1',
diff --git a/Source/WebKit/chromium/public/WebCanvas.h b/Source/WebKit/chromium/public/WebCanvas.h
index 4675487..4cf729e 100644
--- a/Source/WebKit/chromium/public/WebCanvas.h
+++ b/Source/WebKit/chromium/public/WebCanvas.h
@@ -34,7 +34,7 @@
 #include "WebCommon.h"
 
 #if WEBKIT_USING_SKIA
-namespace skia { class PlatformCanvas; }
+class SkCanvas;
 #elif WEBKIT_USING_CG
 struct CGContext;
 #endif
@@ -42,7 +42,7 @@ struct CGContext;
 namespace WebKit {
 
 #if WEBKIT_USING_SKIA
-typedef skia::PlatformCanvas WebCanvas;
+typedef SkCanvas WebCanvas;
 #elif WEBKIT_USING_CG
 typedef struct CGContext WebCanvas;
 #else
diff --git a/Source/WebKit/chromium/public/WebContextMenuData.h b/Source/WebKit/chromium/public/WebContextMenuData.h
index 5fad616..5bdd2fe 100644
--- a/Source/WebKit/chromium/public/WebContextMenuData.h
+++ b/Source/WebKit/chromium/public/WebContextMenuData.h
@@ -39,6 +39,8 @@
 #include "WebURL.h"
 #include "WebVector.h"
 
+#define WEBCONTEXT_MEDIATYPEFILE_DEFINED
+
 namespace WebKit {
 
 // This struct is passed to WebViewClient::ShowContextMenu.
@@ -52,6 +54,8 @@ struct WebContextMenuData {
         MediaTypeVideo,
         // An audio node is selected.
         MediaTypeAudio,
+        // A file node is selected.
+        MediaTypeFile,
         // A plugin node is selected.
         MediaTypePlugin,
     };
@@ -91,7 +95,7 @@ struct WebContextMenuData {
         MediaCanSave = 0x10,
         MediaHasAudio = 0x20,
         MediaHasVideo = 0x40,
-        MediaControls = 0x80,
+        MediaControlRootElement = 0x80,
         MediaCanPrint = 0x100,
     };
 
@@ -107,6 +111,9 @@ struct WebContextMenuData {
     // The editable (possibily) misspelled word.
     WebString misspelledWord;
 
+    // If misspelledWord is not empty, holds suggestions from the dictionary.
+    WebVector<WebString> dictionarySuggestions;
+
     // Whether context is editable.
     bool isEditable;
 
diff --git a/Source/WebKit/chromium/public/WebFileSystem.h b/Source/WebKit/chromium/public/WebFileSystem.h
index 7198f31..773a1f5 100644
--- a/Source/WebKit/chromium/public/WebFileSystem.h
+++ b/Source/WebKit/chromium/public/WebFileSystem.h
@@ -40,11 +40,15 @@ class WebFileSystemCallbacks;
 class WebFileWriter;
 class WebFileWriterClient;
 
+// FIXME(zelidrag): Remove this define once Chromium side catches up.
+#define WEB_FILE_SYSTEM_TYPE_EXTERNAL
+
 class WebFileSystem {
 public:
     enum Type {
         TypeTemporary,
         TypePersistent,
+        TypeExternal,
     };
 
     // Moves a file or directory at |srcPath| to |destPath|.
diff --git a/Source/WebKit/chromium/public/WebFrame.h b/Source/WebKit/chromium/public/WebFrame.h
index d5d2ff4..701936f 100644
--- a/Source/WebKit/chromium/public/WebFrame.h
+++ b/Source/WebKit/chromium/public/WebFrame.h
@@ -32,6 +32,7 @@
 #define WebFrame_h
 
 #include "WebCanvas.h"
+#include "WebFileSystem.h"
 #include "WebNode.h"
 #include "WebURL.h"
 
@@ -67,10 +68,12 @@ class WebURLRequest;
 class WebView;
 struct WebConsoleMessage;
 struct WebFindOptions;
+struct WebPoint;
 struct WebRect;
 struct WebScriptSource;
 struct WebSize;
 struct WebURLLoaderOptions;
+
 template <typename T> class WebVector;
 
 class WebFrame {
@@ -97,6 +100,13 @@ public:
     WEBKIT_API static WebFrame* frameForEnteredContext();
     WEBKIT_API static WebFrame* frameForCurrentContext();
 
+#if WEBKIT_USING_V8
+    // Returns the frame corresponding to the given context. This can return 0
+    // if the context is detached from the frame, or if the context doesn't
+    // correspond to a frame (e.g., workers).
+    WEBKIT_API static WebFrame* frameForContext(v8::Handle<v8::Context>);
+#endif
+
     // Returns the frame inside a given frame or iframe element. Returns 0 if
     // the given element is not a frame, iframe or if the frame is empty.
     WEBKIT_API static WebFrame* fromFrameOwnerElement(const WebElement&);
@@ -255,9 +265,15 @@ public:
     virtual v8::Local<v8::Context> mainWorldScriptContext() const = 0;
 
     // Creates an instance of file system object.
-    virtual v8::Handle<v8::Value> createFileSystem(int type,
+    virtual v8::Handle<v8::Value> createFileSystem(WebFileSystem::Type,
                                                    const WebString& name,
                                                    const WebString& path) = 0;
+    // Creates an instance of file or directory entry object.
+    virtual v8::Handle<v8::Value> createFileEntry(WebFileSystem::Type,
+                                                  const WebString& fileSystemName,
+                                                  const WebString& fileSystemPath,
+                                                  const WebString& filePath,
+                                                  bool isDirectory) = 0;
 #endif
 
 
@@ -408,6 +424,8 @@ public:
     // there is ranged selection.
     virtual bool selectWordAroundCaret() = 0;
 
+    virtual void selectRange(const WebPoint& start, const WebPoint& end) = 0;
+
 
     // Printing ------------------------------------------------------------
 
diff --git a/Source/WebKit/chromium/public/WebFrameClient.h b/Source/WebKit/chromium/public/WebFrameClient.h
index 2c21ee6..a542c1e 100644
--- a/Source/WebKit/chromium/public/WebFrameClient.h
+++ b/Source/WebKit/chromium/public/WebFrameClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -35,6 +35,8 @@
 #include "WebFileSystem.h"
 #include "WebNavigationPolicy.h"
 #include "WebNavigationType.h"
+#include "WebStorageQuotaType.h"
+#include "WebTextDirection.h"
 #include "WebURLError.h"
 
 namespace WebKit {
@@ -51,6 +53,7 @@ class WebNode;
 class WebPlugin;
 class WebSecurityOrigin;
 class WebSharedWorker;
+class WebStorageQuotaCallbacks;
 class WebString;
 class WebURL;
 class WebURLRequest;
@@ -204,7 +207,12 @@ public:
     virtual void didCreateDocumentElement(WebFrame*) { }
 
     // The page title is available.
+    // FIXME: remove override once Chrome is updated to new API.
     virtual void didReceiveTitle(WebFrame*, const WebString& title) { }
+    virtual void didReceiveTitle(WebFrame* frame, const WebString& title, WebTextDirection direction)
+    {
+        didReceiveTitle(frame, title);
+    }
 
     // The icons for the page have changed.
     virtual void didChangeIcons(WebFrame*) { }
@@ -362,6 +370,33 @@ public:
         WebFrame*, WebFileSystem::Type, long long size,
         bool create, WebFileSystemCallbacks*) { }
 
+    // Quota ---------------------------------------------------------
+
+    // Queries the origin's storage usage and quota information.
+    // WebStorageQuotaCallbacks::didQueryStorageUsageAndQuota will be called
+    // with the current usage and quota information for the origin. When
+    // an error occurs WebStorageQuotaCallbacks::didFail is called with an
+    // error code.
+    // The callbacks object is deleted when the callback method is called
+    // and does not need to be (and should not be) deleted manually.
+    virtual void queryStorageUsageAndQuota(
+        WebFrame*, WebStorageQuotaType, WebStorageQuotaCallbacks*) { }
+
+    // Requests a new quota size for the origin's storage.
+    // |newQuotaInBytes| indicates how much storage space (in bytes) the
+    // caller expects to need.
+    // WebStorageQuotaCallbacks::didGrantStorageQuota will be called when
+    // a new quota is granted. WebStorageQuotaCallbacks::didFail
+    // is called with an error code otherwise.
+    // Note that the requesting quota size may not always be granted and
+    // a smaller amount of quota than requested might be returned.
+    // The callbacks object is deleted when the callback method is called
+    // and does not need to be (and should not be) deleted manually.
+    virtual void requestStorageQuota(
+        WebFrame*, WebStorageQuotaType,
+        unsigned long long newQuotaInBytes,
+        WebStorageQuotaCallbacks*) { }
+
 protected:
     ~WebFrameClient() { }
 };
diff --git a/Source/WebKit/chromium/public/WebGraphicsContext3D.h b/Source/WebKit/chromium/public/WebGraphicsContext3D.h
index 984f79d..2d7b0a5 100644
--- a/Source/WebKit/chromium/public/WebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/public/WebGraphicsContext3D.h
@@ -168,6 +168,12 @@ public:
     virtual void blitFramebufferCHROMIUM(WGC3Dint srcX0, WGC3Dint srcY0, WGC3Dint srcX1, WGC3Dint srcY1, WGC3Dint dstX0, WGC3Dint dstY0, WGC3Dint dstX1, WGC3Dint dstY1, WGC3Dbitfield mask, WGC3Denum filter) = 0;
     virtual void renderbufferStorageMultisampleCHROMIUM(WGC3Denum target, WGC3Dsizei samples, WGC3Denum internalformat, WGC3Dsizei width, WGC3Dsizei height) = 0;
 
+    // GL_CHROMIUM_latch
+    virtual void getParentToChildLatchCHROMIUM(WGC3Duint* latchId) = 0;
+    virtual void getChildToParentLatchCHROMIUM(WGC3Duint* latchId) = 0;
+    virtual void waitLatchCHROMIUM(WGC3Duint latchId) = 0;
+    virtual void setLatchCHROMIUM(WGC3Duint latchId) = 0;
+
     // The entry points below map directly to the OpenGL ES 2.0 API.
     // See: http://www.khronos.org/registry/gles/
     // and: http://www.khronos.org/opengles/sdk/docs/man/
diff --git a/Source/WebKit/chromium/public/WebHTTPLoadInfo.h b/Source/WebKit/chromium/public/WebHTTPLoadInfo.h
index 9ff9153..0024878 100644
--- a/Source/WebKit/chromium/public/WebHTTPLoadInfo.h
+++ b/Source/WebKit/chromium/public/WebHTTPLoadInfo.h
@@ -62,9 +62,18 @@ public:
     WEBKIT_API WebString httpStatusText() const;
     WEBKIT_API void setHTTPStatusText(const WebString&);
 
+    WEBKIT_API long long encodedDataLength() const;
+    WEBKIT_API void setEncodedDataLength(long long);
+
     WEBKIT_API void addRequestHeader(const WebString& name, const WebString& value);
     WEBKIT_API void addResponseHeader(const WebString& name, const WebString& value);
 
+    WEBKIT_API WebString requestHeadersText() const;
+    WEBKIT_API void setRequestHeadersText(const WebString&);
+
+    WEBKIT_API WebString responseHeadersText() const;
+    WEBKIT_API void setResponseHeadersText(const WebString&);
+
 #if WEBKIT_IMPLEMENTATION
     WebHTTPLoadInfo(WTF::PassRefPtr<WebCore::ResourceLoadInfo>);
     operator WTF::PassRefPtr<WebCore::ResourceLoadInfo>() const;
diff --git a/Source/WebKit/chromium/public/WebIDBFactory.h b/Source/WebKit/chromium/public/WebIDBFactory.h
index 29414e8..97588d5 100755
--- a/Source/WebKit/chromium/public/WebIDBFactory.h
+++ b/Source/WebKit/chromium/public/WebIDBFactory.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,11 +57,7 @@ public:
     };
 
     // The WebKit implementation of open ignores the WebFrame* parameter.
-    // FIXME: Assert not reached when Chromium side is updated.
-    virtual void open(const WebString& name, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame* frame, const WebString& dataDir, unsigned long long maximumSize, BackingStoreType) { open(name, callbacks, origin, frame, dataDir, maximumSize); }
-
-    // FIXME: Remove this when Chromium side is updated.
-    virtual void open(const WebString& name, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame* frame, const WebString& dataDir, unsigned long long maximumSize) { open(name, callbacks, origin, frame, dataDir, maximumSize, DefaultBackingStore); }
+    virtual void open(const WebString& name, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir, unsigned long long maximumSize, BackingStoreType) { WEBKIT_ASSERT_NOT_REACHED(); }
 
     virtual void deleteDatabase(const WebString& name, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir) { WEBKIT_ASSERT_NOT_REACHED(); }
 };
diff --git a/Source/WebKit/chromium/public/WebMediaPlayer.h b/Source/WebKit/chromium/public/WebMediaPlayer.h
index c0084db..3b2aaaa 100644
--- a/Source/WebKit/chromium/public/WebMediaPlayer.h
+++ b/Source/WebKit/chromium/public/WebMediaPlayer.h
@@ -79,6 +79,12 @@ public:
         LiveStream,
     };
 
+    enum Preload {
+        None,
+        MetaData,
+        Auto,
+    };
+
     virtual ~WebMediaPlayer() {}
 
     virtual void load(const WebURL&) = 0;
@@ -94,7 +100,7 @@ public:
     virtual void setRate(float) = 0;
     virtual void setVolume(float) = 0;
     virtual void setVisible(bool) = 0;
-    virtual bool setAutoBuffer(bool) = 0;
+    virtual void setPreload(Preload) { };
     virtual bool totalBytesKnown() = 0;
     virtual const WebTimeRanges& buffered() = 0;
     virtual float maxTimeSeekable() const = 0;
diff --git a/Source/WebKit/chromium/public/WebMediaPlayerClient.h b/Source/WebKit/chromium/public/WebMediaPlayerClient.h
index 5f60870..6919717 100644
--- a/Source/WebKit/chromium/public/WebMediaPlayerClient.h
+++ b/Source/WebKit/chromium/public/WebMediaPlayerClient.h
@@ -31,6 +31,8 @@
 #ifndef WebMediaPlayerClient_h
 #define WebMediaPlayerClient_h
 
+#include "WebMediaPlayer.h"
+
 namespace WebKit {
 
 class WebRequest;
@@ -50,6 +52,7 @@ public:
     virtual void sawUnsupportedTracks() = 0;
     virtual float volume() const = 0;
     virtual void playbackStateChanged() = 0;
+    virtual WebMediaPlayer::Preload preload() const = 0;
 
 protected:
     ~WebMediaPlayerClient() { }
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index dfaae5e..276a166 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -100,6 +100,9 @@ public:
     WEBKIT_API static void enableJavaScriptI18NAPI(bool);
     WEBKIT_API static bool isJavaScriptI18NAPIEnabled();
 
+    WEBKIT_API static void enableQuota(bool);
+    WEBKIT_API static bool isQuotaEnabled();
+
 private:
     WebRuntimeFeatures();
 };
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 113de52..ed4e6ef 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -110,11 +110,13 @@ public:
     virtual void setAcceleratedCompositingForPluginsEnabled(bool) = 0;
     virtual void setAcceleratedCompositingForAnimationEnabled(bool) = 0;
     virtual void setAccelerated2dCanvasEnabled(bool) = 0;
+    virtual void setAcceleratedDrawingEnabled(bool) = 0;
     virtual void setMemoryInfoEnabled(bool) = 0;
     virtual void setHyperlinkAuditingEnabled(bool) = 0;
     virtual void setAsynchronousSpellCheckingEnabled(bool) = 0;
     virtual void setCaretBrowsingEnabled(bool) = 0;
     virtual void setInteractiveFormValidationEnabled(bool) = 0;
+    virtual void setValidationMessageTimerMagnification(int) = 0;
     virtual void setMinimumTimerInterval(double) = 0;
     virtual void setFullScreenEnabled(bool) = 0;
 
diff --git a/Source/WebKit/chromium/public/WebSpellCheckClient.h b/Source/WebKit/chromium/public/WebSpellCheckClient.h
index 87bdf9e..5190428 100755
--- a/Source/WebKit/chromium/public/WebSpellCheckClient.h
+++ b/Source/WebKit/chromium/public/WebSpellCheckClient.h
@@ -32,6 +32,7 @@
 #define WebSpellCheckClient_h
 
 #include "WebString.h"
+#include "WebVector.h"
 
 namespace WebKit {
 
@@ -44,9 +45,12 @@ public:
     // text contains a misspelled word, then upon return misspelledOffset
     // will point to the start of the misspelled word, and misspelledLength
     // will indicates its length. Otherwise, if there was not a spelling
-    // error, then upon return misspelledLength is 0.
-    virtual void spellCheck(
-        const WebString& text, int& misspelledOffset, int& misspelledLength) { }
+    // error, then upon return misspelledLength is 0. If optional_suggestions
+    // is given, then it will be filled with suggested words (not a cheap step).
+    virtual void spellCheck(const WebString& text,
+                            int& misspelledOffset,
+                            int& misspelledLength,
+                            WebVector<WebString>* optionalSuggestions) { }
     // Requests asynchronous spelling and grammar checking, whose result should be
     // returned by passed completion object.
     virtual void requestCheckingOfText(const WebString&, WebTextCheckingCompletion*) { }
diff --git a/Source/WebKit/chromium/public/WebStorageQuotaCallbacks.h b/Source/WebKit/chromium/public/WebStorageQuotaCallbacks.h
new file mode 100644
index 0000000..ee7dc5e
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebStorageQuotaCallbacks.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageQuotaCallbacks_h
+#define WebStorageQuotaCallbacks_h
+
+#include "WebStorageQuotaError.h"
+
+namespace WebKit {
+
+class WebStorageQuotaCallbacks {
+public:
+    // Callback for WebFrameClient::queryStorageUsageAndQuota.
+    virtual void didQueryStorageUsageAndQuota(unsigned long long usageInBytes, unsigned long long quotaInBytes) = 0;
+
+    // Callback for WebFrameClient::requestStorageQuota.
+    // This may return a smaller amount of quota than the requested.
+    virtual void didGrantStorageQuota(unsigned long long grantedQuotaInBytes) = 0;
+
+    virtual void didFail(WebStorageQuotaError) = 0;
+
+protected:
+    virtual ~WebStorageQuotaCallbacks() { }
+};
+
+} // namespace WebKit
+
+#endif // WebStorageQuotaCallbacks_h
diff --git a/Source/WebCore/thirdparty/glu/gluos.h b/Source/WebKit/chromium/public/WebStorageQuotaError.h
index 6380cb2..13e5c03 100644
--- a/Source/WebCore/thirdparty/glu/gluos.h
+++ b/Source/WebKit/chromium/public/WebStorageQuotaError.h
@@ -1,6 +1,5 @@
 /*
- * Copyright 2010, Google Inc.
- * All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,20 +28,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef GLUOS_H_
-#define GLUOS_H_
+#ifndef WebStorageQuotaError_h
+#define WebStorageQuotaError_h
 
-// This header provides the minimal definitions needed to compile the
-// GLU tessellator sources.
-#define GLAPIENTRY
+namespace WebKit {
 
-typedef unsigned char GLboolean;
-typedef double GLdouble;
-typedef unsigned int GLenum;
-typedef float GLfloat;
-typedef void GLvoid;
+// The error code used for WebStorageQuota.
+enum WebStorageQuotaError {
+    WebStorageQuotaErrorNotSupported = 9,
+    WebStorageQuotaErrorAbort = 20,
+};
 
-#undef MIN
-#undef MAX
+} // namespace WebKit
 
-#endif  // GLUOS_H_
+#endif // WebStorageQuotaError_h
diff --git a/Source/WebKit/chromium/public/WebStorageQuotaType.h b/Source/WebKit/chromium/public/WebStorageQuotaType.h
new file mode 100644
index 0000000..b18caf8
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebStorageQuotaType.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageQuotaType_h
+#define WebStorageQuotaType_h
+
+namespace WebKit {
+
+enum WebStorageQuotaType {
+    WebStorageQuotaTypeTemporary,
+    WebStorageQuotaTypePersistent,
+};
+
+} // namespace WebKit
+
+#endif // WebStorageQuotaType_h
diff --git a/Source/WebKit/chromium/public/WebURLLoader.h b/Source/WebKit/chromium/public/WebURLLoader.h
index 38efcb4..a47b986 100644
--- a/Source/WebKit/chromium/public/WebURLLoader.h
+++ b/Source/WebKit/chromium/public/WebURLLoader.h
@@ -41,21 +41,6 @@ class WebURLRequest;
 class WebURLResponse;
 struct WebURLError;
 
-enum WebCrossOriginRequestPolicy {
-    DenyCrossOriginRequests,
-    UseAccessControl,
-    AllowCrossOriginRequests
-};
-
-struct WebURLLoaderOptions {
-    WebURLLoaderOptions() : sniffContent(false), allowCredentials(false), forcePreflight(false), crossOriginRequestPolicy(DenyCrossOriginRequests) { }
-
-    bool sniffContent; // Whether to sniff content.
-    bool allowCredentials; // Whether to send HTTP credentials and cookies with the request.
-    bool forcePreflight; // If AccessControl is used, whether to force a preflight.
-    WebCrossOriginRequestPolicy crossOriginRequestPolicy;
-};
-
 class WebURLLoader {
 public:
     // The WebURLLoader may be deleted in a call to its client.
diff --git a/Source/WebKit/chromium/public/WebURLLoaderClient.h b/Source/WebKit/chromium/public/WebURLLoaderClient.h
index e306b19..20a3b44 100644
--- a/Source/WebKit/chromium/public/WebURLLoaderClient.h
+++ b/Source/WebKit/chromium/public/WebURLLoaderClient.h
@@ -58,11 +58,7 @@ public:
     virtual void didDownloadData(WebURLLoader*, int dataLength) { }
 
     // Called when a chunk of response data is received.
-    // FIXME(vsevik): rename once original didReceiveData() is removed.
-    virtual void didReceiveData2(WebURLLoader*, const char* data, int dataLength, int lengthReceived) { }
-
-    // FIXME(vsevik): remove once not used downstream
-    virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength) { }
+    virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength, int encodedDataLength) { }
 
     // Called when a chunk of renderer-generated metadata is received from the cache.
     virtual void didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength) { }
diff --git a/Source/WebKit/chromium/public/WebURLLoaderOptions.h b/Source/WebKit/chromium/public/WebURLLoaderOptions.h
new file mode 100644
index 0000000..bd10763
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebURLLoaderOptions.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebURLLoaderOptions_h
+#define WebURLLoaderOptions_h
+
+namespace WebKit {
+
+struct WebURLLoaderOptions {
+
+    enum CrossOriginRequestPolicy {
+        CrossOriginRequestPolicyDeny,
+        CrossOriginRequestPolicyUseAccessControl,
+        CrossOriginRequestPolicyAllow
+    };
+
+    WebURLLoaderOptions() : sniffContent(false), allowCredentials(false), forcePreflight(false), crossOriginRequestPolicy(CrossOriginRequestPolicyDeny) { }
+
+    bool sniffContent; // Whether to sniff content.
+    bool allowCredentials; // Whether to send HTTP credentials and cookies with the request.
+    bool forcePreflight; // If policy is to use access control, whether to force a preflight for GET, HEAD, and POST requests.
+    CrossOriginRequestPolicy crossOriginRequestPolicy;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebURLRequest.h b/Source/WebKit/chromium/public/WebURLRequest.h
index 7dd97ca..d88c7b9 100644
--- a/Source/WebKit/chromium/public/WebURLRequest.h
+++ b/Source/WebKit/chromium/public/WebURLRequest.h
@@ -69,6 +69,7 @@ public:
         TargetIsWorker = 9,
         TargetIsSharedWorker = 10,
         TargetIsPrefetch = 11,
+        TargetIsFavicon = 12,
     };
 
     ~WebURLRequest() { reset(); }
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index d32e09c..6b69e7c 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -230,10 +230,6 @@ public:
     // Callback methods when a drag-and-drop operation is trying to drop
     // something on the WebView.
     virtual WebDragOperation dragTargetDragEnter(
-        const WebDragData&, int identity, // FIXME: remove identity from this function signature.
-        const WebPoint& clientPoint, const WebPoint& screenPoint,
-        WebDragOperationsMask operationsAllowed) = 0;
-    virtual WebDragOperation dragTargetDragEnter(
         const WebDragData&,
         const WebPoint& clientPoint, const WebPoint& screenPoint,
         WebDragOperationsMask operationsAllowed) = 0;
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index c168ef2..5174351 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -122,6 +122,12 @@ public:
     // The icon is shown in a file upload control.
     virtual bool queryIconForFiles(const WebVector<WebString>& filenames, WebIconLoadingCompletion*) { return false; }
 
+    // This method enumerates all the files in the path. It returns immediately
+    // and asynchronously invokes the WebFileChooserCompletion with all the
+    // files in the directory. Returns false if the WebFileChooserCompletion
+    // will never be called.
+    virtual bool enumerateChosenDirectory(const WebString& path, WebFileChooserCompletion*) { return false; }
+
 
     // Navigational --------------------------------------------------------
 
diff --git a/Source/WebKit/chromium/public/WebWidget.h b/Source/WebKit/chromium/public/WebWidget.h
index 36fbf31..1290ad8 100644
--- a/Source/WebKit/chromium/public/WebWidget.h
+++ b/Source/WebKit/chromium/public/WebWidget.h
@@ -41,6 +41,7 @@ namespace WebKit {
 
 class WebInputEvent;
 class WebString;
+struct WebPoint;
 struct WebRect;
 struct WebSize;
 template <typename T> class WebVector;
@@ -126,6 +127,10 @@ public:
     // will be returned if a selection range is available.
     virtual WebRect caretOrSelectionBounds() = 0;
 
+    // Returns the start and end point for the current selection, aligned to the
+    // bottom of the selected line.
+    virtual bool selectionRange(WebPoint& start, WebPoint& end) const = 0;
+
     // Changes the text direction of the selected input node.
     virtual void setTextDirection(WebTextDirection) = 0;
 
diff --git a/Source/WebKit/chromium/scripts/inline_js_imports.py b/Source/WebKit/chromium/scripts/inline_js_imports.py
new file mode 100644
index 0000000..2655016
--- /dev/null
+++ b/Source/WebKit/chromium/scripts/inline_js_imports.py
@@ -0,0 +1,82 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#         * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#         * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#         * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+# This script replaces calls to importScripts with script sources
+# in input script file and dumps result into output script file.
+
+from cStringIO import StringIO
+
+import jsmin
+import os.path
+import re
+import sys
+
+
+def main(argv):
+
+    if len(argv) < 3:
+        print('usage: %s input_file imports_dir output_file' % argv[0])
+        return 1
+
+    input_file_name = argv[1]
+    imports_dir = argv[2]
+    output_file_name = argv[3]
+
+    input_file = open(input_file_name, 'r')
+    input_script = input_file.read()
+    input_file.close()
+
+    def replace(match):
+        import_file_name = match.group(1)
+        full_path = os.path.join(imports_dir, import_file_name)
+        if not os.access(full_path, os.F_OK):
+            raise Exception('File %s referenced in %s not found on any source paths, '
+                            'check source tree for consistency' %
+                            (import_file_name, input_file_name))
+        import_file = open(full_path, 'r')
+        import_script = import_file.read()
+        import_file.close()
+        return import_script
+
+    output_script = re.sub(r'importScripts\([\'"]([^\'"]+)[\'"]\)', replace, input_script)
+
+    output_file = open(output_file_name, 'w')
+    output_file.write(jsmin.jsmin(output_script))
+    output_file.close()
+
+    # Touch output file directory to make sure that Xcode will copy
+    # modified resource files.
+    if sys.platform == 'darwin':
+        output_dir_name = os.path.dirname(output_file_name)
+        os.utime(output_dir_name, None)
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 7baaf8a..533e8ec 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -38,6 +38,7 @@
 #include "AsyncFileSystem.h"
 #include "DocumentMarker.h"
 #include "EditorInsertAction.h"
+#include "ExceptionCode.h"
 #include "FileError.h"
 #include "FileMetadata.h"
 #include "FontDescription.h"
@@ -52,6 +53,7 @@
 #include "PasteboardPrivate.h"
 #include "PlatformCursor.h"
 #include "Settings.h"
+#include "StorageInfo.h"
 #include "TextAffinity.h"
 #include "UserContentTypes.h"
 #include "UserScriptTypes.h"
@@ -75,6 +77,8 @@
 #include "WebNotificationPresenter.h"
 #include "WebScrollbar.h"
 #include "WebSettings.h"
+#include "WebStorageQuotaError.h"
+#include "WebStorageQuotaType.h"
 #include "WebTextAffinity.h"
 #include "WebTextCaseSensitivity.h"
 #include "WebTextCheckingResult.h"
@@ -390,6 +394,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebIDBFactory::LevelDBBackingStore, IDBFactoryBacke
 #if ENABLE(FILE_SYSTEM)
 COMPILE_ASSERT_MATCHING_ENUM(WebFileSystem::TypeTemporary, AsyncFileSystem::Temporary);
 COMPILE_ASSERT_MATCHING_ENUM(WebFileSystem::TypePersistent, AsyncFileSystem::Persistent);
+COMPILE_ASSERT_MATCHING_ENUM(WebFileSystem::TypeExternal, AsyncFileSystem::External);
 COMPILE_ASSERT_MATCHING_ENUM(WebFileInfo::TypeUnknown, FileMetadata::TypeUnknown);
 COMPILE_ASSERT_MATCHING_ENUM(WebFileInfo::TypeFile, FileMetadata::TypeFile);
 COMPILE_ASSERT_MATCHING_ENUM(WebFileInfo::TypeDirectory, FileMetadata::TypeDirectory);
@@ -414,6 +419,17 @@ COMPILE_ASSERT_MATCHING_ENUM(WebGeolocationError::ErrorPositionUnavailable, Geol
 COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingResult::ErrorSpelling, DocumentMarker::Spelling);
 COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingResult::ErrorGrammar, DocumentMarker::Grammar);
 
+#if ENABLE(QUOTA)
+COMPILE_ASSERT_MATCHING_ENUM(WebStorageQuotaErrorNotSupported, NOT_SUPPORTED_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebStorageQuotaErrorAbort, ABORT_ERR);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebStorageQuotaTypeTemporary, StorageInfo::TEMPORARY);
+COMPILE_ASSERT_MATCHING_ENUM(WebStorageQuotaTypePersistent, StorageInfo::PERSISTENT);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebStorageQuotaErrorNotSupported, NOT_SUPPORTED_ERR);
+COMPILE_ASSERT_MATCHING_ENUM(WebStorageQuotaErrorAbort, ABORT_ERR);
+#endif
+
 #if OS(DARWIN)
 COMPILE_ASSERT_MATCHING_ENUM(WebThemeEngine::StateDisabled, PlatformBridge::StateDisabled);
 COMPILE_ASSERT_MATCHING_ENUM(WebThemeEngine::StateInactive, PlatformBridge::StateInactive);
diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
index 1ca9900..acb7687 100644
--- a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
@@ -124,17 +124,16 @@ void AssociatedURLLoader::ClientAdapter::didReceiveData(const char* data, int da
     if (!m_client)
         return;
 
-    // FIXME(vsevik): add -1 to params once migrated.
-    m_client->didReceiveData(m_loader, data, dataLength);
+    m_client->didReceiveData(m_loader, data, dataLength, -1);
     m_downloadLength += dataLength;
 }
 
-void AssociatedURLLoader::ClientAdapter::didReceiveCachedMetadata(const char* data, int lengthReceived)
+void AssociatedURLLoader::ClientAdapter::didReceiveCachedMetadata(const char* data, int dataLength)
 {
     if (!m_client)
         return;
 
-    m_client->didReceiveCachedMetadata(m_loader, data, lengthReceived);
+    m_client->didReceiveCachedMetadata(m_loader, data, dataLength);
 }
 
 void AssociatedURLLoader::ClientAdapter::didFinishLoading(unsigned long identifier, double finishTime)
@@ -169,7 +168,7 @@ AssociatedURLLoader::AssociatedURLLoader(PassRefPtr<WebFrameImpl> frameImpl)
     m_options.sniffContent = false;
     m_options.allowCredentials = true;
     m_options.forcePreflight = false;
-    m_options.crossOriginRequestPolicy = AllowCrossOriginRequests; // TODO(bbudge) Default should be DenyCrossOriginRequests, but this would break some tests.
+    m_options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPolicyAllow; // FIXME We should deny by default, but this would break some tests.
 }
 
 AssociatedURLLoader::AssociatedURLLoader(PassRefPtr<WebFrameImpl> frameImpl, const WebURLLoaderOptions& options)
@@ -189,9 +188,9 @@ AssociatedURLLoader::~AssociatedURLLoader()
 #define COMPILE_ASSERT_MATCHING_ENUM(webkit_name, webcore_name) \
     COMPILE_ASSERT(static_cast<int>(WebKit::webkit_name) == static_cast<int>(WebCore::webcore_name), mismatching_enums)
 
-COMPILE_ASSERT_MATCHING_ENUM(DenyCrossOriginRequests, DenyCrossOriginRequests);
-COMPILE_ASSERT_MATCHING_ENUM(UseAccessControl, UseAccessControl);
-COMPILE_ASSERT_MATCHING_ENUM(AllowCrossOriginRequests, AllowCrossOriginRequests);
+COMPILE_ASSERT_MATCHING_ENUM(WebURLLoaderOptions::CrossOriginRequestPolicyDeny, DenyCrossOriginRequests);
+COMPILE_ASSERT_MATCHING_ENUM(WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl, UseAccessControl);
+COMPILE_ASSERT_MATCHING_ENUM(WebURLLoaderOptions::CrossOriginRequestPolicyAllow, AllowCrossOriginRequests);
 
 void AssociatedURLLoader::loadSynchronously(const WebURLRequest& request, WebURLResponse& response, WebURLError& error, WebData& data)
 {
diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.h b/Source/WebKit/chromium/src/AssociatedURLLoader.h
index ed183e5..9458986 100644
--- a/Source/WebKit/chromium/src/AssociatedURLLoader.h
+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.h
@@ -32,6 +32,7 @@
 #define AssociatedURLLoader_h
 
 #include "WebURLLoader.h"
+#include "WebURLLoaderOptions.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index 99302cc..f12bf03 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -54,6 +54,7 @@
 #include "Node.h"
 #include "NotificationPresenterImpl.h"
 #include "Page.h"
+#include "PlatformBridge.h"
 #include "PopupMenuChromium.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
@@ -682,6 +683,22 @@ void ChromeClientImpl::chooseIconForFiles(const Vector<String>& filenames, FileC
         iconCompletion->didLoadIcon(WebData());
 }
 
+#if ENABLE(DIRECTORY_UPLOAD)
+void ChromeClientImpl::enumerateChosenDirectory(const String& path, FileChooser* fileChooser)
+{
+    WebViewClient* client = m_webView->client();
+    if (!client)
+        return;
+
+    WebFileChooserCompletionImpl* chooserCompletion =
+        new WebFileChooserCompletionImpl(fileChooser);
+
+    // If the enumeration can't happen, call the callback with an empty list.
+    if (!client->enumerateChosenDirectory(path, chooserCompletion))
+        chooserCompletion->didChooseFile(WebVector<WebString>());
+}
+#endif
+
 void ChromeClientImpl::popupOpened(PopupContainer* popupContainer,
                                    const IntRect& bounds,
                                    bool handleExternally)
@@ -905,4 +922,9 @@ PassRefPtr<SearchPopupMenu> ChromeClientImpl::createSearchPopupMenu(PopupMenuCli
     return adoptRef(new SearchPopupMenuChromium(client));
 }
 
+void ChromeClientImpl::willRunModalDialogDuringPageDismissal(const DialogType& dialogType) const
+{
+    PlatformBridge::histogramEnumeration("Renderer.ModalDialogsDuringPageDismissal", static_cast<int>(dialogType), static_cast<int>(NumDialogTypes));
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index f3a48ee..6a65522 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -139,6 +139,9 @@ public:
     virtual void cancelGeolocationPermissionRequestForFrame(WebCore::Frame*, WebCore::Geolocation*);
     virtual void runOpenPanel(WebCore::Frame*, PassRefPtr<WebCore::FileChooser>);
     virtual void chooseIconForFiles(const Vector<WTF::String>&, WebCore::FileChooser*);
+#if ENABLE(DIRECTORY_UPLOAD)
+    virtual void enumerateChosenDirectory(const WTF::String&, WebCore::FileChooser*);
+#endif
     virtual void setCursor(const WebCore::Cursor&);
     virtual void formStateDidChange(const WebCore::Node*);
 #if ENABLE(TOUCH_EVENTS)
@@ -191,6 +194,8 @@ public:
     virtual void showContextMenu() { }
 #endif
 
+    virtual void willRunModalDialogDuringPageDismissal(const DialogType&) const;
+
 private:
     void getPopupMenuInfo(WebCore::PopupContainer*, WebPopupMenuInfo*);
     void setCursor(const WebCursorInfo&);
diff --git a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
index 9c137c9..0f82d38 100644
--- a/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -61,6 +61,7 @@
 #include "WebPlugin.h"
 #include "WebPluginContainerImpl.h"
 #include "WebPoint.h"
+#include "WebSpellCheckClient.h"
 #include "WebString.h"
 #include "WebURL.h"
 #include "WebURLResponse.h"
@@ -206,7 +207,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         if (mediaElement->hasVideo())
             data.mediaFlags |= WebContextMenuData::MediaHasVideo;
         if (mediaElement->controls())
-            data.mediaFlags |= WebContextMenuData::MediaControls;
+            data.mediaFlags |= WebContextMenuData::MediaControlRootElement;
     } else if (r.innerNonSharedNode()->hasTagName(HTMLNames::objectTag)
                || r.innerNonSharedNode()->hasTagName(HTMLNames::embedTag)) {
         RenderObject* object = r.innerNonSharedNode()->renderer();
@@ -256,8 +257,17 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         if (m_webView->focusedWebCoreFrame()->editor()->isContinuousSpellCheckingEnabled()) {
             data.isSpellCheckingEnabled = true;
             // Spellchecking might be enabled for the field, but could be disabled on the node.
-            if (m_webView->focusedWebCoreFrame()->editor()->isSpellCheckingEnabledInFocusedNode())
+            if (m_webView->focusedWebCoreFrame()->editor()->isSpellCheckingEnabledInFocusedNode()) {
                 data.misspelledWord = selectMisspelledWord(defaultMenu, selectedFrame);
+                if (m_webView->spellCheckClient()) {
+                    int misspelledOffset, misspelledLength;
+                    m_webView->spellCheckClient()->spellCheck(
+                        data.misspelledWord, misspelledOffset, misspelledLength,
+                        &data.dictionarySuggestions);
+                    if (!misspelledLength)
+                        data.misspelledWord.reset();
+                }
+            }
         }
     }
 
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.cpp b/Source/WebKit/chromium/src/EditorClientImpl.cpp
index 6f2231d..1141ea4 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/EditorClientImpl.cpp
@@ -858,7 +858,7 @@ void EditorClientImpl::checkSpellingOfString(const UChar* text, int length,
 
     // Check to see if the provided text is spelled correctly.
     if (isContinuousSpellCheckingEnabled() && m_webView->spellCheckClient())
-        m_webView->spellCheckClient()->spellCheck(WebString(text, length), spellLocation, spellLength);
+        m_webView->spellCheckClient()->spellCheck(WebString(text, length), spellLocation, spellLength, 0);
     else {
         spellLocation = 0;
         spellLength = 0;
@@ -872,7 +872,7 @@ void EditorClientImpl::checkSpellingOfString(const UChar* text, int length,
         *misspellingLength = spellLength;
 }
 
-void EditorClientImpl::requestCheckingOfString(SpellChecker* sender, int identifier, const String& text)
+void EditorClientImpl::requestCheckingOfString(SpellChecker* sender, int identifier, TextCheckingTypeMask, const String& text)
 {
     if (m_webView->spellCheckClient())
         m_webView->spellCheckClient()->requestCheckingOfText(text, new WebTextCheckingCompletionImpl(identifier, sender));
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.h b/Source/WebKit/chromium/src/EditorClientImpl.h
index b81fb56..2ebc6ea 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.h
+++ b/Source/WebKit/chromium/src/EditorClientImpl.h
@@ -114,7 +114,7 @@ public:
                                    WTF::Vector<WTF::String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&);
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&);
 
     virtual WebCore::TextCheckerClient* textChecker() { return this; }
 
diff --git a/Source/WebKit/chromium/src/EventListenerWrapper.cpp b/Source/WebKit/chromium/src/EventListenerWrapper.cpp
index 6360932..b352d81 100644
--- a/Source/WebKit/chromium/src/EventListenerWrapper.cpp
+++ b/Source/WebKit/chromium/src/EventListenerWrapper.cpp
@@ -37,6 +37,8 @@
 #include "WebDOMEvent.h"
 #include "WebDOMEventListener.h"
 
+using namespace WebCore;
+
 namespace WebKit {
 
 EventListenerWrapper::EventListenerWrapper(WebDOMEventListener* webDOMEventListener)
diff --git a/Source/WebKit/chromium/src/EventListenerWrapper.h b/Source/WebKit/chromium/src/EventListenerWrapper.h
index 75b6a95..83e1cf1 100644
--- a/Source/WebKit/chromium/src/EventListenerWrapper.h
+++ b/Source/WebKit/chromium/src/EventListenerWrapper.h
@@ -37,21 +37,19 @@ namespace WebCore {
 class ScriptExecutionContext;
 }
 
-using namespace WebCore;
-
 namespace WebKit {
 
 class WebDOMEventListener;
 
 // FIXME: Remove the DeprecatedEventListenerWrapper class below once Chromium
 // switched to using WebDOMEvent.
-class EventListenerWrapper : public EventListener {
+class EventListenerWrapper : public WebCore::EventListener {
 public:
     EventListenerWrapper(WebDOMEventListener*);
     ~EventListenerWrapper();
 
-    virtual bool operator==(const EventListener&);
-    virtual void handleEvent(ScriptExecutionContext*, Event*);
+    virtual bool operator==(const WebCore::EventListener&);
+    virtual void handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*);
 
     void webDOMEventListenerDeleted();
 
diff --git a/Source/WebKit/chromium/src/Extensions3DChromium.cpp b/Source/WebKit/chromium/src/Extensions3DChromium.cpp
index 30101c7..81fa520 100644
--- a/Source/WebKit/chromium/src/Extensions3DChromium.cpp
+++ b/Source/WebKit/chromium/src/Extensions3DChromium.cpp
@@ -57,6 +57,11 @@ void Extensions3DChromium::ensureEnabled(const String& name)
     ASSERT(result);
 }
 
+bool Extensions3DChromium::isEnabled(const String& name)
+{
+    return m_internal->isExtensionEnabled(name);
+}
+
 int Extensions3DChromium::getGraphicsResetStatusARB()
 {
     return m_internal->isContextLost() ? static_cast<int>(Extensions3D::UNKNOWN_CONTEXT_RESET_ARB) : static_cast<int>(GraphicsContext3D::NO_ERROR);
@@ -97,6 +102,26 @@ void Extensions3DChromium::copyTextureToParentTextureCHROMIUM(unsigned texture,
     m_internal->copyTextureToParentTextureCHROMIUM(texture, parentTexture);
 }
 
+void Extensions3DChromium::getParentToChildLatchCHROMIUM(GC3Duint* latchId)
+{
+    m_internal->getParentToChildLatchCHROMIUM(latchId);
+}
+
+void Extensions3DChromium::getChildToParentLatchCHROMIUM(GC3Duint* latchId)
+{
+    m_internal->getChildToParentLatchCHROMIUM(latchId);
+}
+
+void Extensions3DChromium::waitLatchCHROMIUM(GC3Duint latchId)
+{
+    m_internal->waitLatchCHROMIUM(latchId);
+}
+
+void Extensions3DChromium::setLatchCHROMIUM(GC3Duint latchId)
+{
+    m_internal->setLatchCHROMIUM(latchId);
+}
+
 Platform3DObject Extensions3DChromium::createVertexArrayOES()
 {
     return 0;
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index 647a70c..d640b65 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -380,7 +380,7 @@ void FrameLoaderClientImpl::dispatchDidReceiveResponse(DocumentLoader* loader,
 void FrameLoaderClientImpl::dispatchDidReceiveContentLength(
     DocumentLoader* loader,
     unsigned long identifier,
-    int lengthReceived)
+    int dataLength)
 {
 }
 
@@ -714,10 +714,18 @@ void FrameLoaderClientImpl::dispatchDidStartProvisionalLoad()
         // m_expectedClientRedirectDest could be something like
         // "javascript:history.go(-1)" thus we need to exclude url starts with
         // "javascript:". See bug: 1080873
-        ASSERT(m_expectedClientRedirectDest.protocolIs("javascript")
-            || m_expectedClientRedirectDest == url);
-        ds->appendRedirect(m_expectedClientRedirectSrc);
-        completingClientRedirect = true;
+        if (m_expectedClientRedirectDest.protocolIs("javascript")
+            || m_expectedClientRedirectDest == url) {
+            ds->appendRedirect(m_expectedClientRedirectSrc);
+            completingClientRedirect = true;
+        } else {
+            // Any pending redirect is no longer in progress. This can happen
+            // if the navigation was canceled with PolicyIgnore, or if the
+            // redirect was scheduled on the wrong frame (e.g., due to a form
+            // submission targeted to _blank, as in http://webkit.org/b/44079).
+            m_expectedClientRedirectSrc = KURL();
+            m_expectedClientRedirectDest = KURL();
+        }
     }
     ds->appendRedirect(url);
 
@@ -734,10 +742,10 @@ void FrameLoaderClientImpl::dispatchDidStartProvisionalLoad()
     }
 }
 
-void FrameLoaderClientImpl::dispatchDidReceiveTitle(const String& title)
+void FrameLoaderClientImpl::dispatchDidReceiveTitle(const StringWithDirection& title)
 {
     if (m_webFrame->client())
-        m_webFrame->client()->didReceiveTitle(m_webFrame, title);
+        m_webFrame->client()->didReceiveTitle(m_webFrame, title.string(), title.direction() == LTR ? WebTextDirectionLeftToRight : WebTextDirectionRightToLeft);
 }
 
 void FrameLoaderClientImpl::dispatchDidChangeIcons()
@@ -1328,7 +1336,7 @@ PassRefPtr<DocumentLoader> FrameLoaderClientImpl::createDocumentLoader(
     return ds.release();
 }
 
-void FrameLoaderClientImpl::setTitle(const String& title, const KURL& url)
+void FrameLoaderClientImpl::setTitle(const StringWithDirection& title, const KURL& url)
 {
     // FIXME: inform consumer of changes to the title.
 }
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
index f19c26c..042b462 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.h
@@ -88,7 +88,7 @@ public:
     virtual void dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::AuthenticationChallenge&);
     virtual void dispatchDidCancelAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::AuthenticationChallenge&);
     virtual void dispatchDidReceiveResponse(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceResponse&);
-    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived);
+    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int dataLength);
     virtual void dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long identifier);
     virtual void dispatchDidFailLoading(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceError&);
     virtual bool dispatchDidLoadResourceFromMemoryCache(WebCore::DocumentLoader*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&, int length);
@@ -104,7 +104,7 @@ public:
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
-    virtual void dispatchDidReceiveTitle(const WTF::String& title);
+    virtual void dispatchDidReceiveTitle(const WebCore::StringWithDirection&);
     virtual void dispatchDidChangeIcons();
     virtual void dispatchDidCommitLoad();
     virtual void dispatchDidFailProvisionalLoad(const WebCore::ResourceError&);
@@ -166,7 +166,7 @@ public:
     virtual void prepareForDataSourceReplacement();
     virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(
         const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
-    virtual void setTitle(const WTF::String& title, const WebCore::KURL&);
+    virtual void setTitle(const WebCore::StringWithDirection&, const WebCore::KURL&);
     virtual WTF::String userAgent(const WebCore::KURL&);
     virtual void savePlatformDataToCachedFrame(WebCore::CachedFrame*);
     virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index 54c18e3..611103c 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
+++ b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -54,7 +54,7 @@
 #include <wtf/FastMalloc.h>
 #include <wtf/text/CString.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include "GraphicsContext.h"
 #include "WebGLRenderingContext.h"
 #include <CoreGraphics/CGContext.h>
@@ -84,7 +84,7 @@ GraphicsContext3DInternal::GraphicsContext3DInternal()
     , m_initializedAvailableExtensions(false)
     , m_layerComposited(false)
 #if USE(SKIA)
-#elif PLATFORM(CG)
+#elif USE(CG)
     , m_renderOutput(0)
 #else
 #error Must port to your platform
@@ -94,7 +94,7 @@ GraphicsContext3DInternal::GraphicsContext3DInternal()
 
 GraphicsContext3DInternal::~GraphicsContext3DInternal()
 {
-#if PLATFORM(CG)
+#if USE(CG)
     if (m_renderOutput)
         delete[] m_renderOutput;
 #endif
@@ -210,7 +210,7 @@ void GraphicsContext3DInternal::paintRenderingResultsToCanvas(CanvasRenderingCon
     // Read back the frame buffer.
     SkAutoLockPixels bitmapLock(*readbackBitmap);
     pixels = static_cast<unsigned char*>(readbackBitmap->getPixels());
-#elif PLATFORM(CG)
+#elif USE(CG)
     if (m_renderOutput)
         pixels = m_renderOutput;
 #else
@@ -230,6 +230,7 @@ void GraphicsContext3DInternal::paintRenderingResultsToCanvas(CanvasRenderingCon
     }
 
 #if USE(SKIA)
+    readbackBitmap->notifyPixelsChanged();
     if (m_resizingBitmap.readyToDraw()) {
         // We need to draw the resizing bitmap into the canvas's backing store.
         SkCanvas canvas(*canvasBitmap);
@@ -237,7 +238,7 @@ void GraphicsContext3DInternal::paintRenderingResultsToCanvas(CanvasRenderingCon
         dst.set(SkIntToScalar(0), SkIntToScalar(0), SkIntToScalar(canvasBitmap->width()), SkIntToScalar(canvasBitmap->height()));
         canvas.drawBitmapRect(m_resizingBitmap, 0, dst);
     }
-#elif PLATFORM(CG)
+#elif USE(CG)
     if (m_renderOutput && context->is3d()) {
         WebGLRenderingContext* webGLContext = static_cast<WebGLRenderingContext*>(context);
         webGLContext->graphicsContext3D()->paintToCanvas(m_renderOutput, m_impl->width(), m_impl->height(), canvas->width(), canvas->height(), imageBuffer->context()->platformContext());
@@ -277,7 +278,7 @@ void GraphicsContext3DInternal::reshape(int width, int height)
 
     m_impl->reshape(width, height);
 
-#if PLATFORM(CG)
+#if USE(CG)
     // Need to reallocate the client-side backing store.
     // FIXME: make this more efficient.
     if (m_renderOutput) {
@@ -286,7 +287,7 @@ void GraphicsContext3DInternal::reshape(int width, int height)
     }
     int rowBytes = width * 4;
     m_renderOutput = new unsigned char[height * rowBytes];
-#endif // PLATFORM(CG)
+#endif // USE(CG)
 }
 
 IntSize GraphicsContext3DInternal::getInternalFramebufferSize()
@@ -793,6 +794,13 @@ bool GraphicsContext3DInternal::ensureExtensionEnabled(const String& name)
     return m_enabledExtensions.contains(mappedName);
 }
 
+bool GraphicsContext3DInternal::isExtensionEnabled(const String& name)
+{
+    initializeExtensions();
+    String mappedName = mapExtensionName(name);
+    return m_enabledExtensions.contains(mappedName);
+}
+
 DELEGATE_TO_IMPL_4R(mapBufferSubDataCHROMIUM, GC3Denum, GC3Dsizeiptr, GC3Dsizei, GC3Denum, void*)
 DELEGATE_TO_IMPL_1(unmapBufferSubDataCHROMIUM, const void*)
 DELEGATE_TO_IMPL_9R(mapTexSubImage2DCHROMIUM, GC3Denum, GC3Dint, GC3Dint, GC3Dint, GC3Dsizei, GC3Dsizei, GC3Denum, GC3Denum, GC3Denum, void*)
@@ -800,6 +808,10 @@ DELEGATE_TO_IMPL_1(unmapTexSubImage2DCHROMIUM, const void*)
 DELEGATE_TO_IMPL_2(copyTextureToParentTextureCHROMIUM, Platform3DObject, Platform3DObject)
 DELEGATE_TO_IMPL_10(blitFramebufferCHROMIUM, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dint, GC3Dbitfield, GC3Denum)
 DELEGATE_TO_IMPL_5(renderbufferStorageMultisampleCHROMIUM, GC3Denum, GC3Dsizei, GC3Denum, GC3Dsizei, GC3Dsizei)
+DELEGATE_TO_IMPL_1(getParentToChildLatchCHROMIUM, GC3Duint*)
+DELEGATE_TO_IMPL_1(getChildToParentLatchCHROMIUM, GC3Duint*)
+DELEGATE_TO_IMPL_1(waitLatchCHROMIUM, GC3Duint)
+DELEGATE_TO_IMPL_1(setLatchCHROMIUM, GC3Duint)
 
 //----------------------------------------------------------------------
 // GraphicsContext3D
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DInternal.h b/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
index 0af291e..c02491c 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
+++ b/Source/WebKit/chromium/src/GraphicsContext3DInternal.h
@@ -251,6 +251,7 @@ public:
     Extensions3D* getExtensions();
     bool supportsExtension(const String& name);
     bool ensureExtensionEnabled(const String& name);
+    bool isExtensionEnabled(const String& name);
 
     // EXT_texture_format_BGRA8888
     bool supportsBGRA();
@@ -270,6 +271,12 @@ public:
     void blitFramebufferCHROMIUM(GC3Dint srcX0, GC3Dint srcY0, GC3Dint srcX1, GC3Dint srcY1, GC3Dint dstX0, GC3Dint dstY0, GC3Dint dstX1, GC3Dint dstY1, GC3Dbitfield mask, GC3Denum filter);
     void renderbufferStorageMultisampleCHROMIUM(GC3Denum target, GC3Dsizei samples, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height);
 
+    // Latch support
+    void getParentToChildLatchCHROMIUM(GC3Duint* latchId);
+    void getChildToParentLatchCHROMIUM(GC3Duint* latchId);
+    void waitLatchCHROMIUM(GC3Duint latchId);
+    void setLatchCHROMIUM(GC3Duint latchId);
+
 private:
     OwnPtr<WebKit::WebGraphicsContext3D> m_impl;
     OwnPtr<Extensions3DChromium> m_extensions;
@@ -291,7 +298,7 @@ private:
     SkBitmap m_resizingBitmap;
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG)
     unsigned char* m_renderOutput;
 #endif
 
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
index 727092a..c536c38 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,8 +29,10 @@
 #include "config.h"
 #include "IDBCallbacksProxy.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBDatabaseBackendProxy.h"
 #include "IDBDatabaseError.h"
-#include "IDBDatabaseProxy.h"
 #include "WebIDBCallbacks.h"
 #include "WebIDBCursorImpl.h"
 #include "WebIDBDatabaseImpl.h"
@@ -39,16 +41,16 @@
 #include "WebIDBTransactionImpl.h"
 #include "WebSerializedScriptValue.h"
 
-#if ENABLE(INDEXED_DATABASE)
+using namespace WebCore;
 
-namespace WebCore {
+namespace WebKit {
 
-PassRefPtr<IDBCallbacksProxy> IDBCallbacksProxy::create(PassOwnPtr<WebKit::WebIDBCallbacks> callbacks)
+PassRefPtr<IDBCallbacksProxy> IDBCallbacksProxy::create(PassOwnPtr<WebIDBCallbacks> callbacks)
 {
     return adoptRef(new IDBCallbacksProxy(callbacks));
 }
 
-IDBCallbacksProxy::IDBCallbacksProxy(PassOwnPtr<WebKit::WebIDBCallbacks> callbacks)
+IDBCallbacksProxy::IDBCallbacksProxy(PassOwnPtr<WebIDBCallbacks> callbacks)
     : m_callbacks(callbacks)
 {
 }
@@ -59,32 +61,32 @@ IDBCallbacksProxy::~IDBCallbacksProxy()
 
 void IDBCallbacksProxy::onError(PassRefPtr<IDBDatabaseError> idbDatabaseError)
 {
-    m_callbacks->onError(WebKit::WebIDBDatabaseError(idbDatabaseError));
+    m_callbacks->onError(WebIDBDatabaseError(idbDatabaseError));
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBCursorBackendInterface> idbCursorBackend)
 {
-    m_callbacks->onSuccess(new WebKit::WebIDBCursorImpl(idbCursorBackend));
+    m_callbacks->onSuccess(new WebIDBCursorImpl(idbCursorBackend));
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 {
-    m_callbacks->onSuccess(new WebKit::WebIDBDatabaseImpl(backend));
+    m_callbacks->onSuccess(new WebIDBDatabaseImpl(backend));
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
-    m_callbacks->onSuccess(WebKit::WebIDBKey(idbKey));
+    m_callbacks->onSuccess(WebIDBKey(idbKey));
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBTransactionBackendInterface> backend)
 {
-    m_callbacks->onSuccess(new WebKit::WebIDBTransactionImpl(backend));
+    m_callbacks->onSuccess(new WebIDBTransactionImpl(backend));
 }
 
 void IDBCallbacksProxy::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
-    m_callbacks->onSuccess(WebKit::WebSerializedScriptValue(serializedScriptValue));
+    m_callbacks->onSuccess(WebSerializedScriptValue(serializedScriptValue));
 }
 
 void IDBCallbacksProxy::onBlocked()
@@ -92,6 +94,6 @@ void IDBCallbacksProxy::onBlocked()
     m_callbacks->onBlocked();
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBCallbacksProxy.h b/Source/WebKit/chromium/src/IDBCallbacksProxy.h
index 6829845..e9f45ff 100644
--- a/Source/WebKit/chromium/src/IDBCallbacksProxy.h
+++ b/Source/WebKit/chromium/src/IDBCallbacksProxy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,40 +29,37 @@
 #ifndef IDBCallbacksProxy_h
 #define IDBCallbacksProxy_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "IDBCallbacks.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
-#if ENABLE(INDEXED_DATABASE)
-
 namespace WebKit {
-class WebIDBCallbacks;
-}
 
-namespace WebCore {
+class WebIDBCallbacks;
 
-class IDBCallbacksProxy : public IDBCallbacks {
+class IDBCallbacksProxy : public WebCore::IDBCallbacks {
 public:
-    static PassRefPtr<IDBCallbacksProxy> create(PassOwnPtr<WebKit::WebIDBCallbacks>);
+    static PassRefPtr<IDBCallbacksProxy> create(PassOwnPtr<WebIDBCallbacks>);
     virtual ~IDBCallbacksProxy();
 
-    virtual void onError(PassRefPtr<IDBDatabaseError>);
-    virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>);
-    virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>);
-    virtual void onSuccess(PassRefPtr<IDBKey>);
-    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
-    virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
+    virtual void onError(PassRefPtr<WebCore::IDBDatabaseError>);
+    virtual void onSuccess(PassRefPtr<WebCore::IDBCursorBackendInterface>);
+    virtual void onSuccess(PassRefPtr<WebCore::IDBDatabaseBackendInterface>);
+    virtual void onSuccess(PassRefPtr<WebCore::IDBKey>);
+    virtual void onSuccess(PassRefPtr<WebCore::IDBTransactionBackendInterface>);
+    virtual void onSuccess(PassRefPtr<WebCore::SerializedScriptValue>);
     virtual void onBlocked();
 
 private:
-    IDBCallbacksProxy(PassOwnPtr<WebKit::WebIDBCallbacks>);
+    IDBCallbacksProxy(PassOwnPtr<WebIDBCallbacks>);
 
-    OwnPtr<WebKit::WebIDBCallbacks> m_callbacks;
+    OwnPtr<WebIDBCallbacks> m_callbacks;
 };
 
-
-} // namespace WebCore
+} // namespace WebKit
 
 #endif
 
diff --git a/Source/WebKit/chromium/src/IDBCursorBackendProxy.cpp b/Source/WebKit/chromium/src/IDBCursorBackendProxy.cpp
index b3b9ea7..7dab6a2 100644
--- a/Source/WebKit/chromium/src/IDBCursorBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBCursorBackendProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,14 +36,16 @@
 #include "WebIDBKey.h"
 #include "WebSerializedScriptValue.h"
 
-namespace WebCore {
+using namespace WebCore;
 
-PassRefPtr<IDBCursorBackendInterface> IDBCursorBackendProxy::create(PassOwnPtr<WebKit::WebIDBCursor> idbCursor)
+namespace WebKit {
+
+PassRefPtr<IDBCursorBackendInterface> IDBCursorBackendProxy::create(PassOwnPtr<WebIDBCursor> idbCursor)
 {
     return adoptRef(new IDBCursorBackendProxy(idbCursor));
 }
 
-IDBCursorBackendProxy::IDBCursorBackendProxy(PassOwnPtr<WebKit::WebIDBCursor> idbCursor)
+IDBCursorBackendProxy::IDBCursorBackendProxy(PassOwnPtr<WebIDBCursor> idbCursor)
     : m_idbCursor(idbCursor)
 {
 }
@@ -87,6 +89,6 @@ void IDBCursorBackendProxy::deleteFunction(PassRefPtr<IDBCallbacks> callbacks, E
     m_idbCursor->deleteFunction(new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBCursorBackendProxy.h b/Source/WebKit/chromium/src/IDBCursorBackendProxy.h
index 0c2e1c7..d725360 100644
--- a/Source/WebKit/chromium/src/IDBCursorBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBCursorBackendProxy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,28 +35,28 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
-namespace WebCore {
+namespace WebKit {
 
-class IDBCursorBackendProxy : public IDBCursorBackendInterface {
+class IDBCursorBackendProxy : public WebCore::IDBCursorBackendInterface {
 public:
-    static PassRefPtr<IDBCursorBackendInterface> create(PassOwnPtr<WebKit::WebIDBCursor>);
+    static PassRefPtr<WebCore::IDBCursorBackendInterface> create(PassOwnPtr<WebIDBCursor>);
     virtual ~IDBCursorBackendProxy();
 
     virtual unsigned short direction() const;
-    virtual PassRefPtr<IDBKey> key() const;
-    virtual PassRefPtr<IDBKey> primaryKey() const;
-    virtual PassRefPtr<SerializedScriptValue> value() const;
-    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
-    virtual void continueFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
-    virtual void deleteFunction(PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual PassRefPtr<WebCore::IDBKey> key() const;
+    virtual PassRefPtr<WebCore::IDBKey> primaryKey() const;
+    virtual PassRefPtr<WebCore::SerializedScriptValue> value() const;
+    virtual void update(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::ExceptionCode&);
+    virtual void continueFunction(PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::ExceptionCode&);
+    virtual void deleteFunction(PassRefPtr<WebCore::IDBCallbacks>, WebCore::ExceptionCode&);
 
 private:
-    IDBCursorBackendProxy(PassOwnPtr<WebKit::WebIDBCursor>);
+    IDBCursorBackendProxy(PassOwnPtr<WebIDBCursor>);
 
-    OwnPtr<WebKit::WebIDBCursor> m_idbCursor;
+    OwnPtr<WebIDBCursor> m_idbCursor;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif
 
diff --git a/Source/WebKit/chromium/src/IDBDatabaseProxy.cpp b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
index 7fe7378..7e5ecc3 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,12 +24,14 @@
  */
 
 #include "config.h"
-#include "IDBDatabaseProxy.h"
+#include "IDBDatabaseBackendProxy.h"
+
+#if ENABLE(INDEXED_DATABASE)
 
 #include "DOMStringList.h"
 #include "IDBCallbacks.h"
 #include "IDBDatabaseCallbacks.h"
-#include "IDBObjectStoreProxy.h"
+#include "IDBObjectStoreBackendProxy.h"
 #include "IDBTransactionBackendProxy.h"
 #include "WebDOMStringList.h"
 #include "WebFrameImpl.h"
@@ -40,51 +42,51 @@
 #include "WebIDBObjectStore.h"
 #include "WebIDBTransaction.h"
 
-#if ENABLE(INDEXED_DATABASE)
+using namespace WebCore;
 
-namespace WebCore {
+namespace WebKit {
 
-PassRefPtr<IDBDatabaseBackendInterface> IDBDatabaseProxy::create(PassOwnPtr<WebKit::WebIDBDatabase> database)
+PassRefPtr<IDBDatabaseBackendInterface> IDBDatabaseBackendProxy::create(PassOwnPtr<WebIDBDatabase> database)
 {
-    return adoptRef(new IDBDatabaseProxy(database));
+    return adoptRef(new IDBDatabaseBackendProxy(database));
 }
 
-IDBDatabaseProxy::IDBDatabaseProxy(PassOwnPtr<WebKit::WebIDBDatabase> database)
+IDBDatabaseBackendProxy::IDBDatabaseBackendProxy(PassOwnPtr<WebIDBDatabase> database)
     : m_webIDBDatabase(database)
 {
 }
 
-IDBDatabaseProxy::~IDBDatabaseProxy()
+IDBDatabaseBackendProxy::~IDBDatabaseBackendProxy()
 {
 }
 
-String IDBDatabaseProxy::name() const
+String IDBDatabaseBackendProxy::name() const
 {
     return m_webIDBDatabase->name();
 }
 
-String IDBDatabaseProxy::version() const
+String IDBDatabaseBackendProxy::version() const
 {
     return m_webIDBDatabase->version();
 }
 
-PassRefPtr<DOMStringList> IDBDatabaseProxy::objectStoreNames() const
+PassRefPtr<DOMStringList> IDBDatabaseBackendProxy::objectStoreNames() const
 {
     return m_webIDBDatabase->objectStoreNames();
 }
 
-PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseProxy::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseBackendProxy::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
     IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    WebKit::WebIDBObjectStore* objectStore = m_webIDBDatabase->createObjectStore(name, keyPath, autoIncrement, *transactionProxy->getWebIDBTransaction(), ec);
+    WebIDBObjectStore* objectStore = m_webIDBDatabase->createObjectStore(name, keyPath, autoIncrement, *transactionProxy->getWebIDBTransaction(), ec);
     if (!objectStore)
         return 0;
-    return IDBObjectStoreProxy::create(objectStore);
+    return IDBObjectStoreBackendProxy::create(objectStore);
 }
 
-void IDBDatabaseProxy::deleteObjectStore(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+void IDBDatabaseBackendProxy::deleteObjectStore(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
@@ -92,15 +94,15 @@ void IDBDatabaseProxy::deleteObjectStore(const String& name, IDBTransactionBacke
     m_webIDBDatabase->deleteObjectStore(name, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBDatabaseProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBDatabaseCallbacks> databaseCallbacks, ExceptionCode& ec)
+void IDBDatabaseBackendProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBDatabaseCallbacks> databaseCallbacks, ExceptionCode& ec)
 {
     m_webIDBDatabase->setVersion(version, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseProxy::transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode& ec)
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendProxy::transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode& ec)
 {
-    WebKit::WebDOMStringList names(storeNames);
-    WebKit::WebIDBTransaction* transaction = m_webIDBDatabase->transaction(names, mode, ec);
+    WebDOMStringList names(storeNames);
+    WebIDBTransaction* transaction = m_webIDBDatabase->transaction(names, mode, ec);
     if (!transaction) {
         ASSERT(ec);
         return 0;
@@ -108,16 +110,16 @@ PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseProxy::transaction(DOMStri
     return IDBTransactionBackendProxy::create(transaction);
 }
 
-void IDBDatabaseProxy::close(PassRefPtr<IDBDatabaseCallbacks>)
+void IDBDatabaseBackendProxy::close(PassRefPtr<IDBDatabaseCallbacks>)
 {
     m_webIDBDatabase->close();
 }
 
-void IDBDatabaseProxy::open(PassRefPtr<IDBDatabaseCallbacks> databaseCallbacks)
+void IDBDatabaseBackendProxy::open(PassRefPtr<IDBDatabaseCallbacks> databaseCallbacks)
 {
     m_webIDBDatabase->open(new WebIDBDatabaseCallbacksImpl(databaseCallbacks));
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBDatabaseProxy.h b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
index c3e8346..5a5baf2 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseProxy.h
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,45 +23,45 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef IDBDatabaseProxy_h
-#define IDBDatabaseProxy_h
+#ifndef IDBDatabaseBackendProxy_h
+#define IDBDatabaseBackendProxy_h
+
+#if ENABLE(INDEXED_DATABASE)
 
 #include "IDBDatabaseBackendInterface.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 
-#if ENABLE(INDEXED_DATABASE)
-
-namespace WebKit { class WebIDBDatabase; }
+namespace WebKit {
 
-namespace WebCore {
+class WebIDBDatabase;
 
-class IDBDatabaseProxy : public IDBDatabaseBackendInterface {
+class IDBDatabaseBackendProxy : public WebCore::IDBDatabaseBackendInterface {
 public:
-    static PassRefPtr<IDBDatabaseBackendInterface> create(PassOwnPtr<WebKit::WebIDBDatabase>);
-    virtual ~IDBDatabaseProxy();
+    static PassRefPtr<WebCore::IDBDatabaseBackendInterface> create(PassOwnPtr<WebIDBDatabase>);
+    virtual ~IDBDatabaseBackendProxy();
 
     virtual String name() const;
     virtual String version() const;
-    virtual PassRefPtr<DOMStringList> objectStoreNames() const;
+    virtual PassRefPtr<WebCore::DOMStringList> objectStoreNames() const;
 
-    virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void deleteObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBDatabaseCallbacks>, ExceptionCode&);
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, ExceptionCode&);
-    virtual void close(PassRefPtr<IDBDatabaseCallbacks>);
+    virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void deleteObjectStore(const String& name, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void setVersion(const String& version, PassRefPtr<WebCore::IDBCallbacks>, PassRefPtr<WebCore::IDBDatabaseCallbacks>, WebCore::ExceptionCode&);
+    virtual PassRefPtr<WebCore::IDBTransactionBackendInterface> transaction(WebCore::DOMStringList* storeNames, unsigned short mode, WebCore::ExceptionCode&);
+    virtual void close(PassRefPtr<WebCore::IDBDatabaseCallbacks>);
 
-    virtual void open(PassRefPtr<IDBDatabaseCallbacks>);
+    virtual void open(PassRefPtr<WebCore::IDBDatabaseCallbacks>);
 
 private:
-    IDBDatabaseProxy(PassOwnPtr<WebKit::WebIDBDatabase>);
+    IDBDatabaseBackendProxy(PassOwnPtr<WebIDBDatabase>);
 
-    OwnPtr<WebKit::WebIDBDatabase> m_webIDBDatabase;
+    OwnPtr<WebIDBDatabase> m_webIDBDatabase;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif
 
-#endif // IDBDatabaseProxy_h
+#endif // IDBDatabaseBackendProxy_h
diff --git a/Source/WebKit/chromium/src/IDBDatabaseCallbacksProxy.cpp b/Source/WebKit/chromium/src/IDBDatabaseCallbacksProxy.cpp
index 28c134f..816faf6 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseCallbacksProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBDatabaseCallbacksProxy.cpp
@@ -30,14 +30,16 @@
 
 #include "WebIDBDatabaseCallbacks.h"
 
-namespace WebCore {
+using namespace WebCore;
 
-PassRefPtr<IDBDatabaseCallbacksProxy> IDBDatabaseCallbacksProxy::create(PassOwnPtr<WebKit::WebIDBDatabaseCallbacks> callbacks)
+namespace WebKit {
+
+PassRefPtr<IDBDatabaseCallbacksProxy> IDBDatabaseCallbacksProxy::create(PassOwnPtr<WebIDBDatabaseCallbacks> callbacks)
 {
     return adoptRef(new IDBDatabaseCallbacksProxy(callbacks));
 }
 
-IDBDatabaseCallbacksProxy::IDBDatabaseCallbacksProxy(PassOwnPtr<WebKit::WebIDBDatabaseCallbacks> callbacks)
+IDBDatabaseCallbacksProxy::IDBDatabaseCallbacksProxy(PassOwnPtr<WebIDBDatabaseCallbacks> callbacks)
     : m_callbacks(callbacks)
 {
 }
@@ -51,6 +53,6 @@ void IDBDatabaseCallbacksProxy::onVersionChange(const String& requestedVersion)
     m_callbacks->onVersionChange(requestedVersion);
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBDatabaseCallbacksProxy.h b/Source/WebKit/chromium/src/IDBDatabaseCallbacksProxy.h
index 9fd7a0b..affdce7 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseCallbacksProxy.h
+++ b/Source/WebKit/chromium/src/IDBDatabaseCallbacksProxy.h
@@ -26,30 +26,29 @@
 #ifndef IDBDatabaseCallbacksProxy_h
 #define IDBDatabaseCallbacksProxy_h
 
-#include "IDBDatabaseCallbacks.h"
-
 #if ENABLE(INDEXED_DATABASE)
 
+#include "IDBDatabaseCallbacks.h"
 #include <wtf/PassOwnPtr.h>
 
-namespace WebKit { class WebIDBDatabaseCallbacks; }
+namespace WebKit {
 
-namespace WebCore {
+class WebIDBDatabaseCallbacks;
 
-class IDBDatabaseCallbacksProxy : public IDBDatabaseCallbacks {
+class IDBDatabaseCallbacksProxy : public WebCore::IDBDatabaseCallbacks {
 public:
-    static PassRefPtr<IDBDatabaseCallbacksProxy> create(PassOwnPtr<WebKit::WebIDBDatabaseCallbacks>);
+    static PassRefPtr<IDBDatabaseCallbacksProxy> create(PassOwnPtr<WebIDBDatabaseCallbacks>);
     virtual ~IDBDatabaseCallbacksProxy();
 
     virtual void onVersionChange(const String& requestedVersion);
 
 private:
-    IDBDatabaseCallbacksProxy(PassOwnPtr<WebKit::WebIDBDatabaseCallbacks>);
+    IDBDatabaseCallbacksProxy(PassOwnPtr<WebIDBDatabaseCallbacks>);
 
-    OwnPtr<WebKit::WebIDBDatabaseCallbacks> m_callbacks;
+    OwnPtr<WebIDBDatabaseCallbacks> m_callbacks;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif
 
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index 9e5ccc0..1824eb8 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,9 +29,11 @@
 #include "config.h"
 #include "IDBFactoryBackendProxy.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "DOMStringList.h"
+#include "IDBDatabaseBackendProxy.h"
 #include "IDBDatabaseError.h"
-#include "IDBDatabaseProxy.h"
 #include "WebFrameImpl.h"
 #include "WebIDBCallbacksImpl.h"
 #include "WebIDBDatabase.h"
@@ -41,9 +43,9 @@
 #include "WebKitClient.h"
 #include "WebVector.h"
 
-#if ENABLE(INDEXED_DATABASE)
+using namespace WebCore;
 
-namespace WebCore {
+namespace WebKit {
 
 PassRefPtr<IDBFactoryBackendInterface> IDBFactoryBackendProxy::create()
 {
@@ -51,7 +53,7 @@ PassRefPtr<IDBFactoryBackendInterface> IDBFactoryBackendProxy::create()
 }
 
 IDBFactoryBackendProxy::IDBFactoryBackendProxy()
-    : m_webIDBFactory(WebKit::webKitClient()->idbFactory())
+    : m_webIDBFactory(webKitClient()->idbFactory())
 {
 }
 
@@ -61,10 +63,10 @@ IDBFactoryBackendProxy::~IDBFactoryBackendProxy()
 
 void IDBFactoryBackendProxy::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> origin, Frame* frame, const String& dataDir, int64_t maximumSize, BackingStoreType backingStoreType)
 {
-    WebKit::WebFrame* webFrame = WebKit::WebFrameImpl::fromFrame(frame);
-    m_webIDBFactory->open(name, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir, maximumSize, static_cast<WebKit::WebIDBFactory::BackingStoreType>(backingStoreType));
+    WebFrame* webFrame = WebFrameImpl::fromFrame(frame);
+    m_webIDBFactory->open(name, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir, maximumSize, static_cast<WebIDBFactory::BackingStoreType>(backingStoreType));
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.h b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.h
index 593051e..89ed355 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,32 +29,32 @@
 #ifndef IDBFactoryBackendProxy_h
 #define IDBFactoryBackendProxy_h
 
-#include "IDBFactoryBackendInterface.h"
-
 #if ENABLE(INDEXED_DATABASE)
 
-namespace WebKit { class WebIDBFactory; }
+#include "IDBFactoryBackendInterface.h"
+
+namespace WebCore { class DOMStringList; }
 
-namespace WebCore {
+namespace WebKit {
 
-class DOMStringList;
+class WebIDBFactory;
 
-class IDBFactoryBackendProxy : public IDBFactoryBackendInterface {
+class IDBFactoryBackendProxy : public WebCore::IDBFactoryBackendInterface {
 public:
-    static PassRefPtr<IDBFactoryBackendInterface> create();
+    static PassRefPtr<WebCore::IDBFactoryBackendInterface> create();
     virtual ~IDBFactoryBackendProxy();
 
-    PassRefPtr<DOMStringList> databases(void) const;
-    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType);
+    PassRefPtr<WebCore::DOMStringList> databases(void) const;
+    virtual void open(const String& name, PassRefPtr<WebCore::IDBCallbacks>, PassRefPtr<WebCore::SecurityOrigin>, WebCore::Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType);
 
 private:
     IDBFactoryBackendProxy();
 
     // We don't own this pointer (unlike all the other proxy classes which do).
-    WebKit::WebIDBFactory* m_webIDBFactory;
+    WebIDBFactory* m_webIDBFactory;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif
 
diff --git a/Source/WebKit/chromium/src/IDBIndexBackendProxy.cpp b/Source/WebKit/chromium/src/IDBIndexBackendProxy.cpp
index 410750e..556c9b6 100644
--- a/Source/WebKit/chromium/src/IDBIndexBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBIndexBackendProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,14 +37,16 @@
 #include "WebIDBKey.h"
 #include "WebIDBKeyRange.h"
 
-namespace WebCore {
+using namespace WebCore;
 
-PassRefPtr<IDBIndexBackendInterface> IDBIndexBackendProxy::create(PassOwnPtr<WebKit::WebIDBIndex> index)
+namespace WebKit {
+
+PassRefPtr<IDBIndexBackendInterface> IDBIndexBackendProxy::create(PassOwnPtr<WebIDBIndex> index)
 {
     return adoptRef(new IDBIndexBackendProxy(index));
 }
 
-IDBIndexBackendProxy::IDBIndexBackendProxy(PassOwnPtr<WebKit::WebIDBIndex> index)
+IDBIndexBackendProxy::IDBIndexBackendProxy(PassOwnPtr<WebIDBIndex> index)
     : m_webIDBIndex(index)
 {
 }
@@ -105,6 +107,6 @@ void IDBIndexBackendProxy::getKey(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallback
     m_webIDBIndex->getKey(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBIndexBackendProxy.h b/Source/WebKit/chromium/src/IDBIndexBackendProxy.h
index e9de05a..b63640f 100644
--- a/Source/WebKit/chromium/src/IDBIndexBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBIndexBackendProxy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,19 +26,19 @@
 #ifndef IDBIndexBackendProxy_h
 #define IDBIndexBackendProxy_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "IDBIndexBackendInterface.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
-#if ENABLE(INDEXED_DATABASE)
-
-namespace WebKit { class WebIDBIndex; }
+namespace WebKit {
 
-namespace WebCore {
+class WebIDBIndex;
 
-class IDBIndexBackendProxy : public IDBIndexBackendInterface {
+class IDBIndexBackendProxy : public WebCore::IDBIndexBackendInterface {
 public:
-    static PassRefPtr<IDBIndexBackendInterface> create(PassOwnPtr<WebKit::WebIDBIndex>);
+    static PassRefPtr<IDBIndexBackendInterface> create(PassOwnPtr<WebIDBIndex>);
     virtual ~IDBIndexBackendProxy();
 
     virtual String name();
@@ -46,18 +46,18 @@ public:
     virtual String keyPath();
     virtual bool unique();
 
-    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void openKeyCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void getKey(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void openCursor(PassRefPtr<WebCore::IDBKeyRange>, unsigned short direction, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void openKeyCursor(PassRefPtr<WebCore::IDBKeyRange>, unsigned short direction, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void get(PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void getKey(PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
 
 private:
-    IDBIndexBackendProxy(PassOwnPtr<WebKit::WebIDBIndex>);
+    IDBIndexBackendProxy(PassOwnPtr<WebIDBIndex>);
 
-    OwnPtr<WebKit::WebIDBIndex> m_webIDBIndex;
+    OwnPtr<WebIDBIndex> m_webIDBIndex;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif
 
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreProxy.cpp b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
index d6871e0..2a0e075 100755
--- a/Source/WebKit/chromium/src/IDBObjectStoreProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,7 +24,9 @@
  */
 
 #include "config.h"
-#include "IDBObjectStoreProxy.h"
+#include "IDBObjectStoreBackendProxy.h"
+
+#if ENABLE(INDEXED_DATABASE)
 
 #include "DOMStringList.h"
 #include "IDBCallbacks.h"
@@ -39,40 +41,40 @@
 #include "WebIDBTransactionImpl.h"
 #include "WebSerializedScriptValue.h"
 
-#if ENABLE(INDEXED_DATABASE)
+using namespace WebCore;
 
-namespace WebCore {
+namespace WebKit {
 
-PassRefPtr<IDBObjectStoreBackendInterface> IDBObjectStoreProxy::create(PassOwnPtr<WebKit::WebIDBObjectStore> objectStore)
+PassRefPtr<IDBObjectStoreBackendInterface> IDBObjectStoreBackendProxy::create(PassOwnPtr<WebIDBObjectStore> objectStore)
 {
-    return adoptRef(new IDBObjectStoreProxy(objectStore));
+    return adoptRef(new IDBObjectStoreBackendProxy(objectStore));
 }
 
-IDBObjectStoreProxy::IDBObjectStoreProxy(PassOwnPtr<WebKit::WebIDBObjectStore> objectStore)
+IDBObjectStoreBackendProxy::IDBObjectStoreBackendProxy(PassOwnPtr<WebIDBObjectStore> objectStore)
     : m_webIDBObjectStore(objectStore)
 {
 }
 
-IDBObjectStoreProxy::~IDBObjectStoreProxy()
+IDBObjectStoreBackendProxy::~IDBObjectStoreBackendProxy()
 {
 }
 
-String IDBObjectStoreProxy::name() const
+String IDBObjectStoreBackendProxy::name() const
 {
     return m_webIDBObjectStore->name();
 }
 
-String IDBObjectStoreProxy::keyPath() const
+String IDBObjectStoreBackendProxy::keyPath() const
 {
     return m_webIDBObjectStore->keyPath();
 }
 
-PassRefPtr<DOMStringList> IDBObjectStoreProxy::indexNames() const
+PassRefPtr<DOMStringList> IDBObjectStoreBackendProxy::indexNames() const
 {
     return m_webIDBObjectStore->indexNames();
 }
 
-void IDBObjectStoreProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+void IDBObjectStoreBackendProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
@@ -80,15 +82,15 @@ void IDBObjectStoreProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> c
     m_webIDBObjectStore->get(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+void IDBObjectStoreBackendProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
     IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBObjectStore->put(value, key, static_cast<WebKit::WebIDBObjectStore::PutMode>(putMode), new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
+    m_webIDBObjectStore->put(value, key, static_cast<WebIDBObjectStore::PutMode>(putMode), new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+void IDBObjectStoreBackendProxy::deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
@@ -96,7 +98,7 @@ void IDBObjectStoreProxy::deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBC
     m_webIDBObjectStore->deleteFunction(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::clear(PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+void IDBObjectStoreBackendProxy::clear(PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
@@ -104,26 +106,26 @@ void IDBObjectStoreProxy::clear(PassRefPtr<IDBCallbacks> callbacks, IDBTransacti
     m_webIDBObjectStore->clear(new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
     IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    WebKit::WebIDBIndex* index = m_webIDBObjectStore->createIndex(name, keyPath, unique, *transactionProxy->getWebIDBTransaction(), ec);
+    WebIDBIndex* index = m_webIDBObjectStore->createIndex(name, keyPath, unique, *transactionProxy->getWebIDBTransaction(), ec);
     if (!index)
         return 0;
     return IDBIndexBackendProxy::create(index);
 }
 
-PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::index(const String& name, ExceptionCode& ec)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendProxy::index(const String& name, ExceptionCode& ec)
 {
-    WebKit::WebIDBIndex* index = m_webIDBObjectStore->index(name, ec);
+    WebIDBIndex* index = m_webIDBObjectStore->index(name, ec);
     if (!index)
         return 0;
     return IDBIndexBackendProxy::create(index);
 }
 
-void IDBObjectStoreProxy::deleteIndex(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+void IDBObjectStoreBackendProxy::deleteIndex(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
@@ -131,7 +133,7 @@ void IDBObjectStoreProxy::deleteIndex(const String& name, IDBTransactionBackendI
     m_webIDBObjectStore->deleteIndex(name, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+void IDBObjectStoreBackendProxy::openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
@@ -139,6 +141,6 @@ void IDBObjectStoreProxy::openCursor(PassRefPtr<IDBKeyRange> range, unsigned sho
     m_webIDBObjectStore->openCursor(range, direction, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
new file mode 100755
index 0000000..cb0ee32
--- /dev/null
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBObjectStoreBackendProxy_h
+#define IDBObjectStoreBackendProxy_h
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBObjectStoreBackendInterface.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebKit {
+
+class WebIDBObjectStore;
+
+class IDBObjectStoreBackendProxy : public WebCore::IDBObjectStoreBackendInterface {
+public:
+    static PassRefPtr<WebCore::IDBObjectStoreBackendInterface> create(PassOwnPtr<WebIDBObjectStore>);
+    virtual ~IDBObjectStoreBackendProxy();
+
+    virtual String name() const;
+    virtual String keyPath() const;
+    virtual PassRefPtr<WebCore::DOMStringList> indexNames() const;
+
+    virtual void get(PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void put(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, PutMode, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void deleteFunction(PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void clear(PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+
+    PassRefPtr<WebCore::IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    PassRefPtr<WebCore::IDBIndexBackendInterface> index(const String& name, WebCore::ExceptionCode&);
+    void deleteIndex(const String& name, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+
+    virtual void openCursor(PassRefPtr<WebCore::IDBKeyRange>, unsigned short direction, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+
+private:
+    IDBObjectStoreBackendProxy(PassOwnPtr<WebIDBObjectStore>);
+
+    OwnPtr<WebIDBObjectStore> m_webIDBObjectStore;
+};
+
+} // namespace WebKit
+
+#endif
+
+#endif // IDBObjectStoreBackendProxy_h
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreProxy.h b/Source/WebKit/chromium/src/IDBObjectStoreProxy.h
deleted file mode 100755
index a6e3748..0000000
--- a/Source/WebKit/chromium/src/IDBObjectStoreProxy.h
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef IDBObjectStoreProxy_h
-#define IDBObjectStoreProxy_h
-
-#include "IDBObjectStoreBackendInterface.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/PassRefPtr.h>
-
-#if ENABLE(INDEXED_DATABASE)
-
-namespace WebKit { class WebIDBObjectStore; }
-
-namespace WebCore {
-
-class IDBObjectStoreProxy : public IDBObjectStoreBackendInterface {
-public:
-    static PassRefPtr<IDBObjectStoreBackendInterface> create(PassOwnPtr<WebKit::WebIDBObjectStore>);
-    virtual ~IDBObjectStoreProxy();
-
-    virtual String name() const;
-    virtual String keyPath() const;
-    virtual PassRefPtr<DOMStringList> indexNames() const;
-
-    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-
-    PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface*, ExceptionCode&);
-    PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&);
-    void deleteIndex(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
-
-    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-
-private:
-    IDBObjectStoreProxy(PassOwnPtr<WebKit::WebIDBObjectStore>);
-
-    OwnPtr<WebKit::WebIDBObjectStore> m_webIDBObjectStore;
-};
-
-} // namespace WebCore
-
-#endif
-
-#endif // IDBObjectStoreProxy_h
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
index 95c90d5..6d91f48 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,21 +28,23 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
-#include "IDBObjectStoreProxy.h"
+#include "IDBObjectStoreBackendProxy.h"
 #include "IDBTransactionCallbacks.h"
 #include "WebIDBDatabaseError.h"
 #include "WebIDBObjectStore.h"
 #include "WebIDBTransaction.h"
 #include "WebIDBTransactionCallbacksImpl.h"
 
-namespace WebCore {
+using namespace WebCore;
 
-PassRefPtr<IDBTransactionBackendInterface> IDBTransactionBackendProxy::create(PassOwnPtr<WebKit::WebIDBTransaction> transaction)
+namespace WebKit {
+
+PassRefPtr<IDBTransactionBackendInterface> IDBTransactionBackendProxy::create(PassOwnPtr<WebIDBTransaction> transaction)
 {
     return adoptRef(new IDBTransactionBackendProxy(transaction));
 }
 
-IDBTransactionBackendProxy::IDBTransactionBackendProxy(PassOwnPtr<WebKit::WebIDBTransaction> transaction)
+IDBTransactionBackendProxy::IDBTransactionBackendProxy(PassOwnPtr<WebIDBTransaction> transaction)
     : m_webIDBTransaction(transaction)
 {
     ASSERT(m_webIDBTransaction);
@@ -54,10 +56,10 @@ IDBTransactionBackendProxy::~IDBTransactionBackendProxy()
 
 PassRefPtr<IDBObjectStoreBackendInterface> IDBTransactionBackendProxy::objectStore(const String& name, ExceptionCode& ec)
 {
-    WebKit::WebIDBObjectStore* objectStore = m_webIDBTransaction->objectStore(name, ec);
+    WebIDBObjectStore* objectStore = m_webIDBTransaction->objectStore(name, ec);
     if (!objectStore)
         return 0;
-    return IDBObjectStoreProxy::create(objectStore);
+    return IDBObjectStoreBackendProxy::create(objectStore);
 }
 
 unsigned short IDBTransactionBackendProxy::mode() const
@@ -88,6 +90,6 @@ void IDBTransactionBackendProxy::setCallbacks(IDBTransactionCallbacks* callbacks
     m_webIDBTransaction->setCallbacks(new WebIDBTransactionCallbacksImpl(callbacks));
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
index 96d7293..103f552 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,38 +26,37 @@
 #ifndef IDBTransactionBackendProxy_h
 #define IDBTransactionBackendProxy_h
 
-#include "IDBTransactionBackendInterface.h"
-
 #if ENABLE(INDEXED_DATABASE)
 
+#include "IDBTransactionBackendInterface.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
-namespace WebKit { class WebIDBTransaction; }
+namespace WebKit {
 
-namespace WebCore {
+class WebIDBTransaction;
 
-class IDBTransactionBackendProxy : public IDBTransactionBackendInterface {
+class IDBTransactionBackendProxy : public WebCore::IDBTransactionBackendInterface {
 public:
-    static PassRefPtr<IDBTransactionBackendInterface> create(PassOwnPtr<WebKit::WebIDBTransaction>);
+    static PassRefPtr<IDBTransactionBackendInterface> create(PassOwnPtr<WebIDBTransaction>);
     virtual ~IDBTransactionBackendProxy();
 
-    virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, ExceptionCode&);
+    virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> objectStore(const String& name, WebCore::ExceptionCode&);
     virtual unsigned short mode() const;
     virtual void abort();
-    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>, PassOwnPtr<ScriptExecutionContext::Task>);
+    virtual bool scheduleTask(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
     virtual void didCompleteTaskEvents();
-    virtual void setCallbacks(IDBTransactionCallbacks*);
+    virtual void setCallbacks(WebCore::IDBTransactionCallbacks*);
 
-    WebKit::WebIDBTransaction* getWebIDBTransaction() const { return m_webIDBTransaction.get(); }
+    WebIDBTransaction* getWebIDBTransaction() const { return m_webIDBTransaction.get(); }
 
 private:
-    IDBTransactionBackendProxy(PassOwnPtr<WebKit::WebIDBTransaction>);
+    IDBTransactionBackendProxy(PassOwnPtr<WebIDBTransaction>);
 
-    OwnPtr<WebKit::WebIDBTransaction> m_webIDBTransaction;
+    OwnPtr<WebIDBTransaction> m_webIDBTransaction;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif
 
diff --git a/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp b/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
index ebda1dd..83d7e3a 100644
--- a/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,18 +29,20 @@
 #include "config.h"
 #include "IDBTransactionCallbacksProxy.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "WebIDBTransactionCallbacks.h"
 
-#if ENABLE(INDEXED_DATABASE)
+using namespace WebCore;
 
-namespace WebCore {
+namespace WebKit {
 
-PassRefPtr<IDBTransactionCallbacksProxy> IDBTransactionCallbacksProxy::create(PassOwnPtr<WebKit::WebIDBTransactionCallbacks> callbacks)
+PassRefPtr<IDBTransactionCallbacksProxy> IDBTransactionCallbacksProxy::create(PassOwnPtr<WebIDBTransactionCallbacks> callbacks)
 {
     return adoptRef(new IDBTransactionCallbacksProxy(callbacks));
 }
 
-IDBTransactionCallbacksProxy::IDBTransactionCallbacksProxy(PassOwnPtr<WebKit::WebIDBTransactionCallbacks> callbacks)
+IDBTransactionCallbacksProxy::IDBTransactionCallbacksProxy(PassOwnPtr<WebIDBTransactionCallbacks> callbacks)
     : m_callbacks(callbacks)
 {
 }
@@ -59,6 +61,6 @@ void IDBTransactionCallbacksProxy::onComplete()
     m_callbacks->onComplete();
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.h b/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
index 79c32f6..044eecf 100644
--- a/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
+++ b/Source/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,33 +29,32 @@
 #ifndef IDBTransactionCallbacksProxy_h
 #define IDBTransactionCallbacksProxy_h
 
-#include "IDBTransactionCallbacks.h"
-
 #if ENABLE(INDEXED_DATABASE)
 
+#include "IDBTransactionCallbacks.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 
-namespace WebKit { class WebIDBTransactionCallbacks; }
+namespace WebKit {
 
-namespace WebCore {
+class WebIDBTransactionCallbacks;
 
-class IDBTransactionCallbacksProxy : public IDBTransactionCallbacks {
+class IDBTransactionCallbacksProxy : public WebCore::IDBTransactionCallbacks {
 public:
-    static PassRefPtr<IDBTransactionCallbacksProxy> create(PassOwnPtr<WebKit::WebIDBTransactionCallbacks>);
+    static PassRefPtr<IDBTransactionCallbacksProxy> create(PassOwnPtr<WebIDBTransactionCallbacks>);
     virtual ~IDBTransactionCallbacksProxy();
 
     virtual void onAbort();
     virtual void onComplete();
 
 private:
-    IDBTransactionCallbacksProxy(PassOwnPtr<WebKit::WebIDBTransactionCallbacks>);
+    IDBTransactionCallbacksProxy(PassOwnPtr<WebIDBTransactionCallbacks>);
 
-    OwnPtr<WebKit::WebIDBTransactionCallbacks> m_callbacks;
+    OwnPtr<WebIDBTransactionCallbacks> m_callbacks;
 };
 
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif
 
diff --git a/Source/WebKit/chromium/src/PlatformBridge.cpp b/Source/WebKit/chromium/src/PlatformBridge.cpp
index d825d24..bbed1ba 100644
--- a/Source/WebKit/chromium/src/PlatformBridge.cpp
+++ b/Source/WebKit/chromium/src/PlatformBridge.cpp
@@ -61,7 +61,7 @@
 #include "WebViewImpl.h"
 #include "WebWorkerClientImpl.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGContext.h>
 #endif
 
@@ -178,6 +178,12 @@ void PlatformBridge::clipboardReadHTML(
     *sourceURL = url;
 }
 
+PassRefPtr<SharedBuffer> PlatformBridge::clipboardReadImage(
+    PasteboardPrivate::ClipboardBuffer buffer)
+{
+    return webKitClient()->clipboard()->readImage(static_cast<WebClipboard::Buffer>(buffer));
+}
+
 void PlatformBridge::clipboardWriteSelection(const String& htmlText,
                                              const KURL& sourceURL,
                                              const String& plainText,
diff --git a/Source/WebKit/chromium/src/ResourceHandle.cpp b/Source/WebKit/chromium/src/ResourceHandle.cpp
index f88a48a..a11e0c3 100644
--- a/Source/WebKit/chromium/src/ResourceHandle.cpp
+++ b/Source/WebKit/chromium/src/ResourceHandle.cpp
@@ -72,10 +72,7 @@ public:
     virtual void didSendData(
         WebURLLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
     virtual void didReceiveResponse(WebURLLoader*, const WebURLResponse&);
-    virtual void didReceiveData2(WebURLLoader*, const char* data, int dataLength, int lengthReceived);
-
-    // FIXME(vsevik): remove once not used downstream
-    virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength);
+    virtual void didReceiveData(WebURLLoader*, const char* data, int dataLength, int encodedDataLength);
 
     virtual void didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength);
     virtual void didFinishLoading(WebURLLoader*, double finishTime);
@@ -163,20 +160,14 @@ void ResourceHandleInternal::didReceiveResponse(WebURLLoader*, const WebURLRespo
     m_client->didReceiveResponse(m_owner, response.toResourceResponse());
 }
 
-// FIXME(vsevik): remove once not used
-void ResourceHandleInternal::didReceiveData(WebURLLoader* webURLLoader, const char* data, int dataLength)
-{
-    didReceiveData2(webURLLoader, data, dataLength, -1);
-}
-
-void ResourceHandleInternal::didReceiveData2(WebURLLoader*, const char* data, int dataLength, int lengthReceived)
+void ResourceHandleInternal::didReceiveData(WebURLLoader*, const char* data, int dataLength, int encodedDataLength)
 {
     ASSERT(m_client);
     if (m_state != ConnectionStateReceivedResponse && m_state != ConnectionStateReceivingData)
         CRASH();
     m_state = ConnectionStateReceivingData;
 
-    m_client->didReceiveData(m_owner, data, dataLength, lengthReceived);
+    m_client->didReceiveData(m_owner, data, dataLength, encodedDataLength);
 }
 
 void ResourceHandleInternal::didReceiveCachedMetadata(WebURLLoader*, const char* data, int dataLength)
diff --git a/Source/WebKit/chromium/src/StorageInfoChromium.cpp b/Source/WebKit/chromium/src/StorageInfoChromium.cpp
new file mode 100644
index 0000000..5f58c2c
--- /dev/null
+++ b/Source/WebKit/chromium/src/StorageInfoChromium.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageInfo.h"
+
+#if ENABLE(QUOTA)
+
+#include "DOMCoreException.h"
+#include "Document.h"
+#include "ScriptExecutionContext.h"
+#include "StorageInfoErrorCallback.h"
+#include "StorageInfoQuotaCallback.h"
+#include "StorageInfoUsageCallback.h"
+#include "WebFrameClient.h"
+#include "WebFrameImpl.h"
+#include "WebStorageQuotaCallbacksImpl.h"
+#include "WebStorageQuotaType.h"
+
+using namespace WebKit;
+
+namespace WebCore {
+
+namespace {
+void fireStorageInfoErrorCallback(PassRefPtr<StorageInfoErrorCallback> errorCallback, ExceptionCode ec)
+{
+    ASSERT(errorCallback);
+    ExceptionCodeDescription description;
+    getExceptionCodeDescription(ec, description);
+    errorCallback->handleEvent(DOMCoreException::create(description).get());
+}
+}
+
+void StorageInfo::queryUsageAndQuota(ScriptExecutionContext* context, int storageType, PassRefPtr<StorageInfoUsageCallback> successCallback, PassRefPtr<StorageInfoErrorCallback> errorCallback)
+{
+    ASSERT(context);
+    if (storageType != WebStorageQuotaTypeTemporary && storageType != WebStorageQuotaTypePersistent) {
+        // Unknown storage type is requested.
+        fireStorageInfoErrorCallback(errorCallback, NOT_SUPPORTED_ERR);
+        return;
+    }
+    if (context->isDocument()) {
+        Document* document = static_cast<Document*>(context);
+        WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
+        webFrame->client()->queryStorageUsageAndQuota(webFrame, static_cast<WebStorageQuotaType>(storageType), new WebStorageQuotaCallbacksImpl(successCallback, errorCallback));
+    } else if (errorCallback) {
+        // FIXME: calling this on worker is not yet supported.
+        fireStorageInfoErrorCallback(errorCallback, NOT_SUPPORTED_ERR);
+    }
+}
+
+void StorageInfo::requestQuota(ScriptExecutionContext* context, int storageType, unsigned long long newQuotaInBytes, PassRefPtr<StorageInfoQuotaCallback> successCallback, PassRefPtr<StorageInfoErrorCallback> errorCallback)
+{
+    ASSERT(context);
+    if (storageType != WebStorageQuotaTypeTemporary && storageType != WebStorageQuotaTypePersistent) {
+        // Unknown storage type is requested.
+        fireStorageInfoErrorCallback(errorCallback, NOT_SUPPORTED_ERR);
+        return;
+    }
+    if (context->isDocument()) {
+        Document* document = static_cast<Document*>(context);
+        WebFrameImpl* webFrame = WebFrameImpl::fromFrame(document->frame());
+        webFrame->client()->requestStorageQuota(webFrame, static_cast<WebStorageQuotaType>(storageType), newQuotaInBytes, new WebStorageQuotaCallbacksImpl(successCallback, errorCallback));
+    } else if (errorCallback) {
+        // FIXME: calling this on worker is not yet supported.
+        fireStorageInfoErrorCallback(errorCallback, NOT_SUPPORTED_ERR);
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(QUOTA)
diff --git a/Source/WebKit/chromium/src/VideoFrameChromiumImpl.h b/Source/WebKit/chromium/src/VideoFrameChromiumImpl.h
index ca7f88b..44a3cc7 100644
--- a/Source/WebKit/chromium/src/VideoFrameChromiumImpl.h
+++ b/Source/WebKit/chromium/src/VideoFrameChromiumImpl.h
@@ -34,16 +34,14 @@
 #include "VideoFrameChromium.h"
 #include "WebVideoFrame.h"
 
-using namespace WebCore;
-
 namespace WebKit {
 
 // A wrapper class for WebKit::WebVideoFrame. Objects can be created in WebKit
 // and used in WebCore because of the VideoFrameChromium interface.
-class VideoFrameChromiumImpl : public VideoFrameChromium {
+class VideoFrameChromiumImpl : public WebCore::VideoFrameChromium {
 public:
     // Converts a WebCore::VideoFrameChromium to a WebKit::WebVideoFrame.
-    static WebVideoFrame* toWebVideoFrame(VideoFrameChromium*);
+    static WebVideoFrame* toWebVideoFrame(WebCore::VideoFrameChromium*);
 
     // Creates a VideoFrameChromiumImpl object to wrap the given WebVideoFrame.
     // The VideoFrameChromiumImpl does not take ownership of the WebVideoFrame
@@ -59,7 +57,7 @@ public:
     virtual int stride(unsigned plane) const;
     virtual const void* data(unsigned plane) const;
     virtual unsigned texture(unsigned plane) const;
-    virtual const IntSize requiredTextureSize(unsigned plane) const;
+    virtual const WebCore::IntSize requiredTextureSize(unsigned plane) const;
     virtual bool hasPaddingBytes(unsigned plane) const;
 
 private:
diff --git a/Source/WebKit/chromium/src/WebDOMEventListener.cpp b/Source/WebKit/chromium/src/WebDOMEventListener.cpp
index 93c1640..55d71a7 100644
--- a/Source/WebKit/chromium/src/WebDOMEventListener.cpp
+++ b/Source/WebKit/chromium/src/WebDOMEventListener.cpp
@@ -33,6 +33,8 @@
 
 #include "WebDOMEventListenerPrivate.h"
 
+using namespace WebCore;
+
 namespace WebKit {
 
 WebDOMEventListener::WebDOMEventListener()
diff --git a/Source/WebKit/chromium/src/WebDOMEventListenerPrivate.cpp b/Source/WebKit/chromium/src/WebDOMEventListenerPrivate.cpp
index 4edbeef..fb05823 100644
--- a/Source/WebKit/chromium/src/WebDOMEventListenerPrivate.cpp
+++ b/Source/WebKit/chromium/src/WebDOMEventListenerPrivate.cpp
@@ -34,6 +34,8 @@
 #include "EventListenerWrapper.h"
 #include "WebDOMEventListener.h"
 
+using namespace WebCore;
+
 namespace WebKit {
 
 WebDOMEventListenerPrivate::WebDOMEventListenerPrivate(WebDOMEventListener* webDOMEventListener)
diff --git a/Source/WebKit/chromium/src/WebDOMEventListenerPrivate.h b/Source/WebKit/chromium/src/WebDOMEventListenerPrivate.h
index c86f427..2fe443f 100644
--- a/Source/WebKit/chromium/src/WebDOMEventListenerPrivate.h
+++ b/Source/WebKit/chromium/src/WebDOMEventListenerPrivate.h
@@ -39,8 +39,6 @@ namespace WebCore {
 class Node;
 }
 
-using namespace WebCore;
-
 namespace WebKit {
 
 class EventListenerWrapper;
@@ -52,12 +50,12 @@ public:
     ~WebDOMEventListenerPrivate();
 
     EventListenerWrapper* createEventListenerWrapper(
-        const WebString& eventType, bool useCapture, Node* node);
+        const WebString& eventType, bool useCapture, WebCore::Node*);
 
     // Gets the ListenerEventWrapper for a specific node.
     // Used by WebNode::removeDOMEventListener().
     EventListenerWrapper* getEventListenerWrapper(
-        const WebString& eventType, bool useCapture, Node* node);
+        const WebString& eventType, bool useCapture, WebCore::Node*);
 
     // Called by the WebDOMEventListener when it is about to be deleted.
     void webDOMEventListenerDeleted();
@@ -68,7 +66,7 @@ public:
     struct ListenerInfo {
         ListenerInfo(const WebString& eventType, bool useCapture,
                      EventListenerWrapper* eventListenerWrapper,
-                     Node* node)
+                     WebCore::Node* node)
             : eventType(eventType)
             , useCapture(useCapture)
             , eventListenerWrapper(eventListenerWrapper)
@@ -79,7 +77,7 @@ public:
         WebString eventType;
         bool useCapture;
         EventListenerWrapper* eventListenerWrapper;
-        Node* node;
+        WebCore::Node* node;
     };
 
 private:
diff --git a/Source/WebKit/chromium/src/WebDataSourceImpl.cpp b/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
index 1366a80..3170aff 100644
--- a/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDataSourceImpl.cpp
@@ -82,7 +82,8 @@ void WebDataSourceImpl::redirectChain(WebVector<WebURL>& result) const
 
 WebString WebDataSourceImpl::pageTitle() const
 {
-    return title();
+    // FIXME: use direction of title as well.
+    return title().string();
 }
 
 WebNavigationType WebDataSourceImpl::navigationType() const
diff --git a/Source/WebKit/chromium/src/WebElement.cpp b/Source/WebKit/chromium/src/WebElement.cpp
index ee7ec09..66e3e95 100644
--- a/Source/WebKit/chromium/src/WebElement.cpp
+++ b/Source/WebKit/chromium/src/WebElement.cpp
@@ -92,7 +92,7 @@ WebString WebElement::innerText() const
 
 WebNode WebElement::shadowRoot()
 {
-    return adoptRef(unwrap<Element>()->shadowRoot());
+    return adoptRef(static_cast<Node*>(unwrap<Element>()->shadowRoot()));
 }
 
 WebString WebElement::computeInheritedLanguage() const
diff --git a/Source/WebKit/chromium/src/WebFileChooserCompletionImpl.cpp b/Source/WebKit/chromium/src/WebFileChooserCompletionImpl.cpp
index ef2409c..d7583c5 100644
--- a/Source/WebKit/chromium/src/WebFileChooserCompletionImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFileChooserCompletionImpl.cpp
@@ -46,8 +46,7 @@ void WebFileChooserCompletionImpl::didChooseFile(const WebVector<WebString>& fil
 {
     if (fileNames.size() == 1)
         m_fileChooser->chooseFile(fileNames[0]);
-    else {
-        // This clause handles a case of file_names.size()==0 too.
+    else if (fileNames.size() > 0) {
         Vector<WTF::String> paths;
         for (size_t i = 0; i < fileNames.size(); ++i)
             paths.append(fileNames[i]);
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index fdfb14e..c06087d 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -90,6 +90,7 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HitTestResult.h"
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameOwnerElement.h"
@@ -106,6 +107,7 @@
 #include "PluginDocument.h"
 #include "PrintContext.h"
 #include "RenderFrame.h"
+#include "RenderLayer.h"
 #include "RenderObject.h"
 #include "RenderTreeAsText.h"
 #include "RenderView.h"
@@ -140,6 +142,7 @@
 #include "WebPerformance.h"
 #include "WebPlugin.h"
 #include "WebPluginContainerImpl.h"
+#include "WebPoint.h"
 #include "WebRange.h"
 #include "WebRect.h"
 #include "WebScriptSource.h"
@@ -161,8 +164,13 @@
 #if USE(V8)
 #include "AsyncFileSystem.h"
 #include "AsyncFileSystemChromium.h"
+#include "DirectoryEntry.h"
 #include "DOMFileSystem.h"
+#include "FileEntry.h"
+#include "V8DirectoryEntry.h"
 #include "V8DOMFileSystem.h"
+#include "V8FileEntry.h"
+#include "WebFileSystem.h"
 #endif
 
 using namespace WebCore;
@@ -473,6 +481,13 @@ WebFrame* WebFrame::frameForCurrentContext()
     return WebFrameImpl::fromFrame(frame);
 }
 
+#if WEBKIT_USING_V8
+WebFrame* WebFrame::frameForContext(v8::Handle<v8::Context> context)
+{
+    return WebFrameImpl::fromFrame(V8Proxy::retrieveFrame(context));
+}
+#endif
+
 WebFrame* WebFrame::fromFrameOwnerElement(const WebElement& element)
 {
     return WebFrameImpl::fromFrameOwnerElement(
@@ -841,12 +856,24 @@ v8::Local<v8::Context> WebFrameImpl::mainWorldScriptContext() const
     return V8Proxy::mainWorldContext(m_frame);
 }
 
-v8::Handle<v8::Value> WebFrameImpl::createFileSystem(int type,
+v8::Handle<v8::Value> WebFrameImpl::createFileSystem(WebFileSystem::Type type,
                                                      const WebString& name,
                                                      const WebString& path)
 {
     return toV8(DOMFileSystem::create(frame()->document(), name, AsyncFileSystemChromium::create(static_cast<AsyncFileSystem::Type>(type), path)));
 }
+
+v8::Handle<v8::Value> WebFrameImpl::createFileEntry(WebFileSystem::Type type,
+                                                    const WebString& fileSystemName,
+                                                    const WebString& fileSystemPath,
+                                                    const WebString& filePath,
+                                                    bool isDirectory)
+{
+    RefPtr<DOMFileSystemBase> fileSystem = DOMFileSystem::create(frame()->document(), fileSystemName, AsyncFileSystemChromium::create(static_cast<AsyncFileSystem::Type>(type), fileSystemPath));
+    if (isDirectory)
+        return toV8(DirectoryEntry::create(fileSystem, filePath));
+    return toV8(FileEntry::create(fileSystem, filePath));
+}
 #endif
 
 bool WebFrameImpl::insertStyleText(
@@ -1305,6 +1332,39 @@ bool WebFrameImpl::selectWordAroundCaret()
     return true;
 }
 
+void WebFrameImpl::selectRange(const WebPoint& start, const WebPoint& end)
+{
+    VisibleSelection selection(visiblePositionForWindowPoint(start),
+                               visiblePositionForWindowPoint(end));
+
+    if (frame()->selection()->shouldChangeSelection(selection))
+        frame()->selection()->setSelection(selection, CharacterGranularity,
+                                           MakeNonDirectionalSelection);
+}
+
+VisiblePosition WebFrameImpl::visiblePositionForWindowPoint(const WebPoint& point)
+{
+    HitTestRequest::HitTestRequestType hitType = HitTestRequest::MouseMove;
+    hitType |= HitTestRequest::ReadOnly;
+    hitType |= HitTestRequest::Active;
+    HitTestRequest request(hitType);
+    FrameView* view = frame()->view();
+    HitTestResult result(view->windowToContents(
+        view->convertFromContainingWindow(IntPoint(point.x, point.y))));
+
+    frame()->document()->renderView()->layer()->hitTest(request, result);
+
+    // Matching the logic in MouseEventWithHitTestResults::targetNode()
+    Node* node = result.innerNode();
+    if (!node)
+        return VisiblePosition();
+    Element* element = node->parentElement();
+    if (!node->inDocument() && element && element->inDocument())
+        node = element;
+
+    return node->renderer()->positionForPoint(result.localPoint());
+}
+
 int WebFrameImpl::printBegin(const WebSize& pageSize,
                              const WebNode& constrainToNode,
                              int printerDPI,
@@ -1366,7 +1426,13 @@ float WebFrameImpl::printPage(int page, WebCanvas* canvas)
         return 0;
     }
 
-    return m_printContext->spoolPage(GraphicsContextBuilder(canvas).context(), page);
+    GraphicsContextBuilder builder(canvas);
+    GraphicsContext& gc = builder.context();
+#if WEBKIT_USING_SKIA
+    gc.platformContext()->setPrinting(true);
+#endif
+
+    return m_printContext->spoolPage(gc, page);
 }
 
 void WebFrameImpl::printEnd()
@@ -1482,12 +1548,8 @@ bool WebFrameImpl::find(int identifier,
                     m_activeMatchIndex = m_lastMatchCount - 1;
             }
             if (selectionRect) {
-                WebRect rect = frame()->view()->convertToContainingWindow(currSelectionRect);
-                rect.x -= frameView()->scrollOffset().width();
-                rect.y -= frameView()->scrollOffset().height();
-                *selectionRect = rect;
-
-                reportFindInPageSelection(rect, m_activeMatchIndex + 1, identifier);
+                *selectionRect = frameView()->contentsToWindow(currSelectionRect);
+                reportFindInPageSelection(*selectionRect, m_activeMatchIndex + 1, identifier);
             }
         }
     } else {
@@ -1624,10 +1686,8 @@ void WebFrameImpl::scopeStringMatches(int identifier,
                 m_locatingActiveRect = false;
 
                 // Notify browser of new location for the selected rectangle.
-                resultBounds.move(-frameView()->scrollOffset().width(),
-                                  -frameView()->scrollOffset().height());
                 reportFindInPageSelection(
-                    frame()->view()->convertToContainingWindow(resultBounds),
+                    frameView()->contentsToWindow(resultBounds),
                     m_activeMatchIndex + 1,
                     identifier);
             }
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index 6129de1..572408a 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -109,9 +109,14 @@ public:
     virtual v8::Handle<v8::Value> executeScriptAndReturnValue(
         const WebScriptSource&);
     virtual v8::Local<v8::Context> mainWorldScriptContext() const;
-    virtual v8::Handle<v8::Value> createFileSystem(int type,
+    virtual v8::Handle<v8::Value> createFileSystem(WebFileSystem::Type,
                                                    const WebString& name,
                                                    const WebString& path);
+    virtual v8::Handle<v8::Value> createFileEntry(WebFileSystem::Type,
+                                                  const WebString& fileSystemName,
+                                                  const WebString& fileSystemPath,
+                                                  const WebString& filePath,
+                                                  bool isDirectory);
 #endif
     virtual bool insertStyleText(const WebString& css, const WebString& id);
     virtual void reload(bool ignoreCache);
@@ -157,6 +162,7 @@ public:
     virtual WebString selectionAsText() const;
     virtual WebString selectionAsMarkup() const;
     virtual bool selectWordAroundCaret();
+    virtual void selectRange(const WebPoint& start, const WebPoint& end);
     virtual int printBegin(const WebSize& pageSize,
                            const WebNode& constrainToNode,
                            int printerDPI,
@@ -326,6 +332,9 @@ private:
 
     void loadJavaScriptURL(const WebCore::KURL&);
 
+    // Returns a hit-tested VisiblePosition for the given point
+    WebCore::VisiblePosition visiblePositionForWindowPoint(const WebPoint&);
+
     FrameLoaderClientImpl m_frameLoaderClient;
 
     WebFrameClient* m_client;
diff --git a/Source/WebKit/chromium/src/WebHTTPLoadInfo.cpp b/Source/WebKit/chromium/src/WebHTTPLoadInfo.cpp
index 876a489..9cb4aaa 100644
--- a/Source/WebKit/chromium/src/WebHTTPLoadInfo.cpp
+++ b/Source/WebKit/chromium/src/WebHTTPLoadInfo.cpp
@@ -89,6 +89,18 @@ void WebHTTPLoadInfo::setHTTPStatusText(const WebString& statusText)
     m_private->httpStatusText = statusText;
 }
 
+long long WebHTTPLoadInfo::encodedDataLength() const
+{
+    ASSERT(!m_private.isNull());
+    return m_private->encodedDataLength;
+}
+
+void WebHTTPLoadInfo::setEncodedDataLength(long long encodedDataLength)
+{
+    ASSERT(!m_private.isNull());
+    m_private->encodedDataLength = encodedDataLength;
+}
+
 static void addHeader(HTTPHeaderMap* map, const WebString& name, const WebString& value)
 {
     pair<HTTPHeaderMap::iterator, bool> result = map->add(name, value);
@@ -108,4 +120,28 @@ void WebHTTPLoadInfo::addResponseHeader(const WebString& name, const WebString&
     addHeader(&m_private->responseHeaders, name, value);
 }
 
+WebString WebHTTPLoadInfo::requestHeadersText() const
+{
+    ASSERT(!m_private.isNull());
+    return m_private->requestHeadersText;
+}
+
+void WebHTTPLoadInfo::setRequestHeadersText(const WebString& headersText)
+{
+    ASSERT(!m_private.isNull());
+    m_private->requestHeadersText = headersText;
+}
+
+WebString WebHTTPLoadInfo::responseHeadersText() const
+{
+    ASSERT(!m_private.isNull());
+    return m_private->responseHeadersText;
+}
+
+void WebHTTPLoadInfo::setResponseHeadersText(const WebString& headersText)
+{
+    ASSERT(!m_private.isNull());
+    m_private->responseHeadersText = headersText;
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index ce307a4..24d3f6c 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,12 @@
 #include "config.h"
 #include "WebIDBCallbacksImpl.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "IDBCallbacks.h"
 #include "IDBCursorBackendProxy.h"
+#include "IDBDatabaseBackendProxy.h"
 #include "IDBDatabaseError.h"
-#include "IDBDatabaseProxy.h"
 #include "IDBKey.h"
 #include "IDBTransactionBackendProxy.h"
 #include "WebIDBCallbacks.h"
@@ -39,9 +41,9 @@
 #include "WebIDBTransaction.h"
 #include "WebSerializedScriptValue.h"
 
-#if ENABLE(INDEXED_DATABASE)
+using namespace WebCore;
 
-namespace WebCore {
+namespace WebKit {
 
 WebIDBCallbacksImpl::WebIDBCallbacksImpl(PassRefPtr<IDBCallbacks> callbacks)
     : m_callbacks(callbacks)
@@ -52,32 +54,32 @@ WebIDBCallbacksImpl::~WebIDBCallbacksImpl()
 {
 }
 
-void WebIDBCallbacksImpl::onError(const WebKit::WebIDBDatabaseError& error)
+void WebIDBCallbacksImpl::onError(const WebIDBDatabaseError& error)
 {
     m_callbacks->onError(error);
 }
 
-void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBCursor* cursor)
+void WebIDBCallbacksImpl::onSuccess(WebIDBCursor* cursor)
 {
     m_callbacks->onSuccess(IDBCursorBackendProxy::create(cursor));
 }
 
-void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBDatabase* webKitInstance)
+void WebIDBCallbacksImpl::onSuccess(WebIDBDatabase* webKitInstance)
 {
-    m_callbacks->onSuccess(IDBDatabaseProxy::create(webKitInstance));
+    m_callbacks->onSuccess(IDBDatabaseBackendProxy::create(webKitInstance));
 }
 
-void WebIDBCallbacksImpl::onSuccess(const WebKit::WebIDBKey& key)
+void WebIDBCallbacksImpl::onSuccess(const WebIDBKey& key)
 {
     m_callbacks->onSuccess(key);
 }
 
-void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBTransaction* webKitInstance)
+void WebIDBCallbacksImpl::onSuccess(WebIDBTransaction* webKitInstance)
 {
     m_callbacks->onSuccess(IDBTransactionBackendProxy::create(webKitInstance));
 }
 
-void WebIDBCallbacksImpl::onSuccess(const WebKit::WebSerializedScriptValue& serializedScriptValue)
+void WebIDBCallbacksImpl::onSuccess(const WebSerializedScriptValue& serializedScriptValue)
 {
     m_callbacks->onSuccess(serializedScriptValue);
 }
@@ -87,6 +89,6 @@ void WebIDBCallbacksImpl::onBlocked()
     m_callbacks->onBlocked();
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
index 057aa25..c486601 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,35 +26,35 @@
 #ifndef WebIDBCallbacksImpl_h
 #define WebIDBCallbacksImpl_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "WebIDBCallbacks.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
-#if ENABLE(INDEXED_DATABASE)
-
-namespace WebCore {
+namespace WebCore { class IDBCallbacks; }
 
-class IDBCallbacks;
+namespace WebKit {
 
-class WebIDBCallbacksImpl : public WebKit::WebIDBCallbacks {
+class WebIDBCallbacksImpl : public WebIDBCallbacks {
 public:
-    WebIDBCallbacksImpl(PassRefPtr<IDBCallbacks>);
+    WebIDBCallbacksImpl(PassRefPtr<WebCore::IDBCallbacks>);
     virtual ~WebIDBCallbacksImpl();
 
-    virtual void onError(const WebKit::WebIDBDatabaseError&);
-    virtual void onSuccess(WebKit::WebIDBCursor*);
-    virtual void onSuccess(WebKit::WebIDBDatabase*);
-    virtual void onSuccess(const WebKit::WebIDBKey&);
-    virtual void onSuccess(WebKit::WebIDBTransaction*);
-    virtual void onSuccess(const WebKit::WebSerializedScriptValue&);
+    virtual void onError(const WebIDBDatabaseError&);
+    virtual void onSuccess(WebIDBCursor*);
+    virtual void onSuccess(WebIDBDatabase*);
+    virtual void onSuccess(const WebIDBKey&);
+    virtual void onSuccess(WebIDBTransaction*);
+    virtual void onSuccess(const WebSerializedScriptValue&);
     virtual void onBlocked();
 
 private:
-    RefPtr<IDBCallbacks> m_callbacks;
+    RefPtr<WebCore::IDBCallbacks> m_callbacks;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
-#endif
+#endif // ENABLE(INDEXED_DATABASE)
 
 #endif // WebIDBCallbacksImpl_h
diff --git a/Source/WebKit/chromium/src/WebIDBCursorImpl.cpp b/Source/WebKit/chromium/src/WebIDBCursorImpl.cpp
index 86c4f57..6c0012e 100644
--- a/Source/WebKit/chromium/src/WebIDBCursorImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBCursorImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WebIDBCursorImpl.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "IDBAny.h"
 #include "IDBCallbacksProxy.h"
 #include "IDBCursorBackendInterface.h"
@@ -80,4 +82,6 @@ void WebIDBCursorImpl::deleteFunction(WebIDBCallbacks* callbacks, WebExceptionCo
     m_idbCursorBackend->deleteFunction(IDBCallbacksProxy::create(callbacks), ec);
 }
 
-} // namespace WebCore
+} // namespace WebKit
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBCursorImpl.h b/Source/WebKit/chromium/src/WebIDBCursorImpl.h
index de17a99..c237920 100644
--- a/Source/WebKit/chromium/src/WebIDBCursorImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBCursorImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef WebIDBCursorImpl_h
 #define WebIDBCursorImpl_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "WebCommon.h"
 #include "WebExceptionCode.h"
 #include "WebIDBCursor.h"
@@ -56,4 +58,6 @@ public:
 
 } // namespace WebKit
 
+#endif // ENABLE(INDEXED_DATABASE)
+
 #endif // WebIDBCursorImpl_h
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.cpp
index 3ca0274..0fec84a 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.cpp
@@ -31,7 +31,9 @@
 #include "IDBDatabaseCallbacks.h"
 #include "WebString.h"
 
-namespace WebCore {
+using namespace WebCore;
+
+namespace WebKit {
 
 WebIDBDatabaseCallbacksImpl::WebIDBDatabaseCallbacksImpl(PassRefPtr<IDBDatabaseCallbacks> callbacks)
     : m_callbacks(callbacks)
@@ -42,11 +44,11 @@ WebIDBDatabaseCallbacksImpl::~WebIDBDatabaseCallbacksImpl()
 {
 }
 
-void WebIDBDatabaseCallbacksImpl::onVersionChange(const WebKit::WebString& version)
+void WebIDBDatabaseCallbacksImpl::onVersionChange(const WebString& version)
 {
     m_callbacks->onVersionChange(version);
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.h b/Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.h
index ba3dc5e..d4916af 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseCallbacksImpl.h
@@ -34,23 +34,23 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
-namespace WebCore {
+namespace WebCore { class IDBDatabaseCallbacks; }
 
-class IDBDatabaseCallbacks;
+namespace WebKit {
 
-class WebIDBDatabaseCallbacksImpl : public WebKit::WebIDBDatabaseCallbacks {
+class WebIDBDatabaseCallbacksImpl : public WebIDBDatabaseCallbacks {
 public:
-    WebIDBDatabaseCallbacksImpl(PassRefPtr<IDBDatabaseCallbacks>);
+    WebIDBDatabaseCallbacksImpl(PassRefPtr<WebCore::IDBDatabaseCallbacks>);
     virtual ~WebIDBDatabaseCallbacksImpl();
 
-    virtual void onVersionChange(const WebKit::WebString& version);
+    virtual void onVersionChange(const WebString& version);
 
 private:
-    RefPtr<IDBDatabaseCallbacks> m_callbacks;
+    RefPtr<WebCore::IDBDatabaseCallbacks> m_callbacks;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
-#endif
+#endif // ENABLE(INDEXED_DATABASE)
 
 #endif // WebIDBDatabaseCallbacksImpl_h
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseError.cpp b/Source/WebKit/chromium/src/WebIDBDatabaseError.cpp
index 7413ae6..25e202c 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseError.cpp
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseError.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,11 +31,11 @@
 #include "config.h"
 #include "WebIDBDatabaseError.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "IDBDatabaseError.h"
 #include "WebString.h"
 
-#if ENABLE(INDEXED_DATABASE)
-
 using namespace WebCore;
 
 namespace WebKit {
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
index 2a97923..92dd5ad 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WebIDBDatabaseImpl.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "DOMStringList.h"
 #include "IDBCallbacksProxy.h"
 #include "IDBDatabaseBackendInterface.h"
@@ -36,8 +38,6 @@
 #include "WebIDBObjectStoreImpl.h"
 #include "WebIDBTransactionImpl.h"
 
-#if ENABLE(INDEXED_DATABASE)
-
 using namespace WebCore;
 
 namespace WebKit {
@@ -112,6 +112,6 @@ void WebIDBDatabaseImpl::open(WebIDBDatabaseCallbacks* callbacks)
     m_databaseBackend->open(m_databaseCallbacks);
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
index 0e1d03e..061f5c2 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,19 +26,19 @@
 #ifndef WebIDBDatabaseImpl_h
 #define WebIDBDatabaseImpl_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "WebCommon.h"
 #include "WebExceptionCode.h"
 #include "WebIDBDatabase.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
-namespace WebCore {
-class IDBDatabaseBackendInterface;
-class IDBDatabaseCallbacksProxy;
-}
+namespace WebCore { class IDBDatabaseBackendInterface; }
 
 namespace WebKit {
 
+class IDBDatabaseCallbacksProxy;
 class WebIDBDatabaseCallbacks;
 class WebIDBObjectStore;
 class WebIDBTransaction;
@@ -63,9 +63,11 @@ public:
 
 private:
     WTF::RefPtr<WebCore::IDBDatabaseBackendInterface> m_databaseBackend;
-    WTF::RefPtr<WebCore::IDBDatabaseCallbacksProxy> m_databaseCallbacks;
+    WTF::RefPtr<IDBDatabaseCallbacksProxy> m_databaseCallbacks;
 };
 
 } // namespace WebKit
 
 #endif // WebIDBDatabaseImpl_h
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBFactoryImpl.cpp b/Source/WebKit/chromium/src/WebIDBFactoryImpl.cpp
index 3e21af5..793698e 100755
--- a/Source/WebKit/chromium/src/WebIDBFactoryImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBFactoryImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "WebIDBFactoryImpl.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "DOMStringList.h"
 #include "IDBCallbacksProxy.h"
 #include "IDBFactoryBackendImpl.h"
@@ -38,8 +40,6 @@
 #include "WebIDBDatabaseError.h"
 #include <wtf/OwnPtr.h>
 
-#if ENABLE(INDEXED_DATABASE)
-
 using namespace WebCore;
 
 namespace WebKit {
@@ -50,7 +50,7 @@ WebIDBFactory* WebIDBFactory::create()
 }
 
 WebIDBFactoryImpl::WebIDBFactoryImpl()
-    : m_idbFactoryBackend(WebCore::IDBFactoryBackendImpl::create())
+    : m_idbFactoryBackend(IDBFactoryBackendImpl::create())
 {
 }
 
diff --git a/Source/WebKit/chromium/src/WebIDBFactoryImpl.h b/Source/WebKit/chromium/src/WebIDBFactoryImpl.h
index 0ffd289..62bd9ed 100755
--- a/Source/WebKit/chromium/src/WebIDBFactoryImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBFactoryImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,6 +29,8 @@
 #ifndef WebIDBFactoryImpl_h
 #define WebIDBFactoryImpl_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "WebDOMStringList.h"
 #include "WebIDBFactory.h"
 #include <wtf/RefPtr.h>
@@ -50,4 +52,6 @@ private:
 
 } // namespace WebKit
 
+#endif // ENABLE(INDEXED_DATABASE)
+
 #endif // WebIDBFactoryImpl_h
diff --git a/Source/WebKit/chromium/src/WebIDBIndexImpl.cpp b/Source/WebKit/chromium/src/WebIDBIndexImpl.cpp
index 6e8e1f2..fa33da9 100644
--- a/Source/WebKit/chromium/src/WebIDBIndexImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBIndexImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WebIDBIndexImpl.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "IDBCallbacksProxy.h"
 #include "IDBIndex.h"
 #include "IDBKeyRange.h"
@@ -33,8 +35,6 @@
 #include "WebIDBKey.h"
 #include "WebIDBKeyRange.h"
 
-#if ENABLE(INDEXED_DATABASE)
-
 using namespace WebCore;
 
 namespace WebKit {
@@ -88,6 +88,6 @@ void WebIDBIndexImpl::getKey(const WebIDBKey& keyRange, WebIDBCallbacks* callbac
     m_backend->getKey(keyRange, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBIndexImpl.h b/Source/WebKit/chromium/src/WebIDBIndexImpl.h
index f68da7f..b047c2f 100644
--- a/Source/WebKit/chromium/src/WebIDBIndexImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBIndexImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef WebIDBIndexImpl_h
 #define WebIDBIndexImpl_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "WebCommon.h"
 #include "WebIDBIndex.h"
 #include <wtf/PassRefPtr.h>
@@ -57,4 +59,6 @@ private:
 
 } // namespace WebKit
 
+#endif // ENABLE(INDEXED_DATABASE)
+
 #endif // WebIDBIndexImpl_h
diff --git a/Source/WebKit/chromium/src/WebIDBKey.cpp b/Source/WebKit/chromium/src/WebIDBKey.cpp
index a20146e..f20347a 100644
--- a/Source/WebKit/chromium/src/WebIDBKey.cpp
+++ b/Source/WebKit/chromium/src/WebIDBKey.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -80,7 +80,7 @@ WebIDBKey WebIDBKey::createFromValueAndKeyPath(const WebSerializedScriptValue& s
 {
     if (serializedScriptValue.isNull())
         return WebIDBKey::createInvalid();
-    return WebCore::createIDBKeyFromSerializedValueAndKeyPath(serializedScriptValue, idbKeyPath);
+    return createIDBKeyFromSerializedValueAndKeyPath(serializedScriptValue, idbKeyPath);
 }
 
 WebSerializedScriptValue WebIDBKey::injectIDBKeyIntoSerializedValue(const WebIDBKey& key, const WebSerializedScriptValue& value, const WebIDBKeyPath& path)
diff --git a/Source/WebKit/chromium/src/WebIDBKeyPath.cpp b/Source/WebKit/chromium/src/WebIDBKeyPath.cpp
index 9eb33d6..309c0d9 100644
--- a/Source/WebKit/chromium/src/WebIDBKeyPath.cpp
+++ b/Source/WebKit/chromium/src/WebIDBKeyPath.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -67,7 +67,7 @@ void WebIDBKeyPath::reset()
     m_private.reset(0);
 }
 
-WebIDBKeyPath::operator const WTF::Vector<WebCore::IDBKeyPathElement, 0>&() const
+WebIDBKeyPath::operator const WTF::Vector<IDBKeyPathElement, 0>&() const
 {
     return *m_private.get();
 }
diff --git a/Source/WebKit/chromium/src/WebIDBKeyRange.cpp b/Source/WebKit/chromium/src/WebIDBKeyRange.cpp
index 517ff00..ea641e9 100644
--- a/Source/WebKit/chromium/src/WebIDBKeyRange.cpp
+++ b/Source/WebKit/chromium/src/WebIDBKeyRange.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,11 +26,13 @@
 #include "config.h"
 #include "WebIDBKeyRange.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "IDBKey.h"
 #include "IDBKeyRange.h"
 #include "WebIDBKey.h"
 
-using WebCore::IDBKeyRange;
+using namespace WebCore;
 
 namespace WebKit {
 
@@ -93,3 +95,5 @@ WebIDBKeyRange::operator PassRefPtr<IDBKeyRange>() const
 }
 
 } // namespace WebKit
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 56e354d..0a67f36 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WebIDBObjectStoreImpl.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "DOMStringList.h"
 #include "IDBCallbacksProxy.h"
 #include "IDBIndexBackendInterface.h"
@@ -37,8 +39,6 @@
 #include "WebIDBTransaction.h"
 #include "WebSerializedScriptValue.h"
 
-#if ENABLE(INDEXED_DATABASE)
-
 using namespace WebCore;
 
 namespace WebKit {
@@ -113,6 +113,6 @@ void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned
     m_objectStore->openCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index 3e2dfab..f1093ed 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef WebIDBObjectStoreImpl_h
 #define WebIDBObjectStoreImpl_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "WebCommon.h"
 #include "WebIDBObjectStore.h"
 #include <wtf/PassRefPtr.h>
@@ -64,4 +66,6 @@ public:
 
 } // namespace WebKit
 
+#endif // ENABLE(INDEXED_DATABASE)
+
 #endif // WebIDBObjectStoreImpl_h
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
index 848182e..2f16477 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,7 +30,9 @@
 
 #include "IDBTransactionCallbacks.h"
 
-namespace WebCore {
+using namespace WebCore;
+
+namespace WebKit {
 
 WebIDBTransactionCallbacksImpl::WebIDBTransactionCallbacksImpl(PassRefPtr<IDBTransactionCallbacks> callbacks)
     : m_callbacks(callbacks)
@@ -51,6 +53,6 @@ void WebIDBTransactionCallbacksImpl::onComplete()
     m_callbacks->onComplete();
 }
 
-} // namespace WebCore
+} // namespace WebKit
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h b/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
index 416ac3c..8acb095 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,24 +32,24 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
-namespace WebCore {
+namespace WebCore { class IDBTransactionCallbacks; }
 
-class IDBTransactionCallbacks;
+namespace WebKit {
 
-class WebIDBTransactionCallbacksImpl : public WebKit::WebIDBTransactionCallbacks {
+class WebIDBTransactionCallbacksImpl : public WebIDBTransactionCallbacks {
 public:
-    WebIDBTransactionCallbacksImpl(PassRefPtr<IDBTransactionCallbacks>);
+    WebIDBTransactionCallbacksImpl(PassRefPtr<WebCore::IDBTransactionCallbacks>);
     virtual ~WebIDBTransactionCallbacksImpl();
 
     virtual void onAbort();
     virtual void onComplete();
 
 private:
-    RefPtr<IDBTransactionCallbacks> m_callbacks;
+    RefPtr<WebCore::IDBTransactionCallbacks> m_callbacks;
 };
 
-} // namespace WebCore
+} // namespace WebKit
 
-#endif
+#endif // ENABLE(INDEXED_DATABASE)
 
 #endif // WebIDBTransactionCallbacksImpl_h
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index abe9cbf..dbea93e 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -189,12 +189,18 @@ void WebMediaPlayerClientImpl::playbackStateChanged()
     m_mediaPlayer->playbackStateChanged();
 }
 
+WebMediaPlayer::Preload WebMediaPlayerClientImpl::preload() const
+{
+    if (m_mediaPlayer)
+        return static_cast<WebMediaPlayer::Preload>(m_mediaPlayer->preload());
+    return static_cast<WebMediaPlayer::Preload>(m_preload);
+}
+
 // MediaPlayerPrivateInterface -------------------------------------------------
 
 void WebMediaPlayerClientImpl::load(const String& url)
 {
-    Frame* frame = static_cast<HTMLMediaElement*>(
-        m_mediaPlayer->mediaPlayerClient())->document()->frame();
+    m_url = url;
 
     // Video frame object is owned by WebMediaPlayer. Before destroying
     // WebMediaPlayer all frames need to be released.
@@ -203,9 +209,19 @@ void WebMediaPlayerClientImpl::load(const String& url)
         m_videoLayer->releaseCurrentFrame();
 #endif
 
+    if (m_preload == MediaPlayer::None) {
+        m_webMediaPlayer.clear();
+        m_delayingLoad = true;
+    } else
+        loadInternal();
+}
+
+void WebMediaPlayerClientImpl::loadInternal()
+{
+    Frame* frame = static_cast<HTMLMediaElement*>(m_mediaPlayer->mediaPlayerClient())->document()->frame();
     m_webMediaPlayer.set(createWebMediaPlayer(this, frame));
     if (m_webMediaPlayer.get())
-        m_webMediaPlayer->load(KURL(ParsedURLString, url));
+        m_webMediaPlayer->load(KURL(ParsedURLString, m_url));
 }
 
 void WebMediaPlayerClientImpl::cancelLoad()
@@ -242,6 +258,12 @@ void WebMediaPlayerClientImpl::pause()
         m_webMediaPlayer->pause();
 }
 
+void WebMediaPlayerClientImpl::prepareToPlay()
+{
+    if (m_delayingLoad)
+        startDelayedLoad();
+}
+
 IntSize WebMediaPlayerClientImpl::naturalSize() const
 {
     if (m_webMediaPlayer.get())
@@ -438,10 +460,15 @@ void WebMediaPlayerClientImpl::paintCurrentFrameInContext(GraphicsContext* conte
     }
 }
 
-void WebMediaPlayerClientImpl::setAutobuffer(bool autoBuffer)
+void WebMediaPlayerClientImpl::setPreload(MediaPlayer::Preload preload)
 {
+    m_preload = preload;
+
     if (m_webMediaPlayer.get())
-        m_webMediaPlayer->setAutoBuffer(autoBuffer);
+        m_webMediaPlayer->setPreload(static_cast<WebMediaPlayer::Preload>(preload));
+
+    if (m_delayingLoad && m_preload != MediaPlayer::None)
+        startDelayedLoad();
 }
 
 bool WebMediaPlayerClientImpl::hasSingleSecurityOrigin() const
@@ -566,8 +593,20 @@ MediaPlayer::SupportsType WebMediaPlayerClientImpl::supportsType(const String& t
     return MediaPlayer::IsNotSupported;
 }
 
+void WebMediaPlayerClientImpl::startDelayedLoad()
+{
+    ASSERT(m_delayingLoad);
+    ASSERT(!m_webMediaPlayer.get());
+
+    m_delayingLoad = false;
+
+    loadInternal();
+}
+
 WebMediaPlayerClientImpl::WebMediaPlayerClientImpl()
     : m_mediaPlayer(0)
+    , m_delayingLoad(false)
+    , m_preload(MediaPlayer::MetaData)
 #if USE(ACCELERATED_COMPOSITING)
     , m_videoLayer(0)
     , m_supportsAcceleratedCompositing(false)
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index 22030b3..a08bb3a 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -77,6 +77,7 @@ public:
     virtual void sawUnsupportedTracks();
     virtual float volume() const;
     virtual void playbackStateChanged();
+    virtual WebMediaPlayer::Preload preload() const;
 
     // MediaPlayerPrivateInterface methods:
     virtual void load(const WTF::String& url);
@@ -87,6 +88,7 @@ public:
     virtual WebCore::PlatformMedia platformMedia() const;
     virtual void play();
     virtual void pause();
+    virtual void prepareToPlay();
     virtual bool supportsFullscreen() const;
     virtual bool supportsSave() const;
     virtual WebCore::IntSize naturalSize() const;
@@ -106,13 +108,13 @@ public:
     virtual float maxTimeSeekable() const;
     virtual WTF::PassRefPtr<WebCore::TimeRanges> buffered() const;
     virtual int dataRate() const;
-    virtual void setAutobuffer(bool);
     virtual bool totalBytesKnown() const;
     virtual unsigned totalBytes() const;
     virtual unsigned bytesLoaded() const;
     virtual void setSize(const WebCore::IntSize&);
     virtual void paint(WebCore::GraphicsContext*, const WebCore::IntRect&);
     virtual void paintCurrentFrameInContext(WebCore::GraphicsContext*, const WebCore::IntRect&);
+    virtual void setPreload(WebCore::MediaPlayer::Preload);
     virtual bool hasSingleSecurityOrigin() const;
     virtual WebCore::MediaPlayer::MovieLoadType movieLoadType() const;
     virtual unsigned decodedFrameCount() const;
@@ -129,6 +131,8 @@ public:
 
 private:
     WebMediaPlayerClientImpl();
+    void startDelayedLoad();
+    void loadInternal();
 
     static WebCore::MediaPlayerPrivateInterface* create(WebCore::MediaPlayer*);
     static void getSupportedTypes(WTF::HashSet<WTF::String>&);
@@ -140,6 +144,9 @@ private:
 
     WebCore::MediaPlayer* m_mediaPlayer;
     OwnPtr<WebMediaPlayer> m_webMediaPlayer;
+    String m_url;
+    bool m_delayingLoad;
+    WebCore::MediaPlayer::Preload m_preload;
 #if USE(ACCELERATED_COMPOSITING)
     RefPtr<WebCore::VideoLayerChromium> m_videoLayer;
     bool m_supportsAcceleratedCompositing;
diff --git a/Source/WebKit/chromium/src/WebNode.cpp b/Source/WebKit/chromium/src/WebNode.cpp
index 68b6f13..cfb8528 100644
--- a/Source/WebKit/chromium/src/WebNode.cpp
+++ b/Source/WebKit/chromium/src/WebNode.cpp
@@ -152,7 +152,7 @@ bool WebNode::isFocusable() const
 
 bool WebNode::isContentEditable() const
 {
-    return m_private->rendererIsEditable();
+    return m_private->isContentEditable();
 }
 
 bool WebNode::isElementNode() const
diff --git a/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp b/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
index 4b65b9e..280747f 100644
--- a/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
@@ -295,7 +295,7 @@ void WebPageSerializerImpl::encodeAndFlushBuffer(
                                        status);
 }
 
-void WebPageSerializerImpl::openTagToString(const Element* element,
+void WebPageSerializerImpl::openTagToString(Element* element,
                                             SerializeDomParam* param)
 {
     // FIXME: use StringBuilder instead of String.
@@ -328,11 +328,13 @@ void WebPageSerializerImpl::openTagToString(const Element* element,
                         result += attrValue;
                     else {
                         // Get the absolute link
-                        String completeURL = param->document->completeURL(attrValue);
+                        WebFrameImpl* subFrame = WebFrameImpl::fromFrameOwnerElement(element);
+                        String completeURL = subFrame ? subFrame->frame()->document()->url() : 
+                                                        param->document->completeURL(attrValue);
                         // Check whether we have local files for those link.
                         if (m_localLinks.contains(completeURL)) {
-                            if (!m_localDirectoryName.isEmpty())
-                                result += "./" + m_localDirectoryName + "/";
+                            if (!param->directoryName.isEmpty())
+                                result += "./" + param->directoryName + "/";
                             result += m_localLinks.get(completeURL);
                         } else
                             result += completeURL;
@@ -360,7 +362,7 @@ void WebPageSerializerImpl::openTagToString(const Element* element,
 }
 
 // Serialize end tag of an specified element.
-void WebPageSerializerImpl::endTagToString(const Element* element,
+void WebPageSerializerImpl::endTagToString(Element* element,
                                            SerializeDomParam* param)
 {
     bool needSkip;
@@ -397,18 +399,18 @@ void WebPageSerializerImpl::endTagToString(const Element* element,
     saveHTMLContentToBuffer(result, param);
 }
 
-void WebPageSerializerImpl::buildContentForNode(const Node* node,
+void WebPageSerializerImpl::buildContentForNode(Node* node,
                                                 SerializeDomParam* param)
 {
     switch (node->nodeType()) {
     case Node::ELEMENT_NODE:
         // Process open tag of element.
-        openTagToString(static_cast<const Element*>(node), param);
+        openTagToString(static_cast<Element*>(node), param);
         // Walk through the children nodes and process it.
-        for (const Node *child = node->firstChild(); child; child = child->nextSibling())
+        for (Node *child = node->firstChild(); child; child = child->nextSibling())
             buildContentForNode(child, param);
         // Process end tag of element.
-        endTagToString(static_cast<const Element*>(node), param);
+        endTagToString(static_cast<Element*>(node), param);
         break;
     case Node::TEXT_NODE:
         saveHTMLContentToBuffer(createMarkup(node), param);
diff --git a/Source/WebKit/chromium/src/WebPageSerializerImpl.h b/Source/WebKit/chromium/src/WebPageSerializerImpl.h
index 5ee8805..b53bd66 100644
--- a/Source/WebKit/chromium/src/WebPageSerializerImpl.h
+++ b/Source/WebKit/chromium/src/WebPageSerializerImpl.h
@@ -174,13 +174,13 @@ private:
                               SerializeDomParam* param,
                               FlushOption);
     // Serialize open tag of an specified element.
-    void openTagToString(const WebCore::Element* element,
+    void openTagToString(WebCore::Element*,
                          SerializeDomParam* param);
     // Serialize end tag of an specified element.
-    void endTagToString(const WebCore::Element* element,
+    void endTagToString(WebCore::Element*,
                         SerializeDomParam* param);
     // Build content for a specified node
-    void buildContentForNode(const WebCore::Node* node,
+    void buildContentForNode(WebCore::Node*,
                              SerializeDomParam* param);
 };
 
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 40f8625..150f173 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -480,12 +480,11 @@ void WebPluginContainerImpl::handleMouseEvent(MouseEvent* event)
         return;
 
     if (event->type() == eventNames().mousedownEvent) {
-        // Ensure that the frame containing the plugin has focus.
         Frame* containingFrame = parentView->frame();
         if (Page* currentPage = containingFrame->page())
-            currentPage->focusController()->setFocusedFrame(containingFrame);
-        // Give focus to our containing HTMLPluginElement.
-        containingFrame->document()->setFocusedNode(m_element);
+            currentPage->focusController()->setFocusedNode(m_element, containingFrame);
+        else
+            containingFrame->document()->setFocusedNode(m_element);
     }
 
     WebCursorInfo cursorInfo;
diff --git a/Source/WebKit/chromium/src/WebPopupMenuImpl.h b/Source/WebKit/chromium/src/WebPopupMenuImpl.h
index 7bb9f7e..58a883f 100644
--- a/Source/WebKit/chromium/src/WebPopupMenuImpl.h
+++ b/Source/WebKit/chromium/src/WebPopupMenuImpl.h
@@ -78,6 +78,7 @@ public:
     virtual bool confirmComposition(const WebString& text);
     virtual WebTextInputType textInputType();
     virtual WebRect caretOrSelectionBounds();
+    virtual bool selectionRange(WebPoint& start, WebPoint& end) const { return false; }
     virtual void setTextDirection(WebTextDirection direction);
     virtual bool isAcceleratedCompositingActive() const { return false; }
 
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index 256bf56..5d64cc8 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -320,4 +320,20 @@ bool WebRuntimeFeatures::isJavaScriptI18NAPIEnabled()
 #endif
 }
 
+void WebRuntimeFeatures::enableQuota(bool enable)
+{
+#if ENABLE(QUOTA)
+    RuntimeEnabledFeatures::setQuotaEnabled(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isQuotaEnabled()
+{
+#if ENABLE(QUOTA)
+    return RuntimeEnabledFeatures::quotaEnabled();
+#else
+    return false;
+#endif
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarImpl.cpp b/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
index 57ea92e..41fac66 100644
--- a/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
+++ b/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
@@ -281,12 +281,16 @@ void WebScrollbarImpl::invalidateScrollbarRect(Scrollbar*, const IntRect& rect)
     m_client->invalidateScrollbarRect(this, webrect);
 }
 
+void WebScrollbarImpl::invalidateScrollCornerRect(const IntRect&)
+{
+}
+
 bool WebScrollbarImpl::isActive() const
 {
     return true;
 }
 
-bool WebScrollbarImpl::scrollbarCornerPresent() const
+bool WebScrollbarImpl::isScrollCornerVisible() const
 {
     return false;
 }
diff --git a/Source/WebKit/chromium/src/WebScrollbarImpl.h b/Source/WebKit/chromium/src/WebScrollbarImpl.h
index ac120cf..82fdbfd 100644
--- a/Source/WebKit/chromium/src/WebScrollbarImpl.h
+++ b/Source/WebKit/chromium/src/WebScrollbarImpl.h
@@ -62,8 +62,10 @@ public:
     virtual int scrollPosition(WebCore::Scrollbar*) const;
     virtual void setScrollOffset(const WebCore::IntPoint&);
     virtual void invalidateScrollbarRect(WebCore::Scrollbar*, const WebCore::IntRect&);
+    virtual void invalidateScrollCornerRect(const WebCore::IntRect&);
     virtual bool isActive() const;
-    virtual bool scrollbarCornerPresent() const;
+    virtual WebCore::IntRect scrollCornerRect() const { return WebCore::IntRect(); }
+    virtual bool isScrollCornerVisible() const;
     virtual void getTickmarks(Vector<WebCore::IntRect>&) const;
     virtual WebCore::Scrollbar* horizontalScrollbar() const;
     virtual WebCore::Scrollbar* verticalScrollbar() const;
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 1089af9..c5b60cc 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -343,6 +343,11 @@ void WebSettingsImpl::setAcceleratedCompositingForAnimationEnabled(bool enabled)
     m_settings->setAcceleratedCompositingForAnimationEnabled(enabled);
 }
 
+void WebSettingsImpl::setAcceleratedDrawingEnabled(bool enabled)
+{
+    m_settings->setAcceleratedDrawingEnabled(enabled);
+}
+
 void WebSettingsImpl::setAccelerated2dCanvasEnabled(bool enabled)
 {
     m_settings->setAccelerated2dCanvasEnabled(enabled);
@@ -373,6 +378,11 @@ void WebSettingsImpl::setInteractiveFormValidationEnabled(bool enabled)
     m_settings->setInteractiveFormValidationEnabled(enabled);
 }
 
+void WebSettingsImpl::setValidationMessageTimerMagnification(int newValue)
+{
+    m_settings->setValidationMessageTimerMagnification(newValue);
+}
+
 void WebSettingsImpl::setMinimumTimerInterval(double interval)
 {
     m_settings->setMinDOMTimerInterval(interval);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index d0319f8..57aa804 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -101,13 +101,15 @@ public:
     virtual void setAcceleratedCompositingForVideoEnabled(bool);
     virtual void setAcceleratedCompositingForPluginsEnabled(bool);
     virtual void setAcceleratedCompositingForCanvasEnabled(bool);
-    virtual void setAcceleratedCompositingForAnimationEnabled(bool);    
+    virtual void setAcceleratedCompositingForAnimationEnabled(bool);
     virtual void setAccelerated2dCanvasEnabled(bool);
+    virtual void setAcceleratedDrawingEnabled(bool);
     virtual void setMemoryInfoEnabled(bool);
     virtual void setHyperlinkAuditingEnabled(bool);
     virtual void setAsynchronousSpellCheckingEnabled(bool);
     virtual void setCaretBrowsingEnabled(bool);
     virtual void setInteractiveFormValidationEnabled(bool);
+    virtual void setValidationMessageTimerMagnification(int);
     virtual void setMinimumTimerInterval(double);
     virtual void setFullScreenEnabled(bool);
 
diff --git a/Source/WebKit/chromium/src/WebStorageQuotaCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebStorageQuotaCallbacksImpl.cpp
new file mode 100644
index 0000000..75a3a8a
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebStorageQuotaCallbacksImpl.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebStorageQuotaCallbacksImpl.h"
+
+#if ENABLE(QUOTA)
+
+#include "DOMCoreException.h"
+#include "StorageInfoErrorCallback.h"
+#include "StorageInfoQuotaCallback.h"
+#include "StorageInfoUsageCallback.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebStorageQuotaCallbacksImpl::WebStorageQuotaCallbacksImpl(PassRefPtr<WebCore::StorageInfoUsageCallback> usageCallback, PassRefPtr<WebCore::StorageInfoErrorCallback> errorCallback)
+    : m_usageCallback(usageCallback)
+    , m_errorCallback(errorCallback)
+{
+}
+
+WebStorageQuotaCallbacksImpl::WebStorageQuotaCallbacksImpl(PassRefPtr<WebCore::StorageInfoQuotaCallback> quotaCallback, PassRefPtr<WebCore::StorageInfoErrorCallback> errorCallback)
+    : m_quotaCallback(quotaCallback)
+    , m_errorCallback(errorCallback)
+{
+}
+
+WebStorageQuotaCallbacksImpl::~WebStorageQuotaCallbacksImpl()
+{
+}
+
+void WebStorageQuotaCallbacksImpl::didQueryStorageUsageAndQuota(unsigned long long usageInBytes, unsigned long long quotaInBytes)
+{
+    if (m_usageCallback)
+        m_usageCallback->handleEvent(usageInBytes, quotaInBytes);
+    delete this;
+}
+
+void WebStorageQuotaCallbacksImpl::didGrantStorageQuota(unsigned long long grantedQuotaInBytes)
+{
+    if (m_quotaCallback)
+        m_quotaCallback->handleEvent(grantedQuotaInBytes);
+    delete this;
+}
+
+void WebStorageQuotaCallbacksImpl::didFail(WebStorageQuotaError error)
+{
+    if (m_errorCallback) {
+        ExceptionCodeDescription description;
+        getExceptionCodeDescription(static_cast<ExceptionCode>(error), description);
+        m_errorCallback->handleEvent(DOMCoreException::create(description).get());
+    }
+    delete this;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(QUOTA)
diff --git a/Source/WebKit/chromium/src/WebStorageQuotaCallbacksImpl.h b/Source/WebKit/chromium/src/WebStorageQuotaCallbacksImpl.h
new file mode 100644
index 0000000..e8209f5
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebStorageQuotaCallbacksImpl.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStorageQuotaCallbacksImpl_h
+#define WebStorageQuotaCallbacksImpl_h
+
+#include "WebStorageQuotaCallbacks.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+class StorageInfoErrorCallback;
+class StorageInfoQuotaCallback;
+class StorageInfoUsageCallback;
+}
+
+namespace WebKit {
+
+class WebStorageQuotaCallbacksImpl : public WebStorageQuotaCallbacks {
+public:
+    // The class is self-destructed and thus we have bare constructors.
+    WebStorageQuotaCallbacksImpl(PassRefPtr<WebCore::StorageInfoUsageCallback>, PassRefPtr<WebCore::StorageInfoErrorCallback>);
+    WebStorageQuotaCallbacksImpl(PassRefPtr<WebCore::StorageInfoQuotaCallback>, PassRefPtr<WebCore::StorageInfoErrorCallback>);
+
+    virtual ~WebStorageQuotaCallbacksImpl();
+
+    virtual void didQueryStorageUsageAndQuota(unsigned long long usageInBytes, unsigned long long quotaInBytes);
+    virtual void didGrantStorageQuota(unsigned long long grantedQuotaInBytes);
+    virtual void didFail(WebStorageQuotaError);
+
+private:
+    RefPtr<WebCore::StorageInfoUsageCallback> m_usageCallback;
+    RefPtr<WebCore::StorageInfoQuotaCallback> m_quotaCallback;
+    RefPtr<WebCore::StorageInfoErrorCallback> m_errorCallback;
+};
+
+} // namespace WebKit
+
+#endif // WebStorageQuotaCallbacksImpl_h
diff --git a/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp b/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp
index b9e5227..f5a6604 100644
--- a/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp
+++ b/Source/WebKit/chromium/src/WebTextCheckingCompletionImpl.cpp
@@ -34,16 +34,31 @@
 #include "SpellChecker.h"
 #include "WebTextCheckingResult.h"
 #include "WebVector.h"
+#include <wtf/Assertions.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-static Vector<SpellCheckingResult> toCoreResults(const WebVector<WebTextCheckingResult>& results)
+static TextCheckingType toCoreCheckingType(WebTextCheckingResult::Error error)
 {
-    Vector<SpellCheckingResult> coreResults;
-    for (size_t i = 0; i < results.size(); ++i)
-        coreResults.append(SpellCheckingResult(static_cast<DocumentMarker::MarkerType>(results[i].error), results[i].position, results[i].length));
+    if (error == WebTextCheckingResult::ErrorSpelling)
+        return TextCheckingTypeSpelling;
+    ASSERT(error == WebTextCheckingResult::ErrorGrammar);
+    return TextCheckingTypeGrammar;
+}
+
+static Vector<TextCheckingResult> toCoreResults(const WebVector<WebTextCheckingResult>& results)
+{
+    Vector<TextCheckingResult> coreResults;
+    for (size_t i = 0; i < results.size(); ++i) { 
+        TextCheckingResult coreResult;
+        coreResult.type = toCoreCheckingType(results[i].error);
+        coreResult.location = results[i].position;
+        coreResult.length = results[i].length;
+        coreResults.append(coreResult);
+    }
+
     return coreResults;
 }
 
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 4efa880..2438a94 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -102,6 +102,7 @@
 #include "WebDevToolsAgentPrivate.h"
 #include "WebDragData.h"
 #include "WebFrameImpl.h"
+#include "WebGraphicsContext3D.h"
 #include "WebImage.h"
 #include "WebInputElement.h"
 #include "WebInputEvent.h"
@@ -125,7 +126,7 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/RefPtr.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGBitmapContext.h>
 #include <CoreGraphics/CGContext.h>
 #endif
@@ -620,11 +621,6 @@ bool WebViewImpl::keyEvent(const WebKeyboardEvent& event)
     }
 #endif // OS(WINDOWS) || OS(LINUX) || OS(FREEBSD)
 
-    // It's not clear if we should continue after detecting a capslock keypress.
-    // I'll err on the side of continuing, which is the pre-existing behaviour.
-    if (event.windowsKeyCode == VKEY_CAPITAL)
-        handler->capsLockStateMayHaveChanged();
-
     PlatformKeyboardEventBuilder evt(event);
 
     if (handler->keyEvent(evt)) {
@@ -1043,7 +1039,7 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
     // PlatformGraphicsContext is actually a pointer to PlatformContextSkia
     GraphicsContext gc(reinterpret_cast<PlatformGraphicsContext*>(&context));
     int bitmapHeight = canvas->getDevice()->accessBitmap(false).height();
-#elif PLATFORM(CG)
+#elif USE(CG)
     GraphicsContext gc(canvas);
     int bitmapHeight = CGBitmapContextGetHeight(reinterpret_cast<CGContextRef>(canvas));
 #else
@@ -1273,7 +1269,7 @@ void WebViewImpl::setFocus(bool enable)
                 Element* element = static_cast<Element*>(focusedNode);
                 if (element->isTextFormControl())
                     element->updateFocusAppearance(true);
-                else if (focusedNode->rendererIsEditable()) {
+                else if (focusedNode->isContentEditable()) {
                     // updateFocusAppearance() selects all the text of
                     // contentseditable DIVs. So we set the selection explicitly
                     // instead. Note that this has the side effect of moving the
@@ -1335,7 +1331,7 @@ bool WebViewImpl::setComposition(
     PassRefPtr<Range> range = editor->compositionRange();
     if (range) {
         const Node* node = range->startContainer();
-        if (!node || !node->rendererIsEditable())
+        if (!node || !node->isContentEditable())
             return false;
     }
 
@@ -1384,7 +1380,7 @@ bool WebViewImpl::confirmComposition(const WebString& text)
     PassRefPtr<Range> range = editor->compositionRange();
     if (range) {
         const Node* node = range->startContainer();
-        if (!node || !node->rendererIsEditable())
+        if (!node || !node->isContentEditable())
             return false;
     }
 
@@ -1443,22 +1439,53 @@ WebRect WebViewImpl::caretOrSelectionBounds()
     if (!view)
         return rect;
 
-    const Node* node = controller->start().deprecatedNode();
+    const Node* node = controller->base().containerNode();
     if (!node || !node->renderer())
         return rect;
 
     if (controller->isCaret())
         rect = view->contentsToWindow(controller->absoluteCaretBounds());
     else if (controller->isRange()) {
-        node = controller->end().deprecatedNode();
-        if (!node || !node->renderer())
-            return rect;
+        node = controller->extent().containerNode();
         RefPtr<Range> range = controller->toNormalizedRange();
+        if (!node || !node->renderer() || !range)
+            return rect;
         rect = view->contentsToWindow(focused->editor()->firstRectForRange(range.get()));
     }
     return rect;
 }
 
+bool WebViewImpl::selectionRange(WebPoint& start, WebPoint& end) const
+{
+    const Frame* frame = focusedWebCoreFrame();
+    if (!frame)
+        return false;
+    RefPtr<Range> selectedRange = frame->selection()->toNormalizedRange();
+    RefPtr<Range> range(Range::create(selectedRange->startContainer()->document(),
+                                      selectedRange->startContainer(),
+                                      selectedRange->startOffset(),
+                                      selectedRange->startContainer(),
+                                      selectedRange->startOffset()));
+
+    IntRect rect = frame->editor()->firstRectForRange(range.get());
+    start.x = rect.x();
+    start.y = rect.y() + rect.height() - 1;
+
+    range = Range::create(selectedRange->endContainer()->document(),
+                          selectedRange->endContainer(),
+                          selectedRange->endOffset(),
+                          selectedRange->endContainer(),
+                          selectedRange->endOffset());
+
+    rect = frame->editor()->firstRectForRange(range.get());
+    end.x = rect.x() + rect.width() - 1;
+    end.y = rect.y() + rect.height() - 1;
+
+    start = frame->view()->contentsToWindow(start);
+    end = frame->view()->contentsToWindow(end);
+    return true;
+}
+
 void WebViewImpl::setTextDirection(WebTextDirection direction)
 {
     // The Editor::setBaseWritingDirection() function checks if we can change
@@ -1793,21 +1820,6 @@ void WebViewImpl::dragSourceSystemDragEnded()
 }
 
 WebDragOperation WebViewImpl::dragTargetDragEnter(
-    const WebDragData& webDragData, int identity, // FIXME: remove identity from this function signature.
-    const WebPoint& clientPoint,
-    const WebPoint& screenPoint,
-    WebDragOperationsMask operationsAllowed)
-{
-    ASSERT(!m_currentDragData.get());
-
-    m_currentDragData = webDragData;
-    UNUSED_PARAM(identity);
-    m_operationsAllowed = operationsAllowed;
-
-    return dragTargetDragEnterOrOver(clientPoint, screenPoint, DragEnter);
-}
-
-WebDragOperation WebViewImpl::dragTargetDragEnter(
     const WebDragData& webDragData,
     const WebPoint& clientPoint,
     const WebPoint& screenPoint,
@@ -2367,35 +2379,6 @@ private:
     WebViewImpl* m_webViewImpl;
 };
 
-class WebViewImplScrollbarPainter : public TilePaintInterface {
-    WTF_MAKE_NONCOPYABLE(WebViewImplScrollbarPainter);
-public:
-    static PassOwnPtr<WebViewImplScrollbarPainter> create(WebViewImpl* webViewImpl)
-    {
-        return adoptPtr(new WebViewImplScrollbarPainter(webViewImpl));
-    }
-
-    virtual void paint(GraphicsContext& context, const IntRect& contentRect)
-    {
-        Page* page = m_webViewImpl->page();
-        if (!page)
-            return;
-        FrameView* view = page->mainFrame()->view();
-
-        context.translate(static_cast<float>(view->scrollX()), static_cast<float>(view->scrollY()));
-        IntRect windowRect = view->contentsToWindow(contentRect);
-        view->paintScrollbars(&context, windowRect);
-    }
-
-private:
-    explicit WebViewImplScrollbarPainter(WebViewImpl* webViewImpl)
-        : m_webViewImpl(webViewImpl)
-    {
-    }
-
-    WebViewImpl* m_webViewImpl;
-};
-
 void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 {
     PlatformBridge::histogramEnumeration("GPU.setIsAcceleratedCompositingActive", active * 2 + m_isAcceleratedCompositingActive, 4);
@@ -2425,7 +2408,8 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
                 context->reshape(std::max(1, m_size.width), std::max(1, m_size.height));
         }
 
-        m_layerRenderer = LayerRendererChromium::create(context.release(), WebViewImplContentPainter::create(this), WebViewImplScrollbarPainter::create(this));
+
+        m_layerRenderer = LayerRendererChromium::create(context.release(), WebViewImplContentPainter::create(this));
         if (m_layerRenderer) {
             m_client->didActivateAcceleratedCompositing(true);
             m_isAcceleratedCompositingActive = true;
@@ -2463,10 +2447,13 @@ void WebViewImpl::doComposite()
 
 void WebViewImpl::reallocateRenderer()
 {
-    RefPtr<GraphicsContext3D> newContext = GraphicsContext3D::create(
+    RefPtr<GraphicsContext3D> newContext = m_temporaryOnscreenGraphicsContext3D.get();
+    WebGraphicsContext3D* webContext = GraphicsContext3DInternal::extractWebGraphicsContext3D(newContext.get());
+    if (!newContext || !webContext || webContext->isContextLost())
+        newContext = GraphicsContext3D::create(
             getCompositorContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
     // GraphicsContext3D::create might fail and return 0, in that case LayerRendererChromium::create will also return 0.
-    RefPtr<LayerRendererChromium> layerRenderer = LayerRendererChromium::create(newContext, WebViewImplContentPainter::create(this), WebViewImplScrollbarPainter::create(this));
+    RefPtr<LayerRendererChromium> layerRenderer = LayerRendererChromium::create(newContext, WebViewImplContentPainter::create(this));
 
     // Reattach the root layer.  Child layers will get reattached as a side effect of updateLayersRecursive.
     if (layerRenderer) {
@@ -2506,18 +2493,20 @@ WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (m_page->settings()->acceleratedCompositingEnabled() && allowsAcceleratedCompositing()) {
-        GraphicsContext3D* context = 0;
-        if (m_layerRenderer)
-            context = m_layerRenderer->context();
-        else if (m_temporaryOnscreenGraphicsContext3D)
-            context = m_temporaryOnscreenGraphicsContext3D.get();
-        else {
-            m_temporaryOnscreenGraphicsContext3D = GraphicsContext3D::create(getCompositorContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
-            if (m_temporaryOnscreenGraphicsContext3D)
-                m_temporaryOnscreenGraphicsContext3D->reshape(std::max(1, m_size.width), std::max(1, m_size.height));
-            context = m_temporaryOnscreenGraphicsContext3D.get();
+        if (m_layerRenderer) {
+            WebGraphicsContext3D* webContext = GraphicsContext3DInternal::extractWebGraphicsContext3D(m_layerRenderer->context());
+            if (webContext && !webContext->isContextLost())
+                return webContext;
+        }
+        if (m_temporaryOnscreenGraphicsContext3D) {
+            WebGraphicsContext3D* webContext = GraphicsContext3DInternal::extractWebGraphicsContext3D(m_temporaryOnscreenGraphicsContext3D.get());
+            if (webContext && !webContext->isContextLost())
+                return webContext;
         }
-        return GraphicsContext3DInternal::extractWebGraphicsContext3D(context);
+        m_temporaryOnscreenGraphicsContext3D = GraphicsContext3D::create(getCompositorContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
+        if (m_temporaryOnscreenGraphicsContext3D)
+            m_temporaryOnscreenGraphicsContext3D->reshape(std::max(1, m_size.width), std::max(1, m_size.height));
+        return GraphicsContext3DInternal::extractWebGraphicsContext3D(m_temporaryOnscreenGraphicsContext3D.get());
     }
 #endif
     return 0;
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index 66b2908..f10202f 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -109,6 +109,7 @@ public:
     virtual bool confirmComposition(const WebString& text);
     virtual WebTextInputType textInputType();
     virtual WebRect caretOrSelectionBounds();
+    virtual bool selectionRange(WebPoint& start, WebPoint& end) const;
     virtual void setTextDirection(WebTextDirection direction);
     virtual bool isAcceleratedCompositingActive() const;
 
@@ -157,11 +158,6 @@ public:
         WebDragOperation operation);
     virtual void dragSourceSystemDragEnded();
     virtual WebDragOperation dragTargetDragEnter(
-        const WebDragData&, int identity, // FIXME: remove identity from this function signature.
-        const WebPoint& clientPoint,
-        const WebPoint& screenPoint,
-        WebDragOperationsMask operationsAllowed);
-    virtual WebDragOperation dragTargetDragEnter(
         const WebDragData&,
         const WebPoint& clientPoint,
         const WebPoint& screenPoint,
diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
index d05322f..5147e15 100644
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
@@ -45,6 +45,7 @@
 #include "WorkerThread.h"
 #include <wtf/MainThread.h>
 #include <wtf/Threading.h>
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -337,26 +338,14 @@ void WorkerFileSystemCallbacksBridge::didReadDirectoryOnWorkerThread(ScriptExecu
     bridge->m_callbacksOnWorkerThread->didReadDirectory(entries, hasMore);
 }
 
-bool WorkerFileSystemCallbacksBridge::derefIfWorkerIsStopped()
-{
-    WebWorkerBase* worker = 0;
-    {
-        MutexLocker locker(m_mutex);
-        worker = m_worker;
-    }
 
-    if (!worker) {
-        m_selfRef.clear();
-        return true;
-    }
-    return false;
-}
-
-void WorkerFileSystemCallbacksBridge::runTaskOnMainThread(WebCore::ScriptExecutionContext* scriptExecutionContext, WorkerFileSystemCallbacksBridge* bridge, PassOwnPtr<WebCore::ScriptExecutionContext::Task> taskToRun)
+void WorkerFileSystemCallbacksBridge::runTaskOnMainThread(WebCore::ScriptExecutionContext* scriptExecutionContext, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, PassOwnPtr<WebCore::ScriptExecutionContext::Task> taskToRun)
 {
     ASSERT(isMainThread());
-    if (bridge->derefIfWorkerIsStopped())
-        return;
+
+    // Every task run will result in one call to mayPostTaskToWorker, which is where this ref is released.
+    WorkerFileSystemCallbacksBridge* leaked = bridge.leakRef();
+    UNUSED_PARAM(leaked);
     taskToRun->performTask(scriptExecutionContext);
 }
 
@@ -372,19 +361,22 @@ void WorkerFileSystemCallbacksBridge::runTaskOnWorkerThread(WebCore::ScriptExecu
 
 void WorkerFileSystemCallbacksBridge::dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task> task)
 {
-    ASSERT(!m_selfRef);
     ASSERT(m_worker);
     ASSERT(m_workerContext->isContextThread());
-    m_selfRef = this;
-    m_worker->dispatchTaskToMainThread(createCallbackTask(&runTaskOnMainThread, this, task));
+    m_worker->dispatchTaskToMainThread(createCallbackTask(&runTaskOnMainThread, RefPtr<WorkerFileSystemCallbacksBridge>(this).release(), task));
 }
 
 void WorkerFileSystemCallbacksBridge::mayPostTaskToWorker(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     ASSERT(isMainThread());
+
+    // Balancing out the ref() done in runTaskOnMainThread. (Since m_mutex is a member and the deref may result
+    // in the destruction of WorkerFileSystemCallbacksBridge, the ordering of the RefPtr and the MutexLocker
+    // is very important, to ensure that the m_mutex is still valid when it gets unlocked.)
+    RefPtr<WorkerFileSystemCallbacksBridge> bridge = adoptRef(this);
     MutexLocker locker(m_mutex);
     if (m_worker)
-        m_worker->postTaskForModeToWorkerContext(createCallbackTask(&runTaskOnWorkerThread, m_selfRef.release(), task), mode);
+        m_worker->postTaskForModeToWorkerContext(createCallbackTask(&runTaskOnWorkerThread, bridge, task), mode);
 }
 
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
index 9a869dc..5af8529 100644
--- a/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
+++ b/Source/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
@@ -122,25 +122,18 @@ private:
     friend class MainThreadFileSystemCallbacks;
 
     // Methods that dispatch WebFileSystemCallbacks on the worker threads.
-    // They release a selfRef of the WorkerFileSystemCallbacksBridge.
     static void didFailOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, WebFileError);
     static void didOpenFileSystemOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const String& name, const String& rootPath);
     static void didSucceedOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*);
     static void didReadMetadataOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const WebFileInfo&);
     static void didReadDirectoryOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const WebVector<WebFileSystemEntry>&, bool hasMore);
 
-    // For early-exist; this deref's selfRef and returns true if the worker is already null.
-    bool derefIfWorkerIsStopped();
-
-    static void runTaskOnMainThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
+    static void runTaskOnMainThread(WebCore::ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge>, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
     static void runTaskOnWorkerThread(WebCore::ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge>, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
 
     void dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
     void mayPostTaskToWorker(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const String& mode);
 
-    // m_selfRef keeps a reference to itself while there's a pending callback on the main thread.
-    RefPtr<WorkerFileSystemCallbacksBridge> m_selfRef;
-
     Mutex m_mutex;
     WebWorkerBase* m_worker;
     WebCore::ScriptExecutionContext* m_workerContext;
diff --git a/Source/WebKit/chromium/src/js/DevTools.js b/Source/WebKit/chromium/src/js/DevTools.js
index 7a3eb8d..e6b7537 100644
--- a/Source/WebKit/chromium/src/js/DevTools.js
+++ b/Source/WebKit/chromium/src/js/DevTools.js
@@ -169,6 +169,10 @@ WebInspector.platformExtensionAPI = function(tabId)
         return tabId;
     }
     webInspector.inspectedWindow.__proto__.__defineGetter__("tabId", getTabId);
+    chrome = window.chrome || {};
+    chrome.devTools = chrome.devTools || {};
+    for (var property in webInspector)
+        chrome.devTools[property] = webInspector[property];
 }
 
 WebInspector.buildPlatformExtensionAPI = function()
diff --git a/Source/WebKit/chromium/src/js/Tests.js b/Source/WebKit/chromium/src/js/Tests.js
index 1d98656..220cf89 100644
--- a/Source/WebKit/chromium/src/js/Tests.js
+++ b/Source/WebKit/chromium/src/js/Tests.js
@@ -81,7 +81,6 @@ TestSuite.prototype.assertEquals = function(expected, actual, opt_message)
     }
 };
 
-
 /**
  * True assertion tests that value == true.
  * @param {Object} value Actual object.
@@ -522,6 +521,105 @@ TestSuite.prototype.testPauseWhenScriptIsRunning = function()
 
 
 /**
+ * Tests network size.
+ */
+TestSuite.prototype.testNetworkSize = function()
+{
+    var test = this;
+
+    function finishResource(resource, finishTime)
+    {
+        test.assertEquals(221, resource.transferSize, "Incorrect total encoded data length");
+        test.assertEquals(25, resource.resourceSize, "Incorrect total data length");
+        test.releaseControl();
+    }
+    
+    this.addSniffer(WebInspector.NetworkDispatcher.prototype, "_finishResource", finishResource);
+
+    // Reload inspected page to sniff network events
+    test.evaluateInConsole_("window.location.reload(true);", function(resultText) {});
+    
+    this.takeControl();
+};
+
+
+/**
+ * Tests network sync size.
+ */
+TestSuite.prototype.testNetworkSyncSize = function()
+{
+    var test = this;
+
+    function finishResource(resource, finishTime)
+    {
+        test.assertEquals(221, resource.transferSize, "Incorrect total encoded data length");
+        test.assertEquals(25, resource.resourceSize, "Incorrect total data length");
+        test.releaseControl();
+    }
+    
+    this.addSniffer(WebInspector.NetworkDispatcher.prototype, "_finishResource", finishResource);
+
+    // Send synchronous XHR  to sniff network events
+    test.evaluateInConsole_("var xhr = new XMLHttpRequest(); xhr.open(\"GET\", \"chunked\", false); xhr.send(null);", function() {});
+    
+    this.takeControl();
+};
+
+
+/**
+ * Tests network raw headers text.
+ */
+TestSuite.prototype.testNetworkRawHeadersText = function()
+{
+    var test = this;
+    
+    function finishResource(resource, finishTime)
+    {
+        var rawResponseHeadersText = resource.rawResponseHeadersText
+        if (!rawResponseHeadersText)
+            test.fail("Failure: resource does not have raw response header text");
+        test.assertEquals(166, resource.rawResponseHeadersText.length, "Incorrect raw response header text length");
+        test.releaseControl();
+    }
+    
+    this.addSniffer(WebInspector.NetworkDispatcher.prototype, "_finishResource", finishResource);
+
+    // Reload inspected page to sniff network events
+    test.evaluateInConsole_("window.location.reload(true);", function(resultText) {});
+    
+    this.takeControl();
+};
+
+
+/**
+ * Tests network timing.
+ */
+TestSuite.prototype.testNetworkTiming = function()
+{
+    var test = this;
+
+    function finishResource(resource, finishTime)
+    {
+        test.assertTrue(resource.timing.receiveHeadersEnd - resource.timing.connectStart >= 100, 
+                        "Time between receiveHeadersEnd and connectStart should be >=100ms, but was " +
+                        "receiveHeadersEnd=" + resource.timing.receiveHeadersEnd + ", connectStart=" + resource.timing.connectStart + ".");
+        test.assertTrue(resource.endTime - resource.startTime >= 0.2, 
+                        "Time between endTime and startTime should be >=200ms, but was " +
+                        "endtime=" + resource.endTime + ", startTime=" + resource.startTime + ".");
+        
+        test.releaseControl();
+    }
+    
+    this.addSniffer(WebInspector.NetworkDispatcher.prototype, "_finishResource", finishResource);
+    
+    // Reload inspected page to sniff network events
+    test.evaluateInConsole_("window.location.reload(true);", function(resultText) {});
+
+    this.takeControl();
+};
+
+
+/**
  * Serializes options collection to string.
  * @param {HTMLOptionsCollection} options
  * @return {string}
diff --git a/Source/WebKit/chromium/tests/CCThreadTaskTest.cpp b/Source/WebKit/chromium/tests/CCThreadTaskTest.cpp
new file mode 100644
index 0000000..1c5f877
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCThreadTaskTest.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCThreadTask.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+using namespace WTF;
+using namespace WebCore;
+
+namespace {
+
+class Mock {
+public:
+    MOCK_METHOD0(method0, void());
+    MOCK_METHOD1(method1, void(int a1));
+    MOCK_METHOD2(method2, void(int a1, int a2));
+    MOCK_METHOD3(method3, void(int a1, int a2, int a3));
+    MOCK_METHOD4(method4, void(int a1, int a2, int a3, int a4));
+};
+
+TEST(CCThreadTaskTest, runnableMethods)
+{
+    Mock mock;
+    EXPECT_CALL(mock, method0()).Times(1);
+    EXPECT_CALL(mock, method1(9)).Times(1);
+    EXPECT_CALL(mock, method2(9, 8)).Times(1);
+    EXPECT_CALL(mock, method3(9, 8, 7)).Times(1);
+    EXPECT_CALL(mock, method4(9, 8, 7, 6)).Times(1);
+
+    createCCThreadTask(&mock, &Mock::method0)->performTask();
+    createCCThreadTask(&mock, &Mock::method1, 9)->performTask();
+    createCCThreadTask(&mock, &Mock::method2, 9, 8)->performTask();
+    createCCThreadTask(&mock, &Mock::method3, 9, 8, 7)->performTask();
+    createCCThreadTask(&mock, &Mock::method4, 9, 8, 7, 6)->performTask();
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/CCThreadTest.cpp b/Source/WebKit/chromium/tests/CCThreadTest.cpp
new file mode 100644
index 0000000..04fba46
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCThreadTest.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCThread.h"
+
+#include "cc/CCCompletionEvent.h"
+#include "cc/CCMainThreadTask.h"
+#include "cc/CCThreadTask.h"
+#include <gtest/gtest.h>
+#include <webkit/support/webkit_support.h>
+
+using namespace WebCore;
+
+namespace {
+
+class PingPongUsingCondition {
+public:
+    void ping(CCCompletionEvent* completion)
+    {
+        hitThreadID = currentThread();
+        completion->signal();
+    }
+
+    ThreadIdentifier hitThreadID;
+};
+
+
+TEST(CCThreadTest, pingPongUsingCondition)
+{
+    OwnPtr<CCThread> thread = CCThread::create();
+    PingPongUsingCondition target;
+    CCCompletionEvent completion;
+    thread->postTask(createCCThreadTask(&target, &PingPongUsingCondition::ping, &completion));
+    completion.wait();
+
+    EXPECT_EQ(thread->threadID(), target.hitThreadID);
+}
+
+class PingPongTestUsingTasks {
+public:
+    void ping()
+    {
+        CCMainThread::postTask(createMainThreadTask(this, &PingPongTestUsingTasks::pong));
+        hit = true;
+    }
+
+    void pong()
+    {
+        EXPECT_TRUE(isMainThread());
+        webkit_support::QuitMessageLoop();
+    }
+
+    bool hit;
+};
+
+TEST(CCThreadTest, startPostAndWaitOnCondition)
+{
+    OwnPtr<CCThread> thread = CCThread::create();
+
+    PingPongTestUsingTasks target;
+    thread->postTask(createCCThreadTask(&target, &PingPongTestUsingTasks::ping));
+    webkit_support::RunMessageLoop();
+
+    EXPECT_TRUE(target.hit);
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp b/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
index 0454ea9..ac4282b 100644
--- a/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBBindingUtilitiesTest.cpp
@@ -53,7 +53,6 @@ public:
     }
 
 private:
-    v8::Locker m_locker;
     v8::HandleScope m_scope;
     v8::Persistent<v8::Context> m_context;
 };
diff --git a/Source/WebKit/chromium/tests/PopupMenuTest.cpp b/Source/WebKit/chromium/tests/PopupMenuTest.cpp
index 8c53ffc..5a18708 100644
--- a/Source/WebKit/chromium/tests/PopupMenuTest.cpp
+++ b/Source/WebKit/chromium/tests/PopupMenuTest.cpp
@@ -142,6 +142,7 @@ public:
     virtual bool confirmComposition(const WebString& text) { return true; }
     virtual WebTextInputType textInputType() { return WebKit::WebTextInputTypeNone; }
     virtual WebRect caretOrSelectionBounds() { return WebRect(); }
+    virtual bool selectionRange(WebPoint& start, WebPoint& end) const { return false; }
     virtual void setTextDirection(WebTextDirection) { }
 };
 
diff --git a/Source/WebKit/chromium/tests/RunAllTests.cpp b/Source/WebKit/chromium/tests/RunAllTests.cpp
index b213de7..500c3dc 100644
--- a/Source/WebKit/chromium/tests/RunAllTests.cpp
+++ b/Source/WebKit/chromium/tests/RunAllTests.cpp
@@ -39,8 +39,11 @@
 #include "WebUnitTests.h"
 #endif
 
+#include <gmock/gmock.h>
+
 int main(int argc, char** argv)
 {
+    ::testing::InitGoogleMock(&argc, argv);
     TestSuite testSuite(argc, argv);
     // TestSuite must be created before SetUpTestEnvironment so it performs
     // initializations needed by WebKit support.
diff --git a/Source/WebKit/chromium/tests/TilingDataTest.cpp b/Source/WebKit/chromium/tests/TilingDataTest.cpp
index a41f7fe..7573dc7 100755
--- a/Source/WebKit/chromium/tests/TilingDataTest.cpp
+++ b/Source/WebKit/chromium/tests/TilingDataTest.cpp
@@ -49,6 +49,24 @@ TEST(TilingDataTest, numTiles_NoTiling)
 
 TEST(TilingDataTest, numTiles_TilingNoBorders)
 {
+    EXPECT_EQ(0, TilingData(0,  0,  0, false).numTiles());
+    EXPECT_EQ(0, TilingData(0,  4,  0, false).numTiles());
+    EXPECT_EQ(0, TilingData(0,  0,  4, false).numTiles());
+    EXPECT_EQ(0, TilingData(4,  4,  0, false).numTiles());
+    EXPECT_EQ(0, TilingData(4,  0,  4, false).numTiles());
+    EXPECT_EQ(0, TilingData(-8, 1,  1, false).numTiles());
+    EXPECT_EQ(0, TilingData(-1, 1,  1, false).numTiles());
+    EXPECT_EQ(0, TilingData(0,  1,  1, false).numTiles());
+
+    EXPECT_EQ(1, TilingData(1,  1,  1, false).numTiles());
+    EXPECT_EQ(2, TilingData(1,  1,  2, false).numTiles());
+    EXPECT_EQ(2, TilingData(1,  2,  1, false).numTiles());
+    EXPECT_EQ(1, TilingData(2,  1,  1, false).numTiles());
+    EXPECT_EQ(1, TilingData(2,  1,  2, false).numTiles());
+    EXPECT_EQ(1, TilingData(2,  2,  1, false).numTiles());
+    EXPECT_EQ(1, TilingData(2,  2,  2, false).numTiles());
+    EXPECT_EQ(1, TilingData(3,  3,  3, false).numTiles());
+
     EXPECT_EQ(1, TilingData(4,  1,  4, false).numTiles());
     EXPECT_EQ(1, TilingData(4,  2,  4, false).numTiles());
     EXPECT_EQ(1, TilingData(4,  3,  4, false).numTiles());
@@ -82,6 +100,23 @@ TEST(TilingDataTest, numTiles_TilingNoBorders)
 
 TEST(TilingDataTest, numTiles_TilingWithBorders)
 {
+    EXPECT_EQ(0, TilingData(0,  0,  0, true).numTiles());
+    EXPECT_EQ(0, TilingData(0,  4,  0, true).numTiles());
+    EXPECT_EQ(0, TilingData(0,  0,  4, true).numTiles());
+    EXPECT_EQ(0, TilingData(4,  4,  0, true).numTiles());
+    EXPECT_EQ(0, TilingData(4,  0,  4, true).numTiles());
+    EXPECT_EQ(0, TilingData(-8, 1,  1, true).numTiles());
+    EXPECT_EQ(0, TilingData(-1, 1,  1, true).numTiles());
+    EXPECT_EQ(0, TilingData(0,  1,  1, true).numTiles());
+
+    EXPECT_EQ(1, TilingData(1,  1,  1, true).numTiles());
+    EXPECT_EQ(0, TilingData(1,  1,  2, true).numTiles());
+    EXPECT_EQ(0, TilingData(1,  2,  1, true).numTiles());
+    EXPECT_EQ(1, TilingData(2,  1,  1, true).numTiles());
+    EXPECT_EQ(1, TilingData(2,  1,  2, true).numTiles());
+    EXPECT_EQ(1, TilingData(2,  2,  1, true).numTiles());
+    EXPECT_EQ(1, TilingData(2,  2,  2, true).numTiles());
+
     EXPECT_EQ(1, TilingData(3,  1,  3, true).numTiles());
     EXPECT_EQ(1, TilingData(3,  2,  3, true).numTiles());
     EXPECT_EQ(1, TilingData(3,  3,  3, true).numTiles());
@@ -361,7 +396,7 @@ TEST(TilingDataTest, setTotalSize)
     EXPECT_EQ(2, data.tileSizeY(2));
 }
 
-TEST(TilingDataTest, setMaxTextureSize)
+TEST(TilingDataTest, setMaxTextureSizeNoBorders)
 {
     TilingData data(8, 16, 32, false);
     EXPECT_EQ(2, data.numTilesX());
@@ -383,4 +418,26 @@ TEST(TilingDataTest, setMaxTextureSize)
     EXPECT_EQ(7, data.numTilesY());
 }
 
+TEST(TilingDataTest, setMaxTextureSizeBorders)
+{
+    TilingData data(8, 16, 32, true);
+    EXPECT_EQ(3, data.numTilesX());
+    EXPECT_EQ(5, data.numTilesY());
+
+    data.setMaxTextureSize(32);
+    EXPECT_EQ(32, data.maxTextureSize());
+    EXPECT_EQ(1, data.numTilesX());
+    EXPECT_EQ(1, data.numTilesY());
+
+    data.setMaxTextureSize(2);
+    EXPECT_EQ(2, data.maxTextureSize());
+    EXPECT_EQ(0, data.numTilesX());
+    EXPECT_EQ(0, data.numTilesY());
+
+    data.setMaxTextureSize(5);
+    EXPECT_EQ(5, data.maxTextureSize());
+    EXPECT_EQ(5, data.numTilesX());
+    EXPECT_EQ(10, data.numTilesY());
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/TransparencyWinTest.cpp b/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
index ee3307f..191bf9e 100644
--- a/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
+++ b/Source/WebKit/chromium/tests/TransparencyWinTest.cpp
@@ -50,8 +50,8 @@ static FloatRect RECTToFloatRect(const RECT* rect)
 static void drawNativeRect(GraphicsContext* context,
                            int x, int y, int w, int h)
 {
-    skia::PlatformCanvas* canvas = context->platformContext()->canvas();
-    HDC dc = canvas->beginPlatformPaint();
+    SkCanvas* canvas = context->platformContext()->canvas();
+    HDC dc = skia::BeginPlatformPaint(canvas);
 
     RECT innerRc;
     innerRc.left = x;
@@ -61,13 +61,12 @@ static void drawNativeRect(GraphicsContext* context,
     FillRect(dc, &innerRc,
              reinterpret_cast<HBRUSH>(GetStockObject(BLACK_BRUSH)));
 
-    canvas->endPlatformPaint();
+    skia::EndPlatformPaint(canvas);
 }
 
 static Color getPixelAt(GraphicsContext* context, int x, int y)
 {
-    const SkBitmap& bitmap = context->platformContext()->canvas()->
-        getTopPlatformDevice().accessBitmap(false);
+    const SkBitmap& bitmap = context->platformContext()->canvas()->getTopDevice()->accessBitmap(false);
     return Color(*reinterpret_cast<const RGBA32*>(bitmap.getAddr32(x, y)));
 }
 
@@ -75,8 +74,7 @@ static Color getPixelAt(GraphicsContext* context, int x, int y)
 // Windows messing it up.
 static void clearTopLayerAlphaChannel(GraphicsContext* context)
 {
-    SkBitmap& bitmap = const_cast<SkBitmap&>(context->platformContext()->
-        canvas()->getTopPlatformDevice().accessBitmap(false));
+    SkBitmap& bitmap = const_cast<SkBitmap&>(context->platformContext()->canvas()->getTopDevice()->accessBitmap(false));
     for (int y = 0; y < bitmap.height(); y++) {
         uint32_t* row = bitmap.getAddr32(0, y);
         for (int x = 0; x < bitmap.width(); x++)
@@ -87,8 +85,7 @@ static void clearTopLayerAlphaChannel(GraphicsContext* context)
 // Clears the alpha channel on the specified pixel.
 static void clearTopLayerAlphaPixel(GraphicsContext* context, int x, int y)
 {
-    SkBitmap& bitmap = const_cast<SkBitmap&>(context->platformContext()->
-        canvas()->getTopPlatformDevice().accessBitmap(false));
+    SkBitmap& bitmap = const_cast<SkBitmap&>(context->platformContext()->canvas()->getTopDevice()->accessBitmap(false));
     *bitmap.getAddr32(x, y) &= 0x00FFFFFF;
 }
 
@@ -559,9 +556,7 @@ TEST(TransparencyWin, Scale)
         // the helper goes out of scope. We don't want to call
         // clearTopLayerAlphaChannel because that will actually clear the whole
         // canvas (since we have no extra layer!).
-        SkBitmap& bitmap = const_cast<SkBitmap&>(helper.context()->
-            platformContext()->canvas()->getTopPlatformDevice().
-            accessBitmap(false));
+        SkBitmap& bitmap = const_cast<SkBitmap&>(helper.context()->platformContext()->canvas()->getTopDevice()->accessBitmap(false));
         *bitmap.getAddr32(2, 2) &= 0x00FFFFFF;
         helper.composite();
     }
diff --git a/Source/WebKit/chromium/tests/UniscribeHelperTest.cpp b/Source/WebKit/chromium/tests/UniscribeHelperTest.cpp
index 8aaed11..ec88f43 100644
--- a/Source/WebKit/chromium/tests/UniscribeHelperTest.cpp
+++ b/Source/WebKit/chromium/tests/UniscribeHelperTest.cpp
@@ -115,7 +115,7 @@ TEST_F(UniscribeTest, TooBig)
     {
         UniscribeHelper uniscribe(
             input.characters(), static_cast<int>(input.length()),
-            false, hfont, scriptCache, &properties);
+            false, hfont, scriptCache, &properties, 0);
         uniscribe.initWithOptionalLengthProtection(false);
 
         // There should be one shaping entry, with nothing in it.
@@ -148,7 +148,7 @@ TEST_F(UniscribeTest, TooBig)
     {
         UniscribeHelper uniscribe(
             input.characters(), static_cast<int>(input.length()),
-            false, hfont, scriptCache, &properties);
+            false, hfont, scriptCache, &properties, 0);
         uniscribe.initWithOptionalLengthProtection(true);
 
         // There should be 0 runs and shapes.
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index 891fa83..b38d544 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -35,11 +35,13 @@
 #include <webkit/support/webkit_support.h>
 #include "WebFrame.h"
 #include "WebFrameClient.h"
+#include "WebSettings.h"
 #include "WebString.h"
 #include "WebURL.h"
 #include "WebURLRequest.h"
 #include "WebURLResponse.h"
 #include "WebView.h"
+#include "v8.h"
 
 using namespace WebKit;
 
@@ -47,25 +49,44 @@ namespace {
 
 class WebFrameTest : public testing::Test {
 public:
-    WebFrameTest() {}
+    WebFrameTest()
+        : baseURL("http://www.test.com/")
+    {
+    }
 
     virtual void TearDown()
     {
         webkit_support::UnregisterAllMockedURLs();
     }
 
-    void registerMockedURLLoad(const WebURL& url, const WebURLResponse& response, const WebString& fileName)
+    void registerMockedURLLoad(const std::string& fileName)
     {
+        WebURLResponse response;
+        response.initialize();
+        response.setMIMEType("text/html");
+
         std::string filePath = webkit_support::GetWebKitRootDir().utf8();
-        filePath.append("/Source/WebKit/chromium/tests/data/");
-        filePath.append(fileName.utf8());
-        webkit_support::RegisterMockedURL(url, response, WebString::fromUTF8(filePath));
+        filePath += "/Source/WebKit/chromium/tests/data/";
+        filePath += fileName;
+
+        webkit_support::RegisterMockedURL(WebURL(GURL(baseURL + fileName)), response, WebString::fromUTF8(filePath));
     }
 
     void serveRequests()
     {
         webkit_support::ServeAsynchronousMockedRequests();
     }
+
+    void loadFrame(WebFrame* frame, const std::string& fileName)
+    {
+        WebURLRequest urlRequest;
+        urlRequest.initialize();
+        urlRequest.setURL(WebURL(GURL(baseURL + fileName)));
+        frame->loadRequest(urlRequest);
+    }
+
+protected:
+    std::string baseURL;
 };
 
 class TestWebFrameClient : public WebFrameClient {
@@ -73,31 +94,17 @@ class TestWebFrameClient : public WebFrameClient {
 
 TEST_F(WebFrameTest, ContentText)
 {
-    // Register our resources.
-    WebURLResponse response;
-    response.initialize();
-    response.setMIMEType("text/html");
-    std::string rootURL = "http://www.test.com/";
-    const char* files[] = { "iframes_test.html", "visible_iframe.html",
-                            "invisible_iframe.html", "zero_sized_iframe.html" };
-    for (int i = 0; i < (sizeof(files) / sizeof(char*)); ++i) {
-        WebURL webURL = GURL(rootURL + files[i]);
-        registerMockedURLLoad(webURL, response, WebString::fromUTF8(files[i]));
-    }
+    registerMockedURLLoad("iframes_test.html");
+    registerMockedURLLoad("visible_iframe.html");
+    registerMockedURLLoad("invisible_iframe.html");
+    registerMockedURLLoad("zero_sized_iframe.html");
 
-    // Create and initialize the WebView.    
+    // Create and initialize the WebView.
     TestWebFrameClient webFrameClient;
     WebView* webView = WebView::create(0);
     webView->initializeMainFrame(&webFrameClient);
 
-    // Load the main frame URL.
-    WebURL testURL(GURL(rootURL + files[0]));
-    WebURLRequest urlRequest;
-    urlRequest.initialize();
-    urlRequest.setURL(testURL);
-    webView->mainFrame()->loadRequest(urlRequest);
-
-    // Load all pending asynchronous requests.
+    loadFrame(webView->mainFrame(), "iframes_test.html");
     serveRequests();
 
     // Now retrieve the frames text and test it only includes visible elements.
@@ -111,4 +118,31 @@ TEST_F(WebFrameTest, ContentText)
     webView->close();
 }
 
+TEST_F(WebFrameTest, FrameForEnteredContext)
+{
+    registerMockedURLLoad("iframes_test.html");
+    registerMockedURLLoad("visible_iframe.html");
+    registerMockedURLLoad("invisible_iframe.html");
+    registerMockedURLLoad("zero_sized_iframe.html");
+
+    // Create and initialize the WebView.
+    TestWebFrameClient webFrameClient;
+    WebView* webView = WebView::create(0);
+    webView->settings()->setJavaScriptEnabled(true);
+    webView->initializeMainFrame(&webFrameClient);
+
+    loadFrame(webView->mainFrame(), "iframes_test.html");
+    serveRequests();
+
+    v8::HandleScope scope;
+    EXPECT_EQ(webView->mainFrame(),
+              WebFrame::frameForContext(
+                  webView->mainFrame()->mainWorldScriptContext()));
+    EXPECT_EQ(webView->mainFrame()->firstChild(),
+              WebFrame::frameForContext(
+                  webView->mainFrame()->firstChild()->mainWorldScriptContext()));
+
+    webView->close();
+}
+
 }
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index 35da09c..aac8298 100644..100755
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,132 @@
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename lengthReceived to encodedDataLength/dataLength
+        https://bugs.webkit.org/show_bug.cgi?id=58883
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::dispatchDidReceiveContentLength):
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+
+2011-04-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84155.
+        http://trac.webkit.org/changeset/84155
+        https://bugs.webkit.org/show_bug.cgi?id=58802
+
+        "paintEntireContents flag is used for painting outside of the
+        screen. It's not the right way to fix EFL tiled backing
+        store." (Requested by demarchi on #webkit).
+
+        * ewk/ewk_view_tiled.c:
+        (_ewk_view_tiled_smart_add):
+
+2011-04-18  Eunsol Park  <eunsol47.park@samsung.com>
+
+        Reviewed by Eric Seidel.
+
+        [EFL] Scroll doesn't work on tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=55021
+
+        Scroll doesn't work on tiled backing store, but it works on single.
+        If ewk_frame_paint_full_set() set True, view size return content size and scroll can't be made. 
+        so, ewk_frame_paint_full_set() is removed from ewk_tiled_smart_add().
+
+        * ewk/ewk_view_tiled.c:
+        (_ewk_view_tiled_smart_add):
+
+2011-04-14  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        Memory cache API
+        https://bugs.webkit.org/show_bug.cgi?id=58016
+
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_cache_enable_get):
+        (ewk_settings_cache_enable_set):
+        (ewk_settings_cache_capacity_set):
+        * ewk/ewk_settings.h:
+
+2011-04-13  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        Reviewed by Kent Tamura.
+
+        [EFL] Doxygen documentation for ewk_main, ewk_history and tools
+        https://bugs.webkit.org/show_bug.cgi?id=58428
+
+        * ewk/EWebKit.h:
+        * ewk/ewk_eapi.h:
+        * ewk/ewk_history.h:
+        * ewk/ewk_logging.h:
+        * ewk/ewk_main.cpp:
+        * ewk/ewk_main.h:
+        * ewk/ewk_private.h:
+        * ewk/ewk_util.cpp:
+        * ewk/ewk_util.h:
+
+2011-04-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Adjust dpi value to viewport computation.
+        https://bugs.webkit.org/show_bug.cgi?id=58130
+
+        In viewport computation, EFL port have used 160 value for DPI since now.
+        But, we have to use device's dpi value for viewport meta tag computation.
+
+        * ewk/ewk_view.cpp:
+        (_ewk_view_viewport_attributes_compute):
+
+2011-04-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Eric Carlson.
+
+        [EFL] Add seek forward / backward buttons to MediaControl UI.
+        https://bugs.webkit.org/show_bug.cgi?id=56810
+
+        Add seek forward / backward buttons to media control.
+
+        * DefaultTheme/default.edc:
+        * DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc: Added.
+        * DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png: Added.
+        * DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforward_button.edc: Added.
+        * DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforwardbutton.png: Added.
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+        
+        * WebCoreSupport/EditorClientEfl.h:
+        (WebCore::EditorClientEfl::requestCheckingOfString):
+
+2011-04-01  Grzegorz Czajkowski  <g.czajkowski@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Synchronization between WebCore's ContextMenuItem.h and ewk_contextmenu.h
+        https://bugs.webkit.org/show_bug.cgi?id=57000
+
+        * ewk/ewk_contextmenu.h:
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::dispatchDidReceiveTitle):
+        (WebCore::FrameLoaderClientEfl::setTitle):
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+
 2011-03-29  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
 
         Reviewed by Antonio Gomes.
diff --git a/Source/WebKit/efl/DefaultTheme/default.edc b/Source/WebKit/efl/DefaultTheme/default.edc
index f77bd86..e6fbde5 100644
--- a/Source/WebKit/efl/DefaultTheme/default.edc
+++ b/Source/WebKit/efl/DefaultTheme/default.edc
@@ -78,4 +78,6 @@ collections {
 #include "widget/slider/slider.edc"
 #include "widget/mediacontrol/playpausebutton/playpause_button.edc"
 #include "widget/mediacontrol/mutebutton/mute_button.edc"
+#include "widget/mediacontrol/seekforwardbutton/seekforward_button.edc"
+#include "widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc"
 }
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc
new file mode 100644
index 0000000..1bb253c
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) 2008,2009 INdT - Instituto Nokia de Tecnologia
+    Copyright (C) 2009,2010 ProFUSION embedded systems
+    Copyright (C) 2011 Samsung Electronics
+
+    This file is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This file is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+   group {
+      name: "webkit/widget/mediacontrol/seekbackward_button";
+
+      images {
+         image: "widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png" COMP;
+      }
+
+      parts {
+         part {
+            name: "seekbackward_button";
+            type: IMAGE;
+            description { state: "default" 0.0;
+               min: 25 25;
+            }
+            description { state: "seekbackward" 0.0;
+               inherit: "default" 0.0;
+               image.normal: "widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png";
+            }
+         }
+      }
+
+      programs {
+         program {
+             signal: "seekbackward";
+             action: STATE_SET "seekbackward" 0.0;
+             target: "seekbackward_button";
+         }
+      }
+   }
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png
new file mode 100755
index 0000000..f3467cd
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforward_button.edc b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforward_button.edc
new file mode 100644
index 0000000..e34e7f7
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforward_button.edc
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) 2008,2009 INdT - Instituto Nokia de Tecnologia
+    Copyright (C) 2009,2010 ProFUSION embedded systems
+    Copyright (C) 2011 Samsung Electronics
+
+    This file is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This file is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+   group {
+      name: "webkit/widget/mediacontrol/seekforward_button";
+
+      images {
+         image: "widget/mediacontrol/seekforwardbutton/seekforwardbutton.png" COMP;
+      }
+
+      parts {
+         part {
+            name: "seekforward_button";
+            type: IMAGE;
+            description { state: "default" 0.0;
+               min: 25 25;
+            }
+            description { state: "seekforward" 0.0;
+               inherit: "default" 0.0;
+               image.normal: "widget/mediacontrol/seekforwardbutton/seekforwardbutton.png";
+            }
+         }
+      }
+
+      programs {
+         program {
+             signal: "seekforward";
+             action: STATE_SET "seekforward" 0.0;
+             target: "seekforward_button";
+         }
+      }
+   }
diff --git a/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforwardbutton.png b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforwardbutton.png
new file mode 100755
index 0000000..c2fe828
--- /dev/null
+++ b/Source/WebKit/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforwardbutton.png
diff --git a/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.h b/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.h
index 575a50d..56b3300 100644
--- a/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.h
@@ -114,7 +114,7 @@ public:
     virtual void getGuessesForWord(const String& word, const String& context, WTF::Vector<String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&) {}
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
     virtual TextCheckerClient* textChecker() { return this; }
 
 private:
diff --git a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
index fa34ac9..9a409f2 100644
--- a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
@@ -576,9 +576,10 @@ void FrameLoaderClientEfl::dispatchDidStartProvisionalLoad()
         ewk_view_load_provisional(m_view);
 }
 
-void FrameLoaderClientEfl::dispatchDidReceiveTitle(const String& title)
+void FrameLoaderClientEfl::dispatchDidReceiveTitle(const StringWithDirection& title)
 {
-    CString cs = title.utf8();
+    // FIXME: use direction of title.
+    CString cs = title.string().utf8();
     ewk_frame_title_set(m_frame, cs.data());
 
     if (ewk_view_frame_main_get(m_view) != m_frame)
@@ -709,12 +710,12 @@ void FrameLoaderClientEfl::prepareForDataSourceReplacement()
     notImplemented();
 }
 
-void FrameLoaderClientEfl::setTitle(const String& title, const KURL& url)
+void FrameLoaderClientEfl::setTitle(const StringWithDirection& title, const KURL& url)
 {
     // no need for, dispatchDidReceiveTitle is the right callback
 }
 
-void FrameLoaderClientEfl::dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
+void FrameLoaderClientEfl::dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int dataLength)
 {
     notImplemented();
 }
diff --git a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
index 5ea4e8c..3efa2f5 100644
--- a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
@@ -88,7 +88,7 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
 
     virtual void dispatchDidCancelAuthenticationChallenge(DocumentLoader*, unsigned long  identifier, const AuthenticationChallenge&);
     virtual void dispatchDidReceiveResponse(DocumentLoader*, unsigned long  identifier, const ResourceResponse&);
-    virtual void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived);
+    virtual void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int dataLength);
     virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long  identifier);
     virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long  identifier, const ResourceError&);
     virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length);
@@ -102,7 +102,7 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
-    virtual void dispatchDidReceiveTitle(const String&);
+    virtual void dispatchDidReceiveTitle(const StringWithDirection&);
     virtual void dispatchDidChangeIcons();
     virtual void dispatchDidCommitLoad();
     virtual void dispatchDidFailProvisionalLoad(const ResourceError&);
@@ -193,7 +193,7 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
     virtual void prepareForDataSourceReplacement();
 
     virtual WTF::PassRefPtr<DocumentLoader> createDocumentLoader(const ResourceRequest&, const SubstituteData&);
-    virtual void setTitle(const String& title, const KURL&);
+    virtual void setTitle(const StringWithDirection& title, const KURL&);
 
     virtual String userAgent(const KURL&);
 
diff --git a/Source/WebKit/efl/ewk/EWebKit.h b/Source/WebKit/efl/ewk/EWebKit.h
index 183e9dc..6d741e9 100644
--- a/Source/WebKit/efl/ewk/EWebKit.h
+++ b/Source/WebKit/efl/ewk/EWebKit.h
@@ -19,6 +19,13 @@
     Boston, MA 02110-1301, USA.
 */
 
+/**
+ * @file    EWebKit.h
+ * @brief   Contains the header files that are required by WebKit-EFL.
+ *
+ * It includes the all header files that are exported to public API and Evas header.
+ */
+
 #ifndef EWebKit_h
 #define EWebKit_h
 
diff --git a/Source/WebKit/efl/ewk/ewk_contextmenu.h b/Source/WebKit/efl/ewk/ewk_contextmenu.h
index 7b60410..d9e3e83 100644
--- a/Source/WebKit/efl/ewk/ewk_contextmenu.h
+++ b/Source/WebKit/efl/ewk/ewk_contextmenu.h
@@ -98,11 +98,21 @@ enum _Ewk_Context_Menu_Action {
     EWK_CONTEXT_MENU_ITEM_TAG_RIGHT_TO_LEFT,
     EWK_CONTEXT_MENU_ITEM_TAG_PDFSINGLE_PAGE_SCROLLING,
     EWK_CONTEXT_MENU_ITEM_TAG_PDFFACING_PAGES_SCROLLING,
+    // EWK_CONTEXT_MENU_ITEM_TAG_INSPECT_ELEMENT, /**< This feature is disabled in WebKit-EFL - it is a subject to INSPECTOR build variable */
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_MENU, /**< text direction sub-menu */
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_DEFAULT,
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_LEFT_TO_RIGHT,
     EWK_CONTEXT_MENU_ITEM_TAG_TEXT_DIRECTION_RIGHT_TO_LEFT,
+    EWK_CONTEXT_MENU_ITEM_OPEN_MEDIA_IN_NEW_WINDOW,
+    EWK_CONTEXT_MENU_ITEM_TAG_COPY_MEDIA_LINK_TO_CLIPBOARD,
+    EWK_CONTEXT_MENU_ITEM_TAG_TOGGLE_MEDIA_CONTROLS,
+    EWK_CONTEXT_MENU_ITEM_TAG_TOGGLE_MEDIA_LOOP,
+    EWK_CONTEXT_MENU_ITEM_TAG_ENTER_VIDEO_FULLSCREEN,
+    EWK_CONTEXT_MENU_ITEM_TAG_MEDIA_PLAY_PAUSE,
+    EWK_CONTEXT_MENU_ITEM_TAG_MEDIA_MUTE,
     EWK_CONTEXT_MENU_ITEM_BASE_CUSTOM_TAG = 5000,
+    EWK_CONTEXT_MENU_ITEM_CUSTOM_TAG_NO_ACTION = 5998,
+    EWK_CONTEXT_MENU_ITEM_LAST_CUSTOM_TAG = 5999,
     EWK_CONTEXT_MENU_ITEM_BASE_APPLICATION_TAG = 10000
 };
 /** Creates a type name for _Ewk_Context_Menu_Action */
diff --git a/Source/WebKit/efl/ewk/ewk_eapi.h b/Source/WebKit/efl/ewk/ewk_eapi.h
index adb8d7b..11f4371 100644
--- a/Source/WebKit/efl/ewk/ewk_eapi.h
+++ b/Source/WebKit/efl/ewk/ewk_eapi.h
@@ -18,6 +18,15 @@
     Boston, MA 02110-1301, USA.
 */
 
+/**
+ * @file    ewk_eapi.h
+ * @brief   Defines EAPI macro.
+ *
+ * The macro must be used in declaration of public functions.
+ * Functions without EAPI macro have hidden most of symbols and
+ * they are not visible for target applications.
+ */
+
 #ifndef ewk_eapi_h
 #define ewk_eapi_h
 
diff --git a/Source/WebKit/efl/ewk/ewk_history.h b/Source/WebKit/efl/ewk/ewk_history.h
index 3943d7e..3cae74e 100644
--- a/Source/WebKit/efl/ewk/ewk_history.h
+++ b/Source/WebKit/efl/ewk/ewk_history.h
@@ -32,7 +32,8 @@ extern "C" {
 #endif
 
 /**
- * The history (back-forward list) associated with a given ewk_view.
+ * @file ewk_history.h
+ * @brief The history (back-forward list) associated with a given ewk_view.
  *
  * Changing the history affects immediately the view, changing the
  * current uri, for example.
diff --git a/Source/WebKit/efl/ewk/ewk_logging.h b/Source/WebKit/efl/ewk/ewk_logging.h
index 045bd9c..f8a7f41 100644
--- a/Source/WebKit/efl/ewk/ewk_logging.h
+++ b/Source/WebKit/efl/ewk/ewk_logging.h
@@ -18,6 +18,11 @@
     Boston, MA 02110-1301, USA.
 */
 
+/**
+ * @file    ewk_logging.h
+ * @brief   Provides macros for logging.
+ */
+
 #ifndef ewk_logging_h
 #define ewk_logging_h
 
diff --git a/Source/WebKit/efl/ewk/ewk_main.cpp b/Source/WebKit/efl/ewk/ewk_main.cpp
index 0c7cc70..9687f10 100644
--- a/Source/WebKit/efl/ewk/ewk_main.cpp
+++ b/Source/WebKit/efl/ewk/ewk_main.cpp
@@ -56,10 +56,25 @@
 #endif
 
 static int _ewk_init_count = 0;
+
+/**
+ * \var     _ewk_log_dom
+ * @brief   the log domain identifier that is used with EINA's macros
+ */
 int _ewk_log_dom = -1;
 
 static Eina_Bool _ewk_init_body(void);
 
+/**
+ * Initializes webkit's instance.
+ *
+ * - initializes components needed by Efl,
+ * - sets web database location,
+ * - sets page cache capacity,
+ * - increases a reference count of webkit's instance.
+ *
+ * @return a reference count of webkit's instance on success or 0 on failure
+ */
 int ewk_init(void)
 {
     if (_ewk_init_count)
@@ -113,6 +128,13 @@ error_eina:
     return 0;
 }
 
+/**
+ * Decreases a reference count of webkit's instance, possibly destroying it.
+ *
+ * If the reference count reaches 0 webkit's instance is destroyed.
+ *
+ * @return a reference count of webkit's instance
+ */
 int ewk_shutdown(void)
 {
     _ewk_init_count--;
diff --git a/Source/WebKit/efl/ewk/ewk_main.h b/Source/WebKit/efl/ewk/ewk_main.h
index 3730e88..257babc 100644
--- a/Source/WebKit/efl/ewk/ewk_main.h
+++ b/Source/WebKit/efl/ewk/ewk_main.h
@@ -18,6 +18,11 @@
     Boston, MA 02110-1301, USA.
 */
 
+/**
+ * @file    ewk_main.h
+ * @brief   The main file of WebKit-EFL, not tied to any view object.
+ */
+
 #ifndef ewk_main_h
 #define ewk_main_h
 
diff --git a/Source/WebKit/efl/ewk/ewk_private.h b/Source/WebKit/efl/ewk/ewk_private.h
index 114c39e..c3de98a 100644
--- a/Source/WebKit/efl/ewk/ewk_private.h
+++ b/Source/WebKit/efl/ewk/ewk_private.h
@@ -18,6 +18,11 @@
     Boston, MA 02110-1301, USA.
 */
 
+/**
+ * @file    ewk_private.h
+ * @brief   Private methods of WebKit-EFL.
+ */
+
 #ifndef ewk_private_h
 #define ewk_private_h
 
diff --git a/Source/WebKit/efl/ewk/ewk_settings.cpp b/Source/WebKit/efl/ewk/ewk_settings.cpp
index 3a185d9..16abdc7 100644
--- a/Source/WebKit/efl/ewk/ewk_settings.cpp
+++ b/Source/WebKit/efl/ewk/ewk_settings.cpp
@@ -29,6 +29,7 @@
 #include "Image.h"
 #include "IntSize.h"
 #include "KURL.h"
+#include "MemoryCache.h"
 #include "ewk_private.h"
 
 #include <Eina.h>
@@ -326,6 +327,46 @@ const char* ewk_settings_proxy_uri_get(void)
 }
 
 /**
+ * Gets status of the memory cache of WebCore.
+ *
+ * @return @c EINA_TRUE if the cache is enabled or @c EINA_FALSE if not
+ */
+Eina_Bool ewk_settings_cache_enable_get(void)
+{
+    WebCore::MemoryCache* cache = WebCore::memoryCache();
+    return !cache->disabled();
+}
+
+/**
+ * Enables/disables the memory cache of WebCore, possibly clearing it.
+ *
+ * Disabling the cache will remove all resources from the cache.
+ * They may still live on if they are referenced by some Web page though.
+ *
+ * @param set @c EINA_TRUE to enable memory cache, @c EINA_FALSE to disable
+ */
+void ewk_settings_cache_enable_set(Eina_Bool set)
+{
+    WebCore::MemoryCache* cache = WebCore::memoryCache();
+    set = !set;
+    if (cache->disabled() != set)
+        cache->setDisabled(set);
+}
+
+/**
+ * Sets capacity of memory cache of WebCore.
+ *
+ * WebCore sets default value of memory cache on 8192 * 1024 bytes.
+ *
+ * @param capacity the maximum number of bytes that the cache should consume overall
+ */
+void ewk_settings_cache_capacity_set(unsigned capacity)
+{
+    WebCore::MemoryCache* cache = WebCore::memoryCache();
+    cache->setCapacities(0, capacity, capacity);
+}
+
+/**
  * @internal
  *
  * Gets the default user agent string.
diff --git a/Source/WebKit/efl/ewk/ewk_settings.h b/Source/WebKit/efl/ewk/ewk_settings.h
index 3e5ca47..0bbdb48 100644
--- a/Source/WebKit/efl/ewk/ewk_settings.h
+++ b/Source/WebKit/efl/ewk/ewk_settings.h
@@ -54,6 +54,10 @@ EAPI const char      *ewk_settings_cache_directory_path_get(void);
 EAPI void             ewk_settings_proxy_uri_set(const char* proxy);
 EAPI const char*      ewk_settings_proxy_uri_get(void);
 
+EAPI Eina_Bool        ewk_settings_cache_enable_get(void);
+EAPI void             ewk_settings_cache_enable_set(Eina_Bool set);
+EAPI void             ewk_settings_cache_capacity_set(unsigned capacity);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit/efl/ewk/ewk_util.cpp b/Source/WebKit/efl/ewk/ewk_util.cpp
index 6830f76..b01be72 100644
--- a/Source/WebKit/efl/ewk/ewk_util.cpp
+++ b/Source/WebKit/efl/ewk/ewk_util.cpp
@@ -24,6 +24,13 @@
 #include "ewk_private.h"
 #include <eina_safety_checks.h>
 
+/**
+ * Converts an image from cairo_surface to the Evas_Object.
+ *
+ * @param canvas display canvas
+ * @param surface cairo representation of an image
+ * @return converted cairo_surface object to the Evas_Object
+ */
 Evas_Object* ewk_util_image_from_cairo_surface_add(Evas* canvas, cairo_surface_t* surface)
 {
     cairo_status_t status;
diff --git a/Source/WebKit/efl/ewk/ewk_util.h b/Source/WebKit/efl/ewk/ewk_util.h
index d9c8f9c..2371888 100644
--- a/Source/WebKit/efl/ewk/ewk_util.h
+++ b/Source/WebKit/efl/ewk/ewk_util.h
@@ -18,6 +18,11 @@
     Boston, MA 02110-1301, USA.
 */
 
+/**
+ * @file    ewk_util.h
+ * @brief   Helpfull methods for WebKit-EFL.
+ */
+
 #ifndef ewk_util_h
 #define ewk_util_h
 
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index 8a3b04d..a6749de 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -1010,7 +1010,7 @@ static WebCore::ViewportAttributes _ewk_view_viewport_attributes_compute(Evas_Ob
     EWK_VIEW_PRIV_GET(sd, priv);
 
     int desktop_width = 980;
-    int device_dpi = 160;
+    int device_dpi = ewk_view_dpi_get();
 
     int available_width = (int) priv->page->chrome()->client()->pageRect().width();
     int available_height = (int) priv->page->chrome()->client()->pageRect().height();
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index 88452c2..65dfcc8 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,6 +1,143 @@
-2011-03-30  Martin Robinson  <mrobinson@igalia.com>
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
 
-        Reviewed by Dirk Schulze.
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename lengthReceived to encodedDataLength/dataLength
+        https://bugs.webkit.org/show_bug.cgi?id=58883
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidReceiveContentLength):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+        * webkit/webkitdownload.cpp:
+        (DownloadClient::didReceiveData):
+
+2011-04-18  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Need support for dumping focus rectangles in pixel results
+        https://bugs.webkit.org/show_bug.cgi?id=53647
+
+        Add a support function that returns the rectangle of the current
+        selection in frame.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::rectangleForSelection):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+
+2011-04-12  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        * webkit/webkitwebhistoryitem.cpp:
+
+2011-04-12  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58280
+        <rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception.
+
+        Add a header include.  Fallout from untangling some header files in WebCore.
+
+        * webkit/webkitwebhistoryitem.cpp:
+
+2011-02-03  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] The GTK+ DRT needs an implementation of the PlainTextController
+        https://bugs.webkit.org/show_bug.cgi?id=53605
+
+        Added jsValueToDOMRange to DumpRenderTreeSupportGtk. This static method can convert
+        a JSValueRef to a WebKitDOMRange. When it's possible to do this with the public
+        API, we can remove this method.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::jsValueToDOMRange): Added.
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h: Added declaration.
+
+2011-04-11  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [Gtk] Implement support for Embedded Objects
+        https://bugs.webkit.org/show_bug.cgi?id=52148
+
+        New accessibility unit test for embedded objects.
+
+        * tests/testatk.c:
+        (testWebkitAtkEmbeddedObjects): New unit test.
+        (main): Added the new unit test.
+
+2011-04-08  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Roben.
+
+        Make layoutTestController.shadowRoot return null, not undefined,
+        when its argument is invalid.
+        https://bugs.webkit.org/show_bug.cgi?id=58121
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::shadowRoot):
+
+2011-04-08  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Kent Tamura.
+
+        layoutTestController.shadowRoot should return undefined if its
+        argument is not an element.
+        https://bugs.webkit.org/show_bug.cgi?id=58119
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::shadowRoot):
+
+2011-04-08  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement increment() and decrement() functions in DRT's AccessibilityUIElement
+        https://bugs.webkit.org/show_bug.cgi?id=58039
+
+        Implemented missing functions in GTK's DRT.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (modifyAccessibilityValue): Helper function to increment or decrement
+        the current value for an object through the AccessibilityObject's API.
+        (DumpRenderTreeSupportGtk::incrementAccessibilityValue): New function,
+        to be used from GTK's DRT.
+        (DumpRenderTreeSupportGtk::decrementAccessibilityValue): Ditto.
+
+2011-04-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Need a way to get the path to a WebKitWebPlugin
+        https://bugs.webkit.org/show_bug.cgi?id=57968
+
+        Expose the path of the plugin through the WebKitWebPlugin object.
+
+        * webkit/webkitwebplugin.cpp:
+        (webkit_web_plugin_get_path):
+        * webkit/webkitwebplugin.h:
+        * webkit/webkitwebpluginprivate.h:
+
+2011-04-07  Alice Boxhall  <aboxhall@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Move the MouseEventWithHitTestResults::targetNode() method on to EventHandler.
+        https://bugs.webkit.org/show_bug.cgi?id=57921
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_forward_context_menu_event):
+        Call subframeForHitTestResult rather than subframeForTargetNode as the targetNode()
+        method has moved on to EventHandler.
+
+2011-04-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Eric Seidel.
 
         [Cairo] Better separate the concerns of GraphicsContextCairo
         https://bugs.webkit.org/show_bug.cgi?id=55150
@@ -15,6 +152,124 @@
         (webkit_web_view_expose_event):
         (webkit_web_view_draw):
 
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+
+        * WebCoreSupport/TextCheckerClientEnchant.h:
+        (WebKit::TextCheckerClientEnchant::requestCheckingOfString):
+
+2011-04-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebGL support
+        https://bugs.webkit.org/show_bug.cgi?id=31517
+
+        Add support for toggling WebGL at runtime when it's enabled.
+
+        * webkit/webkitwebsettings.cpp: Add the enable-webgl property. When ENABLE_WEBGL
+        is not enabled, it's a no-op.
+        (webkit_web_settings_class_init): Update to support enable-webgl.
+        (webkit_web_settings_set_property): Ditto.
+        (webkit_web_settings_get_property): Ditto.
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings): Ditto.
+
+2011-04-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (WebKit2): Caps-Lock indicator sometimes doesn't appear in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=51230
+        <rdar://problem/8780989>
+
+        * webkit/webkitwebview.cpp: (webkit_web_view_key_release_event): Moved Caps Lock handling from
+        WebKits to WebCore, because WebKit shouldn't be smart.
+
+2011-04-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] webkit_web_view_popup_menu_handler should call SelectionController::localCaretRect
+        https://bugs.webkit.org/show_bug.cgi?id=54633
+
+        Remove use of legacy editing positions when positioning keyboard-driven context
+        menus. Simplify the code greatly.
+
+        * webkit/webkitwebview.cpp:
+        (getLocationForKeyboardGeneratedContextMenu): Added this helper which calculates
+        the context menu position.
+        (webkit_web_view_popup_menu_handler): Simplify code preventing the menu from bumping
+        into the edges of the view. Remove (0,-1) hack as it no longer seems to be important.
+
+2011-04-02  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Martin Robinson.
+
+        Add layoutTestController.shadowRoot to GTK DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=57551
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::shadowRoot):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+
+2011-04-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82721.
+        http://trac.webkit.org/changeset/82721
+        https://bugs.webkit.org/show_bug.cgi?id=57687
+
+        This patch introduced assertion failures on the GTK+ bots.
+        (Requested by mrobinson on #webkit).
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+
+2011-04-01  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Martin Robinson.
+
+        Add layoutTestController.shadowRoot to GTK DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=57551
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::shadowRoot):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+
+2011-03-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Link explicitly with XRender on Linux/Unix
+        https://bugs.webkit.org/show_bug.cgi?id=57558
+
+        * GNUmakefile.am: add XRender LIBS.
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Build fix from previous change.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidReceiveTitle):
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidReceiveTitle):
+        (WebKit::FrameLoaderClient::setTitle):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
 2011-03-29  Philippe Normand  <pnormand@igalia.com>
 
         Unreviewed, disable an assert in testwebview due to
diff --git a/Source/WebKit/gtk/GNUmakefile.am b/Source/WebKit/gtk/GNUmakefile.am
index 7030ea8..20567cc 100644
--- a/Source/WebKit/gtk/GNUmakefile.am
+++ b/Source/WebKit/gtk/GNUmakefile.am
@@ -98,10 +98,12 @@ libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIBA
 	$(LIBSOUP_LIBS) \
 	$(LIBXML_LIBS) \
 	$(LIBXSLT_LIBS) \
+	$(OPENGL_LIBS) \
 	$(PANGO_LIBS) \
 	$(PNG_LIBS) \
 	$(SQLITE3_LIBS) \
 	$(UNICODE_LIBS) \
+	$(XRENDER_LIBS) \
 	$(XT_LIBS) \
 	$(WINMM_LIBS) \
 	$(SHLWAPI_LIBS) \
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
index 1336f11..1ce0ada 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
@@ -28,6 +28,7 @@
 #include "AnimationController.h"
 #include "DOMWrapperWorld.h"
 #include "Document.h"
+#include "Element.h"
 #include "FocusController.h"
 #include "FrameLoaderClientGtk.h"
 #include "FrameTree.h"
@@ -41,6 +42,7 @@
 #include "JSElement.h"
 #include "JSLock.h"
 #include "JSNodeList.h"
+#include "JSRange.h"
 #include "JSValue.h"
 #include "NodeList.h"
 #include "PageGroup.h"
@@ -52,6 +54,7 @@
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "TextIterator.h"
+#include "WebKitDOMRangePrivate.h"
 #include "WorkerThread.h"
 #include "webkitglobalsprivate.h"
 #include "webkitwebframe.h"
@@ -126,6 +129,20 @@ JSValueRef DumpRenderTreeSupportGtk::nodesFromRect(JSContextRef context, JSValue
     return toRef(exec, toJS(exec, jsDocument->globalObject(), nodes.get()));
 }
 
+WebKitDOMRange* DumpRenderTreeSupportGtk::jsValueToDOMRange(JSContextRef context, JSValueRef value)
+{
+    if (!value)
+        return 0;
+
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(context);
+
+    Range* range = toRange(toJS(exec, value));
+    if (!range)
+        return 0;
+    return kit(range);
+}
+
 /**
  * getFrameChildren:
  * @frame: a #WebKitWebFrame
@@ -636,6 +653,17 @@ void DumpRenderTreeSupportGtk::clearOpener(WebKitWebFrame* frame)
         coreFrame->loader()->setOpener(0);
 }
 
+JSValueRef DumpRenderTreeSupportGtk::shadowRoot(JSContextRef context, JSValueRef value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSC::ExecState* exec = toJS(context);
+    Element* element = toElement(toJS(exec, value));
+    if (!element)
+        return JSValueMakeNull(context);
+
+    return toRef(exec, toJS(exec, element->shadowRoot()));
+}
+
 unsigned int DumpRenderTreeSupportGtk::workerThreadCount()
 {
 #if ENABLE(WORKERS)
@@ -667,6 +695,31 @@ void DumpRenderTreeSupportGtk::setMinimumTimerInterval(WebKitWebView* webView, d
     core(webView)->settings()->setMinDOMTimerInterval(interval);
 }
 
+static void modifyAccessibilityValue(AtkObject* axObject, bool increment)
+{
+    if (!axObject || !WEBKIT_IS_ACCESSIBLE(axObject))
+        return;
+
+    AccessibilityObject* coreObject = webkit_accessible_get_accessibility_object(WEBKIT_ACCESSIBLE(axObject));
+    if (!coreObject)
+        return;
+
+    if (increment)
+        coreObject->increment();
+    else
+        coreObject->decrement();
+}
+
+void DumpRenderTreeSupportGtk::incrementAccessibilityValue(AtkObject* axObject)
+{
+    modifyAccessibilityValue(axObject, true);
+}
+
+void DumpRenderTreeSupportGtk::decrementAccessibilityValue(AtkObject* axObject)
+{
+    modifyAccessibilityValue(axObject, false);
+}
+
 void DumpRenderTreeSupportGtk::setAutofilled(JSContextRef context, JSValueRef nodeObject, bool autofilled)
 {
     JSC::ExecState* exec = toJS(context);
@@ -695,3 +748,16 @@ void DumpRenderTreeSupportGtk::setValueForUser(JSContextRef context, JSValueRef
     JSStringGetUTF8CString(value, valueBuffer.get(), bufferSize);
     inputElement->setValueForUser(String::fromUTF8(valueBuffer.get()));
 }
+
+void DumpRenderTreeSupportGtk::rectangleForSelection(WebKitWebFrame* frame, GdkRectangle* rectangle)
+{
+    Frame* coreFrame = core(frame);
+    if (!coreFrame)
+        return;
+
+    IntRect bounds = enclosingIntRect(coreFrame->selection()->bounds());
+    rectangle->x = bounds.x();
+    rectangle->y = bounds.y();
+    rectangle->width = bounds.width();
+    rectangle->height = bounds.height();
+}
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
index 7ad5af6..7731798 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
@@ -20,12 +20,10 @@
 #define DumpRenderTreeSupportGtk_h
 
 #include "JSStringRef.h"
-#include <webkit/webkitdefines.h>
-
 #include <atk/atk.h>
 #include <glib.h>
 #include <webkit/webkitdefines.h>
-#include <webkit/webkitwebframe.h>
+#include <webkit/webkitdomdefines.h>
 #include <wtf/text/CString.h>
 
 namespace WebKit {
@@ -61,6 +59,9 @@ public:
 
     static void clearOpener(WebKitWebFrame*);
 
+    static JSValueRef shadowRoot(JSContextRef, JSValueRef);
+    static WebKitDOMRange* jsValueToDOMRange(JSContextRef, JSValueRef);
+
     // FIXME: Move these to webkitwebframe.h once their API has been discussed.
     static GSList* getFrameChildren(WebKitWebFrame*);
     static WTF::CString getInnerText(WebKitWebFrame*);
@@ -97,6 +98,11 @@ public:
     static bool selectedRange(WebKitWebView*, int* start, int* end);
     static double defaultMinimumTimerInterval(); // Not really tied to WebView
     static void setMinimumTimerInterval(WebKitWebView*, double);
+    static void rectangleForSelection(WebKitWebFrame*, GdkRectangle*);
+
+    // Accessibility
+    static void incrementAccessibilityValue(AtkObject*);
+    static void decrementAccessibilityValue(AtkObject*);
 
     // GC
     static void gcCollectJavascriptObjects();
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index ca8bf9a..539675a 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -949,21 +949,22 @@ void FrameLoaderClient::dispatchDidStartProvisionalLoad()
     notifyStatus(m_frame, WEBKIT_LOAD_PROVISIONAL);
 }
 
-void FrameLoaderClient::dispatchDidReceiveTitle(const String& title)
+void FrameLoaderClient::dispatchDidReceiveTitle(const StringWithDirection& title)
 {
     if (m_loadingErrorPage)
         return;
 
     WebKitWebFramePrivate* priv = m_frame->priv;
     g_free(priv->title);
-    priv->title = g_strdup(title.utf8().data());
+    // FIXME: use direction of title.
+    priv->title = g_strdup(title.string().utf8().data());
 
     g_signal_emit_by_name(m_frame, "title-changed", priv->title);
     g_object_notify(G_OBJECT(m_frame), "title");
 
     WebKitWebView* webView = getViewFromFrame(m_frame);
     if (m_frame == webkit_web_view_get_main_frame(webView)) {
-        g_signal_emit_by_name(webView, "title-changed", m_frame, title.utf8().data());
+        g_signal_emit_by_name(webView, "title-changed", m_frame, title.string().utf8().data());
         g_object_notify(G_OBJECT(webView), "title");
     }
 }
@@ -1119,14 +1120,15 @@ void FrameLoaderClient::prepareForDataSourceReplacement()
     notImplemented();
 }
 
-void FrameLoaderClient::setTitle(const String& title, const KURL& url)
+void FrameLoaderClient::setTitle(const StringWithDirection& title, const KURL& url)
 {
     WebKitWebFramePrivate* frameData = m_frame->priv;
     g_free(frameData->title);
-    frameData->title = g_strdup(title.utf8().data());
+    // FIXME: use direction of title.
+    frameData->title = g_strdup(title.string().utf8().data());
 }
 
-void FrameLoaderClient::dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived)
+void FrameLoaderClient::dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int dataLength)
 {
     notImplemented();
 }
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
index b7ead7a..ed9ac37 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h
@@ -65,7 +65,7 @@ namespace WebKit {
         virtual void dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::AuthenticationChallenge&);
         virtual void dispatchDidCancelAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long  identifier, const WebCore::AuthenticationChallenge&);
         virtual void dispatchDidReceiveResponse(WebCore::DocumentLoader*, unsigned long  identifier, const WebCore::ResourceResponse&);
-        virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived);
+        virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int dataLength);
         virtual void dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long  identifier);
         virtual void dispatchDidFailLoading(WebCore::DocumentLoader*, unsigned long  identifier, const WebCore::ResourceError&);
         virtual bool dispatchDidLoadResourceFromMemoryCache(WebCore::DocumentLoader*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&, int length);
@@ -81,7 +81,7 @@ namespace WebKit {
         virtual void dispatchWillClose();
         virtual void dispatchDidReceiveIcon();
         virtual void dispatchDidStartProvisionalLoad();
-        virtual void dispatchDidReceiveTitle(const WTF::String&);
+        virtual void dispatchDidReceiveTitle(const WebCore::StringWithDirection&);
         virtual void dispatchDidChangeIcons();
         virtual void dispatchDidCommitLoad();
         virtual void dispatchDidFailProvisionalLoad(const WebCore::ResourceError&);
@@ -174,7 +174,7 @@ namespace WebKit {
         virtual void prepareForDataSourceReplacement();
 
         virtual WTF::PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
-        virtual void setTitle(const WTF::String& title, const WebCore::KURL&);
+        virtual void setTitle(const WebCore::StringWithDirection& title, const WebCore::KURL&);
 
         virtual WTF::String userAgent(const WebCore::KURL&);
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientEnchant.h b/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientEnchant.h
index c294a3d..5d93c07 100644
--- a/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientEnchant.h
+++ b/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientEnchant.h
@@ -49,7 +49,7 @@ class TextCheckerClientEnchant : public WebCore::TextCheckerClient {
         virtual WTF::String getAutoCorrectSuggestionForMisspelledWord(const WTF::String&);
         virtual void checkGrammarOfString(const UChar*, int length, WTF::Vector<WebCore::GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength);
         virtual void getGuessesForWord(const WTF::String& word, const WTF::String& context, WTF::Vector<WTF::String>& guesses);
-        virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&) {}
+        virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
 
         void updateSpellCheckingLanguage(const char*);
         static void freeSpellCheckingLanguage(gpointer, gpointer);
diff --git a/Source/WebKit/gtk/tests/testatk.c b/Source/WebKit/gtk/tests/testatk.c
index 161b4b8..603c6c8 100644
--- a/Source/WebKit/gtk/tests/testatk.c
+++ b/Source/WebKit/gtk/tests/testatk.c
@@ -50,6 +50,8 @@ static const char* contentsWithExtraneousWhiteSpaces = "<html><head><body><p>Thi
 
 static const char* comboBoxSelector = "<html><body><select><option selected value='foo'>foo</option><option value='bar'>bar</option></select></body></html>";
 
+static const char* embeddedObjects = "<html><body><p>Choose: <input value='foo' type='checkbox'/>foo <input value='bar' type='checkbox'/>bar (pick one)</p><p>Choose: <select name='foo'><option>bar</option><option>baz</option></select> (pick one)</p><p><input name='foobarbutton' value='foobar' type='button'/></p></body></html>";
+
 static const char* formWithTextInputs = "<html><body><form><input type='text' name='entry' /></form></body></html>";
 
 static const char* hypertextAndHyperlinks = "<html><body><p>A paragraph with no links at all</p><p><a href='http://foo.bar.baz/'>A line</a> with <a href='http://bar.baz.foo/'>a link in the middle</a> as well as at the beginning and <a href='http://baz.foo.bar/'>at the end</a></p><ol><li>List item with a <span><a href='http://foo.bar.baz/'>link inside a span node</a></span></li></ol></body></html>";
@@ -480,6 +482,92 @@ static void testWebkitAtkComboBox()
     g_object_unref(webView);
 }
 
+static void testWebkitAtkEmbeddedObjects()
+{
+    WebKitWebView* webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation allocation = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &allocation);
+    webkit_web_view_load_string(webView, embeddedObjects, 0, 0, 0);
+
+    /* Wait for the accessible objects to be created. */
+    waitForAccessibleObjects();
+
+    AtkObject* object = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(object);
+
+    AtkText* paragraph1 = ATK_TEXT(atk_object_ref_accessible_child(object, 0));
+    g_assert(ATK_IS_TEXT(paragraph1));
+    g_assert(ATK_IS_HYPERTEXT(paragraph1));
+
+    const gchar* expectedText = "Choose: \357\277\274foo \357\277\274bar (pick one)";
+    char* text = atk_text_get_text(paragraph1, 0, -1);
+    g_assert_cmpstr(text, ==, expectedText);
+    g_free(text);
+
+    gint nLinks = atk_hypertext_get_n_links(ATK_HYPERTEXT(paragraph1));
+    g_assert_cmpint(nLinks, ==, 2);
+
+    AtkHyperlink* hLink = atk_hypertext_get_link(ATK_HYPERTEXT(paragraph1), 0);
+    g_assert(ATK_HYPERLINK(hLink));
+    AtkObject* hLinkObject = atk_hyperlink_get_object(hLink, 0);
+    g_assert(ATK_OBJECT(hLinkObject));
+    g_assert(atk_object_get_role(hLinkObject) == ATK_ROLE_CHECK_BOX);
+    g_assert_cmpint(atk_hyperlink_get_start_index(hLink), ==, 8);
+    g_assert_cmpint(atk_hyperlink_get_end_index(hLink), ==, 9);
+    g_assert_cmpint(atk_hyperlink_get_n_anchors(hLink), ==, 1);
+    g_assert_cmpstr(atk_hyperlink_get_uri(hLink, 0), ==, 0);
+
+    AtkText* paragraph2 = ATK_TEXT(atk_object_ref_accessible_child(object, 1));
+    g_assert(ATK_IS_TEXT(paragraph2));
+    g_assert(ATK_IS_HYPERTEXT(paragraph2));
+
+    expectedText = "Choose: \357\277\274 (pick one)";
+    text = atk_text_get_text(paragraph2, 0, -1);
+    g_assert_cmpstr(text, ==, expectedText);
+    g_free(text);
+
+    nLinks = atk_hypertext_get_n_links(ATK_HYPERTEXT(paragraph2));
+    g_assert_cmpint(nLinks, ==, 1);
+
+    hLink = atk_hypertext_get_link(ATK_HYPERTEXT(paragraph2), 0);
+    g_assert(ATK_HYPERLINK(hLink));
+    hLinkObject = atk_hyperlink_get_object(hLink, 0);
+    g_assert(ATK_OBJECT(hLinkObject));
+    g_assert(atk_object_get_role(hLinkObject) == ATK_ROLE_COMBO_BOX);
+    g_assert_cmpint(atk_hyperlink_get_start_index(hLink), ==, 8);
+    g_assert_cmpint(atk_hyperlink_get_end_index(hLink), ==, 9);
+    g_assert_cmpint(atk_hyperlink_get_n_anchors(hLink), ==, 1);
+    g_assert_cmpstr(atk_hyperlink_get_uri(hLink, 0), ==, 0);
+
+    AtkText* paragraph3 = ATK_TEXT(atk_object_ref_accessible_child(object, 2));
+    g_assert(ATK_IS_TEXT(paragraph3));
+    g_assert(ATK_IS_HYPERTEXT(paragraph3));
+
+    expectedText = "\357\277\274";
+    text = atk_text_get_text(paragraph3, 0, -1);
+    g_assert_cmpstr(text, ==, expectedText);
+    g_free(text);
+
+    nLinks = atk_hypertext_get_n_links(ATK_HYPERTEXT(paragraph3));
+    g_assert_cmpint(nLinks, ==, 1);
+
+    hLink = atk_hypertext_get_link(ATK_HYPERTEXT(paragraph3), 0);
+    g_assert(ATK_HYPERLINK(hLink));
+    hLinkObject = atk_hyperlink_get_object(hLink, 0);
+    g_assert(ATK_OBJECT(hLinkObject));
+    g_assert(atk_object_get_role(hLinkObject) == ATK_ROLE_PUSH_BUTTON);
+    g_assert_cmpint(atk_hyperlink_get_start_index(hLink), ==, 0);
+    g_assert_cmpint(atk_hyperlink_get_end_index(hLink), ==, 1);
+    g_assert_cmpint(atk_hyperlink_get_n_anchors(hLink), ==, 1);
+    g_assert_cmpstr(atk_hyperlink_get_uri(hLink, 0), ==, 0);
+
+    g_object_unref(paragraph1);
+    g_object_unref(paragraph2);
+    g_object_unref(paragraph3);
+    g_object_unref(webView);
+}
+
 static void testWebkitAtkGetTextAtOffsetForms()
 {
     WebKitWebView* webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
@@ -1579,6 +1667,7 @@ int main(int argc, char** argv)
     g_test_add_func("/webkit/atk/caretOffsets", testWebkitAtkCaretOffsets);
     g_test_add_func("/webkit/atk/caretOffsetsAndExtranousWhiteSpaces", testWebkitAtkCaretOffsetsAndExtranousWhiteSpaces);
     g_test_add_func("/webkit/atk/comboBox", testWebkitAtkComboBox);
+    g_test_add_func("/webkit/atk/embeddedObjects", testWebkitAtkEmbeddedObjects);
     g_test_add_func("/webkit/atk/getTextAtOffset", testWebkitAtkGetTextAtOffset);
     g_test_add_func("/webkit/atk/getTextAtOffsetForms", testWebkitAtkGetTextAtOffsetForms);
     g_test_add_func("/webkit/atk/getTextAtOffsetNewlines", testWebkitAtkGetTextAtOffsetNewlines);
diff --git a/Source/WebKit/gtk/webkit/webkitdownload.cpp b/Source/WebKit/gtk/webkit/webkitdownload.cpp
index a7890c1..f2d706f 100644
--- a/Source/WebKit/gtk/webkit/webkitdownload.cpp
+++ b/Source/WebKit/gtk/webkit/webkitdownload.cpp
@@ -927,7 +927,7 @@ void DownloadClient::didReceiveResponse(ResourceHandle*, const ResourceResponse&
     webkit_download_set_response(m_download, response);
 }
 
-void DownloadClient::didReceiveData(ResourceHandle*, const char* data, int length, int lengthReceived)
+void DownloadClient::didReceiveData(ResourceHandle*, const char* data, int length, int encodedDataLength)
 {
     webkit_download_received_data(m_download, data, length);
 }
diff --git a/Source/WebKit/gtk/webkit/webkitwebhistoryitem.cpp b/Source/WebKit/gtk/webkit/webkitwebhistoryitem.cpp
index eabdc49..015d770 100644
--- a/Source/WebKit/gtk/webkit/webkitwebhistoryitem.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebhistoryitem.cpp
@@ -22,6 +22,7 @@
 #include "webkitwebhistoryitem.h"
 
 #include "HistoryItem.h"
+#include "KURL.h"
 #include "PlatformString.h"
 #include "webkitglobalsprivate.h"
 #include "webkitwebhistoryitemprivate.h"
diff --git a/Source/WebKit/gtk/webkit/webkitwebplugin.cpp b/Source/WebKit/gtk/webkit/webkitwebplugin.cpp
index 52d5965..95ac614 100644
--- a/Source/WebKit/gtk/webkit/webkitwebplugin.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebplugin.cpp
@@ -1,5 +1,6 @@
 /*
  *  Copyright (C) 2010 Igalia S.L.
+ *  Copyright (C) 2011 Gustavo Noronha Silva <gns@gnome.org>
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -62,6 +63,8 @@ static void webkit_web_plugin_finalize(GObject* object)
     WebKitWebPlugin* plugin = WEBKIT_WEB_PLUGIN(object);
     WebKitWebPluginPrivate* priv = plugin->priv;
 
+    g_free(priv->path);
+
     g_slist_foreach(priv->mimeTypes, (GFunc)freeMIMEType, 0);
     g_slist_free(priv->mimeTypes);
 
@@ -173,6 +176,43 @@ const char* webkit_web_plugin_get_description(WebKitWebPlugin* plugin)
 }
 
 /**
+ * webkit_web_plugin_get_path:
+ * @plugin: a #WebKitWebPlugin
+ *
+ * Returns: the absolute path to @plugin in system filename encoding
+ * or %NULL on failure to convert the filename from UTF-8.
+ *
+ * Since: 1.4.0
+ */
+const char* webkit_web_plugin_get_path(WebKitWebPlugin* plugin)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_PLUGIN(plugin), 0);
+
+    WebKitWebPluginPrivate* priv = plugin->priv;
+
+    if (priv->path)
+        return priv->path;
+
+    GError* error = 0;
+    priv->path = g_filename_from_utf8(priv->corePlugin->path().utf8().data(), -1, 0, 0, &error);
+
+    if (!error)
+        return priv->path;
+
+    // In the unlikely case the convertion fails, report the error and make sure we free
+    // any partial convertion that ended up in the variable.
+    g_free(priv->path);
+    priv->path = 0;
+
+    g_warning("Failed to convert '%s' to system filename encoding: %s", priv->corePlugin->path().utf8().data(), error->message);
+
+    g_clear_error(&error);
+
+    return 0;
+}
+
+
+/**
  * webkit_web_plugin_get_mimetypes:
  * @plugin: a #WebKitWebPlugin
  *
diff --git a/Source/WebKit/gtk/webkit/webkitwebplugin.h b/Source/WebKit/gtk/webkit/webkitwebplugin.h
index 3514d1e..9205674 100644
--- a/Source/WebKit/gtk/webkit/webkitwebplugin.h
+++ b/Source/WebKit/gtk/webkit/webkitwebplugin.h
@@ -73,6 +73,9 @@ webkit_web_plugin_get_name        (WebKitWebPlugin*);
 WEBKIT_API const char*
 webkit_web_plugin_get_description (WebKitWebPlugin*);
 
+WEBKIT_API const char*
+webkit_web_plugin_get_path        (WebKitWebPlugin*);
+
 WEBKIT_API GSList*
 webkit_web_plugin_get_mimetypes   (WebKitWebPlugin*);
 
diff --git a/Source/WebKit/gtk/webkit/webkitwebpluginprivate.h b/Source/WebKit/gtk/webkit/webkitwebpluginprivate.h
index 4ae204b..8a1ba1b 100644
--- a/Source/WebKit/gtk/webkit/webkitwebpluginprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitwebpluginprivate.h
@@ -38,6 +38,7 @@ struct _WebKitWebPluginPrivate {
     RefPtr<WebCore::PluginPackage> corePlugin;
     CString name;
     CString description;
+    char* path;
     GSList* mimeTypes;
 };
 
diff --git a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
index 3b4cf57..e833de9 100644
--- a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -113,6 +113,7 @@ struct _WebKitWebSettingsPrivate {
     gboolean enable_hyperlink_auditing;
     gboolean enable_fullscreen;
     gboolean enable_dns_prefetching;
+    gboolean enable_webgl;
 };
 
 #define WEBKIT_WEB_SETTINGS_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_SETTINGS, WebKitWebSettingsPrivate))
@@ -166,7 +167,8 @@ enum {
     PROP_ENABLE_JAVA_APPLET,
     PROP_ENABLE_HYPERLINK_AUDITING,
     PROP_ENABLE_FULLSCREEN,
-    PROP_ENABLE_DNS_PREFETCHING
+    PROP_ENABLE_DNS_PREFETCHING,
+    PROP_ENABLE_WEBGL
 };
 
 // Create a default user agent string
@@ -912,6 +914,22 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          _("Whether the Mozilla style API should be enabled."),
                                                          FALSE,
                                                          flags));
+    /**
+    * WebKitWebSettings:enable-webgl:
+    *
+    * Enable or disable support for WebGL on pages. WebGL is an experimental
+    * proposal for allowing web pages to use OpenGL ES-like calls directly. The
+    * standard is currently a work-in-progress by the Khronos Group.
+    *
+    * Since: 1.3.14
+    */
+    g_object_class_install_property(gobject_class,
+                                    PROP_ENABLE_WEBGL,
+                                    g_param_spec_boolean("enable-webgl",
+                                                         _("Enable WebGL"),
+                                                         _("Whether WebGL content should be rendered"),
+                                                         FALSE,
+                                                         flags));
 
     /**
     * WebKitWebSettings:enable-dns-prefetching
@@ -1117,6 +1135,9 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_ENABLE_DNS_PREFETCHING:
         priv->enable_dns_prefetching = g_value_get_boolean(value);
         break;
+    case PROP_ENABLE_WEBGL:
+        priv->enable_webgl = g_value_get_boolean(value);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -1270,6 +1291,9 @@ static void webkit_web_settings_get_property(GObject* object, guint prop_id, GVa
     case PROP_ENABLE_DNS_PREFETCHING:
         g_value_set_boolean(value, priv->enable_dns_prefetching);
         break;
+    case PROP_ENABLE_WEBGL:
+        g_value_set_boolean(value, priv->enable_webgl);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index bf74d7b..85ad904 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -319,7 +319,7 @@ static gboolean webkit_web_view_forward_context_menu_event(WebKitWebView* webVie
         IntPoint point = mainFrame->view()->windowToContents(event.pos());
         MouseEventWithHitTestResults mev = mainFrame->document()->prepareMouseEvent(request, point, event);
 
-        Frame* targetFrame = EventHandler::subframeForTargetNode(mev.targetNode());
+        Frame* targetFrame = EventHandler::subframeForHitTestResult(mev);
         if (!targetFrame)
             targetFrame = mainFrame;
 
@@ -381,84 +381,43 @@ static gboolean webkit_web_view_forward_context_menu_event(WebKitWebView* webVie
     return TRUE;
 }
 
+static const int gContextMenuMargin = 1;
+static IntPoint getLocationForKeyboardGeneratedContextMenu(Frame* frame)
+{
+    SelectionController* selection = frame->selection();
+    if (!selection->selection().isNonOrphanedCaretOrRange()
+         || (selection->selection().isCaret() && !selection->selection().isContentEditable())) {
+        if (Node* focusedNode = getFocusedNode(frame))
+            return focusedNode->getRect().location();
+
+        // There was no selection and no focused node, so just put the context
+        // menu into the corner of the view, offset slightly.
+        return IntPoint(gContextMenuMargin, gContextMenuMargin);
+    }
+
+    // selection->selection().firstRange can return 0 here, but if that was the case
+    // selection->selection().isNonOrphanedCaretOrRange() would have returned false
+    // above, so we do not have to check it.
+    IntRect firstRect = frame->editor()->firstRectForRange(selection->selection().firstRange().get());
+    return IntPoint(firstRect.x(), firstRect.maxY());
+}
+
 static gboolean webkit_web_view_popup_menu_handler(GtkWidget* widget)
 {
-    static const int contextMenuMargin = 1;
+    Frame* frame = core(WEBKIT_WEB_VIEW(widget))->focusController()->focusedOrMainFrame();
+    IntPoint location = getLocationForKeyboardGeneratedContextMenu(frame);
 
-    // The context menu event was generated from the keyboard, so show the context menu by the current selection.
-    Page* page = core(WEBKIT_WEB_VIEW(widget));
-    Frame* frame = page->focusController()->focusedOrMainFrame();
     FrameView* view = frame->view();
     if (!view)
-        return FALSE;    
-
-    Position start = frame->selection()->selection().start();
-    Position end = frame->selection()->selection().end();
-
-    int rightAligned = FALSE;
-    IntPoint location;
-
-    if (!start.deprecatedNode() || !end.deprecatedNode()
-        || (frame->selection()->selection().isCaret() && !frame->selection()->selection().isContentEditable())) {
-        // If there's a focused elment, use its location.
-        if (Node* focusedNode = getFocusedNode(frame)) {
-            IntRect focusedNodeRect = focusedNode->getRect();
-            location = IntPoint(rightAligned ? focusedNodeRect.maxX() : focusedNodeRect.x(), focusedNodeRect.maxY());
-        } else
-            location = IntPoint(rightAligned ? view->contentsWidth() - contextMenuMargin : contextMenuMargin, contextMenuMargin);
-    } else {
-        RenderObject* renderer = start.deprecatedNode()->renderer();
-        if (!renderer)
-            return FALSE;
-
-        // Calculate the rect of the first line of the selection (cribbed from -[WebCoreFrameBridge firstRectForDOMRange:],
-        // now Frame::firstRectForRange(), which perhaps this should call).
-        int extraWidthToEndOfLine = 0;
-
-        InlineBox* startInlineBox;
-        int startCaretOffset;
-        start.getInlineBoxAndOffset(DOWNSTREAM, startInlineBox, startCaretOffset);
-        IntRect startCaretRect = renderer->localCaretRect(startInlineBox, startCaretOffset, &extraWidthToEndOfLine);
-        if (startCaretRect != IntRect())
-            startCaretRect = renderer->localToAbsoluteQuad(FloatRect(startCaretRect)).enclosingBoundingBox();
-
-        InlineBox* endInlineBox;
-        int endCaretOffset;
-        end.getInlineBoxAndOffset(UPSTREAM, endInlineBox, endCaretOffset);
-        IntRect endCaretRect = renderer->localCaretRect(endInlineBox, endCaretOffset);
-        if (endCaretRect != IntRect())
-            endCaretRect = renderer->localToAbsoluteQuad(FloatRect(endCaretRect)).enclosingBoundingBox();
-
-        IntRect firstRect;
-        if (startCaretRect.y() == endCaretRect.y())
-            firstRect = IntRect(MIN(startCaretRect.x(), endCaretRect.x()),
-                                startCaretRect.y(),
-                                abs(endCaretRect.x() - startCaretRect.x()),
-                                MAX(startCaretRect.height(), endCaretRect.height()));
-        else
-            firstRect = IntRect(startCaretRect.x(),
-                                startCaretRect.y(),
-                                startCaretRect.width() + extraWidthToEndOfLine,
-                                startCaretRect.height());
-
-        location = IntPoint(rightAligned ? firstRect.maxX() : firstRect.x(), firstRect.maxY());
-    }
+        return FALSE;
 
-    // FIXME: The IntSize(0, -1) is a hack to get the hit-testing to result in the selected element.
-    // Ideally we'd have the position of a context menu event be separate from its target node.
-    location = view->contentsToWindow(location) + IntSize(0, -1);
-    if (location.y() < 0)
-        location.setY(contextMenuMargin);
-    else if (location.y() > view->height())
-        location.setY(view->height() - contextMenuMargin);
-    if (location.x() < 0)
-        location.setX(contextMenuMargin);
-    else if (location.x() > view->width())
-        location.setX(view->width() - contextMenuMargin);
-    IntPoint global(globalPointForClientPoint(gtk_widget_get_window(widget), location));
-
-    PlatformMouseEvent event(location, global, RightButton, MouseEventPressed, 0, false, false, false, false, gtk_get_current_event_time());
+    // Never let the context menu touch the very edge of the view.
+    location = view->contentsToWindow(location);
+    location.expandedTo(IntPoint(gContextMenuMargin, gContextMenuMargin));
+    location.shrunkTo(IntPoint(view->width() - gContextMenuMargin, view->height() - gContextMenuMargin));
 
+    IntPoint globalPoint(globalPointForClientPoint(gtk_widget_get_window(widget), location));
+    PlatformMouseEvent event(location, globalPoint, RightButton, MouseEventPressed, 0, false, false, false, false, gtk_get_current_event_time());
     return webkit_web_view_forward_context_menu_event(WEBKIT_WEB_VIEW(widget), event);
 }
 
@@ -790,9 +749,6 @@ static gboolean webkit_web_view_key_release_event(GtkWidget* widget, GdkEventKey
     if (!frame->view())
         return FALSE;
 
-    if (event->keyval == GDK_Caps_Lock)
-        frame->eventHandler()->capsLockStateMayHaveChanged();
-
     PlatformKeyboardEvent keyboardEvent(event);
     if (frame->eventHandler()->keyEvent(keyboardEvent))
         return TRUE;
@@ -3292,7 +3248,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
         enableXSSAuditor, enableSpatialNavigation, enableFrameFlattening, javascriptCanOpenWindows,
         javaScriptCanAccessClipboard, enableOfflineWebAppCache,
         enableUniversalAccessFromFileURI, enableFileAccessFromFileURI,
-        enableDOMPaste, tabKeyCyclesThroughElements,
+        enableDOMPaste, tabKeyCyclesThroughElements, enableWebGL,
         enableSiteSpecificQuirks, usePageCache, enableJavaApplet,
         enableHyperlinkAuditing, enableFullscreen, enableDNSPrefetching;
 
@@ -3336,6 +3292,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
                  "spell-checking-languages", &defaultSpellCheckingLanguages,
                  "enable-fullscreen", &enableFullscreen,
                  "enable-dns-prefetching", &enableDNSPrefetching,
+                 "enable-webgl", &enableWebGL,
                  NULL);
 
     settings->setDefaultTextEncodingName(defaultEncoding);
@@ -3373,14 +3330,20 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     settings->setUsesPageCache(usePageCache);
     settings->setJavaEnabled(enableJavaApplet);
     settings->setHyperlinkAuditingEnabled(enableHyperlinkAuditing);
+    settings->setDNSPrefetchingEnabled(enableDNSPrefetching);
+
 #if ENABLE(FULLSCREEN_API)
     settings->setFullScreenEnabled(enableFullscreen);
 #endif
+
 #if ENABLE(SPELLCHECK)
     WebKit::EditorClient* client = static_cast<WebKit::EditorClient*>(core(webView)->editorClient());
     static_cast<WebKit::TextCheckerClientEnchant*>(client->textChecker())->updateSpellCheckingLanguage(defaultSpellCheckingLanguages);
 #endif
-    settings->setDNSPrefetchingEnabled(enableDNSPrefetching);
+
+#if ENABLE(WEBGL)
+    settings->setWebGLEnabled(enableWebGL);
+#endif
 
     Page* page = core(webView);
     if (page)
@@ -3498,12 +3461,19 @@ static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GPar
         settings->setJavaEnabled(g_value_get_boolean(&value));
     else if (name == g_intern_string("enable-hyperlink-auditing"))
         settings->setHyperlinkAuditingEnabled(g_value_get_boolean(&value));
+
 #if ENABLE(SPELLCHECK)
     else if (name == g_intern_string("spell-checking-languages")) {
         WebKit::EditorClient* client = static_cast<WebKit::EditorClient*>(core(webView)->editorClient());
         static_cast<WebKit::TextCheckerClientEnchant*>(client->textChecker())->updateSpellCheckingLanguage(g_value_get_string(&value));
     }
 #endif
+
+#if ENABLE(WEBGL)
+    else if (name == g_intern_string("enable-webgl"))
+        settings->setWebGLEnabled(g_value_get_boolean(&value));
+#endif
+
     else if (!g_object_class_find_property(G_OBJECT_GET_CLASS(webSettings), name))
         g_warning("Unexpected setting '%s'", name);
     g_value_unset(&value);
diff --git a/Source/WebKit/haiku/ChangeLog b/Source/WebKit/haiku/ChangeLog
index 7757fe7..6ae3da1 100644
--- a/Source/WebKit/haiku/ChangeLog
+++ b/Source/WebKit/haiku/ChangeLog
@@ -1,3 +1,39 @@
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+
+        * WebCoreSupport/EditorClientHaiku.h:
+        (WebCore::EditorClientHaiku::requestCheckingOfString):
+
+2011-04-04  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        setContentEditable with true/false/inherit string is not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=52058
+
+        Move isContentEditable from HTMLElement to Node. WebKit should only access isContentEditable
+        as rendererIsEditable is for WebCore internal use.
+
+        * WebCoreSupport/EditorClientHaiku.cpp:
+        (WebCore::EditorClientHaiku::handleKeyboardEvent):
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebCoreSupport/FrameLoaderClientHaiku.cpp:
+        (WebCore::FrameLoaderClientHaiku::dispatchDidReceiveTitle):
+        * WebCoreSupport/FrameLoaderClientHaiku.h:
+
 2011-03-25  Andy Estes  <aestes@apple.com>
 
         Reviewed by Adele Peterson.
diff --git a/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.cpp b/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.cpp
index 1a84dab..5c1b13f 100644
--- a/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.cpp
+++ b/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.cpp
@@ -254,7 +254,7 @@ void EditorClientHaiku::handleKeyboardEvent(KeyboardEvent* event)
     if (!start)
         return;
 
-    if (start->rendererIsEditable()) {
+    if (start->isContentEditable()) {
         switch (kevent->windowsVirtualKeyCode()) {
         case VK_BACK:
             frame->editor()->deleteWithDirection(DirectionBackward,
diff --git a/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.h b/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.h
index bb0d8ac..cc21fcb 100644
--- a/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.h
+++ b/Source/WebKit/haiku/WebCoreSupport/EditorClientHaiku.h
@@ -111,7 +111,7 @@ class EditorClientHaiku : public EditorClient, public TextCheckerClient {
         virtual void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses);
         virtual void willSetInputMethodState();
         virtual void setInputMethodState(bool enabled);
-        virtual void requestCheckingOfString(SpellChecker*, int, const String&) {}
+        virtual void requestCheckingOfString(SpellChecker*, int, WebCore::TextCheckingTypeMask, const String&) {}
         virtual TextCheckerClient* textChecker() { return this; }
 
         bool isEditing() const;
diff --git a/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp b/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
index 24a98d5..c04cb7d 100644
--- a/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
+++ b/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.cpp
@@ -237,13 +237,13 @@ void FrameLoaderClientHaiku::dispatchDidStartProvisionalLoad()
     }
 }
 
-void FrameLoaderClientHaiku::dispatchDidReceiveTitle(const String& title)
+void FrameLoaderClientHaiku::dispatchDidReceiveTitle(const StringWithTitle& title)
 {
     if (m_webView) {
-        m_webView->SetPageTitle(title);
-
+        // FIXME: use direction of title.
+        m_webView->SetPageTitle(title.m_string());
         BMessage message(TITLE_CHANGED);
-        message.AddString("title", title);
+        message.AddString("title", title.string());
         m_messenger->SendMessage(&message);
     }
 }
diff --git a/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h b/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
index dbd3084..f576545 100644
--- a/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
+++ b/Source/WebKit/haiku/WebCoreSupport/FrameLoaderClientHaiku.h
@@ -102,7 +102,7 @@ namespace WebCore {
         virtual void dispatchWillClose();
         virtual void dispatchDidReceiveIcon();
         virtual void dispatchDidStartProvisionalLoad();
-        virtual void dispatchDidReceiveTitle(const String& title);
+        virtual void dispatchDidReceiveTitle(const StringWithDirection& title);
         virtual void dispatchDidCommitLoad();
         virtual void dispatchDidFinishDocumentLoad();
         virtual void dispatchDidFinishLoad();
@@ -143,7 +143,7 @@ namespace WebCore {
         virtual void addHistoryItemForFragmentScroll();
         virtual void didFinishLoad();
         virtual void prepareForDataSourceReplacement();
-        virtual void setTitle(const String& title, const KURL&);
+        virtual void setTitle(const StringWithDirection&, const KURL&);
 
         virtual String userAgent(const KURL&);
 
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index afaa1e3..5139734 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,665 @@
+2011-04-19  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        WebPreferences in WebKit1 should have CanvasUsesAcceleratedDrawing set to NO by default
+        https://bugs.webkit.org/show_bug.cgi?id=58936
+
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename lengthReceived to encodedDataLength/dataLength
+        https://bugs.webkit.org/show_bug.cgi?id=58883
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidReceiveContentLength):
+
+2011-04-18  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        WebKit needs to stop importing <AppKit/NSTextChecker.h>
+        https://bugs.webkit.org/show_bug.cgi?id=58798
+        <rdar://problem/9294938>
+
+        Use public header <AppKit/NSSpellChecker.h> instead.
+
+        * WebCoreSupport/CorrectionPanel.h:
+        * WebCoreSupport/CorrectionPanel.mm:
+        (correctionIndicatorType):
+        (CorrectionPanel::show):
+        (CorrectionPanel::dismissInternal):
+        (CorrectionPanel::handleAcceptedReplacement):
+        * WebCoreSupport/WebEditorClient.mm:
+        * WebView/WebView.mm:
+
+2011-04-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Stop using -[NSString initWithContentsOfFile:]
+        https://bugs.webkit.org/show_bug.cgi?id=58763
+
+        -[NSString initWithContentsOfFile:] was deprecated in 10.4, so we should stop using it.
+
+        * WebView/WebView.mm:
+        (leakMailQuirksUserScriptContents):
+        (leakOutlookQuirksUserScriptContents):
+
+2011-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/58463> Switch HTTP pipelining from user default to private setting
+        <rdar://problem/9268729>
+
+        Reviewed by Dan Bernstein.
+
+        This replaces support for the WebKitEnableHTTPPipelining user
+        default with methods on the WebCore::ResourceRequest class in
+        WebCore, the WebView class in WebKit1, and the WebContext class
+        in WebKit2.  It also removes support for the
+        WebKitForceHTTPPipeliningPriorityHigh user default which was not
+        needed.
+
+        * WebView/WebView.mm:
+        (+[WebView(WebPrivate) _HTTPPipeliningEnabled]): Added.
+        (+[WebView(WebPrivate) _setHTTPPipeliningEnabled:]): Added.
+        * WebView/WebViewPrivate.h:
+        (+[WebView(WebPrivate) _HTTPPipeliningEnabled]): Added declaration.
+        (+[WebView(WebPrivate) _setHTTPPipeliningEnabled:]): Added declaration.
+
+2011-04-17  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Assign to self in WebInspectorWindowController constructors
+        https://bugs.webkit.org/show_bug.cgi?id=58749
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController init]):
+        (-[WebInspectorWindowController initWithInspectedWebView:]):
+
+2011-04-17  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Move WebNodeHighlighter into its own file
+        https://bugs.webkit.org/show_bug.cgi?id=58746
+
+        Extract this class into its own file alongside the
+        other WebNodeHighlight files. In doing so do some
+        cleanup on WebInspectorClient removing some methods
+        that were never called.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (WebInspectorClient::WebInspectorClient): style fix.
+        * WebInspector/WebNodeHighlighter.h: Added.
+        * WebInspector/WebNodeHighlighter.mm: Added.
+        (-[WebNodeHighlighter initWithInspectedWebView:]): call super init.
+        (-[WebNodeHighlighter dealloc]):
+        (-[WebNodeHighlighter highlightNode:]):
+        (-[WebNodeHighlighter hideHighlight]):
+        (-[WebNodeHighlighter didAttachWebNodeHighlight:]):
+        (-[WebNodeHighlighter willDetachWebNodeHighlight:]):
+
+2011-04-15  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        [Mac] WebKit needs to convert the bounding box of autocorrected word to view coordinate.
+        https://bugs.webkit.org/show_bug.cgi?id=58717
+
+        Convert the bounding box from window coordinate to view coordinate, which is expected by NSCorrectionPanel.
+
+        * WebCoreSupport/CorrectionPanel.mm:
+        (CorrectionPanel::show):
+
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        GC allocate Structure
+        https://bugs.webkit.org/show_bug.cgi?id=58483
+
+        Rolling r83894 r83827 r83810 r83809 r83808 back in with
+        a workaround for the gcc bug seen by the gtk bots
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.h:
+        * Plugins/Hosted/ProxyInstance.mm:
+        (WebKit::ProxyRuntimeMethod::createStructure):
+        * Plugins/Hosted/ProxyRuntimeObject.h:
+        (WebKit::ProxyRuntimeObject::createStructure):
+
+2011-04-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Password field input does not switch to ASCII-compatible source
+        https://bugs.webkit.org/show_bug.cgi?id=58583
+        <rdar://problem/9059651>
+
+        Now that WebCore doesn't set secure input mode, WebKit has to. Happily, it already has the
+        necessary logic, needed to return a nil text input context when in password fields.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView close]): If the view is still enforcing secure event mode, stop.
+        (-[WebHTMLView windowDidBecomeKey:]): Call _updateSecureInputState.
+        (-[WebHTMLView windowDidResignKey:]): Ditto.
+        (-[WebHTMLView becomeFirstResponder]): Call _updateSecureInputState. It's a bit tricky
+        because the first responder is still different an this point, so set a boolean variable to
+        let _updateSecureInputState know what's going on.
+        (-[WebHTMLView resignFirstResponder]): Disable secure event mode if it's on.
+        (-[WebHTMLView _updateSecureInputState]): Update HIToolbox secure event input state and
+        allowed input sources accorsing to current selection.
+        (-[WebHTMLView _updateSelectionForInputManager]): Call _updateSecureInputState.
+
+2011-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make mac WebKit1 use the default localization strategy
+        https://bugs.webkit.org/show_bug.cgi?id=58628
+
+        * WebCoreSupport/WebPlatformStrategies.h:
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        Remove the localization strategy code. The equivalent is now
+        in WebCore/platform/DefaultLocalizationStrategy.cpp.
+
+2011-04-15  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Renaming TRACK feature define to VIDEO_TRACK
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-14  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Set minimum priority for fast lane connections
+        https://bugs.webkit.org/show_bug.cgi?id=58353
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Support for new WKSI method WKSetHTTPPipeliningMinimumFastLanePriority.
+
+2011-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        WebKit2 doesn't keep overlay scrollers shown while scroll gesture held
+        <rdar://problem/9260518>
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+        Initialize new WKSI functions.
+
+2011-04-13  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/58172> Fix -Wcast-align warning in WebBasePluginPackage.mm
+
+        Reviewed by Anders Carlsson.
+
+        Fixes the following warning with -Wcast-align enabled:
+
+            Source/WebKit/mac/Plugins/WebBasePluginPackage.mm:402:21:{402:21-402:93}{402:39-402:93}: error: cast from 'uint8_t *' (aka 'unsigned char *') to 'struct fat_arch *' increases required alignment from 1 to 4 [-Werror,-Wcast-align,3]
+                         archs = (struct fat_arch*)((uint8_t*)rawData.data() + sizeof(struct fat_header));
+                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+        * Plugins/WebBasePluginPackage.mm:
+        (-[WebBasePluginPackage isNativeLibraryData:]): Added
+        COMPILE_ASSERT() to make sure our pointer math is valid.
+        Removed cast to (uint8_t*) and divide sizeof(struct fat_header)
+        by sizeof(uint32_t) to fix the pointer math.  Replaced C-style
+        casts with reinterpret_cast.
+
+2011-04-12  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Infinite recursion in WebHTMLView executeSavedKeypressCommands.
+        https://bugs.webkit.org/show_bug.cgi?id=58382
+        <rdar://problem/9239370>
+
+        Execution of some editing commands could trigger a call to selectedRange that
+        internally calls executeSavedKeypressCommands creating an infinite recursion.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _executeSavedKeypressCommands]): Added a flag to avoid recursion.
+        (-[WebHTMLView _interpretKeyEvent:savingCommands:]): Added flag initialization.
+
+2011-04-12  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58292
+        Provide new setting to allow site icon loading despite disabling automatic image loading in general.
+
+        * WebView/WebPreferenceKeysPrivate.h: Add preference key.
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]): Initialize to false.
+        (-[WebPreferences setLoadsSiteIconsIgnoringImageLoadingPreference:]): Added.
+        (-[WebPreferences loadsSiteIconsIgnoringImageLoadingPreference]): Added.
+        * WebView/WebPreferencesPrivate.h: Add setter/getter definitions.
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChanged:]): Add to settings that get propagated upon changes. 
+
+2011-04-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Safari doesn't respect cmd-arrows (and variations) as custom keyboard shortcuts
+        https://bugs.webkit.org/show_bug.cgi?id=58175
+        <rdar://problem/9060555>
+
+        * WebView/WebFrameView.mm: (-[WebFrameView keyDown:]): Added a comment explaining how this
+        should be changed to match WebKit2.
+
+2011-04-06  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a bug where the context menu does not show in PDF documents if there is no
+        UI delegate or the UI delegate does not respond to the context menu selector.
+
+        https://webkit.org/b/57958
+
+        Reviewed by Darin Adler.
+
+        * WebView/WebView.mm:
+        (-[WebView _menuForElement:defaultItems:]): CallUIDelegate returns nil
+        if UIDelegate is nil or doesn't respond to the selector. So check that
+        here to distinguish between using defaultMenuItems or the delegate
+        really returning nil to say "no context menu".
+
+2011-04-11  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed; roll out unintentional change to WebFullScreenController.mm.
+
+        * WebView/WebFullScreenController.mm:
+        (-[WebFullScreenController enterFullscreen:]):
+
+2011-04-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A few heap-related renames and file moves.
+        
+        WeakGCPtr<T> => Weak<T>
+        Global<T> => Strong<T>
+        collector/ => heap/
+        collector/* => heap/*
+        runtime/WeakGCPtr.h => heap/Weak.h
+        
+        (Eventually, even more files should move into the heap directory. Like
+        Heap.h and Heap.cpp, for example.)
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.h:
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::LocalObjectMap::idForObject):
+        (WebKit::NetscapePluginInstanceProxy::LocalObjectMap::forget):
+        (WebKit::NetscapePluginInstanceProxy::evaluate):
+        * WebView/WebScriptDebugger.h:
+
+2011-04-08  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: Safari doesn't respect cmd-arrows (and variations) as custom keyboard shortcuts
+        https://bugs.webkit.org/show_bug.cgi?id=58175
+        <rdar://problem/9060555>
+
+        * WebView/WebFrameView.mm: (-[WebFrameView keyDown:]): Added a comment explaining how this
+        should be changed to match WebKit2.
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        -[WebView setPreferences:] can take a lot of time if loading lots of webviews at once
+        https://bugs.webkit.org/show_bug.cgi?id=58128
+        <rdar://problem/9244553>
+        
+        The root of the problem here was an O(N^2) issue - each WebView,
+        upon having its preferences initialized, would broadcast a
+        notification that was listened to by all other WebViews sharing
+        its preferences.
+        
+        To maintain the API contract, I split the notification into two,
+        one that is for public API consumption, and the other which is for
+        internal use only. Changes that don't need to be picked up by
+        other WebViews broadcast the public notification only. And we
+        avoid WebView broadcasting a notification just to get itself to
+        update.
+
+        * Misc/WebIconDatabase.mm:
+        (-[WebIconDatabase _startUpIconDatabase]):
+        (-[WebIconDatabase _shutDownIconDatabase]):
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView viewWillMoveToWindow:]):
+        (-[WebBaseNetscapePluginView viewWillMoveToSuperview:]):
+        (-[WebBaseNetscapePluginView viewDidMoveToWindow]):
+        (-[WebBaseNetscapePluginView viewWillMoveToHostWindow:]):
+        * WebView/WebPreferences.mm:
+        (-[WebPreferences initWithIdentifier:]):
+        (-[WebPreferences _setStringValue:forKey:]):
+        (-[WebPreferences _setIntegerValue:forKey:]):
+        (-[WebPreferences _setFloatValue:forKey:]):
+        (-[WebPreferences _setBoolValue:forKey:]):
+        (-[WebPreferences _setLongLongValue:forKey:]):
+        (-[WebPreferences _setUnsignedLongLongValue:forKey:]):
+        (-[WebPreferences _postPreferencesChangedNotification]):
+        (-[WebPreferences _postPreferencesChangedAPINotification]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+        (-[WebView _preferencesChangedNotification:]):
+        (-[WebView _preferencesChanged:]):
+        (-[WebView setUsesPageCache:]):
+        (+[WebView initialize]):
+        (-[WebView setPreferences:]):
+        (-[WebView _keyboardUIMode]):
+        * WebView/WebViewInternal.h:
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (WebKit2): Reverse conversion doesn't work in Kotoeri
+        https://bugs.webkit.org/show_bug.cgi?id=58066
+        <rdar://problem/8965302>
+
+        * WebView/WebHTMLRepresentation.mm:
+        (-[WebHTMLRepresentation attributedStringFrom:startOffset:to:endOffset:]):
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView attributedSubstringFromRange:]):
+        (-[WebHTMLView attributedString]):
+        (-[WebHTMLView selectedAttributedString]):
+        Updated for editingAttributedStringFromRange: now taking a WebCore::Range instead of DOMRange.
+
+2011-04-07  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r64712): Microsoft Outlook 2011: original message contents
+        not included when replying to an email.
+        https://bugs.webkit.org/show_bug.cgi?id=57794
+        
+        Outlook populates a reply message by creating an empty WebView and
+        using DOM API to populate the WebView's empty document with content
+        from the original message. It expects the initial empty document to
+        simply be "<html></html>", and it proceeds to dynamically create and
+        append a BODY node and add the original message content as a child of
+        that node. Outlook then takes the innerHTML of the frame's first body
+        element and copies it into a *new* document that is displayed and
+        edited in the reply message window.
+        
+        Due to implementing the HTML5 tree building algorithm in r64712,
+        initial empty documents went from being "<html></html>" to being
+        "<html><head></head><body></body></html>". Outlook still dynamically
+        creates a BODY node to parent the original message content, but this
+        BODY node duplicates the one created by the tree builder. When Outlook
+        then takes the innerHTML of the first body element to populate the
+        reply message window it gets the empty body element created by the
+        parser, not the one it created with the original message content.
+        
+        Fix this by injecting a user script into the initial empty document
+        that removes the HEAD and BODY nodes created by the parser. This
+        ensures that the BODY created by Outlook is the only BODY in the
+        document.
+
+        * Misc/OutlookQuirksUserScript.js: Added.
+        * WebView/WebView.mm:
+        (leakMailQuirksUserScriptContents):
+        (-[WebView _injectMailQuirksScript]):
+        (needsOutlookQuirksScript):
+        (leakOutlookQuirksUserScriptContents):
+        (-[WebView _injectOutlookQuirksScript]):
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+
+2011-04-06  Dai Mikurube  <dmikurube@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add QUOTA build flag for unified quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57918
+
+        * Configurations/FeatureDefines.xcconfig: Added QUOTA build flag
+
+2011-04-06  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move code duplicated between the WebKit/mac and WebKit2 down to WebCore because Chromium will need it too
+        https://bugs.webkit.org/show_bug.cgi?id=54969
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _convertToNSRange:]): Moved duplicated code to WebCore
+        (-[WebFrame _characterRangeAtPoint:]): Moved duplicated code to WebCore
+
+2011-04-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Move attributedStringFromRange down to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=57905
+
+        * Misc/WebNSAttributedStringExtras.h: Removed.
+        * Misc/WebNSAttributedStringExtras.mm: Removed.
+        * WebView/WebHTMLRepresentation.mm:
+        (-[WebHTMLRepresentation attributedStringFrom:startOffset:to:endOffset:]):
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _writeSelectionWithPasteboardTypes:toPasteboard:cachedAttributedString:]):
+        (-[WebHTMLView attributedSubstringFromRange:]):
+        (-[WebHTMLView attributedString]):
+        (-[WebHTMLView selectedAttributedString]):
+        * WebView/WebPDFView.mm:
+        (-[WebPDFView writeSelectionWithPasteboardTypes:toPasteboard:]):
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+
+        Removed NSTextCheckingResult to SpellCheckingResult convertion, and extracted
+        NSTextCheckingResult to TextCheckingResult convertio from checkTextOfParagraph method.
+        for requestCheckingOfString method.
+        
+        * WebCoreSupport/WebEditorClient.h:
+        * WebCoreSupport/WebEditorClient.mm:
+        (toCoreTextCheckingResults):
+        (WebEditorClient::checkTextOfParagraph):
+        (-[WebEditorSpellCheckResponder initWithSender:WebCore::sequence:types:WebCore::results:]):
+        (-[WebEditorSpellCheckResponder perform]):
+        (WebEditorClient::requestCheckingOfString):
+        * WebView/WebFrame.mm:
+        (-[WebFrame markersForSelectionStartAsText]):
+        * WebView/WebFramePrivate.h:
+
+2011-04-05  Anders Carlsson  <andersca@apple.com>
+
+        Didn't mean to land this.
+
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView getVariable:value:]):
+
+2011-04-04  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/57384> CFNetwork and WebCore load priorities should match
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Added initialization for
+        wkSetHTTPPipeliningMaximumPriority().
+
+2011-04-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (WebKit2): Caps-Lock indicator sometimes doesn't appear in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=51230
+        <rdar://problem/8780989>
+
+        * WebView/WebHTMLView.mm: (-[WebHTMLView flagsChanged:]): Moved Caps Lock handling from
+        WebKits to WebCore, because WebKit shouldn't be smart.
+
+2011-04-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: Assertion failure when executing a complex custom key binding
+        https://bugs.webkit.org/show_bug.cgi?id=57681
+
+        * WebView/WebHTMLView.mm: (-[WebHTMLView hasMarkedText]): There is no need to execute saved
+        commands when they can't possibly change the result.
+
+2011-04-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Shockwave plug-in doesn't accept mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=57653
+        <rdar://problem/8483273>
+
+        Fix an unrelated bug found by the added test.
+
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView convertFromX:andY:space:toX:andY:space:]):
+        Make sure to always set destX and destY.
+
+2011-04-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit2 text input handling more like WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=57649
+
+        * WebView/WebFrameInternal.h: Expose _convertToDOMRange for use in WebHTMLView.
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _executeSavedKeypressCommands]): Renamed, since these are not editor commands.
+        (-[WebHTMLView _interpretKeyEvent:savingCommands:]): Updated for the renamed _executeSavedKeypressCommands.
+        (-[WebHTMLView characterIndexForPoint:]): Ditto.
+        (-[WebHTMLView firstRectForCharacterRange:]): Ditto.
+        (-[WebHTMLView selectedRange]): Ditto.
+        (-[WebHTMLView markedRange]): Ditto.
+        (-[WebHTMLView attributedSubstringFromRange:]): Ditto.
+        (-[WebHTMLView hasMarkedText]): Ditto.
+        (-[WebHTMLView unmarkText]): Ditto.
+        (-[WebHTMLView setMarkedText:selectedRange:]): Ditto. Changed the comment about the argument
+        type into an assertion. Removed resetting interpretKeyEventsParameters to 0, as we shouldn't
+        be able to call text input protocol methods from here (and we didn't even reset it back on
+        return). Changed to retrieve all data before starting to apply actions to better match WK2 code.
+        (-[WebHTMLView insertText:]): Ditto.
+
+2011-04-01  Timothy Hatcher  <timothy@apple.com>
+
+        Make momentum scroll event latching work in WebKit2 on Mac.
+
+        <rdar://problem/8751861>
+
+        Reviewed by Darin Adler.
+
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Remove IsLatchingWheelEvent, add GetNSEventMomentumPhase.
+        * WebView/WebDynamicScrollBarsView.mm:
+        (-[WebDynamicScrollBarsView scrollWheel:]): Use WKGetNSEventMomentumPhase to set isLatchingEvent.
+
+2011-03-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Assertion failure in -[WebHTMLView _handleStyleKeyEquivalent:]
+        https://bugs.webkit.org/show_bug.cgi?id=26667
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _handleStyleKeyEquivalent:]): Handle the case where WebView is
+        nil rather than asserting that it is non-nil. One case where WebView will be nil
+        is when the frame is closed, but in any case where it is nil, the correct thing
+        to do is to not try to handle the style key.
+
+2011-03-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Patch by John Harvey, reviewed and tweaked by me.
+
+        <rdar://problem/8644403> Should notify TSM that plug-ins would show a bottom input window for marked text.
+
+        * Plugins/Hosted/WebTextInputWindowController.m:
+        (-[WebTextInputPanel _interpretKeyEvent:string:]):
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidReceiveTitle):
+        (WebFrameLoaderClient::setTitle):
+
+2011-03-30  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds layoutTestController.shadowRoot accessor to Mac DRT.
+        https://bugs.webkit.org/show_bug.cgi?id=57415
+
+        * DOM/WebDOMOperations.mm:
+        (-[DOMElement _shadowRoot:]):
+        * DOM/WebDOMOperationsPrivate.h:
+
+2011-03-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebHTMLView shouldn't resend noop: commands
+        https://bugs.webkit.org/show_bug.cgi?id=57504
+        <rdar://problem/9209390>
+
+        * WebView/WebHTMLView.mm: (-[WebHTMLView _executeSavedEditingCommands]): Filter out NOOPs,
+        which we get e.g. when handling Cmd-key combos.
+
 2011-03-30  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Darin Adler.
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 0c1d13c..73d3a47 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -23,8 +23,8 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 // The contents of this file must be kept in sync with FeatureDefines.xcconfig in JavaScriptCore,
-// WebCore and WebKit.  Also the default values of the ENABLE_FEATURE_NAME macros in build-webkit
-// should match the values below, but they do not need to be in the same order.
+// WebCore, WebKit and WebKit2.  Also the default values of the ENABLE_FEATURE_NAME macros in
+// build-webkit should match the values below, but they do not need to be in the same order.
 
 // Keep this list of features (not enabled/disabled state) in sync with FeatureDefines.vsprops
 // and FeatureDefinesCairo.vsprops in WebKitLibraries/win/tools/vsprops.
@@ -91,8 +91,11 @@ ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
+ENABLE_PAGE_VISIBILITY_API = ;
 ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 
+ENABLE_QUOTA = ;
+
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
@@ -109,6 +112,7 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
+ENABLE_VIDEO_TRACK = ;
 
 ENABLE_MEDIA_STATISTICS = ;
 
@@ -127,4 +131,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_QUOTA) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index 5e8e50b..025f4a3 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 27;
+MINOR_VERSION = 30;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit/mac/DOM/WebDOMOperations.mm b/Source/WebKit/mac/DOM/WebDOMOperations.mm
index 979433d..20e9ace 100644
--- a/Source/WebKit/mac/DOM/WebDOMOperations.mm
+++ b/Source/WebKit/mac/DOM/WebDOMOperations.mm
@@ -39,6 +39,7 @@
 #import "WebKitNSStringExtras.h"
 #import <JavaScriptCore/APICast.h>
 #import <WebCore/Document.h>
+#import <WebCore/Element.h>
 #import <WebCore/HTMLInputElement.h>
 #import <WebCore/HTMLParserIdioms.h>
 #import <WebCore/JSElement.h>
@@ -73,6 +74,13 @@ using namespace JSC;
     return WebCore::markerTextForListItem(core(self));
 }
 
+- (JSValueRef)_shadowRoot:(JSContextRef)context
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* execState = toJS(context);
+    return toRef(execState, toJS(execState, core(self)->shadowRoot()));
+}
+
 @end
 
 @implementation DOMNode (WebDOMNodeOperations)
diff --git a/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h b/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
index b579a6f..cd5ff20 100644
--- a/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
+++ b/Source/WebKit/mac/DOM/WebDOMOperationsPrivate.h
@@ -32,6 +32,7 @@
 @interface DOMElement (WebDOMElementOperationsPrivate)
 + (DOMElement *)_DOMElementFromJSContext:(JSContextRef)context value:(JSValueRef)value;
 - (NSString *)_markerTextForListItem;
+- (JSValueRef)_shadowRoot:(JSContextRef)context;
 @end
 
 @interface DOMDocument (WebDOMDocumentOperationsPrivate)
diff --git a/Source/WebKit/mac/Misc/OutlookQuirksUserScript.js b/Source/WebKit/mac/Misc/OutlookQuirksUserScript.js
new file mode 100644
index 0000000..65f6107
--- /dev/null
+++ b/Source/WebKit/mac/Misc/OutlookQuirksUserScript.js
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+(function() {
+    // This should only apply to the initial empty document, which should look like:
+    // <html><head></head><body></body></html>
+    if (document.documentElement.outerHTML != "<html><head></head><body></body></html>")
+        return;
+
+    // Outlook expects the initial empty document to only contain the document
+    // element. It will explicitly insert a BODY node.
+    document.documentElement.removeChild(document.head);
+    document.documentElement.removeChild(document.body);
+})();
+
+ 
+\ No newline at end of file
diff --git a/Source/WebKit/mac/Misc/WebIconDatabase.mm b/Source/WebKit/mac/Misc/WebIconDatabase.mm
index f223f09..e9aa8ec 100644
--- a/Source/WebKit/mac/Misc/WebIconDatabase.mm
+++ b/Source/WebKit/mac/Misc/WebIconDatabase.mm
@@ -35,7 +35,7 @@
 #import "WebNSFileManagerExtras.h"
 #import "WebNSNotificationCenterExtras.h"
 #import "WebNSURLExtras.h"
-#import "WebPreferences.h"
+#import "WebPreferencesPrivate.h"
 #import "WebTypesInternal.h"
 #import <WebCore/IconDatabase.h>
 #import <WebCore/Image.h>
@@ -313,7 +313,7 @@ static WebIconDatabaseClient* defaultClient()
                                                object:NSApp];
     [[NSNotificationCenter defaultCenter] addObserver:self
                                              selector:@selector(_resetCachedWebPreferences:)
-                                                 name:WebPreferencesChangedNotification
+                                                 name:WebPreferencesChangedInternalNotification
                                                object:nil];
 }
 
@@ -324,7 +324,7 @@ static WebIconDatabaseClient* defaultClient()
                                                     name:NSApplicationWillTerminateNotification
                                                   object:NSApp];
     [[NSNotificationCenter defaultCenter] removeObserver:self
-                                                    name:WebPreferencesChangedNotification
+                                                    name:WebPreferencesChangedInternalNotification
                                                   object:nil];
 }
 
diff --git a/Source/WebKit/mac/Misc/WebNSAttributedStringExtras.mm b/Source/WebKit/mac/Misc/WebNSAttributedStringExtras.mm
deleted file mode 100644
index 2469da8..0000000
--- a/Source/WebKit/mac/Misc/WebNSAttributedStringExtras.mm
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * Copyright (C) 2005, 2007, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-    * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "WebNSAttributedStringExtras.h"
-
-#import "DOMRangeInternal.h"
-#import "WebDataSourcePrivate.h"
-#import "WebFrame.h"
-#import "WebFrameInternal.h"
-#import "WebTypesInternal.h"
-#import <WebCore/BlockExceptions.h>
-#import <WebCore/ColorMac.h>
-#import <WebCore/CSSHelper.h>
-#import <WebCore/Document.h>
-#import <WebCore/Element.h>
-#import <WebCore/Frame.h>
-#import <WebCore/FrameLoader.h>
-#import <WebCore/HTMLNames.h>
-#import <WebCore/Image.h>
-#import <WebCore/InlineTextBox.h>
-#import <WebCore/Range.h>
-#import <WebCore/RenderImage.h>
-#import <WebCore/RenderListItem.h>
-#import <WebCore/RenderObject.h>
-#import <WebCore/RenderStyle.h>
-#import <WebCore/RenderText.h>
-#import <WebCore/SimpleFontData.h>
-#import <WebCore/Text.h>
-#import <WebCore/TextIterator.h>
-
-using namespace WebCore;
-using namespace HTMLNames;
-
-struct ListItemInfo {
-    unsigned start;
-    unsigned end;
-};
-
-static NSFileWrapper *fileWrapperForElement(Element* e)
-{
-    NSFileWrapper *wrapper = nil;
-    BEGIN_BLOCK_OBJC_EXCEPTIONS;
-    
-    const AtomicString& attr = e->getAttribute(srcAttr);
-    if (!attr.isEmpty()) {
-        NSURL *URL = e->document()->completeURL(attr);
-        wrapper = [[kit(e->document()->frame()) _dataSource] _fileWrapperForURL:URL];
-    }
-    if (!wrapper) {
-        RenderImage* renderer = toRenderImage(e->renderer());
-        if (renderer->cachedImage() && !renderer->cachedImage()->errorOccurred()) {
-            wrapper = [[NSFileWrapper alloc] initRegularFileWithContents:(NSData *)(renderer->cachedImage()->image()->getTIFFRepresentation())];
-            [wrapper setPreferredFilename:@"image.tiff"];
-            [wrapper autorelease];
-        }
-    }
-
-    return wrapper;
-
-    END_BLOCK_OBJC_EXCEPTIONS;
-
-    return nil;
-}
-
-@implementation NSAttributedString (WebKitExtras)
-
-- (NSAttributedString *)_web_attributedStringByStrippingAttachmentCharacters
-{
-    // This code was originally copied from NSTextView
-    NSRange attachmentRange;
-    NSString *originalString = [self string];
-    static NSString *attachmentCharString = nil;
-    
-    if (!attachmentCharString) {
-        unichar chars[2];
-        if (!attachmentCharString) {
-            chars[0] = NSAttachmentCharacter;
-            chars[1] = 0;
-            attachmentCharString = [[NSString alloc] initWithCharacters:chars length:1];
-        }
-    }
-    
-    attachmentRange = [originalString rangeOfString:attachmentCharString];
-    if (attachmentRange.location != NSNotFound && attachmentRange.length > 0) {
-        NSMutableAttributedString *newAttributedString = [[self mutableCopyWithZone:NULL] autorelease];
-        
-        while (attachmentRange.location != NSNotFound && attachmentRange.length > 0) {
-            [newAttributedString replaceCharactersInRange:attachmentRange withString:@""];
-            attachmentRange = [[newAttributedString string] rangeOfString:attachmentCharString];
-        }
-        return newAttributedString;
-    }
-    
-    return self;
-}
-
-+ (NSAttributedString *)_web_attributedStringFromRange:(Range*)range
-{
-    NSMutableAttributedString *string = [[NSMutableAttributedString alloc] init];
-    NSUInteger stringLength = 0;
-    RetainPtr<NSMutableDictionary> attrs(AdoptNS, [[NSMutableDictionary alloc] init]);
-
-    for (TextIterator it(range); !it.atEnd(); it.advance()) {
-        RefPtr<Range> currentTextRange = it.range();
-        ExceptionCode ec = 0;
-        Node* startContainer = currentTextRange->startContainer(ec);
-        Node* endContainer = currentTextRange->endContainer(ec);
-        int startOffset = currentTextRange->startOffset(ec);
-        int endOffset = currentTextRange->endOffset(ec);
-        
-        if (startContainer == endContainer && (startOffset == endOffset - 1)) {
-            Node* node = startContainer->childNode(startOffset);
-            if (node && node->hasTagName(imgTag)) {
-                NSFileWrapper *fileWrapper = fileWrapperForElement(static_cast<Element*>(node));
-                NSTextAttachment *attachment = [[NSTextAttachment alloc] initWithFileWrapper:fileWrapper];
-                [string appendAttributedString:[NSAttributedString attributedStringWithAttachment:attachment]];
-                [attachment release];
-            }
-        }
-
-        int currentTextLength = it.length();
-        if (!currentTextLength)
-            continue;
-
-        RenderObject* renderer = startContainer->renderer();
-        ASSERT(renderer);
-        if (!renderer)
-            continue;
-        RenderStyle* style = renderer->style();
-        NSFont *font = style->font().primaryFont()->getNSFont();
-        [attrs.get() setObject:font forKey:NSFontAttributeName];
-        if (style->visitedDependentColor(CSSPropertyColor).alpha())
-            [attrs.get() setObject:nsColor(style->visitedDependentColor(CSSPropertyColor)) forKey:NSForegroundColorAttributeName];
-        else
-            [attrs.get() removeObjectForKey:NSForegroundColorAttributeName];
-        if (style->visitedDependentColor(CSSPropertyBackgroundColor).alpha())
-            [attrs.get() setObject:nsColor(style->visitedDependentColor(CSSPropertyBackgroundColor)) forKey:NSBackgroundColorAttributeName];
-        else
-            [attrs.get() removeObjectForKey:NSBackgroundColorAttributeName];
-
-        RetainPtr<NSString> substring(AdoptNS, [[NSString alloc] initWithCharactersNoCopy:const_cast<UChar*>(it.characters()) length:currentTextLength freeWhenDone:NO]);
-        [string replaceCharactersInRange:NSMakeRange(stringLength, 0) withString:substring.get()];
-        [string setAttributes:attrs.get() range:NSMakeRange(stringLength, currentTextLength)];
-        stringLength += currentTextLength;
-    }
-
-    return [string autorelease];
-}
-
-@end
diff --git a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
index 7828460..bf36fbd 100644
--- a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
+++ b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
@@ -28,7 +28,8 @@
 #ifndef NetscapePluginInstanceProxy_h
 #define NetscapePluginInstanceProxy_h
 
-#include <JavaScriptCore/Global.h>
+#include <JavaScriptCore/JSGlobalData.h>
+#include <JavaScriptCore/Strong.h>
 #include <WebCore/Timer.h>
 #include <WebKit/npapi.h>
 #include <wtf/Deque.h>
@@ -327,7 +328,7 @@ private:
         JSC::JSObject* get(uint32_t) const;
 
     private:
-        HashMap<uint32_t, JSC::Global<JSC::JSObject> > m_idToJSObjectMap;
+        HashMap<uint32_t, JSC::Strong<JSC::JSObject> > m_idToJSObjectMap;
         // The pair consists of object ID and a reference count. One reference belongs to remote plug-in,
         // and the proxy will add transient references for arguments that are being sent out.
         HashMap<JSC::JSObject*, pair<uint32_t, uint32_t> > m_jsObjectToIDMap;
diff --git a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index ed646d3..63b0899 100644
--- a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -148,7 +148,7 @@ uint32_t NetscapePluginInstanceProxy::LocalObjectMap::idForObject(JSGlobalData&
         objectID = ++m_objectIDCounter;
     } while (!m_objectIDCounter || m_objectIDCounter == static_cast<uint32_t>(-1) || m_idToJSObjectMap.contains(objectID));
 
-    m_idToJSObjectMap.set(objectID, Global<JSObject>(globalData, object));
+    m_idToJSObjectMap.set(objectID, Strong<JSObject>(globalData, object));
     m_jsObjectToIDMap.set(object, make_pair<uint32_t, uint32_t>(objectID, 1));
 
     return objectID;
@@ -188,7 +188,7 @@ bool NetscapePluginInstanceProxy::LocalObjectMap::forget(uint32_t objectID)
         return true;
     }
 
-    HashMap<uint32_t, JSC::Global<JSC::JSObject> >::iterator iter = m_idToJSObjectMap.find(objectID);
+    HashMap<uint32_t, JSC::Strong<JSC::JSObject> >::iterator iter = m_idToJSObjectMap.find(objectID);
     if (iter == m_idToJSObjectMap.end()) {
         LOG_ERROR("NetscapePluginInstanceProxy::LocalObjectMap::forget: local object %u doesn't exist.", objectID);
         return true;
@@ -866,7 +866,7 @@ bool NetscapePluginInstanceProxy::evaluate(uint32_t objectID, const String& scri
 
     JSLock lock(SilenceAssertionsOnly);
     
-    Global<JSGlobalObject> globalObject(*pluginWorld()->globalData(), frame->script()->globalObject(pluginWorld()));
+    Strong<JSGlobalObject> globalObject(*pluginWorld()->globalData(), frame->script()->globalObject(pluginWorld()));
     ExecState* exec = globalObject->globalExec();
 
     bool oldAllowPopups = frame->script()->allowPopupsFromPlugin();
diff --git a/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm b/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
index f26b85d..1f96c53 100644
--- a/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
+++ b/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
@@ -187,7 +187,7 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
     {
         return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.h b/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.h
index a07c86c..da6de88 100644
--- a/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.h
+++ b/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.h
@@ -41,7 +41,7 @@ public:
 
     ProxyInstance* getInternalProxyInstance() const;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebKit/mac/Plugins/Hosted/WebTextInputWindowController.m b/Source/WebKit/mac/Plugins/Hosted/WebTextInputWindowController.m
index c168e6e..8b59d34 100644
--- a/Source/WebKit/mac/Plugins/Hosted/WebTextInputWindowController.m
+++ b/Source/WebKit/mac/Plugins/Hosted/WebTextInputWindowController.m
@@ -92,7 +92,14 @@
     BOOL hadMarkedText = [_inputTextView hasMarkedText];
  
     *string = nil;
-    
+
+    // Let TSM know that a bottom input window would be created for marked text.
+    EventRef carbonEvent = (EventRef)[event eventRef];
+    if (carbonEvent) {
+        Boolean ignorePAH = true;
+        SetEventParameter(carbonEvent, 'iPAH', typeBoolean, sizeof(ignorePAH), &ignorePAH);
+    }
+
     if (![[_inputTextView inputContext] handleEvent:event])
         return NO;
     
diff --git a/Source/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm b/Source/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
index 59a80c9..f1eecde 100644
--- a/Source/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
+++ b/Source/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
@@ -619,9 +619,9 @@ String WebHaltablePlugin::pluginName() const
             // View will have no associated windows.
             [self stop];
             
-            // Stop observing WebPreferencesChangedNotification -- we only need to observe this when installed in the view hierarchy.
+            // Stop observing WebPreferencesChangedInternalNotification -- we only need to observe this when installed in the view hierarchy.
             // When not in the view hierarchy, -viewWillMoveToWindow: and -viewDidMoveToWindow will start/stop the plugin as needed.
-            [[NSNotificationCenter defaultCenter] removeObserver:self name:WebPreferencesChangedNotification object:nil];
+            [[NSNotificationCenter defaultCenter] removeObserver:self name:WebPreferencesChangedInternalNotification object:nil];
         }
     }
 }
@@ -634,9 +634,9 @@ String WebHaltablePlugin::pluginName() const
         // There is no need to start the plug-in when moving into a superview.  -viewDidMoveToWindow takes care of that.
         [self stop];
         
-        // Stop observing WebPreferencesChangedNotification -- we only need to observe this when installed in the view hierarchy.
+        // Stop observing WebPreferencesChangedInternalNotification -- we only need to observe this when installed in the view hierarchy.
         // When not in the view hierarchy, -viewWillMoveToWindow: and -viewDidMoveToWindow will start/stop the plugin as needed.
-        [[NSNotificationCenter defaultCenter] removeObserver:self name:WebPreferencesChangedNotification object:nil];
+        [[NSNotificationCenter defaultCenter] removeObserver:self name:WebPreferencesChangedInternalNotification object:nil];
     }
 }
 
@@ -645,11 +645,11 @@ String WebHaltablePlugin::pluginName() const
     [self resetTrackingRect];
     
     if ([self window]) {
-        // While in the view hierarchy, observe WebPreferencesChangedNotification so that we can start/stop depending
+        // While in the view hierarchy, observe WebPreferencesChangedInternalNotification so that we can start/stop depending
         // on whether plugins are enabled.
         [[NSNotificationCenter defaultCenter] addObserver:self
                                                  selector:@selector(preferencesHaveChanged:)
-                                                     name:WebPreferencesChangedNotification
+                                                     name:WebPreferencesChangedInternalNotification
                                                    object:nil];
 
         _isPrivateBrowsingEnabled = [[[self webView] preferences] privateBrowsingEnabled];
@@ -677,8 +677,8 @@ String WebHaltablePlugin::pluginName() const
         // View will have no associated windows.
         [self stop];
         
-        // Remove WebPreferencesChangedNotification observer -- we will observe once again when we move back into the window
-        [[NSNotificationCenter defaultCenter] removeObserver:self name:WebPreferencesChangedNotification object:nil];
+        // Remove WebPreferencesChangedInternalNotification observer -- we will observe once again when we move back into the window
+        [[NSNotificationCenter defaultCenter] removeObserver:self name:WebPreferencesChangedInternalNotification object:nil];
     }
 }
 
@@ -857,8 +857,13 @@ String WebHaltablePlugin::pluginName() const
                  toX:(double *)destX andY:(double *)destY space:(NPCoordinateSpace)destSpace
 {
     // Nothing to do
-    if (sourceSpace == destSpace)
-        return TRUE;
+    if (sourceSpace == destSpace) {
+        if (destX)
+            *destX = sourceX;
+        if (destY)
+            *destY = sourceY;
+        return YES;
+    }
     
     NSPoint sourcePoint = NSMakePoint(sourceX, sourceY);
     
diff --git a/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm b/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm
index 3fb86cb..128834e 100644
--- a/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm
+++ b/Source/WebKit/mac/Plugins/WebBasePluginPackage.mm
@@ -403,8 +403,9 @@ static inline void swapIntsInHeader(uint32_t* rawData, size_t length)
             if (magic == FAT_CIGAM)
                 swapIntsInHeader(rawData.data(), rawData.size());
             
-            archs = (struct fat_arch*)((uint8_t*)rawData.data() + sizeof(struct fat_header));            
-            numArchs = ((struct fat_header *)rawData.data())->nfat_arch;
+            COMPILE_ASSERT(sizeof(struct fat_header) % sizeof(uint32_t) == 0, struct_fat_header_must_be_integral_size_of_uint32_t);
+            archs = reinterpret_cast<struct fat_arch*>(rawData.data() + sizeof(struct fat_header) / sizeof(uint32_t));
+            numArchs = reinterpret_cast<struct fat_header*>(rawData.data())->nfat_arch;
             
             unsigned maxArchs = (sizeInBytes - sizeof(struct fat_header)) / sizeof(struct fat_arch);
             if (numArchs > maxArchs)
diff --git a/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.h b/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.h
index 8adb79f..15b2c67 100644
--- a/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.h
+++ b/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.h
@@ -27,8 +27,8 @@
 #define CorrectionPanel_h
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-#import <AppKit/NSTextChecker.h>
-#import <WebCore/CorrectionPanelInfo.h>
+#import <AppKit/NSSpellChecker.h>
+#import <WebCore/SpellingCorrectionController.h>
 #import <wtf/RetainPtr.h>
 
 @class WebView;
@@ -46,7 +46,7 @@ public:
 private:
     bool isShowing() const { return m_view; }
     void dismissInternal(WebCore::ReasonForDismissingCorrectionPanel, bool dismissingExternally);
-    void handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement, NSCorrectionBubbleType);
+    void handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement, NSCorrectionIndicatorType);
 
     bool m_wasDismissedExternally;
     WebCore::ReasonForDismissingCorrectionPanel m_reasonForDismissing;
diff --git a/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.mm b/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.mm
index 05f3f69..ce52b74 100644
--- a/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.mm
+++ b/Source/WebKit/mac/WebCoreSupport/CorrectionPanel.mm
@@ -29,18 +29,18 @@
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 using namespace WebCore;
 
-static inline NSCorrectionBubbleType correctionBubbleType(CorrectionPanelInfo::PanelType panelType)
+static inline NSCorrectionIndicatorType correctionIndicatorType(CorrectionPanelInfo::PanelType panelType)
 {
     switch (panelType) {
     case CorrectionPanelInfo::PanelTypeCorrection:
-        return NSCorrectionBubbleTypeCorrection;
+        return NSCorrectionIndicatorTypeDefault;
     case CorrectionPanelInfo::PanelTypeReversion:
-        return NSCorrectionBubbleTypeReversion;
+        return NSCorrectionIndicatorTypeReversion;
     case CorrectionPanelInfo::PanelTypeSpellingSuggestions:
-        return NSCorrectionBubbleTypeGuesses;
+        return NSCorrectionIndicatorTypeGuesses;
     }
     ASSERT_NOT_REACHED();
-    return NSCorrectionBubbleTypeCorrection;
+    return NSCorrectionIndicatorTypeDefault;
 }
 
 CorrectionPanel::CorrectionPanel()
@@ -65,7 +65,7 @@ void CorrectionPanel::show(WebView* view, CorrectionPanelInfo::PanelType type, c
     NSString* replacedStringAsNSString = replacedString;
     NSString* replacementStringAsNSString = replacementString;
     m_view = view;
-    NSCorrectionBubbleType bubbleType = correctionBubbleType(type);
+    NSCorrectionIndicatorType indicatorType = correctionIndicatorType(type);
     
     NSMutableArray* alternativeStrings = 0;
     if (!alternativeReplacementStrings.isEmpty()) {
@@ -75,8 +75,8 @@ void CorrectionPanel::show(WebView* view, CorrectionPanelInfo::PanelType type, c
             [alternativeStrings addObject:(NSString*)alternativeReplacementStrings[i]];
     }
 
-    [[NSSpellChecker sharedSpellChecker] showCorrectionBubbleOfType:bubbleType primaryString:replacementStringAsNSString alternativeStrings:alternativeStrings forStringInRect:boundingBoxOfReplacedString view:m_view.get() completionHandler:^(NSString* acceptedString) {
-        handleAcceptedReplacement(acceptedString, replacedStringAsNSString, replacementStringAsNSString, bubbleType);
+    [[NSSpellChecker sharedSpellChecker] showCorrectionIndicatorOfType:indicatorType primaryString:replacementStringAsNSString alternativeStrings:alternativeStrings forStringInRect:[view convertRect:boundingBoxOfReplacedString fromView:nil] view:m_view.get() completionHandler:^(NSString* acceptedString) {
+        handleAcceptedReplacement(acceptedString, replacedStringAsNSString, replacementStringAsNSString, indicatorType);
     }];
 }
 
@@ -106,7 +106,7 @@ void CorrectionPanel::dismissInternal(ReasonForDismissingCorrectionPanel reason,
     
     m_reasonForDismissing = reason;
     m_resultForSynchronousDismissal.clear();
-    [[NSSpellChecker sharedSpellChecker] dismissCorrectionBubbleForView:m_view.get()];
+    [[NSSpellChecker sharedSpellChecker] dismissCorrectionIndicatorForView:m_view.get()];
     m_view.clear();
 }
 
@@ -115,13 +115,13 @@ void CorrectionPanel::recordAutocorrectionResponse(WebView* view, NSCorrectionRe
     [[NSSpellChecker sharedSpellChecker] recordResponse:response toCorrection:replacementString forWord:replacedString language:nil inSpellDocumentWithTag:[view spellCheckerDocumentTag]];
 }
 
-void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement,  NSCorrectionBubbleType correctionBubbleType)
+void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement,  NSCorrectionIndicatorType correctionIndicatorType)
 {
     NSSpellChecker* spellChecker = [NSSpellChecker sharedSpellChecker];
     NSInteger documentTag = [m_view.get() spellCheckerDocumentTag];
 
-    switch (correctionBubbleType) {
-    case NSCorrectionBubbleTypeCorrection:
+    switch (correctionIndicatorType) {
+    case NSCorrectionIndicatorTypeDefault:
         if (acceptedReplacement)
             [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
         else {
@@ -131,11 +131,11 @@ void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, N
                 [spellChecker recordResponse:NSCorrectionResponseIgnored toCorrection:proposedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
         }
         break;
-    case NSCorrectionBubbleTypeReversion:
+    case NSCorrectionIndicatorTypeReversion:
         if (acceptedReplacement)
             [spellChecker recordResponse:NSCorrectionResponseReverted toCorrection:replaced forWord:acceptedReplacement language:nil inSpellDocumentWithTag:documentTag];
         break;
-    case NSCorrectionBubbleTypeGuesses:
+    case NSCorrectionIndicatorTypeGuesses:
         if (acceptedReplacement)
             [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
         break;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
index 412cb45..0e52102 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
@@ -130,7 +130,7 @@ public:
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength);
     virtual WTF::String getAutoCorrectSuggestionForMisspelledWord(const WTF::String&);
     virtual void checkGrammarOfString(const UChar*, int length, WTF::Vector<WebCore::GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength);
-    virtual void checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, WTF::Vector<WebCore::TextCheckingResult>& results);
+    virtual void checkTextOfParagraph(const UChar* text, int length, WebCore::TextCheckingTypeMask checkingTypes, WTF::Vector<WebCore::TextCheckingResult>& results);
     virtual void updateSpellingUIWithGrammarString(const WTF::String&, const WebCore::GrammarDetail&);
     virtual void updateSpellingUIWithMisspelledWord(const WTF::String&);
     virtual void showSpellingUI(bool show);
@@ -138,7 +138,7 @@ public:
     virtual void getGuessesForWord(const WTF::String& word, const WTF::String& context, WTF::Vector<WTF::String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&);
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&);
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel);
diff --git a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
index c205ef6..2300be1 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
@@ -69,28 +69,15 @@
 #import <runtime/InitializeThreading.h>
 #import <wtf/PassRefPtr.h>
 #import <wtf/Threading.h>
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-#import <AppKit/NSTextChecker.h>
-#endif
 
 using namespace WebCore;
 
 using namespace HTMLNames;
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-static inline NSCorrectionBubbleType correctionBubbleType(CorrectionPanelInfo::PanelType panelType)
-{
-    switch (panelType) {
-    case CorrectionPanelInfo::PanelTypeCorrection:
-        return NSCorrectionBubbleTypeCorrection;
-    case CorrectionPanelInfo::PanelTypeReversion:
-        return NSCorrectionBubbleTypeReversion;
-    case CorrectionPanelInfo::PanelTypeSpellingSuggestions:
-        return NSCorrectionBubbleTypeGuesses;
-    }
-    ASSERT_NOT_REACHED();
-    return NSCorrectionBubbleTypeCorrection;
-}
+@interface NSSpellChecker (WebNSSpellCheckerDetails)
+- (NSString *)languageForWordRange:(NSRange)range inString:(NSString *)string orthography:(NSOrthography *)orthography;
+@end
 #endif
 
 @interface NSAttributedString (WebNSAttributedStringDetails)
@@ -790,12 +777,11 @@ void WebEditorClient::checkGrammarOfString(const UChar* text, int length, Vector
 #endif
 }
 
-void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<TextCheckingResult>& results)
-{
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    NSString *textString = [[NSString alloc] initWithCharactersNoCopy:const_cast<UChar*>(text) length:length freeWhenDone:NO];
-    NSArray *incomingResults = [[NSSpellChecker sharedSpellChecker] checkString:textString range:NSMakeRange(0, [textString length]) types:(checkingTypes|NSTextCheckingTypeOrthography) options:nil inSpellDocumentWithTag:spellCheckerDocumentTag() orthography:NULL wordCount:NULL];
-    [textString release];
+static Vector<TextCheckingResult> core(NSArray *incomingResults, TextCheckingTypeMask checkingTypes)
+{
+    Vector<TextCheckingResult> results;
+
     for (NSTextCheckingResult *incomingResult in incomingResults) {
         NSRange resultRange = [incomingResult range];
         NSTextCheckingType resultType = [incomingResult resultType];
@@ -867,6 +853,18 @@ void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, uint64
             results.append(result);
         }
     }
+
+    return results;
+}
+#endif
+
+void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, TextCheckingTypeMask checkingTypes, Vector<TextCheckingResult>& results)
+{
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    NSString *textString = [[NSString alloc] initWithCharactersNoCopy:const_cast<UChar*>(text) length:length freeWhenDone:NO];
+    NSArray *incomingResults = [[NSSpellChecker sharedSpellChecker] checkString:textString range:NSMakeRange(0, [textString length]) types:(checkingTypes|NSTextCheckingTypeOrthography) options:nil inSpellDocumentWithTag:spellCheckerDocumentTag() orthography:NULL wordCount:NULL];
+    [textString release];
+    results = core(incomingResults, checkingTypes);
 #endif
 }
 
@@ -965,58 +963,35 @@ void WebEditorClient::setInputMethodState(bool)
 {
     WebCore::SpellChecker* _sender;
     int _sequence;
+    TextCheckingTypeMask _types;
     RetainPtr<NSArray> _results;
 }
-- (id)initWithSender:(WebCore::SpellChecker*)sender sequence:(int)sequence results:(NSArray*)results;
+- (id)initWithSender:(WebCore::SpellChecker*)sender sequence:(int)sequence types:(WebCore::TextCheckingTypeMask)types results:(NSArray*)results;
 - (void)perform;
-- (WTF::Vector<WebCore::SpellCheckingResult>) _coreResults;
 @end
 
 @implementation WebEditorSpellCheckResponder
-- (id)initWithSender:(WebCore::SpellChecker*)sender sequence:(int)sequence results:(NSArray*)results
+- (id)initWithSender:(WebCore::SpellChecker*)sender sequence:(int)sequence types:(WebCore::TextCheckingTypeMask)types results:(NSArray*)results
 {
     self = [super init];
     if (!self)
         return nil;
     _sender = sender;
     _sequence = sequence;
+    _types = types;
     _results = results;
     return self;
 }
 
 - (void)perform
 {
-    _sender->didCheck(_sequence, [self _coreResults]);
-}
-
-static SpellCheckingResult toCoreSpellingResult(NSTextCheckingResult* result)
-{
-    NSTextCheckingType type = [result resultType];
-    NSRange range = [result range];
-    DocumentMarker::MarkerType coreType;
-    if (type & NSTextCheckingTypeSpelling)
-        coreType = DocumentMarker::Spelling;
-    else if (type & NSTextCheckingTypeGrammar)
-        coreType = DocumentMarker::Grammar;
-    else
-        coreType = DocumentMarker::AllMarkers;
-
-    return SpellCheckingResult(coreType, range.location, range.length);
-}
-
-- (WTF::Vector<WebCore::SpellCheckingResult>)_coreResults
-{
-    WTF::Vector<WebCore::SpellCheckingResult> coreResults;
-    coreResults.reserveCapacity([_results.get() count]);
-    for (NSTextCheckingResult* result in _results.get())
-        coreResults.append(toCoreSpellingResult(result));
-    return coreResults;
+    _sender->didCheck(_sequence, core(_results.get(), _types));
 }
 
 @end
 #endif
 
-void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker* sender, int sequence, const String& text)
+void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker* sender, int sequence, WebCore::TextCheckingTypeMask checkingTypes, const String& text)
 {
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     NSRange range = NSMakeRange(0, text.length());
@@ -1024,7 +999,7 @@ void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker* sender, int
     [[NSSpellChecker sharedSpellChecker] requestCheckingOfString:text range:range types:NSTextCheckingAllSystemTypes options:0 inSpellDocumentWithTag:0 
                                          completionHandler:^(NSInteger, NSArray* results, NSOrthography*, NSInteger) {
             [currentLoop performSelector:@selector(perform) 
-                                  target:[[[WebEditorSpellCheckResponder alloc] initWithSender:sender sequence:sequence results:results] autorelease]
+                                  target:[[[WebEditorSpellCheckResponder alloc] initWithSender:sender sequence:sequence types:checkingTypes results:results] autorelease]
                                 argument:nil order:0 modes:[NSArray arrayWithObject:NSDefaultRunLoopMode]];
         }];
 #endif
diff --git a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
index 4fe5664..c415c10 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
@@ -83,7 +83,7 @@ private:
     virtual bool canAuthenticateAgainstProtectionSpace(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ProtectionSpace&);
 #endif
     virtual void dispatchDidReceiveResponse(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceResponse&);
-    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived);
+    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int dataLength);
     virtual void dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long identifier);
     virtual void dispatchDidFailLoading(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceError&);
 
@@ -101,7 +101,7 @@ private:
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
-    virtual void dispatchDidReceiveTitle(const WTF::String& title);
+    virtual void dispatchDidReceiveTitle(const WebCore::StringWithDirection&);
     virtual void dispatchDidChangeIcons();
     virtual void dispatchDidCommitLoad();
     virtual void dispatchDidFailProvisionalLoad(const WebCore::ResourceError&);
@@ -196,7 +196,7 @@ private:
     virtual void prepareForDataSourceReplacement();
     virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
 
-    virtual void setTitle(const WTF::String& title, const WebCore::KURL&);
+    virtual void setTitle(const WebCore::StringWithDirection&, const WebCore::KURL&);
 
     virtual PassRefPtr<WebCore::Frame> createFrame(const WebCore::KURL& url, const WTF::String& name, WebCore::HTMLFrameOwnerElement*,
                                         const WTF::String& referrer, bool allowsScrolling, int marginWidth, int marginHeight);
diff --git a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index 92c2b03..1b5766a 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -491,13 +491,13 @@ NSCachedURLResponse* WebFrameLoaderClient::willCacheResponse(DocumentLoader* loa
     return response;
 }
 
-void WebFrameLoaderClient::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int lengthReceived)
+void WebFrameLoaderClient::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int dataLength)
 {
     WebView *webView = getWebView(m_webFrame.get());
     WebResourceDelegateImplementationCache* implementations = WebViewGetResourceLoadDelegateImplementations(webView);
     if (implementations->didReceiveContentLengthFunc) {
         if (id resource = [webView _objectForIdentifier:identifier])
-            CallResourceLoadDelegate(implementations->didReceiveContentLengthFunc, webView, @selector(webView:resource:didReceiveContentLength:fromDataSource:), resource, (NSInteger)lengthReceived, dataSource(loader));
+            CallResourceLoadDelegate(implementations->didReceiveContentLengthFunc, webView, @selector(webView:resource:didReceiveContentLength:fromDataSource:), resource, (NSInteger)dataLength, dataSource(loader));
     }
 }
 
@@ -624,12 +624,13 @@ void WebFrameLoaderClient::dispatchDidStartProvisionalLoad()
         CallFrameLoadDelegate(implementations->didStartProvisionalLoadForFrameFunc, webView, @selector(webView:didStartProvisionalLoadForFrame:), m_webFrame.get());
 }
 
-void WebFrameLoaderClient::dispatchDidReceiveTitle(const String& title)
+void WebFrameLoaderClient::dispatchDidReceiveTitle(const StringWithDirection& title)
 {
     WebView *webView = getWebView(m_webFrame.get());   
     WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
     if (implementations->didReceiveTitleForFrameFunc)
-        CallFrameLoadDelegate(implementations->didReceiveTitleForFrameFunc, webView, @selector(webView:didReceiveTitle:forFrame:), (NSString *)title, m_webFrame.get());
+        // FIXME: use direction of title.
+        CallFrameLoadDelegate(implementations->didReceiveTitleForFrameFunc, webView, @selector(webView:didReceiveTitle:forFrame:), (NSString *)title.string(), m_webFrame.get());
 }
 
 void WebFrameLoaderClient::dispatchDidChangeIcons()
@@ -893,7 +894,7 @@ void WebFrameLoaderClient::updateGlobalHistory()
         WebHistoryDelegateImplementationCache* implementations = WebViewGetHistoryDelegateImplementations(view);
         if (implementations->navigatedFunc) {
             WebNavigationData *data = [[WebNavigationData alloc] initWithURLString:loader->urlForHistory()
-                                                                             title:loader->title()
+                                                                             title:loader->title().string()
                                                                    originalRequest:loader->originalRequestCopy().nsURLRequest()
                                                                           response:loader->response().nsURLResponse()
                                                                  hasSubstituteData:loader->substituteData().isValid()
@@ -907,7 +908,7 @@ void WebFrameLoaderClient::updateGlobalHistory()
     }
 
     [[WebHistory optionalSharedHistory] _visitedURL:loader->urlForHistory() 
-                                          withTitle:loader->title()
+                                          withTitle:loader->title().string()
                                              method:loader->originalRequestCopy().httpMethod()
                                          wasFailure:loader->urlForHistoryReflectsFailure()
                                  increaseVisitCount:!loader->clientRedirectSourceForHistory()]; // Do not increase visit count due to navigations that were not initiated by the user directly, avoiding growth from programmatic reloads.
@@ -1179,7 +1180,7 @@ PassRefPtr<DocumentLoader> WebFrameLoaderClient::createDocumentLoader(const Reso
     return loader.release();
 }
 
-void WebFrameLoaderClient::setTitle(const String& title, const KURL& url)
+void WebFrameLoaderClient::setTitle(const StringWithDirection& title, const KURL& url)
 {
     WebView* view = getWebView(m_webFrame.get());
     
@@ -1188,7 +1189,8 @@ void WebFrameLoaderClient::setTitle(const String& title, const KURL& url)
         if (!implementations->setTitleFunc)
             return;
             
-        CallHistoryDelegate(implementations->setTitleFunc, view, @selector(webView:updateHistoryTitle:forURL:), (NSString *)title, (NSString *)url);
+        // FIXME: use direction of title.
+        CallHistoryDelegate(implementations->setTitleFunc, view, @selector(webView:updateHistoryTitle:forURL:), (NSString *)title.string(), (NSString *)url);
         return;
     }
     
@@ -1196,7 +1198,7 @@ void WebFrameLoaderClient::setTitle(const String& title, const KURL& url)
     nsURL = [nsURL _webkit_canonicalize];
     if(!nsURL)
         return;
-    NSString *titleNSString = title;
+    NSString *titleNSString = title.string();
        
     [[[WebHistory optionalSharedHistory] itemForURL:nsURL] setTitle:titleNSString];
 }
@@ -1285,7 +1287,7 @@ void WebFrameLoaderClient::transitionToCommittedForNewPage()
         // like the ones that Safari uses for bookmarks it is the only way the DocumentLoader
         // will get the proper title.
         if (DocumentLoader* documentLoader = [dataSource _documentLoader])
-            documentLoader->setTitle([dataSource pageTitle]);
+            documentLoader->setTitle(StringWithDirection([dataSource pageTitle], LTR));
     }
 
     if (HTMLFrameOwnerElement* owner = coreFrame->ownerElement())
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index 9b0c893..e701495 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -36,7 +36,7 @@
 #import "WebInspectorPrivate.h"
 #import "WebInspectorFrontend.h"
 #import "WebLocalizableStringsInternal.h"
-#import "WebNodeHighlight.h"
+#import "WebNodeHighlighter.h"
 #import "WebUIDelegate.h"
 #import "WebViewInternal.h"
 #import <WebCore/InspectorController.h>
@@ -70,25 +70,13 @@ using namespace WebCore;
 - (void)destroyInspectorView:(bool)notifyInspectorController;
 @end
 
-// MARK: -
-
-@interface WebNodeHighlighter : NSObject {
-@private
-    WebView *_inspectedWebView;
-    WebNodeHighlight *_currentHighlight;
-}
-- (id)initWithInspectedWebView:(WebView *)webView;
-- (void)highlightNode:(DOMNode *)node;
-- (void)hideHighlight;
-@end
 
 // MARK: -
 
-
 WebInspectorClient::WebInspectorClient(WebView *webView)
-: m_webView(webView)
-, m_highlighter(AdoptNS, [[WebNodeHighlighter alloc] initWithInspectedWebView:webView])
-, m_frontendPage(0)
+    : m_webView(webView)
+    , m_highlighter(AdoptNS, [[WebNodeHighlighter alloc] initWithInspectedWebView:webView])
+    , m_frontendPage(0)
 {
 }
 
@@ -228,7 +216,7 @@ void WebInspectorFrontendClient::updateWindowTitle() const
 @implementation WebInspectorWindowController
 - (id)init
 {
-    if (![super initWithWindow:nil])
+    if (!(self = [super initWithWindow:nil]))
         return nil;
 
     // Keep preferences separate from the rest of the client, making sure we are using expected preference values.
@@ -272,10 +260,10 @@ void WebInspectorFrontendClient::updateWindowTitle() const
 
 - (id)initWithInspectedWebView:(WebView *)webView
 {
-    if (![self init])
+    if (!(self = [self init]))
         return nil;
 
-    // Don't retain to avoid a circular reference
+    // Don't retain to avoid a circular reference.
     _inspectedWebView = webView;
     return self;
 }
@@ -482,19 +470,6 @@ void WebInspectorFrontendClient::updateWindowTitle() const
 }
 
 // MARK: -
-// MARK: WebNodeHighlight delegate
-
-- (void)didAttachWebNodeHighlight:(WebNodeHighlight *)highlight
-{
-    [_inspectedWebView setCurrentNodeHighlight:highlight];
-}
-
-- (void)willDetachWebNodeHighlight:(WebNodeHighlight *)highlight
-{
-    [_inspectedWebView setCurrentNodeHighlight:nil];
-}
-
-// MARK: -
 // MARK: UI delegate
 
 - (NSUInteger)webView:(WebView *)sender dragDestinationActionMaskForDraggingInfo:(id <NSDraggingInfo>)draggingInfo
@@ -548,60 +523,3 @@ void WebInspectorFrontendClient::updateWindowTitle() const
 }
 
 @end
-
-
-// MARK: -
-
-@implementation WebNodeHighlighter
-- (id)initWithInspectedWebView:(WebView *)webView
-{
-    // Don't retain to avoid a circular reference
-    _inspectedWebView = webView;
-    return self;
-}
-
-- (void)dealloc
-{
-    ASSERT(!_currentHighlight);
-    [super dealloc];
-}
-
-// MARK: -
-
-- (void)highlightNode:(DOMNode *)node
-{
-    // The scrollview's content view stays around between page navigations, so target it
-    NSView *view = [[[[[_inspectedWebView mainFrame] frameView] documentView] enclosingScrollView] contentView];
-    if (![view window])
-        return; // skip the highlight if we have no window (e.g. hidden tab)
-    
-    if (!_currentHighlight) {
-        _currentHighlight = [[WebNodeHighlight alloc] initWithTargetView:view inspectorController:[_inspectedWebView page]->inspectorController()];
-        [_currentHighlight setDelegate:self];
-        [_currentHighlight attach];
-    } else
-        [[_currentHighlight highlightView] setNeedsDisplay:YES];
-}
-
-- (void)hideHighlight
-{
-    [_currentHighlight detach];
-    [_currentHighlight setDelegate:nil];
-    [_currentHighlight release];
-    _currentHighlight = nil;
-}
-
-// MARK: -
-// MARK: WebNodeHighlight delegate
-
-- (void)didAttachWebNodeHighlight:(WebNodeHighlight *)highlight
-{
-    [_inspectedWebView setCurrentNodeHighlight:highlight];
-}
-
-- (void)willDetachWebNodeHighlight:(WebNodeHighlight *)highlight
-{
-    [_inspectedWebView setCurrentNodeHighlight:nil];
-}
-    
-@end
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
index 29bdb8a..87471f6 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
@@ -29,10 +29,9 @@
 #include <WebCore/CookiesStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
-#include <WebCore/LocalizationStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::LocalizationStrategy, private WebCore::VisitedLinkStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
     
@@ -42,7 +41,6 @@ private:
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
-    virtual WebCore::LocalizationStrategy* createLocalizationStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
 
     // WebCore::CookiesStrategy
@@ -52,125 +50,6 @@ private:
     virtual void refreshPlugins();
     virtual void getPluginInfo(const WebCore::Page*, Vector<WebCore::PluginInfo>&);
 
-    // WebCore::LocalizationStrategy    
-    virtual WTF::String inputElementAltText();
-    virtual WTF::String resetButtonDefaultLabel();
-    virtual WTF::String searchableIndexIntroduction();
-    virtual WTF::String submitButtonDefaultLabel();
-    virtual WTF::String fileButtonChooseFileLabel();
-    virtual WTF::String fileButtonNoFileSelectedLabel();
-    virtual WTF::String copyImageUnknownFileLabel();
-    virtual WTF::String defaultDetailsSummaryText();
-#if ENABLE(CONTEXT_MENUS)
-    virtual WTF::String contextMenuItemTagOpenLinkInNewWindow();
-    virtual WTF::String contextMenuItemTagDownloadLinkToDisk();
-    virtual WTF::String contextMenuItemTagCopyLinkToClipboard();
-    virtual WTF::String contextMenuItemTagOpenImageInNewWindow();
-    virtual WTF::String contextMenuItemTagDownloadImageToDisk();
-    virtual WTF::String contextMenuItemTagCopyImageToClipboard();
-    virtual WTF::String contextMenuItemTagOpenFrameInNewWindow();
-    virtual WTF::String contextMenuItemTagCopy();
-    virtual WTF::String contextMenuItemTagGoBack();
-    virtual WTF::String contextMenuItemTagGoForward();
-    virtual WTF::String contextMenuItemTagStop();
-    virtual WTF::String contextMenuItemTagReload();
-    virtual WTF::String contextMenuItemTagCut();
-    virtual WTF::String contextMenuItemTagPaste();
-    virtual WTF::String contextMenuItemTagNoGuessesFound();
-    virtual WTF::String contextMenuItemTagIgnoreSpelling();
-    virtual WTF::String contextMenuItemTagLearnSpelling();
-    virtual WTF::String contextMenuItemTagSearchWeb();
-    virtual WTF::String contextMenuItemTagLookUpInDictionary(const WTF::String& selectedString);
-    virtual WTF::String contextMenuItemTagOpenLink();
-    virtual WTF::String contextMenuItemTagIgnoreGrammar();
-    virtual WTF::String contextMenuItemTagSpellingMenu();
-    virtual WTF::String contextMenuItemTagShowSpellingPanel(bool show);
-    virtual WTF::String contextMenuItemTagCheckSpelling();
-    virtual WTF::String contextMenuItemTagCheckSpellingWhileTyping();
-    virtual WTF::String contextMenuItemTagCheckGrammarWithSpelling();
-    virtual WTF::String contextMenuItemTagFontMenu();
-    virtual WTF::String contextMenuItemTagBold();
-    virtual WTF::String contextMenuItemTagItalic();
-    virtual WTF::String contextMenuItemTagUnderline();
-    virtual WTF::String contextMenuItemTagOutline();
-    virtual WTF::String contextMenuItemTagWritingDirectionMenu();
-    virtual WTF::String contextMenuItemTagTextDirectionMenu();
-    virtual WTF::String contextMenuItemTagDefaultDirection();
-    virtual WTF::String contextMenuItemTagLeftToRight();
-    virtual WTF::String contextMenuItemTagRightToLeft();
-    virtual WTF::String contextMenuItemTagSearchInSpotlight();
-    virtual WTF::String contextMenuItemTagShowFonts();
-    virtual WTF::String contextMenuItemTagStyles();
-    virtual WTF::String contextMenuItemTagShowColors();
-    virtual WTF::String contextMenuItemTagSpeechMenu();
-    virtual WTF::String contextMenuItemTagStartSpeaking();
-    virtual WTF::String contextMenuItemTagStopSpeaking();
-    virtual WTF::String contextMenuItemTagCorrectSpellingAutomatically();
-    virtual WTF::String contextMenuItemTagSubstitutionsMenu();
-    virtual WTF::String contextMenuItemTagShowSubstitutions(bool show);
-    virtual WTF::String contextMenuItemTagSmartCopyPaste();
-    virtual WTF::String contextMenuItemTagSmartQuotes();
-    virtual WTF::String contextMenuItemTagSmartDashes();
-    virtual WTF::String contextMenuItemTagSmartLinks();
-    virtual WTF::String contextMenuItemTagTextReplacement();
-    virtual WTF::String contextMenuItemTagTransformationsMenu();
-    virtual WTF::String contextMenuItemTagMakeUpperCase();
-    virtual WTF::String contextMenuItemTagMakeLowerCase();
-    virtual WTF::String contextMenuItemTagCapitalize();
-    virtual WTF::String contextMenuItemTagChangeBack(const WTF::String& replacedString);
-    virtual WTF::String contextMenuItemTagInspectElement();
-    virtual WTF::String contextMenuItemTagOpenVideoInNewWindow();
-    virtual WTF::String contextMenuItemTagOpenAudioInNewWindow();
-    virtual WTF::String contextMenuItemTagCopyVideoLinkToClipboard();
-    virtual WTF::String contextMenuItemTagCopyAudioLinkToClipboard();
-    virtual WTF::String contextMenuItemTagToggleMediaControls();
-    virtual WTF::String contextMenuItemTagToggleMediaLoop();
-    virtual WTF::String contextMenuItemTagEnterVideoFullscreen();
-    virtual WTF::String contextMenuItemTagMediaPlay();
-    virtual WTF::String contextMenuItemTagMediaPause();
-    virtual WTF::String contextMenuItemTagMediaMute();
-#endif // ENABLE(CONTEXT_MENUS)
-    virtual WTF::String searchMenuNoRecentSearchesText();
-    virtual WTF::String searchMenuRecentSearchesText();
-    virtual WTF::String searchMenuClearRecentSearchesText();
-    virtual WTF::String AXWebAreaText();
-    virtual WTF::String AXLinkText();
-    virtual WTF::String AXListMarkerText();
-    virtual WTF::String AXImageMapText();
-    virtual WTF::String AXHeadingText();
-    virtual WTF::String AXDefinitionListTermText();
-    virtual WTF::String AXDefinitionListDefinitionText();
-    virtual WTF::String AXARIAContentGroupText(const WTF::String& ariaType);
-    virtual WTF::String AXButtonActionVerb();
-    virtual WTF::String AXRadioButtonActionVerb();
-    virtual WTF::String AXTextFieldActionVerb();
-    virtual WTF::String AXCheckedCheckBoxActionVerb();
-    virtual WTF::String AXUncheckedCheckBoxActionVerb();
-    virtual WTF::String AXMenuListActionVerb();
-    virtual WTF::String AXMenuListPopupActionVerb();
-    virtual WTF::String AXLinkActionVerb();
-    virtual WTF::String missingPluginText();
-    virtual WTF::String crashedPluginText();
-    virtual WTF::String multipleFileUploadText(unsigned numberOfFiles);
-    virtual WTF::String unknownFileSizeText();
-    virtual WTF::String keygenMenuItem512();
-    virtual WTF::String keygenMenuItem1024();
-    virtual WTF::String keygenMenuItem2048();
-    virtual WTF::String keygenKeychainItemName(const WTF::String& host);
-    virtual WTF::String imageTitle(const WTF::String& filename, const WebCore::IntSize& size);
-    virtual WTF::String mediaElementLoadingStateText();
-    virtual WTF::String mediaElementLiveBroadcastStateText();
-    virtual WTF::String localizedMediaControlElementString(const WTF::String&);
-    virtual WTF::String localizedMediaControlElementHelpText(const WTF::String&);
-    virtual WTF::String localizedMediaTimeDescription(float);
-    virtual WTF::String validationMessageValueMissingText();
-    virtual WTF::String validationMessageTypeMismatchText();
-    virtual WTF::String validationMessagePatternMismatchText();
-    virtual WTF::String validationMessageTooLongText();
-    virtual WTF::String validationMessageRangeUnderflowText();
-    virtual WTF::String validationMessageRangeOverflowText();
-    virtual WTF::String validationMessageStepMismatchText();
-
     // WebCore::VisitedLinkStrategy
     virtual bool isLinkVisited(WebCore::Page*, WebCore::LinkHash);
     virtual void addVisitedLink(WebCore::Page*, WebCore::LinkHash);
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
index 59ba436..f8e1a7a 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
@@ -25,14 +25,11 @@
 
 #import "WebPlatformStrategies.h"
 
-#import "WebLocalizableStringsInternal.h"
 #import "WebPluginDatabase.h"
 #import "WebPluginPackage.h"
 #import <WebCore/BlockExceptions.h>
-#import <WebCore/IntSize.h>
 #import <WebCore/Page.h>
 #import <WebCore/PageGroup.h>
-#import <wtf/StdLibExtras.h>
 
 using namespace WebCore;
 
@@ -56,11 +53,6 @@ PluginStrategy* WebPlatformStrategies::createPluginStrategy()
     return this;
 }
 
-LocalizationStrategy* WebPlatformStrategies::createLocalizationStrategy()
-{
-    return this;
-}
-
 VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
 {
     return this;
@@ -89,775 +81,6 @@ void WebPlatformStrategies::getPluginInfo(const WebCore::Page*, Vector<WebCore::
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
-// LocalizationStrategy    
-
-String WebPlatformStrategies::inputElementAltText()
-{
-    return UI_STRING_KEY_INTERNAL("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
-}
-
-String WebPlatformStrategies::resetButtonDefaultLabel()
-{
-    return UI_STRING_INTERNAL("Reset", "default label for Reset buttons in forms on web pages");
-}
-
-String WebPlatformStrategies::searchableIndexIntroduction()
-{
-    return UI_STRING_INTERNAL("This is a searchable index. Enter search keywords: ",
-        "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
-}
-
-String WebPlatformStrategies::submitButtonDefaultLabel()
-{
-    return UI_STRING_INTERNAL("Submit", "default label for Submit buttons in forms on web pages");
-}
-
-String WebPlatformStrategies::defaultDetailsSummaryText()
-{
-    return UI_STRING_INTERNAL("Details", "text to display in <details> tag when it has no <summary> child");
-}
-
-String WebPlatformStrategies::fileButtonChooseFileLabel()
-{
-    return UI_STRING_INTERNAL("Choose File", "title for file button used in HTML forms");
-}
-
-String WebPlatformStrategies::fileButtonNoFileSelectedLabel()
-{
-    return UI_STRING_INTERNAL("no file selected", "text to display in file button used in HTML forms when no file is selected");
-}
-
-String WebPlatformStrategies::copyImageUnknownFileLabel()
-{
-    return UI_STRING_INTERNAL("unknown", "Unknown filename");
-}
-
-#if ENABLE(CONTEXT_MENUS)
-
-String WebPlatformStrategies::contextMenuItemTagOpenLinkInNewWindow()
-{
-    return UI_STRING_INTERNAL("Open Link in New Window", "Open in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDownloadLinkToDisk()
-{
-    return UI_STRING_INTERNAL("Download Linked File", "Download Linked File context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyLinkToClipboard()
-{
-    return UI_STRING_INTERNAL("Copy Link", "Copy Link context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenImageInNewWindow()
-{
-    return UI_STRING_INTERNAL("Open Image in New Window", "Open Image in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDownloadImageToDisk()
-{
-    return UI_STRING_INTERNAL("Download Image", "Download Image context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyImageToClipboard()
-{
-    return UI_STRING_INTERNAL("Copy Image", "Copy Image context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenVideoInNewWindow()
-{
-    return UI_STRING_INTERNAL("Open Video in New Window", "Open Video in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenAudioInNewWindow()
-{
-    return UI_STRING_INTERNAL("Open Audio in New Window", "Open Audio in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyVideoLinkToClipboard()
-{
-    return UI_STRING_INTERNAL("Copy Video Address", "Copy Video Address Location context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyAudioLinkToClipboard()
-{
-    return UI_STRING_INTERNAL("Copy Audio Address", "Copy Audio Address Location context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagToggleMediaControls()
-{
-    return UI_STRING_INTERNAL("Controls", "Media Controls context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagToggleMediaLoop()
-{
-    return UI_STRING_INTERNAL("Loop", "Media Loop context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagEnterVideoFullscreen()
-{
-    return UI_STRING_INTERNAL("Enter Fullscreen", "Video Enter Fullscreen context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaPlay()
-{
-    return UI_STRING_INTERNAL("Play", "Media Play context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaPause()
-{
-    return UI_STRING_INTERNAL("Pause", "Media Pause context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaMute()
-{
-    return UI_STRING_INTERNAL("Mute", "Media Mute context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenFrameInNewWindow()
-{
-    return UI_STRING_INTERNAL("Open Frame in New Window", "Open Frame in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopy()
-{
-    return UI_STRING_INTERNAL("Copy", "Copy context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagGoBack()
-{
-    return UI_STRING_INTERNAL("Back", "Back context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagGoForward()
-{
-    return UI_STRING_INTERNAL("Forward", "Forward context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStop()
-{
-    return UI_STRING_INTERNAL("Stop", "Stop context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagReload()
-{
-    return UI_STRING_INTERNAL("Reload", "Reload context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCut()
-{
-    return UI_STRING_INTERNAL("Cut", "Cut context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagPaste()
-{
-    return UI_STRING_INTERNAL("Paste", "Paste context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagNoGuessesFound()
-{
-    return UI_STRING_INTERNAL("No Guesses Found", "No Guesses Found context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagIgnoreSpelling()
-{
-    return UI_STRING_INTERNAL("Ignore Spelling", "Ignore Spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLearnSpelling()
-{
-    return UI_STRING_INTERNAL("Learn Spelling", "Learn Spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSearchWeb()
-{
-    return UI_STRING_INTERNAL("Search in Google", "Search in Google context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary(const String& selectedString)
-{
-#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
-    return UI_STRING_INTERNAL("Look Up in Dictionary", "Look Up in Dictionary context menu item");
-#else
-    return [NSString stringWithFormat:UI_STRING_INTERNAL("Look Up “%@”", "Look Up context menu item with selected word"), (NSString *)selectedString];
-#endif
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenLink()
-{
-    return UI_STRING_INTERNAL("Open Link", "Open Link context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagIgnoreGrammar()
-{
-    return UI_STRING_INTERNAL("Ignore Grammar", "Ignore Grammar context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSpellingMenu()
-{
-#ifndef BUILDING_ON_TIGER
-    return UI_STRING_INTERNAL("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
-#else
-    return UI_STRING_INTERNAL("Spelling", "Spelling context sub-menu item");
-#endif
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowSpellingPanel(bool show)
-{
-#ifndef BUILDING_ON_TIGER
-    if (show)
-        return UI_STRING_INTERNAL("Show Spelling and Grammar", "menu item title");
-    return UI_STRING_INTERNAL("Hide Spelling and Grammar", "menu item title");
-#else
-    return UI_STRING_INTERNAL("Spelling...", "menu item title");
-#endif
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckSpelling()
-{
-#ifndef BUILDING_ON_TIGER
-    return UI_STRING_INTERNAL("Check Document Now", "Check spelling context menu item");
-#else
-    return UI_STRING_INTERNAL("Check Spelling", "Check spelling context menu item");
-#endif
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckSpellingWhileTyping()
-{
-#ifndef BUILDING_ON_TIGER
-    return UI_STRING_INTERNAL("Check Spelling While Typing", "Check spelling while typing context menu item");
-#else
-    return UI_STRING_INTERNAL("Check Spelling as You Type", "Check spelling while typing context menu item");
-#endif
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckGrammarWithSpelling()
-{
-    return UI_STRING_INTERNAL("Check Grammar With Spelling", "Check grammar with spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagFontMenu()
-{
-    return UI_STRING_INTERNAL("Font", "Font context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagBold()
-{
-    return UI_STRING_INTERNAL("Bold", "Bold context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagItalic()
-{
-    return UI_STRING_INTERNAL("Italic", "Italic context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagUnderline()
-{
-    return UI_STRING_INTERNAL("Underline", "Underline context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOutline()
-{
-    return UI_STRING_INTERNAL("Outline", "Outline context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagWritingDirectionMenu()
-{
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    return UI_STRING_INTERNAL("Paragraph Direction", "Paragraph direction context sub-menu item");
-#else
-    return UI_STRING_INTERNAL("Writing Direction", "Writing direction context sub-menu item");
-#endif
-}
-
-String WebPlatformStrategies::contextMenuItemTagTextDirectionMenu()
-{
-    return UI_STRING_INTERNAL("Selection Direction", "Selection direction context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDefaultDirection()
-{
-    return UI_STRING_INTERNAL("Default", "Default writing direction context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLeftToRight()
-{
-    return UI_STRING_INTERNAL("Left to Right", "Left to Right context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagRightToLeft()
-{
-    return UI_STRING_INTERNAL("Right to Left", "Right to Left context menu item");
-}
-
-#if PLATFORM(MAC)
-
-String WebPlatformStrategies::contextMenuItemTagSearchInSpotlight()
-{
-    return UI_STRING_INTERNAL("Search in Spotlight", "Search in Spotlight context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowFonts()
-{
-    return UI_STRING_INTERNAL("Show Fonts", "Show fonts context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStyles()
-{
-    return UI_STRING_INTERNAL("Styles...", "Styles context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowColors()
-{
-    return UI_STRING_INTERNAL("Show Colors", "Show colors context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSpeechMenu()
-{
-    return UI_STRING_INTERNAL("Speech", "Speech context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStartSpeaking()
-{
-    return UI_STRING_INTERNAL("Start Speaking", "Start speaking context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStopSpeaking()
-{
-    return UI_STRING_INTERNAL("Stop Speaking", "Stop speaking context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCorrectSpellingAutomatically()
-{
-    return UI_STRING_INTERNAL("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSubstitutionsMenu()
-{
-    return UI_STRING_INTERNAL("Substitutions", "Substitutions context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowSubstitutions(bool show)
-{
-    if (show) 
-        return UI_STRING_INTERNAL("Show Substitutions", "menu item title");
-    return UI_STRING_INTERNAL("Hide Substitutions", "menu item title");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSmartCopyPaste()
-{
-    return UI_STRING_INTERNAL("Smart Copy/Paste", "Smart Copy/Paste context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSmartQuotes()
-{
-    return UI_STRING_INTERNAL("Smart Quotes", "Smart Quotes context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSmartDashes()
-{
-    return UI_STRING_INTERNAL("Smart Dashes", "Smart Dashes context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSmartLinks()
-{
-    return UI_STRING_INTERNAL("Smart Links", "Smart Links context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagTextReplacement()
-{
-    return UI_STRING_INTERNAL("Text Replacement", "Text Replacement context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagTransformationsMenu()
-{
-    return UI_STRING_INTERNAL("Transformations", "Transformations context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMakeUpperCase()
-{
-    return UI_STRING_INTERNAL("Make Upper Case", "Make Upper Case context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMakeLowerCase()
-{
-    return UI_STRING_INTERNAL("Make Lower Case", "Make Lower Case context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCapitalize()
-{
-    return UI_STRING_INTERNAL("Capitalize", "Capitalize context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagChangeBack(const String& replacedString)
-{
-    static NSString *formatString = nil;
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    static bool lookedUpString = false;
-    if (!lookedUpString) {
-        formatString = [[[NSBundle bundleForClass:[NSSpellChecker class]] localizedStringForKey:@"Change Back to \\U201C%@\\U201D" value:nil table:@"MenuCommands"] retain];
-        lookedUpString = true;
-    }
-#endif
-    if (!formatString)
-        return replacedString;
-    return [NSString stringWithFormat:formatString, (NSString *)replacedString];
-}
-
-#endif
-
-String WebPlatformStrategies::contextMenuItemTagInspectElement()
-{
-    return UI_STRING_INTERNAL("Inspect Element", "Inspect Element context menu item");
-}
-
-#endif // ENABLE(CONTEXT_MENUS)
-
-String WebPlatformStrategies::searchMenuNoRecentSearchesText()
-{
-    return UI_STRING_INTERNAL("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
-}
-
-String WebPlatformStrategies::searchMenuRecentSearchesText()
-{
-    return UI_STRING_INTERNAL("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
-}
-
-String WebPlatformStrategies::searchMenuClearRecentSearchesText()
-{
-    return UI_STRING_INTERNAL("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
-}
-
-String WebPlatformStrategies::AXWebAreaText()
-{
-    return UI_STRING_INTERNAL("HTML content", "accessibility role description for web area");
-}
-
-String WebPlatformStrategies::AXLinkText()
-{
-    return UI_STRING_INTERNAL("link", "accessibility role description for link");
-}
-
-String WebPlatformStrategies::AXListMarkerText()
-{
-    return UI_STRING_INTERNAL("list marker", "accessibility role description for list marker");
-}
-
-String WebPlatformStrategies::AXImageMapText()
-{
-    return UI_STRING_INTERNAL("image map", "accessibility role description for image map");
-}
-
-String WebPlatformStrategies::AXHeadingText()
-{
-    return UI_STRING_INTERNAL("heading", "accessibility role description for headings");
-}
-
-String WebPlatformStrategies::AXDefinitionListTermText()
-{
-    return UI_STRING_INTERNAL("term", "term word of a definition");
-}
-
-String WebPlatformStrategies::AXDefinitionListDefinitionText()
-{
-    return UI_STRING_INTERNAL("definition", "definition phrase");
-}
-
-String WebPlatformStrategies::AXARIAContentGroupText(const String& ariaType)
-{
-    if (ariaType == "ARIAApplicationAlert")
-        return UI_STRING_INTERNAL("alert", "An ARIA accessibility group that acts as an alert.");
-    if (ariaType == "ARIAApplicationAlertDialog")
-        return UI_STRING_INTERNAL("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
-    if (ariaType == "ARIAApplicationDialog")
-        return UI_STRING_INTERNAL("dialog", "An ARIA accessibility group that acts as an dialog.");
-    if (ariaType == "ARIAApplicationLog")
-        return UI_STRING_INTERNAL("log", "An ARIA accessibility group that acts as a console log.");
-    if (ariaType == "ARIAApplicationMarquee")
-        return UI_STRING_INTERNAL("marquee", "An ARIA accessibility group that acts as a marquee.");    
-    if (ariaType == "ARIAApplicationStatus")
-        return UI_STRING_INTERNAL("application status", "An ARIA accessibility group that acts as a status update.");    
-    if (ariaType == "ARIAApplicationTimer")
-        return UI_STRING_INTERNAL("timer", "An ARIA accessibility group that acts as an updating timer.");    
-    if (ariaType == "ARIADocument")
-        return UI_STRING_INTERNAL("document", "An ARIA accessibility group that acts as a document.");    
-    if (ariaType == "ARIADocumentArticle")
-        return UI_STRING_INTERNAL("article", "An ARIA accessibility group that acts as an article.");    
-    if (ariaType == "ARIADocumentNote")
-        return UI_STRING_INTERNAL("note", "An ARIA accessibility group that acts as a note in a document.");    
-    if (ariaType == "ARIADocumentRegion")
-        return UI_STRING_INTERNAL("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
-    if (ariaType == "ARIALandmarkApplication")
-        return UI_STRING_INTERNAL("application", "An ARIA accessibility group that acts as an application.");    
-    if (ariaType == "ARIALandmarkBanner")
-        return UI_STRING_INTERNAL("banner", "An ARIA accessibility group that acts as a banner.");    
-    if (ariaType == "ARIALandmarkComplementary")
-        return UI_STRING_INTERNAL("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
-    if (ariaType == "ARIALandmarkContentInfo")
-        return UI_STRING_INTERNAL("content", "An ARIA accessibility group that contains content.");    
-    if (ariaType == "ARIALandmarkMain")
-        return UI_STRING_INTERNAL("main", "An ARIA accessibility group that is the main portion of the website.");    
-    if (ariaType == "ARIALandmarkNavigation")
-        return UI_STRING_INTERNAL("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
-    if (ariaType == "ARIALandmarkSearch")
-        return UI_STRING_INTERNAL("search", "An ARIA accessibility group that contains a search feature of a website.");    
-    if (ariaType == "ARIAUserInterfaceTooltip")
-        return UI_STRING_INTERNAL("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
-    if (ariaType == "ARIATabPanel")
-        return UI_STRING_INTERNAL("tab panel", "An ARIA accessibility group that contains the content of a tab.");
-    if (ariaType == "ARIADocumentMath")
-        return UI_STRING_INTERNAL("math", "An ARIA accessibility group that contains mathematical symbols.");
-    return String();
-}
-
-String WebPlatformStrategies::AXButtonActionVerb()
-{
-    return UI_STRING_INTERNAL("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXRadioButtonActionVerb() 
-{
-    return UI_STRING_INTERNAL("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXTextFieldActionVerb()
-{
-    return UI_STRING_INTERNAL("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXCheckedCheckBoxActionVerb()
-{
-    return UI_STRING_INTERNAL("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXUncheckedCheckBoxActionVerb()
-{
-    return UI_STRING_INTERNAL("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXMenuListActionVerb()
-{
-    return String();
-}
-
-String WebPlatformStrategies::AXMenuListPopupActionVerb()
-{
-    return String();
-}
-
-String WebPlatformStrategies::AXLinkActionVerb()
-{
-    return UI_STRING_INTERNAL("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::missingPluginText()
-{
-    return UI_STRING_INTERNAL("Missing Plug-in", "Label text to be used when a plugin is missing");
-}
-
-String WebPlatformStrategies::crashedPluginText()
-{
-    return UI_STRING_INTERNAL("Plug-in Failure", "Label text to be used if plugin host process has crashed");
-}
-
-String WebPlatformStrategies::multipleFileUploadText(unsigned numberOfFiles)
-{
-    return [NSString stringWithFormat:UI_STRING_INTERNAL("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles];
-}
-
-String WebPlatformStrategies::unknownFileSizeText()
-{
-    return UI_STRING_INTERNAL("Unknown", "Unknown filesize FTP directory listing item");
-}
-
-String WebPlatformStrategies::keygenMenuItem512()
-{
-    return UI_STRING_INTERNAL("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String WebPlatformStrategies::keygenMenuItem1024()
-{
-    return UI_STRING_INTERNAL("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String WebPlatformStrategies::keygenMenuItem2048()
-{
-    return UI_STRING_INTERNAL("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String WebPlatformStrategies::keygenKeychainItemName(const WTF::String& host)
-{
-    return [NSString stringWithFormat:UI_STRING_INTERNAL("Key from %@", "Name of keychain key generated by the KEYGEN tag"), (NSString *)host];
-}
-
-String WebPlatformStrategies::imageTitle(const String& filename, const IntSize& size)
-{
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    NSString *widthString = [NSNumberFormatter localizedStringFromNumber:[NSNumber numberWithInt:size.width()] numberStyle:NSNumberFormatterDecimalStyle];
-    NSString *heightString = [NSNumberFormatter localizedStringFromNumber:[NSNumber numberWithInt:size.height()] numberStyle:NSNumberFormatterDecimalStyle];
-    return [NSString localizedStringWithFormat:UI_STRING_INTERNAL("%@ %@×%@ pixels", "window title for a standalone image (uses multiplication symbol, not x)"), (NSString *)filename, widthString, heightString];
-#else
-    return [NSString stringWithFormat:UI_STRING_INTERNAL("%@ %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), (NSString *)filename, size.width(), size.height()];
-#endif
-}
-
-String WebPlatformStrategies::mediaElementLoadingStateText()
-{
-    return UI_STRING_INTERNAL("Loading...", "Media controller status message when the media is loading");
-}
-
-String WebPlatformStrategies::mediaElementLiveBroadcastStateText()
-{
-    return UI_STRING_INTERNAL("Live Broadcast", "Media controller status message when watching a live broadcast");
-}
-
-String WebPlatformStrategies::localizedMediaControlElementString(const String& name)
-{
-    if (name == "AudioElement")
-        return UI_STRING_INTERNAL("audio element controller", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return UI_STRING_INTERNAL("video element controller", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return UI_STRING_INTERNAL("mute", "accessibility role description for mute button");
-    if (name == "UnMuteButton")
-        return UI_STRING_INTERNAL("unmute", "accessibility role description for turn mute off button");
-    if (name == "PlayButton")
-        return UI_STRING_INTERNAL("play", "accessibility role description for play button");
-    if (name == "PauseButton")
-        return UI_STRING_INTERNAL("pause", "accessibility role description for pause button");
-    if (name == "Slider")
-        return UI_STRING_INTERNAL("movie time", "accessibility role description for timeline slider");
-    if (name == "SliderThumb")
-        return UI_STRING_INTERNAL("timeline slider thumb", "accessibility role description for timeline thumb");
-    if (name == "RewindButton")
-        return UI_STRING_INTERNAL("back 30 seconds", "accessibility role description for seek back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return UI_STRING_INTERNAL("return to realtime", "accessibility role description for return to real time button");
-    if (name == "CurrentTimeDisplay")
-        return UI_STRING_INTERNAL("elapsed time", "accessibility role description for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return UI_STRING_INTERNAL("remaining time", "accessibility role description for time remaining display");
-    if (name == "StatusDisplay")
-        return UI_STRING_INTERNAL("status", "accessibility role description for movie status");
-    if (name == "FullscreenButton")
-        return UI_STRING_INTERNAL("fullscreen", "accessibility role description for enter fullscreen button");
-    if (name == "SeekForwardButton")
-        return UI_STRING_INTERNAL("fast forward", "accessibility role description for fast forward button");
-    if (name == "SeekBackButton")
-        return UI_STRING_INTERNAL("fast reverse", "accessibility role description for fast reverse button");
-    if (name == "ShowClosedCaptionsButton")
-        return UI_STRING_INTERNAL("show closed captions", "accessibility role description for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return UI_STRING_INTERNAL("hide closed captions", "accessibility role description for hide closed captions button");
-
-    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
-    if (name == "ControlsPanel")
-        return String();
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String WebPlatformStrategies::localizedMediaControlElementHelpText(const String& name)
-{
-    if (name == "AudioElement")
-        return UI_STRING_INTERNAL("audio element playback controls and status display", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return UI_STRING_INTERNAL("video element playback controls and status display", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return UI_STRING_INTERNAL("mute audio tracks", "accessibility help text for mute button");
-    if (name == "UnMuteButton")
-        return UI_STRING_INTERNAL("unmute audio tracks", "accessibility help text for un mute button");
-    if (name == "PlayButton")
-        return UI_STRING_INTERNAL("begin playback", "accessibility help text for play button");
-    if (name == "PauseButton")
-        return UI_STRING_INTERNAL("pause playback", "accessibility help text for pause button");
-    if (name == "Slider")
-        return UI_STRING_INTERNAL("movie time scrubber", "accessibility help text for timeline slider");
-    if (name == "SliderThumb")
-        return UI_STRING_INTERNAL("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
-    if (name == "RewindButton")
-        return UI_STRING_INTERNAL("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return UI_STRING_INTERNAL("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
-    if (name == "CurrentTimeDisplay")
-        return UI_STRING_INTERNAL("current movie time in seconds", "accessibility help text for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return UI_STRING_INTERNAL("number of seconds of movie remaining", "accessibility help text for remaining time display");
-    if (name == "StatusDisplay")
-        return UI_STRING_INTERNAL("current movie status", "accessibility help text for movie status display");
-    if (name == "SeekBackButton")
-        return UI_STRING_INTERNAL("seek quickly back", "accessibility help text for fast rewind button");
-    if (name == "SeekForwardButton")
-        return UI_STRING_INTERNAL("seek quickly forward", "accessibility help text for fast forward button");
-    if (name == "FullscreenButton")
-        return UI_STRING_INTERNAL("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
-    if (name == "ShowClosedCaptionsButton")
-        return UI_STRING_INTERNAL("start displaying closed captions", "accessibility help text for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return UI_STRING_INTERNAL("stop displaying closed captions", "accessibility help text for hide closed captions button");
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String WebPlatformStrategies::localizedMediaTimeDescription(float time)
-{
-    if (!isfinite(time))
-        return UI_STRING_INTERNAL("indefinite time", "accessibility help text for an indefinite media controller time value");
-
-    int seconds = (int)fabsf(time); 
-    int days = seconds / (60 * 60 * 24);
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-
-    if (days)
-        return [NSString stringWithFormat:UI_STRING_INTERNAL("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds];
-    else if (hours)
-        return [NSString stringWithFormat:UI_STRING_INTERNAL("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds];
-    else if (minutes)
-        return [NSString stringWithFormat:UI_STRING_INTERNAL("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds];
-
-    return [NSString stringWithFormat:UI_STRING_INTERNAL("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds];
-}
-
-String WebPlatformStrategies::validationMessageValueMissingText()
-{
-    return UI_STRING_INTERNAL("value missing", "Validation message for required form control elements that have no value");
-}
-
-String WebPlatformStrategies::validationMessageTypeMismatchText()
-{
-    return UI_STRING_INTERNAL("type mismatch", "Validation message for input form controls with a value not matching type");
-}
-
-String WebPlatformStrategies::validationMessagePatternMismatchText()
-{
-    return UI_STRING_INTERNAL("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
-}
-
-String WebPlatformStrategies::validationMessageTooLongText()
-{
-    return UI_STRING_INTERNAL("too long", "Validation message for form control elements with a value longer than maximum allowed length");
-}
-
-String WebPlatformStrategies::validationMessageRangeUnderflowText()
-{
-    return UI_STRING_INTERNAL("range underflow", "Validation message for input form controls with value lower than allowed minimum");
-}
-
-String WebPlatformStrategies::validationMessageRangeOverflowText()
-{
-    return UI_STRING_INTERNAL("range overflow", "Validation message for input form controls with value higher than allowed maximum");
-}
-
-String WebPlatformStrategies::validationMessageStepMismatchText()
-{
-    return UI_STRING_INTERNAL("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
-}
-
-// VisitedLinkStrategy
 bool WebPlatformStrategies::isLinkVisited(Page* page, LinkHash hash)
 {
     return page->group().isLinkVisited(hash);
diff --git a/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm b/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
index 1b212a7..de2a1f4 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
@@ -68,7 +68,6 @@ void InitWebCoreSystemInterface(void)
     INIT(GetWheelEventDeltas);
     INIT(HitTestMediaUIPart);
     INIT(InitializeMaximumHTTPConnectionCountPerHost);
-    INIT(IsLatchingWheelEvent);
     INIT(MeasureMediaUIPart);
     INIT(MediaControllerThemeAvailable);
     INIT(PopupMenu);
@@ -77,7 +76,9 @@ void InitWebCoreSystemInterface(void)
     INIT(SetCONNECTProxyForStream);
     INIT(SetCookieStoragePrivateBrowsingEnabled);
     INIT(SetDragImage);
+    INIT(SetHTTPPipeliningMaximumPriority);
     INIT(SetHTTPPipeliningPriority);
+    INIT(SetHTTPPipeliningMinimumFastLanePriority);
     INIT(SetNSURLConnectionDefersCallbacks);
     INIT(SetNSURLRequestShouldContentSniff);
     INIT(SetPatternBaseCTM);
@@ -119,9 +120,11 @@ void InitWebCoreSystemInterface(void)
 
 #if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
     INIT(GetHyphenationLocationBeforeIndex);
+    INIT(GetNSEventMomentumPhase);
 #endif
 
     INIT(CreateCTLineWithUniCharProvider);
+
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     INIT(IOSurfaceContextCreate);
     INIT(IOSurfaceContextCreateImage);
@@ -155,6 +158,8 @@ void InitWebCoreSystemInterface(void)
     INIT(WillEndLiveResize);
     INIT(ContentAreaDidShow);
     INIT(ContentAreaDidHide);
+    INIT(DidBeginScrollGesture);
+    INIT(DidEndScrollGesture);
     INIT(ScrollbarPainterUsesOverlayScrollers);
 #endif
 
diff --git a/Source/WebKit/mac/WebInspector/WebNodeHighlighter.h b/Source/WebKit/mac/WebInspector/WebNodeHighlighter.h
new file mode 100644
index 0000000..4fca732
--- /dev/null
+++ b/Source/WebKit/mac/WebInspector/WebNodeHighlighter.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+@class DOMNode;
+@class WebView;
+@class WebNodeHighlight;
+
+@interface WebNodeHighlighter : NSObject {
+@private
+    WebView *_inspectedWebView;
+    WebNodeHighlight *_currentHighlight;
+}
+- (id)initWithInspectedWebView:(WebView *)webView;
+- (void)highlightNode:(DOMNode *)node;
+- (void)hideHighlight;
+@end
diff --git a/Source/WebKit/mac/WebInspector/WebNodeHighlighter.mm b/Source/WebKit/mac/WebInspector/WebNodeHighlighter.mm
new file mode 100644
index 0000000..56bee2e
--- /dev/null
+++ b/Source/WebKit/mac/WebInspector/WebNodeHighlighter.mm
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebNodeHighlighter.h"
+
+#import "DOMNodeInternal.h"
+#import "WebNodeHighlight.h"
+#import "WebViewInternal.h"
+#import <WebCore/Page.h>
+
+@implementation WebNodeHighlighter
+
+- (id)initWithInspectedWebView:(WebView *)webView
+{
+    if (!(self = [super init]))
+        return nil;
+
+    // Don't retain to avoid a circular reference.
+    _inspectedWebView = webView;
+
+    return self;
+}
+
+- (void)dealloc
+{
+    ASSERT(!_currentHighlight);
+    [super dealloc];
+}
+
+// MARK: -
+
+- (void)highlightNode:(DOMNode *)node
+{
+    // The scrollview's content view stays around between page navigations, so target it.
+    NSView *view = [[[[[_inspectedWebView mainFrame] frameView] documentView] enclosingScrollView] contentView];
+    if (![view window])
+        return; // Skip the highlight if we have no window (e.g. hidden tab).
+    
+    if (!_currentHighlight) {
+        _currentHighlight = [[WebNodeHighlight alloc] initWithTargetView:view inspectorController:[_inspectedWebView page]->inspectorController()];
+        [_currentHighlight setDelegate:self];
+        [_currentHighlight attach];
+    } else
+        [[_currentHighlight highlightView] setNeedsDisplay:YES];
+}
+
+- (void)hideHighlight
+{
+    [_currentHighlight detach];
+    [_currentHighlight setDelegate:nil];
+    [_currentHighlight release];
+    _currentHighlight = nil;
+}
+
+// MARK: -
+// MARK: WebNodeHighlight delegate
+
+- (void)didAttachWebNodeHighlight:(WebNodeHighlight *)highlight
+{
+    [_inspectedWebView setCurrentNodeHighlight:highlight];
+}
+
+- (void)willDetachWebNodeHighlight:(WebNodeHighlight *)highlight
+{
+    [_inspectedWebView setCurrentNodeHighlight:nil];
+}
+    
+@end
diff --git a/Source/WebKit/mac/WebView/WebDynamicScrollBarsView.mm b/Source/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
index 9f0dd8d..1b245ec 100644
--- a/Source/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
+++ b/Source/WebKit/mac/WebView/WebDynamicScrollBarsView.mm
@@ -515,7 +515,13 @@ static const unsigned cMaxUpdateScrollbarsPass = 2;
     BOOL isContinuous;
     WKGetWheelEventDeltas(event, &deltaX, &deltaY, &isContinuous);
 
-    BOOL isLatchingEvent = WKIsLatchingWheelEvent(event);
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    NSEventPhase momentumPhase = [event momentumPhase];
+    BOOL isLatchingEvent = momentumPhase & NSEventPhaseBegan || momentumPhase & NSEventPhaseChanged;
+#else
+    int momentumPhase = WKGetNSEventMomentumPhase(event);
+    BOOL isLatchingEvent = momentumPhase == WKEventPhaseBegan || momentumPhase == WKEventPhaseChanged;
+#endif
 
     if (fabsf(deltaY) > fabsf(deltaX)) {
         if (![self allowsVerticalScrolling]) {
diff --git a/Source/WebKit/mac/WebView/WebFrame.mm b/Source/WebKit/mac/WebView/WebFrame.mm
index 584b09e..ab8c34d 100644
--- a/Source/WebKit/mac/WebView/WebFrame.mm
+++ b/Source/WebKit/mac/WebView/WebFrame.mm
@@ -670,30 +670,15 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 
 - (NSRange)_convertToNSRange:(Range *)range
 {
-    if (!range || !range->startContainer())
+    if (!range)
         return NSMakeRange(NSNotFound, 0);
 
-    Element* selectionRoot = _private->coreFrame->selection()->rootEditableElement();
-    Element* scope = selectionRoot ? selectionRoot : _private->coreFrame->document()->documentElement();
-    
-    // Mouse events may cause TSM to attempt to create an NSRange for a portion of the view
-    // that is not inside the current editable region.  These checks ensure we don't produce
-    // potentially invalid data when responding to such requests.
-    if (range->startContainer() != scope && !range->startContainer()->isDescendantOf(scope))
-        return NSMakeRange(NSNotFound, 0);
-    if (range->endContainer() != scope && !range->endContainer()->isDescendantOf(scope))
+    size_t location;
+    size_t length;
+    if (!TextIterator::locationAndLengthFromRange(range, location, length))
         return NSMakeRange(NSNotFound, 0);
-    
-    RefPtr<Range> testRange = Range::create(scope->document(), scope, 0, range->startContainer(), range->startOffset());
-    ASSERT(testRange->startContainer() == scope);
-    int startPosition = TextIterator::rangeLength(testRange.get());
-
-    ExceptionCode ec;
-    testRange->setEnd(range->endContainer(), range->endOffset(), ec);
-    ASSERT(testRange->startContainer() == scope);
-    int endPosition = TextIterator::rangeLength(testRange.get());
 
-    return NSMakeRange(startPosition, endPosition - startPosition);
+    return NSMakeRange(location, length);
 }
 
 - (PassRefPtr<Range>)_convertToDOMRange:(NSRange)nsrange
@@ -820,27 +805,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 
 - (DOMRange *)_characterRangeAtPoint:(NSPoint)point
 {
-    VisiblePosition position = [self _visiblePositionForPoint:point];
-    if (position.isNull())
-        return nil;
-    
-    VisiblePosition previous = position.previous();
-    if (previous.isNotNull()) {
-        DOMRange *previousCharacterRange = kit(makeRange(previous, position).get());
-        NSRect rect = [self _firstRectForDOMRange:previousCharacterRange];
-        if (NSPointInRect(point, rect))
-            return previousCharacterRange;
-    }
-
-    VisiblePosition next = position.next();
-    if (next.isNotNull()) {
-        DOMRange *nextCharacterRange = kit(makeRange(position, next).get());
-        NSRect rect = [self _firstRectForDOMRange:nextCharacterRange];
-        if (NSPointInRect(point, rect))
-            return nextCharacterRange;
-    }
-    
-    return nil;
+    return kit(_private->coreFrame->rangeForPoint(IntPoint(point)).get());
 }
 
 - (DOMCSSStyleDeclaration *)_typingStyle
diff --git a/Source/WebKit/mac/WebView/WebFrameInternal.h b/Source/WebKit/mac/WebView/WebFrameInternal.h
index c13b721..ff382d4 100644
--- a/Source/WebKit/mac/WebView/WebFrameInternal.h
+++ b/Source/WebKit/mac/WebView/WebFrameInternal.h
@@ -142,6 +142,7 @@ WebView *getWebView(WebFrame *webFrame);
 - (NSRange)_convertToNSRange:(WebCore::Range*)range;
 - (DOMRange *)_convertNSRangeToDOMRange:(NSRange)range;
 - (NSRange)_convertDOMRangeToNSRange:(DOMRange *)range;
+- (PassRefPtr<WebCore::Range>)_convertToDOMRange:(NSRange)nsrange;
 
 - (DOMDocumentFragment *)_documentFragmentWithMarkupString:(NSString *)markupString baseURLString:(NSString *)baseURLString;
 - (DOMDocumentFragment *)_documentFragmentWithNodesAsParagraphs:(NSArray *)nodes;
diff --git a/Source/WebKit/mac/WebView/WebFrameView.mm b/Source/WebKit/mac/WebView/WebFrameView.mm
index c42738c..41ac9ed 100644
--- a/Source/WebKit/mac/WebView/WebFrameView.mm
+++ b/Source/WebKit/mac/WebView/WebFrameView.mm
@@ -771,6 +771,13 @@ static inline void addTypesFromClass(NSMutableDictionary *allTypes, Class objCCl
 
 - (void)keyDown:(NSEvent *)event
 {
+    // Implement common browser behaviors for all kinds of content.
+
+    // FIXME: This is not a good time to execute commands for WebHTMLView. We should run these at the time commands sent by key bindings
+    // are executed for consistency.
+    // This doesn't work automatically because most of the keys handled here are translated into moveXXX commands, which are not handled
+    // by Editor when focus is not in editable content.
+
     NSString *characters = [event characters];
     int index, count;
     BOOL callSuper = YES;
diff --git a/Source/WebKit/mac/WebView/WebHTMLRepresentation.mm b/Source/WebKit/mac/WebView/WebHTMLRepresentation.mm
index 03edd5d..1802ca8 100644
--- a/Source/WebKit/mac/WebView/WebHTMLRepresentation.mm
+++ b/Source/WebKit/mac/WebView/WebHTMLRepresentation.mm
@@ -38,7 +38,6 @@
 #import "WebFrameInternal.h"
 #import "WebKitNSStringExtras.h"
 #import "WebKitStatisticsPrivate.h"
-#import "WebNSAttributedStringExtras.h"
 #import "WebNSObjectExtras.h"
 #import "WebTypesInternal.h"
 #import "WebView.h"
@@ -48,6 +47,7 @@
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoader.h>
 #import <WebCore/FrameLoaderClient.h>
+#import <WebCore/HTMLConverter.h>
 #import <WebCore/HTMLFormControlElement.h>
 #import <WebCore/HTMLFormElement.h>
 #import <WebCore/HTMLInputElement.h>
@@ -261,7 +261,7 @@ static NSArray *concatenateArrays(NSArray *first, NSArray *second)
 
 - (NSString *)title
 {
-    return nsStringNilIfEmpty([_private->dataSource _documentLoader]->title());
+    return nsStringNilIfEmpty([_private->dataSource _documentLoader]->title().string());
 }
 
 - (DOMDocument *)DOMDocument
@@ -277,7 +277,7 @@ static NSArray *concatenateArrays(NSArray *first, NSArray *second)
 
 - (NSAttributedString *)attributedStringFrom:(DOMNode *)startNode startOffset:(int)startOffset to:(DOMNode *)endNode endOffset:(int)endOffset
 {
-    return [NSAttributedString _web_attributedStringFromRange:Range::create(core(startNode)->document(), core(startNode), startOffset, core(endNode), endOffset).get()];
+    return [WebHTMLConverter editingAttributedStringFromRange:Range::create(core(startNode)->document(), core(startNode), startOffset, core(endNode), endOffset).get()];
 }
 
 static HTMLFormElement* formElementFromDOMElement(DOMElement *element)
diff --git a/Source/WebKit/mac/WebView/WebHTMLView.mm b/Source/WebKit/mac/WebView/WebHTMLView.mm
index e611e2b..fb1d794 100644
--- a/Source/WebKit/mac/WebView/WebHTMLView.mm
+++ b/Source/WebKit/mac/WebView/WebHTMLView.mm
@@ -53,7 +53,6 @@
 #import "WebKitNSStringExtras.h"
 #import "WebKitVersionChecks.h"
 #import "WebLocalizableStringsInternal.h"
-#import "WebNSAttributedStringExtras.h"
 #import "WebNSEventExtras.h"
 #import "WebNSFileManagerExtras.h"
 #import "WebNSImageExtras.h"
@@ -94,6 +93,7 @@
 #import <WebCore/Frame.h>
 #import <WebCore/FrameLoader.h>
 #import <WebCore/FrameView.h>
+#import <WebCore/HTMLConverter.h>
 #import <WebCore/HTMLNames.h>
 #import <WebCore/HitTestResult.h>
 #import <WebCore/Image.h>
@@ -112,6 +112,7 @@
 #import <WebCore/Text.h>
 #import <WebCore/WebCoreObjCExtras.h>
 #import <WebCore/WebFontCache.h>
+#import <WebCore/WebNSAttributedStringExtras.h>
 #import <WebCore/markup.h>
 #import <WebKit/DOM.h>
 #import <WebKit/DOMExtensions.h>
@@ -431,6 +432,7 @@ static CachedResourceClient* promisedDataClient()
 
 @interface WebHTMLView (WebForwardDeclaration) // FIXME: Put this in a normal category and stop doing the forward declaration trick.
 - (void)_setPrinting:(BOOL)printing minimumPageLogicalWidth:(float)minPageWidth logicalHeight:(float)minPageHeight maximumPageLogicalWidth:(float)maxPageWidth adjustViewSize:(BOOL)adjustViewSize paginateScreenContent:(BOOL)paginateScreenContent;
+- (void)_updateSecureInputState;
 @end
 
 @class NSTextInputContext;
@@ -465,6 +467,7 @@ struct WebHTMLViewInterpretKeyEventsParameters {
     bool eventInterpretationHadSideEffects;
     bool shouldSaveCommands;
     bool consumedByIM;
+    bool executingSavedKeypressCommands;
 };
 
 @interface WebHTMLViewPrivate : NSObject {
@@ -493,6 +496,11 @@ struct WebHTMLViewInterpretKeyEventsParameters {
     // This state is saved each time selection changes, because computing it causes style recalc, which is not always safe to do.
     BOOL exposeInputContext;
 
+    // Track whether the view has set a secure input state.
+    BOOL isInSecureInputState;
+
+    BOOL _forceUpdateSecureInputState;
+
     NSPoint lastScrollPosition;
 #ifndef BUILDING_ON_TIGER
     BOOL inScrollPositionChanged;
@@ -1041,12 +1049,10 @@ static NSURL* uniqueURLWithRelativePart(NSString *relativePart)
         [pasteboard setData:RTFDData forType:NSRTFDPboardType];
     }        
     if ([types containsObject:NSRTFPboardType]) {
-        if (attributedString == nil) {
+        if (!attributedString)
             attributedString = [self selectedAttributedString];
-        }
-        if ([attributedString containsAttachments]) {
-            attributedString = [attributedString _web_attributedStringByStrippingAttachmentCharacters];
-        }
+        if ([attributedString containsAttachments])
+            attributedString = attributedStringByStrippingAttachmentCharacters(attributedString);
         NSData *RTFData = [attributedString RTFFromRange:NSMakeRange(0, [attributedString length]) documentAttributes:nil];
         [pasteboard setData:RTFData forType:NSRTFPboardType];
     }
@@ -1994,6 +2000,11 @@ static void _updateMouseoverTimerCallback(CFRunLoopTimerRef timer, void *info)
     // remove tooltips before clearing _private so removeTrackingRect: will work correctly
     [self removeAllToolTips];
 
+    if (_private->isInSecureInputState) {
+        DisableSecureEventInput();
+        _private->isInSecureInputState = NO;
+    }
+
     [_private clear];
 }
 
@@ -3459,8 +3470,10 @@ static void setMenuTargets(NSMenu* menu)
 
     NSWindow *keyWindow = [notification object];
 
-    if (keyWindow == [self window])
+    if (keyWindow == [self window]) {
         [self addMouseMovedObserver];
+        [self _updateSecureInputState];
+    }
 }
 
 - (void)windowDidResignKey:(NSNotification *)notification
@@ -3475,8 +3488,10 @@ static void setMenuTargets(NSMenu* menu)
     if (formerKeyWindow == [self window])
         [self removeMouseMovedObserver];
 
-    if (formerKeyWindow == [self window] || formerKeyWindow == [[self window] attachedSheet])
+    if (formerKeyWindow == [self window] || formerKeyWindow == [[self window] attachedSheet]) {
+        [self _updateSecureInputState];
         [_private->completionController endRevertingChange:NO moveLeft:NO];
+    }
 }
 
 - (void)windowWillClose:(NSNotification *)notification
@@ -3809,6 +3824,10 @@ static BOOL isInPasswordField(Frame* coreFrame)
         [NSApp updateWindows];
     }
 
+    _private->_forceUpdateSecureInputState = YES;
+    [self _updateSecureInputState];
+    _private->_forceUpdateSecureInputState = NO;
+
     frame->editor()->setStartNewKillRingSequence(true);
 
     Page* page = frame->page();
@@ -3834,6 +3853,10 @@ static BOOL isInPasswordField(Frame* coreFrame)
 {
     BOOL resign = [super resignFirstResponder];
     if (resign) {
+        if (_private->isInSecureInputState) {
+            DisableSecureEventInput();
+            _private->isInSecureInputState = NO;
+        }
         [_private->completionController endRevertingChange:NO moveLeft:NO];
         Frame* coreFrame = core([self _frame]);
         if (!coreFrame)
@@ -4163,15 +4186,12 @@ static BOOL isInPasswordField(Frame* coreFrame)
     // the current event prevents that from causing a problem inside WebKit or AppKit code.
     [[event retain] autorelease];
 
-    Frame* coreFrame = core([self _frame]);
-    if (coreFrame)
-        coreFrame->eventHandler()->capsLockStateMayHaveChanged();
-    
     RetainPtr<WebHTMLView> selfProtector = self;
 
+    Frame* coreFrame = core([self _frame]);
     unsigned short keyCode = [event keyCode];
 
-    //Don't make an event from the num lock and function keys
+    // Don't make an event from the num lock and function keys.
     if (coreFrame && keyCode != 0 && keyCode != 10 && keyCode != 63) {
         coreFrame->eventHandler()->keyEvent(PlatformKeyboardEvent(event));
         return;
@@ -4370,8 +4390,11 @@ static BOOL isInPasswordField(Frame* coreFrame)
 
 - (BOOL)_handleStyleKeyEquivalent:(NSEvent *)event
 {
-    ASSERT([self _webView]);
-    if (![[[self _webView] preferences] respectStandardStyleKeyEquivalents])
+    WebView *webView = [self _webView];
+    if (!webView)
+        return NO;
+
+    if (![[webView preferences] respectStandardStyleKeyEquivalents])
         return NO;
     
     if (![self _canEdit])
@@ -5428,26 +5451,35 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
     [self _updateMouseoverWithFakeEvent];
 }
 
-- (void)_executeSavedEditingCommands
+- (void)_executeSavedKeypressCommands
 {
     WebHTMLViewInterpretKeyEventsParameters* parameters = _private->interpretKeyEventsParameters;
     if (!parameters || parameters->event->keypressCommands().isEmpty())
         return;
 
+    // We could be called again if the execution of one command triggers a call to selectedRange.
+    // In this case, the state is up to date, and we don't need to execute any more saved commands to return a result
+    if (parameters->executingSavedKeypressCommands)
+        return;
+    
     // Avoid an infinite loop that would occur if executing a command appended it to event->keypressCommands() again.
     bool wasSavingCommands = parameters->shouldSaveCommands;
     parameters->shouldSaveCommands = false;
-
+    parameters->executingSavedKeypressCommands = true;
+    
     const Vector<KeypressCommand>& commands = parameters->event->keypressCommands();
 
     for (size_t i = 0; i < commands.size(); ++i) {
         if (commands[i].commandName == "insertText:")
             [self insertText:commands[i].text];
+        else if (commands[i].commandName == "noop:")
+            ; // Do nothing. This case can be removed once <rdar://problem/9025012> is fixed.
         else
             [self doCommandBySelector:NSSelectorFromString(commands[i].commandName)];
     }
     parameters->event->keypressCommands().clear();
     parameters->shouldSaveCommands = wasSavingCommands;
+    parameters->executingSavedKeypressCommands = false;
 }
 
 - (BOOL)_interpretKeyEvent:(KeyboardEvent*)event savingCommands:(BOOL)savingCommands
@@ -5458,6 +5490,7 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
     WebHTMLViewInterpretKeyEventsParameters parameters;
     parameters.eventInterpretationHadSideEffects = false;
     parameters.shouldSaveCommands = savingCommands;
+    parameters.executingSavedKeypressCommands = false;
     // If we're intercepting the initial IM call we assume that the IM has consumed the event, 
     // and only change this assumption if one of the NSTextInput/Responder callbacks is used.
     // We assume the IM will *not* consume hotkey sequences
@@ -5501,7 +5534,7 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
         // If there are no text insertion commands, default keydown handler is the right time to execute the commands.
         // Keypress (Char event) handler is the latest opportunity to execute.
         if (!haveTextInsertionCommands || platformEvent->type() == PlatformKeyboardEvent::Char)
-            [self _executeSavedEditingCommands];
+            [self _executeSavedKeypressCommands];
     }
     _private->interpretKeyEventsParameters = 0;
 
@@ -5746,7 +5779,7 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSUInteger)characterIndexForPoint:(NSPoint)thePoint
 {
-    [self _executeSavedEditingCommands];
+    [self _executeSavedKeypressCommands];
 
     NSWindow *window = [self window];
     WebFrame *frame = [self _frame];
@@ -5768,7 +5801,7 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSRect)firstRectForCharacterRange:(NSRange)theRange
 {
-    [self _executeSavedEditingCommands];
+    [self _executeSavedKeypressCommands];
 
     WebFrame *frame = [self _frame];
     
@@ -5800,7 +5833,7 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSRange)selectedRange
 {
-    [self _executeSavedEditingCommands];
+    [self _executeSavedKeypressCommands];
 
     if (!isTextInput(core([self _frame]))) {
         LOG(TextInput, "selectedRange -> (NSNotFound, 0)");
@@ -5814,7 +5847,7 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSRange)markedRange
 {
-    [self _executeSavedEditingCommands];
+    [self _executeSavedKeypressCommands];
 
     WebFrame *webFrame = [self _frame];
     Frame* coreFrame = core(webFrame);
@@ -5828,7 +5861,7 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (NSAttributedString *)attributedSubstringFromRange:(NSRange)nsRange
 {
-    [self _executeSavedEditingCommands];
+    [self _executeSavedKeypressCommands];
 
     WebFrame *frame = [self _frame];
     Frame* coreFrame = core(frame);
@@ -5836,15 +5869,15 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
         LOG(TextInput, "attributedSubstringFromRange:(%u, %u) -> nil", nsRange.location, nsRange.length);
         return nil;
     }
-    DOMRange *domRange = [frame _convertNSRangeToDOMRange:nsRange];
-    if (!domRange) {
+    RefPtr<Range> range = [frame _convertToDOMRange:nsRange];
+    if (!range) {
         LOG(TextInput, "attributedSubstringFromRange:(%u, %u) -> nil", nsRange.location, nsRange.length);
         return nil;
     }
 
-    NSAttributedString *result = [NSAttributedString _web_attributedStringFromRange:core(domRange)];
+    NSAttributedString *result = [WebHTMLConverter editingAttributedStringFromRange:range.get()];
     
-    // [NSAttributedString(WebKitExtras) _web_attributedStringFromRange:]  insists on inserting a trailing 
+    // [WebHTMLConverter editingAttributedStringFromRange:]  insists on inserting a trailing 
     // whitespace at the end of the string which breaks the ATOK input method.  <rdar://problem/5400551>
     // To work around this we truncate the resultant string to the correct length.
     if ([result length] > nsRange.length) {
@@ -5871,23 +5904,27 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
 
 - (BOOL)hasMarkedText
 {
-    [self _executeSavedEditingCommands];
-
     Frame* coreFrame = core([self _frame]);
     BOOL result = coreFrame && coreFrame->editor()->hasComposition();
+
+    if (result) {
+        // A saved command can confirm a composition, but it cannot start a new one.
+        [self _executeSavedKeypressCommands];
+        result = coreFrame->editor()->hasComposition();
+    }
+
     LOG(TextInput, "hasMarkedText -> %u", result);
     return result;
 }
 
 - (void)unmarkText
 {
-    [self _executeSavedEditingCommands];
+    [self _executeSavedKeypressCommands];
 
     LOG(TextInput, "unmarkText");
 
     // Use pointer to get parameters passed to us by the caller of interpretKeyEvents.
     WebHTMLViewInterpretKeyEventsParameters* parameters = _private->interpretKeyEventsParameters;
-    _private->interpretKeyEventsParameters = 0;
 
     if (parameters) {
         parameters->eventInterpretationHadSideEffects = true;
@@ -5920,15 +5957,15 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (void)setMarkedText:(id)string selectedRange:(NSRange)newSelRange
 {
-    [self _executeSavedEditingCommands];
+    [self _executeSavedKeypressCommands];
 
-    BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]]; // Otherwise, NSString
+    BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]];
+    ASSERT(isAttributedString || [string isKindOfClass:[NSString class]]);
 
     LOG(TextInput, "setMarkedText:\"%@\" selectedRange:(%u, %u)", isAttributedString ? [string string] : string, newSelRange.location, newSelRange.length);
 
     // Use pointer to get parameters passed to us by the caller of interpretKeyEvents.
     WebHTMLViewInterpretKeyEventsParameters* parameters = _private->interpretKeyEventsParameters;
-    _private->interpretKeyEventsParameters = 0;
 
     if (parameters) {
         parameters->eventInterpretationHadSideEffects = true;
@@ -5943,20 +5980,25 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
         return;
 
     Vector<CompositionUnderline> underlines;
-    NSString *text = string;
+    NSString *text;
+    NSRange replacementRange = { NSNotFound, 0 };
 
     if (isAttributedString) {
-        unsigned markedTextLength = [(NSString *)string length];
-        NSString *rangeString = [string attribute:NSTextInputReplacementRangeAttributeName atIndex:0 longestEffectiveRange:0 inRange:NSMakeRange(0, markedTextLength)];
+        // FIXME: We ignore most attributes from the string, so an input method cannot specify e.g. a font or a glyph variation.
+        text = [string string];
+        NSString *rangeString = [string attribute:NSTextInputReplacementRangeAttributeName atIndex:0 longestEffectiveRange:0 inRange:NSMakeRange(0, [text length])];
         LOG(TextInput, "    ReplacementRange: %@", rangeString);
         // The AppKit adds a 'secret' property to the string that contains the replacement range.
         // The replacement range is the range of the the text that should be replaced with the new string.
         if (rangeString)
-            [[self _frame] _selectNSRange:NSRangeFromString(rangeString)];
+            replacementRange = NSRangeFromString(rangeString);
 
-        text = [string string];
         extractUnderlines(string, underlines);
-    }
+    } else
+        text = string;
+
+    if (replacementRange.location != NSNotFound)
+        [[self _frame] _selectNSRange:replacementRange];
 
     coreFrame->editor()->setComposition(text, underlines, newSelRange.location, NSMaxRange(newSelRange));
 }
@@ -6018,7 +6060,8 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 
 - (void)insertText:(id)string
 {
-    BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]]; // Otherwise, NSString
+    BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]];
+    ASSERT(isAttributedString || [string isKindOfClass:[NSString class]]);
 
     LOG(TextInput, "insertText:\"%@\"", isAttributedString ? [string string] : string);
 
@@ -6026,20 +6069,19 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     if (parameters)
         parameters->consumedByIM = false;
 
-    // We don't support inserting an attributed string but input methods don't appear to require this.
     RefPtr<Frame> coreFrame = core([self _frame]);
     NSString *text;
+    NSRange replacementRange = { NSNotFound, 0 };
     bool isFromInputMethod = coreFrame && coreFrame->editor()->hasComposition();
+
     if (isAttributedString) {
+        // FIXME: We ignore most attributes from the string, so for example inserting from Character Palette loses font and glyph variation data.
+        // It does not look like any input methods ever use insertText: with attributes other than NSTextInputReplacementRangeAttributeName.
         text = [string string];
-        // We deal with the NSTextInputReplacementRangeAttributeName attribute from NSAttributedString here
-        // simply because it is used by at least one Input Method -- it corresonds to the kEventParamTextInputSendReplaceRange
-        // event in TSM. This behavior matches that of -[WebHTMLView setMarkedText:selectedRange:] when it receives an
-        // NSAttributedString
         NSString *rangeString = [string attribute:NSTextInputReplacementRangeAttributeName atIndex:0 longestEffectiveRange:0 inRange:NSMakeRange(0, [text length])];
         LOG(TextInput, "    ReplacementRange: %@", rangeString);
         if (rangeString) {
-            [[self _frame] _selectNSRange:NSRangeFromString(rangeString)];
+            replacementRange = NSRangeFromString(rangeString);
             isFromInputMethod = true;
         }
     } else
@@ -6062,6 +6104,9 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     if (!coreFrame || !coreFrame->editor()->canEdit())
         return;
 
+    if (replacementRange.location != NSNotFound)
+        [[self _frame] _selectNSRange:replacementRange];
+
     bool eventHandled = false;
     String eventText = text;
     eventText.replace(NSBackTabCharacter, NSTabCharacter); // same thing is done in KeyEventMac.mm in WebCore
@@ -6078,6 +6123,37 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
         parameters->eventInterpretationHadSideEffects |= eventHandled;
 }
 
+- (void)_updateSecureInputState
+{
+    if (![[self window] isKeyWindow] || ([[self window] firstResponder] != self && !_private->_forceUpdateSecureInputState)) {
+        if (_private->isInSecureInputState) {
+            DisableSecureEventInput();
+            _private->isInSecureInputState = NO;
+        }
+        return;
+    }
+
+    Frame* coreFrame = core([self _frame]);
+    if (!coreFrame)
+        return;
+
+    if (isInPasswordField(coreFrame)) {
+        if (!_private->isInSecureInputState)
+            EnableSecureEventInput();
+        _private->isInSecureInputState = YES;
+        // WebKit substitutes nil for input context when in password field, which corresponds to null TSMDocument. So, there is
+        // no need to call TSMGetActiveDocument(), which may return an incorrect result when selection hasn't been yet updated
+        // after focusing a node.
+        static CFArrayRef inputSources = TISCreateASCIICapableInputSourceList();
+        TSMSetDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag, sizeof(CFArrayRef), &inputSources);
+    } else {
+        if (_private->isInSecureInputState)
+            DisableSecureEventInput();
+        _private->isInSecureInputState = NO;
+        TSMRemoveDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag);
+    }
+}
+
 - (void)_updateSelectionForInputManager
 {
     Frame* coreFrame = core([self _frame]);
@@ -6093,6 +6169,8 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
             [NSApp updateWindows];
     }
 
+    [self _updateSecureInputState];
+
     if (!coreFrame->editor()->hasComposition())
         return;
 
@@ -6214,7 +6292,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     NSAttributedString *attributedString = [self _attributeStringFromDOMRange:[document _documentRange]];
     if (!attributedString) {
         Document* coreDocument = core(document);
-        attributedString = [NSAttributedString _web_attributedStringFromRange:Range::create(coreDocument, coreDocument, 0, coreDocument, coreDocument->childNodeCount()).get()];
+        attributedString = [WebHTMLConverter editingAttributedStringFromRange:Range::create(coreDocument, coreDocument, 0, coreDocument, coreDocument->childNodeCount()).get()];
     }
     return attributedString;
 }
@@ -6231,7 +6309,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
         Frame* coreFrame = core([self _frame]);
         if (coreFrame) {
             RefPtr<Range> range = coreFrame->selection()->selection().toNormalizedRange();
-            attributedString = [NSAttributedString _web_attributedStringFromRange:range.get()];
+            attributedString = [WebHTMLConverter editingAttributedStringFromRange:range.get()];
         }
     }
     return attributedString;
diff --git a/Source/WebKit/mac/WebView/WebPDFView.mm b/Source/WebKit/mac/WebView/WebPDFView.mm
index 10ba829..5c9f3b7 100644
--- a/Source/WebKit/mac/WebView/WebPDFView.mm
+++ b/Source/WebKit/mac/WebView/WebPDFView.mm
@@ -39,7 +39,6 @@
 #import "WebFrameView.h"
 #import "WebLocalizableStringsInternal.h"
 #import "WebNSArrayExtras.h"
-#import "WebNSAttributedStringExtras.h"
 #import "WebNSPasteboardExtras.h"
 #import "WebNSViewExtras.h"
 #import "WebPDFRepresentation.h"
@@ -61,6 +60,7 @@
 #import <WebCore/MouseEvent.h>
 #import <WebCore/PlatformKeyboardEvent.h>
 #import <WebCore/RuntimeApplicationChecks.h>
+#import <WebCore/WebNSAttributedStringExtras.h>
 #import <wtf/Assertions.h>
 
 using namespace WebCore;
@@ -924,7 +924,7 @@ static BOOL isFrameInRange(WebFrame *frame, DOMRange *range)
     
     if ([types containsObject:NSRTFPboardType]) {
         if ([attributedString containsAttachments])
-            attributedString = [attributedString _web_attributedStringByStrippingAttachmentCharacters];
+            attributedString = attributedStringByStrippingAttachmentCharacters(attributedString);
 
         NSData *RTFData = [attributedString RTFFromRange:NSMakeRange(0, [attributedString length]) documentAttributes:nil];
         [pasteboard setData:RTFData forType:NSRTFPboardType];
diff --git a/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index a2f176a..c5c101b 100644
--- a/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -60,6 +60,7 @@
 #define WebKitAllowAnimatedImagesPreferenceKey @"WebKitAllowAnimatedImagesPreferenceKey"
 #define WebKitAllowAnimatedImageLoopingPreferenceKey @"WebKitAllowAnimatedImageLoopingPreferenceKey"
 #define WebKitDisplayImagesKey @"WebKitDisplayImagesKey"
+#define WebKitLoadSiteIconsKey @"WebKitLoadSiteIconsKey"
 #define WebKitBackForwardCacheExpirationIntervalKey @"WebKitBackForwardCacheExpirationIntervalKey"
 #define WebKitTabToLinksPreferenceKey @"WebKitTabToLinksPreferenceKey"
 #define WebKitPrivateBrowsingEnabledPreferenceKey @"WebKitPrivateBrowsingEnabled"
diff --git a/Source/WebKit/mac/WebView/WebPreferences.mm b/Source/WebKit/mac/WebView/WebPreferences.mm
index a5f24e0..e69a06b 100644
--- a/Source/WebKit/mac/WebView/WebPreferences.mm
+++ b/Source/WebKit/mac/WebView/WebPreferences.mm
@@ -42,6 +42,7 @@
 
 NSString *WebPreferencesChangedNotification = @"WebPreferencesChangedNotification";
 NSString *WebPreferencesRemovedNotification = @"WebPreferencesRemovedNotification";
+NSString *WebPreferencesChangedInternalNotification = @"WebPreferencesChangedInternalNotification";
 
 #define KEY(x) (_private->identifier ? [_private->identifier stringByAppendingString:(x)] : (x))
 
@@ -232,7 +233,7 @@ static bool useQuickLookQuirks(void)
 
     [[self class] _setInstance:self forIdentifier:_private->identifier];
 
-    [self _postPreferencesChangesNotification];
+    [self _postPreferencesChangedNotification];
 
     return self;
 }
@@ -345,6 +346,7 @@ static bool useQuickLookQuirks(void)
         [NSNumber numberWithBool:YES],  WebKitAllowAnimatedImagesPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAllowAnimatedImageLoopingPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitDisplayImagesKey,
+        [NSNumber numberWithBool:NO],   WebKitLoadSiteIconsKey,
         @"1800",                        WebKitBackForwardCacheExpirationIntervalKey,
         [NSNumber numberWithBool:NO],   WebKitTabToLinksPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitPrivateBrowsingEnabledPreferenceKey,
@@ -375,7 +377,7 @@ static bool useQuickLookQuirks(void)
         [NSNumber numberWithBool:YES],  WebKitXSSAuditorEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAcceleratedCompositingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],  WebKitAcceleratedDrawingEnabledPreferenceKey,
-        [NSNumber numberWithBool:YES],  WebKitCanvasUsesAcceleratedDrawingPreferenceKey,
+        [NSNumber numberWithBool:NO],  WebKitCanvasUsesAcceleratedDrawingPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitShowDebugBordersPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitShowRepaintCounterPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitWebGLEnabledPreferenceKey,
@@ -436,7 +438,7 @@ static bool useQuickLookQuirks(void)
     [_private->values setObject:value forKey:_key];
     if (_private->autosaves)
         [[NSUserDefaults standardUserDefaults] setObject:value forKey:_key];
-    [self _postPreferencesChangesNotification];
+    [self _postPreferencesChangedNotification];
 }
 
 - (int)_integerValueForKey:(NSString *)key
@@ -453,7 +455,7 @@ static bool useQuickLookQuirks(void)
     [_private->values _webkit_setInt:value forKey:_key];
     if (_private->autosaves)
         [[NSUserDefaults standardUserDefaults] setInteger:value forKey:_key];
-    [self _postPreferencesChangesNotification];
+    [self _postPreferencesChangedNotification];
 }
 
 - (float)_floatValueForKey:(NSString *)key
@@ -470,7 +472,7 @@ static bool useQuickLookQuirks(void)
     [_private->values _webkit_setFloat:value forKey:_key];
     if (_private->autosaves)
         [[NSUserDefaults standardUserDefaults] setFloat:value forKey:_key];
-    [self _postPreferencesChangesNotification];
+    [self _postPreferencesChangedNotification];
 }
 
 - (BOOL)_boolValueForKey:(NSString *)key
@@ -486,7 +488,7 @@ static bool useQuickLookQuirks(void)
     [_private->values _webkit_setBool:value forKey:_key];
     if (_private->autosaves)
         [[NSUserDefaults standardUserDefaults] setBool:value forKey:_key];
-    [self _postPreferencesChangesNotification];
+    [self _postPreferencesChangedNotification];
 }
 
 - (long long)_longLongValueForKey:(NSString *)key
@@ -503,7 +505,7 @@ static bool useQuickLookQuirks(void)
     [_private->values _webkit_setLongLong:value forKey:_key];
     if (_private->autosaves)
         [[NSUserDefaults standardUserDefaults] setObject:[NSNumber numberWithLongLong:value] forKey:_key];
-    [self _postPreferencesChangesNotification];
+    [self _postPreferencesChangedNotification];
 }
 
 - (unsigned long long)_unsignedLongLongValueForKey:(NSString *)key
@@ -520,7 +522,7 @@ static bool useQuickLookQuirks(void)
     [_private->values _webkit_setUnsignedLongLong:value forKey:_key];
     if (_private->autosaves)
         [[NSUserDefaults standardUserDefaults] setObject:[NSNumber numberWithUnsignedLongLong:value] forKey:_key];
-    [self _postPreferencesChangesNotification];
+    [self _postPreferencesChangedNotification];
 }
 
 - (NSString *)standardFontFamily
@@ -1173,16 +1175,25 @@ static bool useQuickLookQuirks(void)
         [self performSelector:@selector(_checkLastReferenceForIdentifier:) withObject:[self _concatenateKeyWithIBCreatorID:ident] afterDelay:0.1];
 }
 
-- (void)_postPreferencesChangesNotification
+- (void)_postPreferencesChangedNotification
 {
     if (!pthread_main_np()) {
         [self performSelectorOnMainThread:_cmd withObject:nil waitUntilDone:NO];
         return;
     }
 
-    [[NSNotificationCenter defaultCenter]
-        postNotificationName:WebPreferencesChangedNotification object:self
-                    userInfo:nil];
+    [[NSNotificationCenter defaultCenter] postNotificationName:WebPreferencesChangedInternalNotification object:self userInfo:nil];
+    [[NSNotificationCenter defaultCenter] postNotificationName:WebPreferencesChangedNotification object:self userInfo:nil];
+}
+
+- (void)_postPreferencesChangedAPINotification
+{
+    if (!pthread_main_np()) {
+        [self performSelectorOnMainThread:_cmd withObject:nil waitUntilDone:NO];
+        return;
+    }
+
+    [[NSNotificationCenter defaultCenter] postNotificationName:WebPreferencesChangedNotification object:self userInfo:nil];
 }
 
 + (CFStringEncoding)_systemCFStringEncoding
@@ -1463,6 +1474,16 @@ static NSString *classIBCreatorID = nil;
     setWebKitLinkTimeVersion(version);
 }
 
+- (void)setLoadsSiteIconsIgnoringImageLoadingPreference: (BOOL)flag
+{
+    [self _setBoolValue: flag forKey: WebKitLoadSiteIconsKey];
+}
+
+- (BOOL)loadsSiteIconsIgnoringImageLoadingPreference
+{
+    return [self _boolValueForKey: WebKitLoadSiteIconsKey];
+}
+
 @end
 
 @implementation WebPreferences (WebInternal)
diff --git a/Source/WebKit/mac/WebView/WebPreferencesPrivate.h b/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
index 7e1f6a2..e66604a 100644
--- a/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -51,6 +51,7 @@ typedef enum {
 
 extern NSString *WebPreferencesChangedNotification;
 extern NSString *WebPreferencesRemovedNotification;
+extern NSString *WebPreferencesChangedInternalNotification;
 
 @interface WebPreferences (WebPrivate)
 
@@ -210,7 +211,8 @@ extern NSString *WebPreferencesRemovedNotification;
 - (void)setHyperlinkAuditingEnabled:(BOOL)enabled;
 
 // Other private methods
-- (void)_postPreferencesChangesNotification;
+- (void)_postPreferencesChangedNotification;
+- (void)_postPreferencesChangedAPINotification;
 + (WebPreferences *)_getInstanceForIdentifier:(NSString *)identifier;
 + (void)_setInstance:(WebPreferences *)instance forIdentifier:(NSString *)identifier;
 + (void)_removeReferenceForIdentifier:(NSString *)identifier;
@@ -238,4 +240,7 @@ extern NSString *WebPreferencesRemovedNotification;
 
 - (BOOL)useQuickLookResourceCachingQuirks;
 
+- (void)setLoadsSiteIconsIgnoringImageLoadingPreference: (BOOL)flag;
+- (BOOL)loadsSiteIconsIgnoringImageLoadingPreference;
+
 @end
diff --git a/Source/WebKit/mac/WebView/WebScriptDebugger.h b/Source/WebKit/mac/WebView/WebScriptDebugger.h
index 8f7fcaa..784a802 100644
--- a/Source/WebKit/mac/WebView/WebScriptDebugger.h
+++ b/Source/WebKit/mac/WebView/WebScriptDebugger.h
@@ -29,7 +29,7 @@
 #ifndef WebScriptDebugger_h
 #define WebScriptDebugger_h
 
-#include <collector/handles/Global.h>
+#include <heap/Strong.h>
 #include <debugger/Debugger.h>
 
 #include <wtf/RetainPtr.h>
@@ -69,7 +69,7 @@ private:
     bool m_callingDelegate;
     RetainPtr<WebScriptCallFrame> m_topCallFrame;
 
-    JSC::Global<JSC::JSGlobalObject> m_globalObject;
+    JSC::Strong<JSC::JSGlobalObject> m_globalObject;
     RetainPtr<WebScriptCallFrame> m_globalCallFrame;
 };
 
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index 3d42be0..c36acb9 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2006 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2010 Igalia S.L
  *
@@ -148,6 +148,7 @@
 #import <WebCore/RenderWidget.h>
 #import <WebCore/ResourceHandle.h>
 #import <WebCore/ResourceLoadScheduler.h>
+#import <WebCore/ResourceRequest.h>
 #import <WebCore/RuntimeApplicationChecks.h>
 #import <WebCore/SchemeRegistry.h>
 #import <WebCore/ScriptController.h>
@@ -179,10 +180,6 @@
 #import <wtf/StdLibExtras.h>
 #import <wtf/Threading.h>
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-#import <AppKit/NSTextChecker.h>
-#endif
-
 #if ENABLE(DASHBOARD_SUPPORT)
 #import <WebKit/WebDashboardRegion.h>
 #endif
@@ -639,17 +636,39 @@ static bool shouldEnableLoadDeferring()
     return _private->usesDocumentViews;
 }
 
-static NSString *leakMailQuirksUserScriptPath()
+static NSString *leakMailQuirksUserScriptContents()
 {
     NSString *scriptPath = [[NSBundle bundleForClass:[WebView class]] pathForResource:@"MailQuirksUserScript" ofType:@"js"];
-    return [[NSString alloc] initWithContentsOfFile:scriptPath];
+    NSStringEncoding encoding;
+    return [[NSString alloc] initWithContentsOfFile:scriptPath usedEncoding:&encoding error:0];
 }
 
 - (void)_injectMailQuirksScript
 {
-    static NSString *mailQuirksScriptPath = leakMailQuirksUserScriptPath();
+    static NSString *mailQuirksScriptContents = leakMailQuirksUserScriptContents();
+    core(self)->group().addUserScriptToWorld(core([WebScriptWorld world]),
+        mailQuirksScriptContents, KURL(), 0, 0, InjectAtDocumentEnd, InjectInAllFrames);
+}
+
+static bool needsOutlookQuirksScript()
+{
+    static bool isOutlookNeedingQuirksScript = !WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITH_HTML5_PARSER)
+        && applicationIsMicrosoftOutlook();
+    return isOutlookNeedingQuirksScript;
+}
+
+static NSString *leakOutlookQuirksUserScriptContents()
+{
+    NSString *scriptPath = [[NSBundle bundleForClass:[WebView class]] pathForResource:@"OutlookQuirksUserScript" ofType:@"js"];
+    NSStringEncoding encoding;
+    return [[NSString alloc] initWithContentsOfFile:scriptPath usedEncoding:&encoding error:0];
+}
+
+-(void)_injectOutlookQuirksScript
+{
+    static NSString *outlookQuirksScriptContents = leakOutlookQuirksUserScriptContents();
     core(self)->group().addUserScriptToWorld(core([WebScriptWorld world]),
-        mailQuirksScriptPath, KURL(), 0, 0, InjectAtDocumentEnd, InjectInAllFrames);
+        outlookQuirksScriptContents, KURL(), 0, 0, InjectAtDocumentEnd, InjectInAllFrames);
 }
 
 - (void)_commonInitializationWithFrameName:(NSString *)frameName groupName:(NSString *)groupName usesDocumentViews:(BOOL)usesDocumentViews
@@ -720,6 +739,11 @@ static NSString *leakMailQuirksUserScriptPath()
     _private->page->setCanStartMedia([self window]);
     _private->page->settings()->setLocalStorageDatabasePath([[self preferences] _localStorageDatabasePath]);
 
+    if (needsOutlookQuirksScript()) {
+        _private->page->settings()->setShouldInjectUserScriptsInInitialEmptyDocument(true);
+        [self _injectOutlookQuirksScript];
+    }
+
     [WebFrame _createMainFrameWithPage:_private->page frameName:frameName frameView:frameView];
 
 #ifndef BUILDING_ON_TIGER
@@ -752,10 +776,10 @@ static NSString *leakMailQuirksUserScriptPath()
 
     WebPreferences *prefs = [self preferences];
     [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_preferencesChangedNotification:)
-                                                 name:WebPreferencesChangedNotification object:prefs];
+                                                 name:WebPreferencesChangedInternalNotification object:prefs];
 
-    // Post a notification so the WebCore settings update.
-    [[self preferences] _postPreferencesChangesNotification];
+    [self _preferencesChanged:[self preferences]];
+    [[self preferences] _postPreferencesChangedAPINotification];
 
     if (!WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITH_LOCAL_RESOURCE_SECURITY_RESTRICTION)) {
         // Originally, we allowed all local loads.
@@ -1272,10 +1296,16 @@ static bool fastDocumentTeardownEnabled()
 - (NSMenu *)_menuForElement:(NSDictionary *)element defaultItems:(NSArray *)items
 {
     NSArray *defaultMenuItems = [[WebDefaultUIDelegate sharedUIDelegate] webView:self contextMenuItemsForElement:element defaultMenuItems:items];
-
-    NSArray *menuItems = CallUIDelegate(self, @selector(webView:contextMenuItemsForElement:defaultMenuItems:), element, defaultMenuItems);
-    if (!menuItems)
-        return nil;
+    NSArray *menuItems = defaultMenuItems;
+
+    // CallUIDelegate returns nil if UIDelegate is nil or doesn't respond to the selector. So we need to check that here
+    // to distinguish between using defaultMenuItems or the delegate really returning nil to say "no context menu".
+    SEL selector = @selector(webView:contextMenuItemsForElement:defaultMenuItems:);
+    if (_private->UIDelegate && [_private->UIDelegate respondsToSelector:selector]) {
+        menuItems = CallUIDelegate(self, selector, element, defaultMenuItems);
+        if (!menuItems)
+            return nil;
+    }
 
     unsigned count = [menuItems count];
     if (!count)
@@ -1416,8 +1446,12 @@ static bool fastDocumentTeardownEnabled()
 - (void)_preferencesChangedNotification:(NSNotification *)notification
 {
     WebPreferences *preferences = (WebPreferences *)[notification object];
+    [self _preferencesChanged:preferences];
+}
+
+- (void)_preferencesChanged:(WebPreferences *)preferences
+{    
     ASSERT(preferences == [self preferences]);
-    
     if (!_private->userAgentOverridden)
         _private->userAgent = String();
 
@@ -1459,6 +1493,7 @@ static bool fastDocumentTeardownEnabled()
     settings->setSerifFontFamily([preferences serifFontFamily]);
     settings->setStandardFontFamily([preferences standardFontFamily]);
     settings->setLoadsImagesAutomatically([preferences loadsImagesAutomatically]);
+    settings->setLoadsSiteIconsIgnoringImageLoadingSetting([preferences loadsSiteIconsIgnoringImageLoadingPreference]);
     settings->setShouldPrintBackgrounds([preferences shouldPrintBackgrounds]);
     settings->setTextAreasAreResizable([preferences textAreasAreResizable]);
     settings->setShrinksStandaloneImagesToFit([preferences shrinksStandaloneImagesToFit]);
@@ -2262,8 +2297,9 @@ static inline IMP getMethod(id o, SEL s)
 {
     _private->usesPageCache = usesPageCache;
 
-    // Post a notification so the WebCore settings update.
-    [[self preferences] _postPreferencesChangesNotification];
+    // Update our own settings and post the public notification only
+    [self _preferencesChanged:[self preferences]];
+    [[self preferences] _postPreferencesChangedAPINotification];
 }
 
 - (WebHistoryItem *)_globalHistoryItem
@@ -2790,6 +2826,16 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
         _private->page->settings()->setMinDOMTimerInterval(intervalInSeconds);
 }
 
++ (BOOL)_HTTPPipeliningEnabled
+{
+    return ResourceRequest::httpPipeliningEnabled();
+}
+
++ (void)_setHTTPPipeliningEnabled:(BOOL)enabled
+{
+    ResourceRequest::setHTTPPipeliningEnabled(enabled);
+}
+
 @end
 
 @implementation _WebSafeForwarder
@@ -2848,7 +2894,7 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     WTF::initializeMainThreadToProcessMainThread();
 
     [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_applicationWillTerminate) name:NSApplicationWillTerminateNotification object:NSApp];
-    [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_preferencesChangedNotification:) name:WebPreferencesChangedNotification object:nil];
+    [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_preferencesChangedNotification:) name:WebPreferencesChangedInternalNotification object:nil];
     [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_preferencesRemovedNotification:) name:WebPreferencesRemovedNotification object:nil];    
 
     continuousSpellCheckingEnabled = [[NSUserDefaults standardUserDefaults] boolForKey:WebContinuousSpellCheckingEnabled];
@@ -3353,15 +3399,16 @@ static bool needsWebViewInitThreadWorkaround()
 
     WebPreferences *oldPrefs = _private->preferences;
 
-    [[NSNotificationCenter defaultCenter] removeObserver:self name:WebPreferencesChangedNotification object:[self preferences]];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:WebPreferencesChangedInternalNotification object:[self preferences]];
     [WebPreferences _removeReferenceForIdentifier:[oldPrefs identifier]];
 
     _private->preferences = [prefs retain];
 
     // After registering for the notification, post it so the WebCore settings update.
     [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_preferencesChangedNotification:)
-        name:WebPreferencesChangedNotification object:[self preferences]];
-    [[self preferences] _postPreferencesChangesNotification];
+        name:WebPreferencesChangedInternalNotification object:[self preferences]];
+    [self _preferencesChanged:[self preferences]];
+    [[self preferences] _postPreferencesChangedAPINotification];
 
     [oldPrefs didRemoveFromWebView];
     [oldPrefs release];
@@ -5964,7 +6011,7 @@ static inline uint64_t roundUpToPowerOf2(uint64_t num)
 
         [[NSNotificationCenter defaultCenter] 
             addObserver:self selector:@selector(_retrieveKeyboardUIModeFromPreferences:) 
-            name:WebPreferencesChangedNotification object:nil];
+            name:WebPreferencesChangedInternalNotification object:nil];
     }
     return _private->_keyboardUIMode;
 }
diff --git a/Source/WebKit/mac/WebView/WebViewInternal.h b/Source/WebKit/mac/WebView/WebViewInternal.h
index 65cb4d8..aeef7eb 100644
--- a/Source/WebKit/mac/WebView/WebViewInternal.h
+++ b/Source/WebKit/mac/WebView/WebViewInternal.h
@@ -183,6 +183,8 @@ namespace WebCore {
 
 - (void)_setInsertionPasteboard:(NSPasteboard *)pasteboard;
 
+- (void)_preferencesChanged:(WebPreferences *)preferences;
+
 #if ENABLE(VIDEO) && defined(__cplusplus)
 - (void)_enterFullscreenForNode:(WebCore::Node*)node;
 - (void)_exitFullscreen;
diff --git a/Source/WebKit/mac/WebView/WebViewPrivate.h b/Source/WebKit/mac/WebView/WebViewPrivate.h
index 7d7537e..fa4844f 100644
--- a/Source/WebKit/mac/WebView/WebViewPrivate.h
+++ b/Source/WebKit/mac/WebView/WebViewPrivate.h
@@ -594,6 +594,22 @@ Could be worth adding to the API.
 */
 - (void)_setMinimumTimerInterval:(double)intervalInSeconds;
 
+/*!
+    @method _HTTPPipeliningEnabled
+    @abstract Checks the HTTP pipelining status.
+    @discussion Defaults to NO.
+    @result YES if HTTP pipelining is enabled, NO if not enabled.
+ */
++ (BOOL)_HTTPPipeliningEnabled;
+
+/*!
+    @method _setHTTPPipeliningEnabled:
+    @abstract Set the HTTP pipelining status.
+    @discussion Defaults to NO.
+    @param enabled The new HTTP pipelining status.
+ */
++ (void)_setHTTPPipeliningEnabled:(BOOL)enabled;
+
 @end
 
 @interface WebView (WebViewPrintingPrivate)
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index e5124bd..026a7df 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -313,7 +313,7 @@ void QWebFramePrivate::renderFromTiledBackingStore(GraphicsContext* context, con
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
     renderCompositedLayers(context, IntRect(clip.boundingRect()));
-    renderRelativeCoords(context, (QWebFrame::RenderLayer)(QWebFrame::ScrollBarLayer | QWebFrame::PanIconLayer), clip);
+    renderFrameExtras(context, QFlags<QWebFrame::RenderLayer>(QWebFrame::ScrollBarLayer) | QWebFrame::PanIconLayer, clip);
 #endif
 }
 #endif
@@ -342,7 +342,7 @@ void QWebFramePrivate::renderCompositedLayers(GraphicsContext* context, const In
 }
 #endif
 
-void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QWebFrame::RenderLayer layer, const QRegion& clip)
+void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QFlags<QWebFrame::RenderLayer> layers, const QRegion& clip)
 {
     if (!frame->view() || !frame->contentRenderer())
         return;
@@ -356,7 +356,7 @@ void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QWebFrame:
     WebCore::FrameView* view = frame->view();
     view->updateLayoutAndStyleIfNeededRecursive();
 
-    if (layer & QWebFrame::ContentsLayer) {
+    if (layers & QWebFrame::ContentsLayer) {
         for (int i = 0; i < vector.size(); ++i) {
             const QRect& clipRect = vector.at(i);
 
@@ -385,47 +385,67 @@ void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QWebFrame:
         renderCompositedLayers(context, IntRect(clip.boundingRect()));
 #endif
     }
-    if (layer & (QWebFrame::PanIconLayer | QWebFrame::ScrollBarLayer)) {
-        for (int i = 0; i < vector.size(); ++i) {
-            const QRect& clipRect = vector.at(i);
+    renderFrameExtras(context, layers, clip);
+#if ENABLE(INSPECTOR)
+    if (frame->page()->inspectorController()->highlightedNode()) {
+        context->save();
+        frame->page()->inspectorController()->drawNodeHighlight(*context);
+        context->restore();
+    }
+#endif
+}
 
-            QRect intersectedRect = clipRect.intersected(view->frameRect());
+void QWebFramePrivate::renderFrameExtras(GraphicsContext* context, QFlags<QWebFrame::RenderLayer> layers, const QRegion& clip)
+{
+    if (!(layers & (QWebFrame::PanIconLayer | QWebFrame::ScrollBarLayer)))
+        return;
+    QPainter* painter = context->platformContext();
+    WebCore::FrameView* view = frame->view();
+    QVector<QRect> vector = clip.rects();
+    for (int i = 0; i < vector.size(); ++i) {
+        const QRect& clipRect = vector.at(i);
 
-            painter->save();
-            painter->setClipRect(clipRect, Qt::IntersectClip);
+        QRect intersectedRect = clipRect.intersected(view->frameRect());
 
-            int x = view->x();
-            int y = view->y();
+        painter->save();
+        painter->setClipRect(clipRect, Qt::IntersectClip);
 
-            if (layer & QWebFrame::ScrollBarLayer
-                && !view->scrollbarsSuppressed()
-                && (view->horizontalScrollbar() || view->verticalScrollbar())) {
-                QRect rect = intersectedRect;
-                context->translate(x, y);
-                rect.translate(-x, -y);
+        int x = view->x();
+        int y = view->y();
 
-                view->paintScrollbars(context, rect);
+        if (layers & QWebFrame::ScrollBarLayer
+            && !view->scrollbarsSuppressed()
+            && (view->horizontalScrollbar() || view->verticalScrollbar())) {
 
-                context->translate(-x, -y);
-            }
+            QRect rect = intersectedRect;
+            context->translate(x, y);
+            rect.translate(-x, -y);
+            view->paintScrollbars(context, rect);
+            context->translate(-x, -y);
+        }
 
 #if ENABLE(PAN_SCROLLING)
-            if (layer & QWebFrame::PanIconLayer)
-                view->paintPanScrollIcon(context);
+        if (layers & QWebFrame::PanIconLayer)
+            view->paintPanScrollIcon(context);
 #endif
 
-            painter->restore();
-        }
+        painter->restore();
     }
 }
 
-void QWebFrame::orientationChanged()
+void QWebFramePrivate::emitUrlChanged()
+{
+    url = frame->document()->url();
+    emit q->urlChanged(url);
+}
+
+void QWebFramePrivate::_q_orientationChanged()
 {
 #if ENABLE(ORIENTATION_EVENTS) && ENABLE(DEVICE_ORIENTATION)
     int orientation;
-    WebCore::Frame* frame = QWebFramePrivate::core(this);
+    WebCore::Frame* frame = core(q);
 
-    switch (d->m_orientation.reading()->orientation()) {
+    switch (m_orientation.reading()->orientation()) {
     case QtMobility::QOrientationReading::TopUp:
         orientation = 0;
         break;
@@ -522,7 +542,7 @@ QWebFrame::QWebFrame(QWebPage *parent, QWebFrameData *frameData)
         d->frame->loader()->load(request, frameData->name, false);
     }
 #if ENABLE(ORIENTATION_EVENTS) && ENABLE(DEVICE_ORIENTATION)
-    connect(&d->m_orientation, SIGNAL(readingChanged()), this, SLOT(orientationChanged()));
+    connect(&d->m_orientation, SIGNAL(readingChanged()), this, SLOT(_q_orientationChanged()));
     d->m_orientation.start();
 #endif
 }
@@ -534,7 +554,7 @@ QWebFrame::QWebFrame(QWebFrame *parent, QWebFrameData *frameData)
     d->page = parent->d->page;
     d->init(this, frameData);
 #if ENABLE(ORIENTATION_EVENTS) && ENABLE(DEVICE_ORIENTATION)
-    connect(&d->m_orientation, SIGNAL(readingChanged()), this, SLOT(orientationChanged()));
+    connect(&d->m_orientation, SIGNAL(readingChanged()), this, SLOT(_q_orientationChanged()));
     d->m_orientation.start();
 #endif
 }
@@ -678,7 +698,7 @@ QString QWebFrame::renderTreeDump() const
 QString QWebFrame::title() const
 {
     if (d->frame->document())
-        return d->frame->loader()->documentLoader()->title();
+        return d->frame->loader()->documentLoader()->title().string();
     return QString();
 }
 
@@ -729,6 +749,17 @@ QMultiMap<QString, QString> QWebFrame::metaData() const
     return map;
 }
 
+static inline void clearCoreFrame(WebCore::Frame* frame)
+{
+    frame->loader()->activeDocumentLoader()->writer()->begin();
+    frame->loader()->activeDocumentLoader()->writer()->end();
+}
+
+static inline bool isCoreFrameClear(WebCore::Frame* frame)
+{
+    return frame->document()->url().isEmpty();
+}
+
 static inline QUrl ensureAbsoluteUrl(const QUrl &url)
 {
     if (!url.isValid() || !url.isRelative())
@@ -758,15 +789,15 @@ static inline QUrl ensureAbsoluteUrl(const QUrl &url)
 
 void QWebFrame::setUrl(const QUrl &url)
 {
+    clearCoreFrame(d->frame);
     const QUrl absolute = ensureAbsoluteUrl(url);
-    d->frame->loader()->activeDocumentLoader()->writer()->begin(absolute);
-    d->frame->loader()->activeDocumentLoader()->writer()->end();
+    d->url = absolute;
     load(absolute);
 }
 
 QUrl QWebFrame::url() const
 {
-    return d->frame->document()->url();
+    return d->url;
 }
 
 /*!
@@ -791,7 +822,9 @@ QUrl QWebFrame::requestedUrl() const
 
 QUrl QWebFrame::baseUrl() const
 {
-    return d->frame->loader()->baseURL();
+    if (isCoreFrameClear(d->frame))
+        return QUrl(d->url).resolved(QUrl());
+    return d->frame->document()->baseURL();
 }
 
 /*!
@@ -1913,3 +1946,5 @@ QWebFrame *QWebHitTestResult::frame() const
         return 0;
     return d->frame;
 }
+
+#include "moc_qwebframe.cpp"
diff --git a/Source/WebKit/qt/Api/qwebframe.h b/Source/WebKit/qt/Api/qwebframe.h
index 8410962..3c5a28e 100644
--- a/Source/WebKit/qt/Api/qwebframe.h
+++ b/Source/WebKit/qt/Api/qwebframe.h
@@ -205,9 +205,6 @@ public Q_SLOTS:
     void print(QPrinter *printer) const;
 #endif
 
-private Q_SLOTS:
-    void orientationChanged();
-
 Q_SIGNALS:
     void javaScriptWindowObjectCleared();
 
@@ -237,6 +234,7 @@ private:
     friend class WebCore::ChromeClientQt;
     friend class WebCore::PlatformLayerProxyQt;
     QWebFramePrivate *d;
+    Q_PRIVATE_SLOT(d, void _q_orientationChanged())
 };
 
 #endif
diff --git a/Source/WebKit/qt/Api/qwebframe_p.h b/Source/WebKit/qt/Api/qwebframe_p.h
index ee8c463..4108972 100644
--- a/Source/WebKit/qt/Api/qwebframe_p.h
+++ b/Source/WebKit/qt/Api/qwebframe_p.h
@@ -96,20 +96,25 @@ public:
     static WebCore::Frame* core(const QWebFrame*);
     static QWebFrame* kit(const WebCore::Frame*);
 
-    void renderRelativeCoords(WebCore::GraphicsContext*, QWebFrame::RenderLayer, const QRegion& clip);
+    void renderRelativeCoords(WebCore::GraphicsContext*, QFlags<QWebFrame::RenderLayer>, const QRegion& clip);
 #if ENABLE(TILED_BACKING_STORE)
     void renderFromTiledBackingStore(WebCore::GraphicsContext*, const QRegion& clip);
 #endif
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-    void renderCompositedLayers(WebCore::GraphicsContext* context, const WebCore::IntRect& clip);
+    void renderCompositedLayers(WebCore::GraphicsContext*, const WebCore::IntRect& clip);
 #endif
+    void renderFrameExtras(WebCore::GraphicsContext*, QFlags<QWebFrame::RenderLayer>, const QRegion& clip);
+    void emitUrlChanged();
+    void _q_orientationChanged();
+
     QWebFrame *q;
     Qt::ScrollBarPolicy horizontalScrollBarPolicy;
     Qt::ScrollBarPolicy verticalScrollBarPolicy;
     WebCore::FrameLoaderClientQt *frameLoaderClient;
     WebCore::Frame *frame;
     QWebPage *page;
+    WebCore::KURL url;
 
     bool allowsScrolling;
     int marginWidth;
diff --git a/Source/WebKit/qt/Api/qwebkitplatformplugin.h b/Source/WebKit/qt/Api/qwebkitplatformplugin.h
index f274a0b..9a84973 100644
--- a/Source/WebKit/qt/Api/qwebkitplatformplugin.h
+++ b/Source/WebKit/qt/Api/qwebkitplatformplugin.h
@@ -29,7 +29,7 @@
 #include <QColor>
 #include <QObject>
 #include <QUrl>
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
 #include <QMediaPlayer>
 #endif
 
@@ -123,7 +123,7 @@ public:
     virtual unsigned hitTestPaddingForTouch(const PaddingDirection) const = 0;
 };
 
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
 class QWebFullScreenVideoHandler : public QObject {
     Q_OBJECT
 public:
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index ac1d562..2f51e6f 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -747,7 +747,7 @@ void QWebPagePrivate::handleClipboard(QEvent* ev, Qt::MouseButton button)
         WebCore::Frame* focusFrame = page->focusController()->focusedOrMainFrame();
         if (button == Qt::LeftButton) {
             if (focusFrame && (focusFrame->editor()->canCopy() || focusFrame->editor()->canDHTMLCopy())) {
-                focusFrame->editor()->copy();
+                Pasteboard::generalPasteboard()->writeSelection(focusFrame->editor()->selectedRange().get(), focusFrame->editor()->canSmartCopyOrDelete(), focusFrame);
                 ev->setAccepted(true);
             }
         } else if (button == Qt::MidButton) {
@@ -979,8 +979,7 @@ void QWebPagePrivate::dragEnterEvent(T* ev)
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
     Qt::DropAction action = dragOpToDropAction(page->dragController()->dragEntered(&dragData));
     ev->setDropAction(action);
-    if (action != Qt::IgnoreAction)
-        ev->acceptProposedAction();
+    ev->acceptProposedAction();
 #endif
 }
 
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 1a922ad..97d648d 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,671 @@
+2011-04-19  Igor Oliveira  <igor.oliveira@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] X11: Text selection is causing oncopy event to be called
+        https://bugs.webkit.org/show_bug.cgi?id=58656
+
+        Always when text is selected the oncopy event is fired, this behavior does
+        not exist in Firefox or Chrome. Now, when selecting a text, QtWebKit
+        is making multi part-copies (with rich text metadata), the multi-part
+        data can be obtained by data transfer items interface when supported by QtWebKit.
+        Also, copies to the clipboard of a selected image, is not supported by Chrome and
+        Firefox and was removed from QtWebKit.
+
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::handleClipboard):
+
+2011-04-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][WK2] Unreviewed buildfix after r84174.
+
+        * QtWebKit.pro: Missing includepath added.
+
+2011-04-18  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Fix Api test failure -- tst_QWebFrame::inputFieldFocus
+        https://bugs.webkit.org/show_bug.cgi?id=57546
+
+        Disable the fullscreen VKB when testing inputFieldFocus().
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2011-04-18  Andreas Kling  <kling@webkit.org>
+
+        [Qt] DRT: Unreviewed test fix after r84168.
+        
+        Dump the original request KURL for blocked access attempts.
+        Turns out converting it to a QUrl lower-cases the hostname.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchWillSendRequest):
+
+2011-04-18  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix Api tests for QWebPage on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=56924
+
+        Ignores the style attribute that selectedHtml() returns.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::cursorMovements):
+        (tst_QWebPage::textSelection):
+        (tst_QWebPage::findText):
+
+2011-04-18  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION (r84010): [Qt] DRT: Unbreak redirection of http:/ URLs.
+        https://bugs.webkit.org/show_bug.cgi?id=58779
+
+        KURL::host() doesn't return the host part of [broken] http:/ URLs, so use
+        QUrl instead to match the behavior of other ports.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchWillSendRequest):
+
+2011-04-18  Dominic Cooney  <dominicc@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        Add layoutTestController.shadowRoot to Qt DRT.
+        https://bugs.webkit.org/show_bug.cgi?id=58759
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::shadowRoot): Added.
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2011-04-16  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Autotest got missed in the handover of the QML WebView element
+        https://bugs.webkit.org/show_bug.cgi?id=41449
+
+        Importing WebView QML element test cases from Qt repository. I did some
+        style modifications and simplifications in the original code but hopefully
+        without changing the behavior.
+
+        Tests that do not pass are marked with QEXPECT_FAIL or QSKIP. The two major
+        issues currently are:
+
+        - pixelCache() test checked the usage of pixel cache by using a subclass of
+          QDeclarativeWebView. We can't do that right now because this class is not
+          exported. We may need a Q_AUTOTEST_EXPORT thing for QtWebKit if we want
+          this kind of test.
+        - elementAtArea() test uses a function that is not exported. But in this case
+          I think we should test it's user, the public method "heuristicZoom".
+
+        * tests/qdeclarativewebview/resources/basic.html: Added.
+        * tests/qdeclarativewebview/resources/basic.png: Added.
+        * tests/qdeclarativewebview/resources/basic.qml: Added.
+        * tests/qdeclarativewebview/resources/elements.html: Added.
+        * tests/qdeclarativewebview/resources/elements.qml: Added.
+        * tests/qdeclarativewebview/resources/forward.html: Added.
+        * tests/qdeclarativewebview/resources/forward.png: Added.
+        * tests/qdeclarativewebview/resources/javaScript.html: Added.
+        * tests/qdeclarativewebview/resources/javaScript.qml: Added.
+        * tests/qdeclarativewebview/resources/loadError.qml: Added.
+        * tests/qdeclarativewebview/resources/newwindows.html: Added.
+        * tests/qdeclarativewebview/resources/newwindows.qml: Added.
+        * tests/qdeclarativewebview/resources/propertychanges.qml: Added.
+        * tests/qdeclarativewebview/resources/sethtml.qml: Added.
+        * tests/qdeclarativewebview/tst_qdeclarativewebview.cpp:
+        (tst_QDeclarativeWebView::tmpDir):
+        (strippedHtml):
+        (fileContents):
+        (removeRecursive):
+        (tst_QDeclarativeWebView::cleanupTestCase):
+        (tst_QDeclarativeWebView::basicProperties):
+        (tst_QDeclarativeWebView::elementAreaAt):
+        (tst_QDeclarativeWebView::historyNav):
+        (callEvaluateJavaScript):
+        (tst_QDeclarativeWebView::javaScript):
+        (tst_QDeclarativeWebView::loadError):
+        (tst_QDeclarativeWebView::multipleWindows):
+        (tst_QDeclarativeWebView::newWindowComponent):
+        (tst_QDeclarativeWebView::newWindowParent):
+        (tst_QDeclarativeWebView::pressGrabTime):
+        (tst_QDeclarativeWebView::renderingEnabled):
+        (tst_QDeclarativeWebView::setHtml):
+        (tst_QDeclarativeWebView::settings):
+        (tst_QDeclarativeWebView::checkNoErrors):
+        * tests/qdeclarativewebview/tst_qdeclarativewebview.qrc:
+
+2011-04-08  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPage MIME type handling inconsistency with other web browsers
+        https://bugs.webkit.org/show_bug.cgi?id=46968
+
+        Implementing mime type sniffing based on
+        http://tools.ietf.org/html/draft-abarth-mime-sniff-06.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createNetworkingContext):
+        * WebCoreSupport/FrameNetworkingContextQt.cpp:
+        (WebCore::FrameNetworkingContextQt::FrameNetworkingContextQt):
+        (WebCore::FrameNetworkingContextQt::create):
+        (WebCore::FrameNetworkingContextQt::MIMESniffingEnabled):
+        * WebCoreSupport/FrameNetworkingContextQt.h:
+        * tests/MIMESniffing/MIMESniffing.pro: Added.
+        * tests/MIMESniffing/TestData.h: Added.
+        * tests/MIMESniffing/resources.qrc: Added.
+        * tests/MIMESniffing/resources/application_atom+xml: Added.
+        * tests/MIMESniffing/resources/application_ogg: Added.
+        * tests/MIMESniffing/resources/application_pdf: Added.
+        * tests/MIMESniffing/resources/application_postscript: Added.
+        * tests/MIMESniffing/resources/application_rdf+xml: Added.
+        * tests/MIMESniffing/resources/application_rss+xml: Added.
+        * tests/MIMESniffing/resources/application_x-gzip: Added.
+        * tests/MIMESniffing/resources/application_x-rar-compressed: Added.
+        * tests/MIMESniffing/resources/application_zip: Added.
+        * tests/MIMESniffing/resources/audio_x-wave: Added.
+        * tests/MIMESniffing/resources/image_bmp: Added.
+        * tests/MIMESniffing/resources/image_gif: Added.
+        * tests/MIMESniffing/resources/image_jpeg: Added.
+        * tests/MIMESniffing/resources/image_png: Added.
+        * tests/MIMESniffing/resources/image_vnd.microsoft.icon: Added.
+        * tests/MIMESniffing/resources/image_webp: Added.
+        * tests/MIMESniffing/resources/text_html: Added.
+        * tests/MIMESniffing/resources/text_xml: Added.
+        * tests/MIMESniffing/resources/video_webm: Added.
+        * tests/MIMESniffing/tst_MIMESniffing.cpp: Added.
+        (tst_MIMESniffing::tst_MIMESniffing):
+        (errorText):
+        (tst_MIMESniffing::testCase1):
+        * tests/tests.pro:
+
+2011-04-15  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] DRT: Block access to external URLs.
+
+        Implement the "Blocked access to external URL" behavior for Qt's DRT,
+        based on what other ports are doing.
+
+        Fixes <http://webkit.org/b/57306> and <http://webkit.org/b/58523>.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchWillSendRequest):
+
+2011-01-26  Ragner Magalhaes  <ragner.magalhaes@openbossa.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Web Inspector does not highlight elements
+        https://bugs.webkit.org/show_bug.cgi?id=35125
+
+        Adjust Web inspector to highlight elements on the page when the mouse
+        hovers the element on DOM inspector.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderRelativeCoords):
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::highlight):
+        (WebCore::InspectorClientQt::hideHighlight):
+
+2011-04-12  George Guo  <George.Guo@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] On Symbian got "Update Error" when installing QtWebkit.sis
+        http://bugs.webkit.org/show_bug.cgi?id=58141
+
+        If QtWebKit is already in Symbian ROM, we need package to be
+        both SA and RU type
+
+        * QtWebKit.pro:
+
+2011-04-12  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Private Q_SLOTS void orientationChanged() can't be in qwebframe.h public header file.
+        https://bugs.webkit.org/show_bug.cgi?id=58251
+
+        Fix an issue with slot names after http://trac.webkit.org/changeset/83512.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::QWebFrame):
+
+2011-04-11  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Private Q_SLOTS void orientationChanged() can't be in qwebframe.h public header file.
+        https://bugs.webkit.org/show_bug.cgi?id=58251
+
+        Qt coding conventions states that private slots should be located in private implementation of
+        the class. This allows us to rename/delete the slots in the future without breaking anything.
+
+        No new tests added, just a simple refactoring.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::_q_orientationChanged):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+
+2011-04-11  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Sub-Frame content is not updated when scrolling in certain circumstances
+        https://bugs.webkit.org/show_bug.cgi?id=50373
+
+        Make sure that we invalidate the backing store when using TILED_BACKING_STORE
+        and the page contains sub frames. This bug appears only when frame flattening is
+        disabled and scrollable subframes.
+
+        Original patch from Thomas Thrainer.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::invalidateWindow):
+
+2011-04-11  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] HTML5 Drag and Drop demos not working
+        https://bugs.webkit.org/show_bug.cgi?id=56486
+
+        Handling the drop with JavaScript was not working with Qt because if the action is ignored
+        in response to DragEnter, no further events are sent to the view.
+
+        Drag and drop is defined and used differently by webpages. The drag move events are determining
+        what action should take place. To adopt this behavior for Qt, we always accept drag enter events
+        on the widget.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::dragEnterEvent):
+
+2011-04-11  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] REGRESSION(83122): tst_QWebElement::style() fails
+        https://bugs.webkit.org/show_bug.cgi?id=58032
+
+        According to the documentation of QWebElement the styleProperty method should
+        not respect style inheritance and other CSS rules for the InlineStyle enum.
+
+        r83122 fixed this behaviour.
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style): Fix the expected color for QWebElement::InlineStyle.
+
+2011-04-11  Andreas Kling  <andreas.kling@nokia.com>
+
+        Build fix after r83436.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidReceiveResponse):
+
+2011-04-11  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] dumpResourceResponseMIMETypes shouldn't strip URL query string.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidReceiveResponse): Use KURL::lastPathComponent()
+        for the dumpResourceResponseMIMETypes display string instead of QFileInfo::fileName().
+        This is in line with the Mac port.
+
+2011-04-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r83295.
+        http://trac.webkit.org/changeset/83295
+        https://bugs.webkit.org/show_bug.cgi?id=58144
+
+        Broke 4 tests in QtWebKit (Requested by tonikitoo on #webkit).
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleInputMethodKeydown):
+
+2011-04-08  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt]REGRESSION(r82243): fast/events/onsearch-enter.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=57472
+
+        Avoid to insert new line for both keydown event & keypress event.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleInputMethodKeydown):
+
+2011-04-07  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] QWebFrame::setUrl works only from second time if url fragment is present
+        https://bugs.webkit.org/show_bug.cgi?id=32723
+
+        When clearing the frame, instead of using the URL passed to QWebFrame::setUrl(),
+        use an invalid URL (the begin() without arguments). Clearing the document
+        with the same URL was causing problems when we had a fragment because it assume that
+        only scrolling was enough and did not loaded the document again.
+
+        When setUrl() is called but fails, url() is expected to return the requested value. The
+        begin(url) guaranteed that before. This patch adds a member to track the URL, which is
+        updated when the URL changes and also when setUrl() is called.
+
+        KURL was used for the member so that when setUrl() is called, and then url() is checked
+        before the page gets loaded, we perform the same conversion that will be performed by a
+        successful load, e.g. add trailing '/' to an address. This behavior is checked by
+        tst_QWebFrame::requestedUrl() test.
+
+        For the record: the second QWebPage::setUrl() worked because the load was considered a
+        FrameLoadTypeSame, and because of that, was not fit for just scrolling, a reload was
+        needed. See FrameLoader::shouldScrollToAnchor() for details on this classification.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::emitUrlChanged): update our URL member and emit the signal.
+        (clearCoreFrame):
+        (isCoreFrameClear):
+        (QWebFrame::setUrl):
+        (QWebFrame::url):
+        (QWebFrame::baseUrl): look in the document for the baseURL since its contents can change
+        the baseURL, e.g. by using the <base> tag.
+        * Api/qwebframe_p.h:
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidChangeLocationWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidCommitLoad):
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (tst_QWebFrame::setUrlWithFragment): unskip test.
+
+2011-04-07  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Build fix when using Phonon as a backend for the multimedia support.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::ChromeClientQt):
+        (WebCore::ChromeClientQt::~ChromeClientQt):
+        * WebCoreSupport/ChromeClientQt.h:
+
+2011-04-06  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] LayoutTestController needs to implement numberOfPendingGeolocationPermissionRequests
+        https://bugs.webkit.org/show_bug.cgi?id=56086
+
+        Add the accessor numberOfPendingGeolocationPermissionRequests to call GeolocationClientMock::numberOfPendingPermissionRequests()
+        from the LayoutTestController.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::numberOfPendingGeolocationPermissionRequests):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2011-04-06  Anders Bakken  <agbakken@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] FrameLoaderClientQt.cpp has coding-style errors
+        https://bugs.webkit.org/show_bug.cgi?id=40254
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (drtDescriptionSuitableForTestResult):
+        (WebCore::FrameLoaderClientQt::hasWebView):
+        (WebCore::FrameLoaderClientQt::setCopiesOnScroll):
+        (WebCore::FrameLoaderClientQt::dispatchDidHandleOnloadEvents):
+        (WebCore::FrameLoaderClientQt::dispatchDidReceiveTitle):
+        (WebCore::FrameLoaderClientQt::dispatchDidChangeIcons):
+        (WebCore::FrameLoaderClientQt::cancelPolicyCheck):
+        (WebCore::FrameLoaderClientQt::dispatchWillSubmitForm):
+        (WebCore::FrameLoaderClientQt::postProgressStartedNotification):
+        (WebCore::FrameLoaderClientQt::postProgressFinishedNotification):
+        (WebCore::FrameLoaderClientQt::setMainFrameDocumentReady):
+        (WebCore::FrameLoaderClientQt::willChangeTitle):
+        (WebCore::FrameLoaderClientQt::didChangeTitle):
+        (WebCore::FrameLoaderClientQt::finishedLoading):
+        (WebCore::FrameLoaderClientQt::frameLoadCompleted):
+        (WebCore::FrameLoaderClientQt::provisionalLoadStarted):
+        (WebCore::FrameLoaderClientQt::didFinishLoad):
+        (WebCore::FrameLoaderClientQt::setTitle):
+        (WebCore::FrameLoaderClientQt::dispatchDidReceiveIcon):
+        (WebCore::FrameLoaderClientQt::dispatchDidClearWindowObjectInWorld):
+        (WebCore::FrameLoaderClientQt::updateGlobalHistory):
+        (WebCore::FrameLoaderClientQt::shouldGoToHistoryItem):
+        (WebCore::FrameLoaderClientQt::shouldStopLoadingForHistoryItem):
+        (WebCore::FrameLoaderClientQt::committedLoad):
+        (WebCore::FrameLoaderClientQt::download):
+        (WebCore::FrameLoaderClientQt::dispatchWillSendRequest):
+        (WebCore::FrameLoaderClientQt::shouldUseCredentialStorage):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForResponse):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction):
+        (WebCore::FrameLoaderClientQt::createFrame):
+        (WebCore::FrameLoaderClientQt::objectContentType):
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2011-04-06  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] We should use USE(QT_MULTIMEDIA) rather than ENABLE(QT_MULTIMEDIA).
+        https://bugs.webkit.org/show_bug.cgi?id=57974
+
+        We should use USE(QT_MULTIMEDIA) rather than ENABLE(QT_MULTIMEDIA).
+
+        No new tests needed, just a config flag rename.
+
+        * Api/qwebkitplatformplugin.h:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::mediaContentUrlByElementId):
+        * WebCoreSupport/FullScreenVideoQt.cpp:
+        (WebCore::FullScreenVideoQt::FullScreenVideoQt):
+        (WebCore::FullScreenVideoQt::~FullScreenVideoQt):
+        (WebCore::FullScreenVideoQt::enterFullScreenForNode):
+        (WebCore::FullScreenVideoQt::exitFullScreenForNode):
+        (WebCore::FullScreenVideoQt::requiresFullScreenForVideoPlayback):
+        (WebCore::FullScreenVideoQt::isValid):
+        * WebCoreSupport/FullScreenVideoQt.h:
+        * WebCoreSupport/QtPlatformPlugin.cpp:
+        * WebCoreSupport/QtPlatformPlugin.h:
+        * examples/platformplugin/WebPlugin.cpp:
+        (WebPlugin::supportsExtension):
+        (WebPlugin::createExtension):
+        * examples/platformplugin/WebPlugin.h:
+        * examples/platformplugin/platformplugin.pro:
+        * examples/platformplugin/qwebkitplatformplugin.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadHtml5Video):
+        * tests/tests.pri:
+
+2011-04-06  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Implement fullscreen playback for the GStreamer backend.
+        https://bugs.webkit.org/show_bug.cgi?id=56826
+
+        Implement support for fullscreen playback when building the
+        Qt port with the GStreamer backend (DEFINES+=USE_GSTREAMER=1).
+        The implementation is done in FullScreenVideoQt alongside with
+        the Qt Multimedia support.
+
+        No new tests because layout tests cover it. They are not yet activated
+        but will be any time soon.
+
+        * QtWebKit.pro:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::ChromeClientQt):
+        (WebCore::ChromeClientQt::~ChromeClientQt):
+        (WebCore::ChromeClientQt::enterFullscreenForNode):
+        (WebCore::ChromeClientQt::exitFullscreenForNode):
+        * WebCoreSupport/ChromeClientQt.h:
+        * WebCoreSupport/FullScreenVideoQt.cpp:
+        (WebCore::GStreamerFullScreenVideoHandler::GStreamerFullScreenVideoHandler):
+        (WebCore::GStreamerFullScreenVideoHandler::setVideoElement):
+        (WebCore::GStreamerFullScreenVideoHandler::enterFullScreen):
+        (WebCore::GStreamerFullScreenVideoHandler::windowClosed):
+        (WebCore::GStreamerFullScreenVideoHandler::exitFullScreen):
+        (WebCore::DefaultFullScreenVideoHandler::DefaultFullScreenVideoHandler):
+        (WebCore::FullScreenVideoQt::FullScreenVideoQt):
+        (WebCore::FullScreenVideoQt::~FullScreenVideoQt):
+        (WebCore::FullScreenVideoQt::enterFullScreenForNode):
+        (WebCore::FullScreenVideoQt::exitFullScreenForNode):
+        (WebCore::FullScreenVideoQt::requiresFullScreenForVideoPlayback):
+        (WebCore::FullScreenVideoQt::isValid):
+        * WebCoreSupport/FullScreenVideoQt.h:
+        (WebCore::GStreamerFullScreenVideoHandler::~GStreamerFullScreenVideoHandler):
+
+2011-04-06  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Improve tests for QWebFrame::url() and related methods
+        https://bugs.webkit.org/show_bug.cgi?id=57865
+
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (FakeReply::FakeReply): make more URLs reply HostNotFound. We needed two different URLs in the test.
+        (tst_QWebFrame::requestedUrlAfterSetAndLoadFailures): check the properties after an setUrl()
+        that fails and a load() that fails (for a different URL).
+
+        (tst_QWebFrame::setUrlWithFragment_data):
+        (tst_QWebFrame::setUrlWithFragment): add other test cases similar to the original, but changing
+        the URL in the frame before the test starts.
+
+        (tst_QWebFrame::setUrlSameUrl): document existing behavior of calling setUrl() twice with
+        the same URL as argument.
+
+        (extractBaseUrl):
+        (tst_QWebFrame::setUrlThenLoads_data):
+        (tst_QWebFrame::setUrlThenLoads): check the URL related properties of the frame after a
+        sequence of set and loads. Those tests are interesting because the properties
+        react different to setUrl() and load(): 'requestedUrl' always change, 'url' only when setUrl()
+        is used or after the load() is committed and baseUrl() is similar to url() but also depends
+        on the contents of the page when it loads.
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+        
+        * WebCoreSupport/EditorClientQt.h:
+        (WebCore::EditorClientQt::requestCheckingOfString):
+
+2011-04-04  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        setContentEditable with true/false/inherit string is not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=52058
+
+        Move isContentEditable from HTMLElement to Node. WebKit should only access isContentEditable
+        as rendererIsEditable is for WebCore internal use.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleKeyboardEvent):
+
+2011-04-01  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        Changed QWebFramePrivate::renderFromTiledBackingStore to call directly into
+        Scrollbar/PanIcon rendering, bypassing the potential relayout in renderRelativeCoords.
+
+        Tiled painting still causes synchronous layout when
+        accelerated compositing and texture mapper are enabled
+        https://bugs.webkit.org/show_bug.cgi?id=56929
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderFromTiledBackingStore):
+        (QWebFramePrivate::renderRelativeCoords):
+        (QWebFramePrivate::renderFrameWidgets):
+        * Api/qwebframe_p.h:
+
+2011-04-01  Nancy Piedra  <nancy.piedra@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] DragClientQt.h has coding-style errors
+        https://bugs.webkit.org/show_bug.cgi?id=40425
+
+        * WebCoreSupport/DragClientQt.h:
+
+2011-03-31  Marius Storm-Olsen  <marius.storm-olsen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Properly detect phonon include, and avoid double qtLibraryTarget() call
+        https://bugs.webkit.org/show_bug.cgi?id=57017
+
+        Build fix. No new tests.
+
+        * QtWebKit.pro:
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Another build fix.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::updateGlobalHistory):
+
+2011-03-31  Nancy Piedra  <nancy.piedra@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] ChromeClientQt.h has coding-style errors
+        https://bugs.webkit.org/show_bug.cgi?id=40239
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::scrollbarsModeDidChange):
+        (WebCore::ChromeClientQt::needTouchEvents):
+        (WebCore::ChromeClientQt::formStateDidChange):
+        (WebCore::ChromeClientQt::scrollRectIntoView):
+        (WebCore::ChromeClientQt::requestGeolocationPermissionForFrame):
+        (WebCore::ChromeClientQt::cancelGeolocationPermissionRequestForFrame):
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Build fix from previous change.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::title):
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidReceiveTitle):
+        (WebCore::FrameLoaderClientQt::setTitle):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2011-03-30  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt][Symbian] Fix Api test failure -- tst_QWebView::focusInputTypes
+        https://bugs.webkit.org/show_bug.cgi?id=57020
+
+        Added a macro 'VERIFY_INPUTMETHOD_HINTS' to test inputmethodhints().
+
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::focusInputTypes):
+
 2011-03-30  Robert Hogan  <robert@webkit.org>
 
         Reviewed by Antonio Gomes.
diff --git a/Source/WebKit/qt/QtWebKit.pro b/Source/WebKit/qt/QtWebKit.pro
index 8836c4a..7529ace 100644
--- a/Source/WebKit/qt/QtWebKit.pro
+++ b/Source/WebKit/qt/QtWebKit.pro
@@ -31,6 +31,7 @@ include($$SOURCE_DIR/JavaScriptCore/JavaScriptCore.pri)
 webkit2 {
     include($$SOURCE_DIR/WebKit2/WebKit2.pri)
     include($$SOURCE_DIR/WebKit2/WebKit2API.pri)
+    INCLUDEPATH += $$OUTPUT_DIR/WebKit2/generated
 }
 include($$SOURCE_DIR/WebCore/WebCore.pri)
 
@@ -104,6 +105,11 @@ symbian {
     } else {
         TARGET.UID3 = 0xE00267C2
     }
+    
+    sisheader = "; SIS header: name, uid, version" \
+                "$${LITERAL_HASH}{\"$$TARGET\"},($$TARGET.UID3),$$QT_WEBKIT_MAJOR_VERSION,$$QT_WEBKIT_MINOR_VERSION,$$QT_WEBKIT_PATCH_VERSION,TYPE=SA,RU"
+    webkitsisheader.pkg_prerules = sisheader
+
     webkitlibs.sources = QtWebKit$${QT_LIBINFIX}.dll
     v8:webkitlibs.sources += v8.dll
 
@@ -128,7 +134,7 @@ symbian {
          DEPLOYMENT += declarativeImport
     }
 
-    DEPLOYMENT += webkitlibs webkitbackup
+    DEPLOYMENT += webkitsisheader webkitlibs webkitbackup
     !CONFIG(production):CONFIG-=def_files
 
     # Need to build these sources here because of exported symbols
@@ -211,13 +217,13 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
 contains(DEFINES, ENABLE_VIDEO=1) {
     !contains(DEFINES, USE_GSTREAMER=1):contains(MOBILITY_CONFIG, multimedia) {
-        HEADERS += \
-            $$PWD/WebCoreSupport/FullScreenVideoQt.h \
-            $$PWD/WebCoreSupport/FullScreenVideoWidget.h
+        HEADERS += $$PWD/WebCoreSupport/FullScreenVideoWidget.h
+        SOURCES += $$PWD/WebCoreSupport/FullScreenVideoWidget.cpp
+    }
 
-        SOURCES += \
-            $$PWD/WebCoreSupport/FullScreenVideoQt.cpp \
-            $$PWD/WebCoreSupport/FullScreenVideoWidget.cpp
+    contains(DEFINES, USE_GSTREAMER=1) | contains(MOBILITY_CONFIG, multimedia) {
+        HEADERS += $$PWD/WebCoreSupport/FullScreenVideoQt.h
+        SOURCES += $$PWD/WebCoreSupport/FullScreenVideoQt.cpp
     }
 }
 
@@ -322,7 +328,7 @@ contains(CONFIG, texmap) {
 
                 CONFIG += build_all
             } else {
-                debug_and_release:TARGET = $$qtLibraryTarget($$TARGET)
+                isEmpty(QT_SOURCE_TREE):debug_and_release:TARGET = $$qtLibraryTarget($$TARGET)
             }
 
             CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index bec4bc4..ea2c826 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -75,13 +75,15 @@
 #include <qtooltip.h>
 #include <wtf/OwnPtr.h>
 
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA))
 #include "FullScreenVideoQt.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "HTMLVideoElement.h"
+#if USE(QT_MULTIMEDIA)
 #include "MediaPlayerPrivateQt.h"
 #endif
+#endif
 
 namespace WebCore {
 
@@ -90,7 +92,7 @@ bool ChromeClientQt::dumpVisitedLinksCallbacks = false;
 ChromeClientQt::ChromeClientQt(QWebPage* webPage)
     : m_webPage(webPage)
     , m_eventLoop(0)
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA))
     , m_fullScreenVideo(0)
 #endif
 {
@@ -102,7 +104,7 @@ ChromeClientQt::~ChromeClientQt()
     if (m_eventLoop)
         m_eventLoop->exit();
 
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA))
     delete m_fullScreenVideo;
 #endif
 }
@@ -397,9 +399,18 @@ IntRect ChromeClientQt::windowResizerRect() const
 #endif
 }
 
-void ChromeClientQt::invalidateWindow(const IntRect&, bool)
+void ChromeClientQt::invalidateWindow(const IntRect& windowRect, bool)
 {
-    notImplemented();
+#if ENABLE(TILED_BACKING_STORE)
+    if (platformPageClient()) {
+        WebCore::TiledBackingStore* backingStore = QWebFramePrivate::core(m_webPage->mainFrame())->tiledBackingStore();
+        if (!backingStore)
+            return;
+        backingStore->invalidate(windowRect);
+    }
+#else
+    Q_UNUSED(windowRect);
+#endif
 }
 
 void ChromeClientQt::invalidateContentsAndWindow(const IntRect& windowRect, bool immediate)
@@ -650,7 +661,7 @@ IntRect ChromeClientQt::visibleRectForTiledBackingStore() const
 }
 #endif
 
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA))
 FullScreenVideoQt* ChromeClientQt::fullScreenVideo()
 {
     if (!m_fullScreenVideo)
@@ -673,13 +684,6 @@ void ChromeClientQt::enterFullscreenForNode(Node* node)
 {
     ASSERT(node && node->hasTagName(HTMLNames::videoTag));
 
-    HTMLVideoElement* videoElement = static_cast<HTMLVideoElement*>(node);
-    PlatformMedia platformMedia = videoElement->platformMedia();
-
-    ASSERT(platformMedia.type == PlatformMedia::QtMediaPlayerType);
-    if (platformMedia.type != PlatformMedia::QtMediaPlayerType)
-        return;
-
     fullScreenVideo()->enterFullScreenForNode(node);
 }
 
@@ -687,13 +691,6 @@ void ChromeClientQt::exitFullscreenForNode(Node* node)
 {
     ASSERT(node && node->hasTagName(HTMLNames::videoTag));
 
-    HTMLVideoElement* videoElement = static_cast<HTMLVideoElement*>(node);
-    PlatformMedia platformMedia = videoElement->platformMedia();
-
-    ASSERT(platformMedia.type == PlatformMedia::QtMediaPlayerType);
-    if (platformMedia.type != PlatformMedia::QtMediaPlayerType)
-        return;
-
     fullScreenVideo()->exitFullScreenForNode(node);
 } 
 #endif
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index a12c2ec..c69daf5 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -26,15 +26,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ChromeClientQt_H
-#define ChromeClientQt_H
+#ifndef ChromeClientQt_h
+#define ChromeClientQt_h
 
 #include "ChromeClient.h"
 #include "FloatRect.h"
-#include "RefCounted.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "QtPlatformPlugin.h"
+#include <wtf/RefCounted.h>
 
 QT_BEGIN_NAMESPACE
 class QEventLoop;
@@ -44,176 +44,172 @@ class QWebPage;
 
 namespace WebCore {
 
-    class FileChooser;
-    class FloatRect;
-    class Page;
-    struct FrameLoadRequest;
-    class QtAbstractWebPopup;
-    struct ViewportArguments;
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
-    class FullScreenVideoQt;
+class FileChooser;
+class FloatRect;
+class Page;
+struct FrameLoadRequest;
+class QtAbstractWebPopup;
+struct ViewportArguments;
+#if ENABLE(VIDEO)
+class FullScreenVideoQt;
 #endif
 
-    class ChromeClientQt : public ChromeClient
-    {
-    public:
-        ChromeClientQt(QWebPage* webPage);
-        virtual ~ChromeClientQt();
-        virtual void chromeDestroyed();
+class ChromeClientQt : public ChromeClient {
+public:
+    ChromeClientQt(QWebPage*);
+    virtual ~ChromeClientQt();
+    virtual void chromeDestroyed();
 
-        virtual void setWindowRect(const FloatRect&);
-        virtual FloatRect windowRect();
+    virtual void setWindowRect(const FloatRect&);
+    virtual FloatRect windowRect();
 
-        virtual FloatRect pageRect();
+    virtual FloatRect pageRect();
 
-        virtual float scaleFactor();
+    virtual float scaleFactor();
 
-        virtual void focus();
-        virtual void unfocus();
+    virtual void focus();
+    virtual void unfocus();
 
-        virtual bool canTakeFocus(FocusDirection);
-        virtual void takeFocus(FocusDirection);
+    virtual bool canTakeFocus(FocusDirection);
+    virtual void takeFocus(FocusDirection);
 
-        virtual void focusedNodeChanged(Node*);
-        virtual void focusedFrameChanged(Frame*);
+    virtual void focusedNodeChanged(Node*);
+    virtual void focusedFrameChanged(Frame*);
 
-        virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&, const NavigationAction&);
-        virtual void show();
+    virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&, const NavigationAction&);
+    virtual void show();
 
-        virtual bool canRunModal();
-        virtual void runModal();
+    virtual bool canRunModal();
+    virtual void runModal();
 
-        virtual void setToolbarsVisible(bool);
-        virtual bool toolbarsVisible();
+    virtual void setToolbarsVisible(bool);
+    virtual bool toolbarsVisible();
 
-        virtual void setStatusbarVisible(bool);
-        virtual bool statusbarVisible();
+    virtual void setStatusbarVisible(bool);
+    virtual bool statusbarVisible();
 
-        virtual void setScrollbarsVisible(bool);
-        virtual bool scrollbarsVisible();
+    virtual void setScrollbarsVisible(bool);
+    virtual bool scrollbarsVisible();
 
-        virtual void setMenubarVisible(bool);
-        virtual bool menubarVisible();
+    virtual void setMenubarVisible(bool);
+    virtual bool menubarVisible();
 
-        virtual void setResizable(bool);
+    virtual void setResizable(bool);
 
-        virtual void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message,
-                                         unsigned int lineNumber, const String& sourceID);
+    virtual void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID);
 
-        virtual bool canRunBeforeUnloadConfirmPanel();
-        virtual bool runBeforeUnloadConfirmPanel(const String& message, Frame* frame);
+    virtual bool canRunBeforeUnloadConfirmPanel();
+    virtual bool runBeforeUnloadConfirmPanel(const String& message, Frame*);
 
-        virtual void closeWindowSoon();
+    virtual void closeWindowSoon();
 
-        virtual void runJavaScriptAlert(Frame*, const String&);
-        virtual bool runJavaScriptConfirm(Frame*, const String&);
-        virtual bool runJavaScriptPrompt(Frame*, const String& message, const String& defaultValue, String& result);
-        virtual bool shouldInterruptJavaScript();
+    virtual void runJavaScriptAlert(Frame*, const String&);
+    virtual bool runJavaScriptConfirm(Frame*, const String&);
+    virtual bool runJavaScriptPrompt(Frame*, const String& message, const String& defaultValue, String& result);
+    virtual bool shouldInterruptJavaScript();
 
-        virtual void setStatusbarText(const String&);
+    virtual void setStatusbarText(const String&);
 
-        virtual WebCore::KeyboardUIMode keyboardUIMode();
-        virtual IntRect windowResizerRect() const;
+    virtual KeyboardUIMode keyboardUIMode();
+    virtual IntRect windowResizerRect() const;
 
-        virtual void invalidateWindow(const IntRect&, bool);
-        virtual void invalidateContentsAndWindow(const IntRect&, bool);
-        virtual void invalidateContentsForSlowScroll(const IntRect&, bool);
-        virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
+    virtual void invalidateWindow(const IntRect&, bool);
+    virtual void invalidateContentsAndWindow(const IntRect&, bool);
+    virtual void invalidateContentsForSlowScroll(const IntRect&, bool);
+    virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
 #if ENABLE(TILED_BACKING_STORE)
-        virtual void delegatedScrollRequested(const IntPoint& scrollPoint);
+    virtual void delegatedScrollRequested(const IntPoint& scrollPoint);
 #endif
 
-        virtual IntPoint screenToWindow(const IntPoint&) const;
-        virtual IntRect windowToScreen(const IntRect&) const;
-        virtual PlatformPageClient platformPageClient() const;
-        virtual void contentsSizeChanged(Frame*, const IntSize&) const;
+    virtual IntPoint screenToWindow(const IntPoint&) const;
+    virtual IntRect windowToScreen(const IntRect&) const;
+    virtual PlatformPageClient platformPageClient() const;
+    virtual void contentsSizeChanged(Frame*, const IntSize&) const;
 
-        virtual void scrollbarsModeDidChange() const { }
-        virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
+    virtual void scrollbarsModeDidChange() const { }
+    virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
 
-        virtual void setToolTip(const String&, TextDirection);
+    virtual void setToolTip(const String&, TextDirection);
 
-        virtual void print(Frame*);
+    virtual void print(Frame*);
 #if ENABLE(DATABASE)
-        virtual void exceededDatabaseQuota(Frame*, const String&);
+    virtual void exceededDatabaseQuota(Frame*, const String&);
 #endif
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
-        virtual void reachedApplicationCacheOriginQuota(SecurityOrigin*);
+    virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
+    virtual void reachedApplicationCacheOriginQuota(SecurityOrigin*);
 #endif
 #if ENABLE(CONTEXT_MENUS)
     virtual void showContextMenu() { }
 #endif
 
 #if ENABLE(NOTIFICATIONS)
-        virtual NotificationPresenter* notificationPresenter() const;
+    virtual NotificationPresenter* notificationPresenter() const;
 #endif
 
 #if USE(ACCELERATED_COMPOSITING)
-        // see ChromeClient.h
-        // this is a hook for WebCore to tell us what we need to do with the GraphicsLayers
-        virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*);
-        virtual void setNeedsOneShotDrawingSynchronization();
-        virtual void scheduleCompositingLayerSync();
-        virtual CompositingTriggerFlags allowedCompositingTriggers() const;
+    // This is a hook for WebCore to tell us what we need to do with the GraphicsLayers.
+    virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*);
+    virtual void setNeedsOneShotDrawingSynchronization();
+    virtual void scheduleCompositingLayerSync();
+    virtual CompositingTriggerFlags allowedCompositingTriggers() const;
 #endif
 
 #if ENABLE(TILED_BACKING_STORE)
-        virtual IntRect visibleRectForTiledBackingStore() const;
+    virtual IntRect visibleRectForTiledBackingStore() const;
 #endif
 
 #if ENABLE(TOUCH_EVENTS)
-        virtual void needTouchEvents(bool) { }
+    virtual void needTouchEvents(bool) { }
 #endif
  
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
-        virtual bool supportsFullscreenForNode(const Node*);
-        virtual void enterFullscreenForNode(Node*);
-        virtual void exitFullscreenForNode(Node*);
-        virtual bool requiresFullscreenForVideoPlayback();
-        FullScreenVideoQt* fullScreenVideo();
+#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA))
+    virtual bool supportsFullscreenForNode(const Node*);
+    virtual void enterFullscreenForNode(Node*);
+    virtual void exitFullscreenForNode(Node*);
+    virtual bool requiresFullscreenForVideoPlayback();
+    FullScreenVideoQt* fullScreenVideo();
 #endif
+     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
+     virtual void chooseIconForFiles(const Vector<String>&, FileChooser*);
 
-        virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
-        virtual void chooseIconForFiles(const Vector<String>&, FileChooser*);
+    virtual void formStateDidChange(const Node*) { }
 
-        virtual void formStateDidChange(const Node*) { }
+    virtual void setCursor(const Cursor&);
 
-        virtual void setCursor(const Cursor&);
+    virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const { }
 
-        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const { }
+    virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) { }
+    virtual void cancelGeolocationPermissionRequestForFrame(Frame*, Geolocation*) { }
 
-        virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) { }
-        virtual void cancelGeolocationPermissionRequestForFrame(Frame*, Geolocation*) { }
+    virtual bool selectItemWritingDirectionIsNatural();
+    virtual bool selectItemAlignmentFollowsMenuWritingDirection();
+    virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const;
+    virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const;
+    virtual void populateVisitedLinks();
 
-        virtual bool selectItemWritingDirectionIsNatural();
-        virtual bool selectItemAlignmentFollowsMenuWritingDirection();
-        virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const;
-        virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const;
-        virtual void populateVisitedLinks();
+    QWebSelectMethod* createSelectPopup() const;
 
-        QWebSelectMethod* createSelectPopup() const;
+    virtual void dispatchViewportDataDidChange(const ViewportArguments&) const;
 
-        virtual void dispatchViewportDataDidChange(const ViewportArguments&) const;
+    QWebPage* m_webPage;
+    KURL lastHoverURL;
+    String lastHoverTitle;
+    String lastHoverContent;
 
-        QWebPage* m_webPage;
-        WebCore::KURL lastHoverURL;
-        WTF::String lastHoverTitle;
-        WTF::String lastHoverContent;
+    bool toolBarsVisible;
+    bool statusBarVisible;
+    bool menuBarVisible;
+    QEventLoop* m_eventLoop;
 
-        bool toolBarsVisible;
-        bool statusBarVisible;
-        bool menuBarVisible;
-        QEventLoop* m_eventLoop;
-
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
-        FullScreenVideoQt* m_fullScreenVideo;
+#if ENABLE(VIDEO) && (USE(GSTREAMER) || USE(QT_MULTIMEDIA))
+    FullScreenVideoQt* m_fullScreenVideo;
 #endif
 
-        static bool dumpVisitedLinksCallbacks;
+    static bool dumpVisitedLinksCallbacks;
 
-        mutable QtPlatformPlugin m_platformPlugin;
-    };
+    mutable QtPlatformPlugin m_platformPlugin;
+};
 }
 
 #endif
diff --git a/Source/WebKit/qt/WebCoreSupport/DragClientQt.h b/Source/WebKit/qt/WebCoreSupport/DragClientQt.h
index 38b463b..15724f1 100644
--- a/Source/WebKit/qt/WebCoreSupport/DragClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/DragClientQt.h
@@ -23,23 +23,28 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#ifndef DragClientQt_h
+#define DragClientQt_h
+
 #include "DragClient.h"
+
 class QWebPage;
+
 namespace WebCore {
 
 class DragClientQt : public DragClient {
 public:
     DragClientQt(QWebPage* webPage) : m_webPage(webPage) {};
-    virtual void willPerformDragDestinationAction(DragDestinationAction,
-                                                  DragData*);
-    virtual WebCore::DragDestinationAction actionMaskForDrag(DragData*);
+    virtual void willPerformDragDestinationAction(DragDestinationAction, DragData*);
+    virtual DragDestinationAction actionMaskForDrag(DragData*);
     virtual void dragControllerDestroyed();
     virtual DragSourceAction dragSourceActionMaskForPoint(const IntPoint&);
     virtual void willPerformDragSourceAction(DragSourceAction, const IntPoint&, Clipboard*);    
-    virtual void startDrag(DragImageRef dragImage, const IntPoint& dragImageOrigin, const IntPoint& eventPos, Clipboard*, Frame*, bool linkDrag = false);
+    virtual void startDrag(DragImageRef, const IntPoint& dragImageOrigin, const IntPoint& eventPos, Clipboard*, Frame*, bool linkDrag = false);
 private:
     QWebPage* m_webPage;
 };
 
 }
 
+#endif
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index ba712d1..81102c3 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -26,6 +26,7 @@
 #include "ApplicationCacheStorage.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "ChromeClientQt.h"
+#include "ContainerNode.h"
 #include "ContextMenu.h"
 #include "ContextMenuClientQt.h"
 #include "ContextMenuController.h"
@@ -82,7 +83,7 @@
 #include "qwebpage_p.h"
 #include "qwebscriptworld.h"
 
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && USE(QT_MULTIMEDIA)
 #include "HTMLVideoElement.h"
 #include "MediaPlayerPrivateQt.h"
 #endif
@@ -822,6 +823,17 @@ void DumpRenderTreeSupportQt::setMockGeolocationError(QWebPage* page, int errorC
 #endif
 }
 
+int DumpRenderTreeSupportQt::numberOfPendingGeolocationPermissionRequests(QWebPage* page)
+{
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    Page* corePage = QWebPagePrivate::core(page);
+    GeolocationClientMock* mockClient = toGeolocationClientMock(corePage->geolocationController()->client());
+    return mockClient->numberOfPendingPermissionRequests();
+#else
+    return -1;
+#endif
+}
+
 bool DumpRenderTreeSupportQt::isTargetItem(const QWebHistoryItem& historyItem)
 {
     QWebHistoryItem it = historyItem;
@@ -1014,7 +1026,7 @@ QUrl DumpRenderTreeSupportQt::mediaContentUrlByElementId(QWebFrame* frame, const
 {
     QUrl res;
 
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && USE(QT_MULTIMEDIA)
     Frame* coreFrame = QWebFramePrivate::core(frame);
     if (!coreFrame)
         return res;
@@ -1052,6 +1064,19 @@ void DumpRenderTreeSupportQt::setAlternateHtml(QWebFrame* frame, const QString&
     coreFrame->loader()->load(request, substituteData, false);
 }
 
+QVariant DumpRenderTreeSupportQt::shadowRoot(const QWebElement& element)
+{
+    WebCore::Element* webElement = element.m_element;
+    if (!webElement)
+        return QVariant();
+
+    ContainerNode* webShadowRoot = webElement->shadowRoot();
+    if (!webShadowRoot)
+        return QVariant();
+
+    return QVariant::fromValue(QDRTNode(webShadowRoot));
+}
+
 // Provide a backward compatibility with previously exported private symbols as of QtWebKit 4.6 release
 
 void QWEBKIT_EXPORT qt_resumeActiveDOMObjects(QWebFrame* frame)
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 78752d8..4be6053 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -147,6 +147,7 @@ public:
     static void setMockGeolocationPermission(QWebPage*, bool allowed);
     static void setMockGeolocationPosition(QWebPage*, double latitude, double longitude, double accuracy);
     static void setMockGeolocationError(QWebPage*, int errorCode, const QString& message);
+    static int numberOfPendingGeolocationPermissionRequests(QWebPage*);
 
     static int workerThreadCount();
 
@@ -199,6 +200,8 @@ public:
 
     static QUrl mediaContentUrlByElementId(QWebFrame*, const QString& elementId);
     static void setAlternateHtml(QWebFrame*, const QString& html, const QUrl& baseUrl, const QUrl& failingUrl);
+
+    static QVariant shadowRoot(const QWebElement&);
 };
 
 #endif
diff --git a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index e7bbd2c..0110144 100644
--- a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -420,7 +420,7 @@ void EditorClientQt::handleKeyboardEvent(KeyboardEvent* event)
         return;
 
     // FIXME: refactor all of this to use Actions or something like them
-    if (start->rendererIsEditable()) {
+    if (start->isContentEditable()) {
         bool doSpatialNavigation = false;
         if (isSpatialNavigationEnabled(frame)) {
             if (!kevent->modifiers()) {
diff --git a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.h b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.h
index 0450603..0d8e8c6 100644
--- a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.h
@@ -109,7 +109,7 @@ public:
     virtual void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(SpellChecker*, int, const String&) {}
+    virtual void requestCheckingOfString(SpellChecker*, int, WebCore::TextCheckingTypeMask, const String&) {}
     virtual TextCheckerClient* textChecker() { return this; }
 
     bool isEditing() const;
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index d318494..d083f8f 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -31,71 +31,72 @@
  */
 
 #include "config.h"
+#include "FrameLoaderClientQt.h"
+
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSPropertyNames.h"
+#include "DocumentLoader.h"
 #include "FormState.h"
-#include "FrameLoaderClientQt.h"
 #include "FrameNetworkingContextQt.h"
 #include "FrameTree.h"
 #include "FrameView.h"
-#include "DocumentLoader.h"
+#include "HTMLAppletElement.h"
+#include "HTMLFormElement.h"
+#include "HTMLPlugInElement.h"
+#include "HTTPParsers.h"
+#include "HistoryItem.h"
 #include "HitTestResult.h"
 #if ENABLE(ICONDATABASE)
 #include "IconDatabaseClientQt.h"
 #endif
 #if USE(JSC)
 #include "JSDOMWindowBase.h"
-#elif USE(V8)
-#include "V8DOMWindow.h"
 #endif
 #include "MIMETypeRegistry.h"
 #include "MouseEvent.h"
-#include "ResourceResponse.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "PluginData.h"
 #include "PluginDatabase.h"
 #include "ProgressTracker.h"
-#include "RenderPart.h"
-#include "ResourceRequest.h"
-#include "HistoryItem.h"
-#include "HTMLAppletElement.h"
-#include "HTMLFormElement.h"
-#include "HTMLPlugInElement.h"
-#include "HTTPParsers.h"
-#include "NotImplemented.h"
 #include "QNetworkReplyHandler.h"
-#include "ResourceHandleInternal.h"
+#include "QWebPageClient.h"
+#include "RenderPart.h"
 #include "ResourceHandle.h"
+#include "ResourceHandleInternal.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "ScriptController.h"
 #include "Settings.h"
-#include "QWebPageClient.h"
+#if USE(V8)
+#include "V8DOMWindow.h"
+#endif
 #include "ViewportArguments.h"
 
-#include "qwebpage.h"
-#include "qwebpage_p.h"
 #include "qwebframe.h"
 #include "qwebframe_p.h"
+#include "qwebhistory_p.h"
 #include "qwebhistoryinterface.h"
+#include "qwebpage.h"
+#include "qwebpage_p.h"
 #include "qwebpluginfactory.h"
 
-#include <qfileinfo.h>
-
 #include <QCoreApplication>
 #include <QDebug>
+#include <QFileInfo>
 #include <QGraphicsScene>
 #include <QGraphicsWidget>
-#include <QNetworkRequest>
 #include <QNetworkReply>
+#include <QNetworkRequest>
 #include <QStringList>
-#include "qwebhistory_p.h"
 #include <wtf/OwnPtr.h>
 
 static QMap<unsigned long, QString> dumpAssignedUrls;
 
-// Compare with WebKitTools/DumpRenderTree/mac/FrameLoadDelegate.mm
-static QString drtDescriptionSuitableForTestResult(WebCore::Frame* _frame)
+// Compare with the file "WebKit/Tools/DumpRenderTree/mac/FrameLoadDelegate.mm".
+static QString drtDescriptionSuitableForTestResult(WebCore::Frame* webCoreFrame)
 {
-    QWebFrame* frame = QWebFramePrivate::kit(_frame);
+    QWebFrame* frame = QWebFramePrivate::kit(webCoreFrame);
     QString name = frame->frameName();
 
     bool isMainFrame = frame == frame->page()->mainFrame();
@@ -103,11 +104,10 @@ static QString drtDescriptionSuitableForTestResult(WebCore::Frame* _frame)
         if (!name.isEmpty())
             return QString::fromLatin1("main frame \"%1\"").arg(name);
         return QLatin1String("main frame");
-    } else {
-        if (!name.isEmpty())
-            return QString::fromLatin1("frame \"%1\"").arg(name);
-        return QLatin1String("frame (anonymous)");
     }
+    if (!name.isEmpty())
+        return QString::fromLatin1("frame \"%1\"").arg(name);
+    return QLatin1String("frame (anonymous)");
 }
 
 static QString drtPrintFrameUserGestureStatus(WebCore::Frame* frame)
@@ -117,12 +117,12 @@ static QString drtPrintFrameUserGestureStatus(WebCore::Frame* frame)
     return QString::fromLatin1("Frame with user gesture \"%1\"").arg(QLatin1String("false"));
 }
 
-static QString drtDescriptionSuitableForTestResult(const WebCore::KURL& _url)
+static QString drtDescriptionSuitableForTestResult(const WebCore::KURL& kurl)
 {
-    if (_url.isEmpty() || !_url.isLocalFile())
-        return _url.string();
-    // Remove the leading path from file urls
-    return QString(_url.string()).remove(WebCore::FrameLoaderClientQt::dumpResourceLoadCallbacksPath).mid(1);
+    if (kurl.isEmpty() || !kurl.isLocalFile())
+        return kurl.string();
+    // Remove the leading path from file urls.
+    return QString(kurl.string()).remove(WebCore::FrameLoaderClientQt::dumpResourceLoadCallbacksPath).mid(1);
 }
 
 static QString drtDescriptionSuitableForTestResult(const WebCore::ResourceError& error)
@@ -166,8 +166,7 @@ static QString drtDescriptionSuitableForTestResult(const RefPtr<WebCore::Node> n
     return result;
 }
 
-namespace WebCore
-{
+namespace WebCore {
 
 bool FrameLoaderClientQt::dumpFrameLoaderCallbacks = false;
 bool FrameLoaderClientQt::dumpUserGestureInFrameLoaderCallbacks = false;
@@ -184,7 +183,7 @@ bool FrameLoaderClientQt::policyDelegateEnabled = false;
 bool FrameLoaderClientQt::policyDelegatePermissive = false;
 QMap<QString, QString> FrameLoaderClientQt::URLsToRedirect = QMap<QString, QString>();
 
-// Taken from DumpRenderTree/chromium/WebViewHost.cpp
+// Taken from the file "WebKit/Tools/DumpRenderTree/chromium/WebViewHost.cpp".
 static const char* navigationTypeToString(NavigationType type)
 {
     switch (type) {
@@ -250,7 +249,7 @@ void FrameLoaderClientQt::callPolicyFunction(FramePolicyFunction function, Polic
 
 bool FrameLoaderClientQt::hasWebView() const
 {
-    //notImplemented();
+    // notImplemented();
     return true;
 }
 
@@ -331,7 +330,7 @@ void FrameLoaderClientQt::forceLayoutForNonHTML()
 
 void FrameLoaderClientQt::setCopiesOnScroll()
 {
-    // apparently mac specific
+    // Apparently this is mac specific.
 }
 
 
@@ -346,7 +345,7 @@ void FrameLoaderClientQt::detachedFromParent3()
 
 void FrameLoaderClientQt::dispatchDidHandleOnloadEvents()
 {
-    // don't need this one
+    // Don't need this one.
     if (dumpFrameLoaderCallbacks)
         printf("%s - didHandleOnloadEventsForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 }
@@ -387,7 +386,7 @@ void FrameLoaderClientQt::dispatchDidChangeLocationWithinPage()
     if (!m_webFrame)
         return;
 
-    emit m_webFrame->urlChanged(m_webFrame->url());
+    m_webFrame->d->emitUrlChanged();
     m_webFrame->page()->d->updateNavigationActions();
 }
 
@@ -447,15 +446,16 @@ void FrameLoaderClientQt::dispatchDidStartProvisionalLoad()
 }
 
 
-void FrameLoaderClientQt::dispatchDidReceiveTitle(const String& title)
+void FrameLoaderClientQt::dispatchDidReceiveTitle(const StringWithDirection& title)
 {
+    // FIXME: Use direction of title.
     if (dumpFrameLoaderCallbacks)
-        printf("%s - didReceiveTitle: %s\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)), qPrintable(QString(title)));
+        printf("%s - didReceiveTitle: %s\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)), qPrintable(QString(title.string())));
 
     if (!m_webFrame)
         return;
 
-    emit titleChanged(title);
+    emit titleChanged(title.string());
 }
 
 
@@ -467,7 +467,7 @@ void FrameLoaderClientQt::dispatchDidChangeIcons()
     if (!m_webFrame)
         return;
 
-    // FIXME: To be notified of changing icon URLS add notification
+    // FIXME: In order to get notified of icon URLS' changes, add a notification.
     // emit iconsChanged();
 }
 
@@ -480,7 +480,7 @@ void FrameLoaderClientQt::dispatchDidCommitLoad()
     if (m_frame->tree()->parent() || !m_webFrame)
         return;
 
-    emit m_webFrame->urlChanged(m_webFrame->url());
+    m_webFrame->d->emitUrlChanged();
     m_webFrame->page()->d->updateNavigationActions();
 
     // We should assume first the frame has no title. If it has, then the above dispatchDidReceiveTitle()
@@ -546,7 +546,7 @@ void FrameLoaderClientQt::dispatchShow()
 
 void FrameLoaderClientQt::cancelPolicyCheck()
 {
-//    qDebug() << "FrameLoaderClientQt::cancelPolicyCheck";
+    // qDebug() << "FrameLoaderClientQt::cancelPolicyCheck";
 }
 
 
@@ -554,7 +554,7 @@ void FrameLoaderClientQt::dispatchWillSubmitForm(FramePolicyFunction function,
                                                  PassRefPtr<FormState>)
 {
     notImplemented();
-    // FIXME: This is surely too simple
+    // FIXME: This is surely too simple.
     callPolicyFunction(function, PolicyUse);
 }
 
@@ -573,7 +573,7 @@ void FrameLoaderClientQt::revertToProvisionalState(DocumentLoader*)
 void FrameLoaderClientQt::postProgressStartedNotification()
 {
     if (m_webFrame && m_frame->page()) {
-        // A new load starts, so lets clear the previous error.
+        // As a new load have started, clear the previous error.
         m_loadError = ResourceError();
         emit loadStarted();
         postProgressEstimateChangedNotification();
@@ -591,9 +591,9 @@ void FrameLoaderClientQt::postProgressEstimateChangedNotification()
 
 void FrameLoaderClientQt::postProgressFinishedNotification()
 {
-    // send a mousemove event to
-    // (1) update the cursor to change according to whatever is underneath the mouse cursor right now
-    // (2) display the tool tip if the mouse hovers a node which has a tool tip
+    // Send a mousemove event to:
+    // (1) update the cursor to change according to whatever is underneath the mouse cursor right now;
+    // (2) display the tool tip if the mouse hovers a node which has a tool tip.
     if (m_frame && m_frame->eventHandler() && m_webFrame->page()) {
         QWidget* view = m_webFrame->page()->view();
         if (view && view->hasFocus()) {
@@ -611,19 +611,19 @@ void FrameLoaderClientQt::postProgressFinishedNotification()
 
 void FrameLoaderClientQt::setMainFrameDocumentReady(bool)
 {
-    // this is only interesting once we provide an external API for the DOM
+    // This is only interesting once we provide an external API for the DOM.
 }
 
 
 void FrameLoaderClientQt::willChangeTitle(DocumentLoader*)
 {
-    // no need for, dispatchDidReceiveTitle is the right callback
+    // No need for, dispatchDidReceiveTitle is the right callback.
 }
 
 
 void FrameLoaderClientQt::didChangeTitle(DocumentLoader*)
 {
-    // no need for, dispatchDidReceiveTitle is the right callback
+    // No need for, dispatchDidReceiveTitle is the right callback.
 }
 
 
@@ -631,8 +631,8 @@ void FrameLoaderClientQt::finishedLoading(DocumentLoader* loader)
 {
     if (!m_pluginView) {
         // This is necessary to create an empty document. See bug 634004.
-        // However, we only want to do this if makeRepresentation has been called, to
-        // match the behavior on the Mac.
+        // However, we only want to do this if makeRepresentation has been called,
+        // to match the behavior on the Mac.
         if (m_hasRepresentation)
             loader->writer()->setEncoding("", false);
         return;
@@ -681,7 +681,7 @@ String FrameLoaderClientQt::generatedMIMETypeForURLScheme(const String&) const
 
 void FrameLoaderClientQt::frameLoadCompleted()
 {
-    // Note: Can be called multiple times.
+    // Note that this can be called multiple times.
 }
 
 
@@ -695,13 +695,13 @@ void FrameLoaderClientQt::restoreViewState()
 
 void FrameLoaderClientQt::provisionalLoadStarted()
 {
-    // don't need to do anything here
+    // Don't need to do anything here.
 }
 
 
 void FrameLoaderClientQt::didFinishLoad()
 {
-//     notImplemented();
+    // notImplemented();
 }
 
 
@@ -709,16 +709,17 @@ void FrameLoaderClientQt::prepareForDataSourceReplacement()
 {
 }
 
-void FrameLoaderClientQt::setTitle(const String& title, const KURL& url)
+void FrameLoaderClientQt::setTitle(const StringWithDirection& title, const KURL& url)
 {
     // Used by Apple WebKit to update the title of an existing history item.
     // QtWebKit doesn't accomodate this on history items. If it ever does,
-    // it should be privateBrowsing-aware.For now, we are just passing
+    // it should be privateBrowsing-aware. For now, we are just passing
     // globalhistory layout tests.
+    // FIXME: Use direction of title.
     if (dumpHistoryCallbacks) {
         printf("WebView updated the title for history URL \"%s\" to \"%s\".\n",
             qPrintable(drtDescriptionSuitableForTestResult(url)),
-            qPrintable(QString(title)));
+            qPrintable(QString(title.string())));
     }
 }
 
@@ -733,9 +734,8 @@ String FrameLoaderClientQt::userAgent(const KURL& url)
 
 void FrameLoaderClientQt::dispatchDidReceiveIcon()
 {
-    if (m_webFrame) {
+    if (m_webFrame)
         emit m_webFrame->iconChanged();
-    }
 }
 
 void FrameLoaderClientQt::frameLoaderDestroyed()
@@ -757,9 +757,8 @@ void FrameLoaderClientQt::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* w
     if (world != mainThreadNormalWorld())
         return;
 
-    if (m_webFrame) {
+    if (m_webFrame)
         emit m_webFrame->javaScriptWindowObjectCleared();
-    }
 }
 
 void FrameLoaderClientQt::documentElementAvailable()
@@ -795,7 +794,7 @@ void FrameLoaderClientQt::onIconLoadedForPageURL(const QString& url)
 
 void FrameLoaderClientQt::updateGlobalHistory()
 {
-    QWebHistoryInterface *history = QWebHistoryInterface::defaultInterface();
+    QWebHistoryInterface* history = QWebHistoryInterface::defaultInterface();
     WebCore::DocumentLoader* loader = m_frame->loader()->documentLoader();
     if (history)
         history->addHistoryEntry(loader->urlForHistory().prettyURL());
@@ -803,7 +802,7 @@ void FrameLoaderClientQt::updateGlobalHistory()
     if (dumpHistoryCallbacks) {
         printf("WebView navigated to url \"%s\" with title \"%s\" with HTTP equivalent method \"%s\".  The navigation was %s and was %s%s.\n",
             qPrintable(drtDescriptionSuitableForTestResult(loader->urlForHistory())),
-            qPrintable(QString(loader->title())),
+            qPrintable(QString(loader->title().string())),
             qPrintable(QString(loader->request().httpMethod())),
             ((loader->substituteData().isValid() || (loader->response().httpStatusCode() >= 400)) ? "a failure" : "successful"),
             ((!loader->clientRedirectSourceForHistory().isEmpty()) ? "a client redirect from " : "not a client redirect"),
@@ -840,12 +839,12 @@ void FrameLoaderClientQt::updateGlobalHistoryRedirectLinks()
     }
 }
 
-bool FrameLoaderClientQt::shouldGoToHistoryItem(WebCore::HistoryItem *) const
+bool FrameLoaderClientQt::shouldGoToHistoryItem(WebCore::HistoryItem*) const
 {
     return true;
 }
 
-bool FrameLoaderClientQt::shouldStopLoadingForHistoryItem(WebCore::HistoryItem *) const
+bool FrameLoaderClientQt::shouldStopLoadingForHistoryItem(WebCore::HistoryItem*) const
 {
     return true;
 }
@@ -905,13 +904,13 @@ void FrameLoaderClientQt::committedLoad(WebCore::DocumentLoader* loader, const c
     if (!m_pluginView)
         loader->commitData(data, length);
     
-    // We re-check here as the plugin can have been created
+    // We re-check here as the plugin can have been created.
     if (m_pluginView && m_pluginView->isPluginView()) {
         if (!m_hasSentResponseToPlugin) {
             m_pluginView->didReceiveResponse(loader->response());
-            // didReceiveResponse sets up a new stream to the plug-in. on a full-page plug-in, a failure in
-            // setting up this stream can cause the main document load to be cancelled, setting m_pluginView
-            // to null
+            // The function didReceiveResponse sets up a new stream to the plug-in.
+            // On a full-page plug-in, a failure in setting up this stream can cause the
+            // main document load to be cancelled, setting m_pluginView to null.
             if (!m_pluginView)
                 return;
             m_hasSentResponseToPlugin = true;
@@ -928,12 +927,12 @@ WebCore::ResourceError FrameLoaderClientQt::cancelledError(const WebCore::Resour
     return error;
 }
 
-// copied from WebKit/Misc/WebKitErrors[Private].h
+// This was copied from file "WebKit/Source/WebKit/mac/Misc/WebKitErrors.h".
 enum {
     WebKitErrorCannotShowMIMEType =                             100,
     WebKitErrorCannotShowURL =                                  101,
     WebKitErrorFrameLoadInterruptedByPolicyChange =             102,
-    WebKitErrorCannotUseRestrictedPort = 103,
+    WebKitErrorCannotUseRestrictedPort =                        103,
     WebKitErrorCannotFindPlugIn =                               200,
     WebKitErrorCannotLoadPlugIn =                               201,
     WebKitErrorJavaUnavailable =                                202,
@@ -1011,7 +1010,7 @@ void FrameLoaderClientQt::download(WebCore::ResourceHandle* handle, const WebCor
     QNetworkReplyHandler* handler = handle->getInternal()->m_job;
     QNetworkReply* reply = handler->release();
     if (reply) {
-        QWebPage *page = m_webFrame->page();
+        QWebPage* page = m_webFrame->page();
         if (page->forwardUnsupportedContent())
             emit page->unsupportedContent(reply);
         else
@@ -1027,6 +1026,7 @@ void FrameLoaderClientQt::assignIdentifierToInitialRequest(unsigned long identif
 
 void FrameLoaderClientQt::dispatchWillSendRequest(WebCore::DocumentLoader*, unsigned long identifier, WebCore::ResourceRequest& newRequest, const WebCore::ResourceResponse& redirectResponse)
 {
+    QUrl url = newRequest.url();
 
     if (dumpResourceLoadCallbacks)
         printf("%s - willSendRequest %s redirectResponse %s\n",
@@ -1034,28 +1034,42 @@ void FrameLoaderClientQt::dispatchWillSendRequest(WebCore::DocumentLoader*, unsi
                qPrintable(drtDescriptionSuitableForTestResult(newRequest)),
                (redirectResponse.isNull()) ? "(null)" : qPrintable(drtDescriptionSuitableForTestResult(redirectResponse)));
 
-    if (sendRequestReturnsNull)
+    if (sendRequestReturnsNull) {
         newRequest.setURL(QUrl());
+        return;
+    }
 
     if (sendRequestReturnsNullOnRedirect && !redirectResponse.isNull()) {
         printf("Returning null for this redirect\n");
         newRequest.setURL(QUrl());
+        return;
+    }
+
+    if (QWebPagePrivate::drtRun
+        && url.isValid()
+        && (url.scheme().toLower() == QLatin1String("http") || url.scheme().toLower() == QLatin1String("https"))
+        && url.host() != QLatin1String("127.0.0.1")
+        && url.host() != QLatin1String("255.255.255.255")
+        && url.host().toLower() != QLatin1String("localhost")) {
+
+        printf("Blocked access to external URL %s\n", qPrintable(drtDescriptionSuitableForTestResult(newRequest.url())));
+        newRequest.setURL(QUrl());
+        return;
     }
 
     for (int i = 0; i < sendRequestClearHeaders.size(); ++i)
           newRequest.setHTTPHeaderField(sendRequestClearHeaders.at(i).toLocal8Bit().constData(), QString());
 
     if (QWebPagePrivate::drtRun) {
-        QString url = newRequest.url().string();
-        if (URLsToRedirect.contains(url))
-            newRequest.setURL(QUrl(URLsToRedirect[url]));
+        QMap<QString, QString>::const_iterator it = URLsToRedirect.constFind(url.toString());
+        if (it != URLsToRedirect.constEnd())
+            newRequest.setURL(QUrl(it.value()));
     }
-    // seems like the Mac code doesn't do anything here by default neither
-    //qDebug() << "FrameLoaderClientQt::dispatchWillSendRequest" << request.isNull() << request.url().string`();
+    // Seems like the Mac code doesn't do anything here by default neither.
+    // qDebug() << "FrameLoaderClientQt::dispatchWillSendRequest" << request.isNull() << url;
 }
 
-bool
-FrameLoaderClientQt::shouldUseCredentialStorage(DocumentLoader*, unsigned long)
+bool FrameLoaderClientQt::shouldUseCredentialStorage(DocumentLoader*, unsigned long)
 {
     notImplemented();
     return false;
@@ -1082,7 +1096,7 @@ void FrameLoaderClientQt::dispatchDidReceiveResponse(WebCore::DocumentLoader*, u
 
     if (dumpResourceResponseMIMETypes) {
         printf("%s has MIME type %s\n",
-               qPrintable(QFileInfo(drtDescriptionSuitableForTestResult(response.url())).fileName()),
+               qPrintable(QString(response.url().lastPathComponent())),
                qPrintable(QString(response.mimeType())));
     }
 }
@@ -1178,7 +1192,7 @@ WebCore::Frame* FrameLoaderClientQt::dispatchCreatePage(const WebCore::Navigatio
 
 void FrameLoaderClientQt::dispatchDecidePolicyForResponse(FramePolicyFunction function, const WebCore::ResourceResponse& response, const WebCore::ResourceRequest&)
 {
-    // we need to call directly here
+    // We need to call directly here.
     if (WebCore::contentDispositionType(response.httpHeaderField("Content-Disposition")) == WebCore::ContentDispositionAttachment)
         callPolicyFunction(function, PolicyDownload);
     else if (canShowMIMEType(response.mimeType()))
@@ -1215,7 +1229,7 @@ void FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction(FramePolicyFun
     QWebPage*page = m_webFrame->page();
     PolicyAction result;
 
-    // Currently, this is only enabled by DRT
+    // Currently, this is only enabled by DRT.
     if (policyDelegateEnabled) {
         RefPtr<Node> node;
         for (const Event* event = action.event(); event; event = event->underlyingEvent()) {
@@ -1296,7 +1310,7 @@ PassRefPtr<Frame> FrameLoaderClientQt::createFrame(const KURL& url, const String
 
     emit m_webFrame->page()->frameCreated(webFrame);
 
-    // ### set override encoding if we have one
+    // FIXME: Set override encoding if we have one.
 
     m_frame->loader()->loadURLIntoChildFrame(frameData.url, frameData.referrer, frameData.frame.get());
 
@@ -1331,7 +1345,7 @@ void FrameLoaderClientQt::transferLoadingResourceFromPage(unsigned long, Documen
 
 ObjectContentType FrameLoaderClientQt::objectContentType(const KURL& url, const String& mimeTypeIn, bool shouldPreferPlugInsForImages)
 {
-//    qDebug()<<" ++++++++++++++++ url is "<<url.prettyURL()<<", mime = "<<mimeTypeIn;
+    // qDebug()<<" ++++++++++++++++ url is "<<url.prettyURL()<<", mime = "<<mimeTypeIn;
     QFileInfo fi(url.path());
     String extension = fi.suffix();
     if (mimeTypeIn == "application/x-qt-plugin" || mimeTypeIn == "application/x-qt-styled-widget")
@@ -1432,8 +1446,8 @@ private:
         if (!isVisible())
             return;
 
-        // if setMask is set with an empty QRegion, no clipping will
-        // be performed, so in that case we hide the platformWidget
+        // If setMask is set with an empty QRegion, no clipping will
+        // be performed, so in that case we hide the platformWidget.
         QRegion mask = platformWidget()->mask();
         platformWidget()->setVisible(!mask.isEmpty());
     }
@@ -1467,7 +1481,7 @@ public:
         IntRect windowRect = convertToContainingWindow(IntRect(0, 0, frameRect().width(), frameRect().height()));
         graphicsWidget->setGeometry(QRect(windowRect));
 
-        // FIXME: clipping of graphics widgets
+        // FIXME: Make the code handle clipping of graphics widgets.
     }
     virtual void show()
     {
@@ -1494,8 +1508,8 @@ private:
 PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize, HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames,
                                           const Vector<String>& paramValues, const String& mimeType, bool loadManually)
 {
-//     qDebug()<<"------ Creating plugin in FrameLoaderClientQt::createPlugin for "<<url.prettyURL() << mimeType;
-//     qDebug()<<"------\t url = "<<url.prettyURL();
+    // qDebug()<<"------ Creating plugin in FrameLoaderClientQt::createPlugin for "<<url.prettyURL() << mimeType;
+    // qDebug()<<"------\t url = "<<url.prettyURL();
 
     if (!m_webFrame)
         return 0;
@@ -1553,12 +1567,12 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
             QWidget* parentWidget = 0;
             if (m_webFrame->page()->d->client)
                 parentWidget = qobject_cast<QWidget*>(m_webFrame->page()->d->client->pluginParent());
-            if (parentWidget) // don't reparent to nothing (i.e. keep whatever parent QWebPage::createPlugin() chose.
+            if (parentWidget) // Don't reparent to nothing (i.e. keep whatever parent QWebPage::createPlugin() chose.
                 widget->setParent(parentWidget);
             widget->hide();
             RefPtr<QtPluginWidget> w = adoptRef(new QtPluginWidget());
             w->setPlatformWidget(widget);
-            // Make sure it's invisible until properly placed into the layout
+            // Make sure it's invisible until properly placed into the layout.
             w->setFrameRect(IntRect(0, 0, 0, 0));
             return w;
         }
@@ -1570,16 +1584,16 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
             if (m_webFrame->page()->d->client)
                 parentWidget = qobject_cast<QGraphicsObject*>(m_webFrame->page()->d->client->pluginParent());
             graphicsWidget->hide();
-            if (parentWidget) // don't reparent to nothing (i.e. keep whatever parent QWebPage::createPlugin() chose.
+            if (parentWidget) // Don't reparent to nothing (i.e. keep whatever parent QWebPage::createPlugin() chose.
                 graphicsWidget->setParentItem(parentWidget);
             RefPtr<QtPluginGraphicsWidget> w = QtPluginGraphicsWidget::create(graphicsWidget);
-            // Make sure it's invisible until properly placed into the layout
+            // Make sure it's invisible until properly placed into the layout.
             w->setFrameRect(IntRect(0, 0, 0, 0));
             return w;
         }
 #endif // QT_NO_GRAPHICSVIEW
 
-        // FIXME: make things work for widgetless plugins as well
+        // FIXME: Make things work for widgetless plugins as well.
         delete object;
     }
 #if ENABLE(NETSCAPE_PLUGIN_API)
@@ -1592,16 +1606,16 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
 #if defined(MOZ_PLATFORM_MAEMO) && (MOZ_PLATFORM_MAEMO >= 5)
             size_t wmodeIndex = params.find("wmode");
             if (wmodeIndex == -1) {
-                // Disable XEmbed mode and force it to opaque mode
+                // Disable XEmbed mode and force it to opaque mode.
                 params.append("wmode");
                 values.append("opaque");
             } else if (!isQWebView) {
-                // Disable transparency if client is not a QWebView
+                // Disable transparency if client is not a QWebView.
                 values[wmodeIndex] = "opaque";
             }
 #else
             if (!isQWebView) {
-                // inject wmode=opaque when there is no client or the client is not a QWebView
+                // Inject wmode=opaque when there is no client or the client is not a QWebView.
                 size_t wmodeIndex = params.find("wmode");
                 if (wmodeIndex == -1) {
                     params.append("wmode");
@@ -1646,7 +1660,10 @@ QString FrameLoaderClientQt::chooseFile(const QString& oldFile)
 
 PassRefPtr<FrameNetworkingContext> FrameLoaderClientQt::createNetworkingContext()
 {
-    return FrameNetworkingContextQt::create(m_frame, m_webFrame, m_webFrame->page()->networkAccessManager());
+    QVariant value = m_webFrame->page()->property("_q_MIMESniffingDisabled");
+    bool MIMESniffingDisabled = value.isValid() && value.toBool();
+
+    return FrameNetworkingContextQt::create(m_frame, m_webFrame, !MIMESniffingDisabled, m_webFrame->page()->networkAccessManager());
 }
 
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index 3ec5f20..900489d 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -110,7 +110,7 @@ public:
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
-    virtual void dispatchDidReceiveTitle(const String& title);
+    virtual void dispatchDidReceiveTitle(const StringWithDirection&);
     virtual void dispatchDidChangeIcons();
     virtual void dispatchDidCommitLoad();
     virtual void dispatchDidFailProvisionalLoad(const ResourceError&);
@@ -186,7 +186,7 @@ public:
     virtual void prepareForDataSourceReplacement();
 
     virtual WTF::PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
-    virtual void setTitle(const String& title, const KURL&);
+    virtual void setTitle(const StringWithDirection&, const KURL&);
 
     virtual String userAgent(const WebCore::KURL&);
 
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.cpp b/Source/WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.cpp
index b3b0f00..502a418 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.cpp
@@ -28,16 +28,17 @@
 
 namespace WebCore {
 
-FrameNetworkingContextQt::FrameNetworkingContextQt(Frame* frame, QObject* originatingObject, QNetworkAccessManager* networkAccessManager)
+FrameNetworkingContextQt::FrameNetworkingContextQt(Frame* frame, QObject* originatingObject, bool mimeSniffingEnabled, QNetworkAccessManager* networkAccessManager)
     : FrameNetworkingContext(frame)
     , m_originatingObject(originatingObject)
     , m_networkAccessManager(networkAccessManager)
+    , m_mimeSniffingEnabled(mimeSniffingEnabled)
 {
 }
 
-PassRefPtr<FrameNetworkingContextQt> FrameNetworkingContextQt::create(Frame* frame, QObject* originatingObject, QNetworkAccessManager* networkAccessManager)
+PassRefPtr<FrameNetworkingContextQt> FrameNetworkingContextQt::create(Frame* frame, QObject* originatingObject, bool mimeSniffingEnabled, QNetworkAccessManager* networkAccessManager)
 {
-    return adoptRef(new FrameNetworkingContextQt(frame, originatingObject, networkAccessManager));
+    return adoptRef(new FrameNetworkingContextQt(frame, originatingObject, mimeSniffingEnabled, networkAccessManager));
 }
 
 QObject* FrameNetworkingContextQt::originatingObject() const
@@ -50,4 +51,9 @@ QNetworkAccessManager* FrameNetworkingContextQt::networkAccessManager() const
     return (qobject_cast<QWebFrame*>(m_originatingObject))->page()->networkAccessManager();
 }
 
+bool FrameNetworkingContextQt::mimeSniffingEnabled() const
+{
+    return m_mimeSniffingEnabled;
+}
+
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.h b/Source/WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.h
index 461023e..f23ba95 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/FrameNetworkingContextQt.h
@@ -26,16 +26,18 @@ namespace WebCore {
 
 class FrameNetworkingContextQt : public FrameNetworkingContext {
 public:
-    static PassRefPtr<FrameNetworkingContextQt> create(Frame*, QObject* originatingObject, QNetworkAccessManager*);
+    static PassRefPtr<FrameNetworkingContextQt> create(Frame*, QObject* originatingObject, bool mimeSniffingEnabled, QNetworkAccessManager*);
 
 private:
-    FrameNetworkingContextQt(Frame*, QObject* originatingObject, QNetworkAccessManager*);
+    FrameNetworkingContextQt(Frame*, QObject* originatingObject, bool mimeSniffingEnabled, QNetworkAccessManager*);
 
     virtual QObject* originatingObject() const;
     virtual QNetworkAccessManager* networkAccessManager() const;
+    virtual bool mimeSniffingEnabled() const;
 
     QObject* m_originatingObject;
     QNetworkAccessManager* m_networkAccessManager;
+    bool m_mimeSniffingEnabled;
 };
 
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp
index ccca43c..7939370 100644
--- a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.cpp
@@ -22,18 +22,71 @@
 #include "FullScreenVideoQt.h"
 
 #include "ChromeClientQt.h"
+#if USE(QT_MULTIMEDIA)
 #include "FullScreenVideoWidget.h"
+#include "MediaPlayerPrivateQt.h"
+#endif
 #include "HTMLNames.h"
 #include "HTMLVideoElement.h"
-#include "MediaPlayerPrivateQt.h"
 #include "Node.h"
 
+#if USE(GSTREAMER)
+#include "GStreamerGWorld.h"
+#include "PlatformVideoWindowPrivate.h"
+#endif
 
+#if USE(QT_MULTIMEDIA)
 #include <QGraphicsVideoItem>
 #include <QMediaPlayer>
+#endif
+#include <QWidget>
 
 namespace WebCore {
 
+#if USE(GSTREAMER)
+GStreamerFullScreenVideoHandler::GStreamerFullScreenVideoHandler()
+    : m_videoElement(0)
+    , m_fullScreenWidget(0)
+{
+}
+
+void GStreamerFullScreenVideoHandler::setVideoElement(HTMLVideoElement* element)
+{
+    m_videoElement = element;
+}
+
+void GStreamerFullScreenVideoHandler::enterFullScreen()
+{
+    if (m_videoElement->platformMedia().type != WebCore::PlatformMedia::GStreamerGWorldType)
+        return;
+
+    GStreamerGWorld* gstreamerGWorld = m_videoElement->platformMedia().media.gstreamerGWorld;
+
+    if (!gstreamerGWorld->enterFullscreen())
+        return;
+
+    m_fullScreenWidget = reinterpret_cast<FullScreenVideoWindow*>(gstreamerGWorld->platformVideoWindow()->window());
+    m_fullScreenWidget->setVideoElement(m_videoElement);
+    connect(m_fullScreenWidget, SIGNAL(closed()), this, SLOT(windowClosed()));
+    m_fullScreenWidget->showFullScreen();
+}
+
+void GStreamerFullScreenVideoHandler::windowClosed()
+{
+    m_videoElement->exitFullscreen();
+}
+
+void GStreamerFullScreenVideoHandler::exitFullScreen()
+{
+    if (m_videoElement->platformMedia().type == WebCore::PlatformMedia::GStreamerGWorldType)
+        m_videoElement->platformMedia().media.gstreamerGWorld->exitFullscreen();
+
+    m_fullScreenWidget->setVideoElement(0);
+    m_fullScreenWidget->close();
+}
+#endif
+
+#if USE(QT_MULTIMEDIA)
 bool DefaultFullScreenVideoHandler::s_shouldForceFullScreenVideoPlayback = false;
 
 DefaultFullScreenVideoHandler::DefaultFullScreenVideoHandler()
@@ -42,6 +95,8 @@ DefaultFullScreenVideoHandler::DefaultFullScreenVideoHandler()
 {
     connect(m_fullScreenWidget, SIGNAL(didExitFullScreen()), this, SIGNAL(fullScreenClosed()));
     m_fullScreenWidget->hide();
+
+    m_fullScreenWidget->close();
 }
 
 DefaultFullScreenVideoHandler::~DefaultFullScreenVideoHandler()
@@ -72,24 +127,36 @@ void DefaultFullScreenVideoHandler::exitFullScreen()
 {
     m_fullScreenWidget->close();
 }
+#endif
 
 FullScreenVideoQt::FullScreenVideoQt(ChromeClientQt* chromeClient)
     : m_chromeClient(chromeClient)
     , m_videoElement(0)
 {
     Q_ASSERT(m_chromeClient);
-    m_FullScreenVideoHandler = m_chromeClient->m_platformPlugin.createFullScreenVideoHandler();
 
+#if USE(QT_MULTIMEDIA)
+    m_FullScreenVideoHandler = m_chromeClient->m_platformPlugin.createFullScreenVideoHandler();
     if (!m_FullScreenVideoHandler)
         m_FullScreenVideoHandler = new DefaultFullScreenVideoHandler;
 
     if (m_FullScreenVideoHandler)
         connect(m_FullScreenVideoHandler, SIGNAL(fullScreenClosed()), this, SLOT(aboutToClose()));
+#endif
+
+#if USE(GSTREAMER)
+    m_FullScreenVideoHandlerGStreamer = new GStreamerFullScreenVideoHandler;
+#endif
 }
 
 FullScreenVideoQt::~FullScreenVideoQt()
 {
+#if USE(QT_MULTIMEDIA)
     delete m_FullScreenVideoHandler;
+#endif
+#if USE(GSTREAMER)
+    delete m_FullScreenVideoHandlerGStreamer;
+#endif
 }
 
 void FullScreenVideoQt::enterFullScreenForNode(Node* node)
@@ -97,25 +164,54 @@ void FullScreenVideoQt::enterFullScreenForNode(Node* node)
     Q_ASSERT(node);
     Q_ASSERT(m_FullScreenVideoHandler);
 
+    m_videoElement = static_cast<HTMLVideoElement*>(node);
+
+#if USE(QT_MULTIMEDIA)
+    HTMLVideoElement* videoElement = static_cast<HTMLVideoElement*>(node);
+    PlatformMedia platformMedia = videoElement->platformMedia();
+
+    ASSERT(platformMedia.type == PlatformMedia::QtMediaPlayerType);
+    if (platformMedia.type != PlatformMedia::QtMediaPlayerType)
+        return;
+
     if (!m_FullScreenVideoHandler)
         return;
 
-    MediaPlayerPrivateQt* mediaPlayerQt = mediaPlayerForNode(node);
+    MediaPlayerPrivateQt* mediaPlayerQt = mediaPlayer();
     mediaPlayerQt->removeVideoItem();
     m_FullScreenVideoHandler->enterFullScreen(mediaPlayerQt->mediaPlayer());
+#endif
+
+#if USE(GSTREAMER)
+    m_FullScreenVideoHandlerGStreamer->setVideoElement(m_videoElement);
+    m_FullScreenVideoHandlerGStreamer->enterFullScreen();
+#endif
 }
 
 void FullScreenVideoQt::exitFullScreenForNode(Node* node)
 {
     Q_ASSERT(node);
+
+#if USE(QT_MULTIMEDIA)
+    HTMLVideoElement* videoElement = static_cast<HTMLVideoElement*>(node);
+    PlatformMedia platformMedia = videoElement->platformMedia();
+
+    ASSERT(platformMedia.type == PlatformMedia::QtMediaPlayerType);
+    if (platformMedia.type != PlatformMedia::QtMediaPlayerType)
+        return;
+
     Q_ASSERT(m_FullScreenVideoHandler);
 
     if (!m_FullScreenVideoHandler)
         return;
 
     m_FullScreenVideoHandler->exitFullScreen();
-    MediaPlayerPrivateQt* mediaPlayerQt = mediaPlayerForNode(node);
+    MediaPlayerPrivateQt* mediaPlayerQt = mediaPlayer();
     mediaPlayerQt->restoreVideoItem();
+#endif
+#if USE(GSTREAMER)
+    m_FullScreenVideoHandlerGStreamer->exitFullScreen();
+#endif
 }
 
 void FullScreenVideoQt::aboutToClose()
@@ -124,24 +220,33 @@ void FullScreenVideoQt::aboutToClose()
     m_videoElement->exitFullscreen();
 }
 
+#if USE(QT_MULTIMEDIA)
 MediaPlayerPrivateQt* FullScreenVideoQt::mediaPlayer()
 {
     Q_ASSERT(m_videoElement);
     PlatformMedia platformMedia = m_videoElement->platformMedia();
     return static_cast<MediaPlayerPrivateQt*>(platformMedia.media.qtMediaPlayer);
 }
+#endif
 
-MediaPlayerPrivateQt* FullScreenVideoQt::mediaPlayerForNode(Node* node)
+bool FullScreenVideoQt::requiresFullScreenForVideoPlayback()
 {
-    Q_ASSERT(node);
-    if (node)
-        m_videoElement = static_cast<HTMLVideoElement*>(node);
-    return mediaPlayer();
+#if USE(QT_MULTIMEDIA)
+    return m_FullScreenVideoHandler ? m_FullScreenVideoHandler->requiresFullScreenForVideoPlayback() : false;
+#endif
+#if USE(GSTREAMER)
+    return false;
+#endif
 }
 
-bool FullScreenVideoQt::requiresFullScreenForVideoPlayback()
+bool FullScreenVideoQt::isValid() const
 {
-    return m_FullScreenVideoHandler ? m_FullScreenVideoHandler->requiresFullScreenForVideoPlayback() : false;
+#if USE(QT_MULTIMEDIA)
+    return m_FullScreenVideoHandler;
+#endif
+#if USE(GSTREAMER)
+    return m_FullScreenVideoHandlerGStreamer;
+#endif
 }
 
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.h b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.h
index a48a882..fda153d 100644
--- a/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/FullScreenVideoQt.h
@@ -22,6 +22,7 @@
 
 #include "qwebkitplatformplugin.h"
 #include <QObject>
+#include <wtf/Platform.h>
 
 QT_BEGIN_NAMESPACE
 class QGraphicsVideoItem;
@@ -34,8 +35,35 @@ class ChromeClientQt;
 class FullScreenVideoWidget;
 class HTMLVideoElement;
 class Node;
+#if USE(QT_MULTIMEDIA)
 class MediaPlayerPrivateQt;
+#endif
 
+// We do not use ENABLE or USE because moc does not expand these macros.
+#if defined(WTF_USE_GSTREAMER) && WTF_USE_GSTREAMER
+class FullScreenVideoWindow;
+
+class GStreamerFullScreenVideoHandler : public QObject {
+    Q_OBJECT
+public:
+    GStreamerFullScreenVideoHandler();
+    ~GStreamerFullScreenVideoHandler() { }
+    void setVideoElement(HTMLVideoElement*);
+
+    void enterFullScreen();
+    void exitFullScreen();
+
+public Q_SLOTS:
+    void windowClosed();
+
+private:
+    HTMLVideoElement* m_videoElement;
+    FullScreenVideoWindow* m_fullScreenWidget;
+};
+#endif
+
+// We do not use ENABLE or USE because moc does not expand these macros.
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
 class DefaultFullScreenVideoHandler : public QWebFullScreenVideoHandler {
     Q_OBJECT
 public:
@@ -51,6 +79,7 @@ private:
     static bool s_shouldForceFullScreenVideoPlayback;
     FullScreenVideoWidget *m_fullScreenWidget;
 };
+#endif
 
 class FullScreenVideoQt : public QObject {
     Q_OBJECT
@@ -61,11 +90,12 @@ public:
     virtual void enterFullScreenForNode(Node*);
     virtual void exitFullScreenForNode(Node*);
     bool requiresFullScreenForVideoPlayback();
-    bool isValid() const {  return m_FullScreenVideoHandler; }
+    bool isValid() const;
 
 private:
+#if USE(QT_MULTIMEDIA)
     MediaPlayerPrivateQt* mediaPlayer();
-    MediaPlayerPrivateQt* mediaPlayerForNode(Node* = 0);
+#endif
 
 private slots:
     void aboutToClose();
@@ -73,7 +103,12 @@ private slots:
 private:
     ChromeClientQt* m_chromeClient;
     HTMLVideoElement* m_videoElement;
+#if USE(QT_MULTIMEDIA)
     QWebFullScreenVideoHandler* m_FullScreenVideoHandler;
+#endif
+#if USE(GSTREAMER)
+    GStreamerFullScreenVideoHandler* m_FullScreenVideoHandlerGStreamer;
+#endif
 };
 
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index 6b557db..36ec697 100644
--- a/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -32,6 +32,7 @@
 #include "InspectorClientQt.h"
 
 #include "Frame.h"
+#include "FrameView.h"
 #include "InspectorController.h"
 #include "InspectorFrontend.h"
 #include "InspectorServerQt.h"
@@ -262,12 +263,17 @@ void InspectorClientQt::detachRemoteFrontend()
 
 void InspectorClientQt::highlight(Node*)
 {
-    notImplemented();
+    hideHighlight();
 }
 
 void InspectorClientQt::hideHighlight()
 {
-    notImplemented();
+    WebCore::Frame* frame = m_inspectedWebPage->d->page->mainFrame();
+    if (frame) {
+        QRect rect = m_inspectedWebPage->mainFrame()->geometry();
+        if (!rect.isEmpty())
+            frame->view()->invalidateRect(rect);
+    }
 }
 
 bool InspectorClientQt::sendMessageToFrontend(const String& message)
diff --git a/Source/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp b/Source/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp
index ea56134..12204ac 100644
--- a/Source/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp
@@ -127,7 +127,7 @@ QWebTouchModifier* QtPlatformPlugin::createTouchModifier()
     return p ? static_cast<QWebTouchModifier*>(p->createExtension(QWebKitPlatformPlugin::TouchInteraction)) : 0;
 }
 
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && USE(QT_MULTIMEDIA)
 QWebFullScreenVideoHandler* QtPlatformPlugin::createFullScreenVideoHandler()
 {
     QWebKitPlatformPlugin* p = plugin();
diff --git a/Source/WebKit/qt/WebCoreSupport/QtPlatformPlugin.h b/Source/WebKit/qt/WebCoreSupport/QtPlatformPlugin.h
index 71ee2bb..685195d 100644
--- a/Source/WebKit/qt/WebCoreSupport/QtPlatformPlugin.h
+++ b/Source/WebKit/qt/WebCoreSupport/QtPlatformPlugin.h
@@ -29,7 +29,7 @@ class QWebNotificationPresenter;
 class QWebHapticFeedbackPlayer;
 class QWebSelectData;
 class QWebTouchModifier;
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && USE(QT_MULTIMEDIA)
 class QWebFullScreenVideoHandler;
 #endif
 
@@ -44,7 +44,7 @@ public:
     QWebNotificationPresenter* createNotificationPresenter();
     QWebHapticFeedbackPlayer* createHapticFeedbackPlayer();
     QWebTouchModifier* createTouchModifier();
-#if ENABLE(VIDEO) && ENABLE(QT_MULTIMEDIA)
+#if ENABLE(VIDEO) && USE(QT_MULTIMEDIA)
     QWebFullScreenVideoHandler* createFullScreenVideoHandler();
 #endif
 
diff --git a/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp b/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
index 320079f..b3ff4c1 100644
--- a/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
+++ b/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
@@ -210,7 +210,7 @@ MultipleSelectionPopup::MultipleSelectionPopup(const QWebSelectData& data)
     resize(size().width(), visibleItemCount * gMaemoListItemSize);
 }
 
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
 FullScreenVideoWidget::FullScreenVideoWidget(QMediaPlayer* player)
     : QVideoWidget()
     , m_mediaPlayer(player)
@@ -286,7 +286,7 @@ bool WebPlugin::supportsExtension(Extension extension) const
 #endif
     case TouchInteraction:
         return true;
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
     case FullScreenVideoPlayer:
         return true;
 #endif
@@ -306,7 +306,7 @@ QObject* WebPlugin::createExtension(Extension extension) const
 #endif
     case TouchInteraction:
         return new TouchModifier();
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
     case FullScreenVideoPlayer:
         return new FullScreenVideoHandler();
 #endif
diff --git a/Source/WebKit/qt/examples/platformplugin/WebPlugin.h b/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
index 4994669..a739ee9 100644
--- a/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
+++ b/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
@@ -24,7 +24,7 @@
 #include "WebNotificationPresenter.h"
 
 #include <QDialog>
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
 #include <QVideoWidget>
 #endif
 
@@ -97,7 +97,7 @@ public:
     }
 };
 
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
 class FullScreenVideoWidget : public QVideoWidget {
     Q_OBJECT
 public:
diff --git a/Source/WebKit/qt/examples/platformplugin/platformplugin.pro b/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
index ccc0b3a..80cecb3 100644
--- a/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
+++ b/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
@@ -14,8 +14,8 @@ load(mobilityconfig, true)
         MOBILITY += multimedia
         DEFINES -= ENABLE_VIDEO=0
         DEFINES += ENABLE_VIDEO=1
-        DEFINES -= ENABLE_QT_MULTIMEDIA=0
-        DEFINES += ENABLE_QT_MULTIMEDIA=1
+        DEFINES -= WTF_USE_QT_MULTIMEDIA=0
+        DEFINES += WTF_USE_QT_MULTIMEDIA=1
     }
 }
 
diff --git a/Source/WebKit/qt/examples/platformplugin/qwebkitplatformplugin.h b/Source/WebKit/qt/examples/platformplugin/qwebkitplatformplugin.h
index 2a94e0c..7a76fe7 100644
--- a/Source/WebKit/qt/examples/platformplugin/qwebkitplatformplugin.h
+++ b/Source/WebKit/qt/examples/platformplugin/qwebkitplatformplugin.h
@@ -28,7 +28,7 @@
 
 #include <QObject>
 #include <QUrl>
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
 #include <QMediaPlayer>
 #endif
 
@@ -118,7 +118,7 @@ public:
     virtual unsigned hitTestPaddingForTouch(const PaddingDirection) const = 0;
 };
 
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
 class QWebFullScreenVideoHandler : public QObject {
     Q_OBJECT
 public:
diff --git a/Source/WebKit/qt/tests/MIMESniffing/MIMESniffing.pro b/Source/WebKit/qt/tests/MIMESniffing/MIMESniffing.pro
new file mode 100644
index 0000000..53d80c8
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/MIMESniffing.pro
@@ -0,0 +1,19 @@
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
+TARGET = MIMESniffing
+CONFIG += console
+
+SOURCES += ../../../../WebCore/platform/network/MIMESniffing.cpp
+HEADERS += \
+    ../../../../WebCore/platform/network/MIMESniffing.h \
+    TestData.h
+
+INCLUDEPATH += \
+    ../../../../WebCore/platform/network \
+    ../../../../JavaScriptCore
+
+debug {
+    SOURCES += ../../../../JavaScriptCore/wtf/Assertions.cpp
+}
+
+RESOURCES += resources.qrc
diff --git a/Source/WebKit/qt/tests/MIMESniffing/TestData.h b/Source/WebKit/qt/tests/MIMESniffing/TestData.h
new file mode 100644
index 0000000..c04bd6b
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/TestData.h
@@ -0,0 +1,984 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef TestData_h
+#define TestData_h
+
+typedef struct _TestData {
+    const char* file;
+    const char* advertisedType;
+    bool isImage;
+    const char* sniffedType;
+} TestData;
+
+static const TestData testList[] = {
+    {":/application_atom+xml", "text/plain", false, "text/plain"},
+    {":/application_atom+xml", "text/plain", true, "text/plain"},
+    {":/application_atom+xml", "unknown/unknown", false, "text/xml"},
+    {":/application_atom+xml", "unknown/unknown", true, "text/xml"},
+    {":/application_atom+xml", "application/unknown", false, "text/xml"},
+    {":/application_atom+xml", "application/unknown", true, "text/xml"},
+    {":/application_atom+xml", "*/*", false, "text/xml"},
+    {":/application_atom+xml", "*/*", true, "text/xml"},
+    {":/application_atom+xml", "text/xml", false, 0},
+    {":/application_atom+xml", "text/xml", true, 0},
+    {":/application_atom+xml", "application/xml", false, 0},
+    {":/application_atom+xml", "application/xml", true, 0},
+    {":/application_atom+xml", "text/html", false, "application/atom+xml"},
+    {":/application_atom+xml", "text/html", true, 0},
+    {":/application_atom+xml", "text/xml", false, 0},
+    {":/application_atom+xml", "text/xml", true, 0},
+    {":/application_atom+xml", "application/pdf", false, 0},
+    {":/application_atom+xml", "application/pdf", true, 0},
+    {":/application_atom+xml", "application/postscript", false, 0},
+    {":/application_atom+xml", "application/postscript", true, 0},
+    {":/application_atom+xml", "application/ogg", false, 0},
+    {":/application_atom+xml", "application/ogg", true, 0},
+    {":/application_atom+xml", "video/webm", false, 0},
+    {":/application_atom+xml", "video/webm", true, 0},
+    {":/application_atom+xml", "application/x-rar-compressed", false, 0},
+    {":/application_atom+xml", "application/x-rar-compressed", true, 0},
+    {":/application_atom+xml", "application/zip", false, 0},
+    {":/application_atom+xml", "application/zip", true, 0},
+    {":/application_atom+xml", "application/x-gzip", false, 0},
+    {":/application_atom+xml", "application/x-gzip", true, 0},
+    {":/application_atom+xml", "audio/x-wave", false, 0},
+    {":/application_atom+xml", "audio/x-wave", true, 0},
+    {":/application_atom+xml", "image/webp", false, 0},
+    {":/application_atom+xml", "image/webp", true, 0},
+    {":/application_atom+xml", "image/gif", false, 0},
+    {":/application_atom+xml", "image/gif", true, 0},
+    {":/application_atom+xml", "image/png", false, 0},
+    {":/application_atom+xml", "image/png", true, 0},
+    {":/application_atom+xml", "image/jpeg", false, 0},
+    {":/application_atom+xml", "image/jpeg", true, 0},
+    {":/application_atom+xml", "image/bmp", false, 0},
+    {":/application_atom+xml", "image/bmp", true, 0},
+    {":/application_atom+xml", "image/vnd.microsoft.icon", false, 0},
+    {":/application_atom+xml", "image/vnd.microsoft.icon", true, 0},
+    {":/application_atom+xml", "application/rdf+xml", false, 0},
+    {":/application_atom+xml", "application/rdf+xml", true, 0},
+    {":/application_atom+xml", "application/rss+xml", false, 0},
+    {":/application_atom+xml", "application/rss+xml", true, 0},
+    {":/application_atom+xml", "application/atom+xml", false, 0},
+    {":/application_atom+xml", "application/atom+xml", true, 0},
+    {":/application_ogg", "text/plain", false, "application/ogg"},
+    {":/application_ogg", "text/plain", true, "application/ogg"},
+    {":/application_ogg", "unknown/unknown", false, "application/ogg"},
+    {":/application_ogg", "unknown/unknown", true, "application/ogg"},
+    {":/application_ogg", "application/unknown", false, "application/ogg"},
+    {":/application_ogg", "application/unknown", true, "application/ogg"},
+    {":/application_ogg", "*/*", false, "application/ogg"},
+    {":/application_ogg", "*/*", true, "application/ogg"},
+    {":/application_ogg", "text/xml", false, 0},
+    {":/application_ogg", "text/xml", true, 0},
+    {":/application_ogg", "application/xml", false, 0},
+    {":/application_ogg", "application/xml", true, 0},
+    {":/application_ogg", "text/html", false, 0},
+    {":/application_ogg", "text/html", true, 0},
+    {":/application_ogg", "text/xml", false, 0},
+    {":/application_ogg", "text/xml", true, 0},
+    {":/application_ogg", "application/pdf", false, 0},
+    {":/application_ogg", "application/pdf", true, 0},
+    {":/application_ogg", "application/postscript", false, 0},
+    {":/application_ogg", "application/postscript", true, 0},
+    {":/application_ogg", "application/ogg", false, 0},
+    {":/application_ogg", "application/ogg", true, 0},
+    {":/application_ogg", "video/webm", false, 0},
+    {":/application_ogg", "video/webm", true, 0},
+    {":/application_ogg", "application/x-rar-compressed", false, 0},
+    {":/application_ogg", "application/x-rar-compressed", true, 0},
+    {":/application_ogg", "application/zip", false, 0},
+    {":/application_ogg", "application/zip", true, 0},
+    {":/application_ogg", "application/x-gzip", false, 0},
+    {":/application_ogg", "application/x-gzip", true, 0},
+    {":/application_ogg", "audio/x-wave", false, 0},
+    {":/application_ogg", "audio/x-wave", true, 0},
+    {":/application_ogg", "image/webp", false, 0},
+    {":/application_ogg", "image/webp", true, 0},
+    {":/application_ogg", "image/gif", false, 0},
+    {":/application_ogg", "image/gif", true, 0},
+    {":/application_ogg", "image/png", false, 0},
+    {":/application_ogg", "image/png", true, 0},
+    {":/application_ogg", "image/jpeg", false, 0},
+    {":/application_ogg", "image/jpeg", true, 0},
+    {":/application_ogg", "image/bmp", false, 0},
+    {":/application_ogg", "image/bmp", true, 0},
+    {":/application_ogg", "image/vnd.microsoft.icon", false, 0},
+    {":/application_ogg", "image/vnd.microsoft.icon", true, 0},
+    {":/application_ogg", "application/rdf+xml", false, 0},
+    {":/application_ogg", "application/rdf+xml", true, 0},
+    {":/application_ogg", "application/rss+xml", false, 0},
+    {":/application_ogg", "application/rss+xml", true, 0},
+    {":/application_ogg", "application/atom+xml", false, 0},
+    {":/application_ogg", "application/atom+xml", true, 0},
+    {":/application_pdf", "text/plain", false, "application/octet-stream"},
+    {":/application_pdf", "text/plain", true, "application/octet-stream"},
+    {":/application_pdf", "unknown/unknown", false, "application/pdf"},
+    {":/application_pdf", "unknown/unknown", true, "application/pdf"},
+    {":/application_pdf", "application/unknown", false, "application/pdf"},
+    {":/application_pdf", "application/unknown", true, "application/pdf"},
+    {":/application_pdf", "*/*", false, "application/pdf"},
+    {":/application_pdf", "*/*", true, "application/pdf"},
+    {":/application_pdf", "text/xml", false, 0},
+    {":/application_pdf", "text/xml", true, 0},
+    {":/application_pdf", "application/xml", false, 0},
+    {":/application_pdf", "application/xml", true, 0},
+    {":/application_pdf", "text/html", false, 0},
+    {":/application_pdf", "text/html", true, 0},
+    {":/application_pdf", "text/xml", false, 0},
+    {":/application_pdf", "text/xml", true, 0},
+    {":/application_pdf", "application/pdf", false, 0},
+    {":/application_pdf", "application/pdf", true, 0},
+    {":/application_pdf", "application/postscript", false, 0},
+    {":/application_pdf", "application/postscript", true, 0},
+    {":/application_pdf", "application/ogg", false, 0},
+    {":/application_pdf", "application/ogg", true, 0},
+    {":/application_pdf", "video/webm", false, 0},
+    {":/application_pdf", "video/webm", true, 0},
+    {":/application_pdf", "application/x-rar-compressed", false, 0},
+    {":/application_pdf", "application/x-rar-compressed", true, 0},
+    {":/application_pdf", "application/zip", false, 0},
+    {":/application_pdf", "application/zip", true, 0},
+    {":/application_pdf", "application/x-gzip", false, 0},
+    {":/application_pdf", "application/x-gzip", true, 0},
+    {":/application_pdf", "audio/x-wave", false, 0},
+    {":/application_pdf", "audio/x-wave", true, 0},
+    {":/application_pdf", "image/webp", false, 0},
+    {":/application_pdf", "image/webp", true, 0},
+    {":/application_pdf", "image/gif", false, 0},
+    {":/application_pdf", "image/gif", true, 0},
+    {":/application_pdf", "image/png", false, 0},
+    {":/application_pdf", "image/png", true, 0},
+    {":/application_pdf", "image/jpeg", false, 0},
+    {":/application_pdf", "image/jpeg", true, 0},
+    {":/application_pdf", "image/bmp", false, 0},
+    {":/application_pdf", "image/bmp", true, 0},
+    {":/application_pdf", "image/vnd.microsoft.icon", false, 0},
+    {":/application_pdf", "image/vnd.microsoft.icon", true, 0},
+    {":/application_pdf", "application/rdf+xml", false, 0},
+    {":/application_pdf", "application/rdf+xml", true, 0},
+    {":/application_pdf", "application/rss+xml", false, 0},
+    {":/application_pdf", "application/rss+xml", true, 0},
+    {":/application_pdf", "application/atom+xml", false, 0},
+    {":/application_pdf", "application/atom+xml", true, 0},
+    {":/application_postscript", "text/plain", false, "text/plain"},
+    {":/application_postscript", "text/plain", true, "text/plain"},
+    {":/application_postscript", "unknown/unknown", false, "application/postscript"},
+    {":/application_postscript", "unknown/unknown", true, "application/postscript"},
+    {":/application_postscript", "application/unknown", false, "application/postscript"},
+    {":/application_postscript", "application/unknown", true, "application/postscript"},
+    {":/application_postscript", "*/*", false, "application/postscript"},
+    {":/application_postscript", "*/*", true, "application/postscript"},
+    {":/application_postscript", "text/xml", false, 0},
+    {":/application_postscript", "text/xml", true, 0},
+    {":/application_postscript", "application/xml", false, 0},
+    {":/application_postscript", "application/xml", true, 0},
+    {":/application_postscript", "text/html", false, 0},
+    {":/application_postscript", "text/html", true, 0},
+    {":/application_postscript", "text/xml", false, 0},
+    {":/application_postscript", "text/xml", true, 0},
+    {":/application_postscript", "application/pdf", false, 0},
+    {":/application_postscript", "application/pdf", true, 0},
+    {":/application_postscript", "application/postscript", false, 0},
+    {":/application_postscript", "application/postscript", true, 0},
+    {":/application_postscript", "application/ogg", false, 0},
+    {":/application_postscript", "application/ogg", true, 0},
+    {":/application_postscript", "video/webm", false, 0},
+    {":/application_postscript", "video/webm", true, 0},
+    {":/application_postscript", "application/x-rar-compressed", false, 0},
+    {":/application_postscript", "application/x-rar-compressed", true, 0},
+    {":/application_postscript", "application/zip", false, 0},
+    {":/application_postscript", "application/zip", true, 0},
+    {":/application_postscript", "application/x-gzip", false, 0},
+    {":/application_postscript", "application/x-gzip", true, 0},
+    {":/application_postscript", "audio/x-wave", false, 0},
+    {":/application_postscript", "audio/x-wave", true, 0},
+    {":/application_postscript", "image/webp", false, 0},
+    {":/application_postscript", "image/webp", true, 0},
+    {":/application_postscript", "image/gif", false, 0},
+    {":/application_postscript", "image/gif", true, 0},
+    {":/application_postscript", "image/png", false, 0},
+    {":/application_postscript", "image/png", true, 0},
+    {":/application_postscript", "image/jpeg", false, 0},
+    {":/application_postscript", "image/jpeg", true, 0},
+    {":/application_postscript", "image/bmp", false, 0},
+    {":/application_postscript", "image/bmp", true, 0},
+    {":/application_postscript", "image/vnd.microsoft.icon", false, 0},
+    {":/application_postscript", "image/vnd.microsoft.icon", true, 0},
+    {":/application_postscript", "application/rdf+xml", false, 0},
+    {":/application_postscript", "application/rdf+xml", true, 0},
+    {":/application_postscript", "application/rss+xml", false, 0},
+    {":/application_postscript", "application/rss+xml", true, 0},
+    {":/application_postscript", "application/atom+xml", false, 0},
+    {":/application_postscript", "application/atom+xml", true, 0},
+    {":/application_rdf+xml", "text/plain", false, "text/plain"},
+    {":/application_rdf+xml", "text/plain", true, "text/plain"},
+    {":/application_rdf+xml", "unknown/unknown", false, "text/xml"},
+    {":/application_rdf+xml", "unknown/unknown", true, "text/xml"},
+    {":/application_rdf+xml", "application/unknown", false, "text/xml"},
+    {":/application_rdf+xml", "application/unknown", true, "text/xml"},
+    {":/application_rdf+xml", "*/*", false, "text/xml"},
+    {":/application_rdf+xml", "*/*", true, "text/xml"},
+    {":/application_rdf+xml", "text/xml", false, 0},
+    {":/application_rdf+xml", "text/xml", true, 0},
+    {":/application_rdf+xml", "application/xml", false, 0},
+    {":/application_rdf+xml", "application/xml", true, 0},
+    {":/application_rdf+xml", "text/html", false, "application/rdf+xml"},
+    {":/application_rdf+xml", "text/html", true, 0},
+    {":/application_rdf+xml", "text/xml", false, 0},
+    {":/application_rdf+xml", "text/xml", true, 0},
+    {":/application_rdf+xml", "application/pdf", false, 0},
+    {":/application_rdf+xml", "application/pdf", true, 0},
+    {":/application_rdf+xml", "application/postscript", false, 0},
+    {":/application_rdf+xml", "application/postscript", true, 0},
+    {":/application_rdf+xml", "application/ogg", false, 0},
+    {":/application_rdf+xml", "application/ogg", true, 0},
+    {":/application_rdf+xml", "video/webm", false, 0},
+    {":/application_rdf+xml", "video/webm", true, 0},
+    {":/application_rdf+xml", "application/x-rar-compressed", false, 0},
+    {":/application_rdf+xml", "application/x-rar-compressed", true, 0},
+    {":/application_rdf+xml", "application/zip", false, 0},
+    {":/application_rdf+xml", "application/zip", true, 0},
+    {":/application_rdf+xml", "application/x-gzip", false, 0},
+    {":/application_rdf+xml", "application/x-gzip", true, 0},
+    {":/application_rdf+xml", "audio/x-wave", false, 0},
+    {":/application_rdf+xml", "audio/x-wave", true, 0},
+    {":/application_rdf+xml", "image/webp", false, 0},
+    {":/application_rdf+xml", "image/webp", true, 0},
+    {":/application_rdf+xml", "image/gif", false, 0},
+    {":/application_rdf+xml", "image/gif", true, 0},
+    {":/application_rdf+xml", "image/png", false, 0},
+    {":/application_rdf+xml", "image/png", true, 0},
+    {":/application_rdf+xml", "image/jpeg", false, 0},
+    {":/application_rdf+xml", "image/jpeg", true, 0},
+    {":/application_rdf+xml", "image/bmp", false, 0},
+    {":/application_rdf+xml", "image/bmp", true, 0},
+    {":/application_rdf+xml", "image/vnd.microsoft.icon", false, 0},
+    {":/application_rdf+xml", "image/vnd.microsoft.icon", true, 0},
+    {":/application_rdf+xml", "application/rdf+xml", false, 0},
+    {":/application_rdf+xml", "application/rdf+xml", true, 0},
+    {":/application_rdf+xml", "application/rss+xml", false, 0},
+    {":/application_rdf+xml", "application/rss+xml", true, 0},
+    {":/application_rdf+xml", "application/atom+xml", false, 0},
+    {":/application_rdf+xml", "application/atom+xml", true, 0},
+    {":/application_rss+xml", "text/plain", false, "text/plain"},
+    {":/application_rss+xml", "text/plain", true, "text/plain"},
+    {":/application_rss+xml", "unknown/unknown", false, "text/xml"},
+    {":/application_rss+xml", "unknown/unknown", true, "text/xml"},
+    {":/application_rss+xml", "application/unknown", false, "text/xml"},
+    {":/application_rss+xml", "application/unknown", true, "text/xml"},
+    {":/application_rss+xml", "*/*", false, "text/xml"},
+    {":/application_rss+xml", "*/*", true, "text/xml"},
+    {":/application_rss+xml", "text/xml", false, 0},
+    {":/application_rss+xml", "text/xml", true, 0},
+    {":/application_rss+xml", "application/xml", false, 0},
+    {":/application_rss+xml", "application/xml", true, 0},
+    {":/application_rss+xml", "text/html", false, "application/rss+xml"},
+    {":/application_rss+xml", "text/html", true, 0},
+    {":/application_rss+xml", "text/xml", false, 0},
+    {":/application_rss+xml", "text/xml", true, 0},
+    {":/application_rss+xml", "application/pdf", false, 0},
+    {":/application_rss+xml", "application/pdf", true, 0},
+    {":/application_rss+xml", "application/postscript", false, 0},
+    {":/application_rss+xml", "application/postscript", true, 0},
+    {":/application_rss+xml", "application/ogg", false, 0},
+    {":/application_rss+xml", "application/ogg", true, 0},
+    {":/application_rss+xml", "video/webm", false, 0},
+    {":/application_rss+xml", "video/webm", true, 0},
+    {":/application_rss+xml", "application/x-rar-compressed", false, 0},
+    {":/application_rss+xml", "application/x-rar-compressed", true, 0},
+    {":/application_rss+xml", "application/zip", false, 0},
+    {":/application_rss+xml", "application/zip", true, 0},
+    {":/application_rss+xml", "application/x-gzip", false, 0},
+    {":/application_rss+xml", "application/x-gzip", true, 0},
+    {":/application_rss+xml", "audio/x-wave", false, 0},
+    {":/application_rss+xml", "audio/x-wave", true, 0},
+    {":/application_rss+xml", "image/webp", false, 0},
+    {":/application_rss+xml", "image/webp", true, 0},
+    {":/application_rss+xml", "image/gif", false, 0},
+    {":/application_rss+xml", "image/gif", true, 0},
+    {":/application_rss+xml", "image/png", false, 0},
+    {":/application_rss+xml", "image/png", true, 0},
+    {":/application_rss+xml", "image/jpeg", false, 0},
+    {":/application_rss+xml", "image/jpeg", true, 0},
+    {":/application_rss+xml", "image/bmp", false, 0},
+    {":/application_rss+xml", "image/bmp", true, 0},
+    {":/application_rss+xml", "image/vnd.microsoft.icon", false, 0},
+    {":/application_rss+xml", "image/vnd.microsoft.icon", true, 0},
+    {":/application_rss+xml", "application/rdf+xml", false, 0},
+    {":/application_rss+xml", "application/rdf+xml", true, 0},
+    {":/application_rss+xml", "application/rss+xml", false, 0},
+    {":/application_rss+xml", "application/rss+xml", true, 0},
+    {":/application_rss+xml", "application/atom+xml", false, 0},
+    {":/application_rss+xml", "application/atom+xml", true, 0},
+    {":/application_x-gzip", "text/plain", false, "application/x-gzip"},
+    {":/application_x-gzip", "text/plain", true, "application/x-gzip"},
+    {":/application_x-gzip", "unknown/unknown", false, "application/x-gzip"},
+    {":/application_x-gzip", "unknown/unknown", true, "application/x-gzip"},
+    {":/application_x-gzip", "application/unknown", false, "application/x-gzip"},
+    {":/application_x-gzip", "application/unknown", true, "application/x-gzip"},
+    {":/application_x-gzip", "*/*", false, "application/x-gzip"},
+    {":/application_x-gzip", "*/*", true, "application/x-gzip"},
+    {":/application_x-gzip", "text/xml", false, 0},
+    {":/application_x-gzip", "text/xml", true, 0},
+    {":/application_x-gzip", "application/xml", false, 0},
+    {":/application_x-gzip", "application/xml", true, 0},
+    {":/application_x-gzip", "text/html", false, 0},
+    {":/application_x-gzip", "text/html", true, 0},
+    {":/application_x-gzip", "text/xml", false, 0},
+    {":/application_x-gzip", "text/xml", true, 0},
+    {":/application_x-gzip", "application/pdf", false, 0},
+    {":/application_x-gzip", "application/pdf", true, 0},
+    {":/application_x-gzip", "application/postscript", false, 0},
+    {":/application_x-gzip", "application/postscript", true, 0},
+    {":/application_x-gzip", "application/ogg", false, 0},
+    {":/application_x-gzip", "application/ogg", true, 0},
+    {":/application_x-gzip", "video/webm", false, 0},
+    {":/application_x-gzip", "video/webm", true, 0},
+    {":/application_x-gzip", "application/x-rar-compressed", false, 0},
+    {":/application_x-gzip", "application/x-rar-compressed", true, 0},
+    {":/application_x-gzip", "application/zip", false, 0},
+    {":/application_x-gzip", "application/zip", true, 0},
+    {":/application_x-gzip", "application/x-gzip", false, 0},
+    {":/application_x-gzip", "application/x-gzip", true, 0},
+    {":/application_x-gzip", "audio/x-wave", false, 0},
+    {":/application_x-gzip", "audio/x-wave", true, 0},
+    {":/application_x-gzip", "image/webp", false, 0},
+    {":/application_x-gzip", "image/webp", true, 0},
+    {":/application_x-gzip", "image/gif", false, 0},
+    {":/application_x-gzip", "image/gif", true, 0},
+    {":/application_x-gzip", "image/png", false, 0},
+    {":/application_x-gzip", "image/png", true, 0},
+    {":/application_x-gzip", "image/jpeg", false, 0},
+    {":/application_x-gzip", "image/jpeg", true, 0},
+    {":/application_x-gzip", "image/bmp", false, 0},
+    {":/application_x-gzip", "image/bmp", true, 0},
+    {":/application_x-gzip", "image/vnd.microsoft.icon", false, 0},
+    {":/application_x-gzip", "image/vnd.microsoft.icon", true, 0},
+    {":/application_x-gzip", "application/rdf+xml", false, 0},
+    {":/application_x-gzip", "application/rdf+xml", true, 0},
+    {":/application_x-gzip", "application/rss+xml", false, 0},
+    {":/application_x-gzip", "application/rss+xml", true, 0},
+    {":/application_x-gzip", "application/atom+xml", false, 0},
+    {":/application_x-gzip", "application/atom+xml", true, 0},
+    {":/application_x-rar-compressed", "text/plain", false, "application/x-rar-compressed"},
+    {":/application_x-rar-compressed", "text/plain", true, "application/x-rar-compressed"},
+    {":/application_x-rar-compressed", "unknown/unknown", false, "application/x-rar-compressed"},
+    {":/application_x-rar-compressed", "unknown/unknown", true, "application/x-rar-compressed"},
+    {":/application_x-rar-compressed", "application/unknown", false, "application/x-rar-compressed"},
+    {":/application_x-rar-compressed", "application/unknown", true, "application/x-rar-compressed"},
+    {":/application_x-rar-compressed", "*/*", false, "application/x-rar-compressed"},
+    {":/application_x-rar-compressed", "*/*", true, "application/x-rar-compressed"},
+    {":/application_x-rar-compressed", "text/xml", false, 0},
+    {":/application_x-rar-compressed", "text/xml", true, 0},
+    {":/application_x-rar-compressed", "application/xml", false, 0},
+    {":/application_x-rar-compressed", "application/xml", true, 0},
+    {":/application_x-rar-compressed", "text/html", false, 0},
+    {":/application_x-rar-compressed", "text/html", true, 0},
+    {":/application_x-rar-compressed", "text/xml", false, 0},
+    {":/application_x-rar-compressed", "text/xml", true, 0},
+    {":/application_x-rar-compressed", "application/pdf", false, 0},
+    {":/application_x-rar-compressed", "application/pdf", true, 0},
+    {":/application_x-rar-compressed", "application/postscript", false, 0},
+    {":/application_x-rar-compressed", "application/postscript", true, 0},
+    {":/application_x-rar-compressed", "application/ogg", false, 0},
+    {":/application_x-rar-compressed", "application/ogg", true, 0},
+    {":/application_x-rar-compressed", "video/webm", false, 0},
+    {":/application_x-rar-compressed", "video/webm", true, 0},
+    {":/application_x-rar-compressed", "application/x-rar-compressed", false, 0},
+    {":/application_x-rar-compressed", "application/x-rar-compressed", true, 0},
+    {":/application_x-rar-compressed", "application/zip", false, 0},
+    {":/application_x-rar-compressed", "application/zip", true, 0},
+    {":/application_x-rar-compressed", "application/x-gzip", false, 0},
+    {":/application_x-rar-compressed", "application/x-gzip", true, 0},
+    {":/application_x-rar-compressed", "audio/x-wave", false, 0},
+    {":/application_x-rar-compressed", "audio/x-wave", true, 0},
+    {":/application_x-rar-compressed", "image/webp", false, 0},
+    {":/application_x-rar-compressed", "image/webp", true, 0},
+    {":/application_x-rar-compressed", "image/gif", false, 0},
+    {":/application_x-rar-compressed", "image/gif", true, 0},
+    {":/application_x-rar-compressed", "image/png", false, 0},
+    {":/application_x-rar-compressed", "image/png", true, 0},
+    {":/application_x-rar-compressed", "image/jpeg", false, 0},
+    {":/application_x-rar-compressed", "image/jpeg", true, 0},
+    {":/application_x-rar-compressed", "image/bmp", false, 0},
+    {":/application_x-rar-compressed", "image/bmp", true, 0},
+    {":/application_x-rar-compressed", "image/vnd.microsoft.icon", false, 0},
+    {":/application_x-rar-compressed", "image/vnd.microsoft.icon", true, 0},
+    {":/application_x-rar-compressed", "application/rdf+xml", false, 0},
+    {":/application_x-rar-compressed", "application/rdf+xml", true, 0},
+    {":/application_x-rar-compressed", "application/rss+xml", false, 0},
+    {":/application_x-rar-compressed", "application/rss+xml", true, 0},
+    {":/application_x-rar-compressed", "application/atom+xml", false, 0},
+    {":/application_x-rar-compressed", "application/atom+xml", true, 0},
+    {":/application_zip", "text/plain", false, "application/zip"},
+    {":/application_zip", "text/plain", true, "application/zip"},
+    {":/application_zip", "unknown/unknown", false, "application/zip"},
+    {":/application_zip", "unknown/unknown", true, "application/zip"},
+    {":/application_zip", "application/unknown", false, "application/zip"},
+    {":/application_zip", "application/unknown", true, "application/zip"},
+    {":/application_zip", "*/*", false, "application/zip"},
+    {":/application_zip", "*/*", true, "application/zip"},
+    {":/application_zip", "text/xml", false, 0},
+    {":/application_zip", "text/xml", true, 0},
+    {":/application_zip", "application/xml", false, 0},
+    {":/application_zip", "application/xml", true, 0},
+    {":/application_zip", "text/html", false, 0},
+    {":/application_zip", "text/html", true, 0},
+    {":/application_zip", "text/xml", false, 0},
+    {":/application_zip", "text/xml", true, 0},
+    {":/application_zip", "application/pdf", false, 0},
+    {":/application_zip", "application/pdf", true, 0},
+    {":/application_zip", "application/postscript", false, 0},
+    {":/application_zip", "application/postscript", true, 0},
+    {":/application_zip", "application/ogg", false, 0},
+    {":/application_zip", "application/ogg", true, 0},
+    {":/application_zip", "video/webm", false, 0},
+    {":/application_zip", "video/webm", true, 0},
+    {":/application_zip", "application/x-rar-compressed", false, 0},
+    {":/application_zip", "application/x-rar-compressed", true, 0},
+    {":/application_zip", "application/zip", false, 0},
+    {":/application_zip", "application/zip", true, 0},
+    {":/application_zip", "application/x-gzip", false, 0},
+    {":/application_zip", "application/x-gzip", true, 0},
+    {":/application_zip", "audio/x-wave", false, 0},
+    {":/application_zip", "audio/x-wave", true, 0},
+    {":/application_zip", "image/webp", false, 0},
+    {":/application_zip", "image/webp", true, 0},
+    {":/application_zip", "image/gif", false, 0},
+    {":/application_zip", "image/gif", true, 0},
+    {":/application_zip", "image/png", false, 0},
+    {":/application_zip", "image/png", true, 0},
+    {":/application_zip", "image/jpeg", false, 0},
+    {":/application_zip", "image/jpeg", true, 0},
+    {":/application_zip", "image/bmp", false, 0},
+    {":/application_zip", "image/bmp", true, 0},
+    {":/application_zip", "image/vnd.microsoft.icon", false, 0},
+    {":/application_zip", "image/vnd.microsoft.icon", true, 0},
+    {":/application_zip", "application/rdf+xml", false, 0},
+    {":/application_zip", "application/rdf+xml", true, 0},
+    {":/application_zip", "application/rss+xml", false, 0},
+    {":/application_zip", "application/rss+xml", true, 0},
+    {":/application_zip", "application/atom+xml", false, 0},
+    {":/application_zip", "application/atom+xml", true, 0},
+    {":/audio_x-wave", "text/plain", false, "audio/x-wave"},
+    {":/audio_x-wave", "text/plain", true, "audio/x-wave"},
+    {":/audio_x-wave", "unknown/unknown", false, "audio/x-wave"},
+    {":/audio_x-wave", "unknown/unknown", true, "audio/x-wave"},
+    {":/audio_x-wave", "application/unknown", false, "audio/x-wave"},
+    {":/audio_x-wave", "application/unknown", true, "audio/x-wave"},
+    {":/audio_x-wave", "*/*", false, "audio/x-wave"},
+    {":/audio_x-wave", "*/*", true, "audio/x-wave"},
+    {":/audio_x-wave", "text/xml", false, 0},
+    {":/audio_x-wave", "text/xml", true, 0},
+    {":/audio_x-wave", "application/xml", false, 0},
+    {":/audio_x-wave", "application/xml", true, 0},
+    {":/audio_x-wave", "text/html", false, 0},
+    {":/audio_x-wave", "text/html", true, 0},
+    {":/audio_x-wave", "text/xml", false, 0},
+    {":/audio_x-wave", "text/xml", true, 0},
+    {":/audio_x-wave", "application/pdf", false, 0},
+    {":/audio_x-wave", "application/pdf", true, 0},
+    {":/audio_x-wave", "application/postscript", false, 0},
+    {":/audio_x-wave", "application/postscript", true, 0},
+    {":/audio_x-wave", "application/ogg", false, 0},
+    {":/audio_x-wave", "application/ogg", true, 0},
+    {":/audio_x-wave", "video/webm", false, 0},
+    {":/audio_x-wave", "video/webm", true, 0},
+    {":/audio_x-wave", "application/x-rar-compressed", false, 0},
+    {":/audio_x-wave", "application/x-rar-compressed", true, 0},
+    {":/audio_x-wave", "application/zip", false, 0},
+    {":/audio_x-wave", "application/zip", true, 0},
+    {":/audio_x-wave", "application/x-gzip", false, 0},
+    {":/audio_x-wave", "application/x-gzip", true, 0},
+    {":/audio_x-wave", "audio/x-wave", false, 0},
+    {":/audio_x-wave", "audio/x-wave", true, 0},
+    {":/audio_x-wave", "image/webp", false, 0},
+    {":/audio_x-wave", "image/webp", true, 0},
+    {":/audio_x-wave", "image/gif", false, 0},
+    {":/audio_x-wave", "image/gif", true, 0},
+    {":/audio_x-wave", "image/png", false, 0},
+    {":/audio_x-wave", "image/png", true, 0},
+    {":/audio_x-wave", "image/jpeg", false, 0},
+    {":/audio_x-wave", "image/jpeg", true, 0},
+    {":/audio_x-wave", "image/bmp", false, 0},
+    {":/audio_x-wave", "image/bmp", true, 0},
+    {":/audio_x-wave", "image/vnd.microsoft.icon", false, 0},
+    {":/audio_x-wave", "image/vnd.microsoft.icon", true, 0},
+    {":/audio_x-wave", "application/rdf+xml", false, 0},
+    {":/audio_x-wave", "application/rdf+xml", true, 0},
+    {":/audio_x-wave", "application/rss+xml", false, 0},
+    {":/audio_x-wave", "application/rss+xml", true, 0},
+    {":/audio_x-wave", "application/atom+xml", false, 0},
+    {":/audio_x-wave", "application/atom+xml", true, 0},
+    {":/image_bmp", "text/plain", false, "image/bmp"},
+    {":/image_bmp", "text/plain", true, "image/bmp"},
+    {":/image_bmp", "unknown/unknown", false, "image/bmp"},
+    {":/image_bmp", "unknown/unknown", true, "image/bmp"},
+    {":/image_bmp", "application/unknown", false, "image/bmp"},
+    {":/image_bmp", "application/unknown", true, "image/bmp"},
+    {":/image_bmp", "*/*", false, "image/bmp"},
+    {":/image_bmp", "*/*", true, "image/bmp"},
+    {":/image_bmp", "text/xml", false, 0},
+    {":/image_bmp", "text/xml", true, 0},
+    {":/image_bmp", "application/xml", false, 0},
+    {":/image_bmp", "application/xml", true, 0},
+    {":/image_bmp", "text/html", false, 0},
+    {":/image_bmp", "text/html", true, "image/bmp"},
+    {":/image_bmp", "text/xml", false, 0},
+    {":/image_bmp", "text/xml", true, 0},
+    {":/image_bmp", "application/pdf", false, 0},
+    {":/image_bmp", "application/pdf", true, "image/bmp"},
+    {":/image_bmp", "application/postscript", false, 0},
+    {":/image_bmp", "application/postscript", true, "image/bmp"},
+    {":/image_bmp", "application/ogg", false, 0},
+    {":/image_bmp", "application/ogg", true, "image/bmp"},
+    {":/image_bmp", "video/webm", false, 0},
+    {":/image_bmp", "video/webm", true, "image/bmp"},
+    {":/image_bmp", "application/x-rar-compressed", false, 0},
+    {":/image_bmp", "application/x-rar-compressed", true, "image/bmp"},
+    {":/image_bmp", "application/zip", false, 0},
+    {":/image_bmp", "application/zip", true, "image/bmp"},
+    {":/image_bmp", "application/x-gzip", false, 0},
+    {":/image_bmp", "application/x-gzip", true, "image/bmp"},
+    {":/image_bmp", "audio/x-wave", false, 0},
+    {":/image_bmp", "audio/x-wave", true, "image/bmp"},
+    {":/image_bmp", "image/webp", false, 0},
+    {":/image_bmp", "image/webp", true, "image/bmp"},
+    {":/image_bmp", "image/gif", false, 0},
+    {":/image_bmp", "image/gif", true, "image/bmp"},
+    {":/image_bmp", "image/png", false, 0},
+    {":/image_bmp", "image/png", true, "image/bmp"},
+    {":/image_bmp", "image/jpeg", false, 0},
+    {":/image_bmp", "image/jpeg", true, "image/bmp"},
+    {":/image_bmp", "image/bmp", false, 0},
+    {":/image_bmp", "image/bmp", true, "image/bmp"},
+    {":/image_bmp", "image/vnd.microsoft.icon", false, 0},
+    {":/image_bmp", "image/vnd.microsoft.icon", true, "image/bmp"},
+    {":/image_bmp", "application/rdf+xml", false, 0},
+    {":/image_bmp", "application/rdf+xml", true, 0},
+    {":/image_bmp", "application/rss+xml", false, 0},
+    {":/image_bmp", "application/rss+xml", true, 0},
+    {":/image_bmp", "application/atom+xml", false, 0},
+    {":/image_bmp", "application/atom+xml", true, 0},
+    {":/image_gif", "text/plain", false, "image/gif"},
+    {":/image_gif", "text/plain", true, "image/gif"},
+    {":/image_gif", "unknown/unknown", false, "image/gif"},
+    {":/image_gif", "unknown/unknown", true, "image/gif"},
+    {":/image_gif", "application/unknown", false, "image/gif"},
+    {":/image_gif", "application/unknown", true, "image/gif"},
+    {":/image_gif", "*/*", false, "image/gif"},
+    {":/image_gif", "*/*", true, "image/gif"},
+    {":/image_gif", "text/xml", false, 0},
+    {":/image_gif", "text/xml", true, 0},
+    {":/image_gif", "application/xml", false, 0},
+    {":/image_gif", "application/xml", true, 0},
+    {":/image_gif", "text/html", false, 0},
+    {":/image_gif", "text/html", true, "image/gif"},
+    {":/image_gif", "text/xml", false, 0},
+    {":/image_gif", "text/xml", true, 0},
+    {":/image_gif", "application/pdf", false, 0},
+    {":/image_gif", "application/pdf", true, "image/gif"},
+    {":/image_gif", "application/postscript", false, 0},
+    {":/image_gif", "application/postscript", true, "image/gif"},
+    {":/image_gif", "application/ogg", false, 0},
+    {":/image_gif", "application/ogg", true, "image/gif"},
+    {":/image_gif", "video/webm", false, 0},
+    {":/image_gif", "video/webm", true, "image/gif"},
+    {":/image_gif", "application/x-rar-compressed", false, 0},
+    {":/image_gif", "application/x-rar-compressed", true, "image/gif"},
+    {":/image_gif", "application/zip", false, 0},
+    {":/image_gif", "application/zip", true, "image/gif"},
+    {":/image_gif", "application/x-gzip", false, 0},
+    {":/image_gif", "application/x-gzip", true, "image/gif"},
+    {":/image_gif", "audio/x-wave", false, 0},
+    {":/image_gif", "audio/x-wave", true, "image/gif"},
+    {":/image_gif", "image/webp", false, 0},
+    {":/image_gif", "image/webp", true, "image/gif"},
+    {":/image_gif", "image/gif", false, 0},
+    {":/image_gif", "image/gif", true, "image/gif"},
+    {":/image_gif", "image/png", false, 0},
+    {":/image_gif", "image/png", true, "image/gif"},
+    {":/image_gif", "image/jpeg", false, 0},
+    {":/image_gif", "image/jpeg", true, "image/gif"},
+    {":/image_gif", "image/bmp", false, 0},
+    {":/image_gif", "image/bmp", true, "image/gif"},
+    {":/image_gif", "image/vnd.microsoft.icon", false, 0},
+    {":/image_gif", "image/vnd.microsoft.icon", true, "image/gif"},
+    {":/image_gif", "application/rdf+xml", false, 0},
+    {":/image_gif", "application/rdf+xml", true, 0},
+    {":/image_gif", "application/rss+xml", false, 0},
+    {":/image_gif", "application/rss+xml", true, 0},
+    {":/image_gif", "application/atom+xml", false, 0},
+    {":/image_gif", "application/atom+xml", true, 0},
+    {":/image_jpeg", "text/plain", false, "image/jpeg"},
+    {":/image_jpeg", "text/plain", true, "image/jpeg"},
+    {":/image_jpeg", "unknown/unknown", false, "image/jpeg"},
+    {":/image_jpeg", "unknown/unknown", true, "image/jpeg"},
+    {":/image_jpeg", "application/unknown", false, "image/jpeg"},
+    {":/image_jpeg", "application/unknown", true, "image/jpeg"},
+    {":/image_jpeg", "*/*", false, "image/jpeg"},
+    {":/image_jpeg", "*/*", true, "image/jpeg"},
+    {":/image_jpeg", "text/xml", false, 0},
+    {":/image_jpeg", "text/xml", true, 0},
+    {":/image_jpeg", "application/xml", false, 0},
+    {":/image_jpeg", "application/xml", true, 0},
+    {":/image_jpeg", "text/html", false, 0},
+    {":/image_jpeg", "text/html", true, "image/jpeg"},
+    {":/image_jpeg", "text/xml", false, 0},
+    {":/image_jpeg", "text/xml", true, 0},
+    {":/image_jpeg", "application/pdf", false, 0},
+    {":/image_jpeg", "application/pdf", true, "image/jpeg"},
+    {":/image_jpeg", "application/postscript", false, 0},
+    {":/image_jpeg", "application/postscript", true, "image/jpeg"},
+    {":/image_jpeg", "application/ogg", false, 0},
+    {":/image_jpeg", "application/ogg", true, "image/jpeg"},
+    {":/image_jpeg", "video/webm", false, 0},
+    {":/image_jpeg", "video/webm", true, "image/jpeg"},
+    {":/image_jpeg", "application/x-rar-compressed", false, 0},
+    {":/image_jpeg", "application/x-rar-compressed", true, "image/jpeg"},
+    {":/image_jpeg", "application/zip", false, 0},
+    {":/image_jpeg", "application/zip", true, "image/jpeg"},
+    {":/image_jpeg", "application/x-gzip", false, 0},
+    {":/image_jpeg", "application/x-gzip", true, "image/jpeg"},
+    {":/image_jpeg", "audio/x-wave", false, 0},
+    {":/image_jpeg", "audio/x-wave", true, "image/jpeg"},
+    {":/image_jpeg", "image/webp", false, 0},
+    {":/image_jpeg", "image/webp", true, "image/jpeg"},
+    {":/image_jpeg", "image/gif", false, 0},
+    {":/image_jpeg", "image/gif", true, "image/jpeg"},
+    {":/image_jpeg", "image/png", false, 0},
+    {":/image_jpeg", "image/png", true, "image/jpeg"},
+    {":/image_jpeg", "image/jpeg", false, 0},
+    {":/image_jpeg", "image/jpeg", true, "image/jpeg"},
+    {":/image_jpeg", "image/bmp", false, 0},
+    {":/image_jpeg", "image/bmp", true, "image/jpeg"},
+    {":/image_jpeg", "image/vnd.microsoft.icon", false, 0},
+    {":/image_jpeg", "image/vnd.microsoft.icon", true, "image/jpeg"},
+    {":/image_jpeg", "application/rdf+xml", false, 0},
+    {":/image_jpeg", "application/rdf+xml", true, 0},
+    {":/image_jpeg", "application/rss+xml", false, 0},
+    {":/image_jpeg", "application/rss+xml", true, 0},
+    {":/image_jpeg", "application/atom+xml", false, 0},
+    {":/image_jpeg", "application/atom+xml", true, 0},
+    {":/image_png", "text/plain", false, "image/png"},
+    {":/image_png", "text/plain", true, "image/png"},
+    {":/image_png", "unknown/unknown", false, "image/png"},
+    {":/image_png", "unknown/unknown", true, "image/png"},
+    {":/image_png", "application/unknown", false, "image/png"},
+    {":/image_png", "application/unknown", true, "image/png"},
+    {":/image_png", "*/*", false, "image/png"},
+    {":/image_png", "*/*", true, "image/png"},
+    {":/image_png", "text/xml", false, 0},
+    {":/image_png", "text/xml", true, 0},
+    {":/image_png", "application/xml", false, 0},
+    {":/image_png", "application/xml", true, 0},
+    {":/image_png", "text/html", false, 0},
+    {":/image_png", "text/html", true, "image/png"},
+    {":/image_png", "text/xml", false, 0},
+    {":/image_png", "text/xml", true, 0},
+    {":/image_png", "application/pdf", false, 0},
+    {":/image_png", "application/pdf", true, "image/png"},
+    {":/image_png", "application/postscript", false, 0},
+    {":/image_png", "application/postscript", true, "image/png"},
+    {":/image_png", "application/ogg", false, 0},
+    {":/image_png", "application/ogg", true, "image/png"},
+    {":/image_png", "video/webm", false, 0},
+    {":/image_png", "video/webm", true, "image/png"},
+    {":/image_png", "application/x-rar-compressed", false, 0},
+    {":/image_png", "application/x-rar-compressed", true, "image/png"},
+    {":/image_png", "application/zip", false, 0},
+    {":/image_png", "application/zip", true, "image/png"},
+    {":/image_png", "application/x-gzip", false, 0},
+    {":/image_png", "application/x-gzip", true, "image/png"},
+    {":/image_png", "audio/x-wave", false, 0},
+    {":/image_png", "audio/x-wave", true, "image/png"},
+    {":/image_png", "image/webp", false, 0},
+    {":/image_png", "image/webp", true, "image/png"},
+    {":/image_png", "image/gif", false, 0},
+    {":/image_png", "image/gif", true, "image/png"},
+    {":/image_png", "image/png", false, 0},
+    {":/image_png", "image/png", true, "image/png"},
+    {":/image_png", "image/jpeg", false, 0},
+    {":/image_png", "image/jpeg", true, "image/png"},
+    {":/image_png", "image/bmp", false, 0},
+    {":/image_png", "image/bmp", true, "image/png"},
+    {":/image_png", "image/vnd.microsoft.icon", false, 0},
+    {":/image_png", "image/vnd.microsoft.icon", true, "image/png"},
+    {":/image_png", "application/rdf+xml", false, 0},
+    {":/image_png", "application/rdf+xml", true, 0},
+    {":/image_png", "application/rss+xml", false, 0},
+    {":/image_png", "application/rss+xml", true, 0},
+    {":/image_png", "application/atom+xml", false, 0},
+    {":/image_png", "application/atom+xml", true, 0},
+    {":/image_vnd.microsoft.icon", "text/plain", false, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "text/plain", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "unknown/unknown", false, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "unknown/unknown", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "application/unknown", false, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "application/unknown", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "*/*", false, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "*/*", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "text/xml", false, 0},
+    {":/image_vnd.microsoft.icon", "text/xml", true, 0},
+    {":/image_vnd.microsoft.icon", "application/xml", false, 0},
+    {":/image_vnd.microsoft.icon", "application/xml", true, 0},
+    {":/image_vnd.microsoft.icon", "text/html", false, 0},
+    {":/image_vnd.microsoft.icon", "text/html", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "text/xml", false, 0},
+    {":/image_vnd.microsoft.icon", "text/xml", true, 0},
+    {":/image_vnd.microsoft.icon", "application/pdf", false, 0},
+    {":/image_vnd.microsoft.icon", "application/pdf", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "application/postscript", false, 0},
+    {":/image_vnd.microsoft.icon", "application/postscript", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "application/ogg", false, 0},
+    {":/image_vnd.microsoft.icon", "application/ogg", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "video/webm", false, 0},
+    {":/image_vnd.microsoft.icon", "video/webm", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "application/x-rar-compressed", false, 0},
+    {":/image_vnd.microsoft.icon", "application/x-rar-compressed", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "application/zip", false, 0},
+    {":/image_vnd.microsoft.icon", "application/zip", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "application/x-gzip", false, 0},
+    {":/image_vnd.microsoft.icon", "application/x-gzip", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "audio/x-wave", false, 0},
+    {":/image_vnd.microsoft.icon", "audio/x-wave", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "image/webp", false, 0},
+    {":/image_vnd.microsoft.icon", "image/webp", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "image/gif", false, 0},
+    {":/image_vnd.microsoft.icon", "image/gif", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "image/png", false, 0},
+    {":/image_vnd.microsoft.icon", "image/png", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "image/jpeg", false, 0},
+    {":/image_vnd.microsoft.icon", "image/jpeg", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "image/bmp", false, 0},
+    {":/image_vnd.microsoft.icon", "image/bmp", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "image/vnd.microsoft.icon", false, 0},
+    {":/image_vnd.microsoft.icon", "image/vnd.microsoft.icon", true, "image/vnd.microsoft.icon"},
+    {":/image_vnd.microsoft.icon", "application/rdf+xml", false, 0},
+    {":/image_vnd.microsoft.icon", "application/rdf+xml", true, 0},
+    {":/image_vnd.microsoft.icon", "application/rss+xml", false, 0},
+    {":/image_vnd.microsoft.icon", "application/rss+xml", true, 0},
+    {":/image_vnd.microsoft.icon", "application/atom+xml", false, 0},
+    {":/image_vnd.microsoft.icon", "application/atom+xml", true, 0},
+    {":/image_webp", "text/plain", false, "image/webp"},
+    {":/image_webp", "text/plain", true, "image/webp"},
+    {":/image_webp", "unknown/unknown", false, "image/webp"},
+    {":/image_webp", "unknown/unknown", true, "image/webp"},
+    {":/image_webp", "application/unknown", false, "image/webp"},
+    {":/image_webp", "application/unknown", true, "image/webp"},
+    {":/image_webp", "*/*", false, "image/webp"},
+    {":/image_webp", "*/*", true, "image/webp"},
+    {":/image_webp", "text/xml", false, 0},
+    {":/image_webp", "text/xml", true, 0},
+    {":/image_webp", "application/xml", false, 0},
+    {":/image_webp", "application/xml", true, 0},
+    {":/image_webp", "text/html", false, 0},
+    {":/image_webp", "text/html", true, "image/webp"},
+    {":/image_webp", "text/xml", false, 0},
+    {":/image_webp", "text/xml", true, 0},
+    {":/image_webp", "application/pdf", false, 0},
+    {":/image_webp", "application/pdf", true, "image/webp"},
+    {":/image_webp", "application/postscript", false, 0},
+    {":/image_webp", "application/postscript", true, "image/webp"},
+    {":/image_webp", "application/ogg", false, 0},
+    {":/image_webp", "application/ogg", true, "image/webp"},
+    {":/image_webp", "video/webm", false, 0},
+    {":/image_webp", "video/webm", true, "image/webp"},
+    {":/image_webp", "application/x-rar-compressed", false, 0},
+    {":/image_webp", "application/x-rar-compressed", true, "image/webp"},
+    {":/image_webp", "application/zip", false, 0},
+    {":/image_webp", "application/zip", true, "image/webp"},
+    {":/image_webp", "application/x-gzip", false, 0},
+    {":/image_webp", "application/x-gzip", true, "image/webp"},
+    {":/image_webp", "audio/x-wave", false, 0},
+    {":/image_webp", "audio/x-wave", true, "image/webp"},
+    {":/image_webp", "image/webp", false, 0},
+    {":/image_webp", "image/webp", true, "image/webp"},
+    {":/image_webp", "image/gif", false, 0},
+    {":/image_webp", "image/gif", true, "image/webp"},
+    {":/image_webp", "image/png", false, 0},
+    {":/image_webp", "image/png", true, "image/webp"},
+    {":/image_webp", "image/jpeg", false, 0},
+    {":/image_webp", "image/jpeg", true, "image/webp"},
+    {":/image_webp", "image/bmp", false, 0},
+    {":/image_webp", "image/bmp", true, "image/webp"},
+    {":/image_webp", "image/vnd.microsoft.icon", false, 0},
+    {":/image_webp", "image/vnd.microsoft.icon", true, "image/webp"},
+    {":/image_webp", "application/rdf+xml", false, 0},
+    {":/image_webp", "application/rdf+xml", true, 0},
+    {":/image_webp", "application/rss+xml", false, 0},
+    {":/image_webp", "application/rss+xml", true, 0},
+    {":/image_webp", "application/atom+xml", false, 0},
+    {":/image_webp", "application/atom+xml", true, 0},
+    {":/text_html", "text/plain", false, "text/plain"},
+    {":/text_html", "text/plain", true, "text/plain"},
+    {":/text_html", "unknown/unknown", false, "text/html"},
+    {":/text_html", "unknown/unknown", true, "text/html"},
+    {":/text_html", "application/unknown", false, "text/html"},
+    {":/text_html", "application/unknown", true, "text/html"},
+    {":/text_html", "*/*", false, "text/html"},
+    {":/text_html", "*/*", true, "text/html"},
+    {":/text_html", "text/xml", false, 0},
+    {":/text_html", "text/xml", true, 0},
+    {":/text_html", "application/xml", false, 0},
+    {":/text_html", "application/xml", true, 0},
+    {":/text_html", "text/html", false, 0},
+    {":/text_html", "text/html", true, 0},
+    {":/text_html", "text/xml", false, 0},
+    {":/text_html", "text/xml", true, 0},
+    {":/text_html", "application/pdf", false, 0},
+    {":/text_html", "application/pdf", true, 0},
+    {":/text_html", "application/postscript", false, 0},
+    {":/text_html", "application/postscript", true, 0},
+    {":/text_html", "application/ogg", false, 0},
+    {":/text_html", "application/ogg", true, 0},
+    {":/text_html", "video/webm", false, 0},
+    {":/text_html", "video/webm", true, 0},
+    {":/text_html", "application/x-rar-compressed", false, 0},
+    {":/text_html", "application/x-rar-compressed", true, 0},
+    {":/text_html", "application/zip", false, 0},
+    {":/text_html", "application/zip", true, 0},
+    {":/text_html", "application/x-gzip", false, 0},
+    {":/text_html", "application/x-gzip", true, 0},
+    {":/text_html", "audio/x-wave", false, 0},
+    {":/text_html", "audio/x-wave", true, 0},
+    {":/text_html", "image/webp", false, 0},
+    {":/text_html", "image/webp", true, 0},
+    {":/text_html", "image/gif", false, 0},
+    {":/text_html", "image/gif", true, 0},
+    {":/text_html", "image/png", false, 0},
+    {":/text_html", "image/png", true, 0},
+    {":/text_html", "image/jpeg", false, 0},
+    {":/text_html", "image/jpeg", true, 0},
+    {":/text_html", "image/bmp", false, 0},
+    {":/text_html", "image/bmp", true, 0},
+    {":/text_html", "image/vnd.microsoft.icon", false, 0},
+    {":/text_html", "image/vnd.microsoft.icon", true, 0},
+    {":/text_html", "application/rdf+xml", false, 0},
+    {":/text_html", "application/rdf+xml", true, 0},
+    {":/text_html", "application/rss+xml", false, 0},
+    {":/text_html", "application/rss+xml", true, 0},
+    {":/text_html", "application/atom+xml", false, 0},
+    {":/text_html", "application/atom+xml", true, 0},
+    {":/text_xml", "text/plain", false, "text/plain"},
+    {":/text_xml", "text/plain", true, "text/plain"},
+    {":/text_xml", "unknown/unknown", false, "text/xml"},
+    {":/text_xml", "unknown/unknown", true, "text/xml"},
+    {":/text_xml", "application/unknown", false, "text/xml"},
+    {":/text_xml", "application/unknown", true, "text/xml"},
+    {":/text_xml", "*/*", false, "text/xml"},
+    {":/text_xml", "*/*", true, "text/xml"},
+    {":/text_xml", "text/xml", false, 0},
+    {":/text_xml", "text/xml", true, 0},
+    {":/text_xml", "application/xml", false, 0},
+    {":/text_xml", "application/xml", true, 0},
+    {":/text_xml", "text/html", false, 0},
+    {":/text_xml", "text/html", true, 0},
+    {":/text_xml", "text/xml", false, 0},
+    {":/text_xml", "text/xml", true, 0},
+    {":/text_xml", "application/pdf", false, 0},
+    {":/text_xml", "application/pdf", true, 0},
+    {":/text_xml", "application/postscript", false, 0},
+    {":/text_xml", "application/postscript", true, 0},
+    {":/text_xml", "application/ogg", false, 0},
+    {":/text_xml", "application/ogg", true, 0},
+    {":/text_xml", "video/webm", false, 0},
+    {":/text_xml", "video/webm", true, 0},
+    {":/text_xml", "application/x-rar-compressed", false, 0},
+    {":/text_xml", "application/x-rar-compressed", true, 0},
+    {":/text_xml", "application/zip", false, 0},
+    {":/text_xml", "application/zip", true, 0},
+    {":/text_xml", "application/x-gzip", false, 0},
+    {":/text_xml", "application/x-gzip", true, 0},
+    {":/text_xml", "audio/x-wave", false, 0},
+    {":/text_xml", "audio/x-wave", true, 0},
+    {":/text_xml", "image/webp", false, 0},
+    {":/text_xml", "image/webp", true, 0},
+    {":/text_xml", "image/gif", false, 0},
+    {":/text_xml", "image/gif", true, 0},
+    {":/text_xml", "image/png", false, 0},
+    {":/text_xml", "image/png", true, 0},
+    {":/text_xml", "image/jpeg", false, 0},
+    {":/text_xml", "image/jpeg", true, 0},
+    {":/text_xml", "image/bmp", false, 0},
+    {":/text_xml", "image/bmp", true, 0},
+    {":/text_xml", "image/vnd.microsoft.icon", false, 0},
+    {":/text_xml", "image/vnd.microsoft.icon", true, 0},
+    {":/text_xml", "application/rdf+xml", false, 0},
+    {":/text_xml", "application/rdf+xml", true, 0},
+    {":/text_xml", "application/rss+xml", false, 0},
+    {":/text_xml", "application/rss+xml", true, 0},
+    {":/text_xml", "application/atom+xml", false, 0},
+    {":/text_xml", "application/atom+xml", true, 0},
+    {":/video_webm", "text/plain", false, "video/webm"},
+    {":/video_webm", "text/plain", true, "video/webm"},
+    {":/video_webm", "unknown/unknown", false, "video/webm"},
+    {":/video_webm", "unknown/unknown", true, "video/webm"},
+    {":/video_webm", "application/unknown", false, "video/webm"},
+    {":/video_webm", "application/unknown", true, "video/webm"},
+    {":/video_webm", "*/*", false, "video/webm"},
+    {":/video_webm", "*/*", true, "video/webm"},
+    {":/video_webm", "text/xml", false, 0},
+    {":/video_webm", "text/xml", true, 0},
+    {":/video_webm", "application/xml", false, 0},
+    {":/video_webm", "application/xml", true, 0},
+    {":/video_webm", "text/html", false, 0},
+    {":/video_webm", "text/html", true, 0},
+    {":/video_webm", "text/xml", false, 0},
+    {":/video_webm", "text/xml", true, 0},
+    {":/video_webm", "application/pdf", false, 0},
+    {":/video_webm", "application/pdf", true, 0},
+    {":/video_webm", "application/postscript", false, 0},
+    {":/video_webm", "application/postscript", true, 0},
+    {":/video_webm", "application/ogg", false, 0},
+    {":/video_webm", "application/ogg", true, 0},
+    {":/video_webm", "video/webm", false, 0},
+    {":/video_webm", "video/webm", true, 0},
+    {":/video_webm", "application/x-rar-compressed", false, 0},
+    {":/video_webm", "application/x-rar-compressed", true, 0},
+    {":/video_webm", "application/zip", false, 0},
+    {":/video_webm", "application/zip", true, 0},
+    {":/video_webm", "application/x-gzip", false, 0},
+    {":/video_webm", "application/x-gzip", true, 0},
+    {":/video_webm", "audio/x-wave", false, 0},
+    {":/video_webm", "audio/x-wave", true, 0},
+    {":/video_webm", "image/webp", false, 0},
+    {":/video_webm", "image/webp", true, 0},
+    {":/video_webm", "image/gif", false, 0},
+    {":/video_webm", "image/gif", true, 0},
+    {":/video_webm", "image/png", false, 0},
+    {":/video_webm", "image/png", true, 0},
+    {":/video_webm", "image/jpeg", false, 0},
+    {":/video_webm", "image/jpeg", true, 0},
+    {":/video_webm", "image/bmp", false, 0},
+    {":/video_webm", "image/bmp", true, 0},
+    {":/video_webm", "image/vnd.microsoft.icon", false, 0},
+    {":/video_webm", "image/vnd.microsoft.icon", true, 0},
+    {":/video_webm", "application/rdf+xml", false, 0},
+    {":/video_webm", "application/rdf+xml", true, 0},
+    {":/video_webm", "application/rss+xml", false, 0},
+    {":/video_webm", "application/rss+xml", true, 0},
+    {":/video_webm", "application/atom+xml", false, 0},
+    {":/video_webm", "application/atom+xml", true, 0}
+};
+static const size_t testListSize = sizeof(testList) / sizeof(testList[0]);
+
+#endif // TestData_h
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources.qrc b/Source/WebKit/qt/tests/MIMESniffing/resources.qrc
new file mode 100644
index 0000000..b4afb32
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources.qrc
@@ -0,0 +1,23 @@
+<RCC>
+    <qresource prefix="/">
+        <file alias="application_atom+xml">resources/application_atom+xml</file>
+        <file alias="application_ogg">resources/application_ogg</file>
+        <file alias="application_pdf">resources/application_pdf</file>
+        <file alias="application_postscript">resources/application_postscript</file>
+        <file alias="application_rdf+xml">resources/application_rdf+xml</file>
+        <file alias="application_rss+xml">resources/application_rss+xml</file>
+        <file alias="application_x-gzip">resources/application_x-gzip</file>
+        <file alias="application_x-rar-compressed">resources/application_x-rar-compressed</file>
+        <file alias="application_zip">resources/application_zip</file>
+        <file alias="audio_x-wave">resources/audio_x-wave</file>
+        <file alias="image_bmp">resources/image_bmp</file>
+        <file alias="image_gif">resources/image_gif</file>
+        <file alias="image_jpeg">resources/image_jpeg</file>
+        <file alias="image_png">resources/image_png</file>
+        <file alias="image_vnd.microsoft.icon">resources/image_vnd.microsoft.icon</file>
+        <file alias="image_webp">resources/image_webp</file>
+        <file alias="text_html">resources/text_html</file>
+        <file alias="text_xml">resources/text_xml</file>
+        <file alias="video_webm">resources/video_webm</file>
+    </qresource>
+</RCC>
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_atom+xml b/Source/WebKit/qt/tests/MIMESniffing/resources/application_atom+xml
new file mode 100644
index 0000000..54086a7
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_atom+xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<feed xmlns="http://www.w3.org/2005/Atom">
+    <title>Example Feed</title>
+    <link href="http://example.org/"/>
+    <updated>2003-12-13T18:30:02Z</updated>
+    <author>
+        <name>John Doe</name>
+    </author>
+    <id>urn:uuid:60a76c80-d399-11d9-b93C-0003939e0af6</id>
+    <entry>
+        <title>Atom-Powered Robots Run Amok</title>
+        <link href="http://example.org/2003/12/13/atom03"/>
+        <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6a</id>
+        <updated>2003-12-13T18:30:02Z</updated>
+        <summary>Some text.</summary>
+    </entry>
+</feed>
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_ogg b/Source/WebKit/qt/tests/MIMESniffing/resources/application_ogg
new file mode 100644
index 0000000..b9cc1b2
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_ogg
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_pdf b/Source/WebKit/qt/tests/MIMESniffing/resources/application_pdf
new file mode 100644
index 0000000..7f8996f
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_pdf
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_postscript b/Source/WebKit/qt/tests/MIMESniffing/resources/application_postscript
new file mode 100644
index 0000000..c4b9ae6
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_postscript
@@ -0,0 +1,137 @@
+%!PS-Adobe-2.0 EPSF-1.2
+%%Creator: HiJaak 2.1
+%%CreationDate: 12/29/93 13:52:08
+%%BoundingBox:126 216 486 576
+%%EndComments
+/ld {load def} bind def
+/s /stroke ld /f /fill ld /m /moveto ld /l /lineto ld /c /curveto ld /rgb {255 div 3 1 roll 255 div 3 1 roll 255 div 3 1 roll setrgbcolor} def
+126 216 translate
+360.0000 360.0000 scale
+/picstr 124 string def
+124 124 8 [124 0 0 -124 0 124] {currentfile picstr readhexstring pop} image
+65656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565ADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADAD1B1B1B1B1B1B1B1B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565006565656565006565656500656565656565000000656565656565656565656565656565656565656565656565656565656565ADADAD00ADADAD000000ADAD00ADADADADAD00AD00ADADADAD00ADADADAD00000000001B1B001B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565000065656500006565650065006565656500656565006565656565656565656565656565656565656565656565656565656565ADADAD00ADAD00ADADAD00ADAD00ADADAD00ADAD0000ADADAD00ADADADAD001B1B1B1B001B001B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565000065656500006565650065006565650065656565650065656565656565656565656565656565656565656565656565656565ADADAD00AD00ADADADADADADAD00ADADAD00ADAD00AD00ADAD00ADADADAD001B1B1B1B001B001B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565006500650065006565650065006565650065656565656565656565656565656565656565656565656565656565656565656565ADADAD00AD00ADADADADADADADAD00AD00ADADAD00AD00ADAD00ADADADAD00000000001B1B001B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565006500650065006565006565650065650065656500000065656565656565656565656565656565656565656565656565656565ADADAD00AD00ADADADADADADADADAD00ADADADAD00ADAD00AD00ADADADAD001B1B1B1B001B001B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565006500650065006565000000000065650065656565650065656565656565656565656565656565656565656565656565656565ADADAD00AD00ADADADADADADADADAD00ADADADAD00ADAD00AD00ADADADAD001B1B1B1B001B001B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565006565006565006500656565656500656500656565006565656565656565656565656565656565656565656565656565656565ADADAD00ADAD00ADADAD00ADADADAD00ADADADAD00ADADAD0000ADADADAD001B1B1B1B001B001B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565006565006565006500656565656500656565000000656565656565656565656565656565656565656565656565656565656565ADADAD00ADADAD000000ADADADADAD00ADADADAD00ADADADAD00ADADADAD00000000001B1B00000000FF
+65656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565ADADAD00ADADADADADADADADADADADADADADADADADADADADADADADADADADAD1B1B1B1B1B1B1B1B1B1BFF
+65656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565ADADAD00ADADADADADADADADADADADADADADADADADADADADADADADADADADAD1B1B1B1B1B1B1B1B1B1BFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC0000DCDC0000DC0000000000DC0000DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292000000009292000000000092920000929200009292929292ADADADAD00000000ADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC0000DCDC0000DC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929200009292000092000092920000920000929200009292929292ADADAD0000ADAD0000ADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC00DCDC00DCDC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292920000929292929292000092920000920000009200009292929292ADAD0000ADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC00000000DCDC0000000000DC0000DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292920000929292929292000092920000920000009200009292929292ADAD0000ADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC0000DCDCDC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292920000929200000092000000000092920000920000009292929292ADAD0000ADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC0000DCDCDC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292920000929292000092000092000092920000920000009292929292ADAD0000ADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC0000DCDCDC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929200009292000092000092920000920000929200009292929292ADADAD0000ADAD0000ADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC0000DCDCDC0000000000DC000000000000DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292000000009292000092929200000000929200009292929292ADADADAD00000000ADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+DCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC92929292929292929292929292929292929292929292929292929292929292ADADADADADADADADADADFF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A00000000004A4A00000000004A00000000004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDC0000DCDC0000DC0000000000DC0000DCDCDCDCDCDCDCDCDCDCDC00000065656500000065FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A00004A4A00004A00004A4A4A4A00004A4A00004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDC0000DCDC0000DC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDC00000065656500000065FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A00004A4A00004A00004A4A4A4A00004A4A00004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDC00DCDC00DCDC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDC00000000650000000065FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A00004A4A00004A00000000004A00004A4A00004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDC00000000DCDC0000000000DC0000DCDCDCDCDCDCDCDCDCDCDC00000000650000000065FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A00000000004A4A00004A4A4A4A00004A4A00004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDC0000DCDCDC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDC00006500650065000065FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A00004A00004A4A00004A4A4A4A00004A4A00004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDC0000DCDCDC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDC00006500000065000065FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A00004A4A00004A00004A4A4A4A00004A4A00004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDC0000DCDCDC0000DCDCDCDC0000DCDCDCDCDCDCDCDCDCDCDC00006500000065000065FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A00004A4A4A000000000000004A00000000004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDC0000DCDCDC0000000000DC000000000000DCDCDCDCDCDCDC00006565006565000065FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A00000000004A4A4A4A0000004A4A4A00000000004A4A4A4A004A4A4A4A4A00000000004A00000000004A00000000004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A004A4A4A4A004A4A004A4A4A004A4A4A4A004A4A4A4A4A4A004A4A4A4A4A004A4A4A4A4A004A4A4A4A4A4A4A004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A004A4A4A4A004A004A4A4A4A4A004A4A4A004A4A4A4A4A4A004A4A4A4A4A004A4A4A4A4A004A4A4A4A4A4A4A004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A00000000004A4A004A4A4A4A4A004A4A4A004A4A4A4A4A4A004A4A4A4A4A00000000004A000000004A4A4A4A004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A004A4A4A4A004A004A4A4A4A4A004A4A4A004A4A4A4A4A4A004A4A4A4A4A004A4A4A4A4A004A4A4A4A4A4A4A004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A004A4A4A4A004A004A4A4A4A4A004A4A4A004A4A4A4A4A4A004A4A4A4A4A004A4A4A4A4A004A4A4A4A4A4A4A004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A004A4A4A4A004A4A004A4A4A004A4A4A4A004A4A4A4A4A4A004A4A4A4A4A004A4A4A4A4A004A4A4A4A4A4A4A004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A00000000004A4A4A4A0000004A4A4A4A4A004A4A4A4A4A4A00000000004A00000000004A004A4A4A4A4A4A4A004A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4A4ADCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDCDC65656565656565656565FF
+showpage
+
+\ No newline at end of file
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_rdf+xml b/Source/WebKit/qt/tests/MIMESniffing/resources/application_rdf+xml
new file mode 100644
index 0000000..e214145
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_rdf+xml
@@ -0,0 +1,50 @@
+<?xml version="1.0"?>
+
+<rdf:RDF  xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns="http://purl.org/rss/1.0/">
+
+  <channel rdf:about="http://www.xml.com/xml/news.rss">
+    <title>XML.com</title>
+    <link>http://xml.com/pub</link>
+    <description>
+      XML.com features a rich mix of information and services
+      for the XML community.
+    </description>
+
+    <image rdf:resource="http://xml.com/universal/images/xml_tiny.gif" />
+
+    <items>
+      <rdf:Seq>
+        <rdf:li resource="http://xml.com/pub/2000/08/09/xslt/xslt.html" />
+        <rdf:li resource="http://xml.com/pub/2000/08/09/rdfdb/index.html" />
+      </rdf:Seq>
+    </items>
+
+  </channel>
+
+  <image rdf:about="http://xml.com/universal/images/xml_tiny.gif">
+    <title>XML.com</title>
+    <link>http://www.xml.com</link>
+    <url>http://xml.com/universal/images/xml_tiny.gif</url>
+  </image>
+
+  <item rdf:about="http://xml.com/pub/2000/08/09/xslt/xslt.html">
+    <title>Processing Inclusions with XSLT</title>
+    <link>http://xml.com/pub/2000/08/09/xslt/xslt.html</link>
+    <description>
+     Processing document inclusions with general XML tools can be
+     problematic. This article proposes a way of preserving inclusion
+     information through SAX-based processing.
+    </description>
+  </item>
+
+  <item rdf:about="http://xml.com/pub/2000/08/09/rdfdb/index.html">
+    <title>Putting RDF to Work</title>
+    <link>http://xml.com/pub/2000/08/09/rdfdb/index.html</link>
+    <description>
+     Tool and API support for the Resource Description Framework
+     is slowly coming of age. Edd Dumbill takes a look at RDFDB,
+     one of the most exciting new RDF toolkits.
+    </description>
+  </item>
+
+</rdf:RDF>
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_rss+xml b/Source/WebKit/qt/tests/MIMESniffing/resources/application_rss+xml
new file mode 100644
index 0000000..3537c41
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_rss+xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="ISO-8859-1" ?>
+<rss version="0.91">
+<channel>
+
+<title>Folha.com - Ambiente - Principal</title>
+<link>http://redir.folha.com.br/redir/online/ambiente/rss091/*http://www1.folha.uol.com.br/ambiente/</link>
+<description>Primeiro jornal em tempo real em l�ngua portuguesa</description>
+<language>pt-br</language>
+<copyright>Copyright Folha.com. Todos os direitos reservados.</copyright>
+<docs>http://redir.folha.com.br/redir/online/ambiente/rss091/*http://www1.folha.uol.com.br/folha/conheca/arquivo_e_copyright.shtml</docs>
+<webMaster>webmaster@grupofolha.com.br (Webmaster Folha.com)</webMaster>
+
+<image>
+<title>Folha.com - Ambiente - Principal</title>
+<url>http://www1.folha.uol.com.br/folha/images/lgo-folha_com-88x31.gif</url>
+<link>http://redir.folha.com.br/redir/online/ambiente/rss091/*http://www1.folha.uol.com.br/ambiente/</link>
+<width>88</width>
+<height>31</height>
+<description>Primeiro jornal em tempo real em l�ngua portuguesa</description>
+</image>
+
+<item>
+<title>Nasa dimensiona danos da seca na Amaz�nia em 2,4 mi de km2</title>
+<link>http://redir.folha.com.br/redir/online/ambiente/rss091/*http://www1.folha.uol.com.br/ambiente/895526-nasa-dimensiona-danos-da-seca-na-amazonia-em-24-mi-de-km2.shtml</link>
+<description>
+Os sat�lites da Nasa (ag�ncia espacial americana) forneceram material para uma an�lise dos estragos provocados pela &lt;a href=&quot;http://www1.folha.uol.com.br/ambiente/870588-amazonia-teve-a-pior-seca-dos-ultimos-cem-anos.shtml&quot;&gt;pior seca a atingir a Amaz�nia em 2010&lt;/a&gt;.
+Pela tomada a�rea, estima-se que foram 2,5 milh�es de quil�metros quadrados afetados --pouco menos da metade do ecossistema amaz�nico.
+&lt;table class=&quot;articleGraphic&quot;&gt;
+&lt;tr&gt;
+&lt;td rowspan=&quot;3&quot; class=&quot;articleGraphicSpace&quot;&gt;&lt;/td&gt;
+&lt;td class=&quot;articleGraphicCredit&quot;&gt;Universidade de Boston/Nasa&lt;/td&gt;
+&lt;td rowspan=&quot;3&quot; class=&quot;articleGraphicSpace&quot;&gt;&lt;/td&gt;
+&lt;/tr&gt;
+&lt;tr&gt;
+&lt;td class=&quot;articleGraphicImage&quot;&gt;&lt;img src=&quot;http://f.i.uol.com.br/folha/ambiente/images/11090120.jpeg&quot; alt=&quot;�rea (vermelho) mostra redu��o do �ndice do verdor, onde a vegeta��o ficou menos verde e mais seca&quot; border=&quot;0&quot; /&gt;&lt;/td&gt;
+&lt;/tr&gt;
+&lt;tr&gt;
+&lt;td class=&quot;articleGraphicCaption&quot;&gt;�rea (vermelho) mostra redu��o do �ndice do verdor, onde a vegeta��o ficou menos verde e mais seca&lt;/td&gt;
+&lt;/tr&gt;
+&lt;/table&gt;
+&lt;a href=&quot;http://redir.folha.com.br/redir/online/ambiente/rss091/*http://www1.folha.uol.com.br/ambiente/895526-nasa-dimensiona-danos-da-seca-na-amazonia-em-24-mi-de-km2.shtml&quot;&gt;Leia mais&lt;/a&gt; (29/03/2011 - 18h04)</description>
+<pubDate>29 Mar 2011 18:04:00 -0300</pubDate>
+</item>
+</channel>
+</rss>
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_x-gzip b/Source/WebKit/qt/tests/MIMESniffing/resources/application_x-gzip
new file mode 100644
index 0000000..a5e7d31
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_x-gzip
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_x-rar-compressed b/Source/WebKit/qt/tests/MIMESniffing/resources/application_x-rar-compressed
new file mode 100644
index 0000000..d9cb6ae
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_x-rar-compressed
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/application_zip b/Source/WebKit/qt/tests/MIMESniffing/resources/application_zip
new file mode 100644
index 0000000..8aec52f
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/application_zip
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/audio_x-wave b/Source/WebKit/qt/tests/MIMESniffing/resources/audio_x-wave
new file mode 100644
index 0000000..a0f9b85
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/audio_x-wave
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/image_bmp b/Source/WebKit/qt/tests/MIMESniffing/resources/image_bmp
new file mode 100644
index 0000000..b61d368
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/image_bmp
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/image_gif b/Source/WebKit/qt/tests/MIMESniffing/resources/image_gif
new file mode 100644
index 0000000..32b1ea2
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/image_gif
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/image_jpeg b/Source/WebKit/qt/tests/MIMESniffing/resources/image_jpeg
new file mode 100644
index 0000000..1874576
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/image_jpeg
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/image_png b/Source/WebKit/qt/tests/MIMESniffing/resources/image_png
new file mode 100644
index 0000000..bef59c7
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/image_png
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/image_vnd.microsoft.icon b/Source/WebKit/qt/tests/MIMESniffing/resources/image_vnd.microsoft.icon
new file mode 100644
index 0000000..58921b8
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/image_vnd.microsoft.icon
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/image_webp b/Source/WebKit/qt/tests/MIMESniffing/resources/image_webp
new file mode 100644
index 0000000..0da983e
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/image_webp
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/text_html b/Source/WebKit/qt/tests/MIMESniffing/resources/text_html
new file mode 100644
index 0000000..21eeee3
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/text_html
@@ -0,0 +1,3 @@
+
+<!-- saved from url=(0017)http://127.0.0.1/ -->
+<HTML><HEAD><META http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"></HEAD><BODY><H1>It works!</H1></BODY></HTML>
+\ No newline at end of file
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/text_xml b/Source/WebKit/qt/tests/MIMESniffing/resources/text_xml
new file mode 100644
index 0000000..38a9fe5
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/text_xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<CATALOG>
+	<CD>
+		<TITLE>Empire Burlesque</TITLE>
+		<ARTIST>Bob Dylan</ARTIST>
+		<COUNTRY>USA</COUNTRY>
+		<COMPANY>Columbia</COMPANY>
+		<PRICE>10.90</PRICE>
+		<YEAR>1985</YEAR>
+	</CD>
+	<CD>
+		<TITLE>Unchain my heart</TITLE>
+		<ARTIST>Joe Cocker</ARTIST>
+		<COUNTRY>USA</COUNTRY>
+		<COMPANY>EMI</COMPANY>
+		<PRICE>8.20</PRICE>
+		<YEAR>1987</YEAR>
+	</CD>
+</CATALOG>
diff --git a/Source/WebKit/qt/tests/MIMESniffing/resources/video_webm b/Source/WebKit/qt/tests/MIMESniffing/resources/video_webm
new file mode 100644
index 0000000..95d5031
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/resources/video_webm
diff --git a/Source/WebKit/qt/tests/MIMESniffing/tst_MIMESniffing.cpp b/Source/WebKit/qt/tests/MIMESniffing/tst_MIMESniffing.cpp
new file mode 100644
index 0000000..8c5417f
--- /dev/null
+++ b/Source/WebKit/qt/tests/MIMESniffing/tst_MIMESniffing.cpp
@@ -0,0 +1,72 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "MIMESniffing.h"
+
+#include "TestData.h"
+
+#include <QtCore/QFile>
+#include <QtCore/QString>
+#include <QtTest/QtTest>
+
+class tst_MIMESniffing : public QObject {
+    Q_OBJECT
+
+public:
+    tst_MIMESniffing();
+
+private Q_SLOTS:
+    void testCase1();
+};
+
+tst_MIMESniffing::tst_MIMESniffing()
+{
+}
+
+static inline const char* errorText(const TestData& data, const char* sniffedType)
+{
+    return QString("file: %1, advertised: %2, image: %3. sniffed mime type was expected to be \"%4\" but instead was \"%5\"").arg(data.file).arg(data.advertisedType).arg(data.isImage).arg(data.sniffedType).arg(sniffedType).toLatin1();
+}
+
+void tst_MIMESniffing::testCase1()
+{
+
+    for (int i = 0; i < testListSize; ++i) {
+        QFile file(testList[i].file);
+        QVERIFY2(file.open(QIODevice::ReadOnly), QString("unable to open file %1").arg(file.fileName()).toLatin1());
+
+        MIMESniffer sniffer(testList[i].advertisedType, testList[i].isImage);
+        QByteArray data = file.peek(sniffer.dataSize());
+
+        const char* sniffedType = sniffer.sniff(data.constData(), data.size());
+
+        QVERIFY2(!(sniffedType || testList[i].sniffedType) || (sniffedType && testList[i].sniffedType), errorText(testList[i], sniffedType));
+
+        if (sniffedType)
+            QVERIFY2(!strcmp(sniffedType, testList[i].sniffedType), errorText(testList[i], sniffedType));
+
+    }
+
+    QVERIFY2(true, "Failure");
+}
+
+QTEST_APPLESS_MAIN(tst_MIMESniffing);
+
+#include "tst_MIMESniffing.moc"
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.html b/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.html
new file mode 100644
index 0000000..22e3e24
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.html
@@ -0,0 +1,17 @@
+<html>
+<head><title>Basic</title>
+<link rel="icon" sizes="48x48" href="basic.png">
+<script type="text/javascript">
+<!--
+window.onload = function(){ window.status = "status here"; }
+// -->
+</script>
+</head>
+<body leftmargin="0" marginwidth="0">
+<table width="123">
+<tbody>
+<tr><td>This is a basic test.</td></tr>
+</tbody>
+</table>
+</body>
+</html>
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.png b/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.png
new file mode 100644
index 0000000..35717cc
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.png
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.qml b/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.qml
new file mode 100644
index 0000000..b5208d0
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/basic.qml
@@ -0,0 +1,5 @@
+import QtWebKit 1.0
+
+WebView {
+    url: "basic.html"
+}
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/elements.html b/Source/WebKit/qt/tests/qdeclarativewebview/resources/elements.html
new file mode 100644
index 0000000..9236867
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/elements.html
@@ -0,0 +1,14 @@
+<body leftmargin=0 topmargin=0>
+<table width="300px" border=1 cellpadding=0 cellspacing=0>
+<tr>
+<td align=center width=25%%><p>A</p></td>
+<td width=75% height=50px>
+    <table width=100% border=1 cellpadding=0 cellspacing=0>
+    <tr>
+    <td align=center width=50% height=50px><p>B</p></td>
+    <td align=center width=50% height=50px><p>C</p></td>
+    </tr>
+    </table>
+</td>
+</tr>
+</table>
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/elements.qml b/Source/WebKit/qt/tests/qdeclarativewebview/resources/elements.qml
new file mode 100644
index 0000000..8fef8c9
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/elements.qml
@@ -0,0 +1,7 @@
+import QtWebKit 1.0
+
+WebView {
+    url: "elements.html"
+    width: 310
+    height: 100
+}
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/forward.html b/Source/WebKit/qt/tests/qdeclarativewebview/resources/forward.html
new file mode 100644
index 0000000..62ab62d
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/forward.html
@@ -0,0 +1,12 @@
+<html>
+<head><title>Forward</title>
+<link rel="icon" sizes="32x32" href="forward.png">
+</head>
+<body leftmargin="0" marginwidth="0">
+<table width="123">
+<tbody>
+<tr><td>This is more.</td></tr>
+</tbody>
+</table>
+</body>
+</html>
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/forward.png b/Source/WebKit/qt/tests/qdeclarativewebview/resources/forward.png
new file mode 100644
index 0000000..a82533e
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/forward.png
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/javaScript.html b/Source/WebKit/qt/tests/qdeclarativewebview/resources/javaScript.html
new file mode 100644
index 0000000..35270bc
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/javaScript.html
@@ -0,0 +1,11 @@
+<html>
+<head><title>JavaScript</title>
+<link rel="icon" sizes="48x48" href="basic.png">
+<script type="text/javascript">
+<!--
+window.onload = function(){ window.status = "status here"; }
+// -->
+</script>
+</head>
+<body>
+This is a JS test.
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/javaScript.qml b/Source/WebKit/qt/tests/qdeclarativewebview/resources/javaScript.qml
new file mode 100644
index 0000000..527e3b9
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/javaScript.qml
@@ -0,0 +1,12 @@
+import QtQuick 1.0
+import QtWebKit 1.0
+
+WebView {
+    url: "javaScript.html"
+    javaScriptWindowObjects: [
+        QtObject {
+            property string qmlprop: "qmlvalue"
+            WebView.windowObjectName: "myjsname"
+        }
+    ]
+}
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/loadError.qml b/Source/WebKit/qt/tests/qdeclarativewebview/resources/loadError.qml
new file mode 100644
index 0000000..26cec8f
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/loadError.qml
@@ -0,0 +1,5 @@
+import QtWebKit 1.0
+
+WebView {
+    url: "does-not-exist.html"
+}
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/newwindows.html b/Source/WebKit/qt/tests/qdeclarativewebview/resources/newwindows.html
new file mode 100644
index 0000000..dd541f9
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/newwindows.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+<script type="text/javascript">
+<!--
+function clickTheLink()
+{
+    var ev = document.createEvent('MouseEvents');
+    ev.initEvent( "click", true, false );
+    document.getElementById('thelink').dispatchEvent(ev);
+}
+// -->
+</script>
+</head>
+<h1>Multiple windows...</h1>
+
+<a id=thelink target="_blank" href="newwindows.html">Popup!</a>
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/newwindows.qml b/Source/WebKit/qt/tests/qdeclarativewebview/resources/newwindows.qml
new file mode 100644
index 0000000..e66631d
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/newwindows.qml
@@ -0,0 +1,34 @@
+// Demonstrates opening new WebViews from HTML
+
+import QtQuick 1.0
+import QtWebKit 1.0
+
+Grid {
+    columns: 3
+    id: pages
+    height: 300; width: 600
+    property int total: 0
+
+    Component {
+        id: webViewPage
+        Rectangle {
+            width: webView.width
+            height: webView.height
+            border.color: "gray"
+
+            WebView {
+                id: webView
+                width: 150 // force predictable for test
+                newWindowComponent: webViewPage
+                newWindowParent: pages
+                url: "newwindows.html"
+                Timer {
+                    interval: 10; running: total<4; repeat: false;
+                    onTriggered: { if (webView.status==WebView.Ready) { total++; webView.evaluateJavaScript("clickTheLink()") } }
+                }
+            }
+        }
+    }
+
+    Loader { sourceComponent: webViewPage }
+}
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/propertychanges.qml b/Source/WebKit/qt/tests/qdeclarativewebview/resources/propertychanges.qml
new file mode 100644
index 0000000..db06887
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/propertychanges.qml
@@ -0,0 +1,34 @@
+import QtQuick 1.0
+import QtWebKit 1.0
+
+Item {
+    width: 240
+    height: 160
+    Grid {
+        anchors.fill: parent
+        objectName: "newWindowParent"
+        id: newWindowParent
+    }
+
+    Row {
+        anchors.fill: parent
+        id: oldWindowParent
+        objectName: "oldWindowParent"
+    }
+
+    Loader {
+        sourceComponent: webViewComponent
+    }
+    Component {
+            id: webViewComponent
+            WebView {
+                id: webView
+                objectName: "webView"
+                newWindowComponent: webViewComponent
+                newWindowParent: oldWindowParent         
+                url: "basic.html"
+                renderingEnabled: true
+                pressGrabTime: 200
+            }
+    }
+}
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/resources/sethtml.qml b/Source/WebKit/qt/tests/qdeclarativewebview/resources/sethtml.qml
new file mode 100644
index 0000000..5bff442
--- /dev/null
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/resources/sethtml.qml
@@ -0,0 +1,5 @@
+import QtWebKit 1.0
+
+WebView {
+    html: "<p>This is a <b>string</b> set on the WebView"
+}
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
index 8fcab71..23e8bfb 100644
--- a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
@@ -1,14 +1,18 @@
 #include "../util.h"
+#include <QAction>
 #include <QColor>
 #include <QDebug>
 #include <QDeclarativeComponent>
 #include <QDeclarativeEngine>
+#include <QDeclarativeItem>
 #include <QDeclarativeProperty>
 #include <QDeclarativeView>
 #include <QDir>
 #include <QGraphicsWebView>
 #include <QTest>
+#include <QVariant>
 #include <QWebFrame>
+#include "qdeclarativewebview_p.h"
 
 QT_BEGIN_NAMESPACE
 
@@ -19,16 +23,36 @@ public:
     tst_QDeclarativeWebView();
 
 private slots:
+    void cleanupTestCase();
+
+    void basicProperties();
+    void elementAreaAt();
+    void historyNav();
+    void javaScript();
+    void loadError();
+    void multipleWindows();
+    void newWindowComponent();
+    void newWindowParent();
     void preferredWidthTest();
     void preferredHeightTest();
     void preferredWidthDefaultTest();
     void preferredHeightDefaultTest();
+    void pressGrabTime();
+    void renderingEnabled();
+    void setHtml();
+    void settings();
 #if QT_VERSION >= 0x040703
     void backgroundColor();
 #endif
 
 private:
     void checkNoErrors(const QDeclarativeComponent&);
+    QString tmpDir() const
+    {
+        static QString tmpd = QDir::tempPath() + "/tst_qdeclarativewebview-"
+            + QDateTime::currentDateTime().toString(QLatin1String("yyyyMMddhhmmss"));
+        return tmpd;
+    }
 };
 
 tst_QDeclarativeWebView::tst_QDeclarativeWebView()
@@ -36,6 +60,283 @@ tst_QDeclarativeWebView::tst_QDeclarativeWebView()
     Q_UNUSED(waitForSignal)
 }
 
+static QString strippedHtml(QString html)
+{
+    html.replace(QRegExp("\\s+"), "");
+    return html;
+}
+
+static QString fileContents(const QString& filename)
+{
+    QFile file(filename);
+    file.open(QIODevice::ReadOnly);
+    return QString::fromUtf8(file.readAll());
+}
+
+static void removeRecursive(const QString& dirname)
+{
+    QDir dir(dirname);
+    QFileInfoList entries(dir.entryInfoList(QDir::Dirs | QDir::Files | QDir::NoDotAndDotDot));
+    for (int i = 0; i < entries.count(); ++i)
+        if (entries[i].isDir())
+            removeRecursive(entries[i].filePath());
+        else
+            dir.remove(entries[i].fileName());
+    QDir().rmdir(dirname);
+}
+
+void tst_QDeclarativeWebView::cleanupTestCase()
+{
+    removeRecursive(tmpDir());
+}
+
+void tst_QDeclarativeWebView::basicProperties()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/basic.qml"));
+    checkNoErrors(component);
+    QWebSettings::enablePersistentStorage(tmpDir());
+
+    QObject* wv = component.create();
+    QVERIFY(wv);
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+    QCOMPARE(wv->property("title").toString(), QLatin1String("Basic"));
+    QTRY_COMPARE(qvariant_cast<QPixmap>(wv->property("icon")).width(), 48);
+    QEXPECT_FAIL("", "'icon' property isn't working", Continue);
+    QCOMPARE(qvariant_cast<QPixmap>(wv->property("icon")), QPixmap("qrc:///resources/basic.png"));
+    QCOMPARE(wv->property("statusText").toString(), QLatin1String("status here"));
+    QCOMPARE(strippedHtml(fileContents(":/resources/basic.html")), strippedHtml(wv->property("html").toString()));
+    QEXPECT_FAIL("", "TODO: get preferred width from QGraphicsWebView result", Continue);
+    QCOMPARE(wv->property("preferredWidth").toInt(), 0);
+    QEXPECT_FAIL("", "TODO: get preferred height from QGraphicsWebView result", Continue);
+    QCOMPARE(wv->property("preferredHeight").toInt(), 0);
+    QCOMPARE(wv->property("url").toUrl(), QUrl("qrc:///resources/basic.html"));
+    QCOMPARE(wv->property("status").toInt(), int(QDeclarativeWebView::Ready));
+
+    QAction* reloadAction = wv->property("reload").value<QAction*>();
+    QVERIFY(reloadAction);
+    QVERIFY(reloadAction->isEnabled());
+    QAction* backAction = wv->property("back").value<QAction*>();
+    QVERIFY(backAction);
+    QVERIFY(!backAction->isEnabled());
+    QAction* forwardAction = wv->property("forward").value<QAction*>();
+    QVERIFY(forwardAction);
+    QVERIFY(!forwardAction->isEnabled());
+    QAction* stopAction = wv->property("stop").value<QAction*>();
+    QVERIFY(stopAction);
+    QVERIFY(!stopAction->isEnabled());
+
+    wv->setProperty("pixelCacheSize", 0); // mainly testing that it doesn't crash or anything!
+    QCOMPARE(wv->property("pixelCacheSize").toInt(), 0);
+    reloadAction->trigger();
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+}
+
+void tst_QDeclarativeWebView::elementAreaAt()
+{
+    QSKIP("This test should be changed to test 'heuristicZoom' instead.", SkipAll);
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/elements.qml"));
+    checkNoErrors(component);
+    QDeclarativeWebView* wv = qobject_cast<QDeclarativeWebView*>(component.create());
+    QVERIFY(wv);
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+
+    // Areas from elements.html.
+//    const QRect areaA(1, 1, 75, 54);
+//    const QRect areaB(78, 3, 110, 50);
+//    const QRect wholeView(0, 0, 310, 100);
+//    const QRect areaBC(76, 1, 223, 54);
+
+//    QCOMPARE(wv->elementAreaAt(40, 30, 100, 100), areaA);
+//    QCOMPARE(wv->elementAreaAt(130, 30, 200, 100), areaB);
+//    QCOMPARE(wv->elementAreaAt(40, 30, 400, 400), wholeView);
+//    QCOMPARE(wv->elementAreaAt(130, 30, 280, 280), areaBC);
+//    QCOMPARE(wv->elementAreaAt(130, 30, 400, 400), wholeView);
+}
+
+void tst_QDeclarativeWebView::historyNav()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/basic.qml"));
+    checkNoErrors(component);
+    QWebSettings::enablePersistentStorage(tmpDir());
+
+    QObject* wv = component.create();
+    QVERIFY(wv);
+
+    QAction* reloadAction = wv->property("reload").value<QAction*>();
+    QVERIFY(reloadAction);
+    QAction* backAction = wv->property("back").value<QAction*>();
+    QVERIFY(backAction);
+    QAction* forwardAction = wv->property("forward").value<QAction*>();
+    QVERIFY(forwardAction);
+    QAction* stopAction = wv->property("stop").value<QAction*>();
+    QVERIFY(stopAction);
+
+    for (int i = 1; i <= 2; ++i) {
+        QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+        QCOMPARE(wv->property("title").toString(), QLatin1String("Basic"));
+        QTRY_COMPARE(qvariant_cast<QPixmap>(wv->property("icon")).width(), 48);
+        QEXPECT_FAIL("", "'icon' property isn't working", Continue);
+        QCOMPARE(qvariant_cast<QPixmap>(wv->property("icon")), QPixmap("qrc:///data/basic.png"));
+        QCOMPARE(wv->property("statusText").toString(), QLatin1String("status here"));
+        QCOMPARE(strippedHtml(fileContents(":/resources/basic.html")), strippedHtml(wv->property("html").toString()));
+        QEXPECT_FAIL("", "TODO: get preferred width from QGraphicsWebView result", Continue);
+        QCOMPARE(wv->property("preferredWidth").toDouble(), 0.0);
+        QCOMPARE(wv->property("url").toUrl(), QUrl("qrc:///resources/basic.html"));
+        QCOMPARE(wv->property("status").toInt(), int(QDeclarativeWebView::Ready));
+        QVERIFY(reloadAction->isEnabled());
+        QVERIFY(!backAction->isEnabled());
+        QVERIFY(!forwardAction->isEnabled());
+        QVERIFY(!stopAction->isEnabled());
+        reloadAction->trigger();
+    }
+
+    wv->setProperty("url", QUrl("qrc:///resources/forward.html"));
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+    QCOMPARE(wv->property("title").toString(), QLatin1String("Forward"));
+    QTRY_COMPARE(qvariant_cast<QPixmap>(wv->property("icon")).width(), 32);
+    QEXPECT_FAIL("", "'icon' property isn't working", Continue);
+    QCOMPARE(qvariant_cast<QPixmap>(wv->property("icon")), QPixmap("qrc:///resources/forward.png"));
+    QCOMPARE(strippedHtml(fileContents(":/resources/forward.html")), strippedHtml(wv->property("html").toString()));
+    QCOMPARE(wv->property("url").toUrl(), QUrl("qrc:///resources/forward.html"));
+    QCOMPARE(wv->property("status").toInt(), int(QDeclarativeWebView::Ready));
+    QCOMPARE(wv->property("statusText").toString(), QString());
+
+    QVERIFY(reloadAction->isEnabled());
+    QVERIFY(backAction->isEnabled());
+    QVERIFY(!forwardAction->isEnabled());
+    QVERIFY(!stopAction->isEnabled());
+
+    backAction->trigger();
+
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+    QCOMPARE(wv->property("title").toString(), QLatin1String("Basic"));
+    QCOMPARE(strippedHtml(fileContents(":/resources/basic.html")), strippedHtml(wv->property("html").toString()));
+    QCOMPARE(wv->property("url").toUrl(), QUrl("qrc:///resources/basic.html"));
+    QCOMPARE(wv->property("status").toInt(), int(QDeclarativeWebView::Ready));
+
+    QVERIFY(reloadAction->isEnabled());
+    QVERIFY(!backAction->isEnabled());
+    QVERIFY(forwardAction->isEnabled());
+    QVERIFY(!stopAction->isEnabled());
+}
+
+static inline QVariant callEvaluateJavaScript(QObject *object, const QString& snippet)
+{
+    QVariant result;
+    QMetaObject::invokeMethod(object, "evaluateJavaScript", Q_RETURN_ARG(QVariant, result), Q_ARG(QString, snippet));
+    return result;
+}
+
+void tst_QDeclarativeWebView::javaScript()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/javaScript.qml"));
+    checkNoErrors(component);
+    QObject* wv = component.create();
+    QVERIFY(wv);
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+
+    QCOMPARE(callEvaluateJavaScript(wv, "123").toInt(), 123);
+    QCOMPARE(callEvaluateJavaScript(wv, "window.status").toString(), QLatin1String("status here"));
+    QCOMPARE(callEvaluateJavaScript(wv, "window.myjsname.qmlprop").toString(), QLatin1String("qmlvalue"));
+}
+
+void tst_QDeclarativeWebView::loadError()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/loadError.qml"));
+    checkNoErrors(component);
+    QWebSettings::enablePersistentStorage(tmpDir());
+
+    QObject* wv = component.create();
+    QVERIFY(wv);
+    QAction* reloadAction = wv->property("reload").value<QAction*>();
+    QVERIFY(reloadAction);
+
+    for (int i = 1; i <= 2; ++i) {
+        QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+        QCOMPARE(wv->property("title").toString(), QString());
+        QCOMPARE(wv->property("statusText").toString(), QString()); // HTML 'status bar' text, not error message
+        QCOMPARE(wv->property("url").toUrl(), QUrl("qrc:///resources/does-not-exist.html")); // Unlike QWebPage, which loses url
+        QCOMPARE(wv->property("status").toInt(), int(QDeclarativeWebView::Error));
+        reloadAction->trigger();
+    }
+}
+
+void tst_QDeclarativeWebView::multipleWindows()
+{
+    QSKIP("Rework this test to not depend on QDeclarativeGrid", SkipAll);
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/newwindows.qml"));
+    checkNoErrors(component);
+
+//    QDeclarativeGrid *grid = qobject_cast<QDeclarativeGrid*>(component.create());
+//    QVERIFY(grid != 0);
+//    QTRY_COMPARE(grid->children().count(), 2+4); // Component, Loader (with 1 WebView), 4 new-window WebViews
+//    QDeclarativeItem* popup = qobject_cast<QDeclarativeItem*>(grid->children().at(2)); // first popup after Component and Loader.
+//    QVERIFY(popup != 0);
+//    QTRY_COMPARE(popup->x(), 150.0);
+}
+
+void tst_QDeclarativeWebView::newWindowComponent()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/propertychanges.qml"));
+    checkNoErrors(component);
+    QDeclarativeItem* rootItem = qobject_cast<QDeclarativeItem*>(component.create());
+    QVERIFY(rootItem);
+    QObject* wv = rootItem->findChild<QObject*>("webView");
+    QVERIFY(wv);
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+
+    QDeclarativeComponent substituteComponent(&engine);
+    substituteComponent.setData("import QtQuick 1.0; WebView { objectName: 'newWebView'; url: 'basic.html'; }", QUrl::fromLocalFile(""));
+    QSignalSpy newWindowComponentSpy(wv, SIGNAL(newWindowComponentChanged()));
+
+    wv->setProperty("newWindowComponent", QVariant::fromValue(&substituteComponent));
+    QCOMPARE(wv->property("newWindowComponent"), QVariant::fromValue(&substituteComponent));
+    QCOMPARE(newWindowComponentSpy.count(), 1);
+
+    wv->setProperty("newWindowComponent", QVariant::fromValue(&substituteComponent));
+    QCOMPARE(newWindowComponentSpy.count(), 1);
+
+    wv->setProperty("newWindowComponent", QVariant::fromValue((QDeclarativeComponent*)0));
+    QCOMPARE(newWindowComponentSpy.count(), 2);
+}
+
+void tst_QDeclarativeWebView::newWindowParent()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/propertychanges.qml"));
+    checkNoErrors(component);
+    QDeclarativeItem* rootItem = qobject_cast<QDeclarativeItem*>(component.create());
+    QVERIFY(rootItem);
+    QObject* wv = rootItem->findChild<QObject*>("webView");
+    QVERIFY(wv);
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+
+    QDeclarativeItem* oldWindowParent = rootItem->findChild<QDeclarativeItem*>("oldWindowParent");
+    QCOMPARE(qvariant_cast<QDeclarativeItem*>(wv->property("newWindowParent")), oldWindowParent);
+    QSignalSpy newWindowParentSpy(wv, SIGNAL(newWindowParentChanged()));
+
+    QDeclarativeItem* newWindowParent = rootItem->findChild<QDeclarativeItem*>("newWindowParent");
+    wv->setProperty("newWindowParent", QVariant::fromValue(newWindowParent));
+    QVERIFY(newWindowParent);
+    QVERIFY(oldWindowParent);
+    QCOMPARE(oldWindowParent->childItems().count(), 0);
+    QCOMPARE(wv->property("newWindowParent"), QVariant::fromValue(newWindowParent));
+    QCOMPARE(newWindowParentSpy.count(), 1);
+
+    wv->setProperty("newWindowParent", QVariant::fromValue(newWindowParent));
+    QCOMPARE(newWindowParentSpy.count(), 1);
+
+    wv->setProperty("newWindowParent", QVariant::fromValue((QDeclarativeItem*)0));
+    QCOMPARE(newWindowParentSpy.count(), 2);
+}
+
 void tst_QDeclarativeWebView::preferredWidthTest()
 {
     QDeclarativeEngine engine;
@@ -86,6 +387,110 @@ void tst_QDeclarativeWebView::preferredHeightDefaultTest()
     QCOMPARE(wv->property("prefHeight").toDouble(), view.preferredHeight());
 }
 
+void tst_QDeclarativeWebView::pressGrabTime()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/propertychanges.qml"));
+    checkNoErrors(component);
+    QDeclarativeItem* rootItem = qobject_cast<QDeclarativeItem*>(component.create());
+    QVERIFY(rootItem);
+    QObject* wv = rootItem->findChild<QObject*>("webView");
+    QVERIFY(wv);
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+    QCOMPARE(wv->property("pressGrabTime").toInt(), 200);
+    QSignalSpy pressGrabTimeSpy(wv, SIGNAL(pressGrabTimeChanged()));
+
+    wv->setProperty("pressGrabTime", 100);
+    QCOMPARE(wv->property("pressGrabTime").toInt(), 100);
+    QCOMPARE(pressGrabTimeSpy.count(), 1);
+
+    wv->setProperty("pressGrabTime", 100);
+    QCOMPARE(pressGrabTimeSpy.count(), 1);
+
+    wv->setProperty("pressGrabTime", 0);
+    QCOMPARE(pressGrabTimeSpy.count(), 2);
+}
+
+void tst_QDeclarativeWebView::renderingEnabled()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/propertychanges.qml"));
+    checkNoErrors(component);
+    QDeclarativeItem* rootItem = qobject_cast<QDeclarativeItem*>(component.create());
+    QVERIFY(rootItem);
+    QObject* wv = rootItem->findChild<QObject*>("webView");
+    QVERIFY(wv);
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+
+    QVERIFY(wv->property("renderingEnabled").toBool());
+    QSignalSpy renderingEnabledSpy(wv, SIGNAL(renderingEnabledChanged()));
+
+    wv->setProperty("renderingEnabled", false);
+    QVERIFY(!wv->property("renderingEnabled").toBool());
+    QCOMPARE(renderingEnabledSpy.count(), 1);
+
+    wv->setProperty("renderingEnabled", false);
+    QCOMPARE(renderingEnabledSpy.count(), 1);
+
+    wv->setProperty("renderingEnabled", true);
+    QCOMPARE(renderingEnabledSpy.count(), 2);
+}
+
+void tst_QDeclarativeWebView::setHtml()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/sethtml.qml"));
+    checkNoErrors(component);
+    QObject* wv = component.create();
+    QVERIFY(wv);
+    QCOMPARE(wv->property("html").toString(), QLatin1String("<html><head></head><body><p>This is a <b>string</b> set on the WebView</p></body></html>"));
+
+    QSignalSpy spy(wv, SIGNAL(htmlChanged()));
+    wv->setProperty("html", QLatin1String("<html><head><title>Basic</title></head><body><p>text</p></body></html>"));
+    QCOMPARE(spy.count(), 1);
+}
+
+void tst_QDeclarativeWebView::settings()
+{
+    QDeclarativeEngine engine;
+    QDeclarativeComponent component(&engine, QUrl("qrc:///resources/basic.qml"));
+    checkNoErrors(component);
+    QObject* wv = component.create();
+    QVERIFY(wv);
+    QTRY_COMPARE(wv->property("progress").toDouble(), 1.0);
+
+    QObject* s = QDeclarativeProperty(wv, "settings").object();
+    QVERIFY(s);
+
+    QStringList settingsList;
+    settingsList << QString::fromAscii("autoLoadImages")
+                 << QString::fromAscii("developerExtrasEnabled")
+                 << QString::fromAscii("javaEnabled")
+                 << QString::fromAscii("javascriptCanAccessClipboard")
+                 << QString::fromAscii("javascriptCanOpenWindows")
+                 << QString::fromAscii("javascriptEnabled")
+                 << QString::fromAscii("linksIncludedInFocusChain")
+                 << QString::fromAscii("localContentCanAccessRemoteUrls")
+                 << QString::fromAscii("localStorageDatabaseEnabled")
+                 << QString::fromAscii("offlineStorageDatabaseEnabled")
+                 << QString::fromAscii("offlineWebApplicationCacheEnabled")
+                 << QString::fromAscii("pluginsEnabled")
+                 << QString::fromAscii("printElementBackgrounds")
+                 << QString::fromAscii("privateBrowsingEnabled")
+                 << QString::fromAscii("zoomTextOnly");
+
+    // Merely tests that setting gets stored (in QWebSettings), behavioural tests are in WebKit.
+    for (int b = 0; b <= 1; b++) {
+        bool value = !!b;
+        foreach (const QString& name, settingsList)
+            s->setProperty(name.toAscii().data(), value);
+        for (int i = 0; i < 2; i++) {
+            foreach (const QString& name, settingsList)
+                QCOMPARE(s->property(name.toAscii().data()).toBool(), value);
+        }
+    }
+}
+
 #if QT_VERSION >= 0x040703
 void tst_QDeclarativeWebView::backgroundColor()
 {
@@ -120,6 +525,16 @@ void tst_QDeclarativeWebView::checkNoErrors(const QDeclarativeComponent& compone
 {
     // Wait until the component is ready
     QTRY_VERIFY(component.isReady() || component.isError());
+    if (component.isError()) {
+        QList<QDeclarativeError> errors = component.errors();
+        for (int ii = 0; ii < errors.count(); ++ii) {
+            const QDeclarativeError &error = errors.at(ii);
+            QByteArray errorStr = QByteArray::number(error.line()) + ":" +
+                                  QByteArray::number(error.column()) + ":" +
+                                  error.description().toUtf8();
+            qWarning() << errorStr;
+        }
+    }
     QVERIFY(!component.isError());
 }
 
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.qrc b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.qrc
index e14c333..fb66ad8 100644
--- a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.qrc
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.qrc
@@ -1,8 +1,22 @@
 <RCC>
     <qresource prefix="/">
-        <file>resources/webviewtestdefault.qml</file>
-        <file>resources/webviewtest.qml</file>
+        <file>resources/basic.html</file>
+        <file>resources/basic.png</file>
+        <file>resources/basic.qml</file>
+        <file>resources/elements.html</file>
+        <file>resources/elements.qml</file>
+        <file>resources/forward.html</file>
+        <file>resources/forward.png</file>
+        <file>resources/javaScript.html</file>
+        <file>resources/javaScript.qml</file>
+        <file>resources/loadError.qml</file>
+        <file>resources/newwindows.html</file>
+        <file>resources/newwindows.qml</file>
+        <file>resources/propertychanges.qml</file>
         <file>resources/sample.html</file>
+        <file>resources/sethtml.qml</file>
         <file>resources/webviewbackgroundcolor.qml</file>
+        <file>resources/webviewtestdefault.qml</file>
+        <file>resources/webviewtest.qml</file>
     </qresource>
 </RCC>
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/resources/56929.html b/Source/WebKit/qt/tests/qgraphicswebview/resources/56929.html
new file mode 100644
index 0000000..2f7fa97
--- /dev/null
+++ b/Source/WebKit/qt/tests/qgraphicswebview/resources/56929.html
@@ -0,0 +1,8 @@
+<body style="background-color: white">
+ <div id="1" style="width: 50%; height: 50%; background-color: green"/>
+ <script>
+  function resizeDiv() {
+      document.getElementById("1").setAttribute("style", "width: 150%; height: 150%; background-color: green");
+  }
+ </script>
+</body>
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index 7cc88db..ed162c4 100644
--- a/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -21,6 +21,7 @@
 #include <QtTest/QtTest>
 #include <QGraphicsSceneMouseEvent>
 #include <QGraphicsView>
+#include <QStyleOptionGraphicsItem>
 #include <qgraphicswebview.h>
 #include <qwebpage.h>
 #include <qwebframe.h>
@@ -43,7 +44,9 @@ private slots:
     void setPalette_data();
     void setPalette();
     void renderHints();
-
+#if defined(ENABLE_TILED_BACKING_STORE) && ENABLE_TILED_BACKING_STORE
+    void bug56929();
+#endif
 #if defined(ENABLE_WEBGL) && ENABLE_WEBGL
     void webglSoftwareFallbackVerticalOrientation();
     void webglSoftwareFallbackHorizontalOrientation();
@@ -191,6 +194,38 @@ void tst_QGraphicsWebView::widgetsRenderingThroughCache()
     QCOMPARE(referencePixmap.toImage(), viewWithTiling.toImage());
 }
 
+#if defined(ENABLE_TILED_BACKING_STORE) && ENABLE_TILED_BACKING_STORE
+void tst_QGraphicsWebView::bug56929()
+{
+    // When rendering from tiles sychronous layout should not be triggered
+    // and scrollbars should be in sync with the size of the document in the displayed state.
+
+    QGraphicsWebView* webView = new QGraphicsWebView();
+    webView->setGeometry(QRectF(0.0, 0.0, 100.0, 100.0));
+    QGraphicsView view(new QGraphicsScene());
+    view.scene()->setParent(&view);
+    view.scene()->addItem(webView);
+    webView->settings()->setAttribute(QWebSettings::TiledBackingStoreEnabled, true);
+    QUrl url("qrc:///resources/56929.html");
+    webView->load(url);
+    QVERIFY(waitForSignal(webView, SIGNAL(loadFinished(bool))));
+    QStyleOptionGraphicsItem option;
+    option.exposedRect = webView->geometry();
+    QImage img(option.exposedRect.width(), option.exposedRect.height(), QImage::Format_ARGB32_Premultiplied);
+    QPainter painter(&img);
+    // This will not paint anything as the tiles are not ready, yet.
+    webView->paint(&painter, &option);
+    QApplication::processEvents();
+    webView->paint(&painter, &option);
+    QCOMPARE(img.pixel(option.exposedRect.width() - 2, option.exposedRect.height() / 2), qRgba(255, 255, 255, 255));
+    painter.fillRect(option.exposedRect, Qt::black);
+    QCOMPARE(img.pixel(option.exposedRect.width() - 2, option.exposedRect.height() / 2), qRgba(0, 0, 0, 255));
+    webView->page()->mainFrame()->evaluateJavaScript(QString("resizeDiv();"));
+    webView->paint(&painter, &option);
+    QCOMPARE(img.pixel(option.exposedRect.width() - 2, option.exposedRect.height() / 2), qRgba(255, 255, 255, 255));
+}
+#endif
+
 void tst_QGraphicsWebView::microFocusCoordinates()
 {
     QWebPage* page = new QWebPage;
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.qrc b/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.qrc
index 1488fcf..f929fe7 100644
--- a/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.qrc
+++ b/Source/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.qrc
@@ -3,5 +3,6 @@
         <file>resources/input_types.html</file>
         <file>resources/pointing_right.html</file>
         <file>resources/pointing_up.html</file>
+        <file>resources/56929.html</file>
     </qresource>
 </RCC>
diff --git a/Source/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/Source/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index c7c49a2..9e9948a 100644
--- a/Source/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/Source/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -483,7 +483,7 @@ void tst_QWebElement::style()
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("green"));
 
     p.setStyleProperty("color", "blue");
-    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
     QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("green"));
 
     p.setStyleProperty("color", "blue !important");
diff --git a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 2c44e4c..3b9324d 100644
--- a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -614,6 +614,7 @@ private slots:
     void urlChange();
     void domCycles();
     void requestedUrl();
+    void requestedUrlAfterSetAndLoadFailures();
     void javaScriptWindowObjectCleared_data();
     void javaScriptWindowObjectCleared();
     void javaScriptWindowObjectClearedOnEvaluate();
@@ -649,10 +650,14 @@ private slots:
     void setContent();
     void setCacheLoadControlAttribute();
     void setUrlWithPendingLoads();
+    void setUrlWithFragment_data();
     void setUrlWithFragment();
     void setUrlToEmpty();
     void setUrlToInvalid();
     void setUrlHistory();
+    void setUrlSameUrl();
+    void setUrlThenLoads_data();
+    void setUrlThenLoads();
 
 private:
     QString  evalJS(const QString&s) {
@@ -2309,7 +2314,7 @@ public:
         else if (request.url() == QUrl("qrc:/fake-ssl-error.html"))
             setError(QNetworkReply::SslHandshakeFailedError, tr("Fake error !")); // force a ssl error
 #endif
-        else if (request.url() == QUrl("http://abcdef.abcdef/"))
+        else if (request.url().host() == QLatin1String("abcdef.abcdef"))
             setError(QNetworkReply::HostNotFoundError, tr("Invalid URL"));
 
         open(QIODevice::ReadOnly);
@@ -2413,6 +2418,30 @@ void tst_QWebFrame::requestedUrl()
 #endif
 }
 
+void tst_QWebFrame::requestedUrlAfterSetAndLoadFailures()
+{
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+
+    QSignalSpy spy(frame, SIGNAL(loadFinished(bool)));
+
+    const QUrl first("http://abcdef.abcdef/");
+    frame->setUrl(first);
+    ::waitForSignal(frame, SIGNAL(loadFinished(bool)));
+    QCOMPARE(frame->url(), first);
+    QCOMPARE(frame->requestedUrl(), first);
+    QVERIFY(!spy.at(0).first().toBool());
+
+    const QUrl second("http://abcdef.abcdef/another_page.html");
+    QVERIFY(first != second);
+
+    frame->load(second);
+    ::waitForSignal(frame, SIGNAL(loadFinished(bool)));
+    QCOMPARE(frame->url(), first);
+    QCOMPARE(frame->requestedUrl(), second);
+    QVERIFY(!spy.at(1).first().toBool());
+}
+
 void tst_QWebFrame::javaScriptWindowObjectCleared_data()
 {
     QTest::addColumn<QString>("html");
@@ -2671,6 +2700,8 @@ void tst_QWebFrame::inputFieldFocus()
     int delay = qApp->cursorFlashTime() * 2;
 
     // focus the lineedit and check if it blinks
+    bool autoSipEnabled = qApp->autoSipEnabled();
+    qApp->setAutoSipEnabled(false);
     const QWebElement inputElement = view.page()->mainFrame()->documentElement().findFirst(QLatin1String("input[type=text]"));
     QTest::mouseClick(&view, Qt::LeftButton, 0, inputElement.geometry().center());
     m_inputFieldsTestView = &view;
@@ -2678,6 +2709,7 @@ void tst_QWebFrame::inputFieldFocus()
     QTest::qWait(delay);
     QVERIFY2(m_inputFieldTestPaintCount >= 3,
              "The input field should have a blinking caret");
+    qApp->setAutoSipEnabled(autoSipEnabled);
 }
 
 void tst_QWebFrame::hitTestContent()
@@ -3323,24 +3355,42 @@ void tst_QWebFrame::setUrlWithPendingLoads()
     page.mainFrame()->setUrl(QUrl("about:blank"));
 }
 
+void tst_QWebFrame::setUrlWithFragment_data()
+{
+    QTest::addColumn<QUrl>("previousUrl");
+    QTest::newRow("empty") << QUrl();
+    QTest::newRow("same URL no fragment") << QUrl("qrc:/test1.html");
+    // See comments in setUrlSameUrl about using setUrl() with the same url().
+    QTest::newRow("same URL with same fragment") << QUrl("qrc:/test1.html#");
+    QTest::newRow("same URL with different fragment") << QUrl("qrc:/test1.html#anotherFragment");
+    QTest::newRow("another URL") << QUrl("qrc:/test2.html");
+}
+
+// Based on bug report https://bugs.webkit.org/show_bug.cgi?id=32723
 void tst_QWebFrame::setUrlWithFragment()
 {
-    QSKIP("Bug https://bugs.webkit.org/show_bug.cgi?id=32723", SkipAll);
+    QFETCH(QUrl, previousUrl);
 
-    // Based on bug report https://bugs.webkit.org/show_bug.cgi?id=32723
     QWebPage page;
-    QSignalSpy spy(&page, SIGNAL(loadFinished(bool)));
+    QWebFrame* frame = page.mainFrame();
+
+    if (!previousUrl.isEmpty()) {
+        frame->load(previousUrl);
+        ::waitForSignal(frame, SIGNAL(loadFinished(bool)));
+        QCOMPARE(frame->url(), previousUrl);
+    }
 
+    QSignalSpy spy(frame, SIGNAL(loadFinished(bool)));
     const QUrl url("qrc:/test1.html#");
     QVERIFY(!url.fragment().isNull());
 
-    page.mainFrame()->setUrl(url);
-    ::waitForSignal(&page, SIGNAL(loadFinished(bool)));
+    frame->setUrl(url);
+    ::waitForSignal(frame, SIGNAL(loadFinished(bool)));
 
     QCOMPARE(spy.count(), 1);
-    QVERIFY(!page.mainFrame()->toPlainText().isEmpty());
-    QCOMPARE(page.mainFrame()->requestedUrl(), url);
-    QCOMPARE(page.mainFrame()->url(), url);
+    QVERIFY(!frame->toPlainText().isEmpty());
+    QCOMPARE(frame->requestedUrl(), url);
+    QCOMPARE(frame->url(), url);
 }
 
 void tst_QWebFrame::setUrlToEmpty()
@@ -3486,5 +3536,110 @@ void tst_QWebFrame::setUrlHistory()
     QCOMPARE(m_page->history()->count(), 2);
 }
 
+void tst_QWebFrame::setUrlSameUrl()
+{
+    const QUrl url1("qrc:/test1.html");
+    const QUrl url2("qrc:/test2.html");
+
+    QWebPage page;
+    QWebFrame* frame = page.mainFrame();
+    FakeNetworkManager* networkManager = new FakeNetworkManager(&page);
+    page.setNetworkAccessManager(networkManager);
+
+    QSignalSpy spy(frame, SIGNAL(loadFinished(bool)));
+
+    frame->setUrl(url1);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)));
+    QVERIFY(frame->url() != url1); // Nota bene: our QNAM redirects url1 to url2
+    QCOMPARE(frame->url(), url2);
+    QCOMPARE(spy.count(), 1);
+
+    frame->setUrl(url1);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)));
+    QVERIFY(frame->url() != url1);
+    QCOMPARE(frame->url(), url2);
+    QCOMPARE(spy.count(), 2);
+
+    // Now a case without redirect. The existing behavior we have for setUrl()
+    // is more like a "clear(); load()", so the page will be loaded again, even
+    // if urlToBeLoaded == url(). This test should be changed if we want to
+    // make setUrl() early return in this case.
+    frame->setUrl(url2);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)));
+    QCOMPARE(frame->url(), url2);
+    QCOMPARE(spy.count(), 3);
+
+    frame->setUrl(url1);
+    waitForSignal(frame, SIGNAL(loadFinished(bool)));
+    QCOMPARE(frame->url(), url2);
+    QCOMPARE(spy.count(), 4);
+}
+
+static inline QUrl extractBaseUrl(const QUrl& url)
+{
+    return url.resolved(QUrl());
+}
+
+void tst_QWebFrame::setUrlThenLoads_data()
+{
+    QTest::addColumn<QUrl>("url");
+    QTest::addColumn<QUrl>("baseUrl");
+
+    QTest::newRow("resource file") << QUrl("qrc:/test1.html") << extractBaseUrl(QUrl("qrc:/test1.html"));
+    QTest::newRow("base specified in HTML") << QUrl("data:text/html,<head><base href=\"http://different.base/\"></head>") << QUrl("http://different.base/");
+}
+
+void tst_QWebFrame::setUrlThenLoads()
+{
+    QFETCH(QUrl, url);
+    QFETCH(QUrl, baseUrl);
+    QWebFrame* frame = m_page->mainFrame();
+    QSignalSpy urlChangedSpy(frame, SIGNAL(urlChanged(QUrl)));
+    QSignalSpy startedSpy(frame, SIGNAL(loadStarted()));
+    QSignalSpy finishedSpy(frame, SIGNAL(loadFinished(bool)));
+
+    frame->setUrl(url);
+    QCOMPARE(startedSpy.count(), 1);
+    ::waitForSignal(frame, SIGNAL(urlChanged(QUrl)));
+    QCOMPARE(urlChangedSpy.count(), 1);
+    QVERIFY(finishedSpy.at(0).first().toBool());
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(frame->requestedUrl(), url);
+    QCOMPARE(frame->baseUrl(), baseUrl);
+
+    const QUrl urlToLoad1("qrc:/test2.html");
+    const QUrl urlToLoad2("qrc:/test1.html");
+
+    // Just after first load. URL didn't changed yet.
+    frame->load(urlToLoad1);
+    QCOMPARE(startedSpy.count(), 2);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(frame->requestedUrl(), urlToLoad1);
+    QCOMPARE(frame->baseUrl(), baseUrl);
+
+    // After first URL changed.
+    ::waitForSignal(frame, SIGNAL(urlChanged(QUrl)));
+    QCOMPARE(urlChangedSpy.count(), 2);
+    QVERIFY(finishedSpy.at(1).first().toBool());
+    QCOMPARE(frame->url(), urlToLoad1);
+    QCOMPARE(frame->requestedUrl(), urlToLoad1);
+    QCOMPARE(frame->baseUrl(), extractBaseUrl(urlToLoad1));
+
+    // Just after second load. URL didn't changed yet.
+    frame->load(urlToLoad2);
+    QCOMPARE(startedSpy.count(), 3);
+    QCOMPARE(frame->url(), urlToLoad1);
+    QCOMPARE(frame->requestedUrl(), urlToLoad2);
+    QCOMPARE(frame->baseUrl(), extractBaseUrl(urlToLoad1));
+
+    // After second URL changed.
+    ::waitForSignal(frame, SIGNAL(urlChanged(QUrl)));
+    QCOMPARE(urlChangedSpy.count(), 3);
+    QVERIFY(finishedSpy.at(2).first().toBool());
+    QCOMPARE(frame->url(), urlToLoad2);
+    QCOMPARE(frame->requestedUrl(), urlToLoad2);
+    QCOMPARE(frame->baseUrl(), extractBaseUrl(urlToLoad2));
+}
+
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index d43b2de..9e3337b 100644
--- a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -434,7 +434,7 @@ void tst_QWebPage::userStyleSheet()
 
 void tst_QWebPage::loadHtml5Video()
 {
-#if defined(ENABLE_QT_MULTIMEDIA) && ENABLE_QT_MULTIMEDIA
+#if defined(WTF_USE_QT_MULTIMEDIA) && WTF_USE_QT_MULTIMEDIA
     QByteArray url("http://does.not/exist?a=1%2Cb=2");
     m_view->setHtml("<p><video id ='video' src='" + url + "' autoplay/></p>");
     QTest::qWait(2000);
@@ -986,7 +986,10 @@ void tst_QWebPage::cursorMovements()
         "getSelection().addRange(range);";
     page->mainFrame()->evaluateJavaScript(script);
     QCOMPARE(page->selectedText().trimmed(), QString::fromLatin1("The quick brown fox"));
-    QCOMPARE(page->selectedHtml().trimmed(), QString::fromLatin1("<span class=\"Apple-style-span\" style=\"border-collapse: separate; color: rgb(0, 0, 0); font-family: Times; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; \"><p id=\"one\">The quick brown fox</p></span>"));
+
+    QRegExp regExp(" style=\".*\"");
+    regExp.setMinimal(true);
+    QCOMPARE(page->selectedHtml().trimmed().replace(regExp, ""), QString::fromLatin1("<span class=\"Apple-style-span\"><p id=\"one\">The quick brown fox</p></span>"));
 
     // these actions must exist
     QVERIFY(page->action(QWebPage::MoveToNextChar) != 0);
@@ -1217,7 +1220,9 @@ void tst_QWebPage::textSelection()
         "getSelection().addRange(range);";
     page->mainFrame()->evaluateJavaScript(selectScript);
     QCOMPARE(page->selectedText().trimmed(), QString::fromLatin1("The quick brown fox"));
-    QCOMPARE(page->selectedHtml().trimmed(), QString::fromLatin1("<span class=\"Apple-style-span\" style=\"border-collapse: separate; color: rgb(0, 0, 0); font-family: Times; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; \"><p id=\"one\">The quick brown fox</p></span>"));
+    QRegExp regExp(" style=\".*\"");
+    regExp.setMinimal(true);
+    QCOMPARE(page->selectedHtml().trimmed().replace(regExp, ""), QString::fromLatin1("<span class=\"Apple-style-span\"><p id=\"one\">The quick brown fox</p></span>"));
 
     // Make sure hasSelection returns true, since there is selected text now...
     QCOMPARE(page->hasSelection(), true);
@@ -2671,10 +2676,12 @@ void tst_QWebPage::findText()
     QVERIFY(m_page->selectedText().isEmpty());
     QVERIFY(m_page->selectedHtml().isEmpty());
     QStringList words = (QStringList() << "foo" << "bar");
+    QRegExp regExp(" style=\".*\"");
+    regExp.setMinimal(true);
     foreach (QString subString, words) {
         m_page->findText(subString, QWebPage::FindWrapsAroundDocument);
         QCOMPARE(m_page->selectedText(), subString);
-        QCOMPARE(m_page->selectedHtml(), QString("<span class=\"Apple-style-span\" style=\"border-collapse: separate; color: rgb(0, 0, 0); font-family: Times; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; \">%1</span>").arg(subString));
+        QCOMPARE(m_page->selectedHtml().trimmed().replace(regExp, ""), QString("<span class=\"Apple-style-span\">%1</span>").arg(subString));
         m_page->findText("");
         QVERIFY(m_page->selectedText().isEmpty());
         QVERIFY(m_page->selectedHtml().isEmpty());
diff --git a/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index c7600fc..f557dc1 100644
--- a/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -31,6 +31,16 @@
 #include <qwebelement.h>
 #include <qwebframe.h>
 
+#ifdef Q_OS_SYMBIAN
+#define VERIFY_INPUTMETHOD_HINTS(actual, expect) \
+    QVERIFY(actual & Qt::ImhNoAutoUppercase); \
+    QVERIFY(actual & Qt::ImhNoPredictiveText); \
+    QVERIFY(actual & expect);
+#else
+#define VERIFY_INPUTMETHOD_HINTS(actual, expect) \
+    QVERIFY(actual == expect);
+#endif
+
 class tst_QWebView : public QObject
 {
     Q_OBJECT
@@ -253,37 +263,37 @@ void tst_QWebView::focusInputTypes()
     // 'password' field
     inputElement = mainFrame->documentElement().findFirst(QLatin1String("input[type=password]"));
     QTest::mouseClick(&webView, Qt::LeftButton, 0, inputElement.geometry().center());
-    QVERIFY(webView.inputMethodHints() == Qt::ImhHiddenText);
+    VERIFY_INPUTMETHOD_HINTS(webView.inputMethodHints(), Qt::ImhHiddenText);
     QVERIFY(webView.testAttribute(Qt::WA_InputMethodEnabled));
 
     // 'tel' field
     inputElement = mainFrame->documentElement().findFirst(QLatin1String("input[type=tel]"));
     QTest::mouseClick(&webView, Qt::LeftButton, 0, inputElement.geometry().center());
-    QVERIFY(webView.inputMethodHints() == Qt::ImhDialableCharactersOnly);
+    VERIFY_INPUTMETHOD_HINTS(webView.inputMethodHints(), Qt::ImhDialableCharactersOnly);
     QVERIFY(webView.testAttribute(Qt::WA_InputMethodEnabled));
 
     // 'number' field
     inputElement = mainFrame->documentElement().findFirst(QLatin1String("input[type=number]"));
     QTest::mouseClick(&webView, Qt::LeftButton, 0, inputElement.geometry().center());
-    QVERIFY(webView.inputMethodHints() == Qt::ImhDigitsOnly);
+    VERIFY_INPUTMETHOD_HINTS(webView.inputMethodHints(), Qt::ImhDigitsOnly);
     QVERIFY(webView.testAttribute(Qt::WA_InputMethodEnabled));
 
     // 'email' field
     inputElement = mainFrame->documentElement().findFirst(QLatin1String("input[type=email]"));
     QTest::mouseClick(&webView, Qt::LeftButton, 0, inputElement.geometry().center());
-    QVERIFY(webView.inputMethodHints() == Qt::ImhEmailCharactersOnly);
+    VERIFY_INPUTMETHOD_HINTS(webView.inputMethodHints(), Qt::ImhEmailCharactersOnly);
     QVERIFY(webView.testAttribute(Qt::WA_InputMethodEnabled));
 
     // 'url' field
     inputElement = mainFrame->documentElement().findFirst(QLatin1String("input[type=url]"));
     QTest::mouseClick(&webView, Qt::LeftButton, 0, inputElement.geometry().center());
-    QVERIFY(webView.inputMethodHints() == Qt::ImhUrlCharactersOnly);
+    VERIFY_INPUTMETHOD_HINTS(webView.inputMethodHints(), Qt::ImhUrlCharactersOnly);
     QVERIFY(webView.testAttribute(Qt::WA_InputMethodEnabled));
 
     // 'password' field
     inputElement = mainFrame->documentElement().findFirst(QLatin1String("input[type=password]"));
     QTest::mouseClick(&webView, Qt::LeftButton, 0, inputElement.geometry().center());
-    QVERIFY(webView.inputMethodHints() == Qt::ImhHiddenText);
+    VERIFY_INPUTMETHOD_HINTS(webView.inputMethodHints(), Qt::ImhHiddenText);
     QVERIFY(webView.testAttribute(Qt::WA_InputMethodEnabled));
 
     // 'text' type
@@ -300,13 +310,18 @@ void tst_QWebView::focusInputTypes()
     // 'password' field
     inputElement = mainFrame->documentElement().findFirst(QLatin1String("input[type=password]"));
     QTest::mouseClick(&webView, Qt::LeftButton, 0, inputElement.geometry().center());
-    QVERIFY(webView.inputMethodHints() == Qt::ImhHiddenText);
+    VERIFY_INPUTMETHOD_HINTS(webView.inputMethodHints(), Qt::ImhHiddenText);
     QVERIFY(webView.testAttribute(Qt::WA_InputMethodEnabled));
 
     // 'text area' field
     inputElement = mainFrame->documentElement().findFirst(QLatin1String("textarea"));
     QTest::mouseClick(&webView, Qt::LeftButton, 0, inputElement.geometry().center());
+#if defined(Q_OS_SYMBIAN)
+    QVERIFY(webView.inputMethodHints() & Qt::ImhNoAutoUppercase);
+    QVERIFY(webView.inputMethodHints() & Qt::ImhNoPredictiveText);
+#else
     QVERIFY(webView.inputMethodHints() == Qt::ImhNone);
+#endif
     QVERIFY(webView.testAttribute(Qt::WA_InputMethodEnabled));
 }
 
diff --git a/Source/WebKit/qt/tests/tests.pri b/Source/WebKit/qt/tests/tests.pri
index ebb6f8e..3b0c358 100644
--- a/Source/WebKit/qt/tests/tests.pri
+++ b/Source/WebKit/qt/tests/tests.pri
@@ -10,8 +10,8 @@ ELSE { TARGET = tst_$$TARGET }
 load(mobilityconfig, true)
 contains(MOBILITY_CONFIG, multimedia) {
     # This define is used by tests depending on Qt Multimedia
-    DEFINES -= ENABLE_QT_MULTIMEDIA=0
-    DEFINES += ENABLE_QT_MULTIMEDIA=1
+    DEFINES -= WTF_USE_QT_MULTIMEDIA=0
+    DEFINES += WTF_USE_QT_MULTIMEDIA=1
 }
 
 SOURCES += $${TARGET}.cpp
diff --git a/Source/WebKit/qt/tests/tests.pro b/Source/WebKit/qt/tests/tests.pro
index 529fa04..5fffd7b 100644
--- a/Source/WebKit/qt/tests/tests.pro
+++ b/Source/WebKit/qt/tests/tests.pro
@@ -1,6 +1,6 @@
 
 TEMPLATE = subdirs
-SUBDIRS = qwebframe qwebpage qwebelement qgraphicswebview qwebhistoryinterface qwebview qwebhistory qwebinspector hybridPixmap
+SUBDIRS = qwebframe qwebpage qwebelement qgraphicswebview qwebhistoryinterface qwebview qwebhistory qwebinspector hybridPixmap MIMESniffing
 contains(QT_CONFIG, declarative): SUBDIRS += qdeclarativewebview
 SUBDIRS += benchmarks/painting benchmarks/loading
 contains(DEFINES, ENABLE_WEBGL=1) {
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 870b692..21b04c7 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,6 +1,173 @@
-2011-03-30  Martin Robinson  <mrobinson@igalia.com>
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
 
-        Reviewed by Dirk Schulze.
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename lengthReceived to encodedDataLength/dataLength
+        https://bugs.webkit.org/show_bug.cgi?id=58883
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
+2011-04-18  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the two commands that make en.lproj and copy Localizable.strings.
+
+        Rubber-stamped by Adam Roben.
+
+        * WebKit.vcproj/WebKitLibPostBuild.cmd:
+
+2011-04-18  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Include <WebCore/COMPtr.h> instead of "COMPtr.h"
+        https://bugs.webkit.org/show_bug.cgi?id=58744
+
+        * DOMCoreClasses.cpp:
+        * DOMHTMLClasses.cpp:
+        * WebActionPropertyBag.cpp:
+        * WebBackForwardList.cpp:
+        * WebCoreSupport/WebGeolocationClient.h:
+        * WebDownload.h:
+        * WebDropSource.h:
+        * WebFrame.cpp:
+        * WebHistoryItem.cpp:
+        * WebIconDatabase.cpp:
+        * WebNavigationData.h:
+        * WebPreferences.cpp:
+        * WebResource.h:
+        * WebURLAuthenticationChallenge.cpp:
+        * WebURLAuthenticationChallengeSender.cpp:
+        * WebURLAuthenticationChallengeSenderCFNet.cpp:
+        * WebURLAuthenticationChallengeSenderCurl.cpp:
+        * WebView.h:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CG) to USE(CG)
+        https://bugs.webkit.org/show_bug.cgi?id=58729
+
+        * WebFrame.cpp:
+        (WebFrame::spoolPages):
+        * WebFrame.h:
+        * WebPreferences.cpp:
+        (WebPreferences::setFontSmoothing):
+        (WebPreferences::setFontSmoothingContrast):
+        * WebView.cpp:
+        (systemParameterChanged):
+
+2011-04-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Windows should use WebCore localized strings
+        <rdar://problem/9119405>
+        https://bugs.webkit.org/show_bug.cgi?id=58733
+
+        * WebCoreSupport/WebEditorClient.cpp:
+        (undoNameForEditAction):
+        (WebEditorClient::registerCommandForUndo):
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+        * WebURLResponse.cpp:
+        (CFHTTPMessageCopyLocalizedShortDescriptionForStatusCode):
+        (WebURLResponse::localizedStringForStatusCode):
+        Change to use WEB_UI_STRING.
+
+        * WebCoreSupport/WebPlatformStrategies.cpp:
+        * WebCoreSupport/WebPlatformStrategies.h:
+        Remove the localization strategy in favor of using the default one.
+
+2011-04-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Rename PLATFORM(CAIRO) to USE(CAIRO)
+        https://bugs.webkit.org/show_bug.cgi?id=55192
+
+        * WebFrame.cpp:
+        (WebFrame::spoolPages):
+        * WebFrame.h:
+
+2011-04-14  Adam Roben  <aroben@apple.com>
+
+        Replace some known-to-fail assertions with FIXMEs
+
+        These assertions get hit during various layout tests. They indicate that we're sometimes
+        doing some extra work when a page goes into accelerated compositing mode, but otherwise
+        there's no bad effect.
+
+        See <http://webkit.org/b/58539> for more details.
+
+        Rubber-stamped by John Sullivan.
+
+        * WebView.cpp:
+        (WebView::paintIntoBackingStore):
+        (WebView::paintIntoWindow):
+        Replaced assertions with FIXMEs.
+
+2011-04-13  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Allow setting composited backing stores for scrollbars and scroll corners
+        https://bugs.webkit.org/show_bug.cgi?id=57202
+
+        Update WebScrollBar to reflect ScrollableArea interface changes.
+
+        * WebScrollBar.h:
+        (WebScrollBar::invalidateScrollCornerRect):
+        (WebScrollBar::scrollCornerPresent):
+        (WebScrollBar::scrollCornerRect):
+
+2011-04-12  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58292
+        Provide new setting to allow site icon loading despite disabling automatic image loading in general.
+
+        * Interfaces/IWebPreferencesPrivate.idl: Added prefs. 
+        * Interfaces/WebKit.idl: Touch file to force autogeneration
+        * WebPreferenceKeysPrivate.h: Add preference key.
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings): Initialize setting to false.
+        (WebPreferences::setLoadsSiteIconsIgnoringImageLoadingPreference): Added setter
+        (WebPreferences::loadsSiteIconsIgnoringImageLoadingPreference): Added getter
+        * WebPreferences.h:
+        * WebView.cpp:
+        (WebView::notifyPreferencesChanged): Add to settings that get propagated upon changes.
+
+2011-04-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Cannot use Ctrl-Delete as a custom keyboard shortcut
+        https://bugs.webkit.org/show_bug.cgi?id=58265
+        <rdar://problem/9221468>
+
+        * WebView.cpp: (WebView::keyDown): Removed special handling of Backspace, which is unnecessary
+        now that WebCore implements it.
+
+2011-04-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Support Windows 7 Gestures
+        https://bugs.webkit.org/show_bug.cgi?id=49824
+        <rdar://problem/8689728>
+        
+        Move WindowsTouch.h from WebKit/win to WebCore/platform/win, so it can be
+        used in both WebKit and WebKit2.
+
+        * WebKit.vcproj/WebKit.vcproj: Remove WindowsTouch.h.
+        * WebView.cpp: Include WindowsTouch.h from WebCore instead of WebKit.
+        * WindowsTouch.h: Removed.
+
+2011-04-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Eric Seidel.
 
         [Cairo] Better separate the concerns of GraphicsContextCairo
         https://bugs.webkit.org/show_bug.cgi?id=55150
@@ -12,6 +179,90 @@
         (WebFrame::spoolPages): Ditto.
         * WebFrame.h: Ditto.
 
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+
+        * WebCoreSupport/WebEditorClient.h:
+        (WebEditorClient::requestCheckingOfString):
+
+2011-04-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (WebKit2): Caps-Lock indicator sometimes doesn't appear in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=51230
+        <rdar://problem/8780989>
+
+        * WebView.cpp: (WebView::keyDown): Moved Caps Lock handling from WebKits to WebCore,
+        because WebKit shouldn't be smart.
+
+2011-04-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove unused AnalyzeWithLargeStack code from Windows build files
+        https://bugs.webkit.org/show_bug.cgi?id=57771
+        
+        This was used for us to build with prefast automatically,
+        but it is out-of-date and hasn't been used for some time.
+        Removing completely for now.
+
+        * WebKit.vcproj/WebKitLibPreBuild.cmd:
+
+2011-04-01  Adam Roben  <aroben@apple.com>
+
+        Remove the WebView's "this" pointer from its HWND when WM_DESTROY is received
+
+        This will ensure we don't try to process any window messages after the window has been
+        destroyed.
+
+        Covered by existing tests.
+
+        Fixes <http://webkit.org/b/55054>.
+
+        Reviewed by Steve Falkenburg and John Sullivan.
+
+        * WebView.cpp:
+        (WebView::setIsBeingDestroyed): Moved here from the header file, and added a call to clear
+        out the this pointer from the HWND.
+        (WebView::WebViewWndProc): Changed a runtime check into an assertion.
+
+        * WebView.h: Moved setIsBeingDestroyed from here to the .cpp file.
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidReceiveTitle):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Share most vsprops between Release and Production builds in releaseproduction.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=57508
+
+        * WebKit.vcproj/InterfacesProduction.vsprops:
+        * WebKit.vcproj/InterfacesRelease.vsprops:
+        * WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops:
+        * WebKit.vcproj/WebKitGUIDProduction.vsprops:
+        * WebKit.vcproj/WebKitGUIDRelease.vsprops:
+        * WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops:
+        * WebKit.vcproj/WebKitLibProduction.vsprops:
+        * WebKit.vcproj/WebKitLibRelease.vsprops:
+        * WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops:
+
 2011-03-30  Steve Falkenburg  <sfalken@apple.com>
 
         Reviewed by Adam Roben.
diff --git a/Source/WebKit/win/DOMCoreClasses.cpp b/Source/WebKit/win/DOMCoreClasses.cpp
index b0a6031..7137449 100644
--- a/Source/WebKit/win/DOMCoreClasses.cpp
+++ b/Source/WebKit/win/DOMCoreClasses.cpp
@@ -27,13 +27,13 @@
 #include "WebKitDLL.h"
 #include "DOMCoreClasses.h"
 
-#include "COMPtr.h"
 #include "DOMCSSClasses.h"
 #include "DOMEventsClasses.h"
 #include "DOMHTMLClasses.h"
 #include "WebKitGraphics.h"
 
 #include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/DOMWindow.h>
 #include <WebCore/Document.h>
 #include <WebCore/Element.h>
diff --git a/Source/WebKit/win/DOMHTMLClasses.cpp b/Source/WebKit/win/DOMHTMLClasses.cpp
index c163ec4..d7fdbf6 100644
--- a/Source/WebKit/win/DOMHTMLClasses.cpp
+++ b/Source/WebKit/win/DOMHTMLClasses.cpp
@@ -26,10 +26,10 @@
 #include "config.h"
 #include "WebKitDLL.h"
 #include "DOMHTMLClasses.h"
-#include "COMPtr.h"
 #include "WebFrame.h"
 
 #include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/Document.h>
 #include <WebCore/Element.h>
 #include <WebCore/FrameView.h>
diff --git a/Source/WebKit/win/Interfaces/IWebPreferencesPrivate.idl b/Source/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
index 68cbcf3..e3fabd3 100644
--- a/Source/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
+++ b/Source/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
@@ -121,4 +121,7 @@ interface IWebPreferencesPrivate : IUnknown
 
     HRESULT hyperlinkAuditingEnabled(BOOL *hyperlinkAuditingEnabled);
     HRESULT setHyperlinkAuditingEnabled(BOOL hyperlinkAuditingEnabled);
+
+    HRESULT setLoadsSiteIconsIgnoringImageLoadingPreference([in] BOOL enabled);
+    HRESULT loadsSiteIconsIgnoringImageLoadingPreference([out, retval] BOOL* enabled);
 }
diff --git a/Source/WebKit/win/Interfaces/WebKit.idl b/Source/WebKit/win/Interfaces/WebKit.idl
index 3f401be..88158a4 100644
--- a/Source/WebKit/win/Interfaces/WebKit.idl
+++ b/Source/WebKit/win/Interfaces/WebKit.idl
@@ -301,4 +301,3 @@ library WebKit
         [default] interface IWebUserContentURLPattern;
     }
 }
-
diff --git a/Source/WebKit/win/WebActionPropertyBag.cpp b/Source/WebKit/win/WebActionPropertyBag.cpp
index b20da91..fca83be 100644
--- a/Source/WebKit/win/WebActionPropertyBag.cpp
+++ b/Source/WebKit/win/WebActionPropertyBag.cpp
@@ -27,11 +27,11 @@
 #include "WebKitDLL.h"
 #include "WebActionPropertyBag.h"
 
-#include "COMPtr.h"
 #include "DOMCoreClasses.h"
 #include "WebElementPropertyBag.h"
 #include "WebKit.h"
 #include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/EventHandler.h>
 #include <WebCore/HitTestResult.h>
 #include <WebCore/MouseEvent.h>
diff --git a/Source/WebKit/win/WebBackForwardList.cpp b/Source/WebKit/win/WebBackForwardList.cpp
index 2faaf7e..bd23d26 100644
--- a/Source/WebKit/win/WebBackForwardList.cpp
+++ b/Source/WebKit/win/WebBackForwardList.cpp
@@ -27,12 +27,12 @@
 #include "WebKitDLL.h"
 #include "WebBackForwardList.h"
 
-#include "COMPtr.h"
 #include "WebFrame.h"
 #include "WebKit.h"
 #include "WebPreferences.h"
 
 #include <WebCore/BackForwardListImpl.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/HistoryItem.h>
 
 using std::min;
diff --git a/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp b/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
index 1105904..dda0cc3 100644
--- a/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2011 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,7 +28,6 @@
 #include "WebEditorClient.h"
 
 #include "WebKit.h"
-#include "WebLocalizableStrings.h"
 #include "WebNotification.h"
 #include "WebNotificationCenter.h"
 #include "WebView.h"
@@ -40,6 +39,7 @@
 #include <WebCore/HTMLInputElement.h>
 #include <WebCore/HTMLNames.h>
 #include <WebCore/KeyboardEvent.h>
+#include <WebCore/LocalizedStrings.h>
 #include <WebCore/NotImplemented.h>
 #include <WebCore/PlatformKeyboardEvent.h>
 #include <WebCore/Range.h>
@@ -482,65 +482,62 @@ ULONG STDMETHODCALLTYPE WebEditorUndoCommand::Release(void)
     return newRef;
 }
 
-static LPCTSTR undoNameForEditAction(EditAction editAction)
+static String undoNameForEditAction(EditAction editAction)
 {
     switch (editAction) {
-        case EditActionUnspecified: return 0;
-        case EditActionSetColor: return LPCTSTR_UI_STRING_KEY("Set Color", "Set Color (Undo action name)", "Undo action name");
-        case EditActionSetBackgroundColor: return LPCTSTR_UI_STRING_KEY("Set Background Color", "Set Background Color (Undo action name)", "Undo action name");
-        case EditActionTurnOffKerning: return LPCTSTR_UI_STRING_KEY("Turn Off Kerning", "Turn Off Kerning (Undo action name)", "Undo action name");
-        case EditActionTightenKerning: return LPCTSTR_UI_STRING_KEY("Tighten Kerning", "Tighten Kerning (Undo action name)", "Undo action name");
-        case EditActionLoosenKerning: return LPCTSTR_UI_STRING_KEY("Loosen Kerning", "Loosen Kerning (Undo action name)", "Undo action name");
-        case EditActionUseStandardKerning: return LPCTSTR_UI_STRING_KEY("Use Standard Kerning", "Use Standard Kerning (Undo action name)", "Undo action name");
-        case EditActionTurnOffLigatures: return LPCTSTR_UI_STRING_KEY("Turn Off Ligatures", "Turn Off Ligatures (Undo action name)", "Undo action name");
-        case EditActionUseStandardLigatures: return LPCTSTR_UI_STRING_KEY("Use Standard Ligatures", "Use Standard Ligatures (Undo action name)", "Undo action name");
-        case EditActionUseAllLigatures: return LPCTSTR_UI_STRING_KEY("Use All Ligatures", "Use All Ligatures (Undo action name)", "Undo action name");
-        case EditActionRaiseBaseline: return LPCTSTR_UI_STRING_KEY("Raise Baseline", "Raise Baseline (Undo action name)", "Undo action name");
-        case EditActionLowerBaseline: return LPCTSTR_UI_STRING_KEY("Lower Baseline", "Lower Baseline (Undo action name)", "Undo action name");
-        case EditActionSetTraditionalCharacterShape: return LPCTSTR_UI_STRING_KEY("Set Traditional Character Shape", "Set Traditional Character Shape (Undo action name)", "Undo action name");
-        case EditActionSetFont: return LPCTSTR_UI_STRING_KEY("Set Font", "Set Font (Undo action name)", "Undo action name");
-        case EditActionChangeAttributes: return LPCTSTR_UI_STRING_KEY("Change Attributes", "Change Attributes (Undo action name)", "Undo action name");
-        case EditActionAlignLeft: return LPCTSTR_UI_STRING_KEY("Align Left", "Align Left (Undo action name)", "Undo action name");
-        case EditActionAlignRight: return LPCTSTR_UI_STRING_KEY("Align Right", "Align Right (Undo action name)", "Undo action name");
-        case EditActionCenter: return LPCTSTR_UI_STRING_KEY("Center", "Center (Undo action name)", "Undo action name");
-        case EditActionJustify: return LPCTSTR_UI_STRING_KEY("Justify", "Justify (Undo action name)", "Undo action name");
-        case EditActionSetWritingDirection: return LPCTSTR_UI_STRING_KEY("Set Writing Direction", "Set Writing Direction (Undo action name)", "Undo action name");
-        case EditActionSubscript: return LPCTSTR_UI_STRING_KEY("Subscript", "Subscript (Undo action name)", "Undo action name");
-        case EditActionSuperscript: return LPCTSTR_UI_STRING_KEY("Superscript", "Superscript (Undo action name)", "Undo action name");
-        case EditActionUnderline: return LPCTSTR_UI_STRING_KEY("Underline", "Underline (Undo action name)", "Undo action name");
-        case EditActionOutline: return LPCTSTR_UI_STRING_KEY("Outline", "Outline (Undo action name)", "Undo action name");
-        case EditActionUnscript: return LPCTSTR_UI_STRING_KEY("Unscript", "Unscript (Undo action name)", "Undo action name");
-        case EditActionDrag: return LPCTSTR_UI_STRING_KEY("Drag", "Drag (Undo action name)", "Undo action name");
-        case EditActionCut: return LPCTSTR_UI_STRING_KEY("Cut", "Cut (Undo action name)", "Undo action name");
-        case EditActionPaste: return LPCTSTR_UI_STRING_KEY("Paste", "Paste (Undo action name)", "Undo action name");
-        case EditActionPasteFont: return LPCTSTR_UI_STRING_KEY("Paste Font", "Paste Font (Undo action name)", "Undo action name");
-        case EditActionPasteRuler: return LPCTSTR_UI_STRING_KEY("Paste Ruler", "Paste Ruler (Undo action name)", "Undo action name");
-        case EditActionTyping: return LPCTSTR_UI_STRING_KEY("Typing", "Typing (Undo action name)", "Undo action name");
-        case EditActionCreateLink: return LPCTSTR_UI_STRING_KEY("Create Link", "Create Link (Undo action name)", "Undo action name");
-        case EditActionUnlink: return LPCTSTR_UI_STRING_KEY("Unlink", "Unlink (Undo action name)", "Undo action name");
-        case EditActionInsertList: return LPCTSTR_UI_STRING_KEY("Insert List", "Insert List (Undo action name)", "Undo action name");
-        case EditActionFormatBlock: return LPCTSTR_UI_STRING_KEY("Formatting", "Format Block (Undo action name)", "Undo action name");
-        case EditActionIndent: return LPCTSTR_UI_STRING_KEY("Indent", "Indent (Undo action name)", "Undo action name");
-        case EditActionOutdent: return LPCTSTR_UI_STRING_KEY("Outdent", "Outdent (Undo action name)", "Undo action name");
+    case EditActionUnspecified: return String();
+    case EditActionSetColor: return WEB_UI_STRING_KEY("Set Color", "Set Color (Undo action name)", "Undo action name");
+    case EditActionSetBackgroundColor: return WEB_UI_STRING_KEY("Set Background Color", "Set Background Color (Undo action name)", "Undo action name");
+    case EditActionTurnOffKerning: return WEB_UI_STRING_KEY("Turn Off Kerning", "Turn Off Kerning (Undo action name)", "Undo action name");
+    case EditActionTightenKerning: return WEB_UI_STRING_KEY("Tighten Kerning", "Tighten Kerning (Undo action name)", "Undo action name");
+    case EditActionLoosenKerning: return WEB_UI_STRING_KEY("Loosen Kerning", "Loosen Kerning (Undo action name)", "Undo action name");
+    case EditActionUseStandardKerning: return WEB_UI_STRING_KEY("Use Standard Kerning", "Use Standard Kerning (Undo action name)", "Undo action name");
+    case EditActionTurnOffLigatures: return WEB_UI_STRING_KEY("Turn Off Ligatures", "Turn Off Ligatures (Undo action name)", "Undo action name");
+    case EditActionUseStandardLigatures: return WEB_UI_STRING_KEY("Use Standard Ligatures", "Use Standard Ligatures (Undo action name)", "Undo action name");
+    case EditActionUseAllLigatures: return WEB_UI_STRING_KEY("Use All Ligatures", "Use All Ligatures (Undo action name)", "Undo action name");
+    case EditActionRaiseBaseline: return WEB_UI_STRING_KEY("Raise Baseline", "Raise Baseline (Undo action name)", "Undo action name");
+    case EditActionLowerBaseline: return WEB_UI_STRING_KEY("Lower Baseline", "Lower Baseline (Undo action name)", "Undo action name");
+    case EditActionSetTraditionalCharacterShape: return WEB_UI_STRING_KEY("Set Traditional Character Shape", "Set Traditional Character Shape (Undo action name)", "Undo action name");
+    case EditActionSetFont: return WEB_UI_STRING_KEY("Set Font", "Set Font (Undo action name)", "Undo action name");
+    case EditActionChangeAttributes: return WEB_UI_STRING_KEY("Change Attributes", "Change Attributes (Undo action name)", "Undo action name");
+    case EditActionAlignLeft: return WEB_UI_STRING_KEY("Align Left", "Align Left (Undo action name)", "Undo action name");
+    case EditActionAlignRight: return WEB_UI_STRING_KEY("Align Right", "Align Right (Undo action name)", "Undo action name");
+    case EditActionCenter: return WEB_UI_STRING_KEY("Center", "Center (Undo action name)", "Undo action name");
+    case EditActionJustify: return WEB_UI_STRING_KEY("Justify", "Justify (Undo action name)", "Undo action name");
+    case EditActionSetWritingDirection: return WEB_UI_STRING_KEY("Set Writing Direction", "Set Writing Direction (Undo action name)", "Undo action name");
+    case EditActionSubscript: return WEB_UI_STRING_KEY("Subscript", "Subscript (Undo action name)", "Undo action name");
+    case EditActionSuperscript: return WEB_UI_STRING_KEY("Superscript", "Superscript (Undo action name)", "Undo action name");
+    case EditActionUnderline: return WEB_UI_STRING_KEY("Underline", "Underline (Undo action name)", "Undo action name");
+    case EditActionOutline: return WEB_UI_STRING_KEY("Outline", "Outline (Undo action name)", "Undo action name");
+    case EditActionUnscript: return WEB_UI_STRING_KEY("Unscript", "Unscript (Undo action name)", "Undo action name");
+    case EditActionDrag: return WEB_UI_STRING_KEY("Drag", "Drag (Undo action name)", "Undo action name");
+    case EditActionCut: return WEB_UI_STRING_KEY("Cut", "Cut (Undo action name)", "Undo action name");
+    case EditActionPaste: return WEB_UI_STRING_KEY("Paste", "Paste (Undo action name)", "Undo action name");
+    case EditActionPasteFont: return WEB_UI_STRING_KEY("Paste Font", "Paste Font (Undo action name)", "Undo action name");
+    case EditActionPasteRuler: return WEB_UI_STRING_KEY("Paste Ruler", "Paste Ruler (Undo action name)", "Undo action name");
+    case EditActionTyping: return WEB_UI_STRING_KEY("Typing", "Typing (Undo action name)", "Undo action name");
+    case EditActionCreateLink: return WEB_UI_STRING_KEY("Create Link", "Create Link (Undo action name)", "Undo action name");
+    case EditActionUnlink: return WEB_UI_STRING_KEY("Unlink", "Unlink (Undo action name)", "Undo action name");
+    case EditActionInsertList: return WEB_UI_STRING_KEY("Insert List", "Insert List (Undo action name)", "Undo action name");
+    case EditActionFormatBlock: return WEB_UI_STRING_KEY("Formatting", "Format Block (Undo action name)", "Undo action name");
+    case EditActionIndent: return WEB_UI_STRING_KEY("Indent", "Indent (Undo action name)", "Undo action name");
+    case EditActionOutdent: return WEB_UI_STRING_KEY("Outdent", "Outdent (Undo action name)", "Undo action name");
     }
-    return 0;
+    return String();
 }
 
 void WebEditorClient::registerCommandForUndo(PassRefPtr<EditCommand> command)
 {
     IWebUIDelegate* uiDelegate = 0;
     if (SUCCEEDED(m_webView->uiDelegate(&uiDelegate))) {
-        LPCTSTR actionName = undoNameForEditAction(command->editingAction());
+        String actionName = undoNameForEditAction(command->editingAction());
         WebEditorUndoCommand* undoCommand = new WebEditorUndoCommand(command, true);
         if (!undoCommand)
             return;
         uiDelegate->registerUndoWithTarget(m_undoTarget, 0, undoCommand);
         undoCommand->Release(); // the undo manager owns the reference
-        BSTR actionNameBSTR = SysAllocString(actionName);
-        if (actionNameBSTR) {
-            uiDelegate->setActionTitle(actionNameBSTR);
-            SysFreeString(actionNameBSTR);
-        }
+        if (!actionName.isEmpty())
+            uiDelegate->setActionTitle(BString(actionName));
         uiDelegate->Release();
     }
 }
diff --git a/Source/WebKit/win/WebCoreSupport/WebEditorClient.h b/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
index 1d0a7d0..d456cc9 100644
--- a/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
@@ -110,7 +110,7 @@ public:
 
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&) {}
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
     virtual WebCore::TextCheckerClient* textChecker() { return this; }
 
 private:
diff --git a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index 10a3190..ca61d30 100644
--- a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -364,12 +364,13 @@ void WebFrameLoaderClient::dispatchDidStartProvisionalLoad()
         frameLoadDelegate->didStartProvisionalLoadForFrame(webView, m_webFrame);
 }
 
-void WebFrameLoaderClient::dispatchDidReceiveTitle(const String& title)
+void WebFrameLoaderClient::dispatchDidReceiveTitle(const StringWithDirection& title)
 {
     WebView* webView = m_webFrame->webView();
     COMPtr<IWebFrameLoadDelegate> frameLoadDelegate;
     if (SUCCEEDED(webView->frameLoadDelegate(&frameLoadDelegate)))
-        frameLoadDelegate->didReceiveTitle(webView, BString(title), m_webFrame);
+        // FIXME: use direction of title.
+        frameLoadDelegate->didReceiveTitle(webView, BString(title.string()), m_webFrame);
 }
 
 void WebFrameLoaderClient::dispatchDidChangeIcons()
@@ -542,7 +543,7 @@ void WebFrameLoaderClient::updateGlobalHistory()
         COMPtr<IWebURLRequest> urlRequest(AdoptCOM, WebMutableURLRequest::createInstance(loader->originalRequestCopy()));
         
         COMPtr<IWebNavigationData> navigationData(AdoptCOM, WebNavigationData::createInstance(
-            loader->urlForHistory(), loader->title(), urlRequest.get(), urlResponse.get(), loader->substituteData().isValid(), loader->clientRedirectSourceForHistory()));
+            loader->urlForHistory(), loader->title().string(), urlRequest.get(), urlResponse.get(), loader->substituteData().isValid(), loader->clientRedirectSourceForHistory()));
 
         historyDelegate->didNavigateWithNavigationData(webView, navigationData.get(), m_webFrame);
         return;
@@ -552,7 +553,7 @@ void WebFrameLoaderClient::updateGlobalHistory()
     if (!history)
         return;
 
-    history->visitedURL(loader->urlForHistory(), loader->title(), loader->originalRequestCopy().httpMethod(), loader->urlForHistoryReflectsFailure(), !loader->clientRedirectSourceForHistory());
+    history->visitedURL(loader->urlForHistory(), loader->title().string(), loader->originalRequestCopy().httpMethod(), loader->urlForHistoryReflectsFailure(), !loader->clientRedirectSourceForHistory());
 }
 
 void WebFrameLoaderClient::updateGlobalHistoryRedirectLinks()
@@ -672,13 +673,13 @@ PassRefPtr<DocumentLoader> WebFrameLoaderClient::createDocumentLoader(const Reso
     return loader.release();
 }
 
-void WebFrameLoaderClient::setTitle(const String& title, const KURL& url)
+void WebFrameLoaderClient::setTitle(const StringWithDirection& title, const KURL& url)
 {
     WebView* webView = m_webFrame->webView();
     COMPtr<IWebHistoryDelegate> historyDelegate;
     webView->historyDelegate(&historyDelegate);
     if (historyDelegate) {
-        BString titleBSTR(title);
+        BString titleBSTR(title.string());
         BString urlBSTR(url.string());
         historyDelegate->updateHistoryTitle(webView, titleBSTR, urlBSTR);
         return;
@@ -704,7 +705,7 @@ void WebFrameLoaderClient::setTitle(const String& title, const KURL& url)
     if (!itemPrivate)
         return;
 
-    itemPrivate->setTitle(BString(title));
+    itemPrivate->setTitle(BString(title.string()));
 }
 
 void WebFrameLoaderClient::savePlatformDataToCachedFrame(CachedFrame* cachedFrame)
diff --git a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
index d864b23..c80f76c 100644
--- a/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
@@ -53,7 +53,7 @@ public:
     virtual void dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::AuthenticationChallenge&);
     virtual void dispatchDidCancelAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::AuthenticationChallenge&);
     virtual void dispatchDidReceiveResponse(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceResponse&);
-    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived);
+    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int dataLength);
     virtual void dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long identifier);
     virtual void dispatchDidFailLoading(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceError&);
     virtual bool shouldCacheResponse(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceResponse&, const unsigned char* data, unsigned long long length);
@@ -69,7 +69,7 @@ public:
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
-    virtual void dispatchDidReceiveTitle(const WTF::String&);
+    virtual void dispatchDidReceiveTitle(const WebCore::StringWithDirection&);
     virtual void dispatchDidChangeIcons();
     virtual void dispatchDidCommitLoad();
     virtual void dispatchDidFinishDocumentLoad();
@@ -103,7 +103,7 @@ public:
     virtual void didRunInsecureContent(WebCore::SecurityOrigin*, const WebCore::KURL&);
 
     virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
-    virtual void setTitle(const WTF::String& title, const WebCore::KURL&);
+    virtual void setTitle(const WebCore::StringWithDirection&, const WebCore::KURL&);
 
     virtual void savePlatformDataToCachedFrame(WebCore::CachedFrame*);
     virtual void transitionToCommittedFromCachedFrame(WebCore::CachedFrame*);
diff --git a/Source/WebKit/win/WebCoreSupport/WebGeolocationClient.h b/Source/WebKit/win/WebCoreSupport/WebGeolocationClient.h
index c5db134..2bd29af 100644
--- a/Source/WebKit/win/WebCoreSupport/WebGeolocationClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebGeolocationClient.h
@@ -26,7 +26,7 @@
 #ifndef WebGeolocationClient_h
 #define WebGeolocationClient_h
 
-#include "COMPtr.h"
+#include <WebCore/COMPtr.h>
 #include <WebCore/GeolocationClient.h>
 
 namespace WebCore {
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
index e87777e..fdafa25 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,13 +26,9 @@
 #include "config.h"
 #include "WebPlatformStrategies.h"
 
-#include "WebLocalizableStrings.h"
-#include <WebCore/IntSize.h>
 #include <WebCore/Page.h>
 #include <WebCore/PageGroup.h>
 #include <WebCore/PluginDatabase.h>
-#include <wtf/MathExtras.h>
-#include <wtf/RetainPtr.h>
 
 using namespace WebCore;
 
@@ -56,11 +52,6 @@ PluginStrategy* WebPlatformStrategies::createPluginStrategy()
     return this;
 }
 
-LocalizationStrategy* WebPlatformStrategies::createLocalizationStrategy()
-{
-    return this;
-}
-
 VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
 {
     return this;
@@ -108,560 +99,6 @@ void WebPlatformStrategies::getPluginInfo(const WebCore::Page*, Vector<WebCore::
     }
 }
 
-// LocalizationStrategy    
-
-String WebPlatformStrategies::searchableIndexIntroduction()
-{
-    return UI_STRING("This is a searchable index. Enter search keywords: ", "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
-}
-
-String WebPlatformStrategies::submitButtonDefaultLabel()
-{
-    return UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
-}
-
-String WebPlatformStrategies::inputElementAltText()
-{
-    return UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
-}
-
-String WebPlatformStrategies::resetButtonDefaultLabel()
-{
-    return UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
-}
-
-String WebPlatformStrategies::fileButtonChooseFileLabel()
-{
-    return UI_STRING("Choose File", "title for file button used in HTML forms");
-}
-
-String WebPlatformStrategies::fileButtonNoFileSelectedLabel()
-{
-    return UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
-}
-
-String WebPlatformStrategies::defaultDetailsSummaryText()
-{
-    return UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenLinkInNewWindow()
-{
-    return UI_STRING("Open Link in New Window", "Open in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDownloadLinkToDisk()
-{
-    return UI_STRING("Download Linked File", "Download Linked File context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyLinkToClipboard()
-{
-    return UI_STRING("Copy Link", "Copy Link context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenImageInNewWindow()
-{
-    return UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDownloadImageToDisk()
-{
-    return UI_STRING("Download Image", "Download Image context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyImageToClipboard()
-{
-    return UI_STRING("Copy Image", "Copy Image context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenVideoInNewWindow()
-{
-    return UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenAudioInNewWindow()
-{
-    return UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyVideoLinkToClipboard()
-{
-    return UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopyAudioLinkToClipboard()
-{
-    return UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagToggleMediaControls()
-{
-    return UI_STRING("Controls", "Media Controls context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagToggleMediaLoop()
-{
-    return UI_STRING("Loop", "Media Loop context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagEnterVideoFullscreen()
-{
-    return UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaPlay()
-{
-    return UI_STRING("Play", "Media Play context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaPause()
-{
-    return UI_STRING("Pause", "Media Pause context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagMediaMute()
-{
-    return UI_STRING("Mute", "Media Mute context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenFrameInNewWindow()
-{
-    return UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCopy()
-{
-    return UI_STRING("Copy", "Copy context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagGoBack()
-{
-    return UI_STRING("Back", "Back context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagGoForward()
-{
-    return UI_STRING("Forward", "Forward context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagStop()
-{
-    return UI_STRING("Stop", "Stop context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagReload()
-{
-    return UI_STRING("Reload", "Reload context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCut()
-{
-    return UI_STRING("Cut", "Cut context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagPaste()
-{
-    return UI_STRING("Paste", "Paste context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagNoGuessesFound()
-{
-    return UI_STRING("No Guesses Found", "No Guesses Found context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagIgnoreSpelling()
-{
-    return UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLearnSpelling()
-{
-    return UI_STRING("Learn Spelling", "Learn Spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSearchWeb()
-{
-    return UI_STRING("Search with Google", "Search in Google context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLookUpInDictionary(const String&)
-{
-    return UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOpenLink()
-{
-    return UI_STRING("Open Link", "Open Link context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagIgnoreGrammar()
-{
-    return UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagSpellingMenu()
-{
-    return UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckSpelling()
-{
-    return UI_STRING("Check Document Now", "Check spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckSpellingWhileTyping()
-{
-    return UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagCheckGrammarWithSpelling()
-{
-    return UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagFontMenu()
-{
-    return UI_STRING("Font", "Font context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagBold()
-{
-    return UI_STRING("Bold", "Bold context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagItalic()
-{
-    return UI_STRING("Italic", "Italic context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagUnderline()
-{
-    return UI_STRING("Underline", "Underline context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagOutline()
-{
-    return UI_STRING("Outline", "Outline context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagWritingDirectionMenu()
-{
-    return UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagTextDirectionMenu()
-{
-    return UI_STRING("Selection Direction", "Selection direction context sub-menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagDefaultDirection()
-{
-    return UI_STRING("Default", "Default writing direction context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagLeftToRight()
-{
-    return UI_STRING("Left to Right", "Left to Right context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagRightToLeft()
-{
-    return UI_STRING("Right to Left", "Right to Left context menu item");
-}
-
-String WebPlatformStrategies::contextMenuItemTagShowSpellingPanel(bool show)
-{
-    if (show)
-        return UI_STRING("Show Spelling and Grammar", "menu item title");
-    return UI_STRING("Hide Spelling and Grammar", "menu item title");
-}
-
-String WebPlatformStrategies::contextMenuItemTagInspectElement()
-{
-    return UI_STRING("Inspect Element", "Inspect Element context menu item");
-}
-
-String WebPlatformStrategies::searchMenuNoRecentSearchesText()
-{
-    return UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
-}
-
-String WebPlatformStrategies::searchMenuRecentSearchesText()
-{
-    return UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
-}
-
-String WebPlatformStrategies::searchMenuClearRecentSearchesText()
-{
-    return UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
-}
-
-String WebPlatformStrategies::AXWebAreaText()
-{
-    return UI_STRING("web area", "accessibility role description for web area");
-}
-
-String WebPlatformStrategies::AXLinkText()
-{
-    return UI_STRING("link", "accessibility role description for link");
-}
-
-String WebPlatformStrategies::AXListMarkerText()
-{
-    return UI_STRING("list marker", "accessibility role description for list marker");
-}
-
-String WebPlatformStrategies::AXImageMapText()
-{
-    return UI_STRING("image map", "accessibility role description for image map");
-}
-
-String WebPlatformStrategies::AXHeadingText()
-{
-    return UI_STRING("heading", "accessibility role description for headings");
-}
-
-String WebPlatformStrategies::AXDefinitionListTermText()
-{
-    return UI_STRING("term", "term word of a definition");
-}
-
-String WebPlatformStrategies::AXDefinitionListDefinitionText()
-{
-    return UI_STRING("definition", "definition phrase");
-}
-
-String WebPlatformStrategies::AXButtonActionVerb()
-{
-    return UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXRadioButtonActionVerb()
-{
-    return UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXTextFieldActionVerb()
-{
-    return UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXCheckedCheckBoxActionVerb()
-{
-    return UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXUncheckedCheckBoxActionVerb()
-{
-    return UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXLinkActionVerb()
-{
-    return UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXMenuListActionVerb()
-{
-    return UI_STRING("open", "Verb stating the action that will occur when a select element is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::AXMenuListPopupActionVerb()
-{
-    return UI_STRING_KEY("press", "press (select element)", "Verb stating the action that will occur when a select element's popup list is clicked, as used by accessibility");
-}
-
-String WebPlatformStrategies::unknownFileSizeText()
-{
-    return UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
-}
-
-String WebPlatformStrategies::uploadFileText()
-{
-    return UI_STRING("Upload file", "(Windows) Form submit file upload dialog title");
-}
-
-String WebPlatformStrategies::allFilesText()
-{
-    return UI_STRING("All Files", "(Windows) Form submit file upload all files pop-up");
-}
-
-String WebPlatformStrategies::missingPluginText()
-{
-    return UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
-}
-
-String WebPlatformStrategies::crashedPluginText()
-{
-    return UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
-}
-
-String WebPlatformStrategies::imageTitle(const String& filename, const IntSize& size) 
-{
-    RetainPtr<CFStringRef> filenameCF(AdoptCF, filename.createCFString());
-    return RetainPtr<CFStringRef>(AdoptCF, CFStringCreateWithFormat(0, 0, UI_STRING("%@ %d\xC3\x97%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCF.get(), size.width(), size.height())).get();
-}
-
-String WebPlatformStrategies::multipleFileUploadText(unsigned numberOfFiles)
-{
-    return RetainPtr<CFStringRef>(AdoptCF, CFStringCreateWithFormat(0, 0, UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles)).get();
-}
-
-String WebPlatformStrategies::mediaElementLoadingStateText()
-{
-    return UI_STRING("Loading...", "Media controller status message when the media is loading");
-}
-
-String WebPlatformStrategies::mediaElementLiveBroadcastStateText()
-{
-    return UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
-}
-
-String WebPlatformStrategies::localizedMediaControlElementString(const String& name)
-{
-    if (name == "AudioElement")
-        return UI_STRING("audio element controller", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return UI_STRING("video element controller", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return UI_STRING("mute", "accessibility role description for mute button");
-    if (name == "UnMuteButton")
-        return UI_STRING("unmute", "accessibility role description for turn mute off button");
-    if (name == "PlayButton")
-        return UI_STRING("play", "accessibility role description for play button");
-    if (name == "PauseButton")
-        return UI_STRING("pause", "accessibility role description for pause button");
-    if (name == "Slider")
-        return UI_STRING("movie time", "accessibility role description for timeline slider");
-    if (name == "SliderThumb")
-        return UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
-    if (name == "RewindButton")
-        return UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return UI_STRING("return to realtime", "accessibility role description for return to real time button");
-    if (name == "CurrentTimeDisplay")
-        return UI_STRING("elapsed time", "accessibility role description for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return UI_STRING("remaining time", "accessibility role description for time remaining display");
-    if (name == "StatusDisplay")
-        return UI_STRING("status", "accessibility role description for movie status");
-    if (name == "FullscreenButton")
-        return UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
-    if (name == "SeekForwardButton")
-        return UI_STRING("fast forward", "accessibility role description for fast forward button");
-    if (name == "SeekBackButton")
-        return UI_STRING("fast reverse", "accessibility role description for fast reverse button");
-    if (name == "ShowClosedCaptionsButton")
-        return UI_STRING("show closed captions", "accessibility role description for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String WebPlatformStrategies::localizedMediaControlElementHelpText(const String& name)
-{
-    if (name == "AudioElement")
-        return UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return UI_STRING("mute audio tracks", "accessibility help text for mute button");
-    if (name == "UnMuteButton")
-        return UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
-    if (name == "PlayButton")
-        return UI_STRING("begin playback", "accessibility help text for play button");
-    if (name == "PauseButton")
-        return UI_STRING("pause playback", "accessibility help text for pause button");
-    if (name == "Slider")
-        return UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
-    if (name == "SliderThumb")
-        return UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
-    if (name == "RewindButton")
-        return UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
-    if (name == "CurrentTimeDisplay")
-        return UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
-    if (name == "StatusDisplay")
-        return UI_STRING("current movie status", "accessibility help text for movie status display");
-    if (name == "SeekBackButton")
-        return UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
-    if (name == "SeekForwardButton")
-        return UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
-    if (name == "FullscreenButton")
-        return UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
-    if (name == "ShowClosedCaptionsButton")
-        return UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String WebPlatformStrategies::localizedMediaTimeDescription(float time)
-{
-    if (!isfinite(time))
-        return UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
-
-    int seconds = (int)fabsf(time);
-    int days = seconds / (60 * 60 * 24);
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-
-    if (days)
-        return RetainPtr<CFStringRef>(AdoptCF, CFStringCreateWithFormat(0, 0, UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds)).get();
-
-    if (hours)
-        return RetainPtr<CFStringRef>(AdoptCF, CFStringCreateWithFormat(0, 0, UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds)).get();
-
-    if (minutes)
-        return RetainPtr<CFStringRef>(AdoptCF, CFStringCreateWithFormat(0, 0, UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds)).get();
-
-    return RetainPtr<CFStringRef>(AdoptCF, CFStringCreateWithFormat(0, 0, UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds)).get();
-}
-
-String WebPlatformStrategies::validationMessageValueMissingText()
-{
-    return UI_STRING("value missing", "Validation message for required form control elements that have no value");
-}
-
-String WebPlatformStrategies::validationMessageTypeMismatchText()
-{
-    return UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
-}
-
-String WebPlatformStrategies::validationMessagePatternMismatchText()
-{
-    return UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
-}
-
-String WebPlatformStrategies::validationMessageTooLongText()
-{
-    return UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
-}
-
-String WebPlatformStrategies::validationMessageRangeUnderflowText()
-{
-    return UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
-}
-
-String WebPlatformStrategies::validationMessageRangeOverflowText()
-{
-    return UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
-}
-
-String WebPlatformStrategies::validationMessageStepMismatchText()
-{
-    return UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
-}
-
 bool WebPlatformStrategies::isLinkVisited(Page* page, LinkHash hash)
 {
     return page->group().isLinkVisited(hash);
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
index 6d2949d..c4f199b 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,12 +27,11 @@
 #define WebPlatformStrategies_h
 
 #include <WebCore/CookiesStrategy.h>
-#include <WebCore/LocalizationStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::LocalizationStrategy, private WebCore::VisitedLinkStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
     
@@ -42,7 +41,6 @@ private:
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
-    virtual WebCore::LocalizationStrategy* createLocalizationStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
 
     // WebCore::CookiesStrategy
@@ -52,101 +50,6 @@ private:
     virtual void refreshPlugins();
     virtual void getPluginInfo(const WebCore::Page*, Vector<WebCore::PluginInfo>&);
 
-    // WebCore::LocalizationStrategy    
-    virtual WTF::String inputElementAltText();
-    virtual WTF::String resetButtonDefaultLabel();
-    virtual WTF::String searchableIndexIntroduction();
-    virtual WTF::String submitButtonDefaultLabel();
-    virtual WTF::String fileButtonChooseFileLabel();
-    virtual WTF::String fileButtonNoFileSelectedLabel();
-    virtual WTF::String defaultDetailsSummaryText();
-#if ENABLE(CONTEXT_MENUS)
-    virtual WTF::String contextMenuItemTagOpenLinkInNewWindow();
-    virtual WTF::String contextMenuItemTagDownloadLinkToDisk();
-    virtual WTF::String contextMenuItemTagCopyLinkToClipboard();
-    virtual WTF::String contextMenuItemTagOpenImageInNewWindow();
-    virtual WTF::String contextMenuItemTagDownloadImageToDisk();
-    virtual WTF::String contextMenuItemTagCopyImageToClipboard();
-    virtual WTF::String contextMenuItemTagOpenFrameInNewWindow();
-    virtual WTF::String contextMenuItemTagCopy();
-    virtual WTF::String contextMenuItemTagGoBack();
-    virtual WTF::String contextMenuItemTagGoForward();
-    virtual WTF::String contextMenuItemTagStop();
-    virtual WTF::String contextMenuItemTagReload();
-    virtual WTF::String contextMenuItemTagCut();
-    virtual WTF::String contextMenuItemTagPaste();
-    virtual WTF::String contextMenuItemTagNoGuessesFound();
-    virtual WTF::String contextMenuItemTagIgnoreSpelling();
-    virtual WTF::String contextMenuItemTagLearnSpelling();
-    virtual WTF::String contextMenuItemTagSearchWeb();
-    virtual WTF::String contextMenuItemTagLookUpInDictionary(const WTF::String&);
-    virtual WTF::String contextMenuItemTagOpenLink();
-    virtual WTF::String contextMenuItemTagIgnoreGrammar();
-    virtual WTF::String contextMenuItemTagSpellingMenu();
-    virtual WTF::String contextMenuItemTagShowSpellingPanel(bool show);
-    virtual WTF::String contextMenuItemTagCheckSpelling();
-    virtual WTF::String contextMenuItemTagCheckSpellingWhileTyping();
-    virtual WTF::String contextMenuItemTagCheckGrammarWithSpelling();
-    virtual WTF::String contextMenuItemTagFontMenu();
-    virtual WTF::String contextMenuItemTagBold();
-    virtual WTF::String contextMenuItemTagItalic();
-    virtual WTF::String contextMenuItemTagUnderline();
-    virtual WTF::String contextMenuItemTagOutline();
-    virtual WTF::String contextMenuItemTagWritingDirectionMenu();
-    virtual WTF::String contextMenuItemTagTextDirectionMenu();
-    virtual WTF::String contextMenuItemTagDefaultDirection();
-    virtual WTF::String contextMenuItemTagLeftToRight();
-    virtual WTF::String contextMenuItemTagRightToLeft();
-    virtual WTF::String contextMenuItemTagInspectElement();
-    virtual WTF::String contextMenuItemTagOpenVideoInNewWindow();
-    virtual WTF::String contextMenuItemTagOpenAudioInNewWindow();
-    virtual WTF::String contextMenuItemTagCopyVideoLinkToClipboard();
-    virtual WTF::String contextMenuItemTagCopyAudioLinkToClipboard();
-    virtual WTF::String contextMenuItemTagToggleMediaControls();
-    virtual WTF::String contextMenuItemTagToggleMediaLoop();
-    virtual WTF::String contextMenuItemTagEnterVideoFullscreen();
-    virtual WTF::String contextMenuItemTagMediaPlay();
-    virtual WTF::String contextMenuItemTagMediaPause();
-    virtual WTF::String contextMenuItemTagMediaMute();
-#endif // ENABLE(CONTEXT_MENUS)
-    virtual WTF::String searchMenuNoRecentSearchesText();
-    virtual WTF::String searchMenuRecentSearchesText();
-    virtual WTF::String searchMenuClearRecentSearchesText();
-    virtual WTF::String AXWebAreaText();
-    virtual WTF::String AXLinkText();
-    virtual WTF::String AXListMarkerText();
-    virtual WTF::String AXImageMapText();
-    virtual WTF::String AXHeadingText();
-    virtual WTF::String AXDefinitionListTermText();
-    virtual WTF::String AXDefinitionListDefinitionText();
-    virtual WTF::String AXButtonActionVerb();
-    virtual WTF::String AXRadioButtonActionVerb();
-    virtual WTF::String AXTextFieldActionVerb();
-    virtual WTF::String AXCheckedCheckBoxActionVerb();
-    virtual WTF::String AXUncheckedCheckBoxActionVerb();
-    virtual WTF::String AXMenuListActionVerb();
-    virtual WTF::String AXMenuListPopupActionVerb();
-    virtual WTF::String AXLinkActionVerb();
-    virtual WTF::String missingPluginText();
-    virtual WTF::String crashedPluginText();
-    virtual WTF::String multipleFileUploadText(unsigned numberOfFiles);
-    virtual WTF::String unknownFileSizeText();
-    virtual WTF::String uploadFileText();
-    virtual WTF::String allFilesText();
-    virtual WTF::String imageTitle(const WTF::String& filename, const WebCore::IntSize&);
-    virtual WTF::String mediaElementLoadingStateText();
-    virtual WTF::String mediaElementLiveBroadcastStateText();
-    virtual WTF::String localizedMediaControlElementString(const WTF::String&);
-    virtual WTF::String localizedMediaControlElementHelpText(const WTF::String&);
-    virtual WTF::String localizedMediaTimeDescription(float);
-    virtual WTF::String validationMessageValueMissingText();
-    virtual WTF::String validationMessageTypeMismatchText();
-    virtual WTF::String validationMessagePatternMismatchText();
-    virtual WTF::String validationMessageTooLongText();
-    virtual WTF::String validationMessageRangeUnderflowText();
-    virtual WTF::String validationMessageRangeOverflowText();
-    virtual WTF::String validationMessageStepMismatchText();
-
     // WebCore::VisitedLinkStrategy
     virtual bool isLinkVisited(WebCore::Page*, WebCore::LinkHash);
     virtual void addVisitedLink(WebCore::Page*, WebCore::LinkHash);
diff --git a/Source/WebKit/win/WebDataSource.cpp b/Source/WebKit/win/WebDataSource.cpp
index 0350373..1498f6e 100644
--- a/Source/WebKit/win/WebDataSource.cpp
+++ b/Source/WebKit/win/WebDataSource.cpp
@@ -246,7 +246,7 @@ HRESULT STDMETHODCALLTYPE WebDataSource::isLoading(
 HRESULT STDMETHODCALLTYPE WebDataSource::pageTitle( 
     /* [retval][out] */ BSTR* title)
 {
-    *title = BString(m_loader->title()).release();
+    *title = BString(m_loader->title().string()).release();
     return S_OK;
 }
 
diff --git a/Source/WebKit/win/WebDownload.h b/Source/WebKit/win/WebDownload.h
index 3e8e734..446be46 100644
--- a/Source/WebKit/win/WebDownload.h
+++ b/Source/WebKit/win/WebDownload.h
@@ -26,8 +26,8 @@
 #ifndef WebDownload_h
 #define WebDownload_h
 
-#include "COMPtr.h"
 #include "WebKit.h"
+#include <WebCore/COMPtr.h>
 #include <WebCore/PlatformString.h>
 #include <wtf/RetainPtr.h>
 
diff --git a/Source/WebKit/win/WebDropSource.h b/Source/WebKit/win/WebDropSource.h
index 5f06355..5b7ab8c 100644
--- a/Source/WebKit/win/WebDropSource.h
+++ b/Source/WebKit/win/WebDropSource.h
@@ -27,7 +27,7 @@
 #ifndef WebDropSource_h
 #define WebDropSource_h
 
-#include "COMPtr.h"
+#include <WebCore/COMPtr.h>
 #include <objidl.h>
 
 class WebView;
diff --git a/Source/WebKit/win/WebFrame.cpp b/Source/WebKit/win/WebFrame.cpp
index 4b9e35d..5a99b66 100644
--- a/Source/WebKit/win/WebFrame.cpp
+++ b/Source/WebKit/win/WebFrame.cpp
@@ -30,7 +30,6 @@
 
 #include "CFDictionaryPropertyBag.h"
 #include "COMPropertyBag.h"
-#include "COMPtr.h"
 #include "DOMCoreClasses.h"
 #include "DefaultPolicyDelegate.h"
 #include "HTMLFrameOwnerElement.h"
@@ -54,6 +53,7 @@
 #include "WebURLResponse.h"
 #include "WebView.h"
 #include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/MemoryCache.h>
 #include <WebCore/Document.h>
 #include <WebCore/DocumentLoader.h>
@@ -104,14 +104,14 @@
 #include <JavaScriptCore/JSValue.h>
 #include <wtf/MathExtras.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CoreGraphics.h>
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 #include "PlatformContextCairo.h"
 #include <cairo-win32.h>
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG)
 // CG SPI used for printing
 extern "C" {
     CGAffineTransform CGContextGetBaseCTM(CGContextRef c); 
@@ -2113,7 +2113,7 @@ HRESULT STDMETHODCALLTYPE WebFrame::getPrintedPageCount(
     return S_OK;
 }
 
-#if PLATFORM(CG)
+#if USE(CG)
 void WebFrame::drawHeader(PlatformGraphicsContext* pctx, IWebUIDelegate* ui, const IntRect& pageRect, float headerHeight)
 {
     int x = pageRect.x();
@@ -2167,7 +2167,7 @@ void WebFrame::spoolPage(PlatformGraphicsContext* pctx, GraphicsContext* spoolCt
     CGContextEndPage(pctx);
     CGContextRestoreGState(pctx);
 }
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 static float scaleFactor(HDC printDC, const IntRect& marginRect, const IntRect& pageRect)
 {
     const IntRect& printRect = printerRect(printDC);
@@ -2320,12 +2320,12 @@ HRESULT STDMETHODCALLTYPE WebFrame::spoolPages(
     /* [in] */ UINT endPage,
     /* [retval][out] */ void* ctx)
 {
-#if PLATFORM(CG)
+#if USE(CG)
     if (!printDC || !ctx) {
         ASSERT_NOT_REACHED();
         return E_POINTER;
     }
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
     if (!printDC) {
         ASSERT_NOT_REACHED();
         return E_POINTER;
@@ -2369,7 +2369,7 @@ HRESULT STDMETHODCALLTYPE WebFrame::spoolPages(
         return E_FAIL;
 
     UINT pageCount = (UINT) m_pageRects.size();
-#if PLATFORM(CG)
+#if USE(CG)
     PlatformGraphicsContext* pctx = (PlatformGraphicsContext*)ctx;
 #endif
 
@@ -2396,7 +2396,7 @@ HRESULT STDMETHODCALLTYPE WebFrame::spoolPages(
     for (UINT ii = startPage; ii < endPage; ii++)
         spoolPage(pctx, &spoolCtx, printDC, ui.get(), headerHeight, footerHeight, ii, pageCount);
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
     cairo_surface_finish(printSurface);
     ASSERT(!cairo_surface_status(printSurface));
     cairo_surface_destroy(printSurface);
diff --git a/Source/WebKit/win/WebFrame.h b/Source/WebKit/win/WebFrame.h
index 9158fb3..95f2875 100644
--- a/Source/WebKit/win/WebFrame.h
+++ b/Source/WebKit/win/WebFrame.h
@@ -59,9 +59,9 @@ namespace WebCore {
 typedef const struct OpaqueJSContext* JSContextRef;
 typedef struct OpaqueJSValue* JSObjectRef;
 
-#if PLATFORM(CG)
+#if USE(CG)
 typedef struct CGContext PlatformGraphicsContext;
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 namespace WebCore {
 class PlatformContextCairo;
 }
diff --git a/Source/WebKit/win/WebHistoryItem.cpp b/Source/WebKit/win/WebHistoryItem.cpp
index 031f8ab..f8ba2f1 100644
--- a/Source/WebKit/win/WebHistoryItem.cpp
+++ b/Source/WebKit/win/WebHistoryItem.cpp
@@ -28,10 +28,10 @@
 #include "WebHistoryItem.h"
 
 #include "COMEnumVariant.h"
-#include "COMPtr.h"
 #include "MarshallingHelpers.h"
 #include "WebKit.h"
 #include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/HistoryItem.h>
 #include <WebCore/KURL.h>
 #include <wtf/PassOwnPtr.h>
diff --git a/Source/WebKit/win/WebIconDatabase.cpp b/Source/WebKit/win/WebIconDatabase.cpp
index 24e8f41..664cac4 100644
--- a/Source/WebKit/win/WebIconDatabase.cpp
+++ b/Source/WebKit/win/WebIconDatabase.cpp
@@ -28,11 +28,11 @@
 #include "WebIconDatabase.h"
 
 #include "CFDictionaryPropertyBag.h"
-#include "COMPtr.h"
 #include "WebPreferences.h"
 #include "WebNotificationCenter.h"
 #include <WebCore/BitmapInfo.h>
 #include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/FileSystem.h>
 #include <WebCore/IconDatabase.h>
 #include <WebCore/Image.h>
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesProduction.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesProduction.vsprops
index 5e71307..03cb439 100644
--- a/Source/WebKit/win/WebKit.vcproj/InterfacesProduction.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\InterfacesCommon.vsprops"
 	>
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesRelease.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesRelease.vsprops
index 77c4b1f..9329ecb 100644
--- a/Source/WebKit/win/WebKit.vcproj/InterfacesRelease.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\InterfacesCommon.vsprops"
 	>
diff --git a/Source/WebKit/win/WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops
index 5e17aee..64f5ee7 100644
--- a/Source/WebKit/win/WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/InterfacesReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\InterfacesCommon.vsprops"
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKit.vcproj b/Source/WebKit/win/WebKit.vcproj/WebKit.vcproj
index a8b9cc3..4d25f44 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKit.vcproj
+++ b/Source/WebKit/win/WebKit.vcproj/WebKit.vcproj
@@ -699,10 +699,6 @@
 				RelativePath="..\WebWorkersPrivate.h"
 				>
 			</File>
-			<File
-				RelativePath="..\WindowsTouch.h"
-				>
-			</File>
 		</Filter>
 		<Filter
 			Name="Classes"
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDProduction.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDProduction.vsprops
index 941bf46..61ade23 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDProduction.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WebKitGUIDCommon.vsprops"
 	>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDRelease.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDRelease.vsprops
index 39566ea..c7628df 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDRelease.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WebKitGUIDCommon.vsprops"
 	>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops
index bc0b7a1..d4a09a3 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitGUIDReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\WebKitGUIDCommon.vsprops"
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibPostBuild.cmd b/Source/WebKit/win/WebKit.vcproj/WebKitLibPostBuild.cmd
index 7968952..02ecee5 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitLibPostBuild.cmd
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibPostBuild.cmd
@@ -13,7 +13,5 @@ xcopy /y /d "%CONFIGURATIONBUILDDIR%\include\WebCore\nptypes.h" "%CONFIGURATIONB
 
 mkdir 2>NUL "%OUTDIR%\..\bin\WebKit.resources"
 xcopy /y /d "%PROJECTDIR%..\WebKit.resources\*" "%OUTDIR%\..\bin\WebKit.resources"
-mkdir 2>NUL "%OUTDIR%\..\bin\WebKit.resources\en.lproj"
-xcopy /y /d "%PROJECTDIR%..\..\English.lproj\Localizable.strings" "%OUTDIR%\..\bin\WebKit.resources\en.lproj\"
 
 if exist "%CONFIGURATIONBUILDDIR%\buildfailed" del "%CONFIGURATIONBUILDDIR%\buildfailed"
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibPreBuild.cmd b/Source/WebKit/win/WebKit.vcproj/WebKitLibPreBuild.cmd
index b6f0bd4..82f02e9 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitLibPreBuild.cmd
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibPreBuild.cmd
@@ -5,11 +5,6 @@ if exist "%CONFIGURATIONBUILDDIR%\buildfailed" grep XX%PROJECTNAME%XX "%CONFIGUR
 if errorlevel 1 exit 1
 echo XX%PROJECTNAME%XX > "%CONFIGURATIONBUILDDIR%\buildfailed"
 
-touch "%CONFIGURATIONBUILDDIR%\tmp.cpp"
-cl /analyze /nologo /c "%CONFIGURATIONBUILDDIR%\tmp.cpp" /Fo"%INTDIR%\tmp.obj" 2>&1 | findstr D9040
-if ERRORLEVEL 1 (set EnablePREfast="true") else (set EnablePREfast="false")
-if ERRORLEVEL 1 (set AnalyzeWithLargeStack="/analyze:65536") else (set AnalyzeWithLargeStack="")
-
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\JavaScriptCore"
 xcopy /y /d "%WEBKITLIBRARIESDIR%\include\JavaScriptCore\*" "%CONFIGURATIONBUILDDIR%\include\JavaScriptCore"
 
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibProduction.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibProduction.vsprops
index 127707e..cca57e1 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitLibProduction.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WebKitLibCommon.vsprops"
 	>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibRelease.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibRelease.vsprops
index 82f6dfd..18637a4 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitLibRelease.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WebKitLibCommon.vsprops"
 	>
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops b/Source/WebKit/win/WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops
index 692fdc0..4053bbe 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops
+++ b/Source/WebKit/win/WebKit.vcproj/WebKitLibReleaseCairoCFLite.vsprops
@@ -7,6 +7,7 @@
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;
diff --git a/Source/WebKit/win/WebNavigationData.h b/Source/WebKit/win/WebNavigationData.h
index f4793dc..54e5782 100644
--- a/Source/WebKit/win/WebNavigationData.h
+++ b/Source/WebKit/win/WebNavigationData.h
@@ -28,8 +28,8 @@
 
 #include "WebKit.h"
 
-#include "COMPtr.h"
 #include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
 
 class WebNavigationData : public IWebNavigationData {
 public:
diff --git a/Source/WebKit/win/WebPreferenceKeysPrivate.h b/Source/WebKit/win/WebPreferenceKeysPrivate.h
index be0ebe5..9dd14ed 100644
--- a/Source/WebKit/win/WebPreferenceKeysPrivate.h
+++ b/Source/WebKit/win/WebPreferenceKeysPrivate.h
@@ -58,6 +58,7 @@
 #define WebKitAllowAnimatedImagesPreferenceKey "WebKitAllowAnimatedImagesPreferenceKey"
 #define WebKitAllowAnimatedImageLoopingPreferenceKey "WebKitAllowAnimatedImageLoopingPreferenceKey"
 #define WebKitDisplayImagesKey "WebKitDisplayImagesKey"
+#define WebKitLoadSiteIconsKey "WebKitLoadSiteIconsKey"
 #define WebKitBackForwardCacheExpirationIntervalKey "WebKitBackForwardCacheExpirationIntervalKey"
 #define WebKitTabToLinksPreferenceKey "WebKitTabToLinksPreferenceKey"
 #define WebKitPrivateBrowsingEnabledPreferenceKey "WebKitPrivateBrowsingEnabled"
diff --git a/Source/WebKit/win/WebPreferences.cpp b/Source/WebKit/win/WebPreferences.cpp
index a4869b6..0686c2b 100644
--- a/Source/WebKit/win/WebPreferences.cpp
+++ b/Source/WebKit/win/WebPreferences.cpp
@@ -28,16 +28,15 @@
 #include "WebKitDLL.h"
 #include "WebPreferences.h"
 
-#include "COMPtr.h"
-#include "WebLocalizableStrings.h"
 #include "WebNotificationCenter.h"
 #include "WebPreferenceKeysPrivate.h"
 
 #include <CoreFoundation/CoreFoundation.h>
 #include <WebCore/CACFLayerTreeHost.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/FileSystem.h>
 #include <WebCore/Font.h>
-#include <WebCore/PlatformString.h>
+#include <WebCore/LocalizedStrings.h>
 #include <limits>
 #include <shlobj.h>
 #include <wchar.h>
@@ -45,8 +44,9 @@
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CoreGraphics.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #endif
@@ -193,7 +193,8 @@ void WebPreferences::initializeDefaultSettings()
     CFDictionaryAddValue(defaults, CFSTR(WebKitMinimumLogicalFontSizePreferenceKey), CFSTR("9"));
     CFDictionaryAddValue(defaults, CFSTR(WebKitDefaultFontSizePreferenceKey), CFSTR("16"));
     CFDictionaryAddValue(defaults, CFSTR(WebKitDefaultFixedFontSizePreferenceKey), CFSTR("13"));
-    WTF::String defaultDefaultEncoding(LPCTSTR_UI_STRING("ISO-8859-1", "The default, default character encoding"));
+
+    String defaultDefaultEncoding(WEB_UI_STRING("ISO-8859-1", "The default, default character encoding"));
     CFDictionaryAddValue(defaults, CFSTR(WebKitDefaultTextEncodingNamePreferenceKey), defaultDefaultEncoding.createCFString());
 
     CFDictionaryAddValue(defaults, CFSTR(WebKitUserStyleSheetEnabledPreferenceKey), kCFBooleanFalse);
@@ -217,6 +218,7 @@ void WebPreferences::initializeDefaultSettings()
     CFDictionaryAddValue(defaults, CFSTR(WebKitAllowAnimatedImagesPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitAllowAnimatedImageLoopingPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitDisplayImagesKey), kCFBooleanTrue);
+    CFDictionaryAddValue(defaults, CFSTR(WebKitLoadSiteIconsKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitBackForwardCacheExpirationIntervalKey), CFSTR("1800"));
     CFDictionaryAddValue(defaults, CFSTR(WebKitTabToLinksPreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitPrivateBrowsingEnabledPreferenceKey), kCFBooleanFalse);
@@ -926,6 +928,20 @@ HRESULT STDMETHODCALLTYPE WebPreferences::loadsImagesAutomatically(
     return S_OK;
 }
 
+HRESULT STDMETHODCALLTYPE WebPreferences::setLoadsSiteIconsIgnoringImageLoadingPreference(
+    /* [in] */ BOOL enabled)
+{
+    setBoolValue(CFSTR(WebKitLoadSiteIconsKey), enabled);
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebPreferences::loadsSiteIconsIgnoringImageLoadingPreference(
+    /* [retval][out] */ BOOL* enabled)
+{
+    *enabled = boolValueForKey(CFSTR(WebKitLoadSiteIconsKey));
+    return S_OK;
+}
+
 HRESULT STDMETHODCALLTYPE WebPreferences::setAutosaves( 
     /* [in] */ BOOL enabled)
 {
@@ -1085,7 +1101,7 @@ HRESULT STDMETHODCALLTYPE WebPreferences::setFontSmoothing(
     setIntegerValue(CFSTR(WebKitFontSmoothingTypePreferenceKey), smoothingType);
     if (smoothingType == FontSmoothingTypeWindows)
         smoothingType = FontSmoothingTypeMedium;
-#if PLATFORM(CG)
+#if USE(CG)
     wkSetFontSmoothingLevel((int)smoothingType);
 #endif
     return S_OK;
@@ -1102,7 +1118,7 @@ HRESULT STDMETHODCALLTYPE WebPreferences::setFontSmoothingContrast(
     /* [in] */ float contrast)
 {
     setFloatValue(CFSTR(WebKitFontSmoothingContrastPreferenceKey), contrast);
-#if PLATFORM(CG)
+#if USE(CG)
     wkSetFontSmoothingContrast(contrast);
 #endif
     return S_OK;
diff --git a/Source/WebKit/win/WebPreferences.h b/Source/WebKit/win/WebPreferences.h
index d09945a..8996035 100644
--- a/Source/WebKit/win/WebPreferences.h
+++ b/Source/WebKit/win/WebPreferences.h
@@ -429,6 +429,9 @@ public:
     virtual HRESULT STDMETHODCALLTYPE hyperlinkAuditingEnabled(BOOL*);
     virtual HRESULT STDMETHODCALLTYPE setHyperlinkAuditingEnabled(BOOL);
 
+    virtual HRESULT STDMETHODCALLTYPE loadsSiteIconsIgnoringImageLoadingPreference(BOOL*);
+    virtual HRESULT STDMETHODCALLTYPE setLoadsSiteIconsIgnoringImageLoadingPreference(BOOL);
+
     // WebPreferences
 
     // This method accesses a different preference key than developerExtrasEnabled.
diff --git a/Source/WebKit/win/WebResource.h b/Source/WebKit/win/WebResource.h
index 611803e..d5a01ac 100644
--- a/Source/WebKit/win/WebResource.h
+++ b/Source/WebKit/win/WebResource.h
@@ -27,7 +27,7 @@
 #define WebResource_h
 
 #include "WebKit.h"
-#include "COMPtr.h"
+#include <WebCore/COMPtr.h>
 #include <WebCore/KURL.h>
 #include <WebCore/PlatformString.h>
 #include <WebCore/ResourceResponse.h>
diff --git a/Source/WebKit/win/WebScrollBar.h b/Source/WebKit/win/WebScrollBar.h
index 0482419..a741ffd 100644
--- a/Source/WebKit/win/WebScrollBar.h
+++ b/Source/WebKit/win/WebScrollBar.h
@@ -115,11 +115,13 @@ protected:
     virtual int scrollPosition(WebCore::Scrollbar*) const;
     virtual void setScrollOffset(const WebCore::IntPoint&);
     virtual void invalidateScrollbarRect(WebCore::Scrollbar*, const WebCore::IntRect&);
+    virtual void invalidateScrollCornerRect(const WebCore::IntRect&) { }
 
     // FIXME: We should provide a way to set this value.
     virtual bool isActive() const { return true; }
 
-    virtual bool scrollbarCornerPresent() const { return false; }
+    virtual bool isScrollCornerVisible() const { return false; }
+    virtual WebCore::IntRect scrollCornerRect() const { return WebCore::IntRect(); }
 
     virtual WebCore::Scrollbar* horizontalScrollbar() const; 
     virtual WebCore::Scrollbar* verticalScrollbar() const; 
diff --git a/Source/WebKit/win/WebURLAuthenticationChallenge.cpp b/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
index 1663376..e12d0fd 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallenge.cpp
@@ -27,7 +27,6 @@
 #include "WebKitDLL.h"
 #include "WebURLAuthenticationChallenge.h"
 
-#include "COMPtr.h"
 #include "WebError.h"
 #include "WebKit.h"
 #include "WebURLAuthenticationChallengeSender.h"
@@ -36,6 +35,7 @@
 #include "WebURLResponse.h"
 #include "WebKit.h"
 #include <WebCore/BString.h>
+#include <WebCore/COMPtr.h>
 #include <WebCore/ResourceHandle.h>
 
 using namespace WebCore;
diff --git a/Source/WebKit/win/WebURLAuthenticationChallengeSender.cpp b/Source/WebKit/win/WebURLAuthenticationChallengeSender.cpp
index 0a9154f..69c7ca3 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallengeSender.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallengeSender.cpp
@@ -28,11 +28,11 @@
 #include <initguid.h>
 #include "WebURLAuthenticationChallengeSender.h"
 
-#include "COMPtr.h"
 #include "WebKit.h"
 #include "WebURLAuthenticationChallenge.h"
 #include "WebURLCredential.h"
 #include <WebCore/AuthenticationClient.h>
+#include <WebCore/COMPtr.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp b/Source/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
index 3d329d1..8ae2c53 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallengeSenderCFNet.cpp
@@ -28,11 +28,11 @@
 #include <initguid.h>
 #include "WebURLAuthenticationChallengeSender.h"
 
-#include "COMPtr.h"
 #include "WebKit.h"
 #include "WebURLAuthenticationChallenge.h"
 #include "WebURLCredential.h"
 #include <WebCore/AuthenticationClient.h>
+#include <WebCore/COMPtr.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/win/WebURLAuthenticationChallengeSenderCurl.cpp b/Source/WebKit/win/WebURLAuthenticationChallengeSenderCurl.cpp
index 2f49f67..df07f34 100644
--- a/Source/WebKit/win/WebURLAuthenticationChallengeSenderCurl.cpp
+++ b/Source/WebKit/win/WebURLAuthenticationChallengeSenderCurl.cpp
@@ -28,11 +28,11 @@
 #include <initguid.h>
 #include "WebURLAuthenticationChallengeSender.h"
 
-#include "COMPtr.h"
 #include "NotImplemented.h"
 #include "WebKit.h"
 #include "WebURLAuthenticationChallenge.h"
 #include "WebURLCredential.h"
+#include <WebCore/COMPtr.h>
 #include <WebCore/ResourceHandle.h>
 
 using namespace WebCore;
diff --git a/Source/WebKit/win/WebURLResponse.cpp b/Source/WebKit/win/WebURLResponse.cpp
index b6c94dd..f8afa9a 100644
--- a/Source/WebKit/win/WebURLResponse.cpp
+++ b/Source/WebKit/win/WebURLResponse.cpp
@@ -31,7 +31,6 @@
 
 #include "COMPropertyBag.h"
 #include "MarshallingHelpers.h"
-#include "WebLocalizableStrings.h"
 
 #if USE(CFNETWORK)
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
@@ -40,6 +39,7 @@
 #include <wtf/platform.h>
 #include <WebCore/BString.h>
 #include <WebCore/KURL.h>
+#include <WebCore/LocalizedStrings.h>
 #include <WebCore/ResourceHandle.h>
 #include <shlobj.h>
 #include <shlwapi.h>
@@ -47,160 +47,160 @@
 
 using namespace WebCore;
 
-static LPCTSTR CFHTTPMessageCopyLocalizedShortDescriptionForStatusCode(CFIndex statusCode)
+static String CFHTTPMessageCopyLocalizedShortDescriptionForStatusCode(CFIndex statusCode)
 {
-    LPCTSTR result = 0;
+    String result;
     if (statusCode < 100 || statusCode >= 600)
-        result = LPCTSTR_UI_STRING("server error", "HTTP result code string");
+        result = WEB_UI_STRING("server error", "HTTP result code string");
     else if (statusCode >= 100 && statusCode <= 199) {
         switch (statusCode) {
             case 100:
-                result = LPCTSTR_UI_STRING("continue", "HTTP result code string");
+                result = WEB_UI_STRING("continue", "HTTP result code string");
                 break;
             case 101:
-                result = LPCTSTR_UI_STRING("switching protocols", "HTTP result code string");
+                result = WEB_UI_STRING("switching protocols", "HTTP result code string");
                 break;
             default:
-                result = LPCTSTR_UI_STRING("informational", "HTTP result code string");
+                result = WEB_UI_STRING("informational", "HTTP result code string");
                 break;
         }
     } else if (statusCode >= 200 && statusCode <= 299) {
         switch (statusCode) {
             case 200:
-                result = LPCTSTR_UI_STRING("no error", "HTTP result code string");
+                result = WEB_UI_STRING("no error", "HTTP result code string");
                 break;
             case 201:
-                result = LPCTSTR_UI_STRING("created", "HTTP result code string");
+                result = WEB_UI_STRING("created", "HTTP result code string");
                 break;
             case 202:
-                result = LPCTSTR_UI_STRING("accepted", "HTTP result code string");
+                result = WEB_UI_STRING("accepted", "HTTP result code string");
                 break;
             case 203:
-                result = LPCTSTR_UI_STRING("non-authoritative information", "HTTP result code string");
+                result = WEB_UI_STRING("non-authoritative information", "HTTP result code string");
                 break;
             case 204:
-                result = LPCTSTR_UI_STRING("no content", "HTTP result code string");
+                result = WEB_UI_STRING("no content", "HTTP result code string");
                 break;
             case 205:
-                result = LPCTSTR_UI_STRING("reset content", "HTTP result code string");
+                result = WEB_UI_STRING("reset content", "HTTP result code string");
                 break;
             case 206:
-                result = LPCTSTR_UI_STRING("partial content", "HTTP result code string");
+                result = WEB_UI_STRING("partial content", "HTTP result code string");
                 break;
             default:
-                result = LPCTSTR_UI_STRING("success", "HTTP result code string");
+                result = WEB_UI_STRING("success", "HTTP result code string");
                 break;
         } 
     } else if (statusCode >= 300 && statusCode <= 399) {
         switch (statusCode) {
             case 300:
-                result = LPCTSTR_UI_STRING("multiple choices", "HTTP result code string");
+                result = WEB_UI_STRING("multiple choices", "HTTP result code string");
                 break;
             case 301:
-                result = LPCTSTR_UI_STRING("moved permanently", "HTTP result code string");
+                result = WEB_UI_STRING("moved permanently", "HTTP result code string");
                 break;
             case 302:
-                result = LPCTSTR_UI_STRING("found", "HTTP result code string");
+                result = WEB_UI_STRING("found", "HTTP result code string");
                 break;
             case 303:
-                result = LPCTSTR_UI_STRING("see other", "HTTP result code string");
+                result = WEB_UI_STRING("see other", "HTTP result code string");
                 break;
             case 304:
-                result = LPCTSTR_UI_STRING("not modified", "HTTP result code string");
+                result = WEB_UI_STRING("not modified", "HTTP result code string");
                 break;
             case 305:
-                result = LPCTSTR_UI_STRING("needs proxy", "HTTP result code string");
+                result = WEB_UI_STRING("needs proxy", "HTTP result code string");
                 break;
             case 307:
-                result = LPCTSTR_UI_STRING("temporarily redirected", "HTTP result code string");
+                result = WEB_UI_STRING("temporarily redirected", "HTTP result code string");
                 break;
             case 306:   // 306 status code unused in HTTP
             default:
-                result = LPCTSTR_UI_STRING("redirected", "HTTP result code string");
+                result = WEB_UI_STRING("redirected", "HTTP result code string");
                 break;
         }
     } else if (statusCode >= 400 && statusCode <= 499) {
         switch (statusCode) {
             case 400:
-                result = LPCTSTR_UI_STRING("bad request", "HTTP result code string");
+                result = WEB_UI_STRING("bad request", "HTTP result code string");
                 break;
             case 401:
-                result = LPCTSTR_UI_STRING("unauthorized", "HTTP result code string");
+                result = WEB_UI_STRING("unauthorized", "HTTP result code string");
                 break;
             case 402:
-                result = LPCTSTR_UI_STRING("payment required", "HTTP result code string");
+                result = WEB_UI_STRING("payment required", "HTTP result code string");
                 break;
             case 403:
-                result = LPCTSTR_UI_STRING("forbidden", "HTTP result code string");
+                result = WEB_UI_STRING("forbidden", "HTTP result code string");
                 break;
             case 404:
-                result = LPCTSTR_UI_STRING("not found", "HTTP result code string");
+                result = WEB_UI_STRING("not found", "HTTP result code string");
                 break;
             case 405:
-                result = LPCTSTR_UI_STRING("method not allowed", "HTTP result code string");
+                result = WEB_UI_STRING("method not allowed", "HTTP result code string");
                 break;
             case 406:
-                result = LPCTSTR_UI_STRING("unacceptable", "HTTP result code string");
+                result = WEB_UI_STRING("unacceptable", "HTTP result code string");
                 break;
             case 407:
-                result = LPCTSTR_UI_STRING("proxy authentication required", "HTTP result code string");
+                result = WEB_UI_STRING("proxy authentication required", "HTTP result code string");
                 break;
             case 408:
-                result = LPCTSTR_UI_STRING("request timed out", "HTTP result code string");
+                result = WEB_UI_STRING("request timed out", "HTTP result code string");
                 break;
             case 409:
-                result = LPCTSTR_UI_STRING("conflict", "HTTP result code string");
+                result = WEB_UI_STRING("conflict", "HTTP result code string");
                 break;
             case 410:
-                result = LPCTSTR_UI_STRING("no longer exists", "HTTP result code string");
+                result = WEB_UI_STRING("no longer exists", "HTTP result code string");
                 break;
             case 411:
-                result = LPCTSTR_UI_STRING("length required", "HTTP result code string");
+                result = WEB_UI_STRING("length required", "HTTP result code string");
                 break;
             case 412:
-                result = LPCTSTR_UI_STRING("precondition failed", "HTTP result code string");
+                result = WEB_UI_STRING("precondition failed", "HTTP result code string");
                 break;
             case 413:
-                result = LPCTSTR_UI_STRING("request too large", "HTTP result code string");
+                result = WEB_UI_STRING("request too large", "HTTP result code string");
                 break;
             case 414:
-                result = LPCTSTR_UI_STRING("requested URL too long", "HTTP result code string");
+                result = WEB_UI_STRING("requested URL too long", "HTTP result code string");
                 break;
             case 415:
-                result = LPCTSTR_UI_STRING("unsupported media type", "HTTP result code string");
+                result = WEB_UI_STRING("unsupported media type", "HTTP result code string");
                 break;
             case 416:
-                result = LPCTSTR_UI_STRING("requested range not satisfiable", "HTTP result code string");
+                result = WEB_UI_STRING("requested range not satisfiable", "HTTP result code string");
                 break;
             case 417:
-                result = LPCTSTR_UI_STRING("expectation failed", "HTTP result code string");
+                result = WEB_UI_STRING("expectation failed", "HTTP result code string");
                 break;
             default:
-                result = LPCTSTR_UI_STRING("client error", "HTTP result code string");
+                result = WEB_UI_STRING("client error", "HTTP result code string");
                 break;
         }
     } else if (statusCode >= 500 && statusCode <= 599) {
         switch (statusCode) {
             case 500:
-                result = LPCTSTR_UI_STRING("internal server error", "HTTP result code string");
+                result = WEB_UI_STRING("internal server error", "HTTP result code string");
                 break;
             case 501:
-                result = LPCTSTR_UI_STRING("unimplemented", "HTTP result code string");
+                result = WEB_UI_STRING("unimplemented", "HTTP result code string");
                 break;
             case 502:
-                result = LPCTSTR_UI_STRING("bad gateway", "HTTP result code string");
+                result = WEB_UI_STRING("bad gateway", "HTTP result code string");
                 break;
             case 503:
-                result = LPCTSTR_UI_STRING("service unavailable", "HTTP result code string");
+                result = WEB_UI_STRING("service unavailable", "HTTP result code string");
                 break;
             case 504:
-                result = LPCTSTR_UI_STRING("gateway timed out", "HTTP result code string");
+                result = WEB_UI_STRING("gateway timed out", "HTTP result code string");
                 break;
             case 505:
-                result = LPCTSTR_UI_STRING("unsupported version", "HTTP result code string");
+                result = WEB_UI_STRING("unsupported version", "HTTP result code string");
                 break;
             default:
-                result = LPCTSTR_UI_STRING("server error", "HTTP result code string");
+                result = WEB_UI_STRING("server error", "HTTP result code string");
                 break;
         }
     }
@@ -372,11 +372,11 @@ HRESULT STDMETHODCALLTYPE WebURLResponse::localizedStringForStatusCode(
     ASSERT(m_response.isHTTP());
     if (statusString)
         *statusString = 0;
-    LPCTSTR statusText = CFHTTPMessageCopyLocalizedShortDescriptionForStatusCode(statusCode);
+    String statusText = CFHTTPMessageCopyLocalizedShortDescriptionForStatusCode(statusCode);
     if (!statusText)
         return E_FAIL;
     if (statusString)
-        *statusString = SysAllocString(statusText);
+        *statusString = BString(statusText).release();
     return S_OK;
 }
 
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index 69f83de..c9f086b 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -58,7 +58,6 @@
 #include "WebPluginHalterClient.h"
 #include "WebPreferences.h"
 #include "WebScriptWorld.h"
-#include "WindowsTouch.h"
 #include "resource.h"
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/InitializeThreading.h>
@@ -131,6 +130,7 @@
 #include <WebCore/SystemInfo.h>
 #include <WebCore/TypingCommand.h>
 #include <WebCore/WindowMessageBroadcaster.h>
+#include <WebCore/WindowsTouch.h>
 #include <wtf/Threading.h>
 
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
@@ -138,7 +138,7 @@
 #include <WebCore/GeolocationError.h>
 #endif
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CGContext.h>
 #endif
 
@@ -1079,9 +1079,9 @@ void WebView::paint(HDC dc, LPARAM options)
 
 void WebView::paintIntoBackingStore(FrameView* frameView, HDC bitmapDC, const IntRect& dirtyRect, WindowsToPaint windowsToPaint)
 {
-#if USE(ACCELERATED_COMPOSITING)
-    ASSERT(!isAcceleratedCompositing());
-#endif
+    // FIXME: This function should never be called in accelerated compositing mode, and we should
+    // assert as such. But currently it *is* sometimes called, so we can't assert yet. See
+    // <http://webkit.org/b/58539>.
 
     LOCAL_GDI_COUNTER(0, __FUNCTION__);
 
@@ -1122,9 +1122,9 @@ void WebView::paintIntoBackingStore(FrameView* frameView, HDC bitmapDC, const In
 
 void WebView::paintIntoWindow(HDC bitmapDC, HDC windowDC, const IntRect& dirtyRect)
 {
-#if USE(ACCELERATED_COMPOSITING)
-    ASSERT(!isAcceleratedCompositing());
-#endif
+    // FIXME: This function should never be called in accelerated compositing mode, and we should
+    // assert as such. But currently it *is* sometimes called, so we can't assert yet. See
+    // <http://webkit.org/b/58539>.
 
     LOCAL_GDI_COUNTER(0, __FUNCTION__);
 #if FLASH_WINDOW_REDRAW
@@ -1935,8 +1935,6 @@ bool WebView::handleEditingKeyboardEvent(KeyboardEvent* evt)
 bool WebView::keyDown(WPARAM virtualKeyCode, LPARAM keyData, bool systemKeyDown)
 {
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
-    if (virtualKeyCode == VK_CAPITAL)
-        frame->eventHandler()->capsLockStateMayHaveChanged();
 
     PlatformKeyboardEvent keyEvent(m_viewWindow, virtualKeyCode, keyData, PlatformKeyboardEvent::RawKeyDown, systemKeyDown);
     bool handled = frame->eventHandler()->keyEvent(keyEvent);
@@ -1955,10 +1953,12 @@ bool WebView::keyDown(WPARAM virtualKeyCode, LPARAM keyData, bool systemKeyDown)
         return true;
     }
 
-    // We need to handle back/forward using either Backspace(+Shift) or Ctrl+Left/Right Arrow keys.
-    if ((virtualKeyCode == VK_BACK && keyEvent.shiftKey()) || (virtualKeyCode == VK_RIGHT && keyEvent.ctrlKey()))
+    // We need to handle back/forward using either Ctrl+Left/Right Arrow keys.
+    // FIXME: This logic should probably be in EventHandler::defaultArrowEventHandler().
+    // FIXME: Should check that other modifiers aren't pressed.
+    if (virtualKeyCode == VK_RIGHT && keyEvent.ctrlKey())
         return m_page->goForward();
-    if (virtualKeyCode == VK_BACK || (virtualKeyCode == VK_LEFT && keyEvent.ctrlKey()))
+    if (virtualKeyCode == VK_LEFT && keyEvent.ctrlKey())
         return m_page->goBack();
 
     // Need to scroll the page if the arrow keys, pgup/dn, or home/end are hit.
@@ -2015,6 +2015,15 @@ bool WebView::keyPress(WPARAM charCode, LPARAM keyData, bool systemKeyDown)
     return frame->eventHandler()->keyEvent(keyEvent);
 }
 
+void WebView::setIsBeingDestroyed()
+{
+    m_isBeingDestroyed = true;
+
+    // Remove our this pointer from the window so we won't try to handle any more window messages.
+    // See <http://webkit.org/b/55054>.
+    ::SetWindowLongPtrW(m_viewWindow, 0, 0);
+}
+
 bool WebView::registerWebViewWindowClass()
 {
     static bool haveRegisteredWindowClass = false;
@@ -2061,9 +2070,13 @@ LRESULT CALLBACK WebView::WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam,
     LONG_PTR longPtr = GetWindowLongPtr(hWnd, 0);
     WebView* webView = reinterpret_cast<WebView*>(longPtr);
     WebFrame* mainFrameImpl = webView ? webView->topLevelFrame() : 0;
-    if (!mainFrameImpl || webView->isBeingDestroyed())
+    if (!mainFrameImpl)
         return DefWindowProc(hWnd, message, wParam, lParam);
 
+    // We shouldn't be trying to handle any window messages after WM_DESTROY.
+    // See <http://webkit.org/b/55054>.
+    ASSERT(!webView->isBeingDestroyed());
+
     // hold a ref, since the WebView could go away in an event handler.
     COMPtr<WebView> protector(webView);
     ASSERT(webView);
@@ -3182,7 +3195,7 @@ HRESULT STDMETHODCALLTYPE WebView::preferencesIdentifier(
 
 static void systemParameterChanged(WPARAM parameter)
 {
-#if PLATFORM(CG)
+#if USE(CG)
     if (parameter == SPI_SETFONTSMOOTHING || parameter == SPI_SETFONTSMOOTHINGTYPE || parameter == SPI_SETFONTSMOOTHINGCONTRAST || parameter == SPI_SETFONTSMOOTHINGORIENTATION)
         wkSystemFontSmoothingChanged();
 #endif
@@ -4778,6 +4791,11 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
         return hr;
     settings->setHyperlinkAuditingEnabled(enabled);
 
+    hr = prefsPrivate->loadsSiteIconsIgnoringImageLoadingPreference(&enabled);
+    if (FAILED(hr))
+        return hr;
+    settings->setLoadsSiteIconsIgnoringImageLoadingSetting(!!enabled);
+
     if (!m_closeWindowTimer)
         m_mainFrame->invalidate(); // FIXME
 
diff --git a/Source/WebKit/win/WebView.h b/Source/WebKit/win/WebView.h
index 957f0a5..db3c2e7 100644
--- a/Source/WebKit/win/WebView.h
+++ b/Source/WebKit/win/WebView.h
@@ -26,10 +26,10 @@
 #ifndef WebView_H
 #define WebView_H
 
-#include "COMPtr.h"
 #include "WebKit.h"
 #include "WebFrame.h"
 #include "WebPreferences.h"
+#include <WebCore/COMPtr.h>
 #include <WebCore/DragActions.h>
 #include <WebCore/IntRect.h>
 #include <WebCore/RefCountedGDIHandle.h>
@@ -883,7 +883,7 @@ public:
 
     static WTF::String standardUserAgentWithApplicationName(const WTF::String&);
 
-    void setIsBeingDestroyed() { m_isBeingDestroyed = true; }
+    void setIsBeingDestroyed();
     bool isBeingDestroyed() const { return m_isBeingDestroyed; }
 
     const char* interpretKeyEvent(const WebCore::KeyboardEvent*);
diff --git a/Source/WebKit/wince/ChangeLog b/Source/WebKit/wince/ChangeLog
index e595f25..f5257b6 100644
--- a/Source/WebKit/wince/ChangeLog
+++ b/Source/WebKit/wince/ChangeLog
@@ -1,3 +1,54 @@
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename lengthReceived to encodedDataLength/dataLength
+        https://bugs.webkit.org/show_bug.cgi?id=58883
+
+        * WebCoreSupport/FrameLoaderClientWinCE.h:
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+
+        * WebCoreSupport/EditorClientWinCE.h:
+        (WebKit::EditorClientWinCE::requestCheckingOfString):
+
+2011-04-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (WebKit2): Caps-Lock indicator sometimes doesn't appear in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=51230
+        <rdar://problem/8780989>
+
+        * WebView.cpp: (WebView::handleKeyDown): Moved Caps Lock handling from WebKits to WebCore,
+        because WebKit shouldn't be smart.
+
+2011-03-31  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r82580.
+
+        * WebCoreSupport/FrameLoaderClientWinCE.h: StringWithDirection is in WebCore
+                                                   and not in WTF namespace.
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebCoreSupport/FrameLoaderClientWinCE.cpp:
+        (WebKit::FrameLoaderClientWinCE::dispatchDidReceiveTitle):
+        (WebKit::FrameLoaderClientWinCE::setTitle):
+        * WebCoreSupport/FrameLoaderClientWinCE.h:
+
 2011-03-27  Patrick Gansterer  <paroga@webkit.org>
 
         Reviewed by Andreas Kling.
diff --git a/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.h b/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
index d93ecc5..a2b23b4 100644
--- a/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
@@ -101,7 +101,7 @@ public:
     virtual void getGuessesForWord(const WTF::String& word, const WTF::String& context, WTF::Vector<WTF::String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&) {}
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
     virtual WebCore::TextCheckerClient* textChecker() { return this; }
 
 private:
diff --git a/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp b/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
index 2d8812f..648c4a5 100644
--- a/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
+++ b/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.cpp
@@ -371,7 +371,7 @@ void FrameLoaderClientWinCE::dispatchDidStartProvisionalLoad()
     notImplemented();
 }
 
-void FrameLoaderClientWinCE::dispatchDidReceiveTitle(const String&)
+void FrameLoaderClientWinCE::dispatchDidReceiveTitle(const StringWithDirection&)
 {
     notImplemented();
 }
@@ -490,7 +490,7 @@ void FrameLoaderClientWinCE::prepareForDataSourceReplacement()
     notImplemented();
 }
 
-void FrameLoaderClientWinCE::setTitle(const String&, const KURL&)
+void FrameLoaderClientWinCE::setTitle(const StringWithDirection&, const KURL&)
 {
     notImplemented();
 }
diff --git a/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h b/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
index 401225d..b0314e5 100644
--- a/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/FrameLoaderClientWinCE.h
@@ -60,7 +60,7 @@ public:
     virtual void dispatchDidReceiveAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::AuthenticationChallenge&);
     virtual void dispatchDidCancelAuthenticationChallenge(WebCore::DocumentLoader*, unsigned long  identifier, const WebCore::AuthenticationChallenge&);
     virtual void dispatchDidReceiveResponse(WebCore::DocumentLoader*, unsigned long  identifier, const WebCore::ResourceResponse&);
-    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived);
+    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int dataLength);
     virtual void dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long  identifier);
     virtual void dispatchDidFailLoading(WebCore::DocumentLoader*, unsigned long  identifier, const WebCore::ResourceError&);
     virtual bool dispatchDidLoadResourceFromMemoryCache(WebCore::DocumentLoader*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&, int length);
@@ -76,7 +76,7 @@ public:
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
-    virtual void dispatchDidReceiveTitle(const WTF::String&);
+    virtual void dispatchDidReceiveTitle(const WebCore::StringWithDirection&);
     virtual void dispatchDidChangeIcons();
     virtual void dispatchDidCommitLoad();
     virtual void dispatchDidFailProvisionalLoad(const WebCore::ResourceError&);
@@ -169,7 +169,7 @@ public:
     virtual void prepareForDataSourceReplacement();
 
     virtual WTF::PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
-    virtual void setTitle(const WTF::String& title, const WebCore::KURL&);
+    virtual void setTitle(const WebCore::StringWithDirection&, const WebCore::KURL&);
 
     virtual WTF::String userAgent(const WebCore::KURL&);
 
diff --git a/Source/WebKit/wince/WebView.cpp b/Source/WebKit/wince/WebView.cpp
index c21a7fd..56cbf28 100644
--- a/Source/WebKit/wince/WebView.cpp
+++ b/Source/WebKit/wince/WebView.cpp
@@ -347,8 +347,6 @@ bool WebView::handleMouseWheel(HWND hWnd, WPARAM wParam, LPARAM lParam, bool isH
 bool WebView::handleKeyDown(WPARAM virtualKeyCode, LPARAM keyData, bool systemKeyDown)
 {
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
-    if (virtualKeyCode == VK_CAPITAL)
-        frame->eventHandler()->capsLockStateMayHaveChanged();
 
     PlatformKeyboardEvent keyEvent(m_windowHandle, virtualKeyCode, keyData, PlatformKeyboardEvent::RawKeyDown, systemKeyDown);
     bool handled = frame->eventHandler()->keyEvent(keyEvent);
diff --git a/Source/WebKit/wx/ChangeLog b/Source/WebKit/wx/ChangeLog
index 980fa8a..908e356 100644
--- a/Source/WebKit/wx/ChangeLog
+++ b/Source/WebKit/wx/ChangeLog
@@ -1,3 +1,67 @@
+2011-04-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fixes for wxMSW and wx 2.9.1.1.
+        
+        * WebKitSupport/ChromeClientWx.cpp:
+        (WebCore::ChromeClientWx::setCursor):
+
+2011-04-06  Malcolm MacLeod  <malcolm.macleod@tshwanedje.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Fix cursor handling so that we always call the chrome to set it.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=57972
+
+        * WebKitSupport/ChromeClientWx.cpp:
+        (WebCore::ChromeClientWx::setCursor):
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+
+        * WebKitSupport/EditorClientWx.h:
+        (WebCore::EditorClientWx::requestCheckingOfString):
+
+2011-04-04  Malcolm MacLeod  <mmacleod@webmail.co.za>
+
+        Reviewed by Kevin Ollivier.
+
+        Move to using FrameView::resize to handle changes in view size.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=57805
+
+        * WebView.cpp:
+        (wxWebView::OnSize):
+
+2011-04-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (WebKit2): Caps-Lock indicator sometimes doesn't appear in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=51230
+        <rdar://problem/8780989>
+
+        * WebView.cpp: (wxWebView::OnKeyEvents): Moved Caps Lock handling from
+        WebKits to WebCore, because WebKit shouldn't be smart.
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::dispatchDidReceiveTitle):
+        (WebCore::FrameLoaderClientWx::setTitle):
+        * WebKitSupport/FrameLoaderClientWx.h:
+
 2011-03-25  Andy Estes  <aestes@apple.com>
 
         Reviewed by Adele Peterson.
diff --git a/Source/WebKit/wx/WebKitSupport/ChromeClientWx.cpp b/Source/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
index d525c09..19096de 100644
--- a/Source/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
+++ b/Source/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
@@ -460,9 +460,10 @@ void ChromeClientWx::chooseIconForFiles(const Vector<String>& filenames, FileCho
     chooser->iconLoaded(Icon::createIconForFiles(filenames));
 }
 
-void ChromeClientWx::setCursor(const Cursor&)
+void ChromeClientWx::setCursor(const Cursor& cursor)
 {
-    notImplemented();
+    if (m_webView && cursor.impl())
+        m_webView->SetCursor(*cursor.impl());
 }
 
 void ChromeClientWx::requestGeolocationPermissionForFrame(Frame*, Geolocation*)
diff --git a/Source/WebKit/wx/WebKitSupport/EditorClientWx.h b/Source/WebKit/wx/WebKitSupport/EditorClientWx.h
index d1d3597..65ee493 100644
--- a/Source/WebKit/wx/WebKitSupport/EditorClientWx.h
+++ b/Source/WebKit/wx/WebKitSupport/EditorClientWx.h
@@ -114,7 +114,7 @@ public:
 
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&) {}
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
     virtual TextCheckerClient* textChecker() { return this; }
 
 private:
diff --git a/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp b/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
index afc255c..b408636 100644
--- a/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
+++ b/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
@@ -295,12 +295,13 @@ void FrameLoaderClientWx::dispatchDidStartProvisionalLoad()
 }
 
 
-void FrameLoaderClientWx::dispatchDidReceiveTitle(const String& title)
+void FrameLoaderClientWx::dispatchDidReceiveTitle(const StringWithDirection& title)
 {
     if (m_webView) {
-        m_webView->SetPageTitle(title);
+        // FIXME: use direction of title.
+        m_webView->SetPageTitle(title.string());
         wxWebViewReceivedTitleEvent wkEvent(m_webView);
-        wkEvent.SetTitle(title);
+        wkEvent.SetTitle(title.string());
         m_webView->GetEventHandler()->ProcessEvent(wkEvent);
     }
 }
@@ -525,7 +526,7 @@ void FrameLoaderClientWx::prepareForDataSourceReplacement()
 }
 
 
-void FrameLoaderClientWx::setTitle(const String& title, const KURL&)
+void FrameLoaderClientWx::setTitle(const StringWithDirection& title, const KURL&)
 {
     notImplemented();
 }
diff --git a/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h b/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
index 254f95c..b28d389 100644
--- a/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
+++ b/Source/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h
@@ -103,7 +103,7 @@ namespace WebCore {
         virtual void dispatchWillClose();
         virtual void dispatchDidReceiveIcon();
         virtual void dispatchDidStartProvisionalLoad();
-        virtual void dispatchDidReceiveTitle(const String& title);
+        virtual void dispatchDidReceiveTitle(const StringWithDirection& title);
         virtual void dispatchDidCommitLoad();
         virtual void dispatchDidFinishDocumentLoad();
         virtual void dispatchDidFinishLoad();
@@ -145,7 +145,7 @@ namespace WebCore {
         virtual void addHistoryItemForFragmentScroll();
         virtual void didFinishLoad();
         virtual void prepareForDataSourceReplacement();
-        virtual void setTitle(const String& title, const KURL&);
+        virtual void setTitle(const StringWithDirection&, const KURL&);
 
         virtual String userAgent(const KURL&);
 
diff --git a/Source/WebKit/wx/WebView.cpp b/Source/WebKit/wx/WebView.cpp
index dab3225..acfd0ee 100644
--- a/Source/WebKit/wx/WebView.cpp
+++ b/Source/WebKit/wx/WebView.cpp
@@ -703,8 +703,7 @@ void wxWebView::OnSize(wxSizeEvent& event)
 { 
     if (m_isInitialized && m_mainFrame) {
         WebCore::Frame* frame = m_mainFrame->GetFrame();
-        frame->view()->setFrameRect(wxRect(wxPoint(0,0), event.GetSize()));
-        frame->view()->forceLayout();
+        frame->view()->resize(event.GetSize());
         frame->view()->adjustViewSize();
     }
       
@@ -895,9 +894,6 @@ void wxWebView::OnKeyEvents(wxKeyEvent& event)
     if (!(frame && frame->view()))
         return;
 
-    if (event.GetKeyCode() == WXK_CAPITAL)
-        frame->eventHandler()->capsLockStateMayHaveChanged();
-
     WebCore::PlatformKeyboardEvent wkEvent(event);
 
     if (frame->eventHandler()->keyEvent(wkEvent))
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index bacf704..fa45768 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,5070 @@
+2011-04-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        UI process thinks the page is unresponsive when a plug-in is showing a context menu
+        https://bugs.webkit.org/show_bug.cgi?id=58943
+        <rdar://problem/9299901>
+
+        Change the HandleMouseEvent message to have a delayed reply and make the PluginControllerProxy
+        respond to it immediately, before even passing the event to the plug-in. Since it doesn't matter
+        for mouse events whether the plug-in handled them or not we can do this.
+
+        Another solution could have been to make handleMouseEvent an asynchronous message, but that could
+        mess up the message ordering so this seemed like the least intrusive change.
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::handleMouseEvent):
+        * PluginProcess/PluginControllerProxy.h:
+        * PluginProcess/PluginControllerProxy.messages.in:
+
+2011-04-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Terminate hung plug-in processes after 45 seconds
+        https://bugs.webkit.org/show_bug.cgi?id=58932
+        <rdar://problem/8083219>
+
+        * UIProcess/Plugins/PluginProcessManager.cpp:
+        (WebKit::PluginProcessManager::pluginSyncMessageSendTimedOut):
+        Find the plug-in process proxy and terminate it.
+
+        (WebKit::PluginProcessManager::pluginProcessWithPath):
+        Add new helper function.
+
+        (WebKit::PluginProcessManager::getOrCreatePluginProcess):
+        Call pluginProcessWithPath.
+
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::terminate):
+        Terminate the process.
+
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::pluginSyncMessageSendTimedOut):
+        Call PluginProcessManager::pluginSyncMessageSendTimedOut.
+
+        * UIProcess/WebProcessProxy.h:
+        * UIProcess/WebProcessProxy.messages.in:
+        Add PluginSyncMessageSendTimedOut message.
+
+        * WebProcess/Plugins/PluginProcessConnection.cpp:
+        (WebKit::defaultSyncMessageTimeout):
+        (WebKit::PluginProcessConnection::PluginProcessConnection):
+        Set a sync message timeout on the plug-in process connection.
+
+        (WebKit::PluginProcessConnection::syncMessageSendTimedOut):
+        Send a message to the web process proxy.
+
+2011-04-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        WebKit2: Merge SelectionState and TextInputState
+        https://bugs.webkit.org/show_bug.cgi?id=58919
+
+        Combined TextInputState and EditorState in one structure, which is updated whenever we get
+        a chance to. There is no sense to keep possibly stale SelectionState data when we have already
+        requested the most recent data synchronously.
+
+        This also simplifies the code, as we don't need to pass the state around in a separate variable.
+
+        * GNUmakefile.am:
+        * Scripts/webkit2/messages.py:
+        * Shared/EditorState.h: Copied from Source/WebKit2/Shared/SelectionState.h.
+        (WebKit::EditorState::EditorState):
+        * Shared/SelectionState.h: Removed.
+        * Shared/mac/TextInputState.h: Removed.
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::interpretKeyEvent):
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView validRequestorForSendType:returnType:]):
+        (-[WKView validateUserInterfaceItem:]):
+        (-[WKView shouldDelayWindowOrderingForEvent:]):
+        (-[WKView doCommandBySelector:]):
+        (-[WKView insertText:replacementRange:]):
+        (-[WKView _handleStyleKeyEquivalent:]):
+        (-[WKView _executeSavedKeypressCommands]):
+        (-[WKView inputContext]):
+        (-[WKView hasMarkedText]):
+        (-[WKView unmarkText]):
+        (-[WKView setMarkedText:selectedRange:replacementRange:]):
+        (-[WKView attributedSubstringForProposedRange:actualRange:]):
+        (-[WKView _interpretKeyEvent:savingCommandsTo:WebCore::]):
+        (-[WKView _updateSecureInputState]):
+        * UIProcess/API/mac/WKViewInternal.h:
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::editorStateChanged):
+        * UIProcess/WebPageProxy.h:
+        (WebKit::WebPageProxy::editorState):
+        (WebKit::WebPageProxy::hasSelectedRange):
+        (WebKit::WebPageProxy::isContentEditable):
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/mac/WebPageProxyMac.mm:
+        (WebKit::WebPageProxy::setComposition):
+        (WebKit::WebPageProxy::confirmComposition):
+        (WebKit::WebPageProxy::insertText):
+        (WebKit::WebPageProxy::executeKeypressCommands):
+        (WebKit::WebPageProxy::writeSelectionToPasteboard):
+        (WebKit::WebPageProxy::readSelectionFromPasteboard):
+        (WebKit::WebPageProxy::interpretQueuedKeyEvent):
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::compositionSelectionChanged):
+        (WebKit::WebView::onIMEComposition):
+        (WebKit::WebView::onIMEEndComposition):
+        (WebKit::WebView::onIMERequestCharPosition):
+        (WebKit::WebView::onIMERequest):
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::respondToChangedSelection):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::editorState):
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in:
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::handleEditingKeyboardEvent):
+        (WebKit::WebPage::setComposition):
+        (WebKit::WebPage::confirmComposition):
+        (WebKit::WebPage::insertText):
+        (WebKit::WebPage::executeKeypressCommands):
+        * win/WebKit2.vcproj:
+
+2011-04-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        100% reproducible crash when right-clicking any element in Web Inspector on any page
+        https://bugs.webkit.org/show_bug.cgi?id=58822
+
+        Web Inspector changes selection from JavaScript, and checks in UI process are insufficient
+        when selection is changing asynchronously.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::writeSelectionToPasteboard): Check that there is a selection, matching WK1
+        and UI process side. Perhaps the check should really be in WebCore, but for now, it's a
+        WebKit responsibility.
+        (WebKit::WebPage::readSelectionFromPasteboard): Same check, for no other reason but consistency.
+
+2011-04-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add syncMessageSendTimedOut CoreIPC Connection::Client member function
+        https://bugs.webkit.org/show_bug.cgi?id=58928
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::waitForSyncReply):
+        Call syncMessageSendTimedOut.
+
+        * Platform/CoreIPC/Connection.h:
+        Add syncMessageSendTimedOut to Connection::Client.
+
+        * PluginProcess/PluginProcess.cpp:
+        * PluginProcess/PluginProcess.h:
+        * PluginProcess/WebProcessConnection.cpp:
+        * PluginProcess/WebProcessConnection.h:
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        * UIProcess/WebProcessProxy.cpp:
+        * UIProcess/WebProcessProxy.h:
+        * WebProcess/Plugins/PluginProcessConnection.cpp:
+        * WebProcess/Plugins/PluginProcessConnection.h:
+        * WebProcess/WebProcess.cpp:
+        * WebProcess/WebProcess.h:
+        Add syncMessageSendTimedOut stubs.
+
+2011-04-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Replace the didFailToSendSyncMessage Connection::Client function with a flag
+        https://bugs.webkit.org/show_bug.cgi?id=58923
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::Connection):
+        Initialize m_shouldExitOnSyncMessageSendFailure to false.
+
+        (CoreIPC::Connection::setShouldExitOnSyncMessageSendFailure):
+        Set m_didCloseOnConnectionWorkQueueCallback.
+
+        (CoreIPC::Connection::sendSyncMessage):
+        Call didFailToSendSyncMessage if we fail to send the sync message for some reason.
+
+        (CoreIPC::Connection::didFailToSendSyncMessage):
+        if m_shouldExitOnSyncMessageSendFailure is true, exit.
+
+        * Platform/CoreIPC/Connection.h:
+        Remove didFailToSendSyncMessage from Connection::Client.
+
+        * PluginProcess/PluginProcess.cpp:
+        * PluginProcess/PluginProcess.h:
+        Remove didFailToSendSyncMessage.
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::initialize):
+        * WebProcess/WebProcess.h:
+        Remove didFailToSendSyncMessage. Call setShouldExitOnSyncMessageSendFailure on our
+        UI process connection.
+
+2011-04-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a way to set the default sync message timeout for a CoreIPC connection
+        https://bugs.webkit.org/show_bug.cgi?id=58908
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::Connection):
+        Initialize m_defaultSyncMessageTimeout.
+
+        (CoreIPC::Connection::setDefaultSyncMessageTimeout):
+        Set the m_defaultSyncMessageTimeout member variable.
+
+        (CoreIPC::Connection::waitForSyncReply):
+        Handle the timeout being one of our two special magic values.
+
+        * Platform/CoreIPC/Connection.h:
+        Add a DefaultTimeout constant and change the NoTimeout constant to be -1.
+
+2011-04-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Rename lengthReceived to encodedDataLength/dataLength
+        https://bugs.webkit.org/show_bug.cgi?id=58883
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchDidReceiveContentLength):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
+
+2011-04-19  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        WebKit2: Typo fix in WebPopupMenu::Type.
+        https://bugs.webkit.org/show_bug.cgi?id=58891
+
+        Fixed a typo, Seperator -> Separator.
+        Also removed m_ prefix on an argument variable name.
+
+        * Shared/WebPopupItem.h:
+        * UIProcess/mac/WebPopupMenuProxyMac.mm:
+        (WebKit::WebPopupMenuProxyMac::populate):
+        * WebProcess/WebCoreSupport/WebPopupMenu.cpp:
+        (WebKit::WebPopupMenu::populateItems):
+
+2011-04-19  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        WKContextDownloadURLRequest() should return a WKDownloadRef
+        https://bugs.webkit.org/show_bug.cgi?id=58867
+        Part of <rdar://problem/8931717>
+
+        Reviewed by Steve Falkenburg.
+
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextDownloadURLRequest):
+        Return the result of calling WebContext::download().
+
+        * UIProcess/API/C/WKContext.h:
+        Updated return type of WKContextDownloadURLRequest().
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::download):
+        Return the DownloadProxy returned by createDownloadProxy().
+        (WebKit::WebContext::createDownloadProxy):
+        Return the DownloadProxy.
+
+        * UIProcess/WebContext.h:
+        Changed return type of download() and createDownloadProxy().
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::receivedPolicyDecision):
+        Call the DownloadProxy's downloadID() function to get the ID.
+
+2011-04-18  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        WebKit needs to stop importing <AppKit/NSTextChecker.h>
+        https://bugs.webkit.org/show_bug.cgi?id=58798
+        <rdar://problem/9294938>
+
+        Use public header <AppKit/NSSpellChecker.h> instead.
+
+        * UIProcess/mac/CorrectionPanel.h:
+        * UIProcess/mac/CorrectionPanel.mm:
+        (correctionIndicatorType):
+        (WebKit::CorrectionPanel::show):
+        (WebKit::CorrectionPanel::dismissInternal):
+        (WebKit::CorrectionPanel::handleAcceptedReplacement):
+        * UIProcess/mac/TextCheckerMac.mm:
+        * WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
+
+2011-04-05  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: WKTR should support WebKit2 full screen APIs
+        https://bugs.webkit.org/show_bug.cgi?id=56318
+
+        Add a new WKBundlePage API for Full Screen events, and move some of the implementation
+        of WebFullScreenManager into the new InjectedBundlePageFullScreenClient class, so that
+        the default behavior can be overridden by a WKBundlePageFullScreenClient.
+
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/FullScreen/WebFullScreenManager.cpp:
+        (WebKit::WebFullScreenManager::supportsFullScreen): Moved contents into InjectedBundlePageFullScreenClient.
+        (WebKit::WebFullScreenManager::enterFullScreenForElement): Ditto.
+        (WebKit::WebFullScreenManager::exitFullScreenForElement): Ditto.
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:
+        (WKBundlePageSetFullScreenClient): Added.
+        (WKBundlePageWillEnterFullScreenForElement): Added.
+        (WKBundlePageDidEnterFullScreenForElement): Added.
+        (WKBundlePageWillExitFullScreenForElement): Added.
+        (WKBundlePageDidExitFullScreenForElement): Added.
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.h:
+        * WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.cpp: Added.
+        (WebKit::InjectedBundlePageFullScreenClient::supportsFullScreen): Added. 
+        (WebKit::InjectedBundlePageFullScreenClient::enterFullScreenForElement): Added.
+        (WebKit::InjectedBundlePageFullScreenClient::exitFullScreenForElement): Added.
+        * WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.h: Added.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::initializeInjectedBundleFullScreenClient): Added.
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit::WebPage::injectedBundleFullScreenClient): Added.
+
+2011-04-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Re-add a null check lost in r83081
+        https://bugs.webkit.org/show_bug.cgi?id=58846
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::getSelectedRange):
+
+2011-04-18  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt][WK2] Clean up tool-tip/status-bar confusion.
+        https://bugs.webkit.org/show_bug.cgi?id=58844
+
+        Tool-tips were incorrectly hooked up to the status bar text.
+        Chrome::setStatusbarText() now correctly causes the QWKPage::statusBarMessage() signal.
+
+        New API:
+        - QWKPage::toolTipChanged(const QString& toolTip) [signal]
+
+        QGraphicsWKView will automatically listen for this and set its own toolTip().
+
+        * UIProcess/API/qt/ClientImpl.cpp:
+        (qt_wk_setStatusText):
+        * UIProcess/API/qt/ClientImpl.h:
+        * UIProcess/API/qt/qgraphicswkview.cpp:
+        (QGraphicsWKView::QGraphicsWKView):
+        (QGraphicsWKViewPrivate::onToolTipChanged):
+        * UIProcess/API/qt/qgraphicswkview.h:
+        * UIProcess/API/qt/qwkpage.cpp:
+        (QWKPagePrivate::toolTipChanged):
+        (QWKPage::QWKPage):
+        * UIProcess/API/qt/qwkpage.h:
+
+2011-04-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        sandbox violation for ~/Library/Dictionaries
+        https://bugs.webkit.org/show_bug.cgi?id=58841
+        <rdar://problem/9294770>
+
+        * WebProcess/com.apple.WebProcess.sb: Add to sandbox profile.
+        No obvious harm from allowing this, though it's not 100% clear
+        why it's needed.
+
+2011-04-18  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * Scripts/webkit2/messages.py:
+
+2011-04-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Get rid of WebProcessProxyLegacyMessage
+        https://bugs.webkit.org/show_bug.cgi?id=58825
+
+        * GNUmakefile.am:
+        * Platform/CoreIPC/MessageID.h:
+        * Shared/CoreIPCSupport/WebProcessProxyMessageKinds.h: Removed.
+        * UIProcess/WebProcessProxy.cpp:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/Plugins/PluginProcessConnectionManager.cpp:
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        * WebProcess/WebPage/WebPage.cpp:
+        * win/WebKit2.vcproj:
+
+2011-04-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * UIProcess/Plugins/PluginInfoStore.h:
+
+2011-04-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use the message generator for the GetPluginProcessConnection message
+        https://bugs.webkit.org/show_bug.cgi?id=58815
+
+        * Platform/CoreIPC/HandleMessage.h:
+        (CoreIPC::callMemberFunction):
+        (CoreIPC::handleMessageDelayed):
+        Add helper functions.
+
+        * UIProcess/Plugins/PluginInfoStore.h:
+        Mark class noncopyable.
+
+        * UIProcess/Plugins/PluginProcessManager.cpp:
+        (WebKit::PluginProcessManager::getPluginProcessConnection):
+        This now takes a delayed reply.
+
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::getPluginProcessConnection):
+        This now takes a delayed reply.
+
+        (WebKit::PluginProcessProxy::pluginProcessCrashedOrFailedToLaunch):
+        (WebKit::PluginProcessProxy::didCreateWebProcessConnection):
+        Call DelayedReply::send.
+
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::getPluginProcessConnection):
+        This now takes a delayed reply.
+        
+        (WebKit::WebProcessProxy::didReceiveSyncMessage):
+        No need to handle this message here.
+
+        * UIProcess/WebProcessProxy.messages.in:
+        Add GetPluginProcessConnection message.
+
+        * WebProcess/Plugins/PluginProcessConnectionManager.cpp:
+        (WebKit::PluginProcessConnectionManager::getPluginProcessConnection):
+        Don't use deprecatedSendSync.
+
+2011-04-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Finish implementing delayed sync replies in the CoreIPC message generator
+        https://bugs.webkit.org/show_bug.cgi?id=58814
+
+        Put the DelayedReply function definitions in the .cpp file and fix bugs found by
+        actually trying to compile the generated files.
+
+        * Scripts/webkit2/messages.py:
+        * Scripts/webkit2/messages_unittest.py:
+
+2011-04-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Reproducible crash in Find on Page, on pages that use accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=58793
+        <rdar://problem/9295870>
+
+        Move the call to PageOverlay::setNeedsDisplay() back to WebPage::installPageOverlay;
+        it needs to be called after we've told the drawing area that a page overlay has been installed.
+
+        * WebProcess/WebPage/PageOverlay.cpp:
+        (WebKit::PageOverlay::setPage):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::installPageOverlay):
+
+2011-04-18  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WKFrameLoadState should be a uint32_t to match our API conventions
+        https://bugs.webkit.org/show_bug.cgi?id=58785
+
+        * UIProcess/API/C/WKFrame.h: typedef WKFrameLoadState as a uint32_t and define its values as an anonymous enum.
+
+2011-04-18  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix WebKit2 GTK build after 84017.
+
+        * GNUmakefile.am:
+        * Shared/NativeWebMouseEvent.h:
+        (WebKit::NativeWebMouseEvent::nativeEvent):
+        * Shared/gtk/NativeWebMouseEventGtk.cpp: Copied from Source/WebKit2/Shared/NativeWebMouseEvent.h.
+        (WebKit::NativeWebMouseEvent::NativeWebMouseEvent):
+        * UIProcess/gtk/WebView.cpp:
+        (WebKit::WebView::handleMouseEvent):
+
+2011-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/58463> Switch HTTP pipelining from user default to private setting
+        <rdar://problem/9268729>
+
+        Reviewed by Dan Bernstein.
+
+        This replaces support for the WebKitEnableHTTPPipelining user
+        default with methods on the WebCore::ResourceRequest class in
+        WebCore, the WebView class in WebKit1, and the WebContext class
+        in WebKit2.  It also removes support for the
+        WebKitForceHTTPPipeliningPriorityHigh user default which was not
+        needed.
+
+        * UIProcess/API/C/WKContext.cpp:
+        (_WKContextSetHTTPPipeliningEnabled): Added.
+        * UIProcess/API/C/WKContextPrivate.h:
+        (_WKContextSetHTTPPipeliningEnabled): Added declaration.
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::setHTTPPipeliningEnabled): Added.
+        (WebKit::WebContext::httpPipeliningEnabled): Added.
+        * UIProcess/WebContext.h:
+        (WebKit::WebContext::setHTTPPipeliningEnabled): Added declaration.
+        (WebKit::WebContext::httpPipeliningEnabled): Added declaration.
+
+2011-04-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Make more strings in WebKit2 localizable
+        https://bugs.webkit.org/show_bug.cgi?id=58757
+
+        * UIProcess/API/mac/PDFViewController.mm:
+        (-[WKPDFView menuForEvent:]):
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::setViewportArguments):
+        (WebKit::PageClientImpl::registerEditCommand):
+        * UIProcess/WebEditCommandProxy.cpp:
+        (WebKit::WebEditCommandProxy::nameForEditAction):
+        * UIProcess/WebEditCommandProxy.h:
+        Use WebCore's localization macro to make more strings localizable.
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CA) to USE(CA)
+        https://bugs.webkit.org/show_bug.cgi?id=58742
+
+        * WebProcess/WebPage/LayerTreeHost.cpp:
+        * WebProcess/WebPage/win/LayerTreeHostWin.cpp:
+        (WebKit::LayerTreeHost::supportsAcceleratedCompositing):
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CG) to USE(CG)
+        https://bugs.webkit.org/show_bug.cgi?id=58729
+
+        * Shared/ShareableBitmap.h:
+        * Shared/WebCoreArgumentCoders.cpp:
+        * Shared/WebCoreArgumentCoders.h:
+        * Shared/WebGraphicsContext.cpp:
+        (WebKit::WebGraphicsContext::WebGraphicsContext):
+        * Shared/WebGraphicsContext.h:
+        * Shared/win/PlatformCertificateInfo.cpp:
+        (WebKit::PlatformCertificateInfo::PlatformCertificateInfo):
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::setFindIndicator):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::drawRectToPDF):
+        (WebKit::WebPage::drawPagesToPDF):
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::WebPage::platformPreferencesDidChange):
+        * config.h:
+
+2011-04-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when NPP_Write returns -1 when writing the manual stream
+        https://bugs.webkit.org/show_bug.cgi?id=58735
+        <rdar://problem/9124993>
+
+        If NPP_Write returns -1 we must cancel the stream.
+
+        * WebProcess/Plugins/Netscape/NetscapePluginStream.cpp:
+        (WebKit::NetscapePluginStream::deliverDataToPlugin):
+
+2011-04-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Pages in the PageCache don't have the correct visited link coloring after being restored
+        https://bugs.webkit.org/show_bug.cgi?id=58721
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::visitedLinkStateChanged):
+        (WebKit::WebProcess::allVisitedLinkStateChanged):
+        Mark all pages in the page cache as needing visited link style recalc
+        whenever visited link information changes.
+
+2011-04-15  Daniel Bates  <dbates@webkit.org>
+
+        Attempt to fix the Qt Linux Release build after changeset 84064 <http://trac.webkit.org/changeset/84064>
+        (https://bugs.webkit.org/show_bug.cgi?id=58686).
+
+        * UIProcess/API/qt/qwkpage_p.h: Remove takeFocus().
+
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-15  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add takeFocus callback to WKPageUIClient
+        https://bugs.webkit.org/show_bug.cgi?id=58686
+
+        On Windows, we need to handle moving focus out of the web view in the client, so add a takeFocus callback to WKPageUIClient
+        and stop handling taking focus in the framework in WKView.mm on the Mac.
+
+        * UIProcess/API/C/WKPage.h: Added WKFocusDirection enum and takeFocus to WKPageUIClient.
+        * UIProcess/API/mac/PageClientImpl.h: Removed takeFocus().
+        * UIProcess/API/mac/PageClientImpl.mm: Removed takeFocus().
+        * UIProcess/API/mac/WKView.mm: Removed _takeFocus().
+        * UIProcess/API/mac/WKViewInternal.h: Removed _takeFocus().
+        * UIProcess/API/qt/ClientImpl.cpp:
+        (qt_wk_takeFocus): Added.
+        * UIProcess/API/qt/ClientImpl.h: Added qt_wk_takeFocus.
+        * UIProcess/API/qt/qwkpage.cpp: Remove takeFocus().
+        (QWKPage::QWKPage): Added takeFocus() callback.
+        * UIProcess/PageClient.h: Removed takeFocus().
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::takeFocus): Call m_uiClient to take focus.
+        * UIProcess/WebPageProxy.h: Pass FocusDirection as a uint32_t to takeFocus().
+        * UIProcess/WebPageProxy.messages.in: Pass FocusDirection as a uint32_t in TakeFocus message.
+        * UIProcess/WebUIClient.cpp:
+        (WebKit::WebUIClient::takeFocus): Added.
+        * UIProcess/WebUIClient.h: Added takeFocus().
+        * UIProcess/win/WebView.cpp: Removed takeFocus(), which was never implemented on Windows.
+        * UIProcess/win/WebView.h: Removed takeFocus().
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::takeFocus): Pass FocusDirection as a uint32_t in TakeFocus message.
+
+2011-04-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Stop using deprecated NSInputManager
+        https://bugs.webkit.org/show_bug.cgi?id=58709
+
+        Changed all mouse related functions to give NSInputContext a chance to handle the event,
+        added logging. Removed -rightMouseMoved: method, which was added by accident.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView mouseMoved:]):
+        (-[WKView mouseDown:]):
+        (-[WKView mouseUp:]):
+        (-[WKView mouseDragged:]):
+
+2011-04-15  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Potential crash getting a JS wrapper.
+
+        <rdar://problem/8988741>
+
+        Reviewed by Brian Weinstein.
+
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::jsWrapperForWorld):
+        Ensure that we have a valid m_coreFrame, because it can be cleared by
+        invalidate().
+
+2011-04-08  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPage MIME type handling inconsistency with other web browsers
+        https://bugs.webkit.org/show_bug.cgi?id=46968
+
+        Implementing mime type sniffing based on
+        http://tools.ietf.org/html/draft-abarth-mime-sniff-06.
+
+        * WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.cpp:
+        (WebCore::WebFrameNetworkingContext::WebFrameNetworkingContext):
+        (WebCore::WebFrameNetworkingContext::MIMESniffingEnabled):
+        * WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.h:
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        GC allocate Structure
+        https://bugs.webkit.org/show_bug.cgi?id=58483
+
+        Rolling r83894 r83827 r83810 r83809 r83808 back in with
+        a workaround for the gcc bug seen by the gtk bots
+
+        * WebProcess/Plugins/Netscape/JSNPMethod.h:
+        (WebKit::JSNPMethod::createStructure):
+        * WebProcess/Plugins/Netscape/JSNPObject.h:
+        (WebKit::JSNPObject::createStructure):
+
+2011-04-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add API to get the bundle page overlay fade in fraction.
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp:
+        (WKBundlePageOverlayFractionFadedIn):
+        * WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.h:
+
+2011-04-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fade the find page overlay
+        https://bugs.webkit.org/show_bug.cgi?id=58697
+
+        * WebProcess/WebPage/FindController.cpp:
+        Make the color components floats.
+
+        (WebKit::overlayBackgroundColor):
+        (WebKit::holeShadowColor):
+        (WebKit::holeFillColor):
+        Add helper functions for returning the colors given the fraction faded in.
+
+        (WebKit::FindController::drawRect):
+        Use the new helper functions.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::installPageOverlay):
+        Start the fade animation unless we're replacing an already existing page overlay
+        with another.
+
+2011-04-15  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+
+        * WebProcess/WebPage/PageOverlay.cpp:
+        (WebKit::PageOverlay::fadeAnimationTimerFired):
+
+2011-04-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add the ability for PageOverlays to fade in and out
+        https://bugs.webkit.org/show_bug.cgi?id=58694
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:
+        (WKBundlePageUninstallPageOverlay):
+        WebPage::uninstallPageOverlay now takes a boolean. Default to false for now.
+
+        * WebProcess/WebPage/FindController.cpp:
+        (WebKit::FindController::findString):
+        Pass false to uninstallPageOverlay.
+
+        (WebKit::FindController::hideFindUI):
+        Pass true to uninstallPageOverlay.
+        
+        * WebProcess/WebPage/PageOverlay.cpp:
+        (WebKit::PageOverlay::PageOverlay):
+        Initialize new member variables.
+
+        (WebKit::PageOverlay::bounds):
+        Get rid of an unnecessary webPage() getter.
+
+        (WebKit::PageOverlay::setPage):
+        Stop the animation timer.
+
+        (WebKit::PageOverlay::startFadeInAnimation):
+        Update m_fractionFadedIn and call startFadeAnimation.
+
+        (WebKit::PageOverlay::startFadeOutAnimation):
+        Ditto.
+        
+        (WebKit::PageOverlay::startFadeAnimation):
+        Initialize m_fadeAnimationStartTime and start the fade animation timer.
+
+        (WebKit::PageOverlay::fadeAnimationTimerFired):
+        Update m_fractionFadedIn and call setNeedsDisplay().
+
+        * WebProcess/WebPage/PageOverlay.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::uninstallPageOverlay):
+        If fadeOut is true, tell the page overlay to start the fade out animation.
+        When the fade animation is complete, the page overlay will uninstall itself.
+
+2011-04-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Views should be made visible before painting in WM_PRINTCLIENT messages
+        https://bugs.webkit.org/show_bug.cgi?id=58676
+        <rdar://problem/9279211>
+
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::onPrintClientEvent): If our view isn't currently visible set it to visible
+            before painting, then reset it back to not visible after painting.
+        (WebKit::WebView::onShowWindowEvent): Call setIsVisible instead of duplicating logic.
+        (WebKit::WebView::setIsVisible): Set the m_isVisible flag and call viewStateDidChange.
+        * UIProcess/win/WebView.h:
+
+2011-04-15  Jon Lee  <jonlee@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        onClick does not function with <select> elements in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=57904
+        <rdar://problem/9217757>
+
+        Reviewed by Anders Carlsson.
+
+        * Shared/NativeWebMouseEvent.h: Copied from Source/WebKit2/UIProcess/WebPopupMenuProxy.h.
+        (WebKit::NativeWebMouseEvent::nativeEvent):
+        * Shared/mac/NativeWebMouseEventMac.mm: Added.
+        (WebKit::NativeWebMouseEvent::NativeWebMouseEvent):
+        * Shared/qt/NativeWebMouseEventQt.cpp: Copied from Source/WebKit2/UIProcess/WebPopupMenuProxy.h.
+        (WebKit::NativeWebMouseEvent::NativeWebMouseEvent):
+        * Shared/win/NativeWebMouseEventWin.cpp: Copied from Source/WebKit2/UIProcess/WebPopupMenuProxy.h.
+        (WebKit::NativeWebMouseEvent::NativeWebMouseEvent):
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView mouseMoved:]):
+        (-[WKView _mouseHandler:]): Pre-compiler mouse handler calls need to use the new NativeWebMouseEvent class
+        * UIProcess/API/qt/qwkpage.cpp:
+        (QWKPagePrivate::mouseMoveEvent):
+        (QWKPagePrivate::mousePressEvent):
+        (QWKPagePrivate::mouseReleaseEvent):
+        (QWKPagePrivate::mouseDoubleClickEvent):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::handleMouseEvent): keep track of mouse down event in order to be able to send a fake mouse up event on the select element
+        (WebKit::WebPageProxy::currentMouseDownEvent): for access by the popup menu proxy to dispatch the fake mouse up event
+        (WebKit::WebPageProxy::didReceiveEvent): clear out the cached mouse down event
+        (WebKit::WebPageProxy::processDidCrash): clear out the cached events since we assume that didReceiveEvent did not called prior to the crash
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPopupMenuProxy.h:
+        * UIProcess/mac/WebPopupMenuProxyMac.mm:
+        (WebKit::WebPopupMenuProxyMac::showPopupMenu): after notifying the popup menu client that the value changed, fake mouse up and mouse move events are posted
+        * UIProcess/win/WebPopupMenuProxyWin.cpp:
+        (WebKit::WebPopupMenuProxyWin::showPopupMenu): after notifying the popup menu client that the value changed, fake mouse up and mouse move events are posted
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::onMouseEvent):
+        * WebKit2.pro:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+
+2011-04-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Qt build fix.
+
+        * UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::selectionStateChanged): Wrap the variable
+        in PLATFORM(MAC), too, as it's unused on other platforms.
+
+2011-04-15  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/9287880> and https://bugs.webkit.org/show_bug.cgi?id=58596
+        WK2: Past searches not remembered for <input type=search results="5" autosave="foo">
+
+        Add SaveRecentSearches and LoadRecentSearches messages:
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/WebPageProxy.h:
+
+        Message up to the UIProcess for the save/load operations:
+        * WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp:
+        (WebKit::WebSearchPopupMenu::saveRecentSearches):
+        (WebKit::WebSearchPopupMenu::loadRecentSearches):
+        * WebProcess/WebCoreSupport/WebPopupMenu.h:
+        (WebKit::WebPopupMenu::page):
+
+        Save the values to disk CFPreference-style:
+        * UIProcess/cf/WebPageProxyCF.cpp:
+        (WebKit::autosaveKey):
+        (WebKit::WebPageProxy::saveRecentSearches):
+        (WebKit::WebPageProxy::loadRecentSearches):
+
+        Stubbed out for non-CF platforms:
+        * UIProcess/gtk/WebPageProxyGtk.cpp:
+        (WebKit::WebPageProxy::saveRecentSearches):
+        (WebKit::WebPageProxy::loadRecentSearches):
+        * UIProcess/qt/WebPageProxyQt.cpp:
+        (WebKit::WebPageProxy::saveRecentSearches):
+        (WebKit::WebPageProxy::loadRecentSearches):
+
+2011-04-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Password field input does not switch to ASCII-compatible source
+        https://bugs.webkit.org/show_bug.cgi?id=58583
+        <rdar://problem/9059651>
+
+        The implementation is more modern than what we have in WK1. Instead of returning a null
+        input context (as in non-editable content), we now set page context's properties.
+
+        * UIProcess/PageClient.h:
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm: (WebKit::PageClientImpl::updateSecureInputState):
+        Forward updateSecureInputState() call from WebPageProxy to WKView.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView dealloc]): ASSERT that we didn't somehow leave secure input events enabled.
+        (-[WKView becomeFirstResponder]): Update secure event mode.
+        (-[WKView resignFirstResponder]): Disable secure event mode.
+        (-[WKView setMarkedText:selectedRange:replacementRange:]): Prevent most advanced editing
+        behaviors in password fields, matching NSSecureTextInputField.
+        (-[WKView attributedSubstringForProposedRange:actualRange:]): Disable TSM Document Access
+        in password fields. There is also a check in web process, but it doest't hurt to check twice.
+        (-[WKView _windowDidBecomeKey:]): Call _updateSecureInputState.
+        (-[WKView _windowDidResignKey:]): Call _updateSecureInputState.
+        (-[WKView _updateSecureInputState]): Update secure event mode and allowed input sources.
+
+        * UIProcess/API/mac/WKViewInternal.h: Added _updateSecureInputState.
+
+        * UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::selectionStateChanged): Update secure
+        input state when going in or out a password field.
+
+2011-04-14  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        REGRESSION: Rendering in <video> element appears to render quickly to catch up if it has been playing in a background tab
+        https://bugs.webkit.org/show_bug.cgi?id=58637
+
+        Notify AVFoundation that no one will be rendering when the view or window moves off screen.
+
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::isViewVisible): Return false if the view's window is not visible.
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView addWindowObserversForWindow:]): Observe orderOut and orderIn events.
+        (-[WKView removeWindowObservers]): Ditto.
+        (-[WKView _windowDidOrderOffScreen:]): Added.
+        (-[WKView _windowDidOrderOnScreen:]): Added.
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::suspendPainting): Call LayerTreeHost::pauseRendering.
+        (WebKit::DrawingAreaImpl::resumePainting): Call LayerTreeHost::resumeRendering.
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (WebKit::LayerTreeHost::pauseRendering): Added stub.
+        (WebKit::LayerTreeHost::resumeRendering): Added stub.
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h:
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm:
+        (WebKit::LayerTreeHostCAMac::pauseRendering): Added. Post a notification with our
+            intention to stop rendering.
+        (WebKit::LayerTreeHostCAMac::resumeRendering): Added. Post a notification with our
+            intention to start rendering.
+
+2011-04-15  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Need a way to keep the WebProcess alive for testing purposes.
+        https://bugs.webkit.org/show_bug.cgi?id=58592
+
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextDisableProcessTermination):
+        (WKContextEnableProcessTermination):
+        * UIProcess/API/C/WKContextPrivate.h:
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        Initialize m_processTerminationEnabled to true.
+        (WebKit::WebContext::enableProcessTermination):
+        Set m_processTerminationEnabled to true, and try to terminate the web process.
+        (WebKit::WebContext::shouldTerminate):
+        If !m_processTerminationEnabled, return false.
+        * UIProcess/WebContext.h:
+        (WebKit::WebContext::disableProcessTermination):
+        Set m_processTerminationEnabled to false;
+
+2011-04-15  Nancy Piedra  <nancy.piedra@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Need to export ViewportAttributes class
+        https://bugs.webkit.org/show_bug.cgi?id=58651
+
+        On Symbian, if the ViewportAttributes class is not exported we get
+        linking errors.
+
+        Since this is a compilation issue, no new tests added.
+
+        * UIProcess/API/qt/qwkpage.h:
+
+2011-04-15  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Renaming TRACK feature define to VIDEO_TRACK
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Select All context menu item doesn't work in Flash
+        https://bugs.webkit.org/show_bug.cgi?id=58615
+        <rdar://problem/9225761>
+
+        In some cases, -[NSWindow isKeyWindow] will return false even if
+        a window is the key window, so we have to compare our window
+        against -[NSApplication keyWindow].
+
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::isViewWindowActive):
+
+2011-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add CFPreference based backend for WebKit2 preferences
+        https://bugs.webkit.org/show_bug.cgi?id=58605
+
+        * UIProcess/cf/WebPreferencesCF.cpp:
+        (WebKit::cfStringFromWebCoreString):
+        (WebKit::makeKey):
+        (WebKit::setStringValueIfInUserDefaults):
+        (WebKit::setBoolValueIfInUserDefaults):
+        (WebKit::setUInt32ValueIfInUserDefaults):
+        (WebKit::setDoubleValueIfInUserDefaults):
+        (WebKit::WebPreferences::platformInitializeStore):
+        (WebKit::WebPreferences::platformUpdateStringValueForKey):
+        (WebKit::WebPreferences::platformUpdateBoolValueForKey):
+        (WebKit::WebPreferences::platformUpdateUInt32ValueForKey):
+        (WebKit::WebPreferences::platformUpdateDoubleValueForKey):
+        Implement platform functions using CFPreferences API.
+
+2011-04-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8665102> and https://bugs.webkit.org/show_bug.cgi?id=58595
+        Menu is not displayed for <input type=search results="5">
+
+        * WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp:
+        (WebKit::WebSearchPopupMenu::enabled): Return true, like all good search popup menus should.
+
+        * WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm:
+        (WebKit::WebPopupMenu::setUpPlatformData): Remember the shouldPopOver-ness.
+
+        * Shared/PlatformPopupMenuData.cpp:
+        (WebKit::PlatformPopupMenuData::encode): Remember the shouldPopOver-ness.
+        (WebKit::PlatformPopupMenuData::decode): Remember the shouldPopOver-ness.
+        * Shared/PlatformPopupMenuData.h:
+
+        * UIProcess/mac/WebPopupMenuProxyMac.mm:
+        (WebKit::WebPopupMenuProxyMac::showPopupMenu): Use the shouldPopOver-ness to adjust display position.
+
+2011-04-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash in NetscapePluginModule::tryGetSitesWithData when NPP_GetSitesWithData returns null
+        https://bugs.webkit.org/show_bug.cgi?id=58578
+        <rdar://problem/9275201>
+
+        It's OK for NPP_GetSitesWithData to return null.
+
+        * Shared/Plugins/Netscape/NetscapePluginModule.cpp:
+        (WebKit::NetscapePluginModule::tryGetSitesWithData):
+
+2011-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Make creating WebPreferences lazy
+        https://bugs.webkit.org/show_bug.cgi?id=58570
+
+        * UIProcess/WebPageGroup.cpp:
+        (WebKit::WebPageGroup::WebPageGroup):
+        (WebKit::WebPageGroup::~WebPageGroup):
+        (WebKit::WebPageGroup::setPreferences):
+        (WebKit::WebPageGroup::preferences):
+        * UIProcess/WebPageGroup.h:
+        Don't create the WebPreference object until it is requested.
+
+2011-04-14  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Set minimum priority for fast lane connections
+        https://bugs.webkit.org/show_bug.cgi?id=58353
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Support for new WKSI method WKSetHTTPPipeliningMinimumFastLanePriority.
+
+2011-04-14  Anders Carlsson  <andersca@apple.com>
+
+        Clang warning fixes.
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/mac/TextCheckerMac.mm:
+        * WebProcess/Downloads/mac/DownloadMac.mm:
+
+2011-04-14  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebKit2: Add an option for a PageGroup to be invisible to the History Client.
+        https://bugs.webkit.org/show_bug.cgi?id=58547
+
+        * Shared/WebPageGroupData.cpp:
+        (WebKit::WebPageGroupData::encode):
+        (WebKit::WebPageGroupData::decode):
+        * Shared/WebPageGroupData.h:
+
+        * UIProcess/WebInspectorProxy.cpp:
+        (WebKit::WebInspectorProxy::inspectorPageGroup):
+        The Web Inspector should not be visible to the History Client, because its HTML-based nature
+        should not be exposed through the API.
+
+        * UIProcess/WebPageGroup.cpp:
+        (WebKit::WebPageGroup::create):
+        (WebKit::WebPageGroup::WebPageGroup):
+        * UIProcess/WebPageGroup.h:
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::updateGlobalHistory):
+        Do not send the message to the WebContent for the history client.
+        (WebKit::WebFrameLoaderClient::updateGlobalHistoryRedirectLinks):
+        Ditto.
+        (WebKit::WebFrameLoaderClient::setTitle):
+        Ditto.
+
+        * WebProcess/WebPage/WebPageGroupProxy.h:
+        (WebKit::WebPageGroupProxy::isVisibleToHistoryClient):
+
+2011-04-14  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt][WK2] Make Qt port compiling with ENABLE_PLUGIN_PROCESS=1
+        https://bugs.webkit.org/show_bug.cgi?id=55719
+
+        Guard functionality related to complex text and implementations
+        that rely on MachPort with PLATFORM(MAC).
+        Based on Oleg Romashin's patch.
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        * PluginProcess/PluginControllerProxy.messages.in:
+        * PluginProcess/PluginProcess.cpp:
+        (WebKit::PluginProcess::createWebProcessConnection):
+        * PluginProcess/WebProcessConnection.cpp:
+        (WebKit::WebProcessConnection::createPlugin):
+        * Shared/Plugins/PluginProcessCreationParameters.cpp:
+        (WebKit::PluginProcessCreationParameters::decode): Fix bad C++ that
+        does not compile with gcc-linux.
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::pluginProcessCrashedOrFailedToLaunch):
+        (WebKit::PluginProcessProxy::didCreateWebProcessConnection):
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        * UIProcess/Plugins/PluginProcessProxy.messages.in:
+        * WebKit2.pro: Move implementation that does not need external
+        visibility from WebKit2API.pri. Adding the headers as well.
+        * WebKit2API.pri:
+        * WebProcess/Plugins/PluginProcessConnectionManager.cpp:
+        (WebKit::PluginProcessConnectionManager::getPluginProcessConnection):
+        * WebProcess/WebPage/WebPage.cpp:
+
+2011-04-13  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Allow setting composited backing stores for scrollbars and scroll corners
+        https://bugs.webkit.org/show_bug.cgi?id=57202
+
+        Update WebPopupMenuProxyWin to reflect ScrollableArea interface changes.
+
+        * UIProcess/win/WebPopupMenuProxyWin.h:
+        (WebKit::WebPopupMenuProxyWin::invalidateScrollCornerRect):
+        (WebKit::WebPopupMenuProxyWin::scrollCornerPresent):
+        (WebKit::WebPopupMenuProxyWin::scrollCornerRect):
+
+2011-04-13  Jon Lee  <jonlee@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION(r81880): Paste menu is disabled for many edit fields (yahoo and google search, yahoo mail msg, forms, etc)
+        https://bugs.webkit.org/show_bug.cgi?id=58284
+        <rdar://problem/9246149>
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::setFocused): Check for whether we are not supposed to be focused AND whether our platform behavior dictates to clear out the selection
+
+2011-04-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a bug where WKView changed the cursor when the mouse was moving over other views.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView mouseMoved:]): If getting this message because this view is the first responder,
+        ignore it unless it is inside the visible rect.
+
+2011-04-13  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Should not rely on WKEditableLinkBehavior being in synch
+        with WebCore::EditableLinkBehavior.
+        https://bugs.webkit.org/show_bug.cgi?id=58473
+
+        Adding conversion routines.
+
+        * UIProcess/API/C/WKAPICast.h:
+        (WebKit::toAPI):
+        (WebKit::toEditableLinkBehavior):
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetEditableLinkBehavior):
+        (WKPreferencesGetEditableLinkBehavior):
+
+2011-04-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        After closing the last window, re-opening my last visited website is over 2X slower
+        https://bugs.webkit.org/show_bug.cgi?id=58488
+        <rdar://problem/9233518>
+
+        Give the web process a 60 second termination timeout.
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::WebProcess):
+
+2011-04-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Convert WebProcess over to using disableTermination/enableTermination
+        https://bugs.webkit.org/show_bug.cgi?id=58485
+
+        * PluginProcess/PluginProcess.cpp:
+        (WebKit::PluginProcess::getSitesWithData):
+        (WebKit::PluginProcess::clearSiteData):
+        Use the LocalTerminationDisabler RAII class.
+
+        * Shared/ChildProcess.h:
+        (WebKit::ChildProcess::LocalTerminationDisabler::LocalTerminationDisabler):
+        (WebKit::ChildProcess::LocalTerminationDisabler::~LocalTerminationDisabler):
+        Add RAII class for calling disableTermination/enableTermination.
+
+        * WebProcess/ApplicationCache/WebApplicationCacheManager.cpp:
+        (WebKit::WebApplicationCacheManager::getApplicationCacheOrigins):
+        (WebKit::WebApplicationCacheManager::deleteEntriesForOrigin):
+        (WebKit::WebApplicationCacheManager::deleteAllEntries):
+        Use the LocalTerminationDisabler RAII class.
+
+        * WebProcess/Cookies/WebCookieManager.cpp:
+        (WebKit::WebCookieManager::getHostnamesWithCookies):
+        (WebKit::WebCookieManager::deleteCookiesForHostname):
+        (WebKit::WebCookieManager::deleteAllCookies):
+        (WebKit::WebCookieManager::startObservingCookieChanges):
+        (WebKit::WebCookieManager::setHTTPCookieAcceptPolicy):
+        (WebKit::WebCookieManager::getHTTPCookieAcceptPolicy):
+        Use the LocalTerminationDisabler RAII class.
+
+        * WebProcess/Downloads/Download.cpp:
+        (WebKit::Download::Download):
+        Call disableTermination().
+
+        (WebKit::Download::~Download):
+        Call enableTermination().
+
+        * WebProcess/Downloads/DownloadManager.cpp:
+        (WebKit::DownloadManager::downloadFinished):
+        Remove call to terminateIfPossible.
+
+        * WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp:
+        (WebKit::WebKeyValueStorageManager::getKeyValueStorageOrigins):
+        (WebKit::WebKeyValueStorageManager::deleteEntriesForOrigin):
+        (WebKit::WebKeyValueStorageManager::deleteAllEntries):
+        Use the LocalTerminationDisabler RAII class.
+        
+        * WebProcess/MediaCache/WebMediaCacheManager.cpp:
+        (WebKit::WebMediaCacheManager::getHostnamesWithMediaCache):
+        (WebKit::WebMediaCacheManager::clearCacheForHostname):
+        (WebKit::WebMediaCacheManager::clearCacheForAllHostnames):
+        Use the LocalTerminationDisabler RAII class.
+        
+        * WebProcess/ResourceCache/WebResourceCacheManager.cpp:
+        (WebKit::WebResourceCacheManager::getCacheOrigins):
+        (WebKit::WebResourceCacheManager::clearCacheForOrigin):
+        (WebKit::WebResourceCacheManager::clearCacheForAllOrigins):
+        Use the LocalTerminationDisabler RAII class.
+        
+        * WebProcess/WebCoreSupport/WebDatabaseManager.cpp:
+        (WebKit::WebDatabaseManager::getDatabasesByOrigin):
+        (WebKit::WebDatabaseManager::getDatabaseOrigins):
+        (WebKit::WebDatabaseManager::deleteDatabaseWithNameForOrigin):
+        (WebKit::WebDatabaseManager::deleteDatabasesForOrigin):
+        (WebKit::WebDatabaseManager::deleteAllDatabases):
+        (WebKit::WebDatabaseManager::setQuotaForOrigin):
+        Use the LocalTerminationDisabler RAII class.
+        
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::createWebPage):
+        Call disableTermination().
+
+        (WebKit::WebProcess::removeWebPage):
+        Call enableTermination().
+
+        (WebKit::WebProcess::shouldTerminate):
+        Move logic from terminateIfPossible over here.
+
+        (WebKit::WebProcess::terminate):
+        Move logic from terminateIfPossible over here.
+
+        (WebKit::WebProcess::getSitesWithPluginData):
+        (WebKit::WebProcess::clearPluginSiteData):
+        Use the LocalTerminationDisabler RAII class.
+
+        * WebProcess/WebProcess.h:
+        Publically inherit from ChildProcess, LocalTerminationDisabler needs to be accessible
+        from the WebProcess class.
+
+2011-04-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Follow-up to: WebKit2 will load two copies of the same plugin, but should not
+        https://bugs.webkit.org/show_bug.cgi?id=49075
+        
+        Use pathGetFileName instead of Win32 PathFindFileNameW.
+
+        * UIProcess/Plugins/win/PluginInfoStoreWin.cpp:
+        (WebKit::PluginInfoStore::shouldUsePlugin):
+
+2011-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        WebKit2 doesn't keep overlay scrollers shown while scroll gesture held
+        <rdar://problem/9260518>
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+        Initialize new WKSI functions.
+
+2011-04-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebKit2 will load two copies of the same plugin, but should not
+        https://bugs.webkit.org/show_bug.cgi?id=49075
+        <rdar://problem/8635947>
+
+        * UIProcess/Plugins/win/PluginInfoStoreWin.cpp:
+        (WebKit::PluginInfoStore::shouldUsePlugin): Don't use a plug-in if we've already allowed a plug-in with the same filename.
+
+2011-04-13  Timothy Hatcher  <timothy@apple.com>
+
+        Hide the dictionary panel when navigating or crashing.
+
+        <rdar://problem/9261202>
+
+        Reviewed by Sam Weinig.
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::dismissDictionaryLookupPanel): Added. Call WKHideWordDefinitionWindow.
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didCommitLoadForFrame): Call PageClient::dismissDictionaryLookupPanel.
+        (WebKit::WebPageProxy::processDidCrash): Call dismissCorrectionPanel and PageClient::dismissDictionaryLookupPanel.
+
+2011-04-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for disabling/enabling termination to ChildProcess
+        https://bugs.webkit.org/show_bug.cgi?id=58476
+
+        Add ChildProcess::disableTermination and ChildProcess::enableTermination and convert
+        the PluginProcess class over to using them.
+
+        * PluginProcess/PluginProcess.cpp:
+        (WebKit::PluginProcess::PluginProcess):
+        The child process now takes a terminationTimeout argument. Get rid of the shutdown timer.
+
+        (WebKit::PluginProcess::removeWebProcessConnection):
+        Call enableTermination().
+
+        (WebKit::PluginProcess::shouldTerminate):
+        Always return true.
+
+        (WebKit::PluginProcess::createWebProcessConnection):
+        Call disableTermination().
+
+        (WebKit::PluginProcess::getSitesWithData):
+        Call disableTermination()/enableTermination().
+
+        (WebKit::PluginProcess::clearSiteData):
+        Ditto.
+
+        * Shared/ChildProcess.cpp:
+        (WebKit::ChildProcess::disableTermination):
+        Increment the counter and stop the timer.
+
+        (WebKit::ChildProcess::enableTermination):
+        Decrement the counter; if it's zero, start the timer.
+
+        (WebKit::ChildProcess::terminationTimerFired):
+        Call shouldTerminate(). If it returns true, call terminate().
+
+        (WebKit::ChildProcess::terminate):
+        Call RunLoop::quit().
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::WebProcess):
+        Just initialize the termination timeout to 0 for now.
+
+        (WebKit::WebProcess::shouldTerminate):
+        Always return true; this isn't used yet.
+
+        * WebProcess/WebProcess.h:
+
+2011-04-13  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: Links are clickable when a contentEditable is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=58473
+        <rdar://problem/9256793>
+        
+        Added support for editable link behavior property.
+
+        * Shared/WebPreferencesStore.cpp:
+        * Shared/WebPreferencesStore.h:
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetEditableLinkBehavior):
+        (WKPreferencesGetEditableLinkBehavior):
+        * UIProcess/API/C/WKPreferencesPrivate.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences):
+
+2011-04-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (WebKit2): Input methods are active in non-editable content
+        https://bugs.webkit.org/show_bug.cgi?id=58404
+        <rdar://problem/9275940>
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView insertText:]): Re-add the old variant of this function, because it's not only part
+        of deprecated NSTextInput protocol, but it's also part of NSResponder, and it's called when
+        the input context in nil.
+        (-[WKView inputContext]): Return nil when not in editable content.
+
+2011-04-12  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9029193> and https://bugs.webkit.org/show_bug.cgi?id=58406
+        Bringing up the context menu on a link might also follow the link.
+
+        This patch adds a flag that is set just before the WebProcess tells the UIProcess to show a context menu.
+
+        As long as this flag is set, the WebProcess will ignore any other mouse events that might have queued up
+        by the time the UIProcess gets around to showing the menu.
+
+        After the UIProcess is done showing the menu, it messages back telling the WebProcess to clear the flag
+        and resume normal MouseEvent handling.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::showContextMenu): No matter what internalShowContextMenu does, always notify
+          the WebProcess that any context menu is now hidden.
+        (WebKit::WebPageProxy::internalShowContextMenu):
+        * UIProcess/WebPageProxy.h:
+
+        * WebProcess/WebPage/WebContextMenu.cpp:
+        (WebKit::WebContextMenu::show): Since we're telling the UIProcess to show the menu, tell the WebPage a
+          context menu is showing so it will stop handling mouse events.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        (WebKit::WebPage::mouseEvent): Don't try to handle mouse events if a context menu is flagged as showing.
+
+        Add accessors to twiddle the "context menu showing" flag:
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit::WebPage::contextMenuShowing):
+        (WebKit::WebPage::contextMenuHidden):
+        * WebProcess/WebPage/WebPage.messages.in: Add the ContextMenuHidden message.
+
+2011-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Quarantine related sandbox denial when downloading files
+        <rdar://problem/9203736>
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Sandbox violations dragging an image to the desktop.
+        <rdar://problem/9261834>
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Sandbox violations trying to access ~/Library/Keyboard Layouts and ~/Library/Input Methods
+        <rdar://problem/8973159> 
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-04-12  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov and Sam Weinig.
+
+        Implement non-activating clicks to allow dragging out of a background window.
+        https://bugs.webkit.org/show_bug.cgi?id=55053
+        <rdar://problem/9042197>
+
+        Added methods to WKView to support non activating click. Unfortunately both
+        methods require a synchronous call to the WebProcess to decide what to do.
+        acceptFirstMouse is called only if shouldDelayWindowOrderingForEvent returns
+        true. In order to minimize the number of synchronous calls, we send the request
+        only if our window is not the key window.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView acceptsFirstMouse:]):
+        (-[WKView shouldDelayWindowOrderingForEvent:]):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/mac/WebPageProxyMac.mm:
+        (WebKit::WebPageProxy::shouldDelayWindowOrderingForEvent):
+        (WebKit::WebPageProxy::acceptsFirstMouse):
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in:
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::shouldDelayWindowOrderingEvent):
+        (WebKit::WebPage::acceptsFirstMouse):
+
+2011-04-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash when serializing a null AttributedString
+        https://bugs.webkit.org/show_bug.cgi?id=58393
+        <rdar://problem/9275326>
+
+        * Shared/mac/AttributedString.mm:
+        (WebKit::AttributedString::encode):
+        (WebKit::AttributedString::decode):
+        Prefix the serialized value with an isNull tag.
+
+2011-04-12  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Infinite recursion in WebHTMLView executeSavedKeypressCommands.
+        https://bugs.webkit.org/show_bug.cgi?id=58382
+        <rdar://problem/9239370>
+
+        Execution of some editing commands could trigger a call to selectedRange that
+        internally calls executeSavedKeypressCommands creating an infinite recursion.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView _executeSavedKeypressCommands]): Added flag to avoid recursion.
+        (-[WKView _interpretKeyEvent:withCachedTextInputState:savingCommandsTo:WebCore::]):
+        Added flag initialization.
+
+2011-04-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Page tears and stutters in WebKit2 when page is > 2048 pixels wide
+        https://bugs.webkit.org/show_bug.cgi?id=58330
+
+        Turn off tiling for nonCompositedContentLayer to avoid tearing when
+        scrolling very wide (> 2048) windows.
+
+        * WebProcess/WebPage/ca/LayerTreeHostCA.cpp:
+        (WebKit::LayerTreeHostCA::initialize):
+
+2011-04-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Assertion in DrawingAreaImpl::resumePainting() (m_isPaintingSuspended) when clicking a link at twitter.com
+        https://bugs.webkit.org/show_bug.cgi?id=58377
+        <rdar://problem/8976531>
+
+        Remove the assertion.
+
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::resumePainting):
+
+2011-04-11  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58280
+        <rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception
+        Change use of SerializedScriptValue::Create to use the same api as the rest of WebKit2.  This has the benefit
+        of handling any exceptions so Javascript is not in an inconsistent state.
+
+        * Shared/API/c/WKSerializedScriptValue.h: fix a typo
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::runJavaScriptInMainFrame):
+
+2011-04-12  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Pressing Tab in Web Inspector's console does not cycle through completion options
+        https://bugs.webkit.org/show_bug.cgi?id=56020
+
+        Safari was always calling TranslateMessage() on key events since it has no way to know whether
+        WebKit handled the event without a PageUIClient (which Safari only installs on pages inside
+        a Safari window), which was generating a WM_CHAR message containing the tab in this case.  The fix
+        is for Safari to never call TranslateMessage() on key events outside of a Safari window, but this
+        means the WebPageProxy needs to do this for unhandled key events if there is no didNotHandleKeyEvent
+        callback in the PageUIClient.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didReceiveEvent): Call TranslateMessage() on Windows for unhandled key events that can't be handled by the PageUIClient.
+        * UIProcess/WebUIClient.cpp:
+        (WebKit::WebUIClient::canNotHandleKeyEvent): Added.
+        * UIProcess/WebUIClient.h: Added canNotHandleKeyEvent().
+
+2011-04-12  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58292
+        Provide new setting to allow site icon loading despite disabling automatic image loading in general.
+
+        * Shared/WebPreferencesStore.h: Add macro for setting default value.
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetLoadsSiteIconsIgnoringImageLoadingPreference): Added setter.
+        (WKPreferencesGetLoadsSiteIconsIgnoringImageLoadingPreference): Added getter.
+        * UIProcess/API/C/WKPreferences.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences): Add to list of WebCore settings that get propagated to WebKit preferences.
+
+2011-04-12  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Spelling and Grammar Checking: Make sure to remove the markings from the document
+        when spelling and/or grammar checking is disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=58350
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView toggleContinuousSpellChecking:]):
+        Move the call to unmark the errors to the WebProcess.
+        (-[WKView setGrammarCheckingEnabled:]):
+        Ditto.
+        (-[WKView toggleGrammarChecking:]):
+        Ditto.
+
+        * UIProcess/WebPageProxy.cpp:
+        Remove unused functions.
+        * UIProcess/WebPageProxy.h:
+        Ditto.
+        * WebProcess/WebPage/WebPage.messages.in:
+        Ditto.
+        * WebProcess/WebPage/WebPage.h:
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::setTextCheckerState):
+        If grammar or spelling checking is disabled, unmark all the pages.
+        Doing it here allows makes it possible to unmark all pages in a cross-platform way that is
+        triggered both by selecting the the context menu items and by any other methods of updating
+        the enabled / disabled state.
+
+2011-04-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Cisco Meeting Center will not download or launch from Safari
+        https://bugs.webkit.org/show_bug.cgi?id=58366
+        <rdar://problem/8987139>
+
+        It's OK if a plug-in has less (or more) MIME type descriptions than actual MIME types.
+        
+        * Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:
+        (WebKit::getPluginInfoFromCarbonResources):
+
+2011-04-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Call PluginControllerProxy::platformGeometryDidChange before Plugin::geometryDidChange
+        https://bugs.webkit.org/show_bug.cgi?id=58361
+
+        Since Plugin::geometryDidChange ends up calling plug-in code it can resize the plug-in which causes
+        platformGeometryDidChange to be called with the wrong rect.
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::geometryDidChange):
+        Call platformGeometryDidChange.
+
+        * PluginProcess/PluginControllerProxy.h:
+        * PluginProcess/mac/PluginControllerProxyMac.mm:
+        (WebKit::PluginControllerProxy::platformGeometryDidChange):
+        Remove the parameters to platformGeometryDidChange and just use m_frameRect instead.
+
+2011-04-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Move three Mac specific functions to PluginControllerProxyMac.mm.
+        
+2011-04-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Cache the window and plug-in element NPObjects
+        https://bugs.webkit.org/show_bug.cgi?id=58355
+
+        * PluginProcess/PluginControllerProxy.cpp:
+        (WebKit::PluginControllerProxy::PluginControllerProxy):
+        (WebKit::PluginControllerProxy::~PluginControllerProxy):
+        (WebKit::PluginControllerProxy::windowScriptNPObject):
+        (WebKit::PluginControllerProxy::pluginElementNPObject):
+        * PluginProcess/PluginControllerProxy.h:
+
+2011-04-12  Alejandro G. Castro  <alex@igalia.com>
+
+        Fixed GTK compilation after r83454.
+
+        * UIProcess/gtk/WebView.cpp:
+        (WebKit::WebView::findStringInCustomRepresentation):
+        (WebKit::WebView::countStringMatchesInCustomRepresentation):
+        * UIProcess/gtk/WebView.h:
+
+2011-04-11  Daniel Bates  <dbates@webkit.org>
+
+        Attempt to fix the Qt Linux Release build after changeset 83550 <http://trac.webkit.org/changeset/83550>
+        (https://bugs.webkit.org/show_bug.cgi?id=54159).
+
+        * WebKit2API.pri: Append UIProcess/API/C/WKResourceCacheManager.cpp to the list WEBKIT2_API_SOURCES.
+
+2011-04-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move focus management out of WebKit via  the UIClient
+        <rdar://problem/8784068>
+        https://bugs.webkit.org/show_bug.cgi?id=58278
+
+        * UIProcess/API/C/WKPage.h:
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        * UIProcess/API/qt/qwkpage.cpp:
+        (QWKPage::QWKPage):
+        * UIProcess/API/qt/qwkpage_p.h:
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::setFocus):
+        * UIProcess/WebUIClient.cpp:
+        (WebKit::WebUIClient::focus):
+        (WebKit::WebUIClient::unfocus):
+        * UIProcess/WebUIClient.h:
+        * UIProcess/gtk/WebView.cpp:
+        * UIProcess/gtk/WebView.h:
+        * UIProcess/win/WebView.h:
+        Remove PageClient::setFocus() in favor of WebUIClient::focus and WebUIClient::unfocus. 
+
+2011-04-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Cannot use Ctrl-Delete as a custom keyboard shortcut
+        https://bugs.webkit.org/show_bug.cgi?id=58265
+        <rdar://problem/9221468>
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::keyEvent): Added a comment explaining that doing work after DOM event
+        dispatch isn't great.
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::performNonEditingBehaviorForSelector): Added a comment explaining how this
+        might be moved down to WebCore.
+        (WebKit::WebPage::performDefaultBehaviorForKeyEvent): This is now empty, since both Space
+        and Backspace behaviors are implemented in WebCore.
+
+2011-04-11  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * UIProcess/win/WebInspectorProxyWin.cpp:
+        (WebKit::WebInspectorProxy::platformCreateInspectorPage):
+
+2011-04-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r83081): Esc key no longer removes current Kotoeri text operation
+        https://bugs.webkit.org/show_bug.cgi?id=58274
+        <rdar://problem/9263683>
+
+        * WebProcess/WebPage/mac/WebPageMac.mm: (WebKit::WebPage::getMarkedRange): Wrap the returned
+        temporary in RefPtr.
+
+2011-04-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove m_urlAtProcessExit from WebPageProxy
+        https://bugs.webkit.org/show_bug.cgi?id=58275
+
+        Get rid of m_urlAtProcessExit and replace some zeros with nullptrs.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::processDidCrash):
+        * UIProcess/WebPageProxy.h:
+
+2011-04-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove the WebContext member variable from WebPageProxy
+        https://bugs.webkit.org/show_bug.cgi?id=58271
+        <rdar://problem/9148125>
+
+        * UIProcess/API/C/WKPage.cpp:
+        (WKPageGetContext):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::create):
+        (WebKit::WebPageProxy::WebPageProxy):
+        (WebKit::WebPageProxy::process):
+        (WebKit::WebPageProxy::reattachToWebProcess):
+        (WebKit::WebPageProxy::canShowMIMEType):
+        (WebKit::WebPageProxy::receivedPolicyDecision):
+        (WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didCommitLoadForFrame):
+        (WebKit::WebPageProxy::didFinishDocumentLoadForFrame):
+        (WebKit::WebPageProxy::didFinishLoadForFrame):
+        (WebKit::WebPageProxy::didFailLoadForFrame):
+        (WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
+        (WebKit::WebPageProxy::didReceiveTitleForFrame):
+        (WebKit::WebPageProxy::didFirstLayoutForFrame):
+        (WebKit::WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame):
+        (WebKit::WebPageProxy::didRemoveFrameFromHierarchy):
+        (WebKit::WebPageProxy::didDisplayInsecureContentForFrame):
+        (WebKit::WebPageProxy::didRunInsecureContentForFrame):
+        (WebKit::WebPageProxy::decidePolicyForNavigationAction):
+        (WebKit::WebPageProxy::decidePolicyForNewWindowAction):
+        (WebKit::WebPageProxy::decidePolicyForResponse):
+        (WebKit::WebPageProxy::unableToImplementPolicy):
+        (WebKit::WebPageProxy::willSubmitForm):
+        (WebKit::WebPageProxy::mouseDidMoveOverElement):
+        (WebKit::WebPageProxy::showContextMenu):
+        (WebKit::WebPageProxy::contextMenuItemSelected):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::createWebPage):
+        * UIProcess/mac/WebInspectorProxyMac.mm:
+        (WebKit::WebInspectorProxy::platformCreateInspectorPage):
+
+2011-04-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Ignore context change callbacks when not on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=58256
+        <rdar://problem/9266090>
+
+        * WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp:
+        (WebKit::LayerTreeHostCAWin::contextDidChangeCallback): Do nothing when not called
+            on the main thread. This should only happen when no changes have actually 
+            been committed to the context, eg. when a video frame has been added to an image
+            queue, so return without triggering animations etc.
+
+2011-04-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        First step towards simplifying WebPageProxy/WebProcessProxy/WebContext ownership
+        https://bugs.webkit.org/show_bug.cgi?id=58266
+        <rdar://problem/9148125>
+
+        With this patch, the WKView holds a strong reference to a WebPageProxy. The 
+        WebPageProxy in turn holds a strong reference to its WebProcessProxy. Finally,
+        The WebProcessProxy holds a strong reference to its WebContext.
+
+        The WebContext holds a strong reference to the running WebProcessProxy which results
+        in a reference cycle that's broken when the web process exits.
+
+        The reason for is to avoid crashes where WebPageProxy::process() returns null if the web process
+        has crashed but has not yet been relaunched.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::disconnectProcess):
+        Add comment.
+
+        (WebKit::WebContext::createWebPage):
+        Return a PassRefPtr.
+
+        (WebKit::WebContext::relaunchProcessIfNecessary):
+        Change this to return a WebPageProxy.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::create):
+        This now takes a PassRefPtr<WebProcessProxy>.
+
+        (WebKit::WebPageProxy::WebPageProxy):
+        Ditto.
+
+        (WebKit::WebPageProxy::~WebPageProxy):
+        Call close() if necessary.
+
+        (WebKit::WebPageProxy::reattachToWebProcess):
+        Replace the current process with the new process.
+
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::create):
+        Take a PassRefPtr<WebContext>.
+        
+        (WebKit::WebProcessProxy::WebProcessProxy):
+        Ditto.
+
+        (WebKit::WebProcessProxy::webPage):
+        Remove .get() now that the page map uses weak references.
+
+        (WebKit::WebProcessProxy::createWebPage):
+        This now returns the created web page proxy.
+
+2011-04-11  Adam Roben  <aroben@apple.com>
+
+        Dispatch sent messages to windows owned by the web process when waiting a sync CoreIPC reply
+
+        On Windows, windowed plugins' HWNDs are created as children of the WKView's window. This
+        creates a cross-process window hierarchy, which in turn attaches the input states of the UI
+        process's and web process's main threads (as if ::AttachThreadInput has been called). Having
+        the input states attached means that changes to the input state (e.g., changing the focus
+        window) can result in synchronous window messages being sent between the processes. This can
+        result in deadlocks if the UI process changes the input state while handling a synchronous
+        CoreIPC message from the web process. Since the web process isn't running its message loop
+        while waiting for the reply, it never processes the messages Windows is sending it from the
+        UI process.
+
+        The solution taken in this patch is to continue to dispatch sent (not posted) messages to
+        windows created by the web process while waiting for a sync CoreIPC reply. Someday we can
+        hopefully reduce the number of cases in which the UI process modifies the thread's input
+        state while handling a synchronous message; see the bug for details.
+
+        Fixes <http://webkit.org/b/58239> <rdar://problem/8769302> REGRESSION (WebKit2): Deadlock
+        clicking Flash plugin
+
+        Reviewed by Anders Carlsson.
+
+        * Platform/CoreIPC/BinarySemaphore.h:
+        (CoreIPC::BinarySemaphore::event): Added. Simple getter to expose the underlying event
+        HANDLE.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::SyncMessageState::waitWhileDispatchingSentMessages): New Windows-only
+        function that is used instead of wait() so that sent messages will continue to be
+        dispatched.
+        (CoreIPC::Connection::waitForSyncReply): Use waitWhileDispatchingSentMessages instead of
+        wait on Windows. Our Client gives us the set of windows that need to have windows delivered
+        to them.
+
+        * Platform/CoreIPC/Connection.h: Added new
+        windowsToReceiveSentMessagesWhileWaitingForSyncReply function to Client.
+
+        * Platform/RunLoop.h: Added new dispatchSentMessagesUntil function to be used while waiting
+        for a sync CoreIPC reply.
+
+        * Platform/win/RunLoopWin.cpp:
+        (RunLoop::dispatchSentMessagesUntil): Added. If we have no windows to dispatch messages to,
+        then just wait on the semaphore. Otherwise spin a ::MsgWaitForMultipleObjectsEx loop to
+        detect when the semaphore is signaled, the timeout elapses, or sent messages are available,
+        and handle each case appropriately.
+
+        * UIProcess/WebProcessProxy.h: Added new CoreIPC::Connection::Client function.
+
+        * UIProcess/win/WebProcessProxyWin.cpp: Added.
+        (WebKit::WebProcessProxy::windowsToReceiveSentMessagesWhileWaitingForSyncReply): Just return
+        an empty Vector. The web process never modifies the thread's input state while responding to
+        a synchronous message, so we don't have anything to worry about here.
+
+        * WebProcess/WebProcess.h: Added new CoreIPC::Connection::Client function.
+
+        * WebProcess/win/WebProcessWin.cpp:
+        (WebKit::addWindowToVectorIfOwnedByCurrentThread): New helper function to be called by
+        ::EnumThreadWindows/::EnumChildWindows. Does what it says.
+        (WebKit::WebProcess::windowsToReceiveSentMessagesWhileWaitingForSyncReply): Added. Returns
+        all top-level windows created by this thread, descendants of those windows created by this
+        thread, and descendants of WKViews' windows created by this thread.
+
+        * win/WebKit2.vcproj: Added WebProcessProxyWin.cpp.
+
+2011-04-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Implement TextChecker on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57862
+
+        Part 7: Implement getGuessesForWord, learnWord, and ignoreWord.
+
+        * UIProcess/API/C/win/WKTextChecker.cpp:
+        (WKTextCheckerChangeSpellingToWord):
+        * UIProcess/API/C/win/WKTextChecker.h:
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::changeSpellingToWord):
+        Make this function const since it does not modify the WebPageProxy and making it const
+        allows WebTextChecker::changeSpellingToWord to take a const WebPageProxy.
+        (WebKit::WebPageProxy::learnWord):
+        * UIProcess/WebPageProxy.h:
+
+        * UIProcess/TextChecker.h:
+        * UIProcess/win/TextCheckerWin.cpp:
+        (WebKit::TextChecker::getGuessesForWord):
+        Ask the TextCheckerClient for the guesses.
+        (WebKit::TextChecker::learnWord):
+        Tell the TextCheckerClient.
+        (WebKit::TextChecker::ignoreWord):
+        Ditto.
+        * UIProcess/gtk/TextCheckerGtk.cpp:
+        (WebKit::TextChecker::learnWord):
+        Add an unused param that is necessary for Windows.
+        * UIProcess/mac/TextCheckerMac.mm:
+        (WebKit::TextChecker::learnWord):
+        Ditto.
+        * UIProcess/qt/TextCheckerQt.cpp:
+        (WebKit::TextChecker::learnWord):
+        Ditto.
+
+        * UIProcess/win/WebTextChecker.cpp:
+        (WebKit::WebTextChecker::changeSpellingToWord):
+        Tell the page.
+        * UIProcess/win/WebTextChecker.h:
+
+        * UIProcess/win/WebTextCheckerClient.cpp:
+        (WebKit::WebTextCheckerClient::guessesForWord):
+        (WebKit::WebTextCheckerClient::learnWord):
+        (WebKit::WebTextCheckerClient::ignoreWord):
+        * UIProcess/win/WebTextCheckerClient.h:
+
+2011-04-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove unused WebProcessProxy functions
+        https://bugs.webkit.org/show_bug.cgi?id=58262
+
+        * UIProcess/WebProcessProxy.cpp:
+        * UIProcess/WebProcessProxy.h:
+
+2011-04-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash in WebPageProxy::countStringMatches
+        https://bugs.webkit.org/show_bug.cgi?id=58255
+        <rdar://problem/9243837>
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::countStringMatches):
+        Return early if the page is not valid.
+
+2011-04-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: links don’t update to look visited
+        <rdar://problem/8806254>
+        https://bugs.webkit.org/show_bug.cgi?id=58252
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::visitedLinkStateChanged):
+        (WebKit::WebProcess::allVisitedLinkStateChanged):
+        * WebProcess/WebProcess.h:
+        Remove use of vestigial sharedPageGroup and instead iterate set of
+        page groups in use by the process.
+
+2011-04-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Windows 7 Gestures Window Bounce shouldn't require a sync message
+        https://bugs.webkit.org/show_bug.cgi?id=58167
+        <rdar://problem/9259813>
+        
+        Instead of making GestureDidScroll sync, have WebPageWin call from WebProcess ->
+        UIProcess when the gesture causes the page to scroll to the beginning or the
+        end of the document.
+
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::gestureDidScroll): Not a sync message anymore.
+        (WebKit::WebPageProxy::setGestureScrollingLimitReached): Tell the page client that the gesture
+            scrolling limnit was reached.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in: Add a new message.
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::WebView): Initialize new variable.
+        (WebKit::WebView::onGesture): Use the state of the member variable, not the response from
+            the sync message.
+        * UIProcess/win/WebView.h:
+        (WebKit::WebView::setGestureScrollingLimitReached):
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in:
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::scrollbarAtTopOfBottomOrDocument): Returns whether or not the scrollbar is at the
+            top or bottom of the document.
+        (WebKit::WebPage::gestureDidScroll): Track whether or not we started at the beginning
+            or end of the document, and whether or not we ended at the beginning or end of the document,
+            and send a message if the value changed.
+
+2011-04-04  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WK2: PDF: Find in page
+        https://bugs.webkit.org/show_bug.cgi?id=57765
+
+        Support searching text within PDF documents.  Find requests must be routed from the
+        WebPageProxy, through the PageClient, and to the WKView, where they can be passed to 
+        the PDFViewController.
+
+        * UIProcess/API/mac/PDFViewController.h:
+        * UIProcess/API/mac/PDFViewController.mm:
+        (_PDFSelectionsAreEqual): Copied from WebPDFView.
+        (-[WKPDFView _nextMatchFor:direction:caseSensitive:wrap:fromSelection:startInSelection:]): Copied from WebPDFView.
+        (-[WKPDFView _countMatches:caseSensitive:]): Added.
+        (WebKit::PDFViewController::findString): Added.
+        (WebKit::PDFViewController::countStringMatches): Added.
+        * UIProcess/PageClient.h:
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::findStringInCustomRepresentation): Added.
+        (WebKit::PageClientImpl::countStringMatchesInCustomRepresentation): Added.
+        * UIProcess/API/mac/WKViewInternal.h:
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView _findStringInCustomRepresentation:withFindOptions:maxMatchCount:]): Added.
+        (-[WKView _countStringMatchesInCustomRepresentation:withFindOptions:maxMatchCount:]): Added.
+        * UIProcess/WebPageProxy.h: Moved a number of find-related functions from private: to public: so
+            they could be called from PDFViewController.
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::findString): Added. 
+        (WebKit::WebPageProxy::countStringMatches): Added.
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::findStringInCustomRepresentation): Added stub.
+        (WebKit::WebView::countStringMatchesInCustomRepresentation): Ditto.
+        * UIProcess/win/WebView.h:
+        * UIProcess/API/qt/qwkpage_p.h:
+        (QWKPagePrivate::findStringInCustomRepresentation): Added stub.
+        (QWKPagePrivate::countStringMatchesInCustomRepresentation): Added stub.
+
+2011-04-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Implement TextChecker on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57862
+
+        Part 6: Update the Spelling UI with the spelling and grammar mistakes.
+
+        * UIProcess/API/C/win/WKAPICastWin.h:
+        (WebKit::toAPI):
+        Make it possible to go from a WebCore::GrammarDetail to a WebGrammarDetail.
+ 
+        * UIProcess/API/C/win/WKGrammarDetail.cpp:
+        (WKGrammarDetailCreate):
+        (WKGrammarDetailGetLocation):
+        (WKGrammarDetailGetLength):
+        (WKGrammarDetailCopyGuesses):
+        (WKGrammarDetailCopyUserDescription):
+        * UIProcess/API/C/win/WKGrammarDetail.h:
+
+        * UIProcess/API/C/win/WKTextChecker.cpp:
+        (WKTextCheckerCheckSpelling):
+        Tell the WebTextChecker.
+        * UIProcess/API/C/win/WKTextChecker.h:
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::contextMenuItemSelected):
+        If the show/hide spelling UI is selected and the spelling UI is not showing, make sure to
+        advance to the next misspelling (in this case, the first).
+        This behavior matches that in WebCore and WKView.mm.
+        (WebKit::WebPageProxy::advanceToNextMisspelling):
+        Make this function const since it does not modify the WebPageProxy and making it const
+        allows WebTextChecker::checkSpelling to take a const WebPageProxy.
+        (WebKit::WebPageProxy::spellDocumentTag):
+        (WebKit::WebPageProxy::updateSpellingUIWithMisspelledWord):
+        (WebKit::WebPageProxy::updateSpellingUIWithGrammarString):
+        * UIProcess/WebPageProxy.h:
+
+        * UIProcess/TextChecker.h:
+        * UIProcess/win/TextCheckerWin.cpp:
+        (WebKit::TextChecker::uniqueSpellDocumentTag):
+        Tell the TextCheckerClient which WebPageProxy this tag is for.
+        (WebKit::TextChecker::updateSpellingUIWithMisspelledWord):
+        Tell the TextCheckerClient.
+        (WebKit::TextChecker::updateSpellingUIWithGrammarString):
+        Ditto.
+        * UIProcess/mac/TextCheckerMac.mm:
+        (WebKit::TextChecker::uniqueSpellDocumentTag):
+        Add the new argument that is unused by this port.
+        (WebKit::TextChecker::updateSpellingUIWithMisspelledWord):
+        Ditto.
+        (WebKit::TextChecker::updateSpellingUIWithGrammarString):
+        Ditto.
+        * UIProcess/gtk/TextCheckerGtk.cpp:
+        (WebKit::TextChecker::uniqueSpellDocumentTag):
+        Ditto.
+        (WebKit::TextChecker::updateSpellingUIWithMisspelledWord):
+        Ditto.
+        (WebKit::TextChecker::updateSpellingUIWithGrammarString):
+        Ditto.
+        * UIProcess/qt/TextCheckerQt.cpp:
+        (WebKit::TextChecker::uniqueSpellDocumentTag):
+        Ditto.
+        (WebKit::TextChecker::updateSpellingUIWithMisspelledWord):
+        Ditto.
+        (WebKit::TextChecker::updateSpellingUIWithGrammarString):
+        Ditto.
+
+        * UIProcess/win/WebGrammarDetail.cpp:
+        (WebKit::WebGrammarDetail::create):
+        (WebKit::WebGrammarDetail::WebGrammarDetail):
+        (WebKit::WebGrammarDetail::guesses):
+        * UIProcess/win/WebGrammarDetail.h:
+        (WebKit::WebGrammarDetail::location):
+        (WebKit::WebGrammarDetail::length):
+        (WebKit::WebGrammarDetail::userDescription):
+
+        * UIProcess/win/WebTextChecker.cpp:
+        (WebKit::WebTextChecker::checkSpelling):
+        Tell the page to advance to the next misspelling. This matches the WK1 WebView.cpp logic.
+
+        * UIProcess/win/WebTextChecker.h:
+        * UIProcess/win/WebTextCheckerClient.cpp:
+        (WebKit::WebTextCheckerClient::uniqueSpellDocumentTag):
+        (WebKit::WebTextCheckerClient::toggleSpellingUIIsShowing):
+        (WebKit::WebTextCheckerClient::updateSpellingUIWithMisspelledWord):
+        (WebKit::WebTextCheckerClient::updateSpellingUIWithGrammarString):
+        * UIProcess/win/WebTextCheckerClient.h:
+
+2011-04-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed.
+
+        Remove extra inadvertantly commiteed changes from last change.
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-04-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: WebProcess spews sandboxing violations for outbound network traffic
+        https://bugs.webkit.org/show_bug.cgi?id=58215
+        <rdar://problem/9251695>
+        
+        * WebProcess/com.apple.WebProcess.sb: Restore some previously removed rules.
+
+2011-04-10  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Require no undefined symbols during compilation.
+
+        [Qt] [WK2] WebKitTestRunner, QtWebProcess and WTRInjectBundle should fail to compile when there's undefined symbols
+        https://bugs.webkit.org/show_bug.cgi?id=54896
+        
+        Add -Wl,--no-undefined to catch missing symbols early.
+
+        * WebProcess.pro:
+
+2011-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try recommitting some things svn left out of my last commit.
+
+        * WebProcess/Plugins/Netscape/NPJSObject.h:
+
+2011-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try recommitting some things svn left out of my last commit.
+
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
+        (WebKit::NPRuntimeObjectMap::evaluate):
+
+2011-04-08  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: Safari doesn't respect cmd-arrows (and variations) as custom keyboard shortcuts
+        https://bugs.webkit.org/show_bug.cgi?id=58175
+        <rdar://problem/9060555>
+
+        The problem is that command handling should be different for events that come as keyDown:
+        and those that come as performKeyEquivalent:. WebKit1 only tries custom "key bindings"
+        when handling a keyDown:, letting a performKeyEquivalent: run through the whole responder
+        chain first.
+
+        This would be very difficult to implement in WebKit2 because of how it re-sends the same
+        event after web process handling. Luckily, we can both fix the bug and make the behavior
+        more robust by not hardcoding key combinations.
+
+        * WebProcess/WebPage/WebPage.h: Edit performNonEditingBehaviorForSelector.
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::executeKeypressCommandsInternal): When executing commands, also try
+        executing editor commands in their non-editing meaning, which is usually scrolling.
+        (WebKit::WebPage::performNonEditingBehaviorForSelector): Naive implementation with a chain
+        of ifs, which is hopefully ok performance-wise for a dozen check.
+        (WebKit::WebPage::performDefaultBehaviorForKeyEvent): Only kept two commands here that I
+        couldn't easily move.
+
+2011-04-08  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Show the substitutions panel on Mac and make sure the menu items titles are
+        updated correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=58179
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView validateUserInterfaceItem:]):
+        The title of the context menu item should be opposite of whether or not the spelling panel
+        is visible.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::contextMenuItemSelected):
+        If the "Show/Hide" Substitutions item is selected, call toggleSubstitutionsPanelIsShowing.
+        (WebKit::WebPageProxy::substitutionsPanelIsShowing):
+        Ask the TextChecker.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+
+        * UIProcess/TextChecker.h:
+        * UIProcess/mac/TextCheckerMac.mm:
+        (WebKit::TextChecker::substitutionsPanelIsShowing):
+        As the shared NSSpellChecker if the substitutionsPanel is visible.
+        (WebKit::TextChecker::toggleSubstitutionsPanelIsShowing):
+        Order the substitutionsPanel out or front (copied from WKView.mm).
+
+        * WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
+        (WebKit::WebEditorClient::substitutionsPanelIsShowing):
+        Send a sync message to the UI process to find out.
+        It needs to be sync because the editor code relies on the value returned.
+
+2011-04-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fixed a bug where right-to-left frames incorrectly reported that they were pinned to the left
+        when they were actually not.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::didChangeScrollOffsetForMainFrame): Do not assume that the minimum scroll offset
+        is zero, because it is not.
+
+2011-04-08  Anders Carlsson  <andersca@apple.com>
+
+        Fix the Windows build.
+
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::Drop):
+
+2011-04-08  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Implement TextChecker on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57862
+
+        Part 5: Implement the code show and hide the Spelling UI via the context menu item (both
+        Windows and Mac).
+
+        * UIProcess/API/C/win/WKTextChecker.h:
+        Add the new WKTextCheckerClient funtions.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView validateUserInterfaceItem:]):
+        The title of the context menu item should be opposite of whether or not the spelling panel
+        is visible.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::contextMenuItemSelected):
+        If the "Show/Hide Spelling and Grammar" item is selected, call toggleSpellingUIIsShowing.
+        (WebKit::WebPageProxy::spellingUIIsShowing):
+        Call through to TextChecker.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+
+        * UIProcess/TextChecker.h:
+       * UIProcess/win/TextCheckerWin.cpp:
+        (WebKit::TextChecker::spellingUIIsShowing):
+        Call the TextCheckerClient.
+        (WebKit::TextChecker::toggleSpellingUIIsShowing):
+        Ditto.
+        * UIProcess/mac/TextCheckerMac.mm:
+        (WebKit::TextChecker::spellingUIIsShowing):
+        Ask the shared NSSpellChecker if the spellingPanel is visible.
+        (WebKit::TextChecker::toggleSpellingUIIsShowing):
+        Order the spellingPanel out or front (copied from WKView.mm).
+        * UIProcess/qt/TextCheckerQt.cpp:
+        (WebKit::TextChecker::spellingUIIsShowing):
+        Call notImplemented.
+        (WebKit::TextChecker::toggleSpellingUIIsShowing):
+        Ditto.
+        * UIProcess/gtk/TextCheckerGtk.cpp:
+        (WebKit::TextChecker::spellingUIIsShowing):
+        Ditto.
+        (WebKit::TextChecker::toggleSpellingUIIsShowing):
+        Ditto.
+ 
+        * UIProcess/win/WebTextCheckerClient.cpp:
+        (WebKit::WebTextCheckerClient::spellingUIIsShowing):
+        Call the client.
+        (WebKit::WebTextCheckerClient::toggleSpellingUIIsShowing):
+        Ditto.
+        * UIProcess/win/WebTextCheckerClient.h:
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::spellingUIIsShowing):
+        Send a sync message to the UI process to find out.
+        It needs to be sync because the Editor code relies on the value returned.
+
+2011-04-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Sandboxing doesn't work if a local file is dropped on the content area
+        https://bugs.webkit.org/show_bug.cgi?id=58177
+        <rdar://problem/9019253>
+
+        When performing a drag and the dragging pasteboard contains a local file, create a
+        sandbox extension and pass it along. If we end up loading the file, the sandbox extension
+        tracker will consume the extension.
+
+        * UIProcess/API/mac/WKView.mm:
+        (maybeCreateSandboxExtensionFromPasteboard):
+        Add helper function.
+
+        (-[WKView performDragOperation:]):
+        Create a sandbox extension handle and pass it to performDrag.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::dragEntered):
+        (WebKit::WebPageProxy::dragUpdated):
+        (WebKit::WebPageProxy::dragExited):
+        Pass an empty sandbox extension handle to performDragControllerAction.
+
+        (WebKit::WebPageProxy::performDrag):
+        Pass the sandbox extension handle along to performDragControllerAction.
+
+        (WebKit::WebPageProxy::performDragControllerAction):
+        Send along the sandbox extension handle.
+
+        * WebProcess/WebCoreSupport/WebDragClient.cpp:
+        (WebKit::WebDragClient::willPerformDragDestinationAction):
+        If the destination action is a load action, call WebPage::willPerformLoadDragDestinationAction.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::performDragControllerAction):
+        Create a sandbox extension.
+
+        (WebKit::WebPage::willPerformLoadDragDestinationAction):
+        If we have a sandbox extension, pass it along to the sandbox extension tracker.
+
+        (WebKit::WebPage::SandboxExtensionTracker::willPerformLoadDragDestinationAction):
+        Call setPendingProvisionalSandboxExtension.
+
+        (WebKit::WebPage::SandboxExtensionTracker::beginLoad):
+        Call setPendingProvisionalSandboxExtension.
+
+        (WebKit::WebPage::SandboxExtensionTracker::setPendingProvisionalSandboxExtension):
+        Factor code from beginLoad out into a separate function.
+
+        * WebProcess/WebPage/WebPage.messages.in:
+        PerformDragControllerAction now takes a sandbox extension handle.
+
+2011-04-08  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58151
+        Crash after closing a Webview, in WebKit!WebCore::WindowMessageBroadcaster::SubclassedWndProc
+
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::close):
+        Resolve a difference between old WebKit WebView and WebKit2 WebView by destroying and clearing
+        out WebKit2 WebView's HWND when closing. Not doing so was causing the WebView to remain in the
+        list of WindowMessageBroadcaster listeners, and after closing the WebView, WindowMessageBroadcaster
+        would message a dead WebView and crash.
+
+2011-04-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make the drag operations be different functions
+        https://bugs.webkit.org/show_bug.cgi?id=58169
+
+        Since we want performDrag to take a sandbox extension, separate the four
+        drag operations out into different functions. No functionality change.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView draggingEntered:]):
+        (-[WKView draggingUpdated:]):
+        (-[WKView draggingExited:]):
+        (-[WKView performDragOperation:]):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::dragEntered):
+        (WebKit::WebPageProxy::dragUpdated):
+        (WebKit::WebPageProxy::dragExited):
+        (WebKit::WebPageProxy::performDrag):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::DragEnter):
+        (WebKit::WebView::DragOver):
+        (WebKit::WebView::DragLeave):
+        (WebKit::WebView::Drop):
+
+2011-04-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Parse 'DispatchOnConnectionQueue' in messages.in files
+        https://bugs.webkit.org/show_bug.cgi?id=58168
+
+        Handle parsing multiple, space-separated attributes in .messages.in files. Keep track of
+        'DispatchOnConnectionQueue' and rename 'delayed' to 'Delayed'.
+
+        * Scripts/webkit2/messages.py:
+        * Scripts/webkit2/messages_unittest.py:
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Alder.
+
+        REGRESSION (WebKit2): AppKit thinks that web views don't support DocumentAccess
+        https://bugs.webkit.org/show_bug.cgi?id=58102
+        <rdar://problem/9223246>
+
+        * UIProcess/API/mac/WKView.h:
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView doCommandBySelector:]):
+        (-[WKView insertText:replacementRange:]):
+        (-[WKView validAttributesForMarkedText]):
+        (-[WKView setMarkedText:selectedRange:replacementRange:]):
+        (-[WKView attributedSubstringForProposedRange:actualRange:]):
+        (-[WKView firstRectForCharacterRange:actualRange:]):
+        Switch to NSTextInputClient, opting out of optimizations and optional features for now.
+
+2011-04-08  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Qt][WK2][Symbian] Remove use of stack arrays with variable size
+        https://bugs.webkit.org/show_bug.cgi?id=57877
+
+        For better compiler portability, use new/delete for arrays when size
+        isn't known at compile time. Also fix one compiler warning about bitshift
+        operations on signed integer
+        * Platform/CoreIPC/unix/ConnectionUnix.cpp:
+        (CoreIPC::Connection::readyReadHandler):
+        (CoreIPC::Connection::sendOutgoingMessage):
+
+2011-04-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix the WebKit2 build for older versions of GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=58095
+
+        * UIProcess/gtk/ChunkedUpdateDrawingAreaProxyGtk.cpp: Include the GtkVersioning.h header.
+
+2011-04-07  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [WK2][Qt][GTK] Introduce common use flag for the shared UNIX domain socket IPC implementation
+        https://bugs.webkit.org/show_bug.cgi?id=58030
+
+        Replace "PLATFORM(QT) || PLATFORM(GTK)" conditions in IPC code with
+        USE(UNIX_DOMAIN_SOCKETS).
+
+        * Platform/CoreIPC/Attachment.h:
+        * Platform/CoreIPC/Connection.h:
+        * Platform/SharedMemory.h:
+
+2011-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Clicks not recognized on http://www.nibblestutorials.net/ which uses Silverlight
+        https://bugs.webkit.org/show_bug.cgi?id=58108
+        <rdar://problem/9167611>
+
+        Change platformHandleMouseEvent to return true, which means that the plug-in has handled the
+        event. Some plug-ins (like Silverlight) will return false from NPP_HandleEvent even though the
+        event has been handled. In this case it lead to a very subtle bug where the plug-in element would
+        lose focus right after a mouse down even had been sent.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::NetscapePlugin::platformHandleMouseEvent):
+
+2011-04-07  Adam Roben  <aroben@apple.com>
+
+        Pass NPP_SetWindow a null window handle during plugin destruction on non-Mac platforms
+
+        This matches WebKit1.
+
+        Fixes <http://webkit.org/b/47009> WebKit2 needs to call NPP_SetWindow when destroying a
+        plugin
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
+        (WebKit::NetscapePlugin::destroy): Null out our NPWindow's window handle and pass it to
+        NPP_SetWindow (unless we're on Mac).
+
+2011-04-08  Jamie Cooley  <james.cooley@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt][WK2] Make sure qwkhistory.h is copied into includes/WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=57945
+
+        * UIProcess/API/qt/WKView.h:
+        * UIProcess/API/qt/qwkhistory.h:
+
+2011-04-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Do not destroy WorkQueue event sources unless they have been cancelled
+        https://bugs.webkit.org/show_bug.cgi?id=57611
+
+        * Platform/WorkQueue.h:
+        * Platform/gtk/WorkQueueGtk.cpp:
+        (WorkQueue::EventSource::EventSource): Remove unused member
+        m_dispatchSource.
+        (WorkQueue::EventSource::executeEventSource): Make it return void
+        instead of boolean since we are always ignoring the return value.
+        (WorkQueue::EventSource::performWork): Return FALSE from the
+        callback only when the source has been cancelled (condition = 0)
+        to make sure it's destroyed when the even source handler is
+        unregistered.
+        (WorkQueue::registerEventSourceHandler): Use GRefPtr for the
+        source, to avoid leaking it.
+        (WorkQueue::scheduleWorkOnSource): Receive the source callback as
+        parameter so that it can be used by scheduleWorkOnTermination() too.
+        (WorkQueue::scheduleWork):
+        (WorkQueue::scheduleWorkAfterDelay):
+        (WorkQueue::scheduleWorkOnTermination): Use
+        scheduleWorkOnSource().
+
+2011-04-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Close connection when web process finishes
+        https://bugs.webkit.org/show_bug.cgi?id=57540
+
+        * Platform/CoreIPC/Connection.h:
+        * Platform/CoreIPC/unix/ConnectionUnix.cpp:
+        * Platform/PlatformProcessIdentifier.h: Use GPid as process
+        identifier.
+        * Platform/WorkQueue.h:
+        * Platform/gtk/WorkQueueGtk.cpp:
+        (WorkQueue::EventSource::EventSource): Add cancellable parameter.
+        (WorkQueue::EventSource::cancel): New method to cancel the source.
+        (WorkQueue::EventSource::performWorkOnTermination): New method to
+        execute a work item called when child process has finished.
+        (WorkQueue::registerEventSourceHandler): Create a GCancellable for
+        the socket source.
+        (WorkQueue::unregisterEventSourceHandler): Cancel the source
+        instead of destroying it, this will cause the source to trigger
+        with condition = 0, which makes the callback return FALSE and the
+        source is destroyed.
+        (WorkQueue::scheduleWorkOnSource): Pass NULL as cancellable for
+        idle and timeout sources.
+        (WorkQueue::scheduleWorkOnTermination): Create a child watch
+        source to monitor the child process.
+        * UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp:
+        (WebKit::ProcessLauncher::launchProcess): Use GPid instead of int
+        as process identifier.
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didFinishLaunching): Call
+        WorkQueue::scheduleWorkOnTermination() for GTK platform too when
+        web process has been launched.
+
+2011-04-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement scheduleWorkAfterDelay() in WorkQueueGtk
+        https://bugs.webkit.org/show_bug.cgi?id=57434
+
+        * Platform/WorkQueue.h:
+        * Platform/gtk/WorkQueueGtk.cpp:
+        (WorkQueue::EventSource::executeEventSource): This new method
+        contains the common code to execute a work item.
+        (WorkQueue::EventSource::performWorkOnce): Use
+        executeEventSource() to execute the work item.
+        (WorkQueue::EventSource::performWork): Use executeEventSource() to
+        execute the work item.
+        (WorkQueue::registerEventSourceHandler): Use a GSocket instead of
+        a GIOChannel since the API is newer and allows us to pass a
+        cancellable object to be able to cancel the source.
+        (WorkQueue::scheduleWorkOnSource): This new method contains the
+        common code to attach a source to a context. It doesn't use a lock
+        anymore, since g_source_attach() uses its own mutex internally.
+        (WorkQueue::scheduleWork): Use an idle source instead of a timeout
+        one, changing the priority to G_PRIORITY_DEFAULT.
+        (WorkQueue::scheduleWorkAfterDelay): Implement it using a timeout
+        source with the given delay.
+
+2011-04-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use glib API instead of fork + execl in ProcessLauncherGtk
+        https://bugs.webkit.org/show_bug.cgi?id=57234
+
+        * UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp:
+        (WebKit::childSetupFunction): close the socket and use prctl()
+        when platform is Linux to kill the child process when the parent
+        finishes.
+        (WebKit::ProcessLauncher::launchProcess): Use g_spawn_async() to
+        launch the web process.
+
+2011-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Some Handle<T> cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=58109
+
+        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
+        (WebKit::NPJSObject::NPJSObject): Updated for new null constructor.
+
+2011-04-07  Jessie Berlin  <jberlin@apple.com>
+
+        Max build fix.
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::checkSpellingOfString):
+        Do not risk an overflow.
+        (WebKit::WebEditorClient::checkGrammarOfString):
+        Ditto.
+
+2011-04-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Brian Weinstein.
+
+        WebKit2: Implement TextChecker on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57862
+
+        Part 4: Implement checkGrammarOfString.
+
+        * Scripts/webkit2/messages.py:
+        The generated files should include TextCheckerClient.h for WebCore::GrammarDetail.
+
+        * Shared/API/c/win/WKBaseWin.h:
+        * Shared/APIObject.h:
+        * UIProcess/API/C/win/WKAPICastWin.h:
+
+        * UIProcess/API/C/win/WKGrammarDetail.cpp: Added.
+        (WKGrammarDetailGetTypeID):
+        (WKGrammarDetailCreate):
+        * UIProcess/API/C/win/WKGrammarDetail.h: Added.
+
+        * UIProcess/API/C/win/WKTextChecker.h:
+        Add the checkGrammarOfString WKTextCheckerClient function.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::checkGrammarOfString):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+
+        * UIProcess/TextChecker.h:
+        * UIProcess/win/TextCheckerWin.cpp:
+        (WebKit::TextChecker::checkGrammarOfString):
+        Call the TextCheckerClient.
+        * UIProcess/mac/TextCheckerMac.mm:
+        (WebKit::TextChecker::checkSpellingOfString):
+        Add a comment about this not being used on Mac.
+        (WebKit::TextChecker::checkGrammarOfString):
+        Ditto, and call notImplemented.
+        * UIProcess/gtk/TextCheckerGtk.cpp:
+        (WebKit::TextChecker::checkGrammarOfString):
+        Call notImplemented.
+        * UIProcess/qt/TextCheckerQt.cpp:
+        (WebKit::TextChecker::checkGrammarOfString):
+        Ditto.
+
+        * UIProcess/win/WebGrammarDetail.cpp: Added.
+        (WebKit::WebGrammarDetail::create):
+        (WebKit::WebGrammarDetail::WebGrammarDetail):
+        Initialize the underlying WebCore::GrammarDetail.
+        * UIProcess/win/WebGrammarDetail.h: Added.
+        (WebKit::WebGrammarDetail::grammarDetail):
+        (WebKit::WebGrammarDetail::type):
+
+        * UIProcess/win/WebTextCheckerClient.cpp:
+        (WebKit::WebTextCheckerClient::checkGrammarOfString):
+        Populate the Vector of WebCore::GrammarDetails with the WebGrammarDetails.
+        * UIProcess/win/WebTextCheckerClient.h:
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::checkSpellingOfString):
+        Use WTF::notFound as the initial value for resultLocation.
+        (WebKit::WebEditorClient::checkGrammarOfString):
+        Send a sync message to the UI Process (similar to checkSpellingOfString and checkTextOfParagraph).
+
+        * win/WebKit2.vcproj:
+        Add WKGrammarDetail.h/.cpp and WebGrammarDetail.h/.cpp.
+        * win/WebKit2Generated.make:
+        Copy over WKGrammarDetail.h.
+
+2011-04-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION(WebKit2): execCommand('undo') doesn't work (Windows).
+        https://bugs.webkit.org/show_bug.cgi?id=58056
+        <rdar://problem/8862023>
+        
+        Adding support for execCommand('undo') and execCommand('redo')
+        in WebKit2 for Windows.
+
+        * UIProcess/API/C/win/WKView.h:
+        * UIProcess/win/WebUndoClient.cpp:
+        (WebKit::WebUndoClient::canUndoRedo):
+        (WebKit::WebUndoClient::executeUndoRedo):
+        * UIProcess/win/WebUndoClient.h:
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::canUndoRedo):
+        (WebKit::WebView::executeUndoRedo):
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the WebKit2 GTK+ build for older versions of GTK+.
+
+        * WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp: Include the GtkVersioning.h header.
+
+2011-04-07   Amruth Raj  <amruthraj@motorola.com> and Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [GTK] Implement SharedMemory for WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=49791
+
+        Share the SharedMemory, Attachment and Connection implementations with the Qt port.
+        Both implementation are, in fact, general Unix implementations using standard Unix
+        domain sockets and sendmsg / recvmsg. This should reduce the amount of duplicated code
+        greatly and lay the groundwork for GTK+/Qt implementations for other operating systems.
+
+        * GNUmakefile.am: Replaced GTK+ versions of files with the Unix ones.
+        * Platform/CoreIPC/ArgumentDecoder.cpp: Extended Qt #ifdefs to include GTK.
+        (CoreIPC::ArgumentDecoder::~ArgumentDecoder):
+        * Platform/CoreIPC/ArgumentEncoder.cpp: Ditto.
+        (CoreIPC::ArgumentEncoder::~ArgumentEncoder):
+        * Platform/CoreIPC/Attachment.h: Ditto.
+        * Platform/CoreIPC/Connection.h: Combined the GTK+ and Qt sections.
+        * Platform/CoreIPC/unix/AttachmentUnix.cpp: Renamed from Source/WebKit2/Platform/CoreIPC/qt/AttachmentQt.cpp.
+        * Platform/CoreIPC/unix/ConnectionUnix.cpp: Renamed from Source/WebKit2/Platform/CoreIPC/qt/ConnectionQt.cpp.
+        * Platform/unix/SharedMemoryUnix.cpp: Renamed from Source/WebKit2/Platform/qt/SharedMemoryQt.cpp.
+        * UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp:
+        (WebKit::ProcessLauncher::launchProcess): Use SOCK_DGRAM instead of SOCK_STREAM to match Qt.
+        * WebKit2.pro: Updated source list to reflect file renaming.
+
+2011-04-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brian Weinstein.
+
+        REGRESSION (r83081): Use of deallocated memory in WebEditorClient::respondToChangedSelection()
+        https://bugs.webkit.org/show_bug.cgi?id=58082
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp: (WebKit::WebEditorClient::respondToChangedSelection):
+        Now that the Range is used outside the full expression where it's created, it needs to be
+        protected with RefPtr.
+
+2011-04-07  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/9251566> WebBackForwardList::createCFDictionaryRepresentation's current item index
+        doesn't account for items removed by filter callback.
+
+        * UIProcess/cf/WebBackForwardListCF.cpp:
+        (WebKit::WebBackForwardList::createCFDictionaryRepresentation): Update the current item index
+        when we omit an item due to the filter callback.
+
+2011-04-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (WebKit2): Reverse conversion doesn't work in Kotoeri
+        https://bugs.webkit.org/show_bug.cgi?id=58066
+        <rdar://problem/8965302>
+
+        * Scripts/webkit2/messages.py:
+        * Shared/mac/AttributedString.h: Added.
+        * Shared/mac/AttributedString.mm: Added.
+        (WebKit::AttributedString::encode):
+        (WebKit::AttributedString::decode):
+        Added an class that wraps NSAttributedString. As far as I can tell, one can't pass a CF
+        or NS object to another process without wrapping it in a C++ one.
+        
+        * Shared/mac/ArgumentCodersMac.h: Added.
+        * Shared/mac/ArgumentCodersMac.mm: Added.
+        Added coders for Foundation objects, similar to ArgumentCodersCF. There are two reasons why
+        these are needed:
+        1) Even though most Foundation objects are toll free bridged with CF, CFGetTypeID() doesn't
+        work properly for them (I've been just getting 1).
+        2) NSColor isn't toll free bridged to CF.
+        This adds just the types necessary for editing NSAttributedString (and I don't yet know what
+        happens with attachments).
+
+        * UIProcess/API/mac/WKView.mm: (-[WKView attributedSubstringFromRange:]):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/mac/WebPageProxyMac.mm:
+        (WebKit::WebPageProxy::getAttributedSubstringFromRange):
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in:
+        Boilerplate code for making a sync call to web process.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm: (WebKit::WebPage::getAttributedSubstringFromRange):
+        Ported from WebHTMLView.
+
+2011-04-07  Jeff Miller  <jeffm@apple.com>
+
+        Mac build fix.
+
+        * Shared/WebString.h:
+        (WebKit::WebString::getCharacters): Add explict cast when using std::min().
+
+2011-04-07  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Replace WKStringGetCharactersPtr() with WKStringGetCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=58058
+        
+        WKStringGetCharactersPtr() exposes the internal implementation of WKString, so change this to WKStringGetCharacters(), which makes a UTF-16 copy.
+
+        * Shared/API/c/WKString.cpp:
+        (WKStringGetCharacters): Added, replaces WKStringGetCharactersPtr().
+        * Shared/API/c/WKString.h: Replaced WKStringGetCharactersPtr() with WKStringGetCharacters().
+        * Shared/WebString.h:
+        (WebKit::WebString::getCharacters): Added.
+
+2011-04-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Support window bounce when panning.
+        https://bugs.webkit.org/show_bug.cgi?id=58065
+        <rdar://problem/9244367>
+        
+        Make gestureDidScroll synchronous, as once we scroll, we need to know
+        whether or not we are at the beginning or end of the scrollable document.
+        
+        If we are at either end of the scrollable document, we call the Windows 7
+        API to bounce the window to give an indication that you are past an end
+        of the document.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::gestureDidScroll): Pass a boolean for the reply, and return it.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::WebView): Inititalize a new variable.
+        (WebKit::WebView::onGesture): Once we send the message to scroll, check if have gone to
+            an end of the document, and if we have, bounce the window.
+        * UIProcess/win/WebView.h:
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in: GestureDidScroll is now sync.
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::WebPage::gestureDidScroll): When we are done scrolling, check if we have a vertical
+            scrollbar and if we are at the beginning or the end of the scrollable document.
+
+2011-04-07  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.isPageBoxVisible
+        https://bugs.webkit.org/show_bug.cgi?id=42695
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleIsPageBoxVisible):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::isPageBoxVisible):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+
+2011-04-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION(WebKit2): execCommand('undo') doesn't work (Mac).
+        https://bugs.webkit.org/show_bug.cgi?id=58055
+        <rdar://problem/8862023>
+        
+        Adding support for execCommand('undo') and execCommand('redo')
+        in WebKit2 for Mac.
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::canUndoRedo): Added interaction with undomanager.
+        (WebKit::PageClientImpl::executeUndoRedo): Added interaction with undomanager.
+        
+        Added new empty PageClient methods for other platforms.
+        * UIProcess/API/qt/qwkpage.cpp:
+        (QWKPagePrivate::canUndoRedo):
+        (QWKPagePrivate::executeUndoRedo):
+        * UIProcess/API/qt/qwkpage_p.h:
+        * UIProcess/PageClient.h:
+        * UIProcess/gtk/WebView.cpp:
+        (WebKit::WebView::canUndoRedo):
+        (WebKit::WebView::executeUndoRedo):
+        * UIProcess/gtk/WebView.h:
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::canUndoRedo):
+        (WebKit::WebView::executeUndoRedo):
+        * UIProcess/win/WebView.h:
+
+        * UIProcess/WebEditCommandProxy.cpp:
+        (WebKit::WebEditCommandProxy::unapply): Added flag to allow dispatching
+        of asychronous messages while waiting for a sync message reply.
+        (WebKit::WebEditCommandProxy::reapply): Same as above.
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::canUndoRedo):
+        (WebKit::WebPageProxy::executeUndoRedo):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp: Added missing implementation.
+        (WebKit::WebEditorClient::canUndo):
+        (WebKit::WebEditorClient::canRedo):
+        (WebKit::WebEditorClient::undo):
+        (WebKit::WebEditorClient::redo):
+
+2011-04-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9250368> and https://bugs.webkit.org/show_bug.cgi?id=58062
+
+        * UIProcess/API/C/WKIconDatabase.cpp:
+        (WKIconDatabaseClose):
+        * UIProcess/API/C/WKIconDatabase.h:
+        
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::close):
+        * UIProcess/WebIconDatabase.h:
+
+2011-04-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Implement TextChecker on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57862
+ 
+        Part 3: Implement checkSpellingOfString
+
+        In WebCore, checkTextOfParagraph is only defined and used on platforms where
+        WTF_USE_UNIFIED_TEXT_CHECKING is defined (which right now is only non-Leopard and non-Tiger
+        Mac builds).
+ 
+        On other platforms, checkSpellingOfString and checkGrammarOfString (coming in a separate
+        patch in an attempt to keep things easier to review) are used.
+
+        * UIProcess/API/C/win/WKTextChecker.h:
+        * UIProcess/TextChecker.h:
+        Surround checkTextOfParagraph by #if USE(UNIFIED_TEXT_CHECKING) and add
+        checkSpellingOfString.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::checkTextOfParagraph):
+        Surround this by #if USE(UNIFIED_TEXT_CHECKING).
+        (WebKit::WebPageProxy::checkSpellingOfString):
+        Call through to the client.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        Surround checkTextOfParagraph by #if USE(UNIFIED_TEXT_CHECKING) and add
+        checkSpellingOfString.
+
+        * UIProcess/win/TextCheckerWin.cpp:
+        (WebKit::TextChecker::checkSpellingOfString):
+        Call through to the WebTextCheckerClient.
+        * UIProcess/mac/TextCheckerMac.mm:
+        (WebKit::TextChecker::checkTextOfParagraph):
+        Surround this by #if USE(UNIFIED_TEXT_CHECKING) for clarity.
+        (WebKit::TextChecker::checkSpellingOfString):
+        Add a call to notImplemented.
+        * UIProcess/qt/TextCheckerQt.cpp:
+        (WebKit::TextChecker::checkSpellingOfString):
+        Ditto, and remove the implementation for checkTextOfParagraph.
+        * UIProcess/gtk/TextCheckerGtk.cpp:
+        (WebKit::TextChecker::checkSpellingOfString):
+        Ditto.
+
+        * UIProcess/win/WebTextCheckerClient.cpp:
+        (WebKit::WebTextCheckerClient::checkSpellingOfString):
+        * UIProcess/win/WebTextCheckerClient.h:
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::checkSpellingOfString):
+        Send a sync message to the UI Process (similar to the sync message used for
+        checkTextOfParagraph).
+
+2011-04-07  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][WK2][Symbian] Temporary build fix until native Symbian IPC is done. Implement fake socketpair() as it's not available. 
+        https://bugs.webkit.org/show_bug.cgi?id=57877
+
+        * UIProcess/Launcher/qt/ProcessLauncherQt.cpp:
+        (WebKit::socketpair): socketpair() which returns -1
+
+2011-04-07  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Memory leak in decodeResourceError
+        https://bugs.webkit.org/show_bug.cgi?id=58004
+
+        Release the local NSError after it is used to create a ResourceError
+        object assigned to the reference argument.
+
+        * Shared/mac/WebCoreArgumentCodersMac.mm:
+        (CoreIPC::decodeResourceError):
+
+2011-04-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Remove temporary WebProcess sandbox rules that are unnecessary now that plugins are in their own process
+        https://bugs.webkit.org/show_bug.cgi?id=58023
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-04-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove some no longer needed WebProcess sandbox allowances
+        https://bugs.webkit.org/show_bug.cgi?id=58015
+        <rdar://problem/9232592>
+
+        * WebProcess/com.apple.WebProcess.sb: Remove no-longer needed extra network
+        and launching privileges, since the bugs that required them are fixed.
+
+2011-04-06  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.pageSizeAndMarginsInPixels
+        https://bugs.webkit.org/show_bug.cgi?id=57984
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundlePageSizeAndMarginsInPixels):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::pageSizeAndMarginsInPixels):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+
+2011-04-06  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt][WK2][Symbian] Remove use of stack arrays with variable size
+        https://bugs.webkit.org/show_bug.cgi?id=57877
+        
+        For better compiler portability, use new/delete for arrays when size
+        isn't known at compile time. Also fix one compiler warning about bitshift
+        operations on signed integers. 
+        * Platform/CoreIPC/qt/ConnectionQt.cpp: 
+        (CoreIPC::Connection::readyReadHandler): 
+        (CoreIPC::Connection::sendOutgoingMessage):
+
+2011-04-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Support Windows 7 Gestures
+        https://bugs.webkit.org/show_bug.cgi?id=49824
+        <rdar://problem/8689728>
+        
+        Port code from WebKit1 -> WebKit2 to handle Windows 7 gestures.
+        
+        The UIProcess gets a WM_GESTURENOTIFY message, it sends a sync message to the WebProcess to ask
+        if we should allow panning. The WebProcess checks if we're in a scrollable area, and the mouse
+        isn't over a scrollbar.
+
+        The UIProcess then gets a WM_GESTURE message, and if it is a pan gesture, it sends a message to
+        the WebProcess to scroll by the amount fingers have moved since the last WM_GESTURE messeage. The
+        X and Y are reversed because panning up -> moving the page down, and vice versa.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::gestureWillBegin): Send a sync message to the WebProcess
+            to initialize the gesture. The WebProcess returns whether or not we can start a pan
+            gesture from where we are.
+        (WebKit::WebPageProxy::gestureDidScroll): Send a message to the WebProcess to scroll by
+            pan gesture.
+        (WebKit::WebPageProxy::gestureDidEnd): Send a message to the WebProcess that the gesture has ended.
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/win/WebView.cpp:
+        (WebKit::WebView::wndProc): Add WM_GESTURE and WM_GESTURENOTIFY handlers.
+        (WebKit::WebView::WebView): Initialize two new variables.
+        (WebKit::WebView::onGestureNotify): Figure out which gestures we should support based on where
+            the gesture is beginning.
+        (WebKit::WebView::onGesture): Support starting a gesture, ending a gesture, and panning.
+        * UIProcess/win/WebView.h:
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in: Add messages needed for gestures.
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::WebPage::gestureWillBegin): Set the node that the gesture started on (so we 
+            know which layer to scroll if the user pans), and determine whether or not we should allow
+            panning. If the page can't scroll, or the user is on a scrollbar, disallow panning.
+        (WebKit::WebPage::gestureDidScroll): Scroll the enclosing layer of the element the gesture
+            started on.
+        (WebKit::WebPage::gestureDidEnd): Clear the node the gesture started on.
+
+2011-04-06  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add WKStringGetCharactersPtr() and WKStringGetLength() to WebKit2 C API
+        https://bugs.webkit.org/show_bug.cgi?id=57989
+        
+        Note that WKChar, which is returned by WKStringGetCharactersPtr(), is defined the same way we define JSChar in JSStringRef.h.
+
+        * Shared/API/c/WKString.cpp:
+        (WKStringGetLength): Added.
+        (WKStringGetCharactersPtr): Added.
+        * Shared/API/c/WKString.h: Define WKChar and added WKStringGetLength() and WKStringGetCharactersPtr().
+        * Shared/WebString.h:
+        (WebKit::WebString::length): Added.
+        (WebKit::WebString::characters): Added.
+
+2011-04-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Dock stays in front of Hulu.com full screen video output
+        https://bugs.webkit.org/show_bug.cgi?id=57988
+        <rdar://problem/9216260>
+
+        Instead of using -[NSMenu setMenuBarVisible:] to toggle full screen, use
+        -[NSApp setPresentationOptions:]. Also, make the UI process the front most app before
+        setting the presentation options when exiting full screen, otherwise the dock won't
+        be restored correctly.
+
+        * PluginProcess/mac/PluginProcessShim.mm:
+        Remove some shim functions that aren't needed.
+
+        * UIProcess/Plugins/PluginProcessProxy.cpp:
+        (WebKit::PluginProcessProxy::PluginProcessProxy):
+        Initialize m_preFullscreenAppPresentationOptions.
+
+        * UIProcess/Plugins/PluginProcessProxy.h:
+        Add m_preFullscreenAppPresentationOptions.
+
+        * UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
+        (WebKit::PluginProcessProxy::enterFullscreen):
+        Change the presentation options for the app.
+
+        (WebKit::PluginProcessProxy::exitFullscreen):
+        Restore the presentation options.
+
+2011-04-06  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Expose the original URL of a WKBackForwardListItem.
+
+        Needed for <rdar://problem/9074651>.
+
+        * UIProcess/API/C/WKBackForwardListItem.cpp:
+        (WKBackForwardListItemCopyOriginalURL):
+        * UIProcess/API/C/WKBackForwardListItem.h:
+
+2011-04-06  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57973 and https://bugs.webkit.org/show_bug.cgi?id=57973
+        WK2 icon database should be able to get a CGImage of a specific size
+
+        * UIProcess/API/C/cg/WKIconDatabaseCG.cpp:
+        (WKIconDatabaseTryGetCGImageForURL): Change this API to take a requested size, and find the first matching
+          CGImage in the icon.
+        * UIProcess/API/C/cg/WKIconDatabaseCG.h:
+
+2011-04-06  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Implement TextChecker on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57862
+
+        Part 2: Implement uniqueSpellDocumentTag and closeSpellDocumentWithTag.
+
+        * UIProcess/API/C/win/WKTextChecker.h:
+        * UIProcess/win/TextCheckerWin.cpp:
+        (WebKit::TextChecker::uniqueSpellDocumentTag):
+        (WebKit::TextChecker::closeSpellDocumentWithTag):
+        * UIProcess/win/WebTextCheckerClient.cpp:
+        (WebKit::WebTextCheckerClient::uniqueSpellDocumentTag):
+        (WebKit::WebTextCheckerClient::closeSpellDocumentWithTag):
+        * UIProcess/win/WebTextCheckerClient.h:
+
+2011-04-06  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move code duplicated between the WebKit/mac and WebKit2 down to WebCore because Chromium will need it too
+        https://bugs.webkit.org/show_bug.cgi?id=54969
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::respondToChangedSelection): Moved duplicated code to WebCore
+        * WebProcess/WebPage/mac/WebPageMac.mm: Moved duplicated code to WebCore
+        (WebKit::WebPage::getMarkedRange):
+        (WebKit::WebPage::getSelectedRange):
+        (WebKit::WebPage::characterIndexForPoint):
+        (WebKit::WebPage::performDictionaryLookupAtLocation):
+
+2011-04-06  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.pageNumberForElementById
+        https://bugs.webkit.org/show_bug.cgi?id=42329
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundlePageNumberForElementById):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::pageNumberForElementById):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+
+2011-04-05  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: Drag & Drop Gmail Attachments doesn't work.
+        https://bugs.webkit.org/show_bug.cgi?id=57909
+        <rdar://problem/9103220>
+
+        Added _hitTest method to support drag and drop when the drag types cannot be matched.
+        This is the case for elements that do not place content
+        in the drag pasteboard automatically when the drag start (i.e. dragging a DIV element).
+               
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView _hitTest:dragTypes:]): Added.
+
+2011-04-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix using UNUSED_PARAM introduced in r82907
+        https://bugs.webkit.org/show_bug.cgi?id=57940
+
+        * WebProcess/ResourceCache/WebResourceCacheManager.cpp:
+        (WebKit::WebResourceCacheManager::clearCacheForOrigin):
+
+2011-04-06  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebKit2: Implement TextChecker on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57862
+
+        Part 1: Get and set the state.
+
+        * Shared/API/c/win/WKBaseWin.h:
+        * Shared/APIObject.h:
+        * UIProcess/API/C/win/WKAPICastWin.h:
+ 
+        * UIProcess/API/C/win/WKTextChecker.cpp: Added.
+        (WKTextCheckerSetClient):
+        (WKTextCheckerContinuousSpellCheckingEnabledStateChanged):
+        (WKTextCheckerGrammarCheckingEnabledStateChanged):
+        * UIProcess/API/C/win/WKTextChecker.h: Added.
+ 
+        * UIProcess/TextChecker.h:
+        * UIProcess/win/TextCheckerWin.cpp:
+        (WebKit::TextChecker::state):
+        Do the initalization for the state only once so that it is not necessary to call the client
+        every time the state is requested.
+        (WebKit::TextChecker::isContinuousSpellCheckingAllowed):
+        Call the client.
+        (WebKit::TextChecker::setContinuousSpellCheckingEnabled):
+        Update the state and tell the client.
+        (WebKit::TextChecker::setGrammarCheckingEnabled):
+        Ditto.
+        (WebKit::TextChecker::continuousSpellCheckingEnabledStateChanged):
+        Update the state.
+        (WebKit::TextChecker::grammarCheckingEnabledStateChanged):
+        Update the state.
+
+        * UIProcess/win/WebTextChecker.cpp: Added.
+        (WebKit::WebTextChecker::shared):
+        Make the WebTextChecker available globally.
+        (WebKit::WebTextChecker::WebTextChecker):
+        (WebKit::WebTextChecker::setClient):
+        (WebKit::updateStateForAllWebProcesses):
+        (WebKit::WebTextChecker::continuousSpellCheckingEnabledStateChanged):
+        Tell the TextChecker that the state has changed, and then tell the
+        WebProcessProxies to send the new state to the WebProcesses.
+        (WebKit::WebTextChecker::grammarCheckingEnabledStateChanged):
+        Ditto.
+        * UIProcess/win/WebTextChecker.h: Added.
+        (WebKit::WebTextChecker::client):
+        (WebKit::WebTextChecker::type):
+
+        * UIProcess/win/WebTextCheckerClient.cpp: Added.
+        (WebKit::WebTextCheckerClient::continuousSpellCheckingAllowed):
+        (WebKit::WebTextCheckerClient::continuousSpellCheckingEnabled):
+        (WebKit::WebTextCheckerClient::setContinuousSpellCheckingEnabled):
+        (WebKit::WebTextCheckerClient::grammarCheckingEnabled):
+        (WebKit::WebTextCheckerClient::setGrammarCheckingEnabled):
+        * UIProcess/win/WebTextCheckerClient.h: Added.
+ 
+        * win/WebKit2.vcproj:
+        Add WKTextChecker.h/.cpp, WebTextChecker.h/.cpp, and WebTextCheckerClient.h/.cpp.
+        * win/WebKit2Generated.make:
+        Copy over WKTextChecker.h.
+
+2011-04-05  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.numberOfPages
+        https://bugs.webkit.org/show_bug.cgi?id=42694
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleNumberOfPages):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::numberOfPages):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+
+2011-04-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [Mac] WebKit2: Escape key does not stop page loads when focus is on the web page
+        https://bugs.webkit.org/show_bug.cgi?id=57893
+        <rdar://problem/9130486>
+
+        * UIProcess/API/mac/PageClientImpl.h: Added executeSavedCommandBySelector.
+        * UIProcess/API/mac/PageClientImpl.mm: Renamed internal Objective-C classes to use
+        the WebKit2 Objective-C class prefix, WK, rather than the WebKit1 Objective-C class
+        prefix, Web. Removed some unneeded explicit WebKit namespace prefixes.
+        (-[WKEditCommandObjC initWithWebEditCommandProxy:]): Removed unneeded WebKit
+        namespace prefix.
+        (-[WKEditCommandObjC command]): Ditto.
+        (-[WKEditorUndoTargetObjC undoEditing:]): Updated for new class name.
+        (-[WKEditorUndoTargetObjC redoEditing:]): Ditto.
+        (WebKit::PageClientImpl::PageClientImpl): Ditto.
+        (WebKit::PageClientImpl::registerEditCommand): Ditto.
+        (WebKit::PageClientImpl::executeSavedCommandBySelector): Added.
+
+        * UIProcess/API/mac/WKView.mm: Renamed internal Objective-C categories to use the
+        WebKit2 Objective-C prefix, WK, rather than the WebKit1 Objective-C prefix, Web,
+        or no prefix at all. Tweaked use of extern "C" a little.
+        (-[WKView doCommandBySelector:]): Tweaked the comment.
+        (-[WKView _executeSavedCommandBySelector:]): Added. For use when command is not handled
+        by WebCore.
+        (-[WKResponderChainSink initWithResponderChain:]): Added. Based on the
+        WebResponderChainSink class in WebKit1.
+        (-[WKResponderChainSink detach]): Added.
+        (-[WKResponderChainSink didReceiveUnhandledCommand]): Added.
+        (-[WKResponderChainSink noResponderFor:]): Added.
+        (-[WKResponderChainSink doCommandBySelector:]): Added.
+        (-[WKResponderChainSink tryToPerform:with:]): Added.
+
+        * UIProcess/API/mac/WKViewInternal.h: Added declaration of _executeSavedCommandBySelector:
+        method. Also removed unneeded includes.
+
+        * UIProcess/PageClient.h: Added executeSavedCommandBySelector.
+        * UIProcess/WebPageProxy.h: Added executeSavedCommandBySelector.
+        * UIProcess/WebPageProxy.messages.in: Added ExecuteSavedCommandBySelector.
+
+        * UIProcess/mac/WebFullScreenManagerProxyMac.mm: Updated includes.
+
+        * UIProcess/mac/WebPageProxyMac.mm:
+        (WebKit::WebPageProxy::executeSavedCommandBySelector): Added.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::executeKeypressCommandsInternal): Send the synchronous
+        ExecuteSavedCommandBySelector message when a command is not handled by WebCore.
+
+2011-04-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Some plug-in content is displayed upside down in Unity plug-in
+        https://bugs.webkit.org/show_bug.cgi?id=57895
+        <rdar://problem/9212003>
+
+        Create the flipped geometry layer in the web process instead of the plug-in process,
+        which matches what we do in WebKit1.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::NetscapePlugin::platformPostInitialize):
+        * WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm:
+        (WebKit::PluginProxy::pluginLayer):
+
+2011-04-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure when navigating quickly between file URLs
+        https://bugs.webkit.org/show_bug.cgi?id=57884
+        <rdar://problem/9080559>
+
+        Remove bogus assertion. The pending provisional sandbox extension can be
+        non-null if the current provisional load fails because we're about to load a new
+        page that also has a sandbox extension.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::SandboxExtensionTracker::didFailProvisionalLoad):
+
+2011-04-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Grant the web process access to ~/Library/Preferences/com.apple.universalaccess.plist
+        https://bugs.webkit.org/show_bug.cgi?id=57879
+
+        The web process needs access to the unviersal access preferences to determine if full keyboard
+        access is enabled. I've filed <rdar://problem/9237619> which tracks reading this preference in the UI
+        process and sending it over to the web process whenever it changes.
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-04-05  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add parentheses around && within || to avoid clang warning.
+
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::sendDidUpdateBackingStoreState):
+
+2011-04-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add two more entries to the sandbox profile
+        https://bugs.webkit.org/show_bug.cgi?id=57875
+
+        Allow read-access to /Library/Dictionaries since WebCore::nextBreakablePosition
+        ends up calling into ICU which accesses the dictionary.
+
+        Allow Mach access to com.apple.networkd since it's used by CFNetwork.
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-04-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Invalidate callbacks if the WebPageProxy is no longer valid
+        https://bugs.webkit.org/show_bug.cgi?id=57873
+        <rdar://problem/9059717>
+
+        Audit all function calls that take callbacks and make sure to invalidate the callbacks
+        if the web page is no longer valid.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::runJavaScriptInMainFrame):
+        (WebKit::WebPageProxy::getRenderTreeExternalRepresentation):
+        (WebKit::WebPageProxy::getSourceForFrame):
+        (WebKit::WebPageProxy::getContentsAsString):
+        (WebKit::WebPageProxy::getSelectionOrContentsAsString):
+        (WebKit::WebPageProxy::getMainResourceDataOfFrame):
+        (WebKit::WebPageProxy::getResourceDataFromFrame):
+        (WebKit::WebPageProxy::getWebArchiveOfFrame):
+        (WebKit::WebPageProxy::forceRepaint):
+        (WebKit::WebPageProxy::computePagesForPrinting):
+        (WebKit::WebPageProxy::drawRectToPDF):
+        (WebKit::WebPageProxy::drawPagesToPDF):
+
+2011-04-05  Adam Roben  <aroben@apple.com>
+
+        Disable accelerated compositing on Windows machines that don't support it
+
+        This includes machines without the necessary graphics hardware, and machines without
+        WebKitQuartzCoreAdditions (like the Windows 7 Release (WebKit2 Tests) bots).
+
+        Fixes <http://webkit.org/b/57870> REGRESSION (r82960): Lots of tests crashing in
+        DrawingAreaImpl::enterAcceleratedCompositingMode on Windows 7 Release (WebKit2 Tests)
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (WebKit::LayerTreeHost::supportsAcceleratedCompositing): Added. On platforms other than
+        Windows, this always returns true.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences): Only enable accelerated compositing-related
+        preferences if the machine supports accelerated compositing.
+
+        * WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp:
+        (WebKit::LayerTreeHostCAWin::supportsAcceleratedCompositing): Added. Creates a view, asks it
+        if it can draw, and returns the result.
+
+        * WebProcess/WebPage/ca/win/LayerTreeHostCAWin.h: Added supportsAcceleratedCompositing.
+
+        * WebProcess/WebPage/win/LayerTreeHostWin.cpp: Added.
+        (WebKit::LayerTreeHost::supportsAcceleratedCompositing): Added. Calls through to
+        LayerTreeHostCAWin in configurations that support that class. Otherwise just returns false.
+
+        * win/WebKit2.vcproj: Added LayerTreeHostWin.cpp. Let VS reorder some other files.
+
+2011-04-05  Adam Roben  <aroben@apple.com>
+
+        Make accelerated compositing work in WebKit2 on Windows
+
+        LayerTreeHostCAWin uses WKCACFView to render each frame to an image, then has
+        DrawingAreaImpl send that image over to the UI process (just like it does for
+        non-accelerated rendering). It's unfortunate that this requires reading every frame back
+        from the GPU into system memory. More efficient solutions can be explored in the future.
+
+        Fixes <http://webkit.org/b/45567>.
+
+        Reviewed by Anders Carlsson.
+
+        * DerivedSources.make: Added $(WebKit2) to the VPATH so that DerivedSources.make can be
+        found when used as a target dependency. Added rules to generate a HeaderDetection.h file on
+        Windows. If we can find WebKitQuartzCoreAdditions headers, we define HAVE_WKQCA in
+        HeaderDetection.h.
+
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::setLayerHostNeedsDisplay):
+        * WebProcess/WebPage/DrawingAreaImpl.h:
+        Added setLayerHostNeedsDisplay. Lets the layer host tell the DrawingAreaImpl that it has a
+        new frame to render. This should only be called by layer hosts that participate in
+        DrawingAreaImpl's display mechanism.
+
+        * WebProcess/WebPage/LayerTreeHost.cpp:
+        (WebKit::LayerTreeHost::create): Only try to instantiate LayerTreeHostCAWin if we have
+        WebKitQuartzCoreAdditions, since it depends on that library.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences): Removed code that forced accelerated compositing to be
+        disabled on Windows.
+
+        * WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp:
+        (WebKit::registerDummyWindowClass): Registers the window class we use for the dummy window.
+        (WebKit::createDummyWindow): Creates the dummy window we pass to WKCACFView so that D3D can
+        determine the display mode, etc. (The window is never shown on screen.)
+        (WebKit::LayerTreeHostCAWin::LayerTreeHostCAWin): Initialize new members.
+        (WebKit::LayerTreeHostCAWin::platformInitialize): Create our dummy window and view and
+        associate the two. We set ourselves as the view's context's user data so that
+        PlatformCALayer can get our AbstractCACFLayerTreeHost pointer as needed.
+        (WebKit::LayerTreeHostCAWin::invalidate): Cancel any pending flushes, tear down our view,
+        and destroy the dummy window if no other layer host is using it.
+        (WebKit::LayerTreeHostCAWin::scheduleLayerFlush): Ask LayerChangesFlusher to call us back
+        soon to perform the flush.
+        (WebKit::LayerTreeHostCAWin::participatesInDisplay): Added. Returns true, since we render
+        each frame to an image.
+        (WebKit::LayerTreeHostCAWin::needsDisplay): Added. Returns true if it's now time to
+        displayReturns true if it's now time to display.
+        (WebKit::LayerTreeHostCAWin::timeUntilNextDisplay): Added. Returns how many seconds remain
+        before we need to display again.
+        (WebKit::size): Added. Helper function to get the size of a WKCACFImage.
+        (WebKit::toShareableBitmap): Added. Helper function to convert a WKCACFImage to a
+        ShareableBitmap.
+        (WebKit::LayerTreeHostCAWin::display): Added. Renders the next frame to an image and stuffs
+        the image into the UpdateInfo struct.
+        (WebKit::LayerTreeHostCAWin::sizeDidChange): Added. Tells the view about the new size.
+        (WebKit::LayerTreeHostCAWin::forceRepaint): Added. Flushes any pending changes to the view.
+        (WebKit::LayerTreeHostCAWin::contextDidChangeCallback): Added. WKCACFView calls this
+        whenever any changes made to the view or its layer tree have been flushed. Just calls
+        through to contextDidChange.
+        (WebKit::LayerTreeHostCAWin::contextDidChange): Added. Tells layers that they've started
+        animating, and tells the DrawingAreaImpl that we need to display again.
+        (WebKit::LayerTreeHostCAWin::rootLayer): Added. Gets the root layer's PlatformCALayer.
+        (WebKit::LayerTreeHostCAWin::addPendingAnimatedLayer): Added. Stores the layer so that we
+        can tell it animations have started the next time we get a contextDidChange callback.
+        (WebKit::LayerTreeHostCAWin::layerTreeDidChange): Added. Schedules a flush, unless we're
+        already in the process of flushing. This code came from WebCore::WKCACFViewLayerTreeHost.
+        (WebKit::LayerTreeHostCAWin::flushPendingLayerChangesNow): Added. Performs the flush. This
+        code was adapted from WebCore::WKCACFViewLayerTreeHost.
+
+        * WebProcess/WebPage/ca/win/LayerTreeHostCAWin.h: Wrapped this whole header in HAVE(WKQCA),
+        since this class only works when WebKitQuartzCoreAdditions is available. Added a bunch of
+        new members.
+
+2011-04-04  Adam Roben  <aroben@apple.com>
+
+        Add a way for LayerTreeHost to participate in DrawingAreaImpl's normal display mechanism
+
+        When LayerTreeHost participates in display, it renders each frame into a bitmap.
+        DrawingAreaImpl sends the bitmap to the UI process in an Update message, just like in
+        non-accelerated compositing mode. The UI process never knows that accelerated compositing is
+        going on. (When LayerTreeHost does not participate in display, as on Mac, it is responsible
+        for getting bits from the web process to the UI process.)
+
+        No LayerTreeHost uses this mechanism (yet). This patch should cause no change in behavior.
+
+        Fixes <http://webkit.org/b/57792> LayerTreeHost needs a way to render frames to a bitmap
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::forceRepaint): If the layer tree host participates in display,
+        perform a display (like in the non-accelerated case).
+        (WebKit::DrawingAreaImpl::layerHostDidFlushLayers): Don't send an
+        EnterAcceleratedCompositing message to the UI process if the layer tree host participates in
+        display. In that case, the UI process doesn't even need to know we're using accelerated
+        compositing in the web process.
+        (WebKit::DrawingAreaImpl::sendDidUpdateBackingStoreState): Go through the normal display
+        mechanism if we have a layer tree host that participates in display.
+        (WebKit::DrawingAreaImpl::didUpdate): Don't ignore DidUpdate messages when we have a layer
+        tree host that participates in display.
+        (WebKit::DrawingAreaImpl::enterAcceleratedCompositingMode): If the new layer tree host
+        participates in display, let the display timer continue to run and continue to expect
+        DidUpdate messages so that we don't interrupt the normal display mechanism. We still clear
+        out m_dirtyRegion, m_scrollRect, and m_scrollOffset, though, because the layer tree host is
+        still responsible for keeping track of those things even when it participates in display.
+        (WebKit::DrawingAreaImpl::exitAcceleratedCompositingMode): If the outgoing layer tree host
+        was participating in display, just send another Update message instead of an
+        ExitAcceleratedCompositing message, since the UI process never even knew we were using
+        accelerated compositing.
+        (WebKit::DrawingAreaImpl::displayTimerFired): If we have a layer tree host that's
+        participating in display, ask it when it next needs to display when scheduling our timer.
+
+        (WebKit::DrawingAreaImpl::scheduleDisplay):
+        (WebKit::DrawingAreaImpl::display):
+        If we have a layer tree host that's participating in display, it will keep track of its own
+        dirty region, so ask it if it needs display rather than checking our own dirty region.
+
+        (WebKit::DrawingAreaImpl::display): If we have a layer tree host that's participating in
+        display, don't bail out. Instead, tell it to display rather than asking the page to paint.
+        Moved the setting of updateInfo.viewSize earlier so that it will be set even when the layer
+        tree host is displaying. Other changes are just due to indentation.
+
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (WebKit::LayerTreeHost::participatesInDisplay):
+        (WebKit::LayerTreeHost::needsDisplay):
+        (WebKit::LayerTreeHost::timeUntilNextDisplay):
+        (WebKit::LayerTreeHost::display):
+        Stubbed out these functions. Derived classes can override them to participate in display.
+
+2011-04-04  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        [Refactoring] SpellCheckingResult should be replaced with TextCheckingResult
+        https://bugs.webkit.org/show_bug.cgi?id=56085
+        
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::requestCheckingOfString):
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+        * WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
+        (WebKit::WebEditorClient::checkTextOfParagraph):
+
+2011-04-05  Alejandro G. Castro  <alex@igalia.com>
+
+        Another compilation fix after r82929 horrible patch merge.
+
+        * UIProcess/WebPageProxy.messages.in:
+
+2011-04-05  Alejandro G. Castro  <alex@igalia.com>
+
+        Fix compilation error after r82929.
+
+        * WebProcess/WebPage/WebPage.h:
+
+2011-04-05  Amruth Raj  <amruthraj@motorola.com>, Ravi Phaneendra Kasibhatla  <ravi.kasibhatla@motorola.com> and Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement WebPage class for WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=54230
+
+        Added functions to handle the generation of commands from the
+        keycodes.
+
+        * GNUmakefile.am:
+        * Scripts/webkit2/messages.py:
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/gtk/WebPageProxyGtk.cpp:
+        (WebKit::WebPageProxy::getEditorCommandsForKeyEvent):
+        * UIProcess/gtk/WebView.cpp:
+        (WebKit::backspaceCallback):
+        (WebKit::selectAllCallback):
+        (WebKit::cutClipboardCallback):
+        (WebKit::copyClipboardCallback):
+        (WebKit::pasteClipboardCallback):
+        (WebKit::toggleOverwriteCallback):
+        (WebKit::popupMenuCallback):
+        (WebKit::showHelpCallback):
+        (WebKit::deleteFromCursorCallback):
+        (WebKit::moveCursorCallback):
+        (WebKit::WebView::WebView):
+        (WebKit::WebView::getEditorCommandsForKeyEvent):
+        * UIProcess/gtk/WebView.h:
+        (WebKit::WebView::addPendingEditorCommand):
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+        * WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp: Added.
+        (WebKit::WebEditorClient::getEditorCommandsForKeyEvent):
+        (WebKit::WebEditorClient::executePendingEditorCommands):
+        (WebKit::WebEditorClient::handleKeyboardEvent):
+        (WebKit::WebEditorClient::handleInputMethodKeydown):
+        * WebProcess/WebPage/WebPage.cpp:
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/gtk/WebPageGtk.cpp: Added.
+        (WebKit::WebPage::platformInitialize):
+        (WebKit::WebPage::platformPreferencesDidChange):
+        (WebKit::scroll):
+        (WebKit::WebPage::performDefaultBehaviorForKeyEvent):
+        (WebKit::WebPage::platformHasLocalDataForURL):
+        (WebKit::WebPage::cachedResponseMIMETypeForURL):
+        (WebKit::WebPage::platformCanHandleRequest):
+
+2011-04-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove duplicate API from WKContext
+        <rdar://problem/8727879>
+        https://bugs.webkit.org/show_bug.cgi?id=57815
+
+        Unreviewed buildfix after r82906.
+
+        Add UNUSED_PARAM to resourceCachesToClear, because
+        it is only used within #if USE(CFURLCACHE) guard.
+
+        * WebProcess/ResourceCache/WebResourceCacheManager.cpp:
+        (WebKit::WebResourceCacheManager::clearCacheForOrigin):
+
+2011-04-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brian Weinstein.
+
+        Remove duplicate API from WKContext
+        <rdar://problem/8727879>
+        https://bugs.webkit.org/show_bug.cgi?id=57815
+
+        - Remove WKContextClearResourceCaches and WKContextClearApplicationCache in favor
+          of their more modern counterparts WKResourceCacheManagerClearCacheForAllOrigins
+          and WKApplicationCacheManagerDeleteAllEntries.
+
+        - Expand clearing functionality of WKResourceCacheManager by adding type of resources
+          to clear.
+
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::WebProcessCreationParameters):
+        (WebKit::WebProcessCreationParameters::encode):
+        (WebKit::WebProcessCreationParameters::decode):
+        * Shared/WebProcessCreationParameters.h:
+        Remove clearing bools.
+
+        * UIProcess/API/C/WKAPICast.h:
+        (WebKit::toResourceCachesToClear):
+        Update for new name of enum.
+
+        * UIProcess/API/C/WKContext.cpp:
+        * UIProcess/API/C/WKContext.h:
+        Remove WKContextClearResourceCaches and WKContextClearApplicationCache.
+
+        * UIProcess/API/C/WKResourceCacheManager.cpp:
+        (WKResourceCacheManagerClearCacheForOrigin):
+        (WKResourceCacheManagerClearCacheForAllOrigins):
+        * UIProcess/API/C/WKResourceCacheManager.h:
+        Add WKResourceCachesToClear enum and use it in the clearing functions.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        (WebKit::WebContext::ensureWebProcess):
+        * UIProcess/WebContext.h:
+        * WebProcess/WebProcess.messages.in:
+        Remove clearing functions and setting of bools for clear on launch.
+
+        * UIProcess/WebFullScreenManagerProxy.cpp:
+        Remove unnecessary #include.
+
+        * UIProcess/WebResourceCacheManagerProxy.cpp:
+        (WebKit::WebResourceCacheManagerProxy::clearCacheForOrigin):
+        (WebKit::WebResourceCacheManagerProxy::clearCacheForAllOrigins):
+        * UIProcess/WebResourceCacheManagerProxy.h:
+        * WebProcess/ResourceCache/WebResourceCacheManager.cpp:
+        (WebKit::WebResourceCacheManager::clearCacheForOrigin):
+        (WebKit::WebResourceCacheManager::clearCacheForAllOrigins):
+        * WebProcess/ResourceCache/WebResourceCacheManager.h:
+        * WebProcess/ResourceCache/WebResourceCacheManager.messages.in:
+        Add enum parameter describing what type of caches to clear.
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::initializeWebProcess):
+        (WebKit::WebProcess::clearResourceCaches):
+        * WebProcess/WebProcess.h:
+        No longer need to use opaque type now that it is not a message receiver.
+
+2011-04-04  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/57384> CFNetwork and WebCore load priorities should match
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Added initialization for
+        wkSetHTTPPipeliningMaximumPriority().
+
+2011-04-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Send NPCocoaEventFlagsChanged events
+        https://bugs.webkit.org/show_bug.cgi?id=57811
+        <rdar://problem/9215600>
+
+        * Shared/WebEvent.h:
+        (WebKit::WebEvent::capsLockKey):
+        Add CapsLock modifier and getter.
+
+        * Shared/mac/WebEventFactory.mm:
+        (WebKit::modifiersForEvent):
+        Check for NSAlphaShiftKeyMask and set the CapsLockKey modifier.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::modifierFlags):
+        Check for CapsLockKey and set NSAlphaShiftKeyMask.
+
+        (WebKit::isFlagsChangedEvent):
+        Return whether a given event is a Cocoa flags changed event.
+
+        (WebKit::initializeKeyboardEvent):
+        If this is a flags changed event, set the event type to NPCocoaEventFlagsChanged.
+
+2011-04-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Don't discard the backing stores of WKViews in the key window
+        https://bugs.webkit.org/show_bug.cgi?id=57808
+        <rdar://problem/9110793>
+        <rdar://problem/9194284>
+        <rdar://problem/9222216>
+
+        * UIProcess/DrawingAreaProxy.h:
+        (WebKit::DrawingAreaProxy::setBackingStoreIsDiscardable):
+        Add empty stub.
+
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::DrawingAreaProxyImpl):
+        Initialize m_isBackingStoreDiscardable to true.
+
+        (WebKit::DrawingAreaProxyImpl::setBackingStoreIsDiscardable):
+        Set m_isBackingStoreDiscardable and schedule or stop the discard backing store timer.
+
+        (WebKit::DrawingAreaProxyImpl::discardBackingStoreSoon):
+        Don't start the timer if m_isBackingStoreDiscardable is false.
+
+        * UIProcess/DrawingAreaProxyImpl.h:
+        Add m_isBackingStoreDiscardable.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::viewStateDidChange):
+        Mark the backing store as discardable if the view is hidden or if the containing window
+        is not active.
+
+2011-04-04  Jade Han  <jade.han@nokia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Symbian build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=54977
+
+        * config.h:
+
+2011-04-04  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Adam Roben.
+
+        Add WKIconDatabase* headers to the WebKit2 export for Windows:
+        * win/WebKit2Generated.make:
+
+2011-04-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Get rid of WebContext::process() in more places
+        https://bugs.webkit.org/show_bug.cgi?id=57787
+
+        Migrate calls to WebContext::process() over to sendToAllProcesses and
+        sendToAllProcessesRelaunchingThemIfNecessary.
+
+        Add FIXMEs for things that need to be fixed in order to support multiple web processes.
+                
+        * UIProcess/Downloads/DownloadProxy.cpp:
+        (WebKit::DownloadProxy::cancel):
+        * UIProcess/Plugins/WebPluginSiteDataManager.cpp:
+        (WebKit::WebPluginSiteDataManager::getSitesWithData):
+        (WebKit::WebPluginSiteDataManager::clearSiteData):
+        * UIProcess/VisitedLinkProvider.cpp:
+        (WebKit::VisitedLinkProvider::pendingVisitedLinksTimerFired):
+        * UIProcess/WebApplicationCacheManagerProxy.cpp:
+        (WebKit::WebApplicationCacheManagerProxy::getApplicationCacheOrigins):
+        (WebKit::WebApplicationCacheManagerProxy::deleteEntriesForOrigin):
+        (WebKit::WebApplicationCacheManagerProxy::deleteAllEntries):
+        * UIProcess/WebCookieManagerProxy.cpp:
+        (WebKit::WebCookieManagerProxy::getHostnamesWithCookies):
+        (WebKit::WebCookieManagerProxy::getHTTPCookieAcceptPolicy):
+        * UIProcess/WebDatabaseManagerProxy.cpp:
+        (WebKit::WebDatabaseManagerProxy::getDatabasesByOrigin):
+        (WebKit::WebDatabaseManagerProxy::getDatabaseOrigins):
+        (WebKit::WebDatabaseManagerProxy::deleteDatabaseWithNameForOrigin):
+        (WebKit::WebDatabaseManagerProxy::deleteDatabasesForOrigin):
+        (WebKit::WebDatabaseManagerProxy::deleteAllDatabases):
+        (WebKit::WebDatabaseManagerProxy::setQuotaForOrigin):
+        * UIProcess/WebGeolocationManagerProxy.cpp:
+        (WebKit::WebGeolocationManagerProxy::providerDidChangePosition):
+        (WebKit::WebGeolocationManagerProxy::providerDidFailToDeterminePosition):
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::getLoadDecisionForIconURL):
+        (WebKit::WebIconDatabase::didFinishURLImport):
+        * UIProcess/WebKeyValueStorageManagerProxy.cpp:
+        (WebKit::WebKeyValueStorageManagerProxy::getKeyValueStorageOrigins):
+        (WebKit::WebKeyValueStorageManagerProxy::deleteEntriesForOrigin):
+        (WebKit::WebKeyValueStorageManagerProxy::deleteAllEntries):
+        * UIProcess/WebMediaCacheManagerProxy.cpp:
+        (WebKit::WebMediaCacheManagerProxy::getHostnamesWithMediaCache):
+        (WebKit::WebMediaCacheManagerProxy::clearCacheForHostname):
+        (WebKit::WebMediaCacheManagerProxy::clearCacheForAllHostnames):
+        * UIProcess/WebResourceCacheManagerProxy.cpp:
+        (WebKit::WebResourceCacheManagerProxy::getCacheOrigins):
+        (WebKit::WebResourceCacheManagerProxy::clearCacheForOrigin):
+        (WebKit::WebResourceCacheManagerProxy::clearCacheForAllOrigins):
+
+2011-04-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (WebKit2): Caps-Lock indicator sometimes doesn't appear in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=51230
+        <rdar://problem/8780989>
+
+        <rdar://problem/9015250> REGRESSION (WebKit2): Key events not fired for modifier keys
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView flagsChanged:]): Ported from WebHTMLView.
+        (-[WKView _interpretKeyEvent:withCachedTextInputState:savingCommandsTo:WebCore::]):
+        AppKit isn't happy about attempts to interpret NSFlagsChanged, but WK2 lacked the check.
+
+2011-04-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove unused AnalyzeWithLargeStack code from Windows build files
+        https://bugs.webkit.org/show_bug.cgi?id=57771
+        
+        This was used for us to build with prefast automatically,
+        but it is out-of-date and hasn't been used for some time.
+        Removing completely for now.
+
+        * win/WebKitPreBuild.cmd:
+
+2011-04-04  Anders Carlsson  <andersca@apple.com>
+
+        Attempt to fix the Windows build.
+
+        * UIProcess/win/WebContextWin.cpp:
+        (WebKit::WebContext::setShouldPaintNativeControls):
+
+2011-04-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make it easier to send a message to all processes in a context
+        https://bugs.webkit.org/show_bug.cgi?id=57776
+
+        Add WebContext::sendToAllProcesses and WebContext::sendToAllProcessesRelaunchingThemIfNecessary
+        as a first step towards getting rid of WebContext::process() and getting rid of a class of crashers
+        where WebContext::process() is null.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::initializeHistoryClient):
+        (WebKit::WebContext::languageChanged):
+        (WebKit::WebContext::setAlwaysUsesComplexTextCodePath):
+        (WebKit::WebContext::registerURLSchemeAsEmptyDocument):
+        (WebKit::WebContext::registerURLSchemeAsSecure):
+        (WebKit::WebContext::setDomainRelaxationForbiddenForURLScheme):
+        (WebKit::WebContext::setCacheModel):
+        (WebKit::WebContext::setDefaultRequestTimeoutInterval):
+        (WebKit::WebContext::clearResourceCaches):
+        (WebKit::WebContext::clearApplicationCache):
+        (WebKit::WebContext::setEnhancedAccessibility):
+        (WebKit::WebContext::startMemorySampler):
+        Use sendToAllProcesses.
+
+        (WebKit::WebContext::stopMemorySampler):
+        Use sendToAllProcesses. This is a slight policy change where we now create a sandbox extension even
+        if there's no process around. Since this is a debugging tool it seems OK to do this.
+
+        * UIProcess/WebContext.h:
+        Get rid of hasValidProcess.
+
+        (WebKit::WebContext::sendToAllProcesses):
+        If we have a process and we can send messages to it, then do so.
+
+        (WebKit::WebContext::sendToAllProcessesRelaunchingThemIfNecessary):
+        Relaunch the web process and send the message.
+
+        * UIProcess/WebCookieManagerProxy.cpp:
+        (WebKit::WebCookieManagerProxy::deleteCookiesForHostname):
+        (WebKit::WebCookieManagerProxy::deleteAllCookies):
+        (WebKit::WebCookieManagerProxy::startObservingCookieChanges):
+        (WebKit::WebCookieManagerProxy::stopObservingCookieChanges):
+        (WebKit::WebCookieManagerProxy::setHTTPCookieAcceptPolicy):
+        Use sendToAllProcesses and sendToAllProcessesRelaunchingThemIfNecessary.
+
+2011-04-04  Adam Roben  <aroben@apple.com>
+
+        Move a teensy bit of non-Mac-specific code up to LayerTreeHostCA
+
+        Fixes <http://webkit.org/b/57774> LayerTreeHostCA should know how to flip the root layer
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/WebPage/ca/LayerTreeHostCA.cpp:
+        (WebKit::LayerTreeHostCA::initialize): Cross-platformized and moved some code here...
+
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm:
+        (WebKit::LayerTreeHostCAMac::platformInitialize): ...from here.
+
+2011-04-01  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WK2: Reproducible crash when dragging out of or over Safari window.
+        https://bugs.webkit.org/show_bug.cgi?id=57654
+        <rdar://problem/9139755>
+        
+        AppKit does not retain the owner given to the pasteboard, therefore we
+        need to give the ownership of the retained pointer to NSPasteboard.
+        Also, dragImage will release the NSFilePromiseDragSource object, therefore
+        we retain it before calling dragImage to be able to control its lifetime.
+        
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::WebDragClient::declareAndWriteDragImage): Passing ownership
+        of the pointer to AppKit when providing the owner pointer to the NSPasteboard
+        object.
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::platformDragEnded): Retaining the NSFilePromiseDragSource
+        since dragImage will release it.
+
+2011-03-30  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: No "open in preview" contextual menu item for PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=57527
+
+        Add support for opening a PDF in the associated application from the
+        context menu.
+
+        * UIProcess/API/mac/PDFViewController.mm:
+        (_applicationInfoForMIMEType): Added, copied from WebKit/WebPDFView.mm
+        (-[WKPDFView _openWithFinder:]): Added.
+        (-[WKPDFView hitTest:]): Added, copied from WebKit/WebPDFView.mm.
+        (-[WKPDFView menuForEvent:]): Added, adapted from WebKit/WebPDFVie.mm.
+        (-[WKPDFView validateUserInterfaceItem:]): Added.
+
+2011-04-04  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.setAllowFileAccessFromFileURLs
+        https://bugs.webkit.org/show_bug.cgi?id=57572
+
+        * Shared/WebPreferencesStore.cpp:
+        (WebKit::WebPreferencesStore::decode):
+        (WebKit::WebPreferencesStore::overrideAllowFileAccessFromFileURLsForTestRunner):
+        * Shared/WebPreferencesStore.h:
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleSetAllowFileAccessFromFileURLs):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::setAllowFileAccessFromFileURLs):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+
+2011-04-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57683
+        Flesh out WK2 Icon Database API
+
+        For now the new API will add a client interface where the WK1 version used NSNotifications.
+
+        If we decide we'd like the granularity of specific callback functions later, 
+        they can easily be added on.
+
+        Project file nonsense:
+        * GNUmakefile.am:
+        * WebKit2.pro:
+        * WebKit2.xcodeproj/project.pbxproj:
+        * win/WebKit2.vcproj:
+
+        Add a WKIconDatabaseClient and some new API:
+        * UIProcess/API/C/WKIconDatabase.cpp:
+        (WKIconDatabaseSetIconDatabaseClient):
+        (WKIconDatabaseRemoveAllIcons):
+        (WKIconDatabaseCheckIntegrityBeforeOpening):
+        * UIProcess/API/C/WKIconDatabase.h:
+        * UIProcess/API/C/cg/WKIconDatabaseCG.cpp:
+        (WKIconDatabaseTryGetCGImageForURL): Renamed to "try" for subtle clarification.
+        * UIProcess/API/C/cg/WKIconDatabaseCG.h:
+
+        Implementations for the new APIs:
+        * UIProcess/WebIconDatabase.cpp:
+        (WebKit::WebIconDatabase::retainIconForPageURL): Remove excessive logging.
+        (WebKit::WebIconDatabase::releaseIconForPageURL): Ditto.
+        (WebKit::WebIconDatabase::imageForPageURL):
+        (WebKit::WebIconDatabase::removeAllIcons):
+        (WebKit::WebIconDatabase::checkIntegrityBeforeOpening):
+        (WebKit::WebIconDatabase::initializeIconDatabaseClient):
+        (WebKit::WebIconDatabase::didImportIconURLForPageURL): Dispatch a client callback,
+          much like the WK1 API uses notifications.
+        (WebKit::WebIconDatabase::didImportIconDataForPageURL): Ditto.
+        (WebKit::WebIconDatabase::didChangeIconForPageURL): Ditto.
+        (WebKit::WebIconDatabase::didRemoveAllIcons): Ditto.
+        * UIProcess/WebIconDatabase.h:
+        * UIProcess/WebIconDatabaseClient.cpp: Added.
+        (WebKit::WebIconDatabaseClient::didChangeIconForPageURL):
+        (WebKit::WebIconDatabaseClient::didRemoveAllIcons):
+        * UIProcess/WebIconDatabaseClient.h: Added.
+
+2011-04-04  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Main loop sources are leaked in RunLoopGtk
+        https://bugs.webkit.org/show_bug.cgi?id=57618
+
+        * Platform/RunLoop.h:
+        (RunLoop::TimerBase::isRepeating):
+        * Platform/gtk/RunLoopGtk.cpp:
+        (RunLoop::~RunLoop): Make sure main loop is currently running
+        before calling g_main_loop_quit(), RunLoop::stop() might have been
+        called.
+        (RunLoop::wakeUp): Use an idle source with default priority
+        instead of a timeout one with a 0 interval.
+        (RunLoop::TimerBase::clearTimerSource): New method to clear the
+        timer.
+        (RunLoop::TimerBase::destroyNotifyCallback): Destroy notify
+        callback called when the source is destroyed to clear the timer.
+        (RunLoop::TimerBase::timerFiredCallback): Use the same callback for
+        repeating and no repeating timers.
+        (RunLoop::TimerBase::start): g_source_attach() increments the
+        source reference counter, so use GRefPtr to make sure the source
+        is freed.
+        (RunLoop::TimerBase::stop): Use clearTimerSource().
+
+2011-04-03  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * Shared/DictionaryPopupInfo.cpp:
+        (WebKit::DictionaryPopupInfo::encode):
+        (WebKit::DictionaryPopupInfo::decode):
+        * Shared/DictionaryPopupInfo.h:
+
+2011-04-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9227839> REGRESSION: Reproducible crash in Snow Leopard when trying to show the Dictionary panel or application
+        https://bugs.webkit.org/show_bug.cgi?id=57739
+
+        * Shared/DictionaryPopupInfo.cpp:
+        (WebKit::DictionaryPopupInfo::encode): Do not encode the options dictionary on Snow Leopard.
+        (WebKit::DictionaryPopupInfo::decode): Do not decode the options dictionary on Snow Leopard.
+        * Shared/DictionaryPopupInfo.h: Removed the options member variable on Snow Leopard.
+        * Shared/Plugins/PluginQuirks.h:
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::performDictionaryLookupForRange): Do not set the options member variable on
+        Snow Leopard.
+
+2011-04-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57605
+        Frame::pageScaleFactor() should not affect getBoundingClientRect() or 
+        getClientRects()
+        -and corresponding-
+        <rdar://problem/9194541>
+
+        Add DRT support for the scaleWebView SPI.
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:
+        (WKBundlePageSetScaleAtOrigin):
+        * WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h:
+
+2011-04-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        "Search in Spotlight" broken in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=57712
+
+        Proxy spotlight searching to the UIProcess.
+
+        * UIProcess/WebPageProxy.messages.in:
+        Add new message. Re-organize messages to put all mac specific ones together.
+
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/mac/WebPageProxyMac.mm:
+        (WebKit::WebPageProxy::speak):
+        (WebKit::WebPageProxy::searchWithSpotlight):
+        Moved code to trigger spotlight here. Use WTF::String -> NSString conversion function
+        instead of relying on the built in conversion since it doesn't always work in the UIProcess.
+
+        * WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm:
+        (WebKit::WebContextMenuClient::searchWithSpotlight):
+        Post message to the UIProcess to do the searching.
+
+2011-04-02  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Specify the certificate store in WKBundleSetClientCertificate()
+        https://bugs.webkit.org/show_bug.cgi?id=57707
+
+        Include the name of the system certificate store that the client certificate came from in WKBundleSetClientCertificate().
+
+        The PCCERT_CONTEXT for the client certificate we create from the message from the UI process doesn't contain enough information to actually use it in a request, we need to get the real certificate from the certificate store (which is typically the "MY" store).
+
+        * WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp:
+        (WKBundleSetClientCertificate): Add certificateSystemStoreName to parameters.
+        * WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h: Add certificateSystemStoreName to WKBundleSetClientCertificate() parameters.
+        * WebProcess/InjectedBundle/InjectedBundle.h: Add certificateSystemStoreName to setClientCertificate() parameters.
+        * WebProcess/InjectedBundle/win/InjectedBundleWin.cpp:
+        (WebKit::InjectedBundle::setClientCertificate): Read the real certificate from the certificate store.
+
+2011-04-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Implement WKBundleFrameHasHorizontalScrollbar/WKBundleFrameHasVerticalScrollbar
+        <rdar://problem/9225772>
+        https://bugs.webkit.org/show_bug.cgi?id=57709
+
+        * WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp:
+        (WKBundleFrameHasHorizontalScrollbar):
+        (WKBundleFrameHasVerticalScrollbar):
+        * WebProcess/InjectedBundle/API/c/WKBundleFrame.h:
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::hasHorizontalScrollbar):
+        (WebKit::WebFrame::hasVerticalScrollbar):
+        * WebProcess/WebPage/WebFrame.h:
+
+2011-04-01  Jon Lee  <jonlee@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: Type-to-select doesn't work in open <select> menu (53023)
+        https://bugs.webkit.org/show_bug.cgi?id=53023
+        <rdar://problem/8907678>
+
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in: adding new setPopupMenuSelectedIndex message for windows platform
+        * UIProcess/win/WebPageProxyWin.cpp:
+        (WebKit::WebPageProxy::setPopupMenuSelectedIndex):
+        * UIProcess/win/WebPopupMenuProxyWin.h: moving setFocusedIndex() into public method
+        * WebProcess/WebCoreSupport/WebPopupMenu.cpp:
+        (WebKit::WebPopupMenu::updateFromElement): send message back to UIProcess to update the selected element
+
+2011-04-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: Assertion failure when executing a complex custom key binding
+        https://bugs.webkit.org/show_bug.cgi?id=57681
+
+        Also completes a fix for
+        <rdar://problem/9063782> WebKit2: Text fields in Safari don't honor custom key bindings
+
+        * UIProcess/API/mac/WKView.mm: (-[WKView hasMarkedText]): There is no need to execute saved
+        commands when they can't possibly change the result.
+
+2011-04-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Crash when calling WebPageProxy::setMemoryCacheClientCallsEnabled with an invalid Web Process
+        https://bugs.webkit.org/show_bug.cgi?id=57680
+        <rdar://problem/9202909>
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::setMemoryCacheClientCallsEnabled): Add an isValid check before sending
+            the message.
+
+2011-03-31  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Save as PDF in Safari provides Untitled as default file name
+        https://bugs.webkit.org/show_bug.cgi?id=57529
+
+        Set the NSPrintOperation's jobTitle to the printing frame's title.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView printOperationWithPrintInfo:forFrame:]):
+
+2011-04-01  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit2: Link from PDF opens in a new tab instead of in the same tab
+        https://bugs.webkit.org/show_bug.cgi?id=57528
+
+        Notify the WebProcess that a link has been clicked so that the normal policy
+        lookup can occur.
+
+        * Shared/WebEvent.cpp:
+        (WebKit::WebEvent::WebEvent): Initialize ivars in the default constructor.
+        * Shared/WebEvent.h: Add WebEvent::NoType to Type enum.
+        * Shared/WebMouseEvent.cpp: 
+        (WebKit::WebMouseEvent::WebMouseEvent): Ditto.
+        * UIProcess/API/mac/PDFViewController.mm:
+        (-[WKPDFView PDFViewWillClickOnLink:withURL:]): Handle the delegate
+            function and override the PDFView default behavior.
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didReceiveEvent): Handle the new WebEvent::NoType enum.
+        (WebKit::WebPageProxy::linkClicked): Added.  Send event through to WebPage.
+        * UIProcess/WebPageProxy.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::linkClicked): Added.  Call loadFrameRequest().
+        * WebProcess/WebPage/WebPage.h:
+        * WebProcess/WebPage/WebPage.messages.in: Added LinkClicked.
+
+2011-04-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam "Keyword Slasher" Roben.
+
+        Remove unnecessary static keyword.
+
+        * UIProcess/API/cpp/WKRetainPtr.h:
+        (WebKit::adoptWK):
+
+2011-04-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add adoptWK to WKRetainPtr.h
+        https://bugs.webkit.org/show_bug.cgi?id=57670
+
+        * UIProcess/API/cpp/WKRetainPtr.h:
+        (WebKit::adoptWK):
+        Add shared implementation of adoptWK. Previously both WebKitTestRunner
+        and TestWebKitAPI had separate versions of it.
+
+2011-04-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Shockwave plug-in doesn't accept mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=57653
+        <rdar://problem/8483273>
+
+        Add a missing break.
+
+        * WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
+        (WebKit::NetscapePlugin::convertPoint):
+
+2011-04-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKitTestRunner needs layoutTestController.shadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=57661
+
+        * WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp:
+        (WKBundleNodeHandleGetRenderRect):
+        (WKBundleNodeHandleGetElementBounds):
+        (WKBundleNodeHandleCopyElementShadowRoot):
+        * WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h:
+        * WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:
+        (WebKit::InjectedBundleNodeHandle::elementShadowRoot):
+        * WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h:
+        Add accessor for the shadowRoot of an element in the bundle.
+
+2011-04-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit2 text input handling more like WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=57649
+
+        We now send more sync messages from UI process to Web process for NSTextInput protocol
+        methods. Some of the exchanges are avoided by pre-calculating the responses before asking
+        UI process to interpret key events, and also with each sync message sent during
+        interpretation, and which could change the state.
+
+        * Platform/CoreIPC/HandleMessage.h: (CoreIPC::callMemberFunction): Added a missing
+        specialization for a function with 6 arguments and 2 returned values.
+
+        * Scripts/webkit2/messages.py: Added TextInputState to struct list.
+
+        * Shared/WebCoreArgumentCoders.h: Fixed a bug in CompositionUnderline encoding, which only
+        encoded a part of Color field, and didn't match decoder.
+
+        * Shared/mac/TextInputState.h: Added. This is state that's needed for IM machinery and that
+        we don't want to send sync messages for. This is similar to SelectionState, but the latter
+        is only updated asynchronously, and is thus less reliable.
+
+        * UIProcess/API/mac/PageClientImpl.h: We don't "intercept", we "interpret".
+
+        * UIProcess/API/mac/PageClientImpl.mm: (WebKit::PageClientImpl::interpretKeyEvent): Pass
+        current text input state, and don't expect anything input method related in return, as input
+        methods are now sync.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView doCommandBySelector:]):
+        (-[WKView insertText:]):
+        (-[WKView keyDown:]):
+        (-[WKView _executeSavedKeypressCommands]):
+        (-[WKView inputContext]):
+        (-[WKView selectedRange]):
+        (-[WKView hasMarkedText]):
+        (-[WKView unmarkText]):
+        (-[WKView setMarkedText:selectedRange:]):
+        (-[WKView markedRange]):
+        (-[WKView attributedSubstringFromRange:]):
+        (-[WKView characterIndexForPoint:]):
+        (-[WKView firstRectForCharacterRange:]):
+        (-[WKView _interpretKeyEvent:withCachedTextInputState:savingCommandsTo:WebCore::]):
+        * UIProcess/API/mac/WKViewInternal.h:
+        * UIProcess/PageClient.h:
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/mac/WebPageProxyMac.mm:
+        (WebKit::WebPageProxy::setComposition):
+        (WebKit::WebPageProxy::confirmComposition):
+        (WebKit::WebPageProxy::insertText):
+        (WebKit::WebPageProxy::getSelectedRange):
+        (WebKit::WebPageProxy::executeKeypressCommands):
+        (WebKit::WebPageProxy::interpretQueuedKeyEvent):
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
+        (WebKit::WebEditorClient::handleKeyboardEvent):
+        (WebKit::WebEditorClient::handleInputMethodKeydown):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit::WebPage::viewFrameInWindowCoordinates):
+        * WebProcess/WebPage/WebPage.messages.in:
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::createSelectorExceptionMap):
+        (WebKit::commandNameForSelectorName):
+        (WebKit::currentTextInputState):
+        (WebKit::frameForEvent):
+        (WebKit::WebPage::executeKeypressCommandsInternal):
+        (WebKit::WebPage::handleEditingKeyboardEvent):
+        (WebKit::WebPage::setComposition):
+        (WebKit::WebPage::confirmComposition):
+        (WebKit::WebPage::insertText):
+        (WebKit::WebPage::getSelectedRange):
+        (WebKit::convertToRange):
+        (WebKit::WebPage::executeKeypressCommands):
+        (WebKit::WebPage::performDefaultBehaviorForKeyEvent):
+        Rewrote to be more like WebKit1.
+
+2011-04-01  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.setDatabaseQuota
+        https://bugs.webkit.org/show_bug.cgi?id=57568
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleSetDatabaseQuota):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::setDatabaseQuota):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+        * WebProcess/WebCoreSupport/WebDatabaseManager.h:
+
+2011-04-01  Timothy Hatcher  <timothy@apple.com>
+
+        Make momentum scroll event latching work in WebKit2 on Mac.
+
+        <rdar://problem/8751861>
+
+        Reviewed by Darin Adler.
+
+        * Shared/mac/WebEventFactory.mm:
+        (WebKit::momentumPhaseForEvent): Return a phase on older Mac system by using WKGetNSEventMomentumPhase.
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface): Remove IsLatchingWheelEvent, add GetNSEventMomentumPhase.
+
+2011-04-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Assertion failure (type == event.type()) after a web process crash
+        https://bugs.webkit.org/show_bug.cgi?id=56228
+        <rdar://problem/8806106>
+
+        This partially un-confuses the UI process about key processing state after a web process
+        crash. It may not be pefect yet - sending a KeyUp to a new process that never saw a KeyDown
+        seems weird.
+
+        * UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::processDidCrash):
+
+2011-04-01  Adam Roben  <aroben@apple.com>
+
+        Cairo build fix
+
+        * WebProcess/WebPage/LayerTreeHost.cpp: Only pull in the LayerTreeHostCA derived classes for
+        PLATFORM(CA) ports.
+
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Split LayerTreeHostCA into a base class and derived Mac and Win classes
+
+        This will make it easier to customize the Mac and Windows implementations without adding too
+        many #ifdefs.
+
+        Fixes <http://webkit.org/b/57606> Windows and Mac should use separate LayerTreeHost classes
+
+        Reviewed by Anders Carlsson.
+
+        * WebKit2.xcodeproj/project.pbxproj: Added LayerTreeHostCAMac.h.
+
+        * WebProcess/WebPage/LayerTreeHost.cpp:
+        (WebKit::LayerTreeHost::create): Create a LayerTreeHostCAMac on Mac, and LayerTreeHostCAWin
+        on Windows.
+
+        * WebProcess/WebPage/ca/LayerTreeHostCA.cpp:
+        (WebKit::LayerTreeHostCA::LayerTreeHostCA): Moved some code from here...
+        (WebKit::LayerTreeHostCA::initialize): ...to here. This function will be called after the
+        constructor returns, and thus can safely call functions that are pure virtual in this class
+        and its base class. We now pass our LayerTreeContext to platformInitialize so that our
+        derived classes can initialize it.
+        (WebKit::LayerTreeHostCA::~LayerTreeHostCA): Removed Mac-specific code.
+
+        (WebKit::LayerTreeHostCA::invalidate):
+        (WebKit::LayerTreeHostCA::sizeDidChange):
+        (WebKit::LayerTreeHostCA::forceRepaint):
+        (WebKit::LayerTreeHostCA::didPerformScheduledLayerFlush):
+        Removed platform* calls. Derived classes can just override these functions to do what they
+        need.
+
+        * WebProcess/WebPage/ca/LayerTreeHostCA.h: Removed Mac-specific pieces. Made some functions
+        virtual so that derived classes can override them.
+
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h: Added.
+
+        * WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm:
+        (WebKit::LayerTreeHostCAMac::create): Create and initialize a host.
+        (WebKit::LayerTreeHostCAMac::LayerTreeHostCAMac): Simple constructor.
+        (WebKit::LayerTreeHostCAMac::~LayerTreeHostCAMac): Moved code here from LayerTreeHostCA
+        destructor.
+        (WebKit::LayerTreeHostCAMac::platformInitialize): Removed direct uses of LayerTreeHostCA
+        data members.
+
+        (WebKit::LayerTreeHostCAMac::invalidate):
+        (WebKit::LayerTreeHostCAMac::sizeDidChange):
+        (WebKit::LayerTreeHostCAMac::forceRepaint):
+        (WebKit::LayerTreeHostCAMac::didPerformScheduledLayerFlush):
+        Renamed from platform*. Now call up to the base class.
+
+        (WebKit::LayerTreeHostCAMac::flushPendingLayerChangesRunLoopObserverCallback): Updated type.
+
+        * WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp:
+        (WebKit::LayerTreeHostCAWin::create): Create and initialize a host.
+
+        (WebKit::LayerTreeHostCAWin::LayerTreeHostCAWin):
+        (WebKit::LayerTreeHostCAWin::~LayerTreeHostCAWin):
+        (WebKit::LayerTreeHostCAWin::platformInitialize):
+        (WebKit::LayerTreeHostCAWin::scheduleLayerFlush):
+        Stubbed out.
+
+        * WebProcess/WebPage/ca/win/LayerTreeHostCAWin.h: Added.
+
+        * win/WebKit2.vcproj: Added LayerTreeHostCAWin.h
+
+        * win/WebKit2Apple.vsprops: Added WebProcess/WebPage/ca/win to the include path.
+
+2011-03-31  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed WinCairo build fix after r82632.
+
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::visibilityDidChange):
+
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Add SharedMemory::adopt, which can take ownership of an existing file mapping object
+
+        Fixes <http://webkit.org/b/57599> Need a way to wrap an existing file mapping object in a
+        SharedMemory
+
+        Reviewed by Anders Carlsson.
+
+        * Platform/SharedMemory.h: Added adopt.
+
+        * Platform/win/SharedMemoryWin.cpp:
+        (WebKit::SharedMemory::create): Moved code to adopt the HANDLE from here...
+        (WebKit::SharedMemory::adopt): ...to here.
+
+2011-03-31  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.clearAllDatabases
+        https://bugs.webkit.org/show_bug.cgi?id=42540
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleClearAllDatabases):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::clearAllDatabases):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+        * WebProcess/WebCoreSupport/WebDatabaseManager.h:
+
+2011-03-31  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add some more media related things to the sandbox profile.
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-03-31  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Tabbed pages redraw unnecessarily when activated
+        https://bugs.webkit.org/show_bug.cgi?id=57589
+        <rdar://problem/9218258>
+
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::visibilityDidChange):
+        If we become visible and have no backing store, make sure to call backingStoreStateDidChange
+        so that the next time we're asked to paint we'll wait for something to paint.
+
+        (WebKit::DrawingAreaProxyImpl::exitAcceleratedCompositingMode):
+        Remove now redundant call to backingStoreStateDidChange.
+
+2011-03-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Sandbox violations when playing back HTML5 video on YouTube
+        <rdar://problem/8950692>
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2011-03-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement mouseDown, mouseUp, and mouseMoveTo in WebKitTestRunner
+        https://bugs.webkit.org/show_bug.cgi?id=57573
+
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:
+        (WKBundlePageSimulateMouseDown): Added.
+        (WKBundlePageSimulateMouseUp): Added.
+        (WKBundlePageSimulateMouseMotion): Added.
+        * WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h: Added above functions.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::simulateMouseDown): Added.
+        (WebKit::WebPage::simulateMouseUp): Added.
+        (WebKit::WebPage::simulateMouseMotion): Added.
+        * WebProcess/WebPage/WebPage.h: Added above functions.
+
+2011-03-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Rename WebCore's UI_STRING to WEB_UI_STRING to not overlap with WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=57582
+
+        * PluginProcess/mac/PluginProcessMac.mm:
+        (WebKit::PluginProcess::platformInitialize):
+        * UIProcess/mac/WebInspectorProxyMac.mm:
+        (WebKit::WebInspectorProxy::platformInspectedURLChanged):
+        * WebProcess/WebCoreSupport/mac/WebErrorsMac.mm:
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::WebProcess::platformInitializeWebProcess):
+
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Specify both FILE_MAP_READ and FILE_MAP_WRITE when creating a read-write SharedMemory object
+
+        When passed to ::MapViewOfFile, FILE_MAP_WRITE implies FILE_MAP_READ, but other file mapping
+        APIs don't work that way. This bug wasn't causing any problems in practice, but it would
+        have prevented us from creating a DIB that wraps a SharedMemory object (which I noticed
+        while working on another bug).
+
+        Fixes <http://webkit.org/b/57576> File mappings used by read-write SharedMemory objects
+        aren't correctly marked as read-write after being sent over a CoreIPC::Connection
+
+        Reviewed by Brian Weinstein.
+
+        * Platform/win/SharedMemoryWin.cpp:
+        (WebKit::accessRights): Specify FILE_MAP_READ in addition to FILE_MAP_WRITE for read-write
+        SharedMemory.
+
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Quote the executable path we pass to ::CreateProcessW
+
+        This will ensure that spaces in the path will be interpreted correctly.
+
+        Fixes <http://webkit.org/b/57569> Web process sometimes fails to launch when there are
+        spaces in its path
+
+        Reviewed by Steve Falkenburg.
+
+        * UIProcess/Launcher/win/ProcessLauncherWin.cpp:
+        (WebKit::ProcessLauncher::launchProcess): Surround the executable path in quotes.
+
+2011-03-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Patch by John Harvey, reviewed and tweaked by me.
+
+        <rdar://problem/8644403> Should notify TSM that plug-ins would show a bottom input window for marked text.
+
+        * UIProcess/API/mac/WKTextInputWindowController.mm:
+        (-[WKTextInputPanel _interpretKeyEvent:string:]):
+
+2011-03-31  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan, Darin Adler, Dan Bernstein and Sam Weinig.
+
+        If a user doesn't have a Database/LocalStorage directory, it can't be created (sandbox violations)
+        https://bugs.webkit.org/show_bug.cgi?id=57561
+        <rdar://problem/9127411>
+
+        Ensure that any readwrite sandbox directories actually exist before entering the sandbox.
+
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::appendReadwriteSandboxDirectory):
+
+2011-03-31  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        <rdar://problem/9214824> Find client not told when WKPageCountStringMatches exceeds maximum
+        https://bugs.webkit.org/show_bug.cgi?id=57552
+
+        * WebProcess/WebPage/FindController.cpp:
+        (WebKit::FindController::countStringMatches):
+        Use the same technique as findString() to report kWKMoreThanMaximumMatchCount when appropriate.
+        (WebKit::FindController::findString):
+        Convert numeric_limits::max() to max() - 1 to avoid overflow case.
+
+2011-03-31  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <title> should support dir attribute
+        https://bugs.webkit.org/show_bug.cgi?id=50961
+
+        Update to new FrameLoaderClient interface.
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchDidReceiveTitle):
+        (WebKit::WebFrameLoaderClient::setTitle):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
+
+2011-03-31  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [WK2] Introduce an option for no NPAPI support
+        https://bugs.webkit.org/show_bug.cgi?id=55828
+
+        Stub out NPAPI support for platform and OS combinations that are
+        not supported yet. Ancestor patch was made by Laszlo Gombos.
+
+        * GNUmakefile.am: Add NetscapePluginModuleNone.cpp and NetscapePluginNone.cpp
+        to the build system.
+
+        * Shared/Plugins/Netscape/NetscapePluginModule.cpp:
+        Remove the sanity check because from now all combinations that
+        don't have an explicitly set plugin architecture fall into
+        the PLUGIN_ARCHITECTURE(UNSUPPORTED) category and has a stubbed
+        implementation.
+
+        * Shared/Plugins/Netscape/NetscapePluginModuleNone.cpp: Added.
+        Stubbed implementation.
+        (WebKit::NetscapePluginModule::getPluginInfo):
+        (WebKit::NetscapePluginModule::determineQuirks):
+
+        * Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp: Guard with
+        PLUGIN_ARCHITECTURE(X11).
+
+        * WebKit2.pro: Add NetscapePluginModuleNone.cpp and NetscapePluginNone.cpp
+        to the build system.
+
+        * WebProcess/Plugins/Netscape/NetscapePluginNone.cpp: Added.
+        Stubbed implementation
+        (WebKit::NetscapePlugin::platformPostInitialize):
+        (WebKit::NetscapePlugin::platformDestroy):
+        (WebKit::NetscapePlugin::platformInvalidate):
+        (WebKit::NetscapePlugin::platformGeometryDidChange):
+        (WebKit::NetscapePlugin::platformPaint):
+        (WebKit::NetscapePlugin::platformHandleMouseEvent):
+        (WebKit::NetscapePlugin::platformHandleWheelEvent):
+        (WebKit::NetscapePlugin::platformSetFocus):
+        (WebKit::NetscapePlugin::platformHandleMouseEnterEvent):
+        (WebKit::NetscapePlugin::platformHandleMouseLeaveEvent):
+        (WebKit::NetscapePlugin::platformHandleKeyboardEvent):
+
+        * WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp: Guard with
+        PLUGIN_ARCHITECTURE(X11)
+
+        * config.h: Introduce PLUGIN_ARCHITECTURE(UNSUPPORTED) as another
+        option. Make platform and OS combinations that are not supported
+        yet fall into this. Don't use Q_WS_X11 to test the window system
+        for Qt because it is not defined without including <QtGlobal>.
+        No clue about how could it work so far.
+
+2011-03-31  Vamshikrishna.Yellenki  <vamshi@motorola.com> and Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Implement MiniBrowser for Gtk port.
+        https://bugs.webkit.org/show_bug.cgi?id=48512
+
+        * Shared/API/c/gtk/WKBaseGtk.h: Add the stdbool.h include.
+
+2011-03-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9005982> Flash of white when a WKView with composited content moves on-screen
+        https://bugs.webkit.org/show_bug.cgi?id=57522
+
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::exitAcceleratedCompositingMode): Invalidate the current
+        backing store state, so that we get an update as soon as the page enters compositing mode
+        next.
+        * WebProcess/WebPage/DrawingAreaImpl.cpp:
+        (WebKit::DrawingAreaImpl::sendDidUpdateBackingStoreState): Added a call to
+        LayerTreeHost::forceRepaint() in order to flush and synchronize the layers
+        before sending the update message to the UI process.
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Sandbox violations if you navigate a file URL via something other than a click
+        <rdar://problem/9016086>
+        https://bugs.webkit.org/show_bug.cgi?id=57519
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::shouldReuseCommittedSandboxExtension):
+        Remove unnecessary restriction on extension reuse. Any type of file to file navigation
+        should be allowed.
+
+2011-03-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Clean up the sandbox parameter code
+        https://bugs.webkit.org/show_bug.cgi?id=57518
+
+        * Shared/WebProcessCreationParameters.h:
+        Make nsURLCachePath and uiProcessBundleResourcePath Strings to match the other paths we send over.
+
+        * UIProcess/mac/WebContextMac.mm:
+        (WebKit::WebContext::platformInitializeWebProcess):
+        nsURLCachePath and uiProcessBundleResourcePath are now Strings.
+
+        * WebProcess/mac/WebProcessMac.mm:
+        (WebKit::appendSandboxParameterPathInternal):
+        (WebKit::appendReadwriteConfDirectory):
+        (WebKit::appendReadonlySandboxDirectory):
+        (WebKit::appendReadwriteSandboxDirectory):
+        (WebKit::initializeSandbox):
+        Make it more clear whether the directories we're adding are readonly or readwrite. No functionality change.
+        
+        (WebKit::WebProcess::platformInitializeWebProcess):
+        nsURLCachePath is now a string.
+
+2011-03-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Downloading a file fails due to a sandbox violation if the destination path is a symlink
+        https://bugs.webkit.org/show_bug.cgi?id=57517
+        <rdar://problem/8943865>
+
+        Make sure to resolve any symlinks in the given path when creating a sandbox extension handle.
+        Note that we can't use realpath or -[NSString stringByResolvingSymlinksInPath], because those calls
+        will fail if the pointed to file doesn't exist.
+
+        * Shared/mac/SandboxExtensionMac.mm:
+        (WebKit::resolveSymlinksInPath):
+        New function that resolves all the symlinks in the given path.
+
+        (WebKit::SandboxExtension::createHandle):
+        Call resolveSymlinksInPath on the resulting path.
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Share most vsprops between Release and Production builds in releaseproduction.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=57508
+
+        * win/WebKit2Production.vsprops:
+        * win/WebKit2Release.vsprops:
+        * win/WebKit2ReleaseCairoCFLite.vsprops:
+        * win/WebKit2WebProcessProduction.vsprops:
+        * win/WebKit2WebProcessRelease.vsprops:
+        * win/WebKit2WebProcessReleaseCairoCFLite.vsprops:
+
 2011-03-30  Ivan Krstić  <ike@apple.com>
 
         Reviewed by Oliver Hunt.
@@ -1080,7 +6147,7 @@
 
 2011-03-26  Maciej Stachowiak  <mjs@apple.com>
 
-        Revert inadvertently commited changes.
+        Revert inadvertently committed changes.
 
         * WebProcess/com.apple.WebProcess.sb:
 
diff --git a/Source/WebKit2/Configurations/FeatureDefines.xcconfig b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
index 3971037..73d3a47 100644
--- a/Source/WebKit2/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
@@ -23,8 +23,8 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 // The contents of this file must be kept in sync with FeatureDefines.xcconfig in JavaScriptCore,
-// WebCore and WebKit.  Also the default values of the ENABLE_FEATURE_NAME macros in build-webkit
-// should match the values below, but they do not need to be in the same order.
+// WebCore, WebKit and WebKit2.  Also the default values of the ENABLE_FEATURE_NAME macros in
+// build-webkit should match the values below, but they do not need to be in the same order.
 
 // Keep this list of features (not enabled/disabled state) in sync with FeatureDefines.vsprops
 // and FeatureDefinesCairo.vsprops in WebKitLibraries/win/tools/vsprops.
@@ -66,6 +66,8 @@ ENABLE_DATAGRID = ;
 ENABLE_DATALIST = $(ENABLE_DATALIST_$(REAL_PLATFORM_NAME));
 ENABLE_DATALIST_macosx = ENABLE_DATALIST;
 
+ENABLE_DATA_TRANSFER_ITEMS = ;
+
 ENABLE_DEVICE_ORIENTATION = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
@@ -89,8 +91,11 @@ ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
+ENABLE_PAGE_VISIBILITY_API = ;
 ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 
+ENABLE_QUOTA = ;
+
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
@@ -107,6 +112,7 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
+ENABLE_VIDEO_TRACK = ;
 
 ENABLE_MEDIA_STATISTICS = ;
 
@@ -125,4 +131,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_QUOTA) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/Source/WebKit2/Configurations/Version.xcconfig b/Source/WebKit2/Configurations/Version.xcconfig
index e3bfad7..2b3ebe3 100644
--- a/Source/WebKit2/Configurations/Version.xcconfig
+++ b/Source/WebKit2/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 27;
+MINOR_VERSION = 30;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit2/DerivedSources.make b/Source/WebKit2/DerivedSources.make
index 6f30dd4..865050c 100644
--- a/Source/WebKit2/DerivedSources.make
+++ b/Source/WebKit2/DerivedSources.make
@@ -21,6 +21,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 VPATH = \
+    $(WebKit2) \
     $(WebKit2)/PluginProcess \
     $(WebKit2)/Shared/Plugins \
     $(WebKit2)/WebProcess/ApplicationCache \
@@ -100,3 +101,16 @@ all : \
 %Messages.h : %.messages.in $(SCRIPTS)
 	@echo Generating message receiver for $*...
 	@python $(WebKit2)/Scripts/generate-messages-header.py $< > $@
+
+# ------------------------
+
+# Windows-specific rules
+
+ifeq ($(OS),Windows_NT)
+
+all : HeaderDetection.h
+
+HeaderDetection.h : DerivedSources.make
+	if [ -f "$(WEBKITLIBRARIESDIR)/include/WebKitQuartzCoreAdditions/WebKitQuartzCoreAdditionsBase.h" ]; then echo "#define HAVE_WKQCA 1" > $@; else echo > $@; fi
+
+endif # Windows_NT
diff --git a/Source/WebKit2/GNUmakefile.am b/Source/WebKit2/GNUmakefile.am
index 837165d..2d6ad7e 100644
--- a/Source/WebKit2/GNUmakefile.am
+++ b/Source/WebKit2/GNUmakefile.am
@@ -93,13 +93,13 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/Platform/CoreIPC/CoreIPCMessageKinds.h \
 	Source/WebKit2/Platform/CoreIPC/DataReference.cpp \
 	Source/WebKit2/Platform/CoreIPC/DataReference.h \
-	Source/WebKit2/Platform/CoreIPC/gtk/ConnectionGtk.cpp \
 	Source/WebKit2/Platform/CoreIPC/HandleMessage.h \
 	Source/WebKit2/Platform/CoreIPC/MessageID.h \
 	Source/WebKit2/Platform/CoreIPC/MessageSender.h \
+	Source/WebKit2/Platform/CoreIPC/unix/AttachmentUnix.cpp \
+	Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp \
 	Source/WebKit2/Platform/gtk/ModuleGtk.cpp \
 	Source/WebKit2/Platform/gtk/RunLoopGtk.cpp \
-	Source/WebKit2/Platform/gtk/SharedMemoryGtk.cpp \
 	Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp \
 	Source/WebKit2/Platform/Logging.cpp \
 	Source/WebKit2/Platform/Logging.h \
@@ -109,6 +109,7 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/Platform/RunLoop.cpp \
 	Source/WebKit2/Platform/RunLoop.h \
 	Source/WebKit2/Platform/SharedMemory.h \
+	Source/WebKit2/Platform/unix/SharedMemoryUnix.cpp \
 	Source/WebKit2/Platform/WorkItem.h \
 	Source/WebKit2/Platform/WorkQueue.cpp \
 	Source/WebKit2/Platform/WorkQueue.h \
@@ -182,11 +183,12 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/Shared/CoreIPCSupport/InjectedBundleMessageKinds.h \
 	Source/WebKit2/Shared/CoreIPCSupport/WebContextMessageKinds.h \
 	Source/WebKit2/Shared/CoreIPCSupport/WebPageProxyMessageKinds.h \
-	Source/WebKit2/Shared/CoreIPCSupport/WebProcessProxyMessageKinds.h \
 	Source/WebKit2/Shared/DrawingAreaInfo.h \
+	Source/WebKit2/Shared/EditorState.h \
 	Source/WebKit2/Shared/FontSmoothingLevel.h \
 	Source/WebKit2/Shared/gtk/ShareableBitmapGtk.cpp \
 	Source/WebKit2/Shared/gtk/NativeWebKeyboardEventGtk.cpp \
+	Source/WebKit2/Shared/gtk/NativeWebMouseEventGtk.cpp \
 	Source/WebKit2/Shared/gtk/PlatformCertificateInfo.h \
 	Source/WebKit2/Shared/gtk/UpdateChunk.cpp \
 	Source/WebKit2/Shared/gtk/UpdateChunk.h \
@@ -204,6 +206,7 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/Shared/MutableDictionary.cpp \
 	Source/WebKit2/Shared/MutableDictionary.h \
 	Source/WebKit2/Shared/NativeWebKeyboardEvent.h \
+	Source/WebKit2/Shared/NativeWebMouseEvent.h \
 	Source/WebKit2/Shared/OriginAndDatabases.cpp \
 	Source/WebKit2/Shared/OriginAndDatabases.h \
 	Source/WebKit2/Shared/PlatformPopupMenuData.cpp \
@@ -212,6 +215,7 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/Shared/PrintInfo.h \
 	Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp \
 	Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.h \
+	Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModuleNone.cpp \
 	Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp \
 	Source/WebKit2/Shared/Plugins/NPIdentifierData.cpp \
 	Source/WebKit2/Shared/Plugins/NPIdentifierData.h \
@@ -230,7 +234,6 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/Shared/SandboxExtension.h \
 	Source/WebKit2/Shared/SecurityOriginData.h \
 	Source/WebKit2/Shared/SecurityOriginData.cpp \
-	Source/WebKit2/Shared/SelectionState.h \
 	Source/WebKit2/Shared/SessionState.cpp \
 	Source/WebKit2/Shared/SessionState.h \
 	Source/WebKit2/Shared/StringPairVector.h \
@@ -454,6 +457,8 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/UIProcess/WebHistoryClient.h \
 	Source/WebKit2/UIProcess/WebIconDatabase.cpp \
 	Source/WebKit2/UIProcess/WebIconDatabase.h \
+	Source/WebKit2/UIProcess/WebIconDatabaseClient.cpp \
+	Source/WebKit2/UIProcess/WebIconDatabaseClient.h \
 	Source/WebKit2/UIProcess/WebInspectorProxy.cpp \
 	Source/WebKit2/UIProcess/WebInspectorProxy.h \
 	Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp \
@@ -588,6 +593,7 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.h \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.h \
+	Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginNone.cpp \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp \
@@ -611,6 +617,7 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.h \
 	Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebContextMenuClientGtk.cpp \
+	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebErrorsGtk.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebFrameNetworkingContext.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebPopupMenuGtk.cpp \
@@ -651,6 +658,7 @@ libWebKit2_la_SOURCES = \
 	Source/WebKit2/WebProcess/WebPage/FindController.h \
 	Source/WebKit2/WebProcess/WebPage/gtk/ChunkedUpdateDrawingAreaGtk.cpp \
 	Source/WebKit2/WebProcess/WebPage/gtk/WebInspectorGtk.cpp \
+	Source/WebKit2/WebProcess/WebPage/gtk/WebPageGtk.cpp \
 	Source/WebKit2/WebProcess/WebPage/PageOverlay.cpp \
 	Source/WebKit2/WebProcess/WebPage/PageOverlay.h \
 	Source/WebKit2/WebProcess/WebPage/TiledDrawingArea.cpp \
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
index 44f9a9f..b80a9bf 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
@@ -47,7 +47,7 @@ ArgumentDecoder::~ArgumentDecoder()
 {
     ASSERT(m_buffer);
     fastFree(m_buffer);
-#if !PLATFORM(QT)
+#if !PLATFORM(QT) && !PLATFORM(GTK)
     // FIXME: We need to dispose of the mach ports in cases of failure.
 #else
     Deque<Attachment>::iterator end = m_attachments.end();
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp b/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
index fb0b68b..d20dc10 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
@@ -50,7 +50,7 @@ ArgumentEncoder::~ArgumentEncoder()
 {
     if (m_buffer)
         fastFree(m_buffer);
-#if !PLATFORM(QT)
+#if !PLATFORM(QT) && !PLATFORM(GTK)
     // FIXME: We need to dispose of the attachments in cases of failure.
 #else
     for (int i = 0; i < m_attachments.size(); ++i)
diff --git a/Source/WebKit2/Platform/CoreIPC/Attachment.h b/Source/WebKit2/Platform/CoreIPC/Attachment.h
index c057714..8060c64 100644
--- a/Source/WebKit2/Platform/CoreIPC/Attachment.h
+++ b/Source/WebKit2/Platform/CoreIPC/Attachment.h
@@ -39,8 +39,8 @@ public:
         Uninitialized,
 #if PLATFORM(MAC)
         MachPortType,
-        MachOOLMemoryType
-#elif PLATFORM(QT)
+        MachOOLMemoryType,
+#elif USE(UNIX_DOMAIN_SOCKETS)
         MappedMemory
 #endif
     };
@@ -48,7 +48,7 @@ public:
 #if PLATFORM(MAC)
     Attachment(mach_port_name_t port, mach_msg_type_name_t disposition);
     Attachment(void* address, mach_msg_size_t size, mach_msg_copy_options_t copyOptions, bool deallocate);
-#elif PLATFORM(QT)
+#elif USE(UNIX_DOMAIN_SOCKETS)
     Attachment(int fileDescriptor, size_t);
 #endif
 
@@ -66,7 +66,7 @@ public:
     mach_msg_size_t size() const { ASSERT(m_type == MachOOLMemoryType); return m_oolMemory.size; }
     mach_msg_copy_options_t copyOptions() const { ASSERT(m_type == MachOOLMemoryType); return m_oolMemory.copyOptions; }
     bool deallocate() const { ASSERT(m_type == MachOOLMemoryType); return m_oolMemory.deallocate; }
-#elif PLATFORM(QT)
+#elif USE(UNIX_DOMAIN_SOCKETS)
     size_t size() const { return m_size; }
 
     int releaseFileDescriptor() { int temp = m_fileDescriptor; m_fileDescriptor = -1; return temp; }
@@ -94,7 +94,7 @@ private:
             bool deallocate;
         } m_oolMemory;
     };
-#elif PLATFORM(QT)
+#elif USE(UNIX_DOMAIN_SOCKETS)
     int m_fileDescriptor;
     size_t m_size;
 #endif
diff --git a/Source/WebKit2/Platform/CoreIPC/BinarySemaphore.h b/Source/WebKit2/Platform/CoreIPC/BinarySemaphore.h
index 32b5b02..e75ed75 100644
--- a/Source/WebKit2/Platform/CoreIPC/BinarySemaphore.h
+++ b/Source/WebKit2/Platform/CoreIPC/BinarySemaphore.h
@@ -41,6 +41,10 @@ public:
     void signal();
     bool wait(double absoluteTime);
 
+#if PLATFORM(WIN)
+    HANDLE event() const { return m_event; }
+#endif
+
 private:
 #if PLATFORM(WIN)
     HANDLE m_event;
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.cpp b/Source/WebKit2/Platform/CoreIPC/Connection.cpp
index a65f065..0821ae8 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.cpp
@@ -29,6 +29,7 @@
 #include "BinarySemaphore.h"
 #include "CoreIPCMessageKinds.h"
 #include "RunLoop.h"
+#include "WebProcess.h"
 #include "WorkItem.h"
 #include <wtf/CurrentTime.h>
 
@@ -51,6 +52,13 @@ public:
         return m_waitForSyncReplySemaphore.wait(absoluteTime);
     }
 
+#if PLATFORM(WIN)
+    bool waitWhileDispatchingSentWin32Messages(double absoluteTime, const Vector<HWND>& windowsToReceiveMessages)
+    {
+        return RunLoop::dispatchSentMessagesUntil(windowsToReceiveMessages, m_waitForSyncReplySemaphore, absoluteTime);
+    }
+#endif
+
     // Returns true if this message will be handled on a client thread that is currently
     // waiting for a reply to a synchronous message.
     bool processIncomingMessage(Connection*, IncomingMessage&);
@@ -189,6 +197,7 @@ Connection::Connection(Identifier identifier, bool isServer, Client* client, Run
     , m_isServer(isServer)
     , m_syncRequestID(0)
     , m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage(false)
+    , m_shouldExitOnSyncMessageSendFailure(false)
     , m_didCloseOnConnectionWorkQueueCallback(0)
     , m_isConnected(false)
     , m_connectionQueue("com.apple.CoreIPC.ReceiveQueue")
@@ -196,6 +205,7 @@ Connection::Connection(Identifier identifier, bool isServer, Client* client, Run
     , m_inDispatchMessageCount(0)
     , m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount(0)
     , m_didReceiveInvalidMessage(false)
+    , m_defaultSyncMessageTimeout(NoTimeout)
     , m_syncMessageState(SyncMessageState::getOrCreate(clientRunLoop))
     , m_shouldWaitForSyncReplies(true)
 {
@@ -218,6 +228,13 @@ void Connection::setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcess
     m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage = flag;
 }
 
+void Connection::setShouldExitOnSyncMessageSendFailure(bool shouldExitOnSyncMessageSendFailure)
+{
+    ASSERT(!m_isConnected);
+
+    m_shouldExitOnSyncMessageSendFailure = shouldExitOnSyncMessageSendFailure;
+}
+
 void Connection::setDidCloseOnConnectionWorkQueueCallback(DidCloseOnConnectionWorkQueueCallback callback)
 {
     ASSERT(!m_isConnected);
@@ -246,6 +263,13 @@ void Connection::markCurrentlyDispatchedMessageAsInvalid()
     m_didReceiveInvalidMessage = true;
 }
 
+void Connection::setDefaultSyncMessageTimeout(double defaultSyncMessageTimeout)
+{
+    ASSERT(defaultSyncMessageTimeout != DefaultTimeout);
+
+    m_defaultSyncMessageTimeout = defaultSyncMessageTimeout;
+}
+
 PassOwnPtr<ArgumentEncoder> Connection::createSyncMessageArgumentEncoder(uint64_t destinationID, uint64_t& syncRequestID)
 {
     OwnPtr<ArgumentEncoder> argumentEncoder = ArgumentEncoder::create(destinationID);
@@ -342,14 +366,16 @@ PassOwnPtr<ArgumentDecoder> Connection::sendSyncMessage(MessageID messageID, uin
     // We only allow sending sync messages from the client run loop.
     ASSERT(RunLoop::current() == m_clientRunLoop);
 
-    if (!isValid())
+    if (!isValid()) {
+        didFailToSendSyncMessage();
         return 0;
-    
+    }
+
     // Push the pending sync reply information on our stack.
     {
         MutexLocker locker(m_syncReplyStateMutex);
         if (!m_shouldWaitForSyncReplies) {
-            m_client->didFailToSendSyncMessage(this);
+            didFailToSendSyncMessage();
             return 0;
         }
 
@@ -371,14 +397,21 @@ PassOwnPtr<ArgumentDecoder> Connection::sendSyncMessage(MessageID messageID, uin
         m_pendingSyncReplies.removeLast();
     }
 
-    if (!reply && m_client)
-        m_client->didFailToSendSyncMessage(this);
+    if (!reply)
+        didFailToSendSyncMessage();
 
     return reply.release();
 }
 
 PassOwnPtr<ArgumentDecoder> Connection::waitForSyncReply(uint64_t syncRequestID, double timeout)
 {
+    if (timeout == DefaultTimeout)
+        timeout = m_defaultSyncMessageTimeout;
+
+    // Use a really long timeout.
+    if (timeout == NoTimeout)
+        timeout = 1e10;
+
     double absoluteTime = currentTime() + timeout;
 
     bool timedOut = false;
@@ -401,10 +434,17 @@ PassOwnPtr<ArgumentDecoder> Connection::waitForSyncReply(uint64_t syncRequestID,
         }
 
         // We didn't find a sync reply yet, keep waiting.
+#if PLATFORM(WIN)
+        timedOut = !m_syncMessageState->waitWhileDispatchingSentWin32Messages(absoluteTime, m_client->windowsToReceiveSentMessagesWhileWaitingForSyncReply());
+#else
         timedOut = !m_syncMessageState->wait(absoluteTime);
+#endif
     }
 
     // We timed out.
+    if (m_client)
+        m_client->syncMessageSendTimedOut(this);
+
     return 0;
 }
 
@@ -565,6 +605,14 @@ void Connection::dispatchSyncMessage(MessageID messageID, ArgumentDecoder* argum
     sendSyncReply(replyEncoder);
 }
 
+void Connection::didFailToSendSyncMessage()
+{
+    if (!m_shouldExitOnSyncMessageSendFailure)
+        return;
+
+    exit(0);
+}
+
 void Connection::enqueueIncomingMessage(IncomingMessage& incomingMessage)
 {
     MutexLocker locker(m_incomingMessagesLock);
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.h b/Source/WebKit2/Platform/CoreIPC/Connection.h
index b6a2415..8754034 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.h
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.h
@@ -44,6 +44,9 @@
 #include <string>
 #elif PLATFORM(QT)
 class QSocketNotifier;
+#endif
+
+#if PLATFORM(QT) || PLATFORM(GTK)
 #include "PlatformProcessIdentifier.h"
 #endif
 
@@ -90,7 +93,11 @@ public:
     public:
         virtual void didClose(Connection*) = 0;
         virtual void didReceiveInvalidMessage(Connection*, MessageID) = 0;
-        virtual void didFailToSendSyncMessage(Connection*) { }
+        virtual void syncMessageSendTimedOut(Connection*) = 0;
+
+#if PLATFORM(WIN)
+        virtual Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply() = 0;
+#endif
     };
 
 #if PLATFORM(MAC)
@@ -98,9 +105,7 @@ public:
 #elif PLATFORM(WIN)
     typedef HANDLE Identifier;
     static bool createServerAndClientIdentifiers(Identifier& serverIdentifier, Identifier& clientIdentifier);
-#elif PLATFORM(QT)
-    typedef int Identifier;
-#elif PLATFORM(GTK)
+#elif USE(UNIX_DOMAIN_SOCKETS)
     typedef int Identifier;
 #endif
 
@@ -110,11 +115,12 @@ public:
 
 #if PLATFORM(MAC)
     void setShouldCloseConnectionOnMachExceptions();
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) || PLATFORM(GTK)
     void setShouldCloseConnectionOnProcessTermination(WebKit::PlatformProcessIdentifier);
 #endif
 
     void setOnlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage(bool);
+    void setShouldExitOnSyncMessageSendFailure(bool shouldExitOnSyncMessageSendFailure);
 
     // The set callback will be called on the connection work queue when the connection is closed, 
     // before didCall is called on the client thread. Must be called before the connection is opened.
@@ -128,10 +134,13 @@ public:
     void invalidate();
     void markCurrentlyDispatchedMessageAsInvalid();
 
-    static const unsigned long long NoTimeout = 10000000000ULL;
+    void setDefaultSyncMessageTimeout(double);
+
+    static const int DefaultTimeout = 0;
+    static const int NoTimeout = -1;
 
     template<typename T> bool send(const T& message, uint64_t destinationID, unsigned messageSendFlags = 0);
-    template<typename T> bool sendSync(const T& message, const typename T::Reply& reply, uint64_t destinationID, double timeout = NoTimeout);
+    template<typename T> bool sendSync(const T& message, const typename T::Reply& reply, uint64_t destinationID, double timeout = DefaultTimeout);
     template<typename T> bool waitForAndDispatchImmediately(uint64_t destinationID, double timeout);
 
     PassOwnPtr<ArgumentEncoder> createSyncMessageArgumentEncoder(uint64_t destinationID, uint64_t& syncRequestID);
@@ -208,6 +217,7 @@ private:
     void dispatchMessage(IncomingMessage&);
     void dispatchMessages();
     void dispatchSyncMessage(MessageID, ArgumentDecoder*);
+    void didFailToSendSyncMessage();
 
     // Can be called on any thread.
     void enqueueIncomingMessage(IncomingMessage&);
@@ -217,6 +227,7 @@ private:
     uint64_t m_syncRequestID;
 
     bool m_onlySendMessagesAsDispatchWhenWaitingForSyncReplyWhenProcessingSuchAMessage;
+    bool m_shouldExitOnSyncMessageSendFailure;
     DidCloseOnConnectionWorkQueueCallback m_didCloseOnConnectionWorkQueueCallback;
 
     bool m_isConnected;
@@ -227,6 +238,8 @@ private:
     unsigned m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount;
     bool m_didReceiveInvalidMessage;
 
+    double m_defaultSyncMessageTimeout;
+
     // Incoming messages.
     Mutex m_incomingMessagesLock;
     Vector<IncomingMessage> m_incomingMessages;
@@ -305,23 +318,17 @@ private:
     OwnPtr<ArgumentEncoder> m_pendingWriteArguments;
     OVERLAPPED m_writeState;
     HANDLE m_connectionPipe;
-#elif PLATFORM(QT)
+#elif USE(UNIX_DOMAIN_SOCKETS)
     // Called on the connection queue.
     void readyReadHandler();
 
     Vector<uint8_t> m_readBuffer;
     size_t m_currentMessageSize;
-    QSocketNotifier* m_socketNotifier;
     int m_socketDescriptor;
-#elif PLATFORM(GTK)
-    void readEventHandler();
-    void processCompletedMessage();
-    bool messageProcessingCompleted() { return !m_currentMessageSize; }
 
-    int m_socket;
-    Vector<uint8_t> m_readBuffer;
-    size_t m_currentMessageSize;
-    size_t m_pendingBytes;
+#if PLATFORM(QT)
+    QSocketNotifier* m_socketNotifier;
+#endif
 #endif
 };
 
diff --git a/Source/WebKit2/Platform/CoreIPC/HandleMessage.h b/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
index a99c76e..112503d 100644
--- a/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
+++ b/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
@@ -141,6 +141,12 @@ void callMemberFunction(const Arguments4<P1, P2, P3, P4>& args, Arguments1<R1>&
     (object->*function)(args.argument1, args.argument2, args.argument3, args.argument4, replyArgs.argument1);
 }
 
+template<typename C, typename MF, typename P1, typename P2, typename P3, typename P4, typename P5, typename P6, typename R1>
+void callMemberFunction(const Arguments6<P1, P2, P3, P4, P5, P6>& args, Arguments1<R1>& replyArgs, C* object, MF function)
+{
+    (object->*function)(args.argument1, args.argument2, args.argument3, args.argument4, args.argument5, args.argument6, replyArgs.argument1);
+}
+
 template<typename C, typename MF, typename P1, typename P2, typename P3, typename P4, typename P5, typename P6, typename P7, typename R1>
 void callMemberFunction(const Arguments7<P1, P2, P3, P4, P5, P6, P7>& args, Arguments1<R1>& replyArgs, C* object, MF function)
 {
@@ -171,6 +177,13 @@ void callMemberFunction(const Arguments4<P1, P2, P3, P4>& args, Arguments3<R1, R
     (object->*function)(args.argument1, args.argument2, args.argument3, args.argument4, replyArgs.argument1, replyArgs.argument2, replyArgs.argument3);
 }
 
+// Dispatch functions with delayed reply arguments.
+template<typename C, typename MF, typename P1, typename R>
+void callMemberFunction(const Arguments1<P1>& args, PassRefPtr<R> delayedReply, C* object, MF function)
+{
+    (object->*function)(args.argument1, delayedReply);
+}
+
 // Variadic dispatch functions.
 
 template<typename C, typename MF>
@@ -286,6 +299,17 @@ void handleMessageVariadic(ArgumentDecoder* argumentDecoder, ArgumentEncoder* re
     replyEncoder->encode(replyArguments);
 }
 
+template<typename T, typename C, typename MF>
+void handleMessageDelayed(Connection* connection, ArgumentDecoder* argumentDecoder, ArgumentEncoder* replyEncoder, C* object, MF function)
+{
+    typename T::DecodeType::ValueType arguments;
+    if (!argumentDecoder->decode(arguments))
+        return;
+
+    RefPtr<typename T::DelayedReply> delayedReply = adoptRef(new typename T::DelayedReply(connection, replyEncoder));
+    callMemberFunction(arguments, delayedReply.release(), object, function);
+}
+
 } // namespace CoreIPC
 
 #endif // HandleMessage_h
diff --git a/Source/WebKit2/Platform/CoreIPC/MessageID.h b/Source/WebKit2/Platform/CoreIPC/MessageID.h
index 2afb168..0b52806 100644
--- a/Source/WebKit2/Platform/CoreIPC/MessageID.h
+++ b/Source/WebKit2/Platform/CoreIPC/MessageID.h
@@ -69,7 +69,6 @@ enum MessageClass {
     MessageClassWebMediaCacheManagerProxy,
     MessageClassWebPageProxy,
     MessageClassWebProcessProxy,
-    MessageClassWebProcessProxyLegacy,
     MessageClassWebResourceCacheManagerProxy,
 
     // Messages sent by the UI process to the plug-in process.
diff --git a/Source/WebKit2/Platform/CoreIPC/gtk/ConnectionGtk.cpp b/Source/WebKit2/Platform/CoreIPC/gtk/ConnectionGtk.cpp
deleted file mode 100644
index 4b140ee..0000000
--- a/Source/WebKit2/Platform/CoreIPC/gtk/ConnectionGtk.cpp
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Portions Copyright (c) 2010 Motorola Mobility, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "Connection.h"
-
-#include "ArgumentEncoder.h"
-#include "WorkItem.h"
-#include <errno.h>
-#include <glib.h>
-#include <sys/fcntl.h>
-
-using namespace std;
-
-namespace CoreIPC {
-
-static const size_t initialMessageBufferSize = 4096;
-
-static int readBytesFromSocket(int fileDescriptor, uint8_t* ptr, size_t length)
-{
-    ASSERT(fileDescriptor > 0);
-    ASSERT(ptr);
-    ASSERT(length > 0);
-
-    ssize_t numberOfBytesRead = 0;
-    size_t pendingBytesToRead = length;
-    uint8_t* buffer = ptr;
-
-    while (pendingBytesToRead > 0) {
-        if ((numberOfBytesRead = read(fileDescriptor, buffer, pendingBytesToRead)) < 0) {
-            if (errno == EINTR)
-                numberOfBytesRead = 0;
-            else if (errno == EAGAIN || errno == EWOULDBLOCK)
-                break;
-            else
-                return 0; 
-        } else if (!numberOfBytesRead)
-            break;
-
-        buffer += numberOfBytesRead;
-        pendingBytesToRead -= numberOfBytesRead;
-    }
-
-    return (length - pendingBytesToRead);
-}
-
-static bool writeBytesToSocket(int fileDescriptor, uint8_t* ptr, size_t length)
-{
-    ASSERT(fileDescriptor > 0);
-    ASSERT(ptr);
-    ASSERT(length > 0);
-
-    ssize_t numberOfBytesWritten = 0;
-    size_t pendingBytesToWrite = length;
-    uint8_t* buffer = ptr;
-
-    // Keep writing to the socket till the complete message has been written.
-    while (pendingBytesToWrite > 0) {
-        if ((numberOfBytesWritten = write(fileDescriptor, buffer, pendingBytesToWrite)) < 0) {
-            if (errno == EINTR)
-                numberOfBytesWritten = 0;
-            else
-                return false;
-        }
-        buffer += numberOfBytesWritten;
-        pendingBytesToWrite -= numberOfBytesWritten;
-    }
-
-    // Write operation failed if complete message is not written.
-    return !pendingBytesToWrite;
-}
-
-void Connection::platformInitialize(Identifier identifier)
-{
-    m_currentMessageSize = 0;
-    m_pendingBytes = 0;
-    m_readBuffer.resize(initialMessageBufferSize);
-    m_socket = identifier;
-}
-
-void Connection::platformInvalidate()
-{
-    if (!m_isConnected)
-        return;
-
-    m_connectionQueue.unregisterEventSourceHandler(m_socket);
-    if (m_socket > 0) {
-        close(m_socket);
-        m_socket = -1;
-    }
-
-    m_isConnected = false;
-}
-
-void Connection::processCompletedMessage()
-{
-    size_t realBufferSize = m_currentMessageSize - sizeof(MessageID);
-    unsigned messageID = *reinterpret_cast<unsigned*>(m_readBuffer.data() + realBufferSize);
-
-    processIncomingMessage(MessageID::fromInt(messageID), adoptPtr(new ArgumentDecoder(m_readBuffer.data(), realBufferSize)));
-
-    // Prepare for the next message.
-    m_currentMessageSize = 0;
-    m_pendingBytes = 0;
-}
-
-void Connection::readEventHandler()
-{
-    if (m_socket < 0)
-        return;
-
-    // Handle any previously unprocessed message.
-    if (!messageProcessingCompleted()) {
-        if ((m_pendingBytes -= readBytesFromSocket(m_socket, (m_readBuffer.data() + (m_currentMessageSize - m_pendingBytes)), m_pendingBytes)) > 0)
-            return;
-
-        // Message received completely. Process the message now.
-        processCompletedMessage();
-    }
-
-    // Prepare to read the next message.
-    uint8_t sizeBuffer[sizeof(size_t)];
-    memset(sizeBuffer, 0, sizeof(size_t));
-    
-    while (messageProcessingCompleted()) {
-        if (readBytesFromSocket(m_socket, sizeBuffer, sizeof(size_t)))
-            m_currentMessageSize = *reinterpret_cast<size_t*>(sizeBuffer);
-
-        if (!m_currentMessageSize)
-            break;
-
-        if (m_readBuffer.size() < m_currentMessageSize)
-            m_readBuffer.grow(m_currentMessageSize);
-
-        m_pendingBytes = m_currentMessageSize - readBytesFromSocket(m_socket, m_readBuffer.data(), m_currentMessageSize);
-        if (m_pendingBytes > 0) // Message partially received.
-            break;
-
-        // Message received completely. Process the message now.
-        processCompletedMessage();
-
-        memset(sizeBuffer, 0, sizeof(size_t));
-    }
-}
-
-bool Connection::open()
-{
-    int flags = fcntl(m_socket, F_GETFL, 0);
-    fcntl(m_socket, F_SETFL, flags | O_NONBLOCK);
-
-    m_isConnected = true;
-
-    // Register callbacks for connection termination and input data on the WorkQueue.
-    m_connectionQueue.registerEventSourceHandler(m_socket, (G_IO_HUP | G_IO_ERR), WorkItem::create(this, &Connection::connectionDidClose));
-    m_connectionQueue.registerEventSourceHandler(m_socket, G_IO_IN, WorkItem::create(this, &Connection::readEventHandler));
-    return true;
-}
-
-bool Connection::platformCanSendOutgoingMessages() const
-{
-    return (m_socket > 0);
-}
-
-bool Connection::sendOutgoingMessage(MessageID messageID, PassOwnPtr<ArgumentEncoder> arguments)
-{
-    if (m_socket < 0)
-        return false;
-
-    // We put the message ID last.
-    arguments->encodeUInt32(messageID.toInt());
-
-    size_t bufferSize = arguments->bufferSize();
-
-    // Send the message size first.
-    if (!writeBytesToSocket(m_socket, reinterpret_cast<uint8_t*>(&bufferSize), sizeof(size_t)))
-        return false;
-
-    if (!writeBytesToSocket(m_socket, arguments->buffer(), arguments->bufferSize()))
-        return false;
-
-    return true;
-}
-
-} // namespace CoreIPC
diff --git a/Source/WebKit2/Platform/CoreIPC/qt/AttachmentQt.cpp b/Source/WebKit2/Platform/CoreIPC/unix/AttachmentUnix.cpp
index 4c0ebc0..2d842da 100644
--- a/Source/WebKit2/Platform/CoreIPC/qt/AttachmentQt.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/unix/AttachmentUnix.cpp
@@ -27,11 +27,8 @@
 #include "config.h"
 #include "Attachment.h"
 
-#if PLATFORM(QT)
 #include <unistd.h>
 #include <errno.h>
-#endif
-
 
 namespace CoreIPC {
 
diff --git a/Source/WebKit2/Platform/CoreIPC/qt/ConnectionQt.cpp b/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
index 225d7dc..92ffff3 100644
--- a/Source/WebKit2/Platform/CoreIPC/qt/ConnectionQt.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
@@ -32,14 +32,19 @@
 #include "WorkItem.h"
 #include "SharedMemory.h"
 #include "WebProcessProxy.h"
-#include <QApplication>
-#include <QSocketNotifier>
 #include <sys/socket.h>
 #include <unistd.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <wtf/Assertions.h>
 
+#if PLATFORM(QT)
+#include <QApplication>
+#include <QSocketNotifier>
+#elif PLATFORM(GTK)
+#include <glib.h>
+#endif
+
 using namespace std;
 
 namespace CoreIPC {
@@ -48,7 +53,7 @@ static const size_t messageMaxSize = 4096;
 static const size_t attachmentMaxAmount = 255;
 
 enum {
-    MessageBodyIsOOL = 1 << 31
+    MessageBodyIsOOL = 1U << 31
 };
 
 class MessageInfo {
@@ -88,9 +93,12 @@ private:
 void Connection::platformInitialize(Identifier identifier)
 {
     m_socketDescriptor = identifier;
-    m_socketNotifier = 0;
     m_readBuffer.resize(messageMaxSize);
     m_currentMessageSize = 0;
+
+#if PLATFORM(QT)
+    m_socketNotifier = 0;
+#endif
 }
 
 void Connection::platformInvalidate()
@@ -101,12 +109,20 @@ void Connection::platformInvalidate()
     if (!m_isConnected)
         return;
 
+#if PLATFORM(GTK)
+    m_connectionQueue.unregisterEventSourceHandler(m_socketDescriptor);
+#endif
+
+#if PLATFORM(QT)
     delete m_socketNotifier;
     m_socketNotifier = 0;
+#endif
+
     m_socketDescriptor = -1;
     m_isConnected = false;
 }
 
+#if PLATFORM(QT)
 class SocketNotifierResourceGuard {
 public:
     SocketNotifierResourceGuard(QSocketNotifier* socketNotifier)
@@ -123,6 +139,7 @@ public:
 private:
     QSocketNotifier* const m_socketNotifier;
 };
+#endif
 
 template<class T, class iterator>
 class AttachmentResourceGuard {
@@ -144,17 +161,19 @@ private:
 void Connection::readyReadHandler()
 {
     Deque<Attachment> attachments;
+#if PLATFORM(QT)
     SocketNotifierResourceGuard socketNotifierEnabler(m_socketNotifier);
+#endif
     AttachmentResourceGuard<Deque<Attachment>, Deque<Attachment>::iterator> attachementDisposer(attachments);
 
-    char attachmentDescriptorBuffer[CMSG_SPACE(sizeof(int) * (attachmentMaxAmount))];
+    OwnArrayPtr<char> attachmentDescriptorBuffer = adoptArrayPtr(new char[CMSG_SPACE(sizeof(int) * (attachmentMaxAmount))]);
     struct msghdr message;
     memset(&message, 0, sizeof(message));
 
     struct iovec iov[1];
     memset(&iov, 0, sizeof(iov));
 
-    message.msg_control = attachmentDescriptorBuffer;
+    message.msg_control = attachmentDescriptorBuffer.get();
     message.msg_controllen = CMSG_SPACE(sizeof(int) * (attachmentMaxAmount));
 
     iov[0].iov_base = m_readBuffer.data();
@@ -184,13 +203,13 @@ void Connection::readyReadHandler()
 
     if (messageInfo.attachmentCount()) {
         if (controlMessage && controlMessage->cmsg_level == SOL_SOCKET && controlMessage->cmsg_type == SCM_RIGHTS) {
-            size_t attachmentSizes[messageInfo.attachmentCount()];
-            memcpy(attachmentSizes, messageData, sizeof(attachmentSizes));
+            OwnArrayPtr<size_t> attachmentSizes = adoptArrayPtr(new size_t[messageInfo.attachmentCount()]);
+            memcpy(attachmentSizes.get(), messageData, sizeof(size_t) * messageInfo.attachmentCount());
 
             messageData += sizeof(attachmentSizes);
 
-            int fileDescriptors[messageInfo.attachmentCount()];
-            memcpy(fileDescriptors, CMSG_DATA(controlMessage), sizeof(fileDescriptors));
+            OwnArrayPtr<int> fileDescriptors = adoptArrayPtr(new int[messageInfo.attachmentCount()]);
+            memcpy(fileDescriptors.get(), CMSG_DATA(controlMessage), sizeof(int) * messageInfo.attachmentCount());
 
             int attachmentCount = messageInfo.attachmentCount();
 
@@ -253,7 +272,10 @@ void Connection::readyReadHandler()
 
 bool Connection::open()
 {
+#if PLATFORM(QT)
     ASSERT(!m_socketNotifier);
+#endif
+
     int flags = fcntl(m_socketDescriptor, F_GETFL, 0);
     while (fcntl(m_socketDescriptor, F_SETFL, flags | O_NONBLOCK) == -1) {
         if (errno != EINTR) {
@@ -263,7 +285,12 @@ bool Connection::open()
     }
 
     m_isConnected = true;
+#if PLATFORM(QT)
     m_socketNotifier = m_connectionQueue.registerSocketEventHandler(m_socketDescriptor, QSocketNotifier::Read, WorkItem::create(this, &Connection::readyReadHandler));
+#elif PLATFORM(GTK)
+    m_connectionQueue.registerEventSourceHandler(m_socketDescriptor, (G_IO_HUP | G_IO_ERR), WorkItem::create(this, &Connection::connectionDidClose));
+    m_connectionQueue.registerEventSourceHandler(m_socketDescriptor, G_IO_IN, WorkItem::create(this, &Connection::readyReadHandler));
+#endif
 
     // Schedule a call to readyReadHandler. Data may have arrived before installation of the signal
     // handler.
@@ -274,12 +301,15 @@ bool Connection::open()
 
 bool Connection::platformCanSendOutgoingMessages() const
 {
-    return m_socketNotifier;
+    return m_isConnected;
 }
 
 bool Connection::sendOutgoingMessage(MessageID messageID, PassOwnPtr<ArgumentEncoder> arguments)
 {
+#if PLATFORM(QT)
     ASSERT(m_socketNotifier);
+#endif
+
     COMPILE_ASSERT(sizeof(MessageInfo) + attachmentMaxAmount * sizeof(size_t) <= messageMaxSize, AttachmentsFitToMessageInline);
 
     Vector<Attachment> attachments = arguments->releaseAttachments();
@@ -320,12 +350,12 @@ bool Connection::sendOutgoingMessage(MessageID messageID, PassOwnPtr<ArgumentEnc
     iov[0].iov_base = reinterpret_cast<void*>(&messageInfo);
     iov[0].iov_len = sizeof(messageInfo);
 
-    char attachmentFDBuffer[CMSG_SPACE(sizeof(int) * (attachments.size()))];
-    size_t attachmentSizes[attachments.size()];
+    OwnArrayPtr<char> attachmentFDBuffer = adoptArrayPtr(new char[CMSG_SPACE(sizeof(int) * attachments.size())]);
+    OwnArrayPtr<size_t> attachmentSizes = adoptArrayPtr(new size_t[attachments.size()]);
 
     if (!attachments.isEmpty()) {
-        message.msg_control = attachmentFDBuffer;
-        message.msg_controllen = sizeof(attachmentFDBuffer);
+        message.msg_control = attachmentFDBuffer.get();
+        message.msg_controllen = sizeof(char) * CMSG_SPACE(sizeof(int) * attachments.size());
 
         struct cmsghdr* cmsg = CMSG_FIRSTHDR(&message);
         cmsg->cmsg_level = SOL_SOCKET;
@@ -333,15 +363,15 @@ bool Connection::sendOutgoingMessage(MessageID messageID, PassOwnPtr<ArgumentEnc
         cmsg->cmsg_len = CMSG_LEN(sizeof(int) * attachments.size());
 
         int* fdptr = reinterpret_cast<int*>(CMSG_DATA(cmsg));
-        for (int i = 0; i < attachments.size(); ++i) {
+        for (size_t i = 0; i < attachments.size(); ++i) {
             attachmentSizes[i] = attachments[i].size();
             fdptr[i] = attachments[i].fileDescriptor();
         }
 
         message.msg_controllen = cmsg->cmsg_len;
 
-        iov[iovLength].iov_base = attachmentSizes;
-        iov[iovLength].iov_len = sizeof(attachmentSizes);
+        iov[iovLength].iov_base = attachmentSizes.get();
+        iov[iovLength].iov_len = sizeof(size_t) * attachments.size();
         ++iovLength;
     }
 
@@ -361,9 +391,11 @@ bool Connection::sendOutgoingMessage(MessageID messageID, PassOwnPtr<ArgumentEnc
     return true;
 }
 
+#if PLATFORM(QT) || PLATFORM(GTK)
 void Connection::setShouldCloseConnectionOnProcessTermination(WebKit::PlatformProcessIdentifier process)
 {
     m_connectionQueue.scheduleWorkOnTermination(process, WorkItem::create(this, &Connection::connectionDidClose));
 }
+#endif
 
 } // namespace CoreIPC
diff --git a/Source/WebKit2/Platform/PlatformProcessIdentifier.h b/Source/WebKit2/Platform/PlatformProcessIdentifier.h
index 0363692..5022da7 100644
--- a/Source/WebKit2/Platform/PlatformProcessIdentifier.h
+++ b/Source/WebKit2/Platform/PlatformProcessIdentifier.h
@@ -40,7 +40,12 @@ typedef HANDLE PlatformProcessIdentifier;
 #elif PLATFORM(QT)
 typedef QProcess* PlatformProcessIdentifier;
 #elif PLATFORM(GTK)
-typedef pid_t PlatformProcessIdentifier;
+#ifdef G_OS_WIN32
+typedef void* GPid;
+#else
+typedef int GPid;
+#endif
+typedef GPid PlatformProcessIdentifier;
 #endif
 
 } // namespace WebKit 
diff --git a/Source/WebKit2/Platform/RunLoop.h b/Source/WebKit2/Platform/RunLoop.h
index aa87506..b2f1411 100644
--- a/Source/WebKit2/Platform/RunLoop.h
+++ b/Source/WebKit2/Platform/RunLoop.h
@@ -34,6 +34,7 @@
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
 #if PLATFORM(GTK)
+#include <wtf/gobject/GRefPtr.h>
 typedef struct _GSource GSource;
 typedef struct _GMainLoop GMainLoop;
 typedef struct _GMainContext GMainContext;
@@ -42,6 +43,10 @@ typedef int gboolean;
 
 class WorkItem;
 
+namespace CoreIPC {
+    class BinarySemaphore;
+}
+
 class RunLoop {
 public:
     // Must be called from the main thread.
@@ -52,6 +57,14 @@ public:
 
     void scheduleWork(PassOwnPtr<WorkItem>);
 
+#if PLATFORM(WIN)
+    // The absoluteTime is in seconds, starting on January 1, 1970. The time is assumed to use the
+    // same time zone as WTF::currentTime(). Dispatches sent (not posted) messages to the passed-in
+    // set of HWNDs until the semaphore is signaled or absoluteTime is reached. Returns true if the
+    // semaphore is signaled, false otherwise.
+    static bool dispatchSentMessagesUntil(const Vector<HWND>& windows, CoreIPC::BinarySemaphore&, double absoluteTime);
+#endif
+
     static void run();
     void stop();
 
@@ -86,10 +99,12 @@ public:
         int m_ID;
         bool m_isRepeating;
 #elif PLATFORM(GTK)
-        static gboolean oneShotTimerFired(RunLoop::TimerBase*);
-        static gboolean repeatingTimerFired(RunLoop::TimerBase*);
-        void resetTimerSource();
-        GSource* m_timerSource;
+        static gboolean timerFiredCallback(RunLoop::TimerBase*);
+        static void destroyNotifyCallback(RunLoop::TimerBase*);
+        gboolean isRepeating() const { return m_isRepeating; }
+        void clearTimerSource();
+        GRefPtr<GSource> m_timerSource;
+        gboolean m_isRepeating;
 #endif
     };
 
diff --git a/Source/WebKit2/Platform/SharedMemory.h b/Source/WebKit2/Platform/SharedMemory.h
index a4b95bf..b242b9b 100644
--- a/Source/WebKit2/Platform/SharedMemory.h
+++ b/Source/WebKit2/Platform/SharedMemory.h
@@ -30,7 +30,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(GTK)
 #include "Attachment.h"
 #include <wtf/text/WTFString.h>
 #endif
@@ -60,7 +60,7 @@ public:
         void encode(CoreIPC::ArgumentEncoder*) const;
         static bool decode(CoreIPC::ArgumentDecoder*, Handle&);
 
-#if PLATFORM(QT)
+#if USE(UNIX_DOMAIN_SOCKETS)
         CoreIPC::Attachment releaseToAttachment() const;
         void adoptFromAttachment(int fileDescriptor, size_t);
 #endif
@@ -70,7 +70,7 @@ public:
         mutable mach_port_t m_port;
 #elif PLATFORM(WIN)
         mutable HANDLE m_handle;
-#elif PLATFORM(QT)
+#elif USE(UNIX_DOMAIN_SOCKETS)
         mutable int m_fileDescriptor;
 #endif
         size_t m_size;
@@ -82,6 +82,10 @@ public:
     // Create a shared memory object from the given handle and the requested protection. Will return 0 on failure.
     static PassRefPtr<SharedMemory> create(const Handle&, Protection);
     
+#if PLATFORM(WIN)
+    static PassRefPtr<SharedMemory> adopt(HANDLE, size_t, Protection);
+#endif
+
     ~SharedMemory();
 
     bool createHandle(Handle&, Protection);
@@ -99,7 +103,7 @@ private:
     mach_port_t m_port;
 #elif PLATFORM(WIN)
     HANDLE m_handle;
-#elif PLATFORM(QT)
+#elif USE(UNIX_DOMAIN_SOCKETS)
     int m_fileDescriptor;
 #endif
 };
diff --git a/Source/WebKit2/Platform/WorkQueue.h b/Source/WebKit2/Platform/WorkQueue.h
index 99f77ae..74d6055 100644
--- a/Source/WebKit2/Platform/WorkQueue.h
+++ b/Source/WebKit2/Platform/WorkQueue.h
@@ -46,8 +46,10 @@
 class QObject;
 class QThread;
 #elif PLATFORM(GTK)
+#include "PlatformProcessIdentifier.h"
 typedef struct _GMainContext GMainContext;
 typedef struct _GMainLoop GMainLoop;
+typedef gboolean (*GSourceFunc) (gpointer data);
 #endif
 
 class WorkQueue {
@@ -87,6 +89,7 @@ public:
 #elif PLATFORM(GTK)
     void registerEventSourceHandler(int, int, PassOwnPtr<WorkItem>);
     void unregisterEventSourceHandler(int);
+    void scheduleWorkOnTermination(WebKit::PlatformProcessIdentifier, PassOwnPtr<WorkItem>);
 #endif
 
 private:
@@ -165,6 +168,7 @@ private:
 #elif PLATFORM(GTK)
     static void* startWorkQueueThread(WorkQueue*);
     void workQueueThreadBody();
+    void scheduleWorkOnSource(GSource*, PassOwnPtr<WorkItem>, GSourceFunc);
 
     ThreadIdentifier m_workQueueThread;
     GMainContext* m_eventContext;
diff --git a/Source/WebKit2/Platform/gtk/RunLoopGtk.cpp b/Source/WebKit2/Platform/gtk/RunLoopGtk.cpp
index 70b0552..0f4ab68 100644
--- a/Source/WebKit2/Platform/gtk/RunLoopGtk.cpp
+++ b/Source/WebKit2/Platform/gtk/RunLoopGtk.cpp
@@ -41,7 +41,8 @@ RunLoop::RunLoop()
 RunLoop::~RunLoop()
 {
     if (m_runLoopMain) {
-        g_main_loop_quit(m_runLoopMain);
+        if (g_main_loop_is_running(m_runLoopMain))
+            g_main_loop_quit(m_runLoopMain);
         g_main_loop_unref(m_runLoopMain);
     }
 
@@ -72,9 +73,10 @@ gboolean RunLoop::queueWork(RunLoop* runLoop)
 
 void RunLoop::wakeUp()
 {
-    GSource* source = g_timeout_source_new(0);
-    g_source_set_callback(source, reinterpret_cast<GSourceFunc>(&RunLoop::queueWork), this, 0);
-    g_source_attach(source, m_runLoopContext);
+    GRefPtr<GSource> source = adoptGRef(g_idle_source_new());
+    g_source_set_priority(source.get(), G_PRIORITY_DEFAULT);
+    g_source_set_callback(source.get(), reinterpret_cast<GSourceFunc>(&RunLoop::queueWork), this, 0);
+    g_source_attach(source.get(), m_runLoopContext);
 
     g_main_context_wakeup(m_runLoopContext);
 }
@@ -90,22 +92,20 @@ RunLoop::TimerBase::~TimerBase()
     stop();
 }
 
-void RunLoop::TimerBase::resetTimerSource()
+void RunLoop::TimerBase::clearTimerSource()
 {
     m_timerSource = 0;
 }
 
-gboolean RunLoop::TimerBase::oneShotTimerFired(RunLoop::TimerBase* timer)
+void RunLoop::TimerBase::destroyNotifyCallback(RunLoop::TimerBase* timer)
 {
-    timer->fired();
-    timer->resetTimerSource();
-    return FALSE;
+    timer->clearTimerSource();
 }
 
-gboolean RunLoop::TimerBase::repeatingTimerFired(RunLoop::TimerBase* timer)
+gboolean RunLoop::TimerBase::timerFiredCallback(RunLoop::TimerBase* timer)
 {
     timer->fired();
-    return TRUE;
+    return timer->isRepeating();
 }
 
 void RunLoop::TimerBase::start(double fireInterval, bool repeat)
@@ -113,12 +113,11 @@ void RunLoop::TimerBase::start(double fireInterval, bool repeat)
     if (m_timerSource)
         stop();
 
-    m_timerSource = g_timeout_source_new(static_cast<guint>(fireInterval));
-    if (repeat)
-        g_source_set_callback(m_timerSource, reinterpret_cast<GSourceFunc>(&RunLoop::TimerBase::repeatingTimerFired), this, 0);
-    else
-        g_source_set_callback(m_timerSource, reinterpret_cast<GSourceFunc>(&RunLoop::TimerBase::oneShotTimerFired), this, 0);
-    g_source_attach(m_timerSource, m_runLoop->m_runLoopContext);
+    m_timerSource = adoptGRef(g_timeout_source_new(static_cast<guint>(fireInterval * 1000)));
+    m_isRepeating = repeat;
+    g_source_set_callback(m_timerSource.get(), reinterpret_cast<GSourceFunc>(&RunLoop::TimerBase::timerFiredCallback), this,
+                          reinterpret_cast<GDestroyNotify>(&RunLoop::TimerBase::destroyNotifyCallback));
+    g_source_attach(m_timerSource.get(), m_runLoop->m_runLoopContext);
 }
 
 void RunLoop::TimerBase::stop()
@@ -126,8 +125,8 @@ void RunLoop::TimerBase::stop()
     if (!m_timerSource)
         return;
 
-    g_source_destroy(m_timerSource);
-    m_timerSource = 0;
+    g_source_destroy(m_timerSource.get());
+    clearTimerSource();
 }
 
 bool RunLoop::TimerBase::isActive() const
diff --git a/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp b/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
index dbe38bd..0cdb92f 100644
--- a/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
+++ b/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2011 Igalia S.L.
  * Copyright (C) 2010 Apple Inc. All rights reserved.
  * Portions Copyright (c) 2010 Motorola Mobility, Inc.  All rights reserved.
  *
@@ -29,56 +30,63 @@
 
 #include "WKBase.h"
 #include <WebCore/NotImplemented.h>
+#include <gio/gio.h>
 #include <glib.h>
+#include <wtf/gobject/GRefPtr.h>
 
 // WorkQueue::EventSource
 class WorkQueue::EventSource {
 public:
-    EventSource(GSource* dispatchSource, PassOwnPtr<WorkItem> workItem, WorkQueue* workQueue)
-        : m_dispatchSource(dispatchSource)
-        , m_workItem(workItem)
+    EventSource(PassOwnPtr<WorkItem> workItem, WorkQueue* workQueue, GCancellable* cancellable)
+        : m_workItem(workItem)
         , m_workQueue(workQueue)
+        , m_cancellable(cancellable)
     {
     }
 
-    GSource* dispatchSource() { return m_dispatchSource; }
+    void cancel()
+    {
+        if (!m_cancellable)
+            return;
+        g_cancellable_cancel(m_cancellable);
+    }
 
-    static gboolean performWorkOnce(EventSource* eventSource)
+    static void executeEventSource(EventSource* eventSource)
     {
         ASSERT(eventSource);
         WorkQueue* queue = eventSource->m_workQueue;
         {
             MutexLocker locker(queue->m_isValidMutex);
             if (!queue->m_isValid)
-                return FALSE;
+                return;
         }
 
         eventSource->m_workItem->execute();
-        return FALSE;
     }
 
-    static gboolean performWork(GIOChannel* channel, GIOCondition condition, EventSource* eventSource) 
+    static gboolean performWorkOnce(EventSource* eventSource)
     {
-        ASSERT(eventSource);
+        executeEventSource(eventSource);
+        return FALSE;
+    }
 
-        if (!(condition & G_IO_IN) && !(condition & G_IO_HUP) && !(condition & G_IO_ERR))
+    static gboolean performWork(GSocket* socket, GIOCondition condition, EventSource* eventSource)
+    {
+        if (!(condition & G_IO_IN) && !(condition & G_IO_HUP) && !(condition & G_IO_ERR)) {
+            // EventSource has been cancelled, return FALSE to destroy the source.
             return FALSE;
-
-        WorkQueue* queue = eventSource->m_workQueue;
-        {
-            MutexLocker locker(queue->m_isValidMutex);
-            if (!queue->m_isValid)
-                return FALSE;
         }
 
-        eventSource->m_workItem->execute();
-
-        if ((condition & G_IO_HUP) || (condition & G_IO_ERR))
-            return FALSE;
-
+        executeEventSource(eventSource);
         return TRUE;
     }
-    
+
+    static gboolean performWorkOnTermination(GPid, gint, EventSource* eventSource)
+    {
+        executeEventSource(eventSource);
+        return FALSE;
+    }
+
     static void deleteEventSource(EventSource* eventSource) 
     {
         ASSERT(eventSource);
@@ -86,9 +94,9 @@ public:
     }
    
 public:
-    GSource* m_dispatchSource;
     PassOwnPtr<WorkItem> m_workItem;
     WorkQueue* m_workQueue;
+    GCancellable* m_cancellable;
 };
 
 // WorkQueue
@@ -132,14 +140,15 @@ void WorkQueue::workQueueThreadBody()
 
 void WorkQueue::registerEventSourceHandler(int fileDescriptor, int condition, PassOwnPtr<WorkItem> item)
 {
-    GIOChannel* channel = g_io_channel_unix_new(fileDescriptor);
-    ASSERT(channel);
-    GSource* dispatchSource = g_io_create_watch(channel, static_cast<GIOCondition>(condition));
+    GRefPtr<GSocket> socket = adoptGRef(g_socket_new_from_fd(fileDescriptor, 0));
+    ASSERT(socket);
+    GRefPtr<GCancellable> cancellable = adoptGRef(g_cancellable_new());
+    GRefPtr<GSource> dispatchSource = adoptGRef(g_socket_create_source(socket.get(), static_cast<GIOCondition>(condition), cancellable.get()));
     ASSERT(dispatchSource);
-    EventSource* eventSource = new EventSource(dispatchSource, item, this);
+    EventSource* eventSource = new EventSource(item, this, cancellable.get());
     ASSERT(eventSource);
 
-    g_source_set_callback(dispatchSource, reinterpret_cast<GSourceFunc>(&WorkQueue::EventSource::performWork), 
+    g_source_set_callback(dispatchSource.get(), reinterpret_cast<GSourceFunc>(&WorkQueue::EventSource::performWork),
         eventSource, reinterpret_cast<GDestroyNotify>(&WorkQueue::EventSource::deleteEventSource));
 
     // Set up the event sources under the mutex since this is shared across multiple threads.
@@ -154,11 +163,7 @@ void WorkQueue::registerEventSourceHandler(int fileDescriptor, int condition, Pa
         m_eventSources.set(fileDescriptor, sources);
     }
 
-    // Attach the event source to the GMainContext under the mutex since this is shared across multiple threads.
-    {
-        MutexLocker locker(m_eventLoopLock);
-        g_source_attach(dispatchSource, m_eventContext);
-    }
+    g_source_attach(dispatchSource.get(), m_eventContext);
 }
 
 void WorkQueue::unregisterEventSourceHandler(int fileDescriptor)
@@ -174,29 +179,43 @@ void WorkQueue::unregisterEventSourceHandler(int fileDescriptor)
     if (it != m_eventSources.end()) {
         Vector<EventSource*> sources = it->second;
         for (unsigned i = 0; i < sources.size(); i++)
-            g_source_destroy(sources[i]->dispatchSource());
+            sources[i]->cancel();
 
         m_eventSources.remove(it);
     }
 }
 
+void WorkQueue::scheduleWorkOnSource(GSource* dispatchSource, PassOwnPtr<WorkItem> item, GSourceFunc sourceCallback)
+{
+    EventSource* eventSource = new EventSource(item, this, 0);
+
+    g_source_set_callback(dispatchSource, sourceCallback, eventSource,
+                          reinterpret_cast<GDestroyNotify>(&WorkQueue::EventSource::deleteEventSource));
+
+    g_source_attach(dispatchSource, m_eventContext);
+}
+
 void WorkQueue::scheduleWork(PassOwnPtr<WorkItem> item)
 {
-    GSource* dispatchSource = g_timeout_source_new(0);
+    GRefPtr<GSource> dispatchSource = adoptGRef(g_idle_source_new());
     ASSERT(dispatchSource);
-    EventSource* eventSource = new EventSource(dispatchSource, item, this);
-    
-    g_source_set_callback(dispatchSource, 
-                          reinterpret_cast<GSourceFunc>(&WorkQueue::EventSource::performWorkOnce), 
-                          eventSource, 
-                          reinterpret_cast<GDestroyNotify>(&WorkQueue::EventSource::deleteEventSource));
-    {
-        MutexLocker locker(m_eventLoopLock);
-        g_source_attach(dispatchSource, m_eventContext);
-    }
+    g_source_set_priority(dispatchSource.get(), G_PRIORITY_DEFAULT);
+
+    scheduleWorkOnSource(dispatchSource.get(), item, reinterpret_cast<GSourceFunc>(&WorkQueue::EventSource::performWorkOnce));
 }
 
-void WorkQueue::scheduleWorkAfterDelay(PassOwnPtr<WorkItem>, double)
+void WorkQueue::scheduleWorkAfterDelay(PassOwnPtr<WorkItem> item, double delay)
 {
-    notImplemented();
+    GRefPtr<GSource> dispatchSource = adoptGRef(g_timeout_source_new(static_cast<guint>(delay * 1000)));
+    ASSERT(dispatchSource);
+
+    scheduleWorkOnSource(dispatchSource.get(), item, reinterpret_cast<GSourceFunc>(&WorkQueue::EventSource::performWorkOnce));
+}
+
+void WorkQueue::scheduleWorkOnTermination(WebKit::PlatformProcessIdentifier process, PassOwnPtr<WorkItem> item)
+{
+    GRefPtr<GSource> dispatchSource = adoptGRef(g_child_watch_source_new(process));
+    ASSERT(dispatchSource);
+
+    scheduleWorkOnSource(dispatchSource.get(), item, reinterpret_cast<GSourceFunc>(&WorkQueue::EventSource::performWorkOnTermination));
 }
diff --git a/Source/WebKit2/Platform/qt/SharedMemoryQt.cpp b/Source/WebKit2/Platform/unix/SharedMemoryUnix.cpp
index 8d5d70f..7acf132 100644
--- a/Source/WebKit2/Platform/qt/SharedMemoryQt.cpp
+++ b/Source/WebKit2/Platform/unix/SharedMemoryUnix.cpp
@@ -31,7 +31,6 @@
 #include "ArgumentDecoder.h"
 #include "ArgumentEncoder.h"
 #include "WebCoreArgumentCoders.h"
-#include <QDir>
 #include <errno.h>
 #include <fcntl.h>
 #include <stdlib.h>
@@ -42,6 +41,12 @@
 #include <wtf/Assertions.h>
 #include <wtf/CurrentTime.h>
 
+#if PLATFORM(QT)
+#include <QDir>
+#elif PLATFORM(GTK)
+#include <wtf/gobject/GOwnPtr.h>
+#endif
+
 namespace WebKit {
 
 SharedMemory::Handle::Handle()
@@ -101,9 +106,14 @@ void SharedMemory::Handle::adoptFromAttachment(int fileDescriptor, size_t size)
 
 PassRefPtr<SharedMemory> SharedMemory::create(size_t size)
 {
+#if PLATFORM(QT)
     QString tempName = QDir::temp().filePath(QLatin1String("qwkshm.XXXXXX"));
     QByteArray tempNameCSTR = tempName.toLocal8Bit();
     char* tempNameC = tempNameCSTR.data();
+#elif PLATFORM(GTK)
+    GOwnPtr<gchar> tempName(g_build_filename(g_get_tmp_dir(), "WK2SharedMemoryXXXXXX", NULL));
+    gchar* tempNameC = tempName.get();
+#endif
 
     int fileDescriptor;
     while ((fileDescriptor = mkstemp(tempNameC)) == -1) {
diff --git a/Source/WebKit2/Platform/win/RunLoopWin.cpp b/Source/WebKit2/Platform/win/RunLoopWin.cpp
index 0ca7d9b..21bc2e0 100644
--- a/Source/WebKit2/Platform/win/RunLoopWin.cpp
+++ b/Source/WebKit2/Platform/win/RunLoopWin.cpp
@@ -26,7 +26,12 @@
 #include "config.h"
 #include "RunLoop.h"
 
+#include "BinarySemaphore.h"
 #include "WorkItem.h"
+#include <wtf/CurrentTime.h>
+
+using namespace CoreIPC;
+using namespace std;
 
 static const UINT PerformWorkMessage = WM_USER + 1;
 static const LPWSTR kRunLoopMessageWindowClassName = L"RunLoopMessageWindow";
@@ -74,6 +79,47 @@ void RunLoop::run()
     }
 }
 
+bool RunLoop::dispatchSentMessagesUntil(const Vector<HWND>& windows, CoreIPC::BinarySemaphore& semaphore, double absoluteTime)
+{
+    if (windows.isEmpty())
+        return semaphore.wait(absoluteTime);
+
+    HANDLE handle = semaphore.event();
+    DWORD handleCount = 1;
+
+    while (true) {
+        DWORD interval = absoluteTimeToWaitTimeoutInterval(absoluteTime);
+        if (!interval) {
+            // Consider the wait to have timed out, even if the semaphore is currently signaled.
+            // This matches the WTF::ThreadCondition implementation of BinarySemaphore::wait.
+            return false;
+        }
+
+        DWORD result = ::MsgWaitForMultipleObjectsEx(handleCount, &handle, interval, QS_SENDMESSAGE, 0);
+        if (result == WAIT_OBJECT_0) {
+            // The semaphore was signaled.
+            return true;
+        }
+        if (result == WAIT_TIMEOUT) {
+            // absoluteTime was reached.
+            return false;
+        }
+        if (result == WAIT_OBJECT_0 + handleCount) {
+            // One or more sent messages are available. Process sent messages for all the windows
+            // we were given, since we don't have a way of knowing which window has available sent
+            // messages.
+            for (size_t i = 0; i < windows.size(); ++i) {
+                MSG message;
+                ::PeekMessageW(&message, windows[i], 0, 0, PM_NOREMOVE | PM_QS_SENDMESSAGE);
+            }
+            continue;
+        }
+        ASSERT_WITH_MESSAGE(result != WAIT_FAILED, "::MsgWaitForMultipleObjectsEx failed with error %lu", ::GetLastError());
+        ASSERT_WITH_MESSAGE(false, "::MsgWaitForMultipleObjectsEx returned unexpected result %lu", result);
+        return false;
+    }
+}
+
 void RunLoop::stop()
 {
     ::PostQuitMessage(0);
diff --git a/Source/WebKit2/Platform/win/SharedMemoryWin.cpp b/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
index ef83de7..50985e7 100644
--- a/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
+++ b/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
@@ -136,8 +136,7 @@ static DWORD accessRights(SharedMemory::Protection protection)
     case SharedMemory::ReadOnly:
         return FILE_MAP_READ;
     case SharedMemory::ReadWrite:
-        // FILE_MAP_WRITE implies read access, too.
-        return FILE_MAP_WRITE;
+        return FILE_MAP_READ | FILE_MAP_WRITE;
     }
 
     ASSERT_NOT_REACHED();
@@ -146,23 +145,32 @@ static DWORD accessRights(SharedMemory::Protection protection)
 
 PassRefPtr<SharedMemory> SharedMemory::create(const Handle& handle, Protection protection)
 {
-    if (handle.isNull())
+    RefPtr<SharedMemory> memory = adopt(handle.m_handle, handle.m_size, protection);
+    if (!memory)
+        return 0;
+
+    // The SharedMemory object now owns the HANDLE.
+    handle.m_handle = 0;
+
+    return memory.release();
+}
+
+PassRefPtr<SharedMemory> SharedMemory::adopt(HANDLE handle, size_t size, Protection protection)
+{
+    if (!handle)
         return 0;
 
     DWORD desiredAccess = accessRights(protection);
 
-    void* baseAddress = ::MapViewOfFile(handle.m_handle, desiredAccess, 0, 0, handle.m_size);
+    void* baseAddress = ::MapViewOfFile(handle, desiredAccess, 0, 0, size);
     ASSERT_WITH_MESSAGE(baseAddress, "::MapViewOfFile failed with error %lu", ::GetLastError());
     if (!baseAddress)
         return 0;
 
     RefPtr<SharedMemory> memory = adoptRef(new SharedMemory);
-    memory->m_size = handle.m_size;
+    memory->m_size = size;
     memory->m_data = baseAddress;
-
-    // Adopt the HANDLE.
-    memory->m_handle = handle.m_handle;
-    handle.m_handle = 0;
+    memory->m_handle = handle;
 
     return memory.release();
 }
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp b/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
index 03a8aec..30223b8 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp
@@ -65,12 +65,20 @@ PluginControllerProxy::PluginControllerProxy(WebProcessConnection* connection, u
 #if PLATFORM(MAC)
     , m_isComplexTextInputEnabled(false)
 #endif
+    , m_windowNPObject(0)
+    , m_pluginElementNPObject(0)
 {
 }
 
 PluginControllerProxy::~PluginControllerProxy()
 {
     ASSERT(!m_plugin);
+
+    if (m_windowNPObject)
+        releaseNPObject(m_windowNPObject);
+
+    if (m_pluginElementNPObject)
+        releaseNPObject(m_pluginElementNPObject);
 }
 
 bool PluginControllerProxy::initialize(const Plugin::Parameters& parameters)
@@ -210,28 +218,40 @@ void PluginControllerProxy::cancelManualStreamLoad()
 
 NPObject* PluginControllerProxy::windowScriptNPObject()
 {
-    uint64_t windowScriptNPObjectID = 0;
+    if (!m_windowNPObject) {
+        uint64_t windowScriptNPObjectID = 0;
 
-    if (!m_connection->connection()->sendSync(Messages::PluginProxy::GetWindowScriptNPObject(), Messages::PluginProxy::GetWindowScriptNPObject::Reply(windowScriptNPObjectID), m_pluginInstanceID))
-        return 0;
+        if (!m_connection->connection()->sendSync(Messages::PluginProxy::GetWindowScriptNPObject(), Messages::PluginProxy::GetWindowScriptNPObject::Reply(windowScriptNPObjectID), m_pluginInstanceID))
+            return 0;
 
-    if (!windowScriptNPObjectID)
-        return 0;
+        if (!windowScriptNPObjectID)
+            return 0;
+
+        m_windowNPObject = m_connection->npRemoteObjectMap()->createNPObjectProxy(windowScriptNPObjectID, m_plugin.get());
+        ASSERT(m_windowNPObject);
+    }
 
-    return m_connection->npRemoteObjectMap()->createNPObjectProxy(windowScriptNPObjectID, m_plugin.get());
+    retainNPObject(m_windowNPObject);
+    return m_windowNPObject;
 }
 
 NPObject* PluginControllerProxy::pluginElementNPObject()
 {
-    uint64_t pluginElementNPObjectID = 0;
+    if (!m_pluginElementNPObject) {
+        uint64_t pluginElementNPObjectID = 0;
 
-    if (!m_connection->connection()->sendSync(Messages::PluginProxy::GetPluginElementNPObject(), Messages::PluginProxy::GetPluginElementNPObject::Reply(pluginElementNPObjectID), m_pluginInstanceID))
-        return 0;
+        if (!m_connection->connection()->sendSync(Messages::PluginProxy::GetPluginElementNPObject(), Messages::PluginProxy::GetPluginElementNPObject::Reply(pluginElementNPObjectID), m_pluginInstanceID))
+            return 0;
 
-    if (!pluginElementNPObjectID)
-        return 0;
+        if (!pluginElementNPObjectID)
+            return 0;
 
-    return m_connection->npRemoteObjectMap()->createNPObjectProxy(pluginElementNPObjectID, m_plugin.get());
+        m_pluginElementNPObject = m_connection->npRemoteObjectMap()->createNPObjectProxy(pluginElementNPObjectID, m_plugin.get());
+        ASSERT(m_pluginElementNPObject);
+    }
+
+    retainNPObject(m_pluginElementNPObject);
+    return m_pluginElementNPObject;
 }
 
 bool PluginControllerProxy::evaluate(NPObject* npObject, const String& scriptString, NPVariant* result, bool allowPopups)
@@ -273,6 +293,7 @@ void PluginControllerProxy::pluginProcessCrashed()
     ASSERT_NOT_REACHED();
 }
 
+#if PLATFORM(MAC)
 void PluginControllerProxy::setComplexTextInputEnabled(bool complexTextInputEnabled)
 {
     if (m_isComplexTextInputEnabled == complexTextInputEnabled)
@@ -287,6 +308,7 @@ mach_port_t PluginControllerProxy::compositingRenderServerPort()
 {
     return PluginProcess::shared().compositingRenderServerPort();
 }
+#endif
 
 String PluginControllerProxy::proxiesForURL(const String& urlString)
 {
@@ -347,14 +369,14 @@ void PluginControllerProxy::geometryDidChange(const IntRect& frameRect, const In
 
     ASSERT(m_plugin);
 
+    platformGeometryDidChange();
+
     if (!backingStoreHandle.isNull()) {
         // Create a new backing store.
         m_backingStore = ShareableBitmap::create(backingStoreHandle);
     }
 
     m_plugin->geometryDidChange(frameRect, clipRect);
-
-    platformGeometryDidChange(frameRect, clipRect);
 }
 
 void PluginControllerProxy::didEvaluateJavaScript(uint64_t requestID, const String& requestURLString, const String& result)
@@ -414,9 +436,17 @@ void PluginControllerProxy::manualStreamDidFail(bool wasCancelled)
     m_plugin->manualStreamDidFail(wasCancelled);
 }
     
-void PluginControllerProxy::handleMouseEvent(const WebMouseEvent& mouseEvent, bool& handled)
+void PluginControllerProxy::handleMouseEvent(const WebMouseEvent& mouseEvent, PassRefPtr<Messages::PluginControllerProxy::HandleMouseEvent::DelayedReply> reply)
 {
-    handled = m_plugin->handleMouseEvent(mouseEvent);
+    // Always let the web process think that we've handled this mouse event, even before passing it along to the plug-in.
+    // This is a workaround for 
+    // <rdar://problem/9299901> UI process thinks the page is unresponsive when a plug-in is showing a context menu.
+    // The web process sends a synchronous HandleMouseEvent message and the plug-in process spawns a nested
+    // run loop when showing the context menu, so eventually the unresponsiveness timer kicks in in the UI process.
+    // FIXME: We should come up with a better way to do this.
+    reply->send(true);
+
+    m_plugin->handleMouseEvent(mouseEvent);
 }
 
 void PluginControllerProxy::handleWheelEvent(const WebWheelEvent& wheelEvent, bool& handled)
@@ -481,29 +511,6 @@ void PluginControllerProxy::getPluginScriptableNPObject(uint64_t& pluginScriptab
     releaseNPObject(pluginScriptableNPObject);
 }
 
-#if PLATFORM(MAC)
-void PluginControllerProxy::windowFocusChanged(bool hasFocus)
-{
-    m_plugin->windowFocusChanged(hasFocus);
-}
-
-void PluginControllerProxy::windowAndViewFramesChanged(const IntRect& windowFrameInScreenCoordinates, const IntRect& viewFrameInWindowCoordinates)
-{
-    m_plugin->windowAndViewFramesChanged(windowFrameInScreenCoordinates, viewFrameInWindowCoordinates);
-}
-
-void PluginControllerProxy::windowVisibilityChanged(bool isVisible)
-{
-    m_plugin->windowVisibilityChanged(isVisible);
-}
-
-void PluginControllerProxy::sendComplexTextInput(const String& textInput)
-{
-    m_plugin->sendComplexTextInput(textInput);
-}
-
-#endif
-
 void PluginControllerProxy::privateBrowsingStateChanged(bool isPrivateBrowsingEnabled)
 {
     m_plugin->privateBrowsingStateChanged(isPrivateBrowsingEnabled);
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.h b/Source/WebKit2/PluginProcess/PluginControllerProxy.h
index 65be39e..a6207df 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.h
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.h
@@ -31,6 +31,7 @@
 #include "Connection.h"
 #include "Plugin.h"
 #include "PluginController.h"
+#include "PluginControllerProxyMessages.h"
 #include "RunLoop.h"
 #include "ShareableBitmap.h"
 #include <wtf/Noncopyable.h>
@@ -115,7 +116,7 @@ private:
     void manualStreamDidReceiveData(const CoreIPC::DataReference& data);
     void manualStreamDidFinishLoading();
     void manualStreamDidFail(bool wasCancelled);
-    void handleMouseEvent(const WebMouseEvent&, bool& handled);
+    void handleMouseEvent(const WebMouseEvent&, PassRefPtr<Messages::PluginControllerProxy::HandleMouseEvent::DelayedReply>);
     void handleWheelEvent(const WebWheelEvent&, bool& handled);
     void handleMouseEnterEvent(const WebMouseEvent&, bool& handled);
     void handleMouseLeaveEvent(const WebMouseEvent&, bool& handled);
@@ -137,7 +138,7 @@ private:
 
     void platformInitialize();
     void platformDestroy();
-    void platformGeometryDidChange(const WebCore::IntRect& frameRect, const WebCore::IntRect& clipRect);
+    void platformGeometryDidChange();
 
     WebProcessConnection* m_connection;
     uint64_t m_pluginInstanceID;
@@ -182,6 +183,12 @@ private:
     
     // The backing store that this plug-in draws into.
     RefPtr<ShareableBitmap> m_backingStore;
+
+    // The window NPObject.
+    NPObject* m_windowNPObject;
+
+    // The plug-in element NPObject.
+    NPObject* m_pluginElementNPObject;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/PluginProcess/PluginControllerProxy.messages.in b/Source/WebKit2/PluginProcess/PluginControllerProxy.messages.in
index 6e27b36..349172d 100644
--- a/Source/WebKit2/PluginProcess/PluginControllerProxy.messages.in
+++ b/Source/WebKit2/PluginProcess/PluginControllerProxy.messages.in
@@ -60,7 +60,7 @@ messages -> PluginControllerProxy {
     ManualStreamDidFail(bool wasCancelled)
 
     # Sent when a mouse event (that isn't a mouse enter/leave event or a wheel event) should be processed.
-    HandleMouseEvent(WebKit::WebMouseEvent mouseEvent) -> (bool handled)
+    HandleMouseEvent(WebKit::WebMouseEvent mouseEvent) -> (bool handled) Delayed
     
     # Sent when a mouse wheel event should be processed.
     HandleWheelEvent(WebKit::WebWheelEvent wheelEvent) -> (bool handled)
@@ -86,10 +86,10 @@ messages -> PluginControllerProxy {
     # Get a reference to the plug-in's scriptable NPObject.
     GetPluginScriptableNPObject() -> (uint64_t pluginScriptableNPObjectID)
 
+#if PLATFORM(MAC)
     # Send the complex text input to the plug-in.
     SendComplexTextInput(WTF::String textInput)
 
-#if PLATFORM(MAC)
     # Sent when the containing NSWindow's focus changes
     WindowFocusChanged(bool hasFocus)
 
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.cpp b/Source/WebKit2/PluginProcess/PluginProcess.cpp
index e35de9d..30504a2 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.cpp
+++ b/Source/WebKit2/PluginProcess/PluginProcess.cpp
@@ -29,12 +29,15 @@
 #if ENABLE(PLUGIN_PROCESS)
 
 #include "ArgumentCoders.h"
-#include "MachPort.h"
 #include "NetscapePluginModule.h"
 #include "PluginProcessProxyMessages.h"
 #include "PluginProcessCreationParameters.h"
 #include "WebProcessConnection.h"
 
+#if PLATFORM(MAC)
+#include "MachPort.h"
+#endif
+
 namespace WebKit {
 
 static const double shutdownTimeout = 15.0;
@@ -46,8 +49,8 @@ PluginProcess& PluginProcess::shared()
 }
 
 PluginProcess::PluginProcess()
-    : m_shutdownTimer(RunLoop::main(), this, &PluginProcess::shutdownTimerFired)
-#if USE(ACCELERATED_COMPOSITING) && PLATFORM(MAC)
+    : ChildProcess(shutdownTimeout)
+#if PLATFORM(MAC)
     , m_compositingRenderServerPort(MACH_PORT_NULL)
 #endif
 {
@@ -78,7 +81,7 @@ void PluginProcess::removeWebProcessConnection(WebProcessConnection* webProcessC
         m_pluginModule->decrementLoadCount();
     }        
 
-    startShutdownTimerIfNecessary();
+    enableTermination();
 }
 
 NetscapePluginModule* PluginProcess::netscapePluginModule()
@@ -98,6 +101,13 @@ NetscapePluginModule* PluginProcess::netscapePluginModule()
     return m_pluginModule.get();
 }
 
+bool PluginProcess::shouldTerminate()
+{
+    ASSERT(m_webProcessConnections.isEmpty());
+
+    return true;
+}
+
 void PluginProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     didReceivePluginProcessMessage(connection, messageID, arguments);
@@ -114,13 +124,10 @@ void PluginProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::Mess
 {
 }
 
-NO_RETURN void PluginProcess::didFailToSendSyncMessage(CoreIPC::Connection*)
+void PluginProcess::syncMessageSendTimedOut(CoreIPC::Connection*)
 {
-    // We were making a synchronous call to a web process that doesn't exist any more.
-    // Callers are unlikely to be prepared for an error like this, so it's best to exit immediately.
-    exit(0);
 }
-    
+
 void PluginProcess::initializePluginProcess(const PluginProcessCreationParameters& parameters)
 {
     ASSERT(!m_pluginModule);
@@ -132,20 +139,23 @@ void PluginProcess::initializePluginProcess(const PluginProcessCreationParameter
 
 void PluginProcess::createWebProcessConnection()
 {
-    // FIXME: This is platform specific!
+    bool didHaveAnyWebProcessConnections = !m_webProcessConnections.isEmpty();
 
+#if PLATFORM(MAC)
     // Create the listening port.
     mach_port_t listeningPort;
     mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
 
-    bool didHaveAnyWebProcessConnections = !m_webProcessConnections.isEmpty();
-
     // Create a listening connection.
     RefPtr<WebProcessConnection> connection = WebProcessConnection::create(listeningPort);
     m_webProcessConnections.append(connection.release());
 
     CoreIPC::MachPort clientPort(listeningPort, MACH_MSG_TYPE_MAKE_SEND);
     m_connection->send(Messages::PluginProcessProxy::DidCreateWebProcessConnection(clientPort), 0);
+#else
+    // FIXME: Implement.
+    ASSERT_NOT_REACHED();
+#endif
 
     if (NetscapePluginModule* module = netscapePluginModule()) {
         if (!didHaveAnyWebProcessConnections) {
@@ -155,23 +165,24 @@ void PluginProcess::createWebProcessConnection()
         }
     }
 
-    // Stop the shutdown timer.
-    m_shutdownTimer.stop();
+    disableTermination();
 }
 
 void PluginProcess::getSitesWithData(uint64_t callbackID)
 {
+    LocalTerminationDisabler terminationDisabler(*this);
+
     Vector<String> sites;
     if (NetscapePluginModule* module = netscapePluginModule())
         sites = module->sitesWithData();
 
     m_connection->send(Messages::PluginProcessProxy::DidGetSitesWithData(sites, callbackID), 0);
-
-    startShutdownTimerIfNecessary();
 }
 
 void PluginProcess::clearSiteData(const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID)
 {
+    LocalTerminationDisabler terminationDisabler(*this);
+
     if (NetscapePluginModule* module = netscapePluginModule()) {
         if (sites.isEmpty()) {
             // Clear everything.
@@ -183,22 +194,6 @@ void PluginProcess::clearSiteData(const Vector<String>& sites, uint64_t flags, u
     }
 
     m_connection->send(Messages::PluginProcessProxy::DidClearSiteData(callbackID), 0);
-
-    startShutdownTimerIfNecessary();
-}
-
-void PluginProcess::startShutdownTimerIfNecessary()
-{
-    if (!m_webProcessConnections.isEmpty())
-        return;
-
-    // Start the shutdown timer.
-    m_shutdownTimer.startOneShot(shutdownTimeout);
-}
-
-void PluginProcess::shutdownTimerFired()
-{
-    RunLoop::current()->stop();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.h b/Source/WebKit2/PluginProcess/PluginProcess.h
index 83c3b30..a610326 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.h
+++ b/Source/WebKit2/PluginProcess/PluginProcess.h
@@ -64,11 +64,14 @@ private:
     PluginProcess();
     ~PluginProcess();
 
+    // ChildProcess
+    virtual bool shouldTerminate();
+
     // CoreIPC::Connection::Client
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
     virtual void didClose(CoreIPC::Connection*);
     virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
-    virtual void didFailToSendSyncMessage(CoreIPC::Connection*);
+    virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
 
     // Message handlers.
     void didReceivePluginProcessMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
@@ -77,9 +80,6 @@ private:
     void getSitesWithData(uint64_t callbackID);
     void clearSiteData(const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID);
 
-    void startShutdownTimerIfNecessary();
-    void shutdownTimerFired();
-
     void platformInitialize(const PluginProcessCreationParameters&);
 
     // The connection to the UI process.
@@ -94,9 +94,6 @@ private:
     // The plug-in module.
     RefPtr<NetscapePluginModule> m_pluginModule;
     
-    // A timer used for the shutdown timeout.
-    RunLoop::Timer<PluginProcess> m_shutdownTimer;
-
 #if USE(ACCELERATED_COMPOSITING) && PLATFORM(MAC)
     // The Mach port used for accelerated compositing.
     mach_port_t m_compositingRenderServerPort;
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
index 56ffbb9..24e2027 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
@@ -157,6 +157,10 @@ void WebProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIP
     // FIXME: Implement.
 }
 
+void WebProcessConnection::syncMessageSendTimedOut(CoreIPC::Connection*)
+{
+}
+
 void WebProcessConnection::createPlugin(uint64_t pluginInstanceID, const Plugin::Parameters& parameters, const String& userAgent, bool isPrivateBrowsingEnabled, bool isAcceleratedCompositingEnabled, bool& result, uint32_t& remoteLayerClientID)
 {
     OwnPtr<PluginControllerProxy> pluginControllerProxy = PluginControllerProxy::create(this, pluginInstanceID, userAgent, isPrivateBrowsingEnabled, isAcceleratedCompositingEnabled);
@@ -173,7 +177,9 @@ void WebProcessConnection::createPlugin(uint64_t pluginInstanceID, const Plugin:
     if (!result)
         return;
 
+#if PLATFORM(MAC)
     remoteLayerClientID = pluginControllerProxyPtr->remoteLayerClientID();
+#endif
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.h b/Source/WebKit2/PluginProcess/WebProcessConnection.h
index 83fe0fe..57ad82b 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.h
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.h
@@ -61,6 +61,7 @@ private:
     virtual CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
     virtual void didClose(CoreIPC::Connection*);
     virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
 
     // Message handlers.
     CoreIPC::SyncReplyMode didReceiveSyncWebProcessConnectionMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
diff --git a/Source/WebKit2/PluginProcess/mac/PluginControllerProxyMac.mm b/Source/WebKit2/PluginProcess/mac/PluginControllerProxyMac.mm
index 610ca32..347d026 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginControllerProxyMac.mm
+++ b/Source/WebKit2/PluginProcess/mac/PluginControllerProxyMac.mm
@@ -67,17 +67,37 @@ uint32_t PluginControllerProxy::remoteLayerClientID() const
     return WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
 }
 
-void PluginControllerProxy::platformGeometryDidChange(const IntRect& frameRect, const IntRect&)
+void PluginControllerProxy::platformGeometryDidChange()
 {
     CALayer * pluginLayer = m_plugin->pluginLayer();
 
     // We don't want to animate to the new size so we disable actions for this transaction.
     [CATransaction begin];
     [CATransaction setValue:[NSNumber numberWithBool:YES] forKey:kCATransactionDisableActions];
-    [pluginLayer setFrame:CGRectMake(0, 0, frameRect.width(), frameRect.height())];
+    [pluginLayer setFrame:CGRectMake(0, 0, m_frameRect.width(), m_frameRect.height())];
     [CATransaction commit];
 }
 
+void PluginControllerProxy::windowFocusChanged(bool hasFocus)
+{
+    m_plugin->windowFocusChanged(hasFocus);
+}
+
+void PluginControllerProxy::windowAndViewFramesChanged(const IntRect& windowFrameInScreenCoordinates, const IntRect& viewFrameInWindowCoordinates)
+{
+    m_plugin->windowAndViewFramesChanged(windowFrameInScreenCoordinates, viewFrameInWindowCoordinates);
+}
+
+void PluginControllerProxy::windowVisibilityChanged(bool isVisible)
+{
+    m_plugin->windowVisibilityChanged(isVisible);
+}
+
+void PluginControllerProxy::sendComplexTextInput(const String& textInput)
+{
+    m_plugin->sendComplexTextInput(textInput);
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(PLUGIN_PROCESS)
diff --git a/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm b/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
index 3a3586a..d509d49 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
+++ b/Source/WebKit2/PluginProcess/mac/PluginProcessMac.mm
@@ -219,7 +219,7 @@ void PluginProcess::platformInitialize(const PluginProcessCreationParameters& pa
 {
     m_compositingRenderServerPort = parameters.acceleratedCompositingPort.port();
 
-    NSString *applicationName = [NSString stringWithFormat:UI_STRING("%@ (%@ Internet plug-in)",
+    NSString *applicationName = [NSString stringWithFormat:WEB_UI_STRING("%@ (%@ Internet plug-in)",
                                                                      "visible name of the plug-in host process. The first argument is the plug-in name "
                                                                      "and the second argument is the application name."),
                                  [[(NSString *)parameters.pluginPath lastPathComponent] stringByDeletingPathExtension], 
diff --git a/Source/WebKit2/PluginProcess/mac/PluginProcessShim.mm b/Source/WebKit2/PluginProcess/mac/PluginProcessShim.mm
index 6a32727..d01a24f 100644
--- a/Source/WebKit2/PluginProcess/mac/PluginProcessShim.mm
+++ b/Source/WebKit2/PluginProcess/mac/PluginProcessShim.mm
@@ -121,32 +121,6 @@ static void shimHideWindow(WindowRef window)
     HideWindow(window);
 }
 
-static bool isMenuBarVisible = true;
-
-static void shimShowMenuBar(void)
-{
-    isMenuBarVisible = true;
-
-    ShowMenuBar();
-}
-
-static void shimHideMenuBar(void)
-{
-    isMenuBarVisible = false;
-
-    // Make sure to make ourselves the front process
-    ProcessSerialNumber psn;
-    GetCurrentProcess(&psn);
-    SetFrontProcess(&psn);
-    
-    HideMenuBar();
-}
-
-static Boolean shimIsMenuBarVisible(void)
-{
-    return isMenuBarVisible;
-}
-
 DYLD_INTERPOSE(shimDebugger, Debugger);
 DYLD_INTERPOSE(shimGetCurrentEventButtonState, GetCurrentEventButtonState);
 DYLD_INTERPOSE(shimIsWindowActive, IsWindowActive);
@@ -154,9 +128,6 @@ DYLD_INTERPOSE(shimModalDialog, ModalDialog);
 DYLD_INTERPOSE(shimAlert, Alert);
 DYLD_INTERPOSE(shimShowWindow, ShowWindow);
 DYLD_INTERPOSE(shimHideWindow, HideWindow);
-DYLD_INTERPOSE(shimShowMenuBar, ShowMenuBar)
-DYLD_INTERPOSE(shimHideMenuBar, HideMenuBar)
-DYLD_INTERPOSE(shimIsMenuBarVisible, IsMenuBarVisible);
 
 #endif
 
diff --git a/Source/WebKit2/Scripts/webkit2/messages.py b/Source/WebKit2/Scripts/webkit2/messages.py
index 159ca32..433658d 100644
--- a/Source/WebKit2/Scripts/webkit2/messages.py
+++ b/Source/WebKit2/Scripts/webkit2/messages.py
@@ -81,9 +81,9 @@ class MessageReceiver(object):
                 elif line.startswith('#endif'):
                     condition = None
                 continue
-            match = re.search(r'([A-Za-z_0-9]+)\((.*?)\)(?:(?:\s+->\s+)\((.*?)\)(?:\s+(delayed))?)?', line)
+            match = re.search(r'([A-Za-z_0-9]+)\((.*?)\)(?:(?:\s+->\s+)\((.*?)\)(?:\s+(.*))?)?', line)
             if match:
-                name, parameters_string, reply_parameters_string, delayed_string = match.groups()
+                name, parameters_string, reply_parameters_string, attributes_string = match.groups()
                 if parameters_string:
                     parameters = parse_parameter_string(parameters_string)
                 else:
@@ -92,7 +92,13 @@ class MessageReceiver(object):
                 for parameter in parameters:
                     parameter.condition = condition
 
-                delayed = delayed_string == 'delayed'
+                if attributes_string:
+                    attributes = frozenset(attributes_string.split())
+                    is_delayed = "Delayed" in attributes
+                    dispatch_on_connection_queue = "DispatchOnConnectionQueue" in attributes
+                else:
+                    is_delayed = False
+                    dispatch_on_connection_queue = False
 
                 if reply_parameters_string:
                     reply_parameters = parse_parameter_string(reply_parameters_string)
@@ -101,17 +107,18 @@ class MessageReceiver(object):
                 else:
                     reply_parameters = None
 
-                messages.append(Message(name, parameters, reply_parameters, delayed, condition))
+                messages.append(Message(name, parameters, reply_parameters, is_delayed, dispatch_on_connection_queue, condition))
         return MessageReceiver(destination, messages, master_condition)
 
 
 class Message(object):
-    def __init__(self, name, parameters, reply_parameters, delayed, condition):
+    def __init__(self, name, parameters, reply_parameters, is_delayed, dispatch_on_connection_queue, condition):
         self.name = name
         self.parameters = parameters
         self.reply_parameters = reply_parameters
         if self.reply_parameters is not None:
-            self.delayed = delayed
+            self.is_delayed = is_delayed
+        self.dispatch_on_connection_queue = dispatch_on_connection_queue
         self.condition = condition
         if len(self.parameters) != 0:
             self.is_variadic = parameter_type_is_variadic(self.parameters[-1].type)
@@ -217,30 +224,20 @@ def message_to_struct_declaration(message):
     result.append(' {\n')
     result.append('    static const Kind messageID = %s;\n' % message.id())
     if message.reply_parameters != None:
-        if message.delayed:
+        if message.is_delayed:
             send_parameters = [(function_parameter_type(x.type), x.name) for x in message.reply_parameters]
-            result.append('    struct DelayedReply {\n')
-            result.append('        DelayedReply(PassRefPtr<CoreIPC::Connection> connection, PassOwnPtr<CoreIPC::ArgumentDecoder> arguments)\n')
-            result.append('            : m_connection(connection)\n')
-            result.append('            , m_arguments(arguments)\n')
-            result.append('        {\n')
-            result.append('        }\n')
+            result.append('    struct DelayedReply : public ThreadSafeRefCounted<DelayedReply> {\n')
+            result.append('        DelayedReply(PassRefPtr<CoreIPC::Connection>, PassOwnPtr<CoreIPC::ArgumentEncoder>);\n')
+            result.append('        ~DelayedReply();\n')
             result.append('\n')
-            result.append('        bool send(%s)\n' % ', '.join([' '.join(x) for x in send_parameters]))
-            result.append('        {\n')
-            result.append('            ASSERT(m_arguments);\n')
-            result += ['            m_arguments->encode(%s);\n' % x.name for x in message.reply_parameters]
-            result.append('            bool result = m_connection->sendSyncReply(m_arguments.release());\n')
-            result.append('            m_connection = nullptr;\n')
-            result.append('            return result;\n')
-            result.append('        }\n')
+            result.append('        bool send(%s);\n' % ', '.join([' '.join(x) for x in send_parameters]))
             result.append('\n')
             result.append('    private:\n')
             result.append('        RefPtr<CoreIPC::Connection> m_connection;\n')
-            result.append('        OwnPtr<CoreIPC::ArgumentDecoder> m_arguments;\n')
+            result.append('        OwnPtr<CoreIPC::ArgumentEncoder> m_arguments;\n')
             result.append('    };\n\n')
-        else:
-            result.append('    typedef %s Reply;\n' % reply_type(message))
+
+        result.append('    typedef %s Reply;\n' % reply_type(message))
 
     result.append('    typedef %s DecodeType;\n' % decode_type(message))
     if len(function_parameters):
@@ -254,6 +251,7 @@ def message_to_struct_declaration(message):
 
 def struct_or_class(namespace, type):
     structs = frozenset([
+        'WebCore::EditorCommandsForKeyEvent',
         'WebCore::CompositionUnderline',
         'WebCore::GrammarDetail',
         'WebCore::KeypressCommand',
@@ -261,14 +259,15 @@ def struct_or_class(namespace, type):
         'WebCore::PrintInfo',
         'WebCore::ViewportArguments',
         'WebCore::WindowFeatures',
+        'WebKit::AttributedString',
         'WebKit::ContextMenuState',
         'WebKit::DictionaryPopupInfo',
         'WebKit::DrawingAreaInfo',
+        'WebKit::EditorState',
         'WebKit::PlatformPopupMenuData',
         'WebKit::PluginProcessCreationParameters',
         'WebKit::PrintInfo',
         'WebKit::SecurityOriginData',
-        'WebKit::SelectionState',
         'WebKit::TextCheckerState',
         'WebKit::WebNavigationDataStore',
         'WebKit::WebOpenPanelParameters::Data',
@@ -299,6 +298,11 @@ def forward_declarations_and_headers(receiver):
         '"MessageID.h"',
     ])
 
+    for message in receiver.messages:
+        if message.reply_parameters != None and message.is_delayed:
+            headers.add('<wtf/ThreadSafeRefCounted.h>')
+            types_by_namespace['CoreIPC'].update(['ArgumentEncoder', 'Connection'])
+
     for parameter in receiver.iterparameters():
         type = parameter.type
 
@@ -385,14 +389,20 @@ def async_case_statement(receiver, message):
 
 def sync_case_statement(receiver, message):
     dispatch_function = 'handleMessage'
+    if message.is_delayed:
+        dispatch_function += 'Delayed'
     if message.is_variadic:
         dispatch_function += 'Variadic'
 
     result = []
     result.append('    case Messages::%s::%s:\n' % (receiver.name, message.id()))
-    result.append('        CoreIPC::%s<Messages::%s::%s>(arguments, reply, this, &%s);\n' % (dispatch_function, receiver.name, message.name, handler_function(receiver, message)))
-    # FIXME: Handle delayed replies
-    result.append('        return CoreIPC::AutomaticReply;\n')
+    result.append('        CoreIPC::%s<Messages::%s::%s>(%sarguments, reply, this, &%s);\n' % (dispatch_function, receiver.name, message.name, 'connection, ' if message.is_delayed else '', handler_function(receiver, message)))
+
+    if message.is_delayed:
+        result.append('        return CoreIPC::ManualReply;\n')
+    else:
+        result.append('        return CoreIPC::AutomaticReply;\n')
+
     return surround_in_condition(''.join(result), message.condition)
 
 
@@ -431,6 +441,7 @@ def headers_for_type(type):
     special_cases = {
         'WTF::String': '<wtf/text/WTFString.h>',
         'WebCore::CompositionUnderline': '<WebCore/Editor.h>',
+        'WebCore::GrammarDetail': '<WebCore/TextCheckerClient.h>',
         'WebCore::KeypressCommand': '<WebCore/KeyboardEvent.h>',
         'WebCore::PluginInfo': '<WebCore/PluginData.h>',
         'WebCore::TextCheckingResult': '<WebCore/TextCheckerClient.h>',
@@ -518,6 +529,46 @@ def generate_message_handler(file):
             result += ['#include %s\n' % headercondition]
     result.append('\n')
 
+    sync_delayed_messages = []
+    for message in receiver.messages:
+        if message.reply_parameters != None and message.is_delayed:
+            sync_delayed_messages.append(message)
+
+    if sync_delayed_messages:
+        result.append('namespace Messages {\n\nnamespace %s {\n\n' % receiver.name)
+
+        for message in sync_delayed_messages:
+            send_parameters = [(function_parameter_type(x.type), x.name) for x in message.reply_parameters]
+
+            if message.condition:
+                result.append('#if %s\n\n' % message.condition)
+            
+            result.append('%s::DelayedReply::DelayedReply(PassRefPtr<CoreIPC::Connection> connection, PassOwnPtr<CoreIPC::ArgumentEncoder> arguments)\n' % message.name)
+            result.append('    : m_connection(connection)\n')
+            result.append('    , m_arguments(arguments)\n')
+            result.append('{\n')
+            result.append('}\n')
+            result.append('\n')
+            result.append('%s::DelayedReply::~DelayedReply()\n' % message.name)
+            result.append('{\n')
+            result.append('    ASSERT(!m_connection);\n')
+            result.append('}\n')
+            result.append('\n')
+            result.append('bool %s::DelayedReply::send(%s)\n' % (message.name, ', '.join([' '.join(x) for x in send_parameters])))
+            result.append('{\n')
+            result.append('    ASSERT(m_arguments);\n')
+            result += ['    m_arguments->encode(%s);\n' % x.name for x in message.reply_parameters]
+            result.append('    bool result = m_connection->sendSyncReply(m_arguments.release());\n')
+            result.append('    m_connection = nullptr;\n')
+            result.append('    return result;\n')
+            result.append('}\n')
+            result.append('\n')
+
+            if message.condition:
+                result.append('#endif\n\n')
+
+        result.append('} // namespace %s\n\n} // namespace Messages\n\n' % receiver.name)
+
     result.append('namespace WebKit {\n\n')
 
     async_messages = []
@@ -541,7 +592,7 @@ def generate_message_handler(file):
 
     if sync_messages:
         result.append('\n')
-        result.append('CoreIPC::SyncReplyMode %s::didReceiveSync%sMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply)\n' % (receiver.name, receiver.name))
+        result.append('CoreIPC::SyncReplyMode %s::didReceiveSync%sMessage(CoreIPC::Connection*%s, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply)\n' % (receiver.name, receiver.name, ' connection' if sync_delayed_messages else ''))
         result.append('{\n')
         result.append('    switch (messageID.get<Messages::%s::Kind>()) {\n' % receiver.name)
         result += [sync_case_statement(receiver, message) for message in sync_messages]
diff --git a/Source/WebKit2/Scripts/webkit2/messages_unittest.py b/Source/WebKit2/Scripts/webkit2/messages_unittest.py
index 90d59ae..2fc5763 100644
--- a/Source/WebKit2/Scripts/webkit2/messages_unittest.py
+++ b/Source/WebKit2/Scripts/webkit2/messages_unittest.py
@@ -65,8 +65,10 @@ messages -> WebPage {
 
     CreatePlugin(uint64_t pluginInstanceID, WebKit::Plugin::Parameters parameters) -> (bool result)
     RunJavaScriptAlert(uint64_t frameID, WTF::String message) -> ()
-    GetPlugins(bool refresh) -> (Vector<WebCore::PluginInfo> plugins)
-    GetPluginProcessConnection(WTF::String pluginPath) -> (CoreIPC::Connection::Handle connectionHandle) delayed
+    GetPlugins(bool refresh) -> (Vector<WebCore::PluginInfo> plugins) DispatchOnConnectionQueue
+    GetPluginProcessConnection(WTF::String pluginPath) -> (CoreIPC::Connection::Handle connectionHandle) Delayed
+
+    TestMultipleAttributes() -> () DispatchOnConnectionQueue Delayed
 
 #if PLATFORM(MAC)
     DidCreateWebProcessConnection(CoreIPC::MachPort connectionIdentifier)
@@ -177,6 +179,14 @@ _expected_results = {
             'condition': None,
         },
         {
+            'name': 'TestMultipleAttributes',
+            'parameters': (
+            ),
+            'reply_parameters': (
+            ),
+            'condition': None,
+        },
+        {
             'name': 'DidCreateWebProcessConnection',
             'parameters': (
                 ('CoreIPC::MachPort', 'connectionIdentifier'),
@@ -260,9 +270,12 @@ _expected_header = """/*
 #include "Plugin.h"
 #include <WebCore/KeyboardEvent.h>
 #include <WebCore/PluginData.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/Vector.h>
 
 namespace CoreIPC {
+    class ArgumentEncoder;
+    class Connection;
     class MachPort;
 }
 
@@ -293,6 +306,7 @@ enum Kind {
     RunJavaScriptAlertID,
     GetPluginsID,
     GetPluginProcessConnectionID,
+    TestMultipleAttributesID,
 #if PLATFORM(MAC)
     DidCreateWebProcessConnectionID,
 #endif
@@ -394,27 +408,18 @@ struct GetPlugins : CoreIPC::Arguments1<bool> {
 
 struct GetPluginProcessConnection : CoreIPC::Arguments1<const WTF::String&> {
     static const Kind messageID = GetPluginProcessConnectionID;
-    struct DelayedReply {
-        DelayedReply(PassRefPtr<CoreIPC::Connection> connection, PassOwnPtr<CoreIPC::ArgumentDecoder> arguments)
-            : m_connection(connection)
-            , m_arguments(arguments)
-        {
-        }
+    struct DelayedReply : public ThreadSafeRefCounted<DelayedReply> {
+        DelayedReply(PassRefPtr<CoreIPC::Connection>, PassOwnPtr<CoreIPC::ArgumentEncoder>);
+        ~DelayedReply();
 
-        bool send(const CoreIPC::Connection::Handle& connectionHandle)
-        {
-            ASSERT(m_arguments);
-            m_arguments->encode(connectionHandle);
-            bool result = m_connection->sendSyncReply(m_arguments.release());
-            m_connection = nullptr;
-            return result;
-        }
+        bool send(const CoreIPC::Connection::Handle& connectionHandle);
 
     private:
         RefPtr<CoreIPC::Connection> m_connection;
-        OwnPtr<CoreIPC::ArgumentDecoder> m_arguments;
+        OwnPtr<CoreIPC::ArgumentEncoder> m_arguments;
     };
 
+    typedef CoreIPC::Arguments1<CoreIPC::Connection::Handle&> Reply;
     typedef CoreIPC::Arguments1<const WTF::String&> DecodeType;
     explicit GetPluginProcessConnection(const WTF::String& pluginPath)
         : CoreIPC::Arguments1<const WTF::String&>(pluginPath)
@@ -422,6 +427,23 @@ struct GetPluginProcessConnection : CoreIPC::Arguments1<const WTF::String&> {
     }
 };
 
+struct TestMultipleAttributes : CoreIPC::Arguments0 {
+    static const Kind messageID = TestMultipleAttributesID;
+    struct DelayedReply : public ThreadSafeRefCounted<DelayedReply> {
+        DelayedReply(PassRefPtr<CoreIPC::Connection>, PassOwnPtr<CoreIPC::ArgumentEncoder>);
+        ~DelayedReply();
+
+        bool send();
+
+    private:
+        RefPtr<CoreIPC::Connection> m_connection;
+        OwnPtr<CoreIPC::ArgumentEncoder> m_arguments;
+    };
+
+    typedef CoreIPC::Arguments0 Reply;
+    typedef CoreIPC::Arguments0 DecodeType;
+};
+
 #if PLATFORM(MAC)
 struct DidCreateWebProcessConnection : CoreIPC::Arguments1<const CoreIPC::MachPort&> {
     static const Kind messageID = DidCreateWebProcessConnectionID;
@@ -511,6 +533,53 @@ _expected_receiver_implementation = """/*
 #include "WebPageMessages.h"
 #include "WebPreferencesStore.h"
 
+namespace Messages {
+
+namespace WebPage {
+
+GetPluginProcessConnection::DelayedReply::DelayedReply(PassRefPtr<CoreIPC::Connection> connection, PassOwnPtr<CoreIPC::ArgumentEncoder> arguments)
+    : m_connection(connection)
+    , m_arguments(arguments)
+{
+}
+
+GetPluginProcessConnection::DelayedReply::~DelayedReply()
+{
+    ASSERT(!m_connection);
+}
+
+bool GetPluginProcessConnection::DelayedReply::send(const CoreIPC::Connection::Handle& connectionHandle)
+{
+    ASSERT(m_arguments);
+    m_arguments->encode(connectionHandle);
+    bool result = m_connection->sendSyncReply(m_arguments.release());
+    m_connection = nullptr;
+    return result;
+}
+
+TestMultipleAttributes::DelayedReply::DelayedReply(PassRefPtr<CoreIPC::Connection> connection, PassOwnPtr<CoreIPC::ArgumentEncoder> arguments)
+    : m_connection(connection)
+    , m_arguments(arguments)
+{
+}
+
+TestMultipleAttributes::DelayedReply::~DelayedReply()
+{
+    ASSERT(!m_connection);
+}
+
+bool TestMultipleAttributes::DelayedReply::send()
+{
+    ASSERT(m_arguments);
+    bool result = m_connection->sendSyncReply(m_arguments.release());
+    m_connection = nullptr;
+    return result;
+}
+
+} // namespace WebPage
+
+} // namespace Messages
+
 namespace WebKit {
 
 void WebPage::didReceiveWebPageMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
@@ -551,7 +620,7 @@ void WebPage::didReceiveWebPageMessage(CoreIPC::Connection*, CoreIPC::MessageID
     ASSERT_NOT_REACHED();
 }
 
-CoreIPC::SyncReplyMode WebPage::didReceiveSyncWebPageMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply)
+CoreIPC::SyncReplyMode WebPage::didReceiveSyncWebPageMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments, CoreIPC::ArgumentEncoder* reply)
 {
     switch (messageID.get<Messages::WebPage::Kind>()) {
     case Messages::WebPage::CreatePluginID:
@@ -564,8 +633,11 @@ CoreIPC::SyncReplyMode WebPage::didReceiveSyncWebPageMessage(CoreIPC::Connection
         CoreIPC::handleMessage<Messages::WebPage::GetPlugins>(arguments, reply, this, &WebPage::getPlugins);
         return CoreIPC::AutomaticReply;
     case Messages::WebPage::GetPluginProcessConnectionID:
-        CoreIPC::handleMessage<Messages::WebPage::GetPluginProcessConnection>(arguments, reply, this, &WebPage::getPluginProcessConnection);
-        return CoreIPC::AutomaticReply;
+        CoreIPC::handleMessageDelayed<Messages::WebPage::GetPluginProcessConnection>(connection, arguments, reply, this, &WebPage::getPluginProcessConnection);
+        return CoreIPC::ManualReply;
+    case Messages::WebPage::TestMultipleAttributesID:
+        CoreIPC::handleMessageDelayed<Messages::WebPage::TestMultipleAttributes>(connection, arguments, reply, this, &WebPage::testMultipleAttributes);
+        return CoreIPC::ManualReply;
 #if PLATFORM(MAC)
     case Messages::WebPage::InterpretKeyEventID:
         CoreIPC::handleMessage<Messages::WebPage::InterpretKeyEvent>(arguments, reply, this, &WebPage::interpretKeyEvent);
diff --git a/Source/WebKit2/Shared/API/c/WKSerializedScriptValue.h b/Source/WebKit2/Shared/API/c/WKSerializedScriptValue.h
index 95fc048..3f73d7a 100644
--- a/Source/WebKit2/Shared/API/c/WKSerializedScriptValue.h
+++ b/Source/WebKit2/Shared/API/c/WKSerializedScriptValue.h
@@ -36,7 +36,7 @@ extern "C" {
 WK_EXPORT WKTypeID WKSerializedScriptValueGetTypeID();
 
 WK_EXPORT WKSerializedScriptValueRef WKSerializedScriptValueCreate(JSContextRef context, JSValueRef value, JSValueRef* exception);
-WK_EXPORT JSValueRef WKSerializedScriptValueDeserialize(WKSerializedScriptValueRef scriptValue, JSContextRef constext, JSValueRef* exception);
+WK_EXPORT JSValueRef WKSerializedScriptValueDeserialize(WKSerializedScriptValueRef scriptValue, JSContextRef context, JSValueRef* exception);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/Shared/API/c/WKString.cpp b/Source/WebKit2/Shared/API/c/WKString.cpp
index 0c388c6..cbac67d 100644
--- a/Source/WebKit2/Shared/API/c/WKString.cpp
+++ b/Source/WebKit2/Shared/API/c/WKString.cpp
@@ -47,6 +47,17 @@ bool WKStringIsEmpty(WKStringRef stringRef)
     return toImpl(stringRef)->isEmpty();
 }
 
+size_t WKStringGetLength(WKStringRef stringRef)
+{
+    return toImpl(stringRef)->length();
+}
+
+size_t WKStringGetCharacters(WKStringRef stringRef, WKChar* buffer, size_t bufferLength)
+{
+    COMPILE_ASSERT(sizeof(WKChar) == sizeof(UChar), WKStringGetCharacters_sizeof_WKChar_matches_UChar);
+    return (toImpl(stringRef)->getCharacters(static_cast<UChar*>(buffer), bufferLength));
+}
+
 size_t WKStringGetMaximumUTF8CStringSize(WKStringRef stringRef)
 {
     return toImpl(stringRef)->maximumUTF8CStringSize();
diff --git a/Source/WebKit2/Shared/API/c/WKString.h b/Source/WebKit2/Shared/API/c/WKString.h
index dffcab2..d1bc1ef 100644
--- a/Source/WebKit2/Shared/API/c/WKString.h
+++ b/Source/WebKit2/Shared/API/c/WKString.h
@@ -36,12 +36,22 @@
 extern "C" {
 #endif
 
+#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__) \
+    && !((defined(__CC_ARM) || defined(__ARMCC__)) && !defined(__linux__)) /* RVCT */
+    typedef unsigned short WKChar;
+#else
+    typedef wchar_t WKChar;
+#endif
+
 WK_EXPORT WKTypeID WKStringGetTypeID();
 
 WK_EXPORT WKStringRef WKStringCreateWithUTF8CString(const char* string);
 
 WK_EXPORT bool WKStringIsEmpty(WKStringRef string);
 
+WK_EXPORT size_t WKStringGetLength(WKStringRef string);
+WK_EXPORT size_t WKStringGetCharacters(WKStringRef string, WKChar* buffer, size_t bufferLength);
+
 WK_EXPORT size_t WKStringGetMaximumUTF8CStringSize(WKStringRef string);
 WK_EXPORT size_t WKStringGetUTF8CString(WKStringRef string, char* buffer, size_t bufferSize);
 
diff --git a/Source/WebKit2/Shared/API/c/gtk/WKBaseGtk.h b/Source/WebKit2/Shared/API/c/gtk/WKBaseGtk.h
index 8f34ed3..eb88f70 100644
--- a/Source/WebKit2/Shared/API/c/gtk/WKBaseGtk.h
+++ b/Source/WebKit2/Shared/API/c/gtk/WKBaseGtk.h
@@ -32,6 +32,8 @@
 #error "Please #include \"WKBase.h\" instead of this file directly."
 #endif
 
+#include <stdbool.h>
+
 typedef const struct OpaqueWKView* WKViewRef;
 
 #endif /* WKBaseGtk_h */
diff --git a/Source/WebKit2/Shared/API/c/win/WKBaseWin.h b/Source/WebKit2/Shared/API/c/win/WKBaseWin.h
index fdd4607..d9c13e3 100644
--- a/Source/WebKit2/Shared/API/c/win/WKBaseWin.h
+++ b/Source/WebKit2/Shared/API/c/win/WKBaseWin.h
@@ -32,5 +32,7 @@
 
 typedef const struct OpaqueWKView* WKViewRef;
 typedef const struct OpaqueWKEditCommand* WKEditCommandRef;
+typedef const struct OpaqueWKTextChecker* WKTextCheckerRef;
+typedef const struct OpaqueWKGrammarDetail* WKGrammarDetailRef;
 
 #endif /* WKBaseWin_h */
diff --git a/Source/WebKit2/Shared/APIObject.h b/Source/WebKit2/Shared/APIObject.h
index 7f50b51..e5a7eed 100644
--- a/Source/WebKit2/Shared/APIObject.h
+++ b/Source/WebKit2/Shared/APIObject.h
@@ -104,8 +104,10 @@ public:
         TypeBundleScriptWorld,
 
         // Platform specific
-        TypeView,
-        TypeEditCommandProxy
+        TypeEditCommandProxy,
+        TypeGrammarDetail,
+        TypeTextChecker,
+        TypeView
     };
 
     virtual ~APIObject()
diff --git a/Source/WebKit2/Shared/ChildProcess.cpp b/Source/WebKit2/Shared/ChildProcess.cpp
index d45f4f2..e700caa 100644
--- a/Source/WebKit2/Shared/ChildProcess.cpp
+++ b/Source/WebKit2/Shared/ChildProcess.cpp
@@ -32,14 +32,54 @@
 
 namespace WebKit {
 
-ChildProcess::ChildProcess()
+void ChildProcess::disableTermination()
 {
+    m_terminationCounter++;
+    m_terminationTimer.stop();
+}
+
+void ChildProcess::enableTermination()
+{
+    ASSERT(m_terminationCounter > 0);
+    m_terminationCounter--;
+
+    if (m_terminationCounter)
+        return;
+
+    if (!m_terminationTimeout) {
+        terminationTimerFired();
+        return;
+    }
+
+    m_terminationTimer.startOneShot(m_terminationTimeout);
+}
+
+ChildProcess::ChildProcess(double terminationTimeout)
+    : m_terminationTimeout(terminationTimeout)
+    , m_terminationCounter(0)
+    , m_terminationTimer(RunLoop::main(), this, &ChildProcess::terminationTimerFired)
+{
+    // FIXME: The termination timer should not be scheduled on the main run loop.
+    // It won't work with the threaded mode, but it's not really useful anyway as is.
 }
 
 ChildProcess::~ChildProcess()
 {
 }
 
+void ChildProcess::terminationTimerFired()
+{
+    if (!shouldTerminate())
+        return;
+
+    terminate();
+}
+
+void ChildProcess::terminate()
+{
+    RunLoop::main()->stop();
+}
+
 NO_RETURN static void watchdogCallback()
 {
     // We use _exit here since the watchdog callback is called from another thread and we don't want 
diff --git a/Source/WebKit2/Shared/ChildProcess.h b/Source/WebKit2/Shared/ChildProcess.h
index 7286d52..0c66a9d 100644
--- a/Source/WebKit2/Shared/ChildProcess.h
+++ b/Source/WebKit2/Shared/ChildProcess.h
@@ -27,16 +27,57 @@
 #define ChildProcess_h
 
 #include "Connection.h"
+#include "RunLoop.h"
 
 namespace WebKit {
 
 class ChildProcess : protected CoreIPC::Connection::Client {
     WTF_MAKE_NONCOPYABLE(ChildProcess);
+
+public:
+    // disable and enable termination of the process. when disableTermination is called, the
+    // process won't terminate unless a corresponding disableTermination call is made.
+    void disableTermination();
+    void enableTermination();
+
+    class LocalTerminationDisabler {
+    public:
+        explicit LocalTerminationDisabler(ChildProcess& childProcess)
+            : m_childProcess(childProcess)
+        {
+            m_childProcess.disableTermination();
+        }
+
+        ~LocalTerminationDisabler()
+        {
+            m_childProcess.enableTermination();
+        }
+
+    private:
+        ChildProcess& m_childProcess;
+    };
+
 protected:
-    ChildProcess();
+    explicit ChildProcess(double terminationTimeout);
     ~ChildProcess();
 
     static void didCloseOnConnectionWorkQueue(WorkQueue&, CoreIPC::Connection*);
+
+private:
+    void terminationTimerFired();
+
+    virtual bool shouldTerminate() = 0;
+    virtual void terminate();
+
+    // The timeout, in seconds, before this process will be terminated if termination
+    // has been enabled. If the timeout is 0 seconds, the process will be terminated immediately.
+    double m_terminationTimeout;
+
+    // A termination counter; when the counter reaches zero, the process will be terminated
+    // after a given period of time.
+    unsigned m_terminationCounter;
+
+    RunLoop::Timer<ChildProcess> m_terminationTimer;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/DictionaryPopupInfo.cpp b/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
index 45bf91d..e24a138 100644
--- a/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
+++ b/Source/WebKit2/Shared/DictionaryPopupInfo.cpp
@@ -40,7 +40,7 @@ void DictionaryPopupInfo::encode(CoreIPC::ArgumentEncoder* encoder) const
     encoder->encode(fontInfo);
     encoder->encodeEnum(type);
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     CoreIPC::encode(encoder, options.get());
 #endif
 }
@@ -53,7 +53,7 @@ bool DictionaryPopupInfo::decode(CoreIPC::ArgumentDecoder* decoder, DictionaryPo
         return false;
     if (!decoder->decodeEnum(result.type))
         return false;
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     if (!CoreIPC::decode(decoder, result.options))
         return false;
 #endif
diff --git a/Source/WebKit2/Shared/DictionaryPopupInfo.h b/Source/WebKit2/Shared/DictionaryPopupInfo.h
index 68c81a7..3814ece 100644
--- a/Source/WebKit2/Shared/DictionaryPopupInfo.h
+++ b/Source/WebKit2/Shared/DictionaryPopupInfo.h
@@ -52,7 +52,7 @@ struct DictionaryPopupInfo {
     WebCore::FloatPoint origin;
     FontInfo fontInfo;
     Type type;
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     RetainPtr<CFDictionaryRef> options;
 #endif
 };
diff --git a/Source/WebKit2/Shared/SelectionState.h b/Source/WebKit2/Shared/EditorState.h
index 9931a10..1e8bcb8 100644
--- a/Source/WebKit2/Shared/SelectionState.h
+++ b/Source/WebKit2/Shared/EditorState.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,52 +23,37 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef SelectionState_h
-#define SelectionState_h
+#ifndef EditorState_h
+#define EditorState_h
 
 #include "ArgumentCoders.h"
 #include <wtf/NotFound.h>
 
 namespace WebKit {
 
-struct SelectionState {
-    SelectionState()
-        : isNone(true)
+struct EditorState {
+    EditorState()
+        : selectionIsNone(true)
+        , selectionIsRange(false)
         , isContentEditable(false)
         , isContentRichlyEditable(false)
         , isInPasswordField(false)
         , hasComposition(false)
-        , selectedRangeStart(notFound)
-        , selectedRangeLength(0)
     {
     }
 
-    // Whether there is a selection at all. This will be false when there is a caret selection.
-    bool isNone;
-
-    // Whether the selection is in a content editable area.
+    bool selectionIsNone; // This will be false when there is a caret selection.
+    bool selectionIsRange;
     bool isContentEditable;
-    
-    // Whether the selection is in a rich content editable area.
     bool isContentRichlyEditable;
-
-    // Whether the selection is in a password field.
     bool isInPasswordField;
-
-    // Whether the selection has a composition.
     bool hasComposition;
-
-    // The start of the selected range.
-    uint64_t selectedRangeStart;
-    
-    // The length of the selected range.
-    uint64_t selectedRangeLength;
 };
 
-} // namespace WebKit
+}
 
 namespace CoreIPC {
-template<> struct ArgumentCoder<WebKit::SelectionState> : SimpleArgumentCoder<WebKit::SelectionState> { };
+template<> struct ArgumentCoder<WebKit::EditorState> : SimpleArgumentCoder<WebKit::EditorState> { };
 };
 
-#endif // SelectionState_h
+#endif // EditorState_h
diff --git a/Source/WebKit2/Shared/NativeWebMouseEvent.h b/Source/WebKit2/Shared/NativeWebMouseEvent.h
new file mode 100644
index 0000000..01b8502
--- /dev/null
+++ b/Source/WebKit2/Shared/NativeWebMouseEvent.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NativeWebMouseEvent_h
+#define NativeWebMouseEvent_h
+
+#include "WebEvent.h"
+
+#if PLATFORM(MAC)
+#include <wtf/RetainPtr.h>
+OBJC_CLASS NSView;
+#elif PLATFORM(QT)
+#include <qgraphicssceneevent.h>
+#elif PLATFORM(GTK)
+typedef union _GdkEvent GdkEvent;
+#endif
+
+namespace WebKit {
+
+class NativeWebMouseEvent : public WebMouseEvent {
+public:
+#if PLATFORM(MAC)
+    NativeWebMouseEvent(NSEvent *, NSView *);
+#elif PLATFORM(WIN)
+    NativeWebMouseEvent(HWND, UINT message, WPARAM, LPARAM, bool);
+#elif PLATFORM(QT)
+    explicit NativeWebMouseEvent(QGraphicsSceneMouseEvent*, int);
+#elif PLATFORM(GTK)
+    NativeWebMouseEvent(GdkEvent*, int);
+#endif
+
+#if PLATFORM(MAC)
+    NSEvent* nativeEvent() const { return m_nativeEvent.get(); }
+#elif PLATFORM(WIN)
+    const MSG* nativeEvent() const { return &m_nativeEvent; }
+#elif PLATFORM(QT)
+    const QGraphicsSceneMouseEvent* nativeEvent() const { return m_nativeEvent; }
+#elif PLATFORM(GTK)
+    GdkEvent* nativeEvent() const { return m_nativeEvent; }
+#endif
+
+private:
+#if PLATFORM(MAC)
+    RetainPtr<NSEvent> m_nativeEvent;
+#elif PLATFORM(WIN)
+    MSG m_nativeEvent;
+#elif PLATFORM(QT)
+    QGraphicsSceneMouseEvent* m_nativeEvent;
+#elif PLATFORM(GTK)
+    GdkEvent* m_nativeEvent;
+#endif
+};
+
+} // namespace WebKit
+
+#endif // NativeWebMouseEvent_h
diff --git a/Source/WebKit2/Shared/PlatformPopupMenuData.cpp b/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
index 1f56daf..6c4d20e 100644
--- a/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
+++ b/Source/WebKit2/Shared/PlatformPopupMenuData.cpp
@@ -61,6 +61,7 @@ void PlatformPopupMenuData::encode(CoreIPC::ArgumentEncoder* encoder) const
     encoder->encode(selectedBackingStoreHandle);
 #elif PLATFORM(MAC)
     encoder->encode(fontInfo);
+    encoder->encode(shouldPopOver);
 #endif
 }
 
@@ -92,6 +93,8 @@ bool PlatformPopupMenuData::decode(CoreIPC::ArgumentDecoder* decoder, PlatformPo
 #elif PLATFORM(MAC)
     if (!decoder->decode(data.fontInfo))
         return false;
+    if (!decoder->decode(data.shouldPopOver))
+        return false;
 #endif
     
     return true;
diff --git a/Source/WebKit2/Shared/PlatformPopupMenuData.h b/Source/WebKit2/Shared/PlatformPopupMenuData.h
index 5b3f58d..f85008a 100644
--- a/Source/WebKit2/Shared/PlatformPopupMenuData.h
+++ b/Source/WebKit2/Shared/PlatformPopupMenuData.h
@@ -54,6 +54,7 @@ struct PlatformPopupMenuData {
     RefPtr<ShareableBitmap> m_selectedBackingStore;
 #elif PLATFORM(MAC)
     FontInfo fontInfo;
+    bool shouldPopOver;
 #endif
 };
 
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp b/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp
index 54af967..c5c0a90 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp
+++ b/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModule.cpp
@@ -32,10 +32,6 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/CString.h>
 
-#if !PLUGIN_ARCHITECTURE(MAC) && !PLUGIN_ARCHITECTURE(WIN) && !PLUGIN_ARCHITECTURE(X11)
-#error Unknown plug-in architecture
-#endif
-
 namespace WebKit {
 
 static Vector<NetscapePluginModule*>& initializedNetscapePluginModules()
@@ -88,6 +84,11 @@ bool NetscapePluginModule::tryGetSitesWithData(Vector<String>& sites)
         return false;
 
     char** siteArray = m_pluginFuncs.getsiteswithdata();
+
+    // There were no sites with data.
+    if (!siteArray)
+        return true;
+
     for (int i = 0; siteArray[i]; ++i) {
         char* site = siteArray[i];
 
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/SendingMessagesToTheWebProcessBeforeItIsValid.cpp b/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModuleNone.cpp
index d48ba31..dc4a37c 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/SendingMessagesToTheWebProcessBeforeItIsValid.cpp
+++ b/Source/WebKit2/Shared/Plugins/Netscape/NetscapePluginModuleNone.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,20 +24,24 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "Test.h"
+#include "config.h"
+#if PLUGIN_ARCHITECTURE(UNSUPPORTED)
 
-#include <WebKit2/WKRetainPtr.h>
-#include <WebKit2/WKContext.h>
+#include "NetscapePluginModule.h"
 
-namespace TestWebKitAPI {
+using namespace WebCore;
 
-TEST(WebKit2, SendingMessagesToTheWebProcessBeforeItIsValid)
+namespace WebKit {
+
+bool NetscapePluginModule::getPluginInfo(const String&, PluginInfoStore::Plugin&)
 {
-    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    return false;
+}
 
-    // Neither of these calls should cause a crash.
-    WKContextClearResourceCaches(context.get(), kWKAllResourceCaches);
-    WKContextClearResourceCaches(context.get(), kWKInMemoryResourceCachesOnly);
+void NetscapePluginModule::determineQuirks()
+{
 }
 
-} // namespace TestWebKitAPI
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm b/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
index d290f5b..6a867a0 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
+++ b/Source/WebKit2/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
@@ -273,22 +273,19 @@ static bool getPluginInfoFromCarbonResources(CFBundleRef bundle, PluginInfo& plu
     if (mimeTypesAndExtensions.size() % 2)
         return false;
 
-    size_t numMimeTypes = mimeTypesAndExtensions.size() / 2;
-    
     // Now get the MIME type descriptions string list. This string list needs to be the same length as the number of MIME types.
     Vector<String> mimeTypeDescriptions;
     if (!getStringListResource(MIMEDescriptionStringNumber, mimeTypeDescriptions))
         return false;
 
-    if (mimeTypeDescriptions.size() != numMimeTypes)
-        return false;
-
     // Add all MIME types.
     for (size_t i = 0; i < mimeTypesAndExtensions.size() / 2; ++i) {
         MimeClassInfo mimeClassInfo;
         
         const String& mimeType = mimeTypesAndExtensions[i * 2];
-        const String& description = mimeTypeDescriptions[i];
+        String description;
+        if (i < mimeTypeDescriptions.size())
+            description = mimeTypeDescriptions[i];
         
         mimeClassInfo.type = mimeType.lower();
         mimeClassInfo.desc = description;
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp b/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
index 76ecda7..2c9b465 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
+++ b/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
@@ -24,6 +24,8 @@
  */
 
 #include "config.h"
+#if PLUGIN_ARCHITECTURE(X11)
+
 #include "NetscapePluginModule.h"
 
 #include "PluginDatabase.h"
@@ -98,3 +100,5 @@ void NetscapePluginModule::determineQuirks()
 }
 
 } // namespace WebKit
+
+#endif // PLUGIN_ARCHITECTURE(X11)
diff --git a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
index 06014a9..c6c87a6 100644
--- a/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
+++ b/Source/WebKit2/Shared/Plugins/PluginProcessCreationParameters.cpp
@@ -46,7 +46,7 @@ void PluginProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder)
 #endif
 }
 
-bool PluginProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, PluginProcessCreationParameters::PluginProcessCreationParameters& result)
+bool PluginProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, PluginProcessCreationParameters& result)
 {
     if (!decoder->decode(result.pluginPath))
         return false;
diff --git a/Source/WebKit2/Shared/Plugins/PluginQuirks.h b/Source/WebKit2/Shared/Plugins/PluginQuirks.h
index ea4643b..1ea38cd 100644
--- a/Source/WebKit2/Shared/Plugins/PluginQuirks.h
+++ b/Source/WebKit2/Shared/Plugins/PluginQuirks.h
@@ -49,7 +49,7 @@ public:
         MakeTransparentIfBackgroundAttributeExists,
 
 #ifndef NP_NO_QUICKDRAW
-        // Allow the plug-in to use the QuickDraw drawing model, since wek now that the plug-in
+        // Allow the plug-in to use the QuickDraw drawing model, since we know that the plug-in
         // will never paint or receive events. Used by the AppleConnect plug-in.
         AllowHalfBakedQuickDrawSupport,
 #endif
diff --git a/Source/WebKit2/Shared/ShareableBitmap.h b/Source/WebKit2/Shared/ShareableBitmap.h
index fe7fa0a..d647a12 100644
--- a/Source/WebKit2/Shared/ShareableBitmap.h
+++ b/Source/WebKit2/Shared/ShareableBitmap.h
@@ -33,7 +33,7 @@
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <wtf/RetainPtr.h>
 #endif
 
@@ -98,7 +98,7 @@ public:
 
     bool isBackedBySharedMemory() const { return m_sharedMemory; }
 
-#if PLATFORM(CG)
+#if USE(CG)
     // This creates a copied CGImageRef (most likely a copy-on-write) of the shareable bitmap.
     RetainPtr<CGImageRef> makeCGImageCopy();
 
@@ -113,7 +113,7 @@ private:
 
     static size_t numBytesForSize(const WebCore::IntSize& size) { return size.width() * size.height() * 4; }
 
-#if PLATFORM(CG)
+#if USE(CG)
     static void releaseBitmapContextData(void* typelessBitmap, void* typelessData);
     static void releaseDataProviderData(void* typelessBitmap, const void* typelessData, size_t);
 #endif
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
index 99b3c00..e015d64 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
@@ -33,7 +33,7 @@ namespace CoreIPC {
 
 // For now, these are CG-only. Once other platforms have createImage functions,
 // we can compile these for non-CG builds.
-#if PLATFORM(CG)
+#if USE(CG)
 
 void encodeImage(ArgumentEncoder* encoder, Image* image)
 {
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.h b/Source/WebKit2/Shared/WebCoreArgumentCoders.h
index e12b9be..1b9b4f5 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.h
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.h
@@ -194,7 +194,7 @@ template<> struct ArgumentCoder<WebCore::Cursor> {
     static void encode(ArgumentEncoder* encoder, const WebCore::Cursor& cursor)
     {
         WebCore::Cursor::Type type = cursor.type();
-#if !PLATFORM(CG)
+#if !USE(CG)
         // FIXME: Currently we only have the createImage function implemented for CG.
         // Once we implement it for other platforms we can remove this conditional,
         // and the other conditionals below and in WebCoreArgumentCoders.cpp.
@@ -202,7 +202,7 @@ template<> struct ArgumentCoder<WebCore::Cursor> {
             type = WebCore::Cursor::Pointer;
 #endif
         encoder->encode(static_cast<uint32_t>(type));
-#if PLATFORM(CG)
+#if USE(CG)
         if (type != WebCore::Cursor::Custom)
             return;
 
@@ -225,7 +225,7 @@ template<> struct ArgumentCoder<WebCore::Cursor> {
             return true;
         }
 
-#if !PLATFORM(CG)
+#if !USE(CG)
         return false;
 #else
         RefPtr<WebCore::Image> image;
@@ -401,7 +401,7 @@ template<> struct ArgumentCoder<WebCore::KeypressCommand> {
 template<> struct ArgumentCoder<WebCore::CompositionUnderline> {
     static void encode(ArgumentEncoder* encoder, const WebCore::CompositionUnderline& underline)
     {
-        encoder->encode(CoreIPC::In(underline.startOffset, underline.endOffset, underline.thick, underline.color.rgb()));
+        encoder->encode(CoreIPC::In(underline.startOffset, underline.endOffset, underline.thick, underline.color));
     }
     
     static bool decode(ArgumentDecoder* decoder, WebCore::CompositionUnderline& underline)
diff --git a/Source/WebKit2/Shared/WebEvent.cpp b/Source/WebKit2/Shared/WebEvent.cpp
index f6738fa..8edc3fd 100644
--- a/Source/WebKit2/Shared/WebEvent.cpp
+++ b/Source/WebKit2/Shared/WebEvent.cpp
@@ -32,6 +32,13 @@
 
 namespace WebKit {
 
+WebEvent::WebEvent()
+    : m_type(static_cast<uint32_t>(NoType))
+    , m_modifiers(0)
+    , m_timestamp(0)
+{
+}
+
 WebEvent::WebEvent(Type type, Modifiers modifiers, double timestamp)
     : m_type(type)
     , m_modifiers(modifiers)
diff --git a/Source/WebKit2/Shared/WebEvent.h b/Source/WebKit2/Shared/WebEvent.h
index 6d2e60b..169c1a9 100644
--- a/Source/WebKit2/Shared/WebEvent.h
+++ b/Source/WebKit2/Shared/WebEvent.h
@@ -43,6 +43,8 @@ namespace WebKit {
 class WebEvent {
 public:
     enum Type {
+        NoType = -1,
+        
         // WebMouseEvent
         MouseDown,
         MouseUp,
@@ -77,6 +79,7 @@ public:
         ControlKey  = 1 << 1,
         AltKey      = 1 << 2,
         MetaKey     = 1 << 3,
+        CapsLockKey = 1 << 4,
     };
 
     Type type() const { return static_cast<Type>(m_type); }
@@ -85,13 +88,14 @@ public:
     bool controlKey() const { return m_modifiers & ControlKey; }
     bool altKey() const { return m_modifiers & AltKey; }
     bool metaKey() const { return m_modifiers & MetaKey; }
+    bool capsLockKey() const { return m_modifiers & CapsLockKey; }
 
     Modifiers modifiers() const { return static_cast<Modifiers>(m_modifiers); }
 
     double timestamp() const { return m_timestamp; }
 
 protected:
-    WebEvent() { }
+    WebEvent();
 
     WebEvent(Type, Modifiers, double timestamp);
 
@@ -114,7 +118,7 @@ public:
         RightButton
     };
 
-    WebMouseEvent() { }
+    WebMouseEvent();
 
     WebMouseEvent(Type, Button, const WebCore::IntPoint& position, const WebCore::IntPoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, Modifiers, double timestamp);
 #if PLATFORM(WIN)
diff --git a/Source/WebKit2/Shared/WebGraphicsContext.cpp b/Source/WebKit2/Shared/WebGraphicsContext.cpp
index 3d319e4..72220b3 100644
--- a/Source/WebKit2/Shared/WebGraphicsContext.cpp
+++ b/Source/WebKit2/Shared/WebGraphicsContext.cpp
@@ -26,15 +26,19 @@
 #include "config.h"
 #include "WebGraphicsContext.h"
 
+#if PLATFORM(GTK) 
+#include <WebCore/PlatformContextCairo.h> 
+#endif 
+
 using namespace WebCore;
 
 namespace WebKit {
 
 WebGraphicsContext::WebGraphicsContext(GraphicsContext* graphicsContext)
-#if PLATFORM(CG)
+#if USE(CG)
     : m_platformContext(graphicsContext->platformContext())
 #elif PLATFORM(GTK)
-    : m_platformContext(graphicsContext->platformContext())
+    : m_platformContext(graphicsContext->platformContext()->cr())
 #endif
 {
 }
diff --git a/Source/WebKit2/Shared/WebGraphicsContext.h b/Source/WebKit2/Shared/WebGraphicsContext.h
index ddb2e34..5f72aae 100644
--- a/Source/WebKit2/Shared/WebGraphicsContext.h
+++ b/Source/WebKit2/Shared/WebGraphicsContext.h
@@ -30,7 +30,7 @@
 #include <WebCore/GraphicsContext.h>
 #include <wtf/PassRefPtr.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <wtf/RetainPtr.h>
 #elif PLATFORM(GTK)
 #include "RefPtrCairo.h"
@@ -47,7 +47,7 @@ public:
         return adoptRef(new WebGraphicsContext(graphicsContext));
     }
 
-#if PLATFORM(CG)
+#if USE(CG)
     CGContextRef platformContext() { return m_platformContext.get(); }
 #elif PLATFORM(GTK)
     cairo_t* platformContext() { return m_platformContext.get(); }
@@ -59,7 +59,7 @@ private:
 
     virtual Type type() const { return APIType; }
 
-#if PLATFORM(CG)
+#if USE(CG)
     RetainPtr<CGContextRef> m_platformContext;
 #elif PLATFORM(GTK)
     RefPtr<cairo_t> m_platformContext;
diff --git a/Source/WebKit2/Shared/WebMouseEvent.cpp b/Source/WebKit2/Shared/WebMouseEvent.cpp
index 16e5057..7aa7dff 100644
--- a/Source/WebKit2/Shared/WebMouseEvent.cpp
+++ b/Source/WebKit2/Shared/WebMouseEvent.cpp
@@ -33,6 +33,19 @@ using namespace WebCore;
 
 namespace WebKit {
 
+WebMouseEvent::WebMouseEvent()
+    : WebEvent()
+    , m_button(static_cast<uint32_t>(NoButton))
+    , m_deltaX(0)
+    , m_deltaY(0)
+    , m_deltaZ(0)
+    , m_clickCount(0)
+#if PLATFORM(WIN)
+    , m_didActivateWebView(false)
+#endif
+{
+}
+
 WebMouseEvent::WebMouseEvent(Type type, Button button, const IntPoint& position, const IntPoint& globalPosition, float deltaX, float deltaY, float deltaZ, int clickCount, Modifiers modifiers, double timestamp)
     : WebEvent(type, modifiers, timestamp)
     , m_button(button)
diff --git a/Source/WebKit2/Shared/WebPageGroupData.cpp b/Source/WebKit2/Shared/WebPageGroupData.cpp
index e8df62f..107df1d 100644
--- a/Source/WebKit2/Shared/WebPageGroupData.cpp
+++ b/Source/WebKit2/Shared/WebPageGroupData.cpp
@@ -33,12 +33,12 @@ namespace WebKit {
 
 void WebPageGroupData::encode(CoreIPC::ArgumentEncoder* encoder) const
 {
-    return encoder->encode(CoreIPC::In(identifer, pageGroupID, visibleToInjectedBundle));
+    return encoder->encode(CoreIPC::In(identifer, pageGroupID, visibleToInjectedBundle, visibleToHistoryClient));
 }
 
 bool WebPageGroupData::decode(CoreIPC::ArgumentDecoder* decoder, WebPageGroupData& data)
 {
-    return decoder->decode(CoreIPC::Out(data.identifer, data.pageGroupID, data.visibleToInjectedBundle));
+    return decoder->decode(CoreIPC::Out(data.identifer, data.pageGroupID, data.visibleToInjectedBundle, data.visibleToHistoryClient));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/WebPageGroupData.h b/Source/WebKit2/Shared/WebPageGroupData.h
index fedb5de..36f6fe1 100644
--- a/Source/WebKit2/Shared/WebPageGroupData.h
+++ b/Source/WebKit2/Shared/WebPageGroupData.h
@@ -42,6 +42,7 @@ struct WebPageGroupData {
     String identifer;
     uint64_t pageGroupID;
     bool visibleToInjectedBundle;
+    bool visibleToHistoryClient;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/WebPopupItem.h b/Source/WebKit2/Shared/WebPopupItem.h
index 85495a3..3dc61d7 100644
--- a/Source/WebKit2/Shared/WebPopupItem.h
+++ b/Source/WebKit2/Shared/WebPopupItem.h
@@ -38,13 +38,13 @@ namespace WebKit {
 
 struct WebPopupItem {
     enum Type {
-        Seperator,
+        Separator,
         Item
     };
 
     WebPopupItem();
     WebPopupItem(Type);
-    WebPopupItem(Type, const String& text, WebCore::TextDirection, bool hasTextDirectionOverride, const String& toolTip, const String& accessibilityText, bool isEnabled, bool m_isLabel);
+    WebPopupItem(Type, const String& text, WebCore::TextDirection, bool hasTextDirectionOverride, const String& toolTip, const String& accessibilityText, bool isEnabled, bool isLabel);
 
     void encode(CoreIPC::ArgumentEncoder*) const;
     static bool decode(CoreIPC::ArgumentDecoder*, WebPopupItem&);
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.cpp b/Source/WebKit2/Shared/WebPreferencesStore.cpp
index c072740..e0bbd4e 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.cpp
+++ b/Source/WebKit2/Shared/WebPreferencesStore.cpp
@@ -28,6 +28,7 @@
 
 #include "FontSmoothingLevel.h"
 #include "WebCoreArgumentCoders.h"
+#include <WebCore/Settings.h>
 
 namespace WebKit {
 
@@ -51,6 +52,8 @@ static bool hasXSSAuditorEnabledTestRunnerOverride;
 static bool xssAuditorEnabledTestRunnerOverride;
 static bool hasAllowUniversalAccessFromFileURLsTestRunnerOverride;
 static bool allowUniversalAccessFromFileURLsTestRunnerOverride;
+static bool hasAllowFileAccessFromFileURLsTestRunnerOverride;
+static bool allowFileAccessFromFileURLsTestRunnerOverride;
 
 WebPreferencesStore::WebPreferencesStore()
 {
@@ -72,6 +75,9 @@ bool WebPreferencesStore::decode(CoreIPC::ArgumentDecoder* decoder, WebPreferenc
     if (hasAllowUniversalAccessFromFileURLsTestRunnerOverride)
         s.m_boolValues.set(WebPreferencesKey::allowUniversalAccessFromFileURLsKey(), allowUniversalAccessFromFileURLsTestRunnerOverride);
 
+    if (hasAllowFileAccessFromFileURLsTestRunnerOverride)
+        s.m_boolValues.set(WebPreferencesKey::allowFileAccessFromFileURLsKey(), allowFileAccessFromFileURLsTestRunnerOverride);
+
     return true;
 }
 
@@ -87,6 +93,12 @@ void WebPreferencesStore::overrideAllowUniversalAccessFromFileURLsForTestRunner(
     allowUniversalAccessFromFileURLsTestRunnerOverride = enabled;
 }
 
+void WebPreferencesStore::overrideAllowFileAccessFromFileURLsForTestRunner(bool enabled)
+{
+    hasAllowFileAccessFromFileURLsTestRunnerOverride = true;
+    allowFileAccessFromFileURLsTestRunnerOverride = enabled;
+}
+
 void WebPreferencesStore::removeTestRunnerOverrides()
 {
     hasXSSAuditorEnabledTestRunnerOverride = false;
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.h b/Source/WebKit2/Shared/WebPreferencesStore.h
index 43ef487..8bef2b4 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.h
+++ b/Source/WebKit2/Shared/WebPreferencesStore.h
@@ -39,6 +39,7 @@ namespace WebKit {
 #define FOR_EACH_WEBKIT_BOOL_PREFERENCE(macro) \
     macro(JavaScriptEnabled, javaScriptEnabled, Bool, bool, true) \
     macro(LoadsImagesAutomatically, loadsImagesAutomatically, Bool, bool, true) \
+    macro(LoadsSiteIconsIgnoringImageLoadingPreference, loadsSiteIconsIgnoringImageLoadingPreference, Bool, bool, false) \
     macro(PluginsEnabled, pluginsEnabled, Bool, bool, true) \
     macro(JavaEnabled, javaEnabled, Bool, bool, true) \
     macro(OfflineWebApplicationCacheEnabled, offlineWebApplicationCacheEnabled, Bool, bool, false) \
@@ -86,6 +87,7 @@ namespace WebKit {
     macro(DefaultFontSize, defaultFontSize, UInt32, uint32_t, 16) \
     macro(DefaultFixedFontSize, defaultFixedFontSize, UInt32, uint32_t, 13) \
     macro(PDFDisplayMode, pdfDisplayMode, UInt32, uint32_t, 1) \
+    macro(EditableLinkBehavior, editableLinkBehavior, UInt32, uint32_t, WebCore::EditableLinkNeverLive) \
     \
 
 #if PLATFORM(WIN)
@@ -169,6 +171,7 @@ struct WebPreferencesStore {
 
     static void overrideXSSAuditorEnabledForTestRunner(bool);
     static void overrideAllowUniversalAccessFromFileURLsForTestRunner(bool);
+    static void overrideAllowFileAccessFromFileURLsForTestRunner(bool);
     static void removeTestRunnerOverrides();
 
     HashMap<String, String> m_stringValues;
diff --git a/Source/WebKit2/Shared/WebProcessCreationParameters.cpp b/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
index db3cd4c..651aaf1 100644
--- a/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
+++ b/Source/WebKit2/Shared/WebProcessCreationParameters.cpp
@@ -32,8 +32,6 @@ namespace WebKit {
 
 WebProcessCreationParameters::WebProcessCreationParameters()
     : shouldTrackVisitedLinks(false)
-    , clearResourceCaches(false)
-    , clearApplicationCache(false)
     , shouldAlwaysUseComplexTextCodePath(false)
     , defaultRequestTimeoutInterval(INT_MAX)
 #if PLATFORM(MAC)
@@ -58,8 +56,6 @@ void WebProcessCreationParameters::encode(CoreIPC::ArgumentEncoder* encoder) con
     encoder->encode(mimeTypesWithCustomRepresentation);
     encoder->encodeEnum(cacheModel);
     encoder->encode(shouldTrackVisitedLinks);
-    encoder->encode(clearResourceCaches);
-    encoder->encode(clearApplicationCache);
     encoder->encode(shouldAlwaysUseComplexTextCodePath);
     encoder->encode(iconDatabaseEnabled);
     encoder->encode(languageCode);
@@ -109,10 +105,6 @@ bool WebProcessCreationParameters::decode(CoreIPC::ArgumentDecoder* decoder, Web
         return false;
     if (!decoder->decode(parameters.shouldTrackVisitedLinks))
         return false;
-    if (!decoder->decode(parameters.clearResourceCaches))
-        return false;
-    if (!decoder->decode(parameters.clearApplicationCache))
-        return false;
     if (!decoder->decode(parameters.shouldAlwaysUseComplexTextCodePath))
         return false;
     if (!decoder->decode(parameters.iconDatabaseEnabled))
diff --git a/Source/WebKit2/Shared/WebProcessCreationParameters.h b/Source/WebKit2/Shared/WebProcessCreationParameters.h
index 112d6eb..faac556 100644
--- a/Source/WebKit2/Shared/WebProcessCreationParameters.h
+++ b/Source/WebKit2/Shared/WebProcessCreationParameters.h
@@ -64,9 +64,6 @@ struct WebProcessCreationParameters {
 
     CacheModel cacheModel;
     bool shouldTrackVisitedLinks;
-    
-    bool clearResourceCaches;
-    bool clearApplicationCache;
 
     bool shouldAlwaysUseComplexTextCodePath;
 
@@ -88,13 +85,14 @@ struct WebProcessCreationParameters {
     pid_t presenterApplicationPid;
 
     // FIXME: These should be merged with CFURLCache counterparts below.
-    CString nsURLCachePath;
+    String nsURLCachePath;
     uint64_t nsURLCacheMemoryCapacity;
     uint64_t nsURLCacheDiskCapacity;
 
     CoreIPC::MachPort acceleratedCompositingPort;
 
-    CString uiProcessBundleResourcePath;
+    String uiProcessBundleResourcePath;
+
 #elif PLATFORM(WIN)
     String cfURLCachePath;
     uint64_t cfURLCacheDiskCapacity;
diff --git a/Source/WebKit2/Shared/WebString.h b/Source/WebKit2/Shared/WebString.h
index 6827276..5935b4a 100644
--- a/Source/WebKit2/Shared/WebString.h
+++ b/Source/WebKit2/Shared/WebString.h
@@ -57,6 +57,16 @@ public:
 
     bool isNull() const { return m_string.isNull(); }
     bool isEmpty() const { return m_string.isEmpty(); }
+    
+    size_t length() const { return m_string.length(); }
+    size_t getCharacters(UChar* buffer, size_t bufferLength) const
+    {
+        if (!bufferLength)
+            return 0;
+        bufferLength = std::min(bufferLength, static_cast<size_t>(m_string.length()));
+        memcpy(buffer, m_string.characters(), bufferLength * sizeof(UChar));
+        return bufferLength;
+    }
 
     size_t maximumUTF8CStringSize() const { return m_string.length() * 3 + 1; }
     size_t getUTF8CString(char* buffer, size_t bufferSize)
diff --git a/Source/WebKit2/Shared/gtk/NativeWebMouseEventGtk.cpp b/Source/WebKit2/Shared/gtk/NativeWebMouseEventGtk.cpp
new file mode 100644
index 0000000..c0bbbd6
--- /dev/null
+++ b/Source/WebKit2/Shared/gtk/NativeWebMouseEventGtk.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NativeWebMouseEvent.h"
+
+#include "WebEventFactory.h"
+
+namespace WebKit {
+
+NativeWebMouseEvent::NativeWebMouseEvent(GdkEvent* event, int eventClickCount)
+    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, eventClickCount))
+    , m_nativeEvent(event)
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/Shared/mac/ArgumentCodersMac.h b/Source/WebKit2/Shared/mac/ArgumentCodersMac.h
new file mode 100644
index 0000000..e83a50f
--- /dev/null
+++ b/Source/WebKit2/Shared/mac/ArgumentCodersMac.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ArgumentCodersMac_h
+#define ArgumentCodersMac_h
+
+#include <wtf/RetainPtr.h>
+
+namespace CoreIPC {
+
+class ArgumentEncoder;
+class ArgumentDecoder;
+
+// NSAttributedString
+void encode(ArgumentEncoder*, NSAttributedString *);
+bool decode(ArgumentDecoder*, RetainPtr<NSAttributedString>&);
+
+// NSColor
+void encode(ArgumentEncoder*, NSColor *);
+bool decode(ArgumentDecoder*, RetainPtr<NSColor>&);
+
+// NSDictionary
+void encode(ArgumentEncoder*, NSDictionary *);
+bool decode(ArgumentDecoder*, RetainPtr<NSDictionary>&);
+
+// NSFont
+void encode(ArgumentEncoder*, NSFont *);
+bool decode(ArgumentDecoder*, RetainPtr<NSFont>&);
+
+// NSNumber
+void encode(ArgumentEncoder*, NSNumber *);
+bool decode(ArgumentDecoder*, RetainPtr<NSNumber>&);
+
+// NSString
+void encode(ArgumentEncoder*, NSString *);
+bool decode(ArgumentDecoder*, RetainPtr<NSString>&);
+
+}
+
+#endif // ArgumentCodersMac_h
diff --git a/Source/WebKit2/Shared/mac/ArgumentCodersMac.mm b/Source/WebKit2/Shared/mac/ArgumentCodersMac.mm
new file mode 100644
index 0000000..394f56c
--- /dev/null
+++ b/Source/WebKit2/Shared/mac/ArgumentCodersMac.mm
@@ -0,0 +1,343 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "ArgumentCodersMac.h"
+
+#import "ArgumentCodersCF.h"
+#import "ArgumentDecoder.h"
+#import "ArgumentEncoder.h"
+#import "WebCoreArgumentCoders.h"
+#import <WebCore/ColorMac.h>
+
+using namespace WebCore;
+using namespace std;
+
+namespace CoreIPC {
+
+enum NSType {
+    NSAttributedStringType,
+    NSColorType,
+    NSDictionaryType,
+    NSFontType,
+    NSNumberType,
+    NSStringType,
+    Unknown,
+};
+
+static NSType typeFromObject(id object)
+{
+    ASSERT(object);
+
+    if ([object isKindOfClass:[NSAttributedString class]])
+        return NSAttributedStringType;
+    if ([object isKindOfClass:[NSColor class]])
+        return NSColorType;
+    if ([object isKindOfClass:[NSDictionary class]])
+        return NSDictionaryType;
+    if ([object isKindOfClass:[NSFont class]])
+        return NSFontType;
+    if ([object isKindOfClass:[NSNumber class]])
+        return NSNumberType;
+    if ([object isKindOfClass:[NSString class]])
+        return NSStringType;
+
+    ASSERT_NOT_REACHED();
+    return Unknown;
+}
+
+static void encode(ArgumentEncoder* encoder, id object)
+{
+    NSType type = typeFromObject(object);
+    encoder->encodeEnum(type);
+
+    switch (type) {
+    case NSAttributedStringType:
+        encode(encoder, static_cast<NSAttributedString *>(object));
+        return;
+    case NSColorType:
+        encode(encoder, static_cast<NSColor *>(object));
+        return;
+    case NSDictionaryType:
+        encode(encoder, static_cast<NSDictionary *>(object));
+        return;
+    case NSFontType:
+        encode(encoder, static_cast<NSFont *>(object));
+        return;
+    case NSNumberType:
+        encode(encoder, static_cast<NSNumber *>(object));
+        return;
+    case NSStringType:
+        encode(encoder, static_cast<NSString *>(object));
+        return;
+    case Unknown:
+        break;
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+static bool decode(ArgumentDecoder* decoder, RetainPtr<id>& result)
+{
+    NSType type;
+    if (!decoder->decodeEnum(type))
+        return false;
+
+    switch (type) {
+    case NSAttributedStringType: {
+        RetainPtr<NSAttributedString> string;
+        if (!decode(decoder, string))
+            return false;
+        result = string;
+        return true;
+    }
+    case NSColorType: {
+        RetainPtr<NSColor> color;
+        if (!decode(decoder, color))
+            return false;
+        result = color;
+        return true;
+    }
+    case NSDictionaryType: {
+        RetainPtr<NSDictionary> dictionary;
+        if (!decode(decoder, dictionary))
+            return false;
+        result = dictionary;
+        return true;
+    }
+    case NSFontType: {
+        RetainPtr<NSFont> font;
+        if (!decode(decoder, font))
+            return false;
+        result = font;
+        return true;
+    }
+    case NSNumberType: {
+        RetainPtr<NSNumber> number;
+        if (!decode(decoder, number))
+            return false;
+        result = number;
+        return true;
+    }
+    case NSStringType: {
+        RetainPtr<NSString> string;
+        if (!decode(decoder, string))
+            return false;
+        result = string;
+        return true;
+    }
+    case Unknown:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    return false;
+}
+
+void encode(ArgumentEncoder* encoder, NSAttributedString *string)
+{
+    // Even though NSAttributedString is toll free bridged with CFAttributedStringRef, attributes' values may be not, so we should stay within this file's code.
+
+    NSString *plainString = [string string];
+    NSUInteger length = [plainString length];
+    CoreIPC::encode(encoder, plainString);
+
+    Vector<pair<NSRange, RetainPtr<NSDictionary> > > ranges;
+
+    NSUInteger position = 0;
+    while (position < length) {
+        // Collect ranges in a vector, becasue the total count should be encoded first.
+        NSRange effectiveRange;
+        RetainPtr<NSDictionary> attributesAtIndex = [string attributesAtIndex:position effectiveRange:&effectiveRange];
+        ASSERT(effectiveRange.location == position);
+        ASSERT(effectiveRange.length);
+        ASSERT(NSMaxRange(effectiveRange) <= length);
+
+        ranges.append(make_pair(effectiveRange, attributesAtIndex));
+
+        position = NSMaxRange(effectiveRange);
+    }
+
+    encoder->encodeUInt64(ranges.size());
+
+    for (size_t i = 0; i < ranges.size(); ++i) {
+        encoder->encodeUInt64(ranges[i].first.location);
+        encoder->encodeUInt64(ranges[i].first.length);
+        CoreIPC::encode(encoder, ranges[i].second.get());
+    }
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSAttributedString>& result)
+{
+    RetainPtr<NSString> plainString;
+    if (!CoreIPC::decode(decoder, plainString))
+        return false;
+
+    NSUInteger stringLength = [plainString.get() length];
+
+    RetainPtr<NSMutableAttributedString> resultString(AdoptNS, [[NSMutableAttributedString alloc] initWithString:plainString.get()]);
+
+    uint64_t rangeCount;
+    if (!decoder->decode(rangeCount))
+        return false;
+
+    while (rangeCount--) {
+        uint64_t rangeLocation;
+        uint64_t rangeLength;
+        RetainPtr<NSDictionary> attributes;
+        if (!decoder->decode(rangeLocation))
+            return false;
+        if (!decoder->decode(rangeLength))
+            return false;
+
+        ASSERT(rangeLocation + rangeLength > rangeLocation);
+        ASSERT(rangeLocation + rangeLength <= stringLength);
+        if (rangeLocation + rangeLength <= rangeLocation || rangeLocation + rangeLength > stringLength)
+            return false;
+
+        if (!CoreIPC::decode(decoder, attributes))
+            return false;
+        [resultString.get() addAttributes:attributes.get() range:NSMakeRange(rangeLocation, rangeLength)];
+    }
+
+    result.adoptCF(resultString.leakRef());
+    return true;
+}
+
+void encode(ArgumentEncoder* encoder, NSColor *color)
+{
+    encoder->encode(colorFromNSColor(color));
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSColor>& result)
+{
+    Color color;
+    if (!decoder->decode(color))
+        return false;
+
+    result = nsColor(color);
+    return true;
+}
+
+void encode(ArgumentEncoder* encoder, NSDictionary *dictionary)
+{
+    // Even though NSDictionary is toll free bridged with CFDictionaryRef, values may be not, so we should stay within this file's code.
+
+    NSUInteger size = [dictionary count];
+    NSArray *keys = [dictionary allKeys];
+    NSArray *values = [dictionary allValues];
+
+    encoder->encodeUInt64(size);
+
+    for (NSUInteger i = 0; i < size; ++i) {
+        id key = [keys objectAtIndex:i];
+        id value = [values objectAtIndex:i];
+        ASSERT(key);
+        ASSERT([key isKindOfClass:[NSString class]]);
+        ASSERT(value);
+
+        // Ignore values we don't recognize.
+        if (typeFromObject(value) == Unknown)
+            continue;
+
+        encode(encoder, (NSString *)key);
+        encode(encoder, value);
+    }
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSDictionary>& result)
+{
+    uint64_t size;
+    if (!decoder->decodeUInt64(size))
+        return false;
+
+    RetainPtr<NSMutableDictionary> dictionary(AdoptNS, [[NSMutableDictionary alloc] initWithCapacity:size]);
+    for (uint64_t i = 0; i < size; ++i) {
+        // Try to decode the key name.
+        RetainPtr<NSString> key;
+        if (!decode(decoder, key))
+            return false;
+
+        RetainPtr<id> value;
+        if (!decode(decoder, value))
+            return false;
+
+        [dictionary.get() setObject:value.get() forKey:key.get()];
+    }
+
+    result.adoptCF(dictionary.leakRef());
+    return true;
+}
+
+
+void encode(ArgumentEncoder* encoder, NSFont *font)
+{
+    // NSFont could use CTFontRef code if we had it in ArgumentCodersCF.
+    encode(encoder, [[font fontDescriptor] fontAttributes]);
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSFont>& result)
+{
+    RetainPtr<NSDictionary> fontAttributes;
+    if (!decode(decoder, fontAttributes))
+        return false;
+
+    NSFontDescriptor *fontDescriptor = [NSFontDescriptor fontDescriptorWithFontAttributes:fontAttributes.get()];
+    result = [NSFont fontWithDescriptor:fontDescriptor size:0];
+
+    return true;
+}
+
+void encode(ArgumentEncoder* encoder, NSNumber *number)
+{
+    encode(encoder, (CFNumberRef)number);
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSNumber>& result)
+{
+    RetainPtr<CFNumberRef> number;
+    if (!decode(decoder, number))
+        return false;
+
+    result.adoptCF((NSNumber *)number.leakRef());
+    return true;
+}
+
+void encode(ArgumentEncoder* encoder, NSString *string)
+{
+    encode(encoder, (CFStringRef)string);
+}
+
+bool decode(ArgumentDecoder* decoder, RetainPtr<NSString>& result)
+{
+    RetainPtr<CFStringRef> string;
+    if (!decode(decoder, string))
+        return false;
+
+    result.adoptCF((NSString *)string.leakRef());
+    return true;
+}
+
+}
diff --git a/Source/WebKit2/Shared/mac/AttributedString.h b/Source/WebKit2/Shared/mac/AttributedString.h
new file mode 100644
index 0000000..6c8a8ae
--- /dev/null
+++ b/Source/WebKit2/Shared/mac/AttributedString.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AttributedString_h
+#define AttributedString_h
+
+#include <wtf/RetainPtr.h>
+
+OBJC_CLASS NSAttributedString;
+
+namespace CoreIPC {
+    class ArgumentDecoder;
+    class ArgumentEncoder;
+}
+
+namespace WebKit {
+
+struct AttributedString {
+    void encode(CoreIPC::ArgumentEncoder*) const;
+    static bool decode(CoreIPC::ArgumentDecoder*, AttributedString&);
+    
+    RetainPtr<NSAttributedString> string;
+};
+
+}
+
+#endif // AttributedString_h
diff --git a/Source/WebKit2/Shared/mac/AttributedString.mm b/Source/WebKit2/Shared/mac/AttributedString.mm
new file mode 100644
index 0000000..bc7cfd0
--- /dev/null
+++ b/Source/WebKit2/Shared/mac/AttributedString.mm
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "AttributedString.h"
+
+#import "ArgumentCodersMac.h"
+#import "ArgumentDecoder.h"
+#import "ArgumentEncoder.h"
+
+namespace WebKit {
+
+void AttributedString::encode(CoreIPC::ArgumentEncoder* encoder) const
+{
+    encoder->encode(!string);
+    if (!string)
+        return;
+    CoreIPC::encode(encoder, string.get());
+}
+
+bool AttributedString::decode(CoreIPC::ArgumentDecoder* decoder, AttributedString& attributedString)
+{
+    bool isNull;
+    if (!decoder->decode(isNull))
+        return false;
+    if (isNull)
+        return true;
+    return CoreIPC::decode(decoder, attributedString.string);
+}
+
+}
diff --git a/Source/WebKit2/Shared/mac/NativeWebMouseEventMac.mm b/Source/WebKit2/Shared/mac/NativeWebMouseEventMac.mm
new file mode 100644
index 0000000..b7064a3
--- /dev/null
+++ b/Source/WebKit2/Shared/mac/NativeWebMouseEventMac.mm
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "NativeWebMouseEvent.h"
+
+#import "WebEventFactory.h"
+
+namespace WebKit {
+
+NativeWebMouseEvent::NativeWebMouseEvent(NSEvent* event, NSView* view)
+    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, view))
+    , m_nativeEvent(event)
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/Shared/mac/SandboxExtensionMac.mm b/Source/WebKit2/Shared/mac/SandboxExtensionMac.mm
index 54cf5d3..60626d1 100644
--- a/Source/WebKit2/Shared/mac/SandboxExtensionMac.mm
+++ b/Source/WebKit2/Shared/mac/SandboxExtensionMac.mm
@@ -33,6 +33,7 @@
 #import "DataReference.h"
 #import "WebKitSystemInterface.h"
 #import <WebCore/FileSystem.h>
+#import <sys/stat.h>
 #import <wtf/text/CString.h>
 
 using namespace WebCore;
@@ -108,12 +109,55 @@ static WKSandboxExtensionType wkSandboxExtensionType(SandboxExtension::Type type
     return WKSandboxExtensionTypeReadOnly;
 }
 
+static CString resolveSymlinksInPath(const CString& path)
+{
+    struct stat statBuf;
+
+    // Check if this file exists.
+    if (!stat(path.data(), &statBuf)) {
+        char resolvedName[PATH_MAX];
+
+        return realpath(path.data(), resolvedName);
+    }
+
+    char* slashPtr = strrchr(path.data(), '/');
+    if (slashPtr == path.data())
+        return path;
+
+    size_t parentDirectoryLength = slashPtr - path.data();
+    if (parentDirectoryLength >= PATH_MAX)
+        return CString();
+
+    // Get the parent directory.
+    char parentDirectory[PATH_MAX];
+    memcpy(parentDirectory, path.data(), parentDirectoryLength);
+    parentDirectory[parentDirectoryLength] = '\0';
+
+    // Resolve it.
+    CString resolvedParentDirectory = resolveSymlinksInPath(CString(parentDirectory));
+    if (resolvedParentDirectory.isNull())
+        return CString();
+
+    size_t lastPathComponentLength = path.length() - parentDirectoryLength;
+    size_t resolvedPathLength = resolvedParentDirectory.length() + lastPathComponentLength;
+    if (resolvedPathLength >= PATH_MAX)
+        return CString();
+
+    // Combine the resolved parent directory with the last path component.
+    char* resolvedPathBuffer;
+    CString resolvedPath = CString::newUninitialized(resolvedPathLength, resolvedPathBuffer);
+    memcpy(resolvedPathBuffer, resolvedParentDirectory.data(), resolvedParentDirectory.length());
+    memcpy(resolvedPathBuffer + resolvedParentDirectory.length(), slashPtr, lastPathComponentLength);
+
+    return resolvedPath;
+}
+
 void SandboxExtension::createHandle(const String& path, Type type, Handle& handle)
 {
     ASSERT(!handle.m_sandboxExtension);
 
-    NSString *standardizedPath = [(NSString *)path stringByStandardizingPath];
-    handle.m_sandboxExtension = WKSandboxExtensionCreate([standardizedPath fileSystemRepresentation], wkSandboxExtensionType(type));
+    CString standardizedPath = resolveSymlinksInPath([[(NSString *)path stringByStandardizingPath] fileSystemRepresentation]);
+    handle.m_sandboxExtension = WKSandboxExtensionCreate(standardizedPath.data(), wkSandboxExtensionType(type));
 }
     
 String SandboxExtension::createHandleForTemporaryFile(const String& prefix, Type type, Handle& handle)
diff --git a/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm b/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
index 321cb40..174daf9 100644
--- a/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
+++ b/Source/WebKit2/Shared/mac/WebCoreArgumentCodersMac.mm
@@ -188,6 +188,7 @@ bool decodeResourceError(ArgumentDecoder* decoder, ResourceError& resourceError)
     NSError *nsError = [[NSError alloc] initWithDomain:nsString(domain) code:code userInfo:userInfo];
 
     resourceError = ResourceError(nsError);
+    [nsError release];
     return true;
 }
 
diff --git a/Source/WebKit2/Shared/mac/WebEventFactory.mm b/Source/WebKit2/Shared/mac/WebEventFactory.mm
index 67ab1ba..4622080 100644
--- a/Source/WebKit2/Shared/mac/WebEventFactory.mm
+++ b/Source/WebKit2/Shared/mac/WebEventFactory.mm
@@ -207,8 +207,9 @@ static WebWheelEvent::Phase phaseForEvent(NSEvent *event)
 
 static WebWheelEvent::Phase momentumPhaseForEvent(NSEvent *event)
 {
-#if !defined(BUILDING_ON_SNOW_LEOPARD)
     uint32_t phase = WebWheelEvent::PhaseNone; 
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     if ([event momentumPhase] & NSEventPhaseBegan)
         phase |= WebWheelEvent::PhaseBegan;
     if ([event momentumPhase] & NSEventPhaseStationary)
@@ -219,10 +220,24 @@ static WebWheelEvent::Phase momentumPhaseForEvent(NSEvent *event)
         phase |= WebWheelEvent::PhaseEnded;
     if ([event momentumPhase] & NSEventPhaseCancelled)
         phase |= WebWheelEvent::PhaseCancelled;
-    return static_cast<WebWheelEvent::Phase>(phase);
 #else
-    return WebWheelEvent::PhaseNone;
+    switch (WKGetNSEventMomentumPhase(event)) {
+    case WKEventPhaseNone:
+        phase = WebWheelEvent::PhaseNone;
+        break;
+    case WKEventPhaseBegan:
+        phase = WebWheelEvent::PhaseBegan;
+        break;
+    case WKEventPhaseChanged:
+        phase = WebWheelEvent::PhaseChanged;
+        break;
+    case WKEventPhaseEnded:
+        phase = WebWheelEvent::PhaseEnded;
+        break;
+    }
 #endif
+
+    return static_cast<WebWheelEvent::Phase>(phase);
 }
 
 #if ENABLE(GESTURE_EVENTS)
@@ -1015,6 +1030,8 @@ static inline bool isKeyUpEvent(NSEvent *event)
 static inline WebEvent::Modifiers modifiersForEvent(NSEvent *event)
 {
     unsigned modifiers = 0;
+    if ([event modifierFlags] & NSAlphaShiftKeyMask)
+        modifiers |= WebEvent::CapsLockKey;
     if ([event modifierFlags] & NSShiftKeyMask)
         modifiers |= WebEvent::ShiftKey;
     if ([event modifierFlags] & NSControlKeyMask)
diff --git a/Source/WebKit2/Shared/CoreIPCSupport/WebProcessProxyMessageKinds.h b/Source/WebKit2/Shared/qt/NativeWebMouseEventQt.cpp
index 1f5a6be..a6f6e34 100644
--- a/Source/WebKit2/Shared/CoreIPCSupport/WebProcessProxyMessageKinds.h
+++ b/Source/WebKit2/Shared/qt/NativeWebMouseEventQt.cpp
@@ -23,29 +23,17 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebProcessProxyMessageKinds_h
-#define WebProcessProxyMessageKinds_h
+#include "config.h"
+#include "NativeWebMouseEvent.h"
 
-// Messages sent from the web process to the WebProcessProxy.
+#include "WebEventFactoryQt.h"
 
-#include "MessageID.h"
-
-namespace WebProcessProxyLegacyMessage {
-
-enum Kind {
-#if ENABLE(PLUGIN_PROCESS)
-    GetPluginProcessConnection,
-#endif
-};
-
-}
-
-namespace CoreIPC {
-
-template<> struct MessageKindTraits<WebProcessProxyLegacyMessage::Kind> { 
-    static const MessageClass messageClass = MessageClassWebProcessProxyLegacy;
-};
+namespace WebKit {
 
+NativeWebMouseEvent::NativeWebMouseEvent(QGraphicsSceneMouseEvent* event, int eventClickCount)
+    : WebMouseEvent(WebEventFactory::createWebMouseEvent(event, eventClickCount))
+    , m_nativeEvent(event)
+{
 }
 
-#endif // WebProcessProxyMessageKinds_h
+} // namespace WebKit
diff --git a/Source/WebKit2/Shared/win/NativeWebMouseEventWin.cpp b/Source/WebKit2/Shared/win/NativeWebMouseEventWin.cpp
new file mode 100644
index 0000000..5b83dc6
--- /dev/null
+++ b/Source/WebKit2/Shared/win/NativeWebMouseEventWin.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NativeWebMouseEvent.h"
+
+#include "WebEventFactory.h"
+
+namespace WebKit {
+
+NativeWebMouseEvent::NativeWebMouseEvent(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam, bool didActivateWebView)
+    : WebMouseEvent(WebEventFactory::createWebMouseEvent(hwnd, message, wParam, lParam, didActivateWebView))
+    , m_nativeEvent()
+{
+    m_nativeEvent.hwnd = hwnd;
+    m_nativeEvent.message = message;
+    m_nativeEvent.wParam = wParam;
+    m_nativeEvent.lParam = lParam;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp b/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
index 0d1ca36..6770f21 100644
--- a/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
+++ b/Source/WebKit2/Shared/win/PlatformCertificateInfo.cpp
@@ -30,7 +30,7 @@
 #include "ArgumentEncoder.h"
 #include <WebCore/ResourceResponse.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #endif
 
@@ -48,7 +48,7 @@ PlatformCertificateInfo::PlatformCertificateInfo(const ResourceResponse& respons
     if (!cfResponse)
         return;
 
-#if PLATFORM(CG)
+#if USE(CG)
     CFDictionaryRef certificateInfo = wkGetSSLCertificateInfo(cfResponse);
     if (!certificateInfo)
         return;
diff --git a/Source/WebKit2/UIProcess/API/C/WKAPICast.h b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
index a440c6f..81c2f5f 100644
--- a/Source/WebKit2/UIProcess/API/C/WKAPICast.h
+++ b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
@@ -37,11 +37,13 @@
 #include "WKPage.h"
 #include "WKPreferencesPrivate.h"
 #include "WKProtectionSpaceTypes.h"
+#include "WKResourceCacheManager.h"
 #include "WKSharedAPICast.h"
 #include <WebCore/CookieJar.h>
 #include <WebCore/Credential.h>
 #include <WebCore/FrameLoaderTypes.h>
 #include <WebCore/ProtectionSpace.h>
+#include <WebCore/Settings.h>
 
 namespace WebKit {
 
@@ -182,6 +184,44 @@ inline WKFontSmoothingLevel toAPI(FontSmoothingLevel level)
     return kWKFontSmoothingLevelMedium;
 }
 
+inline WKEditableLinkBehavior toAPI(WebCore::EditableLinkBehavior behavior)
+{
+    switch (behavior) {
+    case WebCore::EditableLinkDefaultBehavior:
+        return kWKEditableLinkBehaviorDefault;
+    case WebCore::EditableLinkAlwaysLive:
+        return kWKEditableLinkBehaviorAlwaysLive;
+    case WebCore::EditableLinkOnlyLiveWithShiftKey:
+        return kWKEditableLinkBehaviorOnlyLiveWithShiftKey;
+    case WebCore::EditableLinkLiveWhenNotFocused:
+        return kWKEditableLinkBehaviorLiveWhenNotFocused;
+    case WebCore::EditableLinkNeverLive:
+        return kWKEditableLinkBehaviorNeverLive;
+    }
+    
+    ASSERT_NOT_REACHED();
+    return kWKEditableLinkBehaviorNeverLive;
+}
+
+inline WebCore::EditableLinkBehavior toEditableLinkBehavior(WKEditableLinkBehavior wkBehavior)
+{
+    switch (wkBehavior) {
+    case kWKEditableLinkBehaviorDefault:
+        return WebCore::EditableLinkDefaultBehavior;
+    case kWKEditableLinkBehaviorAlwaysLive:
+        return WebCore::EditableLinkAlwaysLive;
+    case kWKEditableLinkBehaviorOnlyLiveWithShiftKey:
+        return WebCore::EditableLinkOnlyLiveWithShiftKey;
+    case kWKEditableLinkBehaviorLiveWhenNotFocused:
+        return WebCore::EditableLinkLiveWhenNotFocused;
+    case kWKEditableLinkBehaviorNeverLive:
+        return WebCore::EditableLinkNeverLive;
+    }
+    
+    ASSERT_NOT_REACHED();
+    return WebCore::EditableLinkNeverLive;
+}
+    
 inline WKProtectionSpaceServerType toAPI(WebCore::ProtectionSpaceServerType type)
 {
     switch (type) {
@@ -246,9 +286,9 @@ inline WebCore::CredentialPersistence toCredentialPersistence(WKCredentialPersis
 inline ResourceCachesToClear toResourceCachesToClear(WKResourceCachesToClear wkResourceCachesToClear)
 {
     switch (wkResourceCachesToClear) {
-    case kWKAllResourceCaches:
+    case WKResourceCachesToClearAll:
         return AllResourceCaches;
-    case kWKInMemoryResourceCachesOnly:
+    case WKResourceCachesToClearInMemoryOnly:
         return InMemoryResourceCachesOnly;
     }
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.cpp b/Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.cpp
index 5f6a222..00dc6da 100644
--- a/Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.cpp
@@ -45,3 +45,8 @@ WKStringRef WKBackForwardListItemCopyTitle(WKBackForwardListItemRef itemRef)
 {
     return toCopiedAPI(toImpl(itemRef)->title());
 }
+
+WKURLRef WKBackForwardListItemCopyOriginalURL(WKBackForwardListItemRef itemRef)
+{
+    return toCopiedURLAPI(toImpl(itemRef)->originalURL());
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.h b/Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.h
index b0bf1de..3810d15 100644
--- a/Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.h
+++ b/Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.h
@@ -36,6 +36,7 @@ WK_EXPORT WKTypeID WKBackForwardListItemGetTypeID();
 
 WK_EXPORT WKURLRef WKBackForwardListItemCopyURL(WKBackForwardListItemRef item);
 WK_EXPORT WKStringRef WKBackForwardListItemCopyTitle(WKBackForwardListItemRef item);
+WK_EXPORT WKURLRef WKBackForwardListItemCopyOriginalURL(WKBackForwardListItemRef item);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.cpp b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
index bf196b7..063f3ea 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
@@ -84,9 +84,9 @@ void WKContextSetDownloadClient(WKContextRef contextRef, const WKContextDownload
     toImpl(contextRef)->initializeDownloadClient(wkClient);
 }
 
-void WKContextDownloadURLRequest(WKContextRef contextRef, const WKURLRequestRef requestRef)
+WKDownloadRef WKContextDownloadURLRequest(WKContextRef contextRef, const WKURLRequestRef requestRef)
 {
-    toImpl(contextRef)->download(0, toImpl(requestRef)->resourceRequest());
+    return toAPI(toImpl(contextRef)->download(0, toImpl(requestRef)->resourceRequest()));
 }
 
 void WKContextSetInitializationUserDataForInjectedBundle(WKContextRef contextRef,  WKTypeRef userDataRef)
@@ -148,16 +148,6 @@ void WKContextSetDomainRelaxationForbiddenForURLScheme(WKContextRef contextRef,
     toImpl(contextRef)->setDomainRelaxationForbiddenForURLScheme(toImpl(urlScheme)->string());
 }
 
-void WKContextClearResourceCaches(WKContextRef contextRef, WKResourceCachesToClear cachesToClear)
-{
-    toImpl(contextRef)->clearResourceCaches(toResourceCachesToClear(cachesToClear));
-}
-
-void WKContextClearApplicationCache(WKContextRef contextRef)
-{
-    toImpl(contextRef)->clearApplicationCache();
-}
-
 WKCookieManagerRef WKContextGetCookieManager(WKContextRef contextRef)
 {
     return toAPI(toImpl(contextRef)->cookieManagerProxy());
@@ -227,3 +217,18 @@ void WKContextSetLocalStorageDirectory(WKContextRef contextRef, WKStringRef loca
 {
     toImpl(contextRef)->setLocalStorageDirectory(toImpl(localStorageDirectory)->string());
 }
+
+void WKContextDisableProcessTermination(WKContextRef contextRef)
+{
+    toImpl(contextRef)->disableProcessTermination();
+}
+
+void WKContextEnableProcessTermination(WKContextRef contextRef)
+{
+    toImpl(contextRef)->enableProcessTermination();
+}
+
+void _WKContextSetHTTPPipeliningEnabled(WKContextRef contextRef, bool enabled)
+{
+    toImpl(contextRef)->setHTTPPipeliningEnabled(enabled);
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.h b/Source/WebKit2/UIProcess/API/C/WKContext.h
index 606574f..6e8e4c0 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.h
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.h
@@ -39,12 +39,6 @@ enum {
 };
 typedef uint32_t WKCacheModel;
 
-enum {
-    kWKAllResourceCaches = 0,
-    kWKInMemoryResourceCachesOnly = 1
-};
-typedef uint32_t WKResourceCachesToClear;
-
 // Injected Bundle Client
 typedef void (*WKContextDidReceiveMessageFromInjectedBundleCallback)(WKContextRef page, WKStringRef messageName, WKTypeRef messageBody, const void *clientInfo);
 typedef void (*WKContextDidReceiveSynchronousMessageFromInjectedBundleCallback)(WKContextRef page, WKStringRef messageName, WKTypeRef messageBody, WKTypeRef* returnData, const void *clientInfo);
@@ -115,7 +109,7 @@ WK_EXPORT void WKContextSetInjectedBundleClient(WKContextRef context, const WKCo
 WK_EXPORT void WKContextSetHistoryClient(WKContextRef context, const WKContextHistoryClient* client);
 WK_EXPORT void WKContextSetDownloadClient(WKContextRef context, const WKContextDownloadClient* client);
 
-WK_EXPORT void WKContextDownloadURLRequest(WKContextRef context, const WKURLRequestRef request);
+WK_EXPORT WKDownloadRef WKContextDownloadURLRequest(WKContextRef context, const WKURLRequestRef request);
 
 WK_EXPORT void WKContextSetInitializationUserDataForInjectedBundle(WKContextRef context, WKTypeRef userData);
 WK_EXPORT void WKContextPostMessageToInjectedBundle(WKContextRef context, WKStringRef messageName, WKTypeRef messageBody);
@@ -125,9 +119,6 @@ WK_EXPORT void WKContextAddVisitedLink(WKContextRef context, WKStringRef visited
 WK_EXPORT void WKContextSetCacheModel(WKContextRef context, WKCacheModel cacheModel);
 WK_EXPORT WKCacheModel WKContextGetCacheModel(WKContextRef context);
 
-WK_EXPORT void WKContextClearResourceCaches(WKContextRef context, WKResourceCachesToClear cachesToClear);
-WK_EXPORT void WKContextClearApplicationCache(WKContextRef context);
-
 WK_EXPORT void WKContextStartMemorySampler(WKContextRef context, WKDoubleRef interval);
 WK_EXPORT void WKContextStopMemorySampler(WKContextRef context);
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h b/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
index 5fd7dd3..153ef3e 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
+++ b/Source/WebKit2/UIProcess/API/C/WKContextPrivate.h
@@ -61,6 +61,13 @@ WK_EXPORT void WKContextSetIconDatabasePath(WKContextRef context, WKStringRef ic
 WK_EXPORT void WKContextSetDatabaseDirectory(WKContextRef context, WKStringRef databaseDirectory);
 WK_EXPORT void WKContextSetLocalStorageDirectory(WKContextRef context, WKStringRef localStorageDirectory);
 
+// FIXME: This is a workaround for testing purposes only and should be removed once a better
+// solution has been found for testing.
+WK_EXPORT void WKContextDisableProcessTermination(WKContextRef context);
+WK_EXPORT void WKContextEnableProcessTermination(WKContextRef context);
+
+WK_EXPORT void _WKContextSetHTTPPipeliningEnabled(WKContextRef context, bool enabled);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/C/WKFrame.h b/Source/WebKit2/UIProcess/API/C/WKFrame.h
index 334a27b..eec939e 100644
--- a/Source/WebKit2/UIProcess/API/C/WKFrame.h
+++ b/Source/WebKit2/UIProcess/API/C/WKFrame.h
@@ -36,12 +36,12 @@
 extern "C" {
 #endif
 
-enum WKFrameLoadState {
+enum {
     kWKFrameLoadStateProvisional = 0,
     kWKFrameLoadStateCommitted = 1,
     kWKFrameLoadStateFinished = 2
 };
-typedef enum WKFrameLoadState WKFrameLoadState;
+typedef uint32_t WKFrameLoadState;
 
 WK_EXPORT WKTypeID WKFrameGetTypeID();
  
diff --git a/Source/WebKit2/UIProcess/API/C/WKIconDatabase.cpp b/Source/WebKit2/UIProcess/API/C/WKIconDatabase.cpp
index c8e87a0..8e9327f 100644
--- a/Source/WebKit2/UIProcess/API/C/WKIconDatabase.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKIconDatabase.cpp
@@ -36,6 +36,13 @@ WKTypeID WKIconDatabaseGetTypeID()
     return toAPI(WebIconDatabase::APIType);
 }
 
+void WKIconDatabaseSetIconDatabaseClient(WKIconDatabaseRef iconDatabaseRef, const WKIconDatabaseClient* wkClient)
+{
+    if (wkClient && wkClient->version)
+        return;
+    toImpl(iconDatabaseRef)->initializeIconDatabaseClient(wkClient);
+}
+
 void WKIconDatabaseRetainIconForURL(WKIconDatabaseRef iconDatabaseRef, WKURLRef pageURLRef)
 {
     toImpl(iconDatabaseRef)->retainIconForPageURL(toWTFString(pageURLRef));
@@ -50,3 +57,18 @@ void WKIconDatabaseEnableDatabaseCleanup(WKIconDatabaseRef iconDatabaseRef)
 {
     toImpl(iconDatabaseRef)->enableDatabaseCleanup();
 }
+
+void WKIconDatabaseRemoveAllIcons(WKIconDatabaseRef iconDatabaseRef)
+{
+    toImpl(iconDatabaseRef)->removeAllIcons();
+}
+
+void WKIconDatabaseCheckIntegrityBeforeOpening(WKIconDatabaseRef iconDatabaseRef)
+{
+    toImpl(iconDatabaseRef)->checkIntegrityBeforeOpening();
+}
+
+void WKIconDatabaseClose(WKIconDatabaseRef iconDatabaseRef)
+{
+    toImpl(iconDatabaseRef)->close();
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKIconDatabase.h b/Source/WebKit2/UIProcess/API/C/WKIconDatabase.h
index 1ea1860..ece3399 100644
--- a/Source/WebKit2/UIProcess/API/C/WKIconDatabase.h
+++ b/Source/WebKit2/UIProcess/API/C/WKIconDatabase.h
@@ -32,12 +32,31 @@
 extern "C" {
 #endif
 
+// IconDatabase Client.
+typedef void (*WKIconDatabaseDidChangeIconForPageURLCallback)(WKIconDatabaseRef iconDatabase, WKURLRef pageURL, const void* clientInfo);
+typedef void (*WKIconDatabaseDidRemoveAllIconsCallback)(WKIconDatabaseRef iconDatabase, const void* clientInfo);
+
+struct WKIconDatabaseClient {
+    int                                                                 version;
+    const void *                                                        clientInfo;
+    WKIconDatabaseDidChangeIconForPageURLCallback                       didChangeIconForPageURL;
+    WKIconDatabaseDidRemoveAllIconsCallback                             didRemoveAllIcons;
+};
+typedef struct WKIconDatabaseClient WKIconDatabaseClient;
+
 WK_EXPORT WKTypeID WKIconDatabaseGetTypeID();
 
+WK_EXPORT void WKIconDatabaseSetIconDatabaseClient(WKIconDatabaseRef iconDatabase, const WKIconDatabaseClient* client);
+
 WK_EXPORT void WKIconDatabaseRetainIconForURL(WKIconDatabaseRef iconDatabase, WKURLRef pageURL);
 WK_EXPORT void WKIconDatabaseReleaseIconForURL(WKIconDatabaseRef iconDatabase, WKURLRef pageURL);
 WK_EXPORT void WKIconDatabaseEnableDatabaseCleanup(WKIconDatabaseRef iconDatabase);
 
+WK_EXPORT void WKIconDatabaseRemoveAllIcons(WKIconDatabaseRef iconDatabase);
+WK_EXPORT void WKIconDatabaseCheckIntegrityBeforeOpening(WKIconDatabaseRef iconDatabase);
+
+WK_EXPORT void WKIconDatabaseClose(WKIconDatabaseRef iconDatabase);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.cpp b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
index 7061e39..18bc5a7 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
@@ -32,6 +32,7 @@
 #include "WebBackForwardList.h"
 #include "WebData.h"
 #include "WebPageProxy.h"
+#include "WebProcessProxy.h"
 
 #ifdef __BLOCKS__
 #include <Block.h>
@@ -46,7 +47,7 @@ WKTypeID WKPageGetTypeID()
 
 WKContextRef WKPageGetContext(WKPageRef pageRef)
 {
-    return toAPI(toImpl(pageRef)->context());
+    return toAPI(toImpl(pageRef)->process()->context());
 }
 
 WKPageGroupRef WKPageGetPageGroup(WKPageRef pageRef)
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index 03f49f7..72405a3 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -41,6 +41,12 @@
 extern "C" {
 #endif
 
+enum {
+    kWKFocusDirectionBackward = 0,
+    kWKFocusDirectionForward = 1
+};
+typedef uint32_t WKFocusDirection;
+
 typedef void (*WKPageCallback)(WKPageRef page, const void* clientInfo);
 
 // FrameLoad Client
@@ -149,6 +155,9 @@ typedef WKPageRef (*WKPageCreateNewPageCallback)(WKPageRef page, WKDictionaryRef
 typedef void (*WKPageRunJavaScriptAlertCallback)(WKPageRef page, WKStringRef alertText, WKFrameRef frame, const void *clientInfo);
 typedef bool (*WKPageRunJavaScriptConfirmCallback)(WKPageRef page, WKStringRef message, WKFrameRef frame, const void *clientInfo);
 typedef WKStringRef (*WKPageRunJavaScriptPromptCallback)(WKPageRef page, WKStringRef message, WKStringRef defaultValue, WKFrameRef frame, const void *clientInfo);
+typedef void (*WKPageTakeFocusCallback)(WKPageRef page, WKFocusDirection direction, const void *clientInfo);
+typedef void (*WKPageFocusCallback)(WKPageRef page, const void *clientInfo);
+typedef void (*WKPageUnfocusCallback)(WKPageRef page, const void *clientInfo);
 typedef void (*WKPageSetStatusTextCallback)(WKPageRef page, WKStringRef text, const void *clientInfo);
 typedef void (*WKPageMouseDidMoveOverElementCallback)(WKPageRef page, WKEventModifiers modifiers, WKTypeRef userData, const void *clientInfo);
 typedef void (*WKPageMissingPluginButtonClickedCallback)(WKPageRef page, WKStringRef mimeType, WKStringRef url, WKStringRef pluginsPageURL, const void* clientInfo);
@@ -181,6 +190,9 @@ struct WKPageUIClient {
     WKPageCreateNewPageCallback                                         createNewPage;
     WKPageCallback                                                      showPage;
     WKPageCallback                                                      close;
+    WKPageTakeFocusCallback                                             takeFocus;
+    WKPageFocusCallback                                                 focus;
+    WKPageUnfocusCallback                                               unfocus;
     WKPageRunJavaScriptAlertCallback                                    runJavaScriptAlert;
     WKPageRunJavaScriptConfirmCallback                                  runJavaScriptConfirm;
     WKPageRunJavaScriptPromptCallback                                   runJavaScriptPrompt;
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
index 0122531..449a1e8 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
@@ -29,6 +29,7 @@
 
 #include "WKAPICast.h"
 #include "WebPreferences.h"
+#include <WebCore/Settings.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -71,6 +72,16 @@ bool WKPreferencesGetLoadsImagesAutomatically(WKPreferencesRef preferencesRef)
     return toImpl(preferencesRef)->loadsImagesAutomatically();
 }
 
+void WKPreferencesSetLoadsSiteIconsIgnoringImageLoadingPreference(WKPreferencesRef preferencesRef, bool loadsSiteIconsIgnoringImageLoadingPreference)
+{
+    toImpl(preferencesRef)->setLoadsSiteIconsIgnoringImageLoadingPreference(loadsSiteIconsIgnoringImageLoadingPreference);
+}
+
+bool WKPreferencesGetLoadsSiteIconsIgnoringImageLoadingPreference(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->loadsSiteIconsIgnoringImageLoadingPreference();
+}
+
 void WKPreferencesSetOfflineWebApplicationCacheEnabled(WKPreferencesRef preferencesRef, bool offlineWebApplicationCacheEnabled)
 {
     toImpl(preferencesRef)->setOfflineWebApplicationCacheEnabled(offlineWebApplicationCacheEnabled);
@@ -251,6 +262,16 @@ uint32_t WKPreferencesGetMinimumFontSize(WKPreferencesRef preferencesRef)
     return toImpl(preferencesRef)->minimumFontSize();
 }
 
+void WKPreferencesSetEditableLinkBehavior(WKPreferencesRef preferencesRef, WKEditableLinkBehavior wkBehavior)
+{
+    toImpl(preferencesRef)->setEditableLinkBehavior(toEditableLinkBehavior(wkBehavior));
+}
+
+WKEditableLinkBehavior WKPreferencesGetEditableLinkBehavior(WKPreferencesRef preferencesRef)
+{
+    return toAPI(static_cast<WebCore::EditableLinkBehavior>(toImpl(preferencesRef)->editableLinkBehavior()));
+}
+
 void WKPreferencesSetDefaultTextEncodingName(WKPreferencesRef preferencesRef, WKStringRef name)
 {
     toImpl(preferencesRef)->setDefaultTextEncodingName(toWTFString(name));
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.h b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
index f2486bf..930f23d 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
@@ -50,6 +50,10 @@ WK_EXPORT void WKPreferencesSetLoadsImagesAutomatically(WKPreferencesRef prefere
 WK_EXPORT bool WKPreferencesGetLoadsImagesAutomatically(WKPreferencesRef preferences);
 
 // Defaults to false.
+WK_EXPORT void WKPreferencesSetLoadsSiteIconsIgnoringImageLoadingPreference(WKPreferencesRef preferences, bool loadsSiteIconsIgnoringImageLoadingPreference);
+WK_EXPORT bool WKPreferencesGetLoadsSiteIconsIgnoringImageLoadingPreference(WKPreferencesRef preferences);
+
+// Defaults to false.
 WK_EXPORT void WKPreferencesSetOfflineWebApplicationCacheEnabled(WKPreferencesRef preferences, bool offlineWebApplicationCacheEnabled);
 WK_EXPORT bool WKPreferencesGetOfflineWebApplicationCacheEnabled(WKPreferencesRef preferences);
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h b/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
index ddf1b9a..d67db14 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
@@ -43,10 +43,23 @@ enum WKFontSmoothingLevel {
 };
 typedef enum WKFontSmoothingLevel WKFontSmoothingLevel;
 
+enum WKEditableLinkBehavior {
+    kWKEditableLinkBehaviorDefault,
+    kWKEditableLinkBehaviorAlwaysLive,
+    kWKEditableLinkBehaviorOnlyLiveWithShiftKey,
+    kWKEditableLinkBehaviorLiveWhenNotFocused,
+    kWKEditableLinkBehaviorNeverLive
+};
+typedef enum WKEditableLinkBehavior WKEditableLinkBehavior;
+
 // Defaults to kWKFontSmoothingLevelMedium.
 WK_EXPORT void WKPreferencesSetFontSmoothingLevel(WKPreferencesRef, WKFontSmoothingLevel);
 WK_EXPORT WKFontSmoothingLevel WKPreferencesGetFontSmoothingLevel(WKPreferencesRef);
 
+// Defaults to EditableLinkNeverLive.
+WK_EXPORT void WKPreferencesSetEditableLinkBehavior(WKPreferencesRef preferencesRef, WKEditableLinkBehavior);
+WK_EXPORT WKEditableLinkBehavior WKPreferencesGetEditableLinkBehavior(WKPreferencesRef preferencesRef);   
+    
 // Defaults to false.
 WK_EXPORT void WKPreferencesSetAcceleratedDrawingEnabled(WKPreferencesRef, bool);
 WK_EXPORT bool WKPreferencesGetAcceleratedDrawingEnabled(WKPreferencesRef);
diff --git a/Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.cpp b/Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.cpp
index 483beeb..a5711e0 100644
--- a/Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.cpp
@@ -41,12 +41,12 @@ void WKResourceCacheManagerGetCacheOrigins(WKResourceCacheManagerRef cacheManage
     toImpl(cacheManagerRef)->getCacheOrigins(ArrayCallback::create(context, callback));
 }
 
-void WKResourceCacheManagerClearCacheForOrigin(WKResourceCacheManagerRef cacheManagerRef, WKSecurityOriginRef originRef)
+void WKResourceCacheManagerClearCacheForOrigin(WKResourceCacheManagerRef cacheManagerRef, WKSecurityOriginRef originRef, WKResourceCachesToClear cachesToClear)
 {
-    toImpl(cacheManagerRef)->clearCacheForOrigin(toImpl(originRef));
+    toImpl(cacheManagerRef)->clearCacheForOrigin(toImpl(originRef), toResourceCachesToClear(cachesToClear));
 }
 
-void WKResourceCacheManagerClearCacheForAllOrigins(WKResourceCacheManagerRef cacheManagerRef)
+void WKResourceCacheManagerClearCacheForAllOrigins(WKResourceCacheManagerRef cacheManagerRef, WKResourceCachesToClear cachesToClear)
 {
-    toImpl(cacheManagerRef)->clearCacheForAllOrigins();    
+    toImpl(cacheManagerRef)->clearCacheForAllOrigins(toResourceCachesToClear(cachesToClear));
 }
diff --git a/Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.h b/Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.h
index 479169d..80c4531 100644
--- a/Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.h
+++ b/Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.h
@@ -32,13 +32,19 @@
 extern "C" {
 #endif
 
+enum {
+    WKResourceCachesToClearAll = 0,
+    WKResourceCachesToClearInMemoryOnly = 1
+};
+typedef uint32_t WKResourceCachesToClear;
+
 WK_EXPORT WKTypeID WKResourceCacheManagerGetTypeID();
 
 typedef void (*WKResourceCacheManagerGetCacheOriginsFunction)(WKArrayRef, WKErrorRef, void*);
 WK_EXPORT void WKResourceCacheManagerGetCacheOrigins(WKResourceCacheManagerRef contextRef, void* context, WKResourceCacheManagerGetCacheOriginsFunction function);
 
-WK_EXPORT void WKResourceCacheManagerClearCacheForOrigin(WKResourceCacheManagerRef cacheManger, WKSecurityOriginRef origin);
-WK_EXPORT void WKResourceCacheManagerClearCacheForAllOrigins(WKResourceCacheManagerRef cacheManager);
+WK_EXPORT void WKResourceCacheManagerClearCacheForOrigin(WKResourceCacheManagerRef cacheManger, WKSecurityOriginRef origin, WKResourceCachesToClear cachesToClear);
+WK_EXPORT void WKResourceCacheManagerClearCacheForAllOrigins(WKResourceCacheManagerRef cacheManager, WKResourceCachesToClear cachesToClear);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.cpp b/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.cpp
index 5e50dd8..40e4a0e 100644
--- a/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.cpp
+++ b/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.cpp
@@ -34,8 +34,8 @@
 using namespace WebKit;
 using namespace WebCore;
 
-CGImageRef WKIconDatabaseGetCGImageForURL(WKIconDatabaseRef iconDatabaseRef, WKURLRef urlRef)
+CGImageRef WKIconDatabaseTryGetCGImageForURL(WKIconDatabaseRef iconDatabaseRef, WKURLRef urlRef, WKSize size)
 {
     Image* image = toImpl(iconDatabaseRef)->imageForPageURL(toWTFString(urlRef));
-    return image ? image->getCGImageRef() : 0;
+    return image ? image->getFirstCGImageRefOfSize(IntSize(static_cast<int>(size.width), static_cast<int>(size.height))) : 0;
 }
diff --git a/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.h b/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.h
index 48cf5bf..62ae82e 100644
--- a/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.h
+++ b/Source/WebKit2/UIProcess/API/C/cg/WKIconDatabaseCG.h
@@ -28,12 +28,13 @@
 
 #include <CoreGraphics/CGImage.h>
 #include <WebKit2/WKBase.h>
+#include <WebKit2/WKGeometry.h>
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
-WK_EXPORT CGImageRef WKIconDatabaseGetCGImageForURL(WKIconDatabaseRef iconDatabase, WKURLRef urlString);
+WK_EXPORT CGImageRef WKIconDatabaseTryGetCGImageForURL(WKIconDatabaseRef iconDatabase, WKURLRef urlString, WKSize size);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKAPICastWin.h b/Source/WebKit2/UIProcess/API/C/win/WKAPICastWin.h
index 09cf06f..24891f5 100644
--- a/Source/WebKit2/UIProcess/API/C/win/WKAPICastWin.h
+++ b/Source/WebKit2/UIProcess/API/C/win/WKAPICastWin.h
@@ -30,14 +30,25 @@
 #error "Please #include \"WKAPICast.h\" instead of this file directly."
 #endif
 
+#include "WebGrammarDetail.h"
+#include <WebCore/TextCheckerClient.h>
+
 namespace WebKit {
 
 class WebView;
 class WebEditCommandProxy;
+class WebTextChecker;
 
 WK_ADD_API_MAPPING(WKViewRef, WebView)
 WK_ADD_API_MAPPING(WKEditCommandRef, WebEditCommandProxy)
+WK_ADD_API_MAPPING(WKTextCheckerRef, WebTextChecker)
+WK_ADD_API_MAPPING(WKGrammarDetailRef, WebGrammarDetail)
 
+inline ProxyingRefPtr<WebGrammarDetail> toAPI(const WebCore::GrammarDetail& grammarDetail)
+{
+    return ProxyingRefPtr<WebGrammarDetail>(WebGrammarDetail::create(grammarDetail));
 }
 
+} // namespace WebKit
+
 #endif // WKAPICastWin_h
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKGrammarDetail.cpp b/Source/WebKit2/UIProcess/API/C/win/WKGrammarDetail.cpp
new file mode 100644
index 0000000..5ab0fc4
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/win/WKGrammarDetail.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKGrammarDetail.h"
+
+#include "APIObject.h"
+#include "ImmutableArray.h"
+#include "WKAPICast.h"
+#include "WebGrammarDetail.h"
+
+using namespace WebKit;
+
+WKTypeID WKGrammarDetailGetTypeID()
+{
+    return toAPI(APIObject::TypeGrammarDetail);
+}
+
+WKGrammarDetailRef WKGrammarDetailCreate(int location, int length, WKArrayRef guesses, WKStringRef userDescription)
+{
+    RefPtr<WebGrammarDetail> detail = WebGrammarDetail::create(location, length, toImpl(guesses), toWTFString(userDescription));
+    return toAPI(detail.release().releaseRef());
+}
+
+int WKGrammarDetailGetLocation(WKGrammarDetailRef grammarDetailRef)
+{
+    return toImpl(grammarDetailRef)->location();
+}
+
+int WKGrammarDetailGetLength(WKGrammarDetailRef grammarDetailRef)
+{
+    return toImpl(grammarDetailRef)->length();
+}
+
+WKArrayRef WKGrammarDetailCopyGuesses(WKGrammarDetailRef grammarDetailRef)
+{
+    return toAPI(toImpl(grammarDetailRef)->guesses().leakRef());
+}
+
+WKStringRef WKGrammarDetailCopyUserDescription(WKGrammarDetailRef grammarDetailRef)
+{
+    return toCopiedAPI(toImpl(grammarDetailRef)->userDescription());
+}
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKGrammarDetail.h b/Source/WebKit2/UIProcess/API/C/win/WKGrammarDetail.h
new file mode 100644
index 0000000..c187ce6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/win/WKGrammarDetail.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKGrammarDetail_h
+#define WKGrammarDetail_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKTypeID WKGrammarDetailGetTypeID();
+WK_EXPORT WKGrammarDetailRef WKGrammarDetailCreate(int location, int length, WKArrayRef guesses, WKStringRef userDescription);
+
+WK_EXPORT int WKGrammarDetailGetLocation(WKGrammarDetailRef grammarDetailRef);
+WK_EXPORT int WKGrammarDetailGetLength(WKGrammarDetailRef grammarDetailRef);
+WK_EXPORT WKArrayRef WKGrammarDetailCopyGuesses(WKGrammarDetailRef grammarDetailRef);
+WK_EXPORT WKStringRef WKGrammarDetailCopyUserDescription(WKGrammarDetailRef grammarDetailRef);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WKGrammarDetail_h */
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKTextChecker.cpp b/Source/WebKit2/UIProcess/API/C/win/WKTextChecker.cpp
new file mode 100644
index 0000000..3329da2
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/win/WKTextChecker.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKTextChecker.h"
+
+#include "WKAPICast.h"
+#include "WebPageProxy.h"
+#include "WebTextChecker.h"
+
+using namespace WebKit;
+
+void WKTextCheckerSetClient(const WKTextCheckerClient* wkClient)
+{
+    if (wkClient && wkClient->version)
+        return;
+    WebTextChecker::shared()->setClient(wkClient);
+}
+
+void WKTextCheckerContinuousSpellCheckingEnabledStateChanged(bool enabled)
+{
+    WebTextChecker::shared()->continuousSpellCheckingEnabledStateChanged(enabled);
+}
+
+void WKTextCheckerGrammarCheckingEnabledStateChanged(bool enabled)
+{
+    WebTextChecker::shared()->grammarCheckingEnabledStateChanged(enabled);
+}
+
+void WKTextCheckerCheckSpelling(WKPageRef page, bool startBeforeSelection)
+{
+    WebTextChecker::shared()->checkSpelling(toImpl(page), startBeforeSelection);
+}
+
+void WKTextCheckerChangeSpellingToWord(WKPageRef page, WKStringRef word)
+{
+    WebTextChecker::shared()->changeSpellingToWord(toImpl(page), toWTFString(word));
+}
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKTextChecker.h b/Source/WebKit2/UIProcess/API/C/win/WKTextChecker.h
new file mode 100644
index 0000000..31a855d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/win/WKTextChecker.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKTextChecker_h
+#define WKTextChecker_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// TextChecker Client
+typedef bool (*WKTextCheckerContinousSpellCheckingAllowed)(const void *clientInfo);
+typedef bool (*WKTextCheckerContinousSpellCheckingEnabled)(const void *clientInfo);
+typedef void (*WKTextCheckerSetContinousSpellCheckingEnabled)(bool enabled, const void *clientInfo);
+typedef bool (*WKTextCheckerGrammarCheckingEnabled)(const void *clientInfo);
+typedef void (*WKTextCheckerSetGrammarCheckingEnabled)(bool enabled, const void *clientInfo);
+typedef uint64_t (*WKTextCheckerUniqueSpellDocumentTag)(WKPageRef page, const void *clientInfo);
+typedef void (*WKTextCheckerCloseSpellDocumentWithTag)(uint64_t tag, const void *clientInfo);
+typedef void (*WKTextCheckerCheckSpellingOfString)(uint64_t tag, WKStringRef text, int32_t* misspellingLocation, int32_t* misspellingLength, const void *clientInfo);
+typedef void (*WKTextCheckerCheckGrammarOfString)(uint64_t tag, WKStringRef text, WKArrayRef* grammarDetails, int32_t* badGrammarLocation, int32_t* badGrammarLength, const void *clientInfo);
+typedef bool (*WKTextCheckerSpellingUIIsShowing)(const void *clientInfo);
+typedef void (*WKTextCheckerToggleSpellingUIIsShowing)(const void *clientInfo);
+typedef void (*WKTextCheckerUpdateSpellingUIWithMisspelledWord)(uint64_t tag, WKStringRef misspelledWord, const void *clientInfo);
+typedef void (*WKTextCheckerUpdateSpellingUIWithGrammarString)(uint64_t tag, WKStringRef badGrammarPhrase, WKGrammarDetailRef grammarDetail, const void *clientInfo);
+typedef WKArrayRef (*WKTextCheckerGuessesForWord)(uint64_t tag, WKStringRef word, const void *clientInfo);
+typedef void (*WKTextCheckerLearnWord)(uint64_t tag, WKStringRef word, const void *clientInfo);
+typedef void (*WKTextCheckerIgnoreWord)(uint64_t tag, WKStringRef word, const void *clientInfo);
+
+struct WKTextCheckerClient {
+    int                                                                     version;
+    const void *                                                            clientInfo;
+    WKTextCheckerContinousSpellCheckingAllowed                              continuousSpellCheckingAllowed;
+    WKTextCheckerContinousSpellCheckingEnabled                              continuousSpellCheckingEnabled;
+    WKTextCheckerSetContinousSpellCheckingEnabled                           setContinuousSpellCheckingEnabled;
+    WKTextCheckerGrammarCheckingEnabled                                     grammarCheckingEnabled;
+    WKTextCheckerSetGrammarCheckingEnabled                                  setGrammarCheckingEnabled;
+    WKTextCheckerUniqueSpellDocumentTag                                     uniqueSpellDocumentTag;
+    WKTextCheckerCloseSpellDocumentWithTag                                  closeSpellDocumentWithTag;
+    WKTextCheckerCheckSpellingOfString                                      checkSpellingOfString;
+    WKTextCheckerCheckGrammarOfString                                       checkGrammarOfString;
+    WKTextCheckerSpellingUIIsShowing                                        spellingUIIsShowing;
+    WKTextCheckerToggleSpellingUIIsShowing                                  toggleSpellingUIIsShowing;
+    WKTextCheckerUpdateSpellingUIWithMisspelledWord                         updateSpellingUIWithMisspelledWord;
+    WKTextCheckerUpdateSpellingUIWithGrammarString                          updateSpellingUIWithGrammarString;
+    WKTextCheckerGuessesForWord                                             guessesForWord;
+    WKTextCheckerLearnWord                                                  learnWord;
+    WKTextCheckerIgnoreWord                                                 ignoreWord;
+};
+typedef struct WKTextCheckerClient WKTextCheckerClient;
+
+WK_EXPORT void WKTextCheckerSetClient(const WKTextCheckerClient* client);
+
+WK_EXPORT void WKTextCheckerContinuousSpellCheckingEnabledStateChanged(bool);
+WK_EXPORT void WKTextCheckerGrammarCheckingEnabledStateChanged(bool);
+
+WK_EXPORT void WKTextCheckerCheckSpelling(WKPageRef page, bool startBeforeSelection);
+WK_EXPORT void WKTextCheckerChangeSpellingToWord(WKPageRef page, WKStringRef word);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WKTextChecker_h */
diff --git a/Source/WebKit2/UIProcess/API/C/win/WKView.h b/Source/WebKit2/UIProcess/API/C/win/WKView.h
index c8ac44c..8b5e5b2 100644
--- a/Source/WebKit2/UIProcess/API/C/win/WKView.h
+++ b/Source/WebKit2/UIProcess/API/C/win/WKView.h
@@ -43,12 +43,16 @@ typedef uint32_t WKViewUndoType;
 
 typedef void (*WKViewRegisterEditCommandCallback)(WKViewRef, WKEditCommandRef, WKViewUndoType undoOrRedo, const void *clientInfo);
 typedef void (*WKViewClearAllEditCommandsCallback)(WKViewRef, const void *clientInfo);
+typedef bool (*WKViewCanUndoRedoCallback)(WKViewRef, WKViewUndoType undoOrRedo, const void *clientInfo);
+typedef void (*WKViewExecuteUndoRedoCallback)(WKViewRef, WKViewUndoType undoOrRedo, const void *clientInfo);
 
 struct WKViewUndoClient {
     int                                                                 version;
     const void *                                                        clientInfo;
     WKViewRegisterEditCommandCallback                                   registerEditCommand;
     WKViewClearAllEditCommandsCallback                                  clearAllEditCommands;
+    WKViewCanUndoRedoCallback                                           canUndoRedo;
+    WKViewExecuteUndoRedoCallback                                       executeUndoRedo;
 };
 typedef struct WKViewUndoClient WKViewUndoClient;
 
diff --git a/Source/WebKit2/UIProcess/API/cpp/WKRetainPtr.h b/Source/WebKit2/UIProcess/API/cpp/WKRetainPtr.h
index cb2a63e..ae5ba65 100644
--- a/Source/WebKit2/UIProcess/API/cpp/WKRetainPtr.h
+++ b/Source/WebKit2/UIProcess/API/cpp/WKRetainPtr.h
@@ -204,9 +204,15 @@ template<typename T, typename U> inline bool operator!=(T* a, const WKRetainPtr<
     return a != b.get(); 
 }
 
+template<typename T> inline WKRetainPtr<T> adoptWK(T o)
+{
+    return WKRetainPtr<T>(AdoptWK, o);
+}
+
 } // namespace WebKit
 
 using WebKit::WKRetainPtr;
 using WebKit::AdoptWK;
+using WebKit::adoptWK;
 
 #endif // WKRetainPtr_h
diff --git a/Source/WebKit2/UIProcess/API/mac/PDFViewController.h b/Source/WebKit2/UIProcess/API/mac/PDFViewController.h
index dc30f56..041aa7b 100644
--- a/Source/WebKit2/UIProcess/API/mac/PDFViewController.h
+++ b/Source/WebKit2/UIProcess/API/mac/PDFViewController.h
@@ -26,6 +26,7 @@
 #ifndef PDFViewController_h
 #define PDFViewController_h
 
+#include "WebFindOptions.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
@@ -64,6 +65,10 @@ public:
     NSPrintOperation *makePrintOperation(NSPrintInfo *);
     void openPDFInFinder();
     void savePDFToDownloadsFolder();
+    void linkClicked(const String& url);
+
+    void findString(const String&, FindOptions, unsigned maxMatchCount);
+    void countStringMatches(const String&, FindOptions, unsigned maxMatchCount);
 
 private:
     explicit PDFViewController(WKView *wkView);
diff --git a/Source/WebKit2/UIProcess/API/mac/PDFViewController.mm b/Source/WebKit2/UIProcess/API/mac/PDFViewController.mm
index 5c64000..436a08a 100644
--- a/Source/WebKit2/UIProcess/API/mac/PDFViewController.mm
+++ b/Source/WebKit2/UIProcess/API/mac/PDFViewController.mm
@@ -30,10 +30,12 @@
 #import "WKAPICast.h"
 #import "WKView.h"
 #import "WebData.h"
+#import "WebEventFactory.h"
 #import "WebPageGroup.h"
 #import "WebPageProxy.h"
 #import "WebPreferences.h"
 #import <PDFKit/PDFKit.h>
+#import <WebCore/LocalizedStrings.h>
 #import <wtf/text/WTFString.h>
 
 // Redeclarations of PDFKit notifications. We can't use the API since we use a weak link to the framework.
@@ -51,7 +53,51 @@ using namespace WebKit;
 @end
 
 extern "C" NSString *_NSPathForSystemFramework(NSString *framework);
+
+// MARK: C UTILITY FUNCTIONS
+
+static void _applicationInfoForMIMEType(NSString *type, NSString **name, NSImage **image)
+{
+    ASSERT(name);
+    ASSERT(image);
     
+    CFURLRef appURL = 0;
+
+    OSStatus error = LSCopyApplicationForMIMEType((CFStringRef)type, kLSRolesAll, &appURL);
+    if (error != noErr)
+        return;
+
+    NSString *appPath = [(NSURL *)appURL path];
+    if (appURL)
+        CFRelease(appURL);
+
+    *image = [[NSWorkspace sharedWorkspace] iconForFile:appPath];
+    [*image setSize:NSMakeSize(16, 16)];
+
+    *name = [[NSFileManager defaultManager] displayNameAtPath:appPath];
+}
+
+// FIXME 4182876: We can eliminate this function in favor if -isEqual: if [PDFSelection isEqual:] is overridden
+// to compare contents.
+static BOOL _PDFSelectionsAreEqual(PDFSelection *selectionA, PDFSelection *selectionB)
+{
+    NSArray *aPages = [selectionA pages];
+    NSArray *bPages = [selectionB pages];
+
+    if (![aPages isEqual:bPages])
+        return NO;
+
+    NSUInteger count = [aPages count];
+    for (NSUInteger i = 0; i < count; ++i) {
+        NSRect aBounds = [selectionA boundsForPage:[aPages objectAtIndex:i]];
+        NSRect bBounds = [selectionB boundsForPage:[bPages objectAtIndex:i]];
+        if (!NSEqualRects(aBounds, bBounds))
+            return NO;
+    }
+
+    return YES;
+}
+
 @interface WKPDFView : NSView
 {
     PDFViewController* _pdfViewController;
@@ -68,7 +114,7 @@ extern "C" NSString *_NSPathForSystemFramework(NSString *framework);
 - (void)setDocument:(PDFDocument *)pdfDocument;
 
 - (void)_applyPDFPreferences;
-
+- (PDFSelection *)_nextMatchFor:(NSString *)string direction:(BOOL)forward caseSensitive:(BOOL)caseFlag wrap:(BOOL)wrapFlag fromSelection:(PDFSelection *)initialSelection startInSelection:(BOOL)startInSelection;
 @end
 
 @implementation WKPDFView
@@ -159,6 +205,64 @@ extern "C" NSString *_NSPathForSystemFramework(NSString *framework);
         [self _updatePreferencesSoon];
 }
 
+- (void)_openWithFinder:(id)sender
+{
+    _pdfViewController->openPDFInFinder();
+}
+
+- (PDFSelection *)_nextMatchFor:(NSString *)string direction:(BOOL)forward caseSensitive:(BOOL)caseFlag wrap:(BOOL)wrapFlag fromSelection:(PDFSelection *)initialSelection startInSelection:(BOOL)startInSelection
+{
+    if (![string length])
+        return nil;
+
+    int options = 0;
+    if (!forward)
+        options |= NSBackwardsSearch;
+
+    if (!caseFlag)
+        options |= NSCaseInsensitiveSearch;
+
+    PDFDocument *document = [_pdfView document];
+
+    PDFSelection *selectionForInitialSearch = [initialSelection copy];
+    if (startInSelection) {
+        // Initially we want to include the selected text in the search.  So we must modify the starting search 
+        // selection to fit PDFDocument's search requirements: selection must have a length >= 1, begin before 
+        // the current selection (if searching forwards) or after (if searching backwards).
+        int initialSelectionLength = [[initialSelection string] length];
+        if (forward) {
+            [selectionForInitialSearch extendSelectionAtStart:1];
+            [selectionForInitialSearch extendSelectionAtEnd:-initialSelectionLength];
+        } else {
+            [selectionForInitialSearch extendSelectionAtEnd:1];
+            [selectionForInitialSearch extendSelectionAtStart:-initialSelectionLength];
+        }
+    }
+    PDFSelection *foundSelection = [document findString:string fromSelection:selectionForInitialSearch withOptions:options];
+    [selectionForInitialSearch release];
+
+    // If we first searched in the selection, and we found the selection, search again from just past the selection
+    if (startInSelection && _PDFSelectionsAreEqual(foundSelection, initialSelection))
+        foundSelection = [document findString:string fromSelection:initialSelection withOptions:options];
+
+    if (!foundSelection && wrapFlag)
+        foundSelection = [document findString:string fromSelection:nil withOptions:options];
+
+    return foundSelection;
+}
+
+- (NSUInteger)_countMatches:(NSString *)string caseSensitive:(BOOL)caseFlag
+{
+    if (![string length])
+        return 0;
+
+    int options = caseFlag ? 0 : NSCaseInsensitiveSearch;
+
+    return [[[_pdfView document] findString:string withOptions:options] count];
+}
+
+// MARK: NSView overrides
+
 - (void)viewDidMoveToWindow
 {
     if (![self window])
@@ -181,7 +285,69 @@ extern "C" NSString *_NSPathForSystemFramework(NSString *framework);
     [notificationCenter removeObserver:self name:_webkit_PDFViewPageChangedNotification object:_pdfView];
 }
 
-// PDFView delegate methods
+- (NSView *)hitTest:(NSPoint)point
+{
+    // Override hitTest so we can override menuForEvent.
+    NSEvent *event = [NSApp currentEvent];
+    NSEventType type = [event type];
+    if (type == NSRightMouseDown || (type == NSLeftMouseDown && ([event modifierFlags] & NSControlKeyMask)))
+        return self;
+
+    return [super hitTest:point];
+}
+
+- (NSMenu *)menuForEvent:(NSEvent *)theEvent
+{
+    NSMenu *menu = [[NSMenu alloc] initWithTitle:@""];
+
+    NSEnumerator *menuItemEnumerator = [[[_pdfView menuForEvent:theEvent] itemArray] objectEnumerator];
+    while (NSMenuItem *item = [menuItemEnumerator nextObject]) {
+        NSMenuItem *itemCopy = [item copy];
+        [menu addItem:itemCopy];
+        [itemCopy release];
+
+        if ([item action] != @selector(copy:))
+            continue;
+
+        // Add in an "Open with <default PDF viewer>" item
+        NSString *appName = nil;
+        NSImage *appIcon = nil;
+
+        _applicationInfoForMIMEType(@"application/pdf", &appName, &appIcon);
+        if (!appName)
+            appName = WEB_UI_STRING("Finder", "Default application name for Open With context menu");
+
+        // To match the PDFKit style, we'll add Open with Preview even when there's no document yet to view, and
+        // disable it using validateUserInterfaceItem.
+        NSString *title = [NSString stringWithFormat:WEB_UI_STRING("Open with %@", "context menu item for PDF"), appName];
+
+        item = [[NSMenuItem alloc] initWithTitle:title action:@selector(_openWithFinder:) keyEquivalent:@""];
+        if (appIcon)
+            [item setImage:appIcon];
+        [menu addItem:[NSMenuItem separatorItem]];
+        [menu addItem:item];
+        [item release];
+    }
+
+    return [menu autorelease];
+}
+
+// MARK: NSUserInterfaceValidations PROTOCOL IMPLEMENTATION
+
+- (BOOL)validateUserInterfaceItem:(id <NSValidatedUserInterfaceItem>)item
+{
+    SEL action = [item action];
+    if (action == @selector(_openWithFinder:))
+        return [_pdfView document] != nil;
+    return YES;
+}
+
+// MARK: PDFView delegate methods
+
+- (void)PDFViewWillClickOnLink:(PDFView *)sender withURL:(NSURL *)URL
+{
+    _pdfViewController->linkClicked([URL absoluteString]);
+}
 
 - (void)PDFViewOpenPDFInNativeApplication:(PDFView *)sender
 {
@@ -416,4 +582,55 @@ NSString *PDFViewController::pathToPDFOnDisk()
     return path;
 }
 
+void PDFViewController::linkClicked(const String& url)
+{
+    NSEvent* nsEvent = [NSApp currentEvent];
+    WebMouseEvent event;
+    switch ([nsEvent type]) {
+    case NSLeftMouseUp:
+    case NSRightMouseUp:
+    case NSOtherMouseUp:
+        event = WebEventFactory::createWebMouseEvent(nsEvent, m_pdfView);
+    default:
+        // For non mouse-clicks or for keyboard events, pass an empty WebMouseEvent
+        // through.  The event is only used by the WebFrameLoaderClient to determine
+        // the modifier keys and which mouse button is down.  These queries will be
+        // valid with an empty event.
+        break;
+    }
+    
+    page()->linkClicked(url, event);
+}
+
+void PDFViewController::findString(const String& string, FindOptions options, unsigned maxMatchCount)
+{
+    BOOL forward = !(options & FindOptionsBackwards);
+    BOOL caseFlag = !(options & FindOptionsCaseInsensitive);
+    BOOL wrapFlag = options & FindOptionsWrapAround;
+
+    PDFSelection *selection = [m_wkPDFView.get() _nextMatchFor:string direction:forward caseSensitive:caseFlag wrap:wrapFlag fromSelection:[m_pdfView currentSelection] startInSelection:NO];
+    NSUInteger matchCount = [m_wkPDFView.get() _countMatches:string caseSensitive:caseFlag];
+    if (matchCount > maxMatchCount)
+        matchCount = maxMatchCount;
+
+    if (!selection) {
+        page()->didFailToFindString(string);
+        return;
+    }
+
+    [m_pdfView setCurrentSelection:selection];
+    [m_pdfView scrollSelectionToVisible:nil];
+    page()->didFindString(string, matchCount);
+}
+
+void PDFViewController::countStringMatches(const String& string, FindOptions options, unsigned maxMatchCount)
+{
+    BOOL caseFlag = !(options & FindOptionsCaseInsensitive);
+
+    NSUInteger matchCount = [m_wkPDFView.get() _countMatches:string caseSensitive:caseFlag];
+    if (matchCount > maxMatchCount)
+        matchCount = maxMatchCount;
+    page()->didCountStringMatches(string, matchCount);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
index e217fc5..9e08a28 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,8 +30,8 @@
 #include "PageClient.h"
 #include <wtf/RetainPtr.h>
 
+@class WKEditorUndoTargetObjC;
 @class WKView;
-@class WebEditorUndoTargetObjC;
 
 namespace WebKit {
 
@@ -63,16 +63,18 @@ private:
     virtual void processDidCrash();
     virtual void pageClosed();
     virtual void didRelaunchProcess();
-    virtual void setFocus(bool focused);
-    virtual void takeFocus(bool direction);
     virtual void toolTipChanged(const String& oldToolTip, const String& newToolTip);
     virtual void setCursor(const WebCore::Cursor&);
     virtual void setViewportArguments(const WebCore::ViewportArguments&);
 
     virtual void registerEditCommand(PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo);
     virtual void clearAllEditCommands();
-    virtual void interceptKeyEvent(const NativeWebKeyboardEvent& event, Vector<WebCore::KeypressCommand>& commandName, uint32_t selectionStart, uint32_t selectionEnd, Vector<WebCore::CompositionUnderline>& underlines);
+    virtual bool canUndoRedo(WebPageProxy::UndoOrRedo);
+    virtual void executeUndoRedo(WebPageProxy::UndoOrRedo);
+    virtual bool interpretKeyEvent(const NativeWebKeyboardEvent&, Vector<WebCore::KeypressCommand>&);
+    virtual bool executeSavedCommandBySelector(const String& selector);
     virtual void setDragImage(const WebCore::IntPoint& clientPosition, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag);
+    virtual void updateSecureInputState();
 
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&);
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&);
@@ -100,10 +102,13 @@ private:
 
     virtual double customRepresentationZoomFactor();
     virtual void setCustomRepresentationZoomFactor(double);
+    virtual void findStringInCustomRepresentation(const String&, FindOptions, unsigned maxMatchCount);
+    virtual void countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned maxMatchCount);
 
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects);
 
     virtual void didPerformDictionaryLookup(const String&, double scaleFactor, const DictionaryPopupInfo&);
+    virtual void dismissDictionaryLookupPanel();
 
     virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel);
@@ -113,7 +118,7 @@ private:
     virtual float userSpaceScaleFactor() const;
 
     WKView* m_wkView;
-    RetainPtr<WebEditorUndoTargetObjC> m_undoTarget;
+    RetainPtr<WKEditorUndoTargetObjC> m_undoTarget;
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
     CorrectionPanel m_correctionPanel;
 #endif
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
index 7a0d62d..e1888de 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,20 +52,24 @@
 @end
 
 using namespace WebCore;
+using namespace WebKit;
 
-@interface WebEditCommandObjC : NSObject
+@interface WKEditCommandObjC : NSObject
 {
-    RefPtr<WebKit::WebEditCommandProxy> m_command;
+    RefPtr<WebEditCommandProxy> m_command;
 }
+- (id)initWithWebEditCommandProxy:(PassRefPtr<WebEditCommandProxy>)command;
+- (WebEditCommandProxy*)command;
+@end
 
-- (id)initWithWebEditCommandProxy:(PassRefPtr<WebKit::WebEditCommandProxy>)command;
-- (WebKit::WebEditCommandProxy*)command;
-
+@interface WKEditorUndoTargetObjC : NSObject
+- (void)undoEditing:(id)sender;
+- (void)redoEditing:(id)sender;
 @end
 
-@implementation WebEditCommandObjC
+@implementation WKEditCommandObjC
 
-- (id)initWithWebEditCommandProxy:(PassRefPtr<WebKit::WebEditCommandProxy>)command
+- (id)initWithWebEditCommandProxy:(PassRefPtr<WebEditCommandProxy>)command
 {
     self = [super init];
     if (!self)
@@ -75,31 +79,24 @@ using namespace WebCore;
     return self;
 }
 
-- (WebKit::WebEditCommandProxy*)command
+- (WebEditCommandProxy*)command
 {
     return m_command.get();
 }
 
 @end
 
-@interface WebEditorUndoTargetObjC : NSObject
-
-- (void)undoEditing:(id)sender;
-- (void)redoEditing:(id)sender;
-
-@end
-
-@implementation WebEditorUndoTargetObjC
+@implementation WKEditorUndoTargetObjC
 
 - (void)undoEditing:(id)sender
 {
-    ASSERT([sender isKindOfClass:[WebEditCommandObjC class]]);
+    ASSERT([sender isKindOfClass:[WKEditCommandObjC class]]);
     [sender command]->unapply();
 }
 
 - (void)redoEditing:(id)sender
 {
-    ASSERT([sender isKindOfClass:[WebEditCommandObjC class]]);
+    ASSERT([sender isKindOfClass:[WKEditCommandObjC class]]);
     [sender command]->reapply();
 }
 
@@ -119,7 +116,7 @@ PassOwnPtr<PageClientImpl> PageClientImpl::create(WKView* wkView)
 
 PageClientImpl::PageClientImpl(WKView* wkView)
     : m_wkView(wkView)
-    , m_undoTarget(AdoptNS, [[WebEditorUndoTargetObjC alloc] init])
+    , m_undoTarget(AdoptNS, [[WKEditorUndoTargetObjC alloc] init])
 {
 }
 
@@ -157,7 +154,7 @@ IntSize PageClientImpl::viewSize()
 
 bool PageClientImpl::isViewWindowActive()
 {
-    return [[m_wkView window] isKeyWindow];
+    return [[m_wkView window] isKeyWindow] || [NSApp keyWindow] == [m_wkView window];
 }
 
 bool PageClientImpl::isViewFocused()
@@ -170,6 +167,9 @@ bool PageClientImpl::isViewVisible()
     if (![m_wkView window])
         return false;
 
+    if (![[m_wkView window] isVisible])
+        return false;
+
     if ([m_wkView isHiddenOrHasHiddenAncestor])
         return false;
 
@@ -196,20 +196,6 @@ void PageClientImpl::didRelaunchProcess()
     [m_wkView _didRelaunchProcess];
 }
 
-void PageClientImpl::setFocus(bool focused)
-{
-    if (focused)
-        [[m_wkView window] makeFirstResponder:m_wkView];
-    else
-        // takeFocus in this context means take focus away from the WKView.
-        takeFocus(true);
-}
-    
-void PageClientImpl::takeFocus(bool direction)
-{
-    [m_wkView _takeFocus:direction];
-}
-
 void PageClientImpl::toolTipChanged(const String& oldToolTip, const String& newToolTip)
 {
     [m_wkView _toolTipChangedFrom:nsStringFromWebCoreString(oldToolTip) to:nsStringFromWebCoreString(newToolTip)];
@@ -223,67 +209,19 @@ void PageClientImpl::setCursor(const WebCore::Cursor& cursor)
 
 void PageClientImpl::setViewportArguments(const WebCore::ViewportArguments&)
 {
-
-}
-
-static NSString* nameForEditAction(EditAction editAction)
-{
-    // FIXME: Use localized strings.
-    // FIXME: Move this to a platform independent location.
-
-    switch (editAction) {
-    case EditActionUnspecified: return nil;
-    case EditActionSetColor: return @"Set Color";
-    case EditActionSetBackgroundColor: return @"Set Background Color";
-    case EditActionTurnOffKerning: return @"Turn Off Kerning";
-    case EditActionTightenKerning: return @"Tighten Kerning";
-    case EditActionLoosenKerning: return @"Loosen Kerning";
-    case EditActionUseStandardKerning: return @"Use Standard Kerning";
-    case EditActionTurnOffLigatures: return @"Turn Off Ligatures";
-    case EditActionUseStandardLigatures: return @"Use Standard Ligatures";
-    case EditActionUseAllLigatures: return @"Use All Ligatures";
-    case EditActionRaiseBaseline: return @"Raise Baseline";
-    case EditActionLowerBaseline: return @"Lower Baseline";
-    case EditActionSetTraditionalCharacterShape: return @"Set Traditional Character Shape";
-    case EditActionSetFont: return @"Set Font";
-    case EditActionChangeAttributes: return @"Change Attributes";
-    case EditActionAlignLeft: return @"Align Left";
-    case EditActionAlignRight: return @"Align Right";
-    case EditActionCenter: return @"Center";
-    case EditActionJustify: return @"Justify";
-    case EditActionSetWritingDirection: return @"Set Writing Direction";
-    case EditActionSubscript: return @"Subscript";
-    case EditActionSuperscript: return @"Superscript";
-    case EditActionUnderline: return @"Underline";
-    case EditActionOutline: return @"Outline";
-    case EditActionUnscript: return @"Unscript";
-    case EditActionDrag: return @"Drag";
-    case EditActionCut: return @"Cut";
-    case EditActionPaste: return @"Paste";
-    case EditActionPasteFont: return @"Paste Font";
-    case EditActionPasteRuler: return @"Paste Ruler";
-    case EditActionTyping: return @"Typing";
-    case EditActionCreateLink: return @"Create Link";
-    case EditActionUnlink: return @"Unlink";
-    case EditActionInsertList: return @"Insert List";
-    case EditActionFormatBlock: return @"Formatting";
-    case EditActionIndent: return @"Indent";
-    case EditActionOutdent: return @"Outdent";
-    }
-    return nil;
 }
 
 void PageClientImpl::registerEditCommand(PassRefPtr<WebEditCommandProxy> prpCommand, WebPageProxy::UndoOrRedo undoOrRedo)
 {
     RefPtr<WebEditCommandProxy> command = prpCommand;
 
-    RetainPtr<WebEditCommandObjC> commandObjC(AdoptNS, [[WebEditCommandObjC alloc] initWithWebEditCommandProxy:command]);
-    NSString *actionName = nameForEditAction(command->editAction());
+    RetainPtr<WKEditCommandObjC> commandObjC(AdoptNS, [[WKEditCommandObjC alloc] initWithWebEditCommandProxy:command]);
+    String actionName = WebEditCommandProxy::nameForEditAction(command->editAction());
 
     NSUndoManager *undoManager = [m_wkView undoManager];
     [undoManager registerUndoWithTarget:m_undoTarget.get() selector:((undoOrRedo == WebPageProxy::Undo) ? @selector(undoEditing:) : @selector(redoEditing:)) object:commandObjC.get()];
-    if (actionName)
-        [undoManager setActionName:actionName];
+    if (!actionName.isEmpty())
+        [undoManager setActionName:(NSString *)actionName];
 }
 
 void PageClientImpl::clearAllEditCommands()
@@ -291,10 +229,19 @@ void PageClientImpl::clearAllEditCommands()
     [[m_wkView undoManager] removeAllActionsWithTarget:m_undoTarget.get()];
 }
 
-void PageClientImpl::interceptKeyEvent(const NativeWebKeyboardEvent& event, Vector<WebCore::KeypressCommand>& commandsList, uint32_t selectionStart, uint32_t selectionEnd, Vector<WebCore::CompositionUnderline>& underlines)
+bool PageClientImpl::canUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
 {
-    commandsList = [m_wkView _interceptKeyEvent:event.nativeEvent()];
-    [m_wkView _getTextInputState:selectionStart selectionEnd:selectionEnd underlines:underlines];
+    return (undoOrRedo == WebPageProxy::Undo) ? [[m_wkView undoManager] canUndo] : [[m_wkView undoManager] canRedo];
+}
+
+void PageClientImpl::executeUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    return (undoOrRedo == WebPageProxy::Undo) ? [[m_wkView undoManager] undo] : [[m_wkView undoManager] redo];
+}
+
+bool PageClientImpl::interpretKeyEvent(const NativeWebKeyboardEvent& event, Vector<WebCore::KeypressCommand>& commands)
+{
+    return [m_wkView _interpretKeyEvent:event.nativeEvent() savingCommandsTo:commands];
 }
 
 void PageClientImpl::setDragImage(const IntPoint& clientPosition, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag)
@@ -304,7 +251,12 @@ void PageClientImpl::setDragImage(const IntPoint& clientPosition, PassRefPtr<Sha
 
     [m_wkView _setDragImage:dragNSImage.get() at:clientPosition linkDrag:isLinkDrag];
 }
-    
+
+void PageClientImpl::updateSecureInputState()
+{
+    [m_wkView _updateSecureInputState];
+}
+
 FloatRect PageClientImpl::convertToDeviceSpace(const FloatRect& rect)
 {
     return [m_wkView _convertToDeviceSpace:rect];
@@ -408,6 +360,16 @@ void PageClientImpl::setCustomRepresentationZoomFactor(double zoomFactor)
     [m_wkView _setCustomRepresentationZoomFactor:zoomFactor];
 }
 
+void PageClientImpl::findStringInCustomRepresentation(const String& string, FindOptions options, unsigned maxMatchCount)
+{
+    [m_wkView _findStringInCustomRepresentation:string withFindOptions:options maxMatchCount:maxMatchCount];
+}
+
+void PageClientImpl::countStringMatchesInCustomRepresentation(const String& string, FindOptions options, unsigned maxMatchCount)
+{
+    [m_wkView _countStringMatchesInCustomRepresentation:string withFindOptions:options maxMatchCount:maxMatchCount];
+}
+
 void PageClientImpl::flashBackingStoreUpdates(const Vector<IntRect>&)
 {
     notImplemented();
@@ -437,6 +399,13 @@ void PageClientImpl::didPerformDictionaryLookup(const String& text, double scale
 #endif
 }
 
+void PageClientImpl::dismissDictionaryLookupPanel()
+{
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    WKHideWordDefinitionWindow();
+#endif
+}
+
 void PageClientImpl::showCorrectionPanel(CorrectionPanelInfo::PanelType type, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings)
 {
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
@@ -484,4 +453,9 @@ float PageClientImpl::userSpaceScaleFactor() const
 #endif
 }
 
+bool PageClientImpl::executeSavedCommandBySelector(const String& selectorString)
+{
+    return [m_wkView _executeSavedCommandBySelector:NSSelectorFromString(selectorString)];
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/API/mac/WKTextInputWindowController.mm b/Source/WebKit2/UIProcess/API/mac/WKTextInputWindowController.mm
index 3b69a1d..2c9ceaa 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKTextInputWindowController.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKTextInputWindowController.mm
@@ -86,7 +86,14 @@
     BOOL hadMarkedText = [_inputTextView hasMarkedText];
  
     *string = nil;
-    
+
+    // Let TSM know that a bottom input window would be created for marked text.
+    EventRef carbonEvent = static_cast<EventRef>(const_cast<void*>([event eventRef]));
+    if (carbonEvent) {
+        Boolean ignorePAH = true;
+        SetEventParameter(carbonEvent, 'iPAH', typeBoolean, sizeof(ignorePAH), &ignorePAH);
+    }
+
     if (![[_inputTextView inputContext] handleEvent:event])
         return NO;
     
diff --git a/Source/WebKit2/UIProcess/API/mac/WKView.h b/Source/WebKit2/UIProcess/API/mac/WKView.h
index 8c1826c..098b3ca 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKView.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKView.h
@@ -29,7 +29,7 @@
 @class WKViewData;
 
 WK_EXPORT
-@interface WKView : NSView <NSTextInput> {
+@interface WKView : NSView <NSTextInputClient> {
     WKViewData *_data;
     unsigned _frameSizeUpdatesDisabledCount;
 }
diff --git a/Source/WebKit2/UIProcess/API/mac/WKView.mm b/Source/WebKit2/UIProcess/API/mac/WKView.mm
index 05693ef..80345f7 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKView.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKView.mm
@@ -26,14 +26,17 @@
 #import "config.h"
 #import "WKView.h"
 
+#import "AttributedString.h"
 #import "ChunkedUpdateDrawingAreaProxy.h"
 #import "DataReference.h"
 #import "DrawingAreaProxyImpl.h"
+#import "EditorState.h"
 #import "FindIndicator.h"
 #import "FindIndicatorWindow.h"
 #import "LayerTreeContext.h"
 #import "Logging.h"
 #import "NativeWebKeyboardEvent.h"
+#import "NativeWebMouseEvent.h"
 #import "PDFViewController.h"
 #import "PageClientImpl.h"
 #import "PasteboardTypes.h"
@@ -69,24 +72,23 @@
 #import <wtf/RefPtr.h>
 #import <wtf/RetainPtr.h>
 
-@interface NSApplication (WebNSApplicationDetails)
+@interface NSApplication (WKNSApplicationDetails)
 - (void)speakString:(NSString *)string;
 - (void)_setCurrentEvent:(NSEvent *)event;
 @end
 
-@interface NSWindow (WebNSWindowDetails)
+@interface NSObject (WKNSTextInputContextDetails)
+- (BOOL)wantsToHandleMouseEvents;
+- (BOOL)handleMouseEvent:(NSEvent *)event;
+@end
+
+@interface NSWindow (WKNSWindowDetails)
 - (NSRect)_growBoxRect;
 - (id)_growBoxOwner;
 - (void)_setShowOpaqueGrowBoxForOwner:(id)owner;
 - (BOOL)_updateGrowBoxForWindowFrameChange;
 @end
 
-extern "C" {
-    // Need to declare this attribute name because AppKit exports it but does not make it available in API or SPI headers.
-    // <rdar://problem/8631468> tracks the request to make it available. This code should be removed when the bug is closed.
-    extern NSString *NSTextInputReplacementRangeAttributeName;
-}
-
 using namespace WebKit;
 using namespace WebCore;
 
@@ -98,6 +100,13 @@ typedef HashMap<String, ValidationVector> ValidationMap;
 
 }
 
+struct WKViewInterpretKeyEventsParameters {
+    bool eventInterpretationHadSideEffects;
+    bool consumedByIM;
+    bool executingSavedKeypressCommands;
+    Vector<KeypressCommand>* commands;
+};
+
 @interface WKViewData : NSObject {
 @public
     OwnPtr<PageClientImpl> _pageClient;
@@ -122,18 +131,13 @@ typedef HashMap<String, ValidationVector> ValidationMap;
     // the application to distinguish the case of a new event from one 
     // that has been already sent to WebCore.
     RetainPtr<NSEvent> _keyDownEventBeingResent;
-    bool _isInInterpretKeyEvents;
-    Vector<KeypressCommand> _commandsList;
+    WKViewInterpretKeyEventsParameters* _interpretKeyEventsParameters;
 
     NSSize _resizeScrollOffset;
 
     // The identifier of the plug-in we want to send complex text input to, or 0 if there is none.
     uint64_t _pluginComplexTextInputIdentifier;
 
-    Vector<CompositionUnderline> _underlines;
-    unsigned _selectionStart;
-    unsigned _selectionEnd;
-
     bool _inBecomeFirstResponder;
     bool _inResignFirstResponder;
     NSEvent *_mouseDownEvent;
@@ -150,15 +154,21 @@ typedef HashMap<String, ValidationVector> ValidationMap;
 
     BOOL _hasSpellCheckerDocumentTag;
     NSInteger _spellCheckerDocumentTag;
+
+    BOOL _inSecureInputState;
 }
 @end
 
-@implementation WKViewData
+@interface WKResponderChainSink : NSResponder {
+    NSResponder *_lastResponderInChain;
+    bool _didReceiveUnhandledCommand;
+}
+- (id)initWithResponderChain:(NSResponder *)chain;
+- (void)detach;
+- (bool)didReceiveUnhandledCommand;
 @end
 
-@interface NSObject (NSTextInputContextDetails)
-- (BOOL)wantsToHandleMouseEvents;
-- (BOOL)handleMouseEvent:(NSEvent *)event;
+@implementation WKViewData
 @end
 
 @implementation WKView
@@ -239,6 +249,8 @@ typedef HashMap<String, ValidationVector> ValidationMap;
 {
     _data->_page->close();
 
+    ASSERT(!_data->_inSecureInputState);
+
     [_data release];
     _data = nil;
 
@@ -282,7 +294,10 @@ typedef HashMap<String, ValidationVector> ValidationMap;
     NSSelectionDirection direction = [[self window] keyViewSelectionDirection];
 
     _data->_inBecomeFirstResponder = true;
+    
+    [self _updateSecureInputState];
     _data->_page->viewStateDidChange(WebPageProxy::ViewIsFocused);
+
     _data->_inBecomeFirstResponder = false;
 
     if (direction != NSDirectSelection)
@@ -294,7 +309,13 @@ typedef HashMap<String, ValidationVector> ValidationMap;
 - (BOOL)resignFirstResponder
 {
     _data->_inResignFirstResponder = true;
+
+    if (_data->_inSecureInputState) {
+        DisableSecureEventInput();
+        _data->_inSecureInputState = NO;
+    }
     _data->_page->viewStateDidChange(WebPageProxy::ViewIsFocused);
+
     _data->_inResignFirstResponder = false;
 
     return YES;
@@ -514,13 +535,13 @@ WEBCORE_COMMAND(yankAndSelect)
 
 - (id)validRequestorForSendType:(NSString *)sendType returnType:(NSString *)returnType
 {
-    BOOL isValidSendType = !sendType || ([PasteboardTypes::forSelection() containsObject:sendType] && !_data->_page->selectionState().isNone);
+    BOOL isValidSendType = !sendType || ([PasteboardTypes::forSelection() containsObject:sendType] && !_data->_page->editorState().selectionIsNone);
     BOOL isValidReturnType = NO;
     if (!returnType)
         isValidReturnType = YES;
-    else if ([PasteboardTypes::forEditing() containsObject:returnType] && _data->_page->selectionState().isContentEditable) {
+    else if ([PasteboardTypes::forEditing() containsObject:returnType] && _data->_page->editorState().isContentEditable) {
         // We can insert strings in any editable context.  We can insert other types, like images, only in rich edit contexts.
-        isValidReturnType = _data->_page->selectionState().isContentRichlyEditable || [returnType isEqualToString:NSStringPboardType];
+        isValidReturnType = _data->_page->editorState().isContentRichlyEditable || [returnType isEqualToString:NSStringPboardType];
     }
     if (isValidSendType && isValidReturnType)
         return self;
@@ -604,12 +625,12 @@ static void validateCommandCallback(WKStringRef commandName, bool isEnabled, int
 
     if (action == @selector(showGuessPanel:)) {
         if (NSMenuItem *menuItem = ::menuItem(item))
-            [menuItem setTitle:contextMenuItemTagShowSpellingPanel([[[NSSpellChecker sharedSpellChecker] spellingPanel] isVisible])];
-        return _data->_page->selectionState().isContentEditable;
+            [menuItem setTitle:contextMenuItemTagShowSpellingPanel(![[[NSSpellChecker sharedSpellChecker] spellingPanel] isVisible])];
+        return _data->_page->editorState().isContentEditable;
     }
 
     if (action == @selector(checkSpelling:) || action == @selector(changeSpelling:))
-        return _data->_page->selectionState().isContentEditable;
+        return _data->_page->editorState().isContentEditable;
 
     if (action == @selector(toggleContinuousSpellChecking:)) {
         bool enabled = TextChecker::isContinuousSpellCheckingAllowed();
@@ -627,47 +648,47 @@ static void validateCommandCallback(WKStringRef commandName, bool isEnabled, int
     if (action == @selector(toggleAutomaticSpellingCorrection:)) {
         bool checked = TextChecker::state().isAutomaticSpellingCorrectionEnabled;
         [menuItem(item) setState:checked ? NSOnState : NSOffState];
-        return _data->_page->selectionState().isContentEditable;
+        return _data->_page->editorState().isContentEditable;
     }
 
     if (action == @selector(orderFrontSubstitutionsPanel:)) {
         if (NSMenuItem *menuItem = ::menuItem(item))
-            [menuItem setTitle:contextMenuItemTagShowSubstitutions([[[NSSpellChecker sharedSpellChecker] substitutionsPanel] isVisible])];
-        return _data->_page->selectionState().isContentEditable;
+            [menuItem setTitle:contextMenuItemTagShowSubstitutions(![[[NSSpellChecker sharedSpellChecker] substitutionsPanel] isVisible])];
+        return _data->_page->editorState().isContentEditable;
     }
 
     if (action == @selector(toggleSmartInsertDelete:)) {
         bool checked = _data->_page->isSmartInsertDeleteEnabled();
         [menuItem(item) setState:checked ? NSOnState : NSOffState];
-        return _data->_page->selectionState().isContentEditable;
+        return _data->_page->editorState().isContentEditable;
     }
 
     if (action == @selector(toggleAutomaticQuoteSubstitution:)) {
         bool checked = TextChecker::state().isAutomaticQuoteSubstitutionEnabled;
         [menuItem(item) setState:checked ? NSOnState : NSOffState];
-        return _data->_page->selectionState().isContentEditable;
+        return _data->_page->editorState().isContentEditable;
     }
 
     if (action == @selector(toggleAutomaticDashSubstitution:)) {
         bool checked = TextChecker::state().isAutomaticDashSubstitutionEnabled;
         [menuItem(item) setState:checked ? NSOnState : NSOffState];
-        return _data->_page->selectionState().isContentEditable;
+        return _data->_page->editorState().isContentEditable;
     }
 
     if (action == @selector(toggleAutomaticLinkDetection:)) {
         bool checked = TextChecker::state().isAutomaticLinkDetectionEnabled;
         [menuItem(item) setState:checked ? NSOnState : NSOffState];
-        return _data->_page->selectionState().isContentEditable;
+        return _data->_page->editorState().isContentEditable;
     }
 
     if (action == @selector(toggleAutomaticTextReplacement:)) {
         bool checked = TextChecker::state().isAutomaticTextReplacementEnabled;
         [menuItem(item) setState:checked ? NSOnState : NSOffState];
-        return _data->_page->selectionState().isContentEditable;
+        return _data->_page->editorState().isContentEditable;
     }
 
     if (action == @selector(uppercaseWord:) || action == @selector(lowercaseWord:) || action == @selector(capitalizeWord:))
-        return _data->_page->selectionState().selectedRangeLength && _data->_page->selectionState().isContentEditable;
+        return _data->_page->editorState().selectionIsRange && _data->_page->editorState().isContentEditable;
     
     if (action == @selector(stopSpeaking:))
         return [NSApp isSpeaking];
@@ -751,9 +772,6 @@ static void speakString(WKStringRef string, WKErrorRef error, void*)
     TextChecker::setContinuousSpellCheckingEnabled(spellCheckingEnabled);
 
     _data->_page->process()->updateTextCheckerState();
-
-    if (!spellCheckingEnabled)
-        _data->_page->unmarkAllMisspellings();
 }
 
 - (BOOL)isGrammarCheckingEnabled
@@ -768,9 +786,6 @@ static void speakString(WKStringRef string, WKErrorRef error, void*)
     
     TextChecker::setGrammarCheckingEnabled(flag);
     _data->_page->process()->updateTextCheckerState();
-
-    if (!flag)
-        _data->_page->unmarkAllBadGrammar();
 }
 
 - (IBAction)toggleGrammarChecking:(id)sender
@@ -779,9 +794,6 @@ static void speakString(WKStringRef string, WKErrorRef error, void*)
     TextChecker::setGrammarCheckingEnabled(grammarCheckingEnabled);
 
     _data->_page->process()->updateTextCheckerState();
-
-    if (!grammarCheckingEnabled)
-        _data->_page->unmarkAllBadGrammar();
 }
 
 - (IBAction)toggleAutomaticSpellingCorrection:(id)sender
@@ -927,6 +939,33 @@ static void speakString(WKStringRef string, WKErrorRef error, void*)
     _data->_mouseDownEvent = [event retain];
 }
 
+#define NATIVE_MOUSE_EVENT_HANDLER(Selector) \
+    - (void)Selector:(NSEvent *)theEvent \
+    { \
+        if ([[self inputContext] handleEvent:theEvent]) { \
+            LOG(TextInput, "%s was handled by text input context", String(#Selector).substring(0, String(#Selector).find("Internal")).ascii().data()); \
+            return; \
+        } \
+        NativeWebMouseEvent webEvent(theEvent, self); \
+        _data->_page->handleMouseEvent(webEvent); \
+    }
+
+NATIVE_MOUSE_EVENT_HANDLER(mouseEntered)
+NATIVE_MOUSE_EVENT_HANDLER(mouseExited)
+NATIVE_MOUSE_EVENT_HANDLER(mouseMovedInternal)
+NATIVE_MOUSE_EVENT_HANDLER(mouseDownInternal)
+NATIVE_MOUSE_EVENT_HANDLER(mouseUpInternal)
+NATIVE_MOUSE_EVENT_HANDLER(mouseDraggedInternal)
+NATIVE_MOUSE_EVENT_HANDLER(otherMouseDown)
+NATIVE_MOUSE_EVENT_HANDLER(otherMouseDragged)
+NATIVE_MOUSE_EVENT_HANDLER(otherMouseMoved)
+NATIVE_MOUSE_EVENT_HANDLER(otherMouseUp)
+NATIVE_MOUSE_EVENT_HANDLER(rightMouseDown)
+NATIVE_MOUSE_EVENT_HANDLER(rightMouseDragged)
+NATIVE_MOUSE_EVENT_HANDLER(rightMouseUp)
+
+#undef NATIVE_MOUSE_EVENT_HANDLER
+
 #define EVENT_HANDLER(Selector, Type) \
     - (void)Selector:(NSEvent *)theEvent \
     { \
@@ -934,28 +973,17 @@ static void speakString(WKStringRef string, WKErrorRef error, void*)
         _data->_page->handle##Type##Event(webEvent); \
     }
 
-EVENT_HANDLER(mouseEntered, Mouse)
-EVENT_HANDLER(mouseExited, Mouse)
-EVENT_HANDLER(mouseMoved, Mouse)
-EVENT_HANDLER(otherMouseDown, Mouse)
-EVENT_HANDLER(otherMouseDragged, Mouse)
-EVENT_HANDLER(otherMouseMoved, Mouse)
-EVENT_HANDLER(otherMouseUp, Mouse)
-EVENT_HANDLER(rightMouseDown, Mouse)
-EVENT_HANDLER(rightMouseDragged, Mouse)
-EVENT_HANDLER(rightMouseMoved, Mouse)
-EVENT_HANDLER(rightMouseUp, Mouse)
 EVENT_HANDLER(scrollWheel, Wheel)
 
 #undef EVENT_HANDLER
 
-- (void)_mouseHandler:(NSEvent *)event
+- (void)mouseMoved:(NSEvent *)event
 {
-    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
-    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
+    // When a view is first responder, it gets mouse moved events even when the mouse is outside its visible rect.
+    if (self == [[self window] firstResponder] && !NSPointInRect([self convertPoint:[event locationInWindow] fromView:nil], [self visibleRect]))
         return;
-    WebMouseEvent webEvent = WebEventFactory::createWebMouseEvent(event, self);
-    _data->_page->handleMouseEvent(webEvent);
+
+    [self mouseMovedInternal:event];
 }
 
 - (void)mouseDown:(NSEvent *)event
@@ -963,20 +991,57 @@ EVENT_HANDLER(scrollWheel, Wheel)
     [self _setMouseDownEvent:event];
     _data->_ignoringMouseDraggedEvents = NO;
     _data->_dragHasStarted = NO;
-    [self _mouseHandler:event];
+    [self mouseDownInternal:event];
 }
 
 - (void)mouseUp:(NSEvent *)event
 {
     [self _setMouseDownEvent:nil];
-    [self _mouseHandler:event];
+    [self mouseUpInternal:event];
 }
 
 - (void)mouseDragged:(NSEvent *)event
 {
     if (_data->_ignoringMouseDraggedEvents)
         return;
-    [self _mouseHandler:event];
+    [self mouseDraggedInternal:event];
+}
+
+- (BOOL)acceptsFirstMouse:(NSEvent *)event
+{
+    // There's a chance that responding to this event will run a nested event loop, and
+    // fetching a new event might release the old one. Retaining and then autoreleasing
+    // the current event prevents that from causing a problem inside WebKit or AppKit code.
+    [[event retain] autorelease];
+    
+    if (![self hitTest:[event locationInWindow]])
+        return NO;
+    
+    [self _setMouseDownEvent:event];
+    bool result = _data->_page->acceptsFirstMouse([event eventNumber], WebEventFactory::createWebMouseEvent(event, self));
+    [self _setMouseDownEvent:nil];
+    return result;
+}
+
+- (BOOL)shouldDelayWindowOrderingForEvent:(NSEvent *)event
+{
+    // If this is the active window or we don't have a range selection, there is no need to perform additional checks
+    // and we can avoid making a synchronous call to the WebProcess.
+    if ([[self window] isKeyWindow] || _data->_page->editorState().selectionIsNone || !_data->_page->editorState().selectionIsRange)
+        return NO;
+
+    // There's a chance that responding to this event will run a nested event loop, and
+    // fetching a new event might release the old one. Retaining and then autoreleasing
+    // the current event prevents that from causing a problem inside WebKit or AppKit code.
+    [[event retain] autorelease];
+    
+    if (![self hitTest:[event locationInWindow]])
+        return NO;
+    
+    [self _setMouseDownEvent:event];
+    bool result = _data->_page->shouldDelayWindowOrderingForEvent(WebEventFactory::createWebMouseEvent(event, self));
+    [self _setMouseDownEvent:nil];
+    return result;
 }
 
 #if ENABLE(GESTURE_EVENTS)
@@ -1018,52 +1083,75 @@ static const short kIOHIDEventTypeScroll = 6;
 {
     LOG(TextInput, "doCommandBySelector:\"%s\"", sel_getName(selector));
 
-    if (!_data->_isInInterpretKeyEvents) {
+    WKViewInterpretKeyEventsParameters* parameters = _data->_interpretKeyEventsParameters;
+    if (parameters)
+        parameters->consumedByIM = false;
+
+    // As in insertText:replacementRange:, we assume that the call comes from an input method if there is marked text.
+    bool isFromInputMethod = _data->_page->editorState().hasComposition;
+
+    if (parameters && !isFromInputMethod)
+        parameters->commands->append(KeypressCommand(NSStringFromSelector(selector)));
+    else {
+        // FIXME: Send the command to Editor synchronously and only send it along the
+        // responder chain if it's a selector that does not correspond to an editing command.
         [super doCommandBySelector:selector];
-        return;
     }
-    if (selector != @selector(noop:))
-        _data->_commandsList.append(KeypressCommand(commandNameForSelector(selector)));
 }
 
 - (void)insertText:(id)string
 {
-    BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]]; // Otherwise, NSString
-    
-    LOG(TextInput, "insertText:\"%@\"", isAttributedString ? [string string] : string);
+    // Unlike and NSTextInputClient variant with replacementRange, this NSResponder method is called when there is no input context,
+    // so text input processing isn't performed. We are not going to actually insert any text in that case, but saving an insertText
+    // command ensures that a keypress event is dispatched as appropriate.
+    [self insertText:string replacementRange:NSMakeRange(NSNotFound, 0)];
+}
+
+- (void)insertText:(id)string replacementRange:(NSRange)replacementRange
+{
+    BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]];
+    ASSERT(isAttributedString || [string isKindOfClass:[NSString class]]);
+
+    if (replacementRange.location != NSNotFound)
+        LOG(TextInput, "insertText:\"%@\" replacementRange:(%u, %u)", isAttributedString ? [string string] : string, replacementRange.location, replacementRange.length);
+    else
+        LOG(TextInput, "insertText:\"%@\"", isAttributedString ? [string string] : string);
+    WKViewInterpretKeyEventsParameters* parameters = _data->_interpretKeyEventsParameters;
+    if (parameters)
+        parameters->consumedByIM = false;
+
     NSString *text;
-    bool isFromInputMethod = _data->_page->selectionState().hasComposition;
+    bool isFromInputMethod = _data->_page->editorState().hasComposition;
 
     if (isAttributedString) {
+        // FIXME: We ignore most attributes from the string, so for example inserting from Character Palette loses font and glyph variation data.
         text = [string string];
-        // We deal with the NSTextInputReplacementRangeAttributeName attribute from NSAttributedString here
-        // simply because it is used by at least one Input Method -- it corresonds to the kEventParamTextInputSendReplaceRange
-        // event in TSM.  This behaviour matches that of -[WebHTMLView setMarkedText:selectedRange:] when it receives an
-        // NSAttributedString
-        NSString *rangeString = [string attribute:NSTextInputReplacementRangeAttributeName atIndex:0 longestEffectiveRange:NULL inRange:NSMakeRange(0, [text length])];
-        LOG(TextInput, "ReplacementRange: %@", rangeString);
-        if (rangeString)
-            isFromInputMethod = YES;
     } else
         text = string;
 
+    // insertText can be called for several reasons:
+    // - If it's from normal key event processing (including key bindings), we may need to save the action to perform it later.
+    // - If it's from an input method, then we should go ahead and insert the text now. We assume it's from the input method if we have marked text.
+    // FIXME: In theory, this could be wrong for some input methods, so we should try to find another way to determine if the call is from the input method.
+    // - If it's sent outside of keyboard event processing (e.g. from Character Viewer, or when confirming an inline input area with a mouse),
+    // then we also execute it immediately, as there will be no other chance.
+    if (parameters && !isFromInputMethod) {
+        ASSERT(replacementRange.location == NSNotFound);
+        parameters->commands->append(KeypressCommand("insertText:", text));
+        return;
+    }
+
     String eventText = text;
-    
-    // We'd need a different code path here if we wanted to be able to handle this
-    // outside of interpretKeyEvents.
-    ASSERT(_data->_isInInterpretKeyEvents);
+    eventText.replace(NSBackTabCharacter, NSTabCharacter); // same thing is done in KeyEventMac.mm in WebCore
+    bool eventHandled = _data->_page->insertText(eventText, replacementRange.location, NSMaxRange(replacementRange));
 
-    if (!isFromInputMethod)
-        _data->_commandsList.append(KeypressCommand("insertText", text));
-    else {
-        eventText.replace(NSBackTabCharacter, NSTabCharacter); // same thing is done in KeyEventMac.mm in WebCore
-        _data->_commandsList.append(KeypressCommand("insertText", eventText));
-    }
+    if (parameters)
+        parameters->eventInterpretationHadSideEffects |= eventHandled;
 }
 
 - (BOOL)_handleStyleKeyEquivalent:(NSEvent *)event
 {
-    if (!_data->_page->selectionState().isContentEditable)
+    if (!_data->_page->editorState().isContentEditable)
         return NO;
 
     if (([event modifierFlags] & NSDeviceIndependentModifierFlagsMask) != NSCommandKeyMask)
@@ -1130,9 +1218,6 @@ static const short kIOHIDEventTypeScroll = 6;
         }
     }
 
-    _data->_underlines.clear();
-    _data->_selectionStart = 0;
-    _data->_selectionEnd = 0;
     // We could be receiving a key down from AppKit if we have re-sent an event
     // that maps to an action that is currently unavailable (for example a copy when
     // there is no range selection).
@@ -1144,37 +1229,108 @@ static const short kIOHIDEventTypeScroll = 6;
     _data->_page->handleKeyboardEvent(NativeWebKeyboardEvent(theEvent, self));
 }
 
-- (NSTextInputContext *)inputContext {
-    if (_data->_pluginComplexTextInputIdentifier && !_data->_isInInterpretKeyEvents)
+- (void)flagsChanged:(NSEvent *)theEvent
+{
+    // There's a chance that responding to this event will run a nested event loop, and
+    // fetching a new event might release the old one. Retaining and then autoreleasing
+    // the current event prevents that from causing a problem inside WebKit or AppKit code.
+    [[theEvent retain] autorelease];
+
+    unsigned short keyCode = [theEvent keyCode];
+
+    // Don't make an event from the num lock and function keys
+    if (!keyCode || keyCode == 10 || keyCode == 63)
+        return;
+
+    _data->_page->handleKeyboardEvent(NativeWebKeyboardEvent(theEvent, self));
+}
+
+- (void)_executeSavedKeypressCommands
+{
+    WKViewInterpretKeyEventsParameters* parameters = _data->_interpretKeyEventsParameters;
+    if (!parameters || parameters->commands->isEmpty())
+        return;
+
+    // We could be called again if the execution of one command triggers a call to selectedRange.
+    // In this case, the state is up to date, and we don't need to execute any more saved commands to return a result.
+    if (parameters->executingSavedKeypressCommands)
+        return;
+
+    parameters->executingSavedKeypressCommands = true;
+    parameters->eventInterpretationHadSideEffects |= _data->_page->executeKeypressCommands(*parameters->commands);
+    parameters->commands->clear();
+    parameters->executingSavedKeypressCommands = false;
+}
+
+- (NSTextInputContext *)inputContext
+{
+    WKViewInterpretKeyEventsParameters* parameters = _data->_interpretKeyEventsParameters;
+
+    if (_data->_pluginComplexTextInputIdentifier && !parameters)
         return [[WKTextInputWindowController sharedTextInputWindowController] inputContext];
 
+    // Disable text input machinery when in non-editable content. An invisible inline input area affects performance, and can prevent Expose from working.
+    if (!_data->_page->editorState().isContentEditable)
+        return nil;
+
     return [super inputContext];
 }
 
 - (NSRange)selectedRange
 {
-    if (_data->_page->selectionState().isNone || !_data->_page->selectionState().isContentEditable)
-        return NSMakeRange(NSNotFound, 0);
-    
-    LOG(TextInput, "selectedRange -> (%u, %u)", _data->_page->selectionState().selectedRangeStart, _data->_page->selectionState().selectedRangeLength);
-    return NSMakeRange(_data->_page->selectionState().selectedRangeStart, _data->_page->selectionState().selectedRangeLength);
+    [self _executeSavedKeypressCommands];
+
+    uint64_t selectionStart;
+    uint64_t selectionLength;
+    _data->_page->getSelectedRange(selectionStart, selectionLength);
+
+    NSRange result = NSMakeRange(selectionStart, selectionLength);
+    if (result.location == NSNotFound)
+        LOG(TextInput, "selectedRange -> (NSNotFound, %u)", result.length);
+    else
+        LOG(TextInput, "selectedRange -> (%u, %u)", result.location, result.length);
+
+    return result;
 }
 
 - (BOOL)hasMarkedText
 {
-    LOG(TextInput, "hasMarkedText -> %u", _data->_page->selectionState().hasComposition);
-    return _data->_page->selectionState().hasComposition;
+    WKViewInterpretKeyEventsParameters* parameters = _data->_interpretKeyEventsParameters;
+
+    BOOL result;
+    if (parameters) {
+        result = _data->_page->editorState().hasComposition;
+        if (result) {
+            // A saved command can confirm a composition, but it cannot start a new one.
+            [self _executeSavedKeypressCommands];
+            result = _data->_page->editorState().hasComposition;
+        }
+    } else {
+        uint64_t location;
+        uint64_t length;
+        _data->_page->getMarkedRange(location, length);
+        result = location != NSNotFound;
+    }
+
+    LOG(TextInput, "hasMarkedText -> %u", result);
+    return result;
 }
 
 - (void)unmarkText
 {
+    [self _executeSavedKeypressCommands];
+
     LOG(TextInput, "unmarkText");
 
-    // We'd need a different code path here if we wanted to be able to handle this
-    // outside of interpretKeyEvents.
-    ASSERT(_data->_isInInterpretKeyEvents);
+    // Use pointer to get parameters passed to us by the caller of interpretKeyEvents.
+    WKViewInterpretKeyEventsParameters* parameters = _data->_interpretKeyEventsParameters;
+
+    if (parameters) {
+        parameters->eventInterpretationHadSideEffects = true;
+        parameters->consumedByIM = false;
+    }
 
-    _data->_commandsList.append(KeypressCommand("unmarkText"));
+    _data->_page->confirmComposition();
 }
 
 - (NSArray *)validAttributesForMarkedText
@@ -1183,7 +1339,7 @@ static const short kIOHIDEventTypeScroll = 6;
     if (!validAttributes) {
         validAttributes = [[NSArray alloc] initWithObjects:
                            NSUnderlineStyleAttributeName, NSUnderlineColorAttributeName,
-                           NSMarkedClauseSegmentAttributeName, NSTextInputReplacementRangeAttributeName, nil];
+                           NSMarkedClauseSegmentAttributeName, nil];
         // NSText also supports the following attributes, but it's
         // hard to tell which are really required for text input to
         // work well; I have not seen any input method make use of them yet.
@@ -1215,47 +1371,86 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     }
 }
 
-- (void)setMarkedText:(id)string selectedRange:(NSRange)newSelRange
+- (void)setMarkedText:(id)string selectedRange:(NSRange)newSelRange replacementRange:(NSRange)replacementRange
 {
-    BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]]; // Otherwise, NSString
-    
+    [self _executeSavedKeypressCommands];
+
+    BOOL isAttributedString = [string isKindOfClass:[NSAttributedString class]];
+    ASSERT(isAttributedString || [string isKindOfClass:[NSString class]]);
+
     LOG(TextInput, "setMarkedText:\"%@\" selectedRange:(%u, %u)", isAttributedString ? [string string] : string, newSelRange.location, newSelRange.length);
+
+    // Use pointer to get parameters passed to us by the caller of interpretKeyEvents.
+    WKViewInterpretKeyEventsParameters* parameters = _data->_interpretKeyEventsParameters;
+
+    if (parameters) {
+        parameters->eventInterpretationHadSideEffects = true;
+        parameters->consumedByIM = false;
+    }
     
-    NSString *text = string;
-    
+    Vector<CompositionUnderline> underlines;
+    NSString *text;
+
     if (isAttributedString) {
+        // FIXME: We ignore most attributes from the string, so an input method cannot specify e.g. a font or a glyph variation.
         text = [string string];
-        extractUnderlines(string, _data->_underlines);
+        extractUnderlines(string, underlines);
+    } else
+        text = string;
+
+    if (_data->_page->editorState().isInPasswordField) {
+        // In password fields, we only allow ASCII dead keys, and don't allow inline input, matching NSSecureTextInputField.
+        // Allowing ASCII dead keys is necessary to enable full Roman input when using a Vietnamese keyboard.
+        ASSERT(!_data->_page->editorState().hasComposition);
+        [[super inputContext] discardMarkedText]; // Inform the input method that we won't have an inline input area despite having been asked to.
+        if ([text length] == 1 && [[text decomposedStringWithCanonicalMapping] characterAtIndex:0] < 0x80) {
+            _data->_page->insertText(text, replacementRange.location, NSMaxRange(replacementRange));
+        } else
+            NSBeep();
+        return;
     }
-    
-    // We'd need a different code path here if we wanted to be able to handle this
-    // outside of interpretKeyEvents.
-    ASSERT(_data->_isInInterpretKeyEvents);
 
-    _data->_commandsList.append(KeypressCommand("setMarkedText", text));
-    _data->_selectionStart = newSelRange.location;
-    _data->_selectionEnd = NSMaxRange(newSelRange);
+    _data->_page->setComposition(text, underlines, newSelRange.location, NSMaxRange(newSelRange), replacementRange.location, NSMaxRange(replacementRange));
 }
 
 - (NSRange)markedRange
 {
+    [self _executeSavedKeypressCommands];
+
     uint64_t location;
     uint64_t length;
-
     _data->_page->getMarkedRange(location, length);
+
     LOG(TextInput, "markedRange -> (%u, %u)", location, length);
     return NSMakeRange(location, length);
 }
 
-- (NSAttributedString *)attributedSubstringFromRange:(NSRange)nsRange
+- (NSAttributedString *)attributedSubstringForProposedRange:(NSRange)nsRange actualRange:(NSRangePointer)actualRange
 {
-    // This is not implemented for now. Need to figure out how to serialize the attributed string across processes.
-    LOG(TextInput, "attributedSubstringFromRange");
-    return nil;
+    [self _executeSavedKeypressCommands];
+
+    if (!_data->_page->editorState().isContentEditable) {
+        LOG(TextInput, "attributedSubstringFromRange:(%u, %u) -> nil", nsRange.location, nsRange.length);
+        return nil;
+    }
+
+    if (_data->_page->editorState().isInPasswordField)
+        return nil;
+
+    AttributedString result;
+    _data->_page->getAttributedSubstringFromRange(nsRange.location, NSMaxRange(nsRange), result);
+
+    if (actualRange)
+        *actualRange = nsRange;
+
+    LOG(TextInput, "attributedSubstringFromRange:(%u, %u) -> \"%@\"", nsRange.location, nsRange.length, [result.string.get() string]);
+    return [[result.string.get() retain] autorelease];
 }
 
 - (NSUInteger)characterIndexForPoint:(NSPoint)thePoint
 {
+    [self _executeSavedKeypressCommands];
+
     NSWindow *window = [self window];
     
     if (window)
@@ -1267,8 +1462,10 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     return result;
 }
 
-- (NSRect)firstRectForCharacterRange:(NSRange)theRange
+- (NSRect)firstRectForCharacterRange:(NSRange)theRange actualRange:(NSRangePointer)actualRange
 { 
+    [self _executeSavedKeypressCommands];
+
     // Just to match NSTextView's behavior. Regression tests cannot detect this;
     // to reproduce, use a test application from http://bugs.webkit.org/show_bug.cgi?id=4682
     // (type something; try ranges (1, -1) and (2, -1).
@@ -1281,7 +1478,10 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     NSWindow *window = [self window];
     if (window)
         resultRect.origin = [window convertBaseToScreen:resultRect.origin];
-    
+
+    if (actualRange)
+        *actualRange = theRange;
+
     LOG(TextInput, "firstRectForCharacterRange:(%u, %u) -> (%f, %f, %f, %f)", theRange.location, theRange.length, resultRect.origin.x, resultRect.origin.y, resultRect.size.width, resultRect.size.height);
     return resultRect;
 }
@@ -1318,7 +1518,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     DragData dragData(draggingInfo, client, global, static_cast<DragOperation>([draggingInfo draggingSourceOperationMask]), [self applicationFlags:draggingInfo]);
 
     _data->_page->resetDragOperation();
-    _data->_page->performDragControllerAction(DragControllerActionEntered, &dragData, [[draggingInfo draggingPasteboard] name]);
+    _data->_page->dragEntered(&dragData, [[draggingInfo draggingPasteboard] name]);
     return NSDragOperationCopy;
 }
 
@@ -1327,7 +1527,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     IntPoint client([self convertPoint:[draggingInfo draggingLocation] fromView:nil]);
     IntPoint global(globalPoint([draggingInfo draggingLocation], [self window]));
     DragData dragData(draggingInfo, client, global, static_cast<DragOperation>([draggingInfo draggingSourceOperationMask]), [self applicationFlags:draggingInfo]);
-    _data->_page->performDragControllerAction(DragControllerActionUpdated, &dragData, [[draggingInfo draggingPasteboard] name]);
+    _data->_page->dragUpdated(&dragData, [[draggingInfo draggingPasteboard] name]);
     return _data->_page->dragOperation();
 }
 
@@ -1336,7 +1536,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     IntPoint client([self convertPoint:[draggingInfo draggingLocation] fromView:nil]);
     IntPoint global(globalPoint([draggingInfo draggingLocation], [self window]));
     DragData dragData(draggingInfo, client, global, static_cast<DragOperation>([draggingInfo draggingSourceOperationMask]), [self applicationFlags:draggingInfo]);
-    _data->_page->performDragControllerAction(DragControllerActionExited, &dragData, [[draggingInfo draggingPasteboard] name]);
+    _data->_page->dragExited(&dragData, [[draggingInfo draggingPasteboard] name]);
     _data->_page->resetDragOperation();
 }
 
@@ -1345,15 +1545,53 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     return YES;
 }
 
+// FIXME: This code is more or less copied from Pasteboard::getBestURL.
+// It would be nice to be able to share the code somehow.
+static void maybeCreateSandboxExtensionFromPasteboard(NSPasteboard *pasteboard, SandboxExtension::Handle& sandboxExtensionHandle)
+{
+    NSArray *types = [pasteboard types];
+    if (![types containsObject:NSFilenamesPboardType])
+        return;
+
+    NSArray *files = [pasteboard propertyListForType:NSFilenamesPboardType];
+    if ([files count] != 1)
+        return;
+
+    NSString *file = [files objectAtIndex:0];
+    BOOL isDirectory;
+    if (![[NSFileManager defaultManager] fileExistsAtPath:file isDirectory:&isDirectory])
+        return;
+
+    if (isDirectory)
+        return;
+
+    SandboxExtension::createHandle("/", SandboxExtension::ReadOnly, sandboxExtensionHandle);
+}
+
 - (BOOL)performDragOperation:(id <NSDraggingInfo>)draggingInfo
 {
     IntPoint client([self convertPoint:[draggingInfo draggingLocation] fromView:nil]);
     IntPoint global(globalPoint([draggingInfo draggingLocation], [self window]));
     DragData dragData(draggingInfo, client, global, static_cast<DragOperation>([draggingInfo draggingSourceOperationMask]), [self applicationFlags:draggingInfo]);
-    _data->_page->performDragControllerAction(DragControllerActionPerformDrag, &dragData, [[draggingInfo draggingPasteboard] name]);
+
+    SandboxExtension::Handle sandboxExtensionHandle;
+    maybeCreateSandboxExtensionFromPasteboard([draggingInfo draggingPasteboard], sandboxExtensionHandle);
+
+    _data->_page->performDrag(&dragData, [[draggingInfo draggingPasteboard] name], sandboxExtensionHandle);
+
     return YES;
 }
 
+// This code is needed to support drag and drop when the drag types cannot be matched.
+// This is the case for elements that do not place content
+// in the drag pasteboard automatically when the drag start (i.e. dragging a DIV element).
+- (NSView *)_hitTest:(NSPoint *)point dragTypes:(NSSet *)types
+{
+    if ([[self superview] mouse:*point inRect:[self frame]])
+        return self;
+    return nil;
+}
+
 - (void)_updateWindowVisibility
 {
     _data->_page->updateWindowIsVisible(![[self window] isMiniaturized]);
@@ -1423,6 +1661,10 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
                                                      name:NSWindowDidMoveNotification object:window];
         [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowFrameDidChange:) 
                                                      name:NSWindowDidResizeNotification object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidOrderOffScreen:) 
+                                                     name:@"NSWindowDidOrderOffScreenNotification" object:window];
+        [[NSNotificationCenter defaultCenter] addObserver:self selector:@selector(_windowDidOrderOnScreen:) 
+                                                     name:@"_NSWindowDidBecomeVisible" object:window];
     }
 }
 
@@ -1438,6 +1680,8 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidDeminiaturizeNotification object:window];
     [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidMoveNotification object:window];
     [[NSNotificationCenter defaultCenter] removeObserver:self name:NSWindowDidResizeNotification object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:@"NSWindowDidOrderOffScreenNotification" object:window];
+    [[NSNotificationCenter defaultCenter] removeObserver:self name:@"_NSWindowDidBecomeVisible" object:window];
 }
 
 - (void)viewWillMoveToWindow:(NSWindow *)window
@@ -1492,15 +1736,19 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 - (void)_windowDidBecomeKey:(NSNotification *)notification
 {
     NSWindow *keyWindow = [notification object];
-    if (keyWindow == [self window] || keyWindow == [[self window] attachedSheet])
+    if (keyWindow == [self window] || keyWindow == [[self window] attachedSheet]) {
+        [self _updateSecureInputState];
         _data->_page->viewStateDidChange(WebPageProxy::ViewWindowIsActive);
+    }
 }
 
 - (void)_windowDidResignKey:(NSNotification *)notification
 {
     NSWindow *formerKeyWindow = [notification object];
-    if (formerKeyWindow == [self window] || formerKeyWindow == [[self window] attachedSheet])
+    if (formerKeyWindow == [self window] || formerKeyWindow == [[self window] attachedSheet]) {
+        [self _updateSecureInputState];
         _data->_page->viewStateDidChange(WebPageProxy::ViewWindowIsActive);
+    }
 }
 
 - (void)_windowDidMiniaturize:(NSNotification *)notification
@@ -1518,6 +1766,16 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
     [self _updateWindowAndViewFrames];
 }
 
+- (void)_windowDidOrderOffScreen:(NSNotification *)notification
+{
+    _data->_page->viewStateDidChange(WebPageProxy::ViewIsVisible);
+}
+
+- (void)_windowDidOrderOnScreen:(NSNotification *)notification
+{
+    _data->_page->viewStateDidChange(WebPageProxy::ViewIsVisible);
+}
+
 static void drawPageBackground(CGContextRef context, WebPageProxy* page, const IntRect& rect)
 {
     if (!page->drawsBackground())
@@ -1667,6 +1925,7 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
         // NSPrintOperation takes ownership of the view.
         NSPrintOperation *printOperation = [NSPrintOperation printOperationWithView:printingView.get()];
         [printOperation setCanSpawnSeparateThread:YES];
+        [printOperation setJobTitle:toImpl(frameRef)->title()];
         printingView->_printOperation = printOperation;
         return printOperation;
     }
@@ -1706,14 +1965,6 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     [self setNeedsDisplay:YES];
 }
 
-- (void)_takeFocus:(BOOL)forward
-{
-    if (forward)
-        [[self window] selectKeyViewFollowingView:self];
-    else
-        [[self window] selectKeyViewPrecedingView:self];
-}
-
 - (void)_setCursor:(NSCursor *)cursor
 {
     if ([NSCursor currentCursor] == cursor)
@@ -1744,27 +1995,34 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_keyDownEventBeingResent = nullptr;
 }
 
-- (Vector<KeypressCommand>&)_interceptKeyEvent:(NSEvent *)theEvent 
+- (BOOL)_interpretKeyEvent:(NSEvent *)event savingCommandsTo:(Vector<WebCore::KeypressCommand>&)commands
 {
-    ASSERT(!_data->_isInInterpretKeyEvents);
+    ASSERT(!_data->_interpretKeyEventsParameters);
+    ASSERT(commands.isEmpty());
 
-    _data->_isInInterpretKeyEvents = true;
-    _data->_commandsList.clear();
+    if ([event type] == NSFlagsChanged)
+        return NO;
 
-    // Calling interpretKeyEvents will trigger one or more calls to doCommandBySelector and insertText
-    // that will populate the commandsList vector.
-    [self interpretKeyEvents:[NSArray arrayWithObject:theEvent]];
+    WKViewInterpretKeyEventsParameters parameters;
+    parameters.eventInterpretationHadSideEffects = false;
+    parameters.executingSavedKeypressCommands = false;
+    // We assume that an input method has consumed the event, and only change this assumption if one of the NSTextInput methods is called.
+    // We assume the IM will *not* consume hotkey sequences.
+    parameters.consumedByIM = !([event modifierFlags] & NSCommandKeyMask);
+    parameters.commands = &commands;
+    _data->_interpretKeyEventsParameters = &parameters;
 
-    _data->_isInInterpretKeyEvents = false;
+    [self interpretKeyEvents:[NSArray arrayWithObject:event]];
 
-    return _data->_commandsList;
-}
+    _data->_interpretKeyEventsParameters = 0;
 
-- (void)_getTextInputState:(unsigned)start selectionEnd:(unsigned)end underlines:(Vector<CompositionUnderline>&)lines
-{
-    start = _data->_selectionStart;
-    end = _data->_selectionEnd;
-    lines = _data->_underlines;
+    // An input method may consume an event and not tell us (e.g. when displaying a candidate window),
+    // in which case we should not bubble the event up the DOM.
+    if (parameters.consumedByIM)
+        return YES;
+
+    // If we have already executed all or some of the commands, the event is "handled". Note that there are additional checks on web process side.
+    return parameters.eventInterpretationHadSideEffects;
 }
 
 - (NSRect)_convertToDeviceSpace:(NSRect)rect
@@ -2010,6 +2268,22 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_pdfViewController->setZoomFactor(zoomFactor);
 }
 
+- (void)_findStringInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count
+{
+    if (!_data->_pdfViewController)
+        return;
+
+    _data->_pdfViewController->findString(string, options, count);
+}
+
+- (void)_countStringMatchesInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count
+{
+    if (!_data->_pdfViewController)
+        return;
+
+    _data->_pdfViewController->countStringMatches(string, options, count);
+}
+
 - (void)_setDragImage:(NSImage *)image at:(NSPoint)clientPoint linkDrag:(BOOL)linkDrag
 {
     // We need to prevent re-entering this call to avoid crashing in AppKit.
@@ -2028,6 +2302,32 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
     _data->_dragHasStarted = NO;
 }
 
+- (void)_updateSecureInputState
+{
+    if (![[self window] isKeyWindow] || ([[self window] firstResponder] != self && !_data->_inBecomeFirstResponder)) {
+        if (_data->_inSecureInputState) {
+            DisableSecureEventInput();
+            _data->_inSecureInputState = NO;
+        }
+        return;
+    }
+    // WKView has a single input context for all editable areas (except for plug-ins).
+    NSTextInputContext *context = [super inputContext];
+    bool isInPasswordField = _data->_page->editorState().isInPasswordField;
+
+    if (isInPasswordField) {
+        if (!_data->_inSecureInputState)
+            EnableSecureEventInput();
+        static NSArray *romanInputSources = [[NSArray alloc] initWithObjects:&NSAllRomanInputSourcesLocaleIdentifier count:1];
+        [context setAllowedInputSourceLocales:romanInputSources];
+    } else {
+        if (_data->_inSecureInputState)
+            DisableSecureEventInput();
+        [context setAllowedInputSourceLocales:nil];
+    }
+    _data->_inSecureInputState = isInPasswordField;
+}
+
 - (void)_setDrawingAreaSize:(NSSize)size
 {
     if (!_data->_page->drawingArea())
@@ -2053,6 +2353,16 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 }
 #endif
 
+- (bool)_executeSavedCommandBySelector:(SEL)selector
+{
+    // The sink does two things: 1) Tells us if the responder went unhandled, and
+    // 2) prevents any NSBeep; we don't ever want to beep here.
+    RetainPtr<WKResponderChainSink> sink(AdoptNS, [[WKResponderChainSink alloc] initWithResponderChain:self]);
+    [super doCommandBySelector:selector];
+    [sink.get() detach];
+    return ![sink.get() didReceiveUnhandledCommand];
+}
+
 @end
 
 @implementation WKView (Private)
@@ -2101,3 +2411,45 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
 
 @end
 
+@implementation WKResponderChainSink
+
+- (id)initWithResponderChain:(NSResponder *)chain
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    _lastResponderInChain = chain;
+    while (NSResponder *next = [_lastResponderInChain nextResponder])
+        _lastResponderInChain = next;
+    [_lastResponderInChain setNextResponder:self];
+    return self;
+}
+
+- (void)detach
+{
+    [_lastResponderInChain setNextResponder:nil];
+    _lastResponderInChain = nil;
+}
+
+- (bool)didReceiveUnhandledCommand
+{
+    return _didReceiveUnhandledCommand;
+}
+
+- (void)noResponderFor:(SEL)selector
+{
+    _didReceiveUnhandledCommand = true;
+}
+
+- (void)doCommandBySelector:(SEL)selector
+{
+    _didReceiveUnhandledCommand = true;
+}
+
+- (BOOL)tryToPerform:(SEL)action with:(id)object
+{
+    _didReceiveUnhandledCommand = true;
+    return YES;
+}
+
+@end
diff --git a/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h b/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
index e4a40f7..82acdcf 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
+++ b/Source/WebKit2/UIProcess/API/mac/WKViewInternal.h
@@ -24,22 +24,25 @@
  */
 
 #import "WKView.h"
-#import <WebCore/Editor.h>
-#import <WebCore/KeyboardEvent.h>
+#import "WebFindOptions.h"
+#import <wtf/Forward.h>
+#import <wtf/Vector.h>
 
 namespace CoreIPC {
     class DataReference;
 }
 
+namespace WebCore {
+    struct KeypressCommand;
+}
+
 namespace WebKit {
     class DrawingAreaProxy;
     class FindIndicator;
     class LayerTreeContext;
 }
 
-#if ENABLE(FULLSCREEN_API)
 @class WKFullScreenWindowController;
-#endif
 
 @interface WKView (Internal)
 - (PassOwnPtr<WebKit::DrawingAreaProxy>)_createDrawingAreaProxy;
@@ -47,13 +50,12 @@ namespace WebKit {
 - (void)_processDidCrash;
 - (void)_pageClosed;
 - (void)_didRelaunchProcess;
-- (void)_takeFocus:(BOOL)direction;
 - (void)_toolTipChangedFrom:(NSString *)oldToolTip to:(NSString *)newToolTip;
 - (void)_setCursor:(NSCursor *)cursor;
 - (void)_setUserInterfaceItemState:(NSString *)commandName enabled:(BOOL)isEnabled state:(int)newState;
-- (Vector<WebCore::KeypressCommand>&)_interceptKeyEvent:(NSEvent *)theEvent;
-- (void)_getTextInputState:(unsigned)start selectionEnd:(unsigned)end underlines:(Vector<WebCore::CompositionUnderline>&)lines;
+- (BOOL)_interpretKeyEvent:(NSEvent *)theEvent savingCommandsTo:(Vector<WebCore::KeypressCommand>&)commands;
 - (void)_resendKeyDownEvent:(NSEvent *)event;
+- (bool)_executeSavedCommandBySelector:(SEL)selector;
 - (NSRect)_convertToDeviceSpace:(NSRect)rect;
 - (NSRect)_convertToUserSpace:(NSRect)rect;
 - (void)_setFindIndicator:(PassRefPtr<WebKit::FindIndicator>)findIndicator fadeOut:(BOOL)fadeOut;
@@ -68,7 +70,10 @@ namespace WebKit {
 - (void)_didFinishLoadingDataForCustomRepresentationWithSuggestedFilename:(const String&)suggestedFilename dataReference:(const CoreIPC::DataReference&)dataReference;
 - (double)_customRepresentationZoomFactor;
 - (void)_setCustomRepresentationZoomFactor:(double)zoomFactor;
+- (void)_findStringInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count;
+- (void)_countStringMatchesInCustomRepresentation:(NSString *)string withFindOptions:(WebKit::FindOptions)options maxMatchCount:(NSUInteger)count;
 - (void)_setDragImage:(NSImage *)image at:(NSPoint)clientPoint linkDrag:(BOOL)linkDrag;
+- (void)_updateSecureInputState;
 
 - (void)_setDrawingAreaSize:(NSSize)size;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/ClientImpl.cpp b/Source/WebKit2/UIProcess/API/qt/ClientImpl.cpp
index 8197236..b427058 100644
--- a/Source/WebKit2/UIProcess/API/qt/ClientImpl.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/ClientImpl.cpp
@@ -165,6 +165,17 @@ void qt_wk_close(WKPageRef page, const void* clientInfo)
     emit toQWKPage(clientInfo)->windowCloseRequested();
 }
 
+void qt_wk_takeFocus(WKPageRef page, WKFocusDirection direction, const void *clientInfo)
+{
+    emit toQWKPage(clientInfo)->focusNextPrevChild(direction == kWKFocusDirectionForward);
+}
+
 void qt_wk_runJavaScriptAlert(WKPageRef page, WKStringRef alertText, WKFrameRef frame, const void* clientInfo)
 {
 }
+
+void qt_wk_setStatusText(WKPageRef page, WKStringRef text, const void *clientInfo)
+{
+    QString qText = WKStringCopyQString(text);
+    emit toQWKPage(clientInfo)->statusBarMessage(qText);
+}
diff --git a/Source/WebKit2/UIProcess/API/qt/ClientImpl.h b/Source/WebKit2/UIProcess/API/qt/ClientImpl.h
index 5d8c062..7955144 100644
--- a/Source/WebKit2/UIProcess/API/qt/ClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/qt/ClientImpl.h
@@ -48,7 +48,9 @@ void qt_wk_didBecomeResponsive(WKPageRef, const void* clientInfo);
 WKPageRef qt_wk_createNewPage(WKPageRef page, WKDictionaryRef features, WKEventModifiers modifiers, WKEventMouseButton mouseButton, const void *clientInfo);
 void qt_wk_showPage(WKPageRef page, const void *clientInfo);
 void qt_wk_close(WKPageRef page, const void *clientInfo);
+void qt_wk_takeFocus(WKPageRef page, WKFocusDirection direction, const void *clientInfo);
 void qt_wk_runJavaScriptAlert(WKPageRef page, WKStringRef alertText, WKFrameRef frame, const void* clientInfo);
+void qt_wk_setStatusText(WKPageRef page, WKStringRef text, const void *clientInfo);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/UIProcess/API/qt/WKView.h b/Source/WebKit2/UIProcess/API/qt/WKView.h
index 5bb95e8..57a5458 100644
--- a/Source/WebKit2/UIProcess/API/qt/WKView.h
+++ b/Source/WebKit2/UIProcess/API/qt/WKView.h
@@ -22,6 +22,7 @@
 
 #include <WebKit2/qgraphicswkview.h>
 #include <WebKit2/qwkcontext.h>
+#include <WebKit2/qwkhistory.h>
 #include <WebKit2/qwkpage.h>
 #include <WebKit2/qwkpreferences.h>
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qgraphicswkview.cpp b/Source/WebKit2/UIProcess/API/qt/qgraphicswkview.cpp
index 0381d73..d85ade3 100644
--- a/Source/WebKit2/UIProcess/API/qt/qgraphicswkview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qgraphicswkview.cpp
@@ -50,6 +50,7 @@ struct QGraphicsWKViewPrivate {
     QGraphicsWKViewPrivate(QGraphicsWKView* view);
     WKPageRef pageRef() const { return page->pageRef(); }
 
+    void onToolTipChanged(const QString&);
     void onScaleChanged();
     void commitScale();
 
@@ -84,6 +85,7 @@ QGraphicsWKView::QGraphicsWKView(QWKContext* context, BackingStoreType backingSt
     connect(d->page, SIGNAL(cursorChanged(const QCursor&)), this, SLOT(updateCursor(const QCursor&)));
     connect(d->page, SIGNAL(focusNextPrevChild(bool)), this, SLOT(focusNextPrevChildCallback(bool)));
     connect(d->page, SIGNAL(showContextMenu(QSharedPointer<QMenu>)), this, SLOT(showContextMenu(QSharedPointer<QMenu>)));
+    connect(d->page, SIGNAL(toolTipChanged(QString)), this, SLOT(onToolTipChanged(QString)));
 }
 
 QGraphicsWKView::~QGraphicsWKView()
@@ -424,6 +426,11 @@ void QGraphicsWKViewPrivate::onScaleChanged()
 #endif
 }
 
+void QGraphicsWKViewPrivate::onToolTipChanged(const QString& toolTip)
+{
+    q->setToolTip(toolTip);
+}
+
 void QGraphicsWKViewPrivate::commitScale()
 {
 #if ENABLE(TILED_BACKING_STORE)
diff --git a/Source/WebKit2/UIProcess/API/qt/qgraphicswkview.h b/Source/WebKit2/UIProcess/API/qt/qgraphicswkview.h
index 03fc722..e4aecdd 100644
--- a/Source/WebKit2/UIProcess/API/qt/qgraphicswkview.h
+++ b/Source/WebKit2/UIProcess/API/qt/qgraphicswkview.h
@@ -90,7 +90,8 @@ protected:
     virtual void focusOutEvent(QFocusEvent*);
 
 private:
-    Q_PRIVATE_SLOT(d, void onScaleChanged());
+    Q_PRIVATE_SLOT(d, void onScaleChanged())
+    Q_PRIVATE_SLOT(d, void onToolTipChanged(const QString&))
 
     QGraphicsWKViewPrivate* d;
     friend class QGraphicsWKViewPrivate;
diff --git a/Source/WebKit2/UIProcess/API/qt/qwkhistory.h b/Source/WebKit2/UIProcess/API/qt/qwkhistory.h
index 81081c9..cf1c842 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwkhistory.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwkhistory.h
@@ -25,10 +25,10 @@
 #ifndef qwkhistory_h
 #define qwkhistory_h
 
+#include "WebKit2/WKBackForwardListItem.h"
 #include "qwebkitglobal.h"
 #include <QObject>
 #include <QSharedData>
-#include "WKBackForwardListItem.h"
 
 class QWKHistoryPrivate;
 class QWKHistoryItemPrivate;
@@ -49,7 +49,7 @@ public:
     QUrl url() const;
 
 private:
-    QWKHistoryItem(WKBackForwardListItemRef item);
+    QWKHistoryItem(WKBackForwardListItemRef);
 
     QExplicitlySharedDataPointer<QWKHistoryItemPrivate> d;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qwkpage.cpp b/Source/WebKit2/UIProcess/API/qt/qwkpage.cpp
index a162918..7eb78da 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwkpage.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwkpage.cpp
@@ -34,6 +34,7 @@
 #include "FindIndicator.h"
 #include "LocalizedStrings.h"
 #include "NativeWebKeyboardEvent.h"
+#include "NativeWebMouseEvent.h"
 #include "NotImplemented.h"
 #include "TiledDrawingAreaProxy.h"
 #include "WebContext.h"
@@ -125,11 +126,6 @@ void QWKPagePrivate::setViewportArguments(const ViewportArguments& args)
     emit q->viewportChangeRequested();
 }
 
-void QWKPagePrivate::takeFocus(bool direction)
-{
-    emit q->focusNextPrevChild(direction);
-}
-
 PassOwnPtr<DrawingAreaProxy> QWKPagePrivate::createDrawingAreaProxy()
 {
     // FIXME: We should avoid this cast by decoupling the view from the page.
@@ -206,7 +202,7 @@ void QWKPagePrivate::didChangeContentsSize(const IntSize& newSize)
 
 void QWKPagePrivate::toolTipChanged(const String&, const String& newTooltip)
 {
-    emit q->statusBarMessage(QString(newTooltip));
+    emit q->toolTipChanged(QString(newTooltip));
 }
 
 void QWKPagePrivate::registerEditCommand(PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo)
@@ -217,6 +213,15 @@ void QWKPagePrivate::clearAllEditCommands()
 {
 }
 
+bool QWKPagePrivate::canUndoRedo(WebPageProxy::UndoOrRedo)
+{
+    return false;
+}
+
+void QWKPagePrivate::executeUndoRedo(WebPageProxy::UndoOrRedo)
+{
+}
+
 FloatRect QWKPagePrivate::convertToDeviceSpace(const FloatRect& rect)
 {
     return rect;
@@ -297,32 +302,27 @@ void QWKPagePrivate::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
         return;
     lastPos = ev->pos();
 
-    WebMouseEvent mouseEvent = WebEventFactory::createWebMouseEvent(ev, 0);
-    page->handleMouseEvent(mouseEvent);
+    page->handleMouseEvent(NativeWebMouseEvent(ev, 0));
 }
 
 void QWKPagePrivate::mousePressEvent(QGraphicsSceneMouseEvent* ev)
 {
     if (tripleClickTimer.isActive() && (ev->pos() - tripleClick).manhattanLength() < QApplication::startDragDistance()) {
-        WebMouseEvent mouseEvent = WebEventFactory::createWebMouseEvent(ev, 3);
-        page->handleMouseEvent(mouseEvent);
+        page->handleMouseEvent(NativeWebMouseEvent(ev, 3));
         return;
     }
 
-    WebMouseEvent mouseEvent = WebEventFactory::createWebMouseEvent(ev, 1);
-    page->handleMouseEvent(mouseEvent);
+    page->handleMouseEvent(NativeWebMouseEvent(ev, 1));
 }
 
 void QWKPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 {
-    WebMouseEvent mouseEvent = WebEventFactory::createWebMouseEvent(ev, 0);
-    page->handleMouseEvent(mouseEvent);
+    page->handleMouseEvent(NativeWebMouseEvent(ev, 0));
 }
 
 void QWKPagePrivate::mouseDoubleClickEvent(QGraphicsSceneMouseEvent* ev)
 {
-    WebMouseEvent mouseEvent = WebEventFactory::createWebMouseEvent(ev, 2);
-    page->handleMouseEvent(mouseEvent);
+    page->handleMouseEvent(NativeWebMouseEvent(ev, 2));
 
     tripleClickTimer.start(QApplication::doubleClickInterval(), q);
     tripleClick = ev->pos().toPoint();
@@ -458,10 +458,13 @@ QWKPage::QWKPage(QWKContext* context)
         qt_wk_createNewPage,
         qt_wk_showPage,
         qt_wk_close,
+        qt_wk_takeFocus,
+        0,  /* focus */
+        0,  /* unfocus */
         qt_wk_runJavaScriptAlert,
         0,  /* runJavaScriptConfirm */
         0,  /* runJavaScriptPrompt */
-        0,  /* setStatusText */
+        qt_wk_setStatusText,
         0,  /* mouseDidMoveOverElement */
         0,  /* missingPluginButtonClicked */
         0,  /* didNotHandleKeyEvent */
diff --git a/Source/WebKit2/UIProcess/API/qt/qwkpage.h b/Source/WebKit2/UIProcess/API/qt/qwkpage.h
index 48fdd9f..5dcfad2 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwkpage.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwkpage.h
@@ -48,7 +48,7 @@ public:
         WebActionCount
     };
 
-    class ViewportAttributes {
+    class QWEBKIT_EXPORT ViewportAttributes {
     public:
         ViewportAttributes();
         ViewportAttributes(const QWKPage::ViewportAttributes& other);
@@ -122,6 +122,7 @@ public:
 
 public:
     Q_SIGNAL void statusBarMessage(const QString&);
+    Q_SIGNAL void toolTipChanged(const QString&);
     Q_SIGNAL void titleChanged(const QString&);
     Q_SIGNAL void loadStarted();
     Q_SIGNAL void loadFinished(bool ok);
diff --git a/Source/WebKit2/UIProcess/API/qt/qwkpage_p.h b/Source/WebKit2/UIProcess/API/qt/qwkpage_p.h
index ee1fb0e..d2fd26b 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwkpage_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwkpage_p.h
@@ -71,11 +71,11 @@ public:
     virtual void didFindZoomableArea(const WebCore::IntRect&);
     virtual void setCursor(const WebCore::Cursor&);
     virtual void setViewportArguments(const WebCore::ViewportArguments&);
-    virtual void takeFocus(bool direction);
-    virtual void setFocus(bool focused) { }
     virtual void toolTipChanged(const WTF::String&, const WTF::String&);
     virtual void registerEditCommand(PassRefPtr<WebKit::WebEditCommandProxy>, WebKit::WebPageProxy::UndoOrRedo);
     virtual void clearAllEditCommands();
+    virtual bool canUndoRedo(WebPageProxy::UndoOrRedo);
+    virtual void executeUndoRedo(WebPageProxy::UndoOrRedo);
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&);
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&);
     virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&);
@@ -94,7 +94,8 @@ public:
     virtual void didChangeScrollbarsForMainFrame() const { }
 
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects);
-
+    virtual void findStringInCustomRepresentation(const String&, FindOptions, unsigned maxMatchCount) { }
+    virtual void countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned maxMatchCount) { }
     virtual float userSpaceScaleFactor() const { return 1; }
 
     void paint(QPainter* painter, QRect);
diff --git a/Source/WebKit2/UIProcess/Downloads/DownloadProxy.cpp b/Source/WebKit2/UIProcess/Downloads/DownloadProxy.cpp
index ad61d33..c93a6df 100644
--- a/Source/WebKit2/UIProcess/Downloads/DownloadProxy.cpp
+++ b/Source/WebKit2/UIProcess/Downloads/DownloadProxy.cpp
@@ -65,7 +65,8 @@ void DownloadProxy::cancel()
     if (!m_webContext)
         return;
 
-    m_webContext->process()->send(Messages::WebProcess::CancelDownload(m_downloadID), 0);
+    // FIXME (Multi-WebProcess): Downloads shouldn't be handled in the web process.
+    m_webContext->sendToAllProcesses(Messages::WebProcess::CancelDownload(m_downloadID));
 }
 
 void DownloadProxy::invalidate()
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.h b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
index c72cf03..5ccb2fb 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
@@ -83,9 +83,10 @@ public:
 
     virtual void sizeDidChange() = 0;
 
-    // FIXME: visibilityDidChange() should be pure virtual.
+    // FIXME: These should be pure virtual.
     virtual void visibilityDidChange() { }
-
+    virtual void setBackingStoreIsDiscardable(bool) { }
+    
     virtual void setPageIsVisible(bool isVisible) = 0;
 
     const WebCore::IntSize& size() const { return m_size; }
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
index 0ee42f4..0c5359a 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
@@ -52,6 +52,7 @@ DrawingAreaProxyImpl::DrawingAreaProxyImpl(WebPageProxy* webPageProxy)
     , m_currentBackingStoreStateID(0)
     , m_nextBackingStoreStateID(0)
     , m_isWaitingForDidUpdateBackingStoreState(false)
+    , m_isBackingStoreDiscardable(true)
     , m_discardBackingStoreTimer(RunLoop::current(), this, &DrawingAreaProxyImpl::discardBackingStore)
 {
 }
@@ -135,12 +136,31 @@ void DrawingAreaProxyImpl::visibilityDidChange()
 
     // Resume painting.
     m_webPageProxy->process()->send(Messages::DrawingArea::ResumePainting(), m_webPageProxy->pageID());
+
+#if USE(ACCELERATED_COMPOSITING)
+    // If we don't have a backing store, go ahead and mark the backing store as being changed so
+    // that when paint we'll actually wait for something to paint and not flash white.
+    if (!m_backingStore && m_layerTreeContext.isEmpty())
+        backingStoreStateDidChange(DoNotRespondImmediately);
+#endif
 }
 
 void DrawingAreaProxyImpl::setPageIsVisible(bool)
 {
 }
 
+void DrawingAreaProxyImpl::setBackingStoreIsDiscardable(bool isBackingStoreDiscardable)
+{
+    if (m_isBackingStoreDiscardable == isBackingStoreDiscardable)
+        return;
+
+    m_isBackingStoreDiscardable = isBackingStoreDiscardable;
+    if (m_isBackingStoreDiscardable)
+        discardBackingStoreSoon();
+    else
+        m_discardBackingStoreTimer.stop();
+}
+
 void DrawingAreaProxyImpl::update(uint64_t backingStoreStateID, const UpdateInfo& updateInfo)
 {
     ASSERT_ARG(backingStoreStateID, backingStoreStateID <= m_currentBackingStoreStateID);
@@ -277,7 +297,7 @@ void DrawingAreaProxyImpl::waitForAndDispatchDidUpdateBackingStoreState()
         return;
     if (m_webPageProxy->process()->isLaunching())
         return;
-    
+
 #if USE(ACCELERATED_COMPOSITING)
     // FIXME: waitForAndDispatchImmediately will always return the oldest DidUpdateBackingStoreState message that
     // hasn't yet been processed. But it might be better to skip ahead to some other DidUpdateBackingStoreState
@@ -311,6 +331,9 @@ void DrawingAreaProxyImpl::exitAcceleratedCompositingMode()
 
 void DrawingAreaProxyImpl::discardBackingStoreSoon()
 {
+    if (!m_isBackingStoreDiscardable)
+        return;
+
     // We'll wait this many seconds after the last paint before throwing away our backing store to save memory.
     // FIXME: It would be smarter to make this delay based on how expensive painting is. See <http://webkit.org/b/55733>.
     static const double discardBackingStoreDelay = 5;
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
index 11e430c..5762264 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
@@ -54,6 +54,7 @@ private:
     virtual void sizeDidChange();
     virtual void visibilityDidChange();
     virtual void setPageIsVisible(bool);
+    virtual void setBackingStoreIsDiscardable(bool);
 
     // CoreIPC message handlers
     virtual void update(uint64_t backingStoreStateID, const UpdateInfo&);
@@ -98,6 +99,7 @@ private:
     // Used to throttle UpdateBackingStoreState messages so we don't send them faster than the Web process can handle.
     bool m_isWaitingForDidUpdateBackingStoreState;
 
+    bool m_isBackingStoreDiscardable;
     OwnPtr<BackingStore> m_backingStore;
 
     RunLoop::Timer<DrawingAreaProxyImpl> m_discardBackingStoreTimer;
diff --git a/Source/WebKit2/UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp b/Source/WebKit2/UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp
index 04d8a03..f877209 100644
--- a/Source/WebKit2/UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/gtk/ProcessLauncherGtk.cpp
@@ -32,8 +32,9 @@
 #include <WebCore/FileSystem.h>
 #include <WebCore/ResourceHandle.h>
 #include <errno.h>
-#include <stdio.h>
-#include <unistd.h>
+#if OS(LINUX)
+#include <sys/prctl.h>
+#endif
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 #include <wtf/gobject/GOwnPtr.h>
@@ -44,32 +45,46 @@ namespace WebKit {
 
 const char* gWebKitWebProcessName = "WebKitWebProcess";
 
+static void childSetupFunction(gpointer userData)
+{
+    int socket = GPOINTER_TO_INT(userData);
+    close(socket);
+
+#if OS(LINUX)
+    // Kill child process when parent dies.
+    prctl(PR_SET_PDEATHSIG, SIGKILL);
+#endif
+}
+
 void ProcessLauncher::launchProcess()
 {
-    pid_t pid = 0;
+    GPid pid = 0;
 
     int sockets[2];
-    if (socketpair(AF_UNIX, SOCK_STREAM, 0, sockets) < 0) {
-        fprintf(stderr, "Creation of socket failed with errno %d.\n", errno);
+    if (socketpair(AF_UNIX, SOCK_DGRAM, 0, sockets) < 0) {
+        g_printerr("Creation of socket failed: %s.\n", g_strerror(errno));
         ASSERT_NOT_REACHED();
         return;
     }
 
-    pid = fork();
-    if (!pid) { // child process
-        close(sockets[1]);
-        String socket = String::format("%d", sockets[0]);
-        GOwnPtr<gchar> binaryPath(g_build_filename(applicationDirectoryPath().data(), gWebKitWebProcessName, NULL));
-        execl(binaryPath.get(), gWebKitWebProcessName, socket.utf8().data(), NULL);
-    } else if (pid > 0) { // parent process
-        close(sockets[0]);
-        m_processIdentifier = pid;
-        // We've finished launching the process, message back to the main run loop.
-        RunLoop::main()->scheduleWork(WorkItem::create(this, &ProcessLauncher::didFinishLaunchingProcess, pid, sockets[1]));
-    } else {
-        fprintf(stderr, "Unable to fork a new WebProcess with errno: %d.\n", errno);
+    GOwnPtr<gchar> binaryPath(g_build_filename(applicationDirectoryPath().data(), gWebKitWebProcessName, NULL));
+    GOwnPtr<gchar> socket(g_strdup_printf("%d", sockets[0]));
+    char* argv[3];
+    argv[0] = binaryPath.get();
+    argv[1] = socket.get();
+    argv[2] = 0;
+
+    GOwnPtr<GError> error;
+    int spawnFlags = G_SPAWN_LEAVE_DESCRIPTORS_OPEN | G_SPAWN_DO_NOT_REAP_CHILD;
+    if (!g_spawn_async(0, argv, 0, static_cast<GSpawnFlags>(spawnFlags), childSetupFunction, GINT_TO_POINTER(sockets[1]), &pid, &error.outPtr())) {
+        g_printerr("Unable to fork a new WebProcess: %s.\n", error->message);
         ASSERT_NOT_REACHED();
     }
+
+    close(sockets[0]);
+    m_processIdentifier = pid;
+    // We've finished launching the process, message back to the main run loop.
+    RunLoop::main()->scheduleWork(WorkItem::create(this, &ProcessLauncher::didFinishLaunchingProcess, m_processIdentifier, sockets[1]));
 }
 
 void ProcessLauncher::terminateProcess()
diff --git a/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp b/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
index cae5bdf..5f3c99f 100644
--- a/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
@@ -83,6 +83,16 @@ void QtWebProcess::setupChildProcess()
 #endif
 }
 
+#if OS(SYMBIAN)
+// FIXME: Symbian's POSIX layer doesn't have a socketpair(), so
+// the following is just to fix the build until a pure Symbian
+// IPC implementation lands on trunk
+static int socketpair(int, int, int , int[2])
+{
+    return -1;
+}
+#endif
+
 void ProcessLauncher::launchProcess()
 {
     QString applicationPath = QLatin1String("%1 %2");
diff --git a/Source/WebKit2/UIProcess/Launcher/win/ProcessLauncherWin.cpp b/Source/WebKit2/UIProcess/Launcher/win/ProcessLauncherWin.cpp
index 8981e80..03175b5 100644
--- a/Source/WebKit2/UIProcess/Launcher/win/ProcessLauncherWin.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/win/ProcessLauncherWin.cpp
@@ -76,7 +76,9 @@ void ProcessLauncher::launchProcess()
 
     // FIXME: It would be nice if we could just create a CommandLine object and output a command line vector from it.
     Vector<UChar> commandLineVector;
+    append(commandLineVector, "\"");
     append(commandLineVector, commandLine);
+    append(commandLineVector, "\"");
     append(commandLineVector, " -type webprocess");
     append(commandLineVector, " -clientIdentifier ");
     append(commandLineVector, String::number(reinterpret_cast<uintptr_t>(clientIdentifier)));
diff --git a/Source/WebKit2/UIProcess/PageClient.h b/Source/WebKit2/UIProcess/PageClient.h
index 83ce502..7582152 100644
--- a/Source/WebKit2/UIProcess/PageClient.h
+++ b/Source/WebKit2/UIProcess/PageClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -81,8 +81,6 @@ public:
     virtual void didRelaunchProcess() = 0;
     virtual void pageClosed() = 0;
 
-    virtual void setFocus(bool focused) = 0;
-    virtual void takeFocus(bool direction) = 0;
     virtual void toolTipChanged(const String&, const String&) = 0;
 
 #if ENABLE(TILED_BACKING_STORE)
@@ -98,14 +96,21 @@ public:
 
     virtual void registerEditCommand(PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo) = 0;
     virtual void clearAllEditCommands() = 0;
+    virtual bool canUndoRedo(WebPageProxy::UndoOrRedo) = 0;
+    virtual void executeUndoRedo(WebPageProxy::UndoOrRedo) = 0;
 #if PLATFORM(MAC)
     virtual void accessibilityWebProcessTokenReceived(const CoreIPC::DataReference&) = 0;
-    virtual void interceptKeyEvent(const NativeWebKeyboardEvent&, Vector<WebCore::KeypressCommand>& commandName, uint32_t selectionStart, uint32_t selectionEnd, Vector<WebCore::CompositionUnderline>& underlines) = 0;
+    virtual bool interpretKeyEvent(const NativeWebKeyboardEvent&, Vector<WebCore::KeypressCommand>&) = 0;
+    virtual bool executeSavedCommandBySelector(const String& selector) = 0;
     virtual void setDragImage(const WebCore::IntPoint& clientPosition, PassRefPtr<ShareableBitmap> dragImage, bool isLinkDrag) = 0;
+    virtual void updateSecureInputState() = 0;
 #endif
 #if PLATFORM(WIN)
     virtual void compositionSelectionChanged(bool) = 0;
 #endif
+#if PLATFORM(GTK)
+    virtual void getEditorCommandsForKeyEvent(const NativeWebKeyboardEvent&, Vector<WTF::String>&) = 0;
+#endif
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&) = 0;
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&) = 0;
     virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&) = 0;
@@ -124,12 +129,14 @@ public:
 
 #if PLATFORM(WIN)
     virtual HWND nativeWindow() = 0;
+    virtual void setGestureReachedScrollingLimit(bool) = 0;
 #endif
 
 #if PLATFORM(MAC)
     virtual void setComplexTextInputEnabled(uint64_t pluginComplexTextInputIdentifier, bool complexTextInputEnabled) = 0;
     virtual CGContextRef containingWindowGraphicsContext() = 0;
     virtual void didPerformDictionaryLookup(const String&, double scaleFactor, const DictionaryPopupInfo&) = 0;
+    virtual void dismissDictionaryLookupPanel() = 0;
     virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings) = 0;
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel) = 0;
     virtual String dismissCorrectionPanelSoon(WebCore::ReasonForDismissingCorrectionPanel) = 0;
@@ -145,6 +152,8 @@ public:
     virtual void setCustomRepresentationZoomFactor(double) = 0;
 
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects) = 0;
+    virtual void findStringInCustomRepresentation(const String&, FindOptions, unsigned maxMatchCount) = 0;
+    virtual void countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned maxMatchCount) = 0;
 
     virtual float userSpaceScaleFactor() const = 0;
 };
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
index fc49d96..bcef7d6 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginInfoStore.h
@@ -35,6 +35,8 @@ namespace WebCore {
 namespace WebKit {
 
 class PluginInfoStore {
+    WTF_MAKE_NONCOPYABLE(PluginInfoStore);
+
 public:
     PluginInfoStore();
 
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.cpp b/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.cpp
index c0aa8b3..fd81da5 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.cpp
@@ -45,14 +45,13 @@ PluginProcessManager::PluginProcessManager()
 {
 }
 
-void PluginProcessManager::getPluginProcessConnection(const String& pluginPath, WebProcessProxy* webProcessProxy, CoreIPC::ArgumentEncoder* reply)
+void PluginProcessManager::getPluginProcessConnection(PluginInfoStore* pluginInfoStore, const String& pluginPath, PassRefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply)
 {
     ASSERT(!pluginPath.isNull());
 
-    PluginInfoStore::Plugin plugin = webProcessProxy->context()->pluginInfoStore()->infoForPluginWithPath(pluginPath);
+    PluginInfoStore::Plugin plugin = pluginInfoStore->infoForPluginWithPath(pluginPath);
     PluginProcessProxy* pluginProcess = getOrCreatePluginProcess(plugin);
-
-    pluginProcess->createWebProcessConnection(webProcessProxy, reply);
+    pluginProcess->getPluginProcessConnection(reply);
 }
 
 void PluginProcessManager::removePluginProcessProxy(PluginProcessProxy* pluginProcessProxy)
@@ -75,12 +74,28 @@ void PluginProcessManager::clearSiteData(const PluginInfoStore::Plugin& plugin,
     pluginProcess->clearSiteData(webPluginSiteDataManager, sites, flags, maxAgeInSeconds, callbackID);
 }
 
-PluginProcessProxy* PluginProcessManager::getOrCreatePluginProcess(const PluginInfoStore::Plugin& plugin)
+void PluginProcessManager::pluginSyncMessageSendTimedOut(const String& pluginPath)
+{
+    PluginProcessProxy* pluginProcess = pluginProcessWithPath(pluginPath);
+    if (!pluginProcess)
+        return;
+
+    pluginProcess->terminate();
+}
+
+PluginProcessProxy* PluginProcessManager::pluginProcessWithPath(const String& pluginPath)
 {
     for (size_t i = 0; i < m_pluginProcesses.size(); ++i) {
-        if (m_pluginProcesses[i]->pluginInfo().path == plugin.path)
+        if (m_pluginProcesses[i]->pluginInfo().path == pluginPath)
             return m_pluginProcesses[i];
     }
+    return 0;
+}
+
+PluginProcessProxy* PluginProcessManager::getOrCreatePluginProcess(const PluginInfoStore::Plugin& plugin)
+{
+    if (PluginProcessProxy* pluginProcess = pluginProcessWithPath(plugin.path))
+        return pluginProcess;
 
     PluginProcessProxy* pluginProcess = PluginProcessProxy::create(this, plugin).leakPtr();
     m_pluginProcesses.append(pluginProcess);
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h b/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
index 79e5952..eaa7536 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
@@ -29,6 +29,7 @@
 #if ENABLE(PLUGIN_PROCESS)
 
 #include "PluginInfoStore.h"
+#include "WebProcessProxyMessages.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
@@ -39,6 +40,7 @@ namespace CoreIPC {
 
 namespace WebKit {
 
+class PluginInfoStore;
 class PluginProcessProxy;
 class WebProcessProxy;
 class WebPluginSiteDataManager;
@@ -48,16 +50,19 @@ class PluginProcessManager {
 public:
     static PluginProcessManager& shared();
 
-    void getPluginProcessConnection(const String& pluginPath, WebProcessProxy*, CoreIPC::ArgumentEncoder* reply);
+    void getPluginProcessConnection(PluginInfoStore*, const String& pluginPath, PassRefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply>);
     void removePluginProcessProxy(PluginProcessProxy*);
 
     void getSitesWithData(const PluginInfoStore::Plugin&, WebPluginSiteDataManager*, uint64_t callbackID);
     void clearSiteData(const PluginInfoStore::Plugin&, WebPluginSiteDataManager*, const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID);
 
+    void pluginSyncMessageSendTimedOut(const String& pluginPath);
+
 private:
     PluginProcessManager();
 
     PluginProcessProxy* getOrCreatePluginProcess(const PluginInfoStore::Plugin&);
+    PluginProcessProxy* pluginProcessWithPath(const String& pluginPath);
 
     Vector<PluginProcessProxy*> m_pluginProcesses;
 };
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
index f167747..561c02b 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
@@ -28,7 +28,6 @@
 
 #if ENABLE(PLUGIN_PROCESS)
 
-#include "MachPort.h"
 #include "PluginProcessCreationParameters.h"
 #include "PluginProcessManager.h"
 #include "PluginProcessMessages.h"
@@ -37,6 +36,10 @@
 #include "WebPluginSiteDataManager.h"
 #include "WebProcessProxy.h"
 
+#if PLATFORM(MAC)
+#include "MachPort.h"
+#endif
+
 namespace WebKit {
 
 PassOwnPtr<PluginProcessProxy> PluginProcessProxy::create(PluginProcessManager* PluginProcessManager, const PluginInfoStore::Plugin& pluginInfo)
@@ -51,6 +54,7 @@ PluginProcessProxy::PluginProcessProxy(PluginProcessManager* PluginProcessManage
 #if PLATFORM(MAC)
     , m_modalWindowIsShowing(false)
     , m_fullscreenWindowIsShowing(false)
+    , m_preFullscreenAppPresentationOptions(0)
 #endif
 {
     ProcessLauncher::LaunchOptions launchOptions;
@@ -69,15 +73,15 @@ PluginProcessProxy::~PluginProcessProxy()
 
 // Asks the plug-in process to create a new connection to a web process. The connection identifier will be 
 // encoded in the given argument encoder and sent back to the connection of the given web process.
-void PluginProcessProxy::createWebProcessConnection(WebProcessProxy* webProcessProxy, CoreIPC::ArgumentEncoder* reply)
+void PluginProcessProxy::getPluginProcessConnection(PassRefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply)
 {
-    m_pendingConnectionReplies.append(make_pair(webProcessProxy, reply));
+    m_pendingConnectionReplies.append(reply);
 
     if (m_processLauncher->isLaunching()) {
         m_numPendingConnectionRequests++;
         return;
     }
-
+    
     // Ask the plug-in process to create a connection. Since the plug-in can be waiting for a synchronous reply
     // we need to make sure that this message is always processed, even when the plug-in is waiting for a synchronus reply.
     m_connection->send(Messages::PluginProcess::CreateWebProcessConnection(), 0, CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply);
@@ -116,17 +120,23 @@ void PluginProcessProxy::clearSiteData(WebPluginSiteDataManager* webPluginSiteDa
     m_connection->send(Messages::PluginProcess::ClearSiteData(sites, flags, maxAgeInSeconds, callbackID), 0);
 }
 
+void PluginProcessProxy::terminate()
+{
+     m_processLauncher->terminateProcess();
+}
+
 void PluginProcessProxy::pluginProcessCrashedOrFailedToLaunch()
 {
     // The plug-in process must have crashed or exited, send any pending sync replies we might have.
     while (!m_pendingConnectionReplies.isEmpty()) {
-        RefPtr<WebProcessProxy> replyWebProcessProxy = m_pendingConnectionReplies.first().first.release();
-        CoreIPC::ArgumentEncoder* reply = m_pendingConnectionReplies.first().second;
-        m_pendingConnectionReplies.removeFirst();
+        RefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
-        // FIXME: This is Mac specific.
-        reply->encode(CoreIPC::MachPort(0, MACH_MSG_TYPE_MOVE_SEND));
-        replyWebProcessProxy->connection()->sendSyncReply(reply);
+#if PLATFORM(MAC)
+        reply->send(CoreIPC::MachPort(0, MACH_MSG_TYPE_MOVE_SEND));
+#else
+        // FIXME: Implement.
+        ASSERT_NOT_REACHED();
+#endif
     }
 
     while (!m_pendingGetSitesReplies.isEmpty())
@@ -162,6 +172,10 @@ void PluginProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC:
 {
 }
 
+void PluginProcessProxy::syncMessageSendTimedOut(CoreIPC::Connection*)
+{
+}
+
 void PluginProcessProxy::didFinishLaunching(ProcessLauncher*, CoreIPC::Connection::Identifier connectionIdentifier)
 {
     ASSERT(!m_connection);
@@ -200,19 +214,17 @@ void PluginProcessProxy::didFinishLaunching(ProcessLauncher*, CoreIPC::Connectio
     m_numPendingConnectionRequests = 0;
 }
 
+#if PLATFORM(MAC)
 void PluginProcessProxy::didCreateWebProcessConnection(const CoreIPC::MachPort& machPort)
 {
     ASSERT(!m_pendingConnectionReplies.isEmpty());
 
     // Grab the first pending connection reply.
-    RefPtr<WebProcessProxy> replyWebProcessProxy = m_pendingConnectionReplies.first().first.release();
-    CoreIPC::ArgumentEncoder* reply = m_pendingConnectionReplies.first().second;
-    m_pendingConnectionReplies.removeFirst();
+    RefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
-    // FIXME: This is Mac specific.
-    reply->encode(CoreIPC::MachPort(machPort.port(), MACH_MSG_TYPE_MOVE_SEND));
-    replyWebProcessProxy->connection()->sendSyncReply(reply);
+    reply->send(CoreIPC::MachPort(machPort.port(), MACH_MSG_TYPE_MOVE_SEND));
 }
+#endif
 
 void PluginProcessProxy::didGetSitesWithData(const Vector<String>& sites, uint64_t callbackID)
 {
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
index e285d64..59bfd90 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.h
@@ -31,6 +31,7 @@
 #include "Connection.h"
 #include "PluginInfoStore.h"
 #include "ProcessLauncher.h"
+#include "WebProcessProxyMessages.h"
 #include <wtf/Deque.h>
 
 #if PLATFORM(MAC)
@@ -63,14 +64,17 @@ public:
 
     // Asks the plug-in process to create a new connection to a web process. The connection identifier will be 
     // encoded in the given argument encoder and sent back to the connection of the given web process.
-    void createWebProcessConnection(WebProcessProxy*, CoreIPC::ArgumentEncoder* reply);
-
+    void getPluginProcessConnection(PassRefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply>);
+    
     // Asks the plug-in process to get a list of domains for which the plug-in has data stored.
     void getSitesWithData(WebPluginSiteDataManager*, uint64_t callbackID);
 
     // Asks the plug-in process to clear the data for the given sites.
     void clearSiteData(WebPluginSiteDataManager*, const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID);
 
+    // Terminates the plug-in process.
+    void terminate();
+
 private:
     PluginProcessProxy(PluginProcessManager*, const PluginInfoStore::Plugin&);
 
@@ -80,13 +84,16 @@ private:
     virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
     virtual void didClose(CoreIPC::Connection*);
     virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
 
     // ProcessLauncher::Client
     virtual void didFinishLaunching(ProcessLauncher*, CoreIPC::Connection::Identifier);
 
     // Message handlers
     void didReceivePluginProcessProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+#if PLATFORM(MAC)
     void didCreateWebProcessConnection(const CoreIPC::MachPort&);
+#endif
     void didGetSitesWithData(const Vector<String>& sites, uint64_t callbackID);
     void didClearSiteData(uint64_t callbackID);
 
@@ -120,7 +127,7 @@ private:
     // The process launcher for the plug-in host process.
     RefPtr<ProcessLauncher> m_processLauncher;
 
-    Deque<std::pair<RefPtr<WebProcessProxy>, CoreIPC::ArgumentEncoder*> > m_pendingConnectionReplies;
+    Deque<RefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> > m_pendingConnectionReplies;
 
     Vector<uint64_t> m_pendingGetSitesRequests;
     HashMap<uint64_t, RefPtr<WebPluginSiteDataManager> > m_pendingGetSitesReplies;
@@ -143,6 +150,7 @@ private:
     RetainPtr<WKPlaceholderModalWindow *> m_placeholderWindow;
     bool m_modalWindowIsShowing;
     bool m_fullscreenWindowIsShowing;
+    unsigned m_preFullscreenAppPresentationOptions;
 #endif
 };
 
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
index 5fcbe71..7caac11 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.messages.in
@@ -23,8 +23,9 @@
 #if ENABLE(PLUGIN_PROCESS)
 
 messages -> PluginProcessProxy {
-    # FIXME: This is platform specific
+#if PLATFORM(MAC)
     DidCreateWebProcessConnection(CoreIPC::MachPort connectionIdentifier)
+#endif
 
     DidGetSitesWithData(Vector<WTF::String> sites, uint64_t callbackID)
     DidClearSiteData(uint64_t callbackID)
diff --git a/Source/WebKit2/UIProcess/Plugins/WebPluginSiteDataManager.cpp b/Source/WebKit2/UIProcess/Plugins/WebPluginSiteDataManager.cpp
index 5f56d0b..89620a1 100644
--- a/Source/WebKit2/UIProcess/Plugins/WebPluginSiteDataManager.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/WebPluginSiteDataManager.cpp
@@ -167,8 +167,10 @@ void WebPluginSiteDataManager::getSitesWithData(PassRefPtr<ArrayCallback> prpCal
 
     Vector<String> pluginPaths;
     m_webContext->pluginInfoStore()->getPluginPaths(pluginPaths);
-    m_webContext->ensureWebProcess();    
-    m_webContext->process()->send(Messages::WebProcess::GetSitesWithPluginData(pluginPaths, callbackID), 0);
+
+    // FIXME (Multi-WebProcess): When multi-process is enabled, we must always use a plug-in process for this,
+    // so this code should just be removed.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebProcess::GetSitesWithPluginData(pluginPaths, callbackID));
 #endif
 }
 
@@ -226,8 +228,10 @@ void WebPluginSiteDataManager::clearSiteData(ImmutableArray* sites, uint64_t fla
     m_webContext->relaunchProcessIfNecessary();
     Vector<String> pluginPaths;
     m_webContext->pluginInfoStore()->getPluginPaths(pluginPaths);
-    m_webContext->ensureWebProcess();    
-    m_webContext->process()->send(Messages::WebProcess::ClearPluginSiteData(pluginPaths, sitesVector, flags, maxAgeInSeconds, callbackID), 0);
+
+    // FIXME (Multi-WebProcess): When multi-process is enabled, we must always use a plug-in process for this,
+    // so this code should just be removed.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebProcess::ClearPluginSiteData(pluginPaths, sitesVector, flags, maxAgeInSeconds, callbackID));
 #endif
 }
 
diff --git a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
index 8375fd2..c845a49 100644
--- a/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
+++ b/Source/WebKit2/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
@@ -105,30 +105,37 @@ void PluginProcessProxy::setFullscreenWindowIsShowing(bool fullscreenWindowIsSho
 
 void PluginProcessProxy::enterFullscreen()
 {
-    [NSMenu setMenuBarVisible:NO];
+    // Get the current presentation options.
+    m_preFullscreenAppPresentationOptions = [NSApp presentationOptions];
 
+    // Figure out which presentation options to use.
+    unsigned presentationOptions = m_preFullscreenAppPresentationOptions & ~(NSApplicationPresentationAutoHideDock | NSApplicationPresentationAutoHideMenuBar);
+    presentationOptions |= NSApplicationPresentationHideDock | NSApplicationPresentationHideMenuBar;
+
+    [NSApp setPresentationOptions:presentationOptions];
     makePluginProcessTheFrontProcess();
 }
 
 void PluginProcessProxy::exitFullscreen()
 {
-    [NSMenu setMenuBarVisible:YES];
-
     // If the plug-in host is the current application then we should bring ourselves to the front when it exits full-screen mode.
-
     ProcessSerialNumber frontProcessSerialNumber;
     GetFrontProcess(&frontProcessSerialNumber);
-    Boolean isSameProcess = 0;
+
+    // The UI process must be the front process in order to change the presentation mode.
+    makeUIProcessTheFrontProcess();
+    [NSApp setPresentationOptions:m_preFullscreenAppPresentationOptions];
 
     ProcessSerialNumber pluginProcessSerialNumber;
     if (!getPluginProcessSerialNumber(pluginProcessSerialNumber))
         return;
 
-    SameProcess(&frontProcessSerialNumber, &pluginProcessSerialNumber, &isSameProcess);
-    if (!isSameProcess)
-        return;
-
-    makeUIProcessTheFrontProcess();
+    // If the plug-in process was not the front process, switch back to the previous front process.
+    // (Otherwise we'll keep the UI process as the front process).
+    Boolean isPluginProcessFrontProcess;
+    SameProcess(&frontProcessSerialNumber, &pluginProcessSerialNumber, &isPluginProcessFrontProcess);
+    if (!isPluginProcessFrontProcess)
+        SetFrontProcess(&frontProcessSerialNumber);
 }
 
 void PluginProcessProxy::setModalWindowIsShowing(bool modalWindowIsShowing)
diff --git a/Source/WebKit2/UIProcess/Plugins/win/PluginInfoStoreWin.cpp b/Source/WebKit2/UIProcess/Plugins/win/PluginInfoStoreWin.cpp
index f695969..f29fa4f 100644
--- a/Source/WebKit2/UIProcess/Plugins/win/PluginInfoStoreWin.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/win/PluginInfoStoreWin.cpp
@@ -27,6 +27,7 @@
 #include "PluginInfoStore.h"
 
 #include "NetscapePluginModule.h"
+#include <WebCore/FileSystem.h>
 #include <WebCore/PathWalker.h>
 #include <shlwapi.h>
 
@@ -339,9 +340,6 @@ static bool isNewWindowsMediaPlayerPlugin(const PluginInfoStore::Plugin& plugin)
 
 bool PluginInfoStore::shouldUsePlugin(const Plugin& plugin)
 {
-    // FIXME: We should prefer a newer version of a plugin to an older version, rather than loading
-    // both. <http://webkit.org/b/49075>
-
     if (plugin.info.name == "Citrix ICA Client") {
         // The Citrix ICA Client plug-in requires a Mozilla-based browser; see <rdar://6418681>.
         return false;
@@ -393,6 +391,17 @@ bool PluginInfoStore::shouldUsePlugin(const Plugin& plugin)
         return true;
     }
 
+    // FIXME: We should prefer a newer version of a plugin to an older version, rather than loading
+    // only the first. <http://webkit.org/b/58469>
+    String pluginFileName = pathGetFileName(plugin.path);
+    for (size_t i = 0; i < m_plugins.size(); ++i) {
+        Plugin& loadedPlugin = m_plugins[i];
+
+        // If a plug-in with the same filename already exists, we don't want to load it.
+        if (equalIgnoringCase(pluginFileName, pathGetFileName(loadedPlugin.path)))
+            return false;
+    }
+
     return true;
 }
 
diff --git a/Source/WebKit2/UIProcess/TextChecker.h b/Source/WebKit2/UIProcess/TextChecker.h
index 7a5d535..69e2837 100644
--- a/Source/WebKit2/UIProcess/TextChecker.h
+++ b/Source/WebKit2/UIProcess/TextChecker.h
@@ -31,6 +31,7 @@
 
 namespace WebKit {
 
+class WebPageProxy;
 struct TextCheckerState;
 
 class TextChecker {
@@ -50,16 +51,27 @@ public:
 
     static bool isSmartInsertDeleteEnabled();
     static void setSmartInsertDeleteEnabled(bool);
+
+    static bool substitutionsPanelIsShowing();
+    static void toggleSubstitutionsPanelIsShowing();
+#elif PLATFORM(WIN)
+    static void continuousSpellCheckingEnabledStateChanged(bool);
+    static void grammarCheckingEnabledStateChanged(bool);
 #endif
 
-    static int64_t uniqueSpellDocumentTag();
+    static int64_t uniqueSpellDocumentTag(WebPageProxy*);
     static void closeSpellDocumentWithTag(int64_t);
-
+#if USE(UNIFIED_TEXT_CHECKING)
     static Vector<WebCore::TextCheckingResult> checkTextOfParagraph(int64_t spellDocumentTag, const UChar* text, int length, uint64_t checkingTypes);
-    static void updateSpellingUIWithMisspelledWord(const String& misspelledWord);
-    static void updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const WebCore::GrammarDetail&);
+#endif
+    static void checkSpellingOfString(int64_t spellDocumentTag, const UChar* text, uint32_t length, int32_t& misspellingLocation, int32_t& misspellingLength);
+    static void checkGrammarOfString(int64_t spellDocumentTag, const UChar* text, uint32_t length, Vector<WebCore::GrammarDetail>&, int32_t& badGrammarLocation, int32_t& badGrammarLength);
+    static bool spellingUIIsShowing();
+    static void toggleSpellingUIIsShowing();
+    static void updateSpellingUIWithMisspelledWord(int64_t spellDocumentTag, const String& misspelledWord);
+    static void updateSpellingUIWithGrammarString(int64_t spellDocumentTag, const String& badGrammarPhrase, const WebCore::GrammarDetail&);
     static void getGuessesForWord(int64_t spellDocumentTag, const String& word, const String& context, Vector<String>& guesses);
-    static void learnWord(const String& word);
+    static void learnWord(int64_t spellDocumentTag, const String& word);
     static void ignoreWord(int64_t spellDocumentTag, const String& word);
 };
 
diff --git a/Source/WebKit2/UIProcess/VisitedLinkProvider.cpp b/Source/WebKit2/UIProcess/VisitedLinkProvider.cpp
index 94b595a..912d05f 100644
--- a/Source/WebKit2/UIProcess/VisitedLinkProvider.cpp
+++ b/Source/WebKit2/UIProcess/VisitedLinkProvider.cpp
@@ -163,17 +163,19 @@ void VisitedLinkProvider::pendingVisitedLinksTimerFired()
         if (!m_table.sharedMemory()->createHandle(handle, SharedMemory::ReadOnly))
             return;
 
-        m_context->process()->send(Messages::WebProcess::SetVisitedLinkTable(handle), 0);
+        // FIXME (Multi-WebProcess): Encoding a handle will null it out so we need to create a new
+        // handle for every process. Maybe the ArgumentEncoder should handle this.
+        m_context->sendToAllProcesses(Messages::WebProcess::SetVisitedLinkTable(handle));
     }
     
     // We now need to let the web process know that we've added links.
     if (m_webProcessHasVisitedLinkState && addedVisitedLinks.size() <= 20) {
-        m_context->process()->send(Messages::WebProcess::VisitedLinkStateChanged(addedVisitedLinks), 0);
+        m_context->sendToAllProcesses(Messages::WebProcess::VisitedLinkStateChanged(addedVisitedLinks));
         return;
     }
     
     // Just recalculate all the visited links.
-    m_context->process()->send(Messages::WebProcess::AllVisitedLinkStateChanged(), 0);
+    m_context->sendToAllProcesses(Messages::WebProcess::AllVisitedLinkStateChanged());
     m_webProcessHasVisitedLinkState = true;
 }
 
diff --git a/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp b/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp
index 6b24940..5ea62cd 100644
--- a/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp
@@ -65,11 +65,12 @@ void WebApplicationCacheManagerProxy::didReceiveMessage(CoreIPC::Connection* con
 void WebApplicationCacheManagerProxy::getApplicationCacheOrigins(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    m_webContext->relaunchProcessIfNecessary();
     
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
-    m_webContext->process()->send(Messages::WebApplicationCacheManager::GetApplicationCacheOrigins(callbackID), 0);
+
+    // FIXME (Multi-WebProcess): The application cache shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebApplicationCacheManager::GetApplicationCacheOrigins(callbackID));
 }
     
 void WebApplicationCacheManagerProxy::didGetApplicationCacheOrigins(const Vector<SecurityOriginData>& originDatas, uint64_t callbackID)
@@ -80,20 +81,19 @@ void WebApplicationCacheManagerProxy::didGetApplicationCacheOrigins(const Vector
 
 void WebApplicationCacheManagerProxy::deleteEntriesForOrigin(WebSecurityOrigin* origin)
 {
-    m_webContext->relaunchProcessIfNecessary();
-    
     SecurityOriginData securityOriginData;
     securityOriginData.protocol = origin->protocol();
     securityOriginData.host = origin->host();
     securityOriginData.port = origin->port();
 
-    m_webContext->process()->send(Messages::WebApplicationCacheManager::DeleteEntriesForOrigin(securityOriginData), 0);
+    // FIXME (Multi-WebProcess): The application cache shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebApplicationCacheManager::DeleteEntriesForOrigin(securityOriginData));
 }
 
 void WebApplicationCacheManagerProxy::deleteAllEntries()
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebApplicationCacheManager::DeleteAllEntries(), 0);
+    // FIXME (Multi-WebProcess): The application cache shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebApplicationCacheManager::DeleteAllEntries());
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebContext.cpp b/Source/WebKit2/UIProcess/WebContext.cpp
index 0609d68..c5d4abc 100644
--- a/Source/WebKit2/UIProcess/WebContext.cpp
+++ b/Source/WebKit2/UIProcess/WebContext.cpp
@@ -54,6 +54,7 @@
 #include <WebCore/Language.h>
 #include <WebCore/LinkHash.h>
 #include <WebCore/Logging.h>
+#include <WebCore/ResourceRequest.h>
 #include <wtf/CurrentTime.h>
 
 #ifndef NDEBUG
@@ -111,8 +112,6 @@ WebContext::WebContext(ProcessModel processModel, const String& injectedBundlePa
     , m_visitedLinkProvider(this)
     , m_alwaysUsesComplexTextCodePath(false)
     , m_cacheModel(CacheModelDocumentViewer)
-    , m_clearResourceCachesForNewWebProcess(false)
-    , m_clearApplicationCacheForNewWebProcess(false)
     , m_memorySamplerEnabled(false)
     , m_memorySamplerInterval(1400.0)
     , m_applicationCacheManagerProxy(WebApplicationCacheManagerProxy::create(this))
@@ -128,6 +127,7 @@ WebContext::WebContext(ProcessModel processModel, const String& injectedBundlePa
     , m_shouldPaintNativeControls(true)
     , m_initialHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicyAlways)
 #endif
+    , m_processTerminationEnabled(true)
 {
 #ifndef NDEBUG
     WebKit::initializeLogChannelsIfNecessary();
@@ -193,11 +193,8 @@ void WebContext::initializeInjectedBundleClient(const WKContextInjectedBundleCli
 void WebContext::initializeHistoryClient(const WKContextHistoryClient* client)
 {
     m_historyClient.initialize(client);
-    
-    if (!hasValidProcess())
-        return;
-        
-    m_process->send(Messages::WebProcess::SetShouldTrackVisitedLinks(m_historyClient.shouldTrackVisitedLinks()), 0);
+
+    sendToAllProcesses(Messages::WebProcess::SetShouldTrackVisitedLinks(m_historyClient.shouldTrackVisitedLinks()));
 }
 
 void WebContext::initializeDownloadClient(const WKContextDownloadClient* client)
@@ -212,10 +209,7 @@ void WebContext::languageChanged(void* context)
 
 void WebContext::languageChanged()
 {
-    if (!hasValidProcess())
-        return;
-
-    m_process->send(Messages::WebProcess::LanguageChanged(defaultLanguage()), 0);
+    sendToAllProcesses(Messages::WebProcess::LanguageChanged(defaultLanguage()));
 }
 
 void WebContext::ensureWebProcess()
@@ -241,14 +235,9 @@ void WebContext::ensureWebProcess()
     parameters.applicationCacheDirectory = applicationCacheDirectory();
     parameters.databaseDirectory = databaseDirectory();
     parameters.localStorageDirectory = localStorageDirectory();
-    parameters.clearResourceCaches = m_clearResourceCachesForNewWebProcess;
-    parameters.clearApplicationCache = m_clearApplicationCacheForNewWebProcess;
 #if PLATFORM(MAC)
     parameters.presenterApplicationPid = getpid();
 #endif
-
-    m_clearResourceCachesForNewWebProcess = false;
-    m_clearApplicationCacheForNewWebProcess = false;
     
     copyToVector(m_schemesToRegisterAsEmptyDocument, parameters.urlSchemesRegistererdAsEmptyDocument);
     copyToVector(m_schemesToRegisterAsSecure, parameters.urlSchemesRegisteredAsSecure);
@@ -274,11 +263,21 @@ void WebContext::ensureWebProcess()
     m_pendingMessagesToPostToInjectedBundle.clear();
 }
 
+void WebContext::enableProcessTermination()
+{
+    m_processTerminationEnabled = true;
+    if (shouldTerminate(m_process.get()))
+        m_process->terminate();
+}
+
 bool WebContext::shouldTerminate(WebProcessProxy* process)
 {
     // FIXME: Once we support multiple processes per context, this assertion won't hold.
     ASSERT(process == m_process);
 
+    if (!m_processTerminationEnabled)
+        return false;
+
     if (!m_downloads.isEmpty())
         return false;
 
@@ -348,10 +347,11 @@ void WebContext::disconnectProcess(WebProcessProxy* process)
     m_pluginSiteDataManager->invalidate();
 #endif
 
+    // This can cause the web context to be destroyed.
     m_process = 0;
 }
 
-WebPageProxy* WebContext::createWebPage(PageClient* pageClient, WebPageGroup* pageGroup)
+PassRefPtr<WebPageProxy> WebContext::createWebPage(PageClient* pageClient, WebPageGroup* pageGroup)
 {
     ensureWebProcess();
 
@@ -361,17 +361,21 @@ WebPageProxy* WebContext::createWebPage(PageClient* pageClient, WebPageGroup* pa
     return m_process->createWebPage(pageClient, this, pageGroup);
 }
 
-void WebContext::relaunchProcessIfNecessary()
+WebProcessProxy* WebContext::relaunchProcessIfNecessary()
 {
     ensureWebProcess();
+
+    ASSERT(m_process);
+    return m_process.get();
 }
 
-void WebContext::download(WebPageProxy* initiatingPage, const ResourceRequest& request)
+DownloadProxy* WebContext::download(WebPageProxy* initiatingPage, const ResourceRequest& request)
 {
-    uint64_t downloadID = createDownloadProxy();
+    DownloadProxy* download = createDownloadProxy();
     uint64_t initiatingPageID = initiatingPage ? initiatingPage->pageID() : 0;
 
-    process()->send(Messages::WebProcess::DownloadRequest(downloadID, initiatingPageID, request), 0);
+    process()->send(Messages::WebProcess::DownloadRequest(download->downloadID(), initiatingPageID, request), 0);
+    return download;
 }
 
 void WebContext::postMessageToInjectedBundle(const String& messageName, APIObject* messageBody)
@@ -463,58 +467,36 @@ void WebContext::setAdditionalPluginsDirectory(const String& directory)
 void WebContext::setAlwaysUsesComplexTextCodePath(bool alwaysUseComplexText)
 {
     m_alwaysUsesComplexTextCodePath = alwaysUseComplexText;
-
-    if (!hasValidProcess())
-        return;
-
-    m_process->send(Messages::WebProcess::SetAlwaysUsesComplexTextCodePath(alwaysUseComplexText), 0);
+    sendToAllProcesses(Messages::WebProcess::SetAlwaysUsesComplexTextCodePath(alwaysUseComplexText));
 }
 
 void WebContext::registerURLSchemeAsEmptyDocument(const String& urlScheme)
 {
     m_schemesToRegisterAsEmptyDocument.add(urlScheme);
-
-    if (!hasValidProcess())
-        return;
-
-    m_process->send(Messages::WebProcess::RegisterURLSchemeAsEmptyDocument(urlScheme), 0);
+    sendToAllProcesses(Messages::WebProcess::RegisterURLSchemeAsEmptyDocument(urlScheme));
 }
 
 void WebContext::registerURLSchemeAsSecure(const String& urlScheme)
 {
     m_schemesToRegisterAsSecure.add(urlScheme);
-
-    if (!hasValidProcess())
-        return;
-
-    m_process->send(Messages::WebProcess::RegisterURLSchemeAsSecure(urlScheme), 0);
+    sendToAllProcesses(Messages::WebProcess::RegisterURLSchemeAsSecure(urlScheme));
 }
 
 void WebContext::setDomainRelaxationForbiddenForURLScheme(const String& urlScheme)
 {
     m_schemesToSetDomainRelaxationForbiddenFor.add(urlScheme);
-
-    if (!hasValidProcess())
-        return;
-
-    m_process->send(Messages::WebProcess::SetDomainRelaxationForbiddenForURLScheme(urlScheme), 0);
+    sendToAllProcesses(Messages::WebProcess::SetDomainRelaxationForbiddenForURLScheme(urlScheme));
 }
 
 void WebContext::setCacheModel(CacheModel cacheModel)
 {
     m_cacheModel = cacheModel;
-
-    if (!hasValidProcess())
-        return;
-    m_process->send(Messages::WebProcess::SetCacheModel(static_cast<uint32_t>(m_cacheModel)), 0);
+    sendToAllProcesses(Messages::WebProcess::SetCacheModel(static_cast<uint32_t>(m_cacheModel)));
 }
 
 void WebContext::setDefaultRequestTimeoutInterval(double timeoutInterval)
 {
-    if (!hasValidProcess())
-        return;
-
-    m_process->send(Messages::WebProcess::SetDefaultRequestTimeoutInterval(timeoutInterval), 0);
+    sendToAllProcesses(Messages::WebProcess::SetDefaultRequestTimeoutInterval(timeoutInterval));
 }
 
 void WebContext::addVisitedLink(const String& visitedURL)
@@ -561,14 +543,11 @@ void WebContext::didClearPluginSiteData(uint64_t callbackID)
 }
 #endif
 
-uint64_t WebContext::createDownloadProxy()
+DownloadProxy* WebContext::createDownloadProxy()
 {
     RefPtr<DownloadProxy> downloadProxy = DownloadProxy::create(this);
-    uint64_t downloadID = downloadProxy->downloadID();
-
-    m_downloads.set(downloadID, downloadProxy.release());
-
-    return downloadID;
+    m_downloads.set(downloadProxy->downloadID(), downloadProxy);
+    return downloadProxy.get();
 }
 
 void WebContext::downloadFinished(DownloadProxy* downloadProxy)
@@ -700,41 +679,9 @@ CoreIPC::SyncReplyMode WebContext::didReceiveSyncMessage(CoreIPC::Connection* co
     return CoreIPC::AutomaticReply;
 }
 
-void WebContext::clearResourceCaches(ResourceCachesToClear cachesToClear)
-{
-    if (hasValidProcess()) {
-        m_process->send(Messages::WebProcess::ClearResourceCaches(cachesToClear), 0);
-        return;
-    }
-
-    if (cachesToClear == InMemoryResourceCachesOnly)
-        return;
-
-    // FIXME <rdar://problem/8727879>: Setting this flag ensures that the next time a WebProcess is created, this request to
-    // clear the resource cache will be respected. But if the user quits the application before another WebProcess is created,
-    // their request will be ignored.
-    m_clearResourceCachesForNewWebProcess = true;
-}
-
-void WebContext::clearApplicationCache()
-{
-    if (!hasValidProcess()) {
-        // FIXME <rdar://problem/8727879>: Setting this flag ensures that the next time a WebProcess is created, this request to
-        // clear the application cache will be respected. But if the user quits the application before another WebProcess is created,
-        // their request will be ignored.
-        m_clearApplicationCacheForNewWebProcess = true;
-        return;
-    }
-
-    m_process->send(Messages::WebProcess::ClearApplicationCache(), 0);
-}
-   
 void WebContext::setEnhancedAccessibility(bool flag)
 {
-    if (!hasValidProcess())
-        return;
-    
-    m_process->send(Messages::WebProcess::SetEnhancedAccessibility(flag), 0);
+    sendToAllProcesses(Messages::WebProcess::SetEnhancedAccessibility(flag));
 }
     
 void WebContext::startMemorySampler(const double interval)
@@ -748,16 +695,13 @@ void WebContext::startMemorySampler(const double interval)
     WebMemorySampler::shared()->start(interval);
 #endif
     
-    if (!hasValidProcess())
-        return;
-    
     // For WebProcess
     SandboxExtension::Handle sampleLogSandboxHandle;    
     double now = WTF::currentTime();
     String sampleLogFilePath = String::format("WebProcess%llu", static_cast<uint64_t>(now));
     sampleLogFilePath = SandboxExtension::createHandleForTemporaryFile(sampleLogFilePath, SandboxExtension::WriteOnly, sampleLogSandboxHandle);
     
-    m_process->send(Messages::WebProcess::StartMemorySampler(sampleLogSandboxHandle, sampleLogFilePath, interval), 0);
+    sendToAllProcesses(Messages::WebProcess::StartMemorySampler(sampleLogSandboxHandle, sampleLogFilePath, interval));
 }
 
 void WebContext::stopMemorySampler()
@@ -769,11 +713,8 @@ void WebContext::stopMemorySampler()
 #if ENABLE(MEMORY_SAMPLER)
     WebMemorySampler::shared()->stop();
 #endif
-    
-    if (!hasValidProcess())
-        return;
-    
-    m_process->send(Messages::WebProcess::StopMemorySampler(), 0);
+
+    sendToAllProcesses(Messages::WebProcess::StopMemorySampler());
 }
 
 String WebContext::databaseDirectory() const
@@ -806,4 +747,20 @@ String WebContext::localStorageDirectory() const
     return platformDefaultLocalStorageDirectory();
 }
 
+void WebContext::setHTTPPipeliningEnabled(bool enabled)
+{
+#if PLATFORM(MAC)
+    ResourceRequest::setHTTPPipeliningEnabled(enabled);
+#endif
+}
+
+bool WebContext::httpPipeliningEnabled()
+{
+#if PLATFORM(MAC)
+    return ResourceRequest::httpPipeliningEnabled();
+#else
+    return false;
+#endif
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebContext.h b/Source/WebKit2/UIProcess/WebContext.h
index a9ba22f..676f1aa 100644
--- a/Source/WebKit2/UIProcess/WebContext.h
+++ b/Source/WebKit2/UIProcess/WebContext.h
@@ -75,20 +75,22 @@ public:
 
     ProcessModel processModel() const { return m_processModel; }
     WebProcessProxy* process() const { return m_process.get(); }
-    bool hasValidProcess() const { return m_process && m_process->isValid(); }
 
+    template<typename U> bool sendToAllProcesses(const U& message);
+    template<typename U> bool sendToAllProcessesRelaunchingThemIfNecessary(const U& message);
+    
     void processDidFinishLaunching(WebProcessProxy*);
 
     // Disconnect the process from the context.
     void disconnectProcess(WebProcessProxy*);
 
-    WebPageProxy* createWebPage(PageClient*, WebPageGroup*);
+    PassRefPtr<WebPageProxy> createWebPage(PageClient*, WebPageGroup*);
 
-    void relaunchProcessIfNecessary();
+    WebProcessProxy* relaunchProcessIfNecessary();
 
     const String& injectedBundlePath() const { return m_injectedBundlePath; }
 
-    void download(WebPageProxy* initiatingPage, const WebCore::ResourceRequest&);
+    DownloadProxy* download(WebPageProxy* initiatingPage, const WebCore::ResourceRequest&);
 
     void setInjectedBundleInitializationUserData(PassRefPtr<APIObject> userData) { m_injectedBundleInitializationUserData = userData; }
     APIObject* injectedBundleInitializationUserData() const { return m_injectedBundleInitializationUserData.get(); }
@@ -120,8 +122,6 @@ public:
 
     void setCacheModel(CacheModel);
     CacheModel cacheModel() const { return m_cacheModel; }
-    void clearResourceCaches(ResourceCachesToClear);
-    void clearApplicationCache();
 
     void setDefaultRequestTimeoutInterval(double);
 
@@ -137,7 +137,7 @@ public:
     void setEnhancedAccessibility(bool);
     
     // Downloads.
-    uint64_t createDownloadProxy();
+    DownloadProxy* createDownloadProxy();
     WebDownloadClient& downloadClient() { return m_downloadClient; }
     void downloadFinished(DownloadProxy*);
 
@@ -168,6 +168,13 @@ public:
 
     bool shouldTerminate(WebProcessProxy*);
 
+    void disableProcessTermination() { m_processTerminationEnabled = false; }
+    void enableProcessTermination();
+
+    // Defaults to false.
+    void setHTTPPipeliningEnabled(bool);
+    bool httpPipeliningEnabled();
+
 private:
     WebContext(ProcessModel, const String& injectedBundlePath);
 
@@ -205,7 +212,7 @@ private:
 
     String localStorageDirectory() const;
     String platformDefaultLocalStorageDirectory() const;
-    
+
     ProcessModel m_processModel;
     
     // FIXME: In the future, this should be one or more WebProcessProxies.
@@ -234,9 +241,6 @@ private:
 
     WebDownloadClient m_downloadClient;
     HashMap<uint64_t, RefPtr<DownloadProxy> > m_downloads;
-
-    bool m_clearResourceCachesForNewWebProcess;
-    bool m_clearApplicationCacheForNewWebProcess;
     
     bool m_memorySamplerEnabled;
     double m_memorySamplerInterval;
@@ -263,8 +267,25 @@ private:
     String m_overrideDatabaseDirectory;
     String m_overrideIconDatabasePath;
     String m_overrideLocalStorageDirectory;
+
+    bool m_processTerminationEnabled;
 };
 
+template<typename U> inline bool WebContext::sendToAllProcesses(const U& message)
+{
+    if (!m_process || !m_process->canSendMessage())
+        return false;
+
+    return m_process->send(message, 0);
+}
+
+template<typename U> bool WebContext::sendToAllProcessesRelaunchingThemIfNecessary(const U& message)
+{
+    relaunchProcessIfNecessary();
+
+    return m_process->send(message, 0);
+}
+
 } // namespace WebKit
 
 #endif // WebContext_h
diff --git a/Source/WebKit2/UIProcess/WebCookieManagerProxy.cpp b/Source/WebKit2/UIProcess/WebCookieManagerProxy.cpp
index a30ab41..e7b4a6a 100644
--- a/Source/WebKit2/UIProcess/WebCookieManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebCookieManagerProxy.cpp
@@ -73,11 +73,11 @@ void WebCookieManagerProxy::getHostnamesWithCookies(PassRefPtr<ArrayCallback> pr
     ASSERT(m_webContext);
 
     RefPtr<ArrayCallback> callback = prpCallback;
-    m_webContext->relaunchProcessIfNecessary();
-    
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
-    m_webContext->process()->send(Messages::WebCookieManager::GetHostnamesWithCookies(callbackID), 0);
+
+    // FIXME (Multi-WebProcess): Cookies shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebCookieManager::GetHostnamesWithCookies(callbackID));
 }
     
 void WebCookieManagerProxy::didGetHostnamesWithCookies(const Vector<String>& hostnameList, uint64_t callbackID)
@@ -100,30 +100,25 @@ void WebCookieManagerProxy::didGetHostnamesWithCookies(const Vector<String>& hos
 void WebCookieManagerProxy::deleteCookiesForHostname(const String& hostname)
 {
     ASSERT(m_webContext);
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebCookieManager::DeleteCookiesForHostname(hostname), 0);
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebCookieManager::DeleteCookiesForHostname(hostname));
 }
 
 void WebCookieManagerProxy::deleteAllCookies()
 {
     ASSERT(m_webContext);
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebCookieManager::DeleteAllCookies(), 0);
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebCookieManager::DeleteAllCookies());
 }
 
 void WebCookieManagerProxy::startObservingCookieChanges()
 {
     ASSERT(m_webContext);
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebCookieManager::StartObservingCookieChanges(), 0);
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebCookieManager::StartObservingCookieChanges());
 }
 
 void WebCookieManagerProxy::stopObservingCookieChanges()
 {
     ASSERT(m_webContext);
-    if (!m_webContext->hasValidProcess())
-        return;
-    m_webContext->process()->send(Messages::WebCookieManager::StopObservingCookieChanges(), 0);
+    m_webContext->sendToAllProcesses(Messages::WebCookieManager::StopObservingCookieChanges());
 }
 
 void WebCookieManagerProxy::cookiesDidChange()
@@ -134,11 +129,11 @@ void WebCookieManagerProxy::cookiesDidChange()
 void WebCookieManagerProxy::setHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
 {
     ASSERT(m_webContext);
-    m_webContext->relaunchProcessIfNecessary();
 #if PLATFORM(MAC)
     persistHTTPCookieAcceptPolicy(policy);
 #endif
-    m_webContext->process()->send(Messages::WebCookieManager::SetHTTPCookieAcceptPolicy(policy), 0);
+
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebCookieManager::SetHTTPCookieAcceptPolicy(policy));
 }
 
 void WebCookieManagerProxy::getHTTPCookieAcceptPolicy(PassRefPtr<HTTPCookieAcceptPolicyCallback> prpCallback)
@@ -146,11 +141,12 @@ void WebCookieManagerProxy::getHTTPCookieAcceptPolicy(PassRefPtr<HTTPCookieAccep
     ASSERT(m_webContext);
 
     RefPtr<HTTPCookieAcceptPolicyCallback> callback = prpCallback;
-    m_webContext->relaunchProcessIfNecessary();
 
     uint64_t callbackID = callback->callbackID();
     m_httpCookieAcceptPolicyCallbacks.set(callbackID, callback.release());
-    m_webContext->process()->send(Messages::WebCookieManager::GetHTTPCookieAcceptPolicy(callbackID), 0);
+
+    // FIXME (Multi-WebProcess): Cookies shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebCookieManager::GetHTTPCookieAcceptPolicy(callbackID));
 }
 
 void WebCookieManagerProxy::didGetHTTPCookieAcceptPolicy(uint32_t policy, uint64_t callbackID)
diff --git a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
index 67323cd..26c518f 100644
--- a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
@@ -116,12 +116,12 @@ void WebDatabaseManagerProxy::initializeClient(const WKDatabaseManagerClient* cl
 void WebDatabaseManagerProxy::getDatabasesByOrigin(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    m_webContext->relaunchProcessIfNecessary();
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
-    m_webContext->process()->send(Messages::WebDatabaseManager::GetDatabasesByOrigin(callbackID), 0);
-}
 
+    // FIXME (Multi-WebProcess): Databases shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebDatabaseManager::GetDatabasesByOrigin(callbackID));
+}
 
 void WebDatabaseManagerProxy::didGetDatabasesByOrigin(const Vector<OriginAndDatabases>& originAndDatabasesVector, uint64_t callbackID)
 {
@@ -169,10 +169,11 @@ void WebDatabaseManagerProxy::didGetDatabasesByOrigin(const Vector<OriginAndData
 void WebDatabaseManagerProxy::getDatabaseOrigins(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    m_webContext->relaunchProcessIfNecessary();
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
-    m_webContext->process()->send(Messages::WebDatabaseManager::GetDatabaseOrigins(callbackID), 0);
+
+    // FIXME (Multi-WebProcess): Databases shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebDatabaseManager::GetDatabaseOrigins(callbackID));
 }
 
 void WebDatabaseManagerProxy::didGetDatabaseOrigins(const Vector<String>& originIdentifiers, uint64_t callbackID)
@@ -194,26 +195,26 @@ void WebDatabaseManagerProxy::didGetDatabaseOrigins(const Vector<String>& origin
 
 void WebDatabaseManagerProxy::deleteDatabaseWithNameForOrigin(const String& databaseIdentifier, WebSecurityOrigin* origin)
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebDatabaseManager::DeleteDatabaseWithNameForOrigin(databaseIdentifier, origin->databaseIdentifier()), 0);
+    // FIXME (Multi-WebProcess): Databases shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebDatabaseManager::DeleteDatabaseWithNameForOrigin(databaseIdentifier, origin->databaseIdentifier()));
 }
 
 void WebDatabaseManagerProxy::deleteDatabasesForOrigin(WebSecurityOrigin* origin)
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebDatabaseManager::DeleteDatabasesForOrigin(origin->databaseIdentifier()), 0);
+    // FIXME (Multi-WebProcess): Databases shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebDatabaseManager::DeleteDatabasesForOrigin(origin->databaseIdentifier()));
 }
 
 void WebDatabaseManagerProxy::deleteAllDatabases()
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebDatabaseManager::DeleteAllDatabases(), 0);
+    // FIXME (Multi-WebProcess): Databases shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebDatabaseManager::DeleteAllDatabases());
 }
 
 void WebDatabaseManagerProxy::setQuotaForOrigin(WebSecurityOrigin* origin, uint64_t quota)
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebDatabaseManager::SetQuotaForOrigin(origin->databaseIdentifier(), quota), 0);
+    // FIXME (Multi-WebProcess): Databases shouldn't be stored in the web process.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebDatabaseManager::SetQuotaForOrigin(origin->databaseIdentifier(), quota));
 }
 
 void WebDatabaseManagerProxy::didModifyOrigin(const String& originIdentifier)
diff --git a/Source/WebKit2/UIProcess/WebEditCommandProxy.cpp b/Source/WebKit2/UIProcess/WebEditCommandProxy.cpp
index b9599f3..25ffe23 100644
--- a/Source/WebKit2/UIProcess/WebEditCommandProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebEditCommandProxy.cpp
@@ -29,6 +29,8 @@
 #include "WebPageMessages.h"
 #include "WebPageProxy.h"
 #include "WebProcessProxy.h"
+#include <WebCore/LocalizedStrings.h>
+#include <wtf/text/WTFString.h>
 
 using namespace WebCore;
 
@@ -53,7 +55,7 @@ void WebEditCommandProxy::unapply()
     if (!m_page || !m_page->isValid())
         return;
 
-    m_page->process()->send(Messages::WebPage::UnapplyEditCommand(m_commandID), m_page->pageID());
+    m_page->process()->send(Messages::WebPage::UnapplyEditCommand(m_commandID), m_page->pageID(), CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply);
     m_page->registerEditCommand(this, WebPageProxy::Redo);
 }
 
@@ -62,8 +64,89 @@ void WebEditCommandProxy::reapply()
     if (!m_page || !m_page->isValid())
         return;
 
-    m_page->process()->send(Messages::WebPage::ReapplyEditCommand(m_commandID), m_page->pageID());
+    m_page->process()->send(Messages::WebPage::ReapplyEditCommand(m_commandID), m_page->pageID(), CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply);
     m_page->registerEditCommand(this, WebPageProxy::Undo);
 }
 
+String WebEditCommandProxy::nameForEditAction(EditAction editAction)
+{
+    switch (editAction) {
+    case EditActionUnspecified:
+        return String();
+    case EditActionSetColor:
+        return WEB_UI_STRING_KEY("Set Color", "Set Color (Undo action name)", "Undo action name");
+    case EditActionSetBackgroundColor:
+        return WEB_UI_STRING_KEY("Set Background Color", "Set Background Color (Undo action name)", "Undo action name");
+    case EditActionTurnOffKerning:
+        return WEB_UI_STRING_KEY("Turn Off Kerning", "Turn Off Kerning (Undo action name)", "Undo action name");
+    case EditActionTightenKerning:
+        return WEB_UI_STRING_KEY("Tighten Kerning", "Tighten Kerning (Undo action name)", "Undo action name");
+    case EditActionLoosenKerning:
+        return WEB_UI_STRING_KEY("Loosen Kerning", "Loosen Kerning (Undo action name)", "Undo action name");
+    case EditActionUseStandardKerning:
+        return WEB_UI_STRING_KEY("Use Standard Kerning", "Use Standard Kerning (Undo action name)", "Undo action name");
+    case EditActionTurnOffLigatures:
+        return WEB_UI_STRING_KEY("Turn Off Ligatures", "Turn Off Ligatures (Undo action name)", "Undo action name");
+    case EditActionUseStandardLigatures:
+        return WEB_UI_STRING_KEY("Use Standard Ligatures", "Use Standard Ligatures (Undo action name)", "Undo action name");
+    case EditActionUseAllLigatures:
+        return WEB_UI_STRING_KEY("Use All Ligatures", "Use All Ligatures (Undo action name)", "Undo action name");
+    case EditActionRaiseBaseline:
+        return WEB_UI_STRING_KEY("Raise Baseline", "Raise Baseline (Undo action name)", "Undo action name");
+    case EditActionLowerBaseline:
+        return WEB_UI_STRING_KEY("Lower Baseline", "Lower Baseline (Undo action name)", "Undo action name");
+    case EditActionSetTraditionalCharacterShape:
+        return WEB_UI_STRING_KEY("Set Traditional Character Shape", "Set Traditional Character Shape (Undo action name)", "Undo action name");
+    case EditActionSetFont:
+        return WEB_UI_STRING_KEY("Set Font", "Set Font (Undo action name)", "Undo action name");
+    case EditActionChangeAttributes:
+        return WEB_UI_STRING_KEY("Change Attributes", "Change Attributes (Undo action name)", "Undo action name");
+    case EditActionAlignLeft:
+        return WEB_UI_STRING_KEY("Align Left", "Align Left (Undo action name)", "Undo action name");
+    case EditActionAlignRight:
+        return WEB_UI_STRING_KEY("Align Right", "Align Right (Undo action name)", "Undo action name");
+    case EditActionCenter:
+        return WEB_UI_STRING_KEY("Center", "Center (Undo action name)", "Undo action name");
+    case EditActionJustify:
+        return WEB_UI_STRING_KEY("Justify", "Justify (Undo action name)", "Undo action name");
+    case EditActionSetWritingDirection:
+        return WEB_UI_STRING_KEY("Set Writing Direction", "Set Writing Direction (Undo action name)", "Undo action name");
+    case EditActionSubscript:
+        return WEB_UI_STRING_KEY("Subscript", "Subscript (Undo action name)", "Undo action name");
+    case EditActionSuperscript:
+        return WEB_UI_STRING_KEY("Superscript", "Superscript (Undo action name)", "Undo action name");
+    case EditActionUnderline:
+        return WEB_UI_STRING_KEY("Underline", "Underline (Undo action name)", "Undo action name");
+    case EditActionOutline:
+        return WEB_UI_STRING_KEY("Outline", "Outline (Undo action name)", "Undo action name");
+    case EditActionUnscript:
+        return WEB_UI_STRING_KEY("Unscript", "Unscript (Undo action name)", "Undo action name");
+    case EditActionDrag:
+        return WEB_UI_STRING_KEY("Drag", "Drag (Undo action name)", "Undo action name");
+    case EditActionCut:
+        return WEB_UI_STRING_KEY("Cut", "Cut (Undo action name)", "Undo action name");
+    case EditActionPaste:
+        return WEB_UI_STRING_KEY("Paste", "Paste (Undo action name)", "Undo action name");
+    case EditActionPasteFont:
+        return WEB_UI_STRING_KEY("Paste Font", "Paste Font (Undo action name)", "Undo action name");
+    case EditActionPasteRuler:
+        return WEB_UI_STRING_KEY("Paste Ruler", "Paste Ruler (Undo action name)", "Undo action name");
+    case EditActionTyping:
+        return WEB_UI_STRING_KEY("Typing", "Typing (Undo action name)", "Undo action name");
+    case EditActionCreateLink:
+        return WEB_UI_STRING_KEY("Create Link", "Create Link (Undo action name)", "Undo action name");
+    case EditActionUnlink:
+        return WEB_UI_STRING_KEY("Unlink", "Unlink (Undo action name)", "Undo action name");
+    case EditActionInsertList:
+        return WEB_UI_STRING_KEY("Insert List", "Insert List (Undo action name)", "Undo action name");
+    case EditActionFormatBlock:
+        return WEB_UI_STRING_KEY("Formatting", "Format Block (Undo action name)", "Undo action name");
+    case EditActionIndent:
+        return WEB_UI_STRING_KEY("Indent", "Indent (Undo action name)", "Undo action name");
+    case EditActionOutdent:
+        return WEB_UI_STRING_KEY("Outdent", "Outdent (Undo action name)", "Undo action name");
+    }
+    return String();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebEditCommandProxy.h b/Source/WebKit2/UIProcess/WebEditCommandProxy.h
index 4c08877..67d1430 100644
--- a/Source/WebKit2/UIProcess/WebEditCommandProxy.h
+++ b/Source/WebKit2/UIProcess/WebEditCommandProxy.h
@@ -28,6 +28,7 @@
 
 #include "APIObject.h"
 #include <WebCore/EditAction.h>
+#include <wtf/Forward.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -51,6 +52,8 @@ public:
     void unapply();
     void reapply();
 
+    static String nameForEditAction(WebCore::EditAction);
+
 private:
     WebEditCommandProxy(uint64_t commandID, WebCore::EditAction, WebPageProxy*);
 
diff --git a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp
index 91daf10..f25bb41 100644
--- a/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebFullScreenManagerProxy.cpp
@@ -31,7 +31,6 @@
 #include "WebContext.h"
 #include "WebFullScreenManagerMessages.h"
 #include "WebFullScreenManagerProxyMessages.h"
-#include "WebProcess.h"
 
 namespace WebKit {
 
diff --git a/Source/WebKit2/UIProcess/WebGeolocationManagerProxy.cpp b/Source/WebKit2/UIProcess/WebGeolocationManagerProxy.cpp
index eae4935..14ab88a 100644
--- a/Source/WebKit2/UIProcess/WebGeolocationManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebGeolocationManagerProxy.cpp
@@ -61,8 +61,7 @@ void WebGeolocationManagerProxy::providerDidChangePosition(WebGeolocationPositio
     if (!m_context)
         return;
 
-    // FIXME: Should this check for a valid process?
-    m_context->process()->send(Messages::WebGeolocationManager::DidChangePosition(position->data()), 0);
+    m_context->sendToAllProcesses(Messages::WebGeolocationManager::DidChangePosition(position->data()));
 }
 
 void WebGeolocationManagerProxy::providerDidFailToDeterminePosition()
@@ -70,8 +69,7 @@ void WebGeolocationManagerProxy::providerDidFailToDeterminePosition()
     if (!m_context)
         return;
 
-    // FIXME: Should this check for a valid process?
-    m_context->process()->send(Messages::WebGeolocationManager::DidFailToDeterminePosition(), 0);
+    m_context->sendToAllProcesses(Messages::WebGeolocationManager::DidFailToDeterminePosition());
 }
 
 void WebGeolocationManagerProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
diff --git a/Source/WebKit2/UIProcess/WebIconDatabase.cpp b/Source/WebKit2/UIProcess/WebIconDatabase.cpp
index c397a1d..aecc34d 100644
--- a/Source/WebKit2/UIProcess/WebIconDatabase.cpp
+++ b/Source/WebKit2/UIProcess/WebIconDatabase.cpp
@@ -100,14 +100,12 @@ void WebIconDatabase::enableDatabaseCleanup()
 
 void WebIconDatabase::retainIconForPageURL(const String& pageURL)
 {
-    LOG(IconDatabase, "WK2 UIProcess retaining icon for page URL %s", pageURL.ascii().data());
     if (m_iconDatabaseImpl)
         m_iconDatabaseImpl->retainIconForPageURL(pageURL);
 }
 
 void WebIconDatabase::releaseIconForPageURL(const String& pageURL)
 {
-    LOG(IconDatabase, "WK2 UIProcess releasing icon for page URL %s", pageURL.ascii().data());
     if (m_iconDatabaseImpl)
         m_iconDatabaseImpl->releaseIconForPageURL(pageURL);
 }
@@ -157,7 +155,8 @@ void WebIconDatabase::getLoadDecisionForIconURL(const String& iconURL, uint64_t
         return;
 
     if (!m_iconDatabaseImpl || !m_iconDatabaseImpl->isOpen() || iconURL.isEmpty()) {
-        m_webContext->process()->send(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision(static_cast<int>(IconLoadNo), callbackID), 0);
+        // FIXME (Multi-WebProcess): We need to know which connection to send this message to.
+        m_webContext->sendToAllProcesses(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision(static_cast<int>(IconLoadNo), callbackID));
         return;
     }
     
@@ -170,23 +169,40 @@ void WebIconDatabase::getLoadDecisionForIconURL(const String& iconURL, uint64_t
         m_pendingLoadDecisionURLMap.set(callbackID, iconURL);
         return;    
     }
-    
-    m_webContext->process()->send(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision((int)decision, callbackID), 0);
+
+    // FIXME (Multi-WebProcess): We need to know which connection to send this message to.
+    m_webContext->sendToAllProcesses(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision((int)decision, callbackID));
 }
 
 Image* WebIconDatabase::imageForPageURL(const String& pageURL)
 {
-    if (!m_webContext)
-        return 0;
-
-    if (!m_iconDatabaseImpl || !m_iconDatabaseImpl->isOpen() || pageURL.isEmpty())
-        return 0;
+    if (!m_webContext || !m_iconDatabaseImpl || !m_iconDatabaseImpl->isOpen() || pageURL.isEmpty())
+        return 0;    
 
     // The WebCore IconDatabase ignores the passed in size parameter.
     // If that changes we'll need to rethink how this API is exposed.
     return m_iconDatabaseImpl->synchronousIconForPageURL(pageURL, WebCore::IntSize(32, 32));
 }
 
+void WebIconDatabase::removeAllIcons()
+{
+    m_iconDatabaseImpl->removeAllIcons();   
+}
+
+void WebIconDatabase::checkIntegrityBeforeOpening()
+{
+    IconDatabase::checkIntegrityBeforeOpening();
+}
+
+void WebIconDatabase::close()
+{
+    m_iconDatabaseImpl->close();
+}
+
+void WebIconDatabase::initializeIconDatabaseClient(const WKIconDatabaseClient* client)
+{
+    m_iconDatabaseClient.initialize(client);
+}
 
 // WebCore::IconDatabaseClient
 bool WebIconDatabase::performImport()
@@ -195,24 +211,24 @@ bool WebIconDatabase::performImport()
     return true;
 }
 
-void WebIconDatabase::didImportIconURLForPageURL(const String&)
+void WebIconDatabase::didImportIconURLForPageURL(const String& pageURL)
 {
-    // Send a WK2 client notification out here.
+    didChangeIconForPageURL(pageURL);
 }
 
-void WebIconDatabase::didImportIconDataForPageURL(const String&)
+void WebIconDatabase::didImportIconDataForPageURL(const String& pageURL)
 {
-    // Send a WK2 client notification out here.
+    didChangeIconForPageURL(pageURL);
 }
 
-void WebIconDatabase::didChangeIconForPageURL(const String&)
+void WebIconDatabase::didChangeIconForPageURL(const String& pageURL)
 {
-    // Send a WK2 client notification out here.
+    m_iconDatabaseClient.didChangeIconForPageURL(this, WebURL::create(pageURL).get());
 }
 
 void WebIconDatabase::didRemoveAllIcons()
 {
-    // Send a WK2 client notification out here.
+    m_iconDatabaseClient.didRemoveAllIcons(this);
 }
 
 void WebIconDatabase::didFinishURLImport()
@@ -234,7 +250,8 @@ void WebIconDatabase::didFinishURLImport()
         // Decisions should never be unknown after the inital import is complete
         ASSERT(decision != IconLoadUnknown);
 
-        m_webContext->process()->send(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision(static_cast<int>(decision), i->first), 0);
+        // FIXME (Multi-WebProcess): We need to know which connection to send this message to.
+        m_webContext->sendToAllProcesses(Messages::WebIconDatabaseProxy::ReceivedIconLoadDecision(static_cast<int>(decision), i->first));
     }
     
     m_pendingLoadDecisionURLMap.clear();
diff --git a/Source/WebKit2/UIProcess/WebIconDatabase.h b/Source/WebKit2/UIProcess/WebIconDatabase.h
index 802f2aa..91372d6 100644
--- a/Source/WebKit2/UIProcess/WebIconDatabase.h
+++ b/Source/WebKit2/UIProcess/WebIconDatabase.h
@@ -29,6 +29,7 @@
 #include "APIObject.h"
 
 #include "Connection.h"
+#include "WebIconDatabaseClient.h"
 #include <WebCore/IconDatabaseClient.h>
 #include <wtf/Forward.h>
 #include <wtf/PassRefPtr.h>
@@ -77,6 +78,12 @@ public:
 
     WebCore::Image* imageForPageURL(const String&);
     
+    void removeAllIcons();
+    void checkIntegrityBeforeOpening();
+    void close();
+
+    void initializeIconDatabaseClient(const WKIconDatabaseClient*);
+
     // WebCore::IconDatabaseClient
     virtual bool performImport();
     virtual void didImportIconURLForPageURL(const String&);
@@ -103,6 +110,7 @@ private:
     bool m_databaseCleanupDisabled;
     HashMap<uint64_t, String> m_pendingLoadDecisionURLMap;
 
+    WebIconDatabaseClient m_iconDatabaseClient;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebIconDatabaseClient.cpp b/Source/WebKit2/UIProcess/WebIconDatabaseClient.cpp
new file mode 100644
index 0000000..e0de366
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebIconDatabaseClient.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebIconDatabaseClient.h"
+
+#include "WKAPICast.h"
+#include "WKSharedAPICast.h"
+
+namespace WebKit {
+
+void WebIconDatabaseClient::didChangeIconForPageURL(WebIconDatabase* iconDatabase, WebURL* url)
+{
+    if (!m_client.didChangeIconForPageURL)
+        return;
+    
+    m_client.didChangeIconForPageURL(toAPI(iconDatabase), toAPI(url), m_client.clientInfo);
+}
+
+void WebIconDatabaseClient::didRemoveAllIcons(WebIconDatabase* iconDatabase)
+{
+    if (!m_client.didRemoveAllIcons)
+        return;
+    
+    m_client.didRemoveAllIcons(toAPI(iconDatabase),  m_client.clientInfo);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebIconDatabaseClient.h b/Source/WebKit2/UIProcess/WebIconDatabaseClient.h
new file mode 100644
index 0000000..2311493
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebIconDatabaseClient.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebIconDatabaseClient_h
+#define WebIconDatabaseClient_h
+
+#include "APIClient.h"
+#include "WKIconDatabase.h"
+
+namespace WebKit {
+
+class APIObject;
+class WebIconDatabase;
+class WebURL;
+
+class WebIconDatabaseClient : public APIClient<WKIconDatabaseClient> {
+public:
+    void didChangeIconForPageURL(WebIconDatabase*, WebURL*);
+    void didRemoveAllIcons(WebIconDatabase*);
+};
+
+} // namespace WebKit
+
+#endif // WebIconDatabaseClient_h
diff --git a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
index b971315..694e76a 100644
--- a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
@@ -46,7 +46,7 @@ namespace WebKit {
 
 WebPageGroup* WebInspectorProxy::inspectorPageGroup()
 {
-    static WebPageGroup* pageGroup = WebPageGroup::create("__WebInspectorPageGroup__", false).leakRef();
+    static WebPageGroup* pageGroup = WebPageGroup::create("__WebInspectorPageGroup__", false, false).leakRef();
     return pageGroup;
 }
 
diff --git a/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp b/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp
index 1de1532..93b6fb9 100644
--- a/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp
@@ -65,11 +65,11 @@ void WebKeyValueStorageManagerProxy::didReceiveMessage(CoreIPC::Connection* conn
 void WebKeyValueStorageManagerProxy::getKeyValueStorageOrigins(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    m_webContext->relaunchProcessIfNecessary();
-    
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
-    m_webContext->process()->send(Messages::WebKeyValueStorageManager::GetKeyValueStorageOrigins(callbackID), 0);
+
+    // FIXME (Multi-WebProcess): Should key-value storage be handled in the web process?
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebKeyValueStorageManager::GetKeyValueStorageOrigins(callbackID));
 }
     
 void WebKeyValueStorageManagerProxy::didGetKeyValueStorageOrigins(const Vector<SecurityOriginData>& originDatas, uint64_t callbackID)
@@ -80,20 +80,19 @@ void WebKeyValueStorageManagerProxy::didGetKeyValueStorageOrigins(const Vector<S
 
 void WebKeyValueStorageManagerProxy::deleteEntriesForOrigin(WebSecurityOrigin* origin)
 {
-    m_webContext->relaunchProcessIfNecessary();
-    
     SecurityOriginData securityOriginData;
     securityOriginData.protocol = origin->protocol();
     securityOriginData.host = origin->host();
     securityOriginData.port = origin->port();
 
-    m_webContext->process()->send(Messages::WebKeyValueStorageManager::DeleteEntriesForOrigin(securityOriginData), 0);
+    // FIXME (Multi-WebProcess): Should key-value storage be handled in the web process?
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebKeyValueStorageManager::DeleteEntriesForOrigin(securityOriginData));
 }
 
 void WebKeyValueStorageManagerProxy::deleteAllEntries()
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebKeyValueStorageManager::DeleteAllEntries(), 0);
+    // FIXME (Multi-WebProcess): Should key-value storage be handled in the web process?
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebKeyValueStorageManager::DeleteAllEntries());
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp b/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp
index c8a7f51..3b034d8 100644
--- a/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp
@@ -64,11 +64,12 @@ void WebMediaCacheManagerProxy::didReceiveMessage(CoreIPC::Connection* connectio
 void WebMediaCacheManagerProxy::getHostnamesWithMediaCache(PassRefPtr<ArrayCallback> prpCallback)
 {
     RefPtr<ArrayCallback> callback = prpCallback;
-    m_webContext->relaunchProcessIfNecessary();
-    
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
-    m_webContext->process()->send(Messages::WebMediaCacheManager::GetHostnamesWithMediaCache(callbackID), 0);
+
+    // FIXME (Multi-WebProcess): When we're sending this to multiple processes, we need to aggregate the
+    // callback data when it comes back.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebMediaCacheManager::GetHostnamesWithMediaCache(callbackID));
 }
     
 void WebMediaCacheManagerProxy::didGetHostnamesWithMediaCache(const Vector<String>& hostnameList, uint64_t callbackID)
@@ -90,14 +91,12 @@ void WebMediaCacheManagerProxy::didGetHostnamesWithMediaCache(const Vector<Strin
 
 void WebMediaCacheManagerProxy::clearCacheForHostname(const String& hostname)
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebMediaCacheManager::ClearCacheForHostname(hostname), 0);
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebMediaCacheManager::ClearCacheForHostname(hostname));
 }
 
 void WebMediaCacheManagerProxy::clearCacheForAllHostnames()
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebMediaCacheManager::ClearCacheForAllHostnames(), 0);
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebMediaCacheManager::ClearCacheForAllHostnames());
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebPageGroup.cpp b/Source/WebKit2/UIProcess/WebPageGroup.cpp
index f64dd2c..72588d4 100644
--- a/Source/WebKit2/UIProcess/WebPageGroup.cpp
+++ b/Source/WebKit2/UIProcess/WebPageGroup.cpp
@@ -47,9 +47,9 @@ static WebPageGroupMap& webPageGroupMap()
     return map;
 }
 
-PassRefPtr<WebPageGroup> WebPageGroup::create(const String& identifier, bool visibleToInjectedBundle)
+PassRefPtr<WebPageGroup> WebPageGroup::create(const String& identifier, bool visibleToInjectedBundle, bool visibleToHistoryClient)
 {
-    RefPtr<WebPageGroup> pageGroup = adoptRef(new WebPageGroup(identifier, visibleToInjectedBundle));
+    RefPtr<WebPageGroup> pageGroup = adoptRef(new WebPageGroup(identifier, visibleToInjectedBundle, visibleToHistoryClient));
 
     webPageGroupMap().set(pageGroup->pageGroupID(), pageGroup.get());
 
@@ -61,25 +61,23 @@ WebPageGroup* WebPageGroup::get(uint64_t pageGroupID)
     return webPageGroupMap().get(pageGroupID);
 }
 
-WebPageGroup::WebPageGroup(const String& identifier, bool visibleToInjectedBundle)
+WebPageGroup::WebPageGroup(const String& identifier, bool visibleToInjectedBundle, bool visibleToHistoryClient)
 {
     m_data.pageGroupID = generatePageGroupID();
 
-    if (!identifier.isNull()) {
+    if (!identifier.isNull())
         m_data.identifer = identifier;
-        m_preferences = WebPreferences::create(identifier);
-    } else {
+    else
         m_data.identifer = m_data.identifer = makeString("__uniquePageGroupID-", String::number(m_data.pageGroupID));
-        m_preferences = WebPreferences::create();
-    }
-    m_preferences->addPageGroup(this);
 
-    m_data.visibleToInjectedBundle = visibleToInjectedBundle;    
+    m_data.visibleToInjectedBundle = visibleToInjectedBundle;
+    m_data.visibleToHistoryClient = visibleToHistoryClient;
 }
 
 WebPageGroup::~WebPageGroup()
 {
-    m_preferences->removePageGroup(this);
+    if (m_preferences)
+        m_preferences->removePageGroup(this);
     webPageGroupMap().remove(pageGroupID());
 }
 
@@ -98,15 +96,27 @@ void WebPageGroup::setPreferences(WebPreferences* preferences)
     if (preferences == m_preferences)
         return;
 
-    m_preferences->removePageGroup(this);
-    m_preferences = preferences;
-    m_preferences->addPageGroup(this);
+    if (!m_preferences) {
+        m_preferences = preferences;
+        m_preferences->addPageGroup(this);
+    } else {
+        m_preferences->removePageGroup(this);
+        m_preferences = preferences;
+        m_preferences->addPageGroup(this);
 
-    preferencesDidChange();
+        preferencesDidChange();
+    }
 }
 
 WebPreferences* WebPageGroup::preferences() const
 {
+    if (!m_preferences) {
+        if (!m_data.identifer.isNull())
+            m_preferences = WebPreferences::create(m_data.identifer);
+        else
+            m_preferences = WebPreferences::create();
+        m_preferences->addPageGroup(const_cast<WebPageGroup*>(this));
+    }
     return m_preferences.get();
 }
 
diff --git a/Source/WebKit2/UIProcess/WebPageGroup.h b/Source/WebKit2/UIProcess/WebPageGroup.h
index 7859dfc..ccc14bd 100644
--- a/Source/WebKit2/UIProcess/WebPageGroup.h
+++ b/Source/WebKit2/UIProcess/WebPageGroup.h
@@ -40,7 +40,7 @@ class WebPageGroup : public APIObject {
 public:
     static const Type APIType = TypePageGroup;
 
-    static PassRefPtr<WebPageGroup> create(const String& identifier = String(), bool visibleToInjectedBundle = true);
+    static PassRefPtr<WebPageGroup> create(const String& identifier = String(), bool visibleToInjectedBundle = true, bool visibleToHistoryClient = true);
     static WebPageGroup* get(uint64_t pageGroupID);
 
     virtual ~WebPageGroup();
@@ -58,12 +58,12 @@ public:
     void preferencesDidChange();
 
 private:
-    WebPageGroup(const String& identifier, bool visibleToInjectedBundle);
+    WebPageGroup(const String& identifier, bool visibleToInjectedBundle, bool visibleToHistoryClient);
 
     virtual Type type() const { return APIType; }
 
     WebPageGroupData m_data;
-    RefPtr<WebPreferences> m_preferences;
+    mutable RefPtr<WebPreferences> m_preferences;
     HashSet<WebPageProxy*> m_pages;
 };
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index ce3af46..aabb304 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -29,10 +29,12 @@
 #include "AuthenticationChallengeProxy.h"
 #include "AuthenticationDecisionListener.h"
 #include "DataReference.h"
+#include "DownloadProxy.h"
 #include "DrawingAreaProxy.h"
 #include "FindIndicator.h"
 #include "MessageID.h"
 #include "NativeWebKeyboardEvent.h"
+#include "NativeWebMouseEvent.h"
 #include "PageClient.h"
 #include "PrintInfo.h"
 #include "SessionState.h"
@@ -69,6 +71,7 @@
 #include "WebURLRequest.h"
 #include <WebCore/DragData.h>
 #include <WebCore/FloatRect.h>
+#include <WebCore/FocusDirection.h>
 #include <WebCore/MIMETypeRegistry.h>
 #include <WebCore/WindowFeatures.h>
 #include <stdio.h>
@@ -100,14 +103,14 @@ WKPageDebugPaintFlags WebPageProxy::s_debugPaintFlags = 0;
 static WTF::RefCountedLeakCounter webPageProxyCounter("WebPageProxy");
 #endif
 
-PassRefPtr<WebPageProxy> WebPageProxy::create(PageClient* pageClient, WebContext* context, WebPageGroup* pageGroup, uint64_t pageID)
+PassRefPtr<WebPageProxy> WebPageProxy::create(PageClient* pageClient, PassRefPtr<WebProcessProxy> process, WebPageGroup* pageGroup, uint64_t pageID)
 {
-    return adoptRef(new WebPageProxy(pageClient, context, pageGroup, pageID));
+    return adoptRef(new WebPageProxy(pageClient, process, pageGroup, pageID));
 }
 
-WebPageProxy::WebPageProxy(PageClient* pageClient, WebContext* context, WebPageGroup* pageGroup, uint64_t pageID)
+WebPageProxy::WebPageProxy(PageClient* pageClient, PassRefPtr<WebProcessProxy> process, WebPageGroup* pageGroup, uint64_t pageID)
     : m_pageClient(pageClient)
-    , m_context(context)
+    , m_process(process)
     , m_pageGroup(pageGroup)
     , m_mainFrame(0)
     , m_userAgent(standardUserAgent())
@@ -162,6 +165,9 @@ WebPageProxy::WebPageProxy(PageClient* pageClient, WebContext* context, WebPageG
 
 WebPageProxy::~WebPageProxy()
 {
+    if (!m_isClosed)
+        close();
+
     WebContext::statistics().wkPageCount--;
 
     if (m_hasSpellDocumentTag)
@@ -176,7 +182,7 @@ WebPageProxy::~WebPageProxy()
 
 WebProcessProxy* WebPageProxy::process() const
 {
-    return m_context->process();
+    return m_process.get();
 }
 
 bool WebPageProxy::isValid()
@@ -239,9 +245,11 @@ void WebPageProxy::initializeContextMenuClient(const WKPageContextMenuClient* cl
 
 void WebPageProxy::reattachToWebProcess()
 {
+    ASSERT(!isValid());
+
     m_isValid = true;
 
-    context()->relaunchProcessIfNecessary();
+    m_process = m_process->context()->relaunchProcessIfNecessary();
     process()->addExistingWebPage(this, m_pageID);
 
     initializeWebPage();
@@ -524,7 +532,7 @@ bool WebPageProxy::canShowMIMEType(const String& mimeType) const
         return !MIMETypeRegistry::isUnsupportedTextMIMEType(mimeType);
 
     String newMimeType = mimeType;
-    PluginInfoStore::Plugin plugin = context()->pluginInfoStore()->findPlugin(newMimeType, KURL());
+    PluginInfoStore::Plugin plugin = m_process->context()->pluginInfoStore()->findPlugin(newMimeType, KURL());
     if (!plugin.path.isNull())
         return true;
 
@@ -609,6 +617,9 @@ void WebPageProxy::viewStateDidChange(ViewStateFlags flags)
             process()->send(Messages::WebPage::SetIsInWindow(isInWindow), m_pageID);
         }
     }
+
+    if (flags & (ViewWindowIsActive | ViewIsVisible))
+        m_drawingArea->setBackingStoreIsDiscardable(!m_pageClient->isViewWindowActive() || !isViewVisible());
 }
 
 IntSize WebPageProxy::viewSize() const
@@ -664,6 +675,28 @@ String WebPageProxy::getSelectedText()
     process()->sendSync(Messages::WebPage::GetSelectedText(), Messages::WebPage::GetSelectedText::Reply(text), m_pageID);
     return text;
 }
+
+bool WebPageProxy::gestureWillBegin(const IntPoint& point)
+{
+    bool canBeginPanning = false;
+    process()->sendSync(Messages::WebPage::GestureWillBegin(point), Messages::WebPage::GestureWillBegin::Reply(canBeginPanning), m_pageID);
+    return canBeginPanning;
+}
+
+void WebPageProxy::gestureDidScroll(const IntSize& size)
+{
+    process()->send(Messages::WebPage::GestureDidScroll(size), m_pageID);
+}
+
+void WebPageProxy::gestureDidEnd()
+{
+    process()->send(Messages::WebPage::GestureDidEnd(), m_pageID);
+}
+
+void WebPageProxy::setGestureReachedScrollingLimit(bool limitReached)
+{
+    m_pageClient->setGestureReachedScrollingLimit(limitReached);
+}
 #endif
 
 #if ENABLE(TILED_BACKING_STORE)
@@ -676,7 +709,30 @@ void WebPageProxy::setActualVisibleContentRect(const IntRect& rect)
 }
 #endif
 
-void WebPageProxy::performDragControllerAction(DragControllerAction action, WebCore::DragData* dragData, const String& dragStorageName)
+void WebPageProxy::dragEntered(WebCore::DragData* dragData, const String& dragStorageName)
+{
+    SandboxExtension::Handle sandboxExtensionHandle;
+    performDragControllerAction(DragControllerActionEntered, dragData, dragStorageName, sandboxExtensionHandle);
+}
+
+void WebPageProxy::dragUpdated(WebCore::DragData* dragData, const String& dragStorageName)
+{
+    SandboxExtension::Handle sandboxExtensionHandle;
+    performDragControllerAction(DragControllerActionUpdated, dragData, dragStorageName, sandboxExtensionHandle);
+}
+
+void WebPageProxy::dragExited(WebCore::DragData* dragData, const String& dragStorageName)
+{
+    SandboxExtension::Handle sandboxExtensionHandle;
+    performDragControllerAction(DragControllerActionExited, dragData, dragStorageName, sandboxExtensionHandle);
+}
+
+void WebPageProxy::performDrag(WebCore::DragData* dragData, const String& dragStorageName, const SandboxExtension::Handle& sandboxExtensionHandle)
+{
+    performDragControllerAction(DragControllerActionPerformDrag, dragData, dragStorageName, sandboxExtensionHandle);
+}
+
+void WebPageProxy::performDragControllerAction(DragControllerAction action, WebCore::DragData* dragData, const String& dragStorageName, const SandboxExtension::Handle& sandboxExtensionHandle)
 {
     if (!isValid())
         return;
@@ -685,7 +741,7 @@ void WebPageProxy::performDragControllerAction(DragControllerAction action, WebC
     process()->send(Messages::WebPage::PerformDragControllerAction(action, dragData->clientPosition(), dragData->globalPosition(),
         dragData->draggingSourceOperationMask(), dragData->dragDataMap(), dragData->flags()), m_pageID);
 #else
-    process()->send(Messages::WebPage::PerformDragControllerAction(action, dragData->clientPosition(), dragData->globalPosition(), dragData->draggingSourceOperationMask(), dragStorageName, dragData->flags()), m_pageID);
+    process()->send(Messages::WebPage::PerformDragControllerAction(action, dragData->clientPosition(), dragData->globalPosition(), dragData->draggingSourceOperationMask(), dragStorageName, dragData->flags(), sandboxExtensionHandle), m_pageID);
 #endif
 }
 
@@ -758,7 +814,7 @@ void WebPageProxy::dragEnded(const WebCore::IntPoint& clientPosition, const WebC
     process()->send(Messages::WebPage::DragEnded(clientPosition, globalPosition, operation), m_pageID);
 }
 
-void WebPageProxy::handleMouseEvent(const WebMouseEvent& event)
+void WebPageProxy::handleMouseEvent(const NativeWebMouseEvent& event)
 {
     if (!isValid())
         return;
@@ -768,13 +824,20 @@ void WebPageProxy::handleMouseEvent(const WebMouseEvent& event)
         process()->responsivenessTimer()->start();
     else {
         if (m_processingMouseMoveEvent) {
-            m_nextMouseMoveEvent = adoptPtr(new WebMouseEvent(event));
+            m_nextMouseMoveEvent = adoptPtr(new NativeWebMouseEvent(event));
             return;
         }
 
         m_processingMouseMoveEvent = true;
     }
 
+    // <https://bugs.webkit.org/show_bug.cgi?id=57904> We need to keep track of the mouse down event in the case where we
+    // display a popup menu for select elements. When the user changes the selected item,
+    // we fake a mouse up event by using this stored down event. This event gets cleared
+    // when the mouse up message is received from WebProcess.
+    if (event.type() == WebEvent::MouseDown)
+        m_currentlyProcessedMouseDownEvent = adoptPtr(new NativeWebMouseEvent(event));
+
     process()->send(Messages::WebPage::MouseEvent(event), m_pageID);
 }
 
@@ -860,7 +923,7 @@ void WebPageProxy::receivedPolicyDecision(PolicyAction action, WebFrameProxy* fr
     uint64_t downloadID = 0;
     if (action == PolicyDownload) {
         // Create a download proxy.
-        downloadID = context()->createDownloadProxy();
+        downloadID = m_process->context()->createDownloadProxy()->downloadID();
     }
 
     // If we received a policy decision while in decidePolicyForMIMEType the decision will 
@@ -1077,6 +1140,9 @@ void WebPageProxy::viewScaleFactorDidChange(double scaleFactor)
 
 void WebPageProxy::setMemoryCacheClientCallsEnabled(bool memoryCacheClientCallsEnabled)
 {
+    if (!isValid())
+        return;
+
     if (m_areMemoryCacheClientCallsEnabled == memoryCacheClientCallsEnabled)
         return;
 
@@ -1086,7 +1152,10 @@ void WebPageProxy::setMemoryCacheClientCallsEnabled(bool memoryCacheClientCallsE
 
 void WebPageProxy::findString(const String& string, FindOptions options, unsigned maxMatchCount)
 {
-    process()->send(Messages::WebPage::FindString(string, options, maxMatchCount), m_pageID);
+    if (m_mainFrameHasCustomRepresentation)
+        m_pageClient->findStringInCustomRepresentation(string, options, maxMatchCount);
+    else
+        process()->send(Messages::WebPage::FindString(string, options, maxMatchCount), m_pageID);
 }
 
 void WebPageProxy::hideFindUI()
@@ -1096,12 +1165,25 @@ void WebPageProxy::hideFindUI()
 
 void WebPageProxy::countStringMatches(const String& string, FindOptions options, unsigned maxMatchCount)
 {
+    if (m_mainFrameHasCustomRepresentation) {
+        m_pageClient->countStringMatchesInCustomRepresentation(string, options, maxMatchCount);
+        return;
+    }
+
+    if (!isValid())
+        return;
+
     process()->send(Messages::WebPage::CountStringMatches(string, options, maxMatchCount), m_pageID);
 }
 
 void WebPageProxy::runJavaScriptInMainFrame(const String& script, PassRefPtr<ScriptValueCallback> prpCallback)
 {
     RefPtr<ScriptValueCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+
     uint64_t callbackID = callback->callbackID();
     m_scriptValueCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::RunJavaScriptInMainFrame(script, callbackID), m_pageID);
@@ -1110,6 +1192,11 @@ void WebPageProxy::runJavaScriptInMainFrame(const String& script, PassRefPtr<Scr
 void WebPageProxy::getRenderTreeExternalRepresentation(PassRefPtr<StringCallback> prpCallback)
 {
     RefPtr<StringCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_stringCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::GetRenderTreeExternalRepresentation(callbackID), m_pageID);
@@ -1118,6 +1205,11 @@ void WebPageProxy::getRenderTreeExternalRepresentation(PassRefPtr<StringCallback
 void WebPageProxy::getSourceForFrame(WebFrameProxy* frame, PassRefPtr<StringCallback> prpCallback)
 {
     RefPtr<StringCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_loadDependentStringCallbackIDs.add(callbackID);
     m_stringCallbacks.set(callbackID, callback.get());
@@ -1127,6 +1219,11 @@ void WebPageProxy::getSourceForFrame(WebFrameProxy* frame, PassRefPtr<StringCall
 void WebPageProxy::getContentsAsString(PassRefPtr<StringCallback> prpCallback)
 {
     RefPtr<StringCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_loadDependentStringCallbackIDs.add(callbackID);
     m_stringCallbacks.set(callbackID, callback.get());
@@ -1136,6 +1233,11 @@ void WebPageProxy::getContentsAsString(PassRefPtr<StringCallback> prpCallback)
 void WebPageProxy::getSelectionOrContentsAsString(PassRefPtr<StringCallback> prpCallback)
 {
     RefPtr<StringCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_stringCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::GetSelectionOrContentsAsString(callbackID), m_pageID);
@@ -1144,6 +1246,11 @@ void WebPageProxy::getSelectionOrContentsAsString(PassRefPtr<StringCallback> prp
 void WebPageProxy::getMainResourceDataOfFrame(WebFrameProxy* frame, PassRefPtr<DataCallback> prpCallback)
 {
     RefPtr<DataCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_dataCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::GetMainResourceDataOfFrame(frame->frameID(), callbackID), m_pageID);
@@ -1152,6 +1259,11 @@ void WebPageProxy::getMainResourceDataOfFrame(WebFrameProxy* frame, PassRefPtr<D
 void WebPageProxy::getResourceDataFromFrame(WebFrameProxy* frame, WebURL* resourceURL, PassRefPtr<DataCallback> prpCallback)
 {
     RefPtr<DataCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_dataCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::GetResourceDataFromFrame(frame->frameID(), resourceURL->string(), callbackID), m_pageID);
@@ -1160,6 +1272,11 @@ void WebPageProxy::getResourceDataFromFrame(WebFrameProxy* frame, WebURL* resour
 void WebPageProxy::getWebArchiveOfFrame(WebFrameProxy* frame, PassRefPtr<DataCallback> prpCallback)
 {
     RefPtr<DataCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_dataCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::GetWebArchiveOfFrame(frame->frameID(), callbackID), m_pageID);
@@ -1168,7 +1285,6 @@ void WebPageProxy::getWebArchiveOfFrame(WebFrameProxy* frame, PassRefPtr<DataCal
 void WebPageProxy::forceRepaint(PassRefPtr<VoidCallback> prpCallback)
 {
     RefPtr<VoidCallback> callback = prpCallback;
-
     if (!isValid()) {
         callback->invalidate();
         return;
@@ -1358,7 +1474,7 @@ void WebPageProxy::didStartProvisionalLoadForFrame(uint64_t frameID, const Strin
     clearPendingAPIRequestURL();
 
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1374,7 +1490,7 @@ void WebPageProxy::didStartProvisionalLoadForFrame(uint64_t frameID, const Strin
 void WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame(uint64_t frameID, const String& url, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1389,7 +1505,7 @@ void WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame(uint64_t f
 void WebPageProxy::didFailProvisionalLoadForFrame(uint64_t frameID, const ResourceError& error, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1417,12 +1533,13 @@ void WebPageProxy::clearLoadDependentCallbacks()
 void WebPageProxy::didCommitLoadForFrame(uint64_t frameID, const String& mimeType, bool frameHasCustomRepresentation, const PlatformCertificateInfo& certificateInfo, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
 #if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
+    m_pageClient->dismissDictionaryLookupPanel();
 #endif
 
     WebFrameProxy* frame = process()->webFrame(frameID);
@@ -1443,7 +1560,7 @@ void WebPageProxy::didCommitLoadForFrame(uint64_t frameID, const String& mimeTyp
 void WebPageProxy::didFinishDocumentLoadForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1456,7 +1573,7 @@ void WebPageProxy::didFinishDocumentLoadForFrame(uint64_t frameID, CoreIPC::Argu
 void WebPageProxy::didFinishLoadForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1471,7 +1588,7 @@ void WebPageProxy::didFinishLoadForFrame(uint64_t frameID, CoreIPC::ArgumentDeco
 void WebPageProxy::didFailLoadForFrame(uint64_t frameID, const ResourceError& error, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1488,7 +1605,7 @@ void WebPageProxy::didFailLoadForFrame(uint64_t frameID, const ResourceError& er
 void WebPageProxy::didSameDocumentNavigationForFrame(uint64_t frameID, uint32_t opaqueSameDocumentNavigationType, const String& url, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1503,7 +1620,7 @@ void WebPageProxy::didSameDocumentNavigationForFrame(uint64_t frameID, uint32_t
 void WebPageProxy::didReceiveTitleForFrame(uint64_t frameID, const String& title, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1518,7 +1635,7 @@ void WebPageProxy::didReceiveTitleForFrame(uint64_t frameID, const String& title
 void WebPageProxy::didFirstLayoutForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1531,7 +1648,7 @@ void WebPageProxy::didFirstLayoutForFrame(uint64_t frameID, CoreIPC::ArgumentDec
 void WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1544,7 +1661,7 @@ void WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame(uint64_t frameID, Core
 void WebPageProxy::didRemoveFrameFromHierarchy(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1559,7 +1676,7 @@ void WebPageProxy::didRemoveFrameFromHierarchy(uint64_t frameID, CoreIPC::Argume
 void WebPageProxy::didDisplayInsecureContentForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1572,7 +1689,7 @@ void WebPageProxy::didDisplayInsecureContentForFrame(uint64_t frameID, CoreIPC::
 void WebPageProxy::didRunInsecureContentForFrame(uint64_t frameID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1596,7 +1713,7 @@ void WebPageProxy::frameDidBecomeFrameSet(uint64_t frameID, bool value)
 void WebPageProxy::decidePolicyForNavigationAction(uint64_t frameID, uint32_t opaqueNavigationType, uint32_t opaqueModifiers, int32_t opaqueMouseButton, const ResourceRequest& request, uint64_t listenerID, CoreIPC::ArgumentDecoder* arguments, bool& receivedPolicyAction, uint64_t& policyAction, uint64_t& downloadID)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1633,7 +1750,7 @@ void WebPageProxy::decidePolicyForNavigationAction(uint64_t frameID, uint32_t op
 void WebPageProxy::decidePolicyForNewWindowAction(uint64_t frameID, uint32_t opaqueNavigationType, uint32_t opaqueModifiers, int32_t opaqueMouseButton, const ResourceRequest& request, const String& frameName, uint64_t listenerID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1652,7 +1769,7 @@ void WebPageProxy::decidePolicyForNewWindowAction(uint64_t frameID, uint32_t opa
 void WebPageProxy::decidePolicyForResponse(uint64_t frameID, const ResourceResponse& response, const ResourceRequest& request, uint64_t listenerID, CoreIPC::ArgumentDecoder* arguments, bool& receivedPolicyAction, uint64_t& policyAction, uint64_t& downloadID)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1682,7 +1799,7 @@ void WebPageProxy::decidePolicyForResponse(uint64_t frameID, const ResourceRespo
 void WebPageProxy::unableToImplementPolicy(uint64_t frameID, const WebCore::ResourceError& error, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
     
@@ -1697,7 +1814,7 @@ void WebPageProxy::unableToImplementPolicy(uint64_t frameID, const WebCore::Reso
 void WebPageProxy::willSubmitForm(uint64_t frameID, uint64_t sourceFrameID, const StringPairVector& textFieldValues, uint64_t listenerID, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -1825,7 +1942,7 @@ void WebPageProxy::setStatusText(const String& text)
 void WebPageProxy::mouseDidMoveOverElement(uint32_t opaqueModifiers, CoreIPC::ArgumentDecoder* arguments)
 {
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2025,9 +2142,22 @@ void WebPageProxy::backForwardForwardListCount(int32_t& count)
     count = m_backForwardList->forwardListCount();
 }
 
-void WebPageProxy::selectionStateChanged(const SelectionState& selectionState)
+void WebPageProxy::editorStateChanged(const EditorState& editorState)
 {
-    m_selectionState = selectionState;
+#if PLATFORM(MAC)
+    bool couldChangeSecureInputState = m_editorState.isInPasswordField != editorState.isInPasswordField || m_editorState.selectionIsNone;
+#endif
+
+    m_editorState = editorState;
+
+#if PLATFORM(MAC)
+    // This is a temporary state. Flipping secure input state too quickly can expose race conditions.
+    if (editorState.selectionIsNone)
+        return;
+
+    if (couldChangeSecureInputState)
+        m_pageClient->updateSecureInputState();
+#endif
 }
 
 #if PLATFORM(WIN)
@@ -2054,6 +2184,17 @@ void WebPageProxy::registerEditCommandForUndo(uint64_t commandID, uint32_t editA
     registerEditCommand(WebEditCommandProxy::create(commandID, static_cast<EditAction>(editAction), this), Undo);
 }
 
+void WebPageProxy::canUndoRedo(uint32_t action, bool& result)
+{
+    result = m_pageClient->canUndoRedo(static_cast<UndoOrRedo>(action));
+}
+
+void WebPageProxy::executeUndoRedo(uint32_t action, bool& result)
+{
+    m_pageClient->executeUndoRedo(static_cast<UndoOrRedo>(action));
+    result = true;
+}
+
 void WebPageProxy::clearAllEditCommands()
 {
     m_pageClient->clearAllEditCommands();
@@ -2090,6 +2231,11 @@ void WebPageProxy::setTextFromItemForPopupMenu(WebPopupMenuProxy*, int32_t index
     process()->send(Messages::WebPage::SetTextForActivePopupMenu(index), m_pageID);
 }
 
+NativeWebMouseEvent* WebPageProxy::currentlyProcessedMouseDownEvent()
+{
+    return m_currentlyProcessedMouseDownEvent.get();
+}
+
 void WebPageProxy::showPopupMenu(const IntRect& rect, uint64_t textDirection, const Vector<WebPopupItem>& items, int32_t selectedIndex, const PlatformPopupMenuData& data)
 {
     if (m_activePopupMenu) {
@@ -2122,8 +2268,16 @@ void WebPageProxy::hidePopupMenu()
 
 void WebPageProxy::showContextMenu(const IntPoint& menuLocation, const ContextMenuState& contextMenuState, const Vector<WebContextMenuItemData>& proposedItems, CoreIPC::ArgumentDecoder* arguments)
 {
+    internalShowContextMenu(menuLocation, contextMenuState, proposedItems, arguments);
+    
+    // No matter the result of internalShowContextMenu, always notify the WebProcess that the menu is hidden so it starts handling mouse events again.
+    process()->send(Messages::WebPage::ContextMenuHidden(), m_pageID);
+}
+
+void WebPageProxy::internalShowContextMenu(const IntPoint& menuLocation, const ContextMenuState& contextMenuState, const Vector<WebContextMenuItemData>& proposedItems, CoreIPC::ArgumentDecoder* arguments)
+{
     RefPtr<APIObject> userData;
-    WebContextUserMessageDecoder messageDecoder(userData, context());
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
     if (!arguments->decode(messageDecoder))
         return;
 
@@ -2185,13 +2339,17 @@ void WebPageProxy::contextMenuItemSelected(const WebContextMenuItemData& item)
         process()->updateTextCheckerState();
         return;        
     }
+    if (item.action() == ContextMenuItemTagShowSubstitutions) {
+        TextChecker::toggleSubstitutionsPanelIsShowing();
+        return;
+    }
 #endif
     if (item.action() == ContextMenuItemTagDownloadImageToDisk) {
-        m_context->download(this, KURL(KURL(), m_activeContextMenuState.absoluteImageURLString));
+        m_process->context()->download(this, KURL(KURL(), m_activeContextMenuState.absoluteImageURLString));
         return;    
     }
     if (item.action() == ContextMenuItemTagDownloadLinkToDisk) {
-        m_context->download(this, KURL(KURL(), m_activeContextMenuState.absoluteLinkURLString));
+        m_process->context()->download(this, KURL(KURL(), m_activeContextMenuState.absoluteLinkURLString));
         return;
     }
     if (item.action() == ContextMenuItemTagCheckSpellingWhileTyping) {
@@ -2204,6 +2362,12 @@ void WebPageProxy::contextMenuItemSelected(const WebContextMenuItemData& item)
         process()->updateTextCheckerState();
         return;
     }
+    if (item.action() == ContextMenuItemTagShowSpellingPanel) {
+        if (!TextChecker::spellingUIIsShowing())
+            advanceToNextMisspelling(true);
+        TextChecker::toggleSpellingUIIsShowing();
+        return;
+    }
     if (item.action() == ContextMenuItemTagLearnSpelling || item.action() == ContextMenuItemTagIgnoreSpelling)
         ++m_pendingLearnOrIgnoreWordMessageCount;
 
@@ -2242,12 +2406,12 @@ void WebPageProxy::didCancelForOpenPanel()
     m_openPanelResultListener = 0;
 }
 
-void WebPageProxy::advanceToNextMisspelling(bool startBeforeSelection)
+void WebPageProxy::advanceToNextMisspelling(bool startBeforeSelection) const
 {
     process()->send(Messages::WebPage::AdvanceToNextMisspelling(startBeforeSelection), m_pageID);
 }
 
-void WebPageProxy::changeSpellingToWord(const String& word)
+void WebPageProxy::changeSpellingToWord(const String& word) const
 {
     if (word.isEmpty())
         return;
@@ -2255,16 +2419,6 @@ void WebPageProxy::changeSpellingToWord(const String& word)
     process()->send(Messages::WebPage::ChangeSpellingToWord(word), m_pageID);
 }
 
-void WebPageProxy::unmarkAllMisspellings()
-{
-    process()->send(Messages::WebPage::UnmarkAllMisspellings(), m_pageID);
-}
-
-void WebPageProxy::unmarkAllBadGrammar()
-{
-    process()->send(Messages::WebPage::UnmarkAllBadGrammar(), m_pageID);
-}
-
 void WebPageProxy::registerEditCommand(PassRefPtr<WebEditCommandProxy> commandProxy, UndoOrRedo undoOrRedo)
 {
     m_pageClient->registerEditCommand(commandProxy, undoOrRedo);
@@ -2292,26 +2446,45 @@ bool WebPageProxy::isValidEditCommand(WebEditCommandProxy* command)
 int64_t WebPageProxy::spellDocumentTag()
 {
     if (!m_hasSpellDocumentTag) {
-        m_spellDocumentTag = TextChecker::uniqueSpellDocumentTag();
+        m_spellDocumentTag = TextChecker::uniqueSpellDocumentTag(this);
         m_hasSpellDocumentTag = true;
     }
 
     return m_spellDocumentTag;
 }
 
+#if USE(UNIFIED_TEXT_CHECKING)
+
 void WebPageProxy::checkTextOfParagraph(const String& text, uint64_t checkingTypes, Vector<TextCheckingResult>& results)
 {
     results = TextChecker::checkTextOfParagraph(spellDocumentTag(), text.characters(), text.length(), checkingTypes);
 }
 
+#endif
+
+void WebPageProxy::checkSpellingOfString(const String& text, int32_t& misspellingLocation, int32_t& misspellingLength)
+{
+    TextChecker::checkSpellingOfString(spellDocumentTag(), text.characters(), text.length(), misspellingLocation, misspellingLength);
+}
+
+void WebPageProxy::checkGrammarOfString(const String& text, Vector<WebCore::GrammarDetail>& grammarDetails, int32_t& badGrammarLocation, int32_t& badGrammarLength)
+{
+    TextChecker::checkGrammarOfString(spellDocumentTag(), text.characters(), text.length(), grammarDetails, badGrammarLocation, badGrammarLength);
+}
+
+void WebPageProxy::spellingUIIsShowing(bool& isShowing)
+{
+    isShowing = TextChecker::spellingUIIsShowing();
+}
+
 void WebPageProxy::updateSpellingUIWithMisspelledWord(const String& misspelledWord)
 {
-    TextChecker::updateSpellingUIWithMisspelledWord(misspelledWord);
+    TextChecker::updateSpellingUIWithMisspelledWord(spellDocumentTag(), misspelledWord);
 }
 
 void WebPageProxy::updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
 {
-    TextChecker::updateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail);
+    TextChecker::updateSpellingUIWithGrammarString(spellDocumentTag(), badGrammarPhrase, grammarDetail);
 }
 
 void WebPageProxy::getGuessesForWord(const String& word, const String& context, Vector<String>& guesses)
@@ -2324,7 +2497,7 @@ void WebPageProxy::learnWord(const String& word)
     MESSAGE_CHECK(m_pendingLearnOrIgnoreWordMessageCount);
     --m_pendingLearnOrIgnoreWordMessageCount;
 
-    TextChecker::learnWord(word);
+    TextChecker::learnWord(spellDocumentTag(), word);
 }
 
 void WebPageProxy::ignoreWord(const String& word)
@@ -2339,12 +2512,15 @@ void WebPageProxy::ignoreWord(const String& word)
 
 void WebPageProxy::setFocus(bool focused)
 {
-    m_pageClient->setFocus(focused);
+    if (focused)
+        m_uiClient.focus(this);
+    else
+        m_uiClient.unfocus(this);
 }
 
-void WebPageProxy::takeFocus(bool direction)
+void WebPageProxy::takeFocus(uint32_t direction)
 {
-    m_pageClient->takeFocus(direction);
+    m_uiClient.takeFocus(this, (static_cast<FocusDirection>(direction) == FocusDirectionForward) ? kWKFocusDirectionForward : kWKFocusDirectionBackward);
 }
 
 void WebPageProxy::setToolTip(const String& toolTip)
@@ -2364,6 +2540,7 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
     WebEvent::Type type = static_cast<WebEvent::Type>(opaqueType);
 
     switch (type) {
+    case WebEvent::NoType:
     case WebEvent::MouseMove:
         break;
 
@@ -2383,6 +2560,8 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
     }
 
     switch (type) {
+    case WebEvent::NoType:
+        break;
     case WebEvent::MouseMove:
         m_processingMouseMoveEvent = false;
         if (m_nextMouseMoveEvent) {
@@ -2391,12 +2570,14 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
         }
         break;
     case WebEvent::MouseDown:
-    case WebEvent::MouseUp:
 #if ENABLE(GESTURE_EVENTS)
     case WebEvent::GestureScrollBegin:
     case WebEvent::GestureScrollEnd:
 #endif
         break;
+    case WebEvent::MouseUp:
+        m_currentlyProcessedMouseDownEvent = nullptr;
+        break;
 
     case WebEvent::Wheel: {
         m_processingWheelEvent = false;
@@ -2421,7 +2602,12 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
         if (handled)
             break;
 
-        m_uiClient.didNotHandleKeyEvent(this, event);
+        if (m_uiClient.implementsDidNotHandleKeyEvent())
+            m_uiClient.didNotHandleKeyEvent(this, event);
+#if PLATFORM(WIN)
+        else
+            ::TranslateMessage(event.nativeEvent());
+#endif
         break;
     }
     }
@@ -2542,30 +2728,26 @@ void WebPageProxy::processDidCrash()
 
     m_isValid = false;
 
-    if (m_mainFrame)
-        m_urlAtProcessExit = m_mainFrame->url();
-
-    m_mainFrame = 0;
-
+    m_mainFrame = nullptr;
     m_drawingArea = nullptr;
 
 #if ENABLE(INSPECTOR)
     if (m_inspector) {
         m_inspector->invalidate();
-        m_inspector = 0;
+        m_inspector = nullptr;
     }
 #endif
 
 #if ENABLE(FULLSCREEN_API)
     if (m_fullScreenManager) {
         m_fullScreenManager->invalidate();
-        m_fullScreenManager = 0;
+        m_fullScreenManager = nullptr;
     }
 #endif
 
     if (m_openPanelResultListener) {
         m_openPanelResultListener->invalidate();
-        m_openPanelResultListener = 0;
+        m_openPanelResultListener = nullptr;
     }
 
     m_geolocationPermissionRequestManager.invalidateRequests();
@@ -2601,6 +2783,17 @@ void WebPageProxy::processDidCrash()
 
     m_pageClient->processDidCrash();
     m_loaderClient.processDidCrash(this);
+
+    // Can't expect DidReceiveEvent notifications from a crashed web process.
+    m_keyEventQueue.clear();
+    m_nextWheelEvent = nullptr;
+    m_nextMouseMoveEvent = nullptr;
+    m_currentlyProcessedMouseDownEvent = nullptr;
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    dismissCorrectionPanel(ReasonForDismissingCorrectionPanelIgnored);
+    m_pageClient->dismissDictionaryLookupPanel();
+#endif
 }
 
 WebPageCreationParameters WebPageProxy::creationParameters() const
@@ -2764,8 +2957,14 @@ void WebPageProxy::endPrinting()
     process()->send(Messages::WebPage::EndPrinting(), m_pageID, m_isPerformingDOMPrintOperation ? CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply : 0);
 }
 
-void WebPageProxy::computePagesForPrinting(WebFrameProxy* frame, const PrintInfo& printInfo, PassRefPtr<ComputedPagesCallback> callback)
+void WebPageProxy::computePagesForPrinting(WebFrameProxy* frame, const PrintInfo& printInfo, PassRefPtr<ComputedPagesCallback> prpCallback)
 {
+    RefPtr<ComputedPagesCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+
     uint64_t callbackID = callback->callbackID();
     m_computedPagesCallbacks.set(callbackID, callback.get());
     m_isInPrintingMode = true;
@@ -2773,15 +2972,27 @@ void WebPageProxy::computePagesForPrinting(WebFrameProxy* frame, const PrintInfo
 }
 
 #if PLATFORM(MAC) || PLATFORM(WIN)
-void WebPageProxy::drawRectToPDF(WebFrameProxy* frame, const IntRect& rect, PassRefPtr<DataCallback> callback)
+void WebPageProxy::drawRectToPDF(WebFrameProxy* frame, const IntRect& rect, PassRefPtr<DataCallback> prpCallback)
 {
+    RefPtr<DataCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_dataCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::DrawRectToPDF(frame->frameID(), rect, callbackID), m_pageID, m_isPerformingDOMPrintOperation ? CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply : 0);
 }
 
-void WebPageProxy::drawPagesToPDF(WebFrameProxy* frame, uint32_t first, uint32_t count, PassRefPtr<DataCallback> callback)
+void WebPageProxy::drawPagesToPDF(WebFrameProxy* frame, uint32_t first, uint32_t count, PassRefPtr<DataCallback> prpCallback)
 {
+    RefPtr<DataCallback> callback = prpCallback;
+    if (!isValid()) {
+        callback->invalidate();
+        return;
+    }
+    
     uint64_t callbackID = callback->callbackID();
     m_dataCallbacks.set(callbackID, callback.get());
     process()->send(Messages::WebPage::DrawPagesToPDF(frame->frameID(), first, count, callbackID), m_pageID, m_isPerformingDOMPrintOperation ? CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply : 0);
@@ -2808,7 +3019,19 @@ void WebPageProxy::saveDataToFileInDownloadsFolder(const String& suggestedFilena
     m_uiClient.saveDataToFileInDownloadsFolder(this, suggestedFilename, mimeType, originatingURLString, data);
 }
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+void WebPageProxy::linkClicked(const String& url, const WebMouseEvent& event)
+{
+    process()->send(Messages::WebPage::LinkClicked(url, event), m_pageID, 0);
+}
+
+#if PLATFORM(MAC)
+
+void WebPageProxy::substitutionsPanelIsShowing(bool& isShowing)
+{
+    isShowing = TextChecker::substitutionsPanelIsShowing();
+}
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
 void WebPageProxy::showCorrectionPanel(int32_t panelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings)
 {
     m_pageClient->showCorrectionPanel((WebCore::CorrectionPanelInfo::PanelType)panelType, boundingBoxOfReplacedString, replacedString, replacementString, alternativeReplacementStrings);
@@ -2828,9 +3051,8 @@ void WebPageProxy::recordAutocorrectionResponse(int32_t responseType, const Stri
 {
     m_pageClient->recordAutocorrectionResponse((WebCore::EditorClient::AutocorrectionResponseType)responseType, replacedString, replacementString);
 }
-#endif
+#endif // !defined(BUILDING_ON_SNOW_LEOPARD)
 
-#if PLATFORM(MAC)
 void WebPageProxy::handleCorrectionPanelResult(const String& result)
 {
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
@@ -2838,6 +3060,6 @@ void WebPageProxy::handleCorrectionPanelResult(const String& result)
         process()->send(Messages::WebPage::HandleCorrectionPanelResult(result), m_pageID, 0);
 #endif
 }
-#endif
+#endif // PLATFORM(MAC)
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index e3e62d4..bea43b5 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -31,9 +31,9 @@
 #include "ContextMenuState.h"
 #include "DragControllerAction.h"
 #include "DrawingAreaProxy.h"
+#include "EditorState.h"
 #include "GeolocationPermissionRequestManagerProxy.h"
 #include "SandboxExtension.h"
-#include "SelectionState.h"
 #include "SharedMemory.h"
 #include "WKBase.h"
 #include "WKPagePrivate.h"
@@ -78,6 +78,7 @@ namespace WebCore {
 namespace WebKit {
 
 class NativeWebKeyboardEvent;
+class NativeWebMouseEvent;
 class PageClient;
 class PlatformCertificateInfo;
 class StringPairVector;
@@ -94,7 +95,9 @@ class WebPageGroup;
 class WebProcessProxy;
 class WebURLRequest;
 class WebWheelEvent;
+struct AttributedString;
 struct DictionaryPopupInfo;
+struct EditorState;
 struct PlatformPopupMenuData;
 struct PrintInfo;
 struct WebPageCreationParameters;
@@ -156,7 +159,7 @@ class WebPageProxy : public APIObject, public WebPopupMenuProxy::Client {
 public:
     static const Type APIType = TypePage;
 
-    static PassRefPtr<WebPageProxy> create(PageClient*, WebContext*, WebPageGroup*, uint64_t pageID);
+    static PassRefPtr<WebPageProxy> create(PageClient*, PassRefPtr<WebProcessProxy>, WebPageGroup*, uint64_t pageID);
     virtual ~WebPageProxy();
 
     uint64_t pageID() const { return m_pageID; }
@@ -239,23 +242,34 @@ public:
 
     WebCore::IntSize viewSize() const;
     bool isViewVisible() const { return m_isVisible; }
+    bool isViewWindowActive() const;
 
     void executeEditCommand(const String& commandName);
     void validateCommand(const String& commandName, PassRefPtr<ValidateCommandCallback>);
 
-    const SelectionState& selectionState() const { return m_selectionState; }
+    const EditorState& editorState() const { return m_editorState; }
     bool canDelete() const { return hasSelectedRange() && isContentEditable(); }
-    bool hasSelectedRange() const { return m_selectionState.selectedRangeLength; }
-    bool isContentEditable() const { return m_selectionState.isContentEditable; }
+    bool hasSelectedRange() const { return m_editorState.selectionIsRange; }
+    bool isContentEditable() const { return m_editorState.isContentEditable; }
 
 #if PLATFORM(MAC)
     void updateWindowIsVisible(bool windowIsVisible);
     void windowAndViewFramesChanged(const WebCore::IntRect& windowFrameInScreenCoordinates, const WebCore::IntRect& viewFrameInWindowCoordinates, const WebCore::IntPoint& accessibilityViewCoordinates);
+
+    void setComposition(const String& text, Vector<WebCore::CompositionUnderline> underlines, uint64_t selectionStart, uint64_t selectionEnd, uint64_t replacementRangeStart, uint64_t replacementRangeEnd);
+    void confirmComposition();
+    bool insertText(const String& text, uint64_t replacementRangeStart, uint64_t replacementRangeEnd);
     void getMarkedRange(uint64_t& location, uint64_t& length);
+    void getSelectedRange(uint64_t& location, uint64_t& length);
+    void getAttributedSubstringFromRange(uint64_t location, uint64_t length, AttributedString&);
     uint64_t characterIndexForPoint(const WebCore::IntPoint);
     WebCore::IntRect firstRectForCharacterRange(uint64_t, uint64_t);
+    bool executeKeypressCommands(const Vector<WebCore::KeypressCommand>&);
+
     void sendComplexTextInputToPlugin(uint64_t pluginComplexTextInputIdentifier, const String& textInput);
     CGContextRef containingWindowGraphicsContext();
+    bool shouldDelayWindowOrderingForEvent(const WebMouseEvent&);
+    bool acceptsFirstMouse(int eventNumber, const WebMouseEvent&);
 #endif
 #if PLATFORM(WIN)
     void didChangeCompositionSelection(bool);
@@ -263,12 +277,18 @@ public:
     void setComposition(const String&, Vector<WebCore::CompositionUnderline>&, int);
     WebCore::IntRect firstRectForCharacterInSelectedRange(int);
     String getSelectedText();
+
+    bool gestureWillBegin(const WebCore::IntPoint&);
+    void gestureDidScroll(const WebCore::IntSize&);
+    void gestureDidEnd();
+
+    void setGestureReachedScrollingLimit(bool);
 #endif
 #if ENABLE(TILED_BACKING_STORE)
     void setActualVisibleContentRect(const WebCore::IntRect& rect);
 #endif
 
-    void handleMouseEvent(const WebMouseEvent&);
+    void handleMouseEvent(const NativeWebMouseEvent&);
     void handleWheelEvent(const WebWheelEvent&);
     void handleKeyboardEvent(const NativeWebKeyboardEvent&);
 #if ENABLE(GESTURE_EVENTS)
@@ -340,6 +360,10 @@ public:
     void findString(const String&, FindOptions, unsigned maxMatchCount);
     void hideFindUI();
     void countStringMatches(const String&, FindOptions, unsigned maxMatchCount);
+    void didCountStringMatches(const String&, uint32_t matchCount);
+    void setFindIndicator(const WebCore::FloatRect& selectionRectInWindowCoordinates, const Vector<WebCore::FloatRect>& textRectsInSelectionRectCoordinates, const ShareableBitmap::Handle& contentImageHandle, bool fadeOut);
+    void didFindString(const String&, uint32_t matchCount);
+    void didFailToFindString(const String&);
 
     void getContentsAsString(PassRefPtr<StringCallback>);
     void getMainResourceDataOfFrame(WebFrameProxy*, PassRefPtr<DataCallback>);
@@ -366,7 +390,11 @@ public:
     void backForwardRemovedItem(uint64_t itemID);
 
     // Drag and drop support.
-    void performDragControllerAction(DragControllerAction, WebCore::DragData*, const String& = String());
+    void dragEntered(WebCore::DragData*, const String& dragStorageName = String());
+    void dragUpdated(WebCore::DragData*, const String& dragStorageName = String());
+    void dragExited(WebCore::DragData*, const String& dragStorageName = String());
+    void performDrag(WebCore::DragData*, const String& dragStorageName, const SandboxExtension::Handle&);
+
     void didPerformDragControllerAction(uint64_t resultOperation);
     void dragEnded(const WebCore::IntPoint& clientPosition, const WebCore::IntPoint& globalPosition, uint64_t operation);
 #if PLATFORM(MAC)
@@ -396,7 +424,6 @@ public:
     void registerEditCommand(PassRefPtr<WebEditCommandProxy>, UndoOrRedo);
 
     WebProcessProxy* process() const;
-    WebContext* context() const { return m_context.get(); }
 
     WebPageGroup* pageGroup() const { return m_pageGroup.get(); }
 
@@ -405,9 +432,6 @@ public:
     WebCore::DragOperation dragOperation() { return m_currentDragOperation; }
     void resetDragOperation() { m_currentDragOperation = WebCore::DragOperationNone; }
 
-    // REMOVE: For demo purposes only.
-    const String& urlAtProcessExit() const { return m_urlAtProcessExit; }
-
     void preferencesDidChange();
 
 #if ENABLE(TILED_BACKING_STORE)
@@ -427,10 +451,8 @@ public:
     void findZoomableAreaForPoint(const WebCore::IntPoint&);
 #endif
 
-    void advanceToNextMisspelling(bool startBeforeSelection);
-    void changeSpellingToWord(const String& word);
-    void unmarkAllMisspellings();
-    void unmarkAllBadGrammar();
+    void advanceToNextMisspelling(bool startBeforeSelection) const;
+    void changeSpellingToWord(const String& word) const;
 #if PLATFORM(MAC)
     void uppercaseWord();
     void lowercaseWord();
@@ -467,14 +489,17 @@ public:
 
     void saveDataToFileInDownloadsFolder(const String& suggestedFilename, const String& mimeType, const String& originatingURLString, WebData*);
 
+    void linkClicked(const String&, const WebMouseEvent&);
+ 
 private:
-    WebPageProxy(PageClient*, WebContext*, WebPageGroup*, uint64_t pageID);
+    WebPageProxy(PageClient*, PassRefPtr<WebProcessProxy>, WebPageGroup*, uint64_t pageID);
 
     virtual Type type() const { return APIType; }
 
     // WebPopupMenuProxy::Client
     virtual void valueChangedForPopupMenu(WebPopupMenuProxy*, int32_t newSelectedIndex);
     virtual void setTextFromItemForPopupMenu(WebPopupMenuProxy*, int32_t index);
+    virtual NativeWebMouseEvent* currentlyProcessedMouseDownEvent();
 
     // Implemented in generated WebPageProxyMessageReceiver.cpp
     void didReceiveWebPageProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
@@ -564,8 +589,7 @@ private:
     void didFindZoomableArea(const WebCore::IntRect&);
 #endif
 
-    // Selection
-    void selectionStateChanged(const SelectionState&);
+    void editorStateChanged(const EditorState&);
 
     // Back/Forward list management
     void backForwardAddItem(uint64_t itemID);
@@ -578,24 +602,33 @@ private:
     // Undo management
     void registerEditCommandForUndo(uint64_t commandID, uint32_t editAction);
     void clearAllEditCommands();
+    void canUndoRedo(uint32_t action, bool& result);
+    void executeUndoRedo(uint32_t action, bool& result);
 
     // Keyboard handling
 #if PLATFORM(MAC)
-    void interpretKeyEvent(uint32_t eventType, Vector<WebCore::KeypressCommand>&, uint32_t selectionStart, uint32_t selectionEnd, Vector<WebCore::CompositionUnderline>& underlines);
+    void interpretQueuedKeyEvent(const EditorState&, bool& handled, Vector<WebCore::KeypressCommand>&);
+    void executeSavedCommandBySelector(const String& selector, bool& handled);
+#endif
+
+#if PLATFORM(GTK)
+    void getEditorCommandsForKeyEvent(Vector<String>&);
 #endif
-    
-    // Find.
-    void didCountStringMatches(const String&, uint32_t matchCount);
-    void setFindIndicator(const WebCore::FloatRect& selectionRectInWindowCoordinates, const Vector<WebCore::FloatRect>& textRectsInSelectionRectCoordinates, const ShareableBitmap::Handle& contentImageHandle, bool fadeOut);
-    void didFindString(const String&, uint32_t matchCount);
-    void didFailToFindString(const String&);
 
     // Popup Menu.
     void showPopupMenu(const WebCore::IntRect& rect, uint64_t textDirection, const Vector<WebPopupItem>& items, int32_t selectedIndex, const PlatformPopupMenuData&);
     void hidePopupMenu();
+#if PLATFORM(WIN)
+    void setPopupMenuSelectedIndex(int32_t);
+#endif
 
     // Context Menu.
     void showContextMenu(const WebCore::IntPoint& menuLocation, const ContextMenuState&, const Vector<WebContextMenuItemData>&, CoreIPC::ArgumentDecoder*);
+    void internalShowContextMenu(const WebCore::IntPoint& menuLocation, const ContextMenuState&, const Vector<WebContextMenuItemData>&, CoreIPC::ArgumentDecoder*);
+
+    // Search popup results
+    void saveRecentSearches(const String&, const Vector<String>&);
+    void loadRecentSearches(const String&, Vector<String>&);
 
 #if PLATFORM(MAC)
     // Speech.
@@ -603,13 +636,21 @@ private:
     void speak(const String&);
     void stopSpeaking();
 
+    // Spotlight.
+    void searchWithSpotlight(const String&);
+
     // Dictionary.
     void didPerformDictionaryLookup(const String&, const DictionaryPopupInfo&);
 #endif
 
     // Spelling and grammar.
     int64_t spellDocumentTag();
+#if USE(UNIFIED_TEXT_CHECKING)
     void checkTextOfParagraph(const String& text, uint64_t checkingTypes, Vector<WebCore::TextCheckingResult>& results);
+#endif
+    void checkSpellingOfString(const String& text, int32_t& misspellingLocation, int32_t& misspellingLength);
+    void checkGrammarOfString(const String& text, Vector<WebCore::GrammarDetail>&, int32_t& badGrammarLocation, int32_t& badGrammarLength);
+    void spellingUIIsShowing(bool&);
     void updateSpellingUIWithMisspelledWord(const String& misspelledWord);
     void updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const WebCore::GrammarDetail&);
     void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses);
@@ -617,7 +658,7 @@ private:
     void ignoreWord(const String& word);
 
     void setFocus(bool focused);
-    void takeFocus(bool direction);
+    void takeFocus(uint32_t direction);
     void setToolTip(const String&);
     void setCursor(const WebCore::Cursor&);
 
@@ -649,15 +690,20 @@ private:
 
     void initializeSandboxExtensionHandle(const WebCore::KURL&, SandboxExtension::Handle&);
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if PLATFORM(MAC)
+    void substitutionsPanelIsShowing(bool&);
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     void showCorrectionPanel(int32_t panelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
     void dismissCorrectionPanel(int32_t reason);
     void dismissCorrectionPanelSoon(int32_t reason, String& result);
     void recordAutocorrectionResponse(int32_t responseType, const String& replacedString, const String& replacementString);
-#endif
+#endif // !defined(BUILDING_ON_SNOW_LEOPARD)
+#endif // PLATFORM(MAC)
 
     void clearLoadDependentCallbacks();
 
+    void performDragControllerAction(DragControllerAction, WebCore::DragData*, const String& dragStorageName, const SandboxExtension::Handle&);
+
     PageClient* m_pageClient;
     WebLoaderClient m_loaderClient;
     WebPolicyClient m_policyClient;
@@ -668,7 +714,7 @@ private:
     WebPageContextMenuClient m_contextMenuClient;
 
     OwnPtr<DrawingAreaProxy> m_drawingArea;
-    RefPtr<WebContext> m_context;
+    RefPtr<WebProcessProxy> m_process;
     RefPtr<WebPageGroup> m_pageGroup;
     RefPtr<WebFrameProxy> m_mainFrame;
     RefPtr<WebFrameProxy> m_focusedFrame;
@@ -717,10 +763,7 @@ private:
 
     String m_toolTip;
 
-    SelectionState m_selectionState;
-
-    // REMOVE: For demo purposes only.
-    String m_urlAtProcessExit;
+    EditorState m_editorState;
 
     double m_textZoomFactor;
     double m_pageZoomFactor;
@@ -758,7 +801,8 @@ private:
     OwnPtr<WebWheelEvent> m_nextWheelEvent;
 
     bool m_processingMouseMoveEvent;
-    OwnPtr<WebMouseEvent> m_nextMouseMoveEvent;
+    OwnPtr<NativeWebMouseEvent> m_nextMouseMoveEvent;
+    OwnPtr<NativeWebMouseEvent> m_currentlyProcessedMouseDownEvent;
 
     uint64_t m_pageID;
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index e145d82..f5f4238 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -36,7 +36,7 @@ messages -> WebPageProxy {
     SetStatusText(WTF::String statusText)
     SetToolTip(WTF::String toolTip)
     SetFocus(bool focused)
-    TakeFocus(bool direction)
+    TakeFocus(uint32_t direction)
     FocusedFrameChanged(uint64_t frameID)
     FrameSetLargestFrameChanged(uint64_t frameID)
     SetToolbarsAreVisible(bool toolbarsAreVisible)
@@ -126,17 +126,11 @@ messages -> WebPageProxy {
 
     ViewScaleFactorDidChange(double scaleFactor)
 
-#if PLATFORM(MAC)
-    # Dictionary support.
-    DidPerformDictionaryLookup(WTF::String text, WebKit::DictionaryPopupInfo dictionaryPopupInfo)
-
-    # Keyboard support messages
-    InterpretKeyEvent(uint32_t type) -> (Vector<WebCore::KeypressCommand> commandName, uint32_t selectionStart, uint32_t selectionEnd, Vector<WebCore::CompositionUnderline> underlines)
-    
-    # Remote accessibility messages
-    RegisterWebProcessAccessibilityToken(CoreIPC::DataReference data)
+#if PLATFORM(GTK)
+    # Support for GTK+ platform keybindings
+    GetEditorCommandsForKeyEvent() -> (Vector<WTF::String> commandsList)
 #endif
-    
+
     # BackForward messages
     BackForwardAddItem(uint64_t itemID)
     BackForwardGoToItem(uint64_t itemID)
@@ -149,10 +143,11 @@ messages -> WebPageProxy {
     # Undo/Redo messages
     RegisterEditCommandForUndo(uint64_t commandID, uint32_t editAction)
     ClearAllEditCommands()
-    
-    # Selection messages
-    SelectionStateChanged(WebKit::SelectionState selectionState)
+    CanUndoRedo(uint32_t action) -> (bool result)
+    ExecuteUndoRedo(uint32_t action) -> (bool result)
 
+    # Editor notifications
+    EditorStateChanged(WebKit::EditorState editorState)
 #if PLATFORM(WIN)
     DidChangeCompositionSelection(bool hasChanged)
 #endif
@@ -166,7 +161,10 @@ messages -> WebPageProxy {
     # PopupMenu messages
     ShowPopupMenu(WebCore::IntRect rect, uint64_t textDirection, Vector<WebKit::WebPopupItem> items, int32_t selectedIndex, WebKit::PlatformPopupMenuData data)
     HidePopupMenu()
-    
+#if PLATFORM(WIN)
+    SetPopupMenuSelectedIndex(int32_t selectedIndex)
+#endif
+
     # ContextMenu messages
     ShowContextMenu(WebCore::IntPoint menuLocation, WebKit::ContextMenuState state, Vector<WebKit::WebContextMenuItemData> items, WebKit::InjectedBundleUserMessageEncoder userData)
 
@@ -180,20 +178,13 @@ messages -> WebPageProxy {
     # Geolocation messages
     RequestGeolocationPermissionForFrame(uint64_t geolocationID, uint64_t frameID, WTF::String originIdentifier)
 
-#if PLATFORM(MAC)
-    # Plug-in complex text input support messages
-    SetComplexTextInputEnabled(uint64_t pluginComplexTextInputIdentifier, bool complexTextInputEnabled)
-#endif
-
-#if PLATFORM(MAC)
-    # Speech messages
-    GetIsSpeaking() -> (bool isSpeaking)
-    Speak(WTF::String string)
-    StopSpeaking()
-#endif
-
     # Spelling and grammar messages
+#if USE(UNIFIED_TEXT_CHECKING)  
     CheckTextOfParagraph(WTF::String text, uint64_t checkingTypes) -> (Vector<WebCore::TextCheckingResult> results)
+#endif
+    CheckSpellingOfString(WTF::String text) -> (int32_t misspellingLocation, int32_t misspellingLength)
+    CheckGrammarOfString(WTF::String text) -> (Vector<WebCore::GrammarDetail> results, int32_t badGrammarLocation, int32_t badGrammarLength)
+    SpellingUIIsShowing() -> (bool isShowing)
     UpdateSpellingUIWithMisspelledWord(WTF::String misspelledWord)
     UpdateSpellingUIWithGrammarString(WTF::String badGrammarPhrase, WebCore::GrammarDetail grammarDetail)
     GetGuessesForWord(WTF::String word, WTF::String context) -> (Vector<WTF::String> guesses)
@@ -209,6 +200,32 @@ messages -> WebPageProxy {
     StartDragDrop(WebCore::IntPoint imagePoint, WebCore::IntPoint dragPoint, uint64_t okEffect, HashMap<UINT,Vector<String> > dataMap, WebCore::IntSize dragImageSize, WebKit::SharedMemory::Handle dragImage, bool linkDrag)
 #endif
 
+#if PLATFORM(MAC)
+    # Dictionary support.
+    DidPerformDictionaryLookup(WTF::String text, WebKit::DictionaryPopupInfo dictionaryPopupInfo)
+
+    # Keyboard input support messages
+    InterpretQueuedKeyEvent(WebKit::EditorState state) -> (bool handled, Vector<WebCore::KeypressCommand> savedCommands)
+    ExecuteSavedCommandBySelector(WTF::String selector) -> (bool handled)
+
+    # Remote accessibility messages
+    RegisterWebProcessAccessibilityToken(CoreIPC::DataReference data)
+
+    # Plug-in complex text input support messages
+    SetComplexTextInputEnabled(uint64_t pluginComplexTextInputIdentifier, bool complexTextInputEnabled)
+
+    # Speech messages
+    GetIsSpeaking() -> (bool isSpeaking)
+    Speak(WTF::String string)
+    StopSpeaking()
+
+    # Spotlight
+    SearchWithSpotlight(WTF::String string)
+#endif
+
+#if PLATFORM(MAC)
+    SubstitutionsPanelIsShowing() -> (bool isShowing)
+#endif
 #if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     # Autocorrection messages
     ShowCorrectionPanel(int32_t panelType, WebCore::FloatRect boundingBoxOfReplacedString, String replacedString, String replacementString, Vector<String> alternativeReplacementStrings)
@@ -216,4 +233,13 @@ messages -> WebPageProxy {
     DismissCorrectionPanelSoon(int32_t reason) -> (String result)
     RecordAutocorrectionResponse(int32_t responseType, String replacedString, String replacementString);
 #endif
+
+#if PLATFORM(WIN)
+    # Windows 7 Gesture Messages
+    SetGestureReachedScrollingLimit(bool limitReached)
+#endif
+
+    # Search popup menus
+    SaveRecentSearches(WTF::String name, Vector<String> searchItems)
+    LoadRecentSearches(WTF::String name) -> (Vector<String> result)
 }
diff --git a/Source/WebKit2/UIProcess/WebPopupMenuProxy.h b/Source/WebKit2/UIProcess/WebPopupMenuProxy.h
index 96901fb..0af8880 100644
--- a/Source/WebKit2/UIProcess/WebPopupMenuProxy.h
+++ b/Source/WebKit2/UIProcess/WebPopupMenuProxy.h
@@ -39,6 +39,7 @@ namespace WebKit {
 
 struct PlatformPopupMenuData;
 struct WebPopupItem;
+class NativeWebMouseEvent;
 
 class WebPopupMenuProxy : public RefCounted<WebPopupMenuProxy> {
 public:
@@ -51,6 +52,7 @@ public:
     public:
         virtual void valueChangedForPopupMenu(WebPopupMenuProxy*, int32_t newSelectedIndex) = 0;
         virtual void setTextFromItemForPopupMenu(WebPopupMenuProxy*, int32_t index) = 0;
+        virtual NativeWebMouseEvent* currentlyProcessedMouseDownEvent() = 0;
     };
 
     virtual ~WebPopupMenuProxy()
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.cpp b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
index 8a48724..a8ae574 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
@@ -37,7 +37,6 @@
 #include "WebPageProxy.h"
 #include "WebProcessMessages.h"
 #include "WebProcessProxyMessages.h"
-#include "WebProcessProxyMessageKinds.h"
 #include <WebCore/KURL.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
@@ -59,12 +58,12 @@ static uint64_t generatePageID()
     return uniquePageID++;
 }
 
-PassRefPtr<WebProcessProxy> WebProcessProxy::create(WebContext* context)
+PassRefPtr<WebProcessProxy> WebProcessProxy::create(PassRefPtr<WebContext> context)
 {
     return adoptRef(new WebProcessProxy(context));
 }
 
-WebProcessProxy::WebProcessProxy(WebContext* context)
+WebProcessProxy::WebProcessProxy(PassRefPtr<WebContext> context)
     : m_responsivenessTimer(this)
     , m_context(context)
 {
@@ -163,17 +162,17 @@ void WebProcessProxy::terminate()
 
 WebPageProxy* WebProcessProxy::webPage(uint64_t pageID) const
 {
-    return m_pageMap.get(pageID).get();
+    return m_pageMap.get(pageID);
 }
 
-WebPageProxy* WebProcessProxy::createWebPage(PageClient* pageClient, WebContext* context, WebPageGroup* pageGroup)
+PassRefPtr<WebPageProxy> WebProcessProxy::createWebPage(PageClient* pageClient, WebContext* context, WebPageGroup* pageGroup)
 {
     ASSERT(context->process() == this);
 
     unsigned pageID = generatePageID();
-    RefPtr<WebPageProxy> webPage = WebPageProxy::create(pageClient, context, pageGroup, pageID);
-    m_pageMap.set(pageID, webPage);
-    return webPage.get();
+    RefPtr<WebPageProxy> webPage = WebPageProxy::create(pageClient, this, pageGroup, pageID);
+    m_pageMap.set(pageID, webPage.get());
+    return webPage.release();
 }
 
 void WebProcessProxy::addExistingWebPage(WebPageProxy* webPage, uint64_t pageID)
@@ -186,21 +185,6 @@ void WebProcessProxy::removeWebPage(uint64_t pageID)
     m_pageMap.remove(pageID);
 }
 
-WebProcessProxy::pages_const_iterator WebProcessProxy::pages_begin()
-{
-    return m_pageMap.begin().values();
-}
-
-WebProcessProxy::pages_const_iterator WebProcessProxy::pages_end()
-{
-    return m_pageMap.end().values();
-}
-
-size_t WebProcessProxy::numberOfPages()
-{
-    return m_pageMap.size();
-}
-
 WebBackForwardListItem* WebProcessProxy::webBackForwardItem(uint64_t itemID) const
 {
     return m_backForwardListItemMap.get(itemID).get();
@@ -232,9 +216,14 @@ void WebProcessProxy::addBackForwardItem(uint64_t itemID, const String& original
 }
 
 #if ENABLE(PLUGIN_PROCESS)
-void WebProcessProxy::getPluginProcessConnection(const String& pluginPath, CoreIPC::ArgumentEncoder* reply)
+void WebProcessProxy::getPluginProcessConnection(const String& pluginPath, PassRefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply)
 {
-    PluginProcessManager::shared().getPluginProcessConnection(pluginPath, this, reply);
+    PluginProcessManager::shared().getPluginProcessConnection(context()->pluginInfoStore(), pluginPath, reply);
+}
+
+void WebProcessProxy::pluginSyncMessageSendTimedOut(const String& pluginPath)
+{
+    PluginProcessManager::shared().pluginSyncMessageSendTimedOut(pluginPath);
 }
 #endif
 
@@ -276,22 +265,6 @@ CoreIPC::SyncReplyMode WebProcessProxy::didReceiveSyncMessage(CoreIPC::Connectio
     if (messageID.is<CoreIPC::MessageClassWebProcessProxy>())
         return didReceiveSyncWebProcessProxyMessage(connection, messageID, arguments, reply);
 
-#if ENABLE(PLUGIN_PROCESS)
-    if (messageID.is<CoreIPC::MessageClassWebProcessProxyLegacy>()) {
-        switch (messageID.get<WebProcessProxyLegacyMessage::Kind>()) {
-            case WebProcessProxyLegacyMessage::GetPluginProcessConnection: {
-                String pluginPath;
-                
-                if (!arguments->decode(CoreIPC::Out(pluginPath)))
-                    return CoreIPC::AutomaticReply;
-
-                getPluginProcessConnection(pluginPath, reply);
-                return CoreIPC::ManualReply;
-            }
-        }
-    }
-#endif
-
     if (messageID.is<CoreIPC::MessageClassWebContext>() || messageID.is<CoreIPC::MessageClassWebContextLegacy>() 
         || messageID.is<CoreIPC::MessageClassDownloadProxy>() || messageID.is<CoreIPC::MessageClassWebIconDatabase>())
         return m_context->didReceiveSyncMessage(connection, messageID, arguments, reply);
@@ -331,6 +304,10 @@ void WebProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::Me
     terminate();
 }
 
+void WebProcessProxy::syncMessageSendTimedOut(CoreIPC::Connection*)
+{
+}
+
 void WebProcessProxy::didBecomeUnresponsive(ResponsivenessTimer*)
 {
     Vector<RefPtr<WebPageProxy> > pages;
@@ -364,7 +341,7 @@ void WebProcessProxy::didFinishLaunching(CoreIPC::Connection::Identifier connect
     m_connection = CoreIPC::Connection::createServerConnection(connectionIdentifier, this, RunLoop::main());
 #if PLATFORM(MAC)
     m_connection->setShouldCloseConnectionOnMachExceptions();
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) || PLATFORM(GTK)
     m_connection->setShouldCloseConnectionOnProcessTermination(processIdentifier());
 #endif
 
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.h b/Source/WebKit2/UIProcess/WebProcessProxy.h
index 04dbd98..761aad4 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.h
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.h
@@ -34,6 +34,7 @@
 #include "ResponsivenessTimer.h"
 #include "ThreadLauncher.h"
 #include "WebPageProxy.h"
+#include "WebProcessProxyMessages.h"
 #include <WebCore/LinkHash.h>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -53,12 +54,10 @@ struct WebNavigationDataStore;
 
 class WebProcessProxy : public RefCounted<WebProcessProxy>, CoreIPC::Connection::Client, ResponsivenessTimer::Client, ProcessLauncher::Client, ThreadLauncher::Client {
 public:
-    typedef HashMap<uint64_t, RefPtr<WebPageProxy> > WebPageProxyMap;
-    typedef WebPageProxyMap::const_iterator::Values pages_const_iterator;
     typedef HashMap<uint64_t, RefPtr<WebFrameProxy> > WebFrameProxyMap;
     typedef HashMap<uint64_t, RefPtr<WebBackForwardListItem> > WebBackForwardListItemMap;
 
-    static PassRefPtr<WebProcessProxy> create(WebContext*);
+    static PassRefPtr<WebProcessProxy> create(PassRefPtr<WebContext>);
     ~WebProcessProxy();
 
     void terminate();
@@ -73,19 +72,15 @@ public:
         return m_connection.get(); 
     }
 
-    WebContext* context() const { return m_context; }
+    WebContext* context() const { return m_context.get(); }
 
     PlatformProcessIdentifier processIdentifier() const { return m_processLauncher->processIdentifier(); }
 
     WebPageProxy* webPage(uint64_t pageID) const;
-    WebPageProxy* createWebPage(PageClient*, WebContext*, WebPageGroup*);
+    PassRefPtr<WebPageProxy> createWebPage(PageClient*, WebContext*, WebPageGroup*);
     void addExistingWebPage(WebPageProxy*, uint64_t pageID);
     void removeWebPage(uint64_t pageID);
 
-    pages_const_iterator pages_begin();
-    pages_const_iterator pages_end();
-    size_t numberOfPages();
-
     WebBackForwardListItem* webBackForwardItem(uint64_t itemID) const;
 
     ResponsivenessTimer* responsivenessTimer() { return &m_responsivenessTimer; }
@@ -108,7 +103,7 @@ public:
     template<typename E, typename T> bool deprecatedSend(E messageID, uint64_t destinationID, const T& arguments);
 
 private:
-    explicit WebProcessProxy(WebContext*);
+    explicit WebProcessProxy(PassRefPtr<WebContext>);
 
     // Initializes the process or thread launcher which will begin launching the process.
     void connect();
@@ -126,14 +121,20 @@ private:
     void shouldTerminate(bool& shouldTerminate);
 
 #if ENABLE(PLUGIN_PROCESS)
-    void getPluginProcessConnection(const String& pluginPath, CoreIPC::ArgumentEncoder* reply);
+    void getPluginProcessConnection(const String& pluginPath, PassRefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply>);
+    void pluginSyncMessageSendTimedOut(const String& pluginPath);
 #endif
 
     // CoreIPC::Connection::Client
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
-    CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
-    void didClose(CoreIPC::Connection*);
-    void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    virtual CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
+    virtual void didClose(CoreIPC::Connection*);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
+
+#if PLATFORM(WIN)
+    Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply();
+#endif
 
     // ResponsivenessTimer::Client
     void didBecomeUnresponsive(ResponsivenessTimer*);
@@ -158,9 +159,9 @@ private:
     RefPtr<ProcessLauncher> m_processLauncher;
     RefPtr<ThreadLauncher> m_threadLauncher;
 
-    WebContext* m_context;
+    RefPtr<WebContext> m_context;
 
-    WebPageProxyMap m_pageMap;
+    HashMap<uint64_t, WebPageProxy*> m_pageMap;
     WebFrameProxyMap m_frameMap;
     WebBackForwardListItemMap m_backForwardListItemMap;
 };
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.messages.in b/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
index 99014d4..e80bdd0 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.messages.in
@@ -26,4 +26,9 @@ messages -> WebProcessProxy {
     DidDestroyFrame(uint64_t frameID) 
 
     ShouldTerminate() -> (bool shouldTerminate)
+
+#if ENABLE(PLUGIN_PROCESS)
+    GetPluginProcessConnection(WTF::String pluginPath) -> (CoreIPC::MachPort connectionHandle) Delayed
+    PluginSyncMessageSendTimedOut(WTF::String pluginPath)
+#endif
 }
diff --git a/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.cpp b/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.cpp
index 403a8dc..8c06bdc 100644
--- a/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.cpp
@@ -67,7 +67,9 @@ void WebResourceCacheManagerProxy::getCacheOrigins(PassRefPtr<ArrayCallback> prp
     m_webContext->relaunchProcessIfNecessary();
     uint64_t callbackID = callback->callbackID();
     m_arrayCallbacks.set(callbackID, callback.release());
-    m_webContext->process()->send(Messages::WebResourceCacheManager::GetCacheOrigins(callbackID), 0);
+
+    // FIXME (Multi-WebProcess): When multi-process is enabled, we need to aggregate the callback data from all processes.
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebResourceCacheManager::GetCacheOrigins(callbackID));
 }
 
 void WebResourceCacheManagerProxy::didGetCacheOrigins(const Vector<SecurityOriginData>& origins, uint64_t callbackID)
@@ -76,21 +78,19 @@ void WebResourceCacheManagerProxy::didGetCacheOrigins(const Vector<SecurityOrigi
     performAPICallbackWithSecurityOriginDataVector(origins, callback.get());
 }
 
-void WebResourceCacheManagerProxy::clearCacheForOrigin(WebSecurityOrigin* origin)
+void WebResourceCacheManagerProxy::clearCacheForOrigin(WebSecurityOrigin* origin, ResourceCachesToClear cachesToClear)
 {
-    m_webContext->relaunchProcessIfNecessary();
-
     SecurityOriginData securityOrigin;
     securityOrigin.protocol = origin->protocol();
     securityOrigin.host = origin->host();
     securityOrigin.port = origin->port();
-    m_webContext->process()->send(Messages::WebResourceCacheManager::ClearCacheForOrigin(securityOrigin), 0);
+
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebResourceCacheManager::ClearCacheForOrigin(securityOrigin, cachesToClear));
 }
 
-void WebResourceCacheManagerProxy::clearCacheForAllOrigins()
+void WebResourceCacheManagerProxy::clearCacheForAllOrigins(ResourceCachesToClear cachesToClear)
 {
-    m_webContext->relaunchProcessIfNecessary();
-    m_webContext->process()->send(Messages::WebResourceCacheManager::ClearCacheForAllOrigins(), 0);
+    m_webContext->sendToAllProcessesRelaunchingThemIfNecessary(Messages::WebResourceCacheManager::ClearCacheForAllOrigins(cachesToClear));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.h b/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.h
index 1a360b4..f0c7bb5 100644
--- a/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.h
+++ b/Source/WebKit2/UIProcess/WebResourceCacheManagerProxy.h
@@ -29,6 +29,7 @@
 #include "APIObject.h"
 #include "Arguments.h"
 #include "GenericCallback.h"
+#include "ResourceCachesToClear.h"
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 
@@ -58,8 +59,8 @@ public:
     void clearContext() { m_webContext = 0; }
 
     void getCacheOrigins(PassRefPtr<ArrayCallback>);
-    void clearCacheForOrigin(WebSecurityOrigin*);
-    void clearCacheForAllOrigins();
+    void clearCacheForOrigin(WebSecurityOrigin*, ResourceCachesToClear);
+    void clearCacheForAllOrigins(ResourceCachesToClear);
 
     void didReceiveWebResourceCacheManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
diff --git a/Source/WebKit2/UIProcess/WebUIClient.cpp b/Source/WebKit2/UIProcess/WebUIClient.cpp
index 9bb8efc..ec13a41 100644
--- a/Source/WebKit2/UIProcess/WebUIClient.cpp
+++ b/Source/WebKit2/UIProcess/WebUIClient.cpp
@@ -84,6 +84,30 @@ void WebUIClient::close(WebPageProxy* page)
     m_client.close(toAPI(page), m_client.clientInfo);
 }
 
+void WebUIClient::takeFocus(WebPageProxy* page, WKFocusDirection direction)
+{
+    if (!m_client.takeFocus)
+        return;
+    
+    m_client.takeFocus(toAPI(page), direction, m_client.clientInfo);
+}
+
+void WebUIClient::focus(WebPageProxy* page)
+{
+    if (!m_client.focus)
+        return;
+    
+    m_client.focus(toAPI(page), m_client.clientInfo);
+}
+
+void WebUIClient::unfocus(WebPageProxy* page)
+{
+    if (!m_client.unfocus)
+        return;
+
+    m_client.unfocus(toAPI(page), m_client.clientInfo);
+}
+
 void WebUIClient::runJavaScriptAlert(WebPageProxy* page, const String& message, WebFrameProxy* frame)
 {
     if (!m_client.runJavaScriptAlert)
@@ -139,6 +163,11 @@ void WebUIClient::missingPluginButtonClicked(WebPageProxy* page, const String& m
     m_client.missingPluginButtonClicked(toAPI(page), toAPI(mimeType.impl()), toAPI(url.impl()), toAPI(pluginsPageURL.impl()), m_client.clientInfo);
 }
 
+bool WebUIClient::implementsDidNotHandleKeyEvent() const
+{
+    return m_client.didNotHandleKeyEvent;
+}
+
 void WebUIClient::didNotHandleKeyEvent(WebPageProxy* page, const NativeWebKeyboardEvent& event)
 {
     if (!m_client.didNotHandleKeyEvent)
diff --git a/Source/WebKit2/UIProcess/WebUIClient.h b/Source/WebKit2/UIProcess/WebUIClient.h
index 8fcf7b6..196574a 100644
--- a/Source/WebKit2/UIProcess/WebUIClient.h
+++ b/Source/WebKit2/UIProcess/WebUIClient.h
@@ -56,6 +56,10 @@ public:
     void showPage(WebPageProxy*);
     void close(WebPageProxy*);
 
+    void takeFocus(WebPageProxy*, WKFocusDirection);
+    void focus(WebPageProxy*);
+    void unfocus(WebPageProxy*);
+
     void runJavaScriptAlert(WebPageProxy*, const String&, WebFrameProxy*);
     bool runJavaScriptConfirm(WebPageProxy*, const String&, WebFrameProxy*);
     String runJavaScriptPrompt(WebPageProxy*, const String&, const String&, WebFrameProxy*);
@@ -63,6 +67,8 @@ public:
     void setStatusText(WebPageProxy*, const String&);
     void mouseDidMoveOverElement(WebPageProxy*, WebEvent::Modifiers, APIObject*);
     void missingPluginButtonClicked(WebPageProxy*, const String& mimeType, const String& url, const String& pluginsPageURL);
+    
+    bool implementsDidNotHandleKeyEvent() const;
     void didNotHandleKeyEvent(WebPageProxy*, const NativeWebKeyboardEvent&);
 
     bool toolbarsAreVisible(WebPageProxy*);
diff --git a/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp b/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
index 718e3b8..73245dd 100644
--- a/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
+++ b/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
@@ -54,18 +54,18 @@ CFDictionaryRef WebBackForwardList::createCFDictionaryRepresentation(WebPageProx
 {
     ASSERT(m_current == NoCurrentItemIndex || m_current < m_entries.size());
 
-    RetainPtr<CFNumberRef> currentIndex(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &m_current));    
     RetainPtr<CFMutableArrayRef> entries(AdoptCF, CFArrayCreateMutable(0, m_entries.size(), &kCFTypeArrayCallBacks));
-    
-    const void* keys[2] = { SessionHistoryCurrentIndexKey(), SessionHistoryEntriesKey() };
-    const void* values[2] = { currentIndex.get(), entries.get() };
 
-    RetainPtr<CFDictionaryRef> dictionary(AdoptCF, CFDictionaryCreate(0, keys, values, 2, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+    // We may need to update the current index to account for entries that are filtered by the callback.
+    int currentIndex = m_current;
 
     for (size_t i = 0; i < m_entries.size(); ++i) {
         RefPtr<WebURL> webURL = WebURL::create(m_entries[i]->url());
-        if (filter && !filter(toAPI(m_page), WKPageGetSessionHistoryURLValueType(), toURLRef(m_entries[i]->originalURL().impl()), context))
+        if (filter && !filter(toAPI(m_page), WKPageGetSessionHistoryURLValueType(), toURLRef(m_entries[i]->originalURL().impl()), context)) {
+            if (i <= static_cast<size_t>(currentIndex))
+                currentIndex--;
             continue;
+        }
         
         RetainPtr<CFStringRef> url(AdoptCF, m_entries[i]->url().createCFString());
         RetainPtr<CFStringRef> title(AdoptCF, m_entries[i]->title().createCFString());
@@ -78,8 +78,12 @@ CFDictionaryRef WebBackForwardList::createCFDictionaryRepresentation(WebPageProx
         RetainPtr<CFDictionaryRef> entryDictionary(AdoptCF, CFDictionaryCreate(0, keys, values, 4, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
         CFArrayAppendValue(entries.get(), entryDictionary.get());
     }
-    
-    return dictionary.leakRef();
+    RetainPtr<CFNumberRef> currentIndexNumber(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &currentIndex));
+
+    const void* keys[2] = { SessionHistoryCurrentIndexKey(), SessionHistoryEntriesKey() };
+    const void* values[2] = { currentIndexNumber.get(), entries.get() };
+
+    return CFDictionaryCreate(0, keys, values, 2, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 }
 
 bool WebBackForwardList::restoreFromCFDictionaryRepresentation(CFDictionaryRef dictionary)
diff --git a/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp b/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
index 45e77df..02b864b 100644
--- a/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
+++ b/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
@@ -180,4 +180,48 @@ void WebPageProxy::restoreFromSessionStateData(WebData* webData)
         loadURL(provisionalURL);
 }
 
+static RetainPtr<CFStringRef> autosaveKey(const String& name)
+{
+    String key = "com.apple.WebKit.searchField:" + name;
+    return RetainPtr<CFStringRef>(AdoptCF, key.createCFString());
+}
+
+void WebPageProxy::saveRecentSearches(const String& name, const Vector<String>& searchItems)
+{
+    // The WebProcess shouldn't have bothered to send this message if the name was empty.
+    ASSERT(!name.isEmpty());
+
+    RetainPtr<CFMutableArrayRef> items;
+
+    if (size_t size = searchItems.size()) {
+        items.adoptCF(CFArrayCreateMutable(0, size, &kCFTypeArrayCallBacks));
+        for (size_t i = 0; i < size; ++i) {
+            RetainPtr<CFStringRef> item(AdoptCF, searchItems[i].createCFString());
+            CFArrayAppendValue(items.get(), item.get());
+        }
+    }
+
+    CFPreferencesSetAppValue(autosaveKey(name).get(), items.get(), kCFPreferencesCurrentApplication);
+    CFPreferencesAppSynchronize(kCFPreferencesCurrentApplication);
+}
+
+void WebPageProxy::loadRecentSearches(const String& name, Vector<String>& searchItems)
+{
+    // The WebProcess shouldn't have bothered to send this message if the name was empty.
+    ASSERT(!name.isEmpty());
+
+    searchItems.clear();
+    RetainPtr<CFArrayRef> items(AdoptCF, reinterpret_cast<CFArrayRef>(CFPreferencesCopyAppValue(autosaveKey(name).get(), kCFPreferencesCurrentApplication)));
+
+    if (!items || CFGetTypeID(items.get()) != CFArrayGetTypeID())
+        return;
+
+    size_t size = CFArrayGetCount(items.get());
+    for (size_t i = 0; i < size; ++i) {
+        CFStringRef item = (CFStringRef)CFArrayGetValueAtIndex(items.get(), i);
+        if (CFGetTypeID(item) == CFStringGetTypeID())
+            searchItems.append(item);
+    }
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/cf/WebPreferencesCF.cpp b/Source/WebKit2/UIProcess/cf/WebPreferencesCF.cpp
index 1b7c2dc..5f6ca9d 100644
--- a/Source/WebKit2/UIProcess/cf/WebPreferencesCF.cpp
+++ b/Source/WebKit2/UIProcess/cf/WebPreferencesCF.cpp
@@ -26,28 +26,119 @@
 #include "config.h"
 #include "WebPreferences.h"
 
+#include <wtf/RetainPtr.h>
+#include <wtf/text/StringConcatenate.h>
+
 #if !PLATFORM(MAC)
 
 namespace WebKit {
 
+static RetainPtr<CFStringRef> cfStringFromWebCoreString(const String& string)
+{
+    return RetainPtr<CFStringRef>(AdoptCF, CFStringCreateWithCharacters(0, reinterpret_cast<const UniChar*>(string.characters()), string.length()));
+}
+
+static inline RetainPtr<CFStringRef> makeKey(const String& identifier, const String& baseKey)
+{
+    return cfStringFromWebCoreString(makeString(identifier, ".WebKit2", baseKey));
+}
+
+static void setStringValueIfInUserDefaults(const String& identifier, const String& baseKey, WebPreferencesStore& store)
+{
+    RetainPtr<CFPropertyListRef> value(AdoptCF, CFPreferencesCopyAppValue(makeKey(identifier, baseKey).get(), kCFPreferencesCurrentApplication));
+    if (!value)
+        return;
+    if (CFGetTypeID(value.get()) != CFStringGetTypeID())
+        return;
+
+    store.setStringValueForKey(baseKey, (CFStringRef)value.get());
+}
+
+static void setBoolValueIfInUserDefaults(const String& identifier, const String& baseKey, WebPreferencesStore& store)
+{
+    RetainPtr<CFPropertyListRef> value(AdoptCF, CFPreferencesCopyAppValue(makeKey(identifier, baseKey).get(), kCFPreferencesCurrentApplication));
+    if (!value)
+        return;
+    if (CFGetTypeID(value.get()) != CFBooleanGetTypeID())
+        return;
+
+    store.setBoolValueForKey(baseKey, CFBooleanGetValue((CFBooleanRef)value.get()) ? true : false);
+}
+
+static void setUInt32ValueIfInUserDefaults(const String& identifier, const String& baseKey, WebPreferencesStore& store)
+{
+    RetainPtr<CFPropertyListRef> value(AdoptCF, CFPreferencesCopyAppValue(makeKey(identifier, baseKey).get(), kCFPreferencesCurrentApplication));
+    if (!value)
+        return;
+    if (CFGetTypeID(value.get()) != CFNumberGetTypeID())
+        return;
+    int32_t intValue = 0;
+    if (!CFNumberGetValue((CFNumberRef)value.get(), kCFNumberSInt32Type, &intValue))
+        return;
+
+    store.setUInt32ValueForKey(baseKey, intValue);
+}
+
+static void setDoubleValueIfInUserDefaults(const String& identifier, const String& baseKey, WebPreferencesStore& store)
+{
+    RetainPtr<CFPropertyListRef> value(AdoptCF, CFPreferencesCopyAppValue(makeKey(identifier, baseKey).get(), kCFPreferencesCurrentApplication));
+    if (!value)
+        return;
+    if (CFGetTypeID(value.get()) != CFNumberGetTypeID())
+        return;
+    double doubleValue = 0;
+    if (!CFNumberGetValue((CFNumberRef)value.get(), kCFNumberDoubleType, &doubleValue))
+        return;
+
+    store.setDoubleValueForKey(baseKey, doubleValue);
+}
+
 void WebPreferences::platformInitializeStore()
 {
+    if (!m_identifier)
+        return;
+
+#define INITIALIZE_PREFERENCE_FROM_NSUSERDEFAULTS(KeyUpper, KeyLower, TypeName, Type, DefaultValue) \
+    set##TypeName##ValueIfInUserDefaults(m_identifier, WebPreferencesKey::KeyLower##Key(), m_store);
+
+    FOR_EACH_WEBKIT_PREFERENCE(INITIALIZE_PREFERENCE_FROM_NSUSERDEFAULTS)
+
+#undef INITIALIZE_PREFERENCE_FROM_NSUSERDEFAULTS
+
 }
 
-void WebPreferences::platformUpdateStringValueForKey(const String&, const String&)
+void WebPreferences::platformUpdateStringValueForKey(const String& key, const String& value)
 {
+    if (!m_identifier)
+        return;
+
+    CFPreferencesSetAppValue(makeKey(m_identifier, key).get(), cfStringFromWebCoreString(value).get(), kCFPreferencesCurrentApplication);
 }
 
-void WebPreferences::platformUpdateBoolValueForKey(const String&, bool)
+void WebPreferences::platformUpdateBoolValueForKey(const String& key, bool value)
 {
+    if (!m_identifier)
+        return;
+
+    CFPreferencesSetAppValue(makeKey(m_identifier, key).get(), value ? kCFBooleanTrue : kCFBooleanFalse, kCFPreferencesCurrentApplication);
 }
 
-void WebPreferences::platformUpdateUInt32ValueForKey(const String&, uint32_t)
+void WebPreferences::platformUpdateUInt32ValueForKey(const String& key, uint32_t value)
 {
+    if (!m_identifier)
+        return;
+
+    RetainPtr<CFNumberRef> number(AdoptCF, CFNumberCreate(0, kCFNumberSInt32Type, &value));
+    CFPreferencesSetAppValue(makeKey(m_identifier, key).get(), number.get(), kCFPreferencesCurrentApplication);
 }
 
-void WebPreferences::platformUpdateDoubleValueForKey(const String&, double)
+void WebPreferences::platformUpdateDoubleValueForKey(const String& key, double value)
 {
+    if (!m_identifier)
+        return;
+
+    RetainPtr<CFNumberRef> number(AdoptCF, CFNumberCreate(0, kCFNumberDoubleType, &value));
+    CFPreferencesSetAppValue(makeKey(m_identifier, key).get(), number.get(), kCFPreferencesCurrentApplication);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/gtk/ChunkedUpdateDrawingAreaProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/ChunkedUpdateDrawingAreaProxyGtk.cpp
index a5c708f..89a9ef7 100644
--- a/Source/WebKit2/UIProcess/gtk/ChunkedUpdateDrawingAreaProxyGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/ChunkedUpdateDrawingAreaProxyGtk.cpp
@@ -32,7 +32,7 @@
 #include "UpdateChunk.h"
 #include "WebProcessProxy.h"
 #include "WebView.h"
-
+#include <WebCore/GtkVersioning.h>
 #include <gdk/gdk.h>
 
 using namespace WebCore;
diff --git a/Source/WebKit2/UIProcess/gtk/TextCheckerGtk.cpp b/Source/WebKit2/UIProcess/gtk/TextCheckerGtk.cpp
index 6a6715a..118bee1 100644
--- a/Source/WebKit2/UIProcess/gtk/TextCheckerGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/TextCheckerGtk.cpp
@@ -58,7 +58,7 @@ void TextChecker::setGrammarCheckingEnabled(bool isGrammarCheckingEnabled)
     notImplemented();
 }
 
-int64_t TextChecker::uniqueSpellDocumentTag()
+int64_t TextChecker::uniqueSpellDocumentTag(WebPageProxy*)
 {
     notImplemented();
     return 0;
@@ -69,18 +69,33 @@ void TextChecker::closeSpellDocumentWithTag(int64_t)
     notImplemented();
 }
 
-Vector<TextCheckingResult> TextChecker::checkTextOfParagraph(int64_t spellDocumentTag, const UChar* text, int length, uint64_t checkingTypes)
+void TextChecker::checkSpellingOfString(int64_t, const UChar*, uint32_t, int32_t&, int32_t&)
 {
     notImplemented();
-    return Vector<WebCore::TextCheckingResult>();
 }
 
-void TextChecker::updateSpellingUIWithMisspelledWord(const String& misspelledWord)
+void TextChecker::checkGrammarOfString(int64_t, const UChar*, uint32_t, Vector<WebCore::GrammarDetail>&, int32_t&, int32_t&)
 {
     notImplemented();
 }
 
-void TextChecker::updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
+bool TextChecker::spellingUIIsShowing()
+{
+    notImplemented();
+    return false;
+}
+
+void TextChecker::toggleSpellingUIIsShowing()
+{
+    notImplemented();
+}
+
+void TextChecker::updateSpellingUIWithMisspelledWord(int64_t, const String&)
+{
+    notImplemented();
+}
+
+void TextChecker::updateSpellingUIWithGrammarString(int64_t, const String&, const GrammarDetail&)
 {
     notImplemented();
 }
@@ -90,7 +105,7 @@ void TextChecker::getGuessesForWord(int64_t spellDocumentTag, const String& word
     notImplemented();
 }
 
-void TextChecker::learnWord(const String& word)
+void TextChecker::learnWord(int64_t, const String&)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/UIProcess/gtk/WebPageProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebPageProxyGtk.cpp
index 838de97..8945d13 100644
--- a/Source/WebKit2/UIProcess/gtk/WebPageProxyGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebPageProxyGtk.cpp
@@ -27,6 +27,10 @@
 #include "config.h"
 #include "WebPageProxy.h"
 
+#include "NativeWebKeyboardEvent.h"
+#include "NotImplemented.h"
+#include "PageClient.h"
+
 namespace WebKit {
 
 String WebPageProxy::standardUserAgent(const String& applicationNameForUserAgent)
@@ -35,4 +39,19 @@ String WebPageProxy::standardUserAgent(const String& applicationNameForUserAgent
     return "Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.7 (KHTML, like Gecko) Version/5.0 Safari/534.7";
 }
 
+void WebPageProxy::getEditorCommandsForKeyEvent(Vector<WTF::String>& commandsList)
+{
+    m_pageClient->getEditorCommandsForKeyEvent(m_keyEventQueue.first(), commandsList);
+}
+
+void WebPageProxy::saveRecentSearches(const String&, const Vector<String>&)
+{
+    notImplemented();
+}
+
+void WebPageProxy::loadRecentSearches(const String&, Vector<String>&)
+{
+    notImplemented();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/gtk/WebView.cpp b/Source/WebKit2/UIProcess/gtk/WebView.cpp
index 2ff67cd..aa45c62 100644
--- a/Source/WebKit2/UIProcess/gtk/WebView.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebView.cpp
@@ -30,6 +30,7 @@
 
 #include "ChunkedUpdateDrawingAreaProxy.h"
 #include "NativeWebKeyboardEvent.h"
+#include "NativeWebMouseEvent.h"
 #include "NotImplemented.h"
 #include "WebContext.h"
 #include "WebContextMenuProxy.h"
@@ -38,11 +39,12 @@
 #include "WebPageProxy.h"
 #include <wtf/text/WTFString.h>
 
+typedef HashMap<int, const char*> IntConstCharHashMap;
+
 using namespace WebCore;
 
 namespace WebKit {
 
-
 void WebView::handleFocusInEvent(GtkWidget* widget)
 {
     if (!(m_isPageActive)) {
@@ -59,8 +61,185 @@ void WebView::handleFocusOutEvent(GtkWidget* widget)
     m_page->viewStateDidChange(WebPageProxy::ViewWindowIsActive);
 }
 
+
+static void backspaceCallback(GtkWidget* widget, WebView* client)
+{
+    g_signal_stop_emission_by_name(widget, "backspace");
+    client->addPendingEditorCommand("DeleteBackward");
+}
+
+static void selectAllCallback(GtkWidget* widget, gboolean select, WebView* client)
+{
+    g_signal_stop_emission_by_name(widget, "select-all");
+    client->addPendingEditorCommand(select ? "SelectAll" : "Unselect");
+}
+
+static void cutClipboardCallback(GtkWidget* widget, WebView* client)
+{
+    g_signal_stop_emission_by_name(widget, "cut-clipboard");
+    client->addPendingEditorCommand("Cut");
+}
+
+static void copyClipboardCallback(GtkWidget* widget, WebView* client)
+{
+    g_signal_stop_emission_by_name(widget, "copy-clipboard");
+    client->addPendingEditorCommand("Copy");
+}
+
+static void pasteClipboardCallback(GtkWidget* widget, WebView* client)
+{
+    g_signal_stop_emission_by_name(widget, "paste-clipboard");
+    client->addPendingEditorCommand("Paste");
+}
+
+static void toggleOverwriteCallback(GtkWidget* widget, EditorClient*)
+{
+    // We don't support toggling the overwrite mode, but the default callback expects
+    // the GtkTextView to have a layout, so we handle this signal just to stop it.
+    g_signal_stop_emission_by_name(widget, "toggle-overwrite");
+}
+
+// GTK+ will still send these signals to the web view. So we can safely stop signal
+// emission without breaking accessibility.
+static void popupMenuCallback(GtkWidget* widget, EditorClient*)
+{
+    g_signal_stop_emission_by_name(widget, "popup-menu");
+}
+
+static void showHelpCallback(GtkWidget* widget, EditorClient*)
+{
+    g_signal_stop_emission_by_name(widget, "show-help");
+}
+
+static const char* const gtkDeleteCommands[][2] = {
+    { "DeleteBackward",               "DeleteForward"                        }, // Characters
+    { "DeleteWordBackward",           "DeleteWordForward"                    }, // Word ends
+    { "DeleteWordBackward",           "DeleteWordForward"                    }, // Words
+    { "DeleteToBeginningOfLine",      "DeleteToEndOfLine"                    }, // Lines
+    { "DeleteToBeginningOfLine",      "DeleteToEndOfLine"                    }, // Line ends
+    { "DeleteToBeginningOfParagraph", "DeleteToEndOfParagraph"               }, // Paragraph ends
+    { "DeleteToBeginningOfParagraph", "DeleteToEndOfParagraph"               }, // Paragraphs
+    { 0,                              0                                      } // Whitespace (M-\ in Emacs)
+};
+
+static void deleteFromCursorCallback(GtkWidget* widget, GtkDeleteType deleteType, gint count, WebView* client)
+{
+    g_signal_stop_emission_by_name(widget, "delete-from-cursor");
+    int direction = count > 0 ? 1 : 0;
+
+    // Ensuring that deleteType <= G_N_ELEMENTS here results in a compiler warning
+    // that the condition is always true.
+
+    if (deleteType == GTK_DELETE_WORDS) {
+        if (!direction) {
+            client->addPendingEditorCommand("MoveWordForward");
+            client->addPendingEditorCommand("MoveWordBackward");
+        } else {
+            client->addPendingEditorCommand("MoveWordBackward");
+            client->addPendingEditorCommand("MoveWordForward");
+        }
+    } else if (deleteType == GTK_DELETE_DISPLAY_LINES) {
+        if (!direction)
+            client->addPendingEditorCommand("MoveToBeginningOfLine");
+        else
+            client->addPendingEditorCommand("MoveToEndOfLine");
+    } else if (deleteType == GTK_DELETE_PARAGRAPHS) {
+        if (!direction)
+            client->addPendingEditorCommand("MoveToBeginningOfParagraph");
+        else
+            client->addPendingEditorCommand("MoveToEndOfParagraph");
+    }
+
+    const char* rawCommand = gtkDeleteCommands[deleteType][direction];
+    if (!rawCommand)
+      return;
+
+    for (int i = 0; i < abs(count); i++)
+        client->addPendingEditorCommand(rawCommand);
+}
+
+static const char* const gtkMoveCommands[][4] = {
+    { "MoveBackward",                                   "MoveForward",
+      "MoveBackwardAndModifySelection",                 "MoveForwardAndModifySelection"             }, // Forward/backward grapheme
+    { "MoveLeft",                                       "MoveRight",
+      "MoveBackwardAndModifySelection",                 "MoveForwardAndModifySelection"             }, // Left/right grapheme
+    { "MoveWordBackward",                               "MoveWordForward",
+      "MoveWordBackwardAndModifySelection",             "MoveWordForwardAndModifySelection"         }, // Forward/backward word
+    { "MoveUp",                                         "MoveDown",
+      "MoveUpAndModifySelection",                       "MoveDownAndModifySelection"                }, // Up/down line
+    { "MoveToBeginningOfLine",                          "MoveToEndOfLine",
+      "MoveToBeginningOfLineAndModifySelection",        "MoveToEndOfLineAndModifySelection"         }, // Up/down line ends
+    { "MoveParagraphForward",                           "MoveParagraphBackward",
+      "MoveParagraphForwardAndModifySelection",         "MoveParagraphBackwardAndModifySelection"   }, // Up/down paragraphs
+    { "MoveToBeginningOfParagraph",                     "MoveToEndOfParagraph",
+      "MoveToBeginningOfParagraphAndModifySelection",   "MoveToEndOfParagraphAndModifySelection"    }, // Up/down paragraph ends.
+    { "MovePageUp",                                     "MovePageDown",
+      "MovePageUpAndModifySelection",                   "MovePageDownAndModifySelection"            }, // Up/down page
+    { "MoveToBeginningOfDocument",                      "MoveToEndOfDocument",
+      "MoveToBeginningOfDocumentAndModifySelection",    "MoveToEndOfDocumentAndModifySelection"     }, // Begin/end of buffer
+    { 0,                                                0,
+      0,                                                0                                           } // Horizontal page movement
+};
+
+static void moveCursorCallback(GtkWidget* widget, GtkMovementStep step, gint count, gboolean extendSelection, WebView* client)
+{
+    g_signal_stop_emission_by_name(widget, "move-cursor");
+    int direction = count > 0 ? 1 : 0;
+    if (extendSelection)
+        direction += 2;
+
+    if (static_cast<unsigned>(step) >= G_N_ELEMENTS(gtkMoveCommands))
+        return;
+
+    const char* rawCommand = gtkMoveCommands[step][direction];
+    if (!rawCommand)
+        return;
+
+    for (int i = 0; i < abs(count); i++)
+        client->addPendingEditorCommand(rawCommand);
+}
+
+static const unsigned CtrlKey = 1 << 0;
+static const unsigned AltKey = 1 << 1;
+static const unsigned ShiftKey = 1 << 2;
+
+struct KeyDownEntry {
+    unsigned virtualKey;
+    unsigned modifiers;
+    const char* name;
+};
+
+struct KeyPressEntry {
+    unsigned charCode;
+    unsigned modifiers;
+    const char* name;
+};
+
+static const KeyDownEntry keyDownEntries[] = {
+    { 'B',       CtrlKey,            "ToggleBold"                                  },
+    { 'I',       CtrlKey,            "ToggleItalic"                                },
+    { VK_ESCAPE, 0,                  "Cancel"                                      },
+    { VK_OEM_PERIOD, CtrlKey,        "Cancel"                                      },
+    { VK_TAB,    0,                  "InsertTab"                                   },
+    { VK_TAB,    ShiftKey,           "InsertBacktab"                               },
+    { VK_RETURN, 0,                  "InsertNewline"                               },
+    { VK_RETURN, CtrlKey,            "InsertNewline"                               },
+    { VK_RETURN, AltKey,             "InsertNewline"                               },
+    { VK_RETURN, AltKey | ShiftKey,  "InsertNewline"                               },
+};
+
+static const KeyPressEntry keyPressEntries[] = {
+    { '\t',   0,                  "InsertTab"                                   },
+    { '\t',   ShiftKey,           "InsertBacktab"                               },
+    { '\r',   0,                  "InsertNewline"                               },
+    { '\r',   CtrlKey,            "InsertNewline"                               },
+    { '\r',   AltKey,             "InsertNewline"                               },
+    { '\r',   AltKey | ShiftKey,  "InsertNewline"                               },
+};
+
 WebView::WebView(WebContext* context, WebPageGroup* pageGroup)
     : m_isPageActive(true)
+    , m_nativeWidget(gtk_text_view_new())
 {
     m_page = context->createWebPage(this, pageGroup);
 
@@ -71,6 +250,17 @@ WebView::WebView(WebContext* context, WebPageGroup* pageGroup)
 
     WebViewWidget* webViewWidget = WEB_VIEW_WIDGET(m_viewWidget);
     webViewWidgetSetWebViewInstance(webViewWidget, this);
+
+    g_signal_connect(m_nativeWidget.get(), "backspace", G_CALLBACK(backspaceCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "cut-clipboard", G_CALLBACK(cutClipboardCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "copy-clipboard", G_CALLBACK(copyClipboardCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "paste-clipboard", G_CALLBACK(pasteClipboardCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "select-all", G_CALLBACK(selectAllCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "move-cursor", G_CALLBACK(moveCursorCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "delete-from-cursor", G_CALLBACK(deleteFromCursorCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "toggle-overwrite", G_CALLBACK(toggleOverwriteCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "popup-menu", G_CALLBACK(popupMenuCallback), this);
+    g_signal_connect(m_nativeWidget.get(), "show-help", G_CALLBACK(showHelpCallback), this);
 }
 
 WebView::~WebView()
@@ -99,7 +289,7 @@ void WebView::handleKeyboardEvent(GdkEventKey* event)
 
 void WebView::handleMouseEvent(GdkEvent* event, int currentClickCount)
 {
-    m_page->handleMouseEvent(WebEventFactory::createWebMouseEvent(event, currentClickCount));
+    m_page->handleMouseEvent(NativeWebMouseEvent(event, currentClickCount));
 }
 
 void WebView::handleWheelEvent(GdkEventScroll* event)
@@ -107,6 +297,52 @@ void WebView::handleWheelEvent(GdkEventScroll* event)
     m_page->handleWheelEvent(WebEventFactory::createWebWheelEvent(event));
 }
 
+void WebView::getEditorCommandsForKeyEvent(const NativeWebKeyboardEvent& event, Vector<WTF::String>& commandList)
+{
+    m_pendingEditorCommands.clear();
+
+#ifdef GTK_API_VERSION_2
+    gtk_bindings_activate_event(GTK_OBJECT(m_nativeWidget.get()), const_cast<GdkEventKey*>(&event.nativeEvent()->key));
+#else
+    gtk_bindings_activate_event(G_OBJECT(m_nativeWidget.get()), const_cast<GdkEventKey*>(&event.nativeEvent()->key));
+#endif
+
+    if (m_pendingEditorCommands.isEmpty()) {
+        commandList.append(m_pendingEditorCommands);
+        return;
+    }
+
+    DEFINE_STATIC_LOCAL(IntConstCharHashMap, keyDownCommandsMap, ());
+    DEFINE_STATIC_LOCAL(IntConstCharHashMap, keyPressCommandsMap, ());
+
+    if (keyDownCommandsMap.isEmpty()) {
+        for (unsigned i = 0; i < G_N_ELEMENTS(keyDownEntries); i++)
+            keyDownCommandsMap.set(keyDownEntries[i].modifiers << 16 | keyDownEntries[i].virtualKey, keyDownEntries[i].name);
+
+        for (unsigned i = 0; i < G_N_ELEMENTS(keyPressEntries); i++)
+            keyPressCommandsMap.set(keyPressEntries[i].modifiers << 16 | keyPressEntries[i].charCode, keyPressEntries[i].name);
+    }
+
+    unsigned modifiers = 0;
+    if (event.shiftKey())
+        modifiers |= ShiftKey;
+    if (event.altKey())
+        modifiers |= AltKey;
+    if (event.controlKey())
+        modifiers |= CtrlKey;
+
+    // For keypress events, we want charCode(), but keyCode() does that.
+    int mapKey = modifiers << 16 | event.nativeVirtualKeyCode();
+    if (mapKey) {
+        HashMap<int, const char*>* commandMap = event.type() == WebEvent::KeyDown ?
+            &keyDownCommandsMap : &keyPressCommandsMap;
+        if (const char* commandString = commandMap->get(mapKey))
+            m_pendingEditorCommands.append(commandString);
+    }
+
+    commandList.append(m_pendingEditorCommands);
+}
+
 bool WebView::isActive()
 {
     return m_isPageActive;
@@ -179,11 +415,6 @@ void WebView::didRelaunchProcess()
     notImplemented();
 }
 
-void WebView::setFocus(bool)
-{
-    notImplemented();
-}
-
 void WebView::takeFocus(bool)
 {
     notImplemented();
@@ -222,6 +453,17 @@ void WebView::clearAllEditCommands()
     notImplemented();
 }
 
+bool WebView::canUndoRedo(WebPageProxy::UndoOrRedo)
+{
+    notImplemented();
+    return false;
+}
+
+void WebView::executeUndoRedo(WebPageProxy::UndoOrRedo)
+{
+    notImplemented();
+}
+
 FloatRect WebView::convertToDeviceSpace(const FloatRect& viewRect)
 {
     notImplemented();
@@ -312,5 +554,14 @@ void WebView::flashBackingStoreUpdates(const Vector<IntRect>&)
     notImplemented();
 }
 
+void WebView::findStringInCustomRepresentation(const String&, FindOptions, unsigned)
+{
+    notImplemented();
+}
+
+void WebView::countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned)
+{
+    notImplemented();
+}
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/gtk/WebView.h b/Source/WebKit2/UIProcess/gtk/WebView.h
index 6c281ed..6cef14c 100644
--- a/Source/WebKit2/UIProcess/gtk/WebView.h
+++ b/Source/WebKit2/UIProcess/gtk/WebView.h
@@ -30,6 +30,7 @@
 
 #include "PageClient.h"
 #include "WebPageProxy.h"
+#include "WindowsKeyboardCodes.h"
 #include <WebCore/IntSize.h>
 #include <gdk/gdk.h>
 #include <glib.h>
@@ -64,6 +65,8 @@ public:
     void handleWheelEvent(GdkEventScroll*);
     void handleMouseEvent(GdkEvent*, int);
 
+    void addPendingEditorCommand(const char* command) { m_pendingEditorCommands.append(WTF::String(command)); }
+
 private:
     WebView(WebContext*, WebPageGroup*);
 
@@ -85,13 +88,14 @@ private:
     virtual void processDidCrash();
     virtual void didRelaunchProcess();
     virtual void pageClosed();
-    virtual void setFocus(bool focused);
     virtual void takeFocus(bool direction);
     virtual void toolTipChanged(const WTF::String&, const WTF::String&);
     virtual void setCursor(const WebCore::Cursor&);
     virtual void setViewportArguments(const WebCore::ViewportArguments&);
     virtual void registerEditCommand(PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo);
     virtual void clearAllEditCommands();
+    virtual bool canUndoRedo(WebPageProxy::UndoOrRedo);
+    virtual void executeUndoRedo(WebPageProxy::UndoOrRedo);
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&);
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&);
     virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&);
@@ -103,6 +107,9 @@ private:
     virtual void didChangeScrollbarsForMainFrame() const;
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects);
     virtual float userSpaceScaleFactor() const { return 1; }
+    virtual void getEditorCommandsForKeyEvent(const NativeWebKeyboardEvent&, Vector<WTF::String>&);
+    virtual void findStringInCustomRepresentation(const String&, FindOptions, unsigned);
+    virtual void countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned);
 
 #if USE(ACCELERATED_COMPOSITING)
     virtual void pageDidEnterAcceleratedCompositing();
@@ -118,6 +125,8 @@ private:
     GtkWidget* m_viewWidget;
     bool m_isPageActive;
     RefPtr<WebPageProxy> m_page;
+    Vector<WTF::String> m_pendingEditorCommands;
+    GRefPtr<GtkWidget> m_nativeWidget;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/CorrectionPanel.h b/Source/WebKit2/UIProcess/mac/CorrectionPanel.h
index d4bc353..85a98ef 100644
--- a/Source/WebKit2/UIProcess/mac/CorrectionPanel.h
+++ b/Source/WebKit2/UIProcess/mac/CorrectionPanel.h
@@ -27,8 +27,8 @@
 #define CorrectionPanel_h
 
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
-#import <AppKit/NSTextChecker.h>
-#import <WebCore/CorrectionPanelInfo.h>
+#import <AppKit/NSSpellChecker.h>
+#import <WebCore/SpellingCorrectionController.h>
 #import <wtf/RetainPtr.h>
 
 @class WKView;
@@ -47,7 +47,7 @@ public:
 private:
     bool isShowing() const { return m_view; }
     void dismissInternal(WebCore::ReasonForDismissingCorrectionPanel, bool dismissingExternally);
-    void handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement, NSCorrectionBubbleType);
+    void handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement, NSCorrectionIndicatorType);
 
     bool m_wasDismissedExternally;
     WebCore::ReasonForDismissingCorrectionPanel m_reasonForDismissing;
diff --git a/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm b/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm
index ab6818f..0fc520b 100644
--- a/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm
+++ b/Source/WebKit2/UIProcess/mac/CorrectionPanel.mm
@@ -33,18 +33,18 @@
 
 using namespace WebCore;
 
-static inline NSCorrectionBubbleType correctionBubbleType(CorrectionPanelInfo::PanelType panelType)
+static inline NSCorrectionIndicatorType correctionIndicatorType(CorrectionPanelInfo::PanelType panelType)
 {
     switch (panelType) {
     case CorrectionPanelInfo::PanelTypeCorrection:
-        return NSCorrectionBubbleTypeCorrection;
+        return NSCorrectionIndicatorTypeDefault;
     case CorrectionPanelInfo::PanelTypeReversion:
-        return NSCorrectionBubbleTypeReversion;
+        return NSCorrectionIndicatorTypeReversion;
     case CorrectionPanelInfo::PanelTypeSpellingSuggestions:
-        return NSCorrectionBubbleTypeGuesses;
+        return NSCorrectionIndicatorTypeGuesses;
     }
     ASSERT_NOT_REACHED();
-    return NSCorrectionBubbleTypeCorrection;
+    return NSCorrectionIndicatorTypeDefault;
 }
 
 namespace WebKit {
@@ -71,7 +71,7 @@ void CorrectionPanel::show(WKView* view, CorrectionPanelInfo::PanelType type, co
     NSString* replacedStringAsNSString = replacedString;
     NSString* replacementStringAsNSString = replacementString;
     m_view = view;
-    NSCorrectionBubbleType bubbleType = correctionBubbleType(type);
+    NSCorrectionIndicatorType indicatorType = correctionIndicatorType(type);
     
     NSMutableArray* alternativeStrings = 0;
     if (!alternativeReplacementStrings.isEmpty()) {
@@ -82,8 +82,8 @@ void CorrectionPanel::show(WKView* view, CorrectionPanelInfo::PanelType type, co
     }
 
     NSSpellChecker* spellChecker = [NSSpellChecker sharedSpellChecker];
-    [spellChecker showCorrectionBubbleOfType:bubbleType primaryString:replacementStringAsNSString alternativeStrings:alternativeStrings forStringInRect:boundingBoxOfReplacedString view:m_view.get() completionHandler:^(NSString* acceptedString) {
-        handleAcceptedReplacement(acceptedString, replacedStringAsNSString, replacementStringAsNSString, bubbleType);
+    [spellChecker showCorrectionIndicatorOfType:indicatorType primaryString:replacementStringAsNSString alternativeStrings:alternativeStrings forStringInRect:boundingBoxOfReplacedString view:m_view.get() completionHandler:^(NSString* acceptedString) {
+        handleAcceptedReplacement(acceptedString, replacedStringAsNSString, replacementStringAsNSString, indicatorType);
     }];
 }
 
@@ -113,7 +113,7 @@ void CorrectionPanel::dismissInternal(ReasonForDismissingCorrectionPanel reason,
     
     m_reasonForDismissing = reason;
     m_resultForSynchronousDismissal.clear();
-    [[NSSpellChecker sharedSpellChecker] dismissCorrectionBubbleForView:m_view.get()];
+    [[NSSpellChecker sharedSpellChecker] dismissCorrectionIndicatorForView:m_view.get()];
     m_view.clear();
 }
 
@@ -122,13 +122,13 @@ void CorrectionPanel::recordAutocorrectionResponse(WKView* view, NSCorrectionRes
     [[NSSpellChecker sharedSpellChecker] recordResponse:response toCorrection:replacementString forWord:replacedString language:nil inSpellDocumentWithTag:[view spellCheckerDocumentTag]];
 }
 
-void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement,  NSCorrectionBubbleType correctionBubbleType)
+void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, NSString* replaced, NSString* proposedReplacement,  NSCorrectionIndicatorType correctionIndicatorType)
 {
     NSSpellChecker* spellChecker = [NSSpellChecker sharedSpellChecker];
     NSInteger documentTag = [m_view.get() spellCheckerDocumentTag];
     
-    switch (correctionBubbleType) {
-    case NSCorrectionBubbleTypeCorrection:
+    switch (correctionIndicatorType) {
+    case NSCorrectionIndicatorTypeDefault:
         if (acceptedReplacement)
             [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
         else {
@@ -138,11 +138,11 @@ void CorrectionPanel::handleAcceptedReplacement(NSString* acceptedReplacement, N
                 [spellChecker recordResponse:NSCorrectionResponseIgnored toCorrection:proposedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
         }
         break;
-    case NSCorrectionBubbleTypeReversion:
+    case NSCorrectionIndicatorTypeReversion:
         if (acceptedReplacement)
             [spellChecker recordResponse:NSCorrectionResponseReverted toCorrection:replaced forWord:acceptedReplacement language:nil inSpellDocumentWithTag:documentTag];
         break;
-    case NSCorrectionBubbleTypeGuesses:
+    case NSCorrectionIndicatorTypeGuesses:
         if (acceptedReplacement)
             [spellChecker recordResponse:NSCorrectionResponseAccepted toCorrection:acceptedReplacement forWord:replaced language:nil inSpellDocumentWithTag:documentTag];
         break;
diff --git a/Source/WebKit2/UIProcess/mac/TextCheckerMac.mm b/Source/WebKit2/UIProcess/mac/TextCheckerMac.mm
index cef3a55..29493f9 100644
--- a/Source/WebKit2/UIProcess/mac/TextCheckerMac.mm
+++ b/Source/WebKit2/UIProcess/mac/TextCheckerMac.mm
@@ -27,10 +27,13 @@
 #import "TextChecker.h"
 
 #import "TextCheckerState.h"
+#import <WebCore/NotImplemented.h>
 #import <wtf/RetainPtr.h>
 
 #ifndef BUILDING_ON_SNOW_LEOPARD
-#import <AppKit/NSTextChecker.h>
+@interface NSSpellChecker (WebNSSpellCheckerDetails)
+- (NSString *)languageForWordRange:(NSRange)range inString:(NSString *)string orthography:(NSOrthography *)orthography;
+@end
 #endif
 
 static NSString* const WebAutomaticSpellingCorrectionEnabled = @"WebAutomaticSpellingCorrectionEnabled";
@@ -195,7 +198,22 @@ void TextChecker::setSmartInsertDeleteEnabled(bool flag)
     [[NSUserDefaults standardUserDefaults] setBool:flag forKey:WebSmartInsertDeleteEnabled];
 }
 
-int64_t TextChecker::uniqueSpellDocumentTag()
+bool TextChecker::substitutionsPanelIsShowing()
+{
+    return [[[NSSpellChecker sharedSpellChecker] substitutionsPanel] isVisible];
+}
+
+void TextChecker::toggleSubstitutionsPanelIsShowing()
+{
+    NSPanel *substitutionsPanel = [[NSSpellChecker sharedSpellChecker] substitutionsPanel];
+    if ([substitutionsPanel isVisible]) {
+        [substitutionsPanel orderOut:nil];
+        return;
+    }
+    [substitutionsPanel orderFront:nil];
+}
+
+int64_t TextChecker::uniqueSpellDocumentTag(WebPageProxy*)
 {
     return [NSSpellChecker uniqueSpellDocumentTag];
 }
@@ -205,6 +223,8 @@ void TextChecker::closeSpellDocumentWithTag(int64_t tag)
     [[NSSpellChecker sharedSpellChecker] closeSpellDocumentWithTag:tag];
 }
 
+#if USE(UNIFIED_TEXT_CHECKING)
+
 Vector<TextCheckingResult> TextChecker::checkTextOfParagraph(int64_t spellDocumentTag, const UChar* text, int length, uint64_t checkingTypes)
 {
     Vector<TextCheckingResult> results;
@@ -292,12 +312,40 @@ Vector<TextCheckingResult> TextChecker::checkTextOfParagraph(int64_t spellDocume
     return results;
 }
 
-void TextChecker::updateSpellingUIWithMisspelledWord(const String& misspelledWord)
+#endif
+
+void TextChecker::checkSpellingOfString(int64_t, const UChar*, uint32_t, int32_t&, int32_t&)
+{
+    // Mac uses checkTextOfParagraph instead.
+    notImplemented();
+}
+
+void TextChecker::checkGrammarOfString(int64_t, const UChar*, uint32_t, Vector<WebCore::GrammarDetail>&, int32_t&, int32_t&)
+{
+    // Mac uses checkTextOfParagraph instead.
+    notImplemented();
+}
+
+bool TextChecker::spellingUIIsShowing()
+{
+    return [[[NSSpellChecker sharedSpellChecker] spellingPanel] isVisible];
+}
+
+void TextChecker::toggleSpellingUIIsShowing()
+{
+    NSPanel *spellingPanel = [[NSSpellChecker sharedSpellChecker] spellingPanel];
+    if ([spellingPanel isVisible])
+        [spellingPanel orderOut:nil];
+    else
+        [spellingPanel orderFront:nil];
+}
+
+void TextChecker::updateSpellingUIWithMisspelledWord(int64_t, const String& misspelledWord)
 {
     [[NSSpellChecker sharedSpellChecker] updateSpellingPanelWithMisspelledWord:misspelledWord];
 }
 
-void TextChecker::updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
+void TextChecker::updateSpellingUIWithGrammarString(int64_t, const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
 {
     RetainPtr<NSMutableArray> corrections(AdoptNS, [[NSMutableArray alloc] init]);
     for (size_t i = 0; i < grammarDetail.guesses.size(); ++i) {
@@ -307,7 +355,7 @@ void TextChecker::updateSpellingUIWithGrammarString(const String& badGrammarPhra
 
     NSRange grammarRange = NSMakeRange(grammarDetail.location, grammarDetail.length);
     NSString *grammarUserDescription = grammarDetail.userDescription;
-    RetainPtr<NSMutableDictionary> grammarDetailDict(AdoptNS, [[NSDictionary alloc] initWithObjectsAndKeys:[NSValue valueWithRange:grammarRange], NSGrammarRange, grammarUserDescription, NSGrammarUserDescription, corrections.get(), NSGrammarCorrections, nil]);
+    RetainPtr<NSDictionary> grammarDetailDict(AdoptNS, [[NSDictionary alloc] initWithObjectsAndKeys:[NSValue valueWithRange:grammarRange], NSGrammarRange, grammarUserDescription, NSGrammarUserDescription, corrections.get(), NSGrammarCorrections, nil]);
 
     [[NSSpellChecker sharedSpellChecker] updateSpellingPanelWithGrammarString:badGrammarPhrase detail:grammarDetailDict.get()];
 }
@@ -331,7 +379,7 @@ void TextChecker::getGuessesForWord(int64_t spellDocumentTag, const String& word
         guesses.append(guess);
 }
 
-void TextChecker::learnWord(const String& word)
+void TextChecker::learnWord(int64_t, const String& word)
 {
     [[NSSpellChecker sharedSpellChecker] learnWord:word];
 }
diff --git a/Source/WebKit2/UIProcess/mac/WebContextMac.mm b/Source/WebKit2/UIProcess/mac/WebContextMac.mm
index f7c186d..e770d5b 100644
--- a/Source/WebKit2/UIProcess/mac/WebContextMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebContextMac.mm
@@ -84,12 +84,11 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& para
     NSURLCache *urlCache = [NSURLCache sharedURLCache];
 
     parameters.parentProcessName = [[NSProcessInfo processInfo] processName];    
-    parameters.nsURLCachePath = fileSystemRepresentation([(NSString *)cachePath.get() stringByStandardizingPath]);
+    parameters.nsURLCachePath = [(NSString *)cachePath.get() stringByStandardizingPath];
     parameters.nsURLCacheMemoryCapacity = [urlCache memoryCapacity];
     parameters.nsURLCacheDiskCapacity = [urlCache diskCapacity];
 
-    ASSERT(strlen(parameters.nsURLCachePath.data()));
-    ASSERT(parameters.nsURLCachePath.data()[strlen(parameters.nsURLCachePath.data()) - 1] != '/'); // Necessary for NSURLCache to find the cache file.
+    ASSERT(!parameters.nsURLCachePath.isEmpty());
 
 #if USE(ACCELERATED_COMPOSITING) && HAVE(HOSTED_CORE_ANIMATION)
     mach_port_t renderServerPort = WKInitializeRenderServer();
@@ -98,7 +97,7 @@ void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& para
 #endif
 
     // FIXME: This should really be configurable; we shouldn't just blindly allow read access to the UI process bundle.
-    parameters.uiProcessBundleResourcePath = fileSystemRepresentation([[NSBundle mainBundle] resourcePath]);
+    parameters.uiProcessBundleResourcePath = [[NSBundle mainBundle] resourcePath];
 
 #if USE(CFURLSTORAGESESSIONS)
     parameters.uiProcessBundleIdentifier = String([[NSBundle mainBundle] bundleIdentifier]);
diff --git a/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
index d533573..33238b0 100644
--- a/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebFullScreenManagerProxyMac.mm
@@ -23,11 +23,13 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "WebFullScreenManagerProxy.h"
-#include "LayerTreeContext.h"
-#include "WKFullScreenWindowController.h"
-#include "WKViewInternal.h"
+#import "config.h"
+#import "WebFullScreenManagerProxy.h"
+
+#import "LayerTreeContext.h"
+#import "WKFullScreenWindowController.h"
+#import "WKViewInternal.h"
+#import <WebCore/IntRect.h>
 
 #if ENABLE(FULLSCREEN_API)
 
diff --git a/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
index 9657764..e406166 100644
--- a/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm
@@ -31,6 +31,7 @@
 #import "WKAPICast.h"
 #import "WKView.h"
 #import "WebPageProxy.h"
+#import "WebProcessProxy.h"
 #import <WebKitSystemInterface.h>
 #import <WebCore/LocalizedStrings.h>
 #import <wtf/text/WTFString.h>
@@ -80,7 +81,7 @@ WebPageProxy* WebInspectorProxy::platformCreateInspectorPage()
     ASSERT(m_page);
     ASSERT(!m_inspectorView);
 
-    m_inspectorView.adoptNS([[WKView alloc] initWithFrame:NSZeroRect contextRef:toAPI(page()->context()) pageGroupRef:toAPI(inspectorPageGroup())]);
+    m_inspectorView.adoptNS([[WKView alloc] initWithFrame:NSZeroRect contextRef:toAPI(page()->process()->context()) pageGroupRef:toAPI(inspectorPageGroup())]);
     ASSERT(m_inspectorView);
 
     [m_inspectorView.get() setDrawsBackground:NO];
@@ -135,7 +136,7 @@ void WebInspectorProxy::platformClose()
 
 void WebInspectorProxy::platformInspectedURLChanged(const String& urlString)
 {
-    NSString *title = [NSString stringWithFormat:UI_STRING("Web Inspector — %@", "Web Inspector window title"), (NSString *)urlString];
+    NSString *title = [NSString stringWithFormat:WEB_UI_STRING("Web Inspector — %@", "Web Inspector window title"), (NSString *)urlString];
     [m_inspectorWindow.get() setTitle:title];
 }
 
diff --git a/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
index 90df81e..9dacae5 100644
--- a/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebPageProxyMac.mm
@@ -26,10 +26,13 @@
 #import "config.h"
 #import "WebPageProxy.h"
 
+#import "AttributedString.h"
 #import "DataReference.h"
 #import "DictionaryPopupInfo.h"
+#import "EditorState.h"
 #import "NativeWebKeyboardEvent.h"
 #import "PageClient.h"
+#import "PageClientImpl.h"
 #import "TextChecker.h"
 #import "WebPageMessages.h"
 #import "WebProcessProxy.h"
@@ -105,8 +108,7 @@ void WebPageProxy::getIsSpeaking(bool& isSpeaking)
 
 void WebPageProxy::speak(const String& string)
 {
-    NSString *convertedString = string;
-    [NSApp speakString:convertedString];
+    [NSApp speakString:nsStringFromWebCoreString(string)];
 }
 
 void WebPageProxy::stopSpeaking()
@@ -114,6 +116,11 @@ void WebPageProxy::stopSpeaking()
     [NSApp stopSpeaking:nil];
 }
 
+void WebPageProxy::searchWithSpotlight(const String& string)
+{
+    [[NSWorkspace sharedWorkspace] showSearchResultsForQueryString:nsStringFromWebCoreString(string)];
+}
+
 CGContextRef WebPageProxy::containingWindowGraphicsContext()
 {
     return m_pageClient->containingWindowGraphicsContext();
@@ -134,11 +141,38 @@ void WebPageProxy::windowAndViewFramesChanged(const IntRect& windowFrameInScreen
     process()->send(Messages::WebPage::WindowAndViewFramesChanged(windowFrameInScreenCoordinates, viewFrameInWindowCoordinates, accessibilityViewCoordinates), m_pageID);
 }
 
+void WebPageProxy::setComposition(const String& text, Vector<CompositionUnderline> underlines, uint64_t selectionStart, uint64_t selectionEnd, uint64_t replacementRangeStart, uint64_t replacementRangeEnd)
+{
+    process()->sendSync(Messages::WebPage::SetComposition(text, underlines, selectionStart, selectionEnd, replacementRangeStart, replacementRangeEnd), Messages::WebPage::SetComposition::Reply(m_editorState), m_pageID);
+}
+
+void WebPageProxy::confirmComposition()
+{
+    process()->sendSync(Messages::WebPage::ConfirmComposition(), Messages::WebPage::ConfirmComposition::Reply(m_editorState), m_pageID);
+}
+
+bool WebPageProxy::insertText(const String& text, uint64_t replacementRangeStart, uint64_t replacementRangeEnd)
+{
+    bool handled;
+    process()->sendSync(Messages::WebPage::InsertText(text, replacementRangeStart, replacementRangeEnd), Messages::WebPage::InsertText::Reply(handled, m_editorState), m_pageID);
+    return handled;
+}
+
 void WebPageProxy::getMarkedRange(uint64_t& location, uint64_t& length)
 {
     process()->sendSync(Messages::WebPage::GetMarkedRange(), Messages::WebPage::GetMarkedRange::Reply(location, length), m_pageID);
 }
-    
+
+void WebPageProxy::getSelectedRange(uint64_t& location, uint64_t& length)
+{
+    process()->sendSync(Messages::WebPage::GetSelectedRange(), Messages::WebPage::GetSelectedRange::Reply(location, length), m_pageID);
+}
+
+void WebPageProxy::getAttributedSubstringFromRange(uint64_t location, uint64_t length, AttributedString& result)
+{
+    process()->sendSync(Messages::WebPage::GetAttributedSubstringFromRange(location, length), Messages::WebPage::GetAttributedSubstringFromRange::Reply(result), m_pageID);
+}
+
 uint64_t WebPageProxy::characterIndexForPoint(const IntPoint point)
 {
     uint64_t result;
@@ -152,20 +186,27 @@ WebCore::IntRect WebPageProxy::firstRectForCharacterRange(uint64_t location, uin
     process()->sendSync(Messages::WebPage::FirstRectForCharacterRange(location, length), Messages::WebPage::FirstRectForCharacterRange::Reply(resultRect), m_pageID);
     return resultRect;
 }
-    
+
+bool WebPageProxy::executeKeypressCommands(const Vector<WebCore::KeypressCommand>& commands)
+{
+    bool result;
+    process()->sendSync(Messages::WebPage::ExecuteKeypressCommands(commands), Messages::WebPage::ExecuteKeypressCommands::Reply(result, m_editorState), m_pageID);
+    return result;
+}
+
 bool WebPageProxy::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes)
 {
     bool result;
-    const double MessageTimeout = 20;
-    process()->sendSync(Messages::WebPage::WriteSelectionToPasteboard(pasteboardName, pasteboardTypes), Messages::WebPage::WriteSelectionToPasteboard::Reply(result), m_pageID, MessageTimeout);
+    const double messageTimeout = 20;
+    process()->sendSync(Messages::WebPage::WriteSelectionToPasteboard(pasteboardName, pasteboardTypes), Messages::WebPage::WriteSelectionToPasteboard::Reply(result), m_pageID, messageTimeout);
     return result;
 }
 
 bool WebPageProxy::readSelectionFromPasteboard(const String& pasteboardName)
 {
     bool result;
-    const double MessageTimeout = 20;
-    process()->sendSync(Messages::WebPage::ReadSelectionFromPasteboard(pasteboardName), Messages::WebPage::ReadSelectionFromPasteboard::Reply(result), m_pageID, MessageTimeout);
+    const double messageTimeout = 20;
+    process()->sendSync(Messages::WebPage::ReadSelectionFromPasteboard(pasteboardName), Messages::WebPage::ReadSelectionFromPasteboard::Reply(result), m_pageID, messageTimeout);
     return result;
 }
 
@@ -186,9 +227,10 @@ void WebPageProxy::performDictionaryLookupAtLocation(const WebCore::FloatPoint&
     process()->send(Messages::WebPage::PerformDictionaryLookupAtLocation(point), m_pageID); 
 }
 
-void WebPageProxy::interpretKeyEvent(uint32_t type, Vector<KeypressCommand>& commandsList, uint32_t selectionStart, uint32_t selectionEnd, Vector<CompositionUnderline>& underlines)
+void WebPageProxy::interpretQueuedKeyEvent(const EditorState& state, bool& handled, Vector<WebCore::KeypressCommand>& commands)
 {
-    m_pageClient->interceptKeyEvent(m_keyEventQueue.first(), commandsList, selectionStart, selectionEnd, underlines);
+    m_editorState = state;
+    handled = m_pageClient->interpretKeyEvent(m_keyEventQueue.first(), commands);
 }
 
 // Complex text input support for plug-ins.
@@ -248,4 +290,25 @@ void WebPageProxy::setComplexTextInputEnabled(uint64_t pluginComplexTextInputIde
     m_pageClient->setComplexTextInputEnabled(pluginComplexTextInputIdentifier, complexTextInputEnabled);
 }
 
+void WebPageProxy::executeSavedCommandBySelector(const String& selector, bool& handled)
+{
+    handled = m_pageClient->executeSavedCommandBySelector(selector);
+}
+
+bool WebPageProxy::shouldDelayWindowOrderingForEvent(const WebKit::WebMouseEvent& event)
+{
+    bool result = false;
+    const double messageTimeout = 3;
+    process()->sendSync(Messages::WebPage::ShouldDelayWindowOrderingEvent(event), Messages::WebPage::ShouldDelayWindowOrderingEvent::Reply(result), m_pageID, messageTimeout);
+    return result;
+}
+
+bool WebPageProxy::acceptsFirstMouse(int eventNumber, const WebKit::WebMouseEvent& event)
+{
+    bool result = false;
+    const double messageTimeout = 3;
+    process()->sendSync(Messages::WebPage::AcceptsFirstMouse(eventNumber, event), Messages::WebPage::AcceptsFirstMouse::Reply(result), m_pageID, messageTimeout);
+    return result;
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
index 7ce8764..d13a2a7 100644
--- a/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "WebPopupMenuProxyMac.h"
 
+#import "NativeWebMouseEvent.h"
 #import "PageClientImpl.h"
 #import "PlatformPopupMenuData.h"
 #import "WKView.h"
@@ -61,7 +62,7 @@ void WebPopupMenuProxyMac::populate(const Vector<WebPopupItem>& items, NSFont *f
     int size = items.size();
 
     for (int i = 0; i < size; i++) {
-        if (items[i].m_type == WebPopupItem::Seperator)
+        if (items[i].m_type == WebPopupItem::Separator)
             [[m_popup.get() menu] addItem:[NSMenuItem separatorItem]];
         else {
             [m_popup.get() addItemWithTitle:@""];
@@ -108,11 +109,20 @@ void WebPopupMenuProxyMac::showPopupMenu(const IntRect& rect, TextDirection text
 
     // These values were borrowed from AppKit to match their placement of the menu.
     const int popOverHorizontalAdjust = -10;
-    NSRect titleFrame = [m_popup.get()  titleRectForBounds:rect];
-    if (titleFrame.size.width <= 0 || titleFrame.size.height <= 0)
-        titleFrame = rect;
-    float vertOffset = roundf((NSMaxY(rect) - NSMaxY(titleFrame)) + NSHeight(titleFrame));
-    NSPoint location = NSMakePoint(NSMinX(rect) + popOverHorizontalAdjust, NSMaxY(rect) - vertOffset);
+    const int popUnderHorizontalAdjust = 6;
+    const int popUnderVerticalAdjust = 6;
+    
+    // Menus that pop-over directly obscure the node that generated the popup menu.
+    // Menus that pop-under are offset underneath it.
+    NSPoint location;
+    if (data.shouldPopOver) {
+        NSRect titleFrame = [m_popup.get()  titleRectForBounds:rect];
+        if (titleFrame.size.width <= 0 || titleFrame.size.height <= 0)
+            titleFrame = rect;
+        float vertOffset = roundf((NSMaxY(rect) - NSMaxY(titleFrame)) + NSHeight(titleFrame));
+        location = NSMakePoint(NSMinX(rect) + popOverHorizontalAdjust, NSMaxY(rect) - vertOffset);
+    } else
+        location = NSMakePoint(NSMinX(rect) + popUnderHorizontalAdjust, NSMaxY(rect) + popUnderVerticalAdjust);  
 
     RetainPtr<NSView> dummyView(AdoptNS, [[NSView alloc] initWithFrame:rect]);
     [m_webView addSubview:dummyView.get()];
@@ -122,9 +132,41 @@ void WebPopupMenuProxyMac::showPopupMenu(const IntRect& rect, TextDirection text
 
     [m_popup.get() dismissPopUp];
     [dummyView.get() removeFromSuperview];
-
-    if (m_client)
-        m_client->valueChangedForPopupMenu(this, [m_popup.get() indexOfSelectedItem]);
+    
+    if (!m_client)
+        return;
+    
+    m_client->valueChangedForPopupMenu(this, [m_popup.get() indexOfSelectedItem]);
+    
+    // <https://bugs.webkit.org/show_bug.cgi?id=57904> This code is adopted from EventHandler::sendFakeEventsAfterWidgetTracking().
+    if (!m_client->currentlyProcessedMouseDownEvent())
+        return;
+    
+    NSEvent* initiatingNSEvent = m_client->currentlyProcessedMouseDownEvent()->nativeEvent();
+    if ([initiatingNSEvent type] != NSLeftMouseDown)
+        return;
+    
+    NSEvent *fakeEvent = [NSEvent mouseEventWithType:NSLeftMouseUp
+                                            location:[initiatingNSEvent locationInWindow]
+                                       modifierFlags:[initiatingNSEvent modifierFlags]
+                                           timestamp:[initiatingNSEvent timestamp]
+                                        windowNumber:[initiatingNSEvent windowNumber]
+                                             context:[initiatingNSEvent context]
+                                         eventNumber:[initiatingNSEvent eventNumber]
+                                          clickCount:[initiatingNSEvent clickCount]
+                                            pressure:[initiatingNSEvent pressure]];
+    
+    [NSApp postEvent:fakeEvent atStart:YES];
+    fakeEvent = [NSEvent mouseEventWithType:NSMouseMoved
+                                   location:[[m_webView window] convertScreenToBase:[NSEvent mouseLocation]]
+                              modifierFlags:[initiatingNSEvent modifierFlags]
+                                  timestamp:[initiatingNSEvent timestamp]
+                               windowNumber:[initiatingNSEvent windowNumber]
+                                    context:[initiatingNSEvent context]
+                                eventNumber:0
+                                 clickCount:0
+                                   pressure:0];
+    [NSApp postEvent:fakeEvent atStart:YES];
 }
 
 void WebPopupMenuProxyMac::hidePopupMenu()
diff --git a/Source/WebKit2/UIProcess/qt/TextCheckerQt.cpp b/Source/WebKit2/UIProcess/qt/TextCheckerQt.cpp
index a28b867..2582cc2 100644
--- a/Source/WebKit2/UIProcess/qt/TextCheckerQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/TextCheckerQt.cpp
@@ -59,7 +59,7 @@ void TextChecker::setGrammarCheckingEnabled(bool isGrammarCheckingEnabled)
     notImplemented();
 }
 
-int64_t TextChecker::uniqueSpellDocumentTag()
+int64_t TextChecker::uniqueSpellDocumentTag(WebPageProxy*)
 {
     notImplemented();
     return 0;
@@ -70,18 +70,33 @@ void TextChecker::closeSpellDocumentWithTag(int64_t)
     notImplemented();
 }
 
-Vector<TextCheckingResult> TextChecker::checkTextOfParagraph(int64_t spellDocumentTag, const UChar* text, int length, uint64_t checkingTypes)
+void TextChecker::checkSpellingOfString(int64_t, const UChar*, uint32_t, int32_t&, int32_t&)
 {
     notImplemented();
-    return Vector<WebCore::TextCheckingResult>();
 }
 
-void TextChecker::updateSpellingUIWithMisspelledWord(const String& misspelledWord)
+void TextChecker::checkGrammarOfString(int64_t, const UChar*, uint32_t, Vector<WebCore::GrammarDetail>&, int32_t&, int32_t&)
 {
     notImplemented();
 }
 
-void TextChecker::updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
+bool TextChecker::spellingUIIsShowing()
+{
+    notImplemented();
+    return false;
+}
+
+void TextChecker::toggleSpellingUIIsShowing()
+{
+    notImplemented();
+}
+
+void TextChecker::updateSpellingUIWithMisspelledWord(int64_t, const String&)
+{
+    notImplemented();
+}
+
+void TextChecker::updateSpellingUIWithGrammarString(int64_t, const String&, const GrammarDetail&)
 {
     notImplemented();
 }
@@ -91,7 +106,7 @@ void TextChecker::getGuessesForWord(int64_t spellDocumentTag, const String& word
     notImplemented();
 }
 
-void TextChecker::learnWord(const String& word)
+void TextChecker::learnWord(int64_t, const String&)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
index d6e8639..615cd8d 100644
--- a/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/WebPageProxyQt.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WebPageProxy.h"
 
+#include <WebCore/NotImplemented.h>
+
 namespace WebKit {
 
 String WebPageProxy::standardUserAgent(const String& applicationNameForUserAgent)
@@ -34,4 +36,14 @@ String WebPageProxy::standardUserAgent(const String& applicationNameForUserAgent
     return "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6) AppleWebKit/531.4 (KHTML, like Gecko) Version/4.0.3 Safari/531.4";
 }
 
+void WebPageProxy::saveRecentSearches(const String&, const Vector<String>&)
+{
+    notImplemented();
+}
+
+void WebPageProxy::loadRecentSearches(const String&, Vector<String>&)
+{
+    notImplemented();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/TextCheckerWin.cpp b/Source/WebKit2/UIProcess/win/TextCheckerWin.cpp
index dbc6fdc..9f7c766 100644
--- a/Source/WebKit2/UIProcess/win/TextCheckerWin.cpp
+++ b/Source/WebKit2/UIProcess/win/TextCheckerWin.cpp
@@ -27,6 +27,7 @@
 #include "TextChecker.h"
 
 #include "TextCheckerState.h"
+#include "WebTextChecker.h"
 #include <WebCore/NotImplemented.h>
 
 using namespace WebCore;
@@ -37,68 +38,103 @@ static TextCheckerState textCheckerState;
 
 const TextCheckerState& TextChecker::state()
 {
-    notImplemented();
+    static bool didInitializeState;
+    if (didInitializeState)
+        return textCheckerState;
+
+    WebTextCheckerClient& client = WebTextChecker::shared()->client();
+    textCheckerState.isContinuousSpellCheckingEnabled = client.continuousSpellCheckingEnabled();
+    textCheckerState.isGrammarCheckingEnabled =  client.grammarCheckingEnabled();
+
+    didInitializeState = true;
 
     return textCheckerState;
 }
   
 bool TextChecker::isContinuousSpellCheckingAllowed()
 {
-    notImplemented();
-
-    return false;
+    return WebTextChecker::shared()->client().continuousSpellCheckingAllowed();
 }
 
 void TextChecker::setContinuousSpellCheckingEnabled(bool isContinuousSpellCheckingEnabled)
 {
-    notImplemented();
+    if (state().isContinuousSpellCheckingEnabled == isContinuousSpellCheckingEnabled)
+        return;
+    textCheckerState.isContinuousSpellCheckingEnabled = isContinuousSpellCheckingEnabled;
+    WebTextChecker::shared()->client().setContinuousSpellCheckingEnabled(isContinuousSpellCheckingEnabled);
 }
 
 void TextChecker::setGrammarCheckingEnabled(bool isGrammarCheckingEnabled)
 {
-    notImplemented();
+    if (state().isGrammarCheckingEnabled == isGrammarCheckingEnabled)
+        return;
+    textCheckerState.isGrammarCheckingEnabled = isGrammarCheckingEnabled;
+    WebTextChecker::shared()->client().setGrammarCheckingEnabled(isGrammarCheckingEnabled);
+}
+
+void TextChecker::continuousSpellCheckingEnabledStateChanged(bool enabled)
+{
+    textCheckerState.isContinuousSpellCheckingEnabled = enabled;
+}
+
+void TextChecker::grammarCheckingEnabledStateChanged(bool enabled)
+{
+    textCheckerState.isGrammarCheckingEnabled = enabled;
+}
+
+int64_t TextChecker::uniqueSpellDocumentTag(WebPageProxy* page)
+{
+    return WebTextChecker::shared()->client().uniqueSpellDocumentTag(page);
+}
+
+void TextChecker::closeSpellDocumentWithTag(int64_t tag)
+{
+    WebTextChecker::shared()->client().closeSpellDocumentWithTag(tag);
+}
+
+void TextChecker::checkSpellingOfString(int64_t spellDocumentTag, const UChar* text, uint32_t length, int32_t& misspellingLocation, int32_t& misspellingLength)
+{
+    WebTextChecker::shared()->client().checkSpellingOfString(spellDocumentTag, String(text, length), misspellingLocation, misspellingLength);
 }
 
-int64_t TextChecker::uniqueSpellDocumentTag()
+void TextChecker::checkGrammarOfString(int64_t spellDocumentTag, const UChar* text, uint32_t length, Vector<WebCore::GrammarDetail>& grammarDetails, int32_t& badGrammarLocation, int32_t& badGrammarLength)
 {
-    notImplemented();
-    return 0;
+    WebTextChecker::shared()->client().checkGrammarOfString(spellDocumentTag, String(text, length), grammarDetails, badGrammarLocation, badGrammarLength);
 }
 
-void TextChecker::closeSpellDocumentWithTag(int64_t)
+bool TextChecker::spellingUIIsShowing()
 {
-    notImplemented();
+    return WebTextChecker::shared()->client().spellingUIIsShowing();
 }
 
-Vector<TextCheckingResult> TextChecker::checkTextOfParagraph(int64_t spellDocumentTag, const UChar* text, int length, uint64_t checkingTypes)
+void TextChecker::toggleSpellingUIIsShowing()
 {
-    notImplemented();
-    return Vector<WebCore::TextCheckingResult>();
+    WebTextChecker::shared()->client().toggleSpellingUIIsShowing();
 }
 
-void TextChecker::updateSpellingUIWithMisspelledWord(const String& misspelledWord)
+void TextChecker::updateSpellingUIWithMisspelledWord(int64_t spellDocumentTag, const String& misspelledWord)
 {
-    notImplemented();
+    WebTextChecker::shared()->client().updateSpellingUIWithMisspelledWord(spellDocumentTag, misspelledWord);
 }
 
-void TextChecker::updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
+void TextChecker::updateSpellingUIWithGrammarString(int64_t spellDocumentTag, const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
 {
-    notImplemented();
+    WebTextChecker::shared()->client().updateSpellingUIWithGrammarString(spellDocumentTag, badGrammarPhrase, grammarDetail);
 }
 
 void TextChecker::getGuessesForWord(int64_t spellDocumentTag, const String& word, const String& context, Vector<String>& guesses)
 {
-    notImplemented();
+    WebTextChecker::shared()->client().guessesForWord(spellDocumentTag, word, guesses);
 }
 
-void TextChecker::learnWord(const String& word)
+void TextChecker::learnWord(int64_t spellDocumentTag, const String& word)
 {
-    notImplemented();
+    WebTextChecker::shared()->client().learnWord(spellDocumentTag, word);
 }
 
 void TextChecker::ignoreWord(int64_t spellDocumentTag, const String& word)
 {
-    notImplemented();
+    WebTextChecker::shared()->client().ignoreWord(spellDocumentTag, word);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebContextWin.cpp b/Source/WebKit2/UIProcess/win/WebContextWin.cpp
index d5fd859..c1c2a00 100644
--- a/Source/WebKit2/UIProcess/win/WebContextWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebContextWin.cpp
@@ -48,9 +48,7 @@ void WebContext::setShouldPaintNativeControls(bool b)
 {
     m_shouldPaintNativeControls = b;
 
-    if (!hasValidProcess())
-        return;
-    m_process->send(Messages::WebProcess::SetShouldPaintNativeControls(m_shouldPaintNativeControls), 0);
+    sendToAllProcesses(Messages::WebProcess::SetShouldPaintNativeControls(m_shouldPaintNativeControls));
 }
 
 void WebContext::platformInitializeWebProcess(WebProcessCreationParameters& parameters)
diff --git a/Source/WebKit2/UIProcess/win/WebGrammarDetail.cpp b/Source/WebKit2/UIProcess/win/WebGrammarDetail.cpp
new file mode 100644
index 0000000..8df528c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebGrammarDetail.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebGrammarDetail.h"
+
+#include "ImmutableArray.h"
+#include "WKGrammarDetail.h"
+#include "WebString.h"
+
+namespace WebKit {
+
+PassRefPtr<WebGrammarDetail> WebGrammarDetail::create(int location, int length, ImmutableArray* guesses, const String& userDescription)
+{
+    return adoptRef(new WebGrammarDetail(location, length, guesses, userDescription));
+}
+
+PassRefPtr<WebGrammarDetail> WebGrammarDetail::create(const WebCore::GrammarDetail& grammarDetail)
+{
+    return adoptRef(new WebGrammarDetail(grammarDetail));
+}
+
+WebGrammarDetail::WebGrammarDetail(int location, int length, ImmutableArray* guesses, const String& userDescription)
+{
+    m_grammarDetail.location = location;
+    m_grammarDetail.length = length;
+
+    size_t numGuesses = guesses->size();
+    m_grammarDetail.guesses.reserveCapacity(numGuesses);
+    for (size_t i = 0; i < numGuesses; ++i)
+        m_grammarDetail.guesses.uncheckedAppend(guesses->at<WebString>(i)->string());
+
+    m_grammarDetail.userDescription = userDescription;
+}
+
+PassRefPtr<ImmutableArray> WebGrammarDetail::guesses() const
+{
+    size_t numGuesses = m_grammarDetail.guesses.size();
+    Vector<RefPtr<APIObject> > wkGuesses(numGuesses);
+    for (unsigned i = 0; i < numGuesses; ++i)
+        wkGuesses[i] = WebString::create(m_grammarDetail.guesses[i]);
+    return ImmutableArray::adopt(wkGuesses);
+}
+
+WebGrammarDetail::WebGrammarDetail(const WebCore::GrammarDetail& grammarDetail)
+    : m_grammarDetail(grammarDetail)
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebGrammarDetail.h b/Source/WebKit2/UIProcess/win/WebGrammarDetail.h
new file mode 100644
index 0000000..ff79b5c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebGrammarDetail.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebGrammarDetail_h
+#define WebGrammarDetail_h
+
+#include "APIObject.h"
+#include <WebCore/TextCheckerClient.h>
+#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebKit {
+
+class ImmutableArray;
+
+class WebGrammarDetail : public APIObject {
+public:
+    static const Type APIType = TypeGrammarDetail;
+    static PassRefPtr<WebGrammarDetail> create(int location, int length, ImmutableArray* guesses, const String& userDescription);
+    static PassRefPtr<WebGrammarDetail> create(const WebCore::GrammarDetail&);
+
+    int location() const { return m_grammarDetail.location; }
+    int length() const { return m_grammarDetail.length; }
+    PassRefPtr<ImmutableArray> guesses() const;
+    const String& userDescription() const { return m_grammarDetail.userDescription; }
+
+    const WebCore::GrammarDetail& grammarDetail() { return m_grammarDetail; }
+
+private:
+    WebGrammarDetail(int location, int length, ImmutableArray* guesses, const String& userDescription);
+    WebGrammarDetail(const WebCore::GrammarDetail&);
+
+    virtual Type type() const { return APIType; }
+
+    WebCore::GrammarDetail m_grammarDetail;
+};
+
+} // namespace WebKit
+
+#endif // WebGrammarDetail_h
diff --git a/Source/WebKit2/UIProcess/win/WebInspectorProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebInspectorProxyWin.cpp
index 30b012e..ec5e91c 100644
--- a/Source/WebKit2/UIProcess/win/WebInspectorProxyWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebInspectorProxyWin.cpp
@@ -30,6 +30,7 @@
 
 #include "WebKitBundle.h"
 #include "WebPageProxy.h"
+#include "WebProcessProxy.h"
 #include "WebView.h"
 #include <WebCore/WebCoreInstanceHandle.h>
 #include <wtf/PassRefPtr.h>
@@ -155,7 +156,7 @@ WebPageProxy* WebInspectorProxy::platformCreateInspectorPage()
     ASSERT(!m_inspectorWindow);
 
     RECT emptyRect = { 0 };
-    m_inspectorView = WebView::create(emptyRect, m_page->context(), inspectorPageGroup(), 0);
+    m_inspectorView = WebView::create(emptyRect, m_page->process()->context(), inspectorPageGroup(), 0);
 
     return m_inspectorView->page();
 }
diff --git a/Source/WebKit2/UIProcess/win/WebPageProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebPageProxyWin.cpp
index 1745a06..40a4cbb 100644
--- a/Source/WebKit2/UIProcess/win/WebPageProxyWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebPageProxyWin.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "WebPageProxy.h"
+#include "WebPopupMenuProxyWin.h"
 
 #include "resource.h"
 #include <tchar.h>
@@ -54,4 +55,12 @@ String WebPageProxy::standardUserAgent(const String& applicationNameForUserAgent
     return makeString("Mozilla/5.0 (", osVersion, ") AppleWebKit/", webKitVersion, " (KHTML, like Gecko)", applicationNameForUserAgent.isEmpty() ? "" : " ", applicationNameForUserAgent);
 }
 
+void WebPageProxy::setPopupMenuSelectedIndex(int32_t selectedIndex)
+{
+    if (!m_activePopupMenu)
+        return;
+
+    static_cast<WebPopupMenuProxyWin*>(m_activePopupMenu.get())->setFocusedIndex(selectedIndex);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.cpp
index eebde75..a8d8063 100644
--- a/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "WebPopupMenuProxyWin.h"
 
+#include "NativeWebMouseEvent.h"
 #include "WebView.h"
 #include <WebCore/WebCoreInstanceHandle.h>
 #include <WebCore/ScrollbarTheme.h>
@@ -324,8 +325,26 @@ void WebPopupMenuProxyWin::showPopupMenu(const IntRect& rect, TextDirection, dou
     m_showPopup = false;
     ::ShowWindow(m_popup, SW_HIDE);
 
-    if (m_client)
-        m_client->valueChangedForPopupMenu(this, m_newSelectedIndex);
+    if (!m_client)
+        return;
+
+    m_client->valueChangedForPopupMenu(this, m_newSelectedIndex);
+
+    // <https://bugs.webkit.org/show_bug.cgi?id=57904> In order to properly call the onClick()
+    // handler on a <select> element, we need to fake a mouse up event in the main window.
+    // The main window already received the mouse down, which showed this popup, but upon
+    // selection of an item the mouse up gets eaten by the popup menu. So we take the mouse down
+    // event, change the message type to a mouse up event, and post that in the message queue.
+    // Thus, we are virtually clicking at the
+    // same location where the mouse down event occurred. This allows the hit test to select
+    // the correct element, and thereby call the onClick() JS handler.
+    if (!m_client->currentlyProcessedMouseDownEvent())
+        return;
+        
+    const MSG* initiatingWinEvent = m_client->currentlyProcessedMouseDownEvent()->nativeEvent();
+    MSG fakeEvent = *initiatingWinEvent;
+    fakeEvent.message = WM_LBUTTONUP;
+    ::PostMessage(fakeEvent.hwnd, fakeEvent.message, fakeEvent.wParam, fakeEvent.lParam);
 }
 
 void WebPopupMenuProxyWin::hidePopupMenu()
diff --git a/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.h b/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.h
index 5a20edf..9d6d5b2 100644
--- a/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.h
+++ b/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.h
@@ -51,6 +51,8 @@ public:
     virtual void showPopupMenu(const WebCore::IntRect&, WebCore::TextDirection, double scaleFactor, const Vector<WebPopupItem>&, const PlatformPopupMenuData&, int32_t selectedIndex);
     virtual void hidePopupMenu();
 
+    bool setFocusedIndex(int index, bool hotTracking = false);
+
     void hide() { hidePopupMenu(); }
 
 private:
@@ -63,8 +65,10 @@ private:
     virtual int scrollPosition(WebCore::Scrollbar*) const;
     virtual void setScrollOffset(const WebCore::IntPoint&);
     virtual void invalidateScrollbarRect(WebCore::Scrollbar*, const WebCore::IntRect&);
+    virtual void invalidateScrollCornerRect(const WebCore::IntRect&) { }
     virtual bool isActive() const { return true; }
-    virtual bool scrollbarCornerPresent() const { return false; }
+    virtual bool isScrollCornerVisible() const { return false; }
+    virtual WebCore::IntRect scrollCornerRect() const { return WebCore::IntRect(); }
     virtual WebCore::Scrollbar* verticalScrollbar() const { return m_scrollbar.get(); }
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
@@ -107,7 +111,6 @@ private:
     void paint(const WebCore::IntRect& damageRect, HDC = 0);
     int visibleItems() const;
     int listIndexAtPoint(const WebCore::IntPoint&) const;
-    bool setFocusedIndex(int index, bool hotTracking = false);
     int focusedIndex() const;
     void focusFirst();
     void focusLast();
diff --git a/Source/WebKit2/UIProcess/win/WebProcessProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebProcessProxyWin.cpp
new file mode 100644
index 0000000..1856b3b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebProcessProxyWin.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebProcessProxy.h"
+
+namespace WebKit {
+
+Vector<HWND> WebProcessProxy::windowsToReceiveSentMessagesWhileWaitingForSyncReply()
+{
+    return Vector<HWND>();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebTextChecker.cpp b/Source/WebKit2/UIProcess/win/WebTextChecker.cpp
new file mode 100644
index 0000000..2761844
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebTextChecker.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebTextChecker.h"
+
+#include "TextChecker.h"
+#include "WKAPICast.h"
+#include "WebContext.h"
+#include <wtf/RefPtr.h>
+
+namespace WebKit {
+
+WebTextChecker* WebTextChecker::shared()
+{
+    static WebTextChecker* textChecker = adoptRef(new WebTextChecker).leakRef();
+    return textChecker;
+}
+
+WebTextChecker::WebTextChecker()
+{
+}
+
+void WebTextChecker::setClient(const WKTextCheckerClient* client)
+{
+    m_client.initialize(client);
+}
+
+static void updateStateForAllWebProcesses()
+{
+    const Vector<WebContext*>& contexts = WebContext::allContexts();
+    for (size_t i = 0; i < contexts.size(); ++i) {
+        WebProcessProxy* webProcess = contexts[i]->process();
+        if (!webProcess)
+            continue;
+        webProcess->updateTextCheckerState();
+    }
+}
+
+void WebTextChecker::continuousSpellCheckingEnabledStateChanged(bool enabled)
+{
+    TextChecker::continuousSpellCheckingEnabledStateChanged(enabled);
+    updateStateForAllWebProcesses();
+}
+
+void WebTextChecker::grammarCheckingEnabledStateChanged(bool enabled)
+{
+    TextChecker::grammarCheckingEnabledStateChanged(enabled);
+    updateStateForAllWebProcesses();
+}
+
+void WebTextChecker::checkSpelling(const WebPageProxy* page, bool startBeforeSelection)
+{
+    page->advanceToNextMisspelling(startBeforeSelection);
+}
+
+void WebTextChecker::changeSpellingToWord(const WebPageProxy* page, const String& text)
+{
+    page->changeSpellingToWord(text);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebTextChecker.h b/Source/WebKit2/UIProcess/win/WebTextChecker.h
new file mode 100644
index 0000000..a1c574c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebTextChecker.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebTextChecker_h
+#define WebTextChecker_h
+
+#include "APIObject.h"
+#include "WKTextChecker.h"
+#include "WebTextCheckerClient.h"
+#include <wtf/Forward.h>
+
+namespace WebKit {
+
+class WebPageProxy;
+
+class WebTextChecker : public APIObject {
+public:
+    static const Type APIType = TypeTextChecker;
+
+    static WebTextChecker* shared();
+
+    void setClient(const WKTextCheckerClient*);
+    WebTextCheckerClient& client() { return m_client; }
+
+    void continuousSpellCheckingEnabledStateChanged(bool);
+    void grammarCheckingEnabledStateChanged(bool);
+
+    void checkSpelling(const WebPageProxy*, bool startBeforeSelection);
+    void changeSpellingToWord(const WebPageProxy*, const String&);
+
+private:
+    WebTextChecker();
+
+    virtual Type type() const { return APIType; }
+
+    WebTextCheckerClient m_client;
+};
+
+} // namespace WebKit
+
+#endif // WebTextChecker_h
diff --git a/Source/WebKit2/UIProcess/win/WebTextCheckerClient.cpp b/Source/WebKit2/UIProcess/win/WebTextCheckerClient.cpp
new file mode 100644
index 0000000..86e52c6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebTextCheckerClient.cpp
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebTextCheckerClient.h"
+
+#include "ImmutableArray.h"
+#include "WKAPICast.h"
+#include "WKSharedAPICast.h"
+#include "WebGrammarDetail.h"
+#include "WebPageProxy.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebKit {
+
+bool WebTextCheckerClient::continuousSpellCheckingAllowed()
+{
+    if (!m_client.continuousSpellCheckingAllowed)
+        return false;
+
+    return m_client.continuousSpellCheckingAllowed(m_client.clientInfo);
+}
+
+bool WebTextCheckerClient::continuousSpellCheckingEnabled()
+{
+    if (!m_client.continuousSpellCheckingEnabled)
+        return false;
+
+    return m_client.continuousSpellCheckingEnabled(m_client.clientInfo);
+}
+
+void WebTextCheckerClient::setContinuousSpellCheckingEnabled(bool enabled)
+{
+    if (!m_client.setContinuousSpellCheckingEnabled)
+        return;
+
+    m_client.setContinuousSpellCheckingEnabled(enabled, m_client.clientInfo);
+}
+
+bool WebTextCheckerClient::grammarCheckingEnabled()
+{
+    if (!m_client.grammarCheckingEnabled)
+        return false;
+
+    return m_client.grammarCheckingEnabled(m_client.clientInfo);
+}
+
+void WebTextCheckerClient::setGrammarCheckingEnabled(bool enabled)
+{
+    if (!m_client.setGrammarCheckingEnabled)
+        return;
+
+    m_client.setGrammarCheckingEnabled(enabled, m_client.clientInfo);
+}
+
+uint64_t WebTextCheckerClient::uniqueSpellDocumentTag(WebPageProxy* page)
+{
+    if (!m_client.uniqueSpellDocumentTag)
+        return 0;
+
+    return m_client.uniqueSpellDocumentTag(toAPI(page), m_client.clientInfo);
+}
+
+void WebTextCheckerClient::closeSpellDocumentWithTag(uint64_t tag)
+{
+    if (!m_client.closeSpellDocumentWithTag)
+        return;
+
+    m_client.closeSpellDocumentWithTag(tag, m_client.clientInfo);
+}
+
+void WebTextCheckerClient::checkSpellingOfString(uint64_t tag, const String& text, int32_t& misspellingLocation, int32_t& misspellingLength)
+{
+    if (!m_client.checkSpellingOfString)
+        return;
+
+    m_client.checkSpellingOfString(tag, toAPI(text.impl()), &misspellingLocation, &misspellingLength, m_client.clientInfo);
+}
+
+void WebTextCheckerClient::checkGrammarOfString(uint64_t tag, const String& text, Vector<WebCore::GrammarDetail>& grammarDetails, int32_t& badGrammarLocation, int32_t& badGrammarLength)
+{
+    if (!m_client.checkGrammarOfString)
+        return;
+
+    WKArrayRef wkGrammarDetailsRef = 0;
+    m_client.checkGrammarOfString(tag, toAPI(text.impl()), &wkGrammarDetailsRef, &badGrammarLocation, &badGrammarLength, m_client.clientInfo);
+
+    RefPtr<ImmutableArray> wkGrammarDetails = adoptRef(toImpl(wkGrammarDetailsRef));
+    size_t numGrammarDetails = wkGrammarDetails->size();
+    for (size_t i = 0; i < numGrammarDetails; ++i)
+        grammarDetails.append(wkGrammarDetails->at<WebGrammarDetail>(i)->grammarDetail());
+}
+
+bool WebTextCheckerClient::spellingUIIsShowing()
+{
+    if (!m_client.spellingUIIsShowing)
+        return false;
+
+    return m_client.spellingUIIsShowing(m_client.clientInfo);
+}
+
+void WebTextCheckerClient::toggleSpellingUIIsShowing()
+{
+    if (!m_client.toggleSpellingUIIsShowing)
+        return;
+
+    return m_client.toggleSpellingUIIsShowing(m_client.clientInfo);
+}
+
+void WebTextCheckerClient::updateSpellingUIWithMisspelledWord(uint64_t tag, const String& misspelledWord)
+{
+    if (!m_client.updateSpellingUIWithMisspelledWord)
+        return;
+
+    m_client.updateSpellingUIWithMisspelledWord(tag, toAPI(misspelledWord.impl()), m_client.clientInfo);
+}
+
+void WebTextCheckerClient::updateSpellingUIWithGrammarString(uint64_t tag, const String& badGrammarPhrase, const WebCore::GrammarDetail& grammarDetail)
+{
+    if (!m_client.updateSpellingUIWithGrammarString)
+        return;
+
+    m_client.updateSpellingUIWithGrammarString(tag, toAPI(badGrammarPhrase.impl()), toAPI(grammarDetail), m_client.clientInfo);
+}
+
+void WebTextCheckerClient::guessesForWord(uint64_t tag, const String& word, Vector<String>& guesses)
+{
+    if (!m_client.guessesForWord)
+        return;
+
+    RefPtr<ImmutableArray> wkGuesses = adoptRef(toImpl(m_client.guessesForWord(tag, toAPI(word.impl()), m_client.clientInfo)));
+    size_t numGuesses = wkGuesses->size();
+    for (size_t i = 0; i < numGuesses; ++i)
+        guesses.append(wkGuesses->at<WebString>(i)->string());
+}
+
+void WebTextCheckerClient::learnWord(uint64_t tag, const String& word)
+{
+    if (!m_client.learnWord)
+        return;
+
+    m_client.learnWord(tag, toAPI(word.impl()), m_client.clientInfo);
+}
+
+void WebTextCheckerClient::ignoreWord(uint64_t tag, const String& word)
+{
+    if (!m_client.ignoreWord)
+        return;
+
+    m_client.ignoreWord(tag, toAPI(word.impl()), m_client.clientInfo);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebTextCheckerClient.h b/Source/WebKit2/UIProcess/win/WebTextCheckerClient.h
new file mode 100644
index 0000000..50fb42d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/win/WebTextCheckerClient.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebTextCheckerClient_h
+#define WebTextCheckerClient_h
+
+#include "APIClient.h"
+#include "WKTextChecker.h"
+#include <WebCore/TextCheckerClient.h>
+#include <wtf/Forward.h>
+#include <wtf/Vector.h>
+
+namespace WebKit {
+
+class WebPageProxy;
+
+class WebTextCheckerClient : public APIClient<WKTextCheckerClient> {
+public:
+    bool continuousSpellCheckingAllowed();
+    bool continuousSpellCheckingEnabled();
+    void setContinuousSpellCheckingEnabled(bool);
+    bool grammarCheckingEnabled();
+    void setGrammarCheckingEnabled(bool);
+    uint64_t uniqueSpellDocumentTag(WebPageProxy*);
+    void closeSpellDocumentWithTag(uint64_t);
+    void checkSpellingOfString(uint64_t tag, const String& text, int32_t& misspellingLocation, int32_t& misspellingLength);
+    void checkGrammarOfString(uint64_t tag, const String& text, Vector<WebCore::GrammarDetail>&, int32_t& badGrammarLocation, int32_t& badGrammarLength);
+    bool spellingUIIsShowing();
+    void toggleSpellingUIIsShowing();
+    void updateSpellingUIWithMisspelledWord(uint64_t tag, const String& misspelledWord);
+    void updateSpellingUIWithGrammarString(uint64_t tag, const String& badGrammarPhrase, const WebCore::GrammarDetail&);
+    void guessesForWord(uint64_t tag, const String& word, Vector<String>& guesses);
+    void learnWord(uint64_t tag, const String& word);
+    void ignoreWord(uint64_t tag, const String& word);
+};
+
+} // namespace WebKit
+
+#endif // WebTextCheckerClient_h
diff --git a/Source/WebKit2/UIProcess/win/WebUndoClient.cpp b/Source/WebKit2/UIProcess/win/WebUndoClient.cpp
index 9bc96f5..9b86540 100644
--- a/Source/WebKit2/UIProcess/win/WebUndoClient.cpp
+++ b/Source/WebKit2/UIProcess/win/WebUndoClient.cpp
@@ -49,5 +49,21 @@ void WebUndoClient::clearAllEditCommands(WebView* view)
     m_client.clearAllEditCommands(toAPI(view), m_client.clientInfo);
 }
 
+bool WebUndoClient::canUndoRedo(WebView* view, WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    if (!m_client.canUndoRedo)
+        return false;
+    
+    return m_client.canUndoRedo(toAPI(view), undoOrRedo, m_client.clientInfo);
+}
+
+void WebUndoClient::executeUndoRedo(WebView* view, WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    if (!m_client.executeUndoRedo)
+        return;
+    
+    m_client.executeUndoRedo(toAPI(view), undoOrRedo, m_client.clientInfo);
+}
+
 } // namespace WebKit
 
diff --git a/Source/WebKit2/UIProcess/win/WebUndoClient.h b/Source/WebKit2/UIProcess/win/WebUndoClient.h
index 12582c0..b7fdc15 100755
--- a/Source/WebKit2/UIProcess/win/WebUndoClient.h
+++ b/Source/WebKit2/UIProcess/win/WebUndoClient.h
@@ -39,6 +39,8 @@ class WebUndoClient : public APIClient<WKViewUndoClient> {
 public:
     void registerEditCommand(WebView*, PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo);
     void clearAllEditCommands(WebView*);
+    bool canUndoRedo(WebView*, WebPageProxy::UndoOrRedo);
+    void executeUndoRedo(WebView*, WebPageProxy::UndoOrRedo);
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/win/WebView.cpp b/Source/WebKit2/UIProcess/win/WebView.cpp
index 1447864..8cecb02 100644
--- a/Source/WebKit2/UIProcess/win/WebView.cpp
+++ b/Source/WebKit2/UIProcess/win/WebView.cpp
@@ -31,6 +31,7 @@
 #include "FindIndicator.h"
 #include "Logging.h"
 #include "NativeWebKeyboardEvent.h"
+#include "NativeWebMouseEvent.h"
 #include "Region.h"
 #include "RunLoop.h"
 #include "WKAPICast.h"
@@ -44,13 +45,14 @@
 #include <WebCore/BitmapInfo.h>
 #include <WebCore/Cursor.h>
 #include <WebCore/FloatRect.h>
-#if PLATFORM(CG)
+#if USE(CG)
 #include <WebCore/GraphicsContextCG.h>
 #endif
 #include <WebCore/IntRect.h>
 #include <WebCore/SoftLinking.h>
 #include <WebCore/WebCoreInstanceHandle.h>
 #include <WebCore/WindowMessageBroadcaster.h>
+#include <WebCore/WindowsTouch.h>
 #include <wtf/text/WTFString.h>
 
 namespace Ime {
@@ -67,6 +69,17 @@ SOFT_LINK(IMM32, ImmNotifyIME, BOOL, WINAPI, (HIMC hIMC, DWORD dwAction, DWORD d
 SOFT_LINK(IMM32, ImmAssociateContextEx, BOOL, WINAPI, (HWND hWnd, HIMC hIMC, DWORD dwFlags), (hWnd, hIMC, dwFlags))
 };
 
+// Soft link functions for gestures and panning.
+SOFT_LINK_LIBRARY(USER32);
+SOFT_LINK_OPTIONAL(USER32, GetGestureInfo, BOOL, WINAPI, (HGESTUREINFO, PGESTUREINFO));
+SOFT_LINK_OPTIONAL(USER32, SetGestureConfig, BOOL, WINAPI, (HWND, DWORD, UINT, PGESTURECONFIG, UINT));
+SOFT_LINK_OPTIONAL(USER32, CloseGestureInfoHandle, BOOL, WINAPI, (HGESTUREINFO));
+
+SOFT_LINK_LIBRARY(Uxtheme);
+SOFT_LINK_OPTIONAL(Uxtheme, BeginPanningFeedback, BOOL, WINAPI, (HWND));
+SOFT_LINK_OPTIONAL(Uxtheme, EndPanningFeedback, BOOL, WINAPI, (HWND, BOOL));
+SOFT_LINK_OPTIONAL(Uxtheme, UpdatePanningFeedback, BOOL, WINAPI, (HWND, LONG, LONG, BOOL));
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -157,6 +170,12 @@ LRESULT WebView::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
     case WM_VSCROLL:
         lResult = onVerticalScroll(hWnd, message, wParam, lParam, handled);
         break;
+    case WM_GESTURENOTIFY:
+        lResult = onGestureNotify(hWnd, message, wParam, lParam, handled);
+        break;
+    case WM_GESTURE:
+        lResult = onGesture(hWnd, message, wParam, lParam, handled);
+        break;
     case WM_SYSKEYDOWN:
     case WM_KEYDOWN:
     case WM_SYSCHAR:
@@ -254,6 +273,10 @@ WebView::WebView(RECT rect, WebContext* context, WebPageGroup* pageGroup, HWND p
     , m_inIMEComposition(0)
     , m_findIndicatorCallback(0)
     , m_findIndicatorCallbackContext(0)
+    , m_lastPanX(0)
+    , m_lastPanY(0)
+    , m_overPanY(0)
+    , m_gestureReachedScrollingLimit(false)
 {
     registerWebViewWindowClass();
 
@@ -365,7 +388,7 @@ void WebView::windowAncestryDidChange()
 
 LRESULT WebView::onMouseEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
 {
-    WebMouseEvent mouseEvent = WebEventFactory::createWebMouseEvent(hWnd, message, wParam, lParam, m_wasActivatedByMouseEvent);
+    NativeWebMouseEvent mouseEvent = NativeWebMouseEvent(hWnd, message, wParam, lParam, m_wasActivatedByMouseEvent);
     setWasActivatedByMouseEvent(false);
     
     switch (message) {
@@ -480,6 +503,109 @@ LRESULT WebView::onVerticalScroll(HWND hWnd, UINT message, WPARAM wParam, LPARAM
     return 0;
 }
 
+LRESULT WebView::onGestureNotify(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
+{
+    // We shouldn't be getting any gesture messages without SetGestureConfig soft-linking correctly.
+    ASSERT(SetGestureConfigPtr());
+
+    GESTURENOTIFYSTRUCT* gn = reinterpret_cast<GESTURENOTIFYSTRUCT*>(lParam);
+
+    POINT localPoint = { gn->ptsLocation.x, gn->ptsLocation.y };
+    ::ScreenToClient(m_window, &localPoint);
+
+    bool canPan = m_page->gestureWillBegin(localPoint);
+
+    DWORD dwPanWant = GC_PAN | GC_PAN_WITH_INERTIA | GC_PAN_WITH_GUTTER;
+    DWORD dwPanBlock = GC_PAN_WITH_SINGLE_FINGER_HORIZONTALLY;
+    if (canPan)
+        dwPanWant |= GC_PAN_WITH_SINGLE_FINGER_VERTICALLY;
+    else
+        dwPanBlock |= GC_PAN_WITH_SINGLE_FINGER_VERTICALLY;
+
+    GESTURECONFIG gc = { GID_PAN, dwPanWant, dwPanBlock };
+    return SetGestureConfigPtr()(m_window, 0, 1, &gc, sizeof(gc));
+}
+
+LRESULT WebView::onGesture(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
+{
+    ASSERT(GetGestureInfoPtr());
+    ASSERT(CloseGestureInfoHandlePtr());
+    ASSERT(UpdatePanningFeedbackPtr());
+    ASSERT(BeginPanningFeedbackPtr());
+    ASSERT(EndPanningFeedbackPtr());
+
+    if (!GetGestureInfoPtr() || !CloseGestureInfoHandlePtr() || !UpdatePanningFeedbackPtr() || !BeginPanningFeedbackPtr() || !EndPanningFeedbackPtr()) {
+        handled = false;
+        return 0;
+    }
+
+    HGESTUREINFO gestureHandle = reinterpret_cast<HGESTUREINFO>(lParam);
+    GESTUREINFO gi = {0};
+    gi.cbSize = sizeof(GESTUREINFO);
+
+    if (!GetGestureInfoPtr()(gestureHandle, &gi)) {
+        handled = false;
+        return 0;
+    }
+
+    switch (gi.dwID) {
+    case GID_BEGIN:
+        m_lastPanX = gi.ptsLocation.x;
+        m_lastPanY = gi.ptsLocation.y;
+        break;
+    case GID_END:
+        m_page->gestureDidEnd();
+        break;
+    case GID_PAN: {
+        int currentX = gi.ptsLocation.x;
+        int currentY = gi.ptsLocation.y;
+
+        // Reverse the calculations because moving your fingers up should move the screen down, and
+        // vice-versa.
+        int deltaX = m_lastPanX - currentX;
+        int deltaY = m_lastPanY - currentY;
+
+        m_lastPanX = currentX;
+        m_lastPanY = currentY;
+
+        // Calculate the overpan for window bounce.
+        m_overPanY -= deltaY;
+
+        if (deltaX || deltaY)
+            m_page->gestureDidScroll(IntSize(deltaX, deltaY));
+
+        if (gi.dwFlags & GF_BEGIN) {
+            BeginPanningFeedbackPtr()(m_window);
+            m_gestureReachedScrollingLimit = false;
+            m_overPanY = 0;
+        } else if (gi.dwFlags & GF_END) {
+            EndPanningFeedbackPtr()(m_window, true);
+            m_overPanY = 0;
+        }
+
+        // FIXME: Support horizontal window bounce - <http://webkit.org/b/58068>.
+        // FIXME: Window Bounce doesn't undo until user releases their finger - <http://webkit.org/b/58069>.
+
+        if (m_gestureReachedScrollingLimit)
+            UpdatePanningFeedbackPtr()(m_window, 0, m_overPanY, gi.dwFlags & GF_INERTIA);
+
+        CloseGestureInfoHandlePtr()(gestureHandle);
+
+        handled = true;
+        return 0;
+    }
+    default:
+        break;
+    }
+
+    // If we get to this point, the gesture has not been handled. We forward
+    // the call to DefWindowProc by returning false, and we don't need to 
+    // to call CloseGestureInfoHandle. 
+    // http://msdn.microsoft.com/en-us/library/dd353228(VS.85).aspx
+    handled = false;
+    return 0;
+}
+
 LRESULT WebView::onKeyEvent(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam, bool& handled)
 {
     m_page->handleKeyboardEvent(NativeWebKeyboardEvent(hWnd, message, wParam, lParam));
@@ -565,8 +691,22 @@ LRESULT WebView::onPrintClientEvent(HWND hWnd, UINT, WPARAM wParam, LPARAM, bool
     RECT winRect;
     ::GetClientRect(hWnd, &winRect);
 
+    // Twidding the visibility flags tells the DrawingArea to resume painting. Right now, the
+    // the visible state of the view only affects whether or not painting happens, but in the
+    // future it could affect more, which we wouldn't want to touch here.
+
+    // FIXME: We should have a better way of telling the WebProcess to draw even if we're
+    // invisible than twiddling the visibility flag.
+
+    bool wasVisible = isViewVisible();
+    if (!wasVisible)
+        setIsVisible(true);
+
     paint(hdc, winRect);
 
+    if (!wasVisible)
+        setIsVisible(false);
+
     handled = true;
     return 0;
 }
@@ -626,11 +766,8 @@ LRESULT WebView::onShowWindowEvent(HWND hWnd, UINT message, WPARAM wParam, LPARA
     // lParam is 0 when the message is sent because of a ShowWindow call.
     // FIXME: Since we don't get notified when an ancestor window is hidden or shown, we will keep
     // painting even when we have a hidden ancestor. <http://webkit.org/b/54104>
-    if (!lParam) {
-        m_isVisible = wParam;
-        if (m_page)
-            m_page->viewStateDidChange(WebPageProxy::ViewIsVisible);
-    }
+    if (!lParam)
+        setIsVisible(wParam);
 
     handled = false;
     return 0;
@@ -760,6 +897,15 @@ void WebView::close()
 {
     m_undoClient.initialize(0);
     ::RevokeDragDrop(m_window);
+    if (m_window) {
+        // We can't check IsWindow(m_window) here, because that will return true even while
+        // we're already handling WM_DESTROY. So we check !m_isBeingDestroyed instead.
+        if (!m_isBeingDestroyed)
+            DestroyWindow(m_window);
+        // Either we just destroyed m_window, or it's in the process of being destroyed. Either
+        // way, we clear it out to make sure we don't try to use it later.
+        m_window = 0;
+    }
     setParentWindow(0);
     m_page->close();
 }
@@ -844,10 +990,6 @@ void WebView::didRelaunchProcess()
     ::InvalidateRect(m_window, 0, TRUE);
 }
 
-void WebView::takeFocus(bool)
-{
-}
-
 void WebView::toolTipChanged(const String&, const String& newToolTip)
 {
     if (!m_toolTipWindow)
@@ -929,6 +1071,16 @@ void WebView::clearAllEditCommands()
     m_undoClient.clearAllEditCommands(this);
 }
 
+bool WebView::canUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    return m_undoClient.canUndoRedo(this, undoOrRedo);
+}
+
+void WebView::executeUndoRedo(WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    m_undoClient.executeUndoRedo(this, undoOrRedo);
+}
+    
 void WebView::reapplyEditCommand(WebEditCommandProxy* command)
 {
     if (!m_page->isValid() || !m_page->isValidEditCommand(command))
@@ -996,7 +1148,7 @@ void WebView::setInputMethodState(bool enabled)
 
 void WebView::compositionSelectionChanged(bool hasChanged)
 {
-    if (m_page->selectionState().hasComposition && !hasChanged)
+    if (m_page->editorState().hasComposition && !hasChanged)
         resetIME();
 }
 
@@ -1104,7 +1256,7 @@ bool WebView::onIMEComposition(LPARAM lparam)
     if (!hInputContext)
         return true;
 
-    if (!m_page->selectionState().isContentEditable)
+    if (!m_page->editorState().isContentEditable)
         return true;
 
     prepareCandidateWindow(hInputContext);
@@ -1147,7 +1299,7 @@ bool WebView::onIMEEndComposition()
     LOG(TextInput, "onIMEEndComposition");
     // If the composition hasn't been confirmed yet, it needs to be cancelled.
     // This happens after deleting the last character from inline input hole.
-    if (m_page->selectionState().hasComposition)
+    if (m_page->editorState().hasComposition)
         m_page->confirmComposition(String());
 
     if (m_inIMEComposition)
@@ -1158,7 +1310,7 @@ bool WebView::onIMEEndComposition()
 
 LRESULT WebView::onIMERequestCharPosition(IMECHARPOSITION* charPos)
 {
-    if (charPos->dwCharPos && !m_page->selectionState().hasComposition)
+    if (charPos->dwCharPos && !m_page->editorState().hasComposition)
         return 0;
     IntRect caret = m_page->firstRectForCharacterInSelectedRange(charPos->dwCharPos);
     charPos->pt.x = caret.x();
@@ -1190,7 +1342,7 @@ LRESULT WebView::onIMERequestReconvertString(RECONVERTSTRING* reconvertString)
 LRESULT WebView::onIMERequest(WPARAM request, LPARAM data)
 {
     LOG(TextInput, "onIMERequest %s", imeRequestName(request).latin1().data());
-    if (!m_page->selectionState().isContentEditable)
+    if (!m_page->editorState().isContentEditable)
         return 0;
 
     switch (request) {
@@ -1254,7 +1406,7 @@ void WebView::setFindIndicator(PassRefPtr<FindIndicator> prpFindIndicator, bool
 
             hbmp = CreateDIBSection(0, &bitmapInfo, DIB_RGB_COLORS, static_cast<void**>(&bits), 0, 0);
             HBITMAP hbmpOld = static_cast<HBITMAP>(SelectObject(hdc, hbmp));
-#if PLATFORM(CG)
+#if USE(CG)
             RetainPtr<CGContextRef> context(AdoptCF, CGBitmapContextCreate(bits, width, height,
                 8, width * sizeof(RGBQUAD), deviceRGBColorSpaceRef(), kCGBitmapByteOrder32Little | kCGImageAlphaPremultipliedFirst));
 
@@ -1310,12 +1462,28 @@ void WebView::didChangeScrollbarsForMainFrame() const
 {
 }
 
+void WebView::findStringInCustomRepresentation(const String&, FindOptions, unsigned)
+{
+}
+
+void WebView::countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned)
+{
+}
+
 void WebView::setIsInWindow(bool isInWindow)
 {
     m_isInWindow = isInWindow;
     m_page->viewStateDidChange(WebPageProxy::ViewIsInWindow);
 }
 
+void WebView::setIsVisible(bool isVisible)
+{
+    m_isVisible = isVisible;
+
+    if (m_page)
+        m_page->viewStateDidChange(WebPageProxy::ViewIsVisible);
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 
 void WebView::enterAcceleratedCompositingMode(const LayerTreeContext&)
@@ -1425,7 +1593,7 @@ HRESULT STDMETHODCALLTYPE WebView::DragEnter(IDataObject* pDataObject, DWORD grf
     POINTL localpt = pt;
     ::ScreenToClient(m_window, (LPPOINT)&localpt);
     DragData data(pDataObject, IntPoint(localpt.x, localpt.y), IntPoint(pt.x, pt.y), keyStateToDragOperation(grfKeyState));
-    m_page->performDragControllerAction(DragControllerActionEntered, &data);
+    m_page->dragEntered(&data);
     *pdwEffect = dragOperationToDragCursor(m_page->dragOperation());
 
     m_lastDropEffect = *pdwEffect;
@@ -1443,7 +1611,7 @@ HRESULT STDMETHODCALLTYPE WebView::DragOver(DWORD grfKeyState, POINTL pt, DWORD*
         POINTL localpt = pt;
         ::ScreenToClient(m_window, (LPPOINT)&localpt);
         DragData data(m_dragData.get(), IntPoint(localpt.x, localpt.y), IntPoint(pt.x, pt.y), keyStateToDragOperation(grfKeyState));
-        m_page->performDragControllerAction(DragControllerActionUpdated, &data);
+        m_page->dragUpdated(&data);
         *pdwEffect = dragOperationToDragCursor(m_page->dragOperation());
     } else
         *pdwEffect = DROPEFFECT_NONE;
@@ -1459,7 +1627,7 @@ HRESULT STDMETHODCALLTYPE WebView::DragLeave()
 
     if (m_dragData) {
         DragData data(m_dragData.get(), IntPoint(), IntPoint(), DragOperationNone);
-        m_page->performDragControllerAction(DragControllerActionExited, &data);
+        m_page->dragExited(&data);
         m_dragData = 0;
         m_page->resetDragOperation();
     }
@@ -1476,7 +1644,9 @@ HRESULT STDMETHODCALLTYPE WebView::Drop(IDataObject* pDataObject, DWORD grfKeySt
     POINTL localpt = pt;
     ::ScreenToClient(m_window, (LPPOINT)&localpt);
     DragData data(pDataObject, IntPoint(localpt.x, localpt.y), IntPoint(pt.x, pt.y), keyStateToDragOperation(grfKeyState));
-    m_page->performDragControllerAction(DragControllerActionPerformDrag, &data);
+
+    SandboxExtension::Handle sandboxExtensionHandle;
+    m_page->performDrag(&data, String(), sandboxExtensionHandle);
     return S_OK;
 }
 
diff --git a/Source/WebKit2/UIProcess/win/WebView.h b/Source/WebKit2/UIProcess/win/WebView.h
index 1d65179..d62311c 100644
--- a/Source/WebKit2/UIProcess/win/WebView.h
+++ b/Source/WebKit2/UIProcess/win/WebView.h
@@ -60,6 +60,7 @@ public:
     void setParentWindow(HWND);
     void windowAncestryDidChange();
     void setIsInWindow(bool);
+    void setIsVisible(bool);
     void setOverrideCursor(HCURSOR);
     void setInitialFocus(bool forward);
     void setScrollOffsetOnNextResize(const WebCore::IntSize&);
@@ -97,6 +98,8 @@ private:
     LRESULT onWheelEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onHorizontalScroll(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onVerticalScroll(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
+    LRESULT onGestureNotify(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
+    LRESULT onGesture(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onKeyEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onPaintEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
     LRESULT onPrintClientEvent(HWND hWnd, UINT message, WPARAM, LPARAM, bool& handled);
@@ -154,13 +157,13 @@ private:
     virtual void processDidCrash();
     virtual void didRelaunchProcess();
     virtual void pageClosed();
-    virtual void takeFocus(bool direction);
-    virtual void setFocus(bool focused) { }
     virtual void toolTipChanged(const WTF::String&, const WTF::String&);
     virtual void setCursor(const WebCore::Cursor&);
     virtual void setViewportArguments(const WebCore::ViewportArguments&);
     virtual void registerEditCommand(PassRefPtr<WebEditCommandProxy>, WebPageProxy::UndoOrRedo);
     virtual void clearAllEditCommands();
+    virtual bool canUndoRedo(WebPageProxy::UndoOrRedo);
+    virtual void executeUndoRedo(WebPageProxy::UndoOrRedo);
     virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect&);
     virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect&);
     virtual WebCore::IntRect windowToScreen(const WebCore::IntRect&);
@@ -182,8 +185,13 @@ private:
     WebCore::DragOperation keyStateToDragOperation(DWORD grfKeyState) const;
     virtual void didChangeScrollbarsForMainFrame() const;
 
+    virtual void findStringInCustomRepresentation(const String&, FindOptions, unsigned maxMatchCount);
+    virtual void countStringMatchesInCustomRepresentation(const String&, FindOptions, unsigned maxMatchCount);
+
     virtual HWND nativeWindow();
 
+    virtual void setGestureReachedScrollingLimit(bool limitReached) { m_gestureReachedScrollingLimit = limitReached; }
+
     // WebCore::WindowMessageListener
     virtual void windowReceivedMessage(HWND, UINT message, WPARAM, LPARAM);
 
@@ -219,6 +227,13 @@ private:
     // Thus, on return from DoDragDrop we have the correct pdwEffect for the drag-and-drop operation.
     // (see https://bugs.webkit.org/show_bug.cgi?id=29264)
     DWORD m_lastDropEffect;
+
+    int m_lastPanX;
+    int m_lastPanY;
+
+    int m_overPanY;
+
+    bool m_gestureReachedScrollingLimit;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebKit2.pro b/Source/WebKit2/WebKit2.pro
index d3b0814..47a1ebc 100644
--- a/Source/WebKit2/WebKit2.pro
+++ b/Source/WebKit2/WebKit2.pro
@@ -107,6 +107,9 @@ HEADERS += \
     Platform/SharedMemory.h \
     Platform/WorkItem.h \
     Platform/WorkQueue.h \
+    PluginProcess/PluginControllerProxy.h \
+    PluginProcess/PluginProcess.h \
+    PluginProcess/WebProcessConnection.h \
     Shared/ShareableBitmap.h \
     Shared/CacheModel.h \
     Shared/ChildProcess.h \
@@ -120,6 +123,7 @@ HEADERS += \
     Shared/MutableArray.h \
     Shared/MutableDictionary.h \
     Shared/NativeWebKeyboardEvent.h \
+    Shared/NativeWebMouseEvent.h \
     Shared/OriginAndDatabases.h \
     Shared/PlatformPopupMenuData.h \
     Shared/PrintInfo.h \
@@ -207,6 +211,7 @@ HEADERS += \
     UIProcess/WebGeolocationProvider.h \
     UIProcess/WebHistoryClient.h \
     UIProcess/WebIconDatabase.h \
+    UIProcess/WebIconDatabaseClient.h \
     UIProcess/WebInspectorProxy.h \
     UIProcess/WebKeyValueStorageManagerProxy.h \
     UIProcess/WebLoaderClient.h \
@@ -297,17 +302,23 @@ SOURCES += \
     Platform/CoreIPC/BinarySemaphore.cpp \
     Platform/CoreIPC/Connection.cpp \
     Platform/CoreIPC/DataReference.cpp \
-    Platform/CoreIPC/qt/AttachmentQt.cpp \
-    Platform/CoreIPC/qt/ConnectionQt.cpp \
+    Platform/CoreIPC/unix/AttachmentUnix.cpp \
+    Platform/CoreIPC/unix/ConnectionUnix.cpp \
     Platform/Logging.cpp \
     Platform/Module.cpp \
     Platform/RunLoop.cpp \
     Platform/WorkQueue.cpp \
     Platform/qt/ModuleQt.cpp \
     Platform/qt/RunLoopQt.cpp \
-    Platform/qt/SharedMemoryQt.cpp \
     Platform/qt/WorkQueueQt.cpp \
+    Platform/unix/SharedMemoryUnix.cpp \
+    PluginProcess/PluginControllerProxy.cpp \
+    PluginProcess/PluginProcess.cpp \
+    PluginProcess/WebProcessConnection.cpp \
+    PluginProcess/qt/PluginControllerProxyQt.cpp \
+    PluginProcess/qt/PluginProcessQt.cpp \
     Shared/Plugins/Netscape/NetscapePluginModule.cpp \
+    Shared/Plugins/Netscape/NetscapePluginModuleNone.cpp \
     Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp \
     Shared/ShareableBitmap.cpp \
     Shared/Plugins/NPRemoteObjectMap.cpp \
@@ -353,6 +364,7 @@ SOURCES += \
     Shared/WebWheelEvent.cpp \
     Shared/qt/ShareableBitmapQt.cpp \
     Shared/qt/NativeWebKeyboardEventQt.cpp \
+    Shared/qt/NativeWebMouseEventQt.cpp \
     Shared/qt/UpdateChunk.cpp \
     Shared/qt/WebCoreArgumentCodersQt.cpp \
     Shared/qt/WebEventFactoryQt.cpp \
@@ -403,6 +415,7 @@ SOURCES += \
     UIProcess/WebGeolocationProvider.cpp \
     UIProcess/WebHistoryClient.cpp \
     UIProcess/WebIconDatabase.cpp \
+    UIProcess/WebIconDatabaseClient.cpp \
     UIProcess/WebInspectorProxy.cpp \
     UIProcess/WebKeyValueStorageManagerProxy.cpp \
     UIProcess/WebLoaderClient.cpp \
@@ -466,6 +479,7 @@ SOURCES += \
     WebProcess/Plugins/Netscape/NPRuntimeUtilities.cpp \
     WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp \
     WebProcess/Plugins/Netscape/NetscapePlugin.cpp \
+    WebProcess/Plugins/Netscape/NetscapePluginNone.cpp \
     WebProcess/Plugins/Netscape/NetscapePluginStream.cpp \
     WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp \
     WebProcess/Plugins/Netscape/qt/PluginProxyQt.cpp \
diff --git a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
index d54f8f2..d899e1d 100644
--- a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
+++ b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
@@ -179,7 +179,7 @@
 		1AA2E51E12E4C05E00BC4966 /* CGUtilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AA2E51C12E4C05E00BC4966 /* CGUtilities.cpp */; };
 		1AA417CB12C00CCA002BE67B /* TextChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AA417C912C00CCA002BE67B /* TextChecker.h */; };
 		1AA417EF12C00D87002BE67B /* TextCheckerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AA417ED12C00D87002BE67B /* TextCheckerMac.mm */; };
-		1AA41AB512C02EC4002BE67B /* SelectionState.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AA41AB412C02EC4002BE67B /* SelectionState.h */; };
+		1AA41AB512C02EC4002BE67B /* EditorState.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AA41AB412C02EC4002BE67B /* EditorState.h */; };
 		1AA4792312A59FD9008236C3 /* PluginProcessMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AA4792212A59FD9008236C3 /* PluginProcessMac.mm */; };
 		1AA479B012A5A436008236C3 /* Carbon.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1AA1CD06100FA1BA0078DEBC /* Carbon.framework */; };
 		1AA56F2911E92BC80061B882 /* PluginController.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AA56F2811E92BC80061B882 /* PluginController.h */; };
@@ -236,6 +236,7 @@
 		1CA8B954127C891500576C2B /* WebInspectorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1C8E2DAD1278C5B200BC7BD0 /* WebInspectorMac.mm */; };
 		29CD55AA128E294F00133C85 /* AccessibilityWebPageObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 29CD55A8128E294F00133C85 /* AccessibilityWebPageObject.h */; };
 		29CD55AB128E294F00133C85 /* AccessibilityWebPageObject.mm in Sources */ = {isa = PBXBuildFile; fileRef = 29CD55A9128E294F00133C85 /* AccessibilityWebPageObject.mm */; };
+		31EA25D2134F78C0005B1452 /* NativeWebMouseEventMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 31EA25D0134F78B2005B1452 /* NativeWebMouseEventMac.mm */; };
 		330934471315B9220097A7BC /* WebCookieManagerMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 330934431315B9220097A7BC /* WebCookieManagerMessageReceiver.cpp */; };
 		330934481315B9220097A7BC /* WebCookieManagerMessages.h in Headers */ = {isa = PBXBuildFile; fileRef = 330934441315B9220097A7BC /* WebCookieManagerMessages.h */; };
 		330934491315B9220097A7BC /* WebCookieManagerProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 330934451315B9220097A7BC /* WebCookieManagerProxyMessageReceiver.cpp */; };
@@ -323,6 +324,8 @@
 		51578B831209ECEF00A37C4A /* WebData.h in Headers */ = {isa = PBXBuildFile; fileRef = 51578B821209ECEF00A37C4A /* WebData.h */; };
 		5160BFE113381DF900918999 /* Logging.mac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5160BFE013381DF900918999 /* Logging.mac.mm */; };
 		516A4A5D120A2CCD00C05B7F /* WebError.h in Headers */ = {isa = PBXBuildFile; fileRef = 516A4A5B120A2CCD00C05B7F /* WebError.h */; };
+		51834592134532E90092B696 /* WebIconDatabaseClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51834590134532E80092B696 /* WebIconDatabaseClient.cpp */; };
+		51834593134532E90092B696 /* WebIconDatabaseClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 51834591134532E80092B696 /* WebIconDatabaseClient.h */; };
 		51871B5B127CB89D00F76232 /* WebContextMenu.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51871B59127CB89D00F76232 /* WebContextMenu.cpp */; };
 		51871B5C127CB89D00F76232 /* WebContextMenu.h in Headers */ = {isa = PBXBuildFile; fileRef = 51871B5A127CB89D00F76232 /* WebContextMenu.h */; };
 		518ACAEA12AEE6BB00B04B83 /* WKProtectionSpaceTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 518ACAE912AEE6BB00B04B83 /* WKProtectionSpaceTypes.h */; settings = {ATTRIBUTES = (Public, ); }; };
@@ -643,7 +646,6 @@
 		BCB0B0E012305AB100B1341E /* UserMessageCoders.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB0B0DF12305AB100B1341E /* UserMessageCoders.h */; };
 		BCB28CC0120233D9007D99BC /* InjectedBundleMessageKinds.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB28CBF120233D9007D99BC /* InjectedBundleMessageKinds.h */; };
 		BCB63478116BF10600603215 /* WebKit2.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB63477116BF10600603215 /* WebKit2.h */; settings = {ATTRIBUTES = (Public, ); }; };
-		BCB7346E11CEE3FF00EC5002 /* WebProcessProxyMessageKinds.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB7346D11CEE3FF00EC5002 /* WebProcessProxyMessageKinds.h */; };
 		BCB9E2431120DACA00A137E0 /* WebContext.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB9E2411120DACA00A137E0 /* WebContext.h */; };
 		BCB9E2441120DACA00A137E0 /* WebContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCB9E2421120DACA00A137E0 /* WebContext.cpp */; };
 		BCB9E24B1120E15C00A137E0 /* WKContext.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB9E2491120E15C00A137E0 /* WKContext.h */; settings = {ATTRIBUTES = (Public, ); }; };
@@ -762,11 +764,14 @@
 		C0E3AA7A1209E83000A49D01 /* ModuleMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C0E3AA481209E45000A49D01 /* ModuleMac.mm */; };
 		C0E3AA7B1209E83500A49D01 /* Module.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0E3AA451209E2BA00A49D01 /* Module.cpp */; };
 		C0E3AA7C1209E83C00A49D01 /* Module.h in Headers */ = {isa = PBXBuildFile; fileRef = C0E3AA441209E2BA00A49D01 /* Module.h */; };
+		C0FA52431345694A0028E8C2 /* LayerTreeHostCAMac.h in Headers */ = {isa = PBXBuildFile; fileRef = C0FA52421345694A0028E8C2 /* LayerTreeHostCAMac.h */; };
 		C517388112DF8F4F00EE3F47 /* DragControllerAction.h in Headers */ = {isa = PBXBuildFile; fileRef = C517388012DF8F4F00EE3F47 /* DragControllerAction.h */; };
 		C5237F6012441CA300780472 /* WebEditorClientMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5237F5F12441CA300780472 /* WebEditorClientMac.mm */; };
 		C574A37712E6099D002DFE98 /* WebDragClientMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C554FFA212E4E8EA002F22C0 /* WebDragClientMac.mm */; };
 		C574A58112E66681002DFE98 /* PasteboardTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = C574A57F12E66681002DFE98 /* PasteboardTypes.h */; };
 		C574A58212E66681002DFE98 /* PasteboardTypes.mm in Sources */ = {isa = PBXBuildFile; fileRef = C574A58012E66681002DFE98 /* PasteboardTypes.mm */; };
+		CD5C66A0134B9D38004FE2A8 /* InjectedBundlePageFullScreenClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD5C669E134B9D36004FE2A8 /* InjectedBundlePageFullScreenClient.cpp */; };
+		CD5C66A1134B9D38004FE2A8 /* InjectedBundlePageFullScreenClient.h in Headers */ = {isa = PBXBuildFile; fileRef = CD5C669F134B9D37004FE2A8 /* InjectedBundlePageFullScreenClient.h */; };
 		CD6F75F4131B66D000D6B21E /* WebFullScreenManagerProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD73BA3E131A2E8A00EEDED2 /* WebFullScreenManagerProxy.cpp */; };
 		CD73BA47131ACC9A00EEDED2 /* WebFullScreenManagerProxyMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD73BA45131ACC8800EEDED2 /* WebFullScreenManagerProxyMessageReceiver.cpp */; };
 		CD73BA4E131ACDB700EEDED2 /* WebFullScreenManagerMessageReceiver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD73BA48131ACD8E00EEDED2 /* WebFullScreenManagerMessageReceiver.cpp */; };
@@ -782,7 +787,11 @@
 		D3B9484911FF4B6500032B39 /* WebSearchPopupMenu.h in Headers */ = {isa = PBXBuildFile; fileRef = D3B9484511FF4B6500032B39 /* WebSearchPopupMenu.h */; };
 		E134F01712EA5D33004EC58D /* WKPrintingView.h in Headers */ = {isa = PBXBuildFile; fileRef = E134F01512EA5D11004EC58D /* WKPrintingView.h */; };
 		E134F01A12EA5D99004EC58D /* WKPrintingView.mm in Sources */ = {isa = PBXBuildFile; fileRef = E134F01912EA5D99004EC58D /* WKPrintingView.mm */; };
+		E179FD9C134D38060015B883 /* ArgumentCodersMac.h in Headers */ = {isa = PBXBuildFile; fileRef = E179FD9B134D38060015B883 /* ArgumentCodersMac.h */; };
+		E179FD9F134D38250015B883 /* ArgumentCodersMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E179FD9E134D38250015B883 /* ArgumentCodersMac.mm */; };
 		E18C92F412DB9E7100CF2AEB /* PrintInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18C92F312DB9E7100CF2AEB /* PrintInfo.cpp */; };
+		E1A31732134CEA6C007C9A4F /* AttributedString.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A31731134CEA6C007C9A4F /* AttributedString.h */; };
+		E1A31735134CEA80007C9A4F /* AttributedString.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1A31734134CEA80007C9A4F /* AttributedString.mm */; };
 		E1BB16A413201B9B00F49431 /* FullKeyboardAccessWatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = E1BB1688132018BA00F49431 /* FullKeyboardAccessWatcher.h */; };
 		E1BB16A513201B9B00F49431 /* FullKeyboardAccessWatcher.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1BB1689132018BA00F49431 /* FullKeyboardAccessWatcher.mm */; };
 		E1CC1B9012D7EADF00625838 /* PrintInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = E1CC1B8E12D7EADF00625838 /* PrintInfo.h */; };
@@ -1046,7 +1055,7 @@
 		1AA2E51C12E4C05E00BC4966 /* CGUtilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CGUtilities.cpp; sourceTree = "<group>"; };
 		1AA417C912C00CCA002BE67B /* TextChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextChecker.h; sourceTree = "<group>"; };
 		1AA417ED12C00D87002BE67B /* TextCheckerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TextCheckerMac.mm; sourceTree = "<group>"; };
-		1AA41AB412C02EC4002BE67B /* SelectionState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SelectionState.h; sourceTree = "<group>"; };
+		1AA41AB412C02EC4002BE67B /* EditorState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditorState.h; sourceTree = "<group>"; };
 		1AA4792212A59FD9008236C3 /* PluginProcessMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PluginProcessMac.mm; sourceTree = "<group>"; };
 		1AA56F2811E92BC80061B882 /* PluginController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginController.h; sourceTree = "<group>"; };
 		1AA5889011EE70400061B882 /* NetscapePluginStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetscapePluginStream.h; sourceTree = "<group>"; };
@@ -1108,6 +1117,8 @@
 		1CA8B944127C882A00576C2B /* WebInspectorProxyMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebInspectorProxyMessages.h; sourceTree = "<group>"; };
 		29CD55A8128E294F00133C85 /* AccessibilityWebPageObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityWebPageObject.h; sourceTree = "<group>"; };
 		29CD55A9128E294F00133C85 /* AccessibilityWebPageObject.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AccessibilityWebPageObject.mm; sourceTree = "<group>"; };
+		31EA25D0134F78B2005B1452 /* NativeWebMouseEventMac.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = NativeWebMouseEventMac.mm; sourceTree = "<group>"; };
+		31EA25D3134F78D6005B1452 /* NativeWebMouseEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NativeWebMouseEvent.h; sourceTree = "<group>"; };
 		32DBCF5E0370ADEE00C91783 /* WebKit2Prefix.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKit2Prefix.h; sourceTree = "<group>"; };
 		330934431315B9220097A7BC /* WebCookieManagerMessageReceiver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebCookieManagerMessageReceiver.cpp; sourceTree = "<group>"; };
 		330934441315B9220097A7BC /* WebCookieManagerMessages.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCookieManagerMessages.h; sourceTree = "<group>"; };
@@ -1204,6 +1215,8 @@
 		516A4A5B120A2CCD00C05B7F /* WebError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebError.h; sourceTree = "<group>"; };
 		517A33B3130B308C00F80CB5 /* WKApplicationCacheManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKApplicationCacheManager.cpp; sourceTree = "<group>"; };
 		517A33B4130B308C00F80CB5 /* WKApplicationCacheManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKApplicationCacheManager.h; sourceTree = "<group>"; };
+		51834590134532E80092B696 /* WebIconDatabaseClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebIconDatabaseClient.cpp; sourceTree = "<group>"; };
+		51834591134532E80092B696 /* WebIconDatabaseClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebIconDatabaseClient.h; sourceTree = "<group>"; };
 		5184BC4A132E907A006B9E28 /* WebIconDatabase.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebIconDatabase.messages.in; sourceTree = "<group>"; };
 		51871B59127CB89D00F76232 /* WebContextMenu.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebContextMenu.cpp; sourceTree = "<group>"; };
 		51871B5A127CB89D00F76232 /* WebContextMenu.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContextMenu.h; sourceTree = "<group>"; };
@@ -1537,7 +1550,6 @@
 		BCB0B0DF12305AB100B1341E /* UserMessageCoders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserMessageCoders.h; sourceTree = "<group>"; };
 		BCB28CBF120233D9007D99BC /* InjectedBundleMessageKinds.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundleMessageKinds.h; sourceTree = "<group>"; };
 		BCB63477116BF10600603215 /* WebKit2.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKit2.h; sourceTree = "<group>"; };
-		BCB7346D11CEE3FF00EC5002 /* WebProcessProxyMessageKinds.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebProcessProxyMessageKinds.h; sourceTree = "<group>"; };
 		BCB86F4B116AAACD00CE20B7 /* WebKit2.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = WebKit2.xcconfig; sourceTree = "<group>"; };
 		BCB9E2411120DACA00A137E0 /* WebContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebContext.h; sourceTree = "<group>"; };
 		BCB9E2421120DACA00A137E0 /* WebContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebContext.cpp; sourceTree = "<group>"; };
@@ -1671,11 +1683,14 @@
 		C0E3AA441209E2BA00A49D01 /* Module.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Module.h; sourceTree = "<group>"; };
 		C0E3AA451209E2BA00A49D01 /* Module.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Module.cpp; sourceTree = "<group>"; };
 		C0E3AA481209E45000A49D01 /* ModuleMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ModuleMac.mm; sourceTree = "<group>"; };
+		C0FA52421345694A0028E8C2 /* LayerTreeHostCAMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayerTreeHostCAMac.h; sourceTree = "<group>"; };
 		C517388012DF8F4F00EE3F47 /* DragControllerAction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragControllerAction.h; sourceTree = "<group>"; };
 		C5237F5F12441CA300780472 /* WebEditorClientMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebEditorClientMac.mm; sourceTree = "<group>"; };
 		C554FFA212E4E8EA002F22C0 /* WebDragClientMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebDragClientMac.mm; sourceTree = "<group>"; };
 		C574A57F12E66681002DFE98 /* PasteboardTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardTypes.h; sourceTree = "<group>"; };
 		C574A58012E66681002DFE98 /* PasteboardTypes.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PasteboardTypes.mm; sourceTree = "<group>"; };
+		CD5C669E134B9D36004FE2A8 /* InjectedBundlePageFullScreenClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundlePageFullScreenClient.cpp; sourceTree = "<group>"; };
+		CD5C669F134B9D37004FE2A8 /* InjectedBundlePageFullScreenClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundlePageFullScreenClient.h; sourceTree = "<group>"; };
 		CD73BA37131A29FE00EEDED2 /* WebFullScreenManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebFullScreenManager.cpp; path = FullScreen/WebFullScreenManager.cpp; sourceTree = "<group>"; };
 		CD73BA38131A29FE00EEDED2 /* WebFullScreenManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebFullScreenManager.h; path = FullScreen/WebFullScreenManager.h; sourceTree = "<group>"; };
 		CD73BA39131A29FE00EEDED2 /* WebFullScreenManager.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebFullScreenManager.messages.in; path = FullScreen/WebFullScreenManager.messages.in; sourceTree = "<group>"; };
@@ -1698,7 +1713,11 @@
 		D3B9484511FF4B6500032B39 /* WebSearchPopupMenu.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSearchPopupMenu.h; sourceTree = "<group>"; };
 		E134F01512EA5D11004EC58D /* WKPrintingView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKPrintingView.h; sourceTree = "<group>"; };
 		E134F01912EA5D99004EC58D /* WKPrintingView.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WKPrintingView.mm; sourceTree = "<group>"; };
+		E179FD9B134D38060015B883 /* ArgumentCodersMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArgumentCodersMac.h; sourceTree = "<group>"; };
+		E179FD9E134D38250015B883 /* ArgumentCodersMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ArgumentCodersMac.mm; sourceTree = "<group>"; };
 		E18C92F312DB9E7100CF2AEB /* PrintInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PrintInfo.cpp; sourceTree = "<group>"; };
+		E1A31731134CEA6C007C9A4F /* AttributedString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AttributedString.h; sourceTree = "<group>"; };
+		E1A31734134CEA80007C9A4F /* AttributedString.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AttributedString.mm; sourceTree = "<group>"; };
 		E1BB1688132018BA00F49431 /* FullKeyboardAccessWatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FullKeyboardAccessWatcher.h; sourceTree = "<group>"; };
 		E1BB1689132018BA00F49431 /* FullKeyboardAccessWatcher.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; path = FullKeyboardAccessWatcher.mm; sourceTree = "<group>"; };
 		E1CC1B8E12D7EADF00625838 /* PrintInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrintInfo.h; sourceTree = "<group>"; };
@@ -2053,6 +2072,7 @@
 				BCB0AEE8122F53E300B1341E /* MutableDictionary.cpp */,
 				BCB0AEE7122F53E300B1341E /* MutableDictionary.h */,
 				C02BFF1512514FD8009CCBEA /* NativeWebKeyboardEvent.h */,
+				31EA25D3134F78D6005B1452 /* NativeWebMouseEvent.h */,
 				BCCF673212C7F15C008F9C35 /* OriginAndDatabases.cpp */,
 				BCCF672C12C7EDF7008F9C35 /* OriginAndDatabases.h */,
 				BCC43AB8127B95DC00317F16 /* PlatformPopupMenuData.cpp */,
@@ -2066,7 +2086,7 @@
 				1AAB4A8C1296F0A20023952F /* SandboxExtension.h */,
 				33152973130D0CB200ED2483 /* SecurityOriginData.cpp */,
 				33152974130D0CB200ED2483 /* SecurityOriginData.h */,
-				1AA41AB412C02EC4002BE67B /* SelectionState.h */,
+				1AA41AB412C02EC4002BE67B /* EditorState.h */,
 				518D2CC812D51DFB003BB93B /* SessionState.cpp */,
 				518D2CC912D51DFB003BB93B /* SessionState.h */,
 				1A6420E212DCE2FF00CAAE2C /* ShareableBitmap.cpp */,
@@ -2549,6 +2569,8 @@
 				511B24A8132E097200065A0C /* WebIconDatabase.cpp */,
 				511B24A9132E097200065A0C /* WebIconDatabase.h */,
 				5184BC4A132E907A006B9E28 /* WebIconDatabase.messages.in */,
+				51834590134532E80092B696 /* WebIconDatabaseClient.cpp */,
+				51834591134532E80092B696 /* WebIconDatabaseClient.h */,
 				1C8E28331275D73800BC7BD0 /* WebInspectorProxy.cpp */,
 				1C8E28321275D73800BC7BD0 /* WebInspectorProxy.h */,
 				1C77C1951288A872006A742F /* WebInspectorProxy.messages.in */,
@@ -2749,10 +2771,15 @@
 		BC111B5A112F628200337BAB /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				E179FD9B134D38060015B883 /* ArgumentCodersMac.h */,
+				E179FD9E134D38250015B883 /* ArgumentCodersMac.mm */,
+				E1A31731134CEA6C007C9A4F /* AttributedString.h */,
+				E1A31734134CEA80007C9A4F /* AttributedString.mm */,
 				1A6F9FB611E1408500DB1371 /* CommandLineMac.cpp */,
 				1A9639F512F38ECD0078A062 /* CoreAnimationRenderer.h */,
 				1A9639F612F38ECD0078A062 /* CoreAnimationRenderer.mm */,
 				1A92DC1212F8BAB90017AF65 /* LayerTreeContextMac.mm */,
+				31EA25D0134F78B2005B1452 /* NativeWebMouseEventMac.mm */,
 				C02BFF1D1251502E009CCBEA /* NativeWebKeyboardEventMac.mm */,
 				C574A57F12E66681002DFE98 /* PasteboardTypes.h */,
 				C574A58012E66681002DFE98 /* PasteboardTypes.mm */,
@@ -2781,7 +2808,6 @@
 				BC9E969911457EDE00870E71 /* DrawingAreaProxyMessageKinds.h */,
 				BCB28CBF120233D9007D99BC /* InjectedBundleMessageKinds.h */,
 				BCCB75C51203A1CE00222D1B /* WebContextMessageKinds.h */,
-				BCB7346D11CEE3FF00EC5002 /* WebProcessProxyMessageKinds.h */,
 			);
 			path = CoreIPCSupport;
 			sourceTree = "<group>";
@@ -2829,6 +2855,8 @@
 				BC14DF76120B5B7900826C0C /* InjectedBundleScriptWorld.cpp */,
 				BC14DF75120B5B7900826C0C /* InjectedBundleScriptWorld.h */,
 				BCB0B0DD12305A8C00B1341E /* InjectedBundleUserMessageCoders.h */,
+				CD5C669E134B9D36004FE2A8 /* InjectedBundlePageFullScreenClient.cpp */,
+				CD5C669F134B9D37004FE2A8 /* InjectedBundlePageFullScreenClient.h */,
 			);
 			path = InjectedBundle;
 			sourceTree = "<group>";
@@ -3108,6 +3136,7 @@
 		C03A136A133BEBF900D767D1 /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				C0FA52421345694A0028E8C2 /* LayerTreeHostCAMac.h */,
 				C03A136B133BEBF900D767D1 /* LayerTreeHostCAMac.mm */,
 			);
 			path = mac;
@@ -3339,7 +3368,6 @@
 				BC032D9710F437AF0058C15A /* WebProcess.h in Headers */,
 				1A6FA02011E1528700DB1371 /* WebProcessMain.h in Headers */,
 				BC032DD510F4389F0058C15A /* WebProcessProxy.h in Headers */,
-				BCB7346E11CEE3FF00EC5002 /* WebProcessProxyMessageKinds.h in Headers */,
 				BCC5715B115ADAEF001CCAF9 /* WebSystemInterface.h in Headers */,
 				1A594ABB112A1FB6009DE7C7 /* WebUIClient.h in Headers */,
 				BC646C1B11DD399F006455B0 /* WKBackForwardList.h in Headers */,
@@ -3559,7 +3587,7 @@
 				BC858A2012C0357B00EDEB2E /* WebResourceLoadClient.h in Headers */,
 				1AA417CB12C00CCA002BE67B /* TextChecker.h in Headers */,
 				909854ED12BC4E18000AD080 /* WebMemorySampler.h in Headers */,
-				1AA41AB512C02EC4002BE67B /* SelectionState.h in Headers */,
+				1AA41AB512C02EC4002BE67B /* EditorState.h in Headers */,
 				BCCF672D12C7EDF7008F9C35 /* OriginAndDatabases.h in Headers */,
 				BCCF6ABD12C91EF9008F9C35 /* WebImage.h in Headers */,
 				BCCF6AC312C91F34008F9C35 /* WKImage.h in Headers */,
@@ -3651,6 +3679,11 @@
 				C064504A133BE709003470E2 /* LayerTreeHostCA.h in Headers */,
 				5110AE0D133C16CB0072717A /* WKIconDatabase.h in Headers */,
 				5123CF1C133D260A0056F800 /* WKIconDatabaseCG.h in Headers */,
+				51834593134532E90092B696 /* WebIconDatabaseClient.h in Headers */,
+				C0FA52431345694A0028E8C2 /* LayerTreeHostCAMac.h in Headers */,
+				E1A31732134CEA6C007C9A4F /* AttributedString.h in Headers */,
+				E179FD9C134D38060015B883 /* ArgumentCodersMac.h in Headers */,
+				CD5C66A1134B9D38004FE2A8 /* InjectedBundlePageFullScreenClient.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4275,6 +4308,11 @@
 				5123CF1B133D260A0056F800 /* WKIconDatabaseCG.cpp in Sources */,
 				F6A90813133C20510082C3F4 /* WebCookieManagerMac.mm in Sources */,
 				F6D632BC133D198200743D77 /* WebCookieManagerProxyMac.mm in Sources */,
+				51834592134532E90092B696 /* WebIconDatabaseClient.cpp in Sources */,
+				E1A31735134CEA80007C9A4F /* AttributedString.mm in Sources */,
+				E179FD9F134D38250015B883 /* ArgumentCodersMac.mm in Sources */,
+				31EA25D2134F78C0005B1452 /* NativeWebMouseEventMac.mm in Sources */,
+				CD5C66A0134B9D38004FE2A8 /* InjectedBundlePageFullScreenClient.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebKit2/WebKit2API.pri b/Source/WebKit2/WebKit2API.pri
index 7b182a9..3dfc7bf 100644
--- a/Source/WebKit2/WebKit2API.pri
+++ b/Source/WebKit2/WebKit2API.pri
@@ -40,6 +40,7 @@ WEBKIT2_API_SOURCES = \
     $$SOURCE_DIR/WebKit2/UIProcess/API/C/WKPluginSiteDataManager.cpp \
     $$SOURCE_DIR/WebKit2/UIProcess/API/C/WKPreferences.cpp \
     $$SOURCE_DIR/WebKit2/UIProcess/API/C/WKProtectionSpace.cpp \
+    $$SOURCE_DIR/WebKit2/UIProcess/API/C/WKResourceCacheManager.cpp \
     $$SOURCE_DIR/WebKit2/UIProcess/API/cpp/qt/WKStringQt.cpp \
     $$SOURCE_DIR/WebKit2/UIProcess/API/cpp/qt/WKURLQt.cpp \
     $$SOURCE_DIR/WebKit2/UIProcess/API/qt/ClientImpl.cpp \
@@ -60,12 +61,7 @@ WEBKIT2_API_SOURCES = \
     $$SOURCE_DIR/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageGroup.cpp \
     $$SOURCE_DIR/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp \
     $$SOURCE_DIR/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleScriptWorld.cpp \
-    $$SOURCE_DIR/WebKit2/PluginProcess/PluginControllerProxy.cpp \
-    $$SOURCE_DIR/WebKit2/PluginProcess/PluginProcess.cpp \
-    $$SOURCE_DIR/WebKit2/PluginProcess/WebProcessConnection.cpp \
-    $$SOURCE_DIR/WebKit2/PluginProcess/qt/PluginControllerProxyQt.cpp \
     $$SOURCE_DIR/WebKit2/PluginProcess/qt/PluginProcessMainQt.cpp \
-    $$SOURCE_DIR/WebKit2/PluginProcess/qt/PluginProcessQt.cpp \
     $$SOURCE_DIR/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
 
 
diff --git a/Source/WebKit2/WebProcess.pro b/Source/WebKit2/WebProcess.pro
index 08521de..cd28c26 100644
--- a/Source/WebKit2/WebProcess.pro
+++ b/Source/WebKit2/WebProcess.pro
@@ -27,7 +27,7 @@ linux-* {
     QMAKE_RPATHDIR = \$\$ORIGIN/../lib $$QMAKE_RPATHDIR
     MY_RPATH = $$join(QMAKE_RPATHDIR, ":")
 
-    QMAKE_LFLAGS += -Wl,-z,origin \'-Wl,-rpath,$${MY_RPATH}\'
+    QMAKE_LFLAGS += -Wl,-z,origin \'-Wl,-rpath,$${MY_RPATH}\' -Wl,--no-undefined
     QMAKE_RPATHDIR =
 } else {
     QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp
index 4f91e3d..5f9a724 100644
--- a/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp
+++ b/Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp
@@ -56,6 +56,8 @@ void WebApplicationCacheManager::didReceiveMessage(CoreIPC::Connection* connecti
 
 void WebApplicationCacheManager::getApplicationCacheOrigins(uint64_t callbackID)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash> origins;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
@@ -79,11 +81,12 @@ void WebApplicationCacheManager::getApplicationCacheOrigins(uint64_t callbackID)
     }
 
     WebProcess::shared().connection()->send(Messages::WebApplicationCacheManagerProxy::DidGetApplicationCacheOrigins(identifiers, callbackID), 0);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebApplicationCacheManager::deleteEntriesForOrigin(const SecurityOriginData& originData)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     RefPtr<SecurityOrigin> origin = SecurityOrigin::create(originData.protocol, originData.host, originData.port);
     if (!origin)
@@ -91,15 +94,15 @@ void WebApplicationCacheManager::deleteEntriesForOrigin(const SecurityOriginData
     
     ApplicationCache::deleteCacheForOrigin(origin.get());
 #endif
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebApplicationCacheManager::deleteAllEntries()
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     cacheStorage().deleteAllEntries();
 #endif
-    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp
index 4181e14..e8254cc 100644
--- a/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp
+++ b/Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp
@@ -54,6 +54,8 @@ void WebCookieManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIP
 
 void WebCookieManager::getHostnamesWithCookies(uint64_t callbackID)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     HashSet<String> hostnames;
 
     WebCore::getHostnamesWithCookies(hostnames);
@@ -62,25 +64,27 @@ void WebCookieManager::getHostnamesWithCookies(uint64_t callbackID)
     copyToVector(hostnames, hostnameList);
 
     WebProcess::shared().connection()->send(Messages::WebCookieManagerProxy::DidGetHostnamesWithCookies(hostnameList, callbackID), 0);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::deleteCookiesForHostname(const String& hostname)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     WebCore::deleteCookiesForHostname(hostname);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::deleteAllCookies()
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     WebCore::deleteAllCookies();
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::startObservingCookieChanges()
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     WebCore::startObservingCookieChanges();
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::stopObservingCookieChanges()
@@ -95,14 +99,14 @@ void WebCookieManager::dispatchCookiesDidChange()
 
 void WebCookieManager::setHTTPCookieAcceptPolicy(HTTPCookieAcceptPolicy policy)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
     platformSetHTTPCookieAcceptPolicy(policy);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebCookieManager::getHTTPCookieAcceptPolicy(uint64_t callbackID)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
     WebProcess::shared().connection()->send(Messages::WebCookieManagerProxy::DidGetHTTPCookieAcceptPolicy(platformGetHTTPCookieAcceptPolicy(), callbackID), 0);
-    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Downloads/Download.cpp b/Source/WebKit2/WebProcess/Downloads/Download.cpp
index 3fc87d9..ff0482b 100644
--- a/Source/WebKit2/WebProcess/Downloads/Download.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/Download.cpp
@@ -52,11 +52,15 @@ Download::Download(uint64_t downloadID, const ResourceRequest& request)
 #endif
 {
     ASSERT(m_downloadID);
+
+    WebProcess::shared().disableTermination();
 }
 
 Download::~Download()
 {
     platformInvalidate();
+
+    WebProcess::shared().enableTermination();
 }
 
 CoreIPC::Connection* Download::connection() const
diff --git a/Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp b/Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp
index 4a96b11..a624891 100644
--- a/Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp
+++ b/Source/WebKit2/WebProcess/Downloads/DownloadManager.cpp
@@ -77,8 +77,6 @@ void DownloadManager::downloadFinished(Download* download)
     m_downloads.remove(download->downloadID());
 
     delete download;
-
-    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm b/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
index 2d09612..aacdf0b 100644
--- a/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
+++ b/Source/WebKit2/WebProcess/Downloads/mac/DownloadMac.mm
@@ -45,7 +45,7 @@
 - (void)_setOriginatingURL:(NSURL *)originatingURL;
 @end
 
-@interface WKDownloadAsDelegate : NSObject <NSURLConnectionDelegate> {
+@interface WKDownloadAsDelegate : NSObject <NSURLDownloadDelegate> {
     WebKit::Download* _download;
 }
 - (id)initWithDownload:(WebKit::Download*)download;
diff --git a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp
index e856876..47f1d42 100644
--- a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp
+++ b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.cpp
@@ -66,9 +66,8 @@ bool WebFullScreenManager::supportsFullScreen(bool withKeyboard)
     if (!m_page->corePage()->settings()->fullScreenEnabled())
         return false;
 
-    bool supports = true;
-    m_page->sendSync(Messages::WebFullScreenManagerProxy::SupportsFullScreen(withKeyboard), supports);
-    return supports;
+    return m_page->injectedBundleFullScreenClient().supportsFullScreen(m_page.get(), withKeyboard);
+
 }
 
 void WebFullScreenManager::enterFullScreenForElement(WebCore::Element* element)
@@ -76,14 +75,14 @@ void WebFullScreenManager::enterFullScreenForElement(WebCore::Element* element)
     ASSERT(element);
     m_element = element;
     m_initialFrame = m_element->screenRect();
-    m_page->send(Messages::WebFullScreenManagerProxy::EnterFullScreen());
+    m_page->injectedBundleFullScreenClient().enterFullScreenForElement(m_page.get(), element);
 }
 
 void WebFullScreenManager::exitFullScreenForElement(WebCore::Element* element)
 {
     ASSERT(element);
     ASSERT(m_element == element);
-    m_page->send(Messages::WebFullScreenManagerProxy::ExitFullScreen());
+    m_page->injectedBundleFullScreenClient().exitFullScreenForElement(m_page.get(), element);
 }
 
 void WebFullScreenManager::beganEnterFullScreenAnimation()
diff --git a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h
index d4ec15d..d6ccb15 100644
--- a/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h
+++ b/Source/WebKit2/WebProcess/FullScreen/WebFullScreenManager.h
@@ -63,15 +63,16 @@ public:
     void finishedExitFullScreenAnimation(bool completed);
     virtual void setRootFullScreenLayer(WebCore::GraphicsLayer*) = 0;
 
+    void willEnterFullScreen();
+    void didEnterFullScreen();
+    void willExitFullScreen();
+    void didExitFullScreen();
+
     WebCore::Element* element();
 
 protected:
     WebFullScreenManager(WebPage*);
 
-    void willEnterFullScreen();
-    void didEnterFullScreen();
-    void willExitFullScreen();
-    void didExitFullScreen();
     virtual void beginEnterFullScreenAnimation(float duration) = 0;
     virtual void beginExitFullScreenAnimation(float duration) = 0;
     WebCore::IntRect getFullScreenRect();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
index 587968c..d73070d 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
@@ -133,7 +133,42 @@ void WKBundleOverrideAllowUniversalAccessFromFileURLsForTestRunner(WKBundleRef b
     toImpl(bundleRef)->overrideAllowUniversalAccessFromFileURLsForTestRunner(toImpl(pageGroupRef), enabled);
 }
 
+void WKBundleSetAllowFileAccessFromFileURLs(WKBundleRef bundleRef, WKBundlePageGroupRef pageGroupRef, bool enabled)
+{
+    toImpl(bundleRef)->setAllowFileAccessFromFileURLs(toImpl(pageGroupRef), enabled);
+}
+
 void WKBundleReportException(JSContextRef context, JSValueRef exception)
 {
     InjectedBundle::reportException(context, exception);
 }
+
+void WKBundleClearAllDatabases(WKBundleRef bundleRef)
+{
+    toImpl(bundleRef)->clearAllDatabases();
+}
+
+void WKBundleSetDatabaseQuota(WKBundleRef bundleRef, uint64_t quota)
+{
+    toImpl(bundleRef)->setDatabaseQuota(quota);
+}
+
+int WKBundleNumberOfPages(WKBundleRef bundleRef, WKBundleFrameRef frameRef, double pageWidthInPixels, double pageHeightInPixels)
+{
+    return toImpl(bundleRef)->numberOfPages(toImpl(frameRef), pageWidthInPixels, pageHeightInPixels);
+}
+
+int WKBundlePageNumberForElementById(WKBundleRef bundleRef, WKBundleFrameRef frameRef, WKStringRef idRef, double pageWidthInPixels, double pageHeightInPixels)
+{
+    return toImpl(bundleRef)->pageNumberForElementById(toImpl(frameRef), toImpl(idRef)->string(), pageWidthInPixels, pageHeightInPixels);
+}
+
+WKStringRef WKBundlePageSizeAndMarginsInPixels(WKBundleRef bundleRef, WKBundleFrameRef frameRef, int pageIndex, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft)
+{
+    return toCopiedAPI(toImpl(bundleRef)->pageSizeAndMarginsInPixels(toImpl(frameRef), pageIndex, width, height, marginTop, marginRight, marginBottom, marginLeft));
+}
+
+WK_EXPORT bool WKBundleIsPageBoxVisible(WKBundleRef bundleRef, WKBundleFrameRef frameRef, int pageIndex)
+{
+    return toImpl(bundleRef)->isPageBoxVisible(toImpl(frameRef), pageIndex);
+}
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
index dd44e93..5528dfe 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.cpp
@@ -201,6 +201,16 @@ WKSize WKBundleFrameGetScrollOffset(WKBundleFrameRef frameRef)
     return toAPI(toImpl(frameRef)->scrollOffset());
 }
 
+bool WKBundleFrameHasHorizontalScrollbar(WKBundleFrameRef frameRef)
+{
+    return toImpl(frameRef)->hasHorizontalScrollbar();
+}
+
+bool WKBundleFrameHasVerticalScrollbar(WKBundleFrameRef frameRef)
+{
+    return toImpl(frameRef)->hasVerticalScrollbar();
+}
+
 bool WKBundleFrameGetDocumentBackgroundColor(WKBundleFrameRef frameRef, double* red, double* green, double* blue, double* alpha)
 {
     return toImpl(frameRef)->getDocumentBackgroundColor(red, green, blue, alpha);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
index 3c7c52d..727ea53 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleFrame.h
@@ -63,6 +63,9 @@ WK_EXPORT WKRect WKBundleFrameGetVisibleContentBounds(WKBundleFrameRef frame);
 WK_EXPORT WKRect WKBundleFrameGetVisibleContentBoundsExcludingScrollbars(WKBundleFrameRef frame);
 WK_EXPORT WKSize WKBundleFrameGetScrollOffset(WKBundleFrameRef frame);
 
+WK_EXPORT bool WKBundleFrameHasHorizontalScrollbar(WKBundleFrameRef frame);
+WK_EXPORT bool WKBundleFrameHasVerticalScrollbar(WKBundleFrameRef frame);
+
 WK_EXPORT bool WKBundleFrameGetDocumentBackgroundColor(WKBundleFrameRef frame, double* red, double* green, double* blue, double* alpha);
 
 WK_EXPORT WKStringRef WKBundleFrameCopySuggestedFilenameForResourceWithURL(WKBundleFrameRef frame, WKURLRef url);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
index 6bed7a4..292b022 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandle.cpp
@@ -51,14 +51,20 @@ WKBundleNodeHandleRef WKBundleNodeHandleCopyDocument(WKBundleNodeHandleRef nodeH
     return toAPI(nodeHandle.release().releaseRef());
 }
 
-WKRect WKBundleNodeHandleGetElementBounds(WKBundleNodeHandleRef nodeHandleRef)
+WKRect WKBundleNodeHandleGetRenderRect(WKBundleNodeHandleRef nodeHandleRef, bool* isReplaced)
 {
-    return toAPI(toImpl(nodeHandleRef)->elementBounds());
+    return toAPI(toImpl(nodeHandleRef)->renderRect(isReplaced));
 }
 
-WKRect WKBundleNodeHandleGetRenderRect(WKBundleNodeHandleRef nodeHandleRef, bool* isReplaced)
+WKRect WKBundleNodeHandleGetElementBounds(WKBundleNodeHandleRef elementHandleRef)
 {
-    return toAPI(toImpl(nodeHandleRef)->renderRect(isReplaced));
+    return toAPI(toImpl(elementHandleRef)->elementBounds());
+}
+
+WKBundleNodeHandleRef WKBundleNodeHandleCopyElementShadowRoot(WKBundleNodeHandleRef elementHandleRef)
+{
+    RefPtr<InjectedBundleNodeHandle> nodeHandle = toImpl(elementHandleRef)->elementShadowRoot();
+    return toAPI(nodeHandle.release().releaseRef());
 }
 
 void WKBundleNodeHandleSetHTMLInputElementValueForUser(WKBundleNodeHandleRef htmlInputElementHandleRef, WKStringRef valueRef)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
index 6006596..3655194 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundleNodeHandlePrivate.h
@@ -42,9 +42,11 @@ WK_EXPORT WKBundleNodeHandleRef WKBundleNodeHandleCopyDocument(WKBundleNodeHandl
 
 /* Additional DOM Operations */
 
-WK_EXPORT WKRect WKBundleNodeHandleGetElementBounds(WKBundleNodeHandleRef nodeHandle);
 WK_EXPORT WKRect WKBundleNodeHandleGetRenderRect(WKBundleNodeHandleRef nodeHandle, bool* isReplaced);
 
+/* Element Specific Operations */
+WK_EXPORT WKRect WKBundleNodeHandleGetElementBounds(WKBundleNodeHandleRef elementHandle);
+WK_EXPORT WKBundleNodeHandleRef WKBundleNodeHandleCopyElementShadowRoot(WKBundleNodeHandleRef elementHandle);
 
 /* HTMLInputElement Specific Operations */
 WK_EXPORT void WKBundleNodeHandleSetHTMLInputElementValueForUser(WKBundleNodeHandleRef htmlInputElementHandle, WKStringRef value);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
index 58052c5..e57b420 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,8 +28,10 @@
 #include "WKBundlePagePrivate.h"
 
 #include "InjectedBundleBackForwardList.h"
+#include "InjectedBundleNodeHandle.h"
 #include "WKAPICast.h"
 #include "WKBundleAPICast.h"
+#include "WebFullScreenManager.h"
 #include "WebImage.h"
 #include "WebPage.h"
 #include "WebURL.h"
@@ -93,6 +95,43 @@ void WKBundlePageSetUIClient(WKBundlePageRef pageRef, WKBundlePageUIClient* wkCl
     toImpl(pageRef)->initializeInjectedBundleUIClient(wkClient);
 }
 
+void WKBundlePageSetFullScreenClient(WKBundlePageRef pageRef, WKBundlePageFullScreenClient* wkClient)
+{
+#if defined(ENABLE_FULLSCREEN_API) && ENABLE_FULLSCREEN_API
+    if (wkClient && wkClient->version)
+        return;
+    toImpl(pageRef)->initializeInjectedBundleFullScreenClient(wkClient);
+#endif
+}
+
+void WKBundlePageWillEnterFullScreen(WKBundlePageRef pageRef)
+{
+#if defined(ENABLE_FULLSCREEN_API) && ENABLE_FULLSCREEN_API
+    toImpl(pageRef)->fullScreenManager()->willEnterFullScreen();
+#endif
+}
+
+void WKBundlePageDidEnterFullScreen(WKBundlePageRef pageRef)
+{
+#if defined(ENABLE_FULLSCREEN_API) && ENABLE_FULLSCREEN_API
+    toImpl(pageRef)->fullScreenManager()->didEnterFullScreen();
+#endif
+}
+
+void WKBundlePageWillExitFullScreen(WKBundlePageRef pageRef)
+{
+#if defined(ENABLE_FULLSCREEN_API) && ENABLE_FULLSCREEN_API
+    toImpl(pageRef)->fullScreenManager()->willExitFullScreen();
+#endif
+}
+
+void WKBundlePageDidExitFullScreen(WKBundlePageRef pageRef)
+{
+#if defined(ENABLE_FULLSCREEN_API) && ENABLE_FULLSCREEN_API
+    toImpl(pageRef)->fullScreenManager()->didExitFullScreen();
+#endif
+}
+
 WKBundlePageGroupRef WKBundlePageGetPageGroup(WKBundlePageRef pageRef)
 {
     return toAPI(toImpl(pageRef)->pageGroup());
@@ -158,6 +197,11 @@ void WKBundlePageSetPageZoomFactor(WKBundlePageRef pageRef, double zoomFactor)
     toImpl(pageRef)->setPageZoomFactor(zoomFactor);
 }
 
+void WKBundlePageSetScaleAtOrigin(WKBundlePageRef pageRef, double scale, WKPoint origin)
+{
+    toImpl(pageRef)->scaleWebView(scale, toIntPoint(origin));
+}
+
 WKBundleBackForwardListRef WKBundlePageGetBackForwardList(WKBundlePageRef pageRef)
 {
     return toAPI(toImpl(pageRef)->backForwardList());
@@ -170,7 +214,7 @@ void WKBundlePageInstallPageOverlay(WKBundlePageRef pageRef, WKBundlePageOverlay
 
 void WKBundlePageUninstallPageOverlay(WKBundlePageRef pageRef, WKBundlePageOverlayRef pageOverlayRef)
 {
-    toImpl(pageRef)->uninstallPageOverlay(toImpl(pageOverlayRef));
+    toImpl(pageRef)->uninstallPageOverlay(toImpl(pageOverlayRef), false);
 }
 
 bool WKBundlePageHasLocalDataForURL(WKBundlePageRef pageRef, WKURLRef urlRef)
@@ -217,3 +261,18 @@ void WKBundlePageForceRepaint(WKBundlePageRef page)
 {
     toImpl(page)->forceRepaintWithoutCallback();
 }
+
+void WKBundlePageSimulateMouseDown(WKBundlePageRef page, int button, WKPoint position, int clickCount, WKEventModifiers modifiers, double time)
+{
+    toImpl(page)->simulateMouseDown(button, toIntPoint(position), clickCount, modifiers, time);
+}
+
+void WKBundlePageSimulateMouseUp(WKBundlePageRef page, int button, WKPoint position, int clickCount, WKEventModifiers modifiers, double time)
+{
+    toImpl(page)->simulateMouseUp(button, toIntPoint(position), clickCount, modifiers, time);
+}
+
+void WKBundlePageSimulateMouseMotion(WKBundlePageRef page, WKPoint position, double time)
+{
+    toImpl(page)->simulateMouseMotion(toIntPoint(position), time);
+}
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
index e01f51f..74d899e 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
@@ -66,6 +66,12 @@ enum {
 };
 typedef uint32_t WKInputFieldActionType;
 
+enum {
+    WKFullScreenNoKeyboard,
+    WKFullScreenKeyboard,
+};
+typedef uint32_t WKFullScreenKeyboardRequestType;
+
 // Loader Client
 typedef void (*WKBundlePageDidStartProvisionalLoadForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef* userData, const void *clientInfo);
 typedef void (*WKBundlePageDidReceiveServerRedirectForProvisionalLoadForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef* userData, const void *clientInfo);
@@ -243,8 +249,27 @@ struct WKBundlePageContextMenuClient {
 };
 typedef struct WKBundlePageContextMenuClient WKBundlePageContextMenuClient;
 
+// Full Screen client
+typedef bool (*WKBundlePageSupportsFullScreen)(WKBundlePageRef page, WKFullScreenKeyboardRequestType requestType);
+typedef void (*WKBundlePageEnterFullScreenForElement)(WKBundlePageRef page, WKBundleNodeHandleRef element);
+typedef void (*WKBundlePageExitFullScreenForElement)(WKBundlePageRef page, WKBundleNodeHandleRef element);
+
+struct WKBundlePageFullScreenClient {
+    int                                                                 version;
+    const void *                                                        clientInfo;
+    WKBundlePageSupportsFullScreen                                      supportsFullScreen;
+    WKBundlePageEnterFullScreenForElement                               enterFullScreenForElement;
+    WKBundlePageExitFullScreenForElement                                exitFullScreenForElement;
+};
+typedef struct WKBundlePageFullScreenClient WKBundlePageFullScreenClient;
+
+WK_EXPORT void WKBundlePageWillEnterFullScreen(WKBundlePageRef page);
+WK_EXPORT void WKBundlePageDidEnterFullScreen(WKBundlePageRef page);
+WK_EXPORT void WKBundlePageWillExitFullScreen(WKBundlePageRef page);
+WK_EXPORT void WKBundlePageDidExitFullScreen(WKBundlePageRef page);
+
 WK_EXPORT WKTypeID WKBundlePageGetTypeID();
- 
+
 WK_EXPORT void WKBundlePageSetContextMenuClient(WKBundlePageRef page, WKBundlePageContextMenuClient* client);
 WK_EXPORT void WKBundlePageSetEditorClient(WKBundlePageRef page, WKBundlePageEditorClient* client);
 WK_EXPORT void WKBundlePageSetFormClient(WKBundlePageRef page, WKBundlePageFormClient* client);
@@ -252,6 +277,8 @@ WK_EXPORT void WKBundlePageSetPageLoaderClient(WKBundlePageRef page, WKBundlePag
 WK_EXPORT void WKBundlePageSetResourceLoadClient(WKBundlePageRef page, WKBundlePageResourceLoadClient* client);
 WK_EXPORT void WKBundlePageSetPolicyClient(WKBundlePageRef page, WKBundlePagePolicyClient* client);
 WK_EXPORT void WKBundlePageSetUIClient(WKBundlePageRef page, WKBundlePageUIClient* client);
+    
+WK_EXPORT void WKBundlePageSetFullScreenClient(WKBundlePageRef page, WKBundlePageFullScreenClient* client);
 
 WK_EXPORT WKBundlePageGroupRef WKBundlePageGetPageGroup(WKBundlePageRef page);
 WK_EXPORT WKBundleFrameRef WKBundlePageGetMainFrame(WKBundlePageRef page);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp
index d86c2e0..4364ce9 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp
@@ -137,3 +137,8 @@ void WKBundlePageOverlaySetNeedsDisplay(WKBundlePageOverlayRef bundlePageOverlay
 {
     toImpl(bundlePageOverlayRef)->setNeedsDisplay(enclosingIntRect(toFloatRect(rect)));
 }
+
+float WKBundlePageOverlayFractionFadedIn(WKBundlePageOverlayRef bundlePageOverlayRef)
+{
+    return toImpl(bundlePageOverlayRef)->fractionFadedIn();
+}
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.h
index 3b4f950..e78b350 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.h
@@ -66,6 +66,7 @@ WK_EXPORT WKTypeID WKBundlePageOverlayGetTypeID();
 
 WK_EXPORT WKBundlePageOverlayRef WKBundlePageOverlayCreate(WKBundlePageOverlayClient* client);
 WK_EXPORT void WKBundlePageOverlaySetNeedsDisplay(WKBundlePageOverlayRef bundlePageOverlay, WKRect rect);
+WK_EXPORT float WKBundlePageOverlayFractionFadedIn(WKBundlePageOverlayRef bundlePageOverlay);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
index b9dce68..5e902d9 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,8 +45,14 @@ WK_EXPORT void WKBundlePageSetTextZoomFactor(WKBundlePageRef page, double zoomFa
 WK_EXPORT double WKBundlePageGetPageZoomFactor(WKBundlePageRef page);
 WK_EXPORT void WKBundlePageSetPageZoomFactor(WKBundlePageRef page, double zoomFactor);
 
+WK_EXPORT void WKBundlePageSetScaleAtOrigin(WKBundlePageRef page, double scale, WKPoint origin);
+
 WK_EXPORT void WKBundlePageForceRepaint(WKBundlePageRef page);
 
+WK_EXPORT void WKBundlePageSimulateMouseDown(WKBundlePageRef page, int button, WKPoint position, int clickCount, WKEventModifiers modifiers, double time);
+WK_EXPORT void WKBundlePageSimulateMouseUp(WKBundlePageRef page, int button, WKPoint position, int clickCount, WKEventModifiers modifiers, double time);
+WK_EXPORT void WKBundlePageSimulateMouseMotion(WKBundlePageRef page, WKPoint position, double time);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
index 79c796a..03e17a2 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
@@ -66,6 +66,13 @@ WK_EXPORT void WKBundleRemoveAllUserContent(WKBundleRef bundle, WKBundlePageGrou
 // Will make WebProcess ignore this preference until a preferences change notification, only for WebKitTestRunner use.
 WK_EXPORT void WKBundleOverrideXSSAuditorEnabledForTestRunner(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
 WK_EXPORT void WKBundleOverrideAllowUniversalAccessFromFileURLsForTestRunner(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
+WK_EXPORT void WKBundleSetAllowFileAccessFromFileURLs(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, bool enabled);
+WK_EXPORT void WKBundleClearAllDatabases(WKBundleRef bundle);
+WK_EXPORT void WKBundleSetDatabaseQuota(WKBundleRef bundle, uint64_t);
+WK_EXPORT int WKBundleNumberOfPages(WKBundleRef bundle, WKBundleFrameRef frameRef, double pageWidthInPixels, double pageHeightInPixels);
+WK_EXPORT int WKBundlePageNumberForElementById(WKBundleRef bundle, WKBundleFrameRef frameRef, WKStringRef idRef, double pageWidthInPixels, double pageHeightInPixels);
+WK_EXPORT WKStringRef WKBundlePageSizeAndMarginsInPixels(WKBundleRef bundle, WKBundleFrameRef frameRef, int, int, int, int, int, int, int);
+WK_EXPORT bool WKBundleIsPageBoxVisible(WKBundleRef bundle, WKBundleFrameRef frameRef, int);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp
index d97784e..463a211 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.cpp
@@ -37,7 +37,7 @@ void WKBundleSetHostAllowsAnyHTTPSCertificate(WKBundleRef bundleRef, WKStringRef
     toImpl(bundleRef)->setHostAllowsAnyHTTPSCertificate(toWTFString(host));
 }
 
-void WKBundleSetClientCertificate(WKBundleRef bundleRef, WKStringRef host, WKCertificateInfoRef certificateInfoRef)
+void WKBundleSetClientCertificate(WKBundleRef bundleRef, WKStringRef host, WKStringRef certificateSystemStoreName, WKCertificateInfoRef certificateInfoRef)
 {
-    toImpl(bundleRef)->setClientCertificate(toWTFString(host), toImpl(certificateInfoRef));
+    toImpl(bundleRef)->setClientCertificate(toWTFString(host), toWTFString(certificateSystemStoreName), toImpl(certificateInfoRef));
 }
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h
index e404ec8..03006dc 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/win/WKBundlePrivateWin.h
@@ -33,7 +33,7 @@ extern "C" {
 #endif
 
 WK_EXPORT void WKBundleSetHostAllowsAnyHTTPSCertificate(WKBundleRef bundle, WKStringRef host);
-WK_EXPORT void WKBundleSetClientCertificate(WKBundleRef bundle, WKStringRef host, WKCertificateInfoRef certificateInfo);
+WK_EXPORT void WKBundleSetClientCertificate(WKBundleRef bundle, WKStringRef host, WKStringRef certificateSystemStoreName, WKCertificateInfoRef certificateInfo);
 
 #ifdef __cplusplus
 }
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
index 5e15872..bef3f90 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
@@ -165,6 +165,14 @@ PassRefPtr<InjectedBundleNodeHandle> InjectedBundleNodeHandle::htmlTableCellElem
     return getOrCreate(static_cast<HTMLTableCellElement*>(m_node.get())->cellAbove());
 }
 
+PassRefPtr<InjectedBundleNodeHandle> InjectedBundleNodeHandle::elementShadowRoot()
+{
+    if (!m_node->isElementNode())
+        return 0;
+
+    return getOrCreate(static_cast<Element*>(m_node.get())->shadowRoot());
+}
+
 PassRefPtr<WebFrame> InjectedBundleNodeHandle::documentFrame()
 {
     if (!m_node->isDocumentNode())
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
index e4a5ab9..e1003e8 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h
@@ -68,6 +68,8 @@ public:
     
     PassRefPtr<InjectedBundleNodeHandle> htmlTableCellElementCellAbove();
 
+    PassRefPtr<InjectedBundleNodeHandle> elementShadowRoot();
+
     PassRefPtr<WebFrame> documentFrame();
     PassRefPtr<WebFrame> htmlFrameElementContentFrame();
     PassRefPtr<WebFrame> htmlIFrameElementContentFrame();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index 24dc7f9..baee7c9 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -35,15 +35,20 @@
 #include "WKBundleAPICast.h"
 #include "WebContextMessageKinds.h"
 #include "WebCoreArgumentCoders.h"
+#include "WebDatabaseManager.h"
+#include "WebFrame.h"
 #include "WebPage.h"
 #include "WebPreferencesStore.h"
 #include "WebProcess.h"
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSLock.h>
+#include <WebCore/Frame.h>
+#include <WebCore/FrameView.h>
 #include <WebCore/GCController.h>
 #include <WebCore/JSDOMWindow.h>
 #include <WebCore/Page.h>
 #include <WebCore/PageGroup.h>
+#include <WebCore/PrintContext.h>
 #include <WebCore/Settings.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/PassOwnArrayPtr.h>
@@ -119,6 +124,76 @@ void InjectedBundle::overrideAllowUniversalAccessFromFileURLsForTestRunner(WebPa
         (*iter)->settings()->setAllowUniversalAccessFromFileURLs(enabled);
 }
 
+void InjectedBundle::setAllowFileAccessFromFileURLs(WebPageGroupProxy* pageGroup, bool enabled)
+{
+    // Override the preference for all future pages.
+    WebPreferencesStore::overrideAllowFileAccessFromFileURLsForTestRunner(enabled);
+
+    // Change the setting for existing ones.
+    const HashSet<Page*>& pages = PageGroup::pageGroup(pageGroup->identifier())->pages();
+    for (HashSet<Page*>::iterator iter = pages.begin(); iter != pages.end(); ++iter)
+        (*iter)->settings()->setAllowFileAccessFromFileURLs(enabled);
+}
+
+void InjectedBundle::clearAllDatabases()
+{
+    WebDatabaseManager::shared().deleteAllDatabases();
+}
+
+void InjectedBundle::setDatabaseQuota(uint64_t quota)
+{
+    WebDatabaseManager::shared().setQuotaForOrigin("file:///", quota);
+}
+
+int InjectedBundle::numberOfPages(WebFrame* frame, double pageWidthInPixels, double pageHeightInPixels)
+{
+    Frame* coreFrame = frame ? frame->coreFrame() : 0;
+    if (!coreFrame)
+        return -1;
+    if (!pageWidthInPixels)
+        pageWidthInPixels = coreFrame->view()->width();
+    if (!pageHeightInPixels)
+        pageHeightInPixels = coreFrame->view()->height();
+
+    return PrintContext::numberOfPages(coreFrame, FloatSize(pageWidthInPixels, pageHeightInPixels));
+}
+
+int InjectedBundle::pageNumberForElementById(WebFrame* frame, const String& id, double pageWidthInPixels, double pageHeightInPixels)
+{
+    Frame* coreFrame = frame ? frame->coreFrame() : 0;
+    if (!coreFrame)
+        return -1;
+
+    Element* element = coreFrame->document()->getElementById(AtomicString(id));
+    if (!element)
+        return -1;
+
+    if (!pageWidthInPixels)
+        pageWidthInPixels = coreFrame->view()->width();
+    if (!pageHeightInPixels)
+        pageHeightInPixels = coreFrame->view()->height();
+
+    return PrintContext::pageNumberForElement(element, FloatSize(pageWidthInPixels, pageHeightInPixels));
+}
+
+String InjectedBundle::pageSizeAndMarginsInPixels(WebFrame* frame, int pageIndex, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft)
+{
+    Frame* coreFrame = frame ? frame->coreFrame() : 0;
+    if (!coreFrame)
+        return String();
+
+    return PrintContext::pageSizeAndMarginsInPixels(coreFrame, pageIndex, width, height, marginTop, marginRight, marginBottom, marginLeft);
+}
+
+bool InjectedBundle::isPageBoxVisible(WebFrame* frame, int pageIndex)
+{
+    Frame* coreFrame = frame ? frame->coreFrame() : 0;
+    if (!coreFrame)
+        return false;
+
+    return PrintContext::isPageBoxVisible(coreFrame, pageIndex);
+}
+
 static PassOwnPtr<Vector<String> > toStringVector(ImmutableArray* patterns)
 {
     if (!patterns)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
index 6896669..6755a39 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
@@ -60,6 +60,7 @@ typedef void* PlatformBundle;
 class ImmutableArray;
 class InjectedBundleScriptWorld;
 class WebCertificateInfo;
+class WebFrame;
 class WebPage;
 class WebPageGroupProxy;
 
@@ -82,7 +83,7 @@ public:
     void postSynchronousMessage(const String&, APIObject*, RefPtr<APIObject>& returnData);
 #if PLATFORM(WIN)
     void setHostAllowsAnyHTTPSCertificate(const String&);
-    void setClientCertificate(const String&, const WebCertificateInfo*);
+    void setClientCertificate(const String& host, const String& certificateSystemStoreName, const WebCertificateInfo*);
 #endif
 
     // TestRunner only SPI
@@ -91,6 +92,11 @@ public:
     void activateMacFontAscentHack();
     void overrideXSSAuditorEnabledForTestRunner(WebPageGroupProxy* pageGroup, bool enabled);
     void overrideAllowUniversalAccessFromFileURLsForTestRunner(WebPageGroupProxy*, bool);
+    void setAllowFileAccessFromFileURLs(WebPageGroupProxy*, bool);
+    int numberOfPages(WebFrame*, double, double);
+    int pageNumberForElementById(WebFrame*, const String&, double, double);
+    String pageSizeAndMarginsInPixels(WebFrame*, int, int, int, int, int, int, int);
+    bool isPageBoxVisible(WebFrame*, int);
 
     // UserContent API
     void addUserScript(WebPageGroupProxy*, InjectedBundleScriptWorld*, const String& source, const String& url, ImmutableArray* whitelist, ImmutableArray* blacklist, WebCore::UserScriptInjectionTime, WebCore::UserContentInjectedFrames);
@@ -101,6 +107,10 @@ public:
     void removeUserStyleSheets(WebPageGroupProxy*, InjectedBundleScriptWorld*);
     void removeAllUserContent(WebPageGroupProxy*);
 
+    // Local storage API
+    void clearAllDatabases();
+    void setDatabaseQuota(uint64_t);
+
     // Garbage collection API
     void garbageCollectJavaScriptObjects();
     void garbageCollectJavaScriptObjectsOnAlternateThreadForDebugging(bool waitUntilDone);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.cpp
new file mode 100644
index 0000000..0f81a1c
--- /dev/null
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(FULLSCREEN_API)
+
+#include "InjectedBundlePageFullScreenClient.h"
+
+#include "InjectedBundleNodeHandle.h"
+#include "WKAPICast.h"
+#include "WKBundleAPICast.h"
+#include "WebFullScreenManagerProxyMessages.h"
+#include "WebPage.h"
+#include <WebCore/Element.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+bool InjectedBundlePageFullScreenClient::supportsFullScreen(WebPage *page, bool withKeyboard)
+{
+    if (m_client.supportsFullScreen) 
+        return m_client.supportsFullScreen(toAPI(page), withKeyboard);
+
+    bool supports = true;
+    page->sendSync(Messages::WebFullScreenManagerProxy::SupportsFullScreen(withKeyboard), supports);
+    return supports;
+}
+
+void InjectedBundlePageFullScreenClient::enterFullScreenForElement(WebPage *page, WebCore::Element *element)
+{
+    if (m_client.enterFullScreenForElement) {
+        RefPtr<InjectedBundleNodeHandle> nodeHandle = InjectedBundleNodeHandle::getOrCreate(element);
+        m_client.enterFullScreenForElement(toAPI(page), toAPI(nodeHandle.get()));
+    } else
+        page->send(Messages::WebFullScreenManagerProxy::EnterFullScreen());
+}
+
+void InjectedBundlePageFullScreenClient::exitFullScreenForElement(WebPage *page, WebCore::Element *element)
+{
+    if (m_client.enterFullScreenForElement) {
+        RefPtr<InjectedBundleNodeHandle> nodeHandle = InjectedBundleNodeHandle::getOrCreate(element);
+        m_client.enterFullScreenForElement(toAPI(page), toAPI(nodeHandle.get()));
+    } else
+        page->send(Messages::WebFullScreenManagerProxy::ExitFullScreen());
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.h
new file mode 100644
index 0000000..eebc4b4
--- /dev/null
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedBundlePageFullScreenClient_h
+#define InjectedBundlePageFullScreenClient_h
+
+#if ENABLE(FULLSCREEN_API)
+
+#include "APIClient.h"
+#include "WKBundlePage.h"
+#include "WebEvent.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+class Element;
+}
+
+namespace WebKit {
+
+class WebPage;
+
+class InjectedBundlePageFullScreenClient : public APIClient<WKBundlePageFullScreenClient> {
+public:
+    bool supportsFullScreen(WebPage*, bool withKeyboard);
+    void enterFullScreenForElement(WebPage*, WebCore::Element*);
+    void exitFullScreenForElement(WebPage*, WebCore::Element*);
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(FULLSCREEN_API)
+
+#endif // InjectedBundlePageFullScreenClient_h
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/win/InjectedBundleWin.cpp b/Source/WebKit2/WebProcess/InjectedBundle/win/InjectedBundleWin.cpp
index 4b415a4..08c9a93 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/win/InjectedBundleWin.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/win/InjectedBundleWin.cpp
@@ -31,6 +31,7 @@
 #include "WebCertificateInfo.h"
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/SimpleFontData.h>
+#include <wtf/text/CString.h>
 
 #include <windows.h>
 #include <winbase.h>
@@ -99,10 +100,10 @@ void InjectedBundle::setHostAllowsAnyHTTPSCertificate(const String& host)
 #endif
 }
 
-void InjectedBundle::setClientCertificate(const String& host, const WebCertificateInfo* certificateInfo)
+void InjectedBundle::setClientCertificate(const String& host, const String& certificateSystemStoreName, const WebCertificateInfo* certificateInfo)
 {
 #if USE(CFNETWORK)
-    ASSERT(certificateInfo);
+    ASSERT_ARG(certificateInfo, certificateInfo);
     if (!certificateInfo)
         return;
     
@@ -111,7 +112,29 @@ void InjectedBundle::setClientCertificate(const String& host, const WebCertifica
     if (certificateChain.size() != 1)
         return;
     
-    ResourceHandle::setClientCertificate(host, WebCore::copyCertificateToData(certificateChain.first()).get());
+    ASSERT_ARG(certificateSystemStoreName, !certificateSystemStoreName.isEmpty());
+    if (certificateSystemStoreName.isEmpty())
+        return;
+    
+    // The PCCERT_CONTEXT in the WebCertificateInfo we created using the message from the UI process doesn't contain enough information
+    // to actually use it in a request, we need to get the real certificate from the certificate store (which is typically the "MY" store).
+    String mutableCertificateSystemStoreName = certificateSystemStoreName;
+    HCERTSTORE certStore = ::CertOpenSystemStore(0, mutableCertificateSystemStoreName.charactersWithNullTermination());
+    if (!certStore) {
+        LOG_ERROR("Could not open system certificate store %s", certificateSystemStoreName.ascii().data());
+        return;
+    }
+    
+    PCCERT_CONTEXT realCert = ::CertFindCertificateInStore(certStore, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_EXISTING, certificateChain.first(), 0);
+    if (!realCert) {
+        LOG_ERROR("Could not find certificate in system certificate store");
+        return;
+    }
+
+    ResourceHandle::setClientCertificate(host, WebCore::copyCertificateToData(realCert).get());
+    CertFreeCertificateContext(realCert);
+
+    // We can't close certStore here, since the certificate is still in use.
 #endif
 }
 
diff --git a/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp
index 45431c3..6b41204 100644
--- a/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp
+++ b/Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp
@@ -57,6 +57,8 @@ void WebKeyValueStorageManager::didReceiveMessage(CoreIPC::Connection* connectio
 
 void WebKeyValueStorageManager::getKeyValueStorageOrigins(uint64_t callbackID)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     Vector<RefPtr<SecurityOrigin> > coreOrigins;
 
     StorageTracker::tracker().origins(coreOrigins);
@@ -76,23 +78,23 @@ void WebKeyValueStorageManager::getKeyValueStorageOrigins(uint64_t callbackID)
     }
 
     WebProcess::shared().connection()->send(Messages::WebKeyValueStorageManagerProxy::DidGetKeyValueStorageOrigins(identifiers, callbackID), 0);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebKeyValueStorageManager::deleteEntriesForOrigin(const SecurityOriginData& originData)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     RefPtr<SecurityOrigin> origin = SecurityOrigin::create(originData.protocol, originData.host, originData.port);
     if (!origin)
         return;
 
     StorageTracker::tracker().deleteOrigin(origin.get());
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebKeyValueStorageManager::deleteAllEntries()
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
     StorageTracker::tracker().deleteAllOrigins();
-    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp b/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp
index 6baf6d9..4a5d7f9 100644
--- a/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp
+++ b/Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp
@@ -53,6 +53,8 @@ void WebMediaCacheManager::didReceiveMessage(CoreIPC::Connection* connection, Co
 
 void WebMediaCacheManager::getHostnamesWithMediaCache(uint64_t callbackID)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     Vector<String> mediaCacheHostnames;
 
 #if ENABLE(VIDEO)
@@ -60,23 +62,24 @@ void WebMediaCacheManager::getHostnamesWithMediaCache(uint64_t callbackID)
 #endif
 
     WebProcess::shared().connection()->send(Messages::WebMediaCacheManagerProxy::DidGetHostnamesWithMediaCache(mediaCacheHostnames, callbackID), 0);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebMediaCacheManager::clearCacheForHostname(const String& hostname)
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
 #if ENABLE(VIDEO)
     HTMLMediaElement::clearMediaCacheForSite(hostname);
 #endif
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebMediaCacheManager::clearCacheForAllHostnames()
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
 #if ENABLE(VIDEO)
     HTMLMediaElement::clearMediaCache();
 #endif
-    WebProcess::shared().terminateIfPossible();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
index f0c2424..0fd01ea 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.h
@@ -42,7 +42,7 @@ public:
     NPIdentifier npIdentifier() const { return m_npIdentifier; }
 
 private:    
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
index e8a08da..ed124b9 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h
@@ -55,7 +55,7 @@ public:
 private:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSObject::StructureFlags;
     
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
         return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
index 4c687f4..7720e88 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
@@ -55,7 +55,6 @@ NPJSObject* NPJSObject::create(JSGlobalData& globalData, NPRuntimeObjectMap* obj
 
 NPJSObject::NPJSObject()
     : m_objectMap(0)
-    , m_jsObject(Global<JSObject>::EmptyValue)
 {
 }
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.h b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.h
index 796f1c3..f0ee07a 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.h
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.h
@@ -26,7 +26,7 @@
 #ifndef NPJSObject_h
 #define NPJSObject_h
 
-#include <JavaScriptCore/Global.h>
+#include <JavaScriptCore/Strong.h>
 #include <WebCore/npruntime_internal.h>
 #include <wtf/Noncopyable.h>
 
@@ -90,7 +90,7 @@ private:
     static bool NP_Construct(NPObject*, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result);
     
     NPRuntimeObjectMap* m_objectMap;
-    JSC::Global<JSC::JSObject> m_jsObject;
+    JSC::Strong<JSC::JSObject> m_jsObject;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
index f6c0057..1cf60d2 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
@@ -33,6 +33,7 @@
 #include <JavaScriptCore/Error.h>
 #include <JavaScriptCore/JSLock.h>
 #include <JavaScriptCore/SourceCode.h>
+#include <JavaScriptCore/Strong.h>
 #include <WebCore/Frame.h>
 #include <WebCore/NotImplemented.h>
 
@@ -182,7 +183,7 @@ void NPRuntimeObjectMap::convertJSValueToNPVariant(ExecState* exec, JSValue valu
 
 bool NPRuntimeObjectMap::evaluate(NPObject* npObject, const String&scriptString, NPVariant* result)
 {
-    Global<JSGlobalObject> globalObject(this->globalObject()->globalData(), this->globalObject());
+    Strong<JSGlobalObject> globalObject(this->globalObject()->globalData(), this->globalObject());
     if (!globalObject)
         return false;
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
index 7d00219..574df0d 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
@@ -491,6 +491,11 @@ void NetscapePlugin::destroy()
     // Stop all streams.
     stopAllStreams();
 
+#if !PLUGIN_ARCHITECTURE(MAC)
+    m_npWindow.window = 0;
+    callSetWindow();
+#endif
+
     NPP_Destroy(0);
 
     m_isStarted = false;
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginNone.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginNone.cpp
new file mode 100644
index 0000000..d4b2043
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginNone.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if PLUGIN_ARCHITECTURE(UNSUPPORTED)
+
+#include "NetscapePlugin.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+bool NetscapePlugin::platformPostInitialize()
+{
+    return false;
+}
+
+void NetscapePlugin::platformDestroy()
+{
+}
+
+bool NetscapePlugin::platformInvalidate(const IntRect&)
+{
+    return false;
+}
+
+void NetscapePlugin::platformGeometryDidChange()
+{
+}
+
+void NetscapePlugin::platformPaint(GraphicsContext*, const IntRect&, bool)
+{
+}
+
+bool NetscapePlugin::platformHandleMouseEvent(const WebMouseEvent&)
+{
+    return false;
+}
+
+bool NetscapePlugin::platformHandleWheelEvent(const WebWheelEvent&)
+{
+    return false;
+}
+
+void NetscapePlugin::platformSetFocus(bool)
+{
+}
+
+bool NetscapePlugin::platformHandleMouseEnterEvent(const WebMouseEvent&)
+{
+    return false;
+}
+
+bool NetscapePlugin::platformHandleMouseLeaveEvent(const WebMouseEvent&)
+{
+    return false;
+}
+
+bool NetscapePlugin::platformHandleKeyboardEvent(const WebKeyboardEvent& event)
+{
+    return false;
+}
+
+} // namespace WebKit
+
+#endif // PLUGIN_ARCHITECTURE(UNSUPPORTED)
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
index cf5affc..c5beb5f 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
@@ -221,6 +221,7 @@ void NetscapePluginStream::deliverDataToPlugin()
 
         int32_t numBytesWritten = m_plugin->NPP_Write(&m_npStream, m_offset, dataLength, data);
         if (numBytesWritten < 0) {
+            cancel();
             stop(NPRES_NETWORK_ERR);
             return;
         }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
index 14ac070..e1c193f 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
@@ -124,6 +124,7 @@ NPBool NetscapePlugin::convertPoint(double sourceX, double sourceY, NPCoordinate
     case NPCoordinateSpaceFlippedScreen:
         sourceXInScreenSpace = sourceX;
         sourceYInScreenSpace = flipScreenYCoordinate(sourceY);
+        break;
     default:
         return false;
     }
@@ -231,17 +232,7 @@ bool NetscapePlugin::platformPostInitialize()
         // Get the Core Animation layer.
         if (NPP_GetValue(NPPVpluginCoreAnimationLayer, &value) == NPERR_NO_ERROR && value) {
             ASSERT(!m_pluginLayer);
-
-            CALayer *realPluginLayer = reinterpret_cast<CALayer *>(value);
-
-            // Create a layer with flipped geometry and add the real plug-in layer as a sublayer
-            // so the coordinate system will match the event coordinate system.
-            m_pluginLayer.adoptNS([[CALayer alloc] init]);
-            [m_pluginLayer.get() setBounds:[realPluginLayer bounds]];
-            [m_pluginLayer.get() setGeometryFlipped:YES];
-
-            [realPluginLayer setAutoresizingMask:kCALayerWidthSizable | kCALayerHeightSizable];
-            [m_pluginLayer.get() addSublayer:realPluginLayer];
+            m_pluginLayer = reinterpret_cast<CALayer *>(value);
         }
     }
 
@@ -517,11 +508,14 @@ bool NetscapePlugin::platformHandleMouseEvent(const WebMouseEvent& mouseEvent)
             // access m_currentMouseEvent afterwards.
             RefPtr<NetscapePlugin> protect(this);
 
-            bool returnValue = NPP_HandleEvent(&event);
+            NPP_HandleEvent(&event);
 
             m_currentMouseEvent = previousMouseEvent;
 
-            return returnValue;
+            // Some plug-ins return false even if the mouse event has been handled.
+            // This leads to bugs such as <rdar://problem/9167611>. Work around this
+            // by always returning true.
+            return true;
         }
 
 #ifndef NP_NO_CARBON
@@ -549,7 +543,12 @@ bool NetscapePlugin::platformHandleMouseEvent(const WebMouseEvent& mouseEvent)
             event.where.h = mouseEvent.globalPosition().x();
             event.where.v = mouseEvent.globalPosition().y();
 
-            return NPP_HandleEvent(&event);
+            NPP_HandleEvent(&event);
+
+            // Some plug-ins return false even if the mouse event has been handled.
+            // This leads to bugs such as <rdar://problem/9167611>. Work around this
+            // by always returning true.
+            return true;
         }
 #endif
 
@@ -646,6 +645,8 @@ static unsigned modifierFlags(const WebKeyboardEvent& keyboardEvent)
 {
     unsigned modifierFlags = 0;
 
+    if (keyboardEvent.capsLockKey())
+        modifierFlags |= NSAlphaShiftKeyMask;
     if (keyboardEvent.shiftKey())
         modifierFlags |= NSShiftKeyMask;
     if (keyboardEvent.controlKey())
@@ -658,20 +659,46 @@ static unsigned modifierFlags(const WebKeyboardEvent& keyboardEvent)
     return modifierFlags;
 }
 
+static bool isFlagsChangedEvent(const WebKeyboardEvent& keyboardEvent)
+{
+    switch (keyboardEvent.nativeVirtualKeyCode()) {
+    case 54: // Right Command
+    case 55: // Left Command
+
+    case 57: // Capslock
+
+    case 56: // Left Shift
+    case 60: // Right Shift
+
+    case 58: // Left Alt
+    case 61: // Right Alt
+            
+    case 59: // Left Ctrl
+    case 62: // Right Ctrl
+        return true;
+    }
+
+    return false;
+}
+
 static NPCocoaEvent initializeKeyboardEvent(const WebKeyboardEvent& keyboardEvent)
 {
     NPCocoaEventType eventType;
-    
-    switch (keyboardEvent.type()) {
-        case WebEvent::KeyDown:
-            eventType = NPCocoaEventKeyDown;
-            break;
-        case WebEvent::KeyUp:
-            eventType = NPCocoaEventKeyUp;
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-            return NPCocoaEvent();
+
+    if (isFlagsChangedEvent(keyboardEvent))
+        eventType = NPCocoaEventFlagsChanged;
+    else {
+        switch (keyboardEvent.type()) {
+            case WebEvent::KeyDown:
+                eventType = NPCocoaEventKeyDown;
+                break;
+            case WebEvent::KeyUp:
+                eventType = NPCocoaEventKeyUp;
+                break;
+            default:
+                ASSERT_NOT_REACHED();
+                return NPCocoaEvent();
+        }
     }
 
     NPCocoaEvent event = initializeEvent(eventType);
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm
index d331506..0b2917f 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/mac/PluginProxyMac.mm
@@ -34,8 +34,17 @@ namespace WebKit {
 
 PlatformLayer* PluginProxy::pluginLayer()
 {
-    if (!m_pluginLayer && m_remoteLayerClientID)
-        m_pluginLayer = WKMakeRenderLayer(m_remoteLayerClientID);
+    if (!m_pluginLayer && m_remoteLayerClientID) {
+        CALayer *renderLayer = WKMakeRenderLayer(m_remoteLayerClientID);
+
+        // Create a layer with flipped geometry and add the real plug-in layer as a sublayer
+        // so the coordinate system will match the event coordinate system.
+        m_pluginLayer.adoptNS([[CALayer alloc] init]);
+        [m_pluginLayer.get() setGeometryFlipped:YES];
+        
+        [renderLayer setAutoresizingMask:kCALayerWidthSizable | kCALayerHeightSizable];
+        [m_pluginLayer.get() addSublayer:renderLayer];
+    }
 
     return m_pluginLayer.get();
 }
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
index 27e694b..b8c8f2a 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
@@ -25,6 +25,8 @@
  */
 
 #include "config.h"
+#if PLUGIN_ARCHITECTURE(X11)
+
 #include "NetscapePlugin.h"
 
 #include "WebEvent.h"
@@ -38,6 +40,7 @@
 #include <QX11Info>
 #elif PLATFORM(GTK)
 #include <gdk/gdkx.h>
+#include <WebCore/GtkVersioning.h>
 #endif
 
 using namespace WebCore;
@@ -423,3 +426,5 @@ bool NetscapePlugin::platformHandleKeyboardEvent(const WebKeyboardEvent& event)
 }
 
 } // namespace WebKit
+
+#endif // PLUGIN_ARCHITECTURE(X11)
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
index 3d007a6..31e377f 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.cpp
@@ -32,14 +32,33 @@
 #include "PluginProcessConnectionManager.h"
 #include "PluginProxy.h"
 #include "WebProcess.h"
+#include "WebProcessProxyMessages.h"
+#include <WebCore/FileSystem.h>
+
+using namespace WebCore;
 
 namespace WebKit {
 
+// The timeout, in seconds, when sending sync messages to the plug-in.
+static const double syncMessageTimeout = 45;
+
+static double defaultSyncMessageTimeout(const String& pluginPath)
+{
+    // We don't want a message timeout for the AppleConnect plug-in.
+    // FIXME: We should key this off something other than the path.
+    if (pathGetFileName(pluginPath) == "AppleConnect.plugin")
+        return CoreIPC::Connection::NoTimeout;
+
+    return syncMessageTimeout;
+}
+
 PluginProcessConnection::PluginProcessConnection(PluginProcessConnectionManager* pluginProcessConnectionManager, const String& pluginPath, CoreIPC::Connection::Identifier connectionIdentifier)
     : m_pluginProcessConnectionManager(pluginProcessConnectionManager)
     , m_pluginPath(pluginPath)
 {
     m_connection = CoreIPC::Connection::createClientConnection(connectionIdentifier, this, WebProcess::shared().runLoop());
+
+    m_connection->setDefaultSyncMessageTimeout(defaultSyncMessageTimeout(m_pluginPath));
     m_npRemoteObjectMap = NPRemoteObjectMap::create(m_connection.get());
 
     m_connection->open();
@@ -116,6 +135,11 @@ void PluginProcessConnection::didReceiveInvalidMessage(CoreIPC::Connection*, Cor
 {
 }
 
+void PluginProcessConnection::syncMessageSendTimedOut(CoreIPC::Connection*)
+{
+    WebProcess::shared().connection()->send(Messages::WebProcessProxy::PluginSyncMessageSendTimedOut(m_pluginPath), 0);
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(PLUGIN_PROCESS)
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
index 76e2315..589baf4 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnection.h
@@ -66,7 +66,8 @@ private:
     virtual CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
     virtual void didClose(CoreIPC::Connection*);
     virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
-    
+    virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
+
     PluginProcessConnectionManager* m_pluginProcessConnectionManager;
     String m_pluginPath;
 
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
index 1290391..d2f3686 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
@@ -30,13 +30,16 @@
 
 #include "ArgumentDecoder.h"
 #include "ArgumentEncoder.h"
-#include "MachPort.h"
 #include "PluginProcessConnection.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebProcess.h"
-#include "WebProcessProxyMessageKinds.h"
+#include "WebProcessProxyMessages.h"
 #include <wtf/StdLibExtras.h>
 
+#if PLATFORM(MAC)
+#include "MachPort.h"
+#endif
+
 namespace WebKit {
 
 PluginProcessConnectionManager& PluginProcessConnectionManager::shared()
@@ -61,11 +64,18 @@ PluginProcessConnection* PluginProcessConnectionManager::getPluginProcessConnect
     }
 
     CoreIPC::Connection::Identifier connectionIdentifier;
+#if PLATFORM(MAC)
     CoreIPC::MachPort connectionMachPort;
-    if (!WebProcess::shared().connection()->deprecatedSendSync(WebProcessProxyLegacyMessage::GetPluginProcessConnection, 0, CoreIPC::In(pluginPath), CoreIPC::Out(connectionMachPort)))
+
+    if (!WebProcess::shared().connection()->sendSync(Messages::WebProcessProxy::GetPluginProcessConnection(pluginPath), Messages::WebProcessProxy::GetPluginProcessConnection::Reply(connectionMachPort), 0))
         return 0;
 
     connectionIdentifier = connectionMachPort.port();
+#else
+    // FIXME: Implement.
+    connectionIdentifier = 0;
+    ASSERT_NOT_REACHED();
+#endif
     if (!connectionIdentifier)
         return 0;
 
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
index 1596319..febf61b 100644
--- a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.cpp
@@ -28,6 +28,7 @@
 
 #include "Connection.h"
 #include "MessageID.h"
+#include "ResourceCachesToClear.h"
 #include "SecurityOriginData.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebResourceCacheManagerProxyMessages.h"
@@ -62,6 +63,8 @@ void WebResourceCacheManager::didReceiveMessage(CoreIPC::Connection* connection,
 
 void WebResourceCacheManager::getCacheOrigins(uint64_t callbackID) const
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     MemoryCache::SecurityOriginSet origins;
     memoryCache()->getOriginsWithCache(origins);
 
@@ -93,11 +96,18 @@ void WebResourceCacheManager::getCacheOrigins(uint64_t callbackID) const
     }
 
     WebProcess::shared().connection()->send(Messages::WebResourceCacheManagerProxy::DidGetCacheOrigins(identifiers, callbackID), 0);
-    WebProcess::shared().terminateIfPossible();
 }
 
-void WebResourceCacheManager::clearCacheForOrigin(SecurityOriginData originData) const
+void WebResourceCacheManager::clearCacheForOrigin(SecurityOriginData originData, uint32_t cachesToClear) const
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
+#if USE(CFURLCACHE)
+    ResourceCachesToClear resourceCachesToClear = static_cast<ResourceCachesToClear>(cachesToClear);
+#else
+    UNUSED_PARAM(cachesToClear);
+#endif
+
     RefPtr<SecurityOrigin> origin = SecurityOrigin::create(originData.protocol, originData.host, originData.port);
     if (!origin)
         return;
@@ -105,19 +115,23 @@ void WebResourceCacheManager::clearCacheForOrigin(SecurityOriginData originData)
     memoryCache()->removeResourcesWithOrigin(origin.get());
 
 #if USE(CFURLCACHE)
-    RetainPtr<CFMutableArrayRef> hostArray(AdoptCF, CFArrayCreateMutable(0, 0, &kCFTypeArrayCallBacks));
-    RetainPtr<CFStringRef> host(AdoptCF, origin->host().createCFString());
-    CFArrayAppendValue(hostArray.get(), host.get());
+    if (resourceCachesToClear != InMemoryResourceCachesOnly) { 
+        RetainPtr<CFMutableArrayRef> hostArray(AdoptCF, CFArrayCreateMutable(0, 0, &kCFTypeArrayCallBacks));
+        RetainPtr<CFStringRef> host(AdoptCF, origin->host().createCFString());
+        CFArrayAppendValue(hostArray.get(), host.get());
 
-    clearCFURLCacheForHostNames(hostArray.get());
+        clearCFURLCacheForHostNames(hostArray.get());
+    }
 #endif
-    WebProcess::shared().terminateIfPossible();
 }
 
-void WebResourceCacheManager::clearCacheForAllOrigins() const
+void WebResourceCacheManager::clearCacheForAllOrigins(uint32_t cachesToClear) const
 {
-    WebProcess::shared().clearResourceCaches();
-    WebProcess::shared().terminateIfPossible();
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
+    ResourceCachesToClear resourceCachesToClear = static_cast<ResourceCachesToClear>(cachesToClear);
+
+    WebProcess::shared().clearResourceCaches(resourceCachesToClear);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.h b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.h
index 3a29a4b..0172389 100644
--- a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.h
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.h
@@ -27,6 +27,7 @@
 #define WebResourceCacheManager_h
 
 #include "Arguments.h"
+#include "ResourceCachesToClear.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/text/WTFString.h>
@@ -56,8 +57,8 @@ private:
     void didReceiveWebResourceCacheManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
     void getCacheOrigins(uint64_t callbackID) const;
-    void clearCacheForOrigin(SecurityOriginData origin) const;
-    void clearCacheForAllOrigins() const;
+    void clearCacheForOrigin(SecurityOriginData, uint32_t cachesToClear) const;
+    void clearCacheForAllOrigins(uint32_t cachesToClear) const;
 
 #if USE(CFURLCACHE)
     static RetainPtr<CFArrayRef> cfURLCacheHostNames();
diff --git a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.messages.in b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.messages.in
index b6d5900..336b253 100644
--- a/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.messages.in
+++ b/Source/WebKit2/WebProcess/ResourceCache/WebResourceCacheManager.messages.in
@@ -22,6 +22,6 @@
 
 messages -> WebResourceCacheManager {
     void GetCacheOrigins(uint64_t callbackID)
-    void ClearCacheForOrigin(WebKit::SecurityOriginData originIdentifier)
-    void ClearCacheForAllOrigins()
+    void ClearCacheForOrigin(WebKit::SecurityOriginData originIdentifier, uint32_t cachesToClear)
+    void ClearCacheForAllOrigins(uint32_t cachesToClear)
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index becf48f..2a81851 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -43,7 +43,6 @@
 #include "WebPopupMenu.h"
 #include "WebPreferencesStore.h"
 #include "WebProcess.h"
-#include "WebProcessProxyMessageKinds.h"
 #include "WebSearchPopupMenu.h"
 #include <WebCore/DatabaseTracker.h>
 #include <WebCore/FileChooser.h>
@@ -138,7 +137,7 @@ bool WebChromeClient::canTakeFocus(FocusDirection)
 
 void WebChromeClient::takeFocus(FocusDirection direction)
 {
-    m_page->send(Messages::WebPageProxy::TakeFocus(direction == FocusDirectionForward ? true : false));
+    m_page->send(Messages::WebPageProxy::TakeFocus(direction));
 }
 
 void WebChromeClient::focusedNodeChanged(Node*)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
index 825a448..6104a50 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
@@ -67,6 +67,8 @@ void WebDatabaseManager::didReceiveMessage(CoreIPC::Connection* connection, Core
 
 void WebDatabaseManager::getDatabasesByOrigin(uint64_t callbackID) const
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     // FIXME: This could be made more efficient by adding a function to DatabaseTracker
     // to get both the origins and the Vector of DatabaseDetails for each origin in one
     // shot.  That would avoid taking the numerous locks this requires.
@@ -105,11 +107,12 @@ void WebDatabaseManager::getDatabasesByOrigin(uint64_t callbackID) const
     }
 
     WebProcess::shared().connection()->send(Messages::WebDatabaseManagerProxy::DidGetDatabasesByOrigin(originAndDatabasesVector, callbackID), 0);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::getDatabaseOrigins(uint64_t callbackID) const
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     Vector<RefPtr<SecurityOrigin> > origins;
     DatabaseTracker::tracker().origins(origins);
 
@@ -119,37 +122,41 @@ void WebDatabaseManager::getDatabaseOrigins(uint64_t callbackID) const
     for (size_t i = 0; i < numOrigins; ++i)
         identifiers[i] = origins[i]->databaseIdentifier();
     WebProcess::shared().connection()->send(Messages::WebDatabaseManagerProxy::DidGetDatabaseOrigins(identifiers, callbackID), 0);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::deleteDatabaseWithNameForOrigin(const String& databaseIdentifier, const String& originIdentifier) const
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromDatabaseIdentifier(originIdentifier);
     if (!origin)
         return;
 
     DatabaseTracker::tracker().deleteDatabase(origin.get(), databaseIdentifier);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::deleteDatabasesForOrigin(const String& originIdentifier) const
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromDatabaseIdentifier(originIdentifier);
     if (!origin)
         return;
 
     DatabaseTracker::tracker().deleteOrigin(origin.get());
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::deleteAllDatabases() const
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     DatabaseTracker::tracker().deleteAllDatabases();
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::setQuotaForOrigin(const String& originIdentifier, unsigned long long quota) const
 {
+    WebProcess::LocalTerminationDisabler terminationDisabler(WebProcess::shared());
+
     // If the quota is set to a value lower than the current usage, that quota will
     // "stick" but no data will be purged to meet the new quota. This will simply
     // prevent new data from being added to databases in that origin.
@@ -159,7 +166,6 @@ void WebDatabaseManager::setQuotaForOrigin(const String& originIdentifier, unsig
         return;
 
     DatabaseTracker::tracker().setQuota(origin.get(), quota);
-    WebProcess::shared().terminateIfPossible();
 }
 
 void WebDatabaseManager::dispatchDidModifyOrigin(SecurityOrigin* origin)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.h
index 96ed83e..ad91493 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.h
@@ -46,6 +46,10 @@ public:
     static void initialize(const String& databaseDirectory);
 
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    void setQuotaForOrigin(const String& originIdentifier, unsigned long long quota) const;
+
+public:
+    void deleteAllDatabases() const;
 
 private:
     WebDatabaseManager();
@@ -58,8 +62,6 @@ private:
     void getDatabaseOrigins(uint64_t callbackID) const;
     void deleteDatabaseWithNameForOrigin(const String& databaseIdentifier, const String& originIdentifier) const;
     void deleteDatabasesForOrigin(const String& originIdentifier) const;
-    void deleteAllDatabases() const;
-    void setQuotaForOrigin(const String& originIdentifier, unsigned long long quota) const;
 
     // WebCore::DatabaseTrackerClient
     virtual void dispatchDidModifyOrigin(WebCore::SecurityOrigin*);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp
index dfb1542..204810e 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.cpp
@@ -26,14 +26,16 @@
 #include "config.h"
 #include "WebDragClient.h"
 
-#include <WebCore/NotImplemented.h>
+#include "WebPage.h"
 
 using namespace WebCore;
 
 namespace WebKit {
 
-void WebDragClient::willPerformDragDestinationAction(DragDestinationAction, DragData*)
+void WebDragClient::willPerformDragDestinationAction(DragDestinationAction action, DragData*)
 {
+    if (action == DragDestinationActionLoad)
+        m_page->willPerformLoadDragDestinationAction();
 }
 
 void WebDragClient::willPerformDragSourceAction(DragSourceAction, const IntPoint&, Clipboard*)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
index b954283..197a0ab 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
@@ -26,10 +26,11 @@
 #include "config.h"
 #include "WebEditorClient.h"
 
-#include "SelectionState.h"
+#include "EditorState.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebFrameLoaderClient.h"
 #include "WebPage.h"
+#include "WebPageProxy.h"
 #include "WebPageProxyMessages.h"
 #include "WebProcess.h"
 #include <WebCore/ArchiveResource.h>
@@ -189,16 +190,7 @@ void WebEditorClient::respondToChangedSelection()
     if (!frame)
         return;
 
-    SelectionState selectionState;
-    selectionState.isNone = frame->selection()->isNone();
-    selectionState.isContentEditable = frame->selection()->isContentEditable();
-    selectionState.isContentRichlyEditable = frame->selection()->isContentRichlyEditable();
-    selectionState.isInPasswordField = frame->selection()->isInPasswordField();
-    selectionState.hasComposition = frame->editor()->hasComposition();
-
-    WebPage::getLocationAndLengthFromRange(frame->selection()->toNormalizedRange().get(), selectionState.selectedRangeStart, selectionState.selectedRangeLength);
-
-    m_page->send(Messages::WebPageProxy::SelectionStateChanged(selectionState));
+    m_page->send(Messages::WebPageProxy::EditorStateChanged(m_page->editorState()));
 
 #if PLATFORM(WIN)
     // FIXME: This should also go into the selection state.
@@ -263,27 +255,31 @@ bool WebEditorClient::canPaste(bool defaultValue) const
 
 bool WebEditorClient::canUndo() const
 {
-    notImplemented();
-    return false;
+    bool result = false;
+    m_page->sendSync(Messages::WebPageProxy::CanUndoRedo(static_cast<uint32_t>(WebPageProxy::Undo)), Messages::WebPageProxy::CanUndoRedo::Reply(result));
+    return result;
 }
 
 bool WebEditorClient::canRedo() const
 {
-    notImplemented();
-    return false;
+    bool result = false;
+    m_page->sendSync(Messages::WebPageProxy::CanUndoRedo(static_cast<uint32_t>(WebPageProxy::Redo)), Messages::WebPageProxy::CanUndoRedo::Reply(result));
+    return result;
 }
 
 void WebEditorClient::undo()
 {
-    notImplemented();
+    bool result = false;
+    m_page->sendSync(Messages::WebPageProxy::ExecuteUndoRedo(static_cast<uint32_t>(WebPageProxy::Undo)), Messages::WebPageProxy::ExecuteUndoRedo::Reply(result));
 }
 
 void WebEditorClient::redo()
 {
-    notImplemented();
+    bool result = false;
+    m_page->sendSync(Messages::WebPageProxy::ExecuteUndoRedo(static_cast<uint32_t>(WebPageProxy::Redo)), Messages::WebPageProxy::ExecuteUndoRedo::Reply(result));
 }
 
-#if !PLATFORM(MAC)
+#if !PLATFORM(GTK) && !PLATFORM(MAC)
 void WebEditorClient::handleKeyboardEvent(KeyboardEvent* event)
 {
     if (m_page->handleEditingKeyboardEvent(event))
@@ -389,9 +385,15 @@ void WebEditorClient::learnWord(const String& word)
     m_page->send(Messages::WebPageProxy::LearnWord(word));
 }
 
-void WebEditorClient::checkSpellingOfString(const UChar*, int, int*, int*)
+void WebEditorClient::checkSpellingOfString(const UChar* text, int length, int* misspellingLocation, int* misspellingLength)
 {
-    notImplemented();
+    int32_t resultLocation = -1;
+    int32_t resultLength = 0;
+    // FIXME: It would be nice if we wouldn't have to copy the text here.
+    m_page->sendSync(Messages::WebPageProxy::CheckSpellingOfString(String(text, length)),
+        Messages::WebPageProxy::CheckSpellingOfString::Reply(resultLocation, resultLength));
+    *misspellingLocation = resultLocation;
+    *misspellingLength = resultLength;
 }
 
 String WebEditorClient::getAutoCorrectSuggestionForMisspelledWord(const String&)
@@ -400,9 +402,15 @@ String WebEditorClient::getAutoCorrectSuggestionForMisspelledWord(const String&)
     return String();
 }
 
-void WebEditorClient::checkGrammarOfString(const UChar*, int, Vector<GrammarDetail>&, int*, int*)
+void WebEditorClient::checkGrammarOfString(const UChar* text, int length, Vector<WebCore::GrammarDetail>& grammarDetails, int* badGrammarLocation, int* badGrammarLength)
 {
-    notImplemented();
+    int32_t resultLocation = -1;
+    int32_t resultLength = 0;
+    // FIXME: It would be nice if we wouldn't have to copy the text here.
+    m_page->sendSync(Messages::WebPageProxy::CheckGrammarOfString(String(text, length)),
+        Messages::WebPageProxy::CheckGrammarOfString::Reply(grammarDetails, resultLocation, resultLength));
+    *badGrammarLocation = resultLocation;
+    *badGrammarLength = resultLength;
 }
 
 void WebEditorClient::updateSpellingUIWithGrammarString(const String& badGrammarPhrase, const GrammarDetail& grammarDetail)
@@ -422,8 +430,9 @@ void WebEditorClient::showSpellingUI(bool)
 
 bool WebEditorClient::spellingUIIsShowing()
 {
-    notImplemented();
-    return false;
+    bool isShowing = false;
+    m_page->sendSync(Messages::WebPageProxy::SpellingUIIsShowing(), Messages::WebPageProxy::SpellingUIIsShowing::Reply(isShowing));
+    return isShowing;
 }
 
 void WebEditorClient::getGuessesForWord(const String& word, const String& context, Vector<String>& guesses)
@@ -441,7 +450,7 @@ void WebEditorClient::setInputMethodState(bool)
     notImplemented();
 }
 
-void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&)
+void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
index 9200af0..633090f 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
@@ -123,6 +123,11 @@ private:
     virtual void toggleAutomaticSpellingCorrection();
 #endif
 
+#if PLATFORM(GTK)
+    bool executePendingEditorCommands(WebCore::Frame*, Vector<WTF::String>, bool);
+    void getEditorCommandsForKeyEvent(const WebCore::KeyboardEvent*, Vector<WTF::String>&);
+#endif
+
     TextCheckerClient* textChecker() { return this; }
 
     virtual void ignoreWordInSpellDocument(const String&);
@@ -131,7 +136,7 @@ private:
     virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord);
     virtual void checkGrammarOfString(const UChar*, int length, Vector<WebCore::GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength);
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    virtual void checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<WebCore::TextCheckingResult>& results);
+    virtual void checkTextOfParagraph(const UChar* text, int length, WebCore::TextCheckingTypeMask checkingTypes, Vector<WebCore::TextCheckingResult>& results);
 #endif
     virtual void updateSpellingUIWithGrammarString(const String&, const WebCore::GrammarDetail& detail);
     virtual void updateSpellingUIWithMisspelledWord(const String&);
@@ -140,7 +145,7 @@ private:
     virtual void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, const WTF::String&);
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&);
 #if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings);
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index fa3cdce..c3f72b0 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -44,7 +44,6 @@
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
 #include "WebProcess.h"
-#include "WebProcessProxyMessageKinds.h"
 #include "WebProcessProxyMessages.h"
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSObject.h>
@@ -223,14 +222,14 @@ void WebFrameLoaderClient::dispatchDidReceiveResponse(DocumentLoader*, unsigned
     webPage->send(Messages::WebPageProxy::DidReceiveResponseForResource(m_frame->frameID(), identifier, response));
 }
 
-void WebFrameLoaderClient::dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
+void WebFrameLoaderClient::dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int dataLength)
 {
     WebPage* webPage = m_frame->page();
     if (!webPage)
         return;
 
-    webPage->injectedBundleResourceLoadClient().didReceiveContentLengthForResource(webPage, m_frame, identifier, lengthReceived);
-    webPage->send(Messages::WebPageProxy::DidReceiveContentLengthForResource(m_frame->frameID(), identifier, lengthReceived));
+    webPage->injectedBundleResourceLoadClient().didReceiveContentLengthForResource(webPage, m_frame, identifier, dataLength);
+    webPage->send(Messages::WebPageProxy::DidReceiveContentLengthForResource(m_frame->frameID(), identifier, dataLength));
 }
 
 void WebFrameLoaderClient::dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier)
@@ -403,7 +402,7 @@ void WebFrameLoaderClient::dispatchDidStartProvisionalLoad()
     webPage->send(Messages::WebPageProxy::DidStartProvisionalLoadForFrame(m_frame->frameID(), url, unreachableURL, InjectedBundleUserMessageEncoder(userData.get())));
 }
 
-void WebFrameLoaderClient::dispatchDidReceiveTitle(const String& title)
+void WebFrameLoaderClient::dispatchDidReceiveTitle(const StringWithDirection& title)
 {
     WebPage* webPage = m_frame->page();
     if (!webPage)
@@ -412,10 +411,11 @@ void WebFrameLoaderClient::dispatchDidReceiveTitle(const String& title)
     RefPtr<APIObject> userData;
 
     // Notify the bundle client.
-    webPage->injectedBundleLoaderClient().didReceiveTitleForFrame(webPage, title, m_frame, userData);
+    // FIXME: use direction of title.
+    webPage->injectedBundleLoaderClient().didReceiveTitleForFrame(webPage, title.string(), m_frame, userData);
 
     // Notify the UIProcess.
-    webPage->send(Messages::WebPageProxy::DidReceiveTitleForFrame(m_frame->frameID(), title, InjectedBundleUserMessageEncoder(userData.get())));
+    webPage->send(Messages::WebPageProxy::DidReceiveTitleForFrame(m_frame->frameID(), title.string(), InjectedBundleUserMessageEncoder(userData.get())));
 }
 
 void WebFrameLoaderClient::dispatchDidChangeIcons()
@@ -839,14 +839,15 @@ void WebFrameLoaderClient::finishedLoading(DocumentLoader* loader)
 void WebFrameLoaderClient::updateGlobalHistory()
 {
     WebPage* webPage = m_frame->page();
-    if (!webPage)
+    if (!webPage || !webPage->pageGroup()->isVisibleToHistoryClient())
         return;
 
     DocumentLoader* loader = m_frame->coreFrame()->loader()->documentLoader();
 
     WebNavigationDataStore data;
     data.url = loader->urlForHistory().string();
-    data.title = loader->title();
+    // FIXME: use direction of title.
+    data.title = loader->title().string();
 
     WebProcess::shared().connection()->send(Messages::WebContext::DidNavigateWithNavigationData(webPage->pageID(), data, m_frame->frameID()), 0);
 }
@@ -854,7 +855,7 @@ void WebFrameLoaderClient::updateGlobalHistory()
 void WebFrameLoaderClient::updateGlobalHistoryRedirectLinks()
 {
     WebPage* webPage = m_frame->page();
-    if (!webPage)
+    if (!webPage || !webPage->pageGroup()->isVisibleToHistoryClient())
         return;
 
     DocumentLoader* loader = m_frame->coreFrame()->loader()->documentLoader();
@@ -1061,14 +1062,15 @@ PassRefPtr<DocumentLoader> WebFrameLoaderClient::createDocumentLoader(const Reso
     return DocumentLoader::create(request, data);
 }
 
-void WebFrameLoaderClient::setTitle(const String& title, const KURL& url)
+void WebFrameLoaderClient::setTitle(const StringWithDirection& title, const KURL& url)
 {
     WebPage* webPage = m_frame->page();
-    if (!webPage)
+    if (!webPage || !webPage->pageGroup()->isVisibleToHistoryClient())
         return;
 
+    // FIXME: use direction of title.
     WebProcess::shared().connection()->send(Messages::WebContext::DidUpdateHistoryTitle(webPage->pageID(),
-        title, url.string(), m_frame->frameID()), 0);
+        title.string(), url.string(), m_frame->frameID()), 0);
 }
 
 String WebFrameLoaderClient::userAgent(const KURL&)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
index 1948541..6ab6691 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
@@ -67,7 +67,7 @@ private:
     virtual bool canAuthenticateAgainstProtectionSpace(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ProtectionSpace&);
 #endif
     virtual void dispatchDidReceiveResponse(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceResponse&);
-    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int lengthReceived);
+    virtual void dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long identifier, int dataLength);
     virtual void dispatchDidFinishLoading(WebCore::DocumentLoader*, unsigned long identifier);
     virtual void dispatchDidFailLoading(WebCore::DocumentLoader*, unsigned long identifier, const WebCore::ResourceError&);
     virtual bool dispatchDidLoadResourceFromMemoryCache(WebCore::DocumentLoader*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&, int length);
@@ -84,7 +84,7 @@ private:
     virtual void dispatchWillClose();
     virtual void dispatchDidReceiveIcon();
     virtual void dispatchDidStartProvisionalLoad();
-    virtual void dispatchDidReceiveTitle(const String& title);
+    virtual void dispatchDidReceiveTitle(const WebCore::StringWithDirection&);
     virtual void dispatchDidChangeIcons();
     virtual void dispatchDidCommitLoad();
     virtual void dispatchDidFailProvisionalLoad(const WebCore::ResourceError&);
@@ -165,7 +165,7 @@ private:
     virtual void prepareForDataSourceReplacement();
     
     virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
-    virtual void setTitle(const String& title, const WebCore::KURL&);
+    virtual void setTitle(const WebCore::StringWithDirection&, const WebCore::KURL&);
     
     virtual String userAgent(const WebCore::KURL&);
     
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.cpp
index 7242d4f..940cb95 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.cpp
@@ -81,7 +81,7 @@ Vector<WebPopupItem> WebPopupMenu::populateItems()
     
     for (size_t i = 0; i < size; ++i) {
         if (m_popupClient->itemIsSeparator(i))
-            items.append(WebPopupItem(WebPopupItem::Seperator));
+            items.append(WebPopupItem(WebPopupItem::Separator));
         else {
             // FIXME: Add support for styling the font.
             // FIXME: Add support for styling the foreground and background colors.
@@ -126,6 +126,13 @@ void WebPopupMenu::hide()
 
 void WebPopupMenu::updateFromElement()
 {
+#if PLATFORM(WIN)
+    if (!m_page || !m_popupClient)
+        return;
+
+    int selectedIndex = m_popupClient->selectedIndex();
+    WebProcess::shared().connection()->send(Messages::WebPageProxy::SetPopupMenuSelectedIndex(selectedIndex), m_page->pageID());
+#endif
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.h
index 3083c94..1e6e09a 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.h
@@ -43,6 +43,8 @@ public:
     static PassRefPtr<WebPopupMenu> create(WebPage*, WebCore::PopupMenuClient*);
     ~WebPopupMenu();
 
+    WebPage* page() { return m_page; }
+
     void disconnectFromPage() { m_page = 0; }
     void didChangeSelectedIndex(int newIndex);
     void setTextForIndex(int newIndex);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp
index b875f32..39a7f32 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,6 +23,11 @@
 #include "config.h"
 #include "WebSearchPopupMenu.h"
 
+#include "WebPage.h"
+#include "WebPageProxyMessages.h"
+#include "WebProcess.h"
+#include <wtf/text/AtomicString.h>
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -42,17 +47,33 @@ PopupMenu* WebSearchPopupMenu::popupMenu()
     return m_popup.get();
 }
 
-void WebSearchPopupMenu::saveRecentSearches(const AtomicString&, const Vector<String>&)
+void WebSearchPopupMenu::saveRecentSearches(const AtomicString& name, const Vector<String>& searchItems)
 {
+    if (name.isEmpty())
+        return;
+
+    WebPage* page = m_popup->page();
+    if (!page)
+        return;
+
+    WebProcess::shared().connection()->send(Messages::WebPageProxy::SaveRecentSearches(name, searchItems), page->pageID());
 }
 
-void WebSearchPopupMenu::loadRecentSearches(const AtomicString&, Vector<String>&)
+void WebSearchPopupMenu::loadRecentSearches(const AtomicString& name, Vector<String>& resultItems)
 {
+    if (name.isEmpty())
+        return;
+
+    WebPage* page = m_popup->page();
+    if (!page)
+        return;
+
+    WebProcess::shared().connection()->sendSync(Messages::WebPageProxy::LoadRecentSearches(name), Messages::WebPageProxy::LoadRecentSearches::Reply(resultItems), page->pageID());
 }
 
 bool WebSearchPopupMenu::enabled()
 {
-    return false;
+    return true;
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp
new file mode 100644
index 0000000..c05589b
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp
@@ -0,0 +1,129 @@
+/*
+ *  Copyright (C) 2011 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public License
+ *  as published by the Free Software Foundation; either version 2 of
+ *  the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free
+ *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301 USA
+ */
+
+#include "config.h"
+#include "WebEditorClient.h"
+
+#include "Frame.h"
+#include "PlatformKeyboardEvent.h"
+#include "WebPage.h"
+#include "WebPageProxyMessages.h"
+#include "WebProcess.h"
+#include <WebCore/KeyboardEvent.h>
+#include <WebCore/NotImplemented.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebEditorClient::getEditorCommandsForKeyEvent(const KeyboardEvent* event, Vector<WTF::String>& pendingEditorCommands)
+{
+    ASSERT(event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent);
+
+    // First try to interpret the command in the UI and get the commands.
+    WebProcess::shared().connection()->sendSync(Messages::WebPageProxy::GetEditorCommandsForKeyEvent(),
+                                                Messages::WebPageProxy::GetEditorCommandsForKeyEvent::Reply(pendingEditorCommands),
+                                                m_page->pageID(), CoreIPC::Connection::NoTimeout);
+}
+
+bool WebEditorClient::executePendingEditorCommands(Frame* frame, Vector<WTF::String> pendingEditorCommands, bool allowTextInsertion)
+{
+    Vector<Editor::Command> commands;
+    for (size_t i = 0; i < pendingEditorCommands.size(); i++) {
+        Editor::Command command = frame->editor()->command(pendingEditorCommands.at(i).utf8().data());
+        if (command.isTextInsertion() && !allowTextInsertion)
+            return false;
+
+        commands.append(command);
+    }
+
+    for (size_t i = 0; i < commands.size(); i++) {
+        if (!commands.at(i).execute())
+            return false;
+    }
+
+    return true;
+}
+
+void WebEditorClient::handleKeyboardEvent(KeyboardEvent* event)
+{
+    Node* node = event->target()->toNode();
+    ASSERT(node);
+    Frame* frame = node->document()->frame();
+    ASSERT(frame);
+
+    const PlatformKeyboardEvent* platformEvent = event->keyEvent();
+    if (!platformEvent)
+        return;
+
+    Vector<WTF::String> pendingEditorCommands;
+    getEditorCommandsForKeyEvent(event, pendingEditorCommands);
+    if (!pendingEditorCommands.isEmpty()) {
+
+        // During RawKeyDown events if an editor command will insert text, defer
+        // the insertion until the keypress event. We want keydown to bubble up
+        // through the DOM first.
+        if (platformEvent->type() == PlatformKeyboardEvent::RawKeyDown) {
+            if (executePendingEditorCommands(frame, pendingEditorCommands, false))
+                event->setDefaultHandled();
+
+            return;
+        }
+
+        // Only allow text insertion commands if the current node is editable.
+        if (executePendingEditorCommands(frame, pendingEditorCommands, frame->editor()->canEdit())) {
+            event->setDefaultHandled();
+            return;
+        }
+    }
+
+    // Don't allow text insertion for nodes that cannot edit.
+    if (!frame->editor()->canEdit())
+        return;
+
+    // This is just a normal text insertion, so wait to execute the insertion
+    // until a keypress event happens. This will ensure that the insertion will not
+    // be reflected in the contents of the field until the keyup DOM event.
+    if (event->type() == eventNames().keypressEvent) {
+
+        // FIXME: Add IM support
+        // https://bugs.webkit.org/show_bug.cgi?id=55946
+        frame->editor()->insertText(platformEvent->text(), event);
+        event->setDefaultHandled();
+
+    } else {
+        // Don't insert null or control characters as they can result in unexpected behaviour
+        if (event->charCode() < ' ')
+            return;
+
+        // Don't insert anything if a modifier is pressed
+        if (platformEvent->ctrlKey() || platformEvent->altKey())
+            return;
+
+        if (frame->editor()->insertText(platformEvent->text(), event))
+            event->setDefaultHandled();
+    }
+}
+
+void WebEditorClient::handleInputMethodKeydown(KeyboardEvent*)
+{
+    notImplemented();
+}
+
+}
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
index 6aa83f8..84b7d50 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
@@ -80,9 +80,7 @@ void WebContextMenuClient::searchWithSpotlight()
     if (selectedString.isEmpty())
         return;
 
-    NSString *convertedSelectedString = selectedString;
-
-    [[NSWorkspace sharedWorkspace] showSearchResultsForQueryString:convertedSelectedString];
+    m_page->send(Messages::WebPageProxy::SearchWithSpotlight(selectedString));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
index 75d92e2..b9806f4 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
@@ -152,7 +152,7 @@ void WebDragClient::declareAndWriteDragImage(NSPasteboard *pasteboard, DOMElemen
     RetainPtr<WKPasteboardFilePromiseOwner> filePromiseOwner(AdoptNS, [(WKPasteboardFilePromiseOwner *)[WKPasteboardFilePromiseOwner alloc] initWithSource:pasteboardOwner.get()]);
     m_page->setDragSource(filePromiseOwner.get());
 
-    [pasteboard declareTypes:types.get() owner:pasteboardOwner.get()];    
+    [pasteboard declareTypes:types.get() owner:pasteboardOwner.leakRef()];    
 
     [pasteboard setPropertyList:[NSArray arrayWithObject:extension] forType:NSFilesPromisePboardType];
 
@@ -252,6 +252,7 @@ static CachedResourceClient* promisedDataClient()
 - (void)pasteboardChangedOwner:(NSPasteboard *)pasteboard
 {
     [self clearImage];
+    CFRelease(self); // Balanced by the leakRef that WebDragClient::declareAndWriteDragImage does when making this pasteboard owner.
 }
 
 static bool matchesExtensionOrEquivalent(NSString *filename, NSString *extension)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
index 7a95a72..17fd5fe 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
@@ -46,9 +46,6 @@
 #import <WebCore/Page.h>
 #import <WebKit/WebResource.h>
 #import <WebKit/WebNSURLExtras.h>
-#if !defined(BUILDING_ON_SNOW_LEOPARD)
-#import <AppKit/NSTextChecker.h>
-#endif
 
 using namespace WebCore;
 
@@ -64,13 +61,13 @@ namespace WebKit {
     
 void WebEditorClient::handleKeyboardEvent(KeyboardEvent* event)
 {
-    if (m_page->interceptEditingKeyboardEvent(event, false))
+    if (m_page->handleEditingKeyboardEvent(event, false))
         event->setDefaultHandled();
 }
 
 void WebEditorClient::handleInputMethodKeydown(KeyboardEvent* event)
 {
-    if (m_page->interceptEditingKeyboardEvent(event, true))
+    if (m_page->handleEditingKeyboardEvent(event, true))
         event->setDefaultHandled();
 }
     
@@ -176,8 +173,9 @@ void WebEditorClient::showSubstitutionsPanel(bool)
 
 bool WebEditorClient::substitutionsPanelIsShowing()
 {
-    notImplemented();
-    return false;
+    bool isShowing;
+    m_page->sendSync(Messages::WebPageProxy::SubstitutionsPanelIsShowing(), Messages::WebPageProxy::SubstitutionsPanelIsShowing::Reply(isShowing));
+    return isShowing;
 }
 
 void WebEditorClient::toggleSmartInsertDelete()
@@ -240,7 +238,7 @@ void WebEditorClient::toggleAutomaticSpellingCorrection()
     notImplemented();
 }
 
-void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<TextCheckingResult>& results)
+void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, WebCore::TextCheckingTypeMask checkingTypes, Vector<TextCheckingResult>& results)
 {
     // FIXME: It would be nice if we wouldn't have to copy the text here.
     m_page->sendSync(Messages::WebPageProxy::CheckTextOfParagraph(String(text, length), checkingTypes), Messages::WebPageProxy::CheckTextOfParagraph::Reply(results));
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebErrorsMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebErrorsMac.mm
index 70e7607..3ae02a9 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebErrorsMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebErrorsMac.mm
@@ -43,17 +43,17 @@ static NSString * const WebKitErrorPlugInNameKey =             @"WebKitErrorPlug
 static NSString * const WebKitErrorPlugInPageURLStringKey =    @"WebKitErrorPlugInPageURLStringKey";
 
 // Policy errors
-#define WebKitErrorDescriptionCannotShowMIMEType UI_STRING("Content with specified MIME type can’t be shown", "WebKitErrorCannotShowMIMEType description")
-#define WebKitErrorDescriptionCannotShowURL UI_STRING("The URL can’t be shown", "WebKitErrorCannotShowURL description")
-#define WebKitErrorDescriptionFrameLoadInterruptedByPolicyChange UI_STRING("Frame load interrupted", "WebKitErrorFrameLoadInterruptedByPolicyChange description")
-#define WebKitErrorDescriptionCannotUseRestrictedPort UI_STRING("Not allowed to use restricted network port", "WebKitErrorCannotUseRestrictedPort description")
+#define WebKitErrorDescriptionCannotShowMIMEType WEB_UI_STRING("Content with specified MIME type can’t be shown", "WebKitErrorCannotShowMIMEType description")
+#define WebKitErrorDescriptionCannotShowURL WEB_UI_STRING("The URL can’t be shown", "WebKitErrorCannotShowURL description")
+#define WebKitErrorDescriptionFrameLoadInterruptedByPolicyChange WEB_UI_STRING("Frame load interrupted", "WebKitErrorFrameLoadInterruptedByPolicyChange description")
+#define WebKitErrorDescriptionCannotUseRestrictedPort WEB_UI_STRING("Not allowed to use restricted network port", "WebKitErrorCannotUseRestrictedPort description")
 
 // Plug-in and java errors
-#define WebKitErrorDescriptionCannotFindPlugin UI_STRING("The plug-in can’t be found", "WebKitErrorCannotFindPlugin description")
-#define WebKitErrorDescriptionCannotLoadPlugin UI_STRING("The plug-in can’t be loaded", "WebKitErrorCannotLoadPlugin description")
-#define WebKitErrorDescriptionJavaUnavailable UI_STRING("Java is unavailable", "WebKitErrorJavaUnavailable description")
-#define WebKitErrorDescriptionPlugInCancelledConnection UI_STRING("Plug-in cancelled", "WebKitErrorPlugInCancelledConnection description")
-#define WebKitErrorDescriptionPlugInWillHandleLoad UI_STRING("Plug-in handled load", "WebKitErrorPlugInWillHandleLoad description")
+#define WebKitErrorDescriptionCannotFindPlugin WEB_UI_STRING("The plug-in can’t be found", "WebKitErrorCannotFindPlugin description")
+#define WebKitErrorDescriptionCannotLoadPlugin WEB_UI_STRING("The plug-in can’t be loaded", "WebKitErrorCannotLoadPlugin description")
+#define WebKitErrorDescriptionJavaUnavailable WEB_UI_STRING("Java is unavailable", "WebKitErrorJavaUnavailable description")
+#define WebKitErrorDescriptionPlugInCancelledConnection WEB_UI_STRING("Plug-in cancelled", "WebKitErrorPlugInCancelledConnection description")
+#define WebKitErrorDescriptionPlugInWillHandleLoad WEB_UI_STRING("Plug-in handled load", "WebKitErrorPlugInWillHandleLoad description")
 
 static pthread_once_t registerErrorsControl = PTHREAD_ONCE_INIT;
 static void registerErrors(void);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm
index e36f438..b9bc48f 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,6 +46,7 @@ void WebPopupMenu::setUpPlatformData(const IntRect&, PlatformPopupMenuData& data
         return;
     
     data.fontInfo.fontAttributeDictionary = fontDescriptorAttributes;
+    data.shouldPopOver = m_popupClient->shouldPopOver();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
index 06faa2f..a4fbc09 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebSystemInterface.mm
@@ -65,7 +65,6 @@ void InitWebCoreSystemInterface(void)
         INIT(GetWheelEventDeltas);
         INIT(HitTestMediaUIPart);
         INIT(InitializeMaximumHTTPConnectionCountPerHost);
-        INIT(IsLatchingWheelEvent);
         INIT(MeasureMediaUIPart);
         INIT(MediaControllerThemeAvailable);
         INIT(PopupMenu);
@@ -85,7 +84,9 @@ void InitWebCoreSystemInterface(void)
         INIT(SetCONNECTProxyForStream);
         INIT(SetCookieStoragePrivateBrowsingEnabled);
         INIT(SetDragImage);
+        INIT(SetHTTPPipeliningMaximumPriority);
         INIT(SetHTTPPipeliningPriority);
+        INIT(SetHTTPPipeliningMinimumFastLanePriority);
         INIT(SetNSURLConnectionDefersCallbacks);
         INIT(SetNSURLRequestShouldContentSniff);
         INIT(SetPatternBaseCTM);
@@ -135,9 +136,12 @@ void InitWebCoreSystemInterface(void)
         INIT(WillEndLiveResize);
         INIT(ContentAreaDidShow);
         INIT(ContentAreaDidHide);
+        INIT(DidBeginScrollGesture);
+        INIT(DidEndScrollGesture);
         INIT(ScrollbarPainterUsesOverlayScrollers);
 #else
         INIT(GetHyphenationLocationBeforeIndex);
+        INIT(GetNSEventMomentumPhase);
 #endif
         
         INIT(GetAXTextMarkerTypeID);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.cpp
index 5fcaa84..0248f70 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.cpp
@@ -29,6 +29,7 @@ namespace WebCore {
 WebFrameNetworkingContext::WebFrameNetworkingContext(Frame* frame)
     : FrameNetworkingContext(frame)
     , m_originatingObject(0)
+    , m_mimeSniffingEnabled(true)
 {
 }
 
@@ -47,4 +48,9 @@ QNetworkAccessManager* WebFrameNetworkingContext::networkAccessManager() const
     return WebKit::WebProcess::shared().networkAccessManager();
 }
 
+bool WebFrameNetworkingContext::mimeSniffingEnabled() const
+{
+    return m_mimeSniffingEnabled;
+}
+
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.h b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.h
index 9c87785..f2cf248 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.h
@@ -33,8 +33,10 @@ private:
 
     virtual QObject* originatingObject() const;
     virtual QNetworkAccessManager* networkAccessManager() const;
+    virtual bool mimeSniffingEnabled() const;
 
     QObject* m_originatingObject;
+    bool m_mimeSniffingEnabled;
 };
 
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
index 47acc7a..6272fb5 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp
@@ -42,6 +42,7 @@
 #endif
 
 using namespace WebCore;
+using namespace std;
 
 namespace WebKit {
 
@@ -159,7 +160,8 @@ void DrawingAreaImpl::forceRepaint()
 
     if (m_layerTreeHost) {
         m_layerTreeHost->forceRepaint();
-        return;
+        if (!m_layerTreeHost->participatesInDisplay())
+            return;
     }
 
     m_isWaitingForDidUpdate = false;
@@ -190,6 +192,13 @@ void DrawingAreaImpl::setPageOverlayNeedsDisplay(const IntRect& rect)
     setNeedsDisplay(rect);
 }
 
+void DrawingAreaImpl::setLayerHostNeedsDisplay()
+{
+    ASSERT(m_layerTreeHost);
+    ASSERT(m_layerTreeHost->participatesInDisplay());
+    scheduleDisplay();
+}
+
 void DrawingAreaImpl::layerHostDidFlushLayers()
 {
     ASSERT(m_layerTreeHost);
@@ -201,8 +210,12 @@ void DrawingAreaImpl::layerHostDidFlushLayers()
         return;
     }
 
-    if (!m_layerTreeHost)
+    if (!m_layerTreeHost || m_layerTreeHost->participatesInDisplay()) {
+        // When the layer tree host participates in display, we never tell the UI process about
+        // accelerated compositing. From the UI process's point of view, we're still just sending
+        // it a series of bitmaps in Update messages.
         return;
+    }
 
 #if USE(ACCELERATED_COMPOSITING)
     m_webPage->send(Messages::DrawingAreaProxy::EnterAcceleratedCompositingMode(m_backingStoreStateID, m_layerTreeHost->layerTreeContext()));
@@ -301,13 +314,13 @@ void DrawingAreaImpl::sendDidUpdateBackingStoreState()
 
     UpdateInfo updateInfo;
 
-    if (!m_isPaintingSuspended && !m_layerTreeHost)
+    if (!m_isPaintingSuspended && (!m_layerTreeHost || m_layerTreeHost->participatesInDisplay()))
         display(updateInfo);
 
 #if USE(ACCELERATED_COMPOSITING)
     LayerTreeContext layerTreeContext;
 
-    if (m_isPaintingSuspended || m_layerTreeHost) {
+    if (m_isPaintingSuspended || (m_layerTreeHost && !m_layerTreeHost->participatesInDisplay())) {
         updateInfo.viewSize = m_webPage->size();
 
         if (m_layerTreeHost) {
@@ -318,6 +331,7 @@ void DrawingAreaImpl::sendDidUpdateBackingStoreState()
             // message back to the UI process, but the updated layer tree context
             // will be sent back in the DidUpdateBackingStoreState message.
             m_layerTreeHost->setShouldNotifyAfterNextScheduledLayerFlush(false);
+            m_layerTreeHost->forceRepaint();
         }
     }
 
@@ -329,7 +343,7 @@ void DrawingAreaImpl::didUpdate()
 {
     // We might get didUpdate messages from the UI process even after we've
     // entered accelerated compositing mode. Ignore them.
-    if (m_layerTreeHost)
+    if (m_layerTreeHost && !m_layerTreeHost->participatesInDisplay())
         return;
 
     m_isWaitingForDidUpdate = false;
@@ -342,14 +356,24 @@ void DrawingAreaImpl::suspendPainting()
 {
     ASSERT(!m_isPaintingSuspended);
 
+    if (m_layerTreeHost)
+        m_layerTreeHost->pauseRendering();
+
     m_isPaintingSuspended = true;
     m_displayTimer.stop();
 }
 
 void DrawingAreaImpl::resumePainting()
 {
-    ASSERT(m_isPaintingSuspended);
-
+    if (!m_isPaintingSuspended) {
+        // FIXME: We can get a call to resumePainting when painting is not suspended.
+        // This happens when sending a synchronous message to create a new page. See <rdar://problem/8976531>.
+        return;
+    }
+    
+    if (m_layerTreeHost)
+        m_layerTreeHost->resumeRendering();
+        
     m_isPaintingSuspended = false;
 
     // FIXME: We shouldn't always repaint everything here.
@@ -372,8 +396,11 @@ void DrawingAreaImpl::enterAcceleratedCompositingMode(GraphicsLayer* graphicsLay
     m_dirtyRegion = Region();
     m_scrollRect = IntRect();
     m_scrollOffset = IntSize();
-    m_displayTimer.stop();
-    m_isWaitingForDidUpdate = false;
+
+    if (!m_layerTreeHost->participatesInDisplay()) {
+        m_displayTimer.stop();
+        m_isWaitingForDidUpdate = false;
+    }
 }
 
 void DrawingAreaImpl::exitAcceleratedCompositingMode()
@@ -385,6 +412,8 @@ void DrawingAreaImpl::exitAcceleratedCompositingMode()
 
     ASSERT(m_layerTreeHost);
 
+    bool wasParticipatingInDisplay = m_layerTreeHost->participatesInDisplay();
+
     m_layerTreeHost->invalidate();
     m_layerTreeHost = nullptr;
     m_dirtyRegion = m_webPage->bounds();
@@ -404,9 +433,16 @@ void DrawingAreaImpl::exitAcceleratedCompositingMode()
         display(updateInfo);
 
 #if USE(ACCELERATED_COMPOSITING)
-    // Send along a complete update of the page so we can paint the contents right after we exit the
-    // accelerated compositing mode, eliminiating flicker.
-    m_webPage->send(Messages::DrawingAreaProxy::ExitAcceleratedCompositingMode(m_backingStoreStateID, updateInfo));
+    if (wasParticipatingInDisplay) {
+        // When the layer tree host participates in display, we never tell the UI process about
+        // accelerated compositing. From the UI process's point of view, we're still just sending
+        // it a series of bitmaps in Update messages.
+        m_webPage->send(Messages::DrawingAreaProxy::Update(m_backingStoreStateID, updateInfo));
+    } else {
+        // Send along a complete update of the page so we can paint the contents right after we exit the
+        // accelerated compositing mode, eliminiating flicker.
+        m_webPage->send(Messages::DrawingAreaProxy::ExitAcceleratedCompositingMode(m_backingStoreStateID, updateInfo));
+    }
 #endif
 }
 
@@ -420,14 +456,19 @@ void DrawingAreaImpl::exitAcceleratedCompositingModeSoon()
 
 void DrawingAreaImpl::scheduleDisplay()
 {
+    ASSERT(!m_layerTreeHost || m_layerTreeHost->participatesInDisplay());
+
     if (m_isWaitingForDidUpdate)
         return;
 
     if (m_isPaintingSuspended)
         return;
 
-    if (m_dirtyRegion.isEmpty())
-        return;
+    if (m_layerTreeHost) {
+        if (!m_layerTreeHost->needsDisplay())
+            return;
+    } else if (m_dirtyRegion.isEmpty())
+            return;
 
     if (m_displayTimer.isActive())
         return;
@@ -440,7 +481,8 @@ void DrawingAreaImpl::displayTimerFired()
     static const double minimumFrameInterval = 1.0 / 60.0;
     
     double timeSinceLastDisplay = currentTime() - m_lastDisplayTime;
-    double timeUntilNextDisplay = minimumFrameInterval - timeSinceLastDisplay;
+    double timeUntilLayerTreeHostNeedsDisplay = m_layerTreeHost && m_layerTreeHost->participatesInDisplay() ? m_layerTreeHost->timeUntilNextDisplay() : 0;
+    double timeUntilNextDisplay = max(minimumFrameInterval - timeSinceLastDisplay, timeUntilLayerTreeHostNeedsDisplay);
 
     if (timeUntilNextDisplay > 0) {
         m_displayTimer.startOneShot(timeUntilNextDisplay);
@@ -452,14 +494,17 @@ void DrawingAreaImpl::displayTimerFired()
 
 void DrawingAreaImpl::display()
 {
-    ASSERT(!m_layerTreeHost);
+    ASSERT(!m_layerTreeHost || m_layerTreeHost->participatesInDisplay());
     ASSERT(!m_isWaitingForDidUpdate);
     ASSERT(!m_inUpdateBackingStoreState);
 
     if (m_isPaintingSuspended)
         return;
 
-    if (m_dirtyRegion.isEmpty())
+    if (m_layerTreeHost) {
+        if (!m_layerTreeHost->needsDisplay())
+            return;
+    } else if (m_dirtyRegion.isEmpty())
         return;
 
     if (m_shouldSendDidUpdateBackingStoreState) {
@@ -470,7 +515,7 @@ void DrawingAreaImpl::display()
     UpdateInfo updateInfo;
     display(updateInfo);
 
-    if (m_layerTreeHost) {
+    if (m_layerTreeHost && !m_layerTreeHost->participatesInDisplay()) {
         // The call to update caused layout which turned on accelerated compositing.
         // Don't send an Update message in this case.
         return;
@@ -504,7 +549,7 @@ static bool shouldPaintBoundsRect(const IntRect& bounds, const Vector<IntRect>&
 void DrawingAreaImpl::display(UpdateInfo& updateInfo)
 {
     ASSERT(!m_isPaintingSuspended);
-    ASSERT(!m_layerTreeHost);
+    ASSERT(!m_layerTreeHost || m_layerTreeHost->participatesInDisplay());
     ASSERT(!m_webPage->size().isEmpty());
 
     // FIXME: It would be better if we could avoid painting altogether when there is a custom representation.
@@ -516,44 +561,49 @@ void DrawingAreaImpl::display(UpdateInfo& updateInfo)
 
     m_webPage->layoutIfNeeded();
 
-    // The layout may have put the page into accelerated compositing mode, in which case the
-    // LayerTreeHost is now in charge of displaying.
-    if (m_layerTreeHost)
+    // The layout may have put the page into accelerated compositing mode. If the LayerTreeHost is
+    // in charge of displaying, we have nothing more to do.
+    if (m_layerTreeHost && !m_layerTreeHost->participatesInDisplay())
         return;
 
-    IntRect bounds = m_dirtyRegion.bounds();
-    ASSERT(m_webPage->bounds().contains(bounds));
+    updateInfo.viewSize = m_webPage->size();
+
+    if (m_layerTreeHost)
+        m_layerTreeHost->display(updateInfo);
+    else {
+        IntRect bounds = m_dirtyRegion.bounds();
+        ASSERT(m_webPage->bounds().contains(bounds));
 
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(bounds.size(), ShareableBitmap::SupportsAlpha);
-    if (!bitmap->createHandle(updateInfo.bitmapHandle))
-        return;
+        RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(bounds.size(), ShareableBitmap::SupportsAlpha);
+        if (!bitmap->createHandle(updateInfo.bitmapHandle))
+            return;
 
-    Vector<IntRect> rects = m_dirtyRegion.rects();
+        Vector<IntRect> rects = m_dirtyRegion.rects();
 
-    if (shouldPaintBoundsRect(bounds, rects)) {
-        rects.clear();
-        rects.append(bounds);
-    }
+        if (shouldPaintBoundsRect(bounds, rects)) {
+            rects.clear();
+            rects.append(bounds);
+        }
 
-    updateInfo.scrollRect = m_scrollRect;
-    updateInfo.scrollOffset = m_scrollOffset;
+        updateInfo.scrollRect = m_scrollRect;
+        updateInfo.scrollOffset = m_scrollOffset;
 
-    m_dirtyRegion = Region();
-    m_scrollRect = IntRect();
-    m_scrollOffset = IntSize();
+        m_dirtyRegion = Region();
+        m_scrollRect = IntRect();
+        m_scrollOffset = IntSize();
 
-    OwnPtr<GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
-    
-    updateInfo.viewSize = m_webPage->size();
-    updateInfo.updateRectBounds = bounds;
+        OwnPtr<GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
+        
+        updateInfo.updateRectBounds = bounds;
 
-    graphicsContext->translate(-bounds.x(), -bounds.y());
+        graphicsContext->translate(-bounds.x(), -bounds.y());
 
-    for (size_t i = 0; i < rects.size(); ++i) {
-        m_webPage->drawRect(*graphicsContext, rects[i]);
-        if (m_webPage->hasPageOverlay())
-            m_webPage->drawPageOverlay(*graphicsContext, rects[i]);
-        updateInfo.updateRects.append(rects[i]);
+        for (size_t i = 0; i < rects.size(); ++i) {
+            m_webPage->drawRect(*graphicsContext, rects[i]);
+            if (m_webPage->hasPageOverlay())
+                m_webPage->drawPageOverlay(*graphicsContext, rects[i]);
+            updateInfo.updateRects.append(rects[i]);
+        }
     }
 
     // Layout can trigger more calls to setNeedsDisplay and we don't want to process them
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
index 9e93869..471ba56 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.h
@@ -40,6 +40,7 @@ public:
     static PassOwnPtr<DrawingAreaImpl> create(WebPage*, const WebPageCreationParameters&);
     virtual ~DrawingAreaImpl();
 
+    void setLayerHostNeedsDisplay();
     void layerHostDidFlushLayers();
 
 private:
diff --git a/Source/WebKit2/WebProcess/WebPage/FindController.cpp b/Source/WebKit2/WebProcess/WebPage/FindController.cpp
index 3e7b268..49f5786 100644
--- a/Source/WebKit2/WebProcess/WebPage/FindController.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/FindController.cpp
@@ -38,6 +38,7 @@
 #include <WebCore/GraphicsContext.h>
 #include <WebCore/Page.h>
 
+using namespace std;
 using namespace WebCore;
 
 namespace WebKit {
@@ -64,9 +65,16 @@ FindController::~FindController()
 
 void FindController::countStringMatches(const String& string, FindOptions options, unsigned maxMatchCount)
 {
-    unsigned matchCount = m_webPage->corePage()->markAllMatchesForText(string, core(options), false, maxMatchCount);
+    if (maxMatchCount == numeric_limits<unsigned>::max())
+        --maxMatchCount;
+    
+    unsigned matchCount = m_webPage->corePage()->markAllMatchesForText(string, core(options), false, maxMatchCount + 1);
     m_webPage->corePage()->unmarkAllTextMatches();
 
+    // Check if we have more matches than allowed.
+    if (matchCount > maxMatchCount)
+        matchCount = static_cast<unsigned>(kWKMoreThanMaximumMatchCount);
+    
     m_webPage->send(Messages::WebPageProxy::DidCountStringMatches(string, matchCount));
 }
 
@@ -102,6 +110,9 @@ void FindController::findString(const String& string, FindOptions options, unsig
         shouldShowOverlay = options & FindOptionsShowOverlay;
 
         if (shouldShowOverlay) {
+            if (maxMatchCount == numeric_limits<unsigned>::max())
+                --maxMatchCount;
+            
             unsigned matchCount = m_webPage->corePage()->markAllMatchesForText(string, core(options), false, maxMatchCount + 1);
 
             // Check if we have more matches than allowed.
@@ -122,7 +133,7 @@ void FindController::findString(const String& string, FindOptions options, unsig
     if (!shouldShowOverlay) {
         if (m_findPageOverlay) {
             // Get rid of the overlay.
-            m_webPage->uninstallPageOverlay(m_findPageOverlay);
+            m_webPage->uninstallPageOverlay(m_findPageOverlay, false);
         }
         
         ASSERT(!m_findPageOverlay);
@@ -142,7 +153,7 @@ void FindController::findString(const String& string, FindOptions options, unsig
 void FindController::hideFindUI()
 {
     if (m_findPageOverlay)
-        m_webPage->uninstallPageOverlay(m_findPageOverlay);
+        m_webPage->uninstallPageOverlay(m_findPageOverlay, true);
 
     hideFindIndicator();
 }
@@ -259,27 +270,39 @@ static const float shadowOffsetY = 1.0;
 static const float shadowBlurRadius = 2.0;
 static const float whiteFrameThickness = 1.0;
 
-static const int overlayBackgroundRed = 25;
-static const int overlayBackgroundGreen = 25;
-static const int overlayBackgroundBlue = 25;
-static const int overlayBackgroundAlpha = 63;
+static const float overlayBackgroundRed = 0.1;
+static const float overlayBackgroundGreen = 0.1;
+static const float overlayBackgroundBlue = 0.1;
+static const float overlayBackgroundAlpha = 0.25;
+
+static Color overlayBackgroundColor(float fractionFadedIn)
+{
+    return Color(overlayBackgroundRed, overlayBackgroundGreen, overlayBackgroundBlue, overlayBackgroundAlpha * fractionFadedIn);
+}
 
-static Color overlayBackgroundColor()
+static Color holeShadowColor(float fractionFadedIn)
 {
-    return Color(overlayBackgroundRed, overlayBackgroundGreen, overlayBackgroundBlue, overlayBackgroundAlpha);
+    return Color(0.0f, 0.0f, 0.0f, fractionFadedIn);
 }
 
-void FindController::drawRect(PageOverlay*, GraphicsContext& graphicsContext, const IntRect& dirtyRect)
+static Color holeFillColor(float fractionFadedIn)
 {
+    return Color(1.0f, 1.0f, 1.0f, fractionFadedIn);
+}
+
+void FindController::drawRect(PageOverlay* pageOverlay, GraphicsContext& graphicsContext, const IntRect& dirtyRect)
+{
+    float fractionFadedIn = pageOverlay->fractionFadedIn();
+
     Vector<IntRect> rects = rectsForTextMatches();
 
     // Draw the background.
-    graphicsContext.fillRect(dirtyRect, overlayBackgroundColor(), ColorSpaceSRGB);
+    graphicsContext.fillRect(dirtyRect, overlayBackgroundColor(fractionFadedIn), ColorSpaceSRGB);
 
     graphicsContext.save();
-    graphicsContext.setShadow(FloatSize(shadowOffsetX, shadowOffsetY), shadowBlurRadius, Color::black, ColorSpaceSRGB);
+    graphicsContext.setShadow(FloatSize(shadowOffsetX, shadowOffsetY), shadowBlurRadius, holeShadowColor(fractionFadedIn), ColorSpaceSRGB);
 
-    graphicsContext.setFillColor(Color::white, ColorSpaceSRGB);
+    graphicsContext.setFillColor(holeFillColor(fractionFadedIn), ColorSpaceSRGB);
 
     // Draw white frames around the holes.
     for (size_t i = 0; i < rects.size(); ++i) {
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
index 737e195..24cbcc6 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.cpp
@@ -26,8 +26,12 @@
 #include "config.h"
 #include "LayerTreeHost.h"
 
+#if USE(CA)
 #if PLATFORM(MAC)
-#include "LayerTreeHostCA.h"
+#include "LayerTreeHostCAMac.h"
+#elif PLATFORM(WIN)
+#include "LayerTreeHostCAWin.h"
+#endif
 #endif
 
 #if !PLATFORM(MAC) && !PLATFORM(WIN)
@@ -41,10 +45,12 @@ namespace WebKit {
 PassRefPtr<LayerTreeHost> LayerTreeHost::create(WebPage* webPage)
 {
 #if PLATFORM(MAC)
-    return LayerTreeHostCA::create(webPage);
-#endif
-
+    return LayerTreeHostCAMac::create(webPage);
+#elif PLATFORM(WIN) && HAVE(WKQCA)
+    return LayerTreeHostCAWin::create(webPage);
+#else
     return 0;
+#endif
 }
 
 LayerTreeHost::LayerTreeHost(WebPage* webPage)
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
index bbb94e8..004bdb7 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
@@ -38,6 +38,7 @@ namespace WebCore {
 namespace WebKit {
 
 class LayerTreeContext;
+class UpdateInfo;
 class WebPage;
 
 class LayerTreeHost : public RefCounted<LayerTreeHost> {
@@ -45,6 +46,8 @@ public:
     static PassRefPtr<LayerTreeHost> create(WebPage*);
     virtual ~LayerTreeHost();
 
+    static bool supportsAcceleratedCompositing();
+
     virtual const LayerTreeContext& layerTreeContext() = 0;
     virtual void scheduleLayerFlush() = 0;
     virtual void setShouldNotifyAfterNextScheduledLayerFlush(bool) = 0;
@@ -60,12 +63,29 @@ public:
     virtual void didUninstallPageOverlay() = 0;
     virtual void setPageOverlayNeedsDisplay(const WebCore::IntRect&) = 0;
 
+    virtual void pauseRendering() { }
+    virtual void resumeRendering() { }
+
+    // If a derived class overrides this function to return true, the derived class must also
+    // override the functions beneath it.
+    virtual bool participatesInDisplay() { return false; }
+    virtual bool needsDisplay() { ASSERT_NOT_REACHED(); return false; }
+    virtual double timeUntilNextDisplay() { ASSERT_NOT_REACHED(); return 0; }
+    virtual void display(UpdateInfo&) { ASSERT_NOT_REACHED(); }
+
 protected:
     explicit LayerTreeHost(WebPage*);
 
     WebPage* m_webPage;
 };
 
+#if !PLATFORM(WIN)
+inline bool LayerTreeHost::supportsAcceleratedCompositing()
+{
+    return true;
+}
+#endif
+
 } // namespace WebKit
 
 #endif // LayerTreeHost_h
diff --git a/Source/WebKit2/WebProcess/WebPage/PageOverlay.cpp b/Source/WebKit2/WebProcess/WebPage/PageOverlay.cpp
index 67c1165..d4b1b41 100644
--- a/Source/WebKit2/WebProcess/WebPage/PageOverlay.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/PageOverlay.cpp
@@ -27,6 +27,7 @@
 #include "PageOverlay.h"
 
 #include "WebPage.h"
+#include "WebProcess.h"
 #include <WebCore/Frame.h>
 #include <WebCore/FrameView.h>
 #include <WebCore/GraphicsContext.h>
@@ -37,6 +38,9 @@ using namespace WebCore;
 
 namespace WebKit {
 
+static const double fadeAnimationDuration = 0.2;
+static const double fadeAnimationFrameRate = 30;
+
 PassRefPtr<PageOverlay> PageOverlay::create(Client* client)
 {
     return adoptRef(new PageOverlay(client));
@@ -45,6 +49,11 @@ PassRefPtr<PageOverlay> PageOverlay::create(Client* client)
 PageOverlay::PageOverlay(Client* client)
     : m_client(client)
     , m_webPage(0)
+    , m_fadeAnimationTimer(WebProcess::shared().runLoop(), this, &PageOverlay::fadeAnimationTimerFired)
+    , m_fadeAnimationStartTime(0.0)
+    , m_fadeAnimationDuration(fadeAnimationDuration)
+    , m_fadeAnimationType(NoAnimation)
+    , m_fractionFadedIn(1.0)
 {
 }
 
@@ -54,7 +63,7 @@ PageOverlay::~PageOverlay()
 
 IntRect PageOverlay::bounds() const
 {
-    FrameView* frameView = webPage()->corePage()->mainFrame()->view();
+    FrameView* frameView = m_webPage->corePage()->mainFrame()->view();
 
     int width = frameView->width();
     int height = frameView->height();
@@ -73,6 +82,8 @@ void PageOverlay::setPage(WebPage* webPage)
     m_client->willMoveToWebPage(this, webPage);
     m_webPage = webPage;
     m_client->didMoveToWebPage(this, webPage);
+
+    m_fadeAnimationTimer.stop();
 }
 
 void PageOverlay::setNeedsDisplay(const IntRect& dirtyRect)
@@ -112,4 +123,54 @@ bool PageOverlay::mouseEvent(const WebMouseEvent& mouseEvent)
     return m_client->mouseEvent(this, mouseEvent);
 }
 
+void PageOverlay::startFadeInAnimation()
+{
+    m_fractionFadedIn = 0.0;
+    m_fadeAnimationType = FadeInAnimation;
+
+    startFadeAnimation();
+}
+
+void PageOverlay::startFadeOutAnimation()
+{
+    m_fractionFadedIn = 1.0;
+    m_fadeAnimationType = FadeOutAnimation;
+
+    startFadeAnimation();
+}
+
+void PageOverlay::startFadeAnimation()
+{
+    m_fadeAnimationStartTime = currentTime();
+    
+    // Start the timer
+    m_fadeAnimationTimer.startRepeating(1 / fadeAnimationFrameRate);
+}
+
+void PageOverlay::fadeAnimationTimerFired()
+{
+    float animationProgress = (currentTime() - m_fadeAnimationStartTime) / m_fadeAnimationDuration;
+
+    if (animationProgress >= 1.0)
+        animationProgress = 1.0;
+
+    double sine = sin(piOverTwoFloat * animationProgress);
+    float fadeAnimationValue = sine * sine;
+
+    m_fractionFadedIn = (m_fadeAnimationType == FadeInAnimation) ? fadeAnimationValue : 1 - fadeAnimationValue;
+    setNeedsDisplay();
+
+    if (animationProgress == 1.0) {
+        m_fadeAnimationTimer.stop();
+
+        bool wasFadingOut = m_fadeAnimationType == FadeOutAnimation;
+        m_fadeAnimationType = NoAnimation;
+
+        if (wasFadingOut) {
+            // If this was a fade out, go ahead and uninstall the page overlay.
+            m_webPage->uninstallPageOverlay(this, false);
+        }
+    }
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/PageOverlay.h b/Source/WebKit2/WebProcess/WebPage/PageOverlay.h
index 6f1f70f..1f61ceb 100644
--- a/Source/WebKit2/WebProcess/WebPage/PageOverlay.h
+++ b/Source/WebKit2/WebProcess/WebPage/PageOverlay.h
@@ -27,6 +27,7 @@
 #define PageOverlay_h
 
 #include "APIObject.h"
+#include "RunLoop.h"
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
@@ -65,20 +66,38 @@ public:
     void drawRect(WebCore::GraphicsContext&, const WebCore::IntRect& dirtyRect);
     bool mouseEvent(const WebMouseEvent&);
 
+    void startFadeInAnimation();
+    void startFadeOutAnimation();
+
+    float fractionFadedIn() const { return m_fractionFadedIn; }
+
 protected:
     explicit PageOverlay(Client*);
 
-    WebPage* webPage() const { return m_webPage; }
-
 private:
     // APIObject
     virtual Type type() const { return APIType; }
 
     WebCore::IntRect bounds() const;
 
-    Client* m_client;
+    void startFadeAnimation();
+    void fadeAnimationTimerFired();
 
+    Client* m_client;
     WebPage* m_webPage;
+
+    RunLoop::Timer<PageOverlay> m_fadeAnimationTimer;
+    double m_fadeAnimationStartTime;
+    double m_fadeAnimationDuration;
+
+    enum FadeAnimationType {
+        NoAnimation,
+        FadeInAnimation,
+        FadeOutAnimation,
+    };
+
+    FadeAnimationType m_fadeAnimationType;
+    float m_fractionFadedIn;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/WebContextMenu.cpp b/Source/WebKit2/WebProcess/WebPage/WebContextMenu.cpp
index 35058de..cbed180 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebContextMenu.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebContextMenu.cpp
@@ -82,7 +82,8 @@ void WebContextMenu::show()
     contextMenuState.absoluteImageURLString = controller->hitTestResult().absoluteImageURL().string();
     contextMenuState.absoluteLinkURLString = controller->hitTestResult().absoluteLinkURL().string();
 
-    // Notify the UIProcess.
+    // Mark the WebPage has having a shown context menu then notify the UIProcess.
+    m_page->contextMenuShowing();
     m_page->send(Messages::WebPageProxy::ShowContextMenu(view->contentsToWindow(controller->hitTestResult().point()), contextMenuState, proposedMenu, InjectedBundleUserMessageEncoder(userData.get())));
 }
 
diff --git a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
index 574634f..0d550c9 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
@@ -512,6 +512,30 @@ IntSize WebFrame::scrollOffset() const
     return view->scrollOffset();
 }
 
+bool WebFrame::hasHorizontalScrollbar() const
+{
+    if (!m_coreFrame)
+        return false;
+
+    FrameView* view = m_coreFrame->view();
+    if (!view)
+        return false;
+
+    return view->horizontalScrollbar();
+}
+
+bool WebFrame::hasVerticalScrollbar() const
+{
+    if (!m_coreFrame)
+        return false;
+
+    FrameView* view = m_coreFrame->view();
+    if (!view)
+        return false;
+
+    return view->verticalScrollbar();
+}
+
 bool WebFrame::getDocumentBackgroundColor(double* red, double* green, double* blue, double* alpha)
 {
     if (!m_coreFrame)
@@ -550,6 +574,9 @@ WebFrame* WebFrame::frameForContext(JSContextRef context)
 
 JSValueRef WebFrame::jsWrapperForWorld(InjectedBundleNodeHandle* nodeHandle, InjectedBundleScriptWorld* world)
 {
+    if (!m_coreFrame)
+        return 0;
+
     JSDOMWindow* globalObject = m_coreFrame->script()->globalObject(world->coreWorld());
     ExecState* exec = globalObject->globalExec();
 
@@ -559,6 +586,9 @@ JSValueRef WebFrame::jsWrapperForWorld(InjectedBundleNodeHandle* nodeHandle, Inj
 
 JSValueRef WebFrame::jsWrapperForWorld(InjectedBundleRangeHandle* rangeHandle, InjectedBundleScriptWorld* world)
 {
+    if (!m_coreFrame)
+        return 0;
+
     JSDOMWindow* globalObject = m_coreFrame->script()->globalObject(world->coreWorld());
     ExecState* exec = globalObject->globalExec();
 
diff --git a/Source/WebKit2/WebProcess/WebPage/WebFrame.h b/Source/WebKit2/WebProcess/WebPage/WebFrame.h
index 3c63cf3..b6e1e13 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebFrame.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebFrame.h
@@ -93,6 +93,8 @@ public:
     WebCore::IntRect visibleContentBounds() const;
     WebCore::IntRect visibleContentBoundsExcludingScrollbars() const;
     WebCore::IntSize scrollOffset() const;
+    bool hasHorizontalScrollbar() const;
+    bool hasVerticalScrollbar() const;
     bool getDocumentBackgroundColor(double* red, double* green, double* blue, double* alpha);
 
     static WebFrame* frameForContext(JSContextRef);
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index d5f3724..7707965 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -32,6 +32,7 @@
 #include "DrawingArea.h"
 #include "InjectedBundle.h"
 #include "InjectedBundleBackForwardList.h"
+#include "LayerTreeHost.h"
 #include "MessageID.h"
 #include "NetscapePlugin.h"
 #include "PageOverlay.h"
@@ -66,8 +67,8 @@
 #include "WebPopupMenu.h"
 #include "WebPreferencesStore.h"
 #include "WebProcess.h"
-#include "WebProcessProxyMessageKinds.h"
 #include "WebProcessProxyMessages.h"
+#include <JavaScriptCore/APICast.h>
 #include <WebCore/AbstractDatabase.h>
 #include <WebCore/ArchiveResource.h>
 #include <WebCore/Chrome.h>
@@ -77,18 +78,23 @@
 #include <WebCore/DocumentMarkerController.h>
 #include <WebCore/DragController.h>
 #include <WebCore/DragData.h>
+#include <WebCore/EditingBehavior.h>
 #include <WebCore/EventHandler.h>
 #include <WebCore/FocusController.h>
+#include <WebCore/FormState.h>
 #include <WebCore/Frame.h>
+#include <WebCore/FrameLoadRequest.h>
 #include <WebCore/FrameLoaderTypes.h>
 #include <WebCore/FrameView.h>
+#include <WebCore/HTMLFormElement.h>
 #include <WebCore/HistoryItem.h>
 #include <WebCore/KeyboardEvent.h>
+#include <WebCore/MouseEvent.h>
 #include <WebCore/Page.h>
 #include <WebCore/PlatformKeyboardEvent.h>
 #include <WebCore/PrintContext.h>
-#include <WebCore/RenderTreeAsText.h>
 #include <WebCore/RenderLayer.h>
+#include <WebCore/RenderTreeAsText.h>
 #include <WebCore/RenderView.h>
 #include <WebCore/ReplaceSelectionCommand.h>
 #include <WebCore/ResourceRequest.h>
@@ -110,9 +116,10 @@
 #endif
 
 #if ENABLE(PLUGIN_PROCESS)
-// FIXME: This is currently Mac-specific!
+#if PLATFORM(MAC)
 #include "MachPort.h"
 #endif
+#endif
 
 #if PLATFORM(QT)
 #include "HitTestResult.h"
@@ -151,6 +158,7 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
 #if PLATFORM(MAC)
     , m_windowIsVisible(false)
     , m_isSmartInsertDeleteEnabled(parameters.isSmartInsertDeleteEnabled)
+    , m_keyboardEventBeingInterpreted(0)
 #elif PLATFORM(WIN)
     , m_nativeWindow(parameters.nativeWindow)
 #endif
@@ -163,6 +171,10 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     , m_userSpaceScaleFactor(parameters.userSpaceScaleFactor)
     , m_cachedMainFrameIsPinnedToLeftSide(false)
     , m_cachedMainFrameIsPinnedToRightSide(false)
+    , m_isShowingContextMenu(false)
+#if PLATFORM(WIN)
+    , m_gestureReachedScrollingLimit(false)
+#endif
 {
     ASSERT(m_pageID);
 
@@ -282,6 +294,13 @@ void WebPage::initializeInjectedBundleUIClient(WKBundlePageUIClient* client)
     m_uiClient.initialize(client);
 }
 
+#if ENABLE(FULLSCREEN_API)
+void WebPage::initializeInjectedBundleFullScreenClient(WKBundlePageFullScreenClient* client)
+{
+    m_fullScreenClient.initialize(client);
+}
+#endif
+
 PassRefPtr<Plugin> WebPage::createPlugin(const Plugin::Parameters& parameters)
 {
     String pluginPath;
@@ -302,6 +321,22 @@ PassRefPtr<Plugin> WebPage::createPlugin(const Plugin::Parameters& parameters)
 #endif
 }
 
+EditorState WebPage::editorState() const
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    ASSERT(frame);
+
+    EditorState result;
+    result.selectionIsNone = frame->selection()->isNone();
+    result.selectionIsRange = frame->selection()->isRange();
+    result.isContentEditable = frame->selection()->isContentEditable();
+    result.isContentRichlyEditable = frame->selection()->isContentRichlyEditable();
+    result.isInPasswordField = frame->selection()->isInPasswordField();
+    result.hasComposition = frame->editor()->hasComposition();
+    
+    return result;
+}
+
 String WebPage::renderTreeExternalRepresentation() const
 {
     return externalRepresentation(m_mainFrame->coreFrame(), RenderAsTextBehaviorNormal);
@@ -440,6 +475,20 @@ void WebPage::loadPlainTextString(const String& string)
     loadData(sharedBuffer, "text/plain", "utf-16", blankURL(), KURL());
 }
 
+void WebPage::linkClicked(const String& url, const WebMouseEvent& event)
+{
+    Frame* frame = m_page->mainFrame();
+    if (!frame)
+        return;
+
+    RefPtr<Event> coreEvent;
+    if (event.type() != WebEvent::NoType)
+        coreEvent = MouseEvent::create(eventNames().clickEvent, frame->document()->defaultView(), platform(event), 0, 0);
+
+    frame->loader()->loadFrameRequest(FrameLoadRequest(frame->document()->securityOrigin(), ResourceRequest(url)), 
+        false, false, coreEvent.get(), 0, SendReferrer);
+}
+
 void WebPage::stopLoadingFrame(uint64_t frameID)
 {
     WebFrame* frame = WebProcess::shared().webFrame(frameID);
@@ -697,22 +746,38 @@ void WebPage::setFixedLayoutSize(const IntSize& size)
 
 void WebPage::installPageOverlay(PassRefPtr<PageOverlay> pageOverlay)
 {
-    if (m_pageOverlay)
-        pageOverlay->setPage(0);
+    bool shouldFadeIn = true;
+    
+    if (m_pageOverlay) {
+        m_pageOverlay->setPage(0);
+
+        if (pageOverlay) {
+            // We're installing a page overlay when a page overlay is already active.
+            // In this case we don't want to fade in the new overlay.
+            shouldFadeIn = false;
+        }
+    }
 
     m_pageOverlay = pageOverlay;
     m_pageOverlay->setPage(this);
 
-    m_drawingArea->didInstallPageOverlay();
+    if (shouldFadeIn)
+        m_pageOverlay->startFadeInAnimation();
 
+    m_drawingArea->didInstallPageOverlay();
     m_pageOverlay->setNeedsDisplay();
 }
 
-void WebPage::uninstallPageOverlay(PageOverlay* pageOverlay)
+void WebPage::uninstallPageOverlay(PageOverlay* pageOverlay, bool fadeOut)
 {
     if (pageOverlay != m_pageOverlay)
         return;
 
+    if (fadeOut) {
+        m_pageOverlay->startFadeOutAnimation();
+        return;
+    }
+
     m_pageOverlay->setPage(0);
     m_pageOverlay = nullptr;
 
@@ -804,35 +869,6 @@ WebContextMenu* WebPage::contextMenu()
     return m_contextMenu.get();
 }
 
-void WebPage::getLocationAndLengthFromRange(Range* range, uint64_t& location, uint64_t& length)
-{
-    location = notFound;
-    length = 0;
-
-    if (!range || !range->startContainer())
-        return;
-
-    Element* selectionRoot = range->ownerDocument()->frame()->selection()->rootEditableElement();
-    Element* scope = selectionRoot ? selectionRoot : range->ownerDocument()->documentElement();
-    
-    // Mouse events may cause TSM to attempt to create an NSRange for a portion of the view
-    // that is not inside the current editable region.  These checks ensure we don't produce
-    // potentially invalid data when responding to such requests.
-    if (range->startContainer() != scope && !range->startContainer()->isDescendantOf(scope))
-        return;
-    if (range->endContainer() != scope && !range->endContainer()->isDescendantOf(scope))
-        return;
-
-    RefPtr<Range> testRange = Range::create(scope->document(), scope, 0, range->startContainer(), range->startOffset());
-    ASSERT(testRange->startContainer() == scope);
-    location = TextIterator::rangeLength(testRange.get());
-    
-    ExceptionCode ec;
-    testRange->setEnd(range->endContainer(), range->endOffset(), ec);
-    ASSERT(testRange->startContainer() == scope);
-    length = TextIterator::rangeLength(testRange.get()) - location;
-}
-
 // Events 
 
 static const WebEvent* g_currentEvent = 0;
@@ -913,6 +949,12 @@ static bool handleMouseEvent(const WebMouseEvent& mouseEvent, Page* page)
 
 void WebPage::mouseEvent(const WebMouseEvent& mouseEvent)
 {
+    // Don't try to handle any pending mouse events if a context menu is showing.
+    if (m_isShowingContextMenu) {
+        send(Messages::WebPageProxy::DidReceiveEvent(static_cast<uint32_t>(mouseEvent.type()), false));
+        return;
+    }
+    
     bool handled = false;
     
     if (m_pageOverlay) {
@@ -962,6 +1004,7 @@ void WebPage::keyEvent(const WebKeyboardEvent& keyboardEvent)
     CurrentEvent currentEvent(keyboardEvent);
 
     bool handled = handleKeyEvent(keyboardEvent, m_page.get());
+    // FIXME: Platform default behaviors should be performed during normal DOM event dispatch (in most cases, in default keydown event handler).
     if (!handled)
         handled = performDefaultBehaviorForKeyEvent(keyboardEvent);
 
@@ -1142,8 +1185,9 @@ void WebPage::viewWillEndLiveResize()
 
 void WebPage::setFocused(bool isFocused)
 {
-    if (!isFocused)
+    if (!isFocused && m_page->focusController()->focusedOrMainFrame()->editor()->behavior().shouldClearSelectionWhenLosingWebPageFocus())
         m_page->focusController()->focusedOrMainFrame()->selection()->clear();
+
     m_page->focusController()->setFocused(isFocused);
 }
 
@@ -1240,7 +1284,8 @@ void WebPage::runJavaScriptInMainFrame(const String& script, uint64_t callbackID
 
     JSLock lock(SilenceAssertionsOnly);
     if (JSValue resultValue = m_mainFrame->coreFrame()->script()->executeScript(script, true).jsValue()) {
-        if ((serializedResultValue = SerializedScriptValue::create(m_mainFrame->coreFrame()->script()->globalObject(mainThreadNormalWorld())->globalExec(), resultValue)))
+        if ((serializedResultValue = SerializedScriptValue::create(m_mainFrame->jsContext(), 
+            toRef(m_mainFrame->coreFrame()->script()->globalObject(mainThreadNormalWorld())->globalExec(), resultValue), 0)))
             dataReference = CoreIPC::DataReference(serializedResultValue->data().data(), serializedResultValue->data().size());
     }
 
@@ -1360,6 +1405,7 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
 
     settings->setJavaScriptEnabled(store.getBoolValueForKey(WebPreferencesKey::javaScriptEnabledKey()));
     settings->setLoadsImagesAutomatically(store.getBoolValueForKey(WebPreferencesKey::loadsImagesAutomaticallyKey()));
+    settings->setLoadsSiteIconsIgnoringImageLoadingSetting(store.getBoolValueForKey(WebPreferencesKey::loadsSiteIconsIgnoringImageLoadingPreferenceKey()));
     settings->setPluginsEnabled(store.getBoolValueForKey(WebPreferencesKey::pluginsEnabledKey()));
     settings->setJavaEnabled(store.getBoolValueForKey(WebPreferencesKey::javaEnabledKey()));
     settings->setOfflineWebApplicationCacheEnabled(store.getBoolValueForKey(WebPreferencesKey::offlineWebApplicationCacheEnabledKey()));
@@ -1391,17 +1437,11 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     settings->setMinimumLogicalFontSize(store.getUInt32ValueForKey(WebPreferencesKey::minimumLogicalFontSizeKey()));
     settings->setDefaultFontSize(store.getUInt32ValueForKey(WebPreferencesKey::defaultFontSizeKey()));
     settings->setDefaultFixedFontSize(store.getUInt32ValueForKey(WebPreferencesKey::defaultFixedFontSizeKey()));
+    settings->setEditableLinkBehavior(static_cast<WebCore::EditableLinkBehavior>(store.getUInt32ValueForKey(WebPreferencesKey::editableLinkBehaviorKey())));
 
-#if PLATFORM(WIN)
-    // Temporarily turn off accelerated compositing until we have a good solution for rendering it.
-    settings->setAcceleratedCompositingEnabled(false);
-    settings->setAcceleratedDrawingEnabled(false);
-    settings->setCanvasUsesAcceleratedDrawing(false);
-#else
-    settings->setAcceleratedCompositingEnabled(store.getBoolValueForKey(WebPreferencesKey::acceleratedCompositingEnabledKey()));
-    settings->setAcceleratedDrawingEnabled(store.getBoolValueForKey(WebPreferencesKey::acceleratedDrawingEnabledKey()));
-    settings->setCanvasUsesAcceleratedDrawing(store.getBoolValueForKey(WebPreferencesKey::canvasUsesAcceleratedDrawingKey()));
-#endif
+    settings->setAcceleratedCompositingEnabled(store.getBoolValueForKey(WebPreferencesKey::acceleratedCompositingEnabledKey()) && LayerTreeHost::supportsAcceleratedCompositing());
+    settings->setAcceleratedDrawingEnabled(store.getBoolValueForKey(WebPreferencesKey::acceleratedDrawingEnabledKey()) && LayerTreeHost::supportsAcceleratedCompositing());
+    settings->setCanvasUsesAcceleratedDrawing(store.getBoolValueForKey(WebPreferencesKey::canvasUsesAcceleratedDrawingKey()) && LayerTreeHost::supportsAcceleratedCompositing());
     settings->setShowDebugBorders(store.getBoolValueForKey(WebPreferencesKey::compositingBordersVisibleKey()));
     settings->setShowRepaintCounter(store.getBoolValueForKey(WebPreferencesKey::compositingRepaintCountersVisibleKey()));
     settings->setWebGLEnabled(store.getBoolValueForKey(WebPreferencesKey::webGLEnabledKey()));
@@ -1441,7 +1481,7 @@ WebFullScreenManager* WebPage::fullScreenManager()
 }
 #endif
 
-#if !PLATFORM(MAC)
+#if !PLATFORM(GTK) && !PLATFORM(MAC)
 bool WebPage::handleEditingKeyboardEvent(KeyboardEvent* evt)
 {
     Node* node = evt->target()->toNode();
@@ -1504,7 +1544,7 @@ void WebPage::performDragControllerAction(uint64_t action, WebCore::IntPoint cli
     }
 }
 #else
-void WebPage::performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const String& dragStorageName, uint32_t flags)
+void WebPage::performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const String& dragStorageName, uint32_t flags, const SandboxExtension::Handle& sandboxExtensionHandle)
 {
     if (!m_page) {
         send(Messages::WebPageProxy::DidPerformDragControllerAction(DragOperationNone));
@@ -1525,10 +1565,23 @@ void WebPage::performDragControllerAction(uint64_t action, WebCore::IntPoint cli
         m_page->dragController()->dragExited(&dragData);
         break;
         
-    case DragControllerActionPerformDrag:
+    case DragControllerActionPerformDrag: {
+        ASSERT(!m_pendingDropSandboxExtension);
+
+        m_pendingDropSandboxExtension = SandboxExtension::create(sandboxExtensionHandle);
+
         m_page->dragController()->performDrag(&dragData);
+
+        // If we started loading a local file, the sandbox extension tracker would have adopted this
+        // pending drop sandbox extension. If not, we'll play it safe and invalidate it.
+        if (m_pendingDropSandboxExtension) {
+            m_pendingDropSandboxExtension->invalidate();
+            m_pendingDropSandboxExtension = nullptr;
+        }
+
         break;
-        
+    }
+
     default:
         ASSERT_NOT_REACHED();
     }
@@ -1550,6 +1603,11 @@ void WebPage::dragEnded(WebCore::IntPoint clientPosition, WebCore::IntPoint glob
     m_page->mainFrame()->eventHandler()->dragSourceEndedAt(event, (DragOperation)operation);
 }
 
+void WebPage::willPerformLoadDragDestinationAction()
+{
+    m_sandboxExtensionTracker.willPerformLoadDragDestinationAction(m_pendingDropSandboxExtension.release());
+}
+
 WebEditCommand* WebPage::webEditCommand(uint64_t commandID)
 {
     return m_editCommandMap.get(commandID).get();
@@ -1734,8 +1792,9 @@ void WebPage::didChangeScrollOffsetForMainFrame()
     Frame* frame = m_page->mainFrame();
     IntPoint scrollPosition = frame->view()->scrollPosition();
     IntPoint maximumScrollPosition = frame->view()->maximumScrollPosition();
+    IntPoint minimumScrollPosition = frame->view()->minimumScrollPosition();
 
-    bool isPinnedToLeftSide = (scrollPosition.x() <= 0);
+    bool isPinnedToLeftSide = (scrollPosition.x() <= minimumScrollPosition.x());
     bool isPinnedToRightSide = (scrollPosition.x() >= maximumScrollPosition.x());
 
     if (isPinnedToLeftSide != m_cachedMainFrameIsPinnedToLeftSide || isPinnedToRightSide != m_cachedMainFrameIsPinnedToRightSide) {
@@ -1877,18 +1936,28 @@ void WebPage::SandboxExtensionTracker::invalidate()
     }
 }
 
+void WebPage::SandboxExtensionTracker::willPerformLoadDragDestinationAction(PassRefPtr<SandboxExtension> pendingDropSandboxExtension)
+{
+    setPendingProvisionalSandboxExtension(pendingDropSandboxExtension);
+}
+
 void WebPage::SandboxExtensionTracker::beginLoad(WebFrame* frame, const SandboxExtension::Handle& handle)
 {
     ASSERT(frame->isMainFrame());
 
+    setPendingProvisionalSandboxExtension(SandboxExtension::create(handle));
+}
+
+void WebPage::SandboxExtensionTracker::setPendingProvisionalSandboxExtension(PassRefPtr<SandboxExtension> pendingProvisionalSandboxExtension)
+{
     // If we get two beginLoad calls in succession, without a provisional load starting, then
     // m_pendingProvisionalSandboxExtension will be non-null. Invalidate and null out the extension if that is the case.
     if (m_pendingProvisionalSandboxExtension) {
         m_pendingProvisionalSandboxExtension->invalidate();
         m_pendingProvisionalSandboxExtension = nullptr;
     }
-        
-    m_pendingProvisionalSandboxExtension = SandboxExtension::create(handle);
+    
+    m_pendingProvisionalSandboxExtension = pendingProvisionalSandboxExtension;    
 }
 
 static bool shouldReuseCommittedSandboxExtension(WebFrame* frame)
@@ -1907,8 +1976,7 @@ static bool shouldReuseCommittedSandboxExtension(WebFrame* frame)
     if (!documentLoader || !provisionalDocumentLoader)
         return false;
 
-    if (documentLoader->url().isLocalFile() && provisionalDocumentLoader->url().isLocalFile() 
-        && provisionalDocumentLoader->triggeringAction().type() == NavigationTypeLinkClicked)
+    if (documentLoader->url().isLocalFile() && provisionalDocumentLoader->url().isLocalFile())
         return true;
 
     return false;
@@ -1953,7 +2021,6 @@ void WebPage::SandboxExtensionTracker::didFailProvisionalLoad(WebFrame* frame)
     if (!frame->isMainFrame())
         return;
 
-    ASSERT(!m_pendingProvisionalSandboxExtension);
     if (!m_provisionalSandboxExtension)
         return;
 
@@ -2058,7 +2125,7 @@ void WebPage::drawRectToPDF(uint64_t frameID, const WebCore::IntRect& rect, uint
     if (coreFrame) {
         ASSERT(coreFrame->document()->printing());
 
-#if PLATFORM(CG)
+#if USE(CG)
         // FIXME: Use CGDataConsumerCreate with callbacks to avoid copying the data.
         RetainPtr<CGDataConsumerRef> pdfDataConsumer(AdoptCF, CGDataConsumerCreateWithCFData(pdfPageData.get()));
 
@@ -2090,7 +2157,7 @@ void WebPage::drawPagesToPDF(uint64_t frameID, uint32_t first, uint32_t count, u
     if (coreFrame) {
         ASSERT(coreFrame->document()->printing());
 
-#if PLATFORM(CG)
+#if USE(CG)
         // FIXME: Use CGDataConsumerCreate with callbacks to avoid copying the data.
         RetainPtr<CGDataConsumerRef> pdfDataConsumer(AdoptCF, CGDataConsumerCreateWithCFData(pdfPageData.get()));
 
@@ -2159,4 +2226,19 @@ void WebPage::handleCorrectionPanelResult(const String& result)
 }
 #endif
 
+void WebPage::simulateMouseDown(int button, WebCore::IntPoint position, int clickCount, WKEventModifiers modifiers, double time)
+{
+    mouseEvent(WebMouseEvent(WebMouseEvent::MouseDown, static_cast<WebMouseEvent::Button>(button), position, position, 0, 0, 0, clickCount, static_cast<WebMouseEvent::Modifiers>(modifiers), time));
+}
+
+void WebPage::simulateMouseUp(int button, WebCore::IntPoint position, int clickCount, WKEventModifiers modifiers, double time)
+{
+    mouseEvent(WebMouseEvent(WebMouseEvent::MouseUp, static_cast<WebMouseEvent::Button>(button), position, position, 0, 0, 0, clickCount, static_cast<WebMouseEvent::Modifiers>(modifiers), time));
+}
+
+void WebPage::simulateMouseMotion(WebCore::IntPoint position, double time)
+{
+    mouseEvent(WebMouseEvent(WebMouseEvent::MouseMove, WebMouseEvent::NoButton, position, position, 0, 0, 0, 0, WebMouseEvent::Modifiers(), time));
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index 8e4e71c..7828b45 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -34,6 +34,7 @@
 #include "InjectedBundlePageContextMenuClient.h"
 #include "InjectedBundlePageEditorClient.h"
 #include "InjectedBundlePageFormClient.h"
+#include "InjectedBundlePageFullScreenClient.h"
 #include "InjectedBundlePageLoaderClient.h"
 #include "InjectedBundlePagePolicyClient.h"
 #include "InjectedBundlePageResourceLoadClient.h"
@@ -81,6 +82,7 @@ namespace WebCore {
     class ResourceRequest;
     class SharedBuffer;
     class VisibleSelection;
+    struct KeypressCommand;
 }
 
 namespace WebKit {
@@ -103,6 +105,8 @@ class WebOpenPanelResultListener;
 class WebPageGroupProxy;
 class WebPopupMenu;
 class WebWheelEvent;
+struct AttributedString;
+struct EditorState;
 struct PrintInfo;
 struct WebPageCreationParameters;
 struct WebPreferencesStore;
@@ -159,9 +163,12 @@ public:
     void layoutIfNeeded();
 
     // -- Called from WebCore clients.
-#if !PLATFORM(MAC)
+#if PLATFORM(MAC)
+    bool handleEditingKeyboardEvent(WebCore::KeyboardEvent*, bool saveCommands);
+#elif !PLATFORM(GTK)
     bool handleEditingKeyboardEvent(WebCore::KeyboardEvent*);
 #endif
+
     void show();
     String userAgent() const { return m_userAgent; }
     WebCore::IntRect windowResizerRect() const;
@@ -189,6 +196,9 @@ public:
     void initializeInjectedBundlePolicyClient(WKBundlePagePolicyClient*);
     void initializeInjectedBundleResourceLoadClient(WKBundlePageResourceLoadClient*);
     void initializeInjectedBundleUIClient(WKBundlePageUIClient*);
+#if ENABLE(FULLSCREEN_API)
+    void initializeInjectedBundleFullScreenClient(WKBundlePageFullScreenClient*);
+#endif
 
     InjectedBundlePageContextMenuClient& injectedBundleContextMenuClient() { return m_contextMenuClient; }
     InjectedBundlePageEditorClient& injectedBundleEditorClient() { return m_editorClient; }
@@ -197,12 +207,17 @@ public:
     InjectedBundlePagePolicyClient& injectedBundlePolicyClient() { return m_policyClient; }
     InjectedBundlePageResourceLoadClient& injectedBundleResourceLoadClient() { return m_resourceLoadClient; }
     InjectedBundlePageUIClient& injectedBundleUIClient() { return m_uiClient; }
+#if ENABLE(FULLSCREEN_API)
+    InjectedBundlePageFullScreenClient& injectedBundleFullScreenClient() { return m_fullScreenClient; }
+#endif
 
     bool findStringFromInjectedBundle(const String&, FindOptions);
 
     WebFrame* mainFrame() const { return m_mainFrame.get(); }
     PassRefPtr<Plugin> createPlugin(const Plugin::Parameters&);
 
+    EditorState editorState() const;
+
     String renderTreeExternalRepresentation() const;
     void executeEditingCommand(const String& commandName, const String& argument);
     bool isEditingCommandEnabled(const String& commandName);
@@ -240,14 +255,13 @@ public:
     bool windowIsVisible() const { return m_windowIsVisible; }
     const WebCore::IntRect& windowFrameInScreenCoordinates() const { return m_windowFrameInScreenCoordinates; }
     const WebCore::IntRect& viewFrameInWindowCoordinates() const { return m_viewFrameInWindowCoordinates; }
-    bool interceptEditingKeyboardEvent(WebCore::KeyboardEvent*, bool);
 #elif PLATFORM(WIN)
     HWND nativeWindow() const { return m_nativeWindow; }
 #endif
 
     bool windowIsFocused() const;
     void installPageOverlay(PassRefPtr<PageOverlay>);
-    void uninstallPageOverlay(PageOverlay*);
+    void uninstallPageOverlay(PageOverlay*, bool fadeOut);
     bool hasPageOverlay() const { return m_pageOverlay; }
     WebCore::IntRect windowToScreen(const WebCore::IntRect&);
 
@@ -285,10 +299,14 @@ public:
         void invalidate();
 
         void beginLoad(WebFrame*, const SandboxExtension::Handle& handle);
+        void willPerformLoadDragDestinationAction(PassRefPtr<SandboxExtension> pendingDropSandboxExtension);
         void didStartProvisionalLoad(WebFrame*);
         void didCommitProvisionalLoad(WebFrame*);
         void didFailProvisionalLoad(WebFrame*);
+
     private:
+        void setPendingProvisionalSandboxExtension(PassRefPtr<SandboxExtension>);
+
         RefPtr<SandboxExtension> m_pendingProvisionalSandboxExtension;
         RefPtr<SandboxExtension> m_provisionalSandboxExtension;
         RefPtr<SandboxExtension> m_committedSandboxExtension;
@@ -296,8 +314,6 @@ public:
 
     SandboxExtensionTracker& sandboxExtensionTracker() { return m_sandboxExtensionTracker; }
 
-    static void getLocationAndLengthFromRange(WebCore::Range*, uint64_t& location, uint64_t& length);
-
 #if PLATFORM(MAC)
     void registerUIProcessAccessibilityTokens(const CoreIPC::DataReference& elemenToken, const CoreIPC::DataReference& windowToken);
     AccessibilityWebPageObject* accessibilityRemoteObject();
@@ -305,16 +321,29 @@ public:
     
     void sendComplexTextInputToPlugin(uint64_t pluginComplexTextInputIdentifier, const String& textInput);
 
+    void setComposition(const String& text, Vector<WebCore::CompositionUnderline> underlines, uint64_t selectionStart, uint64_t selectionEnd, uint64_t replacementRangeStart, uint64_t replacementRangeEnd, EditorState& newState);
+    void confirmComposition(EditorState& newState);
+    void insertText(const String& text, uint64_t replacementRangeStart, uint64_t replacementRangeEnd, bool& handled, EditorState& newState);
     void getMarkedRange(uint64_t& location, uint64_t& length);
+    void getSelectedRange(uint64_t& location, uint64_t& length);
+    void getAttributedSubstringFromRange(uint64_t location, uint64_t length, AttributedString&);
     void characterIndexForPoint(const WebCore::IntPoint point, uint64_t& result);
     void firstRectForCharacterRange(uint64_t location, uint64_t length, WebCore::IntRect& resultRect);
+    void executeKeypressCommands(const Vector<WebCore::KeypressCommand>&, bool& handled, EditorState& newState);
     void writeSelectionToPasteboard(const WTF::String& pasteboardName, const WTF::Vector<WTF::String>& pasteboardTypes, bool& result);
     void readSelectionFromPasteboard(const WTF::String& pasteboardName, bool& result);
+    void shouldDelayWindowOrderingEvent(const WebKit::WebMouseEvent&, bool& result);
+    void acceptsFirstMouse(int eventNumber, const WebKit::WebMouseEvent&, bool& result);
+    bool performNonEditingBehaviorForSelector(const String&);
 #elif PLATFORM(WIN)
     void confirmComposition(const String& compositionString);
     void setComposition(const WTF::String& compositionString, const WTF::Vector<WebCore::CompositionUnderline>& underlines, uint64_t cursorPosition);
     void firstRectForCharacterInSelectedRange(const uint64_t characterPosition, WebCore::IntRect& resultRect);
     void getSelectedText(WTF::String&);
+
+    void gestureWillBegin(const WebCore::IntPoint&, bool& canBeginPanning);
+    void gestureDidScroll(const WebCore::IntSize&);
+    void gestureDidEnd();
 #endif
 
     // FIXME: This a dummy message, to avoid breaking the build for platforms that don't require
@@ -335,10 +364,12 @@ public:
 #if PLATFORM(WIN)
     void performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const WebCore::DragDataMap&, uint32_t flags);
 #else
-    void performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const WTF::String& dragStorageName, uint32_t flags);
+    void performDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, const WTF::String& dragStorageName, uint32_t flags, const SandboxExtension::Handle&);
 #endif
     void dragEnded(WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t operation);
 
+    void willPerformLoadDragDestinationAction();
+
     void beginPrinting(uint64_t frameID, const PrintInfo&);
     void endPrinting();
     void computePagesForPrinting(uint64_t frameID, const PrintInfo&, uint64_t callbackID);
@@ -365,6 +396,9 @@ public:
 
     void forceRepaintWithoutCallback();
 
+    void unmarkAllMisspellings();
+    void unmarkAllBadGrammar();
+
 #if PLATFORM(MAC)
     void setDragSource(NSObject *);
 #endif
@@ -373,6 +407,12 @@ public:
     void handleCorrectionPanelResult(const String&);
 #endif
 
+    void simulateMouseDown(int button, WebCore::IntPoint, int clickCount, WKEventModifiers, double time);
+    void simulateMouseUp(int button, WebCore::IntPoint, int clickCount, WKEventModifiers, double time);
+    void simulateMouseMotion(WebCore::IntPoint, double time);
+
+    void contextMenuShowing() { m_isShowingContextMenu = true; }
+
 private:
     WebPage(uint64_t pageID, const WebPageCreationParameters&);
 
@@ -383,9 +423,15 @@ private:
     void didReceiveWebPageMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
     CoreIPC::SyncReplyMode didReceiveSyncWebPageMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
 
+#if !PLATFORM(MAC)
     static const char* interpretKeyEvent(const WebCore::KeyboardEvent*);
+#endif
     bool performDefaultBehaviorForKeyEvent(const WebKeyboardEvent&);
 
+#if PLATFORM(MAC)
+    bool executeKeypressCommandsInternal(const Vector<WebCore::KeypressCommand>&, WebCore::KeyboardEvent*);
+#endif
+
     String sourceForFrame(WebFrame*);
 
     void loadData(PassRefPtr<WebCore::SharedBuffer>, const String& MIMEType, const String& encodingName, const WebCore::KURL& baseURL, const WebCore::KURL& failingURL);
@@ -399,6 +445,7 @@ private:
     void loadHTMLString(const String& htmlString, const String& baseURL);
     void loadAlternateHTMLString(const String& htmlString, const String& baseURL, const String& unreachableURL);
     void loadPlainTextString(const String&);
+    void linkClicked(const String& url, const WebMouseEvent&);
     void reload(bool reloadFromOrigin);
     void goForward(uint64_t, const SandboxExtension::Handle&);
     void goBack(uint64_t, const SandboxExtension::Handle&);
@@ -420,6 +467,7 @@ private:
 #if ENABLE(TOUCH_EVENTS)
     void touchEvent(const WebTouchEvent&);
 #endif
+    void contextMenuHidden() { m_isShowingContextMenu = false; }
 
     static void scroll(WebCore::Page*, WebCore::ScrollDirection, WebCore::ScrollGranularity);
     static void logicalScroll(WebCore::Page*, WebCore::ScrollLogicalDirection, WebCore::ScrollGranularity);
@@ -486,8 +534,6 @@ private:
 
     void advanceToNextMisspelling(bool startBeforeSelection);
     void changeSpellingToWord(const String& word);
-    void unmarkAllMisspellings();
-    void unmarkAllBadGrammar();
 #if PLATFORM(MAC)
     void uppercaseWord();
     void lowercaseWord();
@@ -545,9 +591,14 @@ private:
     RetainPtr<AccessibilityWebPageObject> m_mockAccessibilityElement;
 
     RetainPtr<NSObject> m_dragSource;
+
+    WebCore::KeyboardEvent* m_keyboardEventBeingInterpreted;
+
 #elif PLATFORM(WIN)
     // Our view's window (in the UI process).
     HWND m_nativeWindow;
+
+    RefPtr<WebCore::Node> m_gestureTargetNode;
 #endif
     
     HashMap<uint64_t, RefPtr<WebEditCommand> > m_editCommandMap;
@@ -561,6 +612,9 @@ private:
     InjectedBundlePagePolicyClient m_policyClient;
     InjectedBundlePageResourceLoadClient m_resourceLoadClient;
     InjectedBundlePageUIClient m_uiClient;
+#if ENABLE(FULLSCREEN_API)
+    InjectedBundlePageFullScreenClient m_fullScreenClient;
+#endif
 
 #if ENABLE(TILED_BACKING_STORE)
     WebCore::IntSize m_resizesToContentsLayoutSize;
@@ -585,6 +639,8 @@ private:
     SandboxExtensionTracker m_sandboxExtensionTracker;
     uint64_t m_pageID;
 
+    RefPtr<SandboxExtension> m_pendingDropSandboxExtension;
+
     bool m_canRunBeforeUnloadConfirmPanel;
 
     bool m_canRunModal;
@@ -594,6 +650,12 @@ private:
 
     bool m_cachedMainFrameIsPinnedToLeftSide;
     bool m_cachedMainFrameIsPinnedToRightSide;
+
+    bool m_isShowingContextMenu;
+
+#if PLATFORM(WIN)
+    bool m_gestureReachedScrollingLimit;
+#endif
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index 69bd54d..673e8d6 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -42,6 +42,8 @@ messages -> WebPage {
     TouchEvent(WebKit::WebTouchEvent event)
 #endif
 
+    ContextMenuHidden()
+
     ScrollBy(uint32_t scrollDirection, uint32_t scrollGranularity)
 
     GoBack(uint64_t backForwardItemID, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
@@ -52,6 +54,7 @@ messages -> WebPage {
     LoadPlainTextString(WTF::String string)
     LoadURL(WTF::String url, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
     LoadURLRequest(WebCore::ResourceRequest request, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
+    LinkClicked(WTF::String url, WebKit::WebMouseEvent event)
     Reload(bool reloadFromOrigin)
     StopLoading()
 
@@ -119,7 +122,7 @@ messages -> WebPage {
     PerformDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, HashMap<UINT,Vector<String>> dataMap, uint32_t flags)
 #endif
 #if !PLATFORM(WIN)
-    PerformDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, WTF::String dragStorageName, uint32_t flags)
+    PerformDragControllerAction(uint64_t action, WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t draggingSourceOperationMask, WTF::String dragStorageName, uint32_t flags, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
 #endif
     DragEnded(WebCore::IntPoint clientPosition, WebCore::IntPoint globalPosition, uint64_t operation)
 
@@ -140,8 +143,6 @@ messages -> WebPage {
     # Spelling and grammar.
     AdvanceToNextMisspelling(bool startBeforeSelection)
     ChangeSpellingToWord(WTF::String word)
-    UnmarkAllMisspellings()
-    UnmarkAllBadGrammar()
 #if PLATFORM(MAC)
     UppercaseWord();
     LowercaseWord();
@@ -179,18 +180,33 @@ messages -> WebPage {
 
     SetWindowIsVisible(bool windowIsVisible)
     WindowAndViewFramesChanged(WebCore::IntRect windowFrameInScreenCoordinates, WebCore::IntRect viewFrameInWindowCoordinates, WebCore::IntPoint accessibilityViewCoordinates)
-    GetMarkedRange() -> (uint64_t location, uint64_t length)
-    CharacterIndexForPoint(WebCore::IntPoint point) -> (uint64_t result)
-    FirstRectForCharacterRange(uint64_t location, uint64_t length) -> (WebCore::IntRect resultRect)
     RegisterUIProcessAccessibilityTokens(CoreIPC::DataReference elemenToken, CoreIPC::DataReference windowToken)
     WriteSelectionToPasteboard(WTF::String pasteboardName, WTF::Vector<WTF::String> pasteboardTypes) -> (bool result)
     ReadSelectionFromPasteboard(WTF::String pasteboardName) -> (bool result)
+
+    # Text input.
+    SetComposition(WTF::String text, WTF::Vector<WebCore::CompositionUnderline> underlines, uint64_t selectionStart, uint64_t selectionEnd, uint64_t replacementRangeStart, uint64_t replacementRangeEnd) -> (WebKit::EditorState newState)
+    ConfirmComposition() -> (WebKit::EditorState newState)
+    InsertText(WTF::String text, uint64_t replacementRangeStart, uint64_t replacementRangeEnd) -> (bool handled, WebKit::EditorState newState)
+    GetMarkedRange() -> (uint64_t location, uint64_t length)
+    GetSelectedRange() -> (uint64_t location, uint64_t length)
+    GetAttributedSubstringFromRange(uint64_t location, uint64_t length) -> (WebKit::AttributedString result)
+    CharacterIndexForPoint(WebCore::IntPoint point) -> (uint64_t result)
+    FirstRectForCharacterRange(uint64_t location, uint64_t length) -> (WebCore::IntRect resultRect)
+    ExecuteKeypressCommands(Vector<WebCore::KeypressCommand> savedCommands) -> (bool handled, WebKit::EditorState newState)
+    ShouldDelayWindowOrderingEvent(WebKit::WebMouseEvent event) -> (bool result)
+    AcceptsFirstMouse(int eventNumber, WebKit::WebMouseEvent event) -> (bool result)
 #endif
 #if PLATFORM(WIN)
+    // FIXME: Unify with Mac counterparts.
     ConfirmComposition(WTF::String compositionString)
     SetComposition(WTF::String compositionString, WTF::Vector<WebCore::CompositionUnderline> underlines, uint64_t cursorPosition)
     FirstRectForCharacterInSelectedRange(uint64_t characterPosition) -> (WebCore::IntRect resultRect)
     GetSelectedText() -> (WTF::String text)
+
+    GestureWillBegin(WebCore::IntPoint point) -> (bool canBeginPanning)
+    GestureDidScroll(WebCore::IntSize size)
+    GestureDidEnd()
 #endif
 #if PLATFORM(QT)
     FindZoomableAreaForPoint(WebCore::IntPoint point)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPageGroupProxy.h b/Source/WebKit2/WebProcess/WebPage/WebPageGroupProxy.h
index 55cf629..91e6c5c 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPageGroupProxy.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPageGroupProxy.h
@@ -42,6 +42,7 @@ public:
     const String& identifier() const { return m_data.identifer; }
     uint64_t pageGroupID() const { return m_data.pageGroupID; }
     bool isVisibleToInjectedBundle() const { return m_data.visibleToInjectedBundle; }
+    bool isVisibleToHistoryClient() const { return m_data.visibleToHistoryClient; }
 
 private:
     WebPageGroupProxy(const WebPageGroupData& data)
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
index 2460607..42a2dc9 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.cpp
@@ -31,39 +31,41 @@
 #include "WebProcess.h"
 #include <WebCore/Frame.h>
 #include <WebCore/FrameView.h>
+#include <WebCore/GraphicsLayerCA.h>
 #include <WebCore/Page.h>
+#include <WebCore/PlatformCALayer.h>
 #include <WebCore/Settings.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-PassRefPtr<LayerTreeHostCA> LayerTreeHostCA::create(WebPage* webPage)
-{
-    return adoptRef(new LayerTreeHostCA(webPage));
-}
-
 LayerTreeHostCA::LayerTreeHostCA(WebPage* webPage)
     : LayerTreeHost(webPage)
     , m_isValid(true)
     , m_notifyAfterScheduledLayerFlush(false)
 {
+}
 
+void LayerTreeHostCA::initialize()
+{
     // Create a root layer.
     m_rootLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
     m_rootLayer->setName("LayerTreeHost root layer");
 #endif
     m_rootLayer->setDrawsContent(false);
-    m_rootLayer->setSize(webPage->size());
+    m_rootLayer->setSize(m_webPage->size());
+    static_cast<GraphicsLayerCA*>(m_rootLayer.get())->platformCALayer()->setGeometryFlipped(true);
 
     m_nonCompositedContentLayer = GraphicsLayer::create(this);
+    static_cast<GraphicsLayerCA*>(m_nonCompositedContentLayer.get())->setAllowTiledLayer(false);
 #ifndef NDEBUG
     m_nonCompositedContentLayer->setName("LayerTreeHost non-composited content");
 #endif
     m_nonCompositedContentLayer->setDrawsContent(true);
     m_nonCompositedContentLayer->setContentsOpaque(m_webPage->drawsBackground() && !m_webPage->drawsTransparentBackground());
-    m_nonCompositedContentLayer->setSize(webPage->size());
+    m_nonCompositedContentLayer->setSize(m_webPage->size());
     if (m_webPage->corePage()->settings()->acceleratedDrawingEnabled())
         m_nonCompositedContentLayer->setAcceleratesDrawing(true);
 
@@ -72,7 +74,7 @@ LayerTreeHostCA::LayerTreeHostCA(WebPage* webPage)
     if (m_webPage->hasPageOverlay())
         createPageOverlayLayer();
 
-    platformInitialize();
+    platformInitialize(m_layerTreeContext);
 
     scheduleLayerFlush();
 }
@@ -81,10 +83,6 @@ LayerTreeHostCA::~LayerTreeHostCA()
 {
     ASSERT(!m_isValid);
     ASSERT(!m_rootLayer);
-#if PLATFORM(MAC)
-    ASSERT(!m_flushPendingLayerChangesRunLoopObserver);
-    ASSERT(!m_remoteLayerClient);
-#endif
 }
 
 const LayerTreeContext& LayerTreeHostCA::layerTreeContext()
@@ -109,7 +107,6 @@ void LayerTreeHostCA::setRootCompositingLayer(GraphicsLayer* graphicsLayer)
 void LayerTreeHostCA::invalidate()
 {
     ASSERT(m_isValid);
-    platformInvalidate();
     m_rootLayer = nullptr;
     m_isValid = false;
 }
@@ -138,16 +135,12 @@ void LayerTreeHostCA::sizeDidChange(const IntSize& newSize)
 
     scheduleLayerFlush();
     flushPendingLayerChanges();
-
-    platformSizeDidChange();
 }
 
 void LayerTreeHostCA::forceRepaint()
 {
     scheduleLayerFlush();
     flushPendingLayerChanges();
-
-    platformForceRepaint();
 }    
 
 void LayerTreeHostCA::didInstallPageOverlay()
@@ -218,8 +211,6 @@ void LayerTreeHostCA::performScheduledLayerFlush()
 
 void LayerTreeHostCA::didPerformScheduledLayerFlush()
 {
-    platformDidPerformScheduledLayerFlush();
-
     if (m_notifyAfterScheduledLayerFlush) {
         // Let the drawing area know that we've done a flush of the layer changes.
         static_cast<DrawingAreaImpl*>(m_webPage->drawingArea())->layerHostDidFlushLayers();
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
index ba4e33a..3a62d15 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
+++ b/Source/WebKit2/WebProcess/WebPage/ca/LayerTreeHostCA.h
@@ -31,35 +31,36 @@
 #include <WebCore/GraphicsLayerClient.h>
 #include <wtf/OwnPtr.h>
 
-#if PLATFORM(MAC)
-#include <wtf/RetainPtr.h>
-#endif
-
-#if PLATFORM(MAC)
-typedef struct __WKCARemoteLayerClientRef* WKCARemoteLayerClientRef;
-#endif
-
 namespace WebKit {
 
 class LayerTreeHostCA : public LayerTreeHost, WebCore::GraphicsLayerClient {
 public:
-    static PassRefPtr<LayerTreeHostCA> create(WebPage*);
-    ~LayerTreeHostCA();
+    virtual ~LayerTreeHostCA();
     
-private:
+protected:
     explicit LayerTreeHostCA(WebPage*);
 
+    WebCore::GraphicsLayer* rootLayer() const { return m_rootLayer.get(); }
+
+    void initialize();
+    void performScheduledLayerFlush();
+
+    // LayerTreeHost.
+    virtual void invalidate();
+    virtual void sizeDidChange(const WebCore::IntSize& newSize);
+    virtual void forceRepaint();
+
+    // LayerTreeHostCA
+    virtual void didPerformScheduledLayerFlush();
+
+private:
     // LayerTreeHost.
     virtual const LayerTreeContext& layerTreeContext();
-    virtual void scheduleLayerFlush();
     virtual void setShouldNotifyAfterNextScheduledLayerFlush(bool);
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*);
-    virtual void invalidate();
 
     virtual void setNonCompositedContentsNeedDisplay(const WebCore::IntRect&);
     virtual void scrollNonCompositedContents(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset);
-    virtual void sizeDidChange(const WebCore::IntSize& newSize);
-    virtual void forceRepaint();
 
     virtual void didInstallPageOverlay();
     virtual void didUninstallPageOverlay();
@@ -72,23 +73,14 @@ private:
     virtual bool showDebugBorders() const;
     virtual bool showRepaintCounter() const;
 
-    void platformInitialize();
-    void platformInvalidate();
-    void platformSizeDidChange();
-    void platformForceRepaint();
+    // LayerTreeHostCA
+    virtual void platformInitialize(LayerTreeContext&) = 0;
 
-    void performScheduledLayerFlush();
-    void didPerformScheduledLayerFlush();
-    void platformDidPerformScheduledLayerFlush();
     bool flushPendingLayerChanges();
 
     void createPageOverlayLayer();
     void destroyPageOverlayLayer();
 
-#if PLATFORM(MAC)
-    static void flushPendingLayerChangesRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void*);
-#endif
-
     // The context for this layer tree.
     LayerTreeContext m_layerTreeContext;
 
@@ -107,11 +99,6 @@ private:
 
     // The page overlay layer. Will be null if there's no page overlay.
     OwnPtr<WebCore::GraphicsLayer> m_pageOverlayLayer;
-
-#if PLATFORM(MAC)
-    RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerClient;
-    RetainPtr<CFRunLoopObserverRef> m_flushPendingLayerChangesRunLoopObserver;
-#endif
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h
new file mode 100644
index 0000000..e3a0160
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LayerTreeHostCAMac_h
+#define LayerTreeHostCAMac_h
+
+#include "LayerTreeHostCA.h"
+#include <wtf/RetainPtr.h>
+
+typedef struct __WKCARemoteLayerClientRef* WKCARemoteLayerClientRef;
+
+namespace WebKit {
+
+class LayerTreeHostCAMac : public LayerTreeHostCA {
+public:
+    static PassRefPtr<LayerTreeHostCAMac> create(WebPage*);
+    virtual ~LayerTreeHostCAMac();
+
+private:
+    explicit LayerTreeHostCAMac(WebPage*);
+
+    // LayerTreeHost.
+    virtual void scheduleLayerFlush();
+    virtual void invalidate();
+    virtual void sizeDidChange(const WebCore::IntSize& newSize);
+    virtual void forceRepaint();
+    virtual void pauseRendering();
+    virtual void resumeRendering();
+
+    // LayerTreeHostCA
+    virtual void platformInitialize(LayerTreeContext&);
+    virtual void didPerformScheduledLayerFlush();
+
+    static void flushPendingLayerChangesRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void*);
+
+    RetainPtr<WKCARemoteLayerClientRef> m_remoteLayerClient;
+    RetainPtr<CFRunLoopObserverRef> m_flushPendingLayerChangesRunLoopObserver;
+};
+
+} // namespace WebKit
+
+#endif // LayerTreeHostCAMac_h
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm
index 50776d7..69cfa44 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/ca/mac/LayerTreeHostCAMac.mm
@@ -24,32 +24,50 @@
  */
 
 #import "config.h"
-#import "LayerTreeHostCA.h"
+#import "LayerTreeHostCAMac.h"
 
 #import "WebProcess.h"
 #import <QuartzCore/CATransaction.h>
 #import <WebCore/GraphicsLayer.h>
 #import <WebKitSystemInterface.h>
 
+using namespace WebCore;
+
 @interface CATransaction (Details)
 + (void)synchronize;
 @end
 
 namespace WebKit {
 
-void LayerTreeHostCA::platformInitialize()
+PassRefPtr<LayerTreeHostCAMac> LayerTreeHostCAMac::create(WebPage* webPage)
+{
+    RefPtr<LayerTreeHostCAMac> host = adoptRef(new LayerTreeHostCAMac(webPage));
+    host->initialize();
+    return host.release();
+}
+
+LayerTreeHostCAMac::LayerTreeHostCAMac(WebPage* webPage)
+    : LayerTreeHostCA(webPage)
+{
+}
+
+LayerTreeHostCAMac::~LayerTreeHostCAMac()
+{
+    ASSERT(!m_flushPendingLayerChangesRunLoopObserver);
+    ASSERT(!m_remoteLayerClient);
+}
+
+void LayerTreeHostCAMac::platformInitialize(LayerTreeContext& layerTreeContext)
 {
     mach_port_t serverPort = WebProcess::shared().compositingRenderServerPort();
     m_remoteLayerClient = WKCARemoteLayerClientMakeWithServerPort(serverPort);
 
-    [m_rootLayer->platformLayer() setGeometryFlipped:YES];
+    WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), rootLayer()->platformLayer());
 
-    WKCARemoteLayerClientSetLayer(m_remoteLayerClient.get(), m_rootLayer->platformLayer());
-
-    m_layerTreeContext.contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
+    layerTreeContext.contextID = WKCARemoteLayerClientGetClientId(m_remoteLayerClient.get());
 }
 
-void LayerTreeHostCA::scheduleLayerFlush()
+void LayerTreeHostCAMac::scheduleLayerFlush()
 {
     CFRunLoopRef currentRunLoop = CFRunLoopGetCurrent();
     
@@ -67,7 +85,7 @@ void LayerTreeHostCA::scheduleLayerFlush()
     CFRunLoopAddObserver(currentRunLoop, m_flushPendingLayerChangesRunLoopObserver.get(), kCFRunLoopCommonModes);
 }
 
-void LayerTreeHostCA::platformInvalidate()
+void LayerTreeHostCAMac::invalidate()
 {
     if (m_flushPendingLayerChangesRunLoopObserver) {
         CFRunLoopObserverInvalidate(m_flushPendingLayerChangesRunLoopObserver.get());
@@ -76,34 +94,54 @@ void LayerTreeHostCA::platformInvalidate()
 
     WKCARemoteLayerClientInvalidate(m_remoteLayerClient.get());
     m_remoteLayerClient = nullptr;
+
+    LayerTreeHostCA::invalidate();
 }
 
-void LayerTreeHostCA::platformSizeDidChange()
+void LayerTreeHostCAMac::sizeDidChange(const IntSize& newSize)
 {
+    LayerTreeHostCA::sizeDidChange(newSize);
     [CATransaction flush];
     [CATransaction synchronize];
 }
 
-void LayerTreeHostCA::platformForceRepaint()
+void LayerTreeHostCAMac::forceRepaint()
 {
+    LayerTreeHostCA::forceRepaint();
     [CATransaction flush];
     [CATransaction synchronize];
-}    
+}
+
+void LayerTreeHostCAMac::pauseRendering()
+{
+    CALayer* root = rootLayer()->platformLayer();
+    [root setValue:(id)kCFBooleanTrue forKey:@"NSCAViewRenderPaused"];
+    [[NSNotificationCenter defaultCenter] postNotificationName:@"NSCAViewRenderDidPauseNotification" object:nil userInfo:[NSDictionary dictionaryWithObject:root forKey:@"layer"]];
+}
 
-void LayerTreeHostCA::flushPendingLayerChangesRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void* context)
+void LayerTreeHostCAMac::resumeRendering()
+{
+    CALayer* root = rootLayer()->platformLayer();
+    [root setValue:(id)kCFBooleanFalse forKey:@"NSCAViewRenderPaused"];
+    [[NSNotificationCenter defaultCenter] postNotificationName:@"NSCAViewRenderDidResumeNotification" object:nil userInfo:[NSDictionary dictionaryWithObject:root forKey:@"layer"]];
+}
+
+void LayerTreeHostCAMac::flushPendingLayerChangesRunLoopObserverCallback(CFRunLoopObserverRef, CFRunLoopActivity, void* context)
 {
     // This gets called outside of the normal event loop so wrap in an autorelease pool
     NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
-    static_cast<LayerTreeHostCA*>(context)->performScheduledLayerFlush();
+    static_cast<LayerTreeHostCAMac*>(context)->performScheduledLayerFlush();
     [pool drain];
 }
 
-void LayerTreeHostCA::platformDidPerformScheduledLayerFlush()
+void LayerTreeHostCAMac::didPerformScheduledLayerFlush()
 {
     // We successfully flushed the pending layer changes, remove the run loop observer.
     ASSERT(m_flushPendingLayerChangesRunLoopObserver);
     CFRunLoopObserverInvalidate(m_flushPendingLayerChangesRunLoopObserver.get());
     m_flushPendingLayerChangesRunLoopObserver = 0;
+
+    LayerTreeHostCA::didPerformScheduledLayerFlush();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp b/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp
index 81db03e..699a1fe 100644
--- a/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.cpp
@@ -24,46 +24,276 @@
  */
 
 #include "config.h"
-#include "LayerTreeHostCA.h"
+#include "LayerTreeHostCAWin.h"
 
-#include <WebCore/NotImplemented.h>
+#if HAVE(WKQCA)
+
+#include "DrawingAreaImpl.h"
+#include "ShareableBitmap.h"
+#include "UpdateInfo.h"
+#include "WebPage.h"
+#include <WebCore/GraphicsLayerCA.h>
+#include <WebCore/LayerChangesFlusher.h>
+#include <WebCore/PlatformCALayer.h>
+#include <WebCore/WebCoreInstanceHandle.h>
+#include <WebKitQuartzCoreAdditions/WKCACFImage.h>
+#include <WebKitQuartzCoreAdditions/WKCACFView.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/Threading.h>
+
+#ifdef DEBUG_ALL
+#pragma comment(lib, "WebKitQuartzCoreAdditions_debug")
+#else
+#pragma comment(lib, "WebKitQuartzCoreAdditions")
+#endif
+
+using namespace WebCore;
 
 namespace WebKit {
 
-void LayerTreeHostCA::platformInitialize()
+static HWND dummyWindow;
+static LPCWSTR dummyWindowClass = L"LayerTreeHostCAWindowClass";
+static size_t validLayerTreeHostCount;
+
+static void registerDummyWindowClass()
+{
+    static bool didRegister;
+    if (didRegister)
+        return;
+    didRegister = true;
+
+    WNDCLASSW wndClass = {0};
+    wndClass.lpszClassName = dummyWindowClass;
+    wndClass.lpfnWndProc = ::DefWindowProcW;
+    wndClass.hInstance = instanceHandle();
+
+    ::RegisterClassW(&wndClass);
+}
+
+// This window is never shown. It is only needed so that D3D can determine the display mode, etc.
+static HWND createDummyWindow()
 {
-    // FIXME: <http://webkit.org/b/45567> Implement this!
-    notImplemented();
+    registerDummyWindowClass();
+    return ::CreateWindowW(dummyWindowClass, 0, WS_POPUP, 0, 0, 10, 10, 0, 0, instanceHandle(), 0);
 }
 
-void LayerTreeHostCA::scheduleLayerFlush()
+bool LayerTreeHostCAWin::supportsAcceleratedCompositing()
 {
-    // FIXME: <http://webkit.org/b/45567> Implement this!
-    notImplemented();
+    static bool initialized;
+    static bool supportsAcceleratedCompositing;
+    if (initialized)
+        return supportsAcceleratedCompositing;
+    initialized = true;
+
+    ASSERT(!dummyWindow);
+    dummyWindow = createDummyWindow();
+    RetainPtr<WKCACFViewRef> view(AdoptCF, WKCACFViewCreate(kWKCACFViewDrawingDestinationImage));
+    CGRect fakeBounds = CGRectMake(0, 0, 10, 10);
+    WKCACFViewUpdate(view.get(), dummyWindow, &fakeBounds);
+
+    supportsAcceleratedCompositing = WKCACFViewCanDraw(view.get());
+
+    WKCACFViewUpdate(view.get(), 0, 0);
+    ::DestroyWindow(dummyWindow);
+    dummyWindow = 0;
+
+    return supportsAcceleratedCompositing;
 }
 
-void LayerTreeHostCA::platformInvalidate()
+PassRefPtr<LayerTreeHostCAWin> LayerTreeHostCAWin::create(WebPage* webPage)
 {
-    // FIXME: <http://webkit.org/b/45567> Implement this!
-    notImplemented();
+    RefPtr<LayerTreeHostCAWin> host = adoptRef(new LayerTreeHostCAWin(webPage));
+    host->initialize();
+    return host.release();
 }
 
-void LayerTreeHostCA::platformSizeDidChange()
+LayerTreeHostCAWin::LayerTreeHostCAWin(WebPage* webPage)
+    : LayerTreeHostCA(webPage)
+    , m_isFlushingLayerChanges(false)
+    , m_nextDisplayTime(0)
 {
-    // FIXME: <http://webkit.org/b/45567> Implement this!
-    notImplemented();
 }
 
-void LayerTreeHostCA::platformForceRepaint()
+LayerTreeHostCAWin::~LayerTreeHostCAWin()
 {
-    // FIXME: <http://webkit.org/b/45567> Implement this!
-    notImplemented();
 }
 
-void LayerTreeHostCA::platformDidPerformScheduledLayerFlush()
+void LayerTreeHostCAWin::platformInitialize(LayerTreeContext&)
 {
-    // FIXME: <http://webkit.org/b/45567> Implement this!
-    notImplemented();
+    ++validLayerTreeHostCount;
+    if (!dummyWindow)
+        dummyWindow = createDummyWindow();
+
+    m_view.adoptCF(WKCACFViewCreate(kWKCACFViewDrawingDestinationImage));
+    WKCACFViewSetContextUserData(m_view.get(), static_cast<AbstractCACFLayerTreeHost*>(this));
+    WKCACFViewSetLayer(m_view.get(), rootLayer()->platformLayer());
+    WKCACFViewSetContextDidChangeCallback(m_view.get(), contextDidChangeCallback, this);
+
+    CGRect bounds = m_webPage->bounds();
+    WKCACFViewUpdate(m_view.get(), dummyWindow, &bounds);
+}
+
+void LayerTreeHostCAWin::invalidate()
+{
+    LayerChangesFlusher::shared().cancelPendingFlush(this);
+
+    WKCACFViewUpdate(m_view.get(), 0, 0);
+    WKCACFViewSetContextUserData(m_view.get(), 0);
+    WKCACFViewSetLayer(m_view.get(), 0);
+    WKCACFViewSetContextDidChangeCallback(m_view.get(), 0, 0);
+
+    LayerTreeHostCA::invalidate();
+
+    if (--validLayerTreeHostCount)
+        return;
+    ::DestroyWindow(dummyWindow);
+    dummyWindow = 0;
+}
+
+void LayerTreeHostCAWin::scheduleLayerFlush()
+{
+    LayerChangesFlusher::shared().flushPendingLayerChangesSoon(this);
+}
+
+bool LayerTreeHostCAWin::participatesInDisplay()
+{
+    return true;
+}
+
+bool LayerTreeHostCAWin::needsDisplay()
+{
+    return timeUntilNextDisplay() <= 0;
+}
+
+double LayerTreeHostCAWin::timeUntilNextDisplay()
+{
+    return m_nextDisplayTime - currentTime();
+}
+
+static IntSize size(WKCACFImageRef image)
+{
+    return IntSize(WKCACFImageGetWidth(image), WKCACFImageGetHeight(image));
+}
+
+static PassRefPtr<ShareableBitmap> toShareableBitmap(WKCACFImageRef image)
+{
+    size_t fileMappingSize;
+    HANDLE mapping = WKCACFImageCopyFileMapping(image, &fileMappingSize);
+    if (!mapping)
+        return 0;
+
+    RefPtr<SharedMemory> sharedMemory = SharedMemory::adopt(mapping, fileMappingSize, SharedMemory::ReadWrite);
+    if (!sharedMemory) {
+        ::CloseHandle(mapping);
+        return 0;
+    }
+
+    // WKCACFImage never has an alpha channel.
+    return ShareableBitmap::create(size(image), 0, sharedMemory.release());
+}
+
+void LayerTreeHostCAWin::display(UpdateInfo& updateInfo)
+{
+    CGPoint imageOrigin;
+    CFTimeInterval nextDrawTime;
+    RetainPtr<WKCACFImageRef> image(AdoptCF, WKCACFViewCopyDrawnImage(m_view.get(), &imageOrigin, &nextDrawTime));
+    m_nextDisplayTime = nextDrawTime - CACurrentMediaTime() + currentTime();
+    if (!image)
+        return;
+    RefPtr<ShareableBitmap> bitmap = toShareableBitmap(image.get());
+    if (!bitmap)
+        return;
+    if (!bitmap->createHandle(updateInfo.bitmapHandle))
+        return;
+    updateInfo.updateRectBounds = IntRect(IntPoint(imageOrigin.x, m_webPage->size().height() - imageOrigin.y - bitmap->size().height()), bitmap->size());
+    updateInfo.updateRects.append(updateInfo.updateRectBounds);
+}
+
+void LayerTreeHostCAWin::sizeDidChange(const IntSize& newSize)
+{
+    LayerTreeHostCA::sizeDidChange(newSize);
+    CGRect bounds = CGRectMake(0, 0, newSize.width(), newSize.height());
+    WKCACFViewUpdate(m_view.get(), dummyWindow, &bounds);
+    WKCACFViewFlushContext(m_view.get());
+}
+
+void LayerTreeHostCAWin::forceRepaint()
+{
+    LayerTreeHostCA::forceRepaint();
+    WKCACFViewFlushContext(m_view.get());
+}
+
+void LayerTreeHostCAWin::contextDidChangeCallback(WKCACFViewRef view, void* info)
+{
+    // This should only be called on a background thread when no changes have actually 
+    // been committed to the context, eg. when a video frame has been added to an image
+    // queue, so return without triggering animations etc.
+    if (!isMainThread())
+        return;
+    
+    LayerTreeHostCAWin* host = static_cast<LayerTreeHostCAWin*>(info);
+    ASSERT_ARG(view, view == host->m_view);
+    host->contextDidChange();
+}
+
+void LayerTreeHostCAWin::contextDidChange()
+{
+    // Send currentTime to the pending animations. This function is called by CACF in a callback
+    // which occurs after the drawInContext calls. So currentTime is very close to the time
+    // the animations actually start
+    double currentTime = WTF::currentTime();
+
+    HashSet<RefPtr<PlatformCALayer> >::iterator end = m_pendingAnimatedLayers.end();
+    for (HashSet<RefPtr<PlatformCALayer> >::iterator it = m_pendingAnimatedLayers.begin(); it != end; ++it)
+        (*it)->animationStarted(currentTime);
+
+    m_pendingAnimatedLayers.clear();
+
+    m_nextDisplayTime = 0;
+    static_cast<DrawingAreaImpl*>(m_webPage->drawingArea())->setLayerHostNeedsDisplay();
+}
+
+PlatformCALayer* LayerTreeHostCAWin::rootLayer() const
+{
+    return static_cast<GraphicsLayerCA*>(LayerTreeHostCA::rootLayer())->platformCALayer();
+}
+
+void LayerTreeHostCAWin::addPendingAnimatedLayer(PassRefPtr<PlatformCALayer> layer)
+{
+    m_pendingAnimatedLayers.add(layer);
+}
+
+void LayerTreeHostCAWin::layerTreeDidChange()
+{
+    if (m_isFlushingLayerChanges) {
+        // The layer tree is changing as a result of flushing GraphicsLayer changes to their
+        // underlying PlatformCALayers. We'll flush those changes to the context as part of that
+        // process, so there's no need to schedule another flush here.
+        return;
+    }
+
+    // The layer tree is changing as a result of someone modifying a PlatformCALayer that doesn't
+    // have a corresponding GraphicsLayer. Schedule a flush since we won't schedule one through the
+    // normal GraphicsLayer mechanisms.
+    LayerChangesFlusher::shared().flushPendingLayerChangesSoon(this);
+}
+
+void LayerTreeHostCAWin::flushPendingLayerChangesNow()
+{
+    RefPtr<LayerTreeHostCA> protector(this);
+
+    m_isFlushingLayerChanges = true;
+
+    // Flush changes stored up in GraphicsLayers to their underlying PlatformCALayers, if
+    // requested.
+    performScheduledLayerFlush();
+
+    // Flush changes stored up in PlatformCALayers to the context so they will be rendered.
+    WKCACFViewFlushContext(m_view.get());
+
+    m_isFlushingLayerChanges = false;
 }
 
 } // namespace WebKit
+
+#endif // HAVE(WKQCA)
diff --git a/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.h b/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.h
new file mode 100644
index 0000000..2232b08
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/ca/win/LayerTreeHostCAWin.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LayerTreeHostCAWin_h
+#define LayerTreeHostCAWin_h
+
+#include "HeaderDetection.h"
+
+#if HAVE(WKQCA)
+
+#include "LayerTreeHostCA.h"
+#include <WebCore/AbstractCACFLayerTreeHost.h>
+#include <wtf/HashSet.h>
+#include <wtf/RetainPtr.h>
+
+typedef struct _WKCACFView* WKCACFViewRef;
+
+namespace WebKit {
+
+class LayerTreeHostCAWin : public LayerTreeHostCA, private WebCore::AbstractCACFLayerTreeHost {
+public:
+    static bool supportsAcceleratedCompositing();
+
+    static PassRefPtr<LayerTreeHostCAWin> create(WebPage*);
+    virtual ~LayerTreeHostCAWin();
+
+private:
+    explicit LayerTreeHostCAWin(WebPage*);
+
+    static void contextDidChangeCallback(WKCACFViewRef, void* info);
+    void contextDidChange();
+
+    // LayerTreeHost
+    virtual void invalidate();
+    virtual void forceRepaint();
+    virtual void sizeDidChange(const WebCore::IntSize& newSize);
+    virtual void scheduleLayerFlush();
+    virtual bool participatesInDisplay();
+    virtual bool needsDisplay();
+    virtual double timeUntilNextDisplay();
+    virtual void display(UpdateInfo&);
+
+    // LayerTreeHostCA
+    virtual void platformInitialize(LayerTreeContext&);
+
+    // AbstractCACFLayerTreeHost
+    virtual WebCore::PlatformCALayer* rootLayer() const;
+    virtual void addPendingAnimatedLayer(PassRefPtr<WebCore::PlatformCALayer>);
+    virtual void layerTreeDidChange();
+    virtual void flushPendingLayerChangesNow();
+
+    RetainPtr<WKCACFViewRef> m_view;
+    HashSet<RefPtr<WebCore::PlatformCALayer> > m_pendingAnimatedLayers;
+    bool m_isFlushingLayerChanges;
+    double m_nextDisplayTime;
+};
+
+} // namespace WebKit
+
+#endif // HAVE(WKQCA)
+
+#endif // LayerTreeHostCAWin_h
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/WebPageGtk.cpp b/Source/WebKit2/WebProcess/WebPage/gtk/WebPageGtk.cpp
new file mode 100644
index 0000000..57c9977
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/WebPageGtk.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Portions Copyright (c) 2010 Motorola Mobility, Inc.  All rights reserved.
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebPage.h"
+
+#include "NotImplemented.h"
+#include "WebEvent.h"
+#include "WindowsKeyboardCodes.h"
+#include <WebCore/FocusController.h>
+#include <WebCore/Frame.h>
+#include <WebCore/KeyboardEvent.h>
+#include <WebCore/Page.h>
+#include <WebCore/PlatformKeyboardEvent.h>
+#include <WebCore/Settings.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebPage::platformInitialize()
+{
+    notImplemented();
+}
+
+void WebPage::platformPreferencesDidChange(const WebPreferencesStore&)
+{
+    notImplemented();
+}
+
+static inline void scroll(Page* page, ScrollDirection direction, ScrollGranularity granularity)
+{
+    page->focusController()->focusedOrMainFrame()->eventHandler()->scrollRecursively(direction, granularity);
+}
+
+bool WebPage::performDefaultBehaviorForKeyEvent(const WebKeyboardEvent& keyboardEvent)
+{
+    if (keyboardEvent.type() != WebEvent::KeyDown && keyboardEvent.type() != WebEvent::RawKeyDown)
+        return false;
+
+    switch (keyboardEvent.windowsVirtualKeyCode()) {
+    case VK_BACK:
+        if (keyboardEvent.shiftKey())
+            m_page->goForward();
+        else
+            m_page->goBack();
+        break;
+    case VK_SPACE:
+        scroll(m_page.get(), keyboardEvent.shiftKey() ? ScrollUp : ScrollDown, ScrollByPage);
+        break;
+    case VK_LEFT:
+        scroll(m_page.get(), ScrollLeft, ScrollByLine);
+        break;
+    case VK_RIGHT:
+        scroll(m_page.get(), ScrollRight, ScrollByLine);
+        break;
+    case VK_UP:
+        scroll(m_page.get(), ScrollUp, ScrollByLine);
+        break;
+    case VK_DOWN:
+        scroll(m_page.get(), ScrollDown, ScrollByLine);
+        break;
+    case VK_HOME:
+        scroll(m_page.get(), ScrollUp, ScrollByDocument);
+        break;
+    case VK_END:
+        scroll(m_page.get(), ScrollDown, ScrollByDocument);
+        break;
+    case VK_PRIOR:
+        scroll(m_page.get(), ScrollUp, ScrollByPage);
+        break;
+    case VK_NEXT:
+        scroll(m_page.get(), ScrollDown, ScrollByPage);
+        break;
+    default:
+        return false;
+    }
+
+    return true;
+}
+
+bool WebPage::platformHasLocalDataForURL(const WebCore::KURL&)
+{
+    // FIXME: Implement
+    notImplemented();
+    return false;
+}
+
+String WebPage::cachedResponseMIMETypeForURL(const WebCore::KURL&)
+{
+    // FIXME: Implement
+    return String();
+}
+
+bool WebPage::platformCanHandleRequest(const WebCore::ResourceRequest&)
+{
+    // FIXME: Implement
+    return true;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
index 8d81889..d7b352c 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
@@ -27,10 +27,13 @@
 #import "WebPage.h"
 
 #import "AccessibilityWebPageObject.h"
+#import "AttributedString.h"
 #import "DataReference.h"
+#import "EditorState.h"
 #import "PluginView.h"
 #import "WebCoreArgumentCoders.h"
 #import "WebEvent.h"
+#import "WebEventConversion.h"
 #import "WebFrame.h"
 #import "WebPageProxyMessages.h"
 #import "WebProcess.h"
@@ -39,6 +42,7 @@
 #import <WebCore/Frame.h>
 #import <WebCore/FrameView.h>
 #import <WebCore/HitTestResult.h>
+#import <WebCore/HTMLConverter.h>
 #import <WebCore/KeyboardEvent.h>
 #import <WebCore/Page.h>
 #import <WebCore/PlatformKeyboardEvent.h>
@@ -53,6 +57,8 @@ using namespace WebCore;
 
 namespace WebKit {
 
+static PassRefPtr<Range> convertToRange(Frame*, NSRange);
+
 void WebPage::platformInitialize()
 {
     m_page->addSchedulePair(SchedulePair::create([NSRunLoop currentRunLoop], kCFRunLoopCommonModes));
@@ -77,68 +83,131 @@ void WebPage::platformPreferencesDidChange(const WebPreferencesStore&)
 {
 }
 
-bool WebPage::interceptEditingKeyboardEvent(KeyboardEvent* evt, bool shouldSaveCommand)
+typedef HashMap<String, String> SelectorNameMap;
+
+// Map selectors into Editor command names.
+// This is not needed for any selectors that have the same name as the Editor command.
+static const SelectorNameMap* createSelectorExceptionMap()
+{
+    SelectorNameMap* map = new HashMap<String, String>;
+
+    map->add("insertNewlineIgnoringFieldEditor:", "InsertNewline");
+    map->add("insertParagraphSeparator:", "InsertNewline");
+    map->add("insertTabIgnoringFieldEditor:", "InsertTab");
+    map->add("pageDown:", "MovePageDown");
+    map->add("pageDownAndModifySelection:", "MovePageDownAndModifySelection");
+    map->add("pageUp:", "MovePageUp");
+    map->add("pageUpAndModifySelection:", "MovePageUpAndModifySelection");
+
+    return map;
+}
+
+static String commandNameForSelectorName(const String& selectorName)
+{
+    // Check the exception map first.
+    static const SelectorNameMap* exceptionMap = createSelectorExceptionMap();
+    SelectorNameMap::const_iterator it = exceptionMap->find(selectorName);
+    if (it != exceptionMap->end())
+        return it->second;
+
+    // Remove the trailing colon.
+    // No need to capitalize the command name since Editor command names are not case sensitive.
+    size_t selectorNameLength = selectorName.length();
+    if (selectorNameLength < 2 || selectorName[selectorNameLength - 1] != ':')
+        return String();
+    return selectorName.left(selectorNameLength - 1);
+}
+
+static Frame* frameForEvent(KeyboardEvent* event)
 {
-    Node* node = evt->target()->toNode();
+    Node* node = event->target()->toNode();
     ASSERT(node);
     Frame* frame = node->document()->frame();
     ASSERT(frame);
+    return frame;
+}
+
+bool WebPage::executeKeypressCommandsInternal(const Vector<WebCore::KeypressCommand>& commands, KeyboardEvent* event)
+{
+    Frame* frame = frameForEvent(event);
+    ASSERT(frame->page() == corePage());
+
+    bool eventWasHandled = false;
+    for (size_t i = 0; i < commands.size(); ++i) {
+        if (commands[i].commandName == "insertText:") {
+            ASSERT(!frame->editor()->hasComposition());
+
+            if (!frame->editor()->canEdit())
+                continue;
+
+            // An insertText: might be handled by other responders in the chain if we don't handle it.
+            // One example is space bar that results in scrolling down the page.
+            eventWasHandled |= frame->editor()->insertText(commands[i].text, event);
+        } else {
+            Editor::Command command = frame->editor()->command(commandNameForSelectorName(commands[i].commandName));
+            if (command.isSupported()) {
+                bool commandExecutedByEditor = command.execute(event);
+                eventWasHandled |= commandExecutedByEditor;
+                if (!commandExecutedByEditor) {
+                    bool performedNonEditingBehavior = event->keyEvent()->type() == PlatformKeyboardEvent::RawKeyDown && performNonEditingBehaviorForSelector(commands[i].commandName);
+                    eventWasHandled |= performedNonEditingBehavior;
+                }
+            } else {
+                bool commandWasHandledByUIProcess = false;
+                WebProcess::shared().connection()->sendSync(Messages::WebPageProxy::ExecuteSavedCommandBySelector(commands[i].commandName), 
+                    Messages::WebPageProxy::ExecuteSavedCommandBySelector::Reply(commandWasHandledByUIProcess), m_pageID);
+                eventWasHandled |= commandWasHandledByUIProcess;
+            }
+        }
+    }
+    return eventWasHandled;
+}
+
+bool WebPage::handleEditingKeyboardEvent(KeyboardEvent* event, bool saveCommands)
+{
+    ASSERT(!saveCommands || event->keypressCommands().isEmpty()); // Save commands once for each event.
+
+    Frame* frame = frameForEvent(event);
     
-    const PlatformKeyboardEvent* keyEvent = evt->keyEvent();
-    if (!keyEvent)
+    const PlatformKeyboardEvent* platformEvent = event->keyEvent();
+    if (!platformEvent)
         return false;
-    const Vector<KeypressCommand>& commands = evt->keypressCommands();
-    bool hasKeypressCommand = !commands.isEmpty();
-    
+    Vector<KeypressCommand>& commands = event->keypressCommands();
+
+    if ([platformEvent->macEvent() type] == NSFlagsChanged)
+        return false;
+
     bool eventWasHandled = false;
     
-    if (shouldSaveCommand || !hasKeypressCommand) {
-        Vector<KeypressCommand> commandsList;  
-        Vector<CompositionUnderline> underlines;
-        unsigned start;
-        unsigned end;
-        if (!WebProcess::shared().connection()->sendSync(Messages::WebPageProxy::InterpretKeyEvent(keyEvent->type()), 
-                                                         Messages::WebPageProxy::InterpretKeyEvent::Reply(commandsList, start, end, underlines),
-                                                         m_pageID, CoreIPC::Connection::NoTimeout))
+    if (saveCommands) {
+        KeyboardEvent* oldEvent = m_keyboardEventBeingInterpreted;
+        m_keyboardEventBeingInterpreted = event;
+        bool sendResult = WebProcess::shared().connection()->sendSync(Messages::WebPageProxy::InterpretQueuedKeyEvent(editorState()), 
+            Messages::WebPageProxy::InterpretQueuedKeyEvent::Reply(eventWasHandled, commands), m_pageID);
+        m_keyboardEventBeingInterpreted = oldEvent;
+        if (!sendResult)
+            return false;
+
+        // An input method may make several actions per keypress. For example, pressing Return with Korean IM both confirms it and sends a newline.
+        // IM-like actions are handled immediately (so the return value from UI process is true), but there are saved commands that
+        // should be handled like normal text input after DOM event dispatch.
+        if (!event->keypressCommands().isEmpty())
             return false;
-        if (commandsList.isEmpty())
-            return eventWasHandled;
-        
-        if (commandsList[0].commandName == "setMarkedText") {
-            frame->editor()->setComposition(commandsList[0].text, underlines, start, end);
-            eventWasHandled = true;
-        } else if (commandsList[0].commandName == "insertText" && frame->editor()->hasComposition()) {
-            frame->editor()->confirmComposition(commandsList[0].text);
-            eventWasHandled = true;
-        } else if (commandsList[0].commandName == "unmarkText") {
-            frame->editor()->confirmComposition();
-            eventWasHandled = true;
-        } else {
-            for (size_t i = 0; i < commandsList.size(); i++)
-                evt->keypressCommands().append(commandsList[i]);
-        }
     } else {
-        size_t size = commands.size();
-        // Are there commands that would just cause text insertion if executed via Editor?
+        // Are there commands that could just cause text insertion if executed via Editor?
         // WebKit doesn't have enough information about mode to decide how they should be treated, so we leave it upon WebCore
         // to either handle them immediately (e.g. Tab that changes focus) or let a keypress event be generated
         // (e.g. Tab that inserts a Tab character, or Enter).
         bool haveTextInsertionCommands = false;
-        for (size_t i = 0; i < size; ++i) {
-            if (frame->editor()->command(commands[i].commandName).isTextInsertion())
+        for (size_t i = 0; i < commands.size(); ++i) {
+            if (frame->editor()->command(commandNameForSelectorName(commands[i].commandName)).isTextInsertion())
                 haveTextInsertionCommands = true;
         }
-        if (!haveTextInsertionCommands || keyEvent->type() == PlatformKeyboardEvent::Char) {
-            for (size_t i = 0; i < size; ++i) {
-                if (commands[i].commandName == "insertText") {
-                    // Don't insert null or control characters as they can result in unexpected behaviour
-                    if (evt->charCode() < ' ')
-                        return false;
-                    eventWasHandled = frame->editor()->insertText(commands[i].text, evt);
-                } else
-                    if (frame->editor()->command(commands[i].commandName).isSupported())
-                        eventWasHandled = frame->editor()->command(commands[i].commandName).execute(evt);
-            }
+        // If there are no text insertion commands, default keydown handler is the right time to execute the commands.
+        // Keypress (Char event) handler is the latest opportunity to execute.
+        if (!haveTextInsertionCommands || platformEvent->type() == PlatformKeyboardEvent::Char) {
+            eventWasHandled = executeKeypressCommandsInternal(event->keypressCommands(), event);
+            event->keypressCommands().clear();
         }
     }
     return eventWasHandled;
@@ -152,6 +221,54 @@ void WebPage::sendComplexTextInputToPlugin(uint64_t pluginComplexTextInputIdenti
     }
 }
 
+void WebPage::setComposition(const String& text, Vector<CompositionUnderline> underlines, uint64_t selectionStart, uint64_t selectionEnd, uint64_t replacementRangeStart, uint64_t replacementRangeEnd, EditorState& newState)
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+
+    if (frame->selection()->isContentEditable()) {
+        RefPtr<Range> replacementRange;
+        if (replacementRangeStart != NSNotFound) {
+            replacementRange = convertToRange(frame, NSMakeRange(replacementRangeStart, replacementRangeEnd - replacementRangeStart));
+            frame->selection()->setSelection(VisibleSelection(replacementRange.get(), SEL_DEFAULT_AFFINITY));
+        }
+
+        frame->editor()->setComposition(text, underlines, selectionStart, selectionEnd);
+    }
+
+    newState = editorState();
+}
+
+void WebPage::confirmComposition(EditorState& newState)
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+
+    frame->editor()->confirmComposition();
+
+    newState = editorState();
+}
+
+void WebPage::insertText(const String& text, uint64_t replacementRangeStart, uint64_t replacementRangeEnd, bool& handled, EditorState& newState)
+{
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+
+    RefPtr<Range> replacementRange;
+    if (replacementRangeStart != NSNotFound) {
+        replacementRange = convertToRange(frame, NSMakeRange(replacementRangeStart, replacementRangeEnd - replacementRangeStart));
+        frame->selection()->setSelection(VisibleSelection(replacementRange.get(), SEL_DEFAULT_AFFINITY));
+    }
+
+    if (!frame->editor()->hasComposition()) {
+        // An insertText: might be handled by other responders in the chain if we don't handle it.
+        // One example is space bar that results in scrolling down the page.
+        handled = frame->editor()->insertText(text, m_keyboardEventBeingInterpreted);
+    } else {
+        handled = true;
+        frame->editor()->confirmComposition(text);
+    }
+
+    newState = editorState();
+}
+
 void WebPage::getMarkedRange(uint64_t& location, uint64_t& length)
 {
     location = NSNotFound;
@@ -159,38 +276,59 @@ void WebPage::getMarkedRange(uint64_t& location, uint64_t& length)
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
     if (!frame)
         return;
-    
-    getLocationAndLengthFromRange(frame->editor()->compositionRange().get(), location, length);
-}
 
+    RefPtr<Range> range = frame->editor()->compositionRange();
+    size_t locationSize;
+    size_t lengthSize;
+    if (range && TextIterator::locationAndLengthFromRange(range.get(), locationSize, lengthSize)) {
+        location = static_cast<uint64_t>(locationSize);
+        length = static_cast<uint64_t>(lengthSize);
+    }
+}
 
-static PassRefPtr<Range> characterRangeAtPositionForPoint(Frame* frame, const VisiblePosition& position, const IntPoint& point)
+void WebPage::getSelectedRange(uint64_t& location, uint64_t& length)
 {
-    if (position.isNull())
-        return 0;
+    location = NSNotFound;
+    length = 0;
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return;
 
-    VisiblePosition previous = position.previous();
-    if (previous.isNotNull()) {
-        RefPtr<Range> previousCharacterRange = makeRange(previous, position);
-        IntRect rect = frame->editor()->firstRectForRange(previousCharacterRange.get());
-        if (rect.contains(point))
-            return previousCharacterRange.release();
-    }
-    
-    VisiblePosition next = position.next();
-    if (next.isNotNull()) {
-        RefPtr<Range> nextCharacterRange = makeRange(position, next);
-        IntRect rect = frame->editor()->firstRectForRange(nextCharacterRange.get());
-        if (rect.contains(point))
-            return nextCharacterRange.release();
+    size_t locationSize;
+    size_t lengthSize;
+    RefPtr<Range> range = frame->selection()->toNormalizedRange();
+    if (range && TextIterator::locationAndLengthFromRange(range.get(), locationSize, lengthSize)) {
+        location = static_cast<uint64_t>(locationSize);
+        length = static_cast<uint64_t>(lengthSize);
     }
-    
-    return 0;
 }
 
-static PassRefPtr<Range> characterRangeAtPoint(Frame* frame, const IntPoint& point)
+void WebPage::getAttributedSubstringFromRange(uint64_t location, uint64_t length, AttributedString& result)
 {
-    return characterRangeAtPositionForPoint(frame, frame->visiblePositionForPoint(point), point);
+    NSRange nsRange = NSMakeRange(location, length - location);
+
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return;
+
+    if (frame->selection()->isNone() || !frame->selection()->isContentEditable() || frame->selection()->isInPasswordField())
+        return;
+
+    RefPtr<Range> range = convertToRange(frame, nsRange);
+    if (!range)
+        return;
+
+    result.string = [WebHTMLConverter editingAttributedStringFromRange:range.get()];
+    NSAttributedString* attributedString = result.string.get();
+    
+    // [WebHTMLConverter editingAttributedStringFromRange:] insists on inserting a trailing 
+    // whitespace at the end of the string which breaks the ATOK input method.  <rdar://problem/5400551>
+    // To work around this we truncate the resultant string to the correct length.
+    if ([attributedString length] > nsRange.length) {
+        ASSERT([attributedString length] == nsRange.length + 1);
+        ASSERT([[attributedString string] characterAtIndex:nsRange.length] == '\n' || [[attributedString string] characterAtIndex:nsRange.length] == ' ');
+        result.string = [attributedString attributedSubstringFromRange:NSMakeRange(0, nsRange.length)];
+    }
 }
 
 void WebPage::characterIndexForPoint(IntPoint point, uint64_t& index)
@@ -203,15 +341,17 @@ void WebPage::characterIndexForPoint(IntPoint point, uint64_t& index)
     HitTestResult result = frame->eventHandler()->hitTestResultAtPoint(point, false);
     frame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : m_page->focusController()->focusedOrMainFrame();
     
-    RefPtr<Range> range = characterRangeAtPoint(frame, result.point());
+    RefPtr<Range> range = frame->rangeForPoint(result.point());
     if (!range)
         return;
 
-    uint64_t length;
-    getLocationAndLengthFromRange(range.get(), index, length);
+    size_t location;
+    size_t length;
+    if (TextIterator::locationAndLengthFromRange(range.get(), location, length))
+        index = static_cast<uint64_t>(location);
 }
 
-static PassRefPtr<Range> convertToRange(Frame* frame, NSRange nsrange)
+PassRefPtr<Range> convertToRange(Frame* frame, NSRange nsrange)
 {
     if (nsrange.location > INT_MAX)
         return 0;
@@ -246,6 +386,12 @@ void WebPage::firstRectForCharacterRange(uint64_t location, uint64_t length, Web
     resultRect = frame->view()->contentsToWindow(rect);
 }
 
+void WebPage::executeKeypressCommands(const Vector<WebCore::KeypressCommand>& commands, bool& handled, EditorState& newState)
+{
+    handled = executeKeypressCommandsInternal(commands, m_keyboardEventBeingInterpreted);
+    newState = editorState();
+}
+
 static bool isPositionInRange(const VisiblePosition& position, Range* range)
 {
     RefPtr<Range> positionRange = makeRange(position, position);
@@ -284,12 +430,12 @@ void WebPage::performDictionaryLookupAtLocation(const FloatPoint& floatPoint)
     frame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : m_page->focusController()->focusedOrMainFrame();
 
     IntPoint translatedPoint = frame->view()->windowToContents(point);
-    VisiblePosition position = frame->visiblePositionForPoint(translatedPoint);
 
     // Don't do anything if there is no character at the point.
-    if (!characterRangeAtPositionForPoint(frame, position, translatedPoint))
+    if (!frame->rangeForPoint(translatedPoint))
         return;
 
+    VisiblePosition position = frame->visiblePositionForPoint(translatedPoint);
     VisibleSelection selection = m_page->focusController()->focusedOrMainFrame()->selection()->selection();
     if (shouldUseSelection(position, selection)) {
         performDictionaryLookupForSelection(DictionaryPopupInfo::HotKey, frame, selection);
@@ -378,96 +524,54 @@ void WebPage::performDictionaryLookupForRange(DictionaryPopupInfo::Type type, Fr
     dictionaryPopupInfo.type = type;
     dictionaryPopupInfo.origin = FloatPoint(rangeRect.x(), rangeRect.y());
     dictionaryPopupInfo.fontInfo.fontAttributeDictionary = fontDescriptorAttributes;
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     dictionaryPopupInfo.options = (CFDictionaryRef)options;
+#endif
 
     send(Messages::WebPageProxy::DidPerformDictionaryLookup(rangeText, dictionaryPopupInfo));
 }
 
-bool WebPage::performDefaultBehaviorForKeyEvent(const WebKeyboardEvent& keyboardEvent)
+bool WebPage::performNonEditingBehaviorForSelector(const String& selector)
 {
-    if (keyboardEvent.type() != WebEvent::KeyDown)
-        return false;
-
-    // FIXME: This should be in WebCore.
-
-    switch (keyboardEvent.windowsVirtualKeyCode()) {
-    case VK_BACK:
-        if (keyboardEvent.shiftKey())
-            m_page->goForward();
-        else
-            m_page->goBack();
-        break;
-    case VK_SPACE:
-        if (keyboardEvent.shiftKey())
-            logicalScroll(m_page.get(), ScrollBlockDirectionBackward, ScrollByPage);
-        else
-            logicalScroll(m_page.get(), ScrollBlockDirectionForward, ScrollByPage);
-        break;
-    case VK_PRIOR:
-        logicalScroll(m_page.get(), ScrollBlockDirectionBackward, ScrollByPage);
-        break;
-    case VK_NEXT:
-        logicalScroll(m_page.get(), ScrollBlockDirectionForward, ScrollByPage);
-        break;
-    case VK_HOME:
-        logicalScroll(m_page.get(), ScrollBlockDirectionBackward, ScrollByDocument);
-        break;
-    case VK_END:
-        logicalScroll(m_page.get(), ScrollBlockDirectionForward, ScrollByDocument);
-        break;
-    case VK_UP:
-        if (keyboardEvent.shiftKey())
-            return false;
-        if (keyboardEvent.metaKey()) {
-            scroll(m_page.get(), ScrollUp, ScrollByDocument);
-            scroll(m_page.get(), ScrollLeft, ScrollByDocument);
-        } else if (keyboardEvent.altKey() || keyboardEvent.controlKey())
-            scroll(m_page.get(), ScrollUp, ScrollByPage);
-        else
-            scroll(m_page.get(), ScrollUp, ScrollByLine);
-        break;
-    case VK_DOWN:
-        if (keyboardEvent.shiftKey())
-            return false;
-        if (keyboardEvent.metaKey()) {
-            scroll(m_page.get(), ScrollDown, ScrollByDocument);
-            scroll(m_page.get(), ScrollLeft, ScrollByDocument);
-        } else if (keyboardEvent.altKey() || keyboardEvent.controlKey())
-            scroll(m_page.get(), ScrollDown, ScrollByPage);
-        else
-            scroll(m_page.get(), ScrollDown, ScrollByLine);
-        break;
-    case VK_LEFT:
-        if (keyboardEvent.shiftKey())
-            return false;
-        if (keyboardEvent.metaKey())
-            m_page->goBack();
-        else {
-            if (keyboardEvent.altKey() || keyboardEvent.controlKey())
-                scroll(m_page.get(), ScrollLeft, ScrollByPage);
-            else
-                scroll(m_page.get(), ScrollLeft, ScrollByLine);
-        }
-        break;
-    case VK_RIGHT:
-        if (keyboardEvent.shiftKey())
-            return false;
-        if (keyboardEvent.metaKey())
-            m_page->goForward();
-        else {
-            if (keyboardEvent.altKey() || keyboardEvent.controlKey())
-                scroll(m_page.get(), ScrollRight, ScrollByPage);
-            else
-                scroll(m_page.get(), ScrollRight, ScrollByLine);
-        }
-        break;
-    default:
+    // FIXME: All these selectors have corresponding Editor commands, but the commands only work in editable content.
+    // Should such non-editing behaviors be implemented in Editor or EventHandler::defaultArrowEventHandler() perhaps?
+    if (selector == "moveUp:")
+        scroll(m_page.get(), ScrollUp, ScrollByLine);
+    else if (selector == "moveToBeginningOfParagraph:")
+        scroll(m_page.get(), ScrollUp, ScrollByPage);
+    else if (selector == "moveToBeginningOfDocument:") {
+        scroll(m_page.get(), ScrollUp, ScrollByDocument);
+        scroll(m_page.get(), ScrollLeft, ScrollByDocument);
+    } else if (selector == "moveDown:")
+        scroll(m_page.get(), ScrollDown, ScrollByLine);
+    else if (selector == "moveToEndOfParagraph:")
+        scroll(m_page.get(), ScrollDown, ScrollByPage);
+    else if (selector == "moveToEndOfDocument:") {
+        scroll(m_page.get(), ScrollDown, ScrollByDocument);
+        scroll(m_page.get(), ScrollLeft, ScrollByDocument);
+    } else if (selector == "moveLeft:")
+        scroll(m_page.get(), ScrollLeft, ScrollByLine);
+    else if (selector == "moveWordLeft:")
+        scroll(m_page.get(), ScrollLeft, ScrollByPage);
+    else if (selector == "moveToLeftEndOfLine:")
+        m_page->goBack();
+    else if (selector == "moveRight:")
+        scroll(m_page.get(), ScrollRight, ScrollByLine);
+    else if (selector == "moveWordRight:")
+        scroll(m_page.get(), ScrollRight, ScrollByPage);
+    else if (selector == "moveToRightEndOfLine:")
+        m_page->goForward();
+    else
         return false;
-    }
 
     return true;
 }
 
+bool WebPage::performDefaultBehaviorForKeyEvent(const WebKeyboardEvent&)
+{
+    return false;
+}
+
 void WebPage::registerUIProcessAccessibilityTokens(const CoreIPC::DataReference& elementToken, const CoreIPC::DataReference& windowToken)
 {
 #if !defined(BUILDING_ON_SNOW_LEOPARD)
@@ -484,6 +588,10 @@ void WebPage::registerUIProcessAccessibilityTokens(const CoreIPC::DataReference&
 void WebPage::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes, bool& result)
 {
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame || frame->selection()->isNone()) {
+        result = false;
+        return;
+    }
     frame->editor()->writeSelectionToPasteboard(pasteboardName, pasteboardTypes);
     result = true;
 }
@@ -491,6 +599,10 @@ void WebPage::writeSelectionToPasteboard(const String& pasteboardName, const Vec
 void WebPage::readSelectionFromPasteboard(const String& pasteboardName, bool& result)
 {
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame || frame->selection()->isNone()) {
+        result = false;
+        return;
+    }
     frame->editor()->readSelectionFromPasteboard(pasteboardName);
     result = true;
 }
@@ -548,10 +660,39 @@ void WebPage::setDragSource(NSObject *dragSource)
 
 void WebPage::platformDragEnded()
 {
+    // The draggedImage method releases its responder; we retain here to balance that.
+    [m_dragSource.get() retain];
     // The drag source we care about here is NSFilePromiseDragSource, which doesn't look at
     // the arguments. It's OK to just pass arbitrary constant values, so we just pass all zeroes.
     [m_dragSource.get() draggedImage:nil endedAt:NSZeroPoint operation:NSDragOperationNone];
     m_dragSource = nullptr;
 }
 
+void WebPage::shouldDelayWindowOrderingEvent(const WebKit::WebMouseEvent& event, bool& result)
+{
+    result = false;
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return;
+
+    HitTestResult hitResult = frame->eventHandler()->hitTestResultAtPoint(event.position(), true);
+    if (hitResult.isSelected())
+        result = frame->eventHandler()->eventMayStartDrag(platform(event));
+}
+
+void WebPage::acceptsFirstMouse(int eventNumber, const WebKit::WebMouseEvent& event, bool& result)
+{
+    result = false;
+    Frame* frame = m_page->focusController()->focusedOrMainFrame();
+    if (!frame)
+        return;
+    
+    HitTestResult hitResult = frame->eventHandler()->hitTestResultAtPoint(event.position(), true);
+    frame->eventHandler()->setActivationEventNumber(eventNumber);
+    if (hitResult.isSelected())
+        result = frame->eventHandler()->eventMayStartDrag(platform(event));
+    else 
+        result = !!hitResult.scrollbar();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/win/LayerTreeHostWin.cpp b/Source/WebKit2/WebProcess/WebPage/win/LayerTreeHostWin.cpp
new file mode 100644
index 0000000..57c04bb
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebPage/win/LayerTreeHostWin.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LayerTreeHost.h"
+
+#if USE(CA)
+#include "LayerTreeHostCAWin.h"
+#endif
+
+namespace WebKit {
+
+bool LayerTreeHost::supportsAcceleratedCompositing()
+{
+#if USE(CA) && HAVE(WKQCA)
+    return LayerTreeHostCAWin::supportsAcceleratedCompositing();
+#else
+    return false;
+#endif
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
index 41bb219..9c7206a 100644
--- a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
@@ -28,17 +28,22 @@
 
 #include "FontSmoothingLevel.h"
 #include "WebEvent.h"
+#include "WebPageProxyMessages.h"
 #include "WebPreferencesStore.h"
 #include <WebCore/FocusController.h>
 #include <WebCore/FontRenderingMode.h>
 #include <WebCore/Frame.h>
 #include <WebCore/FrameView.h>
+#include <WebCore/HitTestRequest.h>
+#include <WebCore/HitTestResult.h>
 #include <WebCore/KeyboardEvent.h>
 #include <WebCore/Page.h>
 #include <WebCore/PlatformKeyboardEvent.h>
+#include <WebCore/RenderLayer.h>
+#include <WebCore/RenderView.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/Settings.h>
-#if PLATFORM(CG)
+#if USE(CG)
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
 #endif
 #include <WinUser.h>
@@ -62,7 +67,7 @@ void WebPage::platformPreferencesDidChange(const WebPreferencesStore& store)
 {
     FontSmoothingLevel fontSmoothingLevel = static_cast<FontSmoothingLevel>(store.getUInt32ValueForKey(WebPreferencesKey::fontSmoothingLevelKey()));
 
-#if PLATFORM(CG)
+#if USE(CG)
     FontSmoothingLevel adjustedLevel = fontSmoothingLevel;
     if (adjustedLevel == FontSmoothingLevelWindows)
         adjustedLevel = FontSmoothingLevelMedium;
@@ -351,4 +356,89 @@ void WebPage::getSelectedText(String& text)
     text = selectedRange->text();
 }
 
+void WebPage::gestureWillBegin(const WebCore::IntPoint& point, bool& canBeginPanning)
+{
+    m_gestureReachedScrollingLimit = false;
+
+    bool hitScrollbar = false;
+
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    for (Frame* childFrame = m_page->mainFrame(); childFrame; childFrame = EventHandler::subframeForTargetNode(m_gestureTargetNode.get())) {
+        ScrollView* scollView = childFrame->view();
+        if (!scollView)
+            break;
+        
+        RenderView* renderView = childFrame->document()->renderView();
+        if (!renderView)
+            break;
+
+        RenderLayer* layer = renderView->layer();
+        if (!layer)
+            break;
+
+        HitTestResult result = scollView->windowToContents(point);
+        layer->hitTest(request, result);
+        m_gestureTargetNode = result.innerNode();
+
+        if (!hitScrollbar)
+            hitScrollbar = result.scrollbar();
+    }
+
+    if (hitScrollbar) {
+        canBeginPanning = false;
+        return;
+    }
+
+    if (!m_gestureTargetNode) {
+        canBeginPanning = false;
+        return;
+    }
+
+    for (RenderObject* renderer = m_gestureTargetNode->renderer(); renderer; renderer = renderer->parent()) {
+        if (renderer->isBox() && toRenderBox(renderer)->canBeScrolledAndHasScrollableArea()) {
+            canBeginPanning = true;
+            return;
+        }
+    }
+
+    canBeginPanning = false;
+}
+
+static bool scrollbarAtTopOrBottomOfDocument(Scrollbar* scrollbar)
+{
+    ASSERT_ARG(scrollbar, scrollbar);
+    return !scrollbar->currentPos() || scrollbar->currentPos() >= scrollbar->maximum();
+}
+
+void WebPage::gestureDidScroll(const IntSize& size)
+{
+    ASSERT_ARG(size, !size.isZero());
+
+    if (!m_gestureTargetNode || !m_gestureTargetNode->renderer() || !m_gestureTargetNode->renderer()->enclosingLayer())
+        return;
+
+    Scrollbar* verticalScrollbar = 0;
+    if (Frame* frame = m_page->mainFrame()) {
+        if (ScrollView* view = frame->view())
+            verticalScrollbar = view->verticalScrollbar();
+    }
+
+    m_gestureTargetNode->renderer()->enclosingLayer()->scrollByRecursively(size.width(), size.height());
+    bool gestureReachedScrollingLimit = verticalScrollbar && scrollbarAtTopOrBottomOfDocument(verticalScrollbar);
+
+    // FIXME: We really only want to update this state if the state was updated via scrolling the main frame,
+    // not scrolling something in a main frame when the main frame had already reached its scrolling limit.
+
+    if (gestureReachedScrollingLimit == m_gestureReachedScrollingLimit)
+        return;
+
+    send(Messages::WebPageProxy::SetGestureReachedScrollingLimit(gestureReachedScrollingLimit));
+    m_gestureReachedScrollingLimit = gestureReachedScrollingLimit;
+}
+
+void WebPage::gestureDidEnd()
+{
+    m_gestureTargetNode = nullptr;
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index ba3290b..20bd6e3 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -59,6 +59,7 @@
 #include <WebCore/Logging.h>
 #include <WebCore/MemoryCache.h>
 #include <WebCore/Page.h>
+#include <WebCore/PageCache.h>
 #include <WebCore/PageGroup.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/SchemeRegistry.h>
@@ -69,7 +70,6 @@
 #include <wtf/RandomNumber.h>
 
 #ifndef NDEBUG
-#include <WebCore/MemoryCache.h>
 #include <WebCore/GCController.h>
 #endif
 
@@ -117,8 +117,11 @@ WebProcess& WebProcess::shared()
     return process;
 }
 
+static const double shutdownTimeout = 60;
+
 WebProcess::WebProcess()
-    : m_inDidClose(false)
+    : ChildProcess(shutdownTimeout)
+    , m_inDidClose(false)
     , m_hasSetCacheModel(false)
     , m_cacheModel(CacheModelDocumentViewer)
 #if USE(ACCELERATED_COMPOSITING) && PLATFORM(MAC)
@@ -145,6 +148,7 @@ void WebProcess::initialize(CoreIPC::Connection::Identifier serverIdentifier, Ru
 
     m_connection = CoreIPC::Connection::createClientConnection(serverIdentifier, this, runLoop);
     m_connection->setDidCloseOnConnectionWorkQueueCallback(didCloseOnConnectionWorkQueue);
+    m_connection->setShouldExitOnSyncMessageSendFailure(true);
 
     m_connection->open();
 
@@ -214,11 +218,6 @@ void WebProcess::initializeWebProcess(const WebProcessCreationParameters& parame
 
     for (size_t i = 0; i < parameters.mimeTypesWithCustomRepresentation.size(); ++i)
         m_mimeTypesWithCustomRepresentations.add(parameters.mimeTypesWithCustomRepresentation[i]);
-
-    if (parameters.clearResourceCaches)
-        clearResourceCaches();
-    if (parameters.clearApplicationCache)
-        clearApplicationCache();
     
 #if PLATFORM(MAC)
     m_presenterApplicationPid = parameters.presenterApplicationPid;
@@ -276,20 +275,28 @@ void WebProcess::setVisitedLinkTable(const SharedMemory::Handle& handle)
     m_visitedLinkTable.setSharedMemory(sharedMemory.release());
 }
 
-PageGroup* WebProcess::sharedPageGroup()
-{
-    return PageGroup::pageGroup("WebKit2Group");
-}
-
 void WebProcess::visitedLinkStateChanged(const Vector<WebCore::LinkHash>& linkHashes)
 {
-    for (size_t i = 0; i < linkHashes.size(); ++i)
-        Page::visitedStateChanged(sharedPageGroup(), linkHashes[i]);
+    // FIXME: We may want to track visited links per WebPageGroup rather than per WebContext.
+    for (size_t i = 0; i < linkHashes.size(); ++i) {
+        HashMap<uint64_t, RefPtr<WebPageGroupProxy> >::const_iterator it = m_pageGroupMap.begin();
+        HashMap<uint64_t, RefPtr<WebPageGroupProxy> >::const_iterator end = m_pageGroupMap.end();
+        for (; it != end; ++it)
+            Page::visitedStateChanged(PageGroup::pageGroup(it->second->identifier()), linkHashes[i]);
+    }
+
+    pageCache()->markPagesForVistedLinkStyleRecalc();
 }
 
 void WebProcess::allVisitedLinkStateChanged()
 {
-    Page::allVisitedStateChanged(sharedPageGroup());
+    // FIXME: We may want to track visited links per WebPageGroup rather than per WebContext.
+    HashMap<uint64_t, RefPtr<WebPageGroupProxy> >::const_iterator it = m_pageGroupMap.begin();
+    HashMap<uint64_t, RefPtr<WebPageGroupProxy> >::const_iterator end = m_pageGroupMap.end();
+    for (; it != end; ++it)
+        Page::allVisitedStateChanged(PageGroup::pageGroup(it->second->identifier()));
+
+    pageCache()->markPagesForVistedLinkStyleRecalc();
 }
 
 bool WebProcess::isLinkVisited(LinkHash linkHash) const
@@ -490,6 +497,9 @@ void WebProcess::createWebPage(uint64_t pageID, const WebPageCreationParameters&
     if (result.second) {
         ASSERT(!result.first->second);
         result.first->second = WebPage::create(pageID, parameters);
+
+        // Balanced by an enableTermination in removeWebPage.
+        disableTermination();
     }
 
     ASSERT(result.first->second);
@@ -497,8 +507,11 @@ void WebProcess::createWebPage(uint64_t pageID, const WebPageCreationParameters&
 
 void WebProcess::removeWebPage(uint64_t pageID)
 {
+    ASSERT(m_pageMap.contains(pageID));
+
     m_pageMap.remove(pageID);
-    terminateIfPossible();
+
+    enableTermination();
 }
 
 bool WebProcess::isSeparateProcess() const
@@ -507,29 +520,26 @@ bool WebProcess::isSeparateProcess() const
     return m_runLoop == RunLoop::main();
 }
  
-void WebProcess::terminateIfPossible()
+bool WebProcess::shouldTerminate()
 {
-    if (!m_pageMap.isEmpty())
-        return;
-
-    if (m_inDidClose)
-        return;
-
-    if (DownloadManager::shared().isDownloading())
-        return;
-
     // Keep running forever if we're running in the same process.
     if (!isSeparateProcess())
-        return;
+        return false;
+
+    ASSERT(m_pageMap.isEmpty());
+    ASSERT(!DownloadManager::shared().isDownloading());
 
     // FIXME: the ShouldTerminate message should also send termination parameters, such as any session cookies that need to be preserved.
     bool shouldTerminate = false;
     if (m_connection->sendSync(Messages::WebProcessProxy::ShouldTerminate(), Messages::WebProcessProxy::ShouldTerminate::Reply(shouldTerminate), 0)
         && !shouldTerminate)
-        return;
+        return false;
 
-    // Actually terminate the process.
+    return true;
+}
 
+void WebProcess::terminate()
+{
 #ifndef NDEBUG
     gcController().garbageCollectNow();
     memoryCache()->setDisabled(true);
@@ -656,11 +666,8 @@ void WebProcess::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::Message
     // we'll let it slide.
 }
 
-NO_RETURN void WebProcess::didFailToSendSyncMessage(CoreIPC::Connection*)
+void WebProcess::syncMessageSendTimedOut(CoreIPC::Connection*)
 {
-    // We were making a synchronous call to a UI process that doesn't exist any more.
-    // Callers are unlikely to be prepared for an error like this, so it's best to exit immediately.
-    exit(0);
 }
 
 WebFrame* WebProcess::webFrame(uint64_t frameID) const
@@ -702,10 +709,8 @@ WebPageGroupProxy* WebProcess::webPageGroup(const WebPageGroupData& pageGroupDat
     return result.first->second.get();
 }
 
-void WebProcess::clearResourceCaches(uint32_t cachesToClear)
+void WebProcess::clearResourceCaches(ResourceCachesToClear resourceCachesToClear)
 {
-    ResourceCachesToClear resourceCachesToClear = static_cast<ResourceCachesToClear>(cachesToClear);
-
     platformClearResourceCaches(resourceCachesToClear);
 
     // Toggling the cache model like this forces the cache to evict all its in-memory resources.
@@ -731,6 +736,8 @@ void WebProcess::clearApplicationCache()
 #if !ENABLE(PLUGIN_PROCESS)
 void WebProcess::getSitesWithPluginData(const Vector<String>& pluginPaths, uint64_t callbackID)
 {
+    LocalTerminationDisabler terminationDisabler(*this);
+
     HashSet<String> sitesSet;
 
     for (size_t i = 0; i < pluginPaths.size(); ++i) {
@@ -747,11 +754,12 @@ void WebProcess::getSitesWithPluginData(const Vector<String>& pluginPaths, uint6
     copyToVector(sitesSet, sites);
 
     m_connection->send(Messages::WebContext::DidGetSitesWithPluginData(sites, callbackID), 0);
-    terminateIfPossible();
 }
 
 void WebProcess::clearPluginSiteData(const Vector<String>& pluginPaths, const Vector<String>& sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID)
 {
+    LocalTerminationDisabler terminationDisabler(*this);
+
     for (size_t i = 0; i < pluginPaths.size(); ++i) {
         RefPtr<NetscapePluginModule> netscapePluginModule = NetscapePluginModule::getOrCreate(pluginPaths[i]);
         if (!netscapePluginModule)
@@ -768,7 +776,6 @@ void WebProcess::clearPluginSiteData(const Vector<String>& pluginPaths, const Ve
     }
 
     m_connection->send(Messages::WebContext::DidClearPluginSiteData(callbackID), 0);
-    terminateIfPossible();
 }
 #endif
 
@@ -805,7 +812,22 @@ void WebProcess::stopMemorySampler()
 
 void WebProcess::setTextCheckerState(const TextCheckerState& textCheckerState)
 {
+    bool continuousSpellCheckingTurnedOff = !textCheckerState.isContinuousSpellCheckingEnabled && m_textCheckerState.isContinuousSpellCheckingEnabled;
+    bool grammarCheckingTurnedOff = !textCheckerState.isGrammarCheckingEnabled && m_textCheckerState.isGrammarCheckingEnabled;
+
     m_textCheckerState = textCheckerState;
+
+    if (!continuousSpellCheckingTurnedOff && !grammarCheckingTurnedOff)
+        return;
+
+    HashMap<uint64_t, RefPtr<WebPage> >::iterator end = m_pageMap.end();
+    for (HashMap<uint64_t, RefPtr<WebPage> >::iterator it = m_pageMap.begin(); it != end; ++it) {
+        WebPage* page = (*it).second.get();
+        if (continuousSpellCheckingTurnedOff)
+            page->unmarkAllMisspellings();
+        if (grammarCheckingTurnedOff)
+            page->unmarkAllBadGrammar();
+    }
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebProcess.h b/Source/WebKit2/WebProcess/WebProcess.h
index d666910..e57fb3f 100644
--- a/Source/WebKit2/WebProcess/WebProcess.h
+++ b/Source/WebKit2/WebProcess/WebProcess.h
@@ -66,7 +66,7 @@ struct WebPageGroupData;
 struct WebPreferencesStore;
 struct WebProcessCreationParameters;
 
-class WebProcess : ChildProcess {
+class WebProcess : public ChildProcess {
 public:
     static WebProcess& shared();
 
@@ -99,7 +99,6 @@ public:
 
     WebPageGroupProxy* webPageGroup(uint64_t pageGroupID);
     WebPageGroupProxy* webPageGroup(const WebPageGroupData&);
-    static WebCore::PageGroup* sharedPageGroup();
 #if PLATFORM(MAC)
     pid_t presenterApplicationPid() const { return m_presenterApplicationPid; }
 #endif 
@@ -108,9 +107,6 @@ public:
     QNetworkAccessManager* networkAccessManager() { return m_networkAccessManager; }
 #endif
 
-    // Will terminate the web process if there are no live pages or downloads.
-    void terminateIfPossible();
-
     bool shouldUseCustomRepresentationForMIMEType(const String& mimeType) const { return m_mimeTypesWithCustomRepresentations.contains(mimeType); }
 
     // Text Checking
@@ -119,7 +115,7 @@ public:
     // Geolocation
     WebGeolocationManager& geolocationManager() { return m_geolocationManager; }
 
-    void clearResourceCaches(uint32_t cachesToClear = AllResourceCaches);
+    void clearResourceCaches(ResourceCachesToClear = AllResourceCaches);
     
     const String& localStorageDirectory() const { return m_localStorageDirectory; }
 
@@ -167,12 +163,20 @@ private:
 
     void setTextCheckerState(const TextCheckerState&);
 
+    // ChildProcess
+    virtual bool shouldTerminate();
+    virtual void terminate();
+
     // CoreIPC::Connection::Client
-    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
-    CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
-    void didClose(CoreIPC::Connection*);
-    void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
-    NO_RETURN void didFailToSendSyncMessage(CoreIPC::Connection*);
+    virtual void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    virtual CoreIPC::SyncReplyMode didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*);
+    virtual void didClose(CoreIPC::Connection*);
+    virtual void didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID);
+    virtual void syncMessageSendTimedOut(CoreIPC::Connection*);
+
+#if PLATFORM(WIN)
+    Vector<HWND> windowsToReceiveSentMessagesWhileWaitingForSyncReply();
+#endif
 
     // Implemented in generated WebProcessMessageReceiver.cpp
     void didReceiveWebProcessMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
diff --git a/Source/WebKit2/WebProcess/WebProcess.messages.in b/Source/WebKit2/WebProcess/WebProcess.messages.in
index 36155a7..f50c979 100644
--- a/Source/WebKit2/WebProcess/WebProcess.messages.in
+++ b/Source/WebKit2/WebProcess/WebProcess.messages.in
@@ -50,16 +50,13 @@ messages -> WebProcess {
     GetSitesWithPluginData(Vector<WTF::String> pluginPaths, uint64_t callbackID)
     ClearPluginSiteData(Vector<WTF::String> pluginPaths, Vector<WTF::String> sites, uint64_t flags, uint64_t maxAgeInSeconds, uint64_t callbackID)
 #endif
-
-    ClearResourceCaches(uint32_t cachesToClear);
-    ClearApplicationCache();
     
     void StartMemorySampler(WebKit::SandboxExtension::Handle sampleLogFileHandle, WTF::String sampleLogFilePath, double interval);
     void StopMemorySampler();
 
     # Downloads. This should really be in a Download.messages.in, but it seemed unnecessary to create a new file just for
     # two messages.
-    void DownloadRequest(uint64_t downloadID, uint64_t initiatingPageID, WebCore::ResourceRequest request)
+    DownloadRequest(uint64_t downloadID, uint64_t initiatingPageID, WebCore::ResourceRequest request)
     CancelDownload(uint64_t downloadID)
 
     SetTextCheckerState(WebKit::TextCheckerState textCheckerState)
diff --git a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
index fa81666..f4958d5 100644
--- a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
+++ b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
@@ -11,6 +11,7 @@
 ;; Read-only preferences and data
 (allow file-read*
     ;; Basic system paths
+    (subpath "/Library/Dictionaries")
     (subpath "/Library/Fonts")
     (subpath "/Library/Frameworks")
     (subpath "/Library/Keychains")
@@ -46,6 +47,28 @@
     ;; FIXME: This should be removed when <rdar://problem/8957845> is fixed.
     (subpath (string-append (param "HOME_DIR") "/Library/Fonts"))
 
+    ;; FIXME: These should be removed when <rdar://problem/9217757> is fixed.
+    (subpath (string-append (param "HOME_DIR") "/Library/Audio/Plug-Ins/Components"))
+    (subpath (string-append (param "HOME_DIR") "/Library/Preferences/QuickTime Preferences"))
+    (subpath "/Library/Audio/Plug-Ins/Components")
+    (subpath "/Library/Audio/Plug-Ins/HAL")
+    (subpath "/Library/Video/Plug-Ins")
+    (subpath "/Library/QuickTime")
+
+    ;; FIXME: This should be removed when <rdar://problem/9237619> is fixed.
+    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.universalaccess.plist"))
+
+    ;; FIXME: This should be removed when <rdar://problem/9276253> is fixed.
+    (subpath (string-append (param "HOME_DIR") "/Library/Keyboard Layouts"))
+
+    ;; FIXME: This should be removed when <rdar://problem/9276268> is fixed.
+    (subpath (string-append (param "HOME_DIR") "/Library/Input Methods"))
+
+    ;; FIXME: This should be removed when <rdar://problem/9276430> is fixed.
+    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"))
+
+    (subpath (string-append (param "HOME_DIR") "/Library/Dictionaries"))
+
     ;; Extensions from UIProcess
     (extension)
 )
@@ -61,6 +84,9 @@
     (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/com\.apple\.HIToolbox\."))
     (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.WebProcess\."))
     (subpath (string-append (param "HOME_DIR") "/Library/Keychains"))
+
+    ;; FIXME: This should be removed when <rdar://problem/9217757> is fixed.
+    (literal (string-append (param "HOME_DIR") "/Library/Caches/com.apple.coreaudio.components.plist"))
 )
 
 ;; Darwin temporary files and caches, if present
@@ -94,57 +120,45 @@
 
 ;; Various services required by AppKit and other frameworks
 (allow mach-lookup
-   (global-name "com.apple.CoreServices.coreservicesd")
-   (global-name "com.apple.DiskArbitration.diskarbitrationd")
-   (global-name "com.apple.FileCoordination")
-   (global-name "com.apple.FontObjectsServer")
-   (global-name "com.apple.FontServer")
-   (global-name "com.apple.SecurityServer")
-   (global-name "com.apple.SystemConfiguration.configd")
-   (global-name "com.apple.audio.VDCAssistant")
-   (global-name "com.apple.audio.audiohald")
-   (global-name "com.apple.audio.coreaudiod")
-   (global-name "com.apple.cookied")
-   (global-name "com.apple.cvmsServ")
-   (global-name "com.apple.dock.server")
-   (global-name "com.apple.ocspd")
-   (global-name "com.apple.pasteboard.1")
-   (global-name "com.apple.system.opendirectoryd.api")
-   (global-name "com.apple.window_proxies")
-   (global-name "com.apple.windowserver.active")
-   (global-name-regex #"^com\.apple\.WebKit\.WebProcess-")
-   (global-name-regex #"^com\.apple\.qtkitserver\.")
+    (global-name "com.apple.CoreServices.coreservicesd")
+    (global-name "com.apple.DiskArbitration.diskarbitrationd")
+    (global-name "com.apple.FileCoordination")
+    (global-name "com.apple.FontObjectsServer")
+    (global-name "com.apple.FontServer")
+    (global-name "com.apple.SecurityServer")
+    (global-name "com.apple.SystemConfiguration.configd")
+    (global-name "com.apple.audio.VDCAssistant")
+    (global-name "com.apple.audio.audiohald")
+    (global-name "com.apple.audio.coreaudiod")
+    (global-name "com.apple.cookied")
+    (global-name "com.apple.cvmsServ")
+    (global-name "com.apple.networkd")
+    (global-name "com.apple.dock.server")
+    (global-name "com.apple.ocspd")
+    (global-name "com.apple.pasteboard.1")
+    (global-name "com.apple.system.opendirectoryd.api")
+    (global-name "com.apple.window_proxies")
+    (global-name "com.apple.windowserver.active")
+    (global-name-regex #"^com\.apple\.WebKit\.WebProcess-")
+    (global-name-regex #"^com\.apple\.qtkitserver\.")
+
+    ;; FIXME: This should be removed when <rdar://problem/9276393> is fixed.
+    (global-name "com.apple.metadata.mds")
 )
 
-;; FIXME: These rules are required until <rdar://problem/8448410> is addressed. See <rdar://problem/8349882> for discussion.
+;; FIXME: <rdar://problem/9263428> These rules are required to avoid
+;; sandbox violation spam, but some narrower rule should be
+;; sufficient.
 (allow network-outbound)
 (deny network-outbound (regex ""))
 (deny network-outbound (local ip))
+
 (allow network-outbound
    ;; Local mDNSResponder for DNS, arbitrary outbound TCP
    (literal "/private/var/run/mDNSResponder")
    (remote tcp)
 )
 
-;; FIXME: These rules are required until plug-ins are moved out of the web process.
-(allow file-read*
-   (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/com\.apple\.ist\."))
-   (literal (string-append (param "HOME_DIR") "/Library/Preferences/edu.mit.Kerberos"))
-   (literal "/Library/Preferences/edu.mit.Kerberos")
-)
-
-(allow mach-lookup
-   (global-name "org.h5l.kcm")
-   (global-name "com.apple.tsm.uiserver")
-   (global-name-regex #"^com\.apple\.ist")
-)
-
-(allow network-outbound (remote ip))
-
-;; These rules are required while QTKitServer is being launched directly via posix_spawn (<rdar://problem/6912494>).
-(allow process-fork)
-(allow process-exec (literal "/System/Library/Frameworks/QTKit.framework/Versions/A/Resources/QTKitServer") (with no-sandbox))
-
 ;; FIXME: Once <rdar://problem/8900275> has been fixed, these rules can be removed.
 (allow mach-lookup (global-name "com.apple.pubsub.ipc"))
 (allow network-outbound (regex #"^/private/tmp/launch-[^/]+/Render"))
diff --git a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
index 88ef834..4c23daf 100644
--- a/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
+++ b/Source/WebKit2/WebProcess/mac/WebProcessMac.mm
@@ -30,6 +30,7 @@
 #import "SandboxExtension.h"
 #import "WebPage.h"
 #import "WebProcessCreationParameters.h"
+#import <WebCore/FileSystem.h>
 #import <WebCore/MemoryCache.h>
 #import <WebCore/PageCache.h>
 #import <WebKitSystemInterface.h>
@@ -122,7 +123,7 @@ bool WebProcess::fullKeyboardAccessEnabled()
 }
 
 #if ENABLE(WEB_PROCESS_SANDBOX)
-static void appendSandboxParameterPath(Vector<const char*>& vector, const char* name, const char* path)
+static void appendSandboxParameterPathInternal(Vector<const char*>& vector, const char* name, const char* path)
 {
     char normalizedPath[PATH_MAX];
     if (!realpath(path, normalizedPath))
@@ -132,14 +133,31 @@ static void appendSandboxParameterPath(Vector<const char*>& vector, const char*
     vector.append(fastStrDup(normalizedPath));
 }
 
-static void appendSandboxParameterConfPath(Vector<const char*>& vector, const char* name, int confID)
+static void appendReadwriteConfDirectory(Vector<const char*>& vector, const char* name, int confID)
 {
     char path[PATH_MAX];
     if (confstr(confID, path, PATH_MAX) <= 0)
         path[0] = '\0';
 
-    appendSandboxParameterPath(vector, name, path);
+    appendSandboxParameterPathInternal(vector, name, path);
 }
+
+static void appendReadonlySandboxDirectory(Vector<const char*>& vector, const char* name, NSString *path)
+{
+    appendSandboxParameterPathInternal(vector, name, [(NSString *)path fileSystemRepresentation]);
+}
+
+static void appendReadwriteSandboxDirectory(Vector<const char*>& vector, const char* name, NSString *path)
+{
+    NSError *error = nil;
+
+    // This is very unlikely to fail, but in case it actually happens, we'd like some sort of output in the console.
+    if (![[NSFileManager defaultManager] createDirectoryAtPath:path withIntermediateDirectories:YES attributes:nil error:&error])
+        NSLog(@"could not create \"%@\", error %@", path, error);
+
+    appendSandboxParameterPathInternal(vector, name, [(NSString *)path fileSystemRepresentation]);
+}
+
 #endif
 
 static void initializeSandbox(const WebProcessCreationParameters& parameters)
@@ -152,14 +170,20 @@ static void initializeSandbox(const WebProcessCreationParameters& parameters)
 
     Vector<const char*> sandboxParameters;
 
-    appendSandboxParameterPath(sandboxParameters, "HOME_DIR", [NSHomeDirectory() fileSystemRepresentation]);
-    appendSandboxParameterPath(sandboxParameters, "WEBKIT2_FRAMEWORK_DIR", [[[[NSBundle bundleForClass:NSClassFromString(@"WKView")] bundlePath] stringByDeletingLastPathComponent] fileSystemRepresentation]);
-    appendSandboxParameterConfPath(sandboxParameters, "DARWIN_USER_TEMP_DIR", _CS_DARWIN_USER_TEMP_DIR);
-    appendSandboxParameterConfPath(sandboxParameters, "DARWIN_USER_CACHE_DIR", _CS_DARWIN_USER_CACHE_DIR);
-    appendSandboxParameterPath(sandboxParameters, "WEBKIT_DATABASE_DIR", [(NSString *)parameters.databaseDirectory fileSystemRepresentation]);
-    appendSandboxParameterPath(sandboxParameters, "WEBKIT_LOCALSTORAGE_DIR", [(NSString *)parameters.localStorageDirectory fileSystemRepresentation]);
-    appendSandboxParameterPath(sandboxParameters, "NSURL_CACHE_DIR", parameters.nsURLCachePath.data());
-    appendSandboxParameterPath(sandboxParameters, "UI_PROCESS_BUNDLE_RESOURCE_DIR", parameters.uiProcessBundleResourcePath.data());
+    // These are read-only.
+    appendReadonlySandboxDirectory(sandboxParameters, "WEBKIT2_FRAMEWORK_DIR", [[[NSBundle bundleForClass:NSClassFromString(@"WKView")] bundlePath] stringByDeletingLastPathComponent]);
+    appendReadonlySandboxDirectory(sandboxParameters, "UI_PROCESS_BUNDLE_RESOURCE_DIR", parameters.uiProcessBundleResourcePath);
+
+    // These are read-write getconf paths.
+    appendReadwriteConfDirectory(sandboxParameters, "DARWIN_USER_TEMP_DIR", _CS_DARWIN_USER_TEMP_DIR);
+    appendReadwriteConfDirectory(sandboxParameters, "DARWIN_USER_CACHE_DIR", _CS_DARWIN_USER_CACHE_DIR);
+
+    // These are read-write paths.
+    appendReadwriteSandboxDirectory(sandboxParameters, "HOME_DIR", NSHomeDirectory());
+    appendReadwriteSandboxDirectory(sandboxParameters, "WEBKIT_DATABASE_DIR", parameters.databaseDirectory);
+    appendReadwriteSandboxDirectory(sandboxParameters, "WEBKIT_LOCALSTORAGE_DIR", parameters.localStorageDirectory);
+    appendReadwriteSandboxDirectory(sandboxParameters, "NSURL_CACHE_DIR", parameters.nsURLCachePath);
+
     sandboxParameters.append(static_cast<const char*>(0));
 
     const char* profilePath = [[[NSBundle mainBundle] pathForResource:@"com.apple.WebProcess" ofType:@"sb"] fileSystemRepresentation];
@@ -193,7 +217,7 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
     initializeSandbox(parameters);
 
     if (!parameters.parentProcessName.isNull()) {
-        NSString *applicationName = [NSString stringWithFormat:UI_STRING("%@ Web Content", "Visible name of the web process. The argument is the application name."), (NSString *)parameters.parentProcessName];
+        NSString *applicationName = [NSString stringWithFormat:WEB_UI_STRING("%@ Web Content", "Visible name of the web process. The argument is the application name."), (NSString *)parameters.parentProcessName];
         WKSetVisibleApplicationName((CFStringRef)applicationName);
     }
 
@@ -201,8 +225,7 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
         NSUInteger cacheMemoryCapacity = parameters.nsURLCacheMemoryCapacity;
         NSUInteger cacheDiskCapacity = parameters.nsURLCacheDiskCapacity;
 
-        NSString *nsCachePath = [[NSFileManager defaultManager] stringWithFileSystemRepresentation:parameters.nsURLCachePath.data() length:strlen(parameters.nsURLCachePath.data())];
-        RetainPtr<NSURLCache> parentProcessURLCache(AdoptNS, [[NSURLCache alloc] initWithMemoryCapacity:cacheMemoryCapacity diskCapacity:cacheDiskCapacity diskPath:nsCachePath]);
+        RetainPtr<NSURLCache> parentProcessURLCache(AdoptNS, [[NSURLCache alloc] initWithMemoryCapacity:cacheMemoryCapacity diskCapacity:cacheDiskCapacity diskPath:parameters.nsURLCachePath]);
         [NSURLCache setSharedURLCache:parentProcessURLCache.get()];
     }
 
diff --git a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
index d56fef6..d9a4af5 100644
--- a/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
+++ b/Source/WebKit2/WebProcess/win/WebProcessWin.cpp
@@ -27,6 +27,7 @@
 #include "WebProcess.h"
 
 #include "WebCookieManager.h"
+#include "WebPage.h"
 #include "WebProcessCreationParameters.h"
 #include <WebCore/FileSystem.h>
 #include <WebCore/MemoryCache.h>
@@ -137,4 +138,49 @@ void WebProcess::setShouldPaintNativeControls(bool shouldPaintNativeControls)
 #endif
 }
 
+struct EnumWindowsContext {
+    DWORD currentThreadID;
+    Vector<HWND>* windows;
+};
+
+static BOOL CALLBACK addWindowToVectorIfOwnedByCurrentThread(HWND window, LPARAM lParam)
+{
+    EnumWindowsContext* context = reinterpret_cast<EnumWindowsContext*>(lParam);
+
+    if (::GetWindowThreadProcessId(window, 0) != context->currentThreadID)
+        return TRUE;
+
+    context->windows->append(window);
+    return TRUE;
+}
+
+Vector<HWND> WebProcess::windowsToReceiveSentMessagesWhileWaitingForSyncReply()
+{
+    Vector<HWND> windows;
+
+    // Any non-message-only window created by this thread needs to receive sent messages while we
+    // wait for a sync reply. Otherwise we could deadlock with the UI process if, e.g., the focus
+    // window changes. See <http://webkit.org/b/58239>.
+
+    EnumWindowsContext context;
+    context.currentThreadID = ::GetCurrentThreadId();
+    context.windows = &windows;
+
+    // Start out with top-level windows created by this thread (like Flash's hidden
+    // SWFlash_PlaceholderX top-level windows).
+    ::EnumThreadWindows(context.currentThreadID, addWindowToVectorIfOwnedByCurrentThread, reinterpret_cast<LPARAM>(&context));
+
+    // Also include any descendants of those top-level windows.
+    size_t topLevelWindowCount = windows.size();
+    for (size_t i = 0; i < topLevelWindowCount; ++i)
+        ::EnumChildWindows(windows[i], addWindowToVectorIfOwnedByCurrentThread, reinterpret_cast<LPARAM>(&context));
+
+    // Also include any descendants of the WebPages' windows which we've created (e.g., for windowed plugins).
+    HashMap<uint64_t, RefPtr<WebPage> >::const_iterator::Values end = m_pageMap.end();
+    for (HashMap<uint64_t, RefPtr<WebPage> >::const_iterator::Values it = m_pageMap.begin(); it != end; ++it)
+        ::EnumChildWindows((*it)->nativeWindow(), addWindowToVectorIfOwnedByCurrentThread, reinterpret_cast<LPARAM>(&context));
+
+    return windows;
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/config.h b/Source/WebKit2/config.h
index 3723185..8250891 100644
--- a/Source/WebKit2/config.h
+++ b/Source/WebKit2/config.h
@@ -125,7 +125,7 @@ static const type& name() \
 #include <WebCore/config.h>
 #include <windows.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include <CoreGraphics/CoreGraphics.h>
 #endif
 
@@ -141,12 +141,14 @@ static const type& name() \
 
 #endif
 
-#if PLATFORM(MAC) || (OS(MAC_OS_X) && PLATFORM(QT))
+#if PLATFORM(MAC)
 #define PLUGIN_ARCHITECTURE_MAC 1
-#elif PLATFORM(WIN) || (OS(WINDOWS) && PLATFORM(QT))
+#elif PLATFORM(WIN)
 #define PLUGIN_ARCHITECTURE_WIN 1
-#elif (PLATFORM(QT) && defined(Q_WS_X11)) || (PLATFORM(GTK) && OS(UNIX) && !OS(MAC_OS_X))
+#elif (PLATFORM(QT) || (PLATFORM(GTK))) && (OS(UNIX) && !OS(MAC_OS_X) && !OS(SYMBIAN))
 #define PLUGIN_ARCHITECTURE_X11 1
+#else
+#define PLUGIN_ARCHITECTURE_UNSUPPORTED 1
 #endif
 
 #define PLUGIN_ARCHITECTURE(ARCH) (defined PLUGIN_ARCHITECTURE_##ARCH && PLUGIN_ARCHITECTURE_##ARCH)
diff --git a/Source/WebKit2/win/WebKit2.vcproj b/Source/WebKit2/win/WebKit2.vcproj
index 5e4ffa8..cf8ee60 100755
--- a/Source/WebKit2/win/WebKit2.vcproj
+++ b/Source/WebKit2/win/WebKit2.vcproj
@@ -431,6 +431,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\Shared\EditorState.h"
+				>
+			</File>
+			<File
 				RelativePath="..\Shared\FontInfo.cpp"
 				>
 			</File>
@@ -483,6 +487,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\Shared\NativeWebMouseEvent.h"
+				>
+			</File>
+			<File
 				RelativePath="..\Shared\OriginAndDatabases.cpp"
 				>
 			</File>
@@ -523,10 +531,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\Shared\SelectionState.h"
-				>
-			</File>
-			<File
 				RelativePath="..\Shared\SessionState.cpp"
 				>
 			</File>
@@ -1145,10 +1149,6 @@
 					RelativePath="..\Shared\CoreIPCSupport\WebPageProxyMessageKinds.h"
 					>
 				</File>
-				<File
-					RelativePath="..\Shared\CoreIPCSupport\WebProcessProxyMessageKinds.h"
-					>
-				</File>
 			</Filter>
 			<Filter
 				Name="cf"
@@ -1194,6 +1194,64 @@
 					>
 				</File>
 				<File
+					RelativePath="..\Shared\win\NativeWebMouseEventWin.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+							ObjectFile="$(IntDir)\$(InputName)1.obj"
+							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+							ObjectFile="$(IntDir)\$(InputName)1.obj"
+							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+							ObjectFile="$(IntDir)\$(InputName)1.obj"
+							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+							ObjectFile="$(IntDir)\$(InputName)1.obj"
+							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+							ObjectFile="$(IntDir)\$(InputName)1.obj"
+							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+							ObjectFile="$(IntDir)\$(InputName)1.obj"
+							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
 					RelativePath="..\Shared\win\PlatformCertificateInfo.cpp"
 					>
 				</File>
@@ -1905,6 +1963,10 @@
 						>
 					</File>
 					<File
+						RelativePath="..\WebProcess\WebPage\win\LayerTreeHostWin.cpp"
+						>
+					</File>
+					<File
 						RelativePath="..\WebProcess\WebPage\win\WebInspectorWin.cpp"
 						>
 					</File>
@@ -1963,6 +2025,10 @@
 								/>
 							</FileConfiguration>
 						</File>
+						<File
+							RelativePath="..\WebProcess\WebPage\ca\win\LayerTreeHostCAWin.h"
+							>
+						</File>
 					</Filter>
 				</Filter>
 			</Filter>
@@ -2767,6 +2833,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\UIProcess\WebIconDatabaseClient.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\UIProcess\WebIconDatabaseClient.h"
+				>
+			</File>
+			<File
 				RelativePath="..\UIProcess\WebInspectorProxy.cpp"
 				>
 			</File>
@@ -3236,6 +3310,22 @@
 							>
 						</File>
 						<File
+							RelativePath="..\UIProcess\API\C\win\WKGrammarDetail.cpp"
+							>
+						</File>
+						<File
+							RelativePath="..\UIProcess\API\C\win\WKGrammarDetail.h"
+							>
+						</File>
+						<File
+							RelativePath="..\UIProcess\API\C\win\WKTextChecker.cpp"
+							>
+						</File>
+						<File
+							RelativePath="..\UIProcess\API\C\win\WKTextChecker.h"
+							>
+						</File>
+						<File
 							RelativePath="..\UIProcess\API\C\win\WKView.cpp"
 							>
 						</File>
@@ -3390,6 +3480,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\UIProcess\win\WebGrammarDetail.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\UIProcess\win\WebGrammarDetail.h"
+					>
+				</File>
+				<File
 					RelativePath="..\UIProcess\win\WebInspectorProxyWin.cpp"
 					>
 				</File>
@@ -3406,6 +3504,26 @@
 					>
 				</File>
 				<File
+					RelativePath="..\UIProcess\win\WebProcessProxyWin.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\UIProcess\win\WebTextChecker.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\UIProcess\win\WebTextChecker.h"
+					>
+				</File>
+				<File
+					RelativePath="..\UIProcess\win\WebTextCheckerClient.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\UIProcess\win\WebTextCheckerClient.h"
+					>
+				</File>
+				<File
 					RelativePath="..\UIProcess\win\WebUndoClient.cpp"
 					>
 				</File>
diff --git a/Source/WebKit2/win/WebKit2Apple.vsprops b/Source/WebKit2/win/WebKit2Apple.vsprops
index 68d01ac..2a45d65 100644
--- a/Source/WebKit2/win/WebKit2Apple.vsprops
+++ b/Source/WebKit2/win/WebKit2Apple.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\WebProcess\WebPage\ca&quot;"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\WebProcess\WebPage\ca&quot;;&quot;$(ProjectDir)..\WebProcess\WebPage\ca\win&quot;"
 	/>
 	<Tool
 		Name="VCLinkerTool"
diff --git a/Source/WebKit2/win/WebKit2Generated.make b/Source/WebKit2/win/WebKit2Generated.make
index 79c5f14..694c0d5 100644
--- a/Source/WebKit2/win/WebKit2Generated.make
+++ b/Source/WebKit2/win/WebKit2Generated.make
@@ -37,6 +37,7 @@ all:
     xcopy /y /d "..\Shared\API\c\WKURLRequest.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\Shared\API\c\WKURLResponse.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\Shared\API\c\WKUserContentURLPattern.h" "%ConfigurationBuildDir%\include\WebKit2"
+    xcopy /y /d "..\UIProcess\API\C\cg\WKIconDatabaseCG.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WebKit2.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKApplicationCacheManager.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKAuthenticationChallenge.h" "%ConfigurationBuildDir%\include\WebKit2"
@@ -57,6 +58,7 @@ all:
     xcopy /y /d "..\UIProcess\API\C\WKGeolocationPermissionRequest.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKGeolocationPosition.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKInspector.h" "%ConfigurationBuildDir%\include\WebKit2"
+    xcopy /y /d "..\UIProcess\API\C\WKIconDatabase.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKKeyValueStorageManager.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKMediaCacheManager.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKNativeEvent.h" "%ConfigurationBuildDir%\include\WebKit2"
@@ -73,6 +75,8 @@ all:
     xcopy /y /d "..\UIProcess\API\C\WKProtectionSpaceTypes.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\WKResourceCacheManager.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\win\WKContextPrivateWin.h" "%ConfigurationBuildDir%\include\WebKit2"
+    xcopy /y /d "..\UIProcess\API\C\win\WKGrammarDetail.h" "%ConfigurationBuildDir%\include\WebKit2"
+    xcopy /y /d "..\UIProcess\API\C\win\WKTextChecker.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\win\WKView.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\C\win\WKViewPrivate.h" "%ConfigurationBuildDir%\include\WebKit2"
     xcopy /y /d "..\UIProcess\API\cpp\WKRetainPtr.h" "%ConfigurationBuildDir%\include\WebKit2"
diff --git a/Source/WebKit2/win/WebKit2Production.vsprops b/Source/WebKit2/win/WebKit2Production.vsprops
index 5bdec6f..4387622 100644
--- a/Source/WebKit2/win/WebKit2Production.vsprops
+++ b/Source/WebKit2/win/WebKit2Production.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WebKit2Common.vsprops;
       .\WebKit2DirectX.vsprops;
diff --git a/Source/WebKit2/win/WebKit2Release.vsprops b/Source/WebKit2/win/WebKit2Release.vsprops
index 7ae6676..698b8ff 100644
--- a/Source/WebKit2/win/WebKit2Release.vsprops
+++ b/Source/WebKit2/win/WebKit2Release.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WebKit2Common.vsprops;
       .\WebKit2DirectX.vsprops;
diff --git a/Source/WebKit2/win/WebKit2ReleaseCairoCFLite.vsprops b/Source/WebKit2/win/WebKit2ReleaseCairoCFLite.vsprops
index 685f929..7d5eeee 100644
--- a/Source/WebKit2/win/WebKit2ReleaseCairoCFLite.vsprops
+++ b/Source/WebKit2/win/WebKit2ReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;
diff --git a/Source/WebKit2/win/WebKit2WebProcessProduction.vsprops b/Source/WebKit2/win/WebKit2WebProcessProduction.vsprops
index 08c8ae2..20f75fc 100644
--- a/Source/WebKit2/win/WebKit2WebProcessProduction.vsprops
+++ b/Source/WebKit2/win/WebKit2WebProcessProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WebKit2WebProcessCommon.vsprops"
 	>
diff --git a/Source/WebKit2/win/WebKit2WebProcessRelease.vsprops b/Source/WebKit2/win/WebKit2WebProcessRelease.vsprops
index a32a112..2dbbb93 100644
--- a/Source/WebKit2/win/WebKit2WebProcessRelease.vsprops
+++ b/Source/WebKit2/win/WebKit2WebProcessRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WebKit2WebProcessCommon.vsprops"
 	>
diff --git a/Source/WebKit2/win/WebKit2WebProcessReleaseCairoCFLite.vsprops b/Source/WebKit2/win/WebKit2WebProcessReleaseCairoCFLite.vsprops
index d278242..75811b0 100644
--- a/Source/WebKit2/win/WebKit2WebProcessReleaseCairoCFLite.vsprops
+++ b/Source/WebKit2/win/WebKit2WebProcessReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\WebKit2WebProcessCommon.vsprops"
diff --git a/Source/WebKit2/win/WebKitPreBuild.cmd b/Source/WebKit2/win/WebKitPreBuild.cmd
index b6f0bd4..82f02e9 100644
--- a/Source/WebKit2/win/WebKitPreBuild.cmd
+++ b/Source/WebKit2/win/WebKitPreBuild.cmd
@@ -5,11 +5,6 @@ if exist "%CONFIGURATIONBUILDDIR%\buildfailed" grep XX%PROJECTNAME%XX "%CONFIGUR
 if errorlevel 1 exit 1
 echo XX%PROJECTNAME%XX > "%CONFIGURATIONBUILDDIR%\buildfailed"
 
-touch "%CONFIGURATIONBUILDDIR%\tmp.cpp"
-cl /analyze /nologo /c "%CONFIGURATIONBUILDDIR%\tmp.cpp" /Fo"%INTDIR%\tmp.obj" 2>&1 | findstr D9040
-if ERRORLEVEL 1 (set EnablePREfast="true") else (set EnablePREfast="false")
-if ERRORLEVEL 1 (set AnalyzeWithLargeStack="/analyze:65536") else (set AnalyzeWithLargeStack="")
-
 mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\JavaScriptCore"
 xcopy /y /d "%WEBKITLIBRARIESDIR%\include\JavaScriptCore\*" "%CONFIGURATIONBUILDDIR%\include\JavaScriptCore"
 
diff --git a/Source/autotools/symbols.filter b/Source/autotools/symbols.filter
index 4eeadf4..7e4781b 100644
--- a/Source/autotools/symbols.filter
+++ b/Source/autotools/symbols.filter
@@ -9,6 +9,7 @@ _ZN3WTF16fastZeroedMallocEm;
 _ZN3WTF20fastMallocStatisticsEv;
 _ZN3WTF8fastFreeEPv;
 _ZN3WTF13freeOwnedGPtrI7_GErrorEEvPT_;
+_ZN3WTF8Internal21fastMallocMatchFailedEPv;
 _ZN3WTF3MD58addBytes*;
 _ZN3WTF3MD58checksum*;
 _ZN3WTF3MD5C1Ev;
diff --git a/Source/cmake/OptionsCommon.cmake b/Source/cmake/OptionsCommon.cmake
index be465fa..ac0811d 100644
--- a/Source/cmake/OptionsCommon.cmake
+++ b/Source/cmake/OptionsCommon.cmake
@@ -5,7 +5,7 @@ SET(WTF_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}"
     "${JAVASCRIPTCORE_DIR}/wtf"
     "${JAVASCRIPTCORE_DIR}/wtf/unicode"
-    "${DERIVED_SOURCES_DIR}"
+    "${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}"
 )
 
 IF (WTF_OS_UNIX)
diff --git a/Source/cmake/OptionsEfl.cmake b/Source/cmake/OptionsEfl.cmake
index 6b0b080..338c393 100644
--- a/Source/cmake/OptionsEfl.cmake
+++ b/Source/cmake/OptionsEfl.cmake
@@ -46,8 +46,8 @@ SET(WTF_USE_ICU_UNICODE 1)
 ADD_DEFINITIONS(-DWTF_USE_ICU_UNICODE=1)
 LIST(APPEND WTF_INCLUDE_DIRECTORIES ${ICU_INCLUDE_DIRS})
 
-SET(WTF_PLATFORM_CAIRO 1)
-ADD_DEFINITIONS(-DWTF_PLATFORM_CAIRO=1)
+SET(WTF_USE_CAIRO 1)
+ADD_DEFINITIONS(-DWTF_USE_CAIRO=1)
 
 SET(JSC_EXECUTABLE_NAME jsc_efl)
 SET(WTF_LIBRARY_NAME wtf_efl)
diff --git a/Source/cmake/WebKitFS.cmake b/Source/cmake/WebKitFS.cmake
index 74e7fb8..6a58e0a 100644
--- a/Source/cmake/WebKitFS.cmake
+++ b/Source/cmake/WebKitFS.cmake
@@ -1,5 +1,4 @@
-SET(DERIVED_SOURCES_DIR "${CMAKE_BINARY_DIR}/DerivedSources")
-
-FILE(MAKE_DIRECTORY ${DERIVED_SOURCES_DIR})
+FILE(MAKE_DIRECTORY ${DERIVED_SOURCES_WEBCORE_DIR})
+FILE(MAKE_DIRECTORY ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR})
 FILE(MAKE_DIRECTORY ${CMAKE_BINARY_DIR}/Source/JavaScriptCore/runtime)
 FILE(MAKE_DIRECTORY ${CMAKE_BINARY_DIR}/Programs)
diff --git a/Source/cmake/WebKitHelpers.cmake b/Source/cmake/WebKitHelpers.cmake
index 58c506b..5bf65a3 100644
--- a/Source/cmake/WebKitHelpers.cmake
+++ b/Source/cmake/WebKitHelpers.cmake
@@ -65,12 +65,12 @@ ENDMACRO()
 
 
 # Append the given dependencies to the source file
-# This one consider the given dependencies are in ${DERIVED_SOURCES_DIR}
+# This one consider the given dependencies are in ${DERIVED_SOURCES_WEBCORE_DIR}
 # and prepends this to every member of dependencies list
-MACRO(ADD_SOURCE_DERIVED_DEPENDENCIES _source _deps)
+MACRO(ADD_SOURCE_WEBCORE_DERIVED_DEPENDENCIES _source _deps)
   SET(_tmp "")
   FOREACH (f ${_deps})
-    LIST(APPEND _tmp "${DERIVED_SOURCES_DIR}/${f}")
+    LIST(APPEND _tmp "${DERIVED_SOURCES_WEBCORE_DIR}/${f}")
   ENDFOREACH ()
 
   ADD_SOURCE_DEPENDENCIES(${_source} ${_tmp})
diff --git a/Source/cmake/WebKitMacros.cmake b/Source/cmake/WebKitMacros.cmake
index 75a87a6..7bcb3c8 100644
--- a/Source/cmake/WebKitMacros.cmake
+++ b/Source/cmake/WebKitMacros.cmake
@@ -27,7 +27,7 @@ ENDMACRO ()
 MACRO (GENERATE_DOM_NAMES _namespace _attrs)
     SET(NAMES_GENERATOR ${WEBCORE_DIR}/dom/make_names.pl)
     SET(_arguments  --attrs ${_attrs})
-    SET(_outputfiles ${DERIVED_SOURCES_DIR}/${_namespace}Names.cpp ${DERIVED_SOURCES_DIR}/${_namespace}Names.h)
+    SET(_outputfiles ${DERIVED_SOURCES_WEBCORE_DIR}/${_namespace}Names.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/${_namespace}Names.h)
     SET(_extradef)
     SET(_tags)
 
@@ -41,7 +41,7 @@ MACRO (GENERATE_DOM_NAMES _namespace _attrs)
 
     IF (_tags)
         SET(_arguments "${_arguments}" --tags ${_tags} --factory --wrapperFactory)
-        SET(_outputfiles "${_outputfiles}" ${DERIVED_SOURCES_DIR}/${_namespace}ElementFactory.cpp ${DERIVED_SOURCES_DIR}/${_namespace}ElementFactory.h ${DERIVED_SOURCES_DIR}/JS${_namespace}ElementWrapperFactory.cpp ${DERIVED_SOURCES_DIR}/JS${_namespace}ElementWrapperFactory.h)
+        SET(_outputfiles "${_outputfiles}" ${DERIVED_SOURCES_WEBCORE_DIR}/${_namespace}ElementFactory.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/${_namespace}ElementFactory.h ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_namespace}ElementWrapperFactory.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_namespace}ElementWrapperFactory.h)
     ENDIF ()
 
     IF (_extradef)
@@ -51,7 +51,7 @@ MACRO (GENERATE_DOM_NAMES _namespace _attrs)
     ADD_CUSTOM_COMMAND(
         OUTPUT  ${_outputfiles}
         DEPENDS ${NAMES_GENERATOR} ${SCRIPTS_BINDINGS} ${_attrs} ${_tags}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${NAMES_GENERATOR} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --outputDir ${DERIVED_SOURCES_DIR} ${_arguments} ${_additionArguments}
+        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${NAMES_GENERATOR} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --outputDir ${DERIVED_SOURCES_WEBCORE_DIR} ${_arguments} ${_additionArguments}
         VERBATIM)
 ENDMACRO ()
 
@@ -88,15 +88,15 @@ MACRO(MAKE_HASH_TOOLS _source)
     GET_FILENAME_COMPONENT(_name ${_source} NAME_WE)
 
     IF (${_source} STREQUAL "DocTypeStrings")
-        SET(_hash_tools_h "${DERIVED_SOURCES_DIR}/HashTools.h")
+        SET(_hash_tools_h "${DERIVED_SOURCES_WEBCORE_DIR}/HashTools.h")
     ELSE ()
         SET(_hash_tools_h "")
     ENDIF ()
 
     ADD_CUSTOM_COMMAND(
-        OUTPUT ${DERIVED_SOURCES_DIR}/${_name}.cpp ${_hash_tools_h}
+        OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/${_name}.cpp ${_hash_tools_h}
         MAIN_DEPENDENCY ${_source}.gperf 
-        COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/make-hash-tools.pl ${DERIVED_SOURCES_DIR} ${_source}.gperf
+        COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/make-hash-tools.pl ${DERIVED_SOURCES_WEBCORE_DIR} ${_source}.gperf
         VERBATIM)
 
     UNSET(_name)
@@ -108,13 +108,13 @@ MACRO (WEBKIT_WRAP_SOURCELIST)
         GET_FILENAME_COMPONENT(_basename ${_file} NAME_WE)
         GET_FILENAME_COMPONENT(_path ${_file} PATH)
 
-		IF (NOT _file MATCHES "${DERIVED_SOURCES_DIR}")
+		IF (NOT _file MATCHES "${DERIVED_SOURCES_WEBCORE_DIR}")
             STRING(REGEX REPLACE "/" "\\\\\\\\" _sourcegroup "${_path}")
             SOURCE_GROUP("${_sourcegroup}" FILES ${_file})
 		ENDIF ()
 
         IF (WTF_PLATFORM_QT)
-            SET(_moc_filename ${DERIVED_SOURCES_DIR}/${_basename}.moc)
+            SET(_moc_filename ${DERIVED_SOURCES_WEBCORE_DIR}/${_basename}.moc)
 
             FILE(READ ${_file} _contents)
 
@@ -126,5 +126,5 @@ MACRO (WEBKIT_WRAP_SOURCELIST)
         ENDIF ()
     ENDFOREACH ()
 
-    SOURCE_GROUP("DerivedSources" REGULAR_EXPRESSION "${DERIVED_SOURCES_DIR}")
+    SOURCE_GROUP("DerivedSources" REGULAR_EXPRESSION "${DERIVED_SOURCES_WEBCORE_DIR}")
 ENDMACRO ()
diff --git a/Source/gyp/configure b/Source/gyp/configure
index 28d6677..b4e4ac5 100755
--- a/Source/gyp/configure
+++ b/Source/gyp/configure
@@ -40,6 +40,7 @@ def chdir_to_source():
 def gyp():
     return os.path.join('ThirdParty', 'gyp', 'gyp')
 
+
 class Project:
     def __init__(self, name):
         self._name = name
@@ -47,44 +48,77 @@ class Project:
     def name(self):
         return self._name
 
-    def inputs(self):
+    def _gyp_directory(self):
+        return os.path.join(self._name, 'gyp')
+
+    def _gyp_file_for_port(self, port):
+        # Gyp uses the gyp file name as the XCode proj file name, so for now "apple-mac" must be ProjectName.gyp
+        if port == "mac":
+            return '%s.gyp' % self._name
+        return "%s.gyp" % port
+
+    def inputs(self, port):
         return [
-            os.path.join(self._name, 'gyp', self._name + '.gyp'),
+            os.path.join(self._gyp_directory(), self._gyp_file_for_port(port)),
             os.path.join(self._name, self._name + '.gypi'),
             os.path.join('gyp', 'common.gypi'),
         ]
 
-    def output(self):
-        return os.path.join(self._name, 'gyp', self._name + '.xcodeproj', 'project.pbxproj')
+    def _output_for_port(self, port):
+        format = format_for_port(port)
+        return {
+            'filelist': '%s.am' % port,
+            'xcode': os.path.join(self._name + '.xcodeproj', 'project.pbxproj'),
+        }[format]
 
-    def should_generate(self):
-        if not os.path.exists(self.output()):
+    def output(self, port):
+        return os.path.join(self._gyp_directory(), self._output_for_port(port))
+
+    def should_generate(self, port):
+        if not os.path.exists(self.output(port)):
             return True
-        return os.path.getmtime(self.output()) < self._newest(self.inputs())
+        return os.path.getmtime(self.output(port)) < self._newest(self.inputs(port))
+
+    def _extra_args_for_format(self, format):
+        if format == "xcode":
+            return ['-G', 'xcode_list_excluded_files=0']
+        return []
 
-    def generate(self):
-        subprocess.call([
+    def generate(self, port):
+        args = [
             gyp(),
-            self.inputs()[0],
-            '-G',
-            'xcode_list_excluded_files=0',
+            self.inputs(port)[0],
             '--depth=.',
-        ])
+        ]
+        format = format_for_port(port)
+        args.append('--format=%s' % format)
+        args += self._extra_args_for_format(format)
+
+        subprocess.call(args)
         # GYP doesn't always touch the output file, but we want to touch the
         # file so that we don't keep trying to regenerate it.
-        os.utime(self.output(), None)
+        os.utime(self.output(port), None)
 
     @staticmethod
     def _newest(paths):
         return max([os.path.getmtime(path) for path in paths])
 
+
+def format_for_port(port):
+    return {
+        'mac': 'xcode',
+        'gtk': 'filelist',
+        'win': 'msvs',
+    }[port] # Valid port is required.
+
+
 PROJECTS = [
     Project("JavaScriptCore"),
     Project("WebCore"),
 ]
 
-def projects_to_generate():
-    should_generate = [project for project in PROJECTS if project.should_generate()]
+def projects_to_generate(port):
+    should_generate = [project for project in PROJECTS if project.should_generate(port)]
     already_generated = [project.name() for project in set(PROJECTS) - set(should_generate)]
 
     if already_generated:
@@ -93,11 +127,13 @@ def projects_to_generate():
 
     return should_generate
 
+
 def main():
     chdir_to_source()
 
     parser = OptionParser()
-    # FIXME: The user should be able to pass which port on the command line.
+    parser.add_option("--port", dest="port", action="store", default="mac", # Default to Mac for now
+                      help="Which port to generate for.")
     parser.add_option("--regenerate-projects", dest="regenerate_projects",
                       default=False, action="store_true",
                       help="Generate all project files even if they appear to be up to date.")
@@ -105,11 +141,12 @@ def main():
 
     projects = PROJECTS
     if not options.regenerate_projects:
-        projects = projects_to_generate()
+        projects = projects_to_generate(options.port)
 
     for project in projects:
         print "Generating %s." % project.name()
-        project.generate()
+        project.generate(options.port)
+
 
 if __name__ == "__main__":
     main()
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/config.json b/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
index 28ff304..b4a43d0 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
@@ -55,7 +55,7 @@
                     { "name": "google-windows-2", "platform": "chromium-win" },
                     { "name": "google-mac-2", "platform": "chromium-mac" },
                     { "name": "google-linux-2", "platform": "chromium-linux" },
-                    { "name": "google-new-tests", "platform": "mac-leopard" },
+                    { "name": "google-new-tests", "platform": "mac-snowleopard" },
 
                     { "name": "wincairo-1", "platform": "wincairo" },
 
@@ -101,6 +101,11 @@
                       "slavenames": ["apple-xserve-7", "test-slave"]
                     },
                     {
+                      "name": "SnowLeopard Intel Release (NRWT)", "type": "NewBuildAndTest", "builddir": "google-new-tests",
+                      "platform": "mac-snowleopard", "configuration": "release", "architectures": ["x86_64"],
+                      "slavenames": ["google-new-tests"]
+                    },
+                    {
                       "name": "Windows Release (Build)", "type": "Build", "builddir": "win-release",
                       "platform": "win", "configuration": "release", "architectures": ["i386"],
                       "triggers": ["win-release-tests", "win-release-tests-wk2"],
@@ -197,11 +202,6 @@
                       "slavenames": ["google-linux-2"]
                     },
                     {
-                      "name": "New run-webkit-tests", "type": "NewBuildAndTest", "builddir": "google-new-tests",
-                      "platform": "mac-leopard", "configuration": "release", "architectures": ["i386"],
-                      "slavenames": ["google-new-tests"]
-                    },
-                    {
                       "name": "WinCairo Debug (Build)", "type": "Build", "builddir": "win-cairo-debug",
                       "platform": "wincairo", "configuration": "debug", "architectures": ["i386"],
                       "slavenames": ["wincairo-1"]
@@ -230,7 +230,7 @@
                       "builderNames": ["Leopard Intel Release (Build)", "Leopard Intel Debug (Build)"]
                     },
                     { "type": "PlatformSpecificScheduler", "platform": "mac-snowleopard", "branch": "trunk", "treeStableTimer": 45.0,
-                      "builderNames": ["SnowLeopard Intel Release (Build)", "SnowLeopard Intel Leaks"]
+                      "builderNames": ["SnowLeopard Intel Release (Build)", "SnowLeopard Intel Leaks", "SnowLeopard Intel Release (NRWT)"]
                     },
                     { "type": "PlatformSpecificScheduler", "platform": "win", "branch": "trunk", "treeStableTimer": 45.0,
                       "builderNames": ["Windows Release (Build)", "Windows Debug (Build)"]
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index 1beee38..61d0b42 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -18,6 +18,7 @@ from twisted.internet import defer
 import os
 import re
 import simplejson
+import urllib
 
 from webkitpy.common.config import build as wkbuild
 from webkitpy.common.net.buildbot import BuildBot as wkbuildbot
@@ -403,20 +404,32 @@ class UploadTestResults(transfer.FileUpload):
 class ExtractTestResults(master.MasterShellCommand):
     zipFile = WithProperties("public_html/results/%(buildername)s/r%(got_revision)s (%(buildnumber)s).zip")
     resultDirectory = WithProperties("public_html/results/%(buildername)s/r%(got_revision)s (%(buildnumber)s)")
+    descriptionDone = ["uploaded results"]
 
     def __init__(self):
         master.MasterShellCommand.__init__(self, "")
 
+    def resultDirectoryURL(self):
+        return self.build.getProperties().render(self.resultDirectory).replace("public_html/", "/") + "/"
+
     def start(self):
         self.command = ["ditto", "-k", "-x", "-V", self.build.getProperties().render(self.zipFile), self.build.getProperties().render(self.resultDirectory)]
         return master.MasterShellCommand.start(self)
 
-    def finished(self, result):
-        url = self.build.getProperties().render(self.resultDirectory).replace("public_html/", "/")
+    def addCustomURLs(self):
+        url = self.resultDirectoryURL() + "results.html"
         self.addURL("view results", url)
-        result = master.MasterShellCommand.finished(self, result)
-        self.step_status.setText(["uploaded results"])
-        return result
+
+    def finished(self, result):
+        self.addCustomURLs()
+        return master.MasterShellCommand.finished(self, result)
+
+
+class ExtractTestResultsAndLeaks(ExtractTestResults):
+    def addCustomURLs(self):
+        ExtractTestResults.addCustomURLs(self)
+        url = "/LeaksViewer/?url=" + urllib.quote(self.resultDirectoryURL(), safe="")
+        self.addURL("view leaks", url)
 
 
 class Factory(factory.BuildFactory):
@@ -442,6 +455,7 @@ class BuildFactory(Factory):
 
 class TestFactory(Factory):
     TestClass = RunWebKitTests
+    ExtractTestResultsClass = ExtractTestResults
     def __init__(self, platform, configuration, architectures):
         Factory.__init__(self, platform, configuration, architectures, False)
         self.addStep(DownloadBuiltProduct)
@@ -455,10 +469,11 @@ class TestFactory(Factory):
         self.addStep(RunPerlTests)
         self.addStep(ArchiveTestResults)
         self.addStep(UploadTestResults)
-        self.addStep(ExtractTestResults)
+        self.addStep(self.ExtractTestResultsClass)
 
 class BuildAndTestFactory(Factory):
     TestClass = RunWebKitTests
+    ExtractTestResultsClass = ExtractTestResults
     def __init__(self, platform, configuration, architectures):
         Factory.__init__(self, platform, configuration, architectures, False)
         if platform.startswith("chromium"):
@@ -481,7 +496,7 @@ class BuildAndTestFactory(Factory):
             self.addStep(RunPerlTests)
         self.addStep(ArchiveTestResults)
         self.addStep(UploadTestResults)
-        self.addStep(ExtractTestResults)
+        self.addStep(self.ExtractTestResultsClass)
         if platform == "gtk":
             self.addStep(RunGtkAPITests)
         if platform == "qt":
@@ -489,6 +504,7 @@ class BuildAndTestFactory(Factory):
 
 class BuildAndTestLeaksFactory(BuildAndTestFactory):
     TestClass = RunWebKitLeakTests
+    ExtractTestResultsClass = ExtractTestResultsAndLeaks
 
 class NewBuildAndTestFactory(BuildAndTestFactory):
     TestClass = NewRunWebKitTests
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js
index c15aef2..c847c73 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js
@@ -39,7 +39,7 @@ RecentBuildsLoader.prototype = {
                 var build = data[buildNumber];
 
                 var buildInfo = {
-                    revision: build.sourceStamp.changes[0].rev,
+                    revision: parseInt(build.properties.first(function(property) { return property[0] === "got_revision"; })[1], 10),
                     leakCount: 0,
                     url: null,
                 };
@@ -61,7 +61,8 @@ RecentBuildsLoader.prototype = {
                             return;
                         if (!("view results" in step.urls))
                             return;
-                        buildInfo.url = self._buildbotBaseURL + step.urls["view results"] + "/";
+                        var url = step.urls["view results"];
+                        buildInfo.url = self._buildbotBaseURL + url.replace(/\/results\.html$/, "") + "/";
                     }
 
                     if (buildInfo.leakCount && buildInfo.url) {
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js
index c44848a..b1fd2b4 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js
@@ -40,3 +40,11 @@ function range(n) {
         result[i] = i;
     return result;
 }
+
+Array.prototype.first = function(predicate) {
+    for (var i = 0; i < this.length; ++i) {
+        if (predicate(this[i]))
+            return this[i];
+    }
+    return null;
+}
diff --git a/Tools/BuildSlaveSupport/win/kill-old-processes b/Tools/BuildSlaveSupport/win/kill-old-processes
index f7f4423..d04b990 100755
--- a/Tools/BuildSlaveSupport/win/kill-old-processes
+++ b/Tools/BuildSlaveSupport/win/kill-old-processes
@@ -26,14 +26,33 @@
 import os, sys
 
 def main():
-    tasksToKill = ["DumpRenderTree.exe", "DumpRenderTree_debug.exe", "testapi.exe", "testapi_debug.exe",
-                "svn.exe", "httpd.exe", "cl.exe", "link.exe", "midl.exe", "devenv.exe", "perl.exe",
-                "imagediff.exe", "imagediff_debug.exe", "jsc.exe", "jsc_debug.exe", "WebKit2WebProcess.exe",
-                "WebKit2WebProcess_debug.exe", "WebKitTestRunner.exe", "WebKitTestRunner_debug.exe",
-                "wdiff.exe", "LightTPD.exe"]
-
+    tasksToKill = [ "cl.exe", 
+					"devenv.com", 
+					"devenv.exe", 
+					"DumpRenderTree.exe", 
+					"DumpRenderTree_debug.exe",
+					"httpd.exe", 
+					"imagediff.exe", 
+					"imagediff_debug.exe", 
+					"jsc.exe", 
+					"jsc_debug.exe",
+					"LightTPD.exe", 
+					"link.exe", 
+					"midl.exe", 
+					"perl.exe", 
+					"Safari.exe", 
+					"svn.exe", 
+					"testapi.exe", 
+					"testapi_debug.exe", 
+					"VcBuildHelper.exe", 
+					"wdiff.exe", 
+					"WebKit2WebProcess.exe", 
+					"WebKit2WebProcess_debug.exe", 
+					"WebKitTestRunner.exe", 
+					"WebKitTestRunner_debug.exe"]
+					
     for task in tasksToKill:
-        os.system("taskkill /f /im " + task)
+        os.system("taskkill /t /f /im " + task)
 
 if __name__ == '__main__':
     sys.exit(main())
diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index 479fd41..a45d6a0 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,3 +1,3085 @@
+2011-04-19  Ojan Vafai  <ojan@chromium.org>
+
+        Fix check for whether a failure is expected to deal with
+        flaky tests and FAIL expectations.
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-19  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        don't show missing text results for tests that only dump image results
+        https://bugs.webkit.org/show_bug.cgi?id=58931
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-19  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        don't show failures table if there are only new tests
+        https://bugs.webkit.org/show_bug.cgi?id=58929
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-19  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        don't show failures table if there are only new tests
+        https://bugs.webkit.org/show_bug.cgi?id=58929
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-19  Ojan Vafai  <ojan@chromium.org>
+
+        Fix unittest failures from http://trac.webkit.org/changeset/84294.
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_failures_unittest.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner_unittest.py:
+
+2011-04-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        switch new-run-webkit-tests to using the new results file
+        https://bugs.webkit.org/show_bug.cgi?id=58861
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_failures.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_failures_unittest.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-19  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move the alignment related macros from Vector.h to new Alignment.h.
+        https://bugs.webkit.org/show_bug.cgi?id=56000
+
+        Adding the new file to the forwarding headers of Tools.
+
+        * DumpRenderTree/ForwardingHeaders/wtf/Alignment.h: Added.
+
+2011-04-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix for Win / wx 2.9 wxPython installation.
+
+        * wx/packaging/build-win-installer.py:
+        * wx/packaging/wxWebKitInstaller.iss.in:
+
+2011-04-19  Adam Roben  <aroben@apple.com>
+
+        Skip another accelerated-compositing-sensitive test when accelerated compositing is disabled
+
+        * Scripts/old-run-webkit-tests: Skip media/controls-without-preload.html on Windows when
+        accelerated compositing is disabled.
+
+2011-04-19  Ojan Vafai  <ojan@chromium.org>
+
+        Remove accidentally committed debug code.
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-19  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        Avoid duplicate stub implementation of test routine
+        for WinCairo build.
+
+        * WebKitTestRunner/win/TestInvocationWin.cpp: Exclude
+        WinCairo from using this stub.
+
+2011-04-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        make results file work with audio and reftests
+        https://bugs.webkit.org/show_bug.cgi?id=58860
+
+        Also fix bug with timeout tests and store a bit in the JSON
+        for new image tests instead of loading the image result to check if it's there.
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-19  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r84206): 50 tests failing on SnowLeopard Intel Release (WebKit2 Tests) due to extra "supportsFullScreen() == true" output
+        https://bugs.webkit.org/show_bug.cgi?id=58890
+
+        Add a layoutTestController flag which controls when full screen callbacks are written to stdout.
+        Defaults to false.
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl: Added dumpFullScreenCallbacks().
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::supportsFullScreen): Only write to stdout if shouldDumpFullScreenCallbacks is set.
+        (WTR::InjectedBundlePage::enterFullScreenForElement): Ditto.
+        (WTR::InjectedBundlePage::exitFullScreenForElement): Ditto.
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::LayoutTestController): Initialize new ivar.
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+        (WTR::LayoutTestController::dumpFullScreenCallbacks): Added.
+        (WTR::LayoutTestController::shouldDumpFullScreenCallbacks): Added.
+
+2011-04-19  Kristóf Kosztyó  <Kosztyo.Kristof@stud.u-szeged.hu>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html fails (DRT sideeffect)
+        https://bugs.webkit.org/show_bug.cgi?id=35086
+
+        fast/xmlhttprequest/xmlhttprequest-no-file-access.html caused
+        a DRT sideeffect problem, because the resetSettings didn't set
+        the default value of LocalContentCanAccessFileUrls.
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::WebPage::resetSettings):
+
+2011-04-18  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Need support for dumping focus rectangles in pixel results
+        https://bugs.webkit.org/show_bug.cgi?id=53647
+
+        Dump the selection rect if it has been requested.
+
+        * DumpRenderTree/gtk/PixelDumpSupportGtk.cpp:
+        (createBitmapContextFromWebView):
+
+2011-04-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        test-webkitpy should run the ActiveWorkItems tests
+        https://bugs.webkit.org/show_bug.cgi?id=58859
+
+        Also make the unit tests pass. :)
+
+        * QueueStatusServer/model/activeworkitems.py:
+        * QueueStatusServer/model/queue.py:
+        * QueueStatusServer/model/workitems.py:
+
+2011-04-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        queues.webkit.org should show trailing-days pass counts for queues
+        https://bugs.webkit.org/show_bug.cgi?id=58812
+
+        This lets us see if each bot is pulling its own weight or not.
+        Before I wrote this patch our suspicious was that one of the
+        cq bots was doing most of the work.  Turns out they're actually
+        pretty even in their recent pass counts.
+
+        * QueueStatusServer/handlers/queuestatus.py:
+        * QueueStatusServer/index.yaml:
+        * QueueStatusServer/templates/queuestatus.html:
+
+2011-04-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        new-run-webkit-tests: obsolete old threading code, part 1
+        https://bugs.webkit.org/show_bug.cgi?id=58752
+
+        This patch removes support for the 'old-inline' and
+        'old-threads' worker models, and deletes the corresponding code.
+        Now that the new code is stable, this stuff is no longer
+        necessary.
+
+        * Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py: Removed.
+        * Scripts/webkitpy/layout_tests/layout_package/message_broker.py: Removed.
+        * Scripts/webkitpy/layout_tests/layout_package/message_broker_unittest.py: Removed.
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-04-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        new-run-webkit-tests: add an --additional-drt-flag option
+        https://bugs.webkit.org/show_bug.cgi?id=58680
+
+        NRWT has a bunch of command line flags that exist to pass
+        custom flags to DRT, especially on chromium. It would be nice
+        if there was a generic mechanism to pass through flags so we
+        didn't have all the custom ones.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2011-04-05  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: WKTR should support WebKit2 full screen APIs
+        https://bugs.webkit.org/show_bug.cgi?id=56318
+
+        Respond to enterFullScreenForElement() and exitFullScreenForElement(), allowing 
+        WKTR to test the LayoutTest/fullscreen/ tests.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::InjectedBundlePage): Add support for WKBundlePageFullScreenClient.
+        (WTR::InjectedBundlePage::supportsFullScreen): Added.
+        (WTR::InjectedBundlePage::enterFullScreenForElement): Added.
+        (WTR::InjectedBundlePage::exitFullScreenForElement): Added.
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.h:
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues): Enable the full screen preference.
+
+2011-04-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        new-run-webkit-tests: remove chromium-specific relpath hack for --results-directory
+        https://bugs.webkit.org/show_bug.cgi?id=58388
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+
+2011-04-18  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] expose title direction to webkit client
+        https://bugs.webkit.org/show_bug.cgi?id=58823
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::reset):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        (LayoutTestController::setTitleTextDirection):
+        Add member and setter to let us stash the title direction at load time.
+
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::didReceiveTitle):
+        * DumpRenderTree/chromium/WebViewHost.h:
+        Adapt to new API; push the title into layoutTestController when we
+        receive it.
+
+2011-04-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Unreviewed.
+
+        Re-land r84112. It was rolled out in r84127 but it didn't need
+        to be. Only r84111 actually broke things.
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-04-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        new-run-webkit-tests: don't run more processes than necessary
+        https://bugs.webkit.org/show_bug.cgi?id=58751
+
+        Previously NRWT would start up 1 process for each processor on
+        the machine by default, which was a waste if we were only
+        running a few shards of tests.
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner2.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-04-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        include links to actual.png files for new pixel tests
+        https://bugs.webkit.org/show_bug.cgi?id=58831
+
+        Load image elements to confirm whether the files exist.
+        Image elements will load without being appended to the DOM.
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        add a zoomed view for pixel results to the new results html file
+        https://bugs.webkit.org/show_bug.cgi?id=58827
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        add labels to results html page
+        https://bugs.webkit.org/show_bug.cgi?id=58803
+
+        -fix iframe size to be the size of the png results
+        -fix a bunch of aesthetic nits
+        -fix some incorrectly styled code
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-18  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKitTestRunner needs layoutTestController.pathToLocalResource
+        https://bugs.webkit.org/show_bug.cgi?id=42541
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+        * WebKitTestRunner/InjectedBundle/mac/LayoutTestControllerMac.mm:
+        (WTR::LayoutTestController::pathToLocalResource):
+        * WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp:
+        (WTR::LayoutTestController::pathToLocalResource):
+        * WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp:
+        (WTR::LayoutTestController::pathToLocalResource):
+
+2011-04-18  Timothy Hatcher  <timothy@apple.com>
+
+        Make update-webkit-localizable-strings put WebKit/win strings in WebCore
+        now that all localized strings in WebKit/win use WEB_UI_STRING.
+
+        https://webkit.org/b/58747
+
+        Reviewed by Dan Bernstein.
+
+        * Scripts/update-webkit-localizable-strings: Remove the code that updated WebKit/win differently.
+
+2011-04-18  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Use WCHAR instead of TCHAR
+        https://bugs.webkit.org/show_bug.cgi?id=58755
+
+        We always use the UNICODE versions of windows functions, so
+        the usage of TCHAR makes no sense and mixing them is bad style.
+
+        * WinLauncher/PrintWebUIDelegate.cpp:
+          Also fix various style issues (including indentation and removal of ugly C-casts).
+        * WinLauncher/WinLauncher.cpp:
+
+2011-04-18  Dominic Cooney  <dominicc@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        Add layoutTestController.shadowRoot to Qt DRT.
+        https://bugs.webkit.org/show_bug.cgi?id=58759
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::shadowRoot): Added.
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2011-04-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84111.
+        http://trac.webkit.org/changeset/84111
+        https://bugs.webkit.org/show_bug.cgi?id=58771
+
+        Chromium linux layout tests are broken. (Requested by loislo2
+        on #webkit).
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/mock_drt.py:
+
+2011-04-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84112.
+        http://trac.webkit.org/changeset/84112
+        https://bugs.webkit.org/show_bug.cgi?id=58770
+
+        Chromium linux layout tests are broken. (Requested by loislo2
+        on #webkit).
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-04-17  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel and Adam Barth.
+
+        webkit-patch land hangs if svn prompts for credentials
+        https://bugs.webkit.org/show_bug.cgi?id=31500
+
+        Prompt for username and password when using git-svn and there aren't cached SVN credentials.
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+          - Added mixin class SVNRepository and made both class SVN and Git inherit from it.
+          - Moved SVN.has_authorization_for_realm() to class SVNRepository and removed default value
+            for argument realm; modified call sites as needed.
+          - Modified AuthenticationError constructor to take optional prompt_for_password argument.
+          - Modified {SCM, SVN, Git}.commit_with_message() to take optional password argument.
+          - Modified Git._commit_on_branch() to take optional username and password argument.
+          - Modified Git.push_local_commits_to_server() to take optional username and password
+            argument and to call has_authorization_for_realm().
+        * Scripts/webkitpy/common/checkout/scm_unittest.py:
+          - Modified SVNTest.test_commit_without_authorization() to take dummy realm argument.
+          - Modified SVNTest.test_not_have_authorization_for_realm() to pass realm argument to
+            SVN.has_authorization_for_realm().
+        * Scripts/webkitpy/common/net/credentials.py:
+          - Modified Credentials.read_credentials() to call User.prompt_password() instead
+            of using getpass.getpass() directly.
+        * Scripts/webkitpy/common/system/user.py:
+          - Added User.prompt_password().
+        * Scripts/webkitpy/tool/steps/commit.py:
+          - Modified Commit.run() to prompt for a password if needed.
+
+2011-04-17  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        new-run-webkit-tests: save stderr into the layout-test-results dir
+        https://bugs.webkit.org/show_bug.cgi?id=58690
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-04-17  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        new-run-webkit-tests: read stderr from chromium DRT separately
+        https://bugs.webkit.org/show_bug.cgi?id=58708
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/mock_drt.py:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CA) to USE(CA)
+        https://bugs.webkit.org/show_bug.cgi?id=58742
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CG) to USE(CG)
+        https://bugs.webkit.org/show_bug.cgi?id=58729
+
+        * DumpRenderTree/PixelDumpSupport.cpp:
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::paintRect):
+        * DumpRenderTree/config.h:
+        * DumpRenderTree/win/PixelDumpSupportWin.cpp:
+        (createBitmapContextFromWebView):
+        * TestWebKitAPI/PlatformWebView.h:
+        * WebKitTestRunner/config.h:
+        * WebKitTestRunner/win/TestInvocationWin.cpp:
+
+2011-04-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Rename PLATFORM(CAIRO) to USE(CAIRO)
+        https://bugs.webkit.org/show_bug.cgi?id=55192
+
+        * DumpRenderTree/PixelDumpSupport.cpp:
+        * DumpRenderTree/config.h:
+        * DumpRenderTree/win/PixelDumpSupportWin.cpp:
+        (createBitmapContextFromWebView):
+        * WebKitTestRunner/config.h:
+
+2011-04-16  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        show diffs+test inline in the results page
+        https://bugs.webkit.org/show_bug.cgi?id=58723
+        
+        Put each row in it's own tbody and sort based on tbodies. That way
+        we can append the results to the tbody inline as another table row.
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-16  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        handle new tests in the new results html file
+        https://bugs.webkit.org/show_bug.cgi?id=58715
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-15  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        old-run-webkit-tests: save the list of tests actually run to a file
+        https://bugs.webkit.org/show_bug.cgi?id=58692
+
+        * Scripts/old-run-webkit-tests:
+
+2011-04-15  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        fix MockFileSystem.abspath() on windows
+        https://bugs.webkit.org/show_bug.cgi?id=58713
+
+        The existing code was borked on Windows if a path was passed
+        in using a drive letter (e.g., "d:\foo.txt"), and would go
+        into an infinite recursive loop. While win paths shouldn't
+        normally be passed into the mock filesystem, this just
+        bulletproofs things a bit (note that "/foo.txt" is considered
+        an absolute path on windows python as well.
+
+        * Scripts/webkitpy/common/system/filesystem_mock.py:
+
+2011-04-15  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        show stderr files and httpd log files
+        https://bugs.webkit.org/show_bug.cgi?id=58714
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
+
+        * Scripts/build-webkit:
+
+2011-04-15  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        When a message with url embedded is added to console, the "file:" scheme
+        and path should be stripped.
+        https://bugs.webkit.org/show_bug.cgi?id=58665
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::lastFileURLPathComponent):
+        (WTR::InjectedBundlePage::willAddMessageToConsole):
+
+2011-04-15  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add takeFocus callback to WKPageUIClient
+        https://bugs.webkit.org/show_bug.cgi?id=58686
+
+        Add empty WKPageUIClient entries for the takeFocus callback in the MiniBrowser and WebKitTestRunner.
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (-[BrowserWindowController awakeFromNib]): Added empty takeFocus entry.
+        * MiniBrowser/win/BrowserView.cpp:
+        (BrowserView::create): Added empty takeFocus entry.
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::createOtherPage): Added empty takeFocus entry.
+        (WTR::TestController::initialize): Added empty takeFocus entry.
+
+2011-04-15  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        only show pretty-diff/wdiff if they were generated
+        https://bugs.webkit.org/show_bug.cgi?id=58682
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+
+2011-04-15  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] DRT: Default custom policy delegate decision should be Ignore.
+
+        If layoutTestController.setCustomPolicyDelegate() is called with only
+        one argument, the second ("permissive") should default to false.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2011-04-15  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        fix path to layout test in new results file
+        https://bugs.webkit.org/show_bug.cgi?id=58618
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-15  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        fix sorting in new results file
+        https://bugs.webkit.org/show_bug.cgi?id=58616
+
+        -Fix the custom sort to return -1, 0, 1 instead of true/false.
+        -Secondary sort by test name when sort values are equal.
+        -Sort by test name by default.
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-15  Dmitry Lomov  <dslomov@google.com>
+
+        Reviewed by David Levin.
+
+        check-webkit-style shouldn't complain about not including a primary header file 
+        if none exists
+        https://bugs.webkit.org/show_bug.cgi?id=39514
+
+        * Scripts/webkitpy/style/checkers/cpp.py:
+        * Scripts/webkitpy/style/checkers/cpp_unittest.py:
+
+2011-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mihai Parparita.
+
+        queues.webkit.org should display when a bot last rebooted
+        https://bugs.webkit.org/show_bug.cgi?id=58562
+
+        There is more repeated code here than I would like.  I fear
+        my django-fu isn't quite up to snuff.
+
+        * QueueStatusServer/handlers/queuestatus.py:
+        * QueueStatusServer/templates/queuestatus.html:
+
+2011-04-14  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove dependency on chromium skia::PlatformCanvas
+        https://bugs.webkit.org/show_bug.cgi?id=57563
+        
+        Fixed compile error on Mac when using Core Graphics.
+
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::paintRect):
+
+2011-04-14  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Remove dependency on chromium skia::PlatformCanvas
+        https://bugs.webkit.org/show_bug.cgi?id=57563
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (makeCanvasOpaque):
+        (TestShell::dumpImage):
+        * DumpRenderTree/chromium/TestShell.h:
+        * DumpRenderTree/chromium/WebThemeControlDRTWin.cpp:
+        (WebThemeControlDRTWin::WebThemeControlDRTWin):
+        (WebThemeControlDRTWin::draw):
+        (WebThemeControlDRTWin::drawTextField):
+        (WebThemeControlDRTWin::drawProgressBar):
+        * DumpRenderTree/chromium/WebThemeControlDRTWin.h:
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::canvas):
+        * DumpRenderTree/chromium/WebViewHost.h:
+
+2011-04-14  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Add -maximize flag to QtTestBrowser and MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=58007
+
+        Adds flag to start the test browsers maximized.
+        Symbian started maximized on QtTestBrowser - made MiniBrowser follow
+        suit.
+        Also fixes some ToggleFullScreen issues so that prior window state is
+        restored.
+
+        * MiniBrowser/qt/BrowserWindow.cpp:
+        (BrowserWindow::BrowserWindow):
+        (BrowserWindow::toggleFullScreenMode):
+        * MiniBrowser/qt/MiniBrowserApplication.cpp:
+        (MiniBrowserApplication::handleUserOptions):
+        * MiniBrowser/qt/MiniBrowserApplication.h:
+        (WindowOptions::WindowOptions):
+        * QtTestBrowser/launcherwindow.cpp:
+        (LauncherWindow::init):
+        (LauncherWindow::toggleFullScreenMode):
+        * QtTestBrowser/launcherwindow.h:
+        (WindowOptions::WindowOptions):
+        * QtTestBrowser/main.cpp:
+        (LauncherApplication::handleUserOptions):
+
+2011-04-14  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        add checkbox to only show unexpected results to new results file
+        https://bugs.webkit.org/show_bug.cgi?id=58606
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Martin Robinson.
+
+        [WinCairo] Implement ImageDiff Logic.
+        http://bugs.webkit.org/show_bug.cgi?id=58486
+
+        * DumpRenderTree/win/ImageDiffCairo.cpp: Added.
+        (strtof):
+        (readFromData):
+        (createImageFromStdin):
+        (releaseMallocBuffer):
+        (createDifferenceImage):
+        (imageHasAlpha):
+        (writeToData):
+        (main):
+        * DumpRenderTree/win/ImageDiff.vcproj: Updated for new
+          ImageDiffCairo.cpp (excluding from Apple builds).
+        * DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops: Use
+          new ImageDiffWinCairoCommon.vsprops file.
+        * DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops: Use
+          new ImageDiffWinCairoCommon.vsprops file.
+        * DumpRenderTree/win/ImageDiffWinCairoCommon.vsprops: Added.
+        * Scripts/old-run-webkit-tests: Make sure proper executable
+          is built and executed for WinCairo port.
+
+2011-04-14  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        only show expected failure type for ports that use an expectations file
+        https://bugs.webkit.org/show_bug.cgi?id=58588
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue fails to catch IOError when results.html is missing
+        https://bugs.webkit.org/show_bug.cgi?id=58589
+
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+
+2011-04-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix for Mac installation script.
+
+        * wx/packaging/build-mac-installer.py:
+
+2011-04-14  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        sort columns in the new json_results.html file
+        https://bugs.webkit.org/show_bug.cgi?id=58581
+
+        Also fix padding on TDs and the path to layout tests.
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html:
+
+2011-04-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        queues.webkit.org should display when a bot last passed a patch
+        https://bugs.webkit.org/show_bug.cgi?id=58546
+
+        I am suspicious that some of our commit-queue instances are never
+        actually passing anything.
+
+        This will let us know if those bots are never passing patches.
+
+        * QueueStatusServer/handlers/queuestatus.py:
+        * QueueStatusServer/index.yaml:
+        * QueueStatusServer/templates/queuestatus.html:
+
+2011-04-14  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r83764): webkitpy.layout_tests.port.chromium_win_unittest.ChromiumWinTest.test_default_worker_model fails on apple-windows-13
+        https://bugs.webkit.org/show_bug.cgi?id=58545
+
+        Remove platform-specific overrides; the default behavior should
+        be working everywhere now, I think.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+
+2011-04-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queues are hitting an exception trying to land when the tree is red
+        https://bugs.webkit.org/show_bug.cgi?id=58558
+
+        Just an un-tested (and thus broken) code path from yesterday's changes.
+
+        * Scripts/webkitpy/common/net/layouttestresults.py:
+        * Scripts/webkitpy/common/net/layouttestresults_unittest.py:
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+
+2011-04-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fixes for wxMSW and wx 2.9.1.1.
+
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::shadowRoot):
+        * wx/build/wxpresets.py:
+
+2011-04-14  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Failing GPU video tests
+        https://bugs.webkit.org/show_bug.cgi?id=57926
+
+        Added/updated GPU directory names for rebaseline tool.
+
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+
+2011-04-13  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Barth.
+
+        Perl unit test removeEOL.pl should print test case name on failure
+        https://bugs.webkit.org/show_bug.cgi?id=58513
+
+        * Scripts/webkitperl/VCSUtils_unittest/removeEOL.pl: Pass $title as
+          second argument of Test::Simple::ok().
+
+2011-04-13  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        gdb-safari should pass arguments to safari.
+        https://bugs.webkit.org/show_bug.cgi?id=58439
+
+        We can do:
+          gdb-safari --debug LayoutTests/.../foo.html
+
+        * Scripts/gdb-safari: Passing @ARGV to Safari via gdb --arg.
+
+2011-04-13  Dirk Pranke  <dpranke@chromium.org>
+
+        Unreviewed, build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=52763
+
+        r83799 broke test-webkitpy because it assumed we always have
+        access to a real filesystem (we don't during the unit tests).
+        Stubbing out the copy for now but we might need a better
+        solution at some point.
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-13  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        new-run-webkit-tests --run-singly option is busted
+        https://bugs.webkit.org/show_bug.cgi?id=55909
+
+        Python's broken lexical scoping strikes again :(.
+
+        * Scripts/webkitpy/layout_tests/layout_package/worker_mixin.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-04-13  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        generated unexpected_results.html from unexpected_results.json
+        https://bugs.webkit.org/show_bug.cgi?id=52763
+
+        Eventually, we'll merge this with results.html and have a single richer results page.
+        For now, I just want to get something checked in that we can iterate on.
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_results.html: Added.
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+
+2011-04-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Up the failure limit to allow the commit-queue to actually land when the tree is red
+        https://bugs.webkit.org/show_bug.cgi?id=58499
+
+        This change increases the --exit-after-N-failures limit used by the commit-queue
+        from 1 to 10.  This will cause the code added in bug 58494 to actually get
+        exercised and the queues should start being able to land when the trees are red.
+
+        When testing I found that test_runtests_leopard_commit_queue_hack_command was the
+        only unit test to actually detect this change!  Since we don't actually
+        run on leopard anymore, I removed the hack code and repurposed the test.
+
+        * Scripts/webkitpy/tool/bot/commitqueuetask.py:
+        * Scripts/webkitpy/tool/steps/runtests.py:
+        * Scripts/webkitpy/tool/steps/steps_unittest.py:
+
+2011-04-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue should be able to land when tree is red
+        https://bugs.webkit.org/show_bug.cgi?id=58494
+
+        There is some yak hair on my hands, I will admit.
+
+        This change is mostly about adding an ExpectedFailures
+        class to track when the bots are red and we should be
+        ignoring failures when landing from the commit-queue.
+
+        However, to make intelligent decisions about patches we
+        need to know whether the run hit the --exit-after-N-failures limit
+        or not.  Right now that information is not saved off in results.html
+        so we have to pull the information from RunTests.
+
+        I've plumbed the --exit-after-N-failures information into
+        LayoutTestResults for now to make the ExpectedFailures code cleaner.
+
+        As a result of adding all these additional calls to delegate.layout_test_results()
+        I broke some of our flaky test detection tests and had to re-write them
+        to not depend on the number of layout_test_results code.
+
+        At the same time I updated the commit-queue to use the newer filesystem
+        API (to allow us to use MockFileSystem) which required further changes
+        to the layout tests.  Changes were required in either case, since
+        we're now calling layout_test_results() in more cases, which previously
+        would try and hit the disk (until I moved it to use tool.filesystem).
+
+        I should note that *all* of this code is disabled for now, since our
+        --exit-after-N-failures limit is currently 1!  (Thus were always in the
+        case where we can't actually tell if the layout test results are legit.)
+        I will up that limit in a second patch (which may require a couple more unit test tweaks).
+
+        * Scripts/webkitpy/common/net/layouttestresults.py:
+        * Scripts/webkitpy/tool/bot/commitqueuetask.py:
+        * Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py:
+        * Scripts/webkitpy/tool/bot/expectedfailures.py: Added.
+        * Scripts/webkitpy/tool/bot/expectedfailures_unittest.py: Added.
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        * Scripts/webkitpy/tool/commands/queuestest.py:
+        * Scripts/webkitpy/tool/steps/runtests.py:
+
+2011-04-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        * TestWebKitAPI/PlatformWebView.h: Limit include of
+          <CoreGraphics/CGGeometry> to PLATFORM(CG) users.
+
+2011-04-13  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [NRWT] Rename --baseline-search-patch to --additional-platform-directory to match ORWT
+        https://bugs.webkit.org/show_bug.cgi?id=58489
+        
+        r83743 added --additional-platform-directory to old-run-webkit-tests,
+        rename the equivalent flag in new-run-webkit-tests to be consistent.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-04-13  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Rebaseline queue server
+        https://bugs.webkit.org/show_bug.cgi?id=57891
+
+        Adds a simple rebaseline queue server (meant to run at
+        http://rebaseline-queue.appspot.com/). It presents a list of all (NRWT)
+        builders and their failing tests, and allows those tests to be added to
+        a per-builer rebaseline queue.
+
+        A subsequent change will add a mode to NRWT (and/or a wrapper script)
+        for pulling the tests to be rebaselined from the server and running them
+        with --reset-results (the initial use-case is for the GPU hardware bots,
+        which do not have checked-in baselines, therefore there is no need for a
+        check-in step yet).
+
+        * RebaselineQueueServer/app.yaml: Added.
+        * RebaselineQueueServer/handlers/__init__.py: Added.
+        * RebaselineQueueServer/handlers/builderqueue.py: Added.
+        * RebaselineQueueServer/handlers/pages.py: Added.
+        * RebaselineQueueServer/index.yaml: Added.
+        * RebaselineQueueServer/main.py: Added.
+        * RebaselineQueueServer/model/__init__.py: Added.
+        * RebaselineQueueServer/model/queueentry.py: Added.
+        * RebaselineQueueServer/static/builder-frame-empty.html: Added.
+        * RebaselineQueueServer/static/styles.css: Added.
+        * RebaselineQueueServer/templates/builder-picker.html: Added.
+        * RebaselineQueueServer/templates/builder-queue-edit.html: Added.
+        * RebaselineQueueServer/templates/builder-queue-list.html: Added.
+        * RebaselineQueueServer/templates/home.html: Added.
+
+2011-04-13  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        nrwt: enable multiple processes by default on Chromium Win.
+        https://bugs.webkit.org/show_bug.cgi?id=55163
+
+        Re-land r79268; it should be more stable now and will hopefully
+        work.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py:
+
+2011-04-13  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        new-run-webkit-tests: configure logging in child processes properly
+        https://bugs.webkit.org/show_bug.cgi?id=58296
+
+        Logging propagated properly from manager to worker processes on
+        Unix but not on Windows; this fixes that.
+
+        * Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker.py:
+        * Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker_unittest.py:
+
+2011-04-13  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        new-run-webkit-tests: suppress extraneous pretty patch warnings
+        https://bugs.webkit.org/show_bug.cgi?id=58295
+
+        NRWT wasn't being careful about when it logged messages from
+        PrettyPatch not being available; it should only log during
+        check_build(), and be silent otherwise. This was causing us to
+        get multiple errors at runtime, which was confusing.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+
+2011-04-13  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Jian Li.
+
+        add chromium-linux-x86_64 to rebaseline-chromium-webkit-tests
+        https://bugs.webkit.org/show_bug.cgi?id=58461
+
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+
+2011-04-13  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, fix NRWT.  Stack:
+
+            return super(ChromiumPort, self).results_directory(self)
+        TypeError: results_directory() takes exactly 1 argument (2 given)
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+
+2011-04-13  Adam Roben  <aroben@apple.com>
+
+        Teach ORWT about extra platform-specific directories to be searched before the default ones
+
+        Fixes <http://webkit.org/b/58446> ORWT needs a way to look in a user-specified directory for
+        platform-specific results
+
+        Reviewed by Anders Carlsson.
+
+        * Scripts/old-run-webkit-tests:
+        (top-level): Added @additionalPlatformDirectories and hooked up
+        --additional-platform-directories to populate it.
+        (buildPlatformResultHierarchy): Prepend the additional platform directories to the default
+        list (after filtering out any of the additional directories that don't exist).
+
+2011-04-13  Lucas Forschler  <lforschler@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add the /T command to taskkill.exe.
+        This will kill spawned child processes.
+        
+        * BuildSlaveSupport/win/kill-old-processes:
+
+2011-04-13  Lucas Forschler  <lforschler@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Sort kill list alphabeticaly.
+        Fixed capitalization on VcBuildHelper.  
+
+        * BuildSlaveSupport/win/kill-old-processes:
+
+2011-04-13  Lucas Forschler  <lforschler@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58384
+        Update kill-old-processes to include a few new ones.
+        
+        * BuildSlaveSupport/win/kill-old-processes:
+
+2011-04-13  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] PluginPackage should check whether a plugin mixes GTK+ 2 and 3 symbols itself
+        https://bugs.webkit.org/show_bug.cgi?id=58297
+
+        Do not disable flash specifically when built with GTK+ 3 -
+        PluginPackage should do the right thing while loading plugins.
+
+        * GtkLauncher/main.c:
+        (main):
+
+2011-04-12  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add WebSettings::setValidationMessageTimerMagnification()
+        https://bugs.webkit.org/show_bug.cgi?id=57426
+
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::applyTo): Disable the validation message timer.
+
+2011-04-12  James Kozianski  <koz@chromium.org>
+
+        Unreviewed.
+
+        Adding myself to committers.py.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2011-04-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction for WinCairo bot after r83639.
+        https://bugs.webkit.org/show_bug.cgi?id=51790
+
+        Correct typo for the new "update-webkit-wincairo-libs" script.
+
+        * Scripts/build-webkit: Incorrectly calling the
+          update-webkit-cairo-libs which does not exist.
+
+2011-04-12  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        A change that should have been part of http://trac.webkit.org/changeset/83628
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues): Setting should be off for most tests. Reset to false.
+
+2011-04-12  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        new-run-webkit-tests: --results-directory is relative to builddir, not $PWD
+        https://bugs.webkit.org/show_bug.cgi?id=58272
+
+        NRWT was interpreting the --results-directory cmd line arg as
+        relative to the build directory, not the current working
+        directory (ORWT uses the latter, which is much more intuitive).
+        
+        This patch fixes the base case, but includes an override for
+        Chromium that is needed until the bots can be updated.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2011-04-12  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, roll out r83621 as it broke the GTK build.
+
+        [GTK] arguments passed to build-jsc and build-webkit scripts are not taken into account
+        https://bugs.webkit.org/show_bug.cgi?id=58333
+
+        * Scripts/build-jsc:
+        * Scripts/build-webkit:
+
+2011-04-12  Carl Lobo  <carllobo@gmail.com> and Brent Fulgham <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Patch to download the WinCairo dependancies as part of build-webkit.
+        https://bugs.webkit.org/show_bug.cgi?id=51790
+
+        This patch downloads the dependancies from 
+            http://idisk.mac.com/bfulgham-Public/WinCairoRequirements.zip 
+        checking the modification timestamp etc. 
+
+        * Tools/Scripts/build-webkit
+        * Tools/Scripts/update-webkit: Modified to understand the --wincairo
+          flag, and to update WinCairo dependencies when used.
+        * Tools/Scripts/update-webkit-cairo-libs: added
+        * Tools/Scripts/update-webkit-dependency: added
+        * Tools/Scripts/update-webkit-auxiliary-libs
+
+2011-04-12  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Pressing Tab in Web Inspector's console does not cycle through completion options
+        https://bugs.webkit.org/show_bug.cgi?id=56020
+
+        Don't call TranslateMessage() in the MiniBrowser or TestWebKitAPI for key messages destined for a WebKit2 view,
+        since WebKit will do this for us.  If we didn't do this, TranslateMessage() would be called twice,
+        which would generate two characters for every keypress (for example).  I didn't bother doing this for
+        WebKitTestRunner, since it doesn't get any WM_KEYDOWN events.
+        
+        Add new WebKit2/TranslateMessageGeneratesWMChar test to test expected TranslateMessage() behavior.
+
+        * MiniBrowser/win/main.cpp:
+        (shouldTranslateMessage): Added.
+        (_tWinMain): Don't call TranslateMessage() unless shouldTranslateMessage() says to.
+        * TestWebKitAPI/PlatformUtilities.h: Added shouldTranslateMessage() on Windows.
+        * TestWebKitAPI/PlatformWebView.h: Added simulateAKeyDown().
+        * TestWebKitAPI/Tests/WebKit2/win/TranslateMessageGeneratesWMChar.cpp: Added.
+        (TestWebKitAPI::didNotHandleKeyEventCallback): Added.
+        (TestWebKitAPI::runAndWatchForWMChar): Added.
+        (TestWebKitAPI::TEST): Added.
+        * TestWebKitAPI/win/PlatformUtilitiesWin.cpp:
+        (TestWebKitAPI::Util::run): Don't call TranslateMessage() unless shouldTranslateMessage() says to.
+        (TestWebKitAPI::Util::shouldTranslateMessage): Added.
+        * TestWebKitAPI/win/PlatformWebViewWin.cpp:
+        (TestWebKitAPI::PlatformWebView::simulateAKeyDown): Added.
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj: Added TranslateMessageGeneratesWMChar.cpp.
+
+2011-04-12  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        new-run-webkit-tests: update code to use port.results_directory() instead of options.results_directory
+        https://bugs.webkit.org/show_bug.cgi?id=58290
+
+        This is some preliminary refactoring for bug 58272.
+
+        * Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_runner.py:
+        * Scripts/webkitpy/layout_tests/layout_package/worker_mixin.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2011-04-12  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        webkitpy: fix mock_filesystem abspath to handle relative paths
+        and add filesystem.chdir() and filesystem.getcwd() to be able
+        to test this and mock it out.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58288
+
+        * Scripts/webkitpy/common/system/filesystem.py:
+        * Scripts/webkitpy/common/system/filesystem_mock.py:
+        * Scripts/webkitpy/common/system/filesystem_unittest.py:
+
+2011-04-12  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58292
+        Provide new setting to allow site icon loading despite disabling automatic image loading in general.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues): Setting should be off for most tests. Reset to false.
+
+2011-04-12  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Enable JIT build for SH4 platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=58317
+
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * QtTestBrowser/QtTestBrowser.pro:
+        * Scripts/webkitdirs.pm:
+
+2011-04-12  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] embed checksums in PNGs written by Qt-DRT
+        https://bugs.webkit.org/show_bug.cgi?id=58173
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::dump):
+
+2011-04-12  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue should upload failure diffs when tests fail
+        https://bugs.webkit.org/show_bug.cgi?id=58348
+
+        This change was mostly just plumbing.  We were already saving
+        this information for flaky test reporting.  I just made it possible
+        for normal failures to report archives as well.
+
+        I did a little abstraction work to try and share some code between
+        flakytestreporter.py and this new code.  There is still more we could do.
+
+        In making this change I also went through and updated the various
+        places we have urls hard-coded in our python and pointed them at
+        common.config.urls.
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla.py:
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py:
+        * Scripts/webkitpy/common/net/statusserver.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/tool/bot/botinfo.py: Added.
+        * Scripts/webkitpy/tool/bot/botinfo_unittest.py: Added.
+        * Scripts/webkitpy/tool/bot/commitqueuetask.py:
+        * Scripts/webkitpy/tool/bot/flakytestreporter.py:
+        * Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py:
+        * Scripts/webkitpy/tool/commands/queues.py:
+
+2011-04-12  Daniel Bates  <dbates@rim.com>
+
+        Rubber-stamped by Eric Seidel.
+
+        svn-apply and/or patch(1) has trouble applying patches that makes changes to files
+        with Windows line endings
+        https://bugs.webkit.org/show_bug.cgi?id=53625
+
+        Fixes an issue where a patch made on a SCM checkout on a Unix file system cannot be
+        applied to an SCM checkout on a Windows file system and vice-versa.
+
+        This issue manifests itself due to custom SCM settings as well as differences in
+        gitattributes support in older versions of Git (e.g. 1.7.0.3). We implement support
+        into svn-apply/unapply to compensate for differences in line endings by converting
+        the line endings in a patch to match the line endings in the target file (if it exists).
+
+        * Scripts/VCSUtils.pm:
+          - Added parseFirstEOL(), which returns the first end-of-line character(s) that appear in the
+            content read from the specified file handle. Obviously, this heuristic will not work
+            for files with mixed line endings, but I don't envision such files to be the norm. If
+            this turns out to be an issue then we can improve the heuristic.
+          - Added firstEOLInFile().
+          - Modified parsePatch() and parseDiff() to take an optional hash reference to an options hash.
+            In particular, added the hash key shouldNotUseIndexPathEOL to control whether to use the line
+            endings in the diff instead of the line endings in the target file.
+          - Extracted local variable $chunkRangeRegEx from fixChangeLogPatch() so that it can be
+            re-used in parseDiff().
+        * Scripts/webkitperl/VCSUtils_unittest/parseDiff.pl: Modified to pass {shouldNotUseIndexPathEOL => 1}
+          to parsePatch() since these unit tests don't create mock files. Instead, created unit tests that use
+          mock files in file VCSUtils_unittest/parseDiffWithMockFiles.pl.
+        * Scripts/webkitperl/VCSUtils_unittest/parseDiffWithMockFiles.pl: Added.
+        * Scripts/webkitperl/VCSUtils_unittest/parseFirstEOL.pl: Added.
+
+2011-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r83550): Multiple http tests crashing in the web process in SQLite beneath CFNetwork on Windows 7 Release (WebKit2 Tests)
+        https://bugs.webkit.org/show_bug.cgi?id=58336
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues):
+        Remove cache clearing as that is causing tests to crash on Windows 7.
+
+2011-04-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION(r77974): http/tests/security/aboutBlank/security-context-window-open.html is failing
+        <rdar://problem/8981346>
+        https://bugs.webkit.org/show_bug.cgi?id=54159
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::InjectedBundlePage):
+        (WTR::InjectedBundlePage::decidePolicyForNavigationAction):
+        (WTR::InjectedBundlePage::decidePolicyForNewWindowAction):
+        (WTR::InjectedBundlePage::decidePolicyForResponse):
+        (WTR::InjectedBundlePage::unableToImplementPolicy):
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.h:
+        Add short-circuited policy client which matches WebKit1.
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues):
+        Clear the cache between tests to ensure consistent results.
+
+2011-04-11  George Guo  <George.Guo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        prepare-ChangeLog support email input but -h did not show the option
+        https://bugs.webkit.org/show_bug.cgi?id=58164
+
+        Add email option to -h to improve the usability
+
+        * Scripts/prepare-ChangeLog:
+
+2011-04-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Rename MediaControls to MediaControlRootElement.
+        https://bugs.webkit.org/show_bug.cgi?id=58250
+
+        * Scripts/do-webcore-rename: Documented the renaming.
+
+2011-04-11  Sam Weinig  <sam@webkit.org>
+
+        Fix Windows build.
+
+        * MiniBrowser/win/BrowserView.cpp:
+        (BrowserView::create):
+
+2011-04-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move focus management out of WebKit via  the UIClient
+        <rdar://problem/8784068>
+        https://bugs.webkit.org/show_bug.cgi?id=58278
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (-[BrowserWindowController awakeFromNib]):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::createOtherPage):
+        (WTR::TestController::initialize):
+        Add stubs for new UIClient functions.
+
+2011-02-03  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] The GTK+ DRT needs an implementation of the PlainTextController
+        https://bugs.webkit.org/show_bug.cgi?id=53605
+
+        Add an implementation of the PlainTextController for the GTK+ DRT.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (addControllerToWindow): Added this helper method.
+        (webViewWindowObjectCleared): Use the new helper to add EventSender
+        and the PlainTextController to the window object.
+        * GNUmakefile.am: Added PlainTextController source files.
+        * DumpRenderTree/gtk/PlainTextController.cpp: Added. This will rely
+        on DumpRenderTreeSupportGtk to convert a JSValueRef into a WebKitDOMRange
+        until that functionality exists somewhere in the WebKitGTK+ stack.
+        * DumpRenderTree/gtk/PlainTextController.h: Added.
+
+2011-04-11  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed.
+
+        Adding my IRC nick.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2011-04-11  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        new-run-webkit-tests: fix crash when running under windows cmd.exe
+        https://bugs.webkit.org/show_bug.cgi?id=58197
+
+        We would intermittently crash when running NRWT directly under
+        cmd.exe on windows because we were sharing the stdin file
+        descriptor between the python process and the http server.
+        cmd.exe really didn't like that, and there was no reason to
+        share the descriptor, so we now use a PIPE instead.
+
+        * Scripts/webkitpy/layout_tests/port/http_server.py:
+
+2011-04-11  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        new-run-webkit-tests: add unit tests for Port.diff_image()
+        https://bugs.webkit.org/show_bug.cgi?id=58196
+
+        Add the unit tests for the fix in bug 58195.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        * Scripts/webkitpy/layout_tests/port/webkit_unittest.py:
+
+2011-04-11  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        new-run-webkit-tests: implement support for audio, take two
+        https://bugs.webkit.org/show_bug.cgi?id=58195
+
+        Attempt to re-land the fix for bug 58101 (which was initially
+        landed in r83330, but rolled out). This is the same patch but
+        fixes crashes in Port.diff_image() caused by the change for
+        empty image files being None instead of ''.
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_layout_results_generator.py:
+        * Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_expectations.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_failures.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/dryrun.py:
+        * Scripts/webkitpy/layout_tests/port/mock_drt.py:
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+
+2011-04-11  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Implement AccessibilityUIElement::{row|column}IndexRange in DRT
+        https://bugs.webkit.org/show_bug.cgi?id=57854
+
+        Implement missing features in GTK's DRT.
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (indexRangeInTable): New helper function to get the range string
+        for the current cell inside the parent table, either from the
+        point of view of rows or columns.
+        (AccessibilityUIElement::rowIndexRange): Implemented by relying on
+        the new helper function indexRangeInTable().
+        (AccessibilityUIElement::columnIndexRange): Ditto.
+
+2011-04-11  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [GTK] Implement AccessibilityUIElement::cellForColumnAndRow in DRT
+        https://bugs.webkit.org/show_bug.cgi?id=57826
+
+        Implement missing feature in GTK's DRT.
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::cellForColumnAndRow): Implemented, by
+        relying on the analogous function from the AtkTable interface.
+
+2011-04-05  Timothy Hatcher  <timothy@apple.com>
+
+        Fix the extract-localizable-strings script errors that started after
+        WEB_UI_STRING was added to LocalizedStrings.h in WebCore.
+
+        * Scripts/extract-localizable-strings: Skip LocalizedStrings.h.
+
+2011-04-11  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        fix crc computation on 64 bit machines
+        https://bugs.webkit.org/show_bug.cgi?id=58243
+
+        unsigned long is dependenct on CPU architecture, so use unsigned which is always 32 bits
+
+        * DumpRenderTree/CyclicRedundancyCheck.cpp:
+        (makeCrcTable):
+        (computeCrc):
+        * DumpRenderTree/CyclicRedundancyCheck.h:
+        * DumpRenderTree/PixelDumpSupport.cpp:
+        (appendIntToVector):
+        (convertChecksumToPNGComment):
+
+2011-04-10  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Require no undefined symbols during compilation.
+
+        [Qt] [WK2] WebKitTestRunner, QtWebProcess and WTRInjectBundle should fail to compile when there's undefined symbols
+        https://bugs.webkit.org/show_bug.cgi?id=54896
+
+        Add -Wl,--no-undefined to catch missing symbols early.
+
+        * WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro:
+        * WebKitTestRunner/qt/WebKitTestRunner.pro:
+
+2011-04-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Remove collector dirs from the list of build dirs.
+
+        * wx/build/settings.py:
+
+2011-04-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Add Source/JavaScriptCore/heap to the list of directories.
+
+        * wx/build/settings.py:
+
+2011-04-10  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION(r83384): Change to chromium.py is resulting in failures of the test framework on linux.
+        https://bugs.webkit.org/show_bug.cgi?id=58201
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py: Commented out the assert for now,
+        and filed bug 58202.
+
+2011-04-09  David Levin  <levin@chromium.org>
+
+        Unreviewed, rolling out r83394.
+        http://trac.webkit.org/changeset/83394
+        https://bugs.webkit.org/show_bug.cgi?id=53625
+
+        Patch was incorrect as noted in the bug.
+
+        * Scripts/svn-apply:
+
+2011-04-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        svn-apply and/or patch(1) has trouble applying patches that makes changes to files with Windows line endings
+        https://bugs.webkit.org/show_bug.cgi?id=53625
+
+        * Scripts/svn-apply: Ensure that the portions of patches
+        which are for vcproj/vsprops files has DOS line endings.
+
+2011-04-09  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        It looks like NRWT has not been stopping DRT/TestShell
+        instances properly on windows, probably for a long time.
+        This would go a long way to explaining why we often have
+        processes lying around :)
+
+        https://bugs.webkit.org/show_bug.cgi?id=57807
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+
+2011-04-09  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Don't link against fontconfig or X11 if embedded
+        https://bugs.webkit.org/show_bug.cgi?id=58104
+
+        * DumpRenderTree/qt/DumpRenderTree.pro: fontconfig !included in embedded
+        * QtTestBrowser/QtTestBrowser.pro: ditto
+        * WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro: ditto
+        * WebKitTestRunner/qt/WebKitTestRunner.pro: ditto
+
+2011-04-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        http/tests/loading/preload-append-scan.php is failing on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=58178
+
+        Reviewed by Brian Weinstein.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (lastPathComponent):
+        Use CFURL API to find the last path component, rather than
+        PathFindFileName(), because the latter will include the query string.
+
+2011-04-08  Jian Li  <jianli@chromium.org>
+
+        Unreviewed, rolling out r83327, r83330 since these patches are very
+        likely to break chromium webkit mac10.6 builders.
+
+        * Scripts/webkitpy/layout_tests/layout_package/json_layout_results_generator.py:
+        * Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_expectations.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_failures.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/dryrun.py:
+        * Scripts/webkitpy/layout_tests/port/mock_drt.py:
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+
+2011-04-08  Vincent Scheib  <scheib@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        add chromium-gpu-linux-x86_64 to the recognized list of ports
+        https://bugs.webkit.org/show_bug.cgi?id=58099
+
+        Add chromium-gpu-linux-x86_64 to fix assert.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_linux.py:
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * Scripts/build-webkit:
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * Scripts/build-webkit:
+
+2011-04-08  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        new-run-webkit-tests: configure a NRWT test bot for Mac SL
+        https://bugs.webkit.org/show_bug.cgi?id=58114
+
+        This change removes the old new-run-webkit-tests entry and
+        updates it for a new test-only bot.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+
+2011-04-08  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Roben.
+
+        Make layoutTestController.shadowRoot return null, not undefined,
+        when its argument is invalid.
+        https://bugs.webkit.org/show_bug.cgi?id=58121
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::shadowRoot):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::shadowRoot):
+
+2011-04-08  Pere Martir  <pere.martir4@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Locate NSTD.EXE in 64-bit Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57847
+
+        * Scripts/old-run-webkit-tests:
+
+2011-04-08  Adam Roben  <aroben@apple.com>
+
+        Qt build fix
+
+        * DumpRenderTree/TestNetscapePlugIn/PluginObject.h: Pull in stdarg.h for va_list.
+
+2011-04-07  Adam Roben  <aroben@apple.com>
+
+        Test that NPP_SetWindow is passed a null window handle during plugin destruction on non-Mac platforms
+
+        Test for <http://webkit.org/b/47009> WebKit2 needs to call NPP_SetWindow when destroying a
+        plugin
+
+        Reviewed by Anders Carlsson.
+
+        * DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp:
+        (pluginLogWithArguments): Moved code to format and log the message here...
+        (pluginLog): ...from here.
+
+        * DumpRenderTree/TestNetscapePlugIn/PluginObject.h: Added pluginLogWithArguments.
+
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
+        (PluginTest::log): Added. Calls through to pluginLogWithArguments.
+
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.h: Added log.
+
+        * DumpRenderTree/TestNetscapePlugIn/Tests/NPPSetWindowCalledDuringDestruction.cpp: Added.
+        (NPPSetWindowCalledDuringDestruction::setWillBeDestroyed): Records that destruction is about
+        to begin.
+        (NPPSetWindowCalledDuringDestruction::NPPSetWindowCalledDuringDestruction): Simple
+        constructor.
+        (NPPSetWindowCalledDuringDestruction::NPP_GetValue): Creates and returns a ScriptObject that
+        can be used to invoke our setWillBeDestroyed function.
+        (NPPSetWindowCalledDuringDestruction::NPP_SetWindow): Records what has happened (and logs if
+        anything unexpected happens).
+        (NPPSetWindowCalledDuringDestruction::NPP_Destroy): On Mac, logs a failure message if
+        NPP_SetWindow was called during destruction. On other platforms, logs a failure message if
+        NPP_SetWindow was *not* called during destruction.
+        (NPPSetWindowCalledDuringDestruction::ScriptObject::hasMethod): Return true for our only
+        method, setWillBeDestroyed.
+        (NPPSetWindowCalledDuringDestruction::ScriptObject::invoke): Call through to the PluginTest
+        object.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
+        * GNUmakefile.am:
+        Added new test.
+
+        * Scripts/old-run-webkit-tests: Skip the new test when using out-of-process plugins with
+        WebKit1 on Mac, since it can't work properly due to <http://webkit.org/b/58077>.
+
+2011-04-08  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement increment() and decrement() functions in DRT's AccessibilityUIElement
+        https://bugs.webkit.org/show_bug.cgi?id=58039
+
+        Implement missing functions in GTK's DRT.
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::increment): Implemented.
+        (AccessibilityUIElement::decrement): Implemented.
+
+2011-04-08  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Make WK2 layoutTestController.shadowRoot return undefined, not
+        null, when its argument is not an element.
+        https://bugs.webkit.org/show_bug.cgi?id=58121
+
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::shadowRoot):
+
+2011-04-07  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        Change reference port for Mac GPU baselines from
+        Leopard to SnowLeopard, XP to Win7, and Linux-x86
+        to Linux x86-64.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58099
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * Scripts/build-webkit:
+
+2011-04-07  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        update DRT to embed checksums in png files
+        https://bugs.webkit.org/show_bug.cgi?id=57871
+
+        We insert the bytes for the comment in printPNG rather than at encode
+        time because each platform does its own PNG encoding (either using CG
+        or cairo).  Putting this in pringPNG avoids having to duplicate this
+        code, although it's not as clean as doing it at encoding time.
+
+        We insert the comment right after the IHDR chunk of the PNG.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/CyclicRedundancyCheck.cpp: Added.
+        (makeCrcTable): Ported from LayoutTests/fast/canvas/webgl/resources/pnglib.js
+        (computeCrc): Ported from LayoutTests/fast/canvas/webgl/resources/pnglib.js
+        * DumpRenderTree/CyclicRedundancyCheck.h: Added.
+        * DumpRenderTree/PixelDumpSupport.cpp:
+        (dumpWebViewAsPixelsAndCompareWithExpected):
+        (convertChecksumToPNGComment): Generate the bytes to insert.
+        (printPNG): Insert the png comment before the first IDAT section.
+        * DumpRenderTree/PixelDumpSupport.h:
+        * DumpRenderTree/cairo/PixelDumpSupportCairo.cpp:
+        (printPNG):
+        (dumpBitmap):
+        * DumpRenderTree/cg/PixelDumpSupportCG.cpp:
+        (printPNG):
+        (dumpBitmap):
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        * GNUmakefile.am:
+
+2011-04-07  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Replace WKStringGetCharactersPtr() with WKStringGetCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=58058
+
+        * TestWebKitAPI/Tests/WebKit2/WKString.cpp:
+        (TestWebKitAPI::TEST): Add tests for  WKStringGetLength() and WKStringGetCharactersPtr().
+
+2011-04-07  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.isPageBoxVisible
+        https://bugs.webkit.org/show_bug.cgi?id=42695
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::isPageBoxVisible):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+
+2011-04-07  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg: Added a missing import.
+
+2011-04-07  Adam Roben  <aroben@apple.com>
+
+        Move ExtractTestResults[AndLeaks]'s summarizing code back from commandComplete() to finished()
+
+        commandComplete() is never called for MasterShellCommands like ExtractTestResults[AndLeaks].
+        (Unfortunately the buildbot documentation does not make this clear.) finished() is the only
+        hook we have, so we have to do our work there. I added a new addCustomURLs method which can
+        be overridden by subclasses to provide extra URLs before we call up to the base class (after
+        which adding more URLs is no longer possible).
+
+        Really hopefully fixes <http://webkit.org/b/56032> Leaks viewer should be linked from leaks
+        bot results page
+
+        Reviewed by John Sullivan.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (ExtractTestResults.addCustomURLs): Moved code to add the "view results" URL here...
+        (ExtractTestResults.finished): ...from here. This replaces commandComplete, since that
+        method is never called for MasterShellCommands.
+        (ExtractTestResultsAndLeaks.addCustomURLs): Replaced commandComplete (which is never called)
+        with this method (which is).
+
+2011-04-07  Adam Roben  <aroben@apple.com>
+
+        Move ExtractTestResults[AndLeaks]'s summarizing code from finished() to commandComplete()
+
+        This matches how most of our other build steps work, so is good just for improving
+        consistency between build steps. It should also make it possible for
+        ExtractTestResultsAndLeaks to successfully add a URL to Leaks Viewer. (Previously we were
+        trying to do this in finished() after we had called up to the base class, but that was
+        apparently too late to add more URLs.)
+
+        Hopefully fixes <http://webkit.org/b/56032> Leaks viewer should be linked from leaks bot
+        results page
+
+        Reviewed by John Sullivan.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (ExtractTestResults): Added a descriptionDone property so that we don't have to manually
+        call setText to get the right text to show up for this step. This matches how most of our
+        other build steps work.
+        (ExtractTestResults.commandComplete): Replaced our override of finished with this function.
+        This is how most of our other build steps work.
+        (ExtractTestResultsAndLeaks.commandComplete): Replaced our override of finished with this
+        function, to match the base class.
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        webkit-patch shouldn't state the whole working copy when calling check-webkit-style
+        https://bugs.webkit.org/show_bug.cgi?id=58022
+
+        Previously, we were ignoring the args variable!  This patch fixes the
+        regression introduced in http://trac.webkit.org/changeset/82771.
+
+        * Scripts/webkitpy/tool/commands/download_unittest.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+        * Scripts/webkitpy/tool/steps/checkstyle.py:
+
+2011-04-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION: "webkit-patch land" doesn't work correctly in SVN subdirectories
+        https://bugs.webkit.org/show_bug.cgi?id=58017
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/common/checkout/scm_unittest.py:
+
+2011-04-06  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.pageSizeAndMarginsInPixels
+        https://bugs.webkit.org/show_bug.cgi?id=57984
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::pageSizeAndMarginsInPixels):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+
+2011-04-06  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Tony Chang.
+
+        Add web audio support to DumpRenderTree (mac port)
+        https://bugs.webkit.org/show_bug.cgi?id=57969
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (setEncodedAudioDataCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        (LayoutTestController::dumpAsAudio):
+        (LayoutTestController::setDumpAsAudio):
+        (LayoutTestController::encodedAudioData):
+        (LayoutTestController::setEncodedAudioData):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (dumpAudio):
+        (dump):
+
+2011-04-06  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] LayoutTestController needs to implement numberOfPendingGeolocationPermissionRequests
+        https://bugs.webkit.org/show_bug.cgi?id=56086
+
+        Add the missing method.
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::getAllPages): Add a method to return all the pages allocated for the current test.
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::numberOfPendingGeolocationPermissionRequests):
+
+2011-04-06  Dai Mikurube  <dmikurube@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add QUOTA build flag for unified quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57918
+
+        * Scripts/build-webkit: Added QUOTA build flag
+
+2011-04-06  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Adjust the apple webkit port's default timeout to match
+        old-run-webkit-tests at 35 seconds.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37738
+
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+
+2011-04-06  Scott Cameron  <sccameron@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Remove global variable $httpdPath and replace with the return value of
+        getHTTPDPath().  Also remove unnecessary calls to getHTTPDPath().
+        https://bugs.webkit.org/show_bug.cgi?id=53499
+
+        * Scripts/run-iexploder-tests:
+        * Scripts/webkitperl/httpd.pm:
+
+2011-04-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Make sure JS_EXPORT_PRIVATE is an empty define when we aren't using the export macros.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+        
+        * DumpRenderTree/config.h:
+        * WebKitAPITest/config.h:
+        * WebKitTestRunner/config.h:
+
+2011-04-06  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        teach run-webkit-tests to read checksums from png files
+        https://bugs.webkit.org/show_bug.cgi?id=57993
+
+        * Scripts/old-run-webkit-tests: Read the first 2k of a .png if there's
+          no .checksum and look for the checksum in there.
+
+2011-04-06  David Dorwin  <ddorwin@chromium.org>
+
+        Reviewed by David Levin.
+
+        Enable fullscreen layout tests for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=55726
+
+        Make DumpRenderTree always run with fullscreen enabled (equivalent of --enable-fullscreen).
+
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::applyTo):
+
+2011-04-06  Adam Roben  <aroben@apple.com>
+
+        Add a "view leaks" link to builds on SnowLeopard Intel Leaks
+
+        Fixes <http://webkit.org/b/56032> Leaks viewer should be linked from leaks bot results page
+
+        Reviewed by David Kilzer.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (ExtractTestResults.resultDirectoryURL): Added. Moved code to calculate the URL for the
+        build's results directory here...
+        (ExtractTestResults.finished): ...from here.
+        (ExtractTestResultsAndLeaks): New class that's used by the leaks builder
+        (ExtractTestResultsAndLeaks.finished): Calls up to the base class, but also adds a "view
+        leaks" link to point to Leaks Viewer for this build.
+        (TestFactory): Added ExtractTestResultsClass abstraction. This isn't overridden anywhere,
+        but it seemed good to add for consistency with BuildAndTestFactory.
+        (BuildAndTestFactory): Added ExtractTestResultsClass abstraction.
+        (BuildAndTestLeaksFactory): Use ExtractTestResultsAndLeaks as our ExtractTestResultsClass so
+        that we'll get a "view leaks" link.
+
+2011-04-06  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Gtk] plugins/set-status.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=57844
+
+        Allow an empty status text to be dumped.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (webViewStatusBarTextChanged):
+
+2011-04-06  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.pageNumberForElementById
+        https://bugs.webkit.org/show_bug.cgi?id=42329
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::pageNumberForElementById):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+
+2011-04-06  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] DumpRenderTree: do not try to free NULL SoupURIs
+        https://bugs.webkit.org/show_bug.cgi?id=57932
+
+        Some Layout tests have invalid URIs that do not generate valid
+        SoupURI instances. Do not try to free those NULL SoupURIs.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (willSendRequestCallback):
+
+2011-04-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        ORWT shouldn't generate diff files for tests without expected files
+        https://bugs.webkit.org/show_bug.cgi?id=57846
+
+        * Scripts/old-run-webkit-tests:
+
+2011-04-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Mac build fix. Handle cases where 10.4 SDK is not installed, and also add x86_64 arch
+        to deps.
+
+        * wx/install-unix-extras:
+
+2011-04-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82978, r82999, and r83001.
+        http://trac.webkit.org/changeset/82978
+        http://trac.webkit.org/changeset/82999
+        http://trac.webkit.org/changeset/83001
+        https://bugs.webkit.org/show_bug.cgi?id=57913
+
+        Does not work in Python 2.5 (Requested by abarth on #webkit).
+
+        * Scripts/webkitpy/common/system/executive.py:
+        * Scripts/webkitpy/common/system/executive_unittest.py:
+
+2011-04-05  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.numberOfPages
+        https://bugs.webkit.org/show_bug.cgi?id=42694
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::numberOfPages):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+
+2011-04-05  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        [chromium] stop putting results downloaded from WebKit Linux in chromium-linux-x86_64
+        https://bugs.webkit.org/show_bug.cgi?id=57889
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+
+2011-04-05  Adam Barth  <abarth@webkit.org>
+
+        Silly with statement, from the future!
+
+        * Scripts/webkitpy/common/system/executive.py:
+
+2011-04-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Don't use Exception.message because it's deprecated
+        https://bugs.webkit.org/show_bug.cgi?id=57892
+
+        Suppress the warning for now.  When we move to Python 3, we might need
+        to something more dramatic.
+
+        * Scripts/webkitpy/common/system/executive.py:
+
+2011-04-05  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Add builders.js to dashboard file list
+        https://bugs.webkit.org/show_bug.cgi?id=57899
+
+        Add file added by http://crrev.com/80538 to dashboard file list.
+
+        * TestResultServer/handlers/dashboardhandler.py:
+
+2011-04-05  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Adam Barth.
+
+        webkit-patch should print git's stderr when git svn dcommit fail
+        http://webkit.org/b/57861
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+
+2011-04-05  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Add --baseline-search-path to NRWT
+        https://bugs.webkit.org/show_bug.cgi?id=56233
+        
+        Add NRWT option to specify additional directories to look for baselines
+        (will be used by hardware GPU bots which will have local per-bot
+        expectations for some tests)
+
+        * Scripts/webkitpy/common/system/filesystem_mock.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2011-04-05  Adam Roben  <aroben@apple.com>
+
+        Strip off /results.html from results URLs before trying to load leaks files from them
+
+        r82734 changed build.webkit.org's "view results" URLs to point straight to the results.html
+        files, rather than pointing to the directory that contains them. This is more convenient for
+        people browsing build.webkit.org, but confused Leaks Viewer.
+
+        Fixes <http://webkit.org/b/57869> REGRESSION (r82734): Links in Leaks Viewer's Recent Builds
+        list don't work
+
+        Reviewed by Joseph Pecoraro.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js:
+        (RecentBuildsLoader.prototype.start): Strip off "/results.html" from the results URL.
+
+2011-04-05  Carol Szabo  <carol@webkit.org>
+
+        Unreviewed.
+
+        Updated my info in committers.py
+
+        Scripts\webkitpy\common\config\committers.py 
+
+2011-04-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Make WebKitLibraries optional for building QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=57542
+
+        * Scripts/build-webkit:
+
+2011-04-05  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] MiniBrowser defaultUrl does not work
+        https://bugs.webkit.org/show_bug.cgi?id=57021
+
+        Match the behavior and coding of MiniBrowser to QtTestBrowser.
+        * MiniBrowser/qt/main.cpp:
+        (main):
+
+2011-04-05  Jade Han  <jade.han@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] [Symbian] Disable WebKitTestRunner for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=54977
+
+        This change is a preparation to enable building webkit2 for Symbian.
+        Bug 57834 is filed to fix and enable WebKitTestRunner for Symbian.
+
+        * Tools.pro:
+
+2011-04-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Fix timeoutTimer of MiniBrowser's UrlLoader
+        https://bugs.webkit.org/show_bug.cgi?id=57832
+
+        Only QWKPage has loadFinished signal so connect to it instead of BrowserWindow.
+
+        * MiniBrowser/qt/UrlLoader.cpp:
+        (UrlLoader::UrlLoader):
+
+2011-04-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        [Qt] Linux Release minimal build fix after r82919.
+
+        * MiniBrowser/qt/BrowserWindow.cpp:
+        (BrowserWindow::loadURLListFromFile):
+        * QtTestBrowser/launcherwindow.cpp:
+        (LauncherWindow::loadURLListFromFile):
+
+2011-04-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Make URL loader accessible from testbrowser's menus
+        https://bugs.webkit.org/show_bug.cgi?id=57823
+
+        Add "Load URLs from file" to QtTestBrowser's and to MiniBrowser's menu.
+
+        * MiniBrowser/qt/BrowserWindow.cpp:
+        (BrowserWindow::BrowserWindow):
+        (BrowserWindow::loadURLListFromFile):
+        (BrowserWindow::~BrowserWindow):
+        * MiniBrowser/qt/BrowserWindow.h:
+        * QtTestBrowser/launcherwindow.cpp:
+        (LauncherWindow::LauncherWindow):
+        (LauncherWindow::~LauncherWindow):
+        (LauncherWindow::createChrome):
+        (LauncherWindow::loadURLListFromFile):
+        * QtTestBrowser/launcherwindow.h:
+
+2011-04-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brian Weinstein.
+
+        Remove duplicate API from WKContext
+        <rdar://problem/8727879>
+        https://bugs.webkit.org/show_bug.cgi?id=57815
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WebKit2/SendingMessagesToTheWebProcessBeforeItIsValid.cpp: Removed.
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+        Remove SendingMessagesToTheWebProcessBeforeItIsValid since the API it was testing is now removed.
+
+2011-04-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] don't write .checksum files if a fallback platform has an embedded checksum
+        https://bugs.webkit.org/show_bug.cgi?id=57783
+
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py:
+
+2011-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix, run uninstall when cleaning to remove built files
+        from WebKitBuild.
+
+        * Scripts/webkitdirs.pm:
+
+2011-04-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebGL support
+        https://bugs.webkit.org/show_bug.cgi?id=31517
+
+        Add support to the DRT for turning on WebGL when a layout tests requests it.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::overridePreference): Allow turning on WebGL from tests.
+
+2011-04-04  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.setAllowFileAccessFromFileURLs
+        https://bugs.webkit.org/show_bug.cgi?id=57572
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::setAllowFileAccessFromFileURLs):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+
+2011-04-04  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] DumpRenderTree breaks compilation in some uClibc environments
+        https://bugs.webkit.org/show_bug.cgi?id=57602
+
+        * DumpRenderTree/qt/main.cpp:
+        (get_backtrace):
+
+2011-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix, add new LayoutTestController method stub to wx.
+
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::shadowRoot):
+
+2011-04-04  Pavel Podivilov  <podivilov@chromium.org>
+
+        Unreviewed, fix exception in rebaseline tool.
+
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+
+2011-04-02  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        For Dan!
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetWebViewToConsistentStateBeforeTesting):
+
+2011-04-02  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        Need to reset the scale, much like zoom.
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetWebViewToConsistentStateBeforeTesting):
+
+2011-04-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57605
+        Frame::pageScaleFactor() should not affect getBoundingClientRect() or 
+        getClientRects()
+        -and corresponding-
+        <rdar://problem/9194541>
+
+        Add DRT support for the scaleWebView SPI.
+        * DumpRenderTree/mac/EventSendingController.mm:
+        (+[EventSendingController isSelectorExcludedFromWebScript:]):
+        (+[EventSendingController webScriptNameForSelector:]):
+        (-[EventSendingController scalePageBy:atX:andY:]):
+        * WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl:
+        * WebKitTestRunner/InjectedBundle/EventSendingController.cpp:
+        (WTR::EventSendingController::scalePageBy):
+        * WebKitTestRunner/InjectedBundle/EventSendingController.h:
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::reset):
+
+2011-04-02  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Martin Robinson.
+
+        Add layoutTestController.shadowRoot to GTK DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=57551
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::shadowRoot):
+
+2011-04-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove AbstractStep._run_script and move script names to ports.py
+        https://bugs.webkit.org/show_bug.cgi?id=57704
+
+        Replace deprecated _run_script with _tool.executive.run_and_throw_if_fail.
+
+        * Scripts/webkitpy/common/config/ports.py:
+        * Scripts/webkitpy/tool/commands/download_unittest.py:
+        * Scripts/webkitpy/tool/commands/roll_unittest.py:
+        * Scripts/webkitpy/tool/commands/upload_unittest.py:
+        * Scripts/webkitpy/tool/steps/abstractstep.py:
+        * Scripts/webkitpy/tool/steps/checkstyle.py:
+        * Scripts/webkitpy/tool/steps/preparechangelog.py:
+        * Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py:
+        * Scripts/webkitpy/tool/steps/preparechangelogforrevert.py:
+
+2011-04-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Emulate shebang on Win32
+        https://bugs.webkit.org/show_bug.cgi?id=55927
+
+        Scripts on Windows work only if they are called with the explicit interpreter.
+        Read the first line of scripts to detect the correct executable.
+
+        * Scripts/webkitpy/common/config/ports.py:
+        * Scripts/webkitpy/common/system/executive.py: Added interpreter_for_script().
+        * Scripts/webkitpy/common/system/executive_unittest.py:
+
+2011-04-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        apos entities shouldn't show up in ChangeLogs when using webkit-patch
+        https://bugs.webkit.org/show_bug.cgi?id=57692
+
+        Previously, we were using BeautifulSoup to process XML from
+        bugs.webkit.org, but that's incorrect.  We should be using
+        BeautifulStoneSoup to process the XML.  We were getting the &apos;
+        entity wrong because &apos; is an XML entity but not an HTML entity.
+
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla.py:
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py:
+
+2011-04-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82721.
+        http://trac.webkit.org/changeset/82721
+        https://bugs.webkit.org/show_bug.cgi?id=57687
+
+        This patch introduced assertion failures on the GTK+ bots.
+        (Requested by mrobinson on #webkit).
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::shadowRoot):
+
+2011-04-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix.
+
+        [Qt][WK2] Build Webkit2 using "-2" option on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=55074
+
+        * Scripts/build-webkit: Ensure that "-2" isn't passed to qmake.
+        (The isWK2() function removes it from @ARGV, but not from @options.)
+
+2011-04-01  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] [WK2] MiniBrowser.qrc not found - regression from rev 82671
+        https://bugs.webkit.org/show_bug.cgi?id=57666
+
+        * MiniBrowser/qt/MiniBrowser.qrc: Renamed from Tools/MiniBrowser/MiniBrowser.qrc.
+
+2011-04-01  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        new-run-webkit-tests: fix feature detection, skipped platform lists on mac
+
+        We apparently never implemented the code to skip tests based on
+        what was compiled into DRT. Also, change the logic used to skip
+        platform directories to match what old-run-webkit-tests does: 
+        skip every test not in a directory in the baseline search path.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57662
+
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+        * Scripts/webkitpy/layout_tests/port/mac_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+
+2011-03-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        <http://webkit.org/b/56730> new-run-webkit-tests fails on Lion seed
+
+        Teach new-run-webkit-tests about the concept of an unreleased version of Mac OS X.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+        * Scripts/webkitpy/layout_tests/port/mac_unittest.py:
+
+2011-04-01  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt][WK2] Build Webkit2 using "-2" option on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=55074
+
+        * Scripts/build-webkit:
+
+2011-04-01  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        new-run-webkit-tests: remove spurious port version override in webkit.py
+        base.py provides a default implementation so this is just
+        breaking things.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57667
+
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        * Scripts/webkitpy/layout_tests/port/mac_unittest.py:
+
+2011-04-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Make view results on waterfall direct link to results.html
+        https://bugs.webkit.org/show_bug.cgi?id=57671
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg: Add "/results.html" to the URL.
+        * Scripts/old-run-webkit-tests: Add links to httpd access and error logs.
+
+2011-04-01  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * TestWebKitAPI/Tests/WebKit2/win/HideFindIndicator.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/win/ResizeViewWhileHidden.cpp:
+        (TestWebKitAPI::flushMessages):
+
+2011-04-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add adoptWK to WKRetainPtr.h
+        https://bugs.webkit.org/show_bug.cgi?id=57670
+
+        * TestWebKitAPI/PlatformUtilities.h:
+        * TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp:
+        * TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp:
+        * TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp:
+        * TestWebKitAPI/Tests/WebKit2/CookieManager.cpp:
+        * TestWebKitAPI/Tests/WebKit2/HitTestResultNodeHandle.cpp:
+        * TestWebKitAPI/Tests/WebKit2/PageLoadDidChangeLocationWithinPageForFrame.cpp:
+        * TestWebKitAPI/Tests/WebKit2/ResponsivenessTimerDoesntFireEarly.cpp:
+        * TestWebKitAPI/Tests/WebKit2/RestoreSessionStateContainingFormData.cpp:
+        (TestWebKitAPI::createSessionStateContainingFormData):
+        * WebKitTestRunner/StringFunctions.h:
+        Replace custom versions of adoptWK with the API on in WebKit2/WKRetainPtr.h.
+
+2011-04-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Fix leak noticed by Adam Roben in LayoutTestController::shadowRoot.
+
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::shadowRoot):
+        Make judicious use of adoptWK().
+
+2011-04-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix extract-localizable-strings for macro change from UI_STRING -> WEB_UI_STRING.
+
+        * Scripts/extract-localizable-strings:
+
+2011-04-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Shockwave plug-in doesn't accept mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=57653
+        <rdar://problem/8483273>
+
+        Add a plug-in test.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
+        (PluginTest::indicateTestFailure):
+        Move code from NPDeallocateCalledBeforeNPShutdown::TestObject::~TestObject here.
+
+        (PluginTest::NPN_ConvertPoint):
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.h:
+        * DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp:
+        (NPDeallocateCalledBeforeNPShutdown::TestObject::~TestObject):
+        Call indicateTestFailure.
+
+        * DumpRenderTree/TestNetscapePlugIn/Tests/mac: Added.
+        * DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp: Added.
+        (ConvertPoint::ConvertPoint):
+        (ConvertPoint::testConvert):
+        (ConvertPoint::NPP_New):
+
+2011-04-01  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Martin Robinson.
+
+        Add layoutTestController.shadowRoot to GTK DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=57551
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::shadowRoot):
+
+2011-04-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        WebKitTestRunner needs layoutTestController.shadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=57661
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::shadowRoot):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+        Implement layoutTestController.shadowRoot for WebKit2.
+
+2011-04-01  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.setDatabaseQuota
+        https://bugs.webkit.org/show_bug.cgi?id=57568
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::setDatabaseQuota):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+
+2011-04-01  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        This patch completes the cleanup of
+        rebaseline-chromium-webkit-tests to work with all of the
+        variants of a platform (we can now rebaseline gpu- and non-gpu
+        files at the same time).
+
+        When the rebaselining is complete, any lines declared as
+        REBASELINE in the expectations file that matches a test that was
+        actually rebaselined will be deleted, even if only one of the
+        variants was actually rebaselined. This may cause odd problems,
+        but is better than where we're at today.
+
+        This change removes the -g flag and deprecates -w. The -g flag is gone
+        because GPU baselines are handled just like any other variant.
+        The -w flag is deprecated because this tool now only works
+        against the canaries, since that's the only place we have a full
+        set of bots. It will be trivial to change this to
+        build.webkit.org if we decide that's where we want them to be.
+
+        Also, this patch deletes a lot of cruft that is no longer needed
+        in the test_expectations code and the port-specific code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55191
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_expectations.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_expectations_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_gpu.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_linux.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        * Scripts/webkitpy/layout_tests/port/win.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py:
+
+2011-04-01  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        rebaseline-chromium-webkit-tests does not work correctly with
+        version-specific baselines. This patch updates the tool to use
+        all of the version-specific bots on the canaries, and will now
+        attempt to rebaseline all of the versions by default, although
+        it will not update both GPU and CPU versions.
+        
+        Also, it will no longer modify the test_expectations.txt file
+        *at all*. You will have to manually delete the REBASELINE lines
+        after running the tool and determining that it did what you
+        wanted it to do. This should be fixed in a separate bug - see
+        webkit bug #55191.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55608
+
+        * Scripts/webkitpy/layout_tests/layout_package/test_expectations.py:
+        * Scripts/webkitpy/layout_tests/layout_package/test_expectations_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py:
+
+2011-03-31  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] update the rebaseline tool to know about pngs with checksums
+        https://bugs.webkit.org/show_bug.cgi?id=57481
+
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py: Skip over .checksum files if the checksum is already in the png
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py:
+
+2011-04-01  Adam Roben  <aroben@apple.com>
+
+        Retrieve revision numbers from the build's got_revision property in Leaks Viewer
+
+        Previously, we were getting the revision of the first revision that triggered a build.
+        Choosing the last revision would have been more accurate. But got_revision is what is used
+        everywhere else on build.webkit.org, and should work even when there were no changes that
+        triggered a build (e.g., if someone clicked the Force Build button).
+
+        Fixes <http://webkit.org/b/57630> Leaks viewer gets some revision numbers wrong in the
+        recent builds list
+
+        Reviewed by Anders Carlsson.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/RecentBuildsLoader.js:
+        (RecentBuildsLoader.prototype.start): Pull the revision number out of the got_revision
+        property, rather than out of the first (i.e., earliest) change in the sourceStamp object.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/LeaksViewer/Utilities.js:
+        (Array.prototype.first): Added this helper function to return the first element in an array
+        that matches the given predicate, or null if no such element exists.
+
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Prefer (but don't require) bug URLs to be on their own line when parsing bug numbers from ChangeLogs
+
+        Fixes <http://webkit.org/b/57579> webkit-patch is too strict about bug URL formatting
+
+        Reviewed by Darin Adler.
+
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla.py:
+        (parse_bug_id_from_changelog): Fall back to parse_bug_id if we weren't able to find a bug
+        URL on its own line.
+
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py:
+        (BugzillaTest.test_parse_bug_id_from_changelog): Updated expected results for test
+        progression, and added a new test that uses a short bug URL while I was at it.
+
+2011-04-01  Adam Roben  <aroben@apple.com>
+
+        Mark .vcproj/.vsprops/.sln files as being Windows-only
+
+        Fixes <http://webkit.org/b/57489> Mac builders built 82512, but shouldn't have
+
+        Reviewed by Anders Carlsson.
+
+        * Scripts/webkitpy/common/config/build.py:
+        (_should_file_trigger_build): Added patterns to mark .vcproj/.vsprops/.sln files and .vcproj
+        directories as Windows-only.
+
+        * Scripts/webkitpy/common/config/build_unittest.py:
+        (ShoulBuildTest): Added test cases for the above.
+
+2011-04-01  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Build MiniBrowser for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=56319
+
+        Have MiniBrowser reference it's own copy of useragentlist.txt instead
+        of copying QtTestBrowser's.
+        Remove Tools/MiniBrowser/DerivedSources.pro
+        This reduces complexity in the Tools scripts due to Symbian limitations.
+
+        * DerivedSources.pro:
+        * MiniBrowser/DerivedSources.pro: Removed.
+        * MiniBrowser/MiniBrowser.qrc:
+        * MiniBrowser/qt/MiniBrowser.pro:
+        * Scripts/webkitdirs.pm:
+
+2011-03-31  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.clearAllDatabases
+        https://bugs.webkit.org/show_bug.cgi?id=42540
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::beginTesting):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp:
+        (WTR::LayoutTestController::clearAllDatabases):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+
+2011-03-31  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        WebKitTestRunner needs layoutTestController.setAllowUniversalAccessFromFileURLs
+        https://bugs.webkit.org/show_bug.cgi?id=42692
+
+        * WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl:
+
+2011-03-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement mouseDown, mouseUp, and mouseMoveTo in WebKitTestRunner
+        https://bugs.webkit.org/show_bug.cgi?id=57573
+
+        * WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl:
+        Added real definitions for mouseDown, mouseUp, mouseMoveTo and leapForward.
+        Removed fake definitions of keyDown and contextClick.
+
+        * WebKitTestRunner/InjectedBundle/EventSendingController.cpp:
+        (WTR::operator==): Added. So we can compare two WKPoint structs.
+        (WTR::parseModifier): Added.
+        (WTR::parseModifierArray): Added.
+        (WTR::EventSendingController::EventSendingController): Initialize the
+        new data members.
+        (WTR::EventSendingController::mouseDown): Added. Calls
+        WKBundlePageSimulateMouseDown.
+        (WTR::EventSendingController::mouseUp): Added. Calls
+        WKBundlePageSimulateMouseUp.
+        (WTR::EventSendingController::mouseMoveTo): Added. Calls
+        WKBundlePageSimulateMouseMotion.
+        (WTR::EventSendingController::leapForward): Added.
+        (WTR::EventSendingController::updateClickCount): Added. Used by the
+        mouseDown/Up functions to create a click count.
+
+        * WebKitTestRunner/InjectedBundle/EventSendingController.h: Updated
+        for the changes above.
+
+2011-03-31  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] implement LayoutTestController::setWillSendRequestReturnsNull
+        https://bugs.webkit.org/show_bug.cgi?id=57362
+
+        Do not generate DRT output if willSendRequestReturnsNull is set.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (willSendRequestCallback):
+
+2011-03-31  Vamshikrishna.Yellenki  <vamshi@motorola.com> and Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Implement MiniBrowser for Gtk port.
+        https://bugs.webkit.org/show_bug.cgi?id=48512
+
+        Initial implementation of the Gtk MiniBrowser.
+
+        * MiniBrowser/gtk/GNUmakefile.am: Added.
+        * MiniBrowser/gtk/main.c: Added.
+        (activateUriEntryCallback):
+        (destroyCallback):
+        (goBackCallback):
+        (goForwardCallback):
+        (createToolbar):
+        (createWebView):
+        (createWindow):
+        (argumentToURL):
+        (main):
+
+2011-03-30  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds layoutTestController.shadowRoot accessor to Mac DRT.
+        https://bugs.webkit.org/show_bug.cgi?id=57415
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (shadowRootCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::shadowRoot):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::shadowRoot):
+
+2011-03-30  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Chris Marrin.
+
+        Update fast/canvas tests to avoid dumping the render tree when possible
+        https://bugs.webkit.org/show_bug.cgi?id=57493
+
+        * DumpRenderTree/mac/DumpRenderTree.mm: Make DRT aware of new default values for
+          accelerated drawing and accelerated drawing for canvas
+
+2011-03-30  Adam Roben  <aroben@apple.com>
+
+        Stop ignoring leaks in CGGradientCreateWithColorStops
+
+        Fixes <rdar://problem/7888547>.
+
+        Rubber-stamped by John Sullivan.
+
+        * Scripts/old-run-webkit-tests:
+        (countAndPrintLeaks): Removed some code to ignore those leaks.
+
+2011-03-30  Timur Iskhodzhanov  <timurrrr@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add some dynamic annotations to JavaScriptCore/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=53747
+
+        By using these annotations we can improve the precision of finding
+        WebKit errors using dynamic analysis tools like ThreadSanitizer and Valgrind.
+        These annotations don't affect the compiled binaries unless USE(DYNAMIC_ANNOTATIONS) is "1".
+
+        These files don't add new functionality, so don't need extra tests.
+
+        * DumpRenderTree/ForwardingHeaders/wtf/DynamicAnnotations.h: Added.
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Share most vsprops between Release and Production builds in releaseproduction.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=57508
+
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops:
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops:
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops:
+        * DumpRenderTree/win/DumpRenderTreeProduction.vsprops:
+        * DumpRenderTree/win/DumpRenderTreeRelease.vsprops:
+        * DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops:
+        * DumpRenderTree/win/ImageDiffProduction.vsprops:
+        * DumpRenderTree/win/ImageDiffRelease.vsprops:
+        * DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops:
+        * FindSafari/FindSafariProduction.vsprops:
+        * FindSafari/FindSafariRelease.vsprops:
+        * FindSafari/FindSafariReleaseCairoCFLite.vsprops:
+        * FindSafari/FindSafariReleasePGO.vsprops:
+        * MiniBrowser/Configurations/MiniBrowserProduction.vsprops:
+        * MiniBrowser/Configurations/MiniBrowserRelease.vsprops:
+        * MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops:
+        * TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops:
+        * TestWebKitAPI/Configurations/TestWebKitAPIReleaseCairoCFLite.vsprops:
+        * WebKitAPITest/WebKitAPITestProduction.vsprops:
+        * WebKitAPITest/WebKitAPITestRelease.vsprops:
+        * WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops:
+        * WebKitLauncherWin/WebKitLauncherWinProduction.vsprops:
+        * WebKitLauncherWin/WebKitLauncherWinRelease.vsprops:
+        * WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops:
+        * WebKitTestRunner/win/InjectedBundleProduction.vsprops:
+        * WebKitTestRunner/win/InjectedBundleRelease.vsprops:
+        * WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops:
+        * WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops:
+        * WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops:
+        * WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops:
+        * WinLauncher/WinLauncherProduction.vsprops:
+        * WinLauncher/WinLauncherRelease.vsprops:
+        * WinLauncher/WinLauncherReleaseCairoCFLite.vsprops:
+        * record-memory-win/record-memory-winProduction.vsprops:
+        * record-memory-win/record-memory-winRelease.vsprops:
+        * record-memory-win/record-memory-winReleaseCairoCFLite.vsprops:
+
 2011-03-30  Steve Falkenburg  <sfalken@apple.com>
 
         Reviewed by Adam Roben.
diff --git a/Tools/DerivedSources.pro b/Tools/DerivedSources.pro
index 55a26a2..802f3f7 100644
--- a/Tools/DerivedSources.pro
+++ b/Tools/DerivedSources.pro
@@ -2,7 +2,6 @@ TEMPLATE = subdirs
 CONFIG += ordered
 
 SUBDIRS += \
-    MiniBrowser/DerivedSources.pro \
     WebKitTestRunner/DerivedSources.pro
 
 for(subpro, SUBDIRS) {
diff --git a/Tools/DumpRenderTree/CyclicRedundancyCheck.cpp b/Tools/DumpRenderTree/CyclicRedundancyCheck.cpp
new file mode 100644
index 0000000..361ea0f
--- /dev/null
+++ b/Tools/DumpRenderTree/CyclicRedundancyCheck.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010, Robert Eisele <robert@xarg.org> All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CyclicRedundancyCheck.h"
+
+#include <wtf/Vector.h>
+
+static void makeCrcTable(unsigned crcTable[256])
+{
+    for (unsigned i = 0; i < 256; i++) {
+        unsigned c = i;
+        for (int k = 0; k < 8; k++) {
+            if (c & 1)
+                c = -306674912 ^ ((c >> 1) & 0x7fffffff);
+            else
+                c = c >> 1;
+        }
+        crcTable[i] = c;
+    }
+}
+
+unsigned computeCrc(const Vector<unsigned char>& buffer)
+{
+    static unsigned crcTable[256];
+    static bool crcTableComputed = false;
+    if (!crcTableComputed) {
+        makeCrcTable(crcTable);
+        crcTableComputed = true;
+    }
+
+    unsigned crc = 0xffffffffL;
+    for (size_t i = 0; i < buffer.size(); ++i)
+        crc = crcTable[(crc ^ buffer[i]) & 0xff] ^ ((crc >> 8) & 0x00ffffffL);
+    return crc ^ 0xffffffffL;
+}
+
diff --git a/Tools/DumpRenderTree/CyclicRedundancyCheck.h b/Tools/DumpRenderTree/CyclicRedundancyCheck.h
new file mode 100644
index 0000000..ef1d78e
--- /dev/null
+++ b/Tools/DumpRenderTree/CyclicRedundancyCheck.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CyclicRedundancyCheck_h
+#define CyclicRedundancyCheck_h
+
+#include <wtf/Vector.h>
+
+unsigned computeCrc(const Vector<unsigned char>&);
+
+#endif
diff --git a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
index 67a7556..4eaecb9 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
+++ b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
@@ -36,6 +36,7 @@
 		1A215A8211F2609C008AD0F5 /* PluginTest.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A215A8011F2609C008AD0F5 /* PluginTest.h */; };
 		1A215BE711F27658008AD0F5 /* DocumentOpenInDestroyStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A215A7511F26072008AD0F5 /* DocumentOpenInDestroyStream.cpp */; };
 		1A24BAA9120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A24BAA8120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp */; };
+		1A31EB3813466AC100017372 /* ConvertPoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A31EB3713466AC100017372 /* ConvertPoint.cpp */; };
 		1A3E28AA1311D73B00501349 /* GetURLWithJavaScriptURLDestroyingPlugin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A3E28A91311D73B00501349 /* GetURLWithJavaScriptURLDestroyingPlugin.cpp */; };
 		1A8F02E80BB9B4EC008CFA34 /* TestObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F024C0BB9B056008CFA34 /* TestObject.h */; };
 		1AC6C8490D07638600CD3161 /* main.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC6C77F0D07589B00CD3161 /* main.cpp */; };
@@ -58,6 +59,8 @@
 		4437730F125CBC4D00AAE02C /* WebArchiveDumpSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A997820FCDE86400580F10 /* WebArchiveDumpSupport.h */; };
 		5185F6B210714E07007AA393 /* HistoryDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5185F69F10714A57007AA393 /* HistoryDelegate.mm */; };
 		5185F6B310714E12007AA393 /* HistoryDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 5185F69E10714A57007AA393 /* HistoryDelegate.h */; };
+		53CBB832134E42F3001CE6A4 /* CyclicRedundancyCheck.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53CBB830134E42F3001CE6A4 /* CyclicRedundancyCheck.cpp */; };
+		53CBB833134E42F3001CE6A4 /* CyclicRedundancyCheck.h in Headers */ = {isa = PBXBuildFile; fileRef = 53CBB831134E42F3001CE6A4 /* CyclicRedundancyCheck.h */; };
 		5DB9AC970F722C3600684641 /* AHEM____.TTF in Copy Font Files */ = {isa = PBXBuildFile; fileRef = AA7F10C20CB3C1030003BDC9 /* AHEM____.TTF */; };
 		5DB9AC980F722C3600684641 /* WebKitWeightWatcher100.ttf in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 375F09710DAC3CB600C8B4E5 /* WebKitWeightWatcher100.ttf */; };
 		5DB9AC990F722C3600684641 /* WebKitWeightWatcher200.ttf in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 375F09720DAC3CB600C8B4E5 /* WebKitWeightWatcher200.ttf */; };
@@ -136,6 +139,7 @@
 		BCD08B3A0E1057EF00A7D0C1 /* AccessibilityController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD08B390E1057EF00A7D0C1 /* AccessibilityController.cpp */; };
 		BCD08B710E1059D200A7D0C1 /* AccessibilityControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCD08B700E1059D200A7D0C1 /* AccessibilityControllerMac.mm */; };
 		BCF6C6500C98E9C000AC063E /* GCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF6C64F0C98E9C000AC063E /* GCController.cpp */; };
+		C031182B134E4A2B00919757 /* NPPSetWindowCalledDuringDestruction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C031182A134E4A2B00919757 /* NPPSetWindowCalledDuringDestruction.cpp */; };
 		C06F9ABC1267A7060058E1F6 /* PassDifferentNPPStruct.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C06F9ABB1267A7060058E1F6 /* PassDifferentNPPStruct.cpp */; };
 		C0E720751281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0E720741281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp */; };
 		C0EC3C9C12787F0500939164 /* NullNPPGetValuePointer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0EC3C9B12787F0500939164 /* NullNPPGetValuePointer.cpp */; };
@@ -209,6 +213,7 @@
 		1A215A7F11F2609C008AD0F5 /* PluginTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginTest.cpp; sourceTree = "<group>"; };
 		1A215A8011F2609C008AD0F5 /* PluginTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginTest.h; sourceTree = "<group>"; };
 		1A24BAA8120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPRuntimeObjectFromDestroyedPlugin.cpp; sourceTree = "<group>"; };
+		1A31EB3713466AC100017372 /* ConvertPoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConvertPoint.cpp; sourceTree = "<group>"; };
 		1A3E28A91311D73B00501349 /* GetURLWithJavaScriptURLDestroyingPlugin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetURLWithJavaScriptURLDestroyingPlugin.cpp; sourceTree = "<group>"; };
 		1A8F024C0BB9B056008CFA34 /* TestObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TestObject.h; sourceTree = "<group>"; };
 		1AC6C77F0D07589B00CD3161 /* main.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = main.cpp; sourceTree = "<group>"; };
@@ -241,6 +246,8 @@
 		44A997830FCDE86400580F10 /* WebArchiveDumpSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebArchiveDumpSupport.cpp; path = cf/WebArchiveDumpSupport.cpp; sourceTree = "<group>"; };
 		5185F69E10714A57007AA393 /* HistoryDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HistoryDelegate.h; path = mac/HistoryDelegate.h; sourceTree = "<group>"; };
 		5185F69F10714A57007AA393 /* HistoryDelegate.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; name = HistoryDelegate.mm; path = mac/HistoryDelegate.mm; sourceTree = "<group>"; };
+		53CBB830134E42F3001CE6A4 /* CyclicRedundancyCheck.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CyclicRedundancyCheck.cpp; sourceTree = "<group>"; };
+		53CBB831134E42F3001CE6A4 /* CyclicRedundancyCheck.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CyclicRedundancyCheck.h; sourceTree = "<group>"; };
 		8465E2C60FFA8DF2003B8342 /* PixelDumpSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PixelDumpSupport.cpp; sourceTree = "<group>"; };
 		9335435F03D75502008635CE /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = WebKit.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		933BF5A90F93FA5C000F0441 /* PlainTextController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PlainTextController.h; path = mac/PlainTextController.h; sourceTree = "<group>"; };
@@ -317,6 +324,7 @@
 		BCD08B390E1057EF00A7D0C1 /* AccessibilityController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityController.cpp; sourceTree = "<group>"; };
 		BCD08B700E1059D200A7D0C1 /* AccessibilityControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = AccessibilityControllerMac.mm; path = mac/AccessibilityControllerMac.mm; sourceTree = "<group>"; };
 		BCF6C64F0C98E9C000AC063E /* GCController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = GCController.cpp; sourceTree = "<group>"; };
+		C031182A134E4A2B00919757 /* NPPSetWindowCalledDuringDestruction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NPPSetWindowCalledDuringDestruction.cpp; sourceTree = "<group>"; };
 		C06F9ABB1267A7060058E1F6 /* PassDifferentNPPStruct.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PassDifferentNPPStruct.cpp; sourceTree = "<group>"; };
 		C0E720741281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EvaluateJSAfterRemovingPluginElement.cpp; sourceTree = "<group>"; };
 		C0EC3C9B12787F0500939164 /* NullNPPGetValuePointer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NullNPPGetValuePointer.cpp; sourceTree = "<group>"; };
@@ -475,11 +483,13 @@
 		1A215A6E11F25FF1008AD0F5 /* Tests */ = {
 			isa = PBXGroup;
 			children = (
+				1A31EB3613466AC100017372 /* mac */,
 				1A215A7511F26072008AD0F5 /* DocumentOpenInDestroyStream.cpp */,
 				C0E720741281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp */,
 				1A3E28A91311D73B00501349 /* GetURLWithJavaScriptURLDestroyingPlugin.cpp */,
 				1AD4CB2012A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp */,
 				1ACF898B132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp */,
+				C031182A134E4A2B00919757 /* NPPSetWindowCalledDuringDestruction.cpp */,
 				1A24BAA8120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp */,
 				1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */,
 				C0EC3C9B12787F0500939164 /* NullNPPGetValuePointer.cpp */,
@@ -489,6 +499,14 @@
 			path = Tests;
 			sourceTree = "<group>";
 		};
+		1A31EB3613466AC100017372 /* mac */ = {
+			isa = PBXGroup;
+			children = (
+				1A31EB3713466AC100017372 /* ConvertPoint.cpp */,
+			);
+			path = mac;
+			sourceTree = "<group>";
+		};
 		9340995508540CAF007F3BC8 /* Products */ = {
 			isa = PBXGroup;
 			children = (
@@ -570,6 +588,8 @@
 		BCB284870CFA81ED007E533E /* PixelDump */ = {
 			isa = PBXGroup;
 			children = (
+				53CBB830134E42F3001CE6A4 /* CyclicRedundancyCheck.cpp */,
+				53CBB831134E42F3001CE6A4 /* CyclicRedundancyCheck.h */,
 				BCB284F30CFA84F2007E533E /* ImageDiffCG.cpp */,
 				8465E2C60FFA8DF2003B8342 /* PixelDumpSupport.cpp */,
 				BCB2848A0CFA820F007E533E /* PixelDumpSupport.h */,
@@ -600,6 +620,7 @@
 				BC0E24E00E2D9451001B6BC2 /* AccessibilityUIElement.h in Headers */,
 				BCA18B380C9B021900114369 /* AppleScriptController.h in Headers */,
 				A8B91BFF0CF522B4008F91FF /* CheckedMalloc.h in Headers */,
+				53CBB833134E42F3001CE6A4 /* CyclicRedundancyCheck.h in Headers */,
 				BCA18B7A0C9B08F100114369 /* DumpRenderTreeDraggingInfo.h in Headers */,
 				A8D79CEA0FC28B2C004AC8FE /* DumpRenderTreeFileDraggingSource.h in Headers */,
 				BCA18C0B0C9B59EF00114369 /* DumpRenderTreeMac.h in Headers */,
@@ -774,6 +795,8 @@
 				1AD4CB2212A6D1350027A7AF /* GetUserAgentWithNullNPPFromNPPNew.cpp in Sources */,
 				1A3E28AA1311D73B00501349 /* GetURLWithJavaScriptURLDestroyingPlugin.cpp in Sources */,
 				1ACF898D132EF41C00E915D4 /* NPDeallocateCalledBeforeNPShutdown.cpp in Sources */,
+				1A31EB3813466AC100017372 /* ConvertPoint.cpp in Sources */,
+				C031182B134E4A2B00919757 /* NPPSetWindowCalledDuringDestruction.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -787,6 +810,7 @@
 				BC0E26150E2DA4C6001B6BC2 /* AccessibilityUIElementMac.mm in Sources */,
 				BCA18B390C9B021900114369 /* AppleScriptController.m in Sources */,
 				A8B91BFD0CF522B4008F91FF /* CheckedMalloc.cpp in Sources */,
+				53CBB832134E42F3001CE6A4 /* CyclicRedundancyCheck.cpp in Sources */,
 				BCA18C470C9B5B9400114369 /* DumpRenderTree.mm in Sources */,
 				BCA18B7B0C9B08F100114369 /* DumpRenderTreeDraggingInfo.mm in Sources */,
 				A8D79CEB0FC28B2C004AC8FE /* DumpRenderTreeFileDraggingSource.m in Sources */,
diff --git a/Tools/DumpRenderTree/ForwardingHeaders/wtf/Alignment.h b/Tools/DumpRenderTree/ForwardingHeaders/wtf/Alignment.h
new file mode 100644
index 0000000..e83483e
--- /dev/null
+++ b/Tools/DumpRenderTree/ForwardingHeaders/wtf/Alignment.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Alignment.h>
diff --git a/Tools/DumpRenderTree/ForwardingHeaders/wtf/DynamicAnnotations.h b/Tools/DumpRenderTree/ForwardingHeaders/wtf/DynamicAnnotations.h
new file mode 100644
index 0000000..1280da8
--- /dev/null
+++ b/Tools/DumpRenderTree/ForwardingHeaders/wtf/DynamicAnnotations.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/DynamicAnnotations.h>
diff --git a/Tools/DumpRenderTree/LayoutTestController.cpp b/Tools/DumpRenderTree/LayoutTestController.cpp
index 18b3dcd..3105ce4 100644
--- a/Tools/DumpRenderTree/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/LayoutTestController.cpp
@@ -44,6 +44,7 @@
 
 LayoutTestController::LayoutTestController(const std::string& testPathOrURL, const std::string& expectedPixelHash)
     : m_dumpApplicationCacheDelegateCallbacks(false)
+    , m_dumpAsAudio(false)
     , m_dumpAsPDF(false)
     , m_dumpAsText(false)
     , m_dumpBackForwardList(false)
@@ -315,6 +316,25 @@ static JSValueRef setCloseRemainingWindowsWhenCompleteCallback(JSContextRef cont
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef setEncodedAudioDataCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> encodedAudioData(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    ASSERT(!*exception);
+    
+    size_t maxLength = JSStringGetMaximumUTF8CStringSize(encodedAudioData.get());
+    OwnArrayPtr<char> encodedAudioDataBuffer = adoptArrayPtr(new char[maxLength + 1]);
+    JSStringGetUTF8CString(encodedAudioData.get(), encodedAudioDataBuffer.get(), maxLength + 1);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setEncodedAudioData(encodedAudioDataBuffer.get());
+    controller->setDumpAsAudio(true);
+    
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef testOnscreenCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -1687,6 +1707,14 @@ static JSValueRef setAsynchronousSpellCheckingEnabledCallback(JSContextRef conte
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef shadowRootCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 1)
+        return JSValueMakeUndefined(context);
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    return controller->shadowRoot(context, arguments[0]);
+}
+
 static JSValueRef showWebInspectorCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -2213,6 +2241,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "setAlwaysAcceptCookies", setAlwaysAcceptCookiesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAppCacheMaximumSize", setAppCacheMaximumSizeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setApplicationCacheOriginQuota", setApplicationCacheOriginQuotaCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setEncodedAudioData", setEncodedAudioDataCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAuthenticationPassword", setAuthenticationPasswordCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAuthenticationUsername", setAuthenticationUsernameCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAuthorAndUserStylesEnabled", setAuthorAndUserStylesEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -2264,6 +2293,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "setJavaScriptCanAccessClipboard", setJavaScriptCanAccessClipboardCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setXSSAuditorEnabled", setXSSAuditorEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAsynchronousSpellCheckingEnabled", setAsynchronousSpellCheckingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "shadowRoot", shadowRootCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "showWebInspector", showWebInspectorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "testOnscreen", testOnscreenCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "testRepaint", testRepaintCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/Tools/DumpRenderTree/LayoutTestController.h b/Tools/DumpRenderTree/LayoutTestController.h
index 4a6e59c..a429dbf 100644
--- a/Tools/DumpRenderTree/LayoutTestController.h
+++ b/Tools/DumpRenderTree/LayoutTestController.h
@@ -122,6 +122,7 @@ public:
     void setSpatialNavigationEnabled(bool enable);
     void setScrollbarPolicy(JSStringRef orientation, JSStringRef policy);
     void setEditingBehavior(const char* editingBehavior);
+    JSValueRef shadowRoot(JSContextRef, JSValueRef);
 
     void waitForPolicyDelegate();
     size_t webHistoryItemCount();
@@ -133,6 +134,9 @@ public:
 
     bool elementDoesAutoCompleteForElementWithId(JSStringRef id);
 
+    bool dumpAsAudio() const { return m_dumpAsAudio; }
+    void setDumpAsAudio(bool dumpAsAudio) { m_dumpAsAudio = dumpAsAudio; }
+    
     bool dumpAsPDF() const { return m_dumpAsPDF; }
     void setDumpAsPDF(bool dumpAsPDF) { m_dumpAsPDF = dumpAsPDF; }
 
@@ -262,6 +266,9 @@ public:
 
     const std::string& testPathOrURL() const { return m_testPathOrURL; }
     const std::string& expectedPixelHash() const { return m_expectedPixelHash; }
+
+    const std::string& encodedAudioData() const { return m_encodedAudioData; }
+    void setEncodedAudioData(const std::string& encodedAudioData) { m_encodedAudioData = encodedAudioData; }
     
     bool pauseAnimationAtTimeOnElementWithId(JSStringRef animationName, double time, JSStringRef elementId);
     bool pauseTransitionAtTimeOnElementWithId(JSStringRef propertyName, double time, JSStringRef elementId);
@@ -333,6 +340,7 @@ private:
     void setGeolocationPermissionCommon(bool allow);
 
     bool m_dumpApplicationCacheDelegateCallbacks;
+    bool m_dumpAsAudio;
     bool m_dumpAsPDF;
     bool m_dumpAsText;
     bool m_dumpBackForwardList;
@@ -382,6 +390,9 @@ private:
 
     std::set<std::string> m_willSendRequestClearHeaders;
     
+    // base64 encoded WAV audio data is stored here.
+    std::string m_encodedAudioData;
+    
     // origins which have been granted desktop notification access
     std::vector<JSStringRef> m_desktopNotificationAllowedOrigins;
 
diff --git a/Tools/DumpRenderTree/PixelDumpSupport.cpp b/Tools/DumpRenderTree/PixelDumpSupport.cpp
index 352eaaa..24fbf4b 100644
--- a/Tools/DumpRenderTree/PixelDumpSupport.cpp
+++ b/Tools/DumpRenderTree/PixelDumpSupport.cpp
@@ -29,15 +29,17 @@
 #include "config.h"
 #include "PixelDumpSupport.h"
 
+#include "CyclicRedundancyCheck.h"
 #include "DumpRenderTree.h"
 #include "LayoutTestController.h"
 #include <cstdio>
 #include <wtf/Assertions.h>
 #include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include "PixelDumpSupportCG.h"
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 #include "PixelDumpSupportCairo.h"
 #endif
 
@@ -69,16 +71,60 @@ void dumpWebViewAsPixelsAndCompareWithExpected(const std::string& expectedHash)
     }
     
     if (dumpImage)
-      dumpBitmap(context.get());
+      dumpBitmap(context.get(), actualHash);
 }
 
-void printPNG(const unsigned char* data, const size_t dataLength)
+static void appendIntToVector(unsigned number, Vector<unsigned char>& vector)
 {
+    size_t offset = vector.size();
+    vector.grow(offset + 4);
+    vector[offset] = ((number >> 24) & 0xff);
+    vector[offset + 1] = ((number >> 16) & 0xff);
+    vector[offset + 2] = ((number >> 8) & 0xff);
+    vector[offset + 3] = (number & 0xff);
+}
+
+static void convertChecksumToPNGComment(const char* checksum, Vector<unsigned char>& bytesToAdd)
+{
+    // Chunks of PNG files are <length>, <type>, <data>, <crc>.
+    static const char textCommentPrefix[] = "\x00\x00\x00\x29tEXtchecksum\x00";
+    static const size_t prefixLength = sizeof(textCommentPrefix) - 1; // The -1 is for the null at the end of the char[].
+    static const size_t checksumLength = 32;
+
+    bytesToAdd.append(textCommentPrefix, prefixLength);
+    bytesToAdd.append(checksum, checksumLength);
+
+    Vector<unsigned char> dataToCrc;
+    dataToCrc.append(textCommentPrefix + 4, prefixLength - 4); // Don't include the chunk length in the crc.
+    dataToCrc.append(checksum, checksumLength);
+    unsigned crc32 = computeCrc(dataToCrc);
+
+    appendIntToVector(crc32, bytesToAdd);
+}
+
+static size_t offsetAfterIHDRChunk(const unsigned char* data, const size_t dataLength)
+{
+    const int pngHeaderLength = 8;
+    const int pngIHDRChunkLength = 25; // chunk length + "IHDR" + 13 bytes of data + checksum
+    return pngHeaderLength + pngIHDRChunkLength;
+}
+
+void printPNG(const unsigned char* data, const size_t dataLength, const char* checksum)
+{
+    Vector<unsigned char> bytesToAdd;
+    convertChecksumToPNGComment(checksum, bytesToAdd);
+
     printf("Content-Type: %s\n", "image/png");
-    printf("Content-Length: %lu\n", static_cast<unsigned long>(dataLength));
+    printf("Content-Length: %lu\n", static_cast<unsigned long>(dataLength + bytesToAdd.size()));
+
+    size_t insertOffset = offsetAfterIHDRChunk(data, dataLength);
+
+    fwrite(data, 1, insertOffset, stdout);
+    fwrite(bytesToAdd.data(), 1, bytesToAdd.size(), stdout);
 
     const size_t bytesToWriteInOneChunk = 1 << 15;
-    size_t dataRemainingToWrite = dataLength;
+    data += insertOffset;
+    size_t dataRemainingToWrite = dataLength - insertOffset;
     while (dataRemainingToWrite) {
         size_t bytesToWriteInThisChunk = std::min(dataRemainingToWrite, bytesToWriteInOneChunk);
         size_t bytesWritten = fwrite(data, 1, bytesToWriteInThisChunk, stdout);
diff --git a/Tools/DumpRenderTree/PixelDumpSupport.h b/Tools/DumpRenderTree/PixelDumpSupport.h
index e172a83..87e6402 100644
--- a/Tools/DumpRenderTree/PixelDumpSupport.h
+++ b/Tools/DumpRenderTree/PixelDumpSupport.h
@@ -38,9 +38,9 @@ class BitmapContext;
 void computeMD5HashStringForBitmapContext(BitmapContext*, char hashString[33]);
 PassRefPtr<BitmapContext> createPagedBitmapContext();
 PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool onscreen, bool incrementalRepaint, bool sweepHorizontally, bool drawSelectionRect);
-void dumpBitmap(BitmapContext*);
+void dumpBitmap(BitmapContext*, const char* checksum);
 void dumpWebViewAsPixelsAndCompareWithExpected(const std::string& expectedHash);
-void printPNG(const unsigned char* data, const size_t dataLength);
+void printPNG(const unsigned char* data, const size_t dataLength, const char* checksum);
 
 #if PLATFORM(MAC)
 
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp
index 24ee12c..75b848b 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp
@@ -73,14 +73,10 @@ static void pluginLogWithWindowObjectVariableArgs(NPObject* windowObject, NPP in
     pluginLogWithWindowObject(windowObject, instance, message);
 }
              
-// Helper function to log to the console object.
-void pluginLog(NPP instance, const char* format, ...)
+void pluginLogWithArguments(NPP instance, const char* format, va_list args)
 {
-    va_list args;
-    va_start(args, format);
     char message[2048] = "PLUGIN: ";
     vsprintf(message + strlen(message), format, args);
-    va_end(args);
 
     NPObject* windowObject = 0;
     NPError error = browser->getvalue(instance, NPNVWindowNPObject, &windowObject);
@@ -93,6 +89,15 @@ void pluginLog(NPP instance, const char* format, ...)
     browser->releaseobject(windowObject);
 }
 
+// Helper function to log to the console object.
+void pluginLog(NPP instance, const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    pluginLogWithArguments(instance, format, args);
+    va_end(args);
+}
+
 static void pluginInvalidate(NPObject*);
 static bool pluginHasProperty(NPObject*, NPIdentifier name);
 static bool pluginHasMethod(NPObject*, NPIdentifier name);
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.h b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.h
index c264e49..efca1d5 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.h
@@ -27,6 +27,7 @@
 #define PluginObject_h
 
 #include <WebKit/npfunctions.h>
+#include <stdarg.h>
 
 #if defined(XP_MACOSX)
 #if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
@@ -87,6 +88,7 @@ extern void handleCallback(PluginObject* object, const char *url, NPReason reaso
 extern void notifyStream(PluginObject* object, const char *url, const char *headers);
 extern void testNPRuntime(NPP npp);
 extern void pluginLog(NPP instance, const char* format, ...);
+extern void pluginLogWithArguments(NPP instance, const char* format, va_list args);
 extern bool testDocumentOpen(NPP npp);
 extern bool testWindowOpen(NPP npp);
 
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
index 98ef799..9181a86 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
@@ -25,6 +25,7 @@
 
 #include "PluginTest.h"
 
+#include "PluginObject.h"
 #include <assert.h>
 #include <string.h>
 
@@ -69,6 +70,18 @@ void PluginTest::registerNPShutdownFunction(void (*func)())
     shutdownFunction = func;
 }
 
+void PluginTest::indicateTestFailure()
+{
+    // This should really be an assert, but there's no way for the test framework
+    // to know that the plug-in process crashed, so we'll just sleep for a while
+    // to ensure that the test times out.
+#if defined(XP_WIN)
+    ::Sleep(100000);
+#else
+    sleep(1000);
+#endif
+}
+
 NPError PluginTest::NPP_New(NPMIMEType pluginType, uint16_t mode, int16_t argc, char *argn[], char *argv[], NPSavedData *saved)
 {
     return NPERR_NO_ERROR;
@@ -135,6 +148,13 @@ bool PluginTest::NPN_RemoveProperty(NPObject* npObject, NPIdentifier propertyNam
     return browser->removeproperty(m_npp, npObject, propertyName);
 }
 
+#ifdef XP_MACOSX
+bool PluginTest::NPN_ConvertPoint(double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace)
+{
+    return browser->convertpoint(m_npp, sourceX, sourceY, sourceSpace, destX, destY, destSpace);
+}
+#endif
+
 void PluginTest::executeScript(const char* script)
 {
     NPObject* windowScriptObject;
@@ -149,6 +169,14 @@ void PluginTest::executeScript(const char* script)
     browser->releasevariantvalue(&browserResult);
 }
 
+void PluginTest::log(const char* format, ...)
+{
+    va_list args;
+    va_start(args, format);
+    pluginLogWithArguments(m_npp, format, args);
+    va_end(args);
+}
+
 void PluginTest::waitUntilDone()
 {
     executeScript("layoutTestController.waitUntilDone()");
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
index cf94165..b704014 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
@@ -73,11 +73,17 @@ public:
     NPError NPN_GetValue(NPNVariable, void* value);
     NPObject* NPN_CreateObject(NPClass*);
     bool NPN_RemoveProperty(NPObject*, NPIdentifier propertyName);
-    
+#ifdef XP_MACOSX
+    bool NPN_ConvertPoint(double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
+#endif
+
     void executeScript(const char*);
+    void log(const char* format, ...);
 
     void registerNPShutdownFunction(void (*)());
 
+    static void indicateTestFailure();
+
     template<typename TestClassTy> class Register {
     public:
         Register(const std::string& identifier)
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp
index c53ec97..91f47af 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp
@@ -42,16 +42,8 @@ private:
     public:
         ~TestObject() 
         {
-            // This should really be an assert, but there's no way for the test framework
-            // to know that the plug-in process crashed, so we'll just sleep for a while
-            // to ensure that the test times out.
-            if (wasShutdownCalled) {
-#if defined(XP_WIN)
-                ::Sleep(100000);
-#else
-                sleep(1000);
-#endif
-            }
+            if (wasShutdownCalled)
+                indicateTestFailure();
         }
     };
 
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPPSetWindowCalledDuringDestruction.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPPSetWindowCalledDuringDestruction.cpp
new file mode 100644
index 0000000..ba63243
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPPSetWindowCalledDuringDestruction.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PluginTest.h"
+
+#include "PluginObject.h"
+
+using namespace std;
+
+// NPP_SetWindow should be called with a null window handle as destruction begins on non-Mac platforms.
+
+class NPPSetWindowCalledDuringDestruction : public PluginTest {
+public:
+    NPPSetWindowCalledDuringDestruction(NPP, const string& identifier);
+
+    void setWillBeDestroyed() { m_willBeDestroyed = true; }
+
+private:
+    struct ScriptObject : Object<ScriptObject> {
+        bool hasMethod(NPIdentifier);
+        bool invoke(NPIdentifier, const NPVariant*, uint32_t, NPVariant*);
+    };
+
+    virtual NPError NPP_GetValue(NPPVariable, void*);
+    virtual NPError NPP_SetWindow(NPP, NPWindow*);
+    virtual NPError NPP_Destroy(NPSavedData**);
+
+    bool m_willBeDestroyed;
+    bool m_setWindowCalledBeforeDestruction;
+    bool m_setWindowCalledDuringDestruction;
+};
+
+static PluginTest::Register<NPPSetWindowCalledDuringDestruction> registrar("npp-set-window-called-during-destruction");
+
+NPPSetWindowCalledDuringDestruction::NPPSetWindowCalledDuringDestruction(NPP npp, const string& identifier)
+    : PluginTest(npp, identifier)
+    , m_willBeDestroyed(false)
+    , m_setWindowCalledBeforeDestruction(false)
+    , m_setWindowCalledDuringDestruction(false)
+{
+}
+
+NPError NPPSetWindowCalledDuringDestruction::NPP_GetValue(NPPVariable variable, void* value)
+{
+    if (variable != NPPVpluginScriptableNPObject)
+        return NPERR_GENERIC_ERROR;
+
+    *static_cast<NPObject**>(value) = ScriptObject::create(this);
+
+    return NPERR_NO_ERROR;
+}
+
+NPError NPPSetWindowCalledDuringDestruction::NPP_SetWindow(NPP, NPWindow* window)
+{
+    if (m_willBeDestroyed) {
+        m_setWindowCalledDuringDestruction = true;
+        if (!m_setWindowCalledBeforeDestruction) {
+            log("Fail: setWillBeDestroyed() was called before the initial NPP_SetWindow call");
+            return NPERR_NO_ERROR;
+        }
+#ifndef XP_MACOSX
+        if (window->window)
+            log("Fail: NPP_SetWindow passed a non-null window during plugin destruction");
+#endif
+        return NPERR_NO_ERROR;
+    }
+
+    if (m_setWindowCalledBeforeDestruction) {
+        log("Fail: NPP_SetWindow called more than once before plugin destruction");
+        return NPERR_NO_ERROR;
+    }
+
+    m_setWindowCalledBeforeDestruction = true;
+    return NPERR_NO_ERROR;
+}
+
+NPError NPPSetWindowCalledDuringDestruction::NPP_Destroy(NPSavedData**)
+{
+#ifdef XP_MACOSX
+    bool shouldHaveBeenCalledDuringDestruction = false;
+#else
+    bool shouldHaveBeenCalledDuringDestruction = true;
+#endif
+
+    if (m_setWindowCalledDuringDestruction == shouldHaveBeenCalledDuringDestruction)
+        log("Success: NPP_SetWindow %s called during plugin destruction", shouldHaveBeenCalledDuringDestruction ? "was" : "was not");
+    else
+        log("Fail: NPP_SetWindow %s called during plugin destruction", shouldHaveBeenCalledDuringDestruction ? "was not" : "was");
+
+    return NPERR_NO_ERROR;
+}
+
+bool NPPSetWindowCalledDuringDestruction::ScriptObject::hasMethod(NPIdentifier methodName)
+{
+    return methodName == pluginTest()->NPN_GetStringIdentifier("setWillBeDestroyed");
+}
+
+bool NPPSetWindowCalledDuringDestruction::ScriptObject::invoke(NPIdentifier identifier, const NPVariant*, uint32_t, NPVariant*)
+{
+    assert(identifier == pluginTest()->NPN_GetStringIdentifier("setWillBeDestroyed"));
+    static_cast<NPPSetWindowCalledDuringDestruction*>(pluginTest())->setWillBeDestroyed();
+    return true;
+}
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp
new file mode 100644
index 0000000..7cef707
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/mac/ConvertPoint.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PluginTest.h"
+
+using namespace std;
+
+// Test that NPN_ConvertPoint converts correctly.
+class ConvertPoint : public PluginTest {
+public:
+    ConvertPoint(NPP npp, const string& identifier)
+        : PluginTest(npp, identifier)
+    {
+    }
+
+    bool testConvert(double x, double y, NPCoordinateSpace sourceSpace, NPCoordinateSpace destSpace)
+    {
+        // First convert from src to dest.
+        double destX, destY;
+        if (!NPN_ConvertPoint(x, y, sourceSpace, &destX, &destY, destSpace))
+            return false;
+
+        // Then convert back to src
+        double srcX, srcY;
+        if (!NPN_ConvertPoint(destX, destY, destSpace, &srcX, &srcY, sourceSpace))
+            return false;
+
+
+        // Then compare.
+        if (srcX != x || srcY != y)
+            return false;
+
+        return true;
+    }
+
+    bool testConvert()
+    {
+        static const NPCoordinateSpace spaces[] = { NPCoordinateSpacePlugin, NPCoordinateSpaceWindow, NPCoordinateSpaceFlippedWindow, NPCoordinateSpaceScreen, NPCoordinateSpaceFlippedScreen };
+
+        static const size_t numSpaces = sizeof(spaces) / sizeof(spaces[0]);
+        for (size_t i = 0; i < numSpaces; ++i) {
+            for (size_t j = 0; j < numSpaces; ++j) {
+                if (!testConvert(1234, 5678, spaces[i], spaces[j]))
+                    return false;
+            }
+        }
+        return true;
+    }
+private:
+    virtual NPError NPP_New(NPMIMEType pluginType, uint16_t mode, int16_t argc, char *argn[], char *argv[], NPSavedData *saved)
+    {
+        if (testConvert())
+            executeScript("document.getElementById('result').innerHTML = 'SUCCESS!'");
+
+        return NPERR_NO_ERROR;
+    }        
+};
+
+static PluginTest::Register<ConvertPoint> convertPoint("convert-point");
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
index 5856985..b7bf54b 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
@@ -410,6 +410,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\Tests\NPPSetWindowCalledDuringDestruction.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\Tests\NPRuntimeObjectFromDestroyedPlugin.cpp"
 				>
 			</File>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops
index 4a65c62..8d64b41 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="TestNetscapePluginProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\TestNetscapePluginCommon.vsprops"
 	>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops
index c410e11..1aeb953 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="TestNetscapePluginRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\TestNetscapePluginCommon.vsprops"
 	>
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops
index eb51008..03651ab 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePluginReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="TestNetscapePluginReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\TestNetscapePluginCommon.vsprops"
diff --git a/Tools/DumpRenderTree/cairo/PixelDumpSupportCairo.cpp b/Tools/DumpRenderTree/cairo/PixelDumpSupportCairo.cpp
index 7de019d..c10a3a7 100644
--- a/Tools/DumpRenderTree/cairo/PixelDumpSupportCairo.cpp
+++ b/Tools/DumpRenderTree/cairo/PixelDumpSupportCairo.cpp
@@ -49,7 +49,7 @@ static cairo_status_t writeFunction(void* closure, const unsigned char* data, un
     return CAIRO_STATUS_SUCCESS;
 }
 
-static void printPNG(cairo_surface_t* image)
+static void printPNG(cairo_surface_t* image, const char* checksum)
 {
     Vector<unsigned char> pixelData;
     // Only PNG output is supported for now.
@@ -58,7 +58,7 @@ static void printPNG(cairo_surface_t* image)
     const size_t dataLength = pixelData.size();
     const unsigned char* data = pixelData.data();
 
-    printPNG(data, dataLength);
+    printPNG(data, dataLength, checksum);
 }
 
 void computeMD5HashStringForBitmapContext(BitmapContext* context, char hashString[33])
@@ -86,8 +86,8 @@ void computeMD5HashStringForBitmapContext(BitmapContext* context, char hashStrin
         hash[8], hash[9], hash[10], hash[11], hash[12], hash[13], hash[14], hash[15]);
 }
 
-void dumpBitmap(BitmapContext* context)
+void dumpBitmap(BitmapContext* context, const char* checksum)
 {
     cairo_surface_t* surface = cairo_get_target(context->cairoContext());
-    printPNG(surface);
+    printPNG(surface, checksum);
 }
diff --git a/Tools/DumpRenderTree/cg/PixelDumpSupportCG.cpp b/Tools/DumpRenderTree/cg/PixelDumpSupportCG.cpp
index 5cf32f1..bf59b03 100644
--- a/Tools/DumpRenderTree/cg/PixelDumpSupportCG.cpp
+++ b/Tools/DumpRenderTree/cg/PixelDumpSupportCG.cpp
@@ -55,7 +55,7 @@ using namespace std;
 static const CFStringRef kUTTypePNG = CFSTR("public.png");
 #endif
 
-static void printPNG(CGImageRef image)
+static void printPNG(CGImageRef image, const char* checksum)
 {
     RetainPtr<CFMutableDataRef> imageData(AdoptCF, CFDataCreateMutable(0, 0));
     RetainPtr<CGImageDestinationRef> imageDest(AdoptCF, CGImageDestinationCreateWithData(imageData.get(), kUTTypePNG, 1, 0));
@@ -65,7 +65,7 @@ static void printPNG(CGImageRef image)
     const UInt8* data = CFDataGetBytePtr(imageData.get());
     CFIndex dataLength = CFDataGetLength(imageData.get());
 
-    printPNG(static_cast<const unsigned char*>(data), static_cast<size_t>(dataLength));
+    printPNG(static_cast<const unsigned char*>(data), static_cast<size_t>(dataLength), checksum);
 }
 
 void computeMD5HashStringForBitmapContext(BitmapContext* context, char hashString[33])
@@ -106,8 +106,8 @@ void computeMD5HashStringForBitmapContext(BitmapContext* context, char hashStrin
         snprintf(hashString, 33, "%s%02x", hashString, hash[i]);
 }
 
-void dumpBitmap(BitmapContext* context)
+void dumpBitmap(BitmapContext* context, const char* checksum)
 {
     RetainPtr<CGImageRef> image(AdoptCF, CGBitmapContextCreateImage(context->cgContext()));
-    printPNG(image.get());
+    printPNG(image.get(), checksum);
 }
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
index d91cd6e..72c05b1 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
@@ -214,6 +214,7 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindProperty("globalFlag", &m_globalFlag);
     // webHistoryItemCount is used by tests in LayoutTests\http\tests\history
     bindProperty("webHistoryItemCount", &m_webHistoryItemCount);
+    bindProperty("titleTextDirection", &m_titleTextDirection);
 }
 
 LayoutTestController::~LayoutTestController()
@@ -573,6 +574,7 @@ void LayoutTestController::reset()
     m_deferMainResourceDataLoad = true;
     m_globalFlag.set(false);
     m_webHistoryItemCount.set(0);
+    m_titleTextDirection.set("ltr");
     m_userStyleSheetLocation = WebURL();
 
     webkit_support::SetAcceptAllCookies(false);
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.h b/Tools/DumpRenderTree/chromium/LayoutTestController.h
index a9c6ce4..5df7153 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.h
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.h
@@ -44,6 +44,7 @@
 #include "CppBoundClass.h"
 #include "Task.h"
 #include "WebString.h"
+#include "WebTextDirection.h"
 #include "WebURL.h"
 #include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
@@ -391,6 +392,10 @@ public:
     bool stopProvisionalFrameLoads() { return m_stopProvisionalFrameLoads; }
     bool deferMainResourceDataLoad() { return m_deferMainResourceDataLoad; }
     void setShowDebugLayerTree(bool value) { m_showDebugLayerTree = value; }
+    void setTitleTextDirection(WebKit::WebTextDirection dir)
+    {
+        m_titleTextDirection.set(dir == WebKit::WebTextDirectionLeftToRight ? "ltr" : "rtl");
+    }
 
     bool testRepaint() const { return m_testRepaint; }
     bool sweepHorizontally() const { return m_sweepHorizontally; }
@@ -574,6 +579,9 @@ private:
     // Bound variable counting the number of top URLs visited.
     CppVariant m_webHistoryItemCount;
 
+    // Bound variable tracking the directionality of the <title> tag.
+    CppVariant m_titleTextDirection;
+
     WebKit::WebURL m_userStyleSheetLocation;
 
     OwnPtr<WebKit::WebSpeechInputControllerMock> m_speechInputControllerMock;
diff --git a/Tools/DumpRenderTree/chromium/TestShell.cpp b/Tools/DumpRenderTree/chromium/TestShell.cpp
index 4790509..4a092e7 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShell.cpp
@@ -50,7 +50,6 @@
 #include "WebURLResponse.h"
 #include "WebView.h"
 #include "WebViewHost.h"
-#include "skia/ext/bitmap_platform_device.h"
 #include "skia/ext/platform_canvas.h"
 #include "webkit/support/webkit_support.h"
 #include "webkit/support/webkit_support_gfx.h"
@@ -77,6 +76,21 @@ static const char fileTestPrefix[] = "(file test):";
 static const char dataUrlPattern[] = "data:";
 static const string::size_type dataUrlPatternSize = sizeof(dataUrlPattern) - 1;
 
+// FIXME: Move this to a common place so that it can be shared with
+// WebCore::TransparencyWin::makeLayerOpaque().
+static void makeCanvasOpaque(SkCanvas* canvas)
+{
+    const SkBitmap& bitmap = canvas->getTopDevice()->accessBitmap(true);
+    ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
+
+    SkAutoLockPixels lock(bitmap);
+    for (int y = 0; y < bitmap.height(); y++) {
+        uint32_t* row = bitmap.getAddr32(0, y);
+        for (int x = 0; x < bitmap.width(); x++)
+            row[x] |= 0xFF000000; // Set alpha bits to 1.
+    }
+}
+
 TestShell::TestShell(bool testShellMode)
     : m_testIsPending(false)
     , m_testIsPreparing(false)
@@ -516,14 +530,8 @@ void TestShell::dump()
     fflush(stderr);
 }
 
-void TestShell::dumpImage(skia::PlatformCanvas* canvas) const
+void TestShell::dumpImage(SkCanvas* canvas) const
 {
-    skia::BitmapPlatformDevice& device =
-        static_cast<skia::BitmapPlatformDevice&>(canvas->getTopPlatformDevice());
-    const SkBitmap& sourceBitmap = device.accessBitmap(false);
-
-    SkAutoLockPixels sourceBitmapLock(sourceBitmap);
-
     // Fix the alpha. The expected PNGs on Mac have an alpha channel, so we want
     // to keep it. On Windows, the alpha channel is wrong since text/form control
     // drawing may have erased it in a few places. So on Windows we force it to
@@ -533,9 +541,12 @@ void TestShell::dumpImage(skia::PlatformCanvas* canvas) const
     bool discardTransparency = false;
 #else
     bool discardTransparency = true;
-    device.makeOpaque(0, 0, sourceBitmap.width(), sourceBitmap.height());
+    makeCanvasOpaque(canvas);
 #endif
 
+    const SkBitmap& sourceBitmap = canvas->getTopDevice()->accessBitmap(false);
+    SkAutoLockPixels sourceBitmapLock(sourceBitmap);
+
     // Compute MD5 sum.
     MD5 digester;
     Vector<uint8_t, 16> digestValue;
diff --git a/Tools/DumpRenderTree/chromium/TestShell.h b/Tools/DumpRenderTree/chromium/TestShell.h
index d84d642..10d6909 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.h
+++ b/Tools/DumpRenderTree/chromium/TestShell.h
@@ -54,9 +54,6 @@ class WebNotificationPresenter;
 class WebView;
 class WebURL;
 }
-namespace skia {
-class PlatformCanvas;
-}
 
 class DRTDevToolsAgent;
 class DRTDevToolsCallArgs;
@@ -182,7 +179,7 @@ private:
     void resetWebSettings(WebKit::WebView&);
     void dump();
     std::string dumpAllBackForwardLists();
-    void dumpImage(skia::PlatformCanvas*) const;
+    void dumpImage(SkCanvas*) const;
 
     bool m_testIsPending;
     bool m_testIsPreparing;
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.cpp b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
index 84f84b6..c609397 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.cpp
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
@@ -165,5 +165,8 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setUsesEncodingDetector(false);
     settings->setImagesEnabled(true);
     settings->setInteractiveFormValidationEnabled(true);
+    // Enable fullscreen so the fullscreen layout tests can run.
+    settings->setFullScreenEnabled(true);
+    settings->setValidationMessageTimerMagnification(-1);
 }
 
diff --git a/Tools/DumpRenderTree/chromium/WebThemeControlDRTWin.cpp b/Tools/DumpRenderTree/chromium/WebThemeControlDRTWin.cpp
index b1d9fa1..a2dda1d 100755
--- a/Tools/DumpRenderTree/chromium/WebThemeControlDRTWin.cpp
+++ b/Tools/DumpRenderTree/chromium/WebThemeControlDRTWin.cpp
@@ -46,7 +46,6 @@
 #include <wtf/Assertions.h>
 
 using namespace std;
-using namespace skia;
 
 static const SkColor edgeColor     = SK_ColorBLACK;
 static const SkColor readOnlyColor = SkColorSetRGB(0xe9, 0xc2, 0xa6);
@@ -93,7 +92,7 @@ static SkIRect validate(const SkIRect& rect, WebThemeControlDRTWin::Type ctype)
 
 // WebThemeControlDRTWin
 
-WebThemeControlDRTWin::WebThemeControlDRTWin(PlatformCanvas* canvas,
+WebThemeControlDRTWin::WebThemeControlDRTWin(SkCanvas* canvas,
                                              const SkIRect& irect,
                                              Type ctype,
                                              State cstate)
@@ -304,7 +303,7 @@ void WebThemeControlDRTWin::draw()
     // Indents for the the slider track.
     const int sliderIndent = 2;
 
-    m_canvas->beginPlatformPaint();
+    skia::BeginPlatformPaint(m_canvas);
 
     switch (m_type) {
     case UnknownType:
@@ -475,7 +474,7 @@ void WebThemeControlDRTWin::draw()
     }
 
     markState();
-    m_canvas->endPlatformPaint();
+    skia::EndPlatformPaint(m_canvas);
 }
 
 // Because rendering a text field is dependent on input
@@ -485,7 +484,7 @@ void WebThemeControlDRTWin::drawTextField(bool drawEdges, bool fillContentArea,
 {
     SkPaint paint;
 
-    m_canvas->beginPlatformPaint();
+    skia::BeginPlatformPaint(m_canvas);
     if (fillContentArea) {
         paint.setColor(color);
         paint.setStyle(SkPaint::kFill_Style);
@@ -498,14 +497,14 @@ void WebThemeControlDRTWin::drawTextField(bool drawEdges, bool fillContentArea,
     }
 
     markState();
-    m_canvas->endPlatformPaint();
+    skia::EndPlatformPaint(m_canvas);
 }
 
 void WebThemeControlDRTWin::drawProgressBar(const SkIRect& fillRect)
 {
     SkPaint paint;
 
-    m_canvas->beginPlatformPaint();
+    skia::BeginPlatformPaint(m_canvas);
     paint.setColor(m_bgColor);
     paint.setStyle(SkPaint::kFill_Style);
     m_canvas->drawIRect(m_irect, paint);
@@ -518,6 +517,6 @@ void WebThemeControlDRTWin::drawProgressBar(const SkIRect& fillRect)
     m_canvas->drawIRect(tofill, paint);
 
     markState();
-    m_canvas->endPlatformPaint();
+    skia::EndPlatformPaint(m_canvas);
 }
 
diff --git a/Tools/DumpRenderTree/chromium/WebThemeControlDRTWin.h b/Tools/DumpRenderTree/chromium/WebThemeControlDRTWin.h
index ede1458..6448dc6 100644
--- a/Tools/DumpRenderTree/chromium/WebThemeControlDRTWin.h
+++ b/Tools/DumpRenderTree/chromium/WebThemeControlDRTWin.h
@@ -120,12 +120,9 @@ public:
         ProgressBarType
     };
 
-    // canvas is the canvas to draw onto, and rect gives the size of the
-    // control. ctype and cstate specify the type and state of the control.
-    WebThemeControlDRTWin(skia::PlatformCanvas* canvas,
-                          const SkIRect& rect,
-                          Type ctype,
-                          State cstate);
+    // Constructs a control of the given size, type and state to draw
+    // on to the given canvas.
+    WebThemeControlDRTWin(SkCanvas*, const SkIRect&, Type, State);
     ~WebThemeControlDRTWin();
 
     // Draws the control.
@@ -184,7 +181,7 @@ private:
     // color is which.
     void markState();
 
-    skia::PlatformCanvas* m_canvas;
+    SkCanvas* m_canvas;
     const SkIRect m_irect;
     const Type m_type;
     const State m_state;
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.cpp b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
index 97c00e2..ae4a1b1 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.cpp
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
@@ -66,7 +66,6 @@
 
 using namespace WebCore;
 using namespace WebKit;
-using namespace skia;
 using namespace std;
 
 static const int screenWidth = 1920;
@@ -406,7 +405,7 @@ bool WebViewHost::handleCurrentKeyboardEvent()
     return frame->executeCommand(WebString::fromUTF8(m_editCommandName), WebString::fromUTF8(m_editCommandValue));
 }
 
-void WebViewHost::spellCheck(const WebString& text, int& misspelledOffset, int& misspelledLength)
+void WebViewHost::spellCheck(const WebString& text, int& misspelledOffset, int& misspelledLength, WebVector<WebString>* optionalSuggestions)
 {
     // Check the spelling of the given text.
     m_spellcheck.spellCheckWord(text, &misspelledOffset, &misspelledLength);
@@ -933,7 +932,7 @@ void WebViewHost::didClearWindowObject(WebFrame* frame)
     m_shell->bindJSObjectsToWindow(frame);
 }
 
-void WebViewHost::didReceiveTitle(WebFrame* frame, const WebString& title)
+void WebViewHost::didReceiveTitle(WebFrame* frame, const WebString& title, WebTextDirection direction)
 {
     WebCString title8 = title.utf8();
 
@@ -946,6 +945,7 @@ void WebViewHost::didReceiveTitle(WebFrame* frame, const WebString& title)
         printf("TITLE CHANGED: %s\n", title8.data());
 
     setPageTitle(title);
+    layoutTestController()->setTitleTextDirection(direction);
 }
 
 void WebViewHost::didFinishDocumentLoad(WebFrame* frame)
@@ -1470,8 +1470,9 @@ void WebViewHost::paintRect(const WebRect& rect)
     ASSERT(!m_isPainting);
     ASSERT(canvas());
     m_isPainting = true;
-#if PLATFORM(CG)
-    webWidget()->paint(canvas()->getTopPlatformDevice().GetBitmapContext(), rect);
+#if USE(CG)
+    webWidget()->paint(skia::BeginPlatformPaint(canvas()), rect);
+    skia::EndPlatformPaint(canvas());
 #else
     webWidget()->paint(canvas(), rect);
 #endif
@@ -1512,13 +1513,14 @@ void WebViewHost::paintInvalidatedRegion()
     ASSERT(m_paintRect.isEmpty());
 }
 
-PlatformCanvas* WebViewHost::canvas()
+SkCanvas* WebViewHost::canvas()
 {
     if (m_canvas)
         return m_canvas.get();
     WebSize widgetSize = webWidget()->size();
     resetScrollRect();
-    m_canvas.set(new PlatformCanvas(widgetSize.width, widgetSize.height, true));
+    m_canvas.set(skia::CreateBitmapCanvas(
+        widgetSize.width, widgetSize.height, true));
     return m_canvas.get();
 }
 
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.h b/Tools/DumpRenderTree/chromium/WebViewHost.h
index 014be2e..3251823 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.h
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.h
@@ -45,7 +45,9 @@
 #include <wtf/text/WTFString.h>
 
 class LayoutTestController;
+class SkCanvas;
 class TestShell;
+
 namespace WebKit {
 class WebFrame;
 class WebDeviceOrientationClient;
@@ -61,9 +63,6 @@ struct WebRect;
 struct WebURLError;
 struct WebWindowFeatures;
 }
-namespace skia {
-class PlatformCanvas;
-}
 
 class WebViewHost : public WebKit::WebSpellCheckClient, public WebKit::WebViewClient, public WebKit::WebFrameClient, public NavigationHost {
  public:
@@ -87,7 +86,7 @@ class WebViewHost : public WebKit::WebSpellCheckClient, public WebKit::WebViewCl
     void paintRect(const WebKit::WebRect&);
     void updatePaintRect(const WebKit::WebRect&);
     void paintInvalidatedRegion();
-    skia::PlatformCanvas* canvas();
+    SkCanvas* canvas();
     void displayRepaintMask();
 
     void loadURLForFrame(const WebKit::WebURL&, const WebKit::WebString& frameName);
@@ -106,7 +105,7 @@ class WebViewHost : public WebKit::WebSpellCheckClient, public WebKit::WebViewCl
     virtual bool navigate(const TestNavigationEntry&, bool reload);
 
     // WebKit::WebSpellCheckClient
-    virtual void spellCheck(const WebKit::WebString&, int& offset, int& length);
+    virtual void spellCheck(const WebKit::WebString&, int& offset, int& length, WebKit::WebVector<WebKit::WebString>* optionalSuggestions);
     virtual void requestCheckingOfText(const WebKit::WebString&, WebKit::WebTextCheckingCompletion*);
     virtual WebKit::WebString autoCorrectWord(const WebKit::WebString&);
 
@@ -193,7 +192,7 @@ class WebViewHost : public WebKit::WebSpellCheckClient, public WebKit::WebViewCl
     virtual void didFailProvisionalLoad(WebKit::WebFrame*, const WebKit::WebURLError&);
     virtual void didCommitProvisionalLoad(WebKit::WebFrame*, bool isNewNavigation);
     virtual void didClearWindowObject(WebKit::WebFrame*);
-    virtual void didReceiveTitle(WebKit::WebFrame*, const WebKit::WebString&);
+    virtual void didReceiveTitle(WebKit::WebFrame*, const WebKit::WebString&, WebKit::WebTextDirection);
     virtual void didFinishDocumentLoad(WebKit::WebFrame*);
     virtual void didHandleOnloadEvents(WebKit::WebFrame*);
     virtual void didFailLoad(WebKit::WebFrame*, const WebKit::WebURLError&);
@@ -333,7 +332,7 @@ private:
     MockSpellCheck m_spellcheck;
 
     // Painting.
-    OwnPtr<skia::PlatformCanvas> m_canvas;
+    OwnPtr<SkCanvas> m_canvas;
     WebKit::WebRect m_paintRect;
     bool m_isPainting;
 
diff --git a/Tools/DumpRenderTree/config.h b/Tools/DumpRenderTree/config.h
index 90cfcf6..bde0cc8 100644
--- a/Tools/DumpRenderTree/config.h
+++ b/Tools/DumpRenderTree/config.h
@@ -48,8 +48,8 @@
 #define WEBKIT_EXPORTDATA
 #endif
 
-#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
-#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
 
 #endif /* USE(EXPORT_MACROS) */
 
@@ -74,10 +74,10 @@
 #if PLATFORM(WIN)
 #define WTF_USE_CF 1 
 #if defined(WIN_CAIRO)
-#define WTF_PLATFORM_CAIRO 1
+#define WTF_USE_CAIRO 1
 #define WTF_USE_CURL 1
 #else
-#define WTF_PLATFORM_CG 1
+#define WTF_USE_CG 1
 #define WTF_USE_CFNETWORK 1
 #endif
 
diff --git a/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp b/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
index ff76e4b..8a4a490 100644
--- a/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
@@ -26,15 +26,14 @@
 
 #include "config.h"
 #include "AccessibilityUIElement.h"
+
 #include "GOwnPtr.h"
 #include "GRefPtr.h"
-
+#include "WebCoreSupport/DumpRenderTreeSupportGtk.h"
 #include <JavaScriptCore/JSStringRef.h>
-#include <wtf/Assertions.h>
-
 #include <atk/atk.h>
 #include <gtk/gtk.h>
-
+#include <wtf/Assertions.h>
 
 AccessibilityUIElement::AccessibilityUIElement(PlatformUIElement element)
     : m_element(element)
@@ -488,16 +487,56 @@ int AccessibilityUIElement::indexInTable()
     return 0;
 }
 
+static JSStringRef indexRangeInTable(PlatformUIElement element, bool isRowRange)
+{
+    GOwnPtr<gchar> rangeString(g_strdup("{0, 0}"));
+
+    if (!element)
+        return JSStringCreateWithUTF8CString(rangeString.get());
+
+    ASSERT(ATK_IS_OBJECT(element));
+
+    AtkObject* axTable = atk_object_get_parent(ATK_OBJECT(element));
+    if (!axTable || !ATK_IS_TABLE(axTable))
+        return JSStringCreateWithUTF8CString(rangeString.get());
+
+    // Look for the cell in the table.
+    gint indexInParent = atk_object_get_index_in_parent(ATK_OBJECT(element));
+    if (indexInParent == -1)
+        return JSStringCreateWithUTF8CString(rangeString.get());
+
+    int row = -1;
+    int column = -1;
+    row = atk_table_get_row_at_index(ATK_TABLE(axTable), indexInParent);
+    column = atk_table_get_column_at_index(ATK_TABLE(axTable), indexInParent);
+
+    // Get the actual values, if row and columns are valid values.
+    if (row != -1 && column != -1) {
+        int base = 0;
+        int length = 0;
+        if (isRowRange) {
+            base = row;
+            length = atk_table_get_row_extent_at(ATK_TABLE(axTable), row, column);
+        } else {
+            base = column;
+            length = atk_table_get_column_extent_at(ATK_TABLE(axTable), row, column);
+        }
+        rangeString.set(g_strdup_printf("{%d, %d}", base, length));
+    }
+
+    return JSStringCreateWithUTF8CString(rangeString.get());
+}
+
 JSStringRef AccessibilityUIElement::rowIndexRange()
 {
-    // FIXME: implement
-    return JSStringCreateWithCharacters(0, 0);
+    // Range in table for rows.
+    return indexRangeInTable(m_element, true);
 }
 
 JSStringRef AccessibilityUIElement::columnIndexRange()
 {
-    // FIXME: implement
-    return JSStringCreateWithCharacters(0, 0);
+    // Range in table for columns.
+    return indexRangeInTable(m_element, false);
 }
 
 int AccessibilityUIElement::lineForIndex(int)
@@ -532,8 +571,13 @@ bool AccessibilityUIElement::attributedStringRangeIsMisspelled(unsigned location
 
 AccessibilityUIElement AccessibilityUIElement::cellForColumnAndRow(unsigned column, unsigned row)
 {
-    // FIXME: implement
-    return 0;
+    if (!m_element)
+        return 0;
+
+    ASSERT(ATK_IS_TABLE(m_element));
+
+    AtkObject* foundCell = atk_table_ref_at(ATK_TABLE(m_element), row, column);
+    return foundCell ? AccessibilityUIElement(foundCell) : 0;
 }
 
 JSStringRef AccessibilityUIElement::selectedTextRange()
@@ -572,12 +616,20 @@ bool AccessibilityUIElement::isAttributeSupported(JSStringRef attribute)
 
 void AccessibilityUIElement::increment()
 {
-    // FIXME: implement
+    if (!m_element)
+        return;
+
+    ASSERT(ATK_IS_OBJECT(m_element));
+    DumpRenderTreeSupportGtk::incrementAccessibilityValue(ATK_OBJECT(m_element));
 }
 
 void AccessibilityUIElement::decrement()
 {
-    // FIXME: implement
+    if (!m_element)
+        return;
+
+    ASSERT(ATK_IS_OBJECT(m_element));
+    DumpRenderTreeSupportGtk::decrementAccessibilityValue(ATK_OBJECT(m_element));
 }
 
 void AccessibilityUIElement::press()
diff --git a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
index f768b43..a281e48 100644
--- a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -39,6 +39,7 @@
 #include "GOwnPtr.h"
 #include "LayoutTestController.h"
 #include "PixelDumpSupport.h"
+#include "PlainTextController.h"
 #include "TextInputController.h"
 #include "WebCoreSupport/DumpRenderTreeSupportGtk.h"
 #include "WorkQueue.h"
@@ -814,6 +815,13 @@ static void webViewOnloadEvent(WebKitWebView* view, WebKitWebFrame* frame, void*
     }
 }
 
+static void addControllerToWindow(JSContextRef context, JSObjectRef windowObject, const char* controllerName, JSValueRef controller)
+{
+    JSStringRef controllerNameStr = JSStringCreateWithUTF8CString(controllerName);
+    JSObjectSetProperty(context, windowObject, controllerNameStr, controller, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, 0);
+    JSStringRelease(controllerNameStr); 
+}
+
 static void webViewWindowObjectCleared(WebKitWebView* view, WebKitWebFrame* frame, JSGlobalContextRef context, JSObjectRef windowObject, gpointer data)
 {
     JSValueRef exception = 0;
@@ -828,15 +836,9 @@ static void webViewWindowObjectCleared(WebKitWebView* view, WebKitWebFrame* fram
     axController->makeWindowObject(context, windowObject, &exception);
     ASSERT(!exception);
 
-    JSStringRef eventSenderStr = JSStringCreateWithUTF8CString("eventSender");
-    JSValueRef eventSender = makeEventSender(context, !webkit_web_frame_get_parent(frame));
-    JSObjectSetProperty(context, windowObject, eventSenderStr, eventSender, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, 0);
-    JSStringRelease(eventSenderStr);
-
-    JSStringRef textInputControllerStr = JSStringCreateWithUTF8CString("textInputController");
-    JSValueRef textInputController = makeTextInputController(context);
-    JSObjectSetProperty(context, windowObject, textInputControllerStr, textInputController, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, 0);
-    JSStringRelease(textInputControllerStr);
+    addControllerToWindow(context, windowObject, "eventSender", makeEventSender(context, !webkit_web_frame_get_parent(frame)));
+    addControllerToWindow(context, windowObject, "plainText", makePlainTextController(context));
+    addControllerToWindow(context, windowObject, "textInputController", makeTextInputController(context));
 }
 
 static gboolean webViewConsoleMessage(WebKitWebView* view, const gchar* message, unsigned int line, const gchar* sourceId, gpointer data)
@@ -941,10 +943,8 @@ static void webViewStatusBarTextChanged(WebKitWebView* view, const gchar* messag
 {
     // Are we doing anything wrong? One test that does not call
     // dumpStatusCallbacks gets true here
-    if (gLayoutTestController->dumpStatusCallbacks()) {
-        if (message && strcmp(message, ""))
-            printf("UI DELEGATE STATUS CALLBACK: setStatusText:%s\n", message);
-    }
+    if (gLayoutTestController->dumpStatusCallbacks())
+        printf("UI DELEGATE STATUS CALLBACK: setStatusText:%s\n", message);
 }
 
 static gboolean webViewClose(WebKitWebView* view)
@@ -1048,6 +1048,9 @@ static void frameCreatedCallback(WebKitWebView* webView, WebKitWebFrame* webFram
 
 static void willSendRequestCallback(WebKitWebView* webView, WebKitWebFrame*, WebKitWebResource*, WebKitNetworkRequest* request, WebKitNetworkResponse*)
 {
+    if (!done && gLayoutTestController->willSendRequestReturnsNull())
+        return;
+
     SoupMessage* soupMessage = webkit_network_request_get_message(request);
     SoupURI* uri = soup_uri_new(webkit_network_request_get_uri(request));
 
@@ -1058,8 +1061,8 @@ static void willSendRequestCallback(WebKitWebView* webView, WebKitWebFrame*, Web
         soup_uri_free(uri);
         return;
     }
-    soup_uri_free(uri);
-
+    if (uri)
+        soup_uri_free(uri);
 
     if (soupMessage) {
         const set<string>& clearHeaders = gLayoutTestController->willSendRequestClearHeaders();
diff --git a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index c26e2db..29742be 100644
--- a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -778,6 +778,8 @@ void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value
         propertyName = "enable-plugins";
     else if (g_str_equal(originalName.get(), "WebKitHyperlinkAuditingEnabled"))
         propertyName = "enable-hyperlink-auditing";
+    else if (g_str_equal(originalName.get(), "WebKitWebGLEnabled"))
+        propertyName = "enable-webgl";
     else if (g_str_equal(originalName.get(), "WebKitTabToLinksPreferenceKey")) {
         DumpRenderTreeSupportGtk::setLinksIncludedInFocusChain(!g_ascii_strcasecmp(valueAsString.get(), "true") || !g_ascii_strcasecmp(valueAsString.get(), "1"));
         return;
@@ -917,6 +919,11 @@ void LayoutTestController::setEditingBehavior(const char* editingBehavior)
         g_object_set(G_OBJECT(settings), "editing-behavior", WEBKIT_EDITING_BEHAVIOR_UNIX, NULL);
 }
 
+JSValueRef LayoutTestController::shadowRoot(JSContextRef context, JSValueRef element)
+{
+    return DumpRenderTreeSupportGtk::shadowRoot(context, element);
+}
+
 void LayoutTestController::abortModal()
 {
 }
diff --git a/Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp b/Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
index 1e591bb..2bd8fe2 100644
--- a/Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
@@ -32,9 +32,10 @@
 #include "DumpRenderTree.h"
 #include "GtkVersioning.h"
 #include "PixelDumpSupportCairo.h"
+#include "WebCoreSupport/DumpRenderTreeSupportGtk.h"
 #include <webkit/webkit.h>
 
-PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool)
+PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool drawSelectionRect)
 {
     WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
     GtkWidget* viewContainer = gtk_widget_get_parent(GTK_WIDGET(view));
@@ -49,6 +50,7 @@ PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool)
 
     cairo_surface_t* imageSurface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, width, height);
     cairo_t* context = cairo_create(imageSurface);
+
 #ifdef GTK_API_VERSION_2
     gdk_cairo_set_source_pixmap(context, pixmap, 0, 0);
     cairo_paint(context);
@@ -57,5 +59,15 @@ PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool)
     gtk_widget_draw(viewContainer, context);
 #endif
 
+    if (drawSelectionRect) {
+        GdkRectangle rectangle;
+        DumpRenderTreeSupportGtk::rectangleForSelection(mainFrame, &rectangle);
+
+        cairo_set_line_width(context, 1.0);
+        cairo_rectangle(context, rectangle.x, rectangle.y, rectangle.width, rectangle.height);
+        cairo_set_source_rgba(context, 1.0, 0.0, 0.0, 1.0);
+        cairo_stroke(context);
+    }
+
     return BitmapContext::createByAdoptingBitmapAndContext(0, context);
 }
diff --git a/Tools/DumpRenderTree/gtk/PlainTextController.cpp b/Tools/DumpRenderTree/gtk/PlainTextController.cpp
new file mode 100644
index 0000000..25e251a
--- /dev/null
+++ b/Tools/DumpRenderTree/gtk/PlainTextController.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlainTextController.h"
+
+#include "DumpRenderTree.h"
+#include "WebCoreSupport/DumpRenderTreeSupportGtk.h"
+#include <GOwnPtrGtk.h>
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSRetainPtr.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <webkit/webkit.h>
+
+static JSValueRef plainTextCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    g_return_val_if_fail(argumentCount == 1, JSValueMakeUndefined(context));
+    WebKitDOMRange* kitRange = DumpRenderTreeSupportGtk::jsValueToDOMRange(context, arguments[0]);
+    g_return_val_if_fail(kitRange, JSValueMakeUndefined(context));
+
+    GOwnPtr<gchar> text(webkit_dom_range_get_text(kitRange));
+    JSRetainPtr<JSStringRef> jsText(Adopt, JSStringCreateWithUTF8CString(text.get()));
+    return JSValueMakeString(context, jsText.get());
+}
+
+JSObjectRef makePlainTextController(JSContextRef context)
+{
+    static JSStaticFunction staticFunctions[] = {
+        { "plainText", plainTextCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { 0, 0, 0 }
+    };
+
+    static JSClassRef plainTextControllerClass = 0;
+    if (!plainTextControllerClass) {
+        JSClassDefinition classDefinition = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
+        classDefinition.staticFunctions = staticFunctions;
+        plainTextControllerClass = JSClassCreate(&classDefinition);
+    }
+    return JSObjectMake(context, plainTextControllerClass, 0);
+}
diff --git a/Source/WebKit/mac/Misc/WebNSAttributedStringExtras.h b/Tools/DumpRenderTree/gtk/PlainTextController.h
index a4ee9fc..dadfc13 100644
--- a/Source/WebKit/mac/Misc/WebNSAttributedStringExtras.h
+++ b/Tools/DumpRenderTree/gtk/PlainTextController.h
@@ -1,18 +1,18 @@
 /*
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2011 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -20,19 +20,18 @@
  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-    * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-namespace WebCore {
-    class Range;
-}
+#ifndef PlainTextController_h
+#define PlainTextController_h
 
-@interface NSAttributedString (WebKitExtras)
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef struct OpaqueJSValue* JSObjectRef;
 
-+ (NSAttributedString *)_web_attributedStringFromRange:(WebCore::Range*)range;
-- (NSAttributedString *)_web_attributedStringByStrippingAttachmentCharacters;
+JSObjectRef makePlainTextController(JSContextRef);
 
-@end
+#endif
diff --git a/Tools/DumpRenderTree/gtk/TextInputController.cpp b/Tools/DumpRenderTree/gtk/TextInputController.cpp
index 7243fdc..d1aa33d 100644
--- a/Tools/DumpRenderTree/gtk/TextInputController.cpp
+++ b/Tools/DumpRenderTree/gtk/TextInputController.cpp
@@ -36,6 +36,7 @@
 #include <JavaScriptCore/JSRetainPtr.h>
 #include <JavaScriptCore/JSStringRef.h>
 #include <cstring>
+#include <webkit/webkit.h>
 
 static JSValueRef setMarkedTextCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
diff --git a/Tools/DumpRenderTree/mac/DumpRenderTree.mm b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
index 207e8fb..441f6bb 100644
--- a/Tools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -455,6 +455,7 @@ static void resetDefaultsToConsistentValues()
     [preferences setOfflineWebApplicationCacheEnabled:YES];
     [preferences setDeveloperExtrasEnabled:NO];
     [preferences setLoadsImagesAutomatically:YES];
+    [preferences setLoadsSiteIconsIgnoringImageLoadingPreference:NO];
     [preferences setFrameFlatteningEnabled:NO];
     [preferences setSpatialNavigationEnabled:NO];
     [preferences setEditingBehavior:WebKitEditingMacBehavior];
@@ -468,6 +469,10 @@ static void resetDefaultsToConsistentValues()
     // So, turn it off for now, but we might want to turn it back on some day.
     [preferences setUsesPageCache:NO];
     [preferences setAcceleratedCompositingEnabled:YES];
+#if USE(CA) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    [preferences setCanvasUsesAcceleratedDrawing:YES];
+    [preferences setAcceleratedDrawingEnabled:NO];
+#endif
     [preferences setWebGLEnabled:NO];
     [preferences setUsePreHTML5ParserQuirks:NO];
     [preferences setAsynchronousSpellCheckingEnabled:NO];
@@ -730,6 +735,14 @@ static NSInteger compareHistoryItems(id item1, id item2, void *context)
     return [[item1 target] caseInsensitiveCompare:[item2 target]];
 }
 
+static NSData *dumpAudio()
+{
+    const char *encodedAudioData = gLayoutTestController->encodedAudioData().c_str();
+    
+    NSData *data = [NSData dataWithBytes:encodedAudioData length:gLayoutTestController->encodedAudioData().length()];
+    return data;
+}
+
 static void dumpHistoryItem(WebHistoryItem *item, int indent, BOOL current)
 {
     int start = 0;
@@ -933,7 +946,10 @@ void dump()
             gLayoutTestController->setDumpAsText(true);
             gLayoutTestController->setGeneratePixelResults(false);
         }
-        if (gLayoutTestController->dumpAsText()) {
+        if (gLayoutTestController->dumpAsAudio()) {
+            resultData = dumpAudio();
+            resultMimeType = @"audio/wav";
+        } else if (gLayoutTestController->dumpAsText()) {
             resultString = dumpFramesAsText(mainFrame);
         } else if (gLayoutTestController->dumpAsPDF()) {
             resultData = dumpFrameAsPDF(mainFrame);
@@ -956,6 +972,9 @@ void dump()
 
         printf("Content-Type: %s\n", [resultMimeType UTF8String]);
 
+        if (gLayoutTestController->dumpAsAudio())
+            printf("Content-Transfer-Encoding: base64\n");            
+        
         if (resultData) {
             fwrite([resultData bytes], 1, [resultData length], stdout);
 
@@ -1022,6 +1041,7 @@ static void resetWebViewToConsistentStateBeforeTesting()
     [(EditingDelegate *)[webView editingDelegate] setAcceptsEditing:YES];
     [webView makeTextStandardSize:nil];
     [webView resetPageZoom:nil];
+    [webView _scaleWebView:1.0 atOrigin:NSZeroPoint];
     [webView setTabKeyCyclesThroughElements:YES];
     [webView setPolicyDelegate:nil];
     [policyDelegate setPermissive:NO];
diff --git a/Tools/DumpRenderTree/mac/EventSendingController.mm b/Tools/DumpRenderTree/mac/EventSendingController.mm
index 9031c63..4497105 100644
--- a/Tools/DumpRenderTree/mac/EventSendingController.mm
+++ b/Tools/DumpRenderTree/mac/EventSendingController.mm
@@ -135,6 +135,7 @@ BOOL replayingSavedEvents;
             || aSelector == @selector(textZoomOut)
             || aSelector == @selector(zoomPageIn)
             || aSelector == @selector(zoomPageOut)
+            || aSelector == @selector(scalePageBy:atX:andY:)
             || aSelector == @selector(mouseScrollByX:andY:)
             || aSelector == @selector(continuousMouseScrollByX:andY:))
         return NO;
@@ -174,6 +175,8 @@ BOOL replayingSavedEvents;
         return @"mouseScrollBy";
     if (aSelector == @selector(continuousMouseScrollByX:andY:))
         return @"continuousMouseScrollBy";
+    if (aSelector == @selector(scalePageBy:atX:andY:))
+        return @"scalePageBy";
     return nil;
 }
 
@@ -361,6 +364,11 @@ static int buildModifierFlags(const WebScriptObject* modifiers)
     [[mainFrame webView] zoomPageOut:self];
 }
 
+- (void)scalePageBy:(float)scale atX:(float)x andY:(float)y
+{
+    [[mainFrame webView] _scaleWebView:scale atOrigin:NSMakePoint(x, y)];
+}
+
 - (void)mouseUp:(int)buttonNumber withModifiers:(WebScriptObject*)modifiers
 {
     if (dragMode && !replayingSavedEvents) {
diff --git a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index 66c0cce..4ebf271 100644
--- a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -1068,6 +1068,14 @@ void LayoutTestController::setEditingBehavior(const char* editingBehavior)
     [editingBehaviorNS release];
 }
 
+JSValueRef LayoutTestController::shadowRoot(JSContextRef context, JSValueRef jsElement)
+{
+    DOMElement *element = [DOMElement _DOMElementFromJSContext:context value:jsElement];
+    if (!element)
+        return JSValueMakeNull(context);
+    return [element _shadowRoot:context];
+}
+
 void LayoutTestController::abortModal()
 {
     [NSApp abortModal];
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTree.pro b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
index a76b886..242651d 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -1,6 +1,6 @@
 TARGET = DumpRenderTree
 CONFIG  -= app_bundle
-CONFIG += uitools
+!isEqual(QT_ARCH,sh4): CONFIG += uitools
 
 BASEDIR = $$PWD/../
 isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../..
@@ -13,7 +13,7 @@ INCLUDEPATH += ../../../Source/WebKit/qt/WebCoreSupport
 INCLUDEPATH += $$BASEDIR
 DESTDIR = ../../bin
 
-unix:!mac:!symbian {
+unix:!mac:!symbian:!embedded {
     CONFIG += link_pkgconfig
     PKGCONFIG += fontconfig
 }
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index 97d9f20..1a6c833 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -190,6 +190,7 @@ void WebPage::resetSettings()
     settings()->resetAttribute(QWebSettings::LinksIncludedInFocusChain);
     settings()->resetAttribute(QWebSettings::OfflineWebApplicationCacheEnabled);
     settings()->resetAttribute(QWebSettings::LocalContentCanAccessRemoteUrls);
+    settings()->resetAttribute(QWebSettings::LocalContentCanAccessFileUrls);
     settings()->resetAttribute(QWebSettings::PluginsEnabled);
     settings()->resetAttribute(QWebSettings::JavascriptCanAccessClipboard);
     settings()->resetAttribute(QWebSettings::AutoLoadImages);
@@ -997,6 +998,8 @@ void DumpRenderTree::dump()
         }
 
         if (dumpImage) {
+            image.setText("checksum", actualHash);
+
             QBuffer buffer;
             buffer.open(QBuffer::WriteOnly);
             image.save(&buffer, "PNG");
@@ -1136,6 +1139,17 @@ void DumpRenderTree::switchFocus(bool focused)
 
 }
 
+QList<WebPage*> DumpRenderTree::getAllPages() const
+{
+    QList<WebPage*> pages;
+    pages.append(m_page);
+    foreach (QObject* widget, windows) {
+        if (WebPage* page = widget->findChild<WebPage*>())
+            pages.append(page);
+    }
+    return pages;
+}
+
 #if defined(Q_WS_X11)
 void DumpRenderTree::initializeFonts()
 {
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
index 858856f..cb66296 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.h
@@ -100,6 +100,7 @@ public:
     void switchFocus(bool focused);
 
     WebPage *webPage() const { return m_page; }
+    QList<WebPage*> getAllPages() const;
 
 #if defined(Q_WS_X11)
     static void initializeFonts();
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
index 4e3087e..d9f1a74 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -780,10 +780,19 @@ void LayoutTestController::setGeolocationPermission(bool allow)
     DumpRenderTreeSupportQt::setMockGeolocationPermission(m_drt->webPage(), allow);
 }
 
+QVariant LayoutTestController::shadowRoot(const QWebElement& element)
+{
+    return DumpRenderTreeSupportQt::shadowRoot(element);
+}
+
 int LayoutTestController::numberOfPendingGeolocationPermissionRequests()
 {
-    // FIXME: Implement for Geolocation layout tests.
-    return -1;
+    int pendingPermissionCount = 0;
+    QList<WebCore::WebPage*> pages = m_drt->getAllPages();
+    foreach (WebCore::WebPage* page, pages)
+        pendingPermissionCount += DumpRenderTreeSupportQt::numberOfPendingGeolocationPermissionRequests(page);
+
+    return pendingPermissionCount;
 }
 
 void LayoutTestController::setGeolocationPermissionCommon(bool allow)
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
index f29233a..2c33401 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -197,7 +197,7 @@ public slots:
     void clearAllDatabases();
     void setIconDatabaseEnabled(bool enable);
 
-    void setCustomPolicyDelegate(bool enabled, bool permissive = true);
+    void setCustomPolicyDelegate(bool enabled, bool permissive = false);
     void waitForPolicyDelegate();
 
     void overridePreference(const QString& name, const QVariant& value);
@@ -249,6 +249,8 @@ public slots:
 
     void setEditingBehavior(const QString& editingBehavior);
 
+    QVariant shadowRoot(const QWebElement&);
+
     void evaluateScriptInIsolatedWorld(int worldID, const QString& script);
     bool isPageBoxVisible(int pageIndex);
     QString pageSizeAndMarginsInPixels(int pageIndex, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft);
diff --git a/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro b/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
index 6741668..e03c876 100644
--- a/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
+++ b/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
@@ -33,6 +33,7 @@ SOURCES = PluginObject.cpp \
           Tests/GetURLWithJavaScriptURLDestroyingPlugin.cpp \
           Tests/GetUserAgentWithNullNPPFromNPPNew.cpp \
           Tests/NPDeallocateCalledBeforeNPShutdown.cpp \
+          Tests/NPPSetWindowCalledDuringDestruction.cpp \
           Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
           Tests/NPRuntimeRemoveProperty.cpp \
           Tests/NullNPPGetValuePointer.cpp \
diff --git a/Tools/DumpRenderTree/qt/main.cpp b/Tools/DumpRenderTree/qt/main.cpp
index bc762e5..89a5128 100644
--- a/Tools/DumpRenderTree/qt/main.cpp
+++ b/Tools/DumpRenderTree/qt/main.cpp
@@ -54,7 +54,7 @@
 #include <limits.h>
 #include <signal.h>
 
-#if defined(__GLIBC__)
+#if defined(__GLIBC__) && !defined(__UCLIBC__)
 #include <execinfo.h>
 #endif
 
@@ -97,7 +97,7 @@ void printUsage()
 QString get_backtrace() {
     QString s;
 
-#if defined(__GLIBC__)
+#if defined(__GLIBC__) && !defined(__UCLIBC__)
     void* array[256];
     size_t size; /* number of stack frames */
 
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.cpp b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
index 66e7311..2db43da 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -168,12 +168,15 @@ wstring urlSuitableForTestResult(const wstring& urlString)
     return cfStringRefToWString(substringFromIndex(path.get(), CFStringGetLength(basePath.get())).get());
 }
 
-wstring lastPathComponent(const wstring& url)
+wstring lastPathComponent(const wstring& urlString)
 {
-    if (url.empty())
-        return url;
+    if (urlString.empty())
+        return urlString;
+
+    RetainPtr<CFURLRef> url(AdoptCF, CFURLCreateWithBytes(kCFAllocatorDefault, reinterpret_cast<const UInt8*>(urlString.c_str()), urlString.length() * sizeof(wstring::value_type), kCFStringEncodingUTF16, 0));
+    RetainPtr<CFStringRef> lastPathComponent(CFURLCopyLastPathComponent(url.get()));
 
-    return PathFindFileNameW(url.c_str());
+    return cfStringRefToWString(lastPathComponent.get());
 }
 
 static string toUTF8(const wchar_t* wideString, size_t length)
@@ -873,6 +876,7 @@ static void resetDefaultsToConsistentValues(IWebPreferences* preferences)
         prefsPrivate->setXSSAuditorEnabled(FALSE);
         prefsPrivate->setFrameFlatteningEnabled(FALSE);
         prefsPrivate->setOfflineWebApplicationCacheEnabled(TRUE);
+        prefsPrivate->setLoadsSiteIconsIgnoringImageLoadingPreference(FALSE);
     }
     setAlwaysAcceptCookies(false);
 
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.vcproj b/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
index 39d2df2..803917a 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.vcproj
@@ -515,6 +515,14 @@
 			>
 		</File>
 		<File
+			RelativePath="..\CyclicRedundancyCheck.cpp"
+			>
+		</File>
+		<File
+			RelativePath="..\CyclicRedundancyCheck.h"
+			>
+		</File>
+		<File
 			RelativePath=".\DraggingInfo.h"
 			>
 		</File>
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeProduction.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeProduction.vsprops
index 818bff2..df20c64 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTreeProduction.vsprops
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeProduction.vsprops
@@ -6,7 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\DumpRenderTreeCommon.vsprops;
       .\DumpRenderTreeApple.vsprops"
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeRelease.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeRelease.vsprops
index c39a9cd..5f12a6b 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTreeRelease.vsprops
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeRelease.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\DumpRenderTreeCommon.vsprops;
       .\DumpRenderTreeApple.vsprops"
diff --git a/Tools/DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops b/Tools/DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops
index 508e8c5..27fefbb 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops
+++ b/Tools/DumpRenderTree/win/DumpRenderTreeReleaseCairoCFLite.vsprops
@@ -6,6 +6,7 @@
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\cURL.vsprops;
diff --git a/Tools/DumpRenderTree/win/ImageDiff.vcproj b/Tools/DumpRenderTree/win/ImageDiff.vcproj
index 7094fec..66d4b65 100644
--- a/Tools/DumpRenderTree/win/ImageDiff.vcproj
+++ b/Tools/DumpRenderTree/win/ImageDiff.vcproj
@@ -199,6 +199,7 @@
 		</Configuration>
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
+			IntermediateDirectory="$(ConfigurationName)"
 			ConfigurationType="1"
 			InheritedPropertySheets=".\ImageDiffDebugCairoCFLite.vsprops"
 			CharacterSet="2"
@@ -386,8 +387,60 @@
 	</References>
 	<Files>
 		<File
+			RelativePath="..\win\ImageDiffCairo.cpp"
+			>
+			<FileConfiguration
+				Name="Debug|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Release|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Debug_All|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Production|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+		</File>
+		<File
 			RelativePath="..\cg\ImageDiffCG.cpp"
 			>
+			<FileConfiguration
+				Name="Debug_Cairo_CFLite|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
+			<FileConfiguration
+				Name="Release_Cairo_CFLite|Win32"
+				ExcludedFromBuild="true"
+				>
+				<Tool
+					Name="VCCLCompilerTool"
+				/>
+			</FileConfiguration>
 		</File>
 	</Files>
 	<Globals>
diff --git a/Tools/DumpRenderTree/win/ImageDiffCairo.cpp b/Tools/DumpRenderTree/win/ImageDiffCairo.cpp
new file mode 100644
index 0000000..d10cc14
--- /dev/null
+++ b/Tools/DumpRenderTree/win/ImageDiffCairo.cpp
@@ -0,0 +1,260 @@
+/*
+ * Copyright (C) 2005, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2005 Ben La Monica <ben.lamonica@gmail.com>.  All rights reserved.
+ * Copyright (C) 2011 Brent Fulgham. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// FIXME: We need to be able to include these defines from a config.h somewhere.
+#define JS_EXPORT_PRIVATE
+#define WTF_EXPORT_PRIVATE
+
+#include <cairo.h>
+#include <stdio.h>
+#include <wtf/Platform.h>
+#include <wtf/RefPtr.h>
+#include <wtf/RetainPtr.h>
+
+#if PLATFORM(WIN)
+#include <fcntl.h>
+#include <io.h>
+#include <windows.h>
+#include <wtf/MathExtras.h>
+#endif
+
+using namespace std;
+
+static const int s_bufferSize = 2048;
+static const int s_bytesPerPixel = 4;
+static cairo_user_data_key_t s_imageDataKey;
+
+
+#if PLATFORM(WIN)
+#undef min
+#undef max
+
+static inline float strtof(const char* inputString, char** endptr)
+{
+    return strtod(inputString, endptr);
+}
+#endif
+
+static cairo_status_t readFromData(void* closure, unsigned char* data, unsigned int length)
+{
+    CFMutableDataRef dataSource = reinterpret_cast<CFMutableDataRef>(closure);
+
+    CFRange range = CFRangeMake(0, length);
+    CFDataGetBytes(dataSource, range, data);
+    CFDataDeleteBytes(dataSource, range);
+
+    return CAIRO_STATUS_SUCCESS;
+}
+
+static cairo_surface_t* createImageFromStdin(int bytesRemaining)
+{
+    unsigned char buffer[s_bufferSize];
+    RetainPtr<CFMutableDataRef> data(AdoptCF, CFDataCreateMutable(0, bytesRemaining));
+
+    while (bytesRemaining > 0) {
+        size_t bytesToRead = min(bytesRemaining, s_bufferSize);
+        size_t bytesRead = fread(buffer, 1, bytesToRead, stdin);
+        CFDataAppendBytes(data.get(), buffer, static_cast<CFIndex>(bytesRead));
+        bytesRemaining -= static_cast<int>(bytesRead);
+    }
+
+    return cairo_image_surface_create_from_png_stream (static_cast<cairo_read_func_t>(readFromData), data.get());
+}
+
+static void releaseMallocBuffer(void* data)
+{
+    free(data);
+}
+
+static inline float pixelDifference(float expected, float actual)
+{
+    return (actual - expected) / max<float>(255 - expected, expected);
+}
+
+static inline void normalizeBuffer(float maxDistance, unsigned char* buffer, size_t length)
+{
+    if (maxDistance >= 1)
+        return;
+
+    for (size_t p = 0; p < length; ++p)
+        buffer[p] /= maxDistance;
+}
+
+static cairo_surface_t* createDifferenceImage(cairo_surface_t* baselineImage, cairo_surface_t* actualImage, float& difference)
+{
+    size_t width = cairo_image_surface_get_width(baselineImage);
+    size_t height = cairo_image_surface_get_height(baselineImage);
+
+    unsigned char* baselinePixel = cairo_image_surface_get_data(baselineImage);
+    unsigned char* actualPixel = cairo_image_surface_get_data(actualImage);
+
+    // Compare the content of the 2 bitmaps
+    void* diffBuffer = malloc(width * height);
+    unsigned char* diffPixel = reinterpret_cast<unsigned char*>(diffBuffer);
+
+    float count = 0;
+    float sum = 0;
+    float maxDistance = 0;
+    for (size_t y = 0; y < height; ++y) {
+        for (size_t x = 0; x < width; ++x) {
+            float red = pixelDifference(baselinePixel[0], actualPixel[0]);
+            float green = pixelDifference(baselinePixel[1], actualPixel[1]);
+            float blue = pixelDifference(baselinePixel[2], actualPixel[2]);
+            float alpha = pixelDifference(baselinePixel[3], actualPixel[3]);
+
+            float distance = sqrtf(red * red + green * green + blue * blue + alpha * alpha) / 2.0;
+            
+            *diffPixel++ = static_cast<unsigned char>(distance * 255);
+            
+            if (distance >= 1.0 / 255.0) {
+                ++count;
+                sum += distance;
+                if (distance > maxDistance)
+                    maxDistance = distance;
+            }
+            
+            baselinePixel += s_bytesPerPixel;
+            actualPixel += s_bytesPerPixel;
+        }
+    }
+    
+    // Compute the difference as a percentage combining both the number of different pixels and their difference amount i.e. the average distance over the entire image
+    if (count > 0)
+        difference = 100.0f * sum / (height * width);
+    else
+        difference = 0;
+
+    if (!difference) {
+        free(diffBuffer);
+        return 0;
+    }
+
+    // Generate a normalized diff image
+    normalizeBuffer(maxDistance, reinterpret_cast<unsigned char*>(diffBuffer), height * width);
+        
+    cairo_surface_t* diffImage = cairo_image_surface_create_for_data(diffPixel, CAIRO_FORMAT_ARGB32, width, height, width * s_bytesPerPixel); 
+    cairo_surface_set_user_data(diffImage, &s_imageDataKey, diffBuffer, releaseMallocBuffer);
+    
+    return diffImage;
+}
+
+static inline bool imageHasAlpha(cairo_surface_t* image)
+{
+    return (cairo_image_surface_get_format(image) == CAIRO_FORMAT_ARGB32);
+}
+
+static cairo_status_t writeToData(void* closure, unsigned char* data, unsigned int length)
+{
+    CFMutableDataRef dataTarget = reinterpret_cast<CFMutableDataRef>(closure);
+
+    CFDataAppendBytes(dataTarget, data, length);
+
+    return CAIRO_STATUS_SUCCESS;
+}
+
+int main(int argc, const char* argv[])
+{
+#if PLATFORM(WIN)
+    _setmode(0, _O_BINARY);
+    _setmode(1, _O_BINARY);
+#endif
+
+    float tolerance = 0;
+
+    for (int i = 1; i < argc; ++i) {
+        if (!strcmp(argv[i], "-t") || !strcmp(argv[i], "--tolerance")) {
+            if (i >= argc - 1)
+                exit(1);
+            tolerance = strtof(argv[i + 1], 0);
+            ++i;
+            continue;
+        }
+    }
+
+    char buffer[s_bufferSize];
+    cairo_surface_t* actualImage = 0;
+    cairo_surface_t* baselineImage = 0;
+
+    while (fgets(buffer, sizeof(buffer), stdin)) {
+        char* newLineCharacter = strchr(buffer, '\n');
+        if (newLineCharacter)
+            *newLineCharacter = '\0';
+
+        if (!strncmp("Content-Length: ", buffer, 16)) {
+            strtok(buffer, " ");
+            int imageSize = strtol(strtok(0, " "), 0, 10);
+
+            if (imageSize > 0 && !actualImage)
+                actualImage = createImageFromStdin(imageSize);
+            else if (imageSize > 0 && !baselineImage)
+                baselineImage = createImageFromStdin(imageSize);
+            else
+                fputs("error, image size must be specified.\n", stdout);
+        }
+
+        if (actualImage && baselineImage) {
+            cairo_surface_t* diffImage = 0;
+            float difference = 100.0;
+            
+            if ((cairo_image_surface_get_width(actualImage) == cairo_image_surface_get_width(baselineImage))
+                && (cairo_image_surface_get_height(actualImage) == cairo_image_surface_get_height(baselineImage))
+                && (imageHasAlpha(actualImage) == imageHasAlpha(baselineImage))) {
+                diffImage = createDifferenceImage(actualImage, baselineImage, difference); // difference is passed by reference
+                if (difference <= tolerance)
+                    difference = 0;
+                else {
+                    difference = roundf(difference * 100.0) / 100.0;
+                    difference = max<float>(difference, 0.01); // round to 2 decimal places
+                }
+            } else
+                fputs("error, test and reference image have different properties.\n", stderr);
+                
+            if (difference > 0.0) {
+                if (diffImage) {
+                    RetainPtr<CFMutableDataRef> imageData(AdoptCF, CFDataCreateMutable(0, 0));
+                    cairo_surface_write_to_png_stream(diffImage, (cairo_write_func_t)writeToData, imageData.get());
+                    printf("Content-Length: %lu\n", CFDataGetLength(imageData.get()));
+                    fwrite(CFDataGetBytePtr(imageData.get()), 1, CFDataGetLength(imageData.get()), stdout);
+                    cairo_surface_destroy(diffImage);
+                    diffImage = 0;
+                }
+                
+                fprintf(stdout, "diff: %01.2f%% failed\n", difference);
+            } else
+                fprintf(stdout, "diff: %01.2f%% passed\n", difference);
+            
+            cairo_surface_destroy(actualImage);
+            cairo_surface_destroy(baselineImage);
+            actualImage = 0;
+            baselineImage = 0;
+        }
+
+        fflush(stdout);
+    }
+
+    return 0;
+}
diff --git a/Tools/DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops b/Tools/DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops
index bd6bc8a..0205f9a 100644
--- a/Tools/DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops
+++ b/Tools/DumpRenderTree/win/ImageDiffDebugCairoCFLite.vsprops
@@ -7,6 +7,6 @@
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
-      .\ImageDiffCommon.vsprops"
+      .\ImageDiffWinCairoCommon.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/ImageDiffProduction.vsprops b/Tools/DumpRenderTree/win/ImageDiffProduction.vsprops
index 37ff9de..bd14a38 100644
--- a/Tools/DumpRenderTree/win/ImageDiffProduction.vsprops
+++ b/Tools/DumpRenderTree/win/ImageDiffProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="ImageDiffProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\ImageDiffCommon.vsprops"
 	>
diff --git a/Tools/DumpRenderTree/win/ImageDiffRelease.vsprops b/Tools/DumpRenderTree/win/ImageDiffRelease.vsprops
index 79e9749..16ba125 100644
--- a/Tools/DumpRenderTree/win/ImageDiffRelease.vsprops
+++ b/Tools/DumpRenderTree/win/ImageDiffRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="ImageDiffRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\ImageDiffCommon.vsprops"
 	>
diff --git a/Tools/DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops b/Tools/DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops
index 1cb062b..7ca4b32 100644
--- a/Tools/DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops
+++ b/Tools/DumpRenderTree/win/ImageDiffReleaseCairoCFLite.vsprops
@@ -5,8 +5,9 @@
 	Name="ImageDiffReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
-      .\ImageDiffCommon.vsprops"
+      .\ImageDiffWinCairoCommon.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/ImageDiffWinCairoCommon.vsprops b/Tools/DumpRenderTree/win/ImageDiffWinCairoCommon.vsprops
new file mode 100644
index 0000000..eb1b922
--- /dev/null
+++ b/Tools/DumpRenderTree/win/ImageDiffWinCairoCommon.vsprops
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="ImageDiffCommon"
+	>
+	<Tool
+		Name="VCCLCompilerTool"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;"
+		PreprocessorDefinitions="NOMINMAX"
+	/>
+	<Tool
+		Name="VCLinkerTool"
+		AdditionalOptions="/NXCOMPAT"
+		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib cairo$(LibraryConfigSuffix).lib libjpeg.lib libpng$(LibraryConfigSuffix).lib zlib.lib Msimg32.lib CFLite$(LibraryConfigSuffix).lib"
+		SubSystem="1"
+	/>
+</VisualStudioPropertySheet>
diff --git a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index 1d2f3d8..2086ae7 100644
--- a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -1441,6 +1441,12 @@ void LayoutTestController::setEditingBehavior(const char* editingBehavior)
         preferences->setEditingBehavior(WebKitEditingUnixBehavior);
 }
 
+JSValueRef LayoutTestController::shadowRoot(JSContextRef context, JSValueRef jsElement)
+{
+    // FIXME: Implement this.
+    return JSValueMakeUndefined(context);
+}
+
 void LayoutTestController::abortModal()
 {
 }
diff --git a/Tools/DumpRenderTree/win/PixelDumpSupportWin.cpp b/Tools/DumpRenderTree/win/PixelDumpSupportWin.cpp
index 752cc39..f7a95d3 100644
--- a/Tools/DumpRenderTree/win/PixelDumpSupportWin.cpp
+++ b/Tools/DumpRenderTree/win/PixelDumpSupportWin.cpp
@@ -28,15 +28,15 @@
 
 #include "config.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 #include "PixelDumpSupportCG.h"
-#elif PLATFORM(CAIRO)
+#elif USE(CAIRO)
 #include "PixelDumpSupportCairo.h"
 #endif
 
 #include "DumpRenderTree.h"
 
-#if PLATFORM(CG)
+#if USE(CG)
 // Note: Must be included *after* DumpRenderTree.h to avoid compile error.
 #include <CoreGraphics/CGBitmapContext.h>
 #endif
@@ -70,11 +70,11 @@ PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool onscreen, bool inc
     GetObject(bitmap, sizeof(info), &info);
     ASSERT(info.bmBitsPixel == 32);
 
-#if PLATFORM(CG)
+#if USE(CG)
     RetainPtr<CGColorSpaceRef> colorSpace(AdoptCF, CGColorSpaceCreateDeviceRGB());
     CGContextRef context = CGBitmapContextCreate(info.bmBits, info.bmWidth, info.bmHeight, 8,
                                                 info.bmWidthBytes, colorSpace.get(), kCGBitmapByteOrder32Host | kCGImageAlphaPremultipliedFirst);
-#elif PLATFORM(CAIRO) 
+#elif USE(CAIRO) 
     cairo_surface_t* image = cairo_image_surface_create_for_data((unsigned char*)info.bmBits, CAIRO_FORMAT_ARGB32, 
                                                       info.bmWidth, info.bmHeight, info.bmWidthBytes); 
     cairo_t* context = cairo_create(image); 
diff --git a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index c45ea0e..b2a1f58 100644
--- a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -612,3 +612,9 @@ void LayoutTestController::deleteLocalStorageForOrigin(JSStringRef URL)
 {
     // FIXME: Implement.
 }
+
+const OpaqueJSValue* LayoutTestController::shadowRoot(const OpaqueJSContext*, const OpaqueJSValue*)
+{
+    // FIXME: Implement.
+    return 0;
+}
diff --git a/Tools/FindSafari/FindSafariProduction.vsprops b/Tools/FindSafari/FindSafariProduction.vsprops
index c2d3e36..afb7d22 100644
--- a/Tools/FindSafari/FindSafariProduction.vsprops
+++ b/Tools/FindSafari/FindSafariProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="FindSafariProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\FindSafariCommon.vsprops"
 	>
diff --git a/Tools/FindSafari/FindSafariRelease.vsprops b/Tools/FindSafari/FindSafariRelease.vsprops
index 9d59b3d..ca994f4 100644
--- a/Tools/FindSafari/FindSafariRelease.vsprops
+++ b/Tools/FindSafari/FindSafariRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="FindSafariRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\FindSafariCommon.vsprops"
 	>
diff --git a/Tools/FindSafari/FindSafariReleaseCairoCFLite.vsprops b/Tools/FindSafari/FindSafariReleaseCairoCFLite.vsprops
index fccbb9c..b1e4748 100644
--- a/Tools/FindSafari/FindSafariReleaseCairoCFLite.vsprops
+++ b/Tools/FindSafari/FindSafariReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="FindSafariReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\FindSafariCommon.vsprops"
diff --git a/Tools/FindSafari/FindSafariReleasePGO.vsprops b/Tools/FindSafari/FindSafariReleasePGO.vsprops
index 6c24cbc..1755933 100644
--- a/Tools/FindSafari/FindSafariReleasePGO.vsprops
+++ b/Tools/FindSafari/FindSafariReleasePGO.vsprops
@@ -5,7 +5,7 @@
 	Name="FindSafariReleasePGO"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\FindSafariCommon.vsprops"
 	>
diff --git a/Tools/GNUmakefile.am b/Tools/GNUmakefile.am
index 6de1af5..34052d7 100644
--- a/Tools/GNUmakefile.am
+++ b/Tools/GNUmakefile.am
@@ -56,6 +56,8 @@ Programs_DumpRenderTree_SOURCES = \
 	Tools/DumpRenderTree/AccessibilityTextMarker.h \
 	Tools/DumpRenderTree/AccessibilityUIElement.cpp \
 	Tools/DumpRenderTree/AccessibilityUIElement.h \
+	Tools/DumpRenderTree/CyclicRedundancyCheck.cpp \
+	Tools/DumpRenderTree/CyclicRedundancyCheck.h \
 	Tools/DumpRenderTree/GCController.cpp \
 	Tools/DumpRenderTree/GCController.h \
 	Tools/DumpRenderTree/JavaScriptThreading.h \
@@ -82,6 +84,8 @@ Programs_DumpRenderTree_SOURCES = \
 	Tools/DumpRenderTree/gtk/GCControllerGtk.cpp \
 	Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp \
 	Tools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp \
+	Tools/DumpRenderTree/gtk/PlainTextController.cpp \
+	Tools/DumpRenderTree/gtk/PlainTextController.h \
 	Tools/DumpRenderTree/gtk/TextInputController.h \
 	Tools/DumpRenderTree/gtk/TextInputController.cpp \
 	Tools/DumpRenderTree/gtk/WorkQueueItemGtk.cpp \
@@ -181,6 +185,7 @@ TestNetscapePlugin_libtestnetscapeplugin_la_SOURCES = \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/GetURLWithJavaScriptURLDestroyingPlugin.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/GetUserAgentWithNullNPPFromNPPNew.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPDeallocateCalledBeforeNPShutdown.cpp \
+	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPPSetWindowCalledDuringDestruction.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeRemoveProperty.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/NullNPPGetValuePointer.cpp \
diff --git a/Tools/GtkLauncher/main.c b/Tools/GtkLauncher/main.c
index ad666e2..a1baf05 100644
--- a/Tools/GtkLauncher/main.c
+++ b/Tools/GtkLauncher/main.c
@@ -230,24 +230,6 @@ static gchar* filenameToURL(const char* filename)
     return fileURL;
 }
 
-#ifndef GTK_API_VERSION_2
-static void disablePlugin(const char* pluginName)
-{
-    WebKitWebPluginDatabase *database = webkit_get_web_plugin_database();
-    GSList *plugins = webkit_web_plugin_database_get_plugins(database);
-    GSList *p;
-
-    for (p = plugins; p; p = g_slist_next(p)) {
-        WebKitWebPlugin *plugin = WEBKIT_WEB_PLUGIN(p->data);
-
-        if (!g_strcmp0(webkit_web_plugin_get_name(plugin), pluginName))
-            webkit_web_plugin_set_enabled(plugin, FALSE);
-    }
-
-    webkit_web_plugin_database_plugins_list_free(plugins);
-}
-#endif
-
 int main(int argc, char* argv[])
 {
     WebKitWebView *webView;
@@ -257,10 +239,6 @@ int main(int argc, char* argv[])
     if (!g_thread_supported())
         g_thread_init(NULL);
 
-#ifndef GTK_API_VERSION_2
-    disablePlugin("Shockwave Flash");
-#endif
-
     main_window = createWindow(&webView);
 
     gchar *uri =(gchar*)(argc > 1 ? argv[1] : "http://www.google.com/");
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserProduction.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserProduction.vsprops
index 75195e3..4c5e11b 100644
--- a/Tools/MiniBrowser/Configurations/MiniBrowserProduction.vsprops
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="MiniBrowserProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\MiniBrowserCoreFoundation.vsprops;
       .\MiniBrowserCommon.vsprops"
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserRelease.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserRelease.vsprops
index 27af48a..653d847 100644
--- a/Tools/MiniBrowser/Configurations/MiniBrowserRelease.vsprops
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="MiniBrowserRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\MiniBrowserCoreFoundation.vsprops;
       .\MiniBrowserCommon.vsprops"
diff --git a/Tools/MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops b/Tools/MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops
index a50d5b7..bf485fc 100644
--- a/Tools/MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops
+++ b/Tools/MiniBrowser/Configurations/MiniBrowserReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="MiniBrowserReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\MiniBrowserCFLite.vsprops;
diff --git a/Tools/MiniBrowser/DerivedSources.pro b/Tools/MiniBrowser/DerivedSources.pro
deleted file mode 100644
index 8674beb..0000000
--- a/Tools/MiniBrowser/DerivedSources.pro
+++ /dev/null
@@ -1,33 +0,0 @@
-# DerivedSources - qmake build info
-
-CONFIG -= debug_and_release
-
-TEMPLATE = lib
-TARGET = dummy
-
-QMAKE_EXTRA_TARGETS += generated_files
-
-isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../..
-SRC_ROOT_DIR = $$replace(PWD, "/Tools/MiniBrowser", "")
-
-!exists($$OUTPUT_DIR/MiniBrowser/qt): system($$QMAKE_MKDIR $$OUTPUT_DIR/MiniBrowser/qt)
-
-ualist_copier.input = $$SRC_ROOT_DIR/Tools/QtTestBrowser/useragentlist.txt
-ualist_copier.output = $$OUTPUT_DIR/MiniBrowser/qt/useragentlist.txt
-ualist_copier.tempNames = $$ualist_copier.input $$ualist_copier.output
-ualist_copier.commands = $$QMAKE_COPY $$replace(ualist_copier.tempNames, "/", $$QMAKE_DIR_SEP)
-ualist_copier.depends = $$ualist_copier.input
-generated_files.depends += ualist_copier
-QMAKE_EXTRA_TARGETS += ualist_copier
-
-# We have to copy the resource file to the build directory
-# to use the useragentlist.txt file of QtTestBrowser without
-# polluting the source tree.
-
-qrc_copier.input = $$SRC_ROOT_DIR/Tools/MiniBrowser/MiniBrowser.qrc
-qrc_copier.output = $$OUTPUT_DIR/MiniBrowser/qt/MiniBrowser.qrc
-qrc_copier.tempNames = $$qrc_copier.input $$qrc_copier.output
-qrc_copier.commands = $$QMAKE_COPY $$replace(qrc_copier.tempNames, "/", $$QMAKE_DIR_SEP)
-qrc_copier.depends = ualist_copier $$qrc_copier.input
-generated_files.depends += qrc_copier
-QMAKE_EXTRA_TARGETS += qrc_copier
diff --git a/Tools/MiniBrowser/gtk/GNUmakefile.am b/Tools/MiniBrowser/gtk/GNUmakefile.am
new file mode 100644
index 0000000..24da0ad
--- /dev/null
+++ b/Tools/MiniBrowser/gtk/GNUmakefile.am
@@ -0,0 +1,33 @@
+bin_PROGRAMS += \
+	Programs/MiniBrowser
+
+Programs_MiniBrowser_CPPFLAGS = \
+	-I$(srcdir)/Source \
+	-I$(top_builddir)/DerivedSources/WebKit2/include \
+	$(global_cppflags) \
+	$(GLIB_CFLAGS) \
+	$(GTK_CFLAGS)
+
+Programs_MiniBrowser_SOURCES = \
+	Tools/MiniBrowser/gtk/main.c
+
+BUILT_SOURCES += \
+	generate-minibrowser-forward-headers
+
+MiniBrowser := $(srcdir)/Tools/MiniBrowser/gtk
+MiniBrowserFwdHeaders := $(GENSOURCES_WEBKIT2)/include
+generate-minibrowser-forward-headers: $(WebKit2)/Scripts/generate-forwarding-headers.pl $(Programs_MiniBrowser_SOURCES)
+	$(AM_V_GEN)$(PERL) $< $(MiniBrowser) $(MiniBrowserFwdHeaders) gtk
+	$(AM_V_GEN)$(PERL) $< $(MiniBrowser) $(MiniBrowserFwdHeaders) soup
+
+Programs_MiniBrowser_LDADD = \
+	libwebkit2gtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
+	$(GLIB_LIBS) \
+	$(GTK_LIBS)
+
+Programs_MiniBrowser_LDFLAGS = \
+	-no-fast-install \
+	-no-install
+
+CLEANFILES += \
+	$(top_builddir)/Programs/MiniBrowser
diff --git a/Tools/MiniBrowser/gtk/main.c b/Tools/MiniBrowser/gtk/main.c
new file mode 100644
index 0000000..0c32510
--- /dev/null
+++ b/Tools/MiniBrowser/gtk/main.c
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.
+ * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <WebKit2/WebKit2.h>
+#include <gtk/gtk.h>
+
+static void activateUriEntryCallback(GtkWidget *entry, gpointer data)
+{
+    WKViewRef webView = g_object_get_data(G_OBJECT(entry), "web-view");
+    const gchar *uri = gtk_entry_get_text(GTK_ENTRY(entry));
+    WKPageLoadURL(WKViewGetPage(webView), WKURLCreateWithURL(uri));
+}
+
+static void destroyCallback(GtkWidget *widget, GtkWidget *window)
+{
+    gtk_main_quit();
+}
+
+static void goBackCallback(GtkWidget *widget, WKViewRef webView)
+{
+    WKPageGoBack(WKViewGetPage(webView));
+}
+
+static void goForwardCallback(GtkWidget *widget, WKViewRef webView)
+{
+    WKPageGoForward(WKViewGetPage(webView));
+}
+
+static GtkWidget *createToolbar(GtkWidget *uriEntry, WKViewRef webView)
+{
+    GtkWidget *toolbar = gtk_toolbar_new();
+
+#if GTK_CHECK_VERSION(2, 15, 0)
+    gtk_orientable_set_orientation(GTK_ORIENTABLE(toolbar), GTK_ORIENTATION_HORIZONTAL);
+#else
+    gtk_toolbar_set_orientation(GTK_TOOLBAR(toolbar), GTK_ORIENTATION_HORIZONTAL);
+#endif
+    gtk_toolbar_set_style(GTK_TOOLBAR(toolbar), GTK_TOOLBAR_BOTH_HORIZ);
+
+    GtkToolItem *item = gtk_tool_button_new_from_stock(GTK_STOCK_GO_BACK);
+    g_signal_connect(item, "clicked", G_CALLBACK(goBackCallback), (gpointer)webView);
+    gtk_toolbar_insert(GTK_TOOLBAR(toolbar), item, -1);
+
+    item = gtk_tool_button_new_from_stock(GTK_STOCK_GO_FORWARD);
+    g_signal_connect(G_OBJECT(item), "clicked", G_CALLBACK(goForwardCallback), (gpointer)webView);
+    gtk_toolbar_insert(GTK_TOOLBAR(toolbar), item, -1);
+
+    item = gtk_tool_item_new();
+    gtk_tool_item_set_expand(item, TRUE);
+    gtk_container_add(GTK_CONTAINER(item), uriEntry);
+    g_signal_connect(uriEntry, "activate", G_CALLBACK(activateUriEntryCallback), NULL);
+    gtk_toolbar_insert(GTK_TOOLBAR(toolbar), item, -1);
+
+    g_object_set_data(G_OBJECT(uriEntry), "web-view", (gpointer)webView);
+    item = gtk_tool_button_new_from_stock(GTK_STOCK_OK);
+    g_signal_connect_swapped(item, "clicked", G_CALLBACK(activateUriEntryCallback), (gpointer)uriEntry);
+    gtk_toolbar_insert(GTK_TOOLBAR(toolbar), item, -1);
+
+    return toolbar;
+}
+
+static WKViewRef createWebView()
+{
+    return WKViewCreate(WKContextGetSharedProcessContext(), 0);
+}
+
+static GtkWidget *createWindow(WKViewRef webView)
+{
+    GtkWidget *window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
+    gtk_window_set_default_size(GTK_WINDOW(window), 800, 600);
+    gtk_widget_set_name(window, "MiniBrowser");
+
+    GtkWidget *uriEntry = gtk_entry_new();
+
+    GtkWidget *vbox = gtk_vbox_new(FALSE, 0);
+    gtk_box_pack_start(GTK_BOX(vbox), createToolbar(uriEntry, webView), FALSE, FALSE, 0);
+    gtk_box_pack_start(GTK_BOX(vbox), WKViewGetWindow(webView), TRUE, TRUE, 0);
+
+    gtk_container_add(GTK_CONTAINER(window), vbox);
+
+    g_signal_connect(window, "destroy", G_CALLBACK(destroyCallback), NULL);
+
+    return window;
+}
+
+static gchar *argumentToURL(const char *filename)
+{
+    GFile *gfile = g_file_new_for_commandline_arg(filename);
+    gchar *fileURL = g_file_get_uri(gfile);
+    g_object_unref(gfile);
+
+    return fileURL;
+}
+
+int main(int argc, char *argv[])
+{
+    gtk_init(&argc, &argv);
+
+    if (!g_thread_supported())
+        g_thread_init(NULL);
+
+    WKViewRef webView = createWebView();
+    GtkWidget *mainWindow = createWindow(webView);
+
+    gchar* url = argumentToURL(argc > 1 ? argv[1] : "http://www.webkitgtk.org/");
+    WKPageLoadURL(WKViewGetPage(webView), WKURLCreateWithURL(url));
+    g_free(url);
+
+    gtk_widget_grab_focus(WKViewGetWindow(webView));
+    gtk_widget_show_all(mainWindow);
+    gtk_main();
+
+    return 0;
+}
diff --git a/Tools/MiniBrowser/mac/BrowserWindowController.m b/Tools/MiniBrowser/mac/BrowserWindowController.m
index 1f6fc04..f6b4d1d 100644
--- a/Tools/MiniBrowser/mac/BrowserWindowController.m
+++ b/Tools/MiniBrowser/mac/BrowserWindowController.m
@@ -618,6 +618,9 @@ static void runOpenPanel(WKPageRef page, WKFrameRef frame, WKOpenPanelParameters
         createNewPage,
         showPage,
         closePage,
+        0,          /* takeFocus */
+        0,          /* focus */
+        0,          /* unfocus */
         runJavaScriptAlert,
         runJavaScriptConfirm,
         runJavaScriptPrompt,
diff --git a/Tools/MiniBrowser/qt/BrowserWindow.cpp b/Tools/MiniBrowser/qt/BrowserWindow.cpp
index 53f7de9..a8a2226 100644
--- a/Tools/MiniBrowser/qt/BrowserWindow.cpp
+++ b/Tools/MiniBrowser/qt/BrowserWindow.cpp
@@ -28,6 +28,7 @@
 
 #include "BrowserWindow.h"
 
+#include "UrlLoader.h"
 #include "qwkpreferences.h"
 
 static QWKPage* newPageFunction(QWKPage* page)
@@ -41,6 +42,7 @@ QVector<qreal> BrowserWindow::m_zoomLevels;
 BrowserWindow::BrowserWindow(QWKContext* context, WindowOptions* options)
     : m_isZoomTextOnly(false)
     , m_currentZoom(1)
+    , m_urlLoader(0)
     , m_context(context)
 {
     if (options)
@@ -106,6 +108,8 @@ BrowserWindow::BrowserWindow(QWKContext* context, WindowOptions* options)
     toggleFrameFlattening->setChecked(false);
     toolsMenu->addSeparator();
     toolsMenu->addAction("Change User Agent", this, SLOT(showUserAgentDialog()));
+    toolsMenu->addSeparator();
+    toolsMenu->addAction("Load URLs from file", this, SLOT(loadURLListFromFile()));
 
     QMenu* settingsMenu = menuBar()->addMenu("&Settings");
     QAction* toggleAutoLoadImages = settingsMenu->addAction("Disable Auto Load Images", this, SLOT(toggleAutoLoadImages(bool)));
@@ -137,7 +141,10 @@ BrowserWindow::BrowserWindow(QWKContext* context, WindowOptions* options)
         m_zoomLevels << 1.1 << 1.2 << 1.33 << 1.5 << 1.7 << 2 << 2.4 << 3;
     }
 
-    resize(800, 600);
+    if (m_windowOptions.startMaximized)
+        setWindowState(windowState() | Qt::WindowMaximized);
+    else
+        resize(800, 600);
     show();
 }
 
@@ -294,10 +301,9 @@ void BrowserWindow::toggleZoomTextOnly(bool b)
 
 void BrowserWindow::toggleFullScreenMode(bool enable)
 {
-    if (enable)
-        setWindowState(Qt::WindowFullScreen);
-    else
-        setWindowState(Qt::WindowNoState);
+    bool alreadyEnabled = windowState() & Qt::WindowFullScreen;
+    if (enable ^ alreadyEnabled)
+        setWindowState(windowState() ^ Qt::WindowFullScreen);
 }
 
 void BrowserWindow::toggleFrameFlattening(bool toggle)
@@ -335,6 +341,20 @@ void BrowserWindow::showUserAgentDialog()
         page()->setCustomUserAgent(combo->currentText());
 }
 
+void BrowserWindow::loadURLListFromFile()
+{
+    QString selectedFile;
+#ifndef QT_NO_FILEDIALOG
+    selectedFile = QFileDialog::getOpenFileName(this, tr("Load URL list from file")
+                                                       , QString(), tr("Text Files (*.txt);;All Files (*)"));
+#endif
+    if (selectedFile.isEmpty())
+       return;
+
+    m_urlLoader = new UrlLoader(this, selectedFile, 0, 0);
+    m_urlLoader->loadNext();
+}
+
 void BrowserWindow::printURL(const QUrl& url)
 {
     QTextStream output(stdout);
@@ -380,6 +400,7 @@ void BrowserWindow::applyZoom()
 
 BrowserWindow::~BrowserWindow()
 {
+    delete m_urlLoader;
     delete m_addressBar;
     delete m_browser;
 }
diff --git a/Tools/MiniBrowser/qt/BrowserWindow.h b/Tools/MiniBrowser/qt/BrowserWindow.h
index 6ad8f27..06da2a2 100644
--- a/Tools/MiniBrowser/qt/BrowserWindow.h
+++ b/Tools/MiniBrowser/qt/BrowserWindow.h
@@ -35,6 +35,8 @@
 #include <QStringList>
 #include <QtGui>
 
+class UrlLoader;
+
 class BrowserWindow : public QMainWindow {
     Q_OBJECT
 
@@ -69,6 +71,8 @@ protected slots:
     void toggleFrameFlattening(bool);
     void showUserAgentDialog();
 
+    void loadURLListFromFile();
+
     void printURL(const QUrl&);
 
     void toggleAutoLoadImages(bool);
@@ -83,6 +87,7 @@ private:
     bool m_isZoomTextOnly;
     qreal m_currentZoom;
 
+    UrlLoader* m_urlLoader;
     QWKContext* m_context;
     WindowOptions m_windowOptions;
     BrowserView* m_browser;
diff --git a/Tools/MiniBrowser/qt/MiniBrowser.pro b/Tools/MiniBrowser/qt/MiniBrowser.pro
index 809c934..7836e53 100644
--- a/Tools/MiniBrowser/qt/MiniBrowser.pro
+++ b/Tools/MiniBrowser/qt/MiniBrowser.pro
@@ -58,7 +58,5 @@ contains(QT_CONFIG, opengl) {
 
 DEFINES -= QT_ASCII_CAST_WARNINGS
 
-# We copy the resource file to the build directory.
-# The copier is defined in Tools/MiniBrowser/DerivedSources.pro.
-RESOURCES += \
-    $$OUTPUT_DIR/MiniBrowser/qt/MiniBrowser.qrc
+# Use the MiniBrowser.qrc file from the sources.
+RESOURCES += MiniBrowser.qrc
diff --git a/Tools/MiniBrowser/MiniBrowser.qrc b/Tools/MiniBrowser/qt/MiniBrowser.qrc
index ffe77b0..ffe77b0 100644
--- a/Tools/MiniBrowser/MiniBrowser.qrc
+++ b/Tools/MiniBrowser/qt/MiniBrowser.qrc
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
index f40c870..912419b 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
@@ -55,6 +55,7 @@ void MiniBrowserApplication::handleUserOptions()
 
     if (args.contains("-help")) {
         qDebug() << "Usage:" << programName.toLatin1().data()
+             << "[-maximize]"
              << "[-r list]"
              << "[-robot-timeout seconds]"
              << "[-robot-extra-time seconds]"
@@ -65,6 +66,9 @@ void MiniBrowserApplication::handleUserOptions()
         appQuit(0);
     }
 
+    if (args.contains("-maximize"))
+        m_windowOptions.startMaximized = true;
+
     int robotIndex = args.indexOf("-r");
     if (robotIndex != -1) {
         QString listFile = takeOptionValue(&args, robotIndex);
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.h b/Tools/MiniBrowser/qt/MiniBrowserApplication.h
index 5a78820..2eba9b5 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.h
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.h
@@ -37,12 +37,18 @@ struct WindowOptions {
         : useTiledBackingStore(true)
         , useSeparateWebProcessPerWindow(false)
         , printLoadedUrls(false)
+#if defined(Q_OS_SYMBIAN)
+        , startMaximized(true)
+#else
+        , startMaximized(false)
+#endif
     {
     }
 
     bool useTiledBackingStore;
     bool useSeparateWebProcessPerWindow;
     bool printLoadedUrls;
+    bool startMaximized;
 };
 
 class MiniBrowserApplication : public QApplication {
diff --git a/Tools/MiniBrowser/qt/UrlLoader.cpp b/Tools/MiniBrowser/qt/UrlLoader.cpp
index 600d477..54854c8 100644
--- a/Tools/MiniBrowser/qt/UrlLoader.cpp
+++ b/Tools/MiniBrowser/qt/UrlLoader.cpp
@@ -47,7 +47,7 @@ UrlLoader::UrlLoader(BrowserWindow* browserWindow, const QString& inputFileName,
     if (timeoutSeconds) {
         m_timeoutTimer.setInterval(timeoutSeconds * 1000);
         m_timeoutTimer.setSingleShot(true);
-        connect(m_browserWindow, SIGNAL(loadStarted()), &m_timeoutTimer, SLOT(start()));
+        connect(m_browserWindow->page(), SIGNAL(loadStarted()), &m_timeoutTimer, SLOT(start()));
         connect(&m_timeoutTimer, SIGNAL(timeout()), this, SLOT(loadNext()));
     }
     if (extraTimeSeconds) {
diff --git a/Tools/MiniBrowser/qt/main.cpp b/Tools/MiniBrowser/qt/main.cpp
index 8f4c1ea..8b38912 100644
--- a/Tools/MiniBrowser/qt/main.cpp
+++ b/Tools/MiniBrowser/qt/main.cpp
@@ -51,9 +51,9 @@ int main(int argc, char** argv)
     QStringList urls = app.urls();
 
     if (urls.isEmpty()) {
-        QString defaultUrl = QString("file://%1/%2").arg(QDir::homePath()).arg(QLatin1String("index.html"));
-        if (QDir(defaultUrl).exists())
-            urls.append(defaultUrl);
+        QString defaultIndexFile = QString("%1/%2").arg(QDir::homePath()).arg(QLatin1String("index.html"));
+        if (QFile(defaultIndexFile).exists())
+            urls.append(QString("file://") + defaultIndexFile);
         else
             urls.append("http://www.google.com");
     }
diff --git a/Tools/MiniBrowser/qt/useragentlist.txt b/Tools/MiniBrowser/qt/useragentlist.txt
new file mode 100644
index 0000000..0b29d40
--- /dev/null
+++ b/Tools/MiniBrowser/qt/useragentlist.txt
@@ -0,0 +1,11 @@
+Mozilla/5.0 (X11; U; Linux; en-US) AppleWebKit/533.3 (KHTML, like Gecko) QtTestBrowser/0.1 Safari/533.3
+Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0; en-GB) AppleWebKit/533.3 (KHTML, like Gecko) QtTestBrowser/0.1 Mobile Safari/533.3
+Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8
+Mozilla/5.0 (Linux; U; Android 1.1; en-gb; dream) AppleWebKit/525.10+ (KHTML, like Gecko) Version/3.0.4 Mobile Safari/523.12.2
+Mozilla/5.0 (Unknown; like Android 2.2; U; Intel Mac OS X 10_6; en-gb) AppleWebKit/533.3 (KHTML, like Gecko) Version/4.0.3 Mobile Safari/533.3
+Mozilla/5.0 (iPhone; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10
+Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_0 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8A293 Safari/6531.22.7
+Mozilla/5.0(iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B314 Safari/531.21.10
+Opera/9.25 (Windows NT 6.0; U; en)
+Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0 Nokia5800d-1b/20.2.014; Profile/MIDP-2.1 Configuration/CLDC-1.1 ) AppleWebKit/413 (KHTML, like Gecko) Safari/413
+Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.2; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
diff --git a/Tools/MiniBrowser/win/BrowserView.cpp b/Tools/MiniBrowser/win/BrowserView.cpp
index f9ccfe7..76b8d04 100644
--- a/Tools/MiniBrowser/win/BrowserView.cpp
+++ b/Tools/MiniBrowser/win/BrowserView.cpp
@@ -98,6 +98,9 @@ void BrowserView::create(RECT webViewRect, BrowserWindow* parentWindow)
         createNewPage,
         showPage,
         closePage,
+        0,          /* takeFocus */
+        0,          /* focus */
+        0,          /* unfocus */
         runJavaScriptAlert,
         runJavaScriptConfirm,
         runJavaScriptPrompt,
diff --git a/Tools/MiniBrowser/win/main.cpp b/Tools/MiniBrowser/win/main.cpp
index 0c125ba..93b47ce 100644
--- a/Tools/MiniBrowser/win/main.cpp
+++ b/Tools/MiniBrowser/win/main.cpp
@@ -41,6 +41,22 @@
 
 #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='" PROCESSORARCHITECTURE "' publicKeyToken='6595b64144ccf1df' language='*'\"")
 
+static bool shouldTranslateMessage(const MSG& msg)
+{
+    // Only these four messages are actually translated by ::TranslateMessage or ::TranslateAccelerator.
+    // It's useless (though harmless) to call those functions for other messages, so we always allow other messages to be translated.
+    if (msg.message != WM_KEYDOWN && msg.message != WM_SYSKEYDOWN && msg.message != WM_KEYUP && msg.message != WM_SYSKEYUP)
+        return true;
+    
+    wchar_t className[256];
+    if (!::GetClassNameW(msg.hwnd, className, ARRAYSIZE(className)))
+        return true;
+
+    // Don't call TranslateMessage() on key events destined for a WebKit2 view, WebKit will do this if it doesn't handle the message.
+    // It would be nice to use some API here instead of hard-coding the window class name.
+    return wcscmp(className, L"WebKit2WebViewWindowClass");
+}
+
 int WINAPI _tWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPTSTR lpstrCmdLine, int nCmdShow)
 {
     MiniBrowser::shared().initialize(hInstance);
@@ -52,7 +68,9 @@ int WINAPI _tWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPTSTR lpstrC
     while (BOOL result = ::GetMessage(&message, 0, 0, 0)) {
         if (result == -1)
             break;
-        ::TranslateMessage(&message);
+        
+        if (shouldTranslateMessage(message))
+            ::TranslateMessage(&message);
 
         if (!MiniBrowser::shared().handleMessage(&message))
             ::DispatchMessage(&message);
diff --git a/Tools/QtTestBrowser/QtTestBrowser.pro b/Tools/QtTestBrowser/QtTestBrowser.pro
index 4cd7ecb..a7826e5 100644
--- a/Tools/QtTestBrowser/QtTestBrowser.pro
+++ b/Tools/QtTestBrowser/QtTestBrowser.pro
@@ -22,7 +22,7 @@ HEADERS += \
     webview.h \
     fpstimer.h \
 
-CONFIG += uitools
+!isEqual(QT_ARCH,sh4): CONFIG += uitools
 
 isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../..
 include(../../Source/WebKit.pri)
@@ -34,7 +34,7 @@ DESTDIR = $$OUTPUT_DIR/bin
 QT += network
 macx:QT+=xml
 
-unix:!mac:!symbian {
+unix:!mac:!symbian:!embedded {
     CONFIG += link_pkgconfig
     PKGCONFIG += fontconfig
 }
diff --git a/Tools/QtTestBrowser/launcherwindow.cpp b/Tools/QtTestBrowser/launcherwindow.cpp
index f4db898..a6b05f4 100644
--- a/Tools/QtTestBrowser/launcherwindow.cpp
+++ b/Tools/QtTestBrowser/launcherwindow.cpp
@@ -31,6 +31,7 @@
  */
 
 #include "launcherwindow.h"
+#include "urlloader.h"
 
 const int gExitClickArea = 80;
 QVector<int> LauncherWindow::m_zoomLevels;
@@ -38,6 +39,7 @@ QVector<int> LauncherWindow::m_zoomLevels;
 LauncherWindow::LauncherWindow(WindowOptions* data, QGraphicsScene* sharedScene)
     : MainWindow()
     , m_currentZoom(100)
+    , m_urlLoader(0)
     , m_view(0)
     , m_inspector(0)
     , m_formatMenuAction(0)
@@ -56,6 +58,7 @@ LauncherWindow::LauncherWindow(WindowOptions* data, QGraphicsScene* sharedScene)
 LauncherWindow::~LauncherWindow()
 {
     grabZoomKeys(false);
+    delete m_urlLoader;
 }
 
 void LauncherWindow::init()
@@ -63,12 +66,10 @@ void LauncherWindow::init()
     QSplitter* splitter = new QSplitter(Qt::Vertical, this);
     setCentralWidget(splitter);
 
-#if defined(Q_OS_SYMBIAN)
-    setWindowState(Qt::WindowMaximized);
-#else
-    setWindowState(Qt::WindowNoState);
-    resize(800, 600);
-#endif
+    if (m_windowOptions.startMaximized)
+        setWindowState(windowState() | Qt::WindowMaximized);
+    else
+        resize(800, 600);
 
     m_inspector = new WebInspector;
 #ifndef QT_NO_PROPERTIES
@@ -287,6 +288,8 @@ void LauncherWindow::createChrome()
     QAction* showInspectorAction = toolsMenu->addAction("Show Web Inspector", m_inspector, SLOT(setVisible(bool)), QKeySequence(Qt::CTRL | Qt::ALT | Qt::Key_I));
     showInspectorAction->setCheckable(true);
     showInspectorAction->connect(m_inspector, SIGNAL(visibleChanged(bool)), SLOT(setChecked(bool)));
+    toolsMenu->addSeparator();
+    toolsMenu->addAction("Load URLs from file", this, SLOT(loadURLListFromFile()));
 
     // GraphicsView sub menu.
     QAction* toggleAcceleratedCompositing = graphicsViewMenu->addAction("Toggle Accelerated Compositing", this, SLOT(toggleAcceleratedCompositing(bool)));
@@ -770,15 +773,9 @@ void LauncherWindow::toggleSpatialNavigation(bool b)
 
 void LauncherWindow::toggleFullScreenMode(bool enable)
 {
-    if (enable)
-        setWindowState(Qt::WindowFullScreen);
-    else {
-#if defined(Q_OS_SYMBIAN)
-        setWindowState(Qt::WindowMaximized);
-#else
-        setWindowState(Qt::WindowNoState);
-#endif
-    }
+    bool alreadyEnabled = windowState() & Qt::WindowFullScreen;
+    if (enable ^ alreadyEnabled)
+        setWindowState(windowState() ^ Qt::WindowFullScreen);
 }
 
 void LauncherWindow::toggleFrameFlattening(bool toggle)
@@ -900,6 +897,20 @@ void LauncherWindow::showUserAgentDialog()
     delete dialog;
 }
 
+void LauncherWindow::loadURLListFromFile()
+{
+    QString selectedFile;
+#ifndef QT_NO_FILEDIALOG
+    selectedFile = QFileDialog::getOpenFileName(this, tr("Load URL list from file")
+                                                       , QString(), tr("Text Files (*.txt);;All Files (*)"));
+#endif
+    if (selectedFile.isEmpty())
+       return;
+
+    m_urlLoader = new UrlLoader(this->page()->mainFrame(), selectedFile, 0, 0);
+    m_urlLoader->loadNext();
+}
+
 void LauncherWindow::printURL(const QUrl& url)
 {
     QTextStream output(stdout);
diff --git a/Tools/QtTestBrowser/launcherwindow.h b/Tools/QtTestBrowser/launcherwindow.h
index 8bdad4d..705a1e4 100644
--- a/Tools/QtTestBrowser/launcherwindow.h
+++ b/Tools/QtTestBrowser/launcherwindow.h
@@ -104,6 +104,11 @@ public:
         , useTestFonts(false)
 #endif
         , printLoadedUrls(false)
+#if defined(Q_OS_SYMBIAN)
+        , startMaximized(true)
+#else
+        , startMaximized(false)
+#endif
     {
     }
 
@@ -129,6 +134,7 @@ public:
     bool printLoadedUrls;
     QUrl inspectorUrl;
     quint16 remoteInspectorPort;
+    bool startMaximized;
 };
 
 class LauncherWindow : public MainWindow {
@@ -165,6 +171,8 @@ protected slots:
     /* void dumpPlugins() */
     void dumpHtml();
 
+    void loadURLListFromFile();
+
     void setTouchMocking(bool on);
     void toggleWebView(bool graphicsBased);
     void toggleAcceleratedCompositing(bool toggle);
@@ -217,6 +225,8 @@ private:
     static QVector<int> m_zoomLevels;
     int m_currentZoom;
 
+    UrlLoader* m_urlLoader;
+
     QWidget* m_view;
     WebInspector* m_inspector;
 
diff --git a/Tools/QtTestBrowser/main.cpp b/Tools/QtTestBrowser/main.cpp
index 059269c..c44c4c6 100644
--- a/Tools/QtTestBrowser/main.cpp
+++ b/Tools/QtTestBrowser/main.cpp
@@ -183,6 +183,7 @@ void LauncherApplication::handleUserOptions()
 #endif
              << QString("[-viewport-update-mode %1]").arg(formatKeys(updateModes)).toLatin1().data()
              << "[-cache-webview]"
+             << "[-maximize]"
              << "[-show-fps]"
              << "[-r list]"
              << "[-robot-timeout seconds]"
@@ -234,6 +235,9 @@ void LauncherApplication::handleUserOptions()
     if (args.contains("-local-storage-enabled"))
         windowOptions.useLocalStorage = true;
         
+    if (args.contains("-maximize"))
+        windowOptions.startMaximized = true;
+
     if (args.contains("-offline-storage-database-enabled"))
         windowOptions.useOfflineStorageDatabase = true;
         
diff --git a/Tools/QueueStatusServer/handlers/queuestatus.py b/Tools/QueueStatusServer/handlers/queuestatus.py
index e5dc95f..9eaef6f 100644
--- a/Tools/QueueStatusServer/handlers/queuestatus.py
+++ b/Tools/QueueStatusServer/handlers/queuestatus.py
@@ -26,6 +26,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import datetime
 import itertools
 
 from google.appengine.ext import webapp
@@ -58,11 +59,29 @@ class QueueStatus(webapp.RequestHandler):
 
     def _fetch_statuses(self, queue, bot_id):
         statuses = queuestatus.QueueStatus.all()
-        statuses = statuses.filter("queue_name =", queue.name())
+        statuses.filter("queue_name =", queue.name())
         if bot_id:
             statuses.filter("bot_id =", bot_id)
         return statuses.order("-date").fetch(15)
 
+    def _fetch_last_message_matching(self, queue, bot_id, message):
+        statuses = queuestatus.QueueStatus.all()
+        statuses.filter("queue_name =", queue.name())
+        if bot_id:
+            statuses.filter("bot_id =", bot_id)
+        statuses.filter("message =", message)
+        return statuses.order("-date").get()
+
+    def _fetch_trailing_days_pass_count(self, queue, bot_id, days):
+        statuses = queuestatus.QueueStatus.all()
+        statuses.filter("queue_name =", queue.name())
+        days_ago = datetime.datetime.now() - datetime.timedelta(days=days)
+        statuses.filter("date >", days_ago)
+        if bot_id:
+            statuses.filter("bot_id =", bot_id)
+        statuses.filter("message =", "Pass")
+        return statuses.count()
+
     def _page_title(self, queue, bot_id):
         title = "%s Messages" % queue.display_name()
         if bot_id:
@@ -82,5 +101,9 @@ class QueueStatus(webapp.RequestHandler):
             "work_item_rows": self._rows_for_work_items(queue),
             "status_groups": self._build_status_groups(statuses),
             "bot_id": bot_id,
+            "last_pass": self._fetch_last_message_matching(queue, bot_id, "Pass"),
+            "last_boot": self._fetch_last_message_matching(queue, bot_id, "Starting Queue"),
+            "trailing_month_pass_count": self._fetch_trailing_days_pass_count(queue, bot_id, 30),
+            "trailing_week_pass_count": self._fetch_trailing_days_pass_count(queue, bot_id, 7),
         }
         self.response.out.write(template.render("templates/queuestatus.html", template_values))
diff --git a/Tools/QueueStatusServer/index.yaml b/Tools/QueueStatusServer/index.yaml
index 9724760..34eb72e 100644
--- a/Tools/QueueStatusServer/index.yaml
+++ b/Tools/QueueStatusServer/index.yaml
@@ -26,6 +26,27 @@ indexes:
 - kind: QueueStatus
   properties:
   - name: bot_id
+  - name: message
+  - name: queue_name
+  - name: date
+    direction: desc
+
+- kind: QueueStatus
+  properties:
+  - name: bot_id
+  - name: queue_name
+  - name: date
+    direction: desc
+
+- kind: QueueStatus
+  properties:
+  - name: message
+  - name: queue_name
+  - name: date
+
+- kind: QueueStatus
+  properties:
+  - name: message
   - name: queue_name
   - name: date
     direction: desc
diff --git a/Tools/QueueStatusServer/model/activeworkitems.py b/Tools/QueueStatusServer/model/activeworkitems.py
index ab5d7a6..023258a 100644
--- a/Tools/QueueStatusServer/model/activeworkitems.py
+++ b/Tools/QueueStatusServer/model/activeworkitems.py
@@ -61,6 +61,14 @@ class ActiveWorkItems(db.Model, QueuePropertyMixin):
         nonexpired_pairs = [pair for pair in self._item_time_pairs() if pair[0] != item_id]
         self._set_item_time_pairs(nonexpired_pairs)
 
+    @classmethod
+    def key_for_queue(cls, queue_name):
+        return "active-work-items-%s" % (queue_name)
+
+    @classmethod
+    def lookup_by_queue(cls, queue_name):
+        return cls.get_or_insert(key_name=cls.key_for_queue(queue_name), queue_name=queue_name)
+
     @staticmethod
     def _expire_item(key, item_id):
         active_work_items = db.get(key)
diff --git a/Tools/QueueStatusServer/model/activeworkitems_unitest.py b/Tools/QueueStatusServer/model/activeworkitems_unittest.py
index 6d915a1..b8c620a 100644
--- a/Tools/QueueStatusServer/model/activeworkitems_unitest.py
+++ b/Tools/QueueStatusServer/model/activeworkitems_unittest.py
@@ -28,15 +28,27 @@
 
 import unittest
 from datetime import datetime
+from google.appengine.ext import testbed
 
 from model.activeworkitems import ActiveWorkItems
 
 
 class ActiveWorkItemsTest(unittest.TestCase):
+
+    def setUp(self):
+        self.testbed = testbed.Testbed()
+        self.testbed.activate()
+        self.testbed.init_datastore_v3_stub()
+        self.testbed.init_memcache_stub()
+
+    def tearDown(self):
+        self.testbed.deactivate()
+
     def test_basic(self):
-        items = ActiveWorkItems()
+        items = ActiveWorkItems.lookup_by_queue("test-queue")
         queued_items = [1, 2]
-        time = datetime.now()
+        # db.Model only stores dates to second resolution, so we use an explicit datetime without milliseconds.
+        time = datetime(2011, 4, 18, 18, 50, 44)
         self.assertEqual(items.next_item(queued_items, time), 1)
         self.assertEqual(items.next_item([1], time), None)
         self.assertEqual(items.next_item([], time), None)
@@ -45,8 +57,8 @@ class ActiveWorkItemsTest(unittest.TestCase):
         self.assertEqual(items.time_for_item(2), None)
 
         items.expire_item(1)
+        # expire_item uses a transaction so it doesn't take effect on the current object.
+        self.assertEqual(items.time_for_item(1), time)
+        # If we look up the saved object, we see it's been updated.
+        items = ActiveWorkItems.lookup_by_queue("test-queue")
         self.assertEqual(items.time_for_item(1), None)
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/Tools/QueueStatusServer/model/queues.py b/Tools/QueueStatusServer/model/queues.py
index 1d46f89..bd5e7ed 100644
--- a/Tools/QueueStatusServer/model/queues.py
+++ b/Tools/QueueStatusServer/model/queues.py
@@ -70,13 +70,11 @@ class Queue(object):
         return self._name
 
     def work_items(self):
-        key_name = "work-items-%s" % (self._name)
-        return WorkItems.get_or_insert(key_name=key_name, queue_name=self._name)
+        return WorkItems.lookup_by_queue(self._name)
 
     # FIXME: active_work_items is a bad name for this lock-table.
     def active_work_items(self):
-        key_name = "active-work-items-%s" % (self._name)
-        return ActiveWorkItems.get_or_insert(key_name=key_name, queue_name=self._name)
+        return ActiveWorkItems.lookup_by_queue(self._name)
 
     def _caplitalize_after_dash(self, string):
         return "-".join([word[0].upper() + word[1:] for word in string.split("-")])
diff --git a/Tools/QueueStatusServer/model/workitems.py b/Tools/QueueStatusServer/model/workitems.py
index 772fc39..b74f5f5 100644
--- a/Tools/QueueStatusServer/model/workitems.py
+++ b/Tools/QueueStatusServer/model/workitems.py
@@ -36,6 +36,14 @@ class WorkItems(db.Model, QueuePropertyMixin):
     item_ids = db.ListProperty(int)
     date = db.DateTimeProperty(auto_now_add=True)
 
+    @classmethod
+    def key_for_queue(cls, queue_name):
+        return "work-items-%s" % (queue_name)
+
+    @classmethod
+    def lookup_by_queue(cls, queue_name):
+        return cls.get_or_insert(key_name=cls.key_for_queue(queue_name), queue_name=queue_name)
+
     def display_position_for_attachment(self, attachment_id):
         """Returns a 1-based index corresponding to the position
         of the attachment_id in the queue.  If the attachment is
diff --git a/Tools/QueueStatusServer/templates/queuestatus.html b/Tools/QueueStatusServer/templates/queuestatus.html
index c68abf1..f5b4523 100644
--- a/Tools/QueueStatusServer/templates/queuestatus.html
+++ b/Tools/QueueStatusServer/templates/queuestatus.html
@@ -7,6 +7,22 @@
 <body>
 <h1>{{ page_title }}</h1>
 
+<h3>Summary</h3>
+<div>
+Last Pass: {{ last_pass.date|timesince }} ago
+{% if not bot_id and last_pass.bot_id %}
+by <a href="/queue-status/{{last_pass.queue_name}}/bots/{{last_pass.bot_id}}">{{ last_pass.bot_id }}</a>
+{% endif %}
+</div>
+<div>
+Last Boot: {{ last_boot.date|timesince }} ago
+{% if not bot_id and last_boot.bot_id %}
+by <a href="/queue-status/{{last_boot.queue_name}}/bots/{{last_boot.bot_id}}">{{ last_boot.bot_id }}</a>
+{% endif %}
+</div>
+<div>7-day "Pass" count: {{ trailing_week_pass_count }}</div>
+<div>30-day "Pass" count: {{ trailing_month_pass_count }}</div>
+
 <h3>Recent Status</h3>
 
 <div class="status-details">
diff --git a/Tools/RebaselineQueueServer/app.yaml b/Tools/RebaselineQueueServer/app.yaml
new file mode 100755
index 0000000..c425cfd
--- /dev/null
+++ b/Tools/RebaselineQueueServer/app.yaml
@@ -0,0 +1,11 @@
+application: rebaseline-queue
+version: 1
+runtime: python
+api_version: 1
+
+handlers:
+- url: /static
+  static_dir: static
+
+- url: .*
+  script: main.py
diff --git a/Tools/RebaselineQueueServer/handlers/__init__.py b/Tools/RebaselineQueueServer/handlers/__init__.py
new file mode 100644
index 0000000..ef65bee
--- /dev/null
+++ b/Tools/RebaselineQueueServer/handlers/__init__.py
@@ -0,0 +1 @@
+# Required for Python to search this directory for module files
diff --git a/Tools/RebaselineQueueServer/handlers/builderqueue.py b/Tools/RebaselineQueueServer/handlers/builderqueue.py
new file mode 100644
index 0000000..c84e07b
--- /dev/null
+++ b/Tools/RebaselineQueueServer/handlers/builderqueue.py
@@ -0,0 +1,95 @@
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from urllib import unquote_plus
+
+from google.appengine.ext import webapp
+from google.appengine.ext.webapp import template
+from django.utils import simplejson
+
+from model.queueentry import QueueEntry
+
+
+class QueueHandler(webapp.RequestHandler):
+    def get(self, builder_name):
+        self._get(unquote_plus(builder_name))
+
+    def post(self, builder_name):
+        self._post(unquote_plus(builder_name))
+
+    def _queued_test_names(self, builder_name):
+        return [entry.test for entry in QueueEntry.entries_for_builder(builder_name)]
+        
+    def _queue_list_url(self, builder_name):
+        return '/builder/%s/queue' % builder_name
+
+
+class QueueEdit(QueueHandler):
+    def _get(self, builder_name):
+        test_names = self._queued_test_names(builder_name)
+        self.response.out.write(
+            template.render("templates/builder-queue-edit.html", {
+                'builder_name': builder_name,
+                'queued_test_names': simplejson.dumps(test_names),
+            }))
+
+
+class QueueAdd(QueueHandler):
+    def _post(self, builder_name):
+        current_tests = set(self._queued_test_names(builder_name))
+        tests = set(self.request.get_all('test')).difference(current_tests)
+        
+        for test in tests:
+            QueueEntry.add(builder_name, test)
+
+        self.redirect(self._queue_list_url(builder_name))
+
+
+class QueueRemove(QueueHandler):
+    def _post(self, builder_name):
+        tests = self.request.get_all('test')
+
+        for test in tests:
+            QueueEntry.remove(builder_name, test)
+
+        self.redirect(self._queue_list_url(builder_name))
+
+
+class QueueHtml(QueueHandler):
+    def _get(self, builder_name):
+        self.response.out.write(
+            template.render("templates/builder-queue-list.html", {
+                    'builder_name': builder_name,
+                    'entries': QueueEntry.entries_for_builder(builder_name),
+                }))
+
+
+class QueueJson(QueueHandler):
+    def _get(self, builder_name):
+        queue_json = {'tests': self._queued_test_names(builder_name)}
+        self.response.out.write(simplejson.dumps(queue_json))
diff --git a/Tools/RebaselineQueueServer/handlers/pages.py b/Tools/RebaselineQueueServer/handlers/pages.py
new file mode 100644
index 0000000..8fcf2e3
--- /dev/null
+++ b/Tools/RebaselineQueueServer/handlers/pages.py
@@ -0,0 +1,47 @@
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from google.appengine.ext import webapp
+from google.appengine.ext.webapp import template
+
+from model.queueentry import QueueEntry
+
+
+class Home(webapp.RequestHandler):
+    def get(self):
+        builder_names = QueueEntry.builder_names()
+        self.response.out.write(
+            template.render("templates/home.html", {
+                'builder_names': builder_names,
+            }))
+
+
+class BuilderPicker(webapp.RequestHandler):
+    def get(self):
+        self.response.out.write(
+            template.render("templates/builder-picker.html", {}))
diff --git a/Tools/RebaselineQueueServer/index.yaml b/Tools/RebaselineQueueServer/index.yaml
new file mode 100755
index 0000000..a3b9e05
--- /dev/null
+++ b/Tools/RebaselineQueueServer/index.yaml
@@ -0,0 +1,11 @@
+indexes:
+
+# AUTOGENERATED
+
+# This index.yaml is automatically updated whenever the dev_appserver
+# detects that a new type of query is run.  If you want to manage the
+# index.yaml file manually, remove the above marker line (the line
+# saying "# AUTOGENERATED").  If you want to manage some indexes
+# manually, move them above the marker line.  The index.yaml file is
+# automatically uploaded to the admin console when you next deploy
+# your application using appcfg.py.
diff --git a/Tools/RebaselineQueueServer/main.py b/Tools/RebaselineQueueServer/main.py
new file mode 100755
index 0000000..4497d63
--- /dev/null
+++ b/Tools/RebaselineQueueServer/main.py
@@ -0,0 +1,56 @@
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Request a modern Django
+from google.appengine.dist import use_library
+use_library('django', '1.2')
+
+from google.appengine.ext import webapp
+from google.appengine.ext.webapp import util
+
+from handlers import pages
+from handlers import builderqueue
+
+
+def main():
+    application = webapp.WSGIApplication([
+          ('/', pages.Home),
+          ('/builder/picker', pages.BuilderPicker),
+
+          # Queue CRUD operations
+          ('/builder/(.+)/queue/edit', builderqueue.QueueEdit),
+          ('/builder/(.+)/queue/add', builderqueue.QueueAdd),
+          ('/builder/(.+)/queue/remove', builderqueue.QueueRemove),
+          ('/builder/(.+)/queue', builderqueue.QueueHtml),
+          ('/builder/(.+)/queue/json', builderqueue.QueueJson),
+        ],
+        debug=True)
+    util.run_wsgi_app(application)
+
+if __name__ == '__main__':
+    main()
diff --git a/Tools/RebaselineQueueServer/model/__init__.py b/Tools/RebaselineQueueServer/model/__init__.py
new file mode 100644
index 0000000..ef65bee
--- /dev/null
+++ b/Tools/RebaselineQueueServer/model/__init__.py
@@ -0,0 +1 @@
+# Required for Python to search this directory for module files
diff --git a/Tools/RebaselineQueueServer/model/queueentry.py b/Tools/RebaselineQueueServer/model/queueentry.py
new file mode 100644
index 0000000..6570fc0
--- /dev/null
+++ b/Tools/RebaselineQueueServer/model/queueentry.py
@@ -0,0 +1,63 @@
+# Copyright (C) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from google.appengine.ext import db
+
+
+class QueueEntry(db.Model):
+    test = db.StringProperty()
+    builder = db.StringProperty()
+
+    @staticmethod
+    def add(builder_name, test):
+        entry = QueueEntry()
+        entry.builder = builder_name
+        entry.test = test
+        entry.put()
+        return entry
+
+    @staticmethod
+    def remove(builder_name, test):
+        query = QueueEntry.all()
+        query = query.filter('builder =', builder_name).filter('test =', test)
+        for entry in query:
+            entry.delete()
+
+    @staticmethod
+    def entries_for_builder(builder_name):
+        query = QueueEntry.all()
+        query = query.filter('builder =', builder_name)
+        return query
+
+    @staticmethod
+    def builder_names():
+        query = QueueEntry.all()
+        builder_names = set()
+        for entry in query:
+            builder_names.add(entry.builder)
+        return builder_names
diff --git a/Tools/RebaselineQueueServer/static/builder-frame-empty.html b/Tools/RebaselineQueueServer/static/builder-frame-empty.html
new file mode 100644
index 0000000..31b91bb
--- /dev/null
+++ b/Tools/RebaselineQueueServer/static/builder-frame-empty.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Rebaseline Queue</title>
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body>
+Select a group and then a builder to see tests that are currently failing on it (if any).
+</body>
+</html>
diff --git a/Tools/RebaselineQueueServer/static/styles.css b/Tools/RebaselineQueueServer/static/styles.css
new file mode 100644
index 0000000..a36ff35
--- /dev/null
+++ b/Tools/RebaselineQueueServer/static/styles.css
@@ -0,0 +1,71 @@
+body {
+  font-family: Helvetica, Arial, sans-serif;
+  font-size: 12px;
+}
+
+h1 {
+  border-bottom: solid 1px #ccc;
+}
+
+#builder-picker body,
+#add-form body {
+  margin: 0;
+}
+
+#builder-picker, 
+#builder-picker body {
+  height: 100%;
+}
+
+#builder-picker body {
+  display: -webkit-box;
+  -webkit-box-orient: vertical;
+}
+
+#builder-picker-controls {
+  padding: 0.5em;
+  border-bottom: solid 1px black;
+}
+
+#builder-picker-controls select {
+  min-width: 10em;
+}
+
+#builder-frame {
+  border: 0;
+  -webkit-box-flex: 1;
+  display: block;
+}
+
+.status {
+  font-size: 16px;
+  text-align: center;
+  padding: 1em;
+}
+
+.test-table {
+  border-collapse: collapse;
+}
+
+.test-table caption {
+  font-size: 16px;
+  font-weight: bold;
+  background: #eee;
+  padding: .5em;
+}
+
+.test-table th {
+  text-align: left;
+  border-bottom: solid 1px #ccc;
+  background: #eee;
+  min-width: 8em;
+}
+
+.test-table tbody tr:hover {
+  background: #ffa;
+}
+
+.test-table .submit-row {
+  text-align: right;
+  padding: 1em 0;
+}
diff --git a/Tools/RebaselineQueueServer/templates/builder-picker.html b/Tools/RebaselineQueueServer/templates/builder-picker.html
new file mode 100644
index 0000000..1068c04
--- /dev/null
+++ b/Tools/RebaselineQueueServer/templates/builder-picker.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<html id="builder-picker">
+<head>
+    <title>Rebaseline Queue: Builders</title>
+    <script src="http://test-results.appspot.com/dashboards/builders.js"></script>
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body>
+
+<div id="builder-picker-controls">
+    <label for="builder-group">Group:</label>
+    <select id="builder-group">
+        <option disabled></option>
+    </select>
+
+    <label for="builder">Builder:</label>
+    <select id="builder">
+        <option disabled></option>
+    </select>
+</div>
+
+<iframe src="/static/builder-frame-empty.html" id="builder-frame"></iframe>
+
+<script>
+function init()
+{
+    var builderGroupMenu = document.getElementById('builder-group');
+    builderGroupMenu.addEventListener(
+        'change', handleBuilderGroupSelected, false);
+
+    var builderMenu = document.getElementById('builder');
+    builderMenu.addEventListener(
+        'change', handleBuilderSelected, false);
+
+    for (var builderGroupName in LAYOUT_TESTS_BUILDER_GROUPS) {
+        var builderGroupOption = document.createElement('option');
+        builderGroupOption.textContent = builderGroupOption.value =
+            builderGroupName;
+        builderGroupMenu.appendChild(builderGroupOption);
+    }
+}
+
+function handleBuilderGroupSelected()
+{
+    var builderGroupMenu = document.getElementById('builder-group');
+    var builderGroupName =
+        builderGroupMenu.options[builderGroupMenu.selectedIndex].value;
+    var builderGroup = LAYOUT_TESTS_BUILDER_GROUPS[builderGroupName];
+
+    var builderMenu = document.getElementById('builder');
+    while (builderMenu.options[1]) {
+        builderMenu.removeChild(builderMenu.options[1]);
+    }
+
+    for (var builderName in builderGroup.builders) {
+        var builderOption = document.createElement('option');
+        builderOption.textContent = builderOption.value = builderName;
+        builderMenu.appendChild(builderOption);
+    }
+}
+
+function handleBuilderSelected()
+{
+    var builderMenu = document.getElementById('builder');
+    var builderName = builderMenu.options[builderMenu.selectedIndex].value;
+    document.getElementById('builder-frame').src =
+        '/builder/' + builderName + '/queue/edit';
+}
+
+init();
+</script>
+
+</body>
+</html>
diff --git a/Tools/RebaselineQueueServer/templates/builder-queue-edit.html b/Tools/RebaselineQueueServer/templates/builder-queue-edit.html
new file mode 100644
index 0000000..21a0f02
--- /dev/null
+++ b/Tools/RebaselineQueueServer/templates/builder-queue-edit.html
@@ -0,0 +1,176 @@
+<!DOCTYPE html>
+<html id="add-form">
+<head>
+    <title>Rebaseline Queue: Edit</title>
+    <script src="http://test-results.appspot.com/dashboards/builders.js"></script>
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body">
+
+<div id="loading-indicator" class="status">Loading...</div>
+
+<form method="POST" id="form-template" style="display: none">
+    <table class="test-table">
+        <caption></caption>
+        <thead>
+            <th>Test</th>
+            <th>Expected</th>
+            <th>Actual</th>
+            <th>Results</th>
+        </thead>
+        <tbody></tbody>
+        <tbody>
+            <tr>
+              <td colspan="4" class="submit-row">
+                <input type="submit" value="">
+              </td>
+            </tr>
+        </tbody>
+    </table>
+</form>
+
+<script>
+var TEST_RESULTS_SERVER = 'http://test-results.appspot.com/';
+var BUILDER_TO_GROUP = {};
+for (var builderGroupName in LAYOUT_TESTS_BUILDER_GROUPS) {
+    for (var builderName in LAYOUT_TESTS_BUILDER_GROUPS[builderGroupName]) {
+        BUILDER_TO_GROUP[builderName] = builderGroupName;
+    }
+}
+
+// Extract template parameters
+var builderName = '{{ builder_name|escapejs }}';
+var queuedTestNames = {{ queued_test_names|safe }};
+
+function init()
+{
+  var builderMaster = BUILDER_TO_MASTER[builderName];
+  var resultsUrl = TEST_RESULTS_SERVER + 'testfile?builder=' + builderName +
+      '&master=' + builderMaster.name +
+      '&testtype=layout-tests&name=full_results.json';
+
+  var script = document.createElement('script');
+  script.src = resultsUrl;
+  document.getElementsByTagName('head')[0].appendChild(script);
+}
+
+function ADD_RESULTS(results)
+{
+    var builderGroupName = BUILDER_TO_GROUP[builderName];
+
+    var tests = results.tests;
+    var failingTests = [];
+    var queuedTests = [];
+    for (var test in tests) {
+        var testResults = tests[test];
+        if (testResults.actual == testResults.expected ||
+            testResults.expected.split(' ').indexOf(testResults.actual) != -1 ||
+            testResults.actual == 'SKIP' ||
+            testResults.actual.indexOf('PASS') != -1 ||
+            (testResults.actual != 'PASS' && testResults.expected.indexOf('FAIL') != -1)) {
+            continue;
+        }
+
+        testResults.name = test;
+
+        if (queuedTestNames.indexOf(test) != -1) {
+            queuedTests.push(testResults);
+            queuedTestNames.splice(queuedTestNames.indexOf(test), 1);
+        } else {
+            failingTests.push(testResults);
+        }
+    }
+
+    // If we have remaining queued tests that are currently not failing,
+    // synthesize results for them.
+    queuedTestNames.forEach(function(queuedTestName) {
+        queuedTests.push({
+          name: queuedTestName,
+          actual: 'UNKNOWN',
+          expected: 'UNKNOWN'
+        });
+    });
+
+    document.getElementById('loading-indicator').style.display = 'none';
+
+    renderTestResults(
+        failingTests,
+        'add',
+        'Failing tests',
+        'Add to rebaseline queue',
+        'No failing tests.');
+    renderTestResults(
+        queuedTests,
+        'remove',
+        'Queued tests',
+        'Remove from rebaseline queue',
+        'No queued tests.');
+}
+
+function renderTestResults(testResults, formAction, title, submitLabel, emptyMessage)
+{
+    if (testResults.length == 0) {
+        var emptyNode = document.createElement('div');
+        emptyNode.className = 'status';
+        emptyNode.textContent = emptyMessage;
+        document.body.appendChild(emptyNode);
+        return;
+    }
+
+    var form = document.getElementById('form-template').cloneNode(true);
+    form.action = '/builder/' + builderName + '/queue/' + formAction;
+    form.style.display = '';
+    document.body.appendChild(form);
+
+    var testsTable = form.querySelector('.test-table');
+    testsTable.querySelector('caption').textContent = title;
+    testsTable.querySelector('input[type=submit]').value = submitLabel;
+
+    testResults.sort(function(a, b) {
+        return a.name < b.name ? -1 : (a.name > b.name ? 1 : 0);
+    });
+
+    testResults.forEach(function(result) {
+        var testRow = document.createElement('tr');
+
+        var testCell = document.createElement('td');
+        testRow.appendChild(testCell);
+        var testCheckbox = document.createElement('input');
+        testCheckbox.type = 'checkbox';
+        testCheckbox.name = 'test';
+        testCheckbox.value = result.name;
+        testCheckbox.id = result.name;
+        testCell.appendChild(testCheckbox);
+
+        var testName = document.createElement('label');
+        testName.textContent = result.name;
+        testName.setAttribute('for', result.name);
+        testCell.appendChild(testName);
+
+        var expectedCell = document.createElement('td');
+        testRow.appendChild(expectedCell);
+        expectedCell.textContent = result.expected;
+
+        var actualCell = document.createElement('td');
+        testRow.appendChild(actualCell);
+        actualCell.textContent = result.actual;
+
+        var resultsCell = document.createElement('td');
+        testRow.appendChild(resultsCell);
+        var resultsLink = document.createElement('a');
+        resultsLink.target = '_blank';
+        resultsLink.href = TEST_RESULTS_SERVER +
+            'dashboards/flakiness_dashboard.html#tests=' + result.name +
+            '&group=' + builderGroupName;
+        resultsLink.textContent = 'Flakiness dashboard';
+        resultsCell.appendChild(resultsLink);
+
+        testsTable.tBodies[0].appendChild(testRow);
+    });
+}
+
+init();
+</script>
+
+</body>
+</html>
diff --git a/Tools/RebaselineQueueServer/templates/builder-queue-list.html b/Tools/RebaselineQueueServer/templates/builder-queue-list.html
new file mode 100644
index 0000000..79fa02a
--- /dev/null
+++ b/Tools/RebaselineQueueServer/templates/builder-queue-list.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>{{ builder_name|escape }} Queue</title>
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body>
+
+<h1>Queue: {{ builder_name|escape }}</h1>
+
+<ol>
+{% for entry in entries %}
+    <li>
+        {{ entry.test|escape }}
+    </li>
+{% empty %}
+    No tests found in queue.
+{% endfor %}
+</ol>
+
+<a href="/builder/{{ builder_name|escape }}/queue/edit">Edit queue</a>
+</body>
+</html>
diff --git a/Tools/RebaselineQueueServer/templates/home.html b/Tools/RebaselineQueueServer/templates/home.html
new file mode 100644
index 0000000..c6a16ff
--- /dev/null
+++ b/Tools/RebaselineQueueServer/templates/home.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Rebaseline Queue</title>
+  <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body>
+
+<h1>Rebaseline Queue</h1>
+
+<ul>
+    <li><a href="/builder/picker">Browse and enqueue failing tests on builders</a></li>
+    <li>
+        Builders with enqueued tests:
+        <ul>
+{% for builder_name in builder_names %}
+          <li>
+            <a href="/builder/{{ builder_name|escape }}/queue">{{ builder_name|escape }}</a>
+          </li>
+{% empty %}
+        None
+{% endfor %}
+        </ul>
+    </li>
+</ul>
+
+</body>
+</html>
diff --git a/Tools/Scripts/VCSUtils.pm b/Tools/Scripts/VCSUtils.pm
index a05a75d..8353f25 100644
--- a/Tools/Scripts/VCSUtils.pm
+++ b/Tools/Scripts/VCSUtils.pm
@@ -1,6 +1,6 @@
 # Copyright (C) 2007, 2008, 2009 Apple Inc.  All rights reserved.
 # Copyright (C) 2009, 2010 Chris Jerdonek (chris.jerdonek@gmail.com)
-# Copyright (C) Research In Motion Limited 2010. All rights reserved.
+# Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -68,6 +68,7 @@ BEGIN {
         &makeFilePathRelative
         &mergeChangeLogs
         &normalizePath
+        &parseFirstEOL
         &parsePatch
         &pathRelativeToSVNRepositoryRootForPath
         &prepareParsedPatch
@@ -97,6 +98,7 @@ my $svnVersion;
 # Project time zone for Cupertino, CA, US
 my $changeLogTimeZone = "PST8PDT";
 
+my $chunkRangeRegEx = qr#^\@\@ -(\d+),(\d+) \+\d+,(\d+) \@\@$#; # e.g. @@ -2,6 +2,18 @@
 my $gitDiffStartRegEx = qr#^diff --git (\w/)?(.+) (\w/)?([^\r\n]+)#;
 my $svnDiffStartRegEx = qr#^Index: ([^\r\n]+)#;
 my $svnPropertiesStartRegEx = qr#^Property changes on: ([^\r\n]+)#; # $1 is normally the same as the index path.
@@ -449,6 +451,40 @@ sub removeEOL($)
     return $line;
 }
 
+sub parseFirstEOL($)
+{
+    my ($fileHandle) = @_;
+
+    # Make input record separator the new-line character to simplify regex matching below.
+    my $savedInputRecordSeparator = $INPUT_RECORD_SEPARATOR;
+    $INPUT_RECORD_SEPARATOR = "\n";
+    my $firstLine  = <$fileHandle>;
+    $INPUT_RECORD_SEPARATOR = $savedInputRecordSeparator;
+
+    return unless defined($firstLine);
+
+    my $eol;
+    if ($firstLine =~ /\r\n/) {
+        $eol = "\r\n";
+    } elsif ($firstLine =~ /\r/) {
+        $eol = "\r";
+    } elsif ($firstLine =~ /\n/) {
+        $eol = "\n";
+    }
+    return $eol;
+}
+
+sub firstEOLInFile($)
+{
+    my ($file) = @_;
+    my $eol;
+    if (open(FILE, $file)) {
+        $eol = parseFirstEOL(*FILE);
+        close(FILE);
+    }
+    return $eol;
+}
+
 sub svnStatus($)
 {
     my ($fullPath) = @_;
@@ -822,23 +858,30 @@ sub parseDiffHeader($$)
 #   $fileHandle: a file handle advanced to the first line of the next
 #                header block. Leading junk is okay.
 #   $line: the line last read from $fileHandle.
+#   $optionsHashRef: a hash reference representing optional options to use
+#                    when processing a diff.
+#     shouldNotUseIndexPathEOL: whether to use the line endings in the diff instead
+#                               instead of the line endings in the target file; the
+#                               value of 1 if svnConvertedText should use the line
+#                               endings in the diff.
 #
 # Returns ($diffHashRefs, $lastReadLine):
 #   $diffHashRefs: A reference to an array of references to %diffHash hashes.
 #                  See the %diffHash documentation above.
 #   $lastReadLine: the line last read from $fileHandle
-sub parseDiff($$)
+sub parseDiff($$;$)
 {
     # FIXME: Adjust this method so that it dies if the first line does not
     #        match the start of a diff.  This will require a change to
     #        parsePatch() so that parsePatch() skips over leading junk.
-    my ($fileHandle, $line) = @_;
+    my ($fileHandle, $line, $optionsHashRef) = @_;
 
     my $headerStartRegEx = $svnDiffStartRegEx; # SVN-style header for the default
 
     my $headerHashRef; # Last header found, as returned by parseDiffHeader().
     my $svnPropertiesHashRef; # Last SVN properties diff found, as returned by parseSvnDiffProperties().
     my $svnText;
+    my $indexPathEOL;
     while (defined($line)) {
         if (!$headerHashRef && ($line =~ $gitDiffStartRegEx)) {
             # Then assume all diffs in the patch are Git-formatted. This
@@ -861,6 +904,11 @@ sub parseDiff($$)
         }
         if ($line !~ $headerStartRegEx) {
             # Then we are in the body of the diff.
+            if ($indexPathEOL && $line !~ /$chunkRangeRegEx/) {
+                # The chunk range is part of the body of the diff, but its line endings should't be
+                # modified or patch(1) will complain. So, we only modify non-chunk range lines.
+                $line =~ s/\r\n|\r|\n/$indexPathEOL/g;
+            }
             $svnText .= $line;
             $line = <$fileHandle>;
             next;
@@ -873,6 +921,9 @@ sub parseDiff($$)
         }
 
         ($headerHashRef, $line) = parseDiffHeader($fileHandle, $line);
+        if (!$optionsHashRef || !$optionsHashRef->{shouldNotUseIndexPathEOL}) {
+            $indexPathEOL = firstEOLInFile($headerHashRef->{indexPath}) if !$headerHashRef->{isNew} && !$headerHashRef->{isBinary};
+        }
 
         $svnText .= $headerHashRef->{svnConvertedText};
     }
@@ -1167,13 +1218,19 @@ sub parseSvnPropertyValue($$)
 # Args:
 #   $fileHandle: A file handle to the patch file that has not yet been
 #                read from.
+#   $optionsHashRef: a hash reference representing optional options to use
+#                    when processing a diff.
+#     shouldNotUseIndexPathEOL: whether to use the line endings in the diff instead
+#                               instead of the line endings in the target file; the
+#                               value of 1 if svnConvertedText should use the line
+#                               endings in the diff.
 #
 # Returns:
 #   @diffHashRefs: an array of diff hash references.
 #                  See the %diffHash documentation above.
-sub parsePatch($)
+sub parsePatch($;$)
 {
-    my ($fileHandle) = @_;
+    my ($fileHandle, $optionsHashRef) = @_;
 
     my $newDiffHashRefs;
     my @diffHashRefs; # return value
@@ -1182,7 +1239,7 @@ sub parsePatch($)
 
     while (defined($line)) { # Otherwise, at EOF.
 
-        ($newDiffHashRefs, $line) = parseDiff($fileHandle, $line);
+        ($newDiffHashRefs, $line) = parseDiff($fileHandle, $line, $optionsHashRef);
 
         push @diffHashRefs, @$newDiffHashRefs;
     }
@@ -1440,7 +1497,6 @@ sub fixChangeLogPatch($)
     $deletedLineCount += $dateStartIndex - $chunkStartIndex;
 
     # Update the initial chunk range.
-    my $chunkRangeRegEx = '^\@\@ -(\d+),(\d+) \+\d+,(\d+) \@\@$'; # e.g. @@ -2,6 +2,18 @@
     if ($lines[$chunkStartIndex - 1] !~ /$chunkRangeRegEx/) {
         # FIXME: Handle errors differently from ChangeLog files that
         # are okay but should not be altered. That way we can find out
diff --git a/Tools/Scripts/build-webkit b/Tools/Scripts/build-webkit
index 8ff638d..1b4743e 100755
--- a/Tools/Scripts/build-webkit
+++ b/Tools/Scripts/build-webkit
@@ -96,7 +96,9 @@ my (
     $notificationsSupport,
     $offlineWebApplicationSupport,
     $orientationEventsSupport,
+    $pageVisibilityApiSupport,
     $progressTagSupport,
+    $quotaSupport,
     $registerProtocolHandlerSupport,
     $sharedWorkersSupport,
     $svgSupport,
@@ -225,9 +227,15 @@ my @features = (
     { option => "orientation-events", desc => "Toggle Orientation Events support",
       define => "ENABLE_ORIENTATION_EVENTS", default => 0, value => \$orientationEventsSupport },
 
+    { option => "page-visibility-api", desc => "Page Visibility API support",
+      define => "ENABLE_PAGE_VISIBILITY_API", default => 0, value => \$pageVisibilityApiSupport },
+
     { option => "progress-tag", desc => "Progress Tag support",
       define => "ENABLE_PROGRESS_TAG", default => 1, value => \$progressTagSupport },
 
+    { option => "quota", desc => "Toggle Quota support",
+      define => "ENABLE_QUOTA", default => 0, value => \$quotaSupport },
+
     { option => "register-protocol-handler", desc => "Register Protocol Handler support",
       define => "ENABLE_REGISTER_PROTOCOL_HANDLER", default => 0, value => \$registerProtocolHandlerSupport },
 
@@ -354,6 +362,7 @@ Usage: $programName [options] [options to pass to build system]
   --install-headers=<path>          Set installation path for the headers (Qt only)
   --install-libs=<path>             Set installation path for the libraries (Qt only)
   --v8                              Use V8 as JavaScript engine (Qt only)
+  -2                                build WebKit2 (Qt only)
 
   --prefix=<path>                   Set installation prefix to the given path (Gtk/Efl only)
   --makeargs=<arguments>            Optional Makefile flags
@@ -414,13 +423,16 @@ sub unlinkZeroFiles()
 # Check that all the project directories are there.
 my @projects = ("Source/JavaScriptCore", "Source/WebCore", "Source/WebKit");
 
-my @otherDirs = ("WebKitLibraries");
-for my $dir (@projects, @otherDirs) {
+for my $dir (@projects) {
     if (! -d $dir) {
         die "Error: No $dir directory found. Please do a fresh checkout.\n";
     }
 }
 
+if (!isQt() && !-d "WebKitLibraries") {
+    die "Error: No WebKitLibraries directory found. Please do a fresh checkout.\n";
+}
+
 # Generate the generate project files from .gyp files
 if ($useGYP) {
     system("perl", "Tools/Scripts/generate-project-files") == 0 or die "Failed to run generate-project-files";
@@ -500,11 +512,16 @@ if (isGtk()) {
     # Copy WebKitSupportLibrary to the correct location in WebKitLibraries so it can be found.
     # Will fail if WebKitSupportLibrary.zip is not in source root.
     (system("perl Tools/Scripts/update-webkit-support-libs") == 0) or die;
+    # Update Cairo Dependancies.
+    if (isWinCairo()) {
+        (system("perl Tools/Scripts/update-webkit-wincairo-libs") == 0) or die;
+    }
 } elsif (isQt()) {
-    @options = @ARGV;
     push @options, "--install-headers=" . $installHeaders if defined($installHeaders);
     push @options, "--install-libs=" . $installLibs if defined($installLibs);
     push @options, "--makeargs=" . $makeArgs if $makeArgs;
+    push @options, "--qmakearg=CONFIG+=webkit2" if isWK2();
+    @options = (@ARGV, @options);
 
     foreach (@features) {
         push @options, "DEFINES+=$_->{define}=${$_->{value}}" if ${$_->{value}} != $_->{default};
diff --git a/Tools/Scripts/do-webcore-rename b/Tools/Scripts/do-webcore-rename
index da08cf7..4829f39 100755
--- a/Tools/Scripts/do-webcore-rename
+++ b/Tools/Scripts/do-webcore-rename
@@ -97,7 +97,7 @@ sub wanted
 my $isDOMTypeRename = 0;
 my %renames = (
     # Renames go here in the form of:
-    "DocLoader" => "CachedResourceLoader",
+    "MediaControls" => "MediaControlRootElement",
 );
 
 my %renamesContemplatedForTheFuture = (
diff --git a/Tools/Scripts/extract-localizable-strings b/Tools/Scripts/extract-localizable-strings
index 116f11f..dae60c2 100755
--- a/Tools/Scripts/extract-localizable-strings
+++ b/Tools/Scripts/extract-localizable-strings
@@ -107,7 +107,7 @@ for my $dir (@directoriesToSkip) {
 my @files = ( split "\n", `find $quotedDirectoriesString \\( -name "*.h" -o -name "*.m" -o -name "*.mm" -o -name "*.c" -o -name "*.cpp" \\)` );
 
 for my $file (sort @files) {
-    next if $file =~ /\/\w+LocalizableStrings\w*\.h$/;
+    next if $file =~ /\/\w+LocalizableStrings\w*\.h$/ || $file =~ /\/LocalizedStrings\.h$/;
 
     $file =~ s-^./--;
 
@@ -169,7 +169,7 @@ handleString:
                         # FIXME: Validate UTF-8 here?
                         $UIString = $string;
                         $expected = ",";
-                    } elsif (($macro =~ /UI_STRING_KEY(_INTERNAL)?$/) and !defined $key) {
+                    } elsif (($macro =~ /(WEB_)?UI_STRING_KEY(_INTERNAL)?$/) and !defined $key) {
                         # FIXME: Validate UTF-8 here?
                         $key = $string;
                         $expected = ",";
@@ -228,7 +228,7 @@ handleString:
                     $sawError = 1;
                     $expected = "";
                 }
-                if ($token =~ /UI_STRING(_KEY)?(_INTERNAL)?$/) {
+                if ($token =~ /(WEB_)?UI_STRING(_KEY)?(_INTERNAL)?$/) {
                     $expected = "(";
                     $macro = $token;
                     $UIString = undef;
diff --git a/Tools/Scripts/gdb-safari b/Tools/Scripts/gdb-safari
index 9776212..0c55bd3 100755
--- a/Tools/Scripts/gdb-safari
+++ b/Tools/Scripts/gdb-safari
@@ -50,4 +50,4 @@ $ENV{WEBKIT_UNSET_DYLD_FRAMEWORK_PATH} = 'YES';
 
 print "Starting Safari under gdb with DYLD_FRAMEWORK_PATH set to point to built WebKit in $productDir.\n";
 my @architectureFlags = ("-arch", architecture()) if !isTiger();
-exec $gdbPath, @architectureFlags, $safariPath or die;
+exec $gdbPath, @architectureFlags, "--arg", $safariPath, @ARGV or die;
diff --git a/Tools/Scripts/old-run-webkit-tests b/Tools/Scripts/old-run-webkit-tests
index fe9bdd0..333777e 100755
--- a/Tools/Scripts/old-run-webkit-tests
+++ b/Tools/Scripts/old-run-webkit-tests
@@ -105,6 +105,7 @@ sub openWebSocketServerIfNeeded();
 sub pathcmp($$);
 sub printFailureMessageForTest($$);
 sub processIgnoreTests($$);
+sub readChecksumFromPng($);
 sub readFromDumpToolWithTimer(**);
 sub readSkippedFiles($);
 sub recordActualResultsAndDiff($$);
@@ -125,6 +126,7 @@ sub writeToFile($$);
 
 # Argument handling
 my $addPlatformExceptions = 0;
+my @additionalPlatformDirectories = ();
 my $complexText = 0;
 my $exitAfterNFailures = 0;
 my $exitAfterNCrashesOrTimeouts = 0;
@@ -275,6 +277,8 @@ my $sampleDefault = $runSample ? "run" : "do not run";
 my $usage = <<EOF;
 Usage: $programName [options] [testdir|testpath ...]
   --add-platform-exceptions       Put new results for non-platform-specific failing tests into the platform-specific results directory
+  --additional-platform-directory path/to/directory
+                                  Look in the specified directory before looking in any of the default platform-specific directories
   --complex-text                  Use the complex text code path for all text (Mac OS X and Windows only)
   -c|--configuration config       Set DumpRenderTree build configuration
   -g|--guard-malloc               Enable malloc guard
@@ -323,6 +327,7 @@ setConfiguration();
 
 my $getOptionsResult = GetOptions(
     'add-platform-exceptions' => \$addPlatformExceptions,
+    'additional-platform-directory=s' => \@additionalPlatformDirectories,
     'complex-text' => \$complexText,
     'exit-after-n-failures=i' => \$exitAfterNFailures,
     'exit-after-n-crashes-or-timeouts=i' => \$exitAfterNCrashesOrTimeouts,
@@ -426,6 +431,7 @@ my $dumpToolName = $useWebKitTestRunner ? "WebKitTestRunner" : "DumpRenderTree";
 
 if (isAppleWinWebKit()) {
     $dumpToolName .= "_debug" if configurationForVisualStudio() eq "Debug_All";
+    $dumpToolName .= "_debug" if configurationForVisualStudio() eq "Debug_Cairo_CFLite";
     $dumpToolName .= $Config{_exe};
 }
 my $dumpTool = File::Spec->catfile($productDir, $dumpToolName);
@@ -433,6 +439,7 @@ die "can't find executable $dumpToolName (looked in $productDir)\n" unless -x $d
 
 my $imageDiffTool = "$productDir/ImageDiff";
 $imageDiffTool .= "_debug" if isCygwin() && configurationForVisualStudio() eq "Debug_All";
+$imageDiffTool .= "_debug" if isCygwin() && configurationForVisualStudio() eq "Debug_Cairo_CFLite";
 die "can't find executable $imageDiffTool (looked in $productDir)\n" if $pixelTests && !-x $imageDiffTool;
 
 checkFrameworks() unless isCygwin();
@@ -556,6 +563,7 @@ if (!$hasAcceleratedCompositing) {
         $ignoredFiles{'media/controls-drag-timebar.html'} = 1;
         $ignoredFiles{'media/controls-strict.html'} = 1;
         $ignoredFiles{'media/controls-styling.html'} = 1;
+        $ignoredFiles{'media/controls-without-preload.html'} = 1;
         $ignoredFiles{'media/video-controls-rendering.html'} = 1;
         $ignoredFiles{'media/video-display-toggle.html'} = 1;
         $ignoredFiles{'media/video-no-audio.html'} = 1;
@@ -599,6 +607,12 @@ if (!checkWebCoreFeatureSupport("XHTMLMP", 0)) {
     $ignoredDirectories{'fast/xhtmlmp'} = 1;
 }
 
+if (isAppleMacWebKit() && $platform ne "mac-wk2" && osXVersion()->{minor} >= 6 && architecture() =~ /x86_64/) {
+    # This test relies on executing JavaScript during NPP_Destroy, which isn't supported with
+    # out-of-process plugins in WebKit1. See <http://webkit.org/b/58077>.
+    $ignoredFiles{'plugins/npp-set-window-called-during-destruction.html'} = 1;
+}
+
 processIgnoreTests(join(',', @ignoreTests), "ignore-tests") if @ignoreTests;
 if (!$ignoreSkipped) {
     if (!$skippedOnly || @ARGV == 0) {
@@ -679,6 +693,9 @@ for (my $i = 1; $i < $iterations; $i++) {
     push(@tests, @originalTests);
 }
 
+my $absTestResultsDirectory = resolveAndMakeTestResultsDirectory();
+open my $tests_run_fh, '>', "$absTestResultsDirectory/tests_run.txt" or die $!;
+
 for my $test (@tests) {
     my $newDumpTool = not $isDumpToolOpen;
     openDumpTool();
@@ -729,6 +746,8 @@ for my $test (@tests) {
 
     my $startTime = time if $report10Slowest;
 
+    print $tests_run_fh "$testDirectory/$test\n";
+
     # Try to read expected hash file for pixel tests
     my $suffixExpectedHash = "";
     if ($pixelTests && !$resetResults) {
@@ -740,6 +759,8 @@ for my $test (@tests) {
             
             # Format expected hash into a suffix string that is appended to the path / URL passed to DRT
             $suffixExpectedHash = "'$expectedHash";
+        } elsif (my $expectedHash = readChecksumFromPng(File::Spec->catfile($expectedPixelDir, "$base-$expectedTag.png"))) {
+            $suffixExpectedHash = "'$expectedHash";
         }
     }
 
@@ -1075,6 +1096,8 @@ for my $test (@tests) {
     last if stopRunningTestsEarlyIfNeeded();
 }
 
+close($tests_run_fh);
+
 my $totalTestingTime = time - $overallStartTime;
 my $waitTime = getWaitTime();
 if ($waitTime > 0.1) {
@@ -1157,6 +1180,9 @@ print HTML htmlForResultsSection(@{$tests{webProcessCrash}}, "Tests that caused
 print HTML htmlForResultsSection(@{$tests{error}}, "Tests that had stderr output", \&linksForErrorTest);
 print HTML htmlForResultsSection(@{$tests{new}}, "Tests that had no expected results (probably new)", \&linksForNewTest);
 
+print HTML "<p>httpd access log: <a href=\"access_log.txt\">access_log.txt</a></p>\n";
+print HTML "<p>httpd error log: <a href=\"error_log.txt\">error_log.txt</a></p>\n";
+
 print HTML "</body>\n";
 print HTML "</html>\n";
 close HTML;
@@ -1255,12 +1281,6 @@ sub countAndPrintLeaks($$$)
         );
     }
 
-    if (isDarwin() && !isTiger() && !isLeopard() && !isSnowLeopard()) {
-        push @callStacksToExclude, (
-            "CGGradientCreateWithColorComponents", # leak in CoreGraphics, <rdar://problem/7888492>
-        );
-    }
-
     my $leaksTool = sourceDir() . "/Tools/Scripts/run-leaks";
     my $excludeString = "--exclude-callstack '" . (join "' --exclude-callstack '", @callStacksToExclude) . "'";
     $excludeString .= " --exclude-type '" . (join "' --exclude-type '", @typesToExclude) . "'" if @typesToExclude;
@@ -2112,13 +2132,13 @@ sub recordActualResultsAndDiff($$)
     mkpath(dirname($actualResultsPath));
     writeToFile("$actualResultsPath", $actualResults);
 
-    if (-f $expectedResultPath) {
-        copy("$expectedResultPath", "$copiedExpectedResultsPath");
-    } else {
-        open EMPTY, ">$copiedExpectedResultsPath";
-        close EMPTY;
+    # We don't need diff and pretty diff for tests without expected file.
+    if ( !-f $expectedResultPath) {
+        return;
     }
 
+    copy("$expectedResultPath", "$copiedExpectedResultsPath");
+
     my $diffOuputBasePath = File::Spec->catfile($testResultsDirectory, $base);
     my $diffOutputPath = "$diffOuputBasePath-$diffsTag.txt";
     system "diff -u \"$copiedExpectedResultsPath\" \"$actualResultsPath\" > \"$diffOutputPath\"";
@@ -2165,6 +2185,8 @@ sub buildPlatformResultHierarchy()
         push(@hierarchy, $scoped) if (-d $scoped);
     }
     
+    unshift @hierarchy, grep { -d $_ } @additionalPlatformDirectories;
+
     return @hierarchy;
 }
 
@@ -2457,6 +2479,15 @@ sub readSkippedFiles($)
     }
 }
 
+sub readChecksumFromPng($)
+{
+    my ($path) = @_;
+    my $data;
+    if (open(PNGFILE, $path) && read(PNGFILE, $data, 2048) && $data =~ /tEXtchecksum\0([a-fA-F0-9]{32})/) {
+        return $1;
+    }
+}
+
 my @testsFound;
 
 sub isUsedInReftest
@@ -2668,10 +2699,13 @@ sub setUpWindowsCrashLogSaving()
 
     my $ntsdPath = File::Spec->catfile(toCygwinPath($ENV{PROGRAMFILES}), "Debugging Tools for Windows (x86)", "ntsd.exe");
     unless (-f $ntsdPath) {
-        $ntsdPath = File::Spec->catfile(toCygwinPath($ENV{SYSTEMROOT}), "system32", "ntsd.exe");
+        $ntsdPath = File::Spec->catfile(toCygwinPath($ENV{ProgramW6432}), "Debugging Tools for Windows (x64)", "ntsd.exe");
         unless (-f $ntsdPath) {
-            print STDERR "Can't find ntsd.exe. Crash logs will not be saved.\nSee <http://trac.webkit.org/wiki/BuildingOnWindows#GettingCrashLogs>.\n";
-            return;
+            $ntsdPath = File::Spec->catfile(toCygwinPath($ENV{SYSTEMROOT}), "system32", "ntsd.exe");
+            unless (-f $ntsdPath) {
+                print STDERR "Can't find ntsd.exe. Crash logs will not be saved.\nSee <http://trac.webkit.org/wiki/BuildingOnWindows#GettingCrashLogs>.\n";
+                return;
+            }
         }
     }
 
diff --git a/Tools/Scripts/prepare-ChangeLog b/Tools/Scripts/prepare-ChangeLog
index a4b3d6b..e6fef40 100755
--- a/Tools/Scripts/prepare-ChangeLog
+++ b/Tools/Scripts/prepare-ChangeLog
@@ -140,6 +140,7 @@ if (!$parseOptionsResult || $showHelp) {
     print STDERR "  -o|--open       Open ChangeLogs in an editor when done\n";
     print STDERR "  --[no-]update   Update ChangeLogs from svn before adding entry (default: update)\n";
     print STDERR "  --[no-]write    Write ChangeLogs to disk (otherwise send new entries to stdout) (default: write)\n";
+    print STDERR "  --email=        Specify the email address to be used in the patch\n";
     exit 1;
 }
 
diff --git a/Tools/Scripts/run-iexploder-tests b/Tools/Scripts/run-iexploder-tests
index 97e3630..cb696a2 100755
--- a/Tools/Scripts/run-iexploder-tests
+++ b/Tools/Scripts/run-iexploder-tests
@@ -114,7 +114,6 @@ sub configureAndOpenHTTPDIfNeeded()
 {
     return if $isHttpdOpen;
     mkdir $iExploderTestDirectory;
-    my $httpdPath = getHTTPDPath();
     my $webkitDirectory = getcwd();
     my $testDirectory = $webkitDirectory . "/LayoutTests";
     my $iExploderDirectory = $webkitDirectory . "/Tools/iExploder/iExploder-1.3.2";
diff --git a/Tools/Scripts/update-webkit b/Tools/Scripts/update-webkit
index 5c132ae..6a7b9f7 100755
--- a/Tools/Scripts/update-webkit
+++ b/Tools/Scripts/update-webkit
@@ -2,6 +2,7 @@
 
 # Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 # Copyright (C) 2009 Google Inc. All rights reserved.
+# Copyright (C) 2011 Brent Fulgham. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -49,6 +50,8 @@ my $useGYP = 0;
 
 determineIsChromium();
 
+determineIsWinCairo();
+
 chdirWebKit();
 
 my $getOptionsResult = GetOptions(
@@ -64,6 +67,7 @@ Usage: @{[ basename($0) ]} [options]
   -h|--help   show the help message
   -q|--quiet  pass -q to svn update for quiet updates
   --gyp       generate project files from gyp after update
+  --wincairo  also update dependencies of the WinCairo port
 __END__
     exit 1;
 }
@@ -96,6 +100,9 @@ if (-d "../Internal") {
     system("perl", "Tools/Scripts/update-webkit-chromium") == 0 or die $!;
 } elsif (isAppleWinWebKit()) {
     system("perl", "Tools/Scripts/update-webkit-auxiliary-libs") == 0 or die;
+    if (isWinCairo()) {
+        system("perl", "Tools/Scripts/update-webkit-wincairo-libs") == 0 or die;
+    }
 }
 
 setupAppleWinEnv() if isAppleWinWebKit();
diff --git a/Tools/Scripts/update-webkit-auxiliary-libs b/Tools/Scripts/update-webkit-auxiliary-libs
index 9a6b20f..d301938 100755
--- a/Tools/Scripts/update-webkit-auxiliary-libs
+++ b/Tools/Scripts/update-webkit-auxiliary-libs
@@ -30,106 +30,11 @@
 
 use strict;
 use warnings;
-
-use File::Find;
-use File::Spec;
-use File::Temp ();
 use FindBin;
-use HTTP::Date qw(str2time);
-use POSIX;
-use lib $FindBin::Bin;
-use webkitdirs;
-
-sub lastModifiedToUnixTime($);
-
-# Time in seconds that the new zip file must be newer than the old for us to
-# consider them to be different. If the difference in modification time is less
-# than this threshold, we assume that the files are the same. We need this
-# because the zip file is served from a set of mirrors with slightly different
-# Last-Modified times.
-my $newnessThreshold = 30;
 
-my $sourceDir = sourceDir();
 my $file = "WebKitAuxiliaryLibrary";
 my $zipFile = "$file.zip"; 
 my $auxiliaryLibsURL = "http://developer.apple.com/opensource/internet/$zipFile";
-my $webkitLibrariesDir = toUnixPath($ENV{'WEBKITLIBRARIESDIR'}) || "$sourceDir/WebKitLibraries/win";
-my $tmpRelativeDir = File::Temp::tempdir("webkitlibsXXXXXXX", TMPDIR => 1, CLEANUP => 1);
-my $tmpAbsDir = File::Spec->rel2abs($tmpRelativeDir);
-
-print "Checking Last-Modified date of $zipFile...\n";
-
-my $result = system "curl -s -I $auxiliaryLibsURL | grep Last-Modified > \"$tmpAbsDir/$file.headers\"";
-
-if (WEXITSTATUS($result)) {
-    print STDERR "Couldn't check Last-Modified date of new $zipFile.\n";
-    print STDERR "Please ensure that $auxiliaryLibsURL is reachable.\n";
-
-    if (! -f "$webkitLibrariesDir/$file.headers") {
-        print STDERR "Unable to check Last-Modified date and no version of $file to fall back to.\n";
-        exit 1;
-    }
-
-    print STDERR "Falling back to existing version of $file.\n";
-    exit 0;
-}
-
-if (open NEW, "$tmpAbsDir/$file.headers") {
-    my $new = lastModifiedToUnixTime(<NEW>);
-    close NEW;
-
-    if (defined $new && open OLD, "$webkitLibrariesDir/$file.headers") {
-        my $old = lastModifiedToUnixTime(<OLD>);
-        close OLD;
-        if (defined $old && abs($new - $old) < $newnessThreshold) {
-            print "Current $file is up to date\n";
-            exit 0;
-        }
-    }
-}
-
-print "Downloading $zipFile...\n\n";
-$result = system "curl -o \"$tmpAbsDir/$zipFile\" $auxiliaryLibsURL";
-die "Couldn't download $zipFile!" if $result;
-
-$result = system "unzip", "-q", "-d", $tmpAbsDir, "$tmpAbsDir/$zipFile";
-die "Couldn't unzip $zipFile." if $result;
-
-print "\nInstalling $file...\n";
-
-sub wanted
-{
-    my $relativeName = File::Spec->abs2rel($File::Find::name, "$tmpAbsDir/$file/win");
-    my $destination = "$webkitLibrariesDir/$relativeName";
-
-    if (-d $_) {
-        mkdir $destination;
-        return;
-    }
-
-    system "cp", $_, $destination;
-}
-
-File::Find::find(\&wanted, "$tmpAbsDir/$file");
-
-$result = system "mv", "$tmpAbsDir/$file.headers", $webkitLibrariesDir;
-print STDERR "Couldn't move $file.headers to $webkitLibrariesDir" . ".\n" if $result;
-
-print "The $file has been sucessfully installed in\n $webkitLibrariesDir\n";
-exit;
-
-sub toUnixPath
-{
-    my $path = shift;
-    return unless $path;
-    chomp($path = `cygpath -u '$path'`);
-    return $path;
-}
-
-sub lastModifiedToUnixTime($)
-{
-    my ($str) = @_;
+my $command = "$FindBin::Bin/update-webkit-dependency";
 
-    $str =~ /^Last-Modified: (.*)$/ or return;
-    return str2time($1);
-}
+system("perl", $command, $auxiliaryLibsURL, "win") == 0 or die;
diff --git a/Tools/Scripts/update-webkit-dependency b/Tools/Scripts/update-webkit-dependency
new file mode 100755
index 0000000..1ad4d6d
--- /dev/null
+++ b/Tools/Scripts/update-webkit-dependency
@@ -0,0 +1,157 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2005, 2006, 2007 Apple Computer, Inc.  All rights reserved.
+# Copyright (C) 2011 Carl Lobo.  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+#     its contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Updates a development environment to the new WebKitAuxiliaryLibrary
+
+use strict;
+use warnings;
+
+use File::Find;
+use File::Spec;
+use File::Temp ();
+use FindBin;
+use HTTP::Date qw(str2time);
+use POSIX;
+use lib $FindBin::Bin;
+use webkitdirs;
+
+if ($#ARGV != 1) {
+    die <<EOF;
+Usage:
+        update-webkit-dependancy <URL with the dependancy zip file> <*prefix dir inside zip without filename>
+
+        * If filename is requirements.zip and the contents of the zipfile are "requirements/x" then prefix = "."
+        * If filename is xyz.zip and the contents of the zipfile are xyz/abc/x" then prefix = "abc"
+        * x is lib or include or bin.
+EOF
+}
+
+sub lastModifiedToUnixTime($);
+sub getLibraryName($);
+
+# Time in seconds that the new zip file must be newer than the old for us to
+# consider them to be different. If the difference in modification time is less
+# than this threshold, we assume that the files are the same. We need this
+# because the zip file is served from a set of mirrors with slightly different
+# Last-Modified times.
+my $newnessThreshold = 30;
+
+my $libsURL = shift;
+my $prefixInZip = shift;
+my $sourceDir = sourceDir();
+my $file = getLibraryName($libsURL);
+my $zipFile = "$file.zip"; 
+my $webkitLibrariesDir = toUnixPath($ENV{'WEBKITLIBRARIESDIR'}) || "$sourceDir/WebKitLibraries/win";
+my $tmpRelativeDir = File::Temp::tempdir("webkitlibsXXXXXXX", TMPDIR => 1, CLEANUP => 1);
+my $tmpAbsDir = File::Spec->rel2abs($tmpRelativeDir);
+
+print "Checking Last-Modified date of $zipFile...\n";
+
+my $result = system "curl -s -I $libsURL | grep Last-Modified > \"$tmpAbsDir/$file.headers\"";
+
+if (WEXITSTATUS($result)) {
+    print STDERR "Couldn't check Last-Modified date of new $zipFile.\n";
+    print STDERR "Please ensure that $libsURL is reachable.\n";
+
+    if (! -f "$webkitLibrariesDir/$file.headers") {
+        print STDERR "Unable to check Last-Modified date and no version of $file to fall back to.\n";
+        exit 1;
+    }
+
+    print STDERR "Falling back to existing version of $file.\n";
+    exit 0;
+}
+
+if (open NEW, "$tmpAbsDir/$file.headers") {
+    my $new = lastModifiedToUnixTime(<NEW>);
+    close NEW;
+
+    if (defined $new && open OLD, "$webkitLibrariesDir/$file.headers") {
+        my $old = lastModifiedToUnixTime(<OLD>);
+        close OLD;
+        if (defined $old && abs($new - $old) < $newnessThreshold) {
+            print "Current $file is up to date\n";
+            exit 0;
+        }
+    }
+}
+
+print "Downloading $zipFile...\n\n";
+$result = system "curl -o \"$tmpAbsDir/$zipFile\" $libsURL";
+die "Couldn't download $zipFile!" if $result;
+
+$result = system "unzip", "-q", "-d", $tmpAbsDir, "$tmpAbsDir/$zipFile";
+die "Couldn't unzip $zipFile." if $result;
+
+print "\nInstalling $file...\n";
+
+sub wanted
+{
+    my $relativeName = File::Spec->abs2rel($File::Find::name, "$tmpAbsDir/$file/$prefixInZip");
+    my $destination = "$webkitLibrariesDir/$relativeName";
+
+    if (-d $_) {
+        mkdir $destination;
+        return;
+    }
+
+    system "cp", $_, $destination;
+}
+
+File::Find::find(\&wanted, "$tmpAbsDir/$file");
+
+$result = system "mv", "$tmpAbsDir/$file.headers", $webkitLibrariesDir;
+print STDERR "Couldn't move $file.headers to $webkitLibrariesDir" . ".\n" if $result;
+
+print "The $file has been sucessfully installed in\n $webkitLibrariesDir\n";
+exit;
+
+sub toUnixPath
+{
+    my $path = shift;
+    return unless $path;
+    chomp($path = `cygpath -u '$path'`);
+    return $path;
+}
+
+sub lastModifiedToUnixTime($)
+{
+    my ($str) = @_;
+
+    $str =~ /^Last-Modified: (.*)$/ or return;
+    return str2time($1);
+}
+
+sub getLibraryName($)
+{
+    my $url = shift;
+    $url =~ m#/([^/]+)\.zip$#;
+    return $1;
+}
+
diff --git a/Tools/Scripts/update-webkit-localizable-strings b/Tools/Scripts/update-webkit-localizable-strings
index 0a0ada9..ceb25a5 100755
--- a/Tools/Scripts/update-webkit-localizable-strings
+++ b/Tools/Scripts/update-webkit-localizable-strings
@@ -35,7 +35,7 @@ use lib $FindBin::Bin;
 use webkitdirs;
 
 # WebKit and WebKit2 strings go into WebCore's Localizable.strings.
-my @directoriesToScan = ("Source/WebCore", "Source/WebKit/mac", "Source/WebKit2", "-Source/WebCore/icu", "-Source/WebKit/mac/icu");
+my @directoriesToScan = ("Source/WebCore", "Source/WebKit/mac", "Source/WebKit/win", "Source/WebKit2", "-Source/WebCore/icu", "-Source/WebKit/mac/icu");
 my $fileToUpdate = "Source/WebCore/English.lproj/Localizable.strings";
 
 @ARGV == 0 or die "Usage: " . basename($0) . "\n";
@@ -43,9 +43,3 @@ my $fileToUpdate = "Source/WebCore/English.lproj/Localizable.strings";
 chdirWebKit();
 
 system "Tools/Scripts/extract-localizable-strings", "-", $fileToUpdate, @directoriesToScan;
-
-# FIXME: the following can be removed and "Source/WebKit/win" added above once Windows uses WebCore's Localizable.strings. <rdar://problem/9119405>
-my @webKitDirectoriesToScan = ("Source/WebKit/win");
-my $webKitFileToUpdate = "Source/WebKit/English.lproj/Localizable.strings";
-
-system "Tools/Scripts/extract-localizable-strings", "-", $webKitFileToUpdate, @webKitDirectoriesToScan;
diff --git a/Tools/Scripts/update-webkit-wincairo-libs b/Tools/Scripts/update-webkit-wincairo-libs
new file mode 100755
index 0000000..15c7182
--- /dev/null
+++ b/Tools/Scripts/update-webkit-wincairo-libs
@@ -0,0 +1,40 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2011 Carl Lobo.  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+#     its contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Updates a development environment to the new WebKitAuxiliaryLibrary
+
+use strict;
+use warnings;
+use FindBin;
+
+my $file = "WinCairoRequirements";
+my $zipFile = "$file.zip"; 
+my $winCairoLibsURL = "http://idisk.mac.com/bfulgham-Public/$zipFile";
+my $command = "$FindBin::Bin/update-webkit-dependency";
+
+system("perl", $command, $winCairoLibsURL, ".") == 0 or die;
diff --git a/Tools/Scripts/webkitdirs.pm b/Tools/Scripts/webkitdirs.pm
index d27caba..e7afbea 100644
--- a/Tools/Scripts/webkitdirs.pm
+++ b/Tools/Scripts/webkitdirs.pm
@@ -67,6 +67,7 @@ my $isSymbian;
 my %qtFeatureDefaults;
 my $isGtk;
 my $isWinCE;
+my $isWinCairo;
 my $isWx;
 my $isEfl;
 my @wxArgs;
@@ -445,26 +446,24 @@ sub determinePassedConfiguration
     return if $searchedForPassedConfiguration;
     $searchedForPassedConfiguration = 1;
 
-    my $isWinCairo = checkForArgumentAndRemoveFromARGV("--wincairo");
-
     for my $i (0 .. $#ARGV) {
         my $opt = $ARGV[$i];
         if ($opt =~ /^--debug$/i || $opt =~ /^--devel/i) {
             splice(@ARGV, $i, 1);
             $passedConfiguration = "Debug";
-            $passedConfiguration .= "_Cairo_CFLite" if ($isWinCairo && isCygwin());
+            $passedConfiguration .= "_Cairo_CFLite" if (isWinCairo() && isCygwin());
             return;
         }
         if ($opt =~ /^--release$/i || $opt =~ /^--deploy/i) {
             splice(@ARGV, $i, 1);
             $passedConfiguration = "Release";
-            $passedConfiguration .= "_Cairo_CFLite" if ($isWinCairo && isCygwin());
+            $passedConfiguration .= "_Cairo_CFLite" if (isWinCairo() && isCygwin());
             return;
         }
         if ($opt =~ /^--profil(e|ing)$/i) {
             splice(@ARGV, $i, 1);
             $passedConfiguration = "Profiling";
-            $passedConfiguration .= "_Cairo_CFLite" if ($isWinCairo && isCygwin());
+            $passedConfiguration .= "_Cairo_CFLite" if (isWinCairo() && isCygwin());
             return;
         }
     }
@@ -872,6 +871,18 @@ sub determineIsChromium()
     $isChromium = checkForArgumentAndRemoveFromARGV("--chromium");
 }
 
+sub isWinCairo()
+{
+    determineIsWinCairo();
+    return $isWinCairo;
+}
+
+sub determineIsWinCairo()
+{
+    return if defined($isWinCairo);
+    $isWinCairo = checkForArgumentAndRemoveFromARGV("--wincairo");
+}
+
 sub isCygwin()
 {
     return ($^O eq "cygwin") || 0;
@@ -1332,7 +1343,7 @@ sub buildWafProject
         chomp($wafCommand);
     }
     if ($shouldClean) {
-        return system $wafCommand, "clean", "distclean";
+        return system $wafCommand, "uninstall", "clean", "distclean";
     }
     
     return system $wafCommand, 'configure', 'build', 'install', @options;
@@ -1645,7 +1656,6 @@ sub buildQMakeProject($@)
                 if ($result ne 0) {
                     die "Failed while running $qmakebin to generate derived sources for Tools!\n";
                 }
-                push @subdirs, "MiniBrowser";
                 push @subdirs, "WebKitTestRunner";
             }
         }
diff --git a/Tools/Scripts/webkitperl/VCSUtils_unittest/parseDiff.pl b/Tools/Scripts/webkitperl/VCSUtils_unittest/parseDiff.pl
index 9fe077f..e195023 100644
--- a/Tools/Scripts/webkitperl/VCSUtils_unittest/parseDiff.pl
+++ b/Tools/Scripts/webkitperl/VCSUtils_unittest/parseDiff.pl
@@ -1198,7 +1198,7 @@ foreach my $testCase (@testCaseHashRefs) {
     open($fileHandle, "<", \$testCase->{inputText});
     my $line = <$fileHandle>;
 
-    my @got = VCSUtils::parseDiff($fileHandle, $line);
+    my @got = VCSUtils::parseDiff($fileHandle, $line, {"shouldNotUseIndexPathEOL" => 1});
     my $expectedReturn = $testCase->{expectedReturn};
 
     is_deeply(\@got, $expectedReturn, "$testNameStart return value.");
diff --git a/Tools/Scripts/webkitperl/VCSUtils_unittest/parseDiffWithMockFiles.pl b/Tools/Scripts/webkitperl/VCSUtils_unittest/parseDiffWithMockFiles.pl
new file mode 100644
index 0000000..307f3a7
--- /dev/null
+++ b/Tools/Scripts/webkitperl/VCSUtils_unittest/parseDiffWithMockFiles.pl
@@ -0,0 +1,305 @@
+#!/usr/bin/perl -w
+#
+# Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+# 
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+# 
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+# Unit tests of parseDiff() with mock files; test override of patch EOL with EOL of target file.
+
+use strict;
+use warnings;
+
+use File::Temp;
+use POSIX qw/getcwd/;
+use Test::More;
+use VCSUtils;
+
+my $gitDiffHeaderForNewFile = <<EOF;
+diff --git a/Makefile b/Makefile
+new file mode 100644
+index 0000000..756e864
+--- /dev/null
++++ b/Makefile
+@@ -0,0 +1,17 @@
+EOF
+
+my $gitDiffHeader = <<EOF;
+diff --git a/Makefile b/Makefile
+index 756e864..04d2ae1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,3 +1,4 @@
+EOF
+
+my $svnConvertedGitDiffHeader = <<EOF;
+Index: Makefile
+index 756e864..04d2ae1 100644
+--- Makefile
++++ Makefile
+@@ -1,3 +1,4 @@
+EOF
+
+my $svnConvertedGitDiffHeaderForNewFile = <<EOF;
+Index: Makefile
+new file mode 100644
+index 0000000..756e864
+--- Makefile
++++ Makefile
+@@ -0,0 +1,17 @@
+EOF
+
+my $svnDiffHeaderForNewFile = <<EOF;
+Index: Makefile
+===================================================================
+--- Makefile	(revision 0)
++++ Makefile	(revision 0)
+@@ -0,0 +1,17 @@
+EOF
+
+my $svnDiffHeader = <<EOF;
+Index: Makefile
+===================================================================
+--- Makefile	(revision 53052)
++++ Makefile	(working copy)
+@@ -1,3 +1,4 @@
+EOF
+
+my $diffBody = <<EOF;
++
+ MODULES = JavaScriptCore JavaScriptGlue WebCore WebKit WebKitTools
+ 
+ all:
+EOF
+
+my $MakefileContents = <<EOF;
+MODULES = JavaScriptCore JavaScriptGlue WebCore WebKit WebKitTools 
+
+all:
+EOF
+
+my $mockDir = File::Temp->tempdir("parseDiffXXXX", CLEANUP => 1);
+writeToFile(File::Spec->catfile($mockDir, "MakefileWithUnixEOL"), $MakefileContents);
+writeToFile(File::Spec->catfile($mockDir, "MakefileWithWindowsEOL"), toWindowsLineEndings($MakefileContents));
+
+# The array of test cases.
+my @testCaseHashRefs = (
+###
+# SVN test cases
+##
+{
+    # New test
+    diffName => "SVN: Patch with Unix line endings and IndexPath has Unix line endings",
+    inputText => substituteString($svnDiffHeader, "Makefile", "MakefileWithUnixEOL") . $diffBody,
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnDiffHeader, "Makefile", "MakefileWithUnixEOL") . $diffBody, # Same as input text
+    indexPath => "MakefileWithUnixEOL",
+    isSvn => 1,
+    sourceRevision => "53052",
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "SVN: Patch with Windows line endings and IndexPath has Unix line endings",
+    inputText => substituteString($svnDiffHeader, "Makefile", "MakefileWithUnixEOL") . toWindowsLineEndings($diffBody),
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnDiffHeader, "Makefile", "MakefileWithUnixEOL") . $diffBody,
+    indexPath => "MakefileWithUnixEOL",
+    isSvn => 1,
+    sourceRevision => "53052",
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "SVN: Patch with Windows line endings and IndexPath has Windows line endings",
+    inputText => substituteString($svnDiffHeader, "Makefile", "MakefileWithWindowsEOL") . toWindowsLineEndings($diffBody),
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnDiffHeader, "Makefile", "MakefileWithWindowsEOL") . toWindowsLineEndings($diffBody), # Same as input text
+    indexPath => "MakefileWithWindowsEOL",
+    isSvn => 1,
+    sourceRevision => "53052",
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "SVN: Patch with Unix line endings and IndexPath has Windows line endings",
+    inputText => substituteString($svnDiffHeader, "Makefile", "MakefileWithWindowsEOL") . $diffBody,
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnDiffHeader, "Makefile", "MakefileWithWindowsEOL") . toWindowsLineEndings($diffBody),
+    indexPath => "MakefileWithWindowsEOL",
+    isSvn => 1,
+    sourceRevision => "53052",
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "SVN: Patch with Unix line endings and nonexistent IndexPath",
+    inputText => substituteString($svnDiffHeaderForNewFile, "Makefile", "NonexistentFile") . $diffBody,
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnDiffHeaderForNewFile, "Makefile", "NonexistentFile") . $diffBody, # Same as input text
+    indexPath => "NonexistentFile",
+    isSvn => 1,
+    isNew => 1,
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "SVN: Patch with Windows line endings and nonexistent IndexPath",
+    inputText => substituteString($svnDiffHeaderForNewFile, "Makefile", "NonexistentFile") . toWindowsLineEndings($diffBody),
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnDiffHeaderForNewFile, "Makefile", "NonexistentFile") . toWindowsLineEndings($diffBody), # Same as input text
+    indexPath => "NonexistentFile",
+    isSvn => 1,
+    isNew => 1,
+}],
+undef],
+    expectedNextLine => undef,
+},
+###
+# Git test cases
+##
+{
+    # New test
+    diffName => "Git: Patch with Unix line endings and IndexPath has Unix line endings",
+    inputText => substituteString($gitDiffHeader, "Makefile", "MakefileWithUnixEOL") . $diffBody,
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnConvertedGitDiffHeader, "Makefile", "MakefileWithUnixEOL") . $diffBody, # Same as input text
+    indexPath => "MakefileWithUnixEOL",
+    isGit => 1,
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "Git: Patch with Windows line endings and IndexPath has Unix line endings",
+    inputText => substituteString($gitDiffHeader, "Makefile", "MakefileWithUnixEOL") . toWindowsLineEndings($diffBody),
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnConvertedGitDiffHeader, "Makefile", "MakefileWithUnixEOL") . $diffBody,
+    indexPath => "MakefileWithUnixEOL",
+    isGit => 1,
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "Git: Patch with Windows line endings and IndexPath has Windows line endings",
+    inputText => substituteString($gitDiffHeader, "Makefile", "MakefileWithWindowsEOL") . toWindowsLineEndings($diffBody),
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnConvertedGitDiffHeader, "Makefile", "MakefileWithWindowsEOL") . toWindowsLineEndings($diffBody), # Same as input text
+    indexPath => "MakefileWithWindowsEOL",
+    isGit => 1,
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "Git: Patch with Unix line endings and IndexPath has Windows line endings",
+    inputText => substituteString($gitDiffHeader, "Makefile", "MakefileWithWindowsEOL") . $diffBody,
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnConvertedGitDiffHeader, "Makefile", "MakefileWithWindowsEOL") . toWindowsLineEndings($diffBody),
+    indexPath => "MakefileWithWindowsEOL",
+    isGit => 1,
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "Git: Patch with Unix line endings and nonexistent IndexPath",
+    inputText => substituteString($gitDiffHeaderForNewFile, "Makefile", "NonexistentFile") . $diffBody,
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnConvertedGitDiffHeaderForNewFile, "Makefile", "NonexistentFile") . $diffBody, # Same as input text
+    indexPath => "NonexistentFile",
+    isGit => 1,
+    isNew => 1,
+}],
+undef],
+    expectedNextLine => undef,
+},
+{
+    # New test
+    diffName => "Git: Patch with Windows line endings and nonexistent IndexPath",
+    inputText => substituteString($gitDiffHeaderForNewFile, "Makefile", "NonexistentFile") . toWindowsLineEndings($diffBody),
+    expectedReturn => [
+[{
+    svnConvertedText => substituteString($svnConvertedGitDiffHeaderForNewFile, "Makefile", "NonexistentFile") . toWindowsLineEndings($diffBody), # Same as input text
+    indexPath => "NonexistentFile",
+    isGit => 1,
+    isNew => 1,
+}],
+undef],
+    expectedNextLine => undef,
+},
+);
+
+my $testCasesCount = @testCaseHashRefs;
+plan(tests => 2 * $testCasesCount); # Total number of assertions.
+
+my $savedCWD = getcwd();
+chdir($mockDir) or die;
+foreach my $testCase (@testCaseHashRefs) {
+    my $testNameStart = "parseDiff(): $testCase->{diffName}: comparing";
+
+    my $fileHandle;
+    open($fileHandle, "<", \$testCase->{inputText});
+    my $line = <$fileHandle>;
+
+    my @got = VCSUtils::parseDiff($fileHandle, $line);
+    my $expectedReturn = $testCase->{expectedReturn};
+
+    is_deeply(\@got, $expectedReturn, "$testNameStart return value.");
+
+    my $gotNextLine = <$fileHandle>;
+    is($gotNextLine, $testCase->{expectedNextLine},  "$testNameStart next read line.");
+}
+chdir($savedCWD);
+
+sub substituteString
+{
+    my ($string, $searchString, $replacementString) = @_;
+    $string =~ s/$searchString/$replacementString/g;
+    return $string;
+}
+
+sub writeToFile
+{
+    my ($file, $text) = @_;
+    open(FILE, ">$file") or die;
+    print FILE $text;
+    close(FILE);
+}
diff --git a/Tools/Scripts/webkitperl/VCSUtils_unittest/parseFirstEOL.pl b/Tools/Scripts/webkitperl/VCSUtils_unittest/parseFirstEOL.pl
new file mode 100644
index 0000000..367ad1d
--- /dev/null
+++ b/Tools/Scripts/webkitperl/VCSUtils_unittest/parseFirstEOL.pl
@@ -0,0 +1,63 @@
+#!/usr/bin/perl -w
+#
+# Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+# 
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+# 
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+# Unit tests of VCSUtils::parseFirstEOL().
+
+use strict;
+use warnings;
+
+use Test::Simple tests => 7;
+use VCSUtils;
+
+my $title;
+
+# New test
+$title = "parseFirstEOL: Empty string.";
+ok(!defined(firstEOLInString("")), $title);
+
+# New test
+$title = "parseFirstEOL: Line without a line ending character";
+ok(!defined(firstEOLInString("This line doesn't have a line ending character.")), $title);
+
+# New test
+$title = "parseFirstEOL: Line with Windows line ending.";
+ok(firstEOLInString("This line ends with a Windows line ending.\r\n") eq "\r\n", $title);
+
+# New test
+$title = "parseFirstEOL: Line with Unix line ending.";
+ok(firstEOLInString("This line ends with a Unix line ending.\n") eq "\n", $title);
+
+# New test
+$title = "parseFirstEOL: Line with Mac line ending.";
+ok(firstEOLInString("This line ends with a Mac line ending.\r") eq "\r", $title);
+
+# New test
+$title = "parseFirstEOL: Line with Mac line ending followed by line without a line ending.";
+ok(firstEOLInString("This line ends with a Mac line ending.\rThis line doesn't have a line ending.") eq "\r", $title);
+
+# New test
+$title = "parseFirstEOL: Line with a mix of line endings.";
+ok(firstEOLInString("This line contains a mix of line endings.\r\n\r\n\r\r\n\n\n\n") eq "\r\n", $title);
+
+sub firstEOLInString
+{
+    my ($string) = @_;
+    my $fileHandle;
+    open($fileHandle, "<", \$string);
+    return parseFirstEOL($fileHandle);
+}
diff --git a/Tools/Scripts/webkitperl/VCSUtils_unittest/removeEOL.pl b/Tools/Scripts/webkitperl/VCSUtils_unittest/removeEOL.pl
index 8bd8e90..6880214 100644
--- a/Tools/Scripts/webkitperl/VCSUtils_unittest/removeEOL.pl
+++ b/Tools/Scripts/webkitperl/VCSUtils_unittest/removeEOL.pl
@@ -37,20 +37,20 @@ my $title;
 
 # New test
 $title = "removeEOL: Undefined argument.";
-ok(removeEOL(undef) eq "");
+ok(removeEOL(undef) eq "", $title);
 
 # New test
 $title = "removeEOL: Line with Windows line ending.";
-ok(removeEOL("This line ends with a Windows line ending.\r\n") eq "This line ends with a Windows line ending.");
+ok(removeEOL("This line ends with a Windows line ending.\r\n") eq "This line ends with a Windows line ending.", $title);
 
 # New test
 $title = "removeEOL: Line with Unix line ending.";
-ok(removeEOL("This line ends with a Unix line ending.\n") eq "This line ends with a Unix line ending.");
+ok(removeEOL("This line ends with a Unix line ending.\n") eq "This line ends with a Unix line ending.", $title);
 
 # New test
 $title = "removeEOL: Line with Mac line ending.";
-ok(removeEOL("This line ends with a Mac line ending.\r") eq "This line ends with a Mac line ending.");
+ok(removeEOL("This line ends with a Mac line ending.\r") eq "This line ends with a Mac line ending.", $title);
 
 # New test
 $title = "removeEOL: Line with a mix of line endings.";
-ok(removeEOL("This line contains a mix of line endings.\r\n\r\n\r\r\n\n\n\n") eq "This line contains a mix of line endings.");
+ok(removeEOL("This line contains a mix of line endings.\r\n\r\n\r\r\n\n\n\n") eq "This line contains a mix of line endings.", $title);
diff --git a/Tools/Scripts/webkitperl/httpd.pm b/Tools/Scripts/webkitperl/httpd.pm
index 5795340..3a40b4e 100644
--- a/Tools/Scripts/webkitperl/httpd.pm
+++ b/Tools/Scripts/webkitperl/httpd.pm
@@ -63,7 +63,6 @@ $tmpDir = convertMsysPath($tmpDir) if isMsys();
 my $httpdLockPrefix = "WebKitHttpd.lock.";
 my $myLockFile;
 my $exclusiveLockFile = File::Spec->catfile($tmpDir, "WebKit.lock");
-my $httpdPath;
 my $httpdPidDir = File::Spec->catfile($tmpDir, "WebKit");
 my $httpdPidFile = File::Spec->catfile($httpdPidDir, "httpd.pid");
 my $httpdPid;
@@ -76,6 +75,7 @@ $SIG{'TERM'} = 'handleInterrupt';
 
 sub getHTTPDPath
 {
+    my $httpdPath;
     if (isDebianBased()) {
         $httpdPath = "/usr/sbin/apache2";
     } elsif (isMsys()) {
@@ -130,7 +130,7 @@ sub getHTTPDConfigPathForTestDirectory
     my ($testDirectory) = @_;
     die "No test directory has been specified." unless ($testDirectory);
     my $httpdConfig;
-    getHTTPDPath();
+    my $httpdPath = getHTTPDPath();
     if (isCygwin()) {
         my $windowsConfDirectory = "$testDirectory/http/conf/";
         unless (-x "/usr/lib/apache/libphp4.dll") {
@@ -173,7 +173,7 @@ sub openHTTPD(@)
         unlink $httpdPidFile;
     }
 
-    $httpdPath = "/usr/sbin/httpd" unless ($httpdPath);
+    my $httpdPath = getHTTPDPath();
 
     open2(">&1", \*HTTPDIN, $httpdPath, @args);
 
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm.py b/Tools/Scripts/webkitpy/common/checkout/scm.py
index e436402..3e8d5e5 100644
--- a/Tools/Scripts/webkitpy/common/checkout/scm.py
+++ b/Tools/Scripts/webkitpy/common/checkout/scm.py
@@ -134,8 +134,9 @@ def commit_error_handler(error):
 
 
 class AuthenticationError(Exception):
-    def __init__(self, server_host):
+    def __init__(self, server_host, prompt_for_password=False):
         self.server_host = server_host
+        self.prompt_for_password = prompt_for_password
 
 
 class AmbiguousCommitError(Exception):
@@ -291,7 +292,7 @@ class SCM:
     def revert_files(self, file_paths):
         self._subclass_must_implement()
 
-    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False, changed_files=None):
+    def commit_with_message(self, message, username=None, password=None, git_commit=None, force_squash=False, changed_files=None):
         self._subclass_must_implement()
 
     def svn_commit_log(self, svn_revision):
@@ -319,8 +320,19 @@ class SCM:
         return []
 
 
-class SVN(SCM):
-    # FIXME: We should move these values to a WebKit-specific config file.
+# A mixin class that represents common functionality for SVN and Git-SVN.
+class SVNRepository:
+    def has_authorization_for_realm(self, realm, home_directory=os.getenv("HOME")):
+        # Assumes find and grep are installed.
+        if not os.path.isdir(os.path.join(home_directory, ".subversion")):
+            return False
+        find_args = ["find", ".subversion", "-type", "f", "-exec", "grep", "-q", realm, "{}", ";", "-print"]
+        find_output = self.run(find_args, cwd=home_directory, error_handler=Executive.ignore_error).rstrip()
+        return find_output and os.path.isfile(os.path.join(home_directory, find_output))
+
+
+class SVN(SCM, SVNRepository):
+    # FIXME: These belong in common.config.urls
     svn_server_host = "svn.webkit.org"
     svn_server_realm = "<http://svn.webkit.org:80> Mac OS Forge"
 
@@ -374,14 +386,6 @@ class SVN(SCM):
     def commit_success_regexp():
         return "^Committed revision (?P<svn_revision>\d+)\.$"
 
-    def has_authorization_for_realm(self, realm=svn_server_realm, home_directory=os.getenv("HOME")):
-        # Assumes find and grep are installed.
-        if not os.path.isdir(os.path.join(home_directory, ".subversion")):
-            return False
-        find_args = ["find", ".subversion", "-type", "f", "-exec", "grep", "-q", realm, "{}", ";", "-print"];
-        find_output = self.run(find_args, cwd=home_directory, error_handler=Executive.ignore_error).rstrip()
-        return find_output and os.path.isfile(os.path.join(home_directory, find_output))
-
     @memoized
     def svn_version(self):
         return self.run(['svn', '--version', '--quiet'])
@@ -556,11 +560,11 @@ class SVN(SCM):
         # FIXME: This should probably use cwd=self.checkout_root.
         self.run(['svn', 'revert'] + file_paths)
 
-    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False, changed_files=None):
+    def commit_with_message(self, message, username=None, password=None, git_commit=None, force_squash=False, changed_files=None):
         # git-commit and force are not used by SVN.
         svn_commit_args = ["svn", "commit"]
 
-        if not username and not self.has_authorization_for_realm():
+        if not username and not self.has_authorization_for_realm(self.svn_server_realm):
             raise AuthenticationError(self.svn_server_host)
         if username:
             svn_commit_args.extend(["--username", username])
@@ -577,8 +581,7 @@ class SVN(SCM):
             # Return a string which looks like a commit so that things which parse this output will succeed.
             return "Dry run, no commit.\nCommitted revision 0."
 
-        # FIXME: Should this use cwd=self.checkout_root?
-        return self.run(svn_commit_args, error_handler=commit_error_handler)
+        return self.run(svn_commit_args, cwd=self.checkout_root, error_handler=commit_error_handler)
 
     def svn_commit_log(self, svn_revision):
         svn_revision = self.strip_r_from_svn_revision(svn_revision)
@@ -599,7 +602,7 @@ class SVN(SCM):
 
 
 # All git-specific logic should go here.
-class Git(SCM):
+class Git(SCM, SVNRepository):
     def __init__(self, cwd, executive=None):
         SCM.__init__(self, cwd, executive)
         self._check_git_architecture()
@@ -834,7 +837,7 @@ class Git(SCM):
             if num_local_commits > 1 or (num_local_commits > 0 and not working_directory_is_clean):
                 raise AmbiguousCommitError(num_local_commits, working_directory_is_clean)
 
-    def commit_with_message(self, message, username=None, git_commit=None, force_squash=False, changed_files=None):
+    def commit_with_message(self, message, username=None, password=None, git_commit=None, force_squash=False, changed_files=None):
         # Username is ignored during Git commits.
         working_directory_is_clean = self.working_directory_is_clean()
 
@@ -844,7 +847,7 @@ class Git(SCM):
                 if working_directory_is_clean:
                     raise ScriptError(message="The working copy is not modified. --git-commit=HEAD.. only commits working copy changes.")
                 self.commit_locally_with_message(message)
-                return self._commit_on_branch(message, 'HEAD')
+                return self._commit_on_branch(message, 'HEAD', username=username, password=password)
 
             # Need working directory changes to be committed so we can checkout the merge branch.
             if not working_directory_is_clean:
@@ -852,15 +855,15 @@ class Git(SCM):
                 # That will modify the working-copy and cause us to hit this error.
                 # The ChangeLog modification could be made to modify the existing local commit.
                 raise ScriptError(message="Working copy is modified. Cannot commit individual git_commits.")
-            return self._commit_on_branch(message, git_commit)
+            return self._commit_on_branch(message, git_commit, username=username, password=password)
 
         if not force_squash:
             self._assert_can_squash(working_directory_is_clean)
         self.run(['git', 'reset', '--soft', self.remote_merge_base()])
         self.commit_locally_with_message(message)
-        return self.push_local_commits_to_server()
+        return self.push_local_commits_to_server(username=username, password=password)
 
-    def _commit_on_branch(self, message, git_commit):
+    def _commit_on_branch(self, message, git_commit, username=None, password=None):
         branch_ref = self.run(['git', 'symbolic-ref', 'HEAD']).strip()
         branch_name = branch_ref.replace('refs/heads/', '')
         commit_ids = self.commit_ids_from_commitish_arguments([git_commit])
@@ -889,7 +892,7 @@ class Git(SCM):
                 self.run(['git', 'cherry-pick', '--no-commit', commit])
 
             self.run(['git', 'commit', '-m', message])
-            output = self.push_local_commits_to_server()
+            output = self.push_local_commits_to_server(username=username, password=password)
         except Exception, e:
             log("COMMIT FAILED: " + str(e))
             output = "Commit failed."
@@ -937,11 +940,15 @@ class Git(SCM):
     def commit_locally_with_message(self, message):
         self.run(['git', 'commit', '--all', '-F', '-'], input=message)
 
-    def push_local_commits_to_server(self):
+    def push_local_commits_to_server(self, username=None, password=None):
         dcommit_command = ['git', 'svn', 'dcommit']
         if self.dryrun:
             dcommit_command.append('--dry-run')
-        output = self.run(dcommit_command, error_handler=commit_error_handler)
+        if not self.has_authorization_for_realm(SVN.svn_server_realm):
+            raise AuthenticationError(SVN.svn_server_host, prompt_for_password=True)
+        if username:
+            dcommit_command.extend(["--username", username])
+        output = self.run(dcommit_command, error_handler=commit_error_handler, input=password)
         # Return a string which looks like a commit so that things which parse this output will succeed.
         if self.dryrun:
             output += "\nCommitted r0"
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm_unittest.py b/Tools/Scripts/webkitpy/common/checkout/scm_unittest.py
index 79b354d..ab3f45a 100644
--- a/Tools/Scripts/webkitpy/common/checkout/scm_unittest.py
+++ b/Tools/Scripts/webkitpy/common/checkout/scm_unittest.py
@@ -650,6 +650,13 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
         commit_text = self.scm.commit_with_message("yet another test commit", username)
         self.assertEqual(self.scm.svn_revision_from_commit_text(commit_text), '0')
 
+    def test_commit_in_subdir(self, username=None):
+        write_into_file_at_path('test_dir/test_file3', 'more test content')
+        os.chdir("test_dir")
+        commit_text = self.scm.commit_with_message("another test commit", username)
+        os.chdir("..")
+        self.assertEqual(self.scm.svn_revision_from_commit_text(commit_text), '6')
+
     def test_commit_text_parsing(self):
         self._shared_test_commit_with_message()
 
@@ -657,7 +664,7 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
         self._shared_test_commit_with_message("dbates@webkit.org")
 
     def test_commit_without_authorization(self):
-        self.scm.has_authorization_for_realm = lambda: False
+        self.scm.has_authorization_for_realm = lambda realm: False
         self.assertRaises(AuthenticationError, self._shared_test_commit_with_message)
 
     def test_has_authorization_for_realm(self):
@@ -667,7 +674,7 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
         os.mkdir(svn_config_dir_path)
         fake_webkit_auth_file = os.path.join(svn_config_dir_path, "fake_webkit_auth_file")
         write_into_file_at_path(fake_webkit_auth_file, SVN.svn_server_realm)
-        self.assertTrue(scm.has_authorization_for_realm(home_directory=fake_home_dir))
+        self.assertTrue(scm.has_authorization_for_realm(SVN.svn_server_realm, home_directory=fake_home_dir))
         os.remove(fake_webkit_auth_file)
         os.rmdir(svn_config_dir_path)
         os.rmdir(fake_home_dir)
@@ -677,7 +684,7 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
         fake_home_dir = tempfile.mkdtemp(suffix="fake_home_dir")
         svn_config_dir_path = os.path.join(fake_home_dir, ".subversion")
         os.mkdir(svn_config_dir_path)
-        self.assertFalse(scm.has_authorization_for_realm(home_directory=fake_home_dir))
+        self.assertFalse(scm.has_authorization_for_realm(SVN.svn_server_realm, home_directory=fake_home_dir))
         os.rmdir(svn_config_dir_path)
         os.rmdir(fake_home_dir)
 
diff --git a/Tools/Scripts/webkitpy/common/config/build.py b/Tools/Scripts/webkitpy/common/config/build.py
index 42d0721..d25d606 100644
--- a/Tools/Scripts/webkitpy/common/config/build.py
+++ b/Tools/Scripts/webkitpy/common/config/build.py
@@ -97,10 +97,12 @@ def _should_file_trigger_build(target_platform, file):
         (r"(?:^|/)GNUmakefile\.am$", ["gtk"]),
         (r"/\w+Chromium\w*\.(?:cpp|h|mm)$", ["chromium"]),
         (r"Mac\.(?:cpp|h|mm)$", ["mac"]),
+        (r"\.(?:vcproj|vsprops|sln)$", ["win"]),
         (r"\.exp(?:\.in)?$", ["mac"]),
         (r"\.gypi?", ["chromium"]),
         (r"\.order$", ["mac"]),
         (r"\.pr[io]$", ["qt"]),
+        (r"\.vcproj/", ["win"]),
         (r"\.xcconfig$", ["mac"]),
         (r"\.xcodeproj/", ["mac"]),
     ]
diff --git a/Tools/Scripts/webkitpy/common/config/build_unittest.py b/Tools/Scripts/webkitpy/common/config/build_unittest.py
index 9144874..6bd71e8 100644
--- a/Tools/Scripts/webkitpy/common/config/build_unittest.py
+++ b/Tools/Scripts/webkitpy/common/config/build_unittest.py
@@ -32,6 +32,7 @@ class ShouldBuildTest(unittest.TestCase):
         (["Websites/bugs.webkit.org/foo", "Source/WebCore/bar"], ["*"]),
         (["Websites/bugs.webkit.org/foo"], []),
         (["Source/JavaScriptCore/JavaScriptCore.xcodeproj/foo"], ["mac-leopard", "mac-snowleopard"]),
+        (["Source/JavaScriptCore/JavaScriptCore.vcproj/foo", "Source/WebKit2/win/WebKit2.vcproj", "Source/WebKit/win/WebKit.sln", "Tools/WebKitTestRunner/Configurations/WebKitTestRunnerCommon.vsprops"], ["win"]),
         (["Source/JavaScriptGlue/foo", "Source/WebCore/bar"], ["*"]),
         (["Source/JavaScriptGlue/foo"], ["mac-leopard", "mac-snowleopard"]),
         (["LayoutTests/foo"], ["*"]),
diff --git a/Tools/Scripts/webkitpy/common/config/committers.py b/Tools/Scripts/webkitpy/common/config/committers.py
index fd9bdbb..50506c8 100644
--- a/Tools/Scripts/webkitpy/common/config/committers.py
+++ b/Tools/Scripts/webkitpy/common/config/committers.py
@@ -90,7 +90,7 @@ committers_unable_to_review = [
     Committer("Brett Wilson", "brettw@chromium.org", "brettx"),
     Committer("Cameron McCormack", "cam@webkit.org", "heycam"),
     Committer("Carlos Garcia Campos", ["cgarcia@igalia.com", "carlosgc@gnome.org", "carlosgc@webkit.org"], "KaL"),
-    Committer("Carol Szabo", "carol.szabo@nokia.com"),
+    Committer("Carol Szabo", "carol@webkit.org", "cszabo1"),
     Committer("Chang Shu", ["cshu@webkit.org", "Chang.Shu@nokia.com"], "cshu"),
     Committer("Chris Evans", "cevans@google.com"),
     Committer("Chris Petersen", "cpetersen@apple.com", "cpetersen"),
@@ -129,6 +129,7 @@ committers_unable_to_review = [
     Committer("Jakob Petsovits", ["jpetsovits@rim.com", "jpetso@gmx.at"], "jpetso"),
     Committer("Jakub Wieczorek", "jwieczorek@webkit.org", "fawek"),
     Committer("James Hawkins", ["jhawkins@chromium.org", "jhawkins@google.com"], "jhawkins"),
+    Committer("James Kozianski", ["koz@chromium.org", "koz@google.com"], "koz"),
     Committer("James Simonsen", "simonjam@chromium.org", "simonjam"),
     Committer("Jay Civelli", "jcivelli@chromium.org", "jcivelli"),
     Committer("Jeff Miller", "jeffm@apple.com", "jeffm"),
@@ -204,8 +205,9 @@ committers_unable_to_review = [
     Committer("Victor Wang", "victorw@chromium.org", "victorw"),
     Committer("Vitaly Repeshko", "vitalyr@chromium.org"),
     Committer("William Siegrist", "wsiegrist@apple.com", "wms"),
+    Committer("W. James MacLean", "wjmaclean@chromium.org", "wjmaclean"),
     Committer("Xiaomei Ji", "xji@chromium.org", "xji"),
-    Committer("Yael Aharon", "yael.aharon@nokia.com"),
+    Committer("Yael Aharon", "yael.aharon@nokia.com", "yael"),
     Committer("Yaar Schnitman", ["yaar@chromium.org", "yaar@google.com"]),
     Committer("Yong Li", ["yong.li.webkit@gmail.com", "yong.li@torchmobile.com"], "yong"),
     Committer("Yongjun Zhang", "yongjun.zhang@nokia.com"),
diff --git a/Tools/Scripts/webkitpy/common/config/ports.py b/Tools/Scripts/webkitpy/common/config/ports.py
index 9a5a269..444a4ac 100644
--- a/Tools/Scripts/webkitpy/common/config/ports.py
+++ b/Tools/Scripts/webkitpy/common/config/ports.py
@@ -30,6 +30,7 @@
 
 import os
 import platform
+import sys
 
 from webkitpy.common.system.executive import Executive
 
@@ -43,7 +44,13 @@ class WebKitPort(object):
 
     @classmethod
     def script_shell_command(cls, script_name):
-        return [cls.script_path(script_name)]
+        script_path = cls.script_path(script_name)
+        # Win32 does not support shebang. We need to detect the interpreter ourself.
+        if sys.platform == 'win32':
+            interpreter = Executive.interpreter_for_script(script_path)
+            if interpreter:
+                return [interpreter, script_path]
+        return [script_path]
 
     @staticmethod
     def port(port_name):
@@ -83,6 +90,14 @@ class WebKitPort(object):
         return cls.script_shell_command("update-webkit")
 
     @classmethod
+    def check_webkit_style_command(cls):
+        return cls.script_shell_command("check-webkit-style")
+
+    @classmethod
+    def prepare_changelog_command(cls):
+        return cls.script_shell_command("prepare-ChangeLog")
+
+    @classmethod
     def build_webkit_command(cls, build_style=None):
         command = cls.script_shell_command("build-webkit")
         if build_style == "debug":
diff --git a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
index 8daf92e..c781dfb 100644
--- a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
+++ b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
@@ -46,7 +46,7 @@ from webkitpy.common.config import committers
 from webkitpy.common.net.credentials import Credentials
 from webkitpy.common.system.user import User
 from webkitpy.thirdparty.autoinstalled.mechanize import Browser
-from webkitpy.thirdparty.BeautifulSoup import BeautifulSoup, SoupStrainer
+from webkitpy.thirdparty.BeautifulSoup import BeautifulSoup, BeautifulStoneSoup, SoupStrainer
 
 
 # FIXME: parse_bug_id should not be a free function.
@@ -74,7 +74,9 @@ def parse_bug_id_from_changelog(message):
     match = re.search("^\s*" + Bugzilla.bug_url_long + "$", message, re.MULTILINE)
     if match:
         return int(match.group('bug_id'))
-    return None
+    # We weren't able to find a bug URL in the format used by prepare-ChangeLog. Fall back to the
+    # first bug URL found anywhere in the message.
+    return parse_bug_id(message)
 
 def timestamp():
     return datetime.now().strftime("%Y%m%d%H%M%S")
@@ -218,7 +220,8 @@ class Bugzilla(object):
         # script.
         self.browser.set_handle_robots(False)
 
-    # FIXME: Much of this should go into some sort of config module:
+    # FIXME: Much of this should go into some sort of config module,
+    # such as common.config.urls.
     bug_server_host = "bugs.webkit.org"
     bug_server_regex = "https?://%s/" % re.sub('\.', '\\.', bug_server_host)
     bug_server_url = "https://%s/" % bug_server_host
@@ -270,7 +273,7 @@ class Bugzilla(object):
 
     def _string_contents(self, soup):
         # WebKit's bugzilla instance uses UTF-8.
-        # BeautifulSoup always returns Unicode strings, however
+        # BeautifulStoneSoup always returns Unicode strings, however
         # the .string method returns a (unicode) NavigableString.
         # NavigableString can confuse other parts of the code, so we
         # convert from NavigableString to a real unicode() object using unicode().
@@ -317,7 +320,7 @@ class Bugzilla(object):
         return [Bug(self._parse_bug_dictionary_from_xml(unicode(bug_xml)), self) for bug_xml in soup('bug')]
 
     def _parse_bug_dictionary_from_xml(self, page):
-        soup = BeautifulSoup(page)
+        soup = BeautifulStoneSoup(page, convertEntities=BeautifulStoneSoup.XML_ENTITIES)
         bug = {}
         bug["id"] = int(soup.find("bug_id").string)
         bug["title"] = self._string_contents(soup.find("short_desc"))
diff --git a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py
index 2e75ca9..b996b7c 100644
--- a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py
+++ b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla_unittest.py
@@ -104,7 +104,7 @@ class BugzillaTest(unittest.TestCase):
     <bug>
           <bug_id>32585</bug_id>
           <creation_ts>2009-12-15 15:17 PST</creation_ts>
-          <short_desc>bug to test webkit-patch and commit-queue failures</short_desc>
+          <short_desc>bug to test webkit-patch&apos;s and commit-queue&apos;s failures</short_desc>
           <delta_ts>2009-12-27 21:04:50 PST</delta_ts>
           <reporter_accessible>1</reporter_accessible>
           <cclist_accessible>1</cclist_accessible>
@@ -173,7 +173,7 @@ ZEZpbmlzaExvYWRXaXRoUmVhc29uOnJlYXNvbl07Cit9CisKIEBlbmQKIAogI2VuZGlmCg==
 
     _expected_example_bug_parsing = {
         "id" : 32585,
-        "title" : u"bug to test webkit-patch and commit-queue failures",
+        "title" : u"bug to test webkit-patch's and commit-queue's failures",
         "cc_emails" : ["foo@bar.com", "example@example.com"],
         "reporter_email" : "eric@webkit.org",
         "assigned_to_email" : "webkit-unassigned@lists.webkit.org",
@@ -203,7 +203,7 @@ ZEZpbmlzaExvYWRXaXRoUmVhc29uOnJlYXNvbl07Cit9CisKIEBlbmQKIAogI2VuZGlmCg==
 
         '''
 
-        self.assertEquals(None, parse_bug_id_from_changelog(commit_text))
+        self.assertEquals(56988, parse_bug_id_from_changelog(commit_text))
 
         commit_text = '''
 2011-03-23  Ojan Vafai  <ojan@chromium.org>
@@ -218,6 +218,25 @@ ZEZpbmlzaExvYWRXaXRoUmVhc29uOnJlYXNvbl07Cit9CisKIEBlbmQKIAogI2VuZGlmCg==
 
         self.assertEquals(12345, parse_bug_id_from_changelog(commit_text))
 
+        commit_text = '''
+2011-03-31  Adam Roben  <aroben@apple.com>
+
+        Quote the executable path we pass to ::CreateProcessW
+
+        This will ensure that spaces in the path will be interpreted correctly.
+
+        Fixes <http://webkit.org/b/57569> Web process sometimes fails to launch when there are
+        spaces in its path
+
+        Reviewed by Steve Falkenburg.
+
+        * UIProcess/Launcher/win/ProcessLauncherWin.cpp:
+        (WebKit::ProcessLauncher::launchProcess): Surround the executable path in quotes.
+
+        '''
+
+        self.assertEquals(57569, parse_bug_id_from_changelog(commit_text))
+
 
     # FIXME: This should move to a central location and be shared by more unit tests.
     def _assert_dictionaries_equal(self, actual, expected):
diff --git a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
index d23a6cc..5fdf184 100644
--- a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
+++ b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
@@ -267,7 +267,7 @@ class Build(object):
 
 
 class BuildBot(object):
-    # FIXME: This should move into some sort of webkit_config.py
+    # FIXME: This should move into common.config.urls.
     default_host = "build.webkit.org"
 
     def __init__(self, host=default_host):
diff --git a/Tools/Scripts/webkitpy/common/net/credentials.py b/Tools/Scripts/webkitpy/common/net/credentials.py
index 30480b3..d76405b 100644
--- a/Tools/Scripts/webkitpy/common/net/credentials.py
+++ b/Tools/Scripts/webkitpy/common/net/credentials.py
@@ -29,7 +29,6 @@
 #
 # Python module for reading stored web credentials from the OS.
 
-import getpass
 import os
 import platform
 import re
@@ -149,7 +148,7 @@ class Credentials(object):
         if not username:
             username = User.prompt("%s login: " % self.host)
         if not password:
-            password = getpass.getpass("%s password for %s: " % (self.host, username))
+            password = User.prompt_password("%s password for %s: " % (self.host, username))
             self._offer_to_store_credentials_in_keyring(username, password)
 
         return (username, password)
diff --git a/Tools/Scripts/webkitpy/common/net/layouttestresults.py b/Tools/Scripts/webkitpy/common/net/layouttestresults.py
index 249ecc9..a0e8ae4 100644
--- a/Tools/Scripts/webkitpy/common/net/layouttestresults.py
+++ b/Tools/Scripts/webkitpy/common/net/layouttestresults.py
@@ -134,6 +134,19 @@ class LayoutTestResults(object):
 
     def __init__(self, test_results):
         self._test_results = test_results
+        self._failure_limit_count = None
+
+    # FIXME: run-webkit-tests should store the --exit-after-N-failures value
+    # (or some indication of early exit) somewhere in the results.html/results.json
+    # file.  Until it does, callers should set the limit to
+    # --exit-after-N-failures value used in that run.  Consumers of LayoutTestResults
+    # may use that value to know if absence from the failure list means PASS.
+    # https://bugs.webkit.org/show_bug.cgi?id=58481
+    def set_failure_limit_count(self, limit):
+        self._failure_limit_count = limit
+
+    def failure_limit_count(self):
+        return self._failure_limit_count
 
     def test_results(self):
         return self._test_results
diff --git a/Tools/Scripts/webkitpy/common/net/layouttestresults_unittest.py b/Tools/Scripts/webkitpy/common/net/layouttestresults_unittest.py
index 01b91b8..d25ad02 100644
--- a/Tools/Scripts/webkitpy/common/net/layouttestresults_unittest.py
+++ b/Tools/Scripts/webkitpy/common/net/layouttestresults_unittest.py
@@ -61,6 +61,12 @@ class LayoutTestResultsTest(unittest.TestCase):
 </html>
 """
 
+    def test_set_failure_limit_count(self):
+        results = LayoutTestResults([])
+        self.assertEquals(results.failure_limit_count(), None)
+        results.set_failure_limit_count(10)
+        self.assertEquals(results.failure_limit_count(), 10)
+
     def test_parse_layout_test_results(self):
         failures = [test_failures.FailureMissingResult(), test_failures.FailureMissingImageHash(), test_failures.FailureMissingImage()]
         testname = 'fast/repaint/no-caret-repaint-in-non-content-editable-element.html'
diff --git a/Tools/Scripts/webkitpy/common/net/statusserver.py b/Tools/Scripts/webkitpy/common/net/statusserver.py
index abd298a..9622c89 100644
--- a/Tools/Scripts/webkitpy/common/net/statusserver.py
+++ b/Tools/Scripts/webkitpy/common/net/statusserver.py
@@ -25,6 +25,8 @@
 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# This the client designed to talk to Tools/QueueStatusServer.
 
 from webkitpy.common.net.networktransaction import NetworkTransaction
 from webkitpy.common.system.deprecated_logging import log
@@ -39,6 +41,7 @@ _log = logging.getLogger("webkitpy.common.net.statusserver")
 
 
 class StatusServer:
+    # FIXME: This should probably move to common.config.urls.
     default_host = "queues.webkit.org"
 
     def __init__(self, host=default_host, browser=None, bot_id=None):
diff --git a/Tools/Scripts/webkitpy/common/system/executive.py b/Tools/Scripts/webkitpy/common/system/executive.py
index 02619db..7d198dd 100644
--- a/Tools/Scripts/webkitpy/common/system/executive.py
+++ b/Tools/Scripts/webkitpy/common/system/executive.py
@@ -45,6 +45,7 @@ import sys
 import time
 
 from webkitpy.common.system.deprecated_logging import tee
+from webkitpy.common.system.filesystem import FileSystem
 from webkitpy.python24 import versioning
 
 
@@ -179,6 +180,22 @@ class Executive(object):
         # machines.
         return 2
 
+    @staticmethod
+    def interpreter_for_script(script_path, fs=FileSystem()):
+        lines = fs.read_text_file(script_path).splitlines()
+        if not len(lines):
+            return None
+        first_line = lines[0]
+        if not first_line.startswith('#!'):
+            return None
+        if first_line.find('python') > -1:
+            return sys.executable
+        if first_line.find('perl') > -1:
+            return 'perl'
+        if first_line.find('ruby') > -1:
+            return 'ruby'
+        return None
+
     def kill_process(self, pid):
         """Attempts to kill the given pid.
         Will fail silently if pid does not exist or insufficient permisssions."""
diff --git a/Tools/Scripts/webkitpy/common/system/executive_unittest.py b/Tools/Scripts/webkitpy/common/system/executive_unittest.py
index 1dadc36..9a14d6b 100644
--- a/Tools/Scripts/webkitpy/common/system/executive_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/executive_unittest.py
@@ -34,6 +34,7 @@ import sys
 import unittest
 
 from webkitpy.common.system.executive import Executive, run_command, ScriptError
+from webkitpy.common.system.filesystem_mock import MockFileSystem
 from webkitpy.test import cat, echo
 
 
@@ -65,6 +66,33 @@ def never_ending_command():
 
 class ExecutiveTest(unittest.TestCase):
 
+    def assert_interpreter_for_content(self, intepreter, content):
+        fs = MockFileSystem()
+        file_path = None
+        file_interpreter = None
+
+        tempfile, temp_name = fs.open_binary_tempfile('')
+        tempfile.write(content)
+        tempfile.close()
+        file_interpreter = Executive.interpreter_for_script(temp_name, fs)
+
+        self.assertEqual(file_interpreter, intepreter)
+
+    def test_interpreter_for_script(self):
+        self.assert_interpreter_for_content(None, '')
+        self.assert_interpreter_for_content(None, 'abcd\nefgh\nijklm')
+        self.assert_interpreter_for_content(None, '##/usr/bin/perl')
+        self.assert_interpreter_for_content('perl', '#!/usr/bin/env perl')
+        self.assert_interpreter_for_content('perl', '#!/usr/bin/env perl\nfirst\nsecond')
+        self.assert_interpreter_for_content('perl', '#!/usr/bin/perl')
+        self.assert_interpreter_for_content('perl', '#!/usr/bin/perl -w')
+        self.assert_interpreter_for_content(sys.executable, '#!/usr/bin/env python')
+        self.assert_interpreter_for_content(sys.executable, '#!/usr/bin/env python\nfirst\nsecond')
+        self.assert_interpreter_for_content(sys.executable, '#!/usr/bin/python')
+        self.assert_interpreter_for_content('ruby', '#!/usr/bin/env ruby')
+        self.assert_interpreter_for_content('ruby', '#!/usr/bin/env ruby\nfirst\nsecond')
+        self.assert_interpreter_for_content('ruby', '#!/usr/bin/ruby')
+
     def test_run_command_with_bad_command(self):
         def run_bad_command():
             run_command(["foo_bar_command_blah"], error_handler=Executive.ignore_error, return_exit_code=True)
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem.py b/Tools/Scripts/webkitpy/common/system/filesystem.py
index 1988546..58be03a 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem.py
@@ -61,6 +61,10 @@ class FileSystem(object):
         """Wraps os.path.basename()."""
         return os.path.basename(path)
 
+    def chdir(self, path):
+        """Wraps os.chdir()."""
+        return os.chdir(path)
+
     def copyfile(self, source, destination):
         """Copies the contents of the file at the given path to the destination
         path."""
@@ -108,6 +112,10 @@ class FileSystem(object):
                     files.append(self.join(dirpath, filename))
         return files
 
+    def getcwd(self):
+        """Wraps os.getcwd()."""
+        return os.getcwd()
+
     def glob(self, path):
         """Wraps glob.glob()."""
         return glob.glob(path)
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
index a6d158a..3be5854 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
@@ -35,7 +35,7 @@ from webkitpy.common.system import ospath
 
 
 class MockFileSystem(object):
-    def __init__(self, files=None):
+    def __init__(self, files=None, cwd='/'):
         """Initializes a "mock" filesystem that can be used to completely
         stub out a filesystem.
 
@@ -48,6 +48,8 @@ class MockFileSystem(object):
         self.written_files = {}
         self._sep = '/'
         self.current_tmpno = 0
+        self.cwd = cwd
+        self.dirs = {}
 
     def _get_sep(self):
         return self._sep
@@ -61,13 +63,19 @@ class MockFileSystem(object):
         return path.rsplit(self.sep, 1)
 
     def abspath(self, path):
-        if path.endswith(self.sep):
-            return path[:-1]
-        return path
+        if os.path.isabs(path):
+            return self.normpath(path)
+        return self.abspath(self.join(self.cwd, path))
 
     def basename(self, path):
         return self._split(path)[1]
 
+    def chdir(self, path):
+        path = self.normpath(path)
+        if not self.isdir(path):
+            raise OSError(errno.ENOENT, path, os.strerror(errno.ENOENT))
+        self.cwd = path
+
     def copyfile(self, source, destination):
         if not self.exists(source):
             self._raise_not_found(source)
@@ -117,6 +125,9 @@ class MockFileSystem(object):
 
         return files
 
+    def getcwd(self, path):
+        return self.cwd
+
     def glob(self, path):
         # FIXME: This only handles a wildcard '*' at the end of the path.
         # Maybe it should handle more?
@@ -134,14 +145,18 @@ class MockFileSystem(object):
     def isdir(self, path):
         if path in self.files:
             return False
-        if not path.endswith(self.sep):
-            path += self.sep
+        path = self.normpath(path)
+        if path in self.dirs:
+            return True
 
         # We need to use a copy of the keys here in order to avoid switching
         # to a different thread and potentially modifying the dict in
         # mid-iteration.
         files = self.files.keys()[:]
-        return any(f.startswith(path) for f in files)
+        result = any(f.startswith(path) for f in files)
+        if result:
+            self.dirs[path] = True
+        return result
 
     def join(self, *comps):
         # FIXME: might want tests for this and/or a better comment about how
@@ -204,8 +219,9 @@ class MockFileSystem(object):
         return TemporaryDirectory(fs=self, **kwargs)
 
     def maybe_make_directory(self, *path):
-        # FIXME: Implement such that subsequent calls to isdir() work?
-        pass
+        norm_path = self.normpath(self.join(*path))
+        if not self.isdir(norm_path):
+            self.dirs[norm_path] = True
 
     def move(self, source, destination):
         if self.files[source] is None:
@@ -216,7 +232,9 @@ class MockFileSystem(object):
         self.written_files[source] = None
 
     def normpath(self, path):
-        return path
+        # Like join(), relies on os.path functionality but normalizes the
+        # path separator to the mock one.
+        return re.sub(re.escape(os.path.sep), self.sep, os.path.normpath(path))
 
     def open_binary_tempfile(self, suffix=''):
         path = self._mktemp(suffix)
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem_unittest.py b/Tools/Scripts/webkitpy/common/system/filesystem_unittest.py
index 8455d72..8d4f0cb 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem_unittest.py
@@ -48,6 +48,23 @@ class FileSystemTest(unittest.TestCase):
         self._missing_file = os.path.join(self._this_dir, 'missing_file.py')
         self._this_file = os.path.join(self._this_dir, 'filesystem_unittest.py')
 
+    def test_chdir(self):
+        fs = FileSystem()
+        cwd = fs.getcwd()
+        newdir = '/'
+        if sys.platform == 'win32':
+            newdir = 'c:\\'
+        fs.chdir(newdir)
+        self.assertEquals(fs.getcwd(), newdir)
+        fs.chdir(cwd)
+
+    def test_chdir__notexists(self):
+        fs = FileSystem()
+        newdir = '/dirdoesnotexist'
+        if sys.platform == 'win32':
+            newdir = 'c:\\dirdoesnotexist'
+        self.assertRaises(OSError, fs.chdir, newdir)
+
     def test_exists__true(self):
         fs = FileSystem()
         self.assertTrue(fs.exists(self._this_file))
@@ -56,6 +73,10 @@ class FileSystemTest(unittest.TestCase):
         fs = FileSystem()
         self.assertFalse(fs.exists(self._missing_file))
 
+    def test_getcwd(self):
+        fs = FileSystem()
+        self.assertTrue(fs.exists(fs.getcwd()))
+
     def test_isdir__true(self):
         fs = FileSystem()
         self.assertTrue(fs.isdir(self._this_dir))
diff --git a/Tools/Scripts/webkitpy/common/system/user.py b/Tools/Scripts/webkitpy/common/system/user.py
index b79536c..aecb6ec 100644
--- a/Tools/Scripts/webkitpy/common/system/user.py
+++ b/Tools/Scripts/webkitpy/common/system/user.py
@@ -26,6 +26,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import getpass
 import logging
 import os
 import re
@@ -65,6 +66,10 @@ class User(object):
         return response
 
     @classmethod
+    def prompt_password(cls, message, repeat=1):
+        return cls.prompt(message, repeat=repeat, raw_input=getpass.getpass)
+
+    @classmethod
     def prompt_with_list(cls, list_title, list_items, can_choose_multiple=False, raw_input=raw_input):
         print list_title
         i = 0
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py
deleted file mode 100644
index 6d5cda8..0000000
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py
+++ /dev/null
@@ -1,226 +0,0 @@
-#!/usr/bin/env python
-# Copyright (C) 2010 Google Inc. All rights reserved.
-# Copyright (C) 2010 Gabor Rapcsanyi (rgabor@inf.u-szeged.hu), University of Szeged
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-"""This module implements a shared-memory, thread-based version of the worker
-task in new-run-webkit-tests: it receives a list of tests from TestShellThread
-and passes them one at a time to SingleTestRunner to execute."""
-
-import logging
-import Queue
-import signal
-import sys
-import thread
-import threading
-import time
-
-from webkitpy.layout_tests.layout_package import worker_mixin
-
-_log = logging.getLogger("webkitpy.layout_tests.layout_package."
-                         "dump_render_tree_thread")
-
-
-class TestShellThread(threading.Thread, worker_mixin.WorkerMixin):
-    def __init__(self, port, options, worker_number, worker_name,
-                 filename_list_queue, result_queue):
-        """Initialize all the local state for this DumpRenderTree thread.
-
-        Args:
-          port: interface to port-specific hooks
-          options: command line options argument from optparse
-          worker_number: identifier for a particular worker thread.
-          worker_name: for logging.
-          filename_list_queue: A thread safe Queue class that contains lists
-              of tuples of (filename, uri) pairs.
-          result_queue: A thread safe Queue class that will contain
-              serialized TestResult objects.
-        """
-        threading.Thread.__init__(self)
-        self._canceled = False
-        self._exception_info = None
-        self._next_timeout = None
-        self._thread_id = None
-        self._port = port
-        self._options = options
-        self._worker_number = worker_number
-        self._name = worker_name
-        self._filename_list_queue = filename_list_queue
-        self._result_queue = result_queue
-        self._current_group = None
-        self._filename_list = []
-        self._test_group_timing_stats = {}
-        self._test_results = []
-        self._num_tests = 0
-        self._start_time = 0
-        self._stop_time = 0
-        self._http_lock_wait_begin = 0
-        self._http_lock_wait_end = 0
-
-    def cancel(self):
-        """Set a flag telling this thread to quit."""
-        self._canceled = True
-
-    def clear_next_timeout(self):
-        """Mark a flag telling this thread to stop setting timeouts."""
-        self._timeout = 0
-
-    def exception_info(self):
-        """If run() terminated on an uncaught exception, return it here
-        ((type, value, traceback) tuple).
-        Returns None if run() terminated normally. Meant to be called after
-        joining this thread."""
-        return self._exception_info
-
-    def id(self):
-        """Return a thread identifier."""
-        return self._thread_id
-
-    def next_timeout(self):
-        """Return the time the test is supposed to finish by."""
-        if self._next_timeout:
-            return self._next_timeout + self._http_lock_wait_time()
-        return self._next_timeout
-
-    def get_test_group_timing_stats(self):
-        """Returns a dictionary mapping test group to a tuple of
-        (number of tests in that group, time to run the tests)"""
-        return self._test_group_timing_stats
-
-    def get_test_results(self):
-        """Return the list of all tests run on this thread.
-
-        This is used to calculate per-thread statistics.
-
-        """
-        return self._test_results
-
-    def get_total_time(self):
-        return max(self._stop_time - self._start_time -
-                   self._http_lock_wait_time(), 0.0)
-
-    def get_num_tests(self):
-        return self._num_tests
-
-    def run(self):
-        """Delegate main work to a helper method and watch for uncaught
-        exceptions."""
-
-        self._covered_run()
-
-    def _covered_run(self):
-        # FIXME: this is a separate routine to work around a bug
-        # in coverage: see http://bitbucket.org/ned/coveragepy/issue/85.
-        self._thread_id = thread.get_ident()
-        self._start_time = time.time()
-        self._num_tests = 0
-        try:
-            _log.debug('%s starting' % (self.getName()))
-            self._run(test_runner=None, result_summary=None)
-            _log.debug('%s done (%d tests)' % (self.getName(),
-                       self.get_num_tests()))
-        except KeyboardInterrupt:
-            self._exception_info = sys.exc_info()
-            _log.debug("%s interrupted" % self.getName())
-        except:
-            # Save the exception for our caller to see.
-            self._exception_info = sys.exc_info()
-            self._stop_time = time.time()
-            _log.error('%s dying, exception raised' % self.getName())
-
-        self._stop_time = time.time()
-
-    def run_in_main_thread(self, test_runner, result_summary):
-        """This hook allows us to run the tests from the main thread if
-        --num-test-shells==1, instead of having to always run two or more
-        threads. This allows us to debug the test harness without having to
-        do multi-threaded debugging."""
-        self._run(test_runner, result_summary)
-
-    def _http_lock_wait_time(self):
-        """Return the time what http locking takes."""
-        if self._http_lock_wait_begin == 0:
-            return 0
-        if self._http_lock_wait_end == 0:
-            return time.time() - self._http_lock_wait_begin
-        return self._http_lock_wait_end - self._http_lock_wait_begin
-
-    def _run(self, test_runner, result_summary):
-        """Main work entry point of the thread. Basically we pull urls from the
-        filename queue and run the tests until we run out of urls.
-
-        If test_runner is not None, then we call test_runner.UpdateSummary()
-        with the results of each test."""
-
-        # Initialize the real state of the WorkerMixin now that we're executing
-        # in the child thread. Technically, we could have called this during
-        # __init__(), but we wait until now to match Worker.run().
-        self.safe_init(self._port)
-
-        while True:
-            if self._canceled:
-                _log.debug('Testing cancelled')
-                self.cleanup()
-                return
-
-            if len(self._filename_list) is 0:
-                if self._current_group is not None:
-                    self._test_group_timing_stats[self._current_group] = \
-                        (self._num_tests_in_current_group,
-                         time.time() - self._current_group_start_time)
-
-                try:
-                    self._current_group, self._filename_list = \
-                        self._filename_list_queue.get_nowait()
-                except Queue.Empty:
-                    self.cleanup()
-                    return
-
-                if self._current_group == "tests_to_http_lock":
-                    self._http_lock_wait_begin = time.time()
-                    self.start_servers_with_lock()
-                    self._http_lock_wait_end = time.time()
-                elif self._has_http_lock:
-                    self.stop_servers_with_lock()
-
-                self._num_tests_in_current_group = len(self._filename_list)
-                self._current_group_start_time = time.time()
-
-            test_input = self._filename_list.pop(0)
-
-            # We have a url, run tests.
-            self._num_tests += 1
-
-            result = self.run_test_with_timeout(test_input, self.timeout(test_input))
-
-            self.clean_up_after_test(test_input, result)
-            self._test_results.append(result)
-            self._result_queue.put(result.dumps())
-
-            if test_runner:
-                test_runner.update_summary(result_summary)
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/json_layout_results_generator.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/json_layout_results_generator.py
index 19b02e8..dbb16c0 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/json_layout_results_generator.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/json_layout_results_generator.py
@@ -50,6 +50,7 @@ class JSONLayoutResultsGenerator(json_results_generator.JSONResultsGeneratorBase
                        test_expectations.IMAGE: "I",
                        test_expectations.TEXT: "F",
                        test_expectations.MISSING: "O",
+                       test_expectations.AUDIO: "A",
                        test_expectations.IMAGE_PLUS_TEXT: "Z"}
 
     def __init__(self, port, builder_name, build_name, build_number,
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/json_results.html b/Tools/Scripts/webkitpy/layout_tests/layout_package/json_results.html
new file mode 100644
index 0000000..33aa04a
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/json_results.html
@@ -0,0 +1,555 @@
+<!DocType html>
+<style>
+body {
+    margin: 4px;
+}
+
+body > p:first-of-type {
+    margin-top: 0;
+}
+
+tr:first-of-type:hover {
+    opacity: 0.7
+}
+
+thead, tbody {
+    background-color: #E3E9FF;
+}
+
+td {
+    padding: 0 4px;
+}
+
+th:empty, td:empty {
+    padding: 0;
+}
+
+th {
+    -webkit-user-select: none;
+    -moz-user-select: none;
+}
+
+label {
+    margin-left: 10px;
+}
+
+.results-row {
+    background-color: white;
+}
+
+.results-row iframe {
+    width: 800px;
+    height: 600px;
+}
+
+#options {
+    position: absolute;
+    top: 4px;
+    right: 4px;
+}
+
+.expand-button {
+    background-color: white;
+    color: blue;
+    width: 11px;
+    height: 11px;
+    border: 1px solid blue;
+    display: inline-block;
+    margin: 0 3px 0 0;
+    position: relative;
+}
+
+.expand-button-text {
+    position: absolute;
+    top: -0.3em;
+    left: 1px;
+}
+
+.result-container {
+    display: inline-block;
+    border: 1px solid gray;
+}
+
+.result-container iframe, .result-container img {
+    border: 0;
+    border-top: 1px solid lightgray;
+    vertical-align: top;
+}
+
+.label {
+    padding-left: 3px;
+    font-weight: bold;
+    font-size: small;
+}
+
+.pixel-zoom-container {
+    position: fixed;
+    top: 0;
+    left: 0;
+    width: 100%;
+    display: -webkit-box;
+}
+
+.pixel-zoom-container > * {
+    display: -webkit-box;
+    -webkit-box-flex: 1;
+    border: 1px inset lightgray;
+    height: 100px;
+    overflow: hidden;
+    zoom: 300%;
+    background-color: white;
+}
+
+.pixel-zoom-container img {
+    width: 800px;
+    height: 600px;
+    vertical-align: top;
+}
+</style>
+
+<script>
+var g_results;
+function ADD_RESULTS(input)
+{
+    g_results = input;
+}
+</script>
+
+<script src="full_results.json"></script>
+
+<script>
+function stripExtension(test)
+{
+    var index = test.lastIndexOf('.');
+    return test.substring(0, index);
+}
+
+function parentOfType(node, selector)
+{
+    while (node = node.parentElement) {
+        if (node.webkitMatchesSelector(selector))
+            return node;
+    }
+    return null;
+}
+
+function appendResultIframe(src, parent)
+{
+    // FIXME: use audio tags for AUDIO tests?
+    var layoutTestsIndex = src.indexOf('LayoutTests');
+    var name;
+    if (layoutTestsIndex != -1) {
+        var hasTrac = src.indexOf('trac.webkit.org') != -1;
+        var prefix = hasTrac ? 'trac.webkit.org/.../' : '';
+        name = prefix + src.substring(layoutTestsIndex + 'LayoutTests/'.length);
+    } else {
+        var lastDashIndex = src.lastIndexOf('-pretty');
+        if (lastDashIndex == -1)
+            lastDashIndex = src.lastIndexOf('-');
+        name = src.substring(lastDashIndex + 1);
+    }
+
+    var tagName = (src.lastIndexOf('.png') == -1) ? 'iframe' : 'img';
+
+    var container = document.createElement('div');
+    container.className = 'result-container';
+    container.innerHTML = '<div class=label>' + name + '</div><' + tagName + ' src="' + src + '?format=txt"></' + tagName + '>';
+    parent.appendChild(container);
+}
+
+function expandExpectations(e)
+{
+    var expandLink = e.target;
+    if (expandLink.className != 'expand-button-text')
+        expandLink = expandLink.querySelector('.expand-button-text');
+
+    var isExpand = expandLink.textContent == '+';
+    var row = parentOfType(expandLink, 'tr');
+    var parentTbody = row.parentNode;
+    var existingResultsRow = parentTbody.querySelector('.results-row');
+    
+    if (!isExpand) {
+        expandLink.textContent = '+';
+        existingResultsRow.style.display = 'none';
+        return;
+    }
+    
+    var enDash = '\u2013';
+    expandLink.textContent = enDash;
+    if (existingResultsRow) {
+        existingResultsRow.style.display = '';
+        return;
+    }
+    
+    var newRow = document.createElement('tr');
+    newRow.className = 'results-row';
+    var newCell = document.createElement('td');
+    newCell.colSpan = row.querySelectorAll('td').length;
+
+    appendResultIframe(row.querySelector('.test-link').href, newCell);
+
+    var resultLinks = row.querySelectorAll('.result-link');
+    for (var i = 0; i < resultLinks.length; i++)
+        appendResultIframe(resultLinks[i].href, newCell);
+
+    newRow.appendChild(newCell);
+    parentTbody.appendChild(newRow);
+}
+
+function testLink(test)
+{
+    var basePath;
+    if (g_results.layout_tests_dir && location.toString().indexOf('file://') == 0)
+        basePath = g_results.layout_tests_dir + '/';
+    else
+        basePath = 'http://trac.webkit.org/browser/trunk/LayoutTests/';
+    return '<span class=expand-button onclick="expandExpectations(event)"><span class=expand-button-text>+</span></span>' +
+        '<a class=test-link href="' + basePath + test + '">' + test + '</a>';
+}
+
+function resultLink(testPrefix, suffix, contents)
+{
+    return '<a class=result-link href="' + testPrefix + suffix + '">' + contents + '</a> ';
+}
+
+var g_hasTextFailures = false;
+var g_hasImageFailures = false;
+
+var g_testsWithStderr = [];
+var g_newTests = [];
+var g_hasHttpTests = false;
+
+function tableRows()
+{
+    var html = '';
+    for (var test in g_results.tests) {
+        if (g_results.tests[test].has_stderr)
+            g_testsWithStderr.push(test);
+
+        g_hasHttpTests = g_hasHttpTests || test.indexOf('http/') == 0;
+
+        var actual = g_results.tests[test].actual;
+        if (actual == 'MISSING') {
+            // FIXME: make sure that new-run-webkit-tests spits out an -actual.txt file for
+            // tests with MISSING results.
+            g_newTests.push(test);
+            continue;
+        }
+
+        var expected = g_results.tests[test].expected || 'PASS';
+        if (actual == 'PASS' && (!g_results.uses_expectations_file || expected == 'PASS'))
+          continue;
+
+        // FIXME: put unexpected passes in a separate table.
+
+        var row = '<td>' + testLink(test) + '</td>';
+        var test_prefix = stripExtension(test);
+
+        row += '<td>';
+        if (actual == 'CRASH')
+            row += resultLink(test_prefix, '-stack.txt', 'stack');
+        else if (actual == 'AUDIO') {
+            row += resultLink(test_prefix, '-expected.wav', 'expected');
+            row += resultLink(test_prefix, '-actual.wav', 'actual');
+        } else if (actual.indexOf('TEXT') != -1 || actual == 'TIMEOUT') {
+            // FIXME: only include timeout actual/expected results here if we actually spit out results for timeout tests.
+            g_hasTextFailures = true;
+            row += resultLink(test_prefix, '-expected.txt', 'expected') +
+                resultLink(test_prefix, '-actual.txt', 'actual') +
+                resultLink(test_prefix, '-diff.txt', 'diff');
+      
+            if (g_results.has_pretty_patch)
+                row += resultLink(test_prefix, '-pretty-diff.html', 'pretty diff');
+
+            if (g_results.has_wdiff)
+                row += resultLink(test_prefix, '-wdiff.html', 'wdiff');
+        }
+
+        row += '</td><td>';
+
+        if (actual.indexOf('IMAGE') != -1) {
+            g_hasImageFailures = true;
+
+            if (g_results.tests[test].is_mismatch_reftest) {
+                row += resultLink(test_prefix, '-expected-mismatch.html', 'ref mismatch html') +
+                    resultLink(test_prefix, '-actual.png', 'actual');
+            } else {
+                if (g_results.tests[test].is_reftest)
+                    row += resultLink(test_prefix, '-expected.html', 'ref html');
+
+                row += resultLink(test_prefix, '-expected.png', 'expected') +
+                    resultLink(test_prefix, '-actual.png', 'actual') +
+                    resultLink(test_prefix, '-diff.png', 'diff');
+            }
+        }
+
+        row += '</td>';
+        row += '<td>' + actual + '</td>';
+
+        if (g_results.uses_expectations_file)
+          row += '<td>' + expected + '</td>';
+
+        var isExpected = actual == 'SKIP';
+        if (!isExpected && g_results.uses_expectations_file) {
+            var expectedArray = expected.split(' ');
+            if (expectedArray.indexOf(actual) != -1)
+                isExpected = true;
+            else if (expectedArray.indexOf('FAIL') != -1)
+                isExpected = actual == 'IMAGE' || actual == 'TEXT' || actual == 'IMAGE+TEXT';
+        }
+        html += '<tbody class="' + (isExpected ? 'expected' : '') + '"><tr>' + row + '</tr></tbody>';
+    }
+    return html;
+}
+
+var html = '';
+if (g_results.uses_expectations_file)
+    html += '<div id=options><label><input class="unexpected-results" type=checkbox checked>Only show unexpected results</label></div>';
+
+var tableRowsHtml = tableRows();
+
+if (tableRowsHtml) {
+    html += '<p>Tests where results did not match expected results:</p>' +
+        '<table id="results-table"><thead><tr>' +
+        '<th>test</th>' +
+        '<th id="text-results-header">text results</th>' +
+        '<th id="image-results-header">image results</th>' +
+        '<th>failure type</th>';
+        
+    if (g_results.uses_expectations_file)
+        html += '<th>expected failure type</th>';
+
+    html += '</tr></thead>' + tableRowsHtml + '</table>';
+}
+
+function appendTestList(tests, header, tableId, fileSuffix, linkName)
+{
+    tests.sort();
+
+    html += '<p>' + header + '</p><table id="' + tableId + '">';
+    for (var i = 0; i < tests.length; i++) {
+        var test = tests[i];
+        html += '<tbody><tr><td>' + testLink(test) + '</td><td>';
+        
+        if (fileSuffix.indexOf('actual') == -1)
+            html += resultLink(stripExtension(test), fileSuffix, linkName);
+        else {
+            var testObject = g_results.tests[test];
+            if (testObject.is_missing_audio)
+                html += resultLink(stripExtension(test), '-actual.wav', 'audio result');
+            if (testObject.is_missing_text)
+                html += resultLink(stripExtension(test), fileSuffix, linkName);
+            if (testObject.is_missing_image)
+                html += resultLink(stripExtension(test), '-actual.png', 'png result');
+        } 
+        
+        html += '</td></tr></tbody>';
+    }
+    html += '</table>'
+}
+
+if (g_newTests.length)
+    appendTestList(g_newTests, 'Tests that had no expected results (probably new):', 'new-tests-table', '-actual.txt', 'result');
+
+if (g_testsWithStderr.length)
+    appendTestList(g_testsWithStderr, 'Tests that had stderr output:', 'stderr-table', '-stderr.txt', 'stderr');
+
+if (g_hasHttpTests) {
+    html += '<p>httpd access log: <a href="access_log.txt">access_log.txt</a></p>' +
+        '<p>httpd error log: <a href="error_log.txt">error_log.txt</a></p>';
+}
+
+document.write(html);
+
+function toArray(nodeList)
+{
+    return Array.prototype.slice.call(nodeList);
+}
+
+function trim(string)
+{
+    return string.replace(/^[\s\xa0]+|[\s\xa0]+$/g, '');
+}
+
+// Just a namespace for code management.
+var TableSorter = {};
+
+TableSorter._forwardArrow = '<svg style="width:10px;height:10px"><polygon points="0,0 10,0 5,10" style="fill:#aaa"></svg>';
+
+TableSorter._backwardArrow = '<svg style="width:10px;height:10px"><polygon points="0,10 10,10 5,0" style="fill:#aaa"></svg>';
+
+TableSorter._sortedContents = function(header, arrow)
+{
+    return arrow + ' ' + trim(header.textContent) + ' ' + arrow;
+}
+
+TableSorter._updateHeaderClassNames = function(newHeader)
+{
+    var sortHeader = document.querySelector('.sortHeader');
+    if (sortHeader) {
+        if (sortHeader == newHeader) {
+            var isAlreadyReversed = sortHeader.classList.contains('reversed');
+            if (isAlreadyReversed)
+                sortHeader.classList.remove('reversed');
+            else
+                sortHeader.classList.add('reversed');
+        } else {
+            sortHeader.textContent = sortHeader.textContent;
+            sortHeader.classList.remove('sortHeader');
+            sortHeader.classList.remove('reversed');
+        }
+    }
+
+    newHeader.classList.add('sortHeader');
+}
+
+TableSorter._textContent = function(tbodyRow, column)
+{
+    return tbodyRow.querySelectorAll('td')[column].textContent;
+}
+
+TableSorter._sortRows = function(newHeader, reversed)
+{
+    var testsTable = document.getElementById('results-table');
+    var headers = toArray(testsTable.querySelectorAll('th'));
+    var sortColumn = headers.indexOf(newHeader);
+
+    var rows = toArray(testsTable.querySelectorAll('tbody'));
+
+    rows.sort(function(a, b) {
+        // Only need to support lexicographic sort for now.
+        var aText = TableSorter._textContent(a, sortColumn);
+        var bText = TableSorter._textContent(b, sortColumn);
+        
+        // Forward sort equal values by test name.
+        if (sortColumn && aText == bText) {
+            var aTestName = TableSorter._textContent(a, 0);
+            var bTestName = TableSorter._textContent(b, 0);
+            if (aTestName == bTestName)
+                return 0;
+            return aTestName < bTestName ? -1 : 1;
+        }
+
+        if (reversed)
+            return aText < bText ? 1 : -1;
+        else
+            return aText < bText ? -1 : 1;
+    });
+
+    for (var i = 0; i < rows.length; i++)
+        testsTable.appendChild(rows[i]);
+}
+
+TableSorter.sortColumn = function(columnNumber)
+{
+    var newHeader = document.getElementById('results-table').querySelectorAll('th')[columnNumber];
+    TableSorter._sort(newHeader);
+}
+
+TableSorter.handleClick = function(e)
+{
+    var newHeader = e.target;
+    if (newHeader.localName != 'th')
+        return;
+    TableSorter._sort(newHeader);
+}
+
+TableSorter._sort = function(newHeader)
+{
+    TableSorter._updateHeaderClassNames(newHeader);
+    
+    var reversed = newHeader.classList.contains('reversed');
+    var sortArrow = reversed ? TableSorter._backwardArrow : TableSorter._forwardArrow;
+    newHeader.innerHTML = TableSorter._sortedContents(newHeader, sortArrow);
+    
+    TableSorter._sortRows(newHeader, reversed);
+}
+
+if (document.getElementById('results-table'))
+    document.getElementById('results-table').addEventListener('click', TableSorter.handleClick, false);
+TableSorter.sortColumn(0);
+
+var PixelZoomer = {};
+
+PixelZoomer._createContainer = function(e)
+{
+    var tbody = parentOfType(e.target, 'tbody');
+    var imageDiffLinks = tbody.querySelector('tr').querySelectorAll('a[href$=".png"]');
+    
+    var container = document.createElement('div');
+    container.className = 'pixel-zoom-container';
+    
+    var html = '';
+    for (var i = 0; i < imageDiffLinks.length; i++)
+        html += '<div class=zoom-image-container><img src="' + imageDiffLinks[i].href + '"></div>';
+    
+    container.innerHTML = html;
+    document.body.appendChild(container);
+
+    PixelZoomer._position(e);
+}
+
+PixelZoomer._position = function(e)
+{
+    var pageX = e.clientX;
+    var pageY = e.clientY;
+    var targetLocation = e.target.getBoundingClientRect();
+    var x = pageX - targetLocation.left;
+    var y = pageY - targetLocation.top;
+
+    var zoomContainers = document.querySelectorAll('.pixel-zoom-container > .zoom-image-container');
+    for (var i = 0; i < zoomContainers.length; i++) {
+        var container = zoomContainers[i];
+        container.scrollLeft = x - container.offsetWidth / 2;
+        container.scrollTop = y - container.offsetHeight / 2;
+    }
+}
+
+PixelZoomer.handleMouseMove = function(e) {
+    if (PixelZoomer._mouseMoveTimeout)
+        clearTimeout(PixelZoomer._mouseMoveTimeout);
+
+    if (parentOfType(e.target, '.pixel-zoom-container'))
+        return;
+
+    var container = document.querySelector('.pixel-zoom-container');
+    if (!e.target.src || e.target.src.indexOf('.png') == -1) {
+        if (container)
+            container.parentNode.removeChild(container);
+        return;
+    }
+    
+    if (!container) {
+        PixelZoomer._mouseMoveTimeout = setTimeout(function() {
+            PixelZoomer._createContainer(e);
+        }, 200);
+        return;
+    }
+    
+    PixelZoomer._position(e);
+}
+
+document.body.addEventListener('mousemove', PixelZoomer.handleMouseMove, false);
+
+
+var unexpectedStyleNode = document.createElement('style');
+document.body.appendChild(unexpectedStyleNode);
+
+function updateExpectedResults()
+{
+    var checkBox = document.querySelector('.unexpected-results');
+    if (!checkBox || checkBox.checked)
+        unexpectedStyleNode.innerText = '.expected { display: none; }';
+    else
+        unexpectedStyleNode.innerText = '';
+}
+
+updateExpectedResults();
+if (document.querySelector('.unexpected-results'))
+    document.querySelector('.unexpected-results').addEventListener('change', updateExpectedResults, false);
+
+if (!g_hasTextFailures)
+  document.body.getElementById('text-results-header').textContent = '';
+if (!g_hasImageFailures)
+  document.body.getElementById('image-results-header').textContent = '';
+</script>
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker.py
index 4886c30..7ead483 100644..100755
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker.py
@@ -45,7 +45,9 @@ TestRunner2  --> _InlineManager ---> _InlineWorker <-> Worker
 
 import logging
 import optparse
+import printing
 import Queue
+import sys
 import thread
 import threading
 import time
@@ -315,9 +317,15 @@ if multiprocessing:
             _log.error("%s (pid %d) is wedged on test %s" % (self.name, self.pid, test_name))
 
         def run(self):
-            logging.basicConfig()
-            port_obj = port.get(self._platform_name, self._options)
+            options = self._options
+            port_obj = port.get(self._platform_name, options)
+            # FIXME: this won't work if the calling process is logging
+            # somewhere other than sys.stderr and sys.stdout, but I'm not sure
+            # if this will be an issue in practice.
+            printer = printing.Printer(port_obj, options, sys.stderr, sys.stdout,
+                int(options.child_processes), options.experimental_fully_parallel)
             self._client.run(port_obj)
+            printer.cleanup()
 
 
 class _MultiProcessWorkerConnection(_WorkerConnection):
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker_unittest.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker_unittest.py
index c32f880..6919225 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/manager_worker_broker_unittest.py
@@ -42,6 +42,7 @@ from webkitpy.common.system import outputcapture
 from webkitpy.layout_tests import port
 from webkitpy.layout_tests.layout_package import manager_worker_broker
 from webkitpy.layout_tests.layout_package import message_broker2
+from webkitpy.layout_tests.layout_package import printing
 
 # In order to reliably control when child workers are starting and stopping,
 # we use a pair of global variables to hold queues used for messaging. Ideally
@@ -104,7 +105,10 @@ class _TestWorker(manager_worker_broker.AbstractWorker):
 
 
 def get_options(worker_model):
-    option_list = manager_worker_broker.runtime_options()
+    option_list = (manager_worker_broker.runtime_options() +
+                   printing.print_options() +
+                   [optparse.make_option("--experimental-fully-parallel", default=False),
+                    optparse.make_option("--child-processes", default='2')])
     parser = optparse.OptionParser(option_list=option_list)
     options, args = parser.parse_args(args=['--worker-model', worker_model])
     return options
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/message_broker.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/message_broker.py
deleted file mode 100644
index 66a7aa8..0000000
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/message_broker.py
+++ /dev/null
@@ -1,178 +0,0 @@
-# Copyright (C) 2010 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-"""Module for handling messages, threads, processes, and concurrency for run-webkit-tests.
-
-Testing is accomplished by having a manager (TestRunner) gather all of the
-tests to be run, and sending messages to a pool of workers (TestShellThreads)
-to run each test. Each worker communicates with one driver (usually
-DumpRenderTree) to run one test at a time and then compare the output against
-what we expected to get.
-
-This modules provides a message broker that connects the manager to the
-workers: it provides a messaging abstraction and message loops, and
-handles launching threads and/or processes depending on the
-requested configuration.
-"""
-
-import logging
-import time
-
-from webkitpy.common.system import stack_utils
-
-import dump_render_tree_thread
-
-_log = logging.getLogger(__name__)
-
-
-def get(port, options):
-    """Return an instance of a WorkerMessageBroker."""
-    worker_model = options.worker_model
-    if worker_model == 'old-inline':
-        return InlineBroker(port, options)
-    if worker_model == 'old-threads':
-        return MultiThreadedBroker(port, options)
-    raise ValueError('unsupported value for --worker-model: %s' % worker_model)
-
-
-class _WorkerState(object):
-    def __init__(self, name):
-        self.name = name
-        self.thread = None
-
-
-class WorkerMessageBroker(object):
-    def __init__(self, port, options):
-        self._port = port
-        self._options = options
-        self._num_workers = int(self._options.child_processes)
-
-        # This maps worker names to their _WorkerState values.
-        self._workers = {}
-
-    def _threads(self):
-        return tuple([w.thread for w in self._workers.values()])
-
-    def start_workers(self, test_runner):
-        """Starts up the pool of workers for running the tests.
-
-        Args:
-            test_runner: a handle to the manager/TestRunner object
-        """
-        self._test_runner = test_runner
-        for worker_number in xrange(self._num_workers):
-            worker = _WorkerState('worker-%d' % worker_number)
-            worker.thread = self._start_worker(worker_number, worker.name)
-            self._workers[worker.name] = worker
-        return self._threads()
-
-    def _start_worker(self, worker_number, worker_name):
-        raise NotImplementedError
-
-    def run_message_loop(self):
-        """Loop processing messages until done."""
-        raise NotImplementedError
-
-    def cancel_workers(self):
-        """Cancel/interrupt any workers that are still alive."""
-        pass
-
-    def cleanup(self):
-        """Perform any necessary cleanup on shutdown."""
-        pass
-
-
-class InlineBroker(WorkerMessageBroker):
-    def _start_worker(self, worker_number, worker_name):
-        # FIXME: Replace with something that isn't a thread.
-        thread = dump_render_tree_thread.TestShellThread(self._port,
-            self._options, worker_number, worker_name,
-            self._test_runner._current_filename_queue,
-            self._test_runner._result_queue)
-        # Note: Don't start() the thread! If we did, it would actually
-        # create another thread and start executing it, and we'd no longer
-        # be single-threaded.
-        return thread
-
-    def run_message_loop(self):
-        thread = self._threads()[0]
-        thread.run_in_main_thread(self._test_runner,
-                                  self._test_runner._current_result_summary)
-        self._test_runner.update()
-
-
-class MultiThreadedBroker(WorkerMessageBroker):
-    def _start_worker(self, worker_number, worker_name):
-        thread = dump_render_tree_thread.TestShellThread(self._port,
-            self._options, worker_number, worker_name,
-            self._test_runner._current_filename_queue,
-            self._test_runner._result_queue)
-        thread.start()
-        return thread
-
-    def run_message_loop(self):
-        threads = self._threads()
-        wedged_threads = set()
-
-        # Loop through all the threads waiting for them to finish.
-        some_thread_is_alive = True
-        while some_thread_is_alive:
-            some_thread_is_alive = False
-            t = time.time()
-            for thread in threads:
-                if thread.isAlive():
-                    if thread in wedged_threads:
-                        continue
-
-                    some_thread_is_alive = True
-                    next_timeout = thread.next_timeout()
-                    if next_timeout and t > next_timeout:
-                        stack_utils.log_thread_state(_log.error, thread.getName(), thread.id(), "is wedged")
-                        thread.clear_next_timeout()
-                        wedged_threads.add(thread)
-
-                exception_info = thread.exception_info()
-                if exception_info is not None:
-                    # Re-raise the thread's exception here to make it
-                    # clear that testing was aborted. Otherwise,
-                    # the tests that did not run would be assumed
-                    # to have passed.
-                    raise exception_info[0], exception_info[1], exception_info[2]
-
-            self._test_runner.update()
-
-            if some_thread_is_alive:
-                time.sleep(0.01)
-
-        if wedged_threads:
-            _log.warning("All remaining threads are wedged, bailing out.")
-
-    def cancel_workers(self):
-        threads = self._threads()
-        for thread in threads:
-            thread.cancel()
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/message_broker_unittest.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/message_broker_unittest.py
deleted file mode 100644
index f4cb5d2..0000000
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/message_broker_unittest.py
+++ /dev/null
@@ -1,161 +0,0 @@
-# Copyright (C) 2010 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-import logging
-import Queue
-import sys
-import thread
-import threading
-import time
-import unittest
-
-from webkitpy.common import array_stream
-from webkitpy.common.system import outputcapture
-from webkitpy.tool import mocktool
-
-from webkitpy.layout_tests import run_webkit_tests
-
-import message_broker
-
-
-class TestThread(threading.Thread):
-    def __init__(self, started_queue, stopping_queue):
-        threading.Thread.__init__(self)
-        self._thread_id = None
-        self._started_queue = started_queue
-        self._stopping_queue = stopping_queue
-        self._timeout = False
-        self._timeout_queue = Queue.Queue()
-        self._exception_info = None
-
-    def id(self):
-        return self._thread_id
-
-    def getName(self):
-        return "worker-0"
-
-    def run(self):
-        self._covered_run()
-
-    def _covered_run(self):
-        # FIXME: this is a separate routine to work around a bug
-        # in coverage: see http://bitbucket.org/ned/coveragepy/issue/85.
-        self._thread_id = thread.get_ident()
-        try:
-            self._started_queue.put('')
-            msg = self._stopping_queue.get()
-            if msg == 'KeyboardInterrupt':
-                raise KeyboardInterrupt
-            elif msg == 'Exception':
-                raise ValueError()
-            elif msg == 'Timeout':
-                self._timeout = True
-                self._timeout_queue.get()
-        except:
-            self._exception_info = sys.exc_info()
-
-    def exception_info(self):
-        return self._exception_info
-
-    def next_timeout(self):
-        if self._timeout:
-            return time.time() - 10
-        return time.time()
-
-    def clear_next_timeout(self):
-        self._next_timeout = None
-
-class TestHandler(logging.Handler):
-    def __init__(self, astream):
-        logging.Handler.__init__(self)
-        self._stream = astream
-
-    def emit(self, record):
-        self._stream.write(self.format(record))
-
-
-class MultiThreadedBrokerTest(unittest.TestCase):
-    class MockTestRunner(object):
-        def __init__(self):
-            pass
-
-        def __del__(self):
-            pass
-
-        def update(self):
-            pass
-
-    def run_one_thread(self, msg):
-        runner = self.MockTestRunner()
-        port = None
-        options = mocktool.MockOptions(child_processes='1')
-        starting_queue = Queue.Queue()
-        stopping_queue = Queue.Queue()
-        broker = message_broker.MultiThreadedBroker(port, options)
-        broker._test_runner = runner
-        child_thread = TestThread(starting_queue, stopping_queue)
-        broker._workers['worker-0'] = message_broker._WorkerState('worker-0')
-        broker._workers['worker-0'].thread = child_thread
-        child_thread.start()
-        started_msg = starting_queue.get()
-        stopping_queue.put(msg)
-        res = broker.run_message_loop()
-        if msg == 'Timeout':
-            child_thread._timeout_queue.put('done')
-        child_thread.join(1.0)
-        self.assertFalse(child_thread.isAlive())
-        return res
-
-    def test_basic(self):
-        interrupted = self.run_one_thread('')
-        self.assertFalse(interrupted)
-
-    def test_interrupt(self):
-        self.assertRaises(KeyboardInterrupt, self.run_one_thread, 'KeyboardInterrupt')
-
-    def test_timeout(self):
-        # Because the timeout shows up as a wedged thread, this also tests
-        # log_wedged_worker().
-        oc = outputcapture.OutputCapture()
-        stdout, stderr = oc.capture_output()
-        logger = message_broker._log
-        astream = array_stream.ArrayStream()
-        handler = TestHandler(astream)
-        logger.addHandler(handler)
-        interrupted = self.run_one_thread('Timeout')
-        stdout, stderr = oc.restore_output()
-        self.assertFalse(interrupted)
-        logger.handlers.remove(handler)
-        self.assertTrue('All remaining threads are wedged, bailing out.' in astream.get())
-
-    def test_exception(self):
-        self.assertRaises(ValueError, self.run_one_thread, 'Exception')
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py
index a8c716f..c38cb8f 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/single_test_runner.py
@@ -82,7 +82,7 @@ class SingleTestRunner:
             # For example, if 'foo.html' has two expectation files, 'foo-expected.html' and
             # 'foo-expected.txt', we should warn users. One test file must be used exclusively
             # in either layout tests or reftests, but not in both.
-            for suffix in ['.txt', '.checksum', '.png']:
+            for suffix in ('.txt', '.checksum', '.png', '.wav'):
                 expected_filename = self._port.expected_filename(self._filename, suffix)
                 if fs.exists(expected_filename):
                     _log.error('The reftest (%s) can not have an expectation file (%s).'
@@ -91,7 +91,8 @@ class SingleTestRunner:
     def _expected_driver_output(self):
         return base.DriverOutput(self._port.expected_text(self._filename),
                                  self._port.expected_image(self._filename),
-                                 self._port.expected_checksum(self._filename))
+                                 self._port.expected_checksum(self._filename),
+                                 self._port.expected_audio(self._filename))
 
     def _should_fetch_expected_checksum(self):
         return (self._options.pixel_tests and
@@ -122,14 +123,14 @@ class SingleTestRunner:
         driver_output = self._driver.run_test(self._driver_input())
         expected_driver_output = self._expected_driver_output()
         test_result = self._compare_output(driver_output, expected_driver_output)
-        test_result_writer.write_test_result(self._port, self._options.results_directory, self._filename,
+        test_result_writer.write_test_result(self._port, self._filename,
                                              driver_output, expected_driver_output, test_result.failures)
         return test_result
 
     def _run_rebaseline(self):
         driver_output = self._driver.run_test(self._driver_input())
         failures = self._handle_error(driver_output)
-        test_result_writer.write_test_result(self._port, self._options.results_directory, self._filename,
+        test_result_writer.write_test_result(self._port, self._filename,
                                              driver_output, None, failures)
         # FIXME: It the test crashed or timed out, it might be bettter to avoid
         # to write new baselines.
@@ -142,6 +143,9 @@ class SingleTestRunner:
         # DumpRenderTree may not output utf-8 text (e.g. webarchives).
         self._save_baseline_data(driver_output.text, ".txt",
                                  generate_new_baseline=self._options.new_baseline)
+        if driver_output.audio:
+            self._save_baseline_data(driver_output.audio, '.wav',
+                                     generate_new_baseline=self._options.new_baseline)
         if self._options.pixel_tests and driver_output.image_hash:
             self._save_baseline_data(driver_output.image, ".png",
                                      generate_new_baseline=self._options.new_baseline)
@@ -190,7 +194,7 @@ class SingleTestRunner:
         failures = []
         fs = self._port._filesystem
         if driver_output.timeout:
-            failures.append(test_failures.FailureTimeout(reference_filename))
+            failures.append(test_failures.FailureTimeout(bool(reference_filename)))
 
         if reference_filename:
             testname = self._port.relative_test_filename(reference_filename)
@@ -198,7 +202,7 @@ class SingleTestRunner:
             testname = self._testname
 
         if driver_output.crash:
-            failures.append(test_failures.FailureCrash(reference_filename))
+            failures.append(test_failures.FailureCrash(bool(reference_filename)))
             _log.debug("%s Stacktrace for %s:\n%s" % (self._worker_name, testname,
                                                       driver_output.error))
         elif driver_output.error:
@@ -216,19 +220,28 @@ class SingleTestRunner:
             return TestResult(self._filename, failures, driver_output.test_time)
 
         failures.extend(self._compare_text(driver_output.text, expected_driver_output.text))
+        failures.extend(self._compare_audio(driver_output.audio, expected_driver_output.audio))
         if self._options.pixel_tests:
             failures.extend(self._compare_image(driver_output, expected_driver_output))
         return TestResult(self._filename, failures, driver_output.test_time)
 
     def _compare_text(self, actual_text, expected_text):
         failures = []
-        if self._port.compare_text(self._get_normalized_output_text(actual_text),
-                                   # Assuming expected_text is already normalized.
-                                   expected_text):
-            if expected_text == '':
-                failures.append(test_failures.FailureMissingResult())
-            else:
-                failures.append(test_failures.FailureTextMismatch())
+        if (expected_text and actual_text and
+            # Assuming expected_text is already normalized.
+            self._port.compare_text(self._get_normalized_output_text(actual_text), expected_text)):
+            failures.append(test_failures.FailureTextMismatch())
+        elif actual_text and not expected_text:
+            failures.append(test_failures.FailureMissingResult())
+        return failures
+
+    def _compare_audio(self, actual_audio, expected_audio):
+        failures = []
+        if (expected_audio and actual_audio and
+            self._port.compare_audio(actual_audio, expected_audio)):
+            failures.append(test_failures.FailureAudioMismatch())
+        elif actual_audio and not expected_audio:
+            failures.append(test_failures.FailureMissingAudio())
         return failures
 
     def _get_normalized_output_text(self, output):
@@ -259,7 +272,7 @@ class SingleTestRunner:
             base.DriverInput(self._reference_filename, self._timeout, driver_output1.image_hash))
         test_result = self._compare_output_with_reference(driver_output1, driver_output2)
 
-        test_result_writer.write_test_result(self._port, self._options.results_directory, self._filename,
+        test_result_writer.write_test_result(self._port, self._filename,
                                              driver_output1, driver_output2, test_result.failures)
         return test_result
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_expectations.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_expectations.py
index 132ccc2..a407ecc 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_expectations.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_expectations.py
@@ -41,8 +41,8 @@ _log = logging.getLogger("webkitpy.layout_tests.layout_package."
                          "test_expectations")
 
 # Test expectation and modifier constants.
-(PASS, FAIL, TEXT, IMAGE, IMAGE_PLUS_TEXT, TIMEOUT, CRASH, SKIP, WONTFIX,
- SLOW, REBASELINE, MISSING, FLAKY, NOW, NONE) = range(15)
+(PASS, FAIL, TEXT, IMAGE, IMAGE_PLUS_TEXT, AUDIO, TIMEOUT, CRASH, SKIP, WONTFIX,
+ SLOW, REBASELINE, MISSING, FLAKY, NOW, NONE) = range(16)
 
 # Test expectation file update action constants
 (NO_CHANGE, REMOVE_TEST, REMOVE_PLATFORM, ADD_PLATFORMS_EXCEPT_THIS) = range(4)
@@ -120,7 +120,8 @@ class TestExpectations:
                 self._expected_failures.get_test_set(REBASELINE, IMAGE) |
                 self._expected_failures.get_test_set(REBASELINE, TEXT) |
                 self._expected_failures.get_test_set(REBASELINE,
-                                                     IMAGE_PLUS_TEXT))
+                                                     IMAGE_PLUS_TEXT) |
+                self._expected_failures.get_test_set(REBASELINE, AUDIO))
 
     def get_options(self, test):
         return self._expected_failures.get_options(test)
@@ -166,9 +167,8 @@ class TestExpectations:
     def has_modifier(self, test, modifier):
         return self._expected_failures.has_modifier(test, modifier)
 
-    def remove_platform_from_expectations(self, tests, platform):
-        return self._expected_failures.remove_platform_from_expectations(
-            tests, platform)
+    def remove_rebaselined_tests(self, tests):
+        return self._expected_failures.remove_rebaselined_tests(tests)
 
 
 def strip_comments(line):
@@ -245,11 +245,11 @@ class TestExpectationsFile:
 
     Notes:
       -A test cannot be both SLOW and TIMEOUT
-      -A test should only be one of IMAGE, TEXT, IMAGE+TEXT, or FAIL. FAIL is
-       a migratory state that currently means either IMAGE, TEXT, or
-       IMAGE+TEXT. Once we have finished migrating the expectations, we will
-       change FAIL to have the meaning of IMAGE+TEXT and remove the IMAGE+TEXT
-       identifier.
+      -A test should only be one of IMAGE, TEXT, IMAGE+TEXT, AUDIO, or FAIL.
+       FAIL is a legacy value that currently means either IMAGE,
+       TEXT, or IMAGE+TEXT. Once we have finished migrating the expectations,
+       we should change FAIL to have the meaning of IMAGE+TEXT and remove the
+       IMAGE+TEXT identifier.
       -A test can be included twice, but not via the same path.
       -If a test is included twice, then the more precise path wins.
       -CRASH tests cannot be WONTFIX
@@ -260,6 +260,7 @@ class TestExpectationsFile:
                     'text': TEXT,
                     'image': IMAGE,
                     'image+text': IMAGE_PLUS_TEXT,
+                    'audio': AUDIO,
                     'timeout': TIMEOUT,
                     'crash': CRASH,
                     'missing': MISSING}
@@ -272,6 +273,7 @@ class TestExpectationsFile:
                                 IMAGE: ('image mismatch', 'image mismatch'),
                                 IMAGE_PLUS_TEXT: ('image and text mismatch',
                                                   'image and text mismatch'),
+                                AUDIO: ('audio mismatch', 'audio mismatch'),
                                 CRASH: ('DumpRenderTree crash',
                                         'DumpRenderTree crashes'),
                                 TIMEOUT: ('test timed out', 'tests timed out'),
@@ -279,7 +281,7 @@ class TestExpectationsFile:
                                           'no expected results found')}
 
     EXPECTATION_ORDER = (PASS, CRASH, TIMEOUT, MISSING, IMAGE_PLUS_TEXT,
-       TEXT, IMAGE, FAIL, SKIP)
+       TEXT, IMAGE, AUDIO, FAIL, SKIP)
 
     BUILD_TYPES = ('debug', 'release')
 
@@ -436,75 +438,14 @@ class TestExpectationsFile:
     def get_non_fatal_errors(self):
         return self._non_fatal_errors
 
-    def remove_platform_from_expectations(self, tests, platform):
-        """Returns a copy of the expectations with the tests matching the
-        platform removed.
-
-        If a test is in the test list and has an option that matches the given
-        platform, remove the matching platform and save the updated test back
-        to the file. If no other platforms remaining after removal, delete the
-        test from the file.
-
-        Args:
-          tests: list of tests that need to update..
-          platform: which platform option to remove.
-
-        Returns:
-          the updated string.
-        """
-
-        assert(platform)
-        f_orig = self._get_iterable_expectations(self._expectations)
-        f_new = []
-
-        tests_removed = 0
-        tests_updated = 0
-        lineno = 0
-        for line in f_orig:
-            lineno += 1
-            action = self._get_platform_update_action(line, lineno, tests,
-                                                      platform)
-            assert(action in (NO_CHANGE, REMOVE_TEST, REMOVE_PLATFORM,
-                              ADD_PLATFORMS_EXCEPT_THIS))
-            if action == NO_CHANGE:
-                # Save the original line back to the file
-                _log.debug('No change to test: %s', line)
-                f_new.append(line)
-            elif action == REMOVE_TEST:
-                tests_removed += 1
-                _log.info('Test removed: %s', line)
-            elif action == REMOVE_PLATFORM:
-                parts = line.split(':')
-                new_options = parts[0].replace(platform.upper() + ' ', '', 1)
-                new_line = ('%s:%s' % (new_options, parts[1]))
-                f_new.append(new_line)
-                tests_updated += 1
-                _log.info('Test updated: ')
-                _log.info('  old: %s', line)
-                _log.info('  new: %s', new_line)
-            elif action == ADD_PLATFORMS_EXCEPT_THIS:
-                parts = line.split(':')
-                _log.info('Test updated: ')
-                _log.info('  old: %s', line)
-                for p in self._port.test_platform_names():
-                    p = p.upper()
-                    # This is a temp solution for rebaselining tool.
-                    # Do not add tags WIN-7 and WIN-VISTA to test expectations
-                    # if the original line does not specify the platform
-                    # option.
-                    # TODO(victorw): Remove WIN-VISTA and WIN-WIN7 once we have
-                    # reliable Win 7 and Win Vista buildbots setup.
-                    if not p in (platform.upper(), 'WIN-VISTA', 'WIN-WIN7'):
-                        new_options = parts[0] + p + ' '
-                        new_line = ('%s:%s' % (new_options, parts[1]))
-                        f_new.append(new_line)
-                        _log.info('  new: %s', new_line)
-                tests_updated += 1
-
-        _log.info('Total tests removed: %d', tests_removed)
-        _log.info('Total tests updated: %d', tests_updated)
-
-        return "".join(f_new)
+    def remove_rebaselined_tests(self, tests):
+        """Returns a copy of the expectations with the tests removed."""
+        lines = []
+        for (lineno, line) in enumerate(self._get_iterable_expectations(self._expectations)):
+            test, options, _ = self.parse_expectations_line(line, lineno)
+            if not (test and test in tests and 'rebaseline' in options):
+                lines.append(line)
+        return ''.join(lines)
 
     def parse_expectations_line(self, line, lineno):
         """Parses a line from test_expectations.txt and returns a tuple
@@ -534,41 +475,6 @@ class TestExpectationsFile:
 
         return (test, options, expectations)
 
-    def _get_platform_update_action(self, line, lineno, tests, platform):
-        """Check the platform option and return the action needs to be taken.
-
-        Args:
-          line: current line in test expectations file.
-          lineno: current line number of line
-          tests: list of tests that need to update..
-          platform: which platform option to remove.
-
-        Returns:
-          NO_CHANGE: no change to the line (comments, test not in the list etc)
-          REMOVE_TEST: remove the test from file.
-          REMOVE_PLATFORM: remove this platform option from the test.
-          ADD_PLATFORMS_EXCEPT_THIS: add all the platforms except this one.
-        """
-        test, options, expectations = self.parse_expectations_line(line,
-                                                                   lineno)
-        if not test or test not in tests:
-            return NO_CHANGE
-
-        has_any_platform = False
-        for option in options:
-            if option in self._port.test_platform_names():
-                has_any_platform = True
-                if not option == platform:
-                    return REMOVE_PLATFORM
-
-        # If there is no platform specified, then it means apply to all
-        # platforms. Return the action to add all the platforms except this
-        # one.
-        if not has_any_platform:
-            return ADD_PLATFORMS_EXCEPT_THIS
-
-        return REMOVE_TEST
-
     def _add_to_all_expectations(self, test, options, expectations):
         # Make all paths unix-style so the dashboard doesn't need to.
         test = test.replace('\\', '/')
@@ -929,7 +835,7 @@ class ModifierMatcher(object):
         'mac-leopard': ['mac', 'leopard'],
         'win-xp': ['win', 'xp'],
         'win-vista': ['win', 'vista'],
-        'win-7': ['win', 'win7'],
+        'win-win7': ['win', 'win7'],
     }
 
     # We don't include the "none" modifier because it isn't actually legal.
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_expectations_unittest.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_expectations_unittest.py
index 05d805d..0833079 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_expectations_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_expectations_unittest.py
@@ -377,44 +377,23 @@ BUG_TEST WIN-XP : passes/text.html = TEXT
 
 class RebaseliningTest(Base):
     """Test rebaselining-specific functionality."""
-    def assertRemove(self, platform, input_expectations, expected_expectations):
+    def assertRemove(self, input_expectations, tests, expected_expectations):
         self.parse_exp(input_expectations)
-        test = self.get_test('failures/expected/text.html')
-        actual_expectations = self._exp.remove_platform_from_expectations(
-            test, platform)
+        actual_expectations = self._exp.remove_rebaselined_tests(tests)
         self.assertEqual(expected_expectations, actual_expectations)
 
+    def test_remove(self):
+        self.assertRemove('BUGX REBASELINE : failures/expected/text.html = TEXT\n'
+                          'BUGY : failures/expected/image.html = IMAGE\n'
+                          'BUGZ REBASELINE : failures/expected/crash.html = CRASH\n',
+                          ['failures/expected/text.html'],
+                          'BUGY : failures/expected/image.html = IMAGE\n'
+                          'BUGZ REBASELINE : failures/expected/crash.html = CRASH\n')
+
     def test_no_get_rebaselining_failures(self):
         self.parse_exp(self.get_basic_expectations())
         self.assertEqual(len(self._exp.get_rebaselining_failures()), 0)
 
-    def test_get_rebaselining_failures_expand(self):
-        self.parse_exp("""
-BUG_TEST REBASELINE : failures/expected/text.html = TEXT
-""")
-        self.assertEqual(len(self._exp.get_rebaselining_failures()), 1)
-
-    def test_remove_expand(self):
-        self.assertRemove('mac',
-            'BUGX REBASELINE : failures/expected/text.html = TEXT\n',
-            'BUGX REBASELINE WIN : failures/expected/text.html = TEXT\n'
-            'BUGX REBASELINE WIN-XP : failures/expected/text.html = TEXT\n')
-
-    def test_remove_mac_win(self):
-        self.assertRemove('mac',
-            'BUGX REBASELINE MAC WIN : failures/expected/text.html = TEXT\n',
-            'BUGX REBASELINE WIN : failures/expected/text.html = TEXT\n')
-
-    def test_remove_mac_mac(self):
-        self.assertRemove('mac',
-            'BUGX REBASELINE MAC : failures/expected/text.html = TEXT\n',
-            '')
-
-    def test_remove_nothing(self):
-        self.assertRemove('mac',
-            '\n\n',
-            '\n\n')
-
 
 class ModifierTests(unittest.TestCase):
     def setUp(self):
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures.py
index 1fad772..41f457c 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures.py
@@ -54,7 +54,8 @@ def determine_result_type(failure_list):
         return test_expectations.TIMEOUT
     elif (FailureMissingResult in failure_types or
           FailureMissingImage in failure_types or
-          FailureMissingImageHash in failure_types):
+          FailureMissingImageHash in failure_types or
+          FailureMissingAudio in failure_types):
         return test_expectations.MISSING
     else:
         is_text_failure = FailureTextMismatch in failure_types
@@ -62,12 +63,15 @@ def determine_result_type(failure_list):
                             FailureImageHashMismatch in failure_types)
         is_reftest_failure = (FailureReftestMismatch in failure_types or
                               FailureReftestMismatchDidNotOccur in failure_types)
+        is_audio_failure = (FailureAudioMismatch in failure_types)
         if is_text_failure and is_image_failure:
             return test_expectations.IMAGE_PLUS_TEXT
         elif is_text_failure:
             return test_expectations.TEXT
         elif is_image_failure or is_reftest_failure:
             return test_expectations.IMAGE
+        elif is_audio_failure:
+            return test_expectations.AUDIO
         else:
             raise ValueError("unclassifiable set of failures: "
                              + str(failure_types))
@@ -99,152 +103,56 @@ class TestFailure(object):
         """Returns the string/JSON representation of a TestFailure."""
         return cPickle.dumps(self)
 
-    def result_html_output(self, filename):
-        """Returns an HTML string to be included on the results.html page."""
-        raise NotImplementedError
-
     def should_kill_dump_render_tree(self):
         """Returns True if we should kill DumpRenderTree before the next
         test."""
         return False
 
-    def relative_output_filename(self, filename, modifier):
-        """Returns a relative filename inside the output dir that contains
-        modifier.
-
-        For example, if filename is fast\dom\foo.html and modifier is
-        "-expected.txt", the return value is fast\dom\foo-expected.txt
-
-        Args:
-          filename: relative filename to test file
-          modifier: a string to replace the extension of filename with
-
-        Return:
-          The relative windows path to the output filename
-        """
-        # FIXME: technically this breaks if files don't use ".ext" to indicate
-        # the extension, but passing in a Filesystem object here is a huge
-        # hassle.
-        return filename[:filename.rfind('.')] + modifier
-
-
-class ComparisonTestFailure(TestFailure):
-    """Base class that produces standard HTML output based on the result of the comparison test.
-
-    Subclasses may commonly choose to override the ResultHtmlOutput, but still
-    use the standard OutputLinks.
-    """
-
-    # Filename suffixes used by ResultHtmlOutput.
-    OUT_FILENAMES = ()
-
-    def output_links(self, filename, out_names):
-        """Returns a string holding all applicable output file links.
-
-        Args:
-          filename: the test filename, used to construct the result file names
-          out_names: list of filename suffixes for the files. If three or more
-              suffixes are in the list, they should be [actual, expected, diff,
-              wdiff]. Two suffixes should be [actual, expected], and a
-              single item is the [actual] filename suffix.
-              If out_names is empty, returns the empty string.
-        """
-        # FIXME: Seems like a bad idea to separate the display name data
-        # from the path data by hard-coding the display name here
-        # and passing in the path information via out_names.
-        #
-        # FIXME: Also, we don't know for sure that these files exist,
-        # and we shouldn't be creating links to files that don't exist
-        # (for example, if we don't actually have wdiff output).
-        links = ['']
-        uris = [self.relative_output_filename(filename, fn) for
-                fn in out_names]
-        if len(uris) > 1:
-            links.append("<a href='%s'>expected</a>" % uris[1])
-        if len(uris) > 0:
-            links.append("<a href='%s'>actual</a>" % uris[0])
-        if len(uris) > 2:
-            links.append("<a href='%s'>diff</a>" % uris[2])
-        if len(uris) > 3:
-            links.append("<a href='%s'>wdiff</a>" % uris[3])
-        if len(uris) > 4:
-            links.append("<a href='%s'>pretty diff</a>" % uris[4])
-        return ' '.join(links)
-
-    def result_html_output(self, filename):
-        return self.message() + self.output_links(filename, self.OUT_FILENAMES)
-
 
 class FailureTimeout(TestFailure):
     """Test timed out.  We also want to restart DumpRenderTree if this
     happens."""
-
-    def __init__(self, reference_filename=None):
-        self.reference_filename = reference_filename
+    def __init__(self, is_reftest=False):
+        self.is_reftest = is_reftest
 
     @staticmethod
     def message():
         return "Test timed out"
 
-    def result_html_output(self, filename):
-        if self.reference_filename:
-            return "<strong>%s</strong> (occured in <a href=%s>expected html</a>)" % (
-                self.message(), self.reference_filename)
-        return "<strong>%s</strong>" % self.message()
-
     def should_kill_dump_render_tree(self):
         return True
 
 
 class FailureCrash(TestFailure):
     """DumpRenderTree crashed."""
-
-    def __init__(self, reference_filename=None):
-        self.reference_filename = reference_filename
+    def __init__(self, is_reftest=False):
+        self.is_reftest = is_reftest
 
     @staticmethod
     def message():
         return "DumpRenderTree crashed"
 
-    def result_html_output(self, filename):
-        # FIXME: create a link to the minidump file
-        stack = self.relative_output_filename(filename, "-stack.txt")
-        if self.reference_filename:
-            return "<strong>%s</strong> <a href=%s>stack</a> (occured in <a href=%s>expected html</a>)" % (
-                self.message(), stack, self.reference_filename)
-        else:
-            return "<strong>%s</strong> <a href=%s>stack</a>" % (self.message(), stack)
-
     def should_kill_dump_render_tree(self):
         return True
 
 
-class FailureMissingResult(ComparisonTestFailure):
+class FailureMissingResult(TestFailure):
     """Expected result was missing."""
-    OUT_FILENAMES = ("-actual.txt",)
 
     @staticmethod
     def message():
         return "No expected results found"
 
-    def result_html_output(self, filename):
-        return ("<strong>%s</strong>" % self.message() +
-                self.output_links(filename, self.OUT_FILENAMES))
-
 
-class FailureTextMismatch(ComparisonTestFailure):
+class FailureTextMismatch(TestFailure):
     """Text diff output failed."""
-    # Filename suffixes used by ResultHtmlOutput.
-    # FIXME: Why don't we use the constants from TestTypeBase here?
-    OUT_FILENAMES = ("-actual.txt", "-expected.txt", "-diff.txt",
-                     "-wdiff.html", "-pretty-diff.html")
 
     @staticmethod
     def message():
         return "Text diff mismatch"
 
 
-class FailureMissingImageHash(ComparisonTestFailure):
+class FailureMissingImageHash(TestFailure):
     """Actual result hash was missing."""
     # Chrome doesn't know to display a .checksum file as text, so don't bother
     # putting in a link to the actual result.
@@ -253,26 +161,17 @@ class FailureMissingImageHash(ComparisonTestFailure):
     def message():
         return "No expected image hash found"
 
-    def result_html_output(self, filename):
-        return "<strong>%s</strong>" % self.message()
-
 
-class FailureMissingImage(ComparisonTestFailure):
+class FailureMissingImage(TestFailure):
     """Actual result image was missing."""
-    OUT_FILENAMES = ("-actual.png",)
 
     @staticmethod
     def message():
         return "No expected image found"
 
-    def result_html_output(self, filename):
-        return ("<strong>%s</strong>" % self.message() +
-                self.output_links(filename, self.OUT_FILENAMES))
 
-
-class FailureImageHashMismatch(ComparisonTestFailure):
+class FailureImageHashMismatch(TestFailure):
     """Image hashes didn't match."""
-    OUT_FILENAMES = ("-actual.png", "-expected.png", "-diff.png")
 
     @staticmethod
     def message():
@@ -281,7 +180,7 @@ class FailureImageHashMismatch(ComparisonTestFailure):
         return "Image mismatch"
 
 
-class FailureImageHashIncorrect(ComparisonTestFailure):
+class FailureImageHashIncorrect(TestFailure):
     """Actual result hash is incorrect."""
     # Chrome doesn't know to display a .checksum file as text, so don't bother
     # putting in a link to the actual result.
@@ -290,45 +189,37 @@ class FailureImageHashIncorrect(ComparisonTestFailure):
     def message():
         return "Images match, expected image hash incorrect. "
 
-    def result_html_output(self, filename):
-        return "<strong>%s</strong>" % self.message()
-
 
-class FailureReftestMismatch(ComparisonTestFailure):
+class FailureReftestMismatch(TestFailure):
     """The result didn't match the reference rendering."""
 
-    OUT_FILENAMES = ("-expected.html", "-expected.png", "-actual.png",
-                     "-diff.png",)
-
     @staticmethod
     def message():
         return "Mismatch with reference"
 
-    def output_links(self, filename, out_names):
-        links = ['']
-        uris = [self.relative_output_filename(filename, output_filename)
-                for output_filename in out_names]
-        for text, uri in zip(['-expected.html', 'expected', 'actual', 'diff'], uris):
-            links.append("<a href='%s'>%s</a>" % (uri, text))
-        return ' '.join(links)
 
-
-class FailureReftestMismatchDidNotOccur(ComparisonTestFailure):
+class FailureReftestMismatchDidNotOccur(TestFailure):
     """Unexpected match between the result and the reference rendering."""
 
-    OUT_FILENAMES = ("-expected-mismatch.html", "-actual.png",)
-
     @staticmethod
     def message():
         return "Mismatch with the reference did not occur"
 
-    def output_links(self, filename, out_names):
-        links = ['']
-        uris = [self.relative_output_filename(filename, output_filename)
-                for output_filename in out_names]
-        for text, uri in zip(['-expected-mismatch.html', 'image'], uris):
-            links.append("<a href='%s'>%s</a>" % (uri, text))
-        return ' '.join(links)
+
+class FailureMissingAudio(TestFailure):
+    """Actual result image was missing."""
+
+    @staticmethod
+    def message():
+        return "No expected audio found"
+
+
+class FailureAudioMismatch(TestFailure):
+    """Audio files didn't match."""
+
+    @staticmethod
+    def message():
+        return "Audio mismatch"
 
 
 # Convenient collection of all failure classes for anything that might
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures_unittest.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures_unittest.py
index c5aa2d6..9b0576e 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_failures_unittest.py
@@ -34,9 +34,6 @@ from webkitpy.layout_tests.layout_package.test_failures import *
 
 
 class Test(unittest.TestCase):
-    def assertResultHtml(self, failure_obj):
-        self.assertNotEqual(failure_obj.result_html_output('foo'), None)
-
     def assert_loads(self, cls):
         failure_obj = cls()
         s = failure_obj.dumps()
@@ -49,22 +46,22 @@ class Test(unittest.TestCase):
         self.assertFalse(failure_obj != new_failure_obj)
 
     def test_crash(self):
-        self.assertResultHtml(FailureCrash())
+        FailureCrash()
 
     def test_hash_incorrect(self):
-        self.assertResultHtml(FailureImageHashIncorrect())
+        FailureImageHashIncorrect()
 
     def test_missing(self):
-        self.assertResultHtml(FailureMissingResult())
+        FailureMissingResult()
 
     def test_missing_image(self):
-        self.assertResultHtml(FailureMissingImage())
+        FailureMissingImage()
 
     def test_missing_image_hash(self):
-        self.assertResultHtml(FailureMissingImageHash())
+        FailureMissingImageHash()
 
     def test_timeout(self):
-        self.assertResultHtml(FailureTimeout())
+        FailureTimeout()
 
     def test_unknown_failure_type(self):
         class UnknownFailure(TestFailure):
@@ -73,8 +70,6 @@ class Test(unittest.TestCase):
         failure_obj = UnknownFailure()
         self.assertRaises(ValueError, determine_result_type, [failure_obj])
         self.assertRaises(NotImplementedError, failure_obj.message)
-        self.assertRaises(NotImplementedError, failure_obj.result_html_output,
-                          "foo.txt")
 
     def test_loads(self):
         for c in ALL_FAILURE_CLASSES:
@@ -89,12 +84,5 @@ class Test(unittest.TestCase):
         crash_set = set([FailureCrash(), "FailureCrash"])
         self.assertEqual(len(crash_set), 2)
 
-    def test_relative_output_filename(self):
-        # This could be any Failure* object, since we're testing a method
-        # on the base class.
-        failure_obj = FailureTextMismatch()
-        actual_filename = failure_obj.relative_output_filename("fast/html/article-element.html", "-actual.txt")
-        self.assertEquals(actual_filename, "fast/html/article-element-actual.txt")
-
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py
index e209503..07e6389 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_result_writer.py
@@ -36,12 +36,16 @@ from webkitpy.layout_tests.layout_package import test_failures
 _log = logging.getLogger(__name__)
 
 
-def write_test_result(port, root_output_dir, filename, driver_output,
+def write_test_result(port, filename, driver_output,
                       expected_driver_output, failures):
     """Write the test result to the result output directory."""
+    root_output_dir = port.results_directory()
     checksums_mismatch_but_images_are_same = False
     imagehash_mismatch_failure = None
     writer = TestResultWriter(port, root_output_dir, filename)
+    if driver_output.error:
+        writer.write_stderr(driver_output.error)
+
     for failure in failures:
         # FIXME: Instead of this long 'if' block, each failure class might
         # have a responsibility for writing a test result.
@@ -63,8 +67,11 @@ def write_test_result(port, root_output_dir, filename, driver_output,
             if not images_are_different:
                 checksums_mismatch_but_images_are_same = True
                 imagehash_mismatch_failure = failure
+        elif isinstance(failure, (test_failures.FailureAudioMismatch,
+                                  test_failures.FailureMissingAudio)):
+            writer.write_audio_files(driver_output.audio, expected_driver_output.audio)
         elif isinstance(failure, test_failures.FailureCrash):
-            if failure.reference_filename:
+            if failure.is_reftest:
                 writer.write_crash_report(expected_driver_output.error)
             else:
                 writer.write_crash_report(driver_output.error)
@@ -150,6 +157,12 @@ class TestResultWriter(object):
         if expected is not None:
             fs.write_binary_file(expected_filename, expected)
 
+    def write_stderr(self, error):
+        fs = self._port._filesystem
+        filename = self.output_filename("-stderr.txt")
+        fs.maybe_make_directory(fs.dirname(filename))
+        fs.write_text_file(filename, error)
+
     def write_crash_report(self, error):
         """Write crash information."""
         fs = self._port._filesystem
@@ -187,6 +200,9 @@ class TestResultWriter(object):
         pretty_patch_filename = self.output_filename(self.FILENAME_SUFFIX_PRETTY_PATCH)
         fs.write_binary_file(pretty_patch_filename, pretty_patch)
 
+    def write_audio_files(self, actual_audio, expected_audio):
+        self.write_output_files('.wav', actual_audio, expected_audio)
+
     def write_image_files(self, actual_image, expected_image):
         self.write_output_files('.png', actual_image, expected_image)
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner.py
index 569dd51..8e534b1 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner.py
@@ -46,10 +46,8 @@ import random
 import sys
 import time
 
-from webkitpy.layout_tests.layout_package import dump_render_tree_thread
 from webkitpy.layout_tests.layout_package import json_layout_results_generator
 from webkitpy.layout_tests.layout_package import json_results_generator
-from webkitpy.layout_tests.layout_package import message_broker
 from webkitpy.layout_tests.layout_package import printing
 from webkitpy.layout_tests.layout_package import test_expectations
 from webkitpy.layout_tests.layout_package import test_failures
@@ -145,6 +143,29 @@ def summarize_results(port_obj, expectations, result_summary, retry_summary, tes
         tests[test] = {}
         tests[test]['expected'] = expected
         tests[test]['actual'] = " ".join(actual)
+        # FIXME: Set this correctly once https://webkit.org/b/37739 is fixed
+        # and only set it if there actually is stderr data.
+        tests[test]['has_stderr'] = False
+
+        failure_types = [type(f) for f in result.failures]
+        if test_failures.FailureMissingAudio in failure_types:
+            tests[test]['is_missing_audio'] = True
+
+        if test_failures.FailureReftestMismatch in failure_types:
+            tests[test]['is_reftest'] = True
+
+        for f in result.failures:
+            if 'is_reftest' in result.failures:
+                tests[test]['is_reftest'] = True
+
+        if test_failures.FailureReftestMismatchDidNotOccur in failure_types:
+            tests[test]['is_mismatch_reftest'] = True
+
+        if test_failures.FailureMissingResult in failure_types:
+            tests[test]['is_missing_text'] = True
+
+        if test_failures.FailureMissingImage in failure_types or test_failures.FailureMissingImageHash in failure_types:
+            tests[test]['is_missing_image'] = True
 
         if filename in test_timings_map:
             time_seconds = test_timings_map[filename]
@@ -154,6 +175,12 @@ def summarize_results(port_obj, expectations, result_summary, retry_summary, tes
     results['num_passes'] = num_passes
     results['num_flaky'] = num_flaky
     results['num_regressions'] = num_regressions
+    # FIXME: If non-chromium ports start using an expectations file,
+    # we should make this check more robust.
+    results['uses_expectations_file'] = port_obj.name().find('chromium') != -1
+    results['layout_tests_dir'] = port_obj.layout_tests_dir()
+    results['has_wdiff'] = port_obj.wdiff_available()
+    results['has_pretty_patch'] = port_obj.pretty_patch_available()
 
     return results
 
@@ -205,6 +232,7 @@ class TestRunner:
         self._test_files_list = None
         self._result_queue = Queue.Queue()
         self._retrying = False
+        self._results_directory = self._port.results_directory()
 
     def collect_tests(self, args, last_unexpected_results):
         """Find all the files to test.
@@ -355,8 +383,7 @@ class TestRunner:
                 self._printer.print_expected(extra_msg)
                 tests_run_msg += "\n" + extra_msg
                 files.extend(test_files[0:extra])
-            tests_run_filename = self._fs.join(self._options.results_directory,
-                                              "tests_run.txt")
+            tests_run_filename = self._fs.join(self._results_directory, "tests_run.txt")
             self._fs.write_text_file(tests_run_filename, tests_run_msg)
 
             len_skip_chunk = int(len(files) * len(skipped) /
@@ -513,8 +540,16 @@ class TestRunner:
                 return True
         return False
 
-    def _num_workers(self):
-        return int(self._options.child_processes)
+    def _num_workers(self, num_shards):
+        num_workers = min(int(self._options.child_processes), num_shards)
+        driver_name = self._port.driver_name()
+        if num_workers == 1:
+            self._printer.print_config("Running 1 %s over %s" %
+                (driver_name, grammar.pluralize('shard', num_shards)))
+        else:
+            self._printer.print_config("Running %d %ss in parallel over %d shards" %
+                (num_workers, driver_name, num_shards))
+        return num_workers
 
     def _run_tests(self, file_list, result_summary):
         """Runs the tests in the file_list.
@@ -532,54 +567,7 @@ class TestRunner:
               in the form {filename:filename, test_run_time:test_run_time}
             result_summary: summary object to populate with the results
         """
-
-        self._printer.print_update('Sharding tests ...')
-        num_workers = self._num_workers()
-        test_lists = self._shard_tests(file_list,
-            num_workers > 1 and not self._options.experimental_fully_parallel)
-        filename_queue = Queue.Queue()
-        for item in test_lists:
-            filename_queue.put(item)
-
-        self._printer.print_update('Starting %s ...' %
-                                   grammar.pluralize('worker', num_workers))
-        self._message_broker = message_broker.get(self._port, self._options)
-        broker = self._message_broker
-        self._current_filename_queue = filename_queue
-        self._current_result_summary = result_summary
-
-        if not self._options.dry_run:
-            threads = broker.start_workers(self)
-        else:
-            threads = {}
-
-        self._printer.print_update("Starting testing ...")
-        keyboard_interrupted = False
-        interrupted = False
-        if not self._options.dry_run:
-            try:
-                broker.run_message_loop()
-            except KeyboardInterrupt:
-                _log.info("Interrupted, exiting")
-                broker.cancel_workers()
-                keyboard_interrupted = True
-                interrupted = True
-            except TestRunInterruptedException, e:
-                _log.info(e.reason)
-                broker.cancel_workers()
-                interrupted = True
-            except:
-                # Unexpected exception; don't try to clean up workers.
-                _log.info("Exception raised, exiting")
-                raise
-
-        thread_timings, test_timings, individual_test_timings = \
-            self._collect_timing_info(threads)
-
-        broker.cleanup()
-        self._message_broker = None
-        return (interrupted, keyboard_interrupted, thread_timings, test_timings,
-                individual_test_timings)
+        raise NotImplementedError()
 
     def update(self):
         self.update_summary(self._current_result_summary)
@@ -629,7 +617,7 @@ class TestRunner:
             self._clobber_old_results()
 
         # Create the output directory if it doesn't already exist.
-        self._port.maybe_make_directory(self._options.results_directory)
+        self._port.maybe_make_directory(self._results_directory)
 
         self._port.setup_test_run()
 
@@ -711,9 +699,9 @@ class TestRunner:
 
         # Write the summary to disk (results.html) and display it if requested.
         if not self._options.dry_run:
-            wrote_results = self._write_results_html_file(result_summary)
-            if self._options.show_results and wrote_results:
-                self._show_results_html_file()
+            self._copy_results_html_file()
+            if self._options.show_results:
+                self._show_results_html_file(result_summary)
 
         # Now that we've completed all the processing we can, we re-raise
         # a KeyboardInterrupt if necessary so the caller can handle it.
@@ -773,13 +761,12 @@ class TestRunner:
         # files in the results directory are explicitly used for cross-run
         # tracking.
         self._printer.print_update("Clobbering old results in %s" %
-                                   self._options.results_directory)
+                                   self._results_directory)
         layout_tests_dir = self._port.layout_tests_dir()
         possible_dirs = self._port.test_dirs()
         for dirname in possible_dirs:
             if self._fs.isdir(self._fs.join(layout_tests_dir, dirname)):
-                self._fs.rmtree(self._fs.join(self._options.results_directory,
-                                              dirname))
+                self._fs.rmtree(self._fs.join(self._results_directory, dirname))
 
     def _get_failures(self, result_summary, include_crashes):
         """Filters a dict of results and returns only the failures.
@@ -829,17 +816,17 @@ class TestRunner:
           individual_test_timings: list of test times (used by the flakiness
             dashboard).
         """
-        _log.debug("Writing JSON files in %s." % self._options.results_directory)
+        _log.debug("Writing JSON files in %s." % self._results_directory)
 
-        unexpected_json_path = self._fs.join(self._options.results_directory, "unexpected_results.json")
+        unexpected_json_path = self._fs.join(self._results_directory, "unexpected_results.json")
         json_results_generator.write_json(self._fs, unexpected_results, unexpected_json_path)
 
-        full_results_path = self._fs.join(self._options.results_directory, "full_results.json")
+        full_results_path = self._fs.join(self._results_directory, "full_results.json")
         json_results_generator.write_json(self._fs, summarized_results, full_results_path)
 
         # Write a json file of the test_expectations.txt file for the layout
         # tests dashboard.
-        expectations_path = self._fs.join(self._options.results_directory, "expectations.json")
+        expectations_path = self._fs.join(self._results_directory, "expectations.json")
         expectations_json = \
             self._expectations.get_expectations_json_for_all_platforms()
         self._fs.write_text_file(expectations_path,
@@ -847,7 +834,7 @@ class TestRunner:
 
         generator = json_layout_results_generator.JSONLayoutResultsGenerator(
             self._port, self._options.builder_name, self._options.build_name,
-            self._options.build_number, self._options.results_directory,
+            self._options.build_number, self._results_directory,
             BUILDER_BASE_URL, individual_test_timings,
             self._expectations, result_summary, self._test_files_list,
             self._options.test_results_server,
@@ -865,8 +852,7 @@ class TestRunner:
         p = self._printer
         p.print_config("Using port '%s'" % self._port.name())
         p.print_config("Test configuration: %s" % self._port.test_configuration())
-        p.print_config("Placing test results in %s" %
-                       self._options.results_directory)
+        p.print_config("Placing test results in %s" % self._results_directory)
         if self._options.new_baseline:
             p.print_config("Placing new baselines in %s" %
                            self._port.baseline_path())
@@ -880,12 +866,6 @@ class TestRunner:
                        (self._options.time_out_ms,
                         self._options.slow_time_out_ms))
 
-        if self._num_workers() == 1:
-            p.print_config("Running one %s" % self._port.driver_name())
-        else:
-            p.print_config("Running %s %ss in parallel" %
-                           (self._options.child_processes,
-                            self._port.driver_name()))
         p.print_config('Command line: ' +
                        ' '.join(self._port.driver_cmd_line()))
         p.print_config("Worker model: %s" % self._options.worker_model)
@@ -1136,67 +1116,25 @@ class TestRunner:
                 self._printer.print_actual("  %5d %-24s (%4.1f%%)" %
                     (len(results), desc[len(results) != 1], pct))
 
-    def _results_html(self, test_files, failures, title="Test Failures", override_time=None):
-        """
-        test_files = a list of file paths
-        failures = dictionary mapping test paths to failure objects
-        title = title printed at top of test
-        override_time = current time (used by unit tests)
-        """
-        page = """<html>
-  <head>
-    <title>Layout Test Results (%(time)s)</title>
-  </head>
-  <body>
-    <h2>%(title)s (%(time)s)</h2>
-        """ % {'title': title, 'time': override_time or time.asctime()}
-
-        for test_file in sorted(test_files):
-            test_name = self._port.relative_test_filename(test_file)
-            test_url = self._port.filename_to_uri(test_file)
-            page += u"<p><a href='%s'>%s</a><br />\n" % (test_url, test_name)
-            test_failures = failures.get(test_file, [])
-            for failure in test_failures:
-                page += (u"&nbsp;&nbsp;%s<br/>" %
-                         failure.result_html_output(test_name))
-            page += "</p>\n"
-        page += "</body></html>\n"
-        return page
-
-    def _write_results_html_file(self, result_summary):
-        """Write results.html which is a summary of tests that failed.
-
-        Args:
-          result_summary: a summary of the results :)
+    def _copy_results_html_file(self):
+        base_dir = self._port.path_from_webkit_base('Tools', 'Scripts', 'webkitpy', 'layout_tests', 'layout_package')
+        results_file = self._fs.join(base_dir, 'json_results.html')
+        # FIXME: What should we do if this doesn't exist (e.g., in unit tests)?
+        if self._fs.exists(results_file):
+            self._fs.copyfile(results_file, self._fs.join(self._results_directory, "results.html"))
 
-        Returns:
-          True if any results were written (since expected failures may be
-          omitted)
-        """
-        # test failures
+    def _show_results_html_file(self, result_summary):
+        """Shows the results.html page."""
         if self._options.full_results_html:
-            results_title = "Test Failures"
             test_files = result_summary.failures.keys()
         else:
-            results_title = "Unexpected Test Failures"
-            unexpected_failures = self._get_failures(result_summary,
-                include_crashes=True)
+            unexpected_failures = self._get_failures(result_summary, include_crashes=True)
             test_files = unexpected_failures.keys()
-        if not len(test_files):
-            return False
-
-        out_filename = self._fs.join(self._options.results_directory,
-                                     "results.html")
-        with self._fs.open_text_file_for_writing(out_filename) as results_file:
-            html = self._results_html(test_files, result_summary.failures, results_title)
-            results_file.write(html)
 
-        return True
+        if not len(test_files):
+            return
 
-    def _show_results_html_file(self):
-        """Shows the results.html page."""
-        results_filename = self._fs.join(self._options.results_directory,
-                                         "results.html")
+        results_filename = self._fs.join(self._results_directory, "results.html")
         self._port.show_results_html_file(results_filename)
 
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner2.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner2.py
index 5a6344c..8c19bfe 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner2.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner2.py
@@ -117,15 +117,15 @@ class TestRunner2(test_runner.TestRunner):
         self._group_stats = {}
         self._worker_states = {}
 
-        num_workers = self._num_workers()
         keyboard_interrupted = False
         interrupted = False
         thread_timings = []
 
         self._printer.print_update('Sharding tests ...')
         test_lists = self._shard_tests(file_list,
-            num_workers > 1 and not self._options.experimental_fully_parallel)
-        _log.debug("Using %d shards" % len(test_lists))
+            (int(self._options.child_processes) > 1) and not self._options.experimental_fully_parallel)
+
+        num_workers = self._num_workers(len(test_lists))
 
         manager_connection = manager_worker_broker.get(self._port, self._options,
                                                        self, worker.Worker)
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner_unittest.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner_unittest.py
index 97f8630..82564d2 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/test_runner_unittest.py
@@ -44,27 +44,6 @@ class TestRunnerWrapper(test_runner.TestRunner):
 
 
 class TestRunnerTest(unittest.TestCase):
-    def test_results_html(self):
-        mock_port = Mock()
-        mock_port._filesystem = filesystem_mock.MockFileSystem()
-        mock_port.relative_test_filename = lambda name: name
-        mock_port.filename_to_uri = lambda name: name
-
-        runner = test_runner.TestRunner(port=mock_port, options=Mock(),
-            printer=Mock())
-        expected_html = u"""<html>
-  <head>
-    <title>Layout Test Results (time)</title>
-  </head>
-  <body>
-    <h2>Title (time)</h2>
-        <p><a href='test_path'>test_path</a><br />
-</p>
-</body></html>
-"""
-        html = runner._results_html(["test_path"], {}, "Title", override_time="time")
-        self.assertEqual(html, expected_html)
-
     def test_shard_tests(self):
         # Test that _shard_tests in test_runner.TestRunner really
         # put the http tests first in the queue.
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/worker_mixin.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/worker_mixin.py
index 7876f91..78d7cdb 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/worker_mixin.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/worker_mixin.py
@@ -55,7 +55,7 @@ class WorkerMixin(object):
         self._batch_count = 0
         self._batch_size = self._options.batch_size
         self._driver = None
-        tests_run_filename = self._filesystem.join(self._options.results_directory,
+        tests_run_filename = self._filesystem.join(port.results_directory(),
                                                    "tests_run%d.txt" % self._worker_number)
         self._tests_run_file = self._filesystem.open_text_file_for_writing(tests_run_filename)
 
@@ -159,18 +159,18 @@ class WorkerMixin(object):
           A TestResult
         """
         worker = self
-        result = None
 
         driver = worker._port.create_driver(worker._worker_number)
         driver.start()
 
         class SingleTestThread(threading.Thread):
             def run(self):
-                result = worker._run_single_test(driver, test_input)
+                self.result = worker._run_single_test(driver, test_input)
 
         thread = SingleTestThread()
         thread.start()
         thread.join(thread_timeout_sec)
+        result = getattr(thread, 'result', None)
         if thread.isAlive():
             # If join() returned with the thread still running, the
             # DumpRenderTree is completely hung and there's nothing
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base.py b/Tools/Scripts/webkitpy/layout_tests/port/base.py
index dea126f..c2e565e 100644..100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/base.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base.py
@@ -90,18 +90,24 @@ class Port(object):
                  config=None,
                  **kwargs):
         self._name = port_name
+
+        # These are default values that should be overridden in a subclasses.
+        # FIXME: These should really be passed in.
+        self._operating_system = 'mac'
+        self._version = ''
         self._architecture = 'x86'
-        self._options = options
-        if self._options is None:
-            # FIXME: Ideally we'd have a package-wide way to get a
-            # well-formed options object that had all of the necessary
-            # options defined on it.
-            self._options = DummyOptions()
+        self._graphics_type = 'cpu'
+
+        # FIXME: Ideally we'd have a package-wide way to get a
+        # well-formed options object that had all of the necessary
+        # options defined on it.
+        self._options = options or DummyOptions()
+
         self._executive = executive or Executive()
         self._user = user or User()
         self._filesystem = filesystem or system.filesystem.FileSystem()
-        self._config = config or port_config.Config(self._executive,
-                                                    self._filesystem)
+        self._config = config or port_config.Config(self._executive, self._filesystem)
+
         self._helper = None
         self._http_server = None
         self._webkit_base_dir = None
@@ -123,16 +129,22 @@ class Port(object):
         # http://bugs.python.org/issue3210
         self._wdiff_available = True
 
+        # FIXME: prettypatch.py knows this path, why is it copied here?
         self._pretty_patch_path = self.path_from_webkit_base("Websites",
             "bugs.webkit.org", "PrettyPatch", "prettify.rb")
-        # If we're running on a mocked-out filesystem, this file almost
-        # certainly won't be available, so it's a good test to keep us
-        # from erroring out later.
-        self._pretty_patch_available = self._filesystem.exists(self._pretty_patch_path)
+        self._pretty_patch_available = None
+
         if not hasattr(self._options, 'configuration') or self._options.configuration is None:
             self._options.configuration = self.default_configuration()
         self._test_configuration = None
         self._multiprocessing_is_available = (multiprocessing is not None)
+        self._results_directory = None
+
+    def wdiff_available(self):
+        return bool(self._wdiff_available)
+
+    def pretty_patch_available(self):
+        return bool(self._pretty_patch_available)
 
     def default_child_processes(self):
         """Return the number of DumpRenderTree instances to use for this
@@ -171,23 +183,22 @@ class Port(object):
         """This routine is used to check whether image_diff binary exists."""
         raise NotImplementedError('Port.check_image_diff')
 
-    def check_pretty_patch(self):
+    def check_pretty_patch(self, logging=True):
         """Checks whether we can use the PrettyPatch ruby script."""
-
         # check if Ruby is installed
         try:
             result = self._executive.run_command(['ruby', '--version'])
         except OSError, e:
             if e.errno in [errno.ENOENT, errno.EACCES, errno.ECHILD]:
-                _log.error("Ruby is not installed; "
-                           "can't generate pretty patches.")
-                _log.error('')
+                if logging:
+                    _log.error("Ruby is not installed; can't generate pretty patches.")
+                    _log.error('')
                 return False
 
         if not self.path_exists(self._pretty_patch_path):
-            _log.error('Unable to find %s .' % self._pretty_patch_path)
-            _log.error("Can't generate pretty patches.")
-            _log.error('')
+            if logging:
+                _log.error("Unable to find %s; can't generate pretty patches." % self._pretty_patch_path)
+                _log.error('')
             return False
 
         return True
@@ -200,6 +211,10 @@ class Port(object):
         interface so that it can be overriden for testing purposes."""
         return expected_text != actual_text
 
+    def compare_audio(self, expected_audio, actual_audio):
+        """Return whether the two audio files are *not* equal."""
+        return expected_audio != actual_audio
+
     def diff_image(self, expected_contents, actual_contents,
                    diff_filename=None, tolerance=0):
         """Compare two images and produce a delta image file.
@@ -276,7 +291,7 @@ class Port(object):
 
         baseline_filename = testname + '-expected' + suffix
 
-        baseline_search_path = self.baseline_search_path()
+        baseline_search_path = self.get_option('additional_platform_directory', []) + self.baseline_search_path()
 
         baselines = []
         for platform_dir in baseline_search_path:
@@ -345,15 +360,22 @@ class Port(object):
             return None
         return self._filesystem.read_binary_file(path)
 
+    def expected_audio(self, test):
+        path = self.expected_filename(test, '.wav')
+        if not self.path_exists(path):
+            return None
+        return self._filesystem.read_binary_file(path)
+
     def expected_text(self, test):
-        """Returns the text output we expect the test to produce.
+        """Returns the text output we expect the test to produce, or None
+        if we don't expect there to be any text output.
         End-of-line characters are normalized to '\n'."""
         # FIXME: DRT output is actually utf-8, but since we don't decode the
         # output from DRT (instead treating it as a binary string), we read the
         # baselines as a binary string, too.
         path = self.expected_filename(test, '.txt')
         if not self.path_exists(path):
-            return ''
+            return None
         text = self._filesystem.read_binary_file(path)
         return text.replace("\r\n", "\n")
 
@@ -481,16 +503,27 @@ class Port(object):
         self._filesystem.maybe_make_directory(*path)
 
     def name(self):
-        """Return the name of the port (e.g., 'mac', 'chromium-win-xp').
-
-        Note that this is different from the test_platform_name(), which
-        may be different (e.g., 'win-xp' instead of 'chromium-win-xp'."""
+        """Return the name of the port (e.g., 'mac', 'chromium-win-xp')."""
         return self._name
 
+    def operating_system(self):
+        return self._operating_system
+
+    def version(self):
+        """Returns a string indicating the version of a given platform, e.g.
+        'leopard' or 'xp'.
+
+        This is used to help identify the exact port when parsing test
+        expectations, determining search paths, and logging information."""
+        return self._version
+
     def graphics_type(self):
         """Returns whether the port uses accelerated graphics ('gpu') or not
         ('cpu')."""
-        return 'cpu'
+        return self._graphics_type
+
+    def architecture(self):
+        return self._architecture
 
     def real_name(self):
         """Returns the actual name of the port, not the delegate's."""
@@ -541,8 +574,15 @@ class Port(object):
         return self._filesystem.normpath(self._filesystem.join(self.layout_tests_dir(), test_name))
 
     def results_directory(self):
-        """Absolute path to the place to store the test results."""
-        raise NotImplementedError('Port.results_directory')
+        """Absolute path to the place to store the test results (uses --results-directory)."""
+        if not self._results_directory:
+            option_val = self.get_option('results_directory') or self.default_results_directory()
+            self._results_directory = self._filesystem.abspath(option_val)
+        return self._results_directory
+
+    def default_results_directory(self):
+        """Absolute path to the default place to store the test results."""
+        raise NotImplementedError()
 
     def setup_test_run(self):
         """Perform port-specific work at the beginning of a test run."""
@@ -578,18 +618,16 @@ class Port(object):
         is already running."""
         if self.get_option('use_apache'):
             self._http_server = apache_http_server.LayoutTestApacheHttpd(self,
-                self.get_option('results_directory'))
+                self.results_directory())
         else:
-            self._http_server = http_server.Lighttpd(self,
-                self.get_option('results_directory'))
+            self._http_server = http_server.Lighttpd(self, self.results_directory())
         self._http_server.start()
 
     def start_websocket_server(self):
         """Start a websocket server if it is available. Do nothing if
         it isn't. This routine is allowed to (and may) fail if a server
         is already running."""
-        self._websocket_server = websocket_server.PyWebSocket(self,
-            self.get_option('results_directory'))
+        self._websocket_server = websocket_server.PyWebSocket(self, self.results_directory())
         self._websocket_server.start()
 
     def acquire_http_lock(self):
@@ -631,6 +669,14 @@ class Port(object):
     def all_test_configurations(self):
         return self.test_configuration().all_test_configurations()
 
+    def all_baseline_variants(self):
+        """Returns a list of platform names sufficient to cover all the baselines.
+
+        The list should be sorted so that a later platform  will reuse
+        an earlier platform's baselines if they are the same (e.g.,
+        'snowleopard' should precede 'leopard')."""
+        raise NotImplementedError
+
     def test_expectations(self):
         """Returns the test expectations for this port.
 
@@ -647,39 +693,6 @@ class Port(object):
         sync up the two repos."""
         return None
 
-    def test_platform_name(self):
-        """Returns the string that corresponds to the given platform name
-        in the test expectations. This may be the same as name(), or it
-        may be different. For example, chromium returns 'mac' for
-        'chromium-mac'."""
-        raise NotImplementedError('Port.test_platform_name')
-
-    def test_platforms(self):
-        """Returns the list of test platform identifiers as used in the
-        test_expectations and on dashboards, the rebaselining tool, etc.
-
-        Note that this is not necessarily the same as the list of ports,
-        which must be globally unique (e.g., both 'chromium-mac' and 'mac'
-        might return 'mac' as a test_platform name'."""
-        raise NotImplementedError('Port.platforms')
-
-    def test_platform_name_to_name(self, test_platform_name):
-        """Returns the Port platform name that corresponds to the name as
-        referenced in the expectations file. E.g., "mac" returns
-        "chromium-mac" on the Chromium ports."""
-        raise NotImplementedError('Port.test_platform_name_to_name')
-
-    def architecture(self):
-        return self._architecture
-
-    def version(self):
-        """Returns a string indicating the version of a given platform, e.g.
-        'leopard' or 'xp'.
-
-        This is used to help identify the exact port when parsing test
-        expectations, determining search paths, and logging information."""
-        raise NotImplementedError('Port.version')
-
     def test_repository_paths(self):
         """Returns a list of (repository_name, repository_path) tuples
         of its depending code base.  By default it returns a list that only
@@ -748,6 +761,8 @@ class Port(object):
     _pretty_patch_error_html = "Failed to run PrettyPatch, see error log."
 
     def pretty_patch_text(self, diff_path):
+        if self._pretty_patch_available is None:
+            self._pretty_patch_available = self.check_pretty_patch(logging=False)
         if not self._pretty_patch_available:
             return self._pretty_patch_error_html
         command = ("ruby", "-I", self._filesystem.dirname(self._pretty_patch_path),
@@ -875,22 +890,24 @@ class DriverInput(object):
 class DriverOutput(object):
     """Groups information about a output from driver for easy passing of data."""
 
-    def __init__(self, text, image, image_hash,
-                 crash=False, test_time=None, timeout=False, error=''):
+    def __init__(self, text, image, image_hash, audio,
+                 crash=False, test_time=0, timeout=False, error=''):
         """Initializes a TestOutput object.
 
         Args:
           text: a text output
           image: an image output
           image_hash: a string containing the checksum of the image
+          audio: contents of an audio stream, if any (in WAV format)
           crash: a boolean indicating whether the driver crashed on the test
-          test_time: a time which the test has taken
+          test_time: the time the test took to execute
           timeout: a boolean indicating whehter the test timed out
           error: any unexpected or additional (or error) text output
         """
         self.text = text
         self.image = image
         self.image_hash = image_hash
+        self.audio = audio
         self.crash = crash
         self.test_time = test_time
         self.timeout = timeout
@@ -956,15 +973,8 @@ class Driver:
 class TestConfiguration(object):
     def __init__(self, port=None, os=None, version=None, architecture=None,
                  build_type=None, graphics_type=None):
-
-        # FIXME: We can get the O/S and version from test_platform_name()
-        # and version() for now, but those should go away and be cleaned up
-        # with more generic methods like operation_system() and os_version()
-        # or something.
-        if port:
-            port_version = port.version()
-        self.os = os or port.test_platform_name().replace('-' + port_version, '')
-        self.version = version or port_version
+        self.os = os or port.operating_system()
+        self.version = version or port.version()
         self.architecture = architecture or port.architecture()
         self.build_type = build_type or port._options.configuration.lower()
         self.graphics_type = graphics_type or port.graphics_type()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
index ef90484..b4758fc 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base_unittest.py
@@ -33,7 +33,7 @@ import unittest
 
 from webkitpy.common.system.executive import Executive, ScriptError
 from webkitpy.common.system import executive_mock
-from webkitpy.common.system import filesystem
+from webkitpy.common.system.filesystem_mock import MockFileSystem
 from webkitpy.common.system import outputcapture
 from webkitpy.common.system.path import abspath_to_uri
 from webkitpy.thirdparty.mock import Mock
@@ -86,8 +86,8 @@ class PortTest(unittest.TestCase):
 
     def test_pretty_patch_script_error(self):
         # FIXME: This is some ugly white-box test hacking ...
-        base._pretty_patch_available = True
         port = base.Port(executive=executive_mock.MockExecutive2(exception=ScriptError))
+        port._pretty_patch_available = True
         self.assertEqual(port.pretty_patch_text("patch.txt"),
                          port._pretty_patch_error_html)
 
@@ -232,6 +232,33 @@ class PortTest(unittest.TestCase):
         port = base.Port(port_name='foo')
         self.assertEqual(port.name(), 'foo')
 
+    def test_additional_platform_directory(self):
+        filesystem = MockFileSystem()
+        options, args = optparse.OptionParser().parse_args([])
+        port = base.Port(port_name='foo', filesystem=filesystem, options=options)
+        port.baseline_search_path = lambda: []
+        layout_test_dir = port.layout_tests_dir()
+        test_file = filesystem.join(layout_test_dir, 'fast', 'test.html')
+
+        # No additional platform directory
+        self.assertEqual(
+            port.expected_baselines(test_file, '.txt'),
+            [(None, 'fast/test-expected.txt')])
+
+        # Simple additional platform directory
+        options.additional_platform_directory = ['/tmp/local-baselines']
+        filesystem.files = {
+            '/tmp/local-baselines/fast/test-expected.txt': 'foo',
+        }
+        self.assertEqual(
+            port.expected_baselines(test_file, '.txt'),
+            [('/tmp/local-baselines', 'fast/test-expected.txt')])
+
+        # Multiple additional platform directories
+        options.additional_platform_directory = ['/foo', '/tmp/local-baselines']
+        self.assertEqual(
+            port.expected_baselines(test_file, '.txt'),
+            [('/tmp/local-baselines', 'fast/test-expected.txt')])
 
 class VirtualTest(unittest.TestCase):
     """Tests that various methods expected to be virtual are."""
@@ -247,13 +274,8 @@ class VirtualTest(unittest.TestCase):
         self.assertVirtual(port.create_driver, 0)
         self.assertVirtual(port.diff_image, None, None)
         self.assertVirtual(port.path_to_test_expectations_file)
-        self.assertVirtual(port.test_platform_name)
-        self.assertVirtual(port.results_directory)
+        self.assertVirtual(port.default_results_directory)
         self.assertVirtual(port.test_expectations)
-        self.assertVirtual(port.test_platform_name)
-        self.assertVirtual(port.test_platforms)
-        self.assertVirtual(port.test_platform_name_to_name, None)
-        self.assertVirtual(port.version)
         self.assertVirtual(port._path_to_apache)
         self.assertVirtual(port._path_to_apache_config_file)
         self.assertVirtual(port._path_to_driver)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
index baf1893..a4279b4 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
@@ -51,6 +51,12 @@ _log = logging.getLogger("webkitpy.layout_tests.port.chromium")
 # FIXME: This function doesn't belong in this package.
 class ChromiumPort(base.Port):
     """Abstract base class for Chromium implementations of the Port class."""
+    ALL_BASELINE_VARIANTS = [
+        'chromium-mac-snowleopard', 'chromium-mac-leopard',
+        'chromium-win-win7', 'chromium-win-vista', 'chromium-win-xp',
+        'chromium-linux-x86', 'chromium-linux-x86_64',
+        'chromium-gpu-mac-snowleopard', 'chromium-gpu-win-win7', 'chromium-gpu-linux-x86_64',
+    ]
 
     def __init__(self, **kwargs):
         base.Port.__init__(self, **kwargs)
@@ -102,7 +108,7 @@ class ChromiumPort(base.Port):
 
         # It's okay if pretty patch isn't available, but we will at
         # least log a message.
-        self.check_pretty_patch()
+        self._pretty_patch_available = self.check_pretty_patch()
 
         return result
 
@@ -130,7 +136,11 @@ class ChromiumPort(base.Port):
 
     def diff_image(self, expected_contents, actual_contents,
                    diff_filename=None):
-        executable = self._path_to_image_diff()
+        # FIXME: need unit tests for this.
+        if not actual_contents and not expected_contents:
+            return False
+        if not actual_contents or not expected_contents:
+            return True
 
         tempdir = self._filesystem.mkdtemp()
         expected_filename = self._filesystem.join(str(tempdir), "expected.png")
@@ -138,6 +148,7 @@ class ChromiumPort(base.Port):
         actual_filename = self._filesystem.join(str(tempdir), "actual.png")
         self._filesystem.write_binary_file(actual_filename, actual_contents)
 
+        executable = self._path_to_image_diff()
         if diff_filename:
             cmd = [executable, '--diff', expected_filename,
                    actual_filename, diff_filename]
@@ -189,14 +200,14 @@ class ChromiumPort(base.Port):
         return self.path_from_webkit_base('LayoutTests', 'platform',
             'chromium', 'test_expectations.txt')
 
-    def results_directory(self):
+    def default_results_directory(self):
         try:
             return self.path_from_chromium_base('webkit',
                 self.get_option('configuration'),
-                self.get_option('results_directory'))
+                'layout-test-results')
         except AssertionError:
             return self._build_path(self.get_option('configuration'),
-                                    self.get_option('results_directory'))
+                                    'layout-test-results')
 
     def setup_test_run(self):
         # Delete the disk cache if any to ensure a clean test run.
@@ -230,6 +241,9 @@ class ChromiumPort(base.Port):
             # http://bugs.python.org/issue1731717
             self._helper.wait()
 
+    def all_baseline_variants(self):
+        return self.ALL_BASELINE_VARIANTS
+
     def test_expectations(self):
         """Returns the test expectations for this port.
 
@@ -251,7 +265,6 @@ class ChromiumPort(base.Port):
     def skipped_layout_tests(self, extra_test_files=None):
         expectations_str = self.test_expectations()
         overrides_str = self.test_expectations_overrides()
-        test_platform_name = self.test_platform_name()
         is_debug_mode = False
 
         all_test_files = self.tests([])
@@ -265,15 +278,6 @@ class ChromiumPort(base.Port):
         return [self.relative_test_filename(test)
                 for test in expectations.get_tests_with_result_type(test_expectations.SKIP)]
 
-    def test_platform_names(self):
-        return ('mac', 'win', 'linux', 'win-xp', 'win-vista', 'win-7')
-
-    def test_platform_name_to_name(self, test_platform_name):
-        if test_platform_name in self.test_platform_names():
-            return 'chromium-' + test_platform_name
-        raise ValueError('Unsupported test_platform_name: %s' %
-                         test_platform_name)
-
     def test_repository_paths(self):
         # Note: for JSON file's backward-compatibility we use 'chrome' rather
         # than 'chromium' here.
@@ -335,9 +339,9 @@ class ChromiumDriver(base.Driver):
         self._port = port
         self._worker_number = worker_number
         self._image_path = None
+        self.KILL_TIMEOUT = 3.0
         if self._port.get_option('pixel_tests'):
-            self._image_path = self._port._filesystem.join(
-                self._port.get_option('results_directory'),
+            self._image_path = self._port._filesystem.join(self._port.results_directory(),
                 'png_result%s.png' % self._worker_number)
 
     def cmd_line(self):
@@ -371,6 +375,8 @@ class ChromiumDriver(base.Driver):
             cmd.append('--enable-accelerated-2d-canvas')
         if self._port.get_option('enable_hardware_gpu'):
             cmd.append('--enable-hardware-gpu')
+
+        cmd.extend(self._port.get_option('additional_drt_flag', []))
         return cmd
 
     def start(self):
@@ -426,7 +432,7 @@ class ChromiumDriver(base.Driver):
         if png_path and self._port._filesystem.exists(png_path):
             return self._port._filesystem.read_binary_file(png_path)
         else:
-            return ''
+            return None
 
     def _output_image_with_retry(self):
         # Retry a few more times because open() sometimes fails on Windows,
@@ -501,11 +507,16 @@ class ChromiumDriver(base.Driver):
 
             (line, crash) = self._write_command_and_read_line(input=None)
 
+        # FIXME: Add support for audio when we're ready.
+
         run_time = time.time() - start_time
         output_image = self._output_image_with_retry()
-        assert output_image is not None
-        return base.DriverOutput(''.join(output), output_image, actual_checksum,
-                                 crash, run_time, timeout, ''.join(error))
+        text = ''.join(output)
+        if not text:
+            text = None
+
+        return base.DriverOutput(text, output_image, actual_checksum, audio=None,
+            crash=crash, test_time=run_time, timeout=timeout, error=''.join(error))
 
     def stop(self):
         if self._proc:
@@ -513,21 +524,19 @@ class ChromiumDriver(base.Driver):
             self._proc.stdout.close()
             if self._proc.stderr:
                 self._proc.stderr.close()
-            if sys.platform not in ('win32', 'cygwin'):
-                # Closing stdin/stdout/stderr hangs sometimes on OS X,
-                # (see __init__(), above), and anyway we don't want to hang
-                # the harness if DRT is buggy, so we wait a couple
-                # seconds to give DRT a chance to clean up, but then
-                # force-kill the process if necessary.
-                KILL_TIMEOUT = 3.0
-                timeout = time.time() + KILL_TIMEOUT
-                # poll() is not threadsafe and can throw OSError due to:
-                # http://bugs.python.org/issue1731717
-                while self._proc.poll() is None and time.time() < timeout:
-                    time.sleep(0.1)
-                # poll() is not threadsafe and can throw OSError due to:
-                # http://bugs.python.org/issue1731717
-                if self._proc.poll() is None:
-                    _log.warning('stopping test driver timed out, '
-                                 'killing it')
-                    self._port._executive.kill_process(self._proc.pid)
+            # Closing stdin/stdout/stderr hangs sometimes on OS X,
+            # (see __init__(), above), and anyway we don't want to hang
+            # the harness if DRT is buggy, so we wait a couple
+            # seconds to give DRT a chance to clean up, but then
+            # force-kill the process if necessary.
+            timeout = time.time() + self.KILL_TIMEOUT
+            while self._proc.poll() is None and time.time() < timeout:
+                time.sleep(0.1)
+            if self._proc.poll() is None:
+                _log.warning('stopping test driver timed out, '
+                                'killing it')
+                self._port._executive.kill_process(self._proc.pid)
+            # FIXME: This is sometime none. What is wrong? assert self._proc.poll() is not None
+            if self._proc.poll() is not None:
+                self._proc.wait()
+            self._proc = None
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_gpu.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_gpu.py
index 167f23e..ffc2cf7 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_gpu.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_gpu.py
@@ -60,6 +60,7 @@ def get(platform=None, port_name='chromium-gpu', **kwargs):
 # FIXME: These should really be a mixin class.
 
 def _set_gpu_options(port):
+    port._graphics_type = 'gpu'
     if port.get_option('accelerated_compositing') is None:
         port._options.accelerated_compositing = True
     if port.get_option('accelerated_2d_canvas') is None:
@@ -84,17 +85,6 @@ def _tests(port, paths):
     return test_files.find(port, paths)
 
 
-def _test_platform_names(self):
-    return ('mac', 'win', 'linux')
-
-
-def _test_platform_name_to_name(self, test_platform_name):
-    if test_platform_name in self.test_platform_names():
-        return 'chromium-gpu-' + test_platform_name
-    raise ValueError('Unsupported test_platform_name: %s' %
-                     test_platform_name)
-
-
 class ChromiumGpuLinuxPort(chromium_linux.ChromiumLinuxPort):
     def __init__(self, port_name='chromium-gpu-linux', **kwargs):
         chromium_linux.ChromiumLinuxPort.__init__(self, port_name=port_name, **kwargs)
@@ -112,21 +102,9 @@ class ChromiumGpuLinuxPort(chromium_linux.ChromiumLinuxPort):
     def default_child_processes(self):
         return 1
 
-    def graphics_type(self):
-        return 'gpu'
-
     def tests(self, paths):
         return _tests(self, paths)
 
-    def test_platform_name(self):
-        return 'linux'
-
-    def test_platform_names(self):
-        return _test_platform_names(self)
-
-    def test_platform_name_to_name(self, name):
-        return _test_platform_name_to_name(self, name)
-
 
 class ChromiumGpuMacPort(chromium_mac.ChromiumMacPort):
     def __init__(self, port_name='chromium-gpu-mac', **kwargs):
@@ -144,21 +122,9 @@ class ChromiumGpuMacPort(chromium_mac.ChromiumMacPort):
     def default_child_processes(self):
         return 1
 
-    def graphics_type(self):
-        return 'gpu'
-
     def tests(self, paths):
         return _tests(self, paths)
 
-    def test_platform_name(self):
-        return 'mac'
-
-    def test_platform_names(self):
-        return _test_platform_names(self)
-
-    def test_platform_name_to_name(self, name):
-        return _test_platform_name_to_name(self, name)
-
 
 class ChromiumGpuWinPort(chromium_win.ChromiumWinPort):
     def __init__(self, port_name='chromium-gpu-win', **kwargs):
@@ -176,17 +142,5 @@ class ChromiumGpuWinPort(chromium_win.ChromiumWinPort):
     def default_child_processes(self):
         return 1
 
-    def graphics_type(self):
-        return 'gpu'
-
     def tests(self, paths):
         return _tests(self, paths)
-
-    def test_platform_name(self):
-        return 'win'
-
-    def test_platform_names(self):
-        return _test_platform_names(self)
-
-    def test_platform_name_to_name(self, name):
-        return _test_platform_name_to_name(self, name)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
index 2cd2435..49c01c4 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
@@ -47,27 +47,29 @@ class ChromiumLinuxPort(chromium.ChromiumPort):
         'x86': ['chromium-linux', 'chromium-win', 'chromium', 'win', 'mac'],
     }
 
-    def __init__(self, port_name=None, rebaselining=False, **kwargs):
+    def __init__(self, port_name=None, **kwargs):
         port_name = port_name or 'chromium-linux'
         chromium.ChromiumPort.__init__(self, port_name=port_name, **kwargs)
 
         # We re-set the port name once the base object is fully initialized
         # in order to be able to find the DRT binary properly.
-        if port_name.endswith('-linux') and not rebaselining:
+        if port_name.endswith('-linux'):
             self._architecture = self._determine_architecture()
             # FIXME: this is an ugly hack to avoid renaming the GPU port.
             if port_name == 'chromium-linux':
                 port_name = port_name + '-' + self._architecture
-        elif rebaselining:
-            self._architecture = 'x86'
         else:
             base, arch = port_name.rsplit('-', 1)
             assert base in ('chromium-linux', 'chromium-gpu-linux')
             self._architecture = arch
         assert self._architecture in self.SUPPORTED_ARCHITECTURES
         assert port_name in ('chromium-linux', 'chromium-gpu-linux',
-                             'chromium-linux-x86', 'chromium-linux-x86_64')
+                             'chromium-linux-x86', 'chromium-linux-x86_64',
+                             'chromium-gpu-linux-x86_64')
         self._name = port_name
+        self._operating_system = 'linux'
+        # FIXME: add support for 'lucid'
+        self._version = 'hardy'
 
     def _determine_architecture(self):
         driver_path = self._path_to_driver()
@@ -114,14 +116,6 @@ class ChromiumLinuxPort(chromium.ChromiumPort):
                        'LinuxBuildInstructions')
         return result
 
-    def test_platform_name(self):
-        # We use 'linux' instead of 'chromium-linux' in test_expectations.txt.
-        return 'linux'
-
-    def version(self):
-        # FIXME: add support for Lucid.
-        return 'hardy'
-
     #
     # PROTECTED METHODS
     #
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
index 141b587..7f57bdf 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
@@ -43,7 +43,7 @@ _log = logging.getLogger("webkitpy.layout_tests.port.chromium_mac")
 
 class ChromiumMacPort(chromium.ChromiumPort):
     """Chromium Mac implementation of the Port class."""
-    SUPPORTED_OS_VERSIONS = ('leopard', 'snowleopard')
+    SUPPORTED_OS_VERSIONS = ('leopard', 'snowleopard', 'future')
 
     FALLBACK_PATHS = {
         'leopard': [
@@ -60,41 +60,28 @@ class ChromiumMacPort(chromium.ChromiumPort):
             'mac-snowleopard',
             'mac',
         ],
-        '': [
+        'future': [
             'chromium-mac',
             'chromium',
             'mac',
         ],
     }
 
-    def __init__(self, port_name=None, os_version_string=None, rebaselining=False, **kwargs):
+    def __init__(self, port_name=None, os_version_string=None, **kwargs):
         # We're a little generic here because this code is reused by the
         # 'google-chrome' port as well as the 'mock-' and 'dryrun-' ports.
         port_name = port_name or 'chromium-mac'
-
+        chromium.ChromiumPort.__init__(self, port_name=port_name, **kwargs)
         if port_name.endswith('-mac'):
-            # FIXME: The rebaselining flag is an ugly hack that lets us create an
-            # "chromium-mac" port that is not version-specific. It should only be
-            # used by rebaseline-chromium-webkit-tests to explicitly put files into
-            # the generic directory. In theory we shouldn't need this, because
-            # the newest mac port should be using 'chromium-mac' as the baseline
-            # directory. However, we also don't have stable SL bots :(
-            #
-            # When we remove this FIXME, we also need to remove '' as a valid
-            # fallback key in self.FALLBACK_PATHS.
-            if rebaselining:
-                self._version = ''
-            else:
-                self._version = mac.os_version(os_version_string, self.SUPPORTED_OS_VERSIONS)
-                port_name = port_name + '-' + self._version
+            self._version = mac.os_version(os_version_string, self.SUPPORTED_OS_VERSIONS)
+            self._name = port_name + '-' + self._version
         else:
             self._version = port_name[port_name.index('-mac-') + 5:]
             assert self._version in self.SUPPORTED_OS_VERSIONS
-
-        chromium.ChromiumPort.__init__(self, port_name=port_name, **kwargs)
+        self._operating_system = 'mac'
 
     def baseline_path(self):
-        if self.version() == 'snowleopard':
+        if self.version() in ('snowleopard', 'future'):
             # We treat Snow Leopard as the newest version of mac,
             # so it gets the base dir.
             return self._webkit_baseline_path('chromium-mac')
@@ -123,15 +110,6 @@ class ChromiumMacPort(chromium.ChromiumPort):
     def driver_name(self):
         return "DumpRenderTree"
 
-    def test_platform_name(self):
-        # We use 'mac' instead of 'chromium-mac'
-
-        # FIXME: Get rid of this method after rebaseline_chromium_webkit_tests dies.
-        return 'mac'
-
-    def version(self):
-        return self._version
-
     #
     # PROTECTED METHODS
     #
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py
index 12011c6..4f9c302 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py
@@ -53,7 +53,7 @@ class ChromiumMacPortTest(port_testcase.PortTestCase):
 
     def test_versions(self):
         port = chromium_mac.ChromiumMacPort()
-        self.assertTrue(port.name() in ('chromium-mac-leopard', 'chromium-mac-snowleopard'))
+        self.assertTrue(port.name() in ('chromium-mac-leopard', 'chromium-mac-snowleopard', 'chromium-mac-future'))
 
         self.assert_name(None, '10.5.3', 'chromium-mac-leopard')
         self.assert_name('chromium-mac', '10.5.3', 'chromium-mac-leopard')
@@ -65,18 +65,16 @@ class ChromiumMacPortTest(port_testcase.PortTestCase):
         self.assert_name('chromium-mac-snowleopard', '10.5.3', 'chromium-mac-snowleopard')
         self.assert_name('chromium-mac-snowleopard', '10.6.3', 'chromium-mac-snowleopard')
 
-        self.assertRaises(KeyError, self.assert_name, None, '10.7.1', 'chromium-mac-leopard')
-        self.assertRaises(AssertionError, self.assert_name, None, '10.4.1', 'chromium-mac-leopard')
+        self.assert_name(None, '10.7', 'chromium-mac-future')
+        self.assert_name(None, '10.7.3', 'chromium-mac-future')
+        self.assert_name(None, '10.8', 'chromium-mac-future')
+        self.assert_name('chromium-mac', '10.7.3', 'chromium-mac-future')
+        self.assert_name('chromium-mac-future', '10.4.3', 'chromium-mac-future')
+        self.assert_name('chromium-mac-future', '10.5.3', 'chromium-mac-future')
+        self.assert_name('chromium-mac-future', '10.6.3', 'chromium-mac-future')
+        self.assert_name('chromium-mac-future', '10.7.3', 'chromium-mac-future')
 
-    def test_generic_rebaselining_port(self):
-        port = chromium_mac.ChromiumMacPort(rebaselining=True)
-        self.assertEquals(port.name(), 'chromium-mac')
-        self.assertEquals(port.version(), '')
-        self.assertEquals(port.baseline_path(), port._webkit_baseline_path(port.name()))
-
-        port = chromium_mac.ChromiumMacPort(port_name='chromium-mac-leopard', rebaselining=True)
-        self.assertEquals(port.name(), 'chromium-mac-leopard')
-        self.assertEquals(port.baseline_path(), port._webkit_baseline_path(port.name()))
+        self.assertRaises(AssertionError, self.assert_name, None, '10.4.1', 'should-raise-assertion-so-this-value-does-not-matter')
 
     def test_baseline_path(self):
         port = chromium_mac.ChromiumMacPort(port_name='chromium-mac-leopard')
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
index b287875..0260dff 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
@@ -41,8 +41,10 @@ import chromium_linux
 import chromium_mac
 import chromium_win
 
-class ChromiumDriverTest(unittest.TestCase):
+from webkitpy.layout_tests.port import port_testcase
+
 
+class ChromiumDriverTest(unittest.TestCase):
     def setUp(self):
         mock_port = Mock()
         mock_port.get_option = lambda option_name: ''
@@ -85,8 +87,46 @@ class ChromiumDriverTest(unittest.TestCase):
         self.driver._proc.stdout.readline = mock_readline
         self._assert_write_command_and_read_line(expected_crash=True)
 
+    def test_stop(self):
+        self.pid = None
+        self.wait_called = False
+        self.driver._proc = Mock()
+        self.driver._proc.pid = 1
+        self.driver._proc.stdin = StringIO.StringIO()
+        self.driver._proc.stdout = StringIO.StringIO()
+        self.driver._proc.stderr = StringIO.StringIO()
+        self.driver._proc.poll = lambda: None
+
+        def fake_wait():
+            self.assertTrue(self.pid is not None)
+            self.wait_called = True
+
+        self.driver._proc.wait = fake_wait
+
+        class FakeExecutive(object):
+            def kill_process(other, pid):
+                self.pid = pid
+                self.driver._proc.poll = lambda: 2
+
+        self.driver._port._executive = FakeExecutive()
+        self.driver.KILL_TIMEOUT = 0.01
+        self.driver.stop()
+        self.assertTrue(self.wait_called)
+        self.assertEquals(self.pid, 1)
+
+
+class ChromiumPortTest(port_testcase.PortTestCase):
+    def port_maker(self, platform):
+        return chromium.ChromiumPort
+
+    def test_driver_cmd_line(self):
+        # Override this test since ChromiumPort doesn't implement driver_cmd_line().
+        pass
+
+    def test_baseline_search_path(self):
+        # Override this test since ChromiumPort doesn't implement baseline_search_path().
+        pass
 
-class ChromiumPortTest(unittest.TestCase):
     class TestMacPort(chromium_mac.ChromiumMacPort):
         def __init__(self, options):
             chromium_mac.ChromiumMacPort.__init__(self,
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
index d0908df..171519e 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
@@ -63,34 +63,21 @@ class ChromiumWinPort(chromium.ChromiumPort):
         'xp': ['chromium-win-xp', 'chromium-win-vista', 'chromium-win', 'chromium', 'win', 'mac'],
         'vista': ['chromium-win-vista', 'chromium-win', 'chromium', 'win', 'mac'],
         'win7': ['chromium-win', 'chromium', 'win', 'mac'],
-        '': ['chromium-win', 'chromium', 'win', 'mac'],
     }
 
-    def __init__(self, port_name=None, windows_version=None, rebaselining=False, **kwargs):
+    def __init__(self, port_name=None, windows_version=None, **kwargs):
         # We're a little generic here because this code is reused by the
         # 'google-chrome' port as well as the 'mock-' and 'dryrun-' ports.
         port_name = port_name or 'chromium-win'
-
+        chromium.ChromiumPort.__init__(self, port_name=port_name, **kwargs)
         if port_name.endswith('-win'):
-            # FIXME: The rebaselining flag is an ugly hack that lets us create an
-            # "chromium-win" port that is not version-specific. It should only be
-            # used by rebaseline-chromium-webkit-tests to explicitly put files into
-            # the generic directory. In theory we shouldn't need this, because
-            # the newest win port should be using 'chromium-win' as the baseline
-            # directory. However, we also don't have stable Win 7 bots :(
-            #
-            # When we remove this FIXME, we also need to remove '' as a valid
-            # fallback key in self.FALLBACK_PATHS.
-            if rebaselining:
-                self._version = ''
-            else:
-                self._version = os_version(windows_version)
-                port_name = port_name + '-' + self._version
+            self._version = os_version(windows_version)
+            self._name = port_name + '-' + self._version
         else:
             self._version = port_name[port_name.index('-win-') + 5:]
             assert self._version in self.SUPPORTED_VERSIONS
 
-        chromium.ChromiumPort.__init__(self, port_name=port_name, **kwargs)
+        self._operating_system = 'win'
 
     def setup_environ_for_server(self):
         env = chromium.ChromiumPort.setup_environ_for_server(self)
@@ -129,25 +116,10 @@ class ChromiumWinPort(chromium.ChromiumPort):
                        'build-instructions-windows')
         return result
 
-    def default_worker_model(self):
-        # FIXME: should use base class method instead. See bug 55163.
-        return 'old-threads'
-
     def relative_test_filename(self, filename):
         path = filename[len(self.layout_tests_dir()) + 1:]
         return path.replace('\\', '/')
 
-    def test_platform_name(self):
-        # We return 'win-xp', not 'chromium-win-xp' here, for convenience.
-
-        # FIXME: Get rid of this method after rebaseline_chromium_webkit_tests dies.
-        if self.version() == '':
-            return 'win'
-        return 'win-' + self.version()
-
-    def version(self):
-        return self._version
-
     #
     # PROTECTED ROUTINES
     #
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py
index 8ea7060..9fb9e2d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py
@@ -58,13 +58,6 @@ class ChromiumWinTest(port_testcase.PortTestCase):
     def _mock_path_from_chromium_base(self, *comps):
         return self._port._filesystem.join("/chromium/src", *comps)
 
-    def test_default_worker_model(self):
-        port = self.make_port()
-        if not port:
-            return
-
-        self.assertEqual(port.default_worker_model(), 'old-threads')
-
     def test_setup_environ_for_server(self):
         port = self.make_port()
         if not port:
@@ -127,16 +120,6 @@ class ChromiumWinTest(port_testcase.PortTestCase):
         self.assertRaises(KeyError, self.assert_name, None, (5, 2), 'chromium-win-xp')
         self.assertRaises(KeyError, self.assert_name, None, (7, 1), 'chromium-win-xp')
 
-    def test_generic_rebaselining_port(self):
-        port = chromium_win.ChromiumWinPort(rebaselining=True)
-        self.assertEquals(port.name(), 'chromium-win')
-        self.assertEquals(port.version(), '')
-        self.assertEquals(port.baseline_path(), port._webkit_baseline_path(port.name()))
-
-        port = chromium_win.ChromiumWinPort(port_name='chromium-win-xp', rebaselining=True)
-        self.assertEquals(port.name(), 'chromium-win-xp')
-        self.assertEquals(port.baseline_path(), port._webkit_baseline_path(port.name()))
-
     def test_baseline_path(self):
         port = chromium_win.ChromiumWinPort(port_name='chromium-win-xp')
         self.assertEquals(port.baseline_path(), port._webkit_baseline_path('chromium-win-xp'))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/dryrun.py b/Tools/Scripts/webkitpy/layout_tests/port/dryrun.py
index 20aa776..ba99636 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/dryrun.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/dryrun.py
@@ -119,29 +119,25 @@ class DryrunDriver(base.Driver):
     def run_test(self, driver_input):
         start_time = time.time()
         fs = self._port._filesystem
-        if fs.exists(self._port.reftest_expected_filename(driver_input.filename)) or \
-            fs.exists(self._port.reftest_expected_mismatch_filename(driver_input.filename)):
-            text_output = 'test-text'
+        if (fs.exists(self._port.reftest_expected_filename(driver_input.filename)) or
+            fs.exists(self._port.reftest_expected_mismatch_filename(driver_input.filename)) or
+            driver_input.filename.endswith('-expected.html')):
+            text = 'test-text'
             image = 'test-image'
-            hash = 'test-checksum'
-        elif driver_input.filename.endswith('-expected.html'):
-            text_output = 'test-text'
-            image = 'test-image'
-            hash = 'test-checksum'
+            checksum = 'test-checksum'
+            audio = None
         elif driver_input.filename.endswith('-expected-mismatch.html'):
-            text_output = 'test-text-mismatch'
+            text = 'test-text-mismatch'
             image = 'test-image-mismatch'
-            hash = 'test-checksum-mismatch'
-        elif driver_input.image_hash is not None:
-            text_output = self._port.expected_text(driver_input.filename)
-            image = self._port.expected_image(driver_input.filename)
-            hash = self._port.expected_checksum(driver_input.filename)
+            checksum = 'test-checksum-mismatch'
+            audio = None
         else:
-            text_output = self._port.expected_text(driver_input.filename)
-            image = None
-            hash = None
-        return base.DriverOutput(text_output, image, hash, False,
-                                 time.time() - start_time, False, '')
+            text = self._port.expected_text(driver_input.filename)
+            image = self._port.expected_image(driver_input.filename)
+            checksum = self._port.expected_checksum(driver_input.filename)
+            audio = self._port.expected_audio(driver_input.filename)
+        return base.DriverOutput(text, image, checksum, audio, crash=False,
+            test_time=time.time() - start_time, timeout=False, error='')
 
     def start(self):
         pass
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/http_server.py b/Tools/Scripts/webkitpy/layout_tests/port/http_server.py
index 1753aee..5ba767f 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/http_server.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/http_server.py
@@ -214,7 +214,7 @@ class Lighttpd(http_server_base.HttpServerBase):
         env = self._port_obj.setup_environ_for_server()
         _log.debug('Starting http server, cmd="%s"' % str(start_cmd))
         # FIXME: Should use Executive.run_command
-        self._process = subprocess.Popen(start_cmd, env=env)
+        self._process = subprocess.Popen(start_cmd, env=env, stdin=subprocess.PIPE)
 
         # Wait for server to start.
         self.mappings = mappings
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac.py b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
index 4315543..a44d6d3 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
@@ -39,7 +39,6 @@ _log = logging.getLogger("webkitpy.layout_tests.port.mac")
 
 
 def os_version(os_version_string=None, supported_versions=None):
-    # We only support Tiger, Leopard, and Snow Leopard.
     if not os_version_string:
         if hasattr(platform, 'mac_ver') and platform.mac_ver()[0]:
             os_version_string = platform.mac_ver()[0]
@@ -52,7 +51,8 @@ def os_version(os_version_string=None, supported_versions=None):
         5: 'leopard',
         6: 'snowleopard',
     }
-    version_string = version_strings[release_version]
+    assert release_version >= min(version_strings.keys())
+    version_string = version_strings.get(release_version, 'future')
     if supported_versions:
         assert version_string in supported_versions
     return version_string
@@ -62,26 +62,28 @@ class MacPort(WebKitPort):
     """WebKit Mac implementation of the Port class."""
     # FIXME: 'wk2' probably shouldn't be a version, it should probably be
     # a modifier, like 'chromium-gpu' is to 'chromium'.
-    SUPPORTED_VERSIONS = ('tiger', 'leopard', 'snowleopard', 'wk2')
+    SUPPORTED_VERSIONS = ('tiger', 'leopard', 'snowleopard', 'future', 'wk2')
 
     FALLBACK_PATHS = {
         'tiger': ['mac-tiger', 'mac-leopard', 'mac-snowleopard', 'mac'],
         'leopard': ['mac-leopard', 'mac-snowleopard', 'mac'],
         'snowleopard': ['mac-snowleopard', 'mac'],
+        'future': ['mac'],
         'wk2': ['mac-wk2', 'mac'],
     }
 
     def __init__(self, port_name=None, os_version_string=None, **kwargs):
         port_name = port_name or 'mac'
-
+        WebKitPort.__init__(self, port_name=port_name, **kwargs)
         if port_name == 'mac':
             self._version = os_version(os_version_string)
-            port_name = port_name + '-' + self._version
+            self._name = port_name + '-' + self._version
         else:
             self._version = port_name[4:]
             assert self._version in self.SUPPORTED_VERSIONS
-
-        WebKitPort.__init__(self, port_name=port_name, **kwargs)
+        self._operating_system = 'mac'
+        if not hasattr(self._options, 'time-out-ms') or self._options.time_out_ms is None:
+            self._options.time_out_ms = 35000
 
     def default_child_processes(self):
         # FIXME: new-run-webkit-tests is unstable on Mac running more than
@@ -92,10 +94,12 @@ class MacPort(WebKitPort):
             return 4
         return child_processes
 
-    def default_worker_model(self):
-        if self._multiprocessing_is_available:
-            return 'processes'
-        return 'threads'
+    def baseline_path(self):
+        if self.version() != 'future':
+            return WebKitPort.baseline_path(self)
+
+        assert(self._name[-7:] == '-future')
+        return self._webkit_baseline_path(self._name[:-7])
 
     def baseline_search_path(self):
         return map(self._webkit_baseline_path, self.FALLBACK_PATHS[self._version])
@@ -115,12 +119,6 @@ class MacPort(WebKitPort):
                                           'Skipped'))
         return skipped_files
 
-    def test_platform_name(self):
-        return 'mac-' + self.version()
-
-    def version(self):
-        return self._version
-
     def _build_java_test_support(self):
         java_tests_path = self._filesystem.join(self.layout_tests_dir(), "java")
         build_java = ["/usr/bin/make", "-C", java_tests_path]
@@ -132,24 +130,13 @@ class MacPort(WebKitPort):
     def _check_port_build(self):
         return self._build_java_test_support()
 
-    def _tests_for_other_platforms(self):
-        # The original run-webkit-tests builds up a "whitelist" of tests to
-        # run, and passes that to DumpRenderTree. new-run-webkit-tests assumes
-        # we run *all* tests and test_expectations.txt functions as a
-        # blacklist.
-        # FIXME: This list could be dynamic based on platform name and
-        # pushed into base.Port.
-        return [
-            "platform/chromium",
-            "platform/gtk",
-            "platform/qt",
-            "platform/win",
-        ]
-
     def _path_to_apache_config_file(self):
         return self._filesystem.join(self.layout_tests_dir(), 'http', 'conf',
                                      'apache2-httpd.conf')
 
+    def _path_to_webcore_library(self):
+        return self._build_path('WebCore.framework/Versions/A/WebCore')
+
     # FIXME: This doesn't have anything to do with WebKit.
     def _shut_down_http_server(self, server_pid):
         """Shut down the lighttpd web server. Blocks until it's fully
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
index 4586a23..8906154 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
@@ -84,10 +84,22 @@ svg/batik/text/smallFonts.svg
                            os_version_string=os_version_string)
         self.assertEquals(expected, port.name())
 
+    def test_tests_for_other_platforms(self):
+        port = mac.MacPort(port_name='mac-snowleopard')
+        dirs_to_skip = port._tests_for_other_platforms()
+        self.assertTrue('platform/chromium-linux' in dirs_to_skip)
+        self.assertTrue('platform/mac-tiger' in dirs_to_skip)
+        self.assertFalse('platform/mac' in dirs_to_skip)
+        self.assertFalse('platform/mac-snowleopard' in dirs_to_skip)
+
+    def test_version(self):
+        port = mac.MacPort()
+        self.assertTrue(port.version())
+
     def test_versions(self):
         port = self.make_port()
         if port:
-            self.assertTrue(port.name() in ('mac-tiger', 'mac-leopard', 'mac-snowleopard'))
+            self.assertTrue(port.name() in ('mac-tiger', 'mac-leopard', 'mac-snowleopard', 'mac-future'))
 
         self.assert_name(None, '10.4.8', 'mac-tiger')
         self.assert_name('mac', '10.4.8', 'mac-tiger')
@@ -107,8 +119,16 @@ svg/batik/text/smallFonts.svg
         self.assert_name('mac-snowleopard', '10.5.3', 'mac-snowleopard')
         self.assert_name('mac-snowleopard', '10.6.3', 'mac-snowleopard')
 
-        self.assertRaises(KeyError, self.assert_name, None, '10.7.1', 'mac-leopard')
-        self.assertRaises(KeyError, self.assert_name, None, '10.3.1', 'mac-leopard')
+        self.assert_name(None, '10.7', 'mac-future')
+        self.assert_name(None, '10.7.3', 'mac-future')
+        self.assert_name(None, '10.8', 'mac-future')
+        self.assert_name('mac', '10.7.3', 'mac-future')
+        self.assert_name('mac-future', '10.4.3', 'mac-future')
+        self.assert_name('mac-future', '10.5.3', 'mac-future')
+        self.assert_name('mac-future', '10.6.3', 'mac-future')
+        self.assert_name('mac-future', '10.7.3', 'mac-future')
+
+        self.assertRaises(AssertionError, self.assert_name, None, '10.3.1', 'should-raise-assertion-so-this-value-does-not-matter')
 
 
 if __name__ == '__main__':
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
index 1147846..73967cf 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
@@ -32,6 +32,7 @@ This is an implementation of the Port interface that overrides other
 ports and changes the Driver binary to "MockDRT".
 """
 
+import base64
 import logging
 import optparse
 import os
@@ -206,15 +207,23 @@ class MockDRT(object):
             test_path = test_input.uri
 
         actual_text = port.expected_text(test_path)
+        actual_audio = port.expected_audio(test_path)
         if self._options.pixel_tests and test_input.checksum:
             actual_checksum = port.expected_checksum(test_path)
             actual_image = port.expected_image(test_path)
 
-        self._stdout.write('Content-Type: text/plain\n')
+        if actual_audio:
+            self._stdout.write('Content-Type: audio/wav\n')
+            self._stdout.write('Content-Transfer-Encoding: base64\n')
+            output = base64.b64encode(actual_audio)
+            self._stdout.write('Content-Length: %s\n' % len(output))
+            self._stdout.write(output)
+        else:
+            self._stdout.write('Content-Type: text/plain\n')
+            # FIXME: Note that we don't ensure there is a trailing newline!
+            # This mirrors actual (Mac) DRT behavior but is a bug.
+            self._stdout.write(actual_text)
 
-        # FIXME: Note that we don't ensure there is a trailing newline!
-        # This mirrors actual (Mac) DRT behavior but is a bug.
-        self._stdout.write(actual_text)
         self._stdout.write('#EOF\n')
 
         if self._options.pixel_tests and test_input.checksum:
@@ -223,7 +232,7 @@ class MockDRT(object):
             self._stdout.write('ExpectedHash: %s\n' % test_input.checksum)
             if actual_checksum != test_input.checksum:
                 self._stdout.write('Content-Type: image/png\n')
-                self._stdout.write('Content-Length: %s\n\n' % len(actual_image))
+                self._stdout.write('Content-Length: %s\n' % len(actual_image))
                 self._stdout.write(actual_image)
         self._stdout.write('#EOF\n')
         self._stdout.flush()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
index b6f6e8a..c489e20 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
@@ -39,13 +39,17 @@ from webkitpy.layout_tests.port import factory
 from webkitpy.layout_tests.port import port_testcase
 from webkitpy.layout_tests.port import test
 
+from webkitpy.tool import mocktool
+mock_options = mocktool.MockOptions(use_apache=True,
+                                    configuration='Release')
+
 
 class MockDRTPortTest(port_testcase.PortTestCase):
-    def make_port(self):
+    def make_port(self, options=mock_options):
         if sys.platform == 'win32':
             # We use this because the 'win' port doesn't work yet.
-            return mock_drt.MockDRTPort(port_name='mock-chromium-win')
-        return mock_drt.MockDRTPort()
+            return mock_drt.MockDRTPort(port_name='mock-chromium-win', options=options)
+        return mock_drt.MockDRTPort(options=options)
 
     def test_default_worker_model(self):
         # only overridding the default test; we don't care about this one.
@@ -200,7 +204,7 @@ class MockDRTTest(unittest.TestCase):
                         'ActualHash: checksum-checksum\n',
                         'ExpectedHash: wrong-checksum\n',
                         'Content-Type: image/png\n',
-                        'Content-Length: 13\n\n',
+                        'Content-Length: 13\n',
                         'checksum\x8a-png',
                         '#EOF\n'])
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
index 649e33c..cb1b915 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
@@ -38,8 +38,7 @@ except ImportError:
     multiprocessing = None
 
 from webkitpy.tool import mocktool
-mock_options = mocktool.MockOptions(results_directory='layout-test-results',
-                                    use_apache=True,
+mock_options = mocktool.MockOptions(use_apache=True,
                                     configuration='Release')
 
 # FIXME: This should be used for all ports, not just WebKit Mac. See
@@ -60,10 +59,7 @@ class PortTestCase(unittest.TestCase):
         if not maker:
             return None
 
-        port = maker(options=options)
-        if hasattr(options, "results_directory"):
-            port._options.results_directory = port.results_directory()
-        return port
+        return maker(options=options)
 
     def test_default_worker_model(self):
         port = self.make_port()
@@ -81,6 +77,12 @@ class PortTestCase(unittest.TestCase):
             return
         self.assertTrue(len(port.driver_cmd_line()))
 
+        options = mocktool.MockOptions(additional_drt_flag=['--foo=bar', '--foo=baz'])
+        port = self.make_port(options=options)
+        cmd_line = port.driver_cmd_line()
+        self.assertTrue('--foo=bar' in cmd_line)
+        self.assertTrue('--foo=baz' in cmd_line)
+
     def disabled_test_http_server(self):
         port = self.make_port()
         if not port:
@@ -113,6 +115,30 @@ class PortTestCase(unittest.TestCase):
 
         port._filesystem.remove(tmpfile)
 
+    def test_diff_image__missing_both(self):
+        port = self.make_port()
+        if not port:
+            return
+        self.assertFalse(port.diff_image(None, None, None))
+        self.assertFalse(port.diff_image(None, '', None))
+        self.assertFalse(port.diff_image('', None, None))
+        self.assertFalse(port.diff_image('', '', None))
+
+    def test_diff_image__missing_actual(self):
+        port = self.make_port()
+        if not port:
+            return
+        self.assertTrue(port.diff_image(None, 'foo', None))
+        self.assertTrue(port.diff_image('', 'foo', None))
+
+    def test_diff_image__missing_expected(self):
+        port = self.make_port()
+        if not port:
+            return
+        self.assertTrue(port.diff_image('foo', None, None))
+        self.assertTrue(port.diff_image('foo', '', None))
+
+
     def disabled_test_websocket_server(self):
         port = self.make_port()
         if not port:
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/test.py b/Tools/Scripts/webkitpy/layout_tests/port/test.py
index 392818d..fed7e11 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/test.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/test.py
@@ -30,6 +30,7 @@
 """Dummy Port implementation used for testing."""
 from __future__ import with_statement
 
+import base64
 import time
 
 from webkitpy.common.system import filesystem_mock
@@ -66,6 +67,8 @@ class TestInstance:
         self.expected_checksum = self.actual_checksum
         self.expected_image = self.actual_image
 
+        self.actual_audio = None
+        self.expected_audio = None
 
 # This is an in-memory list of tests, what we want them to produce, and
 # what we want to claim are the expected results.
@@ -111,11 +114,20 @@ def unit_test_list():
     tests.add('failures/expected/image_checksum.html',
               actual_checksum='image_checksum_fail-checksum',
               actual_image='image_checksum_fail-png')
+    tests.add('failures/expected/audio.html',
+              actual_audio=base64.b64encode('audio_fail-wav'), expected_audio='audio-wav',
+              actual_text=None, expected_text=None,
+              actual_image=None, expected_image=None,
+              actual_checksum=None, expected_checksum=None)
     tests.add('failures/expected/keyboard.html', keyboard=True)
     tests.add('failures/expected/missing_check.html',
               expected_checksum=None,
               expected_image=None)
     tests.add('failures/expected/missing_image.html', expected_image=None)
+    tests.add('failures/expected/missing_audio.html', expected_audio=None,
+              actual_text=None, expected_text=None,
+              actual_image=None, expected_image=None,
+              actual_checksum=None, expected_checksum=None)
     tests.add('failures/expected/missing_text.html', expected_text=None)
     tests.add('failures/expected/newlines_leading.html',
               expected_text="\nfoo\n", actual_text="foo\n")
@@ -134,6 +146,11 @@ def unit_test_list():
     tests.add('http/tests/ssl/text.html')
     tests.add('passes/error.html', error='stuff going to stderr')
     tests.add('passes/image.html')
+    tests.add('passes/audio.html',
+              actual_audio=base64.b64encode('audio-wav'), expected_audio='audio-wav',
+              actual_text=None, expected_text=None,
+              actual_image=None, expected_image=None,
+              actual_checksum=None, expected_checksum=None)
     tests.add('passes/platform_image.html')
     tests.add('passes/checksum_in_image.html',
               expected_checksum=None,
@@ -184,20 +201,27 @@ def unit_test_filesystem(files=None):
         add_file(files, test, '.html', '')
         if test.is_reftest:
             continue
+        if test.actual_audio:
+            add_file(files, test, '-expected.wav', test.expected_audio)
+            continue
+
         add_file(files, test, '-expected.txt', test.expected_text)
         add_file(files, test, '-expected.checksum', test.expected_checksum)
         add_file(files, test, '-expected.png', test.expected_image)
 
+
     # Add the test_expectations file.
     files[LAYOUT_TEST_DIR + '/platform/test/test_expectations.txt'] = """
 WONTFIX : failures/expected/checksum.html = IMAGE
 WONTFIX : failures/expected/crash.html = CRASH
 // This one actually passes because the checksums will match.
 WONTFIX : failures/expected/image.html = PASS
+WONTFIX : failures/expected/audio.html = AUDIO
 WONTFIX : failures/expected/image_checksum.html = IMAGE
 WONTFIX : failures/expected/mismatch.html = IMAGE
 WONTFIX : failures/expected/missing_check.html = MISSING PASS
 WONTFIX : failures/expected/missing_image.html = MISSING PASS
+WONTFIX : failures/expected/missing_audio.html = MISSING PASS
 WONTFIX : failures/expected/missing_text.html = MISSING PASS
 WONTFIX : failures/expected/newlines_leading.html = TEXT
 WONTFIX : failures/expected/newlines_trailing.html = TEXT
@@ -220,23 +244,41 @@ WONTFIX SKIP : failures/expected/exception.html = CRASH
 
 class TestPort(base.Port):
     """Test implementation of the Port interface."""
+    ALL_BASELINE_VARIANTS = (
+        'test-mac-snowleopard', 'test-mac-leopard',
+        'test-win-win7', 'test-win-vista', 'test-win-xp',
+        'test-linux-x86',
+    )
 
     def __init__(self, port_name=None, user=None, filesystem=None, **kwargs):
-        if not filesystem:
-            filesystem = unit_test_filesystem()
+        if not port_name or port_name == 'test':
+            port_name = 'test-mac-leopard'
+        user = user or mocktool.MockUser()
+        filesystem = filesystem or unit_test_filesystem()
+        base.Port.__init__(self, port_name=port_name, filesystem=filesystem, user=user,
+                           **kwargs)
+        self._results_directory = None
 
         assert filesystem._tests
         self._tests = filesystem._tests
 
-        if not user:
-            user = mocktool.MockUser()
+        self._operating_system = 'mac'
+        if port_name.startswith('test-win'):
+            self._operating_system = 'win'
+        elif port_name.startswith('test-linux'):
+            self._operating_system = 'linux'
 
-        if not port_name or port_name == 'test':
-            port_name = 'test-mac'
+        version_map = {
+            'test-win-xp': 'xp',
+            'test-win-win7': 'win7',
+            'test-win-vista': 'vista',
+            'test-mac-leopard': 'leopard',
+            'test-mac-snowleopard': 'snowleopard',
+            'test-linux-x86': '',
+        }
+        self._version = version_map[port_name]
 
         self._expectations_path = LAYOUT_TEST_DIR + '/platform/test/test_expectations.txt'
-        base.Port.__init__(self, port_name=port_name, filesystem=filesystem, user=user,
-                           **kwargs)
 
     def _path_to_driver(self):
         # This routine shouldn't normally be called, but it is called by
@@ -248,7 +290,15 @@ class TestPort(base.Port):
         return self._filesystem.join(self.layout_tests_dir(), 'platform', self.name())
 
     def baseline_search_path(self):
-        return [self.baseline_path()]
+        search_paths = {
+            'test-mac-snowleopard': ['test-mac-snowleopard'],
+            'test-mac-leopard': ['test-mac-leopard', 'test-mac-snowleopard'],
+            'test-win-win7': ['test-win-win7'],
+            'test-win-vista': ['test-win-vista', 'test-win-win7'],
+            'test-win-xp': ['test-win-xp', 'test-win-vista', 'test-win-win7'],
+            'test-linux-x86': ['test-linux', 'test-win-win7'],
+        }
+        return [self._webkit_baseline_path(d) for d in search_paths[self.name()]]
 
     def default_child_processes(self):
         return 1
@@ -279,8 +329,8 @@ class TestPort(base.Port):
     def _path_to_wdiff(self):
         return None
 
-    def results_directory(self):
-        return '/tmp/' + self.get_option('results_directory')
+    def default_results_directory(self):
+        return '/tmp/layout-test-results'
 
     def setup_test_run(self):
         pass
@@ -303,24 +353,8 @@ class TestPort(base.Port):
     def path_to_test_expectations_file(self):
         return self._expectations_path
 
-    def test_platform_name(self):
-        name_map = {
-            'test-mac': 'mac',
-            'test-win': 'win',
-            'test-win-xp': 'win-xp',
-        }
-        return name_map[self._name]
-
-    def test_platform_names(self):
-        return ('mac', 'win', 'win-xp')
-
-    def test_platform_name_to_name(self, test_platform_name):
-        name_map = {
-            'mac': 'test-mac',
-            'win': 'test-win',
-            'win-xp': 'test-win-xp',
-        }
-        return name_map[test_platform_name]
+    def all_baseline_variants(self):
+        return self.ALL_BASELINE_VARIANTS
 
     # FIXME: These next two routines are copied from base.py with
     # the calls to path.abspath_to_uri() removed. We shouldn't have
@@ -380,19 +414,6 @@ class TestPort(base.Port):
 
         raise NotImplementedError('unknown url type: %s' % uri)
 
-    def version(self):
-        version_map = {
-            'test-win-xp': 'xp',
-            'test-win': 'win7',
-            'test-mac': 'leopard',
-        }
-        return version_map[self._name]
-
-    def test_configuration(self):
-        if not self._test_configuration:
-            self._test_configuration = TestTestConfiguration(self)
-        return self._test_configuration
-
 
 class TestDriver(base.Driver):
     """Test/Dummy implementation of the DumpRenderTree interface."""
@@ -401,7 +422,7 @@ class TestDriver(base.Driver):
         self._port = port
 
     def cmd_line(self):
-        return [self._port._path_to_driver()]
+        return [self._port._path_to_driver()] + self._port.get_option('additional_drt_flag', [])
 
     def poll(self):
         return True
@@ -416,20 +437,16 @@ class TestDriver(base.Driver):
             raise ValueError('exception from ' + test_name)
         if test.hang:
             time.sleep((float(test_input.timeout) * 4) / 1000.0)
+
+        audio = None
+        if test.actual_audio:
+            audio = base64.b64decode(test.actual_audio)
         return base.DriverOutput(test.actual_text, test.actual_image,
-                                 test.actual_checksum, test.crash,
-                                 time.time() - start_time, test.timeout,
-                                 test.error)
+            test.actual_checksum, audio, crash=test.crash,
+            test_time=time.time() - start_time, timeout=test.timeout, error=test.error)
 
     def start(self):
         pass
 
     def stop(self):
         pass
-
-
-class TestTestConfiguration(base.TestConfiguration):
-    def all_systems(self):
-        return (('mac', 'leopard', 'x86'),
-                ('win', 'xp', 'x86'),
-                ('win', 'win7', 'x86'))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/webkit.py b/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
index 65a047d..4ac4a13 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
@@ -30,7 +30,7 @@
 
 """WebKit implementations of the Port interface."""
 
-
+import base64
 import logging
 import operator
 import os
@@ -69,10 +69,6 @@ class WebKitPort(base.Port):
         return self._filesystem.join(self._webkit_baseline_path(self._name),
                                      'test_expectations.txt')
 
-    # Only needed by ports which maintain versioned test expectations (like mac-tiger vs. mac-leopard)
-    def version(self):
-        return ''
-
     def _build_driver(self):
         configuration = self.get_option('configuration')
         return self._config.build_dumprendertree(configuration)
@@ -113,7 +109,10 @@ class WebKitPort(base.Port):
         image of the two images into |diff_filename| if it is not None."""
 
         # Handle the case where the test didn't actually generate an image.
-        if not actual_contents:
+        # FIXME: need unit tests for this.
+        if not actual_contents and not expected_contents:
+            return False
+        if not actual_contents or not expected_contents:
             return True
 
         sp = self._diff_image_request(expected_contents, actual_contents)
@@ -167,10 +166,10 @@ class WebKitPort(base.Port):
         sp.stop()
         return result
 
-    def results_directory(self):
+    def default_results_directory(self):
         # Results are store relative to the built products to make it easy
         # to have multiple copies of webkit checked out and built.
-        return self._build_path(self.get_option('results_directory'))
+        return self._build_path('layout-test-results')
 
     def setup_test_run(self):
         # This port doesn't require any specific configuration.
@@ -180,19 +179,17 @@ class WebKitPort(base.Port):
         return WebKitDriver(self, worker_number)
 
     def _tests_for_other_platforms(self):
-        raise NotImplementedError('WebKitPort._tests_for_other_platforms')
-        # The original run-webkit-tests builds up a "whitelist" of tests to
-        # run, and passes that to DumpRenderTree. new-run-webkit-tests assumes
-        # we run *all* tests and test_expectations.txt functions as a
-        # blacklist.
-        # FIXME: This list could be dynamic based on platform name and
-        # pushed into base.Port.
-        return [
-            "platform/chromium",
-            "platform/gtk",
-            "platform/qt",
-            "platform/win",
-        ]
+        # By default we will skip any directory under LayoutTests/platform
+        # that isn't in our baseline search path (this mirrors what
+        # old-run-webkit-tests does in findTestsToRun()).
+        # Note this returns LayoutTests/platform/*, not platform/*/*.
+        entries = self._filesystem.glob(self._webkit_baseline_path('*'))
+        dirs_to_skip = []
+        for entry in entries:
+            if self._filesystem.isdir(entry) and not entry in self.baseline_search_path():
+                basename = self._filesystem.basename(entry)
+                dirs_to_skip.append('platform/%s' % basename)
+        return dirs_to_skip
 
     def _runtime_feature_list(self):
         """Return the supported features of DRT. If a port doesn't support
@@ -327,12 +324,6 @@ class WebKitPort(base.Port):
         tests_to_skip.update(self._tests_for_disabled_features())
         return tests_to_skip
 
-    def test_platform_name(self):
-        return self._name + self.version()
-
-    def test_platform_names(self):
-        return ('mac', 'win', 'mac-tiger', 'mac-leopard', 'mac-snowleopard')
-
     def _build_path(self, *comps):
         return self._filesystem.join(self._config.build_directory(
             self.get_option('configuration')), *comps)
@@ -381,11 +372,11 @@ class WebKitDriver(base.Driver):
 
     def cmd_line(self):
         cmd = self._command_wrapper(self._port.get_option('wrapper'))
-        cmd += [self._port._path_to_driver(), '-']
-
+        cmd.append(self._port._path_to_driver())
         if self._port.get_option('pixel_tests'):
             cmd.append('--pixel-tests')
-
+        cmd.extend(self._port.get_option('additional_drt_flag', []))
+        cmd.append('-')
         return cmd
 
     def start(self):
@@ -418,47 +409,24 @@ class WebKitDriver(base.Driver):
         start_time = time.time()
         self._server_process.write(command)
 
-        have_seen_content_type = False
+        text = None
+        image = None
         actual_image_hash = None
-        output = str()  # Use a byte array for output, even though it should be UTF-8.
-        image = str()
+        audio = None
+        deadline = time.time() + int(driver_input.timeout) / 1000.0
 
-        timeout = int(driver_input.timeout) / 1000.0
-        deadline = time.time() + timeout
-        line = self._server_process.read_line(timeout)
-        while (not self._server_process.timed_out
-               and not self._server_process.crashed
-               and line.rstrip() != "#EOF"):
-            if (line.startswith('Content-Type:') and not
-                have_seen_content_type):
-                have_seen_content_type = True
-            else:
-                # Note: Text output from DumpRenderTree is always UTF-8.
-                # However, some tests (e.g. webarchives) spit out binary
-                # data instead of text.  So to make things simple, we
-                # always treat the output as binary.
-                output += line
-            line = self._server_process.read_line(timeout)
-            timeout = deadline - time.time()
+        # First block is either text or audio
+        block = self._read_block(deadline)
+        if block.content_type == 'audio/wav':
+            audio = block.decoded_content
+        else:
+            text = block.decoded_content
 
-        # Now read a second block of text for the optional image data
-        remaining_length = -1
-        HASH_HEADER = 'ActualHash: '
-        LENGTH_HEADER = 'Content-Length: '
-        line = self._server_process.read_line(timeout)
-        while (not self._server_process.timed_out
-               and not self._server_process.crashed
-               and line.rstrip() != "#EOF"):
-            if line.startswith(HASH_HEADER):
-                actual_image_hash = line[len(HASH_HEADER):].strip()
-            elif line.startswith('Content-Type:'):
-                pass
-            elif line.startswith(LENGTH_HEADER):
-                timeout = deadline - time.time()
-                content_length = int(line[len(LENGTH_HEADER):])
-                image = self._server_process.read(timeout, content_length)
-            timeout = deadline - time.time()
-            line = self._server_process.read_line(timeout)
+        # Now read an optional second block of image data
+        block = self._read_block(deadline)
+        if block.content and block.content_type == 'image/png':
+            image = block.decoded_content
+            actual_image_hash = block.content_hash
 
         error_lines = self._server_process.error.splitlines()
         # FIXME: This is a hack.  It is unclear why sometimes
@@ -470,13 +438,59 @@ class WebKitDriver(base.Driver):
         # FIXME: This seems like the wrong section of code to be doing
         # this reset in.
         self._server_process.error = ""
-        return base.DriverOutput(output, image, actual_image_hash,
-                                 self._server_process.crashed,
-                                 time.time() - start_time,
-                                 self._server_process.timed_out,
-                                 error)
+        return base.DriverOutput(text, image, actual_image_hash, audio,
+            crash=self._server_process.crashed, test_time=time.time() - start_time,
+            timeout=self._server_process.timed_out, error=error)
+
+    def _read_block(self, deadline):
+        LENGTH_HEADER = 'Content-Length: '
+        HASH_HEADER = 'ActualHash: '
+        TYPE_HEADER = 'Content-Type: '
+        ENCODING_HEADER = 'Content-Transfer-Encoding: '
+        content_type = None
+        encoding = None
+        content_hash = None
+        content_length = None
+
+        # Content is treated as binary data even though the text output
+        # is usually UTF-8.
+        content = ''
+        timeout = deadline - time.time()
+        line = self._server_process.read_line(timeout)
+        while (not self._server_process.timed_out
+               and not self._server_process.crashed
+               and line.rstrip() != "#EOF"):
+            if line.startswith(TYPE_HEADER) and content_type is None:
+                content_type = line.split()[1]
+            elif line.startswith(ENCODING_HEADER) and encoding is None:
+                encoding = line.split()[1]
+            elif line.startswith(LENGTH_HEADER) and content_length is None:
+                timeout = deadline - time.time()
+                content_length = int(line[len(LENGTH_HEADER):])
+                # FIXME: Technically there should probably be another blank
+                # line here, but DRT doesn't write one.
+                content = self._server_process.read(timeout, content_length)
+            elif line.startswith(HASH_HEADER):
+                content_hash = line.split()[1]
+            else:
+                content += line
+            line = self._server_process.read_line(timeout)
+            timeout = deadline - time.time()
+        return ContentBlock(content_type, encoding, content_hash, content)
 
     def stop(self):
         if self._server_process:
             self._server_process.stop()
             self._server_process = None
+
+
+class ContentBlock(object):
+    def __init__(self, content_type, encoding, content_hash, content):
+        self.content_type = content_type
+        self.encoding = encoding
+        self.content_hash = content_hash
+        self.content = content
+        if self.encoding == 'base64':
+            self.decoded_content = base64.b64decode(content)
+        else:
+            self.decoded_content = content
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/webkit_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/webkit_unittest.py
index c72a411..ef1a1c2 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/webkit_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/webkit_unittest.py
@@ -30,6 +30,7 @@ import unittest
 from webkitpy.common.system import filesystem_mock
 
 from webkitpy.layout_tests.port.webkit import WebKitPort
+from webkitpy.layout_tests.port import port_testcase
 
 
 class TestWebKitPort(WebKitPort):
@@ -63,7 +64,18 @@ class TestWebKitPort(WebKitPort):
             return [self.skips_file]
         return []
 
-class WebKitPortTest(unittest.TestCase):
+
+class WebKitPortTest(port_testcase.PortTestCase):
+    def port_maker(self, platform):
+        return WebKitPort
+
+    def test_driver_cmd_line(self):
+        # Routine is not implemented.
+        pass
+
+    def test_baseline_search_path(self):
+        # Routine is not implemented.
+        pass
 
     def test_skipped_directories_for_symbols(self):
         supported_symbols = ["GraphicsLayer", "WebCoreHas3DRendering", "isXHTMLMPDocument", "fooSymbol"]
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/win.py b/Tools/Scripts/webkitpy/layout_tests/port/win.py
index e7d2004..03a76f4 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/win.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/win.py
@@ -38,9 +38,11 @@ _log = logging.getLogger("webkitpy.layout_tests.port.win")
 class WinPort(WebKitPort):
     """WebKit Win implementation of the Port class."""
 
-    def __init__(self, **kwargs):
-        kwargs.setdefault('port_name', 'win')
-        WebKitPort.__init__(self, **kwargs)
+    def __init__(self, port_name=None, **kwargs):
+        port_name = port_name or 'win'
+        WebKitPort.__init__(self, port_name=port_name, **kwargs)
+        self._version = 'win7'
+        self._operating_system = 'win'
 
     def baseline_search_path(self):
         # Based on code from old-run-webkit-tests expectedDirectoryForTest()
diff --git a/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py b/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
index 9f1d347..50a7374 100644
--- a/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
+++ b/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
@@ -41,6 +41,8 @@ The script does the following for each platform specified:
 At the end, the script generates a html that compares old and new baselines.
 """
 
+from __future__ import with_statement
+
 import copy
 import logging
 import optparse
@@ -55,27 +57,26 @@ from webkitpy.common.system import urlfetcher
 from webkitpy.common.system.executive import ScriptError
 
 from webkitpy.layout_tests import port
+from webkitpy.layout_tests import read_checksum_from_png
 from webkitpy.layout_tests.layout_package import test_expectations
 
 _log = logging.getLogger(__name__)
 
 BASELINE_SUFFIXES = ('.txt', '.png', '.checksum')
-REBASELINE_PLATFORM_ORDER = ('mac', 'win', 'win-xp', 'win-vista', 'linux')
-ARCHIVE_DIR_NAME_DICT = {'win': 'Webkit_Win__deps_',
-                         'win-vista': 'webkit-dbg-vista',
-                         'win-xp': 'Webkit_Win__deps_',
-                         'mac': 'Webkit_Mac10_5__deps_',
-                         'linux': 'Webkit_Linux__deps_',
-
-                         'win-canary': 'Webkit_Win',
-                         'win-vista-canary': 'webkit-dbg-vista',
-                         'win-xp-canary': 'Webkit_Win',
-                         'mac-canary': 'Webkit_Mac10_5',
-                         'linux-canary': 'Webkit_Linux',
-
-                         'gpu-mac-canary': 'Webkit_Mac10_5_-_GPU',
-                         'gpu-win-canary': 'Webkit_Win_-_GPU',
-                         'gpu-linux-canary': 'Webkit_Linux_-_GPU',
+
+ARCHIVE_DIR_NAME_DICT = {
+    'chromium-win-win7': 'Webkit_Win7',
+    'chromium-win-vista': 'Webkit_Vista',
+    'chromium-win-xp': 'Webkit_Win',
+    'chromium-mac-leopard': 'Webkit_Mac10_5',
+    'chromium-mac-snowleopard': 'Webkit_Mac10_6',
+    'chromium-linux-x86': 'Webkit_Linux',
+    'chromium-linux-x86_64': 'Webkit_Linux_64',
+    'chromium-gpu-mac-snowleopard': 'Webkit_Mac10_6_-_GPU',
+    'chromium-gpu-win-xp': 'Webkit_Win_-_GPU',
+    'chromium-gpu-win-win7': 'Webkit_Win7_-_GPU',
+    'chromium-gpu-linux': 'Webkit_Linux_-_GPU',
+    'chromium-gpu-linux-x86_64': 'Webkit_Linux_64_-_GPU',
 }
 
 
@@ -166,11 +167,7 @@ class Rebaseliner(object):
         self._filesystem = running_port._filesystem
         self._target_port = target_port
 
-        # FIXME: See the comments in chromium_{win,mac}.py about why we need
-        # the 'rebaselining' keyword.
-        self._rebaseline_port = port.get(
-            self._target_port.test_platform_name_to_name(platform), options,
-            filesystem=self._filesystem, rebaselining=True)
+        self._rebaseline_port = port.get(platform, options, filesystem=self._filesystem)
         self._rebaselining_tests = set()
         self._rebaselined_tests = []
 
@@ -185,13 +182,13 @@ class Rebaseliner(object):
         self._zip_factory = zip_factory
         self._scm = scm
 
-    def run(self, backup):
+    def run(self):
         """Run rebaseline process."""
 
         log_dashed_string('Compiling rebaselining tests', self._platform)
         if not self._compile_rebaselining_tests():
             return False
-        if not self.get_rebaselining_tests():
+        if not self._rebaselining_tests:
             return True
 
         log_dashed_string('Downloading archive', self._platform)
@@ -209,8 +206,6 @@ class Rebaseliner(object):
         archive_file.close()
 
         log_dashed_string('Updating rebaselined tests in file', self._platform)
-        self._update_rebaselined_tests_in_file(backup)
-        _log.info('')
 
         if len(self._rebaselining_tests) != len(self._rebaselined_tests):
             _log.warning('NOT ALL TESTS THAT NEED REBASELINING HAVE BEEN REBASELINED.')
@@ -222,8 +217,23 @@ class Rebaseliner(object):
 
         return True
 
-    def get_rebaselining_tests(self):
-        return self._rebaselining_tests
+    def remove_rebaselining_expectations(self, tests, backup):
+        """if backup is True, we backup the original test expectations file."""
+        new_expectations = self._test_expectations.remove_rebaselined_tests(tests)
+        path = self._target_port.path_to_test_expectations_file()
+        if backup:
+            date_suffix = time.strftime('%Y%m%d%H%M%S', time.localtime(time.time()))
+            backup_file = '%s.orig.%s' % (path, date_suffix)
+            if self._filesystem.exists(backup_file):
+                self._filesystem.remove(backup_file)
+            _log.info('Saving original file to "%s"', backup_file)
+            self._filesystem.move(path, backup_file)
+
+        self._filesystem.write_text_file(path, new_expectations)
+        # self._scm.add(path)
+
+    def get_rebaselined_tests(self):
+        return self._rebaselined_tests
 
     def _compile_rebaselining_tests(self):
         """Compile list of tests that need rebaselining for the platform.
@@ -232,8 +242,7 @@ class Rebaseliner(object):
           False if reftests are wrongly marked as 'needs rebaselining' or True
         """
 
-        self._rebaselining_tests = \
-            self._test_expectations.get_rebaselining_failures()
+        self._rebaselining_tests = self._test_expectations.get_rebaselining_failures()
         if not self._rebaselining_tests:
             _log.warn('No tests found that need rebaselining.')
             return True
@@ -307,13 +316,7 @@ class Rebaseliner(object):
         if self._options.force_archive_url:
             return self._options.force_archive_url
 
-        platform = self._platform
-        if self._options.webkit_canary:
-            platform += '-canary'
-        if self._options.gpu:
-            platform = 'gpu-' + platform
-
-        dir_name = self._get_archive_dir_name(platform)
+        dir_name = self._get_archive_dir_name(self._platform)
         if not dir_name:
             return None
 
@@ -349,8 +352,7 @@ class Rebaseliner(object):
         for name in zip_namelist:
             _log.debug('  ' + name)
 
-        platform = self._rebaseline_port.test_platform_name_to_name(self._platform)
-        _log.debug('Platform dir: "%s"', platform)
+        _log.debug('Platform dir: "%s"', self._platform)
 
         self._rebaselined_tests = []
         for test_no, test in enumerate(self._rebaselining_tests):
@@ -392,6 +394,12 @@ class Rebaseliner(object):
                 self._delete_baseline(expected_fullpath)
                 continue
 
+            if suffix == '.checksum' and self._png_has_same_checksum(temp_name, test, expected_fullpath):
+                self._filesystem.remove(temp_name)
+                # If an old checksum exists, delete it.
+                self._delete_baseline(expected_fullpath)
+                continue
+
             self._filesystem.maybe_make_directory(self._filesystem.dirname(expected_fullpath))
             self._filesystem.move(temp_name, expected_fullpath)
 
@@ -419,15 +427,40 @@ class Rebaseliner(object):
         tempfile.close()
         return temp_name
 
-    def _is_dup_baseline(self, new_baseline, baseline_path, test, suffix,
-                         platform):
+    def _png_has_same_checksum(self, checksum_path, test, checksum_expected_fullpath):
+        """Returns True if the fallback png for |checksum_expected_fullpath|
+        contains the same checksum."""
+        fs = self._filesystem
+        png_fullpath = self._first_fallback_png_for_test(test)
+
+        if not fs.exists(png_fullpath):
+            _log.error('  Checksum without png file found! Expected %s to exist.' % png_fullpath)
+            return False
+
+        with fs.open_binary_file_for_reading(png_fullpath) as filehandle:
+            checksum_in_png = read_checksum_from_png.read_checksum(filehandle)
+            checksum_in_text_file = fs.read_text_file(checksum_path)
+            if checksum_in_png and checksum_in_png != checksum_in_text_file:
+                _log.error("  checksum in %s and %s don't match!  Continuing"
+                           " to copy but please investigate." % (
+                           checksum_expected_fullpath, png_fullpath))
+            return checksum_in_text_file == checksum_in_png
+
+    def _first_fallback_png_for_test(self, test):
+        test_filepath = self._filesystem.join(self._target_port.layout_tests_dir(), test)
+        all_baselines = self._rebaseline_port.expected_baselines(
+            test_filepath, '.png', True)
+        return self._filesystem.join(all_baselines[0][0], all_baselines[0][1])
+
+    def _is_dup_baseline(self, new_baseline, baseline_path, test, suffix, platform):
         """Check whether a baseline is duplicate and can fallback to same
            baseline for another platform. For example, if a test has same
            baseline on linux and windows, then we only store windows
            baseline and linux baseline will fallback to the windows version.
 
         Args:
-          expected_filename: baseline expectation file name.
+          new_baseline: temp filename containing the new baseline results
+          baseline_path: baseline expectation file name.
           test: test name.
           suffix: file suffix of the expected results, including dot;
                   e.g. '.txt' or '.png'.
@@ -487,33 +520,6 @@ class Rebaseliner(object):
             return
         self._scm.delete(filename)
 
-    def _update_rebaselined_tests_in_file(self, backup):
-        """Update the rebaselined tests in test expectations file.
-
-        Args:
-          backup: if True, backup the original test expectations file.
-
-        Returns:
-          no
-        """
-
-        if self._rebaselined_tests:
-            new_expectations = self._test_expectations.remove_platform_from_expectations(
-                self._rebaselined_tests, self._platform)
-            path = self._target_port.path_to_test_expectations_file()
-            if backup:
-                date_suffix = time.strftime('%Y%m%d%H%M%S', time.localtime(time.time()))
-                backup_file = '%s.orig.%s' % (path, date_suffix)
-                if self._filesystem.exists(backup_file):
-                    self._filesystem.remove(backup_file)
-                _log.info('Saving original file to "%s"', backup_file)
-                self._filesystem.move(path, backup_file)
-
-            self._filesystem.write_text_file(path, new_expectations)
-            # self._scm.add(path)
-        else:
-            _log.info('No test was rebaselined so nothing to remove.')
-
     def _create_html_baseline_files(self, baseline_fullpath):
         """Create baseline files (old, new and diff) in html directory.
 
@@ -792,10 +798,6 @@ def parse_options(args):
                              action='store_true',
                              help='Suppress result HTML viewing')
 
-    option_parser.add_option('-g', '--gpu',
-                            action='store_true', default=False,
-                            help='Rebaseline the GPU versions')
-
     option_parser.add_option('-p', '--platforms',
                              default=None,
                              help=('Comma delimited list of platforms '
@@ -810,12 +812,6 @@ def parse_options(args):
                              help=('Url of result zip file. This option is for debugging '
                                    'purposes'))
 
-    option_parser.add_option('-w', '--webkit_canary',
-                             action='store_true',
-                             default=False,
-                             help=('If True, pull baselines from webkit.org '
-                                   'canary bot.'))
-
     option_parser.add_option('-b', '--backup',
                              action='store_true',
                              default=False,
@@ -833,17 +829,21 @@ def parse_options(args):
                              help=('Use ImageDiff from DumpRenderTree instead '
                                    'of image_diff for pixel tests.'))
 
+    option_parser.add_option('-w', '--webkit_canary',
+                             action='store_true',
+                             default=False,
+                             help=('DEPRECATED. This flag no longer has any effect.'
+                                   '  The canaries are always used.'))
+
     option_parser.add_option('', '--target-platform',
                              default='chromium',
                              help=('The target platform to rebaseline '
                                    '("mac", "chromium", "qt", etc.). Defaults '
                                    'to "chromium".'))
+
     options = option_parser.parse_args(args)[0]
-    if options.platforms == None:
-        if options.gpu:
-            options.platforms = 'mac,win,linux'
-        else:
-            options.platforms = 'mac,win,win-xp,win-vista,linux'
+    if options.webkit_canary:
+        print "-w/--webkit-canary is no longer necessary, ignoring."
 
     target_options = copy.copy(options)
     if options.target_platform == 'chromium':
@@ -866,10 +866,7 @@ def main(args):
                                 '%(levelname)s %(message)s'),
                         datefmt='%y%m%d %H:%M:%S')
 
-    target_port_name = None
-    if options.gpu and options.target_platform == 'chromium':
-        target_port_name = 'chromium-gpu'
-    target_port_obj = port.get(target_port_name, target_options)
+    target_port_obj = port.get(None, target_options)
     host_port_obj = get_host_port_object(options)
     if not host_port_obj or not target_port_obj:
         return 1
@@ -906,30 +903,21 @@ def real_main(options, target_options, host_port_obj, target_port_obj, url_fetch
             the archives.
         scm_obj: object used to add new baselines to the source control system.
     """
-    # Verify 'platforms' option is valid.
-    if not options.platforms:
-        _log.error('Invalid "platforms" option. --platforms must be '
-                   'specified in order to rebaseline.')
-        return 1
-    platforms = [p.strip().lower() for p in options.platforms.split(',')]
-    for platform in platforms:
-        if not platform in REBASELINE_PLATFORM_ORDER:
-            _log.error('Invalid platform: "%s"' % (platform))
-            return 1
-
-    # Adjust the platform order so rebaseline tool is running at the order of
-    # 'mac', 'win' and 'linux'. This is in same order with layout test baseline
-    # search paths. It simplifies how the rebaseline tool detects duplicate
-    # baselines. Check _IsDupBaseline method for details.
-    rebaseline_platforms = []
-    for platform in REBASELINE_PLATFORM_ORDER:
-        if platform in platforms:
-            rebaseline_platforms.append(platform)
-
     options.html_directory = setup_html_directory(host_port_obj._filesystem, options.html_directory)
+    all_platforms = target_port_obj.all_baseline_variants()
+    if options.platforms:
+        bail = False
+        for platform in options.platforms:
+            if not platform in all_platforms:
+                _log.error('Invalid platform: "%s"' % (platform))
+                bail = True
+        if bail:
+            return 1
+        rebaseline_platforms = options.platforms
+    else:
+        rebaseline_platforms = all_platforms
 
-    rebaselining_tests = set()
-    backup = options.backup
+    rebaselined_tests = set()
     for platform in rebaseline_platforms:
         rebaseliner = Rebaseliner(host_port_obj, target_port_obj,
                                   platform, options, url_fetcher, zip_factory,
@@ -937,14 +925,16 @@ def real_main(options, target_options, host_port_obj, target_port_obj, url_fetch
 
         _log.info('')
         log_dashed_string('Rebaseline started', platform)
-        if rebaseliner.run(backup):
-            # Only need to backup one original copy of test expectation file.
-            backup = False
+        if rebaseliner.run():
             log_dashed_string('Rebaseline done', platform)
         else:
             log_dashed_string('Rebaseline failed', platform, logging.ERROR)
 
-        rebaselining_tests |= set(rebaseliner.get_rebaselining_tests())
+        rebaselined_tests |= set(rebaseliner.get_rebaselined_tests())
+
+    if rebaselined_tests:
+        rebaseliner.remove_rebaselining_expectations(rebaselined_tests,
+                                                     options.backup)
 
     _log.info('')
     log_dashed_string('Rebaselining result comparison started', None)
@@ -952,7 +942,7 @@ def real_main(options, target_options, host_port_obj, target_port_obj, url_fetch
                                    target_port_obj,
                                    options,
                                    rebaseline_platforms,
-                                   rebaselining_tests)
+                                   rebaselined_tests)
     html_generator.generate_html()
     if not options.quiet:
         html_generator.show_html()
diff --git a/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py b/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
index 7179bb7..73bc1a7 100644
--- a/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
@@ -65,13 +65,9 @@ def test_options():
                                 html_directory='/tmp',
                                 archive_url=ARCHIVE_URL,
                                 force_archive_url=None,
-                                webkit_canary=True,
-                                use_drt=False,
-                                target_platform='chromium',
                                 verbose=False,
                                 quiet=False,
-                                platforms='mac,win,win-xp',
-                                gpu=False)
+                                platforms=None)
 
 
 def test_host_port_and_filesystem(options, expectations):
@@ -86,8 +82,12 @@ def test_host_port_and_filesystem(options, expectations):
 
 def test_url_fetcher(filesystem):
     urls = {
+        ARCHIVE_URL + '/Webkit_Mac10_6/': '<a href="4/">',
         ARCHIVE_URL + '/Webkit_Mac10_5/': '<a href="1/"><a href="2/">',
+        ARCHIVE_URL + '/Webkit_Win7/': '<a href="1/">',
+        ARCHIVE_URL + '/Webkit_Vista/': '<a href="1/">',
         ARCHIVE_URL + '/Webkit_Win/': '<a href="1/">',
+        ARCHIVE_URL + '/Webkit_Linux/': '<a href="1/">',
     }
     return urlfetcher_mock.make_fetcher_cls(urls)(filesystem)
 
@@ -98,8 +98,31 @@ def test_zip_factory():
             'layout-test-results/failures/expected/image-actual.txt': 'new-image-txt',
             'layout-test-results/failures/expected/image-actual.checksum': 'new-image-checksum',
             'layout-test-results/failures/expected/image-actual.png': 'new-image-png',
+            'layout-test-results/failures/expected/image_checksum-actual.txt': 'png-comment-txt',
+            'layout-test-results/failures/expected/image_checksum-actual.checksum': '0123456789',
+            'layout-test-results/failures/expected/image_checksum-actual.png': 'tEXtchecksum\x000123456789',
         },
-        ARCHIVE_URL + '/Webkit_Win/1/layout-test-results.zip': {
+        ARCHIVE_URL + '/Webkit_Mac10_6/4/layout-test-results.zip': {
+            'layout-test-results/failures/expected/image-actual.txt': 'new-image-txt',
+            'layout-test-results/failures/expected/image-actual.checksum': 'new-image-checksum',
+            'layout-test-results/failures/expected/image-actual.png': 'new-image-png',
+        },
+         ARCHIVE_URL + '/Webkit_Vista/1/layout-test-results.zip': {
+            'layout-test-results/failures/expected/image-actual.txt': 'win-image-txt',
+            'layout-test-results/failures/expected/image-actual.checksum': 'win-image-checksum',
+            'layout-test-results/failures/expected/image-actual.png': 'win-image-png',
+        },
+          ARCHIVE_URL + '/Webkit_Win7/1/layout-test-results.zip': {
+            'layout-test-results/failures/expected/image-actual.txt': 'win-image-txt',
+            'layout-test-results/failures/expected/image-actual.checksum': 'win-image-checksum',
+            'layout-test-results/failures/expected/image-actual.png': 'win-image-png',
+        },
+          ARCHIVE_URL + '/Webkit_Win/1/layout-test-results.zip': {
+            'layout-test-results/failures/expected/image-actual.txt': 'win-image-txt',
+            'layout-test-results/failures/expected/image-actual.checksum': 'win-image-checksum',
+            'layout-test-results/failures/expected/image-actual.png': 'win-image-png',
+        },
+          ARCHIVE_URL + '/Webkit_Linux/1/layout-test-results.zip': {
             'layout-test-results/failures/expected/image-actual.txt': 'win-image-txt',
             'layout-test-results/failures/expected/image-actual.checksum': 'win-image-checksum',
             'layout-test-results/failures/expected/image-actual.png': 'win-image-png',
@@ -108,6 +131,14 @@ def test_zip_factory():
     return zipfileset_mock.make_factory(ziphashes)
 
 
+def test_archive(orig_archive_dict):
+    new_archive_dict = {}
+    for platform, dirname in orig_archive_dict.iteritems():
+        platform = platform.replace('chromium', 'test')
+        new_archive_dict[platform] = dirname
+    return new_archive_dict
+
+
 class TestGetHostPortObject(unittest.TestCase):
     def assert_result(self, release_present, debug_present, valid_port_obj):
         # Tests whether we get a valid port object returned when we claim
@@ -150,6 +181,14 @@ class TestOptions(unittest.TestCase):
 
 
 class TestRebaseliner(unittest.TestCase):
+    def setUp(self):
+        if not hasattr(self, '_orig_archive'):
+            self._orig_archive = rebaseline_chromium_webkit_tests.ARCHIVE_DIR_NAME_DICT
+            rebaseline_chromium_webkit_tests.ARCHIVE_DIR_NAME_DICT = test_archive(self._orig_archive)
+
+    def tearDown(self):
+        rebaseline_chromium_webkit_tests.ARCHIVE_DIR_NAME_DICT = self._orig_archive
+
     def make_rebaseliner(self, expectations):
         options = test_options()
         host_port_obj, filesystem = test_host_port_and_filesystem(options, expectations)
@@ -158,11 +197,11 @@ class TestRebaseliner(unittest.TestCase):
         target_port_obj = port.get('test', target_options,
                                    filesystem=filesystem)
         target_port_obj._expectations = expectations
-        platform = target_port_obj.test_platform_name()
+        platform = target_port_obj.name()
 
         url_fetcher = test_url_fetcher(filesystem)
         zip_factory = test_zip_factory()
-        mock_scm = mocktool.MockSCM()
+        mock_scm = mocktool.MockSCM(filesystem)
         rebaseliner = rebaseline_chromium_webkit_tests.Rebaseliner(host_port_obj,
             target_port_obj, platform, options, url_fetcher, zip_factory, mock_scm)
         return rebaseliner, filesystem
@@ -171,7 +210,7 @@ class TestRebaseliner(unittest.TestCase):
         # this method tests that was can at least instantiate an object, even
         # if there is nothing to do.
         rebaseliner, filesystem = self.make_rebaseliner("")
-        rebaseliner.run(False)
+        rebaseliner.run()
         self.assertEqual(len(filesystem.written_files), 1)
 
     def test_rebaselining_tests(self):
@@ -179,19 +218,19 @@ class TestRebaseliner(unittest.TestCase):
             "BUGX REBASELINE MAC : failures/expected/image.html = IMAGE")
         compile_success = rebaseliner._compile_rebaselining_tests()
         self.assertTrue(compile_success)
-        self.assertEqual(set(['failures/expected/image.html']), rebaseliner.get_rebaselining_tests())
+        self.assertEqual(set(['failures/expected/image.html']), rebaseliner._rebaselining_tests)
 
     def test_rebaselining_tests_should_ignore_reftests(self):
         rebaseliner, filesystem = self.make_rebaseliner(
             "BUGX REBASELINE : failures/expected/reftest.html = IMAGE")
         compile_success = rebaseliner._compile_rebaselining_tests()
         self.assertFalse(compile_success)
-        self.assertFalse(rebaseliner.get_rebaselining_tests())
+        self.assertFalse(rebaseliner._rebaselining_tests)
 
     def test_one_platform(self):
         rebaseliner, filesystem = self.make_rebaseliner(
             "BUGX REBASELINE MAC : failures/expected/image.html = IMAGE")
-        rebaseliner.run(False)
+        rebaseliner.run()
         # We expect to have written 12 files over the course of this rebaseline:
         # *) 3 files in /__im_tmp for the extracted archive members
         # *) 3 new baselines under '/test.checkout/LayoutTests'
@@ -201,25 +240,67 @@ class TestRebaseliner(unittest.TestCase):
         #    create image diffs (FIXME?) and don't display the checksums.
         # *) 1 updated test_expectations file
         self.assertEqual(len(filesystem.written_files), 12)
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test/test_expectations.txt'], '')
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac/failures/expected/image-expected.checksum'], 'new-image-checksum')
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac/failures/expected/image-expected.png'], 'new-image-png')
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac/failures/expected/image-expected.txt'], 'new-image-txt')
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image-expected.checksum'], 'new-image-checksum')
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image-expected.png'], 'new-image-png')
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image-expected.txt'], 'new-image-txt')
 
     def test_all_platforms(self):
         rebaseliner, filesystem = self.make_rebaseliner(
             "BUGX REBASELINE : failures/expected/image.html = IMAGE")
-        rebaseliner.run(False)
+        rebaseliner.run()
         # See comment in test_one_platform for an explanation of the 12 written tests.
         # Note that even though the rebaseline is marked for all platforms, each
         # rebaseliner only ever does one.
         self.assertEqual(len(filesystem.written_files), 12)
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test/test_expectations.txt'],
-            'BUGX REBASELINE WIN : failures/expected/image.html = IMAGE\n'
-            'BUGX REBASELINE WIN-XP : failures/expected/image.html = IMAGE\n')
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac/failures/expected/image-expected.checksum'], 'new-image-checksum')
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac/failures/expected/image-expected.png'], 'new-image-png')
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac/failures/expected/image-expected.txt'], 'new-image-txt')
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image-expected.checksum'], 'new-image-checksum')
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image-expected.png'], 'new-image-png')
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image-expected.txt'], 'new-image-txt')
+
+    def test_png_file_with_comment(self):
+        rebaseliner, filesystem = self.make_rebaseliner(
+            "BUGX REBASELINE MAC : failures/expected/image_checksum.html = IMAGE")
+        compile_success = rebaseliner._compile_rebaselining_tests()
+        self.assertTrue(compile_success)
+        self.assertEqual(set(['failures/expected/image_checksum.html']), rebaseliner._rebaselining_tests)
+        rebaseliner.run()
+        # There is one less file written than |test_one_platform| because we only
+        # write 2 expectations (the png and the txt file).
+        self.assertEqual(len(filesystem.written_files), 11)
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.png'], 'tEXtchecksum\x000123456789')
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.txt'], 'png-comment-txt')
+        self.assertFalse(filesystem.files.get('/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.checksum', None))
+
+    def test_png_file_with_comment_remove_old_checksum(self):
+        rebaseliner, filesystem = self.make_rebaseliner(
+            "BUGX REBASELINE MAC : failures/expected/image_checksum.html = IMAGE")
+        filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.png'] = 'old'
+        filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.checksum'] = 'old'
+        filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.txt'] = 'old'
+
+        compile_success = rebaseliner._compile_rebaselining_tests()
+        self.assertTrue(compile_success)
+        self.assertEqual(set(['failures/expected/image_checksum.html']), rebaseliner._rebaselining_tests)
+        rebaseliner.run()
+        # There is one more file written than |test_png_file_with_comment_remove_old_checksum|
+        # because we also delete the old checksum.
+        self.assertEqual(len(filesystem.written_files), 12)
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.png'], 'tEXtchecksum\x000123456789')
+        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.txt'], 'png-comment-txt')
+        self.assertEqual(filesystem.files.get('/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.checksum', None), None)
+
+    def test_png_file_with_comment_as_duplicate(self):
+        rebaseliner, filesystem = self.make_rebaseliner(
+            "BUGX REBASELINE MAC : failures/expected/image_checksum.html = IMAGE")
+        filesystem.files['/test.checkout/LayoutTests/platform/test-mac-snowleopard/failures/expected/image_checksum-expected.png'] = 'tEXtchecksum\x000123456789'
+        filesystem.files['/test.checkout/LayoutTests/platform/test-mac-snowleopard/failures/expected/image_checksum-expected.txt'] = 'png-comment-txt'
+
+        compile_success = rebaseliner._compile_rebaselining_tests()
+        self.assertTrue(compile_success)
+        self.assertEqual(set(['failures/expected/image_checksum.html']), rebaseliner._rebaselining_tests)
+        rebaseliner.run()
+        self.assertEqual(filesystem.files.get('/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.png', None), None)
+        self.assertEqual(filesystem.files.get('/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.txt', None), None)
+        self.assertEqual(filesystem.files.get('/test.checkout/LayoutTests/platform/test-mac-leopard/failures/expected/image_checksum-expected.checksum', None), None)
 
     def test_diff_baselines_txt(self):
         rebaseliner, filesystem = self.make_rebaseliner("")
@@ -239,28 +320,37 @@ class TestRebaseliner(unittest.TestCase):
 
 
 class TestRealMain(unittest.TestCase):
+    def setUp(self):
+        if not hasattr(self, '_orig_archive'):
+            self._orig_archive = rebaseline_chromium_webkit_tests.ARCHIVE_DIR_NAME_DICT
+            rebaseline_chromium_webkit_tests.ARCHIVE_DIR_NAME_DICT = test_archive(self._orig_archive)
+
+    def tearDown(self):
+        rebaseline_chromium_webkit_tests.ARCHIVE_DIR_NAME_DICT = self._orig_archive
+
     def test_all_platforms(self):
         expectations = "BUGX REBASELINE : failures/expected/image.html = IMAGE"
 
         options = test_options()
-
         host_port_obj, filesystem = test_host_port_and_filesystem(options, expectations)
         url_fetcher = test_url_fetcher(filesystem)
         zip_factory = test_zip_factory()
         mock_scm = mocktool.MockSCM()
         oc = outputcapture.OutputCapture()
         oc.capture_output()
-        rebaseline_chromium_webkit_tests.real_main(options, options, host_port_obj,
-            host_port_obj, url_fetcher, zip_factory, mock_scm)
+        res = rebaseline_chromium_webkit_tests.real_main(options, options,
+            host_port_obj, host_port_obj, url_fetcher, zip_factory, mock_scm)
         oc.restore_output()
 
-        # We expect to have written 35 files over the course of this rebaseline:
-        # *) 11 files * 3 ports for the new baselines and the diffs (see breakdown
-        #    under test_one_platform, above)
-        # *) the updated test_expectations file
-        # *) the rebaseline results html file
-        self.assertEqual(len(filesystem.written_files), 35)
-        self.assertEqual(filesystem.files['/test.checkout/LayoutTests/platform/test/test_expectations.txt'], '')
+        # We expect to have written 36 files over the course of this rebaseline:
+        # *) 6*3 files in /__im_tmp/ for the archived members of the 6 ports
+        # *) 2*3 files in /test.checkout for actually differing baselines
+        # *) 1 file in /test.checkout for the updated test_expectations file
+        # *) 2*4 files in /tmp for the old/new baselines for the two actual ports
+        # *) 2 files in /tmp for the text diffs for the two ports
+        # *) 1 file in /tmp for the rebaseline results html file
+        self.assertEqual(res, 0)
+        self.assertEqual(len(filesystem.written_files), 36)
 
 
 class TestHtmlGenerator(unittest.TestCase):
@@ -268,7 +358,7 @@ class TestHtmlGenerator(unittest.TestCase):
         options = mocktool.MockOptions(configuration=None, html_directory='/tmp')
         host_port = port.get('test', options, filesystem=port.unit_test_filesystem(files))
         generator = rebaseline_chromium_webkit_tests.HtmlGenerator(host_port,
-            target_port=None, options=options, platforms=['mac'], rebaselining_tests=tests)
+            target_port=None, options=options, platforms=['test-mac-leopard'], rebaselining_tests=tests)
         return generator, host_port
 
     def test_generate_baseline_links(self):
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
index d27ea1e..e814008 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
@@ -79,7 +79,7 @@ def run(port, options, args, regular_output=sys.stderr,
         printer.cleanup()
         return 0
 
-    last_unexpected_results = _gather_unexpected_results(port._filesystem, options)
+    last_unexpected_results = _gather_unexpected_results(port)
     if options.print_last_failures:
         printer.write("\n".join(last_unexpected_results) + "\n")
         printer.cleanup()
@@ -89,11 +89,7 @@ def run(port, options, args, regular_output=sys.stderr,
     # in a try/finally to ensure that we clean up the logging configuration.
     num_unexpected_results = -1
     try:
-        if options.worker_model in ('inline', 'threads', 'processes'):
-            runner = test_runner2.TestRunner2(port, options, printer)
-        else:
-            runner = test_runner.TestRunner(port, options, printer)
-
+        runner = test_runner2.TestRunner2(port, options, printer)
         runner._print_config()
 
         printer.print_update("Collecting tests ...")
@@ -135,9 +131,9 @@ def _set_up_derived_options(port_obj, options):
     if options.worker_model is None:
         options.worker_model = port_obj.default_worker_model()
 
-    if options.worker_model in ('inline', 'old-inline'):
+    if options.worker_model == 'inline':
         if options.child_processes and int(options.child_processes) > 1:
-            warnings.append("--worker-model=%s overrides --child-processes" % options.worker_model)
+            warnings.append("--worker-model=inline overrides --child-processes")
         options.child_processes = "1"
     if not options.child_processes:
         options.child_processes = os.environ.get("WEBKIT_TEST_CHILD_PROCESSES",
@@ -152,12 +148,6 @@ def _set_up_derived_options(port_obj, options):
     if not options.use_apache:
         options.use_apache = sys.platform in ('darwin', 'linux2')
 
-    if not port_obj._filesystem.isabs(options.results_directory):
-        # This normalizes the path to the build dir.
-        # FIXME: how this happens is not at all obvious; this is a dumb
-        # interface and should be cleaned up.
-        options.results_directory = port_obj.results_directory()
-
     if not options.time_out_ms:
         if options.configuration == "Debug":
             options.time_out_ms = str(2 * test_runner.TestRunner.DEFAULT_TEST_TIMEOUT_MS)
@@ -165,14 +155,27 @@ def _set_up_derived_options(port_obj, options):
             options.time_out_ms = str(test_runner.TestRunner.DEFAULT_TEST_TIMEOUT_MS)
 
     options.slow_time_out_ms = str(5 * int(options.time_out_ms))
+
+    if options.additional_platform_directory:
+        normalized_platform_directories = []
+        for path in options.additional_platform_directory:
+            if not port_obj._filesystem.isabs(path):
+                warnings.append("--additional-platform-directory=%s is ignored since it is not absolute" % path)
+                continue
+            normalized_platform_directories.append(port_obj._filesystem.normpath(path))
+        options.additional_platform_directory = normalized_platform_directories
+
     return warnings
 
 
-def _gather_unexpected_results(filesystem, options):
+def _gather_unexpected_results(port):
     """Returns the unexpected results from the previous run, if any."""
+    filesystem = port._filesystem
+    results_directory = port.results_directory()
+    options = port._options
     last_unexpected_results = []
     if options.print_last_failures or options.retest_last_failures:
-        unexpected_results_filename = filesystem.join(options.results_directory, "unexpected_results.json")
+        unexpected_results_filename = filesystem.join(results_directory, "unexpected_results.json")
         if filesystem.exists(unexpected_results_filename):
             results = json_results_generator.load_json(filesystem, unexpected_results_filename)
             last_unexpected_results = results['tests'].keys()
@@ -275,10 +278,7 @@ def parse_args(args=None):
         optparse.make_option("--tolerance",
             help="Ignore image differences less than this percentage (some "
                 "ports may ignore this option)", type="float"),
-        optparse.make_option("--results-directory",
-            default="layout-test-results",
-            help="Output results directory source dir, relative to Debug or "
-                 "Release"),
+        optparse.make_option("--results-directory", help="Location of test results"),
         optparse.make_option("--build-directory",
             help="Path to the directory under which build files are kept (should not include configuration)"),
         optparse.make_option("--new-baseline", action="store_true",
@@ -288,6 +288,13 @@ def parse_args(args=None):
         optparse.make_option("--reset-results", action="store_true",
             default=False, help="Reset any existing baselines to the "
                  "generated results"),
+        optparse.make_option("--additional-drt-flag", action="append",
+            default=[], help="Additional command line flag to pass to DumpRenderTree "
+                 "Specify multiple times to add multiple flags."),
+        optparse.make_option("--additional-platform-directory", action="append",
+            default=[], help="Additional directory where to look for test "
+                 "baselines (will take precendence over platform baselines). "
+                 "Specify multiple times to add multiple search path entries."),
         optparse.make_option("--no-show-results", action="store_false",
             default=True, dest="show_results",
             help="Don't launch a browser with results after the tests "
@@ -370,8 +377,8 @@ def parse_args(args=None):
             help="Number of DumpRenderTrees to run in parallel."),
         # FIXME: Display default number of child processes that will run.
         optparse.make_option("--worker-model", action="store",
-            default=None, help=("controls worker model. Valid values are 'old-inline', "
-                                "'old-threads', 'inline', 'threads', and 'processes'.")),
+            default=None, help=("controls worker model. Valid values are "
+                                "'inline', 'threads', and 'processes'.")),
         optparse.make_option("--experimental-fully-parallel",
             action="store_true", default=False,
             help="run all tests in parallel"),
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
index 7076ef2..940b4b8 100644
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
@@ -35,6 +35,7 @@ from __future__ import with_statement
 import codecs
 import itertools
 import logging
+import os
 import Queue
 import sys
 import thread
@@ -53,7 +54,6 @@ from webkitpy.common.system import filesystem_mock
 from webkitpy.tool import mocktool
 from webkitpy.layout_tests import port
 from webkitpy.layout_tests import run_webkit_tests
-from webkitpy.layout_tests.layout_package import dump_render_tree_thread
 from webkitpy.layout_tests.port.test import TestPort, TestDriver
 from webkitpy.layout_tests.port.test_files import is_reference_html_file
 from webkitpy.python24.versioning import compare_version
@@ -196,16 +196,20 @@ class MainTest(unittest.TestCase):
             self.assertTrue(len(batch) <= 2, '%s had too many tests' % ', '.join(batch))
 
     def test_child_process_1(self):
-        (res, buildbot_output, regular_output, user) = logging_run(
+        _, _, regular_output, _ = logging_run(
              ['--print', 'config', '--worker-model', 'threads', '--child-processes', '1'])
-        self.assertTrue('Running one DumpRenderTree\n'
-                        in regular_output.get())
+        self.assertTrue(any(['Running 1 ' in line for line in regular_output.get()]))
 
     def test_child_processes_2(self):
-        (res, buildbot_output, regular_output, user) = logging_run(
+        _, _, regular_output, _ = logging_run(
              ['--print', 'config', '--worker-model', 'threads', '--child-processes', '2'])
-        self.assertTrue('Running 2 DumpRenderTrees in parallel\n'
-                        in regular_output.get())
+        self.assertTrue(any(['Running 2 ' in line for line in regular_output.get()]))
+
+    def test_child_processes_min(self):
+        _, _, regular_output, _ = logging_run(
+             ['--print', 'config', '--worker-model', 'threads', '--child-processes', '2', 'passes'],
+             tests_included=True)
+        self.assertTrue(any(['Running 1 ' in line for line in regular_output.get()]))
 
     def test_dryrun(self):
         batch_tests_run = get_tests_run(['--dry-run'])
@@ -252,8 +256,8 @@ class MainTest(unittest.TestCase):
         fs = port.unit_test_filesystem()
         # We do a logging run here instead of a passing run in order to
         # suppress the output from the json generator.
-        (res, buildbot_output, regular_output, user) = logging_run(['--clobber-old-results'], record_results=True, filesystem=fs)
-        (res, buildbot_output, regular_output, user) = logging_run(
+        res, buildbot_output, regular_output, user = logging_run(['--clobber-old-results'], record_results=True, filesystem=fs)
+        res, buildbot_output, regular_output, user = logging_run(
             ['--print-last-failures'], filesystem=fs)
         self.assertEqual(regular_output.get(), ['\n\n'])
         self.assertEqual(buildbot_output.get(), [])
@@ -324,6 +328,10 @@ class MainTest(unittest.TestCase):
         for batch in batch_tests_run:
             self.assertEquals(len(batch), 1, '%s had too many tests' % ', '.join(batch))
 
+    def test_run_singly_actually_runs_tests(self):
+        res, _, _, _ = logging_run(['--run-singly', 'failures/unexpected'])
+        self.assertEquals(res, 5)
+
     def test_single_file(self):
         tests_run = get_tests_run(['passes/text.html'], tests_included=True, flatten_batches=True)
         self.assertEquals(['passes/text.html'], tests_run)
@@ -336,6 +344,12 @@ class MainTest(unittest.TestCase):
         tests_run = get_tests_run(['failures/expected/keybaord.html'], tests_included=True, flatten_batches=True)
         self.assertEquals([], tests_run)
 
+    def test_stderr_is_saved(self):
+        fs = port.unit_test_filesystem()
+        self.assertTrue(passing_run(filesystem=fs))
+        self.assertEquals(fs.read_text_file('/tmp/layout-test-results/passes/error-stderr.txt'),
+                          'stuff going to stderr')
+
     def test_test_list(self):
         fs = port.unit_test_filesystem()
         filename = '/tmp/foo.txt'
@@ -371,7 +385,7 @@ class MainTest(unittest.TestCase):
 
     def test_exit_after_n_failures_upload(self):
         fs = port.unit_test_filesystem()
-        (res, buildbot_output, regular_output, user) = logging_run([
+        res, buildbot_output, regular_output, user = logging_run([
                 'failures/unexpected/text-image-checksum.html',
                 'passes/text.html',
                 '--exit-after-n-failures', '1',
@@ -465,10 +479,12 @@ class MainTest(unittest.TestCase):
     def test_results_directory_relative(self):
         # We run a configuration that should fail, to generate output, then
         # look for what the output results url was.
-
+        fs = port.unit_test_filesystem()
+        fs.maybe_make_directory('/tmp/cwd')
+        fs.chdir('/tmp/cwd')
         res, out, err, user = logging_run(['--results-directory=foo'],
-                                          tests_included=True)
-        self.assertEqual(user.opened_urls, ['/tmp/foo/results.html'])
+                                          tests_included=True, filesystem=fs)
+        self.assertEqual(user.opened_urls, ['/tmp/cwd/foo/results.html'])
 
     # These next tests test that we run the tests in ascending alphabetical
     # order per directory. HTTP tests are sharded separately from other tests,
@@ -487,15 +503,6 @@ class MainTest(unittest.TestCase):
     def test_run_order__inline(self):
         self.assert_run_order('inline')
 
-    def test_run_order__old_inline(self):
-        self.assert_run_order('old-inline')
-
-    def test_run_order__threads(self):
-        self.assert_run_order('old-inline', child_processes='2')
-
-    def test_run_order__old_threads(self):
-        self.assert_run_order('old-threads', child_processes='2')
-
     def test_tolerance(self):
         class ImageDiffTestPort(TestPort):
             def diff_image(self, expected_contents, actual_contents,
@@ -531,12 +538,6 @@ class MainTest(unittest.TestCase):
         self.assertEqual(res, 0)
         self.assertTrue('--worker-model=inline overrides --child-processes\n' in err.get())
 
-    def test_worker_model__old_inline(self):
-        self.assertTrue(passing_run(['--worker-model', 'old-inline']))
-
-    def test_worker_model__old_threads(self):
-        self.assertTrue(passing_run(['--worker-model', 'old-threads']))
-
     def test_worker_model__processes(self):
         # FIXME: remove this when we fix test-webkitpy to work properly
         # with the multiprocessing module (bug 54520).
@@ -572,6 +573,17 @@ class MainTest(unittest.TestCase):
                                   include_reference_html=True)
         self.assertEquals(['passes/mismatch.html', 'passes/mismatch-expected-mismatch.html'], tests_run)
 
+    def test_additional_platform_directory(self):
+        self.assertTrue(passing_run(['--additional-platform-directory', '/tmp/foo']))
+        self.assertTrue(passing_run(['--additional-platform-directory', '/tmp/../foo']))
+        self.assertTrue(passing_run(['--additional-platform-directory', '/tmp/foo',
+            '--additional-platform-directory', '/tmp/bar']))
+
+        res, buildbot_output, regular_output, user = logging_run(
+             ['--additional-platform-directory', 'foo'])
+        self.assertTrue('--additional-platform-directory=foo is ignored since it is not absolute\n'
+                        in regular_output.get())
+
 
 MainTest = skip_if(MainTest, sys.platform == 'cygwin' and compare_version(sys, '2.6')[0] < 0, 'new-run-webkit-tests tests hang on Cygwin Python 2.5.2')
 
@@ -616,9 +628,9 @@ class RebaselineTest(unittest.TestCase):
         file_list.remove('/tmp/layout-test-results/tests_run0.txt')
         self.assertEqual(len(file_list), 6)
         self.assertBaselines(file_list,
-            "/platform/test-mac/passes/image")
+            "/platform/test-mac-leopard/passes/image")
         self.assertBaselines(file_list,
-            "/platform/test-mac/failures/expected/missing_image")
+            "/platform/test-mac-leopard/failures/expected/missing_image")
 
 
 class DryrunTest(unittest.TestCase):
diff --git a/Tools/Scripts/webkitpy/style/checkers/cpp.py b/Tools/Scripts/webkitpy/style/checkers/cpp.py
index 7f8a9ea..0a0db54 100644
--- a/Tools/Scripts/webkitpy/style/checkers/cpp.py
+++ b/Tools/Scripts/webkitpy/style/checkers/cpp.py
@@ -312,7 +312,7 @@ class _IncludeState(dict):
     def visited_primary_section(self):
         return self._visited_primary_section
 
-    def check_next_include_order(self, header_type, file_is_header):
+    def check_next_include_order(self, header_type, file_is_header, primary_header_exists):
         """Returns a non-empty error message if the next header is out of order.
 
         This function also updates the internal state to be ready to check
@@ -357,7 +357,8 @@ class _IncludeState(dict):
         else:
             assert header_type == _OTHER_HEADER
             if not file_is_header and self._section < self._PRIMARY_SECTION:
-                error_message = before_error_message
+                if primary_header_exists:
+                    error_message = before_error_message
             self._section = self._OTHER_SECTION
 
         return error_message
@@ -2597,6 +2598,17 @@ def _classify_include(filename, include, is_system, include_state):
     return _OTHER_HEADER
 
 
+def _does_primary_header_exist(filename):
+    """Return a primary header file name for a file, or empty string
+    if the file is not source file or primary header does not exist.
+    """
+    fileinfo = FileInfo(filename)
+    if not fileinfo.is_source():
+        return False
+    primary_header = fileinfo.no_extension() + ".h"
+    return os.path.isfile(primary_header)
+
+
 def check_include_line(filename, file_extension, clean_lines, line_number, include_state, error):
     """Check rules that are applicable to #include lines.
 
@@ -2646,6 +2658,7 @@ def check_include_line(filename, file_extension, clean_lines, line_number, inclu
         include_state[include] = line_number
 
     header_type = _classify_include(filename, include, is_system, include_state)
+    primary_header_exists = _does_primary_header_exist(filename)
     include_state.header_types[line_number] = header_type
 
     # Only proceed if this isn't a duplicate header.
@@ -2657,7 +2670,9 @@ def check_include_line(filename, file_extension, clean_lines, line_number, inclu
     # 2) for header files: alphabetically sorted
     # The include_state object keeps track of the last type seen
     # and complains if the header types are out of order or missing.
-    error_message = include_state.check_next_include_order(header_type, file_extension == "h")
+    error_message = include_state.check_next_include_order(header_type,
+                                                           file_extension == "h",
+                                                           primary_header_exists)
 
     # Check to make sure we have a blank line after primary header.
     if not error_message and header_type == _PRIMARY_HEADER:
diff --git a/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py b/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
index 2d2abbf..a98d0dd 100644
--- a/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
+++ b/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
@@ -2452,18 +2452,20 @@ class OrderOfIncludesTest(CppStyleTestBase):
 
         # Cheat os.path.abspath called in FileInfo class.
         self.os_path_abspath_orig = os.path.abspath
+        self.os_path_isfile_orig = os.path.isfile
         os.path.abspath = lambda value: value
 
     def tearDown(self):
         os.path.abspath = self.os_path_abspath_orig
+        os.path.isfile = self.os_path_isfile_orig
 
     def test_check_next_include_order__no_config(self):
         self.assertEqual('Header file should not contain WebCore config.h.',
-                         self.include_state.check_next_include_order(cpp_style._CONFIG_HEADER, True))
+                         self.include_state.check_next_include_order(cpp_style._CONFIG_HEADER, True, True))
 
     def test_check_next_include_order__no_self(self):
         self.assertEqual('Header file should not contain itself.',
-                         self.include_state.check_next_include_order(cpp_style._PRIMARY_HEADER, True))
+                         self.include_state.check_next_include_order(cpp_style._PRIMARY_HEADER, True, True))
         # Test actual code to make sure that header types are correctly assigned.
         self.assert_language_rules_check('Foo.h',
                                          '#include "Foo.h"\n',
@@ -2475,22 +2477,22 @@ class OrderOfIncludesTest(CppStyleTestBase):
 
     def test_check_next_include_order__likely_then_config(self):
         self.assertEqual('Found header this file implements before WebCore config.h.',
-                         self.include_state.check_next_include_order(cpp_style._PRIMARY_HEADER, False))
+                         self.include_state.check_next_include_order(cpp_style._PRIMARY_HEADER, False, True))
         self.assertEqual('Found WebCore config.h after a header this file implements.',
-                         self.include_state.check_next_include_order(cpp_style._CONFIG_HEADER, False))
+                         self.include_state.check_next_include_order(cpp_style._CONFIG_HEADER, False, True))
 
     def test_check_next_include_order__other_then_config(self):
         self.assertEqual('Found other header before WebCore config.h.',
-                         self.include_state.check_next_include_order(cpp_style._OTHER_HEADER, False))
+                         self.include_state.check_next_include_order(cpp_style._OTHER_HEADER, False, True))
         self.assertEqual('Found WebCore config.h after other header.',
-                         self.include_state.check_next_include_order(cpp_style._CONFIG_HEADER, False))
+                         self.include_state.check_next_include_order(cpp_style._CONFIG_HEADER, False, True))
 
     def test_check_next_include_order__config_then_other_then_likely(self):
-        self.assertEqual('', self.include_state.check_next_include_order(cpp_style._CONFIG_HEADER, False))
+        self.assertEqual('', self.include_state.check_next_include_order(cpp_style._CONFIG_HEADER, False, True))
         self.assertEqual('Found other header before a header this file implements.',
-                         self.include_state.check_next_include_order(cpp_style._OTHER_HEADER, False))
+                         self.include_state.check_next_include_order(cpp_style._OTHER_HEADER, False, True))
         self.assertEqual('Found header this file implements after other header.',
-                         self.include_state.check_next_include_order(cpp_style._PRIMARY_HEADER, False))
+                         self.include_state.check_next_include_order(cpp_style._PRIMARY_HEADER, False, True))
 
     def test_check_alphabetical_include_order(self):
         self.assert_language_rules_check('foo.h',
@@ -2586,6 +2588,34 @@ class OrderOfIncludesTest(CppStyleTestBase):
                                          '#include "g.h"\n',
                                          '"foo.h" already included at foo.cpp:2  [build/include] [4]')
 
+    def test_primary_header(self):
+        # File with non-existing primary header should not produce errors.
+        self.assert_language_rules_check('foo.cpp',
+                                         '#include "config.h"\n'
+                                         '\n'
+                                         '#include "bar.h"\n',
+                                         '')
+        # Pretend that header files exist.
+        os.path.isfile = lambda filename: True
+        # Missing include for existing primary header -> error.
+        self.assert_language_rules_check('foo.cpp',
+                                         '#include "config.h"\n'
+                                         '\n'
+                                         '#include "bar.h"\n',
+                                         'Found other header before a header this file implements. '
+                                         'Should be: config.h, primary header, blank line, and then '
+                                         'alphabetically sorted.  [build/include_order] [4]')
+        # Having include for existing primary header -> no error.
+        self.assert_language_rules_check('foo.cpp',
+                                         '#include "config.h"\n'
+                                         '#include "foo.h"\n'
+                                         '\n'
+                                         '#include "bar.h"\n',
+                                         '')
+
+        os.path.isfile = self.os_path_isfile_orig
+
+
     def test_check_wtf_includes(self):
         self.assert_language_rules_check('foo.cpp',
                                          '#include "config.h"\n'
diff --git a/Tools/Scripts/webkitpy/tool/bot/botinfo.py b/Tools/Scripts/webkitpy/tool/bot/botinfo.py
new file mode 100644
index 0000000..b9fd938
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/bot/botinfo.py
@@ -0,0 +1,39 @@
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# FIXME: We should consider hanging one of these off the tool object.
+class BotInfo(object):
+    def __init__(self, tool):
+        self._tool = tool
+
+    def summary_text(self):
+        # bot_id is also stored on the options dictionary on the tool.
+        bot_id = self._tool.status_server.bot_id
+        bot_id_string = "Bot: %s  " % (bot_id) if bot_id else ""
+        return "%sPort: %s  Platform: %s" % (bot_id_string, self._tool.port().name(), self._tool.platform.display_name())
diff --git a/Tools/Scripts/webkitpy/tool/bot/botinfo_unittest.py b/Tools/Scripts/webkitpy/tool/bot/botinfo_unittest.py
new file mode 100644
index 0000000..054acfc
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/bot/botinfo_unittest.py
@@ -0,0 +1,40 @@
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.tool.bot.botinfo import BotInfo
+from webkitpy.tool.mocktool import MockTool, MockStatusServer
+
+
+class BotInfoTest(unittest.TestCase):
+
+    def test_summary_text(self):
+        tool = MockTool()
+        tool.status_server = MockStatusServer("MockBotId")
+        self.assertEqual(BotInfo(tool).summary_text(), "Bot: MockBotId  Port: MockPort  Platform: MockPlatform 1.0")
diff --git a/Tools/Scripts/webkitpy/tool/bot/commitqueuetask.py b/Tools/Scripts/webkitpy/tool/bot/commitqueuetask.py
index c5d9001..93cbcc8 100644
--- a/Tools/Scripts/webkitpy/tool/bot/commitqueuetask.py
+++ b/Tools/Scripts/webkitpy/tool/bot/commitqueuetask.py
@@ -28,6 +28,7 @@
 
 from webkitpy.common.system.executive import ScriptError
 from webkitpy.common.net.layouttestresults import LayoutTestResults
+from webkitpy.tool.bot.expectedfailures import ExpectedFailures
 
 
 class CommitQueueTaskDelegate(object):
@@ -59,6 +60,8 @@ class CommitQueueTask(object):
         self._delegate = delegate
         self._patch = patch
         self._script_error = None
+        self._results_archive_from_patch_test_run = None
+        self._expected_failures = ExpectedFailures()
 
     def _validate(self):
         # Bugs might get closed, or patches might be obsoleted or r-'d while the
@@ -132,7 +135,7 @@ class CommitQueueTask(object):
         "Unable to build without patch")
 
     def _test(self):
-        return self._run_command([
+        success = self._run_command([
             "build-and-test",
             "--no-clean",
             "--no-update",
@@ -143,8 +146,11 @@ class CommitQueueTask(object):
         "Passed tests",
         "Patch does not pass tests")
 
+        self._expected_failures.shrink_expected_failures(self._delegate.layout_test_results(), success)
+        return success
+
     def _build_and_test_without_patch(self):
-        return self._run_command([
+        success = self._run_command([
             "build-and-test",
             "--force-clean",
             "--no-update",
@@ -155,11 +161,8 @@ class CommitQueueTask(object):
         "Able to pass tests without patch",
         "Unable to pass tests without patch (tree is red?)")
 
-    def _failing_results_from_last_run(self):
-        results = self._delegate.layout_test_results()
-        if not results:
-            return []  # Makes callers slighty cleaner to not have to deal with None
-        return results.failing_test_results()
+        self._expected_failures.shrink_expected_failures(self._delegate.layout_test_results(), success)
+        return success
 
     def _land(self):
         # Unclear if this should pass --quiet or not.  If --parent-command always does the reporting, then it should.
@@ -177,36 +180,59 @@ class CommitQueueTask(object):
     def _report_flaky_tests(self, flaky_test_results, results_archive):
         self._delegate.report_flaky_tests(self._patch, flaky_test_results, results_archive)
 
+    def _results_failed_different_tests(self, first, second):
+        first_failing_tests = [] if not first else first.failing_tests()
+        second_failing_tests = [] if not second else second.failing_tests()
+        return first_failing_tests != second_failing_tests
+
     def _test_patch(self):
         if self._test():
             return True
 
-        first_results = self._failing_results_from_last_run()
-        first_failing_tests = [result.filename for result in first_results]
+        # Note: archive_last_layout_test_results deletes the results directory, making these calls order-sensitve.
+        # We could remove this dependency by building the layout_test_results from the archive.
+        first_results = self._delegate.layout_test_results()
         first_results_archive = self._delegate.archive_last_layout_test_results(self._patch)
+
+        if self._expected_failures.failures_were_expected(first_results):
+            return True
+
         if self._test():
-            # Only report flaky tests if we were successful at archiving results.
-            if first_results_archive:
-                self._report_flaky_tests(first_results, first_results_archive)
+            # Only report flaky tests if we were successful at parsing results.html and archiving results.
+            if first_results and first_results_archive:
+                self._report_flaky_tests(first_results.failing_test_results(), first_results_archive)
             return True
 
-        second_results = self._failing_results_from_last_run()
-        second_failing_tests = [result.filename for result in second_results]
-        if first_failing_tests != second_failing_tests:
-            # We could report flaky tests here, but since run-webkit-tests
-            # is run with --exit-after-N-failures=1, we would need to
-            # be careful not to report constant failures as flaky due to earlier
-            # flaky test making them not fail (no results) in one of the runs.
+        second_results = self._delegate.layout_test_results()
+        if self._results_failed_different_tests(first_results, second_results):
+            # We could report flaky tests here, but we would need to be careful
+            # to use similar checks to ExpectedFailures._can_trust_results
+            # to make sure we don't report constant failures as flakes when
+            # we happen to hit the --exit-after-N-failures limit.
             # See https://bugs.webkit.org/show_bug.cgi?id=51272
             return False
 
+        # Archive (and remove) second results so layout_test_results() after
+        # build_and_test_without_patch won't use second results instead of the clean-tree results.
+        second_results_archive = self._delegate.archive_last_layout_test_results(self._patch)
+
         if self._build_and_test_without_patch():
-            return self.report_failure()  # The error from the previous ._test() run is real, report it.
-        return False  # Tree must be red, just retry later.
+            # The error from the previous ._test() run is real, report it.
+            return self.report_failure(first_results_archive)
+
+        clean_tree_results = self._delegate.layout_test_results()
+        self._expected_failures.grow_expected_failures(clean_tree_results)
+
+        return False  # Tree must be redder than we expected, just retry later.
+
+    def results_archive_from_patch_test_run(self, patch):
+        assert(self._patch.id() == patch.id())  # CommitQueueTask is not currently re-useable.
+        return self._results_archive_from_patch_test_run
 
-    def report_failure(self):
+    def report_failure(self, results_archive=None):
         if not self._validate():
             return False
+        self._results_archive_from_patch_test_run = results_archive
         raise self._script_error
 
     def run(self):
diff --git a/Tools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py b/Tools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
index 87d0ab5..7324d78 100644
--- a/Tools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
@@ -30,6 +30,7 @@ from datetime import datetime
 import unittest
 
 from webkitpy.common.net import bugzilla
+from webkitpy.common.net.layouttestresults import LayoutTestResults
 from webkitpy.common.system.deprecated_logging import error, log
 from webkitpy.common.system.outputcapture import OutputCapture
 from webkitpy.layout_tests.layout_package import test_results
@@ -77,9 +78,6 @@ class MockCommitQueue(CommitQueueTaskDelegate):
 
 
 class CommitQueueTaskTest(unittest.TestCase):
-    def _mock_test_result(self, testname):
-        return test_results.TestResult(testname, [test_failures.FailureTextMismatch()])
-
     def _run_through_task(self, commit_queue, expected_stderr, expected_exception=None, expect_retry=False):
         tool = MockTool(log_executive=True)
         patch = tool.bugs.fetch_attachment(197)
@@ -190,6 +188,9 @@ command_failed: failure_message='Unable to build without patch' script_error='MO
             None,
             ScriptError("MOCK tests failure"),
         ])
+        # CommitQueueTask will only report flaky tests if we successfully parsed
+        # results.html and returned a LayoutTestResults object, so we fake one.
+        commit_queue.layout_test_results = lambda: LayoutTestResults([])
         expected_stderr = """run_webkit_patch: ['clean']
 command_passed: success_message='Cleaned working directory' patch='197'
 run_webkit_patch: ['update']
@@ -217,6 +218,7 @@ command_passed: success_message='Landed patch' patch='197'
             None,
             ScriptError("MOCK tests failure"),
         ])
+        commit_queue.layout_test_results = lambda: LayoutTestResults([])
         # It's possible delegate to fail to archive layout tests, don't try to report
         # flaky tests when that happens.
         commit_queue.archive_last_layout_test_results = lambda patch: None
@@ -237,10 +239,25 @@ command_passed: success_message='Landed patch' patch='197'
 """
         self._run_through_task(commit_queue, expected_stderr)
 
-    _double_flaky_test_counter = 0
-
     def test_double_flaky_test_failure(self):
-        commit_queue = MockCommitQueue([
+        class DoubleFlakyCommitQueue(MockCommitQueue):
+            def __init__(self, error_plan):
+                MockCommitQueue.__init__(self, error_plan)
+                self._double_flaky_test_counter = 0
+
+            def run_command(self, command):
+                self._double_flaky_test_counter += 1
+                MockCommitQueue.run_command(self, command)
+
+            def _mock_test_result(self, testname):
+                return test_results.TestResult(testname, [test_failures.FailureTextMismatch()])
+
+            def layout_test_results(self):
+                if self._double_flaky_test_counter % 2:
+                    return LayoutTestResults([self._mock_test_result('foo.html')])
+                return LayoutTestResults([self._mock_test_result('bar.html')])
+
+        commit_queue = DoubleFlakyCommitQueue([
             None,
             None,
             None,
@@ -268,15 +285,6 @@ command_failed: failure_message='Patch does not pass tests' script_error='MOCK t
         tool = MockTool(log_executive=True)
         patch = tool.bugs.fetch_attachment(197)
         task = CommitQueueTask(commit_queue, patch)
-        self._double_flaky_test_counter = 0
-
-        def mock_failing_results_from_last_run():
-            CommitQueueTaskTest._double_flaky_test_counter += 1
-            if CommitQueueTaskTest._double_flaky_test_counter % 2:
-                return [self._mock_test_result('foo.html')]
-            return [self._mock_test_result('bar.html')]
-
-        task._failing_results_from_last_run = mock_failing_results_from_last_run
         success = OutputCapture().assert_outputs(self, task.run, expected_stderr=expected_stderr)
         self.assertEqual(success, False)
 
@@ -302,6 +310,7 @@ command_failed: failure_message='Patch does not pass tests' script_error='MOCK t
 archive_last_layout_test_results: patch='197'
 run_webkit_patch: ['build-and-test', '--no-clean', '--no-update', '--test', '--non-interactive']
 command_failed: failure_message='Patch does not pass tests' script_error='MOCK test failure again' patch='197'
+archive_last_layout_test_results: patch='197'
 run_webkit_patch: ['build-and-test', '--force-clean', '--no-update', '--build', '--test', '--non-interactive']
 command_passed: success_message='Able to pass tests without patch' patch='197'
 """
@@ -330,6 +339,7 @@ command_failed: failure_message='Patch does not pass tests' script_error='MOCK t
 archive_last_layout_test_results: patch='197'
 run_webkit_patch: ['build-and-test', '--no-clean', '--no-update', '--test', '--non-interactive']
 command_failed: failure_message='Patch does not pass tests' script_error='MOCK test failure again' patch='197'
+archive_last_layout_test_results: patch='197'
 run_webkit_patch: ['build-and-test', '--force-clean', '--no-update', '--build', '--test', '--non-interactive']
 command_failed: failure_message='Unable to pass tests without patch (tree is red?)' script_error='MOCK clean test failure' patch='197'
 """
diff --git a/Tools/Scripts/webkitpy/tool/bot/expectedfailures.py b/Tools/Scripts/webkitpy/tool/bot/expectedfailures.py
new file mode 100644
index 0000000..8736ac0
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/bot/expectedfailures.py
@@ -0,0 +1,55 @@
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+class ExpectedFailures(object):
+    def __init__(self):
+        self._failures = set()
+
+    def _can_trust_results(self, results):
+        if not results or not results.failure_limit_count():
+            return False
+        return len(results.failing_tests()) != 0 and len(results.failing_tests()) != results.failure_limit_count()
+
+    def failures_were_expected(self, results):
+        if not self._can_trust_results(results):
+            return False
+        return set(results.failing_tests()) <= self._failures
+
+    def shrink_expected_failures(self, results, run_success):
+        if run_success:
+            self._failures = set()
+        elif self._can_trust_results(results):
+            # Remove all expected failures which are not in the new failing results.
+            self._failures.intersection_update(set(results.failing_tests()))
+
+    def grow_expected_failures(self, results):
+        if not self._can_trust_results(results):
+            return
+        self._failures.update(results.failing_tests())
+        # FIXME: Should we assert() here that expected_failures never crosses a certain size?
diff --git a/Tools/Scripts/webkitpy/tool/bot/expectedfailures_unittest.py b/Tools/Scripts/webkitpy/tool/bot/expectedfailures_unittest.py
new file mode 100644
index 0000000..8a2702b
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/bot/expectedfailures_unittest.py
@@ -0,0 +1,73 @@
+# Copyright (c) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.tool.bot.expectedfailures import ExpectedFailures
+
+
+class MockResults(object):
+    def __init__(self, failing_tests=[], failure_limit=10):
+        self._failing_tests = failing_tests
+        self._failure_limit_count = failure_limit
+
+    def failure_limit_count(self):
+        return self._failure_limit_count
+
+    def failing_tests(self):
+        return self._failing_tests
+
+
+class ExpectedFailuresTest(unittest.TestCase):
+    def _assert_can_trust(self, results, can_trust):
+        self.assertEquals(ExpectedFailures()._can_trust_results(results), can_trust)
+
+    def test_can_trust_results(self):
+        self._assert_can_trust(None, False)
+        self._assert_can_trust(MockResults(failing_tests=[], failure_limit=None), False)
+        self._assert_can_trust(MockResults(failing_tests=[], failure_limit=10), False)
+        self._assert_can_trust(MockResults(failing_tests=[1], failure_limit=None), False)
+        self._assert_can_trust(MockResults(failing_tests=[1], failure_limit=2), True)
+        self._assert_can_trust(MockResults(failing_tests=[1], failure_limit=1), False)
+
+    def _assert_expected(self, expected_failures, failures, expected):
+        self.assertEqual(expected_failures.failures_were_expected(MockResults(failures)), expected)
+
+    def test_failures_were_expected(self):
+        failures = ExpectedFailures()
+        failures.grow_expected_failures(MockResults(['foo.html']))
+        self._assert_expected(failures, ['foo.html'], True)
+        self._assert_expected(failures, ['bar.html'], False)
+        failures.shrink_expected_failures(MockResults(['baz.html']), False)
+        self._assert_expected(failures, ['foo.html'], False)
+        self._assert_expected(failures, ['baz.html'], False)
+
+        failures.grow_expected_failures(MockResults(['baz.html']))
+        self._assert_expected(failures, ['baz.html'], True)
+        failures.shrink_expected_failures(MockResults(), True)
+        self._assert_expected(failures, ['baz.html'], False)
diff --git a/Tools/Scripts/webkitpy/tool/bot/flakytestreporter.py b/Tools/Scripts/webkitpy/tool/bot/flakytestreporter.py
index bec593b..68e1c94 100644
--- a/Tools/Scripts/webkitpy/tool/bot/flakytestreporter.py
+++ b/Tools/Scripts/webkitpy/tool/bot/flakytestreporter.py
@@ -33,6 +33,7 @@ import os.path
 
 from webkitpy.common.net.layouttestresults import path_for_layout_test, LayoutTestResults
 from webkitpy.common.config import urls
+from webkitpy.tool.bot.botinfo import BotInfo
 from webkitpy.tool.grammar import plural, pluralize, join_with_separators
 
 _log = logging.getLogger(__name__)
@@ -42,6 +43,7 @@ class FlakyTestReporter(object):
     def __init__(self, tool, bot_name):
         self._tool = tool
         self._bot_name = bot_name
+        self._bot_info = BotInfo(tool)
 
     def _author_emails_for_test(self, flaky_test):
         test_path = path_for_layout_test(flaky_test)
@@ -121,15 +123,10 @@ If you would like to track this test fix with another bug, please close this bug
         authors_string = join_with_separators(sorted(author_emails))
         return " (%s: %s)" % (heading_string, authors_string)
 
-    def _bot_information(self):
-        bot_id = self._tool.status_server.bot_id
-        bot_id_string = "Bot: %s  " % (bot_id) if bot_id else ""
-        return "%sPort: %s  Platform: %s" % (bot_id_string, self._tool.port().name(), self._tool.platform.display_name())
-
     def _latest_flake_message(self, flaky_result, patch):
         failure_messages = [failure.message() for failure in flaky_result.failures]
         flake_message = "The %s just saw %s flake (%s) while processing attachment %s on bug %s." % (self._bot_name, flaky_result.filename, ", ".join(failure_messages), patch.id(), patch.bug_id())
-        return "%s\n%s" % (flake_message, self._bot_information())
+        return "%s\n%s" % (flake_message, self._bot_info.summary_text())
 
     def _results_diff_path_for_test(self, test_path):
         # FIXME: This is a big hack.  We should get this path from results.json
diff --git a/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py b/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
index 26c98c1..1e3f35a 100644
--- a/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/flakytestreporter_unittest.py
@@ -97,12 +97,6 @@ blocked: 50856
         bug = tool.bugs.fetch_bug(78)
         self.assertEqual(reporter._follow_duplicate_chain(bug).id(), 76)
 
-    def test_bot_information(self):
-        tool = MockTool()
-        tool.status_server = MockStatusServer("MockBotId")
-        reporter = FlakyTestReporter(tool, 'dummy-queue')
-        self.assertEqual(reporter._bot_information(), "Bot: MockBotId  Port: MockPort  Platform: MockPlatform 1.0")
-
     def test_report_flaky_tests_creating_bug(self):
         tool = MockTool()
         tool.filesystem = MockFileSystem({"/mock/foo/bar-diffs.txt": "mock"})
diff --git a/Tools/Scripts/webkitpy/tool/commands/download_unittest.py b/Tools/Scripts/webkitpy/tool/commands/download_unittest.py
index ced5b2f..c8e5fd6 100644
--- a/Tools/Scripts/webkitpy/tool/commands/download_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/download_unittest.py
@@ -123,8 +123,13 @@ class DownloadCommandsTest(CommandsTest):
         self.assert_execute_outputs(Land(), [42], options=self._default_options(), expected_stderr=expected_stderr, tool=mock_tool)
 
     def test_check_style(self):
-        expected_stderr = "Processing 1 patch from 1 bug.\nUpdating working directory\nProcessing patch 197 from bug 42.\nRunning check-webkit-style\n"
-        self.assert_execute_outputs(CheckStyle(), [197], options=self._default_options(), expected_stderr=expected_stderr)
+        expected_stderr = """Processing 1 patch from 1 bug.
+Updating working directory
+MOCK run_and_throw_if_fail: ['mock-update-webkit']
+Processing patch 197 from bug 42.
+MOCK run_and_throw_if_fail: ['mock-check-webkit-style', '--git-commit', 'MOCK git commit', '--diff-files', 'MockFile1']
+"""
+        self.assert_execute_outputs(CheckStyle(), [197], options=self._default_options(), expected_stderr=expected_stderr, tool=MockTool(log_executive=True))
 
     def test_build_attachment(self):
         expected_stderr = "Processing 1 patch from 1 bug.\nUpdating working directory\nProcessing patch 197 from bug 42.\nBuilding WebKit\n"
@@ -171,7 +176,7 @@ Not closing bug 42 as attachment 197 has review=+.  Assuming there are more patc
         self.assert_execute_outputs(LandFromBug(), [42], options=self._default_options(), expected_stderr=expected_stderr)
 
     def test_prepare_rollout(self):
-        expected_stderr = "Preparing rollout for bug 42.\nUpdating working directory\nRunning prepare-ChangeLog\n"
+        expected_stderr = "Preparing rollout for bug 42.\nUpdating working directory\n"
         self.assert_execute_outputs(PrepareRollout(), [852, "Reason"], options=self._default_options(), expected_stderr=expected_stderr)
 
     def test_create_rollout(self):
@@ -184,7 +189,6 @@ Reason
 component: MOCK component
 cc: MOCK cc
 blocked: 42
-Running prepare-ChangeLog
 MOCK add_patch_to_bug: bug_id=78, description=ROLLOUT of r852, mark_for_review=False, mark_for_commit_queue=True, mark_for_landing=False
 -- Begin comment --
 Any committer can land this patch automatically by marking it commit-queue+.  The commit-queue will build and test the patch before landing to ensure that the rollout will be successful.  This process takes approximately 15 minutes.
@@ -202,7 +206,6 @@ where ATTACHMENT_ID is the ID of this attachment.
     def test_rollout(self):
         expected_stderr = """Preparing rollout for bug 42.
 Updating working directory
-Running prepare-ChangeLog
 MOCK: user.open_url: file://...
 Was that diff correct?
 Building WebKit
diff --git a/Tools/Scripts/webkitpy/tool/commands/queues.py b/Tools/Scripts/webkitpy/tool/commands/queues.py
index 9e50dd4..4eadb0e 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queues.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queues.py
@@ -44,11 +44,13 @@ from webkitpy.common.net.layouttestresults import LayoutTestResults
 from webkitpy.common.net.statusserver import StatusServer
 from webkitpy.common.system.deprecated_logging import error, log
 from webkitpy.common.system.executive import ScriptError
+from webkitpy.tool.bot.botinfo import BotInfo
 from webkitpy.tool.bot.commitqueuetask import CommitQueueTask, CommitQueueTaskDelegate
 from webkitpy.tool.bot.feeders import CommitQueueFeeder, EWSFeeder
 from webkitpy.tool.bot.queueengine import QueueEngine, QueueEngineDelegate
 from webkitpy.tool.bot.flakytestreporter import FlakyTestReporter
 from webkitpy.tool.commands.stepsequence import StepSequenceErrorHandler
+from webkitpy.tool.steps.runtests import RunTests
 from webkitpy.tool.multicommandtool import Command, TryAgain
 
 
@@ -258,6 +260,20 @@ class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler, CommitQueueTaskD
         self._update_status("Processing %s" % patch_text, patch)
         return True
 
+    # FIXME: This is not really specific to the commit-queue and could be shared.
+    def _upload_results_archive_for_patch(self, patch, results_archive_zip):
+        bot_id = self._tool.status_server.bot_id or "bot"
+        description = "Archive of layout-test-results from %s" % bot_id
+        # results_archive is a ZipFile object, grab the File object (.fp) to pass to Mechanize for uploading.
+        results_archive_file = results_archive_zip.fp
+        # Rewind the file object to start (since Mechanize won't do that automatically)
+        # See https://bugs.webkit.org/show_bug.cgi?id=54593
+        results_archive_file.seek(0)
+        comment_text = "The attached test failures were seen while running run-webkit-tests on the %s.\n" % (self.name)
+        # FIXME: We could easily list the test failures from the archive here.
+        comment_text += BotInfo(self._tool).summary_text()
+        self._tool.bugs.add_attachment_to_bug(patch.bug_id(), results_archive_file, description, filename="layout-test-results.zip", comment_text=comment_text)
+
     def process_work_item(self, patch):
         self._cc_watchers(patch.bug_id())
         task = CommitQueueTask(self, patch)
@@ -269,6 +285,9 @@ class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler, CommitQueueTaskD
         except ScriptError, e:
             validator = CommitterValidator(self._tool.bugs)
             validator.reject_patch_from_commit_queue(patch.id(), self._error_message_for_bug(task.failure_status_id, e))
+            results_archive = task.results_archive_from_patch_test_run(patch)
+            if results_archive:
+                self._upload_results_archive_for_patch(patch, results_archive)
             self._did_fail(patch)
 
     def _error_message_for_bug(self, status_id, script_error):
@@ -296,19 +315,28 @@ class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler, CommitQueueTaskD
     # tool.filesystem.read_text_file.  They have different error handling at the moment.
     def _read_file_contents(self, path):
         try:
-            with codecs.open(path, "r", "utf-8") as open_file:
-                return open_file.read()
-        except OSError, e:  # File does not exist or can't be read.
+            return self._tool.filesystem.read_text_file(path)
+        except IOError, e:  # File does not exist or can't be read.
             return None
 
-    # FIXME: This may belong on the Port object.
-    def layout_test_results(self):
+    # FIXME: This logic should move to the port object.
+    def _create_layout_test_results(self):
         results_path = self._tool.port().layout_tests_results_path()
         results_html = self._read_file_contents(results_path)
         if not results_html:
             return None
         return LayoutTestResults.results_from_string(results_html)
 
+    def layout_test_results(self):
+        results = self._create_layout_test_results()
+        # FIXME: We should not have to set failure_limit_count, but we
+        # do until run-webkit-tests can be updated save off the value
+        # of --exit-after-N-failures in results.html/results.json.
+        # https://bugs.webkit.org/show_bug.cgi?id=58481
+        if results:
+            results.set_failure_limit_count(RunTests.NON_INTERACTIVE_FAILURE_LIMIT_COUNT)
+        return results
+
     def _results_directory(self):
         results_path = self._tool.port().layout_tests_results_path()
         # FIXME: This is wrong in two ways:
diff --git a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
index e2fb09f..d577baa 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
@@ -253,6 +253,7 @@ MOCK: release_work_item: commit-queue 197
 
     def test_rollout(self):
         tool = MockTool(log_executive=True)
+        tool.filesystem.write_text_file('/mock/results.html', '')  # Otherwise the commit-queue will hit a KeyError trying to read the results from the MockFileSystem.
         tool.buildbot.light_tree_on_fire()
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("commit-queue", MockSCM.fake_checkout_root),
@@ -321,6 +322,7 @@ MOCK: release_work_item: commit-queue 106
     def test_manual_reject_during_processing(self):
         queue = SecondThoughtsCommitQueue()
         queue.bind_to_tool(MockTool())
+        queue._tool.filesystem.write_text_file('/mock/results.html', '')  # Otherwise the commit-queue will hit a KeyError trying to read the results from the MockFileSystem.
         queue._options = Mock()
         queue._options.port = None
         expected_stderr = """MOCK: update_status: commit-queue Cleaned working directory
@@ -376,6 +378,17 @@ The commit-queue is continuing to process your patch.
 
         OutputCapture().assert_outputs(self, queue.report_flaky_tests, [QueuesTest.mock_work_item, test_results, MockZipFile()], expected_stderr=expected_stderr)
 
+    def test_missing_layout_test_results(self):
+        queue = CommitQueue()
+        tool = MockTool()
+        results_path = '/mock/results.html'
+        tool.filesystem = MockFileSystem({results_path: None})
+        queue.bind_to_tool(tool)
+        # Make sure that our filesystem mock functions as we expect.
+        self.assertRaises(IOError, tool.filesystem.read_text_file, results_path)
+        # layout_test_results shouldn't raise even if the results.html file is missing.
+        self.assertEquals(queue.layout_test_results(), None)
+
     def test_layout_test_results(self):
         queue = CommitQueue()
         queue.bind_to_tool(MockTool())
@@ -383,13 +396,30 @@ The commit-queue is continuing to process your patch.
         self.assertEquals(queue.layout_test_results(), None)
         queue._read_file_contents = lambda path: ""
         self.assertEquals(queue.layout_test_results(), None)
+        queue._create_layout_test_results = lambda: LayoutTestResults([])
+        results = queue.layout_test_results()
+        self.assertNotEquals(results, None)
+        self.assertEquals(results.failure_limit_count(), 10)  # This value matches RunTests.NON_INTERACTIVE_FAILURE_LIMIT_COUNT
 
     def test_archive_last_layout_test_results(self):
         queue = CommitQueue()
         queue.bind_to_tool(MockTool())
         patch = queue._tool.bugs.fetch_attachment(128)
+        # This is just to test that the method doesn't raise.
         queue.archive_last_layout_test_results(patch)
 
+    def test_upload_results_archive_for_patch(self):
+        queue = CommitQueue()
+        queue.bind_to_tool(MockTool())
+        patch = queue._tool.bugs.fetch_attachment(128)
+        expected_stderr = """MOCK add_attachment_to_bug: bug_id=42, description=Archive of layout-test-results from bot filename=layout-test-results.zip
+-- Begin comment --
+The attached test failures were seen while running run-webkit-tests on the commit-queue.
+Port: MockPort  Platform: MockPlatform 1.0
+-- End comment --
+"""
+        OutputCapture().assert_outputs(self, queue._upload_results_archive_for_patch, [patch, Mock()], expected_stderr=expected_stderr)
+
 
 class StyleQueueTest(QueuesTest):
     def test_style_queue(self):
diff --git a/Tools/Scripts/webkitpy/tool/commands/queuestest.py b/Tools/Scripts/webkitpy/tool/commands/queuestest.py
index 6455617..758832e 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queuestest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queuestest.py
@@ -67,6 +67,9 @@ class QueuesTest(unittest.TestCase):
     def assert_queue_outputs(self, queue, args=None, work_item=None, expected_stdout=None, expected_stderr=None, expected_exceptions=None, options=None, tool=None):
         if not tool:
             tool = MockTool()
+            # This is a hack to make it easy for callers to not have to setup a custom MockFileSystem just to test the commit-queue
+            # the cq tries to read the layout test results, and will hit a KeyError in MockFileSystem if we don't do this.
+            tool.filesystem.write_text_file('/mock/results.html', "")
         if not expected_stdout:
             expected_stdout = {}
         if not expected_stderr:
diff --git a/Tools/Scripts/webkitpy/tool/commands/roll_unittest.py b/Tools/Scripts/webkitpy/tool/commands/roll_unittest.py
index b6f69ea..da5c635 100644
--- a/Tools/Scripts/webkitpy/tool/commands/roll_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/roll_unittest.py
@@ -36,7 +36,6 @@ class RollCommandsTest(CommandsTest):
     def test_update_chromium_deps(self):
         expected_stderr = """Updating Chromium DEPS to 6764
 MOCK: MockDEPS.write_variable(chromium_rev, 6764)
-Running prepare-ChangeLog
 MOCK: user.open_url: file://...
 Was that diff correct?
 Committed r49824: <http://trac.webkit.org/changeset/49824>
diff --git a/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py b/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
index 4313df9..4870423 100644
--- a/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/upload_unittest.py
@@ -59,8 +59,7 @@ class UploadCommandsTest(CommandsTest):
         options.request_commit = False
         options.review = True
         options.suggest_reviewers = False
-        expected_stderr = """Running check-webkit-style
-MOCK: user.open_url: file://...
+        expected_stderr = """MOCK: user.open_url: file://...
 Was that diff correct?
 Obsoleting 2 old patches on bug 42
 MOCK add_patch_to_bug: bug_id=42, description=MOCK description, mark_for_review=True, mark_for_commit_queue=False, mark_for_landing=False
@@ -107,8 +106,7 @@ extra comment
         options.request_commit = False
         options.review = True
         options.suggest_reviewers = False
-        expected_stderr = """Running check-webkit-style
-MOCK: user.open_url: file://...
+        expected_stderr = """MOCK: user.open_url: file://...
 Was that diff correct?
 Obsoleting 2 old patches on bug 42
 MOCK add_patch_to_bug: bug_id=42, description=MOCK description, mark_for_review=True, mark_for_commit_queue=False, mark_for_landing=False
diff --git a/Tools/Scripts/webkitpy/tool/mocktool.py b/Tools/Scripts/webkitpy/tool/mocktool.py
index 73f55a7..ad03244 100644
--- a/Tools/Scripts/webkitpy/tool/mocktool.py
+++ b/Tools/Scripts/webkitpy/tool/mocktool.py
@@ -458,13 +458,14 @@ class MockSCM(Mock):
 
     fake_checkout_root = os.path.realpath("/tmp") # realpath is needed to allow for Mac OS X's /private/tmp
 
-    def __init__(self):
+    def __init__(self, filesystem=None):
         Mock.__init__(self)
         # FIXME: We should probably use real checkout-root detection logic here.
         # os.getcwd() can't work here because other parts of the code assume that "checkout_root"
         # will actually be the root.  Since getcwd() is wrong, use a globally fake root for now.
         self.checkout_root = self.fake_checkout_root
         self.added_paths = set()
+        self._filesystem = filesystem
 
     def add(self, destination_path, return_exit_code=False):
         self.added_paths.add(destination_path)
@@ -502,6 +503,12 @@ class MockSCM(Mock):
     def svn_revision_from_commit_text(self, commit_text):
         return "49824"
 
+    def delete(self, path):
+        if not self._filesystem:
+            return
+        if self._filesystem.exists(path):
+            self._filesystem.remove(path)
+
 
 class MockDEPS(object):
     def read_variable(self, name):
@@ -686,6 +693,13 @@ class MockPort(Mock):
     def layout_tests_results_path(self):
         return "/mock/results.html"
 
+    def check_webkit_style_command(self):
+        return ["mock-check-webkit-style"]
+
+    def update_webkit_command(self):
+        return ["mock-update-webkit"]
+
+
 class MockTestPort1(object):
 
     def skips_layout_test(self, test_name):
diff --git a/Tools/Scripts/webkitpy/tool/steps/abstractstep.py b/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
index 2ba4291..59ea36a 100644
--- a/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
+++ b/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
@@ -26,7 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-from webkitpy.common.system.deprecated_logging import log
 from webkitpy.common.system.executive import ScriptError
 from webkitpy.common.config.ports import WebKitPort
 from webkitpy.tool.steps.options import Options
@@ -37,14 +36,6 @@ class AbstractStep(object):
         self._tool = tool
         self._options = options
 
-    # FIXME: This should use tool.port()
-    def _run_script(self, script_name, args=None, quiet=False, port=WebKitPort):
-        log("Running %s" % script_name)
-        command = port.script_shell_command(script_name)
-        if args:
-            command.extend(args)
-        self._tool.executive.run_and_throw_if_fail(command, quiet)
-
     def _changed_files(self, state):
         return self.cached_lookup(state, "changed_files")
 
diff --git a/Tools/Scripts/webkitpy/tool/steps/checkstyle.py b/Tools/Scripts/webkitpy/tool/steps/checkstyle.py
index af66c50..c2377e9 100644
--- a/Tools/Scripts/webkitpy/tool/steps/checkstyle.py
+++ b/Tools/Scripts/webkitpy/tool/steps/checkstyle.py
@@ -56,7 +56,7 @@ class CheckStyle(AbstractStep):
         args.extend(self._changed_files(state))
 
         try:
-            self._run_script("check-webkit-style", args)
+            self._tool.executive.run_and_throw_if_fail(self._tool.port().check_webkit_style_command() + args)
         except ScriptError, e:
             if self._options.non_interactive:
                 # We need to re-raise the exception here to have the
diff --git a/Tools/Scripts/webkitpy/tool/steps/commit.py b/Tools/Scripts/webkitpy/tool/steps/commit.py
index 5dc4efb..7a03528 100644
--- a/Tools/Scripts/webkitpy/tool/steps/commit.py
+++ b/Tools/Scripts/webkitpy/tool/steps/commit.py
@@ -50,6 +50,7 @@ class Commit(AbstractStep):
         self._state = state
 
         username = None
+        password = None
         force_squash = False
 
         num_tries = 0
@@ -58,7 +59,7 @@ class Commit(AbstractStep):
 
             try:
                 scm = self._tool.scm()
-                commit_text = scm.commit_with_message(self._commit_message, git_commit=self._options.git_commit, username=username, force_squash=force_squash, changed_files=self._changed_files(state))
+                commit_text = scm.commit_with_message(self._commit_message, git_commit=self._options.git_commit, username=username, password=password, force_squash=force_squash, changed_files=self._changed_files(state))
                 svn_revision = scm.svn_revision_from_commit_text(commit_text)
                 log("Committed r%s: <%s>" % (svn_revision, urls.view_revision_url(svn_revision)))
                 self._state["commit_text"] = commit_text
@@ -72,4 +73,8 @@ class Commit(AbstractStep):
             except AuthenticationError, e:
                 username = self._tool.user.prompt("%s login: " % e.server_host, repeat=5)
                 if not username:
-                    raise ScriptError("You need to specify the username on %s to perform the commit as." % self.svn_server_host)
+                    raise ScriptError("You need to specify the username on %s to perform the commit as." % e.server_host)
+                if e.prompt_for_password:
+                    password = self._tool.user.prompt_password("%s password for %s: " % (e.server_host, username), repeat=5)
+                    if not password:
+                        raise ScriptError("You need to specify the password for %s on %s to perform the commit." % (username, e.server_host))
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
index 4be40ca..b30dd2f 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
@@ -61,7 +61,7 @@ class PrepareChangeLog(AbstractStep):
             self._ensure_bug_url(state)
             return
         os.chdir(self._tool.scm().checkout_root)
-        args = self._tool.port().script_shell_command("prepare-ChangeLog")
+        args = self._tool.port().prepare_changelog_command()
         if state.get("bug_id"):
             args.append("--bug=%s" % state["bug_id"])
             args.append("--description=%s" % self._tool.bugs.fetch_bug(state["bug_id"]).title())
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py
index 39c9a9a..e636cb4 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py
@@ -34,7 +34,7 @@ from webkitpy.tool.steps.abstractstep import AbstractStep
 
 class PrepareChangeLogForDEPSRoll(AbstractStep):
     def run(self, state):
-        self._run_script("prepare-ChangeLog")
+        self._tool.executive.run_and_throw_if_fail(self._tool.port().prepare_changelog_command())
         changelog_paths = self._tool.checkout().modified_changelogs(git_commit=None)
         for changelog_path in changelog_paths:
             ChangeLog(changelog_path).update_with_unreviewed_message("Rolled DEPS.\n\n")
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert.py
index dcd4b93..0a47573 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert.py
@@ -50,7 +50,7 @@ class PrepareChangeLogForRevert(AbstractStep):
 
     def run(self, state):
         # This could move to prepare-ChangeLog by adding a --revert= option.
-        self._run_script("prepare-ChangeLog")
+        self._tool.executive.run_and_throw_if_fail(self._tool.port().prepare_changelog_command())
         changelog_paths = self._tool.checkout().modified_changelogs(git_commit=None)
         bug_url = self._tool.bugs.bug_url_for_bug_id(state["bug_id"]) if state["bug_id"] else None
         message = self._message_for_revert(state["revision_list"], state["reason"], bug_url)
diff --git a/Tools/Scripts/webkitpy/tool/steps/runtests.py b/Tools/Scripts/webkitpy/tool/steps/runtests.py
index 282e381..793a94b 100644
--- a/Tools/Scripts/webkitpy/tool/steps/runtests.py
+++ b/Tools/Scripts/webkitpy/tool/steps/runtests.py
@@ -31,6 +31,9 @@ from webkitpy.tool.steps.options import Options
 from webkitpy.common.system.deprecated_logging import log
 
 class RunTests(AbstractStep):
+    # FIXME: This knowledge really belongs in the commit-queue.
+    NON_INTERACTIVE_FAILURE_LIMIT_COUNT = 10
+
     @classmethod
     def options(cls):
         return AbstractStep.options() + [
@@ -59,21 +62,8 @@ class RunTests(AbstractStep):
         if self._options.non_interactive:
             args.append("--no-new-test-results")
             args.append("--no-launch-safari")
-            args.append("--exit-after-n-failures=1")
+            args.append("--exit-after-n-failures=%s" % self.NON_INTERACTIVE_FAILURE_LIMIT_COUNT)
             args.append("--wait-for-httpd")
-            # FIXME: Hack to work around https://bugs.webkit.org/show_bug.cgi?id=38912
-            # when running the commit-queue on a mac leopard machine since compositing
-            # does not work reliably on Leopard due to various graphics driver/system bugs.
-            if self._tool.port().name() == "Mac" and self._tool.port().is_leopard():
-                tests_to_ignore = []
-                tests_to_ignore.append("compositing")
-
-                # media tests are also broken on mac leopard due to
-                # a separate CoreVideo bug which causes random crashes/hangs
-                # https://bugs.webkit.org/show_bug.cgi?id=38912
-                tests_to_ignore.append("media")
-
-                args.extend(["--ignore-tests", ",".join(tests_to_ignore)])
 
         if self._options.quiet:
             args.append("--quiet")
diff --git a/Tools/Scripts/webkitpy/tool/steps/steps_unittest.py b/Tools/Scripts/webkitpy/tool/steps/steps_unittest.py
index 783ae29..e1ace2c 100644
--- a/Tools/Scripts/webkitpy/tool/steps/steps_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/steps/steps_unittest.py
@@ -66,17 +66,12 @@ class StepsTest(unittest.TestCase):
         tool.user.prompt = lambda message: 42
         self._run_step(PromptForBugOrTitle, tool=tool)
 
-    def test_runtests_leopard_commit_queue_hack_step(self):
-        expected_stderr = "Running Python unit tests\nRunning Perl unit tests\nRunning JavaScriptCore tests\nRunning run-webkit-tests\n"
-        OutputCapture().assert_outputs(self, self._run_step, [RunTests], expected_stderr=expected_stderr)
-
-    def test_runtests_leopard_commit_queue_hack_command(self):
+    def test_runtests_args(self):
         mock_options = self._step_options()
         step = RunTests(MockTool(log_executive=True), mock_options)
         # FIXME: We shouldn't use a real port-object here, but there is too much to mock at the moment.
         mock_port = WebKitPort()
         mock_port.name = lambda: "Mac"
-        mock_port.is_leopard = lambda: True
         tool = MockTool(log_executive=True)
         tool.port = lambda: mock_port
         step = RunTests(tool, mock_options)
@@ -87,6 +82,6 @@ MOCK run_and_throw_if_fail: ['Tools/Scripts/test-webkitperl']
 Running JavaScriptCore tests
 MOCK run_and_throw_if_fail: ['Tools/Scripts/run-javascriptcore-tests']
 Running run-webkit-tests
-MOCK run_and_throw_if_fail: ['Tools/Scripts/run-webkit-tests', '--no-new-test-results', '--no-launch-safari', '--exit-after-n-failures=1', '--wait-for-httpd', '--ignore-tests', 'compositing,media', '--quiet']
+MOCK run_and_throw_if_fail: ['Tools/Scripts/run-webkit-tests', '--no-new-test-results', '--no-launch-safari', '--exit-after-n-failures=10', '--wait-for-httpd', '--quiet']
 """
         OutputCapture().assert_outputs(self, step.run, [{}], expected_stderr=expected_stderr)
diff --git a/Tools/TestResultServer/handlers/dashboardhandler.py b/Tools/TestResultServer/handlers/dashboardhandler.py
index fbbd56b..cae2b13 100644
--- a/Tools/TestResultServer/handlers/dashboardhandler.py
+++ b/Tools/TestResultServer/handlers/dashboardhandler.py
@@ -89,6 +89,7 @@ class UpdateDashboardFile(webapp.RequestHandler):
         if not files:
             # FIXME: Just grab the entire dashboards directory.
             files = ["aggregate_results.html",
+                     "builders.js",
                      "dashboard_base.js",
                      "dygraph-combined.js",
                      "flakiness_dashboard.html",
diff --git a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops
index e7a103c..ebb1f34 100644
--- a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops
+++ b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIRelease.vsprops
@@ -3,6 +3,12 @@
 	ProjectType="Visual C++"
 	Version="8.00"
 	Name="TestWebKitAPIRelease"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\TestWebKitAPICommon.vsprops;.\TestWebKitAPICoreFoundation.vsprops;.\TestWebKitAPICFNetwork.vsprops"
+	InheritedPropertySheets="
+    $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+    $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+    $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+    .\TestWebKitAPICommon.vsprops;
+    .\TestWebKitAPICoreFoundation.vsprops;
+    .\TestWebKitAPICFNetwork.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIReleaseCairoCFLite.vsprops b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIReleaseCairoCFLite.vsprops
index 512eca6..400144d 100644
--- a/Tools/TestWebKitAPI/Configurations/TestWebKitAPIReleaseCairoCFLite.vsprops
+++ b/Tools/TestWebKitAPI/Configurations/TestWebKitAPIReleaseCairoCFLite.vsprops
@@ -3,6 +3,12 @@
 	ProjectType="Visual C++"
 	Version="8.00"
 	Name="TestWebKitAPIReleaseCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICFLite.vsprops"
+	InheritedPropertySheets="
+    $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+    $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+    $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+    $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+    ..\Configurations\TestWebKitAPICommon.vsprops;
+    ..\Configurations\TestWebKitAPICFLite.vsprops"
 	>
 </VisualStudioPropertySheet>
diff --git a/Tools/TestWebKitAPI/PlatformUtilities.h b/Tools/TestWebKitAPI/PlatformUtilities.h
index a682545..dc1dc13 100644
--- a/Tools/TestWebKitAPI/PlatformUtilities.h
+++ b/Tools/TestWebKitAPI/PlatformUtilities.h
@@ -28,6 +28,7 @@
 
 #include <WebKit2/WebKit2.h>
 #include <WebKit2/WKRetainPtr.h>
+#include <wtf/Platform.h>
 #include <string>
 
 namespace TestWebKitAPI {
@@ -36,6 +37,10 @@ namespace Util {
 // Runs a platform runloop until the 'done' is true. 
 void run(bool* done);
 
+#if PLATFORM(WIN)
+bool shouldTranslateMessage(const MSG&);
+#endif
+
 void sleep(double seconds);
 
 WKContextRef createContextForInjectedBundleTest(const std::string&, WKTypeRef userData = 0);
@@ -50,11 +55,6 @@ bool isKeyDown(WKNativeEventPtr);
 std::string toSTD(WKStringRef string);
 WKRetainPtr<WKStringRef> toWK(const char* utf8String);
 
-template<typename T> static inline WKRetainPtr<T> adoptWK(T item)
-{
-    return WKRetainPtr<T>(AdoptWK, item);
-}
-
 } // namespace Util
 } // namespace TestWebKitAPI
 
diff --git a/Tools/TestWebKitAPI/PlatformWebView.h b/Tools/TestWebKitAPI/PlatformWebView.h
index 3d1698f..6a9bc27 100644
--- a/Tools/TestWebKitAPI/PlatformWebView.h
+++ b/Tools/TestWebKitAPI/PlatformWebView.h
@@ -27,7 +27,10 @@
 #define PlatformWebView_h
 
 #include <wtf/Platform.h>
+
+#if USE(CG)
 #include <CoreGraphics/CGGeometry.h>
+#endif
 
 #ifdef __APPLE__
 #ifdef __OBJC__
@@ -65,6 +68,7 @@ public:
     void simulateRightClick(unsigned x, unsigned y);
 
 #if PLATFORM(WIN)
+    void simulateAKeyDown();
     void setParentWindowMessageObserver(WindowMessageObserver* observer) { m_parentWindowMessageObserver = observer; }
 #endif
 
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
index c5c9555..86b691d 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
@@ -57,7 +57,6 @@
 		C0ADBE9612FCA79B00D2C129 /* simple-form.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = C0ADBE8412FCA6B600D2C129 /* simple-form.html */; };
 		C0BD669D131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0BD669C131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp */; };
 		C0BD669F131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0BD669E131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp */; };
-		F6C59E38132AC5E000176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6C59E37132AC5DF00176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp */; };
 		F6F3F29113342FEB00A6BF19 /* CookieManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6F3F29013342FEB00A6BF19 /* CookieManager.cpp */; };
 /* End PBXBuildFile section */
 
@@ -161,7 +160,6 @@
 		C0ADBE8412FCA6B600D2C129 /* simple-form.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "simple-form.html"; sourceTree = "<group>"; };
 		C0BD669C131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResponsivenessTimerDoesntFireEarly.cpp; sourceTree = "<group>"; };
 		C0BD669E131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResponsivenessTimerDoesntFireEarly_Bundle.cpp; sourceTree = "<group>"; };
-		F6C59E37132AC5DF00176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SendingMessagesToTheWebProcessBeforeItIsValid.cpp; sourceTree = "<group>"; };
 		F6F3F29013342FEB00A6BF19 /* CookieManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CookieManager.cpp; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
@@ -289,7 +287,6 @@
 				C0BD669C131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp */,
 				C0BD669E131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp */,
 				C0ADBE8212FCA6AA00D2C129 /* RestoreSessionStateContainingFormData.cpp */,
-				F6C59E37132AC5DF00176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp */,
 				C02B77F1126612140026BF0F /* SpacebarScrolling.cpp */,
 				BC7B619A1299FE9E00D174A4 /* WKPreferences.cpp */,
 				BC90995D12567BC100083756 /* WKString.cpp */,
@@ -444,7 +441,6 @@
 				1ADBEFAE130C689C00D61D19 /* ForceRepaint.cpp in Sources */,
 				4BFDFFA9131477770061F24B /* HitTestResultNodeHandle.cpp in Sources */,
 				C0BD669D131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp in Sources */,
-				F6C59E38132AC5E000176C09 /* SendingMessagesToTheWebProcessBeforeItIsValid.cpp in Sources */,
 				BC246D8E132F115A00B56D7C /* AboutBlankLoad.cpp in Sources */,
 				BC246D9A132F1FE100B56D7C /* CanHandleRequest.cpp in Sources */,
 				F6F3F29113342FEB00A6BF19 /* CookieManager.cpp in Sources */,
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp
index 27180e3..cb00276 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/AboutBlankLoad.cpp
@@ -43,7 +43,7 @@ static void decidePolicyForResponse(WKPageRef, WKFrameRef, WKURLResponseRef resp
 
 TEST(WebKit2, AboutBlankLoad)
 {
-    WKRetainPtr<WKContextRef> context = Util::adoptWK(WKContextCreate());
+    WKRetainPtr<WKContextRef> context = adoptWK(WKContextCreate());
     PlatformWebView webView(context.get());
 
     WKPagePolicyClient policyClient;
@@ -52,7 +52,7 @@ TEST(WebKit2, AboutBlankLoad)
     policyClient.decidePolicyForResponse = decidePolicyForResponse;
     WKPageSetPagePolicyClient(webView.page(), &policyClient);
 
-    WKPageLoadURL(webView.page(), Util::adoptWK(WKURLCreateWithUTF8CString("about:blank")).get());
+    WKPageLoadURL(webView.page(), adoptWK(WKURLCreateWithUTF8CString("about:blank")).get());
 
     Util::run(&done);
 }
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp
index 8460847..dffac9b 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest.cpp
@@ -55,14 +55,14 @@ static void setInjectedBundleClient(WKContextRef context)
 
 TEST(WebKit2, CanHandleRequest)
 {
-    WKRetainPtr<WKContextRef> context = Util::adoptWK(Util::createContextForInjectedBundleTest("CanHandleRequestTest"));
+    WKRetainPtr<WKContextRef> context = adoptWK(Util::createContextForInjectedBundleTest("CanHandleRequestTest"));
     setInjectedBundleClient(context.get());
 
     _WKContextRegisterURLSchemeAsEmptyDocument(context.get(), Util::toWK("emptyscheme").get());
 
     PlatformWebView webView(context.get());
 
-    WKPageLoadURL(webView.page(), Util::adoptWK(Util::createURLForResource("simple", "html")).get());
+    WKPageLoadURL(webView.page(), adoptWK(Util::createURLForResource("simple", "html")).get());
 
     WKContextPostMessageToInjectedBundle(context.get(), Util::toWK("CheckCanHandleRequest").get(), 0);
     Util::run(&didReceiveMessage);
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp
index a253362..b5d644d 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/CanHandleRequest_Bundle.cpp
@@ -47,7 +47,7 @@ CanHandleRequestTest::CanHandleRequestTest(const std::string& identifier)
 
 static bool canHandleURL(const char* url)
 {
-    return WKBundlePageCanHandleRequest(Util::adoptWK(WKURLRequestCreateWithWKURL(Util::adoptWK(WKURLCreateWithUTF8CString(url)).get())).get());
+    return WKBundlePageCanHandleRequest(adoptWK(WKURLRequestCreateWithWKURL(adoptWK(WKURLCreateWithUTF8CString(url)).get())).get());
 }
 
 static bool runTest()
@@ -60,7 +60,7 @@ void CanHandleRequestTest::didReceiveMessage(WKBundleRef bundle, WKStringRef mes
     if (!WKStringIsEqualToUTF8CString(messageName, "CheckCanHandleRequest"))
         return;
 
-    WKBundlePostMessage(bundle, Util::toWK("DidCheckCanHandleRequest").get(), Util::adoptWK(WKBooleanCreate(runTest())).get());
+    WKBundlePostMessage(bundle, Util::toWK("DidCheckCanHandleRequest").get(), adoptWK(WKBooleanCreate(runTest())).get());
 }
 
 } // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/CookieManager.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/CookieManager.cpp
index cc4fc43..a1c366c 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/CookieManager.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/CookieManager.cpp
@@ -80,7 +80,7 @@ TEST(WebKit2, CookieManager)
     loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
     WKPageSetPageLoaderClient(webView.page(), &loaderClient);
 
-    WKPageLoadURL(webView.page(), Util::adoptWK(WKURLCreateWithUTF8CString("about:blank")).get());
+    WKPageLoadURL(webView.page(), adoptWK(WKURLCreateWithUTF8CString("about:blank")).get());
 
     Util::run(&testDone);
 }
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/HitTestResultNodeHandle.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/HitTestResultNodeHandle.cpp
index 5000a47..3f15c15 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/HitTestResultNodeHandle.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/HitTestResultNodeHandle.cpp
@@ -77,7 +77,7 @@ TEST(WebKit2, HitTestResultNodeHandle)
     PlatformWebView webView(context.get());
     setPageLoaderClient(webView.page());
 
-    WKPageLoadURL(webView.page(), Util::adoptWK(Util::createURLForResource("simple", "html")).get());
+    WKPageLoadURL(webView.page(), adoptWK(Util::createURLForResource("simple", "html")).get());
     Util::run(&didFinishLoad);
     didFinishLoad = false;
 
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/PageLoadDidChangeLocationWithinPageForFrame.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/PageLoadDidChangeLocationWithinPageForFrame.cpp
index a492a67..ce7324b 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/PageLoadDidChangeLocationWithinPageForFrame.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/PageLoadDidChangeLocationWithinPageForFrame.cpp
@@ -72,12 +72,12 @@ TEST(WebKit2, PageLoadDidChangeLocationWithinPageForFrame)
     WKPageLoadURL(webView.page(), url.get());
     Util::run(&didFinishLoad);
 
-    WKRetainPtr<WKURLRef> initialURL = Util::adoptWK(WKFrameCopyURL(WKPageGetMainFrame(webView.page())));
+    WKRetainPtr<WKURLRef> initialURL = adoptWK(WKFrameCopyURL(WKPageGetMainFrame(webView.page())));
 
     WKPageRunJavaScriptInMainFrame(webView.page(), Util::toWK("clickLink()").get(), 0, nullJavaScriptCallback);
     Util::run(&didChangeLocationWithinPage);
 
-    WKRetainPtr<WKURLRef> urlAfterAnchorClick = Util::adoptWK(WKFrameCopyURL(WKPageGetMainFrame(webView.page())));
+    WKRetainPtr<WKURLRef> urlAfterAnchorClick = adoptWK(WKFrameCopyURL(WKPageGetMainFrame(webView.page())));
 
     TEST_ASSERT(!WKURLIsEqual(initialURL.get(), urlAfterAnchorClick.get()));
 }
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/ResponsivenessTimerDoesntFireEarly.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/ResponsivenessTimerDoesntFireEarly.cpp
index ea1013a..d8273a1 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/ResponsivenessTimerDoesntFireEarly.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/ResponsivenessTimerDoesntFireEarly.cpp
@@ -75,13 +75,13 @@ static void setPageLoaderClient(WKPageRef page)
 
 TEST(WebKit2, ResponsivenessTimerDoesntFireEarly)
 {
-    WKRetainPtr<WKContextRef> context = Util::adoptWK(Util::createContextForInjectedBundleTest("ResponsivenessTimerDoesntFireEarlyTest"));
+    WKRetainPtr<WKContextRef> context = adoptWK(Util::createContextForInjectedBundleTest("ResponsivenessTimerDoesntFireEarlyTest"));
     setInjectedBundleClient(context.get());
 
     PlatformWebView webView(context.get());
     setPageLoaderClient(webView.page());
 
-    WKPageLoadURL(webView.page(), Util::adoptWK(Util::createURLForResource("simple", "html")).get());
+    WKPageLoadURL(webView.page(), adoptWK(Util::createURLForResource("simple", "html")).get());
     Util::run(&didFinishLoad);
 
     WKContextPostMessageToInjectedBundle(context.get(), Util::toWK("BrieflyPause").get(), 0);
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/RestoreSessionStateContainingFormData.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/RestoreSessionStateContainingFormData.cpp
index 7c08735..0970bd2 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/RestoreSessionStateContainingFormData.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/RestoreSessionStateContainingFormData.cpp
@@ -53,7 +53,7 @@ static WKRetainPtr<WKDataRef> createSessionStateContainingFormData(WKContextRef
     PlatformWebView webView(context);
     setPageLoaderClient(webView.page());
 
-    WKPageLoadURL(webView.page(), Util::adoptWK(Util::createURLForResource("simple-form", "html")).get());
+    WKPageLoadURL(webView.page(), adoptWK(Util::createURLForResource("simple-form", "html")).get());
     Util::run(&didFinishLoad);
     didFinishLoad = false;
 
@@ -61,7 +61,7 @@ static WKRetainPtr<WKDataRef> createSessionStateContainingFormData(WKContextRef
     Util::run(&didFinishLoad);
     didFinishLoad = false;
 
-    return Util::adoptWK(WKPageCopySessionState(webView.page(), 0, 0));
+    return adoptWK(WKPageCopySessionState(webView.page(), 0, 0));
 }
 
 TEST(WebKit2, RestoreSessionStateContainingFormData)
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/WKString.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/WKString.cpp
index b0b133d..4202417 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/WKString.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/WKString.cpp
@@ -46,6 +46,27 @@ TEST(WebKit2, WKString)
 
     delete[] buffer;
     
+    maxSize = WKStringGetLength(string);
+    TEST_ASSERT(maxSize == 5);
+
+    // Allocate a buffer one character larger than we need.
+    WKChar* uniBuffer = new WKChar[maxSize+1];
+    actualSize = WKStringGetCharacters(string, uniBuffer, maxSize);
+    TEST_ASSERT(actualSize == 5);
+    
+    WKChar helloBuffer[] = { 'h', 'e', 'l', 'l', 'o' };
+    TEST_ASSERT(!memcmp(uniBuffer, helloBuffer, 10));
+    
+    // Test passing a buffer length < the string length.
+    actualSize = WKStringGetCharacters(string, uniBuffer, maxSize-1);
+    TEST_ASSERT(actualSize == 4);
+    
+    // Test passing a buffer length > the string length.
+    actualSize = WKStringGetCharacters(string, uniBuffer, maxSize+1);
+    TEST_ASSERT(actualSize == 5);
+    
+    delete[] uniBuffer;
+    
     WKRelease(string);
 }
 
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/win/HideFindIndicator.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/win/HideFindIndicator.cpp
index 40d4f41..7f0c6fa 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/win/HideFindIndicator.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/win/HideFindIndicator.cpp
@@ -63,7 +63,7 @@ TEST(WebKit2, HideFindIndicator)
     PlatformWebView webView(context.get());
     initialize(webView);
 
-    WKRetainPtr<WKURLRef> url = Util::adoptWK(Util::createURLForResource("find", "html"));
+    WKRetainPtr<WKURLRef> url = adoptWK(Util::createURLForResource("find", "html"));
     WKPageLoadURL(webView.page(), url.get());
     Util::run(&didFinishLoad);
     didFinishLoad = false;
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/win/ResizeViewWhileHidden.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/win/ResizeViewWhileHidden.cpp
index 7310e6c..9ebfc2c 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/win/ResizeViewWhileHidden.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/win/ResizeViewWhileHidden.cpp
@@ -55,7 +55,7 @@ static void flushMessages(WKPageRef page)
 
     setPageLoaderClient(page);
 
-    WKPageLoadURL(page, Util::adoptWK(Util::createURLForResource("simple", "html")).get());
+    WKPageLoadURL(page, adoptWK(Util::createURLForResource("simple", "html")).get());
     Util::run(&didFinishLoad);
     didFinishLoad = false;
 
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/win/TranslateMessageGeneratesWMChar.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/win/TranslateMessageGeneratesWMChar.cpp
new file mode 100644
index 0000000..66b1291
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/win/TranslateMessageGeneratesWMChar.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include "WindowMessageObserver.h"
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+static bool didSeeWMChar;
+static bool didNotHandleKeyEventCalled;
+
+static void didNotHandleKeyEventCallback(WKPageRef, WKNativeEventPtr event, const void*)
+{
+    if (event->message != WM_KEYDOWN)
+        return;
+    
+    // Don't call TranslateMessage() here so a WM_CHAR isn't generated.
+    didNotHandleKeyEventCalled = true;
+}
+
+static void runAndWatchForWMChar(bool* done)
+{
+    while (!*done) {
+        MSG msg;
+        BOOL result = ::GetMessageW(&msg, 0, 0, 0);
+        if (!result || result == -1)
+            break;
+        
+        if (msg.message == WM_CHAR)
+            didSeeWMChar = true;
+        
+        if (Util::shouldTranslateMessage(msg))
+            ::TranslateMessage(&msg);
+        
+        ::DispatchMessage(&msg);
+    }
+}
+
+TEST(WebKit2, TranslateMessageGeneratesWMChar)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    PlatformWebView webView(context.get());
+
+    webView.simulateAKeyDown();
+
+    // WebKit should call TranslateMessage() on the WM_KEYDOWN message to generate the WM_CHAR message.
+    runAndWatchForWMChar(&didSeeWMChar);
+    
+    didSeeWMChar = false;
+
+    WKPageUIClient uiClient;
+    memset(&uiClient, 0, sizeof(uiClient));
+
+    uiClient.didNotHandleKeyEvent = didNotHandleKeyEventCallback;
+    WKPageSetPageUIClient(webView.page(), &uiClient);
+
+    webView.simulateAKeyDown();
+
+    runAndWatchForWMChar(&didNotHandleKeyEventCalled);
+
+    // WebKit should not have called TranslateMessage() on the WM_KEYDOWN message since we installed a didNotHandleKeyEvent callback.
+    TEST_ASSERT(!didSeeWMChar);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp b/Tools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp
index 181d88e..90208c5 100644
--- a/Tools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp
+++ b/Tools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp
@@ -49,11 +49,29 @@ void run(bool* done)
         BOOL result = ::GetMessageW(&msg, 0, 0, 0);
         if (!result || result == -1)
             break;
-        ::TranslateMessage(&msg);
+        
+        if (shouldTranslateMessage(msg))
+            ::TranslateMessage(&msg);
         ::DispatchMessage(&msg);
     }
 }
 
+bool shouldTranslateMessage(const MSG& msg)
+{
+    // Only these four messages are actually translated by ::TranslateMessage or ::TranslateAccelerator.
+    // It's useless (though harmless) to call those functions for other messages, so we always allow other messages to be translated.
+    if (msg.message != WM_KEYDOWN && msg.message != WM_SYSKEYDOWN && msg.message != WM_KEYUP && msg.message != WM_SYSKEYUP)
+        return true;
+    
+    wchar_t className[256];
+    if (!::GetClassNameW(msg.hwnd, className, ARRAYSIZE(className)))
+        return true;
+
+    // Don't call TranslateMessage() on key events destined for a WebKit2 view, WebKit will do this if it doesn't handle the message.
+    // It would be nice to use some API here instead of hard-coding the window class name.
+    return wcscmp(className, L"WebKit2WebViewWindowClass");
+}
+
 void sleep(double seconds)
 {
     ::Sleep(seconds * 1000);
diff --git a/Tools/TestWebKitAPI/win/PlatformWebViewWin.cpp b/Tools/TestWebKitAPI/win/PlatformWebViewWin.cpp
index 132ab2a..1f39f8b 100644
--- a/Tools/TestWebKitAPI/win/PlatformWebViewWin.cpp
+++ b/Tools/TestWebKitAPI/win/PlatformWebViewWin.cpp
@@ -92,6 +92,14 @@ void PlatformWebView::simulateSpacebarKeyPress()
     ::SendMessageW(window, WM_KEYUP, VK_SPACE, (1 << repeatCountBitOffset) | (39 << scanCodeBitOffset) | (1 << previousStateBitOffset) | (1 << transitionStateBitOffset));
 }
 
+void PlatformWebView::simulateAKeyDown()
+{
+    HWND window = WKViewGetWindow(m_view);
+    
+    // These values match what happens when you press the 'A' key in Notepad, as observed by Spy++.
+    ::SendMessageW(window, WM_KEYDOWN, 'A', (1 << repeatCountBitOffset) | (30 << scanCodeBitOffset));
+}
+
 void PlatformWebView::simulateAltKeyPress()
 {
     HWND window = WKViewGetWindow(m_view);
diff --git a/Tools/TestWebKitAPI/win/TestWebKitAPI.vcproj b/Tools/TestWebKitAPI/win/TestWebKitAPI.vcproj
index 468ed71..930f7f8 100644
--- a/Tools/TestWebKitAPI/win/TestWebKitAPI.vcproj
+++ b/Tools/TestWebKitAPI/win/TestWebKitAPI.vcproj
@@ -492,10 +492,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\Tests\WebKit2\SendingMessagesToTheWebProcessBeforeItIsValid.cpp"
-					>
-				</File>
-				<File
 					RelativePath="..\Tests\WebKit2\simple-accelerated-compositing.html"
 					>
 				</File>
@@ -563,6 +559,10 @@
 						>
 					</File>
 					<File
+						RelativePath="..\Tests\WebKit2\win\TranslateMessageGeneratesWMChar.cpp"
+						>
+					</File>
+					<File
 						RelativePath="..\Tests\WebKit2\win\WMCloseCallsUIClientClose.cpp"
 						>
 					</File>
diff --git a/Tools/Tools.pro b/Tools/Tools.pro
index ca4ba3d..2e3d96e 100644
--- a/Tools/Tools.pro
+++ b/Tools/Tools.pro
@@ -7,7 +7,7 @@ exists($$PWD/DumpRenderTree/qt/ImageDiff.pro): SUBDIRS += DumpRenderTree/qt/Imag
 
 webkit2 {
     exists($$PWD/MiniBrowser/qt/MiniBrowser.pro): SUBDIRS += MiniBrowser/qt/MiniBrowser.pro
-    exists($$PWD/WebKitTestRunner/WebKitTestRunner.pro): SUBDIRS += WebKitTestRunner/WebKitTestRunner.pro
+    !symbian:exists($$PWD/WebKitTestRunner/WebKitTestRunner.pro): SUBDIRS += WebKitTestRunner/WebKitTestRunner.pro
 }
 
 !win32:!symbian {
diff --git a/Tools/WebKitAPITest/WebKitAPITestProduction.vsprops b/Tools/WebKitAPITest/WebKitAPITestProduction.vsprops
index 45cb5c9..56e6b7a 100644
--- a/Tools/WebKitAPITest/WebKitAPITestProduction.vsprops
+++ b/Tools/WebKitAPITest/WebKitAPITestProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="WebKitAPITestProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WebKitAPITestCommon.vsprops"
 	>
diff --git a/Tools/WebKitAPITest/WebKitAPITestRelease.vsprops b/Tools/WebKitAPITest/WebKitAPITestRelease.vsprops
index e89d3e7..25167ba 100644
--- a/Tools/WebKitAPITest/WebKitAPITestRelease.vsprops
+++ b/Tools/WebKitAPITest/WebKitAPITestRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="WebKitAPITestRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WebKitAPITestCommon.vsprops"
 	>
diff --git a/Tools/WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops b/Tools/WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops
index 8c1a3c3..ba93747 100644
--- a/Tools/WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops
+++ b/Tools/WebKitAPITest/WebKitAPITestReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="WebKitAPITestReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\WebKitAPITestCommon.vsprops"
diff --git a/Tools/WebKitAPITest/config.h b/Tools/WebKitAPITest/config.h
index bee51ac..14b72ff 100644
--- a/Tools/WebKitAPITest/config.h
+++ b/Tools/WebKitAPITest/config.h
@@ -49,8 +49,8 @@
 #define WEBKIT_EXPORTDATA
 #endif
 
-#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
-#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
 
 #endif /* USE(EXPORT_MACROS) */
 
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinProduction.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinProduction.vsprops
index 853abfb..cf126a4 100644
--- a/Tools/WebKitLauncherWin/WebKitLauncherWinProduction.vsprops
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="WebKitLauncherWinProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WebKitLauncherWinCommon.vsprops"
 	>
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinRelease.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinRelease.vsprops
index 1b906ef..63a86ae 100644
--- a/Tools/WebKitLauncherWin/WebKitLauncherWinRelease.vsprops
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="WebKitLauncherWinRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WebKitLauncherWinCommon.vsprops"
 	>
diff --git a/Tools/WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops b/Tools/WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops
index d635f3e..0af7d39 100644
--- a/Tools/WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops
+++ b/Tools/WebKitLauncherWin/WebKitLauncherWinReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="WebKitLauncherWinReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\WebKitLauncherWinCommon.vsprops"
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl b/Tools/WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl
index 1e47772..ec33502 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl
+++ b/Tools/WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,18 +26,17 @@
 module WTR {
 
     interface EventSendingController {
-        [CustomArgumentHandling] void mouseDown();
-        [CustomArgumentHandling] void mouseUp();
-        [CustomArgumentHandling] void mouseMoveTo();
-        [CustomArgumentHandling] void keyDown();
-        [CustomArgumentHandling] void contextClick(); // CustomArgumentHandling only to throw exception while not implemented.
-        [CustomArgumentHandling] void leapForward(/*in unsigned long delay*/); // CustomArgumentHandling only to throw exception while not implemented.
+        void mouseDown(in long buttonNumber, in object modifierArray);
+        void mouseUp(in long buttonNumber, in object modifierArray);
+        void mouseMoveTo(in long x, in long y);
+        void leapForward(in long milliseconds);
 
         // Zoom functions.
         void textZoomIn();
         void textZoomOut();
         void zoomPageIn();
         void zoomPageOut();
+        void scalePageBy(in double scale, in double x, in double y);
     };
 
 }
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl b/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
index a331c64..0593840 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
+++ b/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
@@ -39,6 +39,7 @@ module WTR {
         void dumpSelectionRect();
         void dumpStatusCallbacks();
         void dumpTitleChanges();
+        void dumpFullScreenCallbacks();
 
         // Special options.
         void keepWebHistory();
@@ -46,6 +47,8 @@ module WTR {
         void setCanOpenWindows(in boolean value);
         void setCloseRemainingWindowsWhenComplete(in boolean value);
         void setXSSAuditorEnabled(in boolean value);
+        void setAllowUniversalAccessFromFileURLs(in boolean value);
+        void setAllowFileAccessFromFileURLs(in boolean value);
 
         // Special DOM functions.
         void clearBackForwardList();
@@ -55,12 +58,19 @@ module WTR {
         boolean isCommandEnabled(in DOMString name);
         DOMString markerTextForListItem(in object element);
         unsigned long windowCount();
+        object shadowRoot(in object element);
 
         // Repaint testing.
         void testRepaint();
         void repaintSweepHorizontally();
         void display();
 
+        // Printing
+        int numberOfPages(in double pageWidthInPixels, in double pageHeightInPixels);
+        int pageNumberForElementById(in DOMString id, in double pageWidthInPixels, in double pageHeightInPixels);
+        DOMString pageSizeAndMarginsInPixels(in int pageIndex, in int width, in int height, in int marginTop, in int marginRight, in int marginBottom, in int marginLeft);
+        boolean isPageBoxVisible(in int pageIndex);
+
         // Animation testing.
         int numberOfActiveAnimations();
         boolean pauseAnimationAtTimeOnElementWithId(in DOMString animationName, in double time, in DOMString elementId);
@@ -70,7 +80,12 @@ module WTR {
         // UserContent testing.
         void addUserScript(in DOMString source, in boolean runAtStart, in boolean allFrames);
         void addUserStyleSheet(in DOMString source, in boolean allFrames);
-        
+
+        // Local storage API
+        void clearAllDatabases();
+        void setDatabaseQuota(in unsigned long long quota);
+        DOMString pathToLocalResource(in DOMString url);
+
         // Compositing testing.
         DOMString layerTreeAsText();
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
index cc1720e..0725a85 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,7 +29,7 @@
 #include "InjectedBundle.h"
 #include "InjectedBundlePage.h"
 #include "JSEventSendingController.h"
-#include <WebKit2/WKBundlePage.h>
+#include <WebKit2/WKBundleFrame.h>
 #include <WebKit2/WKBundlePagePrivate.h>
 #include <WebKit2/WKBundlePrivate.h>
 
@@ -37,12 +37,67 @@ namespace WTR {
 
 static const float ZoomMultiplierRatio = 1.2f;
 
+static bool operator==(const WKPoint& a, const WKPoint& b)
+{
+    return a.x == b.x && a.y == b.y;
+}
+
+static WKEventModifiers parseModifier(JSStringRef modifier)
+{
+    if (JSStringIsEqualToUTF8CString(modifier, "ctrlKey"))
+        return kWKEventModifiersControlKey;
+    if (JSStringIsEqualToUTF8CString(modifier, "shiftKey") || JSStringIsEqualToUTF8CString(modifier, "rangeSelectionKey"))
+        return kWKEventModifiersShiftKey;
+    if (JSStringIsEqualToUTF8CString(modifier, "altKey"))
+        return kWKEventModifiersAltKey;
+    if (JSStringIsEqualToUTF8CString(modifier, "metaKey") || JSStringIsEqualToUTF8CString(modifier, "addSelectionKey"))
+        return kWKEventModifiersMetaKey;
+    return 0;
+}
+
+static unsigned arrayLength(JSContextRef context, JSObjectRef array)
+{
+    JSRetainPtr<JSStringRef> lengthString(Adopt, JSStringCreateWithUTF8CString("length"));
+    JSValueRef lengthValue = JSObjectGetProperty(context, array, lengthString.get(), 0);
+    if (!lengthValue)
+        return 0;
+    return static_cast<unsigned>(JSValueToNumber(context, lengthValue, 0));
+}
+
+static WKEventModifiers parseModifierArray(JSContextRef context, JSValueRef arrayValue)
+{
+    if (!arrayValue)
+        return 0;
+    if (!JSValueIsObject(context, arrayValue))
+        return 0;
+    JSObjectRef array = const_cast<JSObjectRef>(arrayValue);
+    unsigned length = arrayLength(context, array);
+    WKEventModifiers modifiers = 0;
+    for (unsigned i = 0; i < length; i++) {
+        JSValueRef exception = 0;
+        JSValueRef value = JSObjectGetPropertyAtIndex(context, array, i, &exception);
+        if (exception)
+            continue;
+        JSRetainPtr<JSStringRef> string(Adopt, JSValueToStringCopy(context, value, &exception));
+        if (exception)
+            continue;
+        modifiers |= parseModifier(string.get());
+    }
+    return modifiers;
+}
+
 PassRefPtr<EventSendingController> EventSendingController::create()
 {
     return adoptRef(new EventSendingController);
 }
 
 EventSendingController::EventSendingController()
+    : m_time(0)
+    , m_position()
+    , m_clickCount(0)
+    , m_clickTime(0)
+    , m_clickPosition()
+    , m_clickButton(kWKEventMouseButtonNoButton)
 {
 }
 
@@ -55,40 +110,50 @@ JSClassRef EventSendingController::wrapperClass()
     return JSEventSendingController::eventSendingControllerClass();
 }
 
-static void setExceptionForString(JSContextRef context, JSValueRef* exception, const char* string)
-{
-    JSRetainPtr<JSStringRef> exceptionString(Adopt, JSStringCreateWithUTF8CString(string));
-    *exception = JSValueMakeString(context, exceptionString.get());
-}
-
-void EventSendingController::mouseDown(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+void EventSendingController::mouseDown(int button, JSValueRef modifierArray)
 {
-    setExceptionForString(context, exception, "EventSender.mouseDown is not yet supported.");
+    WKBundlePageRef page = InjectedBundle::shared().page()->page();
+    WKBundleFrameRef frame = WKBundlePageGetMainFrame(page);
+    JSContextRef context = WKBundleFrameGetJavaScriptContext(frame);
+    WKEventModifiers modifiers = parseModifierArray(context, modifierArray);
+    updateClickCount(button);
+    WKBundlePageSimulateMouseDown(page, button, m_position, m_clickCount, modifiers, m_time);
 }
 
-void EventSendingController::mouseUp(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+void EventSendingController::mouseUp(int button, JSValueRef modifierArray)
 {
-    setExceptionForString(context, exception, "EventSender.mouseUp is not yet supported.");
+    WKBundlePageRef page = InjectedBundle::shared().page()->page();
+    WKBundleFrameRef frame = WKBundlePageGetMainFrame(page);
+    JSContextRef context = WKBundleFrameGetJavaScriptContext(frame);
+    WKEventModifiers modifiers = parseModifierArray(context, modifierArray);
+    updateClickCount(button);
+    WKBundlePageSimulateMouseUp(page, button, m_position, m_clickCount, modifiers, m_time);
 }
 
-void EventSendingController::mouseMoveTo(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+void EventSendingController::mouseMoveTo(int x, int y)
 {
-    setExceptionForString(context, exception, "EventSender.mouseMoveTo is not yet supported.");
+    m_position.x = x;
+    m_position.y = y;
+    WKBundlePageSimulateMouseMotion(InjectedBundle::shared().page()->page(), m_position, m_time);
 }
 
-void EventSendingController::keyDown(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+void EventSendingController::leapForward(int milliseconds)
 {
-    setExceptionForString(context, exception, "EventSender.keyDown is not yet supported.");
+    m_time += milliseconds / 1000.0;
 }
 
-void EventSendingController::contextClick(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+void EventSendingController::updateClickCount(WKEventMouseButton button)
 {
-    setExceptionForString(context, exception, "EventSender.contextClick is not yet supported.");
-}
+    if (m_time - m_clickTime < 1 && m_position == m_clickPosition && button == m_clickButton) {
+        ++m_clickCount;
+        m_clickTime = m_time;
+        return;
+    }
 
-void EventSendingController::leapForward(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    setExceptionForString(context, exception, "EventSender.leapForward is not yet supported.");
+    m_clickCount = 1;
+    m_clickTime = m_time;
+    m_clickPosition = m_position;
+    m_clickButton = button;
 }
 
 void EventSendingController::textZoomIn()
@@ -127,6 +192,12 @@ void EventSendingController::zoomPageOut()
     WKBundlePageSetPageZoomFactor(InjectedBundle::shared().page()->page(), zoomFactor / ZoomMultiplierRatio);
 }
 
+void EventSendingController::scalePageBy(double scale, double x, double y)
+{
+    WKPoint origin = { x, y };
+    WKBundlePageSetScaleAtOrigin(InjectedBundle::shared().page()->page(), scale, origin);
+}
+
 // Object Creation
 
 void EventSendingController::makeWindowObject(JSContextRef context, JSObjectRef windowObject, JSValueRef* exception)
diff --git a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.h b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.h
index 400f60d..702b8e2 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,8 @@
 #define EventSendingController_h
 
 #include "JSWrappable.h"
+#include <WebKit2/WKEvent.h>
+#include <WebKit2/WKGeometry.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WTR {
@@ -41,21 +43,30 @@ public:
     // JSWrappable
     virtual JSClassRef wrapperClass();
 
-    void mouseDown(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
-    void mouseUp(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
-    void mouseMoveTo(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
-    void keyDown(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
-    void contextClick(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
-    void leapForward(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+    void mouseDown(int button, JSValueRef modifierArray);
+    void mouseUp(int button, JSValueRef modifierArray);
+    void mouseMoveTo(int x, int y);
+    void leapForward(int milliseconds);
 
     // Zoom functions.
     void textZoomIn();
     void textZoomOut();
     void zoomPageIn();
     void zoomPageOut();
+    void scalePageBy(double scale, double x, double y);
 
 private:
     EventSendingController();
+
+    void updateClickCount(WKEventMouseButton);
+
+    double m_time;
+    WKPoint m_position;
+
+    int m_clickCount;
+    double m_clickTime;
+    WKPoint m_clickPosition;
+    WKEventMouseButton m_clickButton;
 };
 
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
index ec6b723..311530f 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
@@ -172,6 +172,8 @@ void InjectedBundle::beginTesting()
     WKBundleRemoveAllUserContent(m_bundle, m_pageGroup);
 
     page()->reset();
+
+    WKBundleClearAllDatabases(m_bundle);
 }
 
 void InjectedBundle::done()
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
index 3b73174..911e08f 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
@@ -202,6 +202,16 @@ InjectedBundlePage::InjectedBundlePage(WKBundlePageRef page)
     };
     WKBundlePageSetResourceLoadClient(m_page, &resourceLoadClient);
 
+    WKBundlePagePolicyClient policyClient = {
+        0,
+        this,
+        decidePolicyForNavigationAction,
+        decidePolicyForNewWindowAction,
+        decidePolicyForResponse,
+        unableToImplementPolicy
+    };
+    WKBundlePageSetPolicyClient(m_page, &policyClient);
+
     WKBundlePageUIClient uiClient = {
         0,
         this,
@@ -234,6 +244,17 @@ InjectedBundlePage::InjectedBundlePage(WKBundlePageRef page)
         didChangeSelection
     };
     WKBundlePageSetEditorClient(m_page, &editorClient);
+
+#if ENABLE(FULLSCREEN_API)
+    WKBundlePageFullScreenClient fullScreenClient = {
+        0,
+        this,
+        supportsFullScreen,
+        enterFullScreenForElement,
+        exitFullScreenForElement,
+    };
+    WKBundlePageSetFullScreenClient(m_page, &fullScreenClient);
+#endif
 }
 
 InjectedBundlePage::~InjectedBundlePage()
@@ -252,6 +273,9 @@ void InjectedBundlePage::reset()
     WKBundlePageSetPageZoomFactor(m_page, 1);
     WKBundlePageSetTextZoomFactor(m_page, 1);
 
+    WKPoint origin = { 0, 0 };
+    WKBundlePageSetScaleAtOrigin(m_page, 1, origin);
+
     m_previousTestBackForwardListItem = adoptWK(WKBundleBackForwardListCopyItemAtIndex(WKBundlePageGetBackForwardList(m_page), 0));
 
     WKBundleFrameClearOpener(WKBundlePageGetMainFrame(m_page));
@@ -666,6 +690,48 @@ void InjectedBundlePage::didFailLoadForResource(WKBundlePageRef, WKBundleFrameRe
 {
 }
 
+
+// Policy Client Callbacks
+
+WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForNavigationAction(WKBundlePageRef page, WKBundleFrameRef frame, WKBundleNavigationActionRef navigationAction, WKURLRequestRef request, WKTypeRef* userData, const void* clientInfo)
+{
+    return static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->decidePolicyForNavigationAction(page, frame, navigationAction, request, userData);
+}
+
+WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForNewWindowAction(WKBundlePageRef page, WKBundleFrameRef frame, WKBundleNavigationActionRef navigationAction, WKURLRequestRef request, WKStringRef frameName, WKTypeRef* userData, const void* clientInfo)
+{
+    return static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->decidePolicyForNewWindowAction(page, frame, navigationAction, request, frameName, userData);
+}
+
+WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForResponse(WKBundlePageRef page, WKBundleFrameRef frame, WKURLResponseRef response, WKURLRequestRef request, WKTypeRef* userData, const void* clientInfo)
+{
+    return static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->decidePolicyForResponse(page, frame, response, request, userData);
+}
+
+void InjectedBundlePage::unableToImplementPolicy(WKBundlePageRef page, WKBundleFrameRef frame, WKErrorRef error, WKTypeRef* userData, const void* clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->unableToImplementPolicy(page, frame, error, userData);
+}
+
+WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForNavigationAction(WKBundlePageRef, WKBundleFrameRef, WKBundleNavigationActionRef, WKURLRequestRef request, WKTypeRef*)
+{
+    return WKBundlePagePolicyActionUse;
+}
+
+WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForNewWindowAction(WKBundlePageRef, WKBundleFrameRef, WKBundleNavigationActionRef, WKURLRequestRef, WKStringRef, WKTypeRef*)
+{
+    return WKBundlePagePolicyActionUse;
+}
+
+WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForResponse(WKBundlePageRef, WKBundleFrameRef, WKURLResponseRef, WKURLRequestRef, WKTypeRef*)
+{
+    return WKBundlePagePolicyActionUse;
+}
+
+void InjectedBundlePage::unableToImplementPolicy(WKBundlePageRef, WKBundleFrameRef, WKErrorRef, WKTypeRef*)
+{
+}
+
 // UI Client Callbacks
 
 void InjectedBundlePage::willAddMessageToConsole(WKBundlePageRef page, WKStringRef message, uint32_t lineNumber, const void *clientInfo)
@@ -693,13 +759,38 @@ void InjectedBundlePage::willRunJavaScriptPrompt(WKBundlePageRef page, WKStringR
     static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->willRunJavaScriptPrompt(message, defaultValue, frame);
 }
 
+static string lastFileURLPathComponent(const string& path)
+{
+    size_t pos = path.find("file://");
+    ASSERT(string::npos != pos);
+
+    string tmpPath = path.substr(pos + 7);
+    if (tmpPath.empty())
+        return tmpPath;
+
+    // Remove the trailing delimiter
+    if (tmpPath[tmpPath.length() - 1] == '/')
+        tmpPath.erase(tmpPath.length() - 1);
+
+    pos = tmpPath.rfind('/');
+    if (string::npos != pos)
+        return tmpPath.substr(pos + 1);
+
+    return tmpPath;
+}
+
 void InjectedBundlePage::willAddMessageToConsole(WKStringRef message, uint32_t lineNumber)
 {
     if (!InjectedBundle::shared().isTestRunning())
         return;
 
-    // FIXME: Strip file: urls.
-    InjectedBundle::shared().os() << "CONSOLE MESSAGE: line " << lineNumber << ": " << message << "\n";
+    string messageString = toSTD(message);
+    size_t fileProtocolStart = messageString.find("file://");
+    if (fileProtocolStart != string::npos)
+        // FIXME: The code below does not handle additional text after url nor multiple urls. This matches DumpRenderTree implementation.
+        messageString = messageString.substr(0, fileProtocolStart) + lastFileURLPathComponent(messageString.substr(fileProtocolStart));
+
+    InjectedBundle::shared().os() << "CONSOLE MESSAGE: line " << lineNumber << ": " << messageString << "\n";
 }
 
 void InjectedBundlePage::willSetStatusbarText(WKStringRef statusbarText)
@@ -918,6 +1009,31 @@ void InjectedBundlePage::didChangeSelection(WKStringRef notificationName)
         InjectedBundle::shared().os() << "EDITING DELEGATE: webViewDidChangeSelection:" << notificationName << "\n";
 }
 
+#if ENABLE(FULLSCREEN_API)
+bool InjectedBundlePage::supportsFullScreen(WKBundlePageRef pageRef, WKFullScreenKeyboardRequestType requestType)
+{
+    if (InjectedBundle::shared().layoutTestController()->shouldDumpFullScreenCallbacks())
+        InjectedBundle::shared().os() << "supportsFullScreen() == true\n";
+    return true;
+}
+
+void InjectedBundlePage::enterFullScreenForElement(WKBundlePageRef pageRef, WKBundleNodeHandleRef elementRef)
+{
+    if (InjectedBundle::shared().layoutTestController()->shouldDumpFullScreenCallbacks())
+        InjectedBundle::shared().os() << "enterFullScreenForElement()\n";
+    WKBundlePageWillEnterFullScreen(pageRef);
+    WKBundlePageDidEnterFullScreen(pageRef);
+}
+
+void InjectedBundlePage::exitFullScreenForElement(WKBundlePageRef pageRef, WKBundleNodeHandleRef elementRef)
+{
+    if (InjectedBundle::shared().layoutTestController()->shouldDumpFullScreenCallbacks())
+        InjectedBundle::shared().os() << "exitFullScreenForElement()\n";
+    WKBundlePageWillExitFullScreen(pageRef);
+    WKBundlePageDidExitFullScreen(pageRef);
+}
+#endif
+
 static bool compareByTargetName(WKBundleBackForwardListItemRef item1, WKBundleBackForwardListItemRef item2)
 {
     return toSTD(adoptWK(WKBundleBackForwardListItemCopyTarget(item1))) < toSTD(adoptWK(WKBundleBackForwardListItemCopyTarget(item2)));
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h
index 2c3e9df..bc04e9a 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h
@@ -94,6 +94,16 @@ private:
     void didFinishLoadForResource(WKBundlePageRef, WKBundleFrameRef, uint64_t identifier);
     void didFailLoadForResource(WKBundlePageRef, WKBundleFrameRef, uint64_t identifier, WKErrorRef);
 
+    // WKBundlePagePolicyClient
+    static WKBundlePagePolicyAction decidePolicyForNavigationAction(WKBundlePageRef, WKBundleFrameRef, WKBundleNavigationActionRef, WKURLRequestRef, WKTypeRef*, const void*);
+    static WKBundlePagePolicyAction decidePolicyForNewWindowAction(WKBundlePageRef, WKBundleFrameRef, WKBundleNavigationActionRef, WKURLRequestRef, WKStringRef frameName, WKTypeRef*, const void*);
+    static WKBundlePagePolicyAction decidePolicyForResponse(WKBundlePageRef, WKBundleFrameRef, WKURLResponseRef, WKURLRequestRef, WKTypeRef*, const void*);
+    static void unableToImplementPolicy(WKBundlePageRef, WKBundleFrameRef, WKErrorRef, WKTypeRef*, const void*);
+    WKBundlePagePolicyAction decidePolicyForNavigationAction(WKBundlePageRef, WKBundleFrameRef, WKBundleNavigationActionRef, WKURLRequestRef, WKTypeRef*);
+    WKBundlePagePolicyAction decidePolicyForNewWindowAction(WKBundlePageRef, WKBundleFrameRef, WKBundleNavigationActionRef, WKURLRequestRef, WKStringRef frameName, WKTypeRef*);
+    WKBundlePagePolicyAction decidePolicyForResponse(WKBundlePageRef, WKBundleFrameRef, WKURLResponseRef, WKURLRequestRef, WKTypeRef*);
+    void unableToImplementPolicy(WKBundlePageRef, WKBundleFrameRef, WKErrorRef, WKTypeRef*);
+
     // UI Client
     static void willAddMessageToConsole(WKBundlePageRef, WKStringRef message, uint32_t lineNumber, const void* clientInfo);
     static void willSetStatusbarText(WKBundlePageRef, WKStringRef statusbarText, const void* clientInfo);
@@ -106,6 +116,13 @@ private:
     void willRunJavaScriptConfirm(WKStringRef message, WKBundleFrameRef);
     void willRunJavaScriptPrompt(WKStringRef message, WKStringRef defaultValue, WKBundleFrameRef);
 
+#if ENABLE(FULLSCREEN_API)
+    // Full Screen client
+    static bool supportsFullScreen(WKBundlePageRef, WKFullScreenKeyboardRequestType);
+    static void enterFullScreenForElement(WKBundlePageRef, WKBundleNodeHandleRef element);
+    static void exitFullScreenForElement(WKBundlePageRef, WKBundleNodeHandleRef element);
+#endif
+
     // Editor client
     static bool shouldBeginEditing(WKBundlePageRef, WKBundleRangeHandleRef, const void* clientInfo);
     static bool shouldEndEditing(WKBundlePageRef, WKBundleRangeHandleRef, const void* clientInfo);
diff --git a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
index 7c49d03..45725b4 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
@@ -29,14 +29,17 @@
 #include "InjectedBundle.h"
 #include "InjectedBundlePage.h"
 #include "JSLayoutTestController.h"
+#include "PlatformWebView.h"
 #include "StringFunctions.h"
+#include "TestController.h"
 #include <WebKit2/WKBundleBackForwardList.h>
 #include <WebKit2/WKBundleFrame.h>
 #include <WebKit2/WKBundleFramePrivate.h>
 #include <WebKit2/WKBundleInspector.h>
+#include <WebKit2/WKBundleNodeHandlePrivate.h>
 #include <WebKit2/WKBundlePagePrivate.h>
-#include <WebKit2/WKBundleScriptWorld.h>
 #include <WebKit2/WKBundlePrivate.h>
+#include <WebKit2/WKBundleScriptWorld.h>
 #include <WebKit2/WKRetainPtr.h>
 #include <WebKit2/WebKit2.h>
 #include <wtf/HashMap.h>
@@ -96,6 +99,7 @@ LayoutTestController::LayoutTestController()
     , m_dumpStatusCallbacks(false)
     , m_dumpTitleChanges(false)
     , m_dumpPixels(true)
+    , m_dumpFullScreenCallbacks(false)
     , m_waitToDump(false)
     , m_testRepaint(false)
     , m_testRepaintSweepHorizontally(false)
@@ -286,6 +290,16 @@ bool LayoutTestController::findString(JSStringRef target, JSValueRef optionsArra
     return WKBundlePageFindString(InjectedBundle::shared().page()->page(), toWK(target).get(), options);
 }
 
+void LayoutTestController::clearAllDatabases()
+{
+    WKBundleClearAllDatabases(InjectedBundle::shared().bundle());
+}
+
+void LayoutTestController::setDatabaseQuota(uint64_t quota)
+{
+    return WKBundleSetDatabaseQuota(InjectedBundle::shared().bundle(), quota);
+}
+
 bool LayoutTestController::isCommandEnabled(JSStringRef name)
 {
     return WKBundlePageIsEditingCommandEnabled(InjectedBundle::shared().page()->page(), toWK(name).get());
@@ -307,11 +321,59 @@ void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
     WKBundleOverrideAllowUniversalAccessFromFileURLsForTestRunner(InjectedBundle::shared().bundle(), InjectedBundle::shared().pageGroup(), enabled);
 }
 
+void LayoutTestController::setAllowFileAccessFromFileURLs(bool enabled)
+{
+    WKBundleSetAllowFileAccessFromFileURLs(InjectedBundle::shared().bundle(), InjectedBundle::shared().pageGroup(), enabled);
+}
+
+int LayoutTestController::numberOfPages(double pageWidthInPixels, double pageHeightInPixels)
+{
+    WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::shared().page()->page());
+    return WKBundleNumberOfPages(InjectedBundle::shared().bundle(), mainFrame, pageWidthInPixels, pageHeightInPixels);
+}
+
+int LayoutTestController::pageNumberForElementById(JSStringRef id, double pageWidthInPixels, double pageHeightInPixels)
+{
+    WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::shared().page()->page());
+    return WKBundlePageNumberForElementById(InjectedBundle::shared().bundle(), mainFrame, toWK(id).get(), pageWidthInPixels, pageHeightInPixels);
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::pageSizeAndMarginsInPixels(int pageIndex, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft)
+{
+    WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::shared().page()->page());
+    return toJS(WKBundlePageSizeAndMarginsInPixels(InjectedBundle::shared().bundle(), mainFrame, pageIndex, width, height, marginTop, marginRight, marginBottom, marginLeft));
+}
+
+bool LayoutTestController::isPageBoxVisible(int pageIndex)
+{
+    WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::shared().page()->page());
+    return WKBundleIsPageBoxVisible(InjectedBundle::shared().bundle(), mainFrame, pageIndex);
+}
+
 unsigned LayoutTestController::windowCount()
 {
     return InjectedBundle::shared().pageCount();
 }
 
+JSValueRef LayoutTestController::shadowRoot(JSValueRef element)
+{
+    WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::shared().page()->page());
+    JSContextRef context = WKBundleFrameGetJavaScriptContext(mainFrame);
+
+    if (!element || !JSValueIsObject(context, element))
+        return JSValueMakeNull(context);
+
+    WKRetainPtr<WKBundleNodeHandleRef> domElement = adoptWK(WKBundleNodeHandleCreate(context, const_cast<JSObjectRef>(element)));
+    if (!domElement)
+        return JSValueMakeNull(context);
+
+    WKRetainPtr<WKBundleNodeHandleRef> shadowRootDOMElement = adoptWK(WKBundleNodeHandleCopyElementShadowRoot(domElement.get()));
+    if (!shadowRootDOMElement)
+        return JSValueMakeNull(context);
+
+    return WKBundleFrameGetJavaScriptWrapperForNodeForWorld(mainFrame, shadowRootDOMElement.get(), WKBundleScriptWorldNormalWorld());
+}
+
 void LayoutTestController::clearBackForwardList()
 {
     WKBundleBackForwardListClear(WKBundlePageGetBackForwardList(InjectedBundle::shared().page()->page()));
diff --git a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
index b37f102..00d7e57 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
@@ -67,6 +67,7 @@ public:
     void dumpSelectionRect() { } // Will need to do something when we support pixel tests.
     void dumpStatusCallbacks() { m_dumpStatusCallbacks = true; }
     void dumpTitleChanges() { m_dumpTitleChanges = true; }
+    void dumpFullScreenCallbacks() { m_dumpFullScreenCallbacks = true; }
 
     // Special options.
     void keepWebHistory();
@@ -75,6 +76,7 @@ public:
     void setCloseRemainingWindowsWhenComplete(bool value) { m_shouldCloseExtraWindows = value; }
     void setXSSAuditorEnabled(bool);
     void setAllowUniversalAccessFromFileURLs(bool);
+    void setAllowFileAccessFromFileURLs(bool);
 
     // Special DOM functions.
     JSValueRef computedStyleIncludingVisitedInfo(JSValueRef element);
@@ -84,6 +86,7 @@ public:
     bool isCommandEnabled(JSStringRef name);
     JSRetainPtr<JSStringRef> markerTextForListItem(JSValueRef element);
     unsigned windowCount();
+    JSValueRef shadowRoot(JSValueRef element);
 
     // Repaint testing.
     void testRepaint() { m_testRepaint = true; }
@@ -106,6 +109,17 @@ public:
     // Text search testing.
     bool findString(JSStringRef, JSValueRef optionsArray);
 
+    // Local storage
+    void clearAllDatabases();
+    void setDatabaseQuota(uint64_t);
+    JSRetainPtr<JSStringRef> pathToLocalResource(JSStringRef);
+
+    // Printing
+    int numberOfPages(double pageWidthInPixels, double pageHeightInPixels);
+    int pageNumberForElementById(JSStringRef, double pageWidthInPixels, double pageHeightInPixels);
+    JSRetainPtr<JSStringRef> pageSizeAndMarginsInPixels(int pageIndex, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft);
+    bool isPageBoxVisible(int pageIndex);
+
     enum WhatToDump { RenderTree, MainFrameText, AllFramesText };
     WhatToDump whatToDump() const { return m_whatToDump; }
 
@@ -116,6 +130,7 @@ public:
     bool shouldDumpStatusCallbacks() const { return m_dumpStatusCallbacks; }
     bool shouldDumpTitleChanges() const { return m_dumpTitleChanges; }
     bool shouldDumpPixels() const { return m_dumpPixels; }
+    bool shouldDumpFullScreenCallbacks() const { return m_dumpFullScreenCallbacks; }
 
     bool waitToDump() const { return m_waitToDump; }
     void waitToDumpWatchdogTimerFired();
@@ -157,6 +172,7 @@ private:
     bool m_dumpStatusCallbacks;
     bool m_dumpTitleChanges;
     bool m_dumpPixels;
+    bool m_dumpFullScreenCallbacks;
     bool m_waitToDump; // True if waitUntilDone() has been called, but notifyDone() has not yet been called.
     bool m_testRepaint;
     bool m_testRepaintSweepHorizontally;
diff --git a/Tools/WebKitTestRunner/InjectedBundle/mac/LayoutTestControllerMac.mm b/Tools/WebKitTestRunner/InjectedBundle/mac/LayoutTestControllerMac.mm
index 2eb4d5b..1d5d008 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/mac/LayoutTestControllerMac.mm
+++ b/Tools/WebKitTestRunner/InjectedBundle/mac/LayoutTestControllerMac.mm
@@ -56,4 +56,9 @@ void LayoutTestController::initializeWaitToDumpWatchdogTimerIfNeeded()
     CFRunLoopAddTimer(CFRunLoopGetCurrent(), m_waitToDumpWatchdogTimer.get(), kCFRunLoopCommonModes);
 }
 
+JSRetainPtr<JSStringRef> LayoutTestController::pathToLocalResource(JSStringRef url)
+{
+    return JSStringRetain(url); // Do nothing on mac.
+}
+
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro b/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro
index 6838205..0bac510 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro
@@ -72,7 +72,7 @@ INCLUDEPATH = \
 PREFIX_HEADER = $$PWD/../../WebKitTestRunnerPrefix.h
 *-g++*:QMAKE_CXXFLAGS += "-include $$PREFIX_HEADER"
 
-unix:!mac:!symbian {
+unix:!mac:!symbian:!embedded {
     CONFIG += link_pkgconfig
     PKGCONFIG += fontconfig
 }
@@ -80,3 +80,6 @@ unix:!mac:!symbian {
 TARGET = WTRInjectedBundle
 DESTDIR = $$OUTPUT_DIR/lib
 !CONFIG(standalone_package): CONFIG -= app_bundle
+linux-* {
+    QMAKE_LFLAGS += -Wl,--no-undefined
+}
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp b/Tools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp
index 91f49ea..72902e1 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp
@@ -28,6 +28,7 @@
 #include "LayoutTestController.h"
 
 #include "InjectedBundle.h"
+#include <QDir>
 #include <QObject>
 
 namespace WTR {
@@ -70,6 +71,12 @@ void LayoutTestController::initializeWaitToDumpWatchdogTimerIfNeeded()
     m_waitToDumpWatchdogTimer.start(waitToDumpWatchdogTimerInterval * 1000);
 }
 
+JSRetainPtr<JSStringRef> LayoutTestController::pathToLocalResource(JSStringRef url)
+{
+    QString path = QDir::toNativeSeparators(QString(reinterpret_cast<const QChar*>(JSStringGetCharactersPtr(url)), JSStringGetLength(url)));
+    return JSStringCreateWithCharacters(reinterpret_cast<const JSChar*>(path.constData()), path.length());
+}
+
 } // namespace WTR
 
 #include "LayoutTestControllerQt.moc"
diff --git a/Tools/WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp b/Tools/WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp
index 7c500f2..88230c4 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/win/LayoutTestControllerWin.cpp
@@ -59,4 +59,9 @@ void LayoutTestController::initializeWaitToDumpWatchdogTimerIfNeeded()
     m_waitToDumpWatchdogTimer = ::SetTimer(0, waitToDumpWatchdogTimerIdentifier, waitToDumpWatchdogTimerInterval * 1000, WTR::waitToDumpWatchdogTimerFired);
 }
 
+JSRetainPtr<JSStringRef> LayoutTestController::pathToLocalResource(JSStringRef url)
+{
+    return JSStringRetain(url); // TODO.
+}
+
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/StringFunctions.h b/Tools/WebKitTestRunner/StringFunctions.h
index 33e391d..28c6f85 100644
--- a/Tools/WebKitTestRunner/StringFunctions.h
+++ b/Tools/WebKitTestRunner/StringFunctions.h
@@ -44,11 +44,6 @@ namespace WTR {
 
 // Conversion functions
 
-template<typename T> static inline WKRetainPtr<T> adoptWK(const T item)
-{
-    return WKRetainPtr<T>(AdoptWK, item);
-}
-
 inline WKRetainPtr<WKStringRef> toWK(JSStringRef string)
 {
     return adoptWK(WKStringCreateWithJSString(string));
diff --git a/Tools/WebKitTestRunner/TestController.cpp b/Tools/WebKitTestRunner/TestController.cpp
index 42331da..d33200f 100644
--- a/Tools/WebKitTestRunner/TestController.cpp
+++ b/Tools/WebKitTestRunner/TestController.cpp
@@ -139,6 +139,9 @@ WKPageRef TestController::createOtherPage(WKPageRef oldPage, WKDictionaryRef, WK
         createOtherPage,
         0, // showPage
         closeOtherPage,
+        0, // takeFocus
+        0, // focus
+        0, // unfocus
         0, // runJavaScriptAlert        
         0, // runJavaScriptConfirm
         0, // runJavaScriptPrompt
@@ -273,6 +276,9 @@ void TestController::initialize(int argc, const char* argv[])
         createOtherPage,
         0, // showPage
         0, // close
+        0, // takeFocus
+        0, // focus
+        0, // unfocus
         0, // runJavaScriptAlert        
         0, // runJavaScriptConfirm
         0, // runJavaScriptPrompt
@@ -358,6 +364,9 @@ bool TestController::resetStateToConsistentValues()
     WKPreferencesSetDOMPasteAllowed(preferences, true);
     WKPreferencesSetUniversalAccessFromFileURLsAllowed(preferences, true);
     WKPreferencesSetFileAccessFromFileURLsAllowed(preferences, true);
+#if ENABLE(FULLSCREEN_API)
+    WKPreferencesSetFullScreenEnabled(preferences, true);
+#endif
 
     static WKStringRef standardFontFamily = WKStringCreateWithUTF8CString("Times");
     static WKStringRef cursiveFontFamily = WKStringCreateWithUTF8CString("Apple Chancery");
diff --git a/Tools/WebKitTestRunner/config.h b/Tools/WebKitTestRunner/config.h
index 81f8066..38568ae 100644
--- a/Tools/WebKitTestRunner/config.h
+++ b/Tools/WebKitTestRunner/config.h
@@ -49,18 +49,18 @@
 #define WEBKIT_EXPORTDATA
 #endif
 
-#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
-#define JS_EXPORT_PRIVATE JS_EXPORTDATA
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
 
 #endif /* USE(EXPORT_MACROS) */
 
 #if PLATFORM(WIN)
 #define WTF_USE_CF 1 
 #if defined(WIN_CAIRO)
-#define WTF_PLATFORM_CAIRO 1
+#define WTF_USE_CAIRO 1
 #define WTF_USE_CURL 1
 #else
-#define WTF_PLATFORM_CG 1
+#define WTF_USE_CG 1
 #define WTF_USE_CFNETWORK 1
 #endif
 #endif
diff --git a/Tools/WebKitTestRunner/qt/WebKitTestRunner.pro b/Tools/WebKitTestRunner/qt/WebKitTestRunner.pro
index 684a14a..eb6602f 100644
--- a/Tools/WebKitTestRunner/qt/WebKitTestRunner.pro
+++ b/Tools/WebKitTestRunner/qt/WebKitTestRunner.pro
@@ -26,7 +26,7 @@ INCLUDEPATH += \
 
 DESTDIR = $$OUTPUT_DIR/bin
 
-unix:!mac:!symbian {
+unix:!mac:!symbian:!embedded {
     CONFIG += link_pkgconfig
     PKGCONFIG += fontconfig
 }
@@ -57,7 +57,7 @@ linux-* {
     QMAKE_RPATHDIR = \$\$ORIGIN/../lib $$QMAKE_RPATHDIR
     MY_RPATH = $$join(QMAKE_RPATHDIR, ":")
 
-    QMAKE_LFLAGS += -Wl,-z,origin \'-Wl,-rpath,$${MY_RPATH}\'
+    QMAKE_LFLAGS += -Wl,-z,origin \'-Wl,-rpath,$${MY_RPATH}\' -Wl,--no-undefined
     QMAKE_RPATHDIR =
 } else {
     QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleProduction.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleProduction.vsprops
index b036c84..a8e0607 100644
--- a/Tools/WebKitTestRunner/win/InjectedBundleProduction.vsprops
+++ b/Tools/WebKitTestRunner/win/InjectedBundleProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="InjectedBundleProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       ..\Configurations\InjectedBundleCoreFoundation.vsprops;
       ..\Configurations\InjectedBundleCommon.vsprops"
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleRelease.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleRelease.vsprops
index 8f65ff3..8c88cf8 100644
--- a/Tools/WebKitTestRunner/win/InjectedBundleRelease.vsprops
+++ b/Tools/WebKitTestRunner/win/InjectedBundleRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="InjectedBundleRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       ..\Configurations\InjectedBundleCoreFoundation.vsprops;
       ..\Configurations\InjectedBundleCommon.vsprops"
diff --git a/Tools/WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops b/Tools/WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops
index c7dfb84..22fddd3 100644
--- a/Tools/WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops
+++ b/Tools/WebKitTestRunner/win/InjectedBundleReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="InjectedBundleReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       ..\Configurations\InjectedBundleCFLite.vsprops;
diff --git a/Tools/WebKitTestRunner/win/TestInvocationWin.cpp b/Tools/WebKitTestRunner/win/TestInvocationWin.cpp
index 7c79ff5..2aec9ae 100644
--- a/Tools/WebKitTestRunner/win/TestInvocationWin.cpp
+++ b/Tools/WebKitTestRunner/win/TestInvocationWin.cpp
@@ -28,7 +28,7 @@
 
 namespace WTR {
 
-#if !PLATFORM(CG)
+#if !USE(CG) && !USE(CAIRO)
 void TestInvocation::dumpPixelsAndCompareWithExpected(WKImageRef)
 {
 }
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops
index 28dbf04..c11c3ff 100644
--- a/Tools/WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="WebKitTestRunnerProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       ..\Configurations\WebKitTestRunnerCommon.vsprops;
       ..\Configurations\WebKitTestRunnerCoreFoundation.vsprops;
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops
index 788f4ef..1987a61 100644
--- a/Tools/WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="WebKitTestRunnerRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       ..\Configurations\WebKitTestRunnerCommon.vsprops;
       ..\Configurations\WebKitTestRunnerCoreFoundation.vsprops;
diff --git a/Tools/WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops b/Tools/WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops
index f6e0f00..c5a73a5 100644
--- a/Tools/WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops
+++ b/Tools/WebKitTestRunner/win/WebKitTestRunnerReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="WebKitTestRunnerReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       ..\Configurations\WebKitTestRunnerCommon.vsprops;
diff --git a/Tools/WinLauncher/PrintWebUIDelegate.cpp b/Tools/WinLauncher/PrintWebUIDelegate.cpp
index ccc267b..3e92144 100644
--- a/Tools/WinLauncher/PrintWebUIDelegate.cpp
+++ b/Tools/WinLauncher/PrintWebUIDelegate.cpp
@@ -27,14 +27,13 @@
 #include "stdafx.h"
 #include "PrintWebUIDelegate.h"
 
+#include <WebKit/WebKitCOMAPI.h>
 #include <commctrl.h>
 #include <commdlg.h>
 #include <objbase.h>
 #include <shlwapi.h>
 #include <wininet.h>
 
-#include <WebKit/WebKitCOMAPI.h>
-
 static const int MARGIN = 20;
 
 HRESULT PrintWebUIDelegate::QueryInterface(REFIID riid, void** ppvObject)
@@ -97,98 +96,98 @@ HRESULT PrintWebUIDelegate::webViewPrintingMarginRect(IWebView* view, RECT* rect
 
 HRESULT PrintWebUIDelegate::webViewHeaderHeight(IWebView* webView, float* height)
 {
-   if (!webView || !height)
-      return E_POINTER;
-   
-   HDC dc = ::GetDC(0);
+    if (!webView || !height)
+        return E_POINTER;
 
-   TEXTMETRIC textMetric;
-   ::GetTextMetrics(dc, &textMetric);
-   ::ReleaseDC(0, dc);
+    HDC dc = ::GetDC(0);
 
-   *height = 1.1 * textMetric.tmHeight;
+    TEXTMETRIC textMetric;
+    ::GetTextMetrics(dc, &textMetric);
+    ::ReleaseDC(0, dc);
+
+    *height = 1.1 * textMetric.tmHeight;
 
-   return S_OK;
+    return S_OK;
 }
 
 HRESULT PrintWebUIDelegate::webViewFooterHeight(IWebView* webView, float* height)
 {
-   if (!webView || !height)
-      return E_POINTER;
+    if (!webView || !height)
+        return E_POINTER;
 
-   HDC dc = ::GetDC(0);
+    HDC dc = ::GetDC(0);
 
-   TEXTMETRIC textMetric;
-   ::GetTextMetrics(dc, &textMetric);
-   ::ReleaseDC(0, dc);
+    TEXTMETRIC textMetric;
+    ::GetTextMetrics(dc, &textMetric);
+    ::ReleaseDC(0, dc);
 
-   *height = 1.1 * textMetric.tmHeight;
+    *height = 1.1 * textMetric.tmHeight;
 
-   return S_OK;
+    return S_OK;
 }
 
-HRESULT PrintWebUIDelegate::drawHeaderInRect( 
-            /* [in] */ IWebView *webView,
-            /* [in] */ RECT *rect,
+HRESULT PrintWebUIDelegate::drawHeaderInRect(
+            /* [in] */ IWebView* webView,
+            /* [in] */ RECT* rect,
             /* [in] */ OLE_HANDLE drawingContext)
 {
-   if (!webView || !rect)
-      return E_POINTER;
+    if (!webView || !rect)
+        return E_POINTER;
 
-   // Turn off header for now.
-   HDC dc = reinterpret_cast<HDC>(drawingContext);
+    // Turn off header for now.
+    HDC dc = reinterpret_cast<HDC>(drawingContext);
 
-   HFONT hFont = (HFONT)::GetStockObject(ANSI_VAR_FONT);
-   HFONT hOldFont = (HFONT)::SelectObject(dc, hFont);
+    HGDIOBJ hFont = ::GetStockObject(ANSI_VAR_FONT);
+    HGDIOBJ hOldFont = ::SelectObject(dc, hFont);
 
-   LPCTSTR header(_T("[Sample Header]"));
-   int length = _tcslen(header);
+    LPCWSTR header = L"[Sample Header]";
+    size_t length = wcslen(header);
 
-   int rc = ::DrawText(dc, header, length, rect, DT_LEFT | DT_NOCLIP | DT_VCENTER  | DT_SINGLELINE);
-   ::SelectObject(dc, hOldFont);
+    int rc = ::DrawTextW(dc, header, length, rect, DT_LEFT | DT_NOCLIP | DT_VCENTER | DT_SINGLELINE);
+    ::SelectObject(dc, hOldFont);
 
-   if (!rc)
-      return E_FAIL;
+    if (!rc)
+        return E_FAIL;
 
-   ::MoveToEx(dc, rect->left, rect->bottom, 0);
-   HPEN hPen = (HPEN)::GetStockObject(BLACK_PEN);
-   HPEN hOldPen = (HPEN)::SelectObject(dc, hPen);
-   ::LineTo(dc, rect->right, rect->bottom);
-   ::SelectObject(dc, hOldPen);
+    ::MoveToEx(dc, rect->left, rect->bottom, 0);
+    HGDIOBJ hPen = ::GetStockObject(BLACK_PEN);
+    HGDIOBJ hOldPen = ::SelectObject(dc, hPen);
+    ::LineTo(dc, rect->right, rect->bottom);
+    ::SelectObject(dc, hOldPen);
 
-   return S_OK;
+    return S_OK;
 }
 
-HRESULT PrintWebUIDelegate::drawFooterInRect( 
-            /* [in] */ IWebView *webView,
-            /* [in] */ RECT *rect,
+HRESULT PrintWebUIDelegate::drawFooterInRect(
+            /* [in] */ IWebView* webView,
+            /* [in] */ RECT* rect,
             /* [in] */ OLE_HANDLE drawingContext,
             /* [in] */ UINT pageIndex,
             /* [in] */ UINT pageCount)
 {
-   if (!webView || !rect)
-      return E_POINTER;
+    if (!webView || !rect)
+        return E_POINTER;
 
-   HDC dc = reinterpret_cast<HDC>(drawingContext);
+    HDC dc = reinterpret_cast<HDC>(drawingContext);
 
-   HFONT hFont = (HFONT)::GetStockObject(ANSI_VAR_FONT);
-   HFONT hOldFont = (HFONT)::SelectObject(dc, hFont);
+    HGDIOBJ hFont = ::GetStockObject(ANSI_VAR_FONT);
+    HGDIOBJ hOldFont = ::SelectObject(dc, hFont);
 
-   LPCTSTR footer(_T("[Sample Footer]"));
-   int length = _tcslen(footer);
+    LPCWSTR footer = L"[Sample Footer]";
+    size_t length = wcslen(footer);
 
-   // Add a line, 1/10th inch above the footer text from left margin to right margin.
-   ::MoveToEx(dc, rect->left, rect->top, 0);
-   HPEN hPen = (HPEN)::GetStockObject(BLACK_PEN);
-   HPEN hOldPen = (HPEN)::SelectObject(dc, hPen);
-   ::LineTo(dc, rect->right, rect->top);
-   ::SelectObject(dc, hOldPen);
+    // Add a line, 1/10th inch above the footer text from left margin to right margin.
+    ::MoveToEx(dc, rect->left, rect->top, 0);
+    HGDIOBJ hPen = ::GetStockObject(BLACK_PEN);
+    HGDIOBJ hOldPen = ::SelectObject(dc, hPen);
+    ::LineTo(dc, rect->right, rect->top);
+    ::SelectObject(dc, hOldPen);
 
-   int rc = ::DrawText(dc, footer, length, rect, DT_LEFT | DT_NOCLIP | DT_VCENTER  | DT_SINGLELINE);
-   ::SelectObject(dc, hOldFont);
+    int rc = ::DrawTextW(dc, footer, length, rect, DT_LEFT | DT_NOCLIP | DT_VCENTER | DT_SINGLELINE);
+    ::SelectObject(dc, hOldFont);
 
-   if (!rc)
-      return E_FAIL;
+    if (!rc)
+        return E_FAIL;
 
-   return S_OK;
+    return S_OK;
 }
diff --git a/Tools/WinLauncher/WinLauncher.cpp b/Tools/WinLauncher/WinLauncher.cpp
index 5caf230..f572b15 100644
--- a/Tools/WinLauncher/WinLauncher.cpp
+++ b/Tools/WinLauncher/WinLauncher.cpp
@@ -327,12 +327,12 @@ void PrintView(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
     HDC printDC = getPrinterDC();
     if (!printDC) {
-        ::MessageBox(0, _T("Error creating printing DC"), _T("Error"), MB_APPLMODAL | MB_OK);
+        ::MessageBoxW(0, L"Error creating printing DC", L"Error", MB_APPLMODAL | MB_OK);
         return;
     }
 
     if (::SetAbortProc(printDC, AbortProc) == SP_ERROR) {
-        ::MessageBox(0, _T("Error setting up AbortProc"), _T("Error"), MB_APPLMODAL | MB_OK);
+        ::MessageBoxW(0, L"Error setting up AbortProc", L"Error", MB_APPLMODAL | MB_OK);
         return;
     }
 
@@ -350,7 +350,7 @@ void PrintView(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
     framePrivate->getPrintedPageCount(printDC, &pageCount);
 
     DOCINFO di;
-    initDocStruct(&di, _T("WebKit Doc"));
+    initDocStruct(&di, L"WebKit Doc");
     ::StartDoc(printDC, &di);
 
     // FIXME: Need CoreGraphics implementation
diff --git a/Tools/WinLauncher/WinLauncherProduction.vsprops b/Tools/WinLauncher/WinLauncherProduction.vsprops
index 83292fe..1069f4a 100644
--- a/Tools/WinLauncher/WinLauncherProduction.vsprops
+++ b/Tools/WinLauncher/WinLauncherProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="WinLauncherProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\WinLauncherCommon.vsprops"
 	>
diff --git a/Tools/WinLauncher/WinLauncherRelease.vsprops b/Tools/WinLauncher/WinLauncherRelease.vsprops
index 2b41482..8639931 100644
--- a/Tools/WinLauncher/WinLauncherRelease.vsprops
+++ b/Tools/WinLauncher/WinLauncherRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="WinLauncherRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\WinLauncherCommon.vsprops"
 	>
diff --git a/Tools/WinLauncher/WinLauncherReleaseCairoCFLite.vsprops b/Tools/WinLauncher/WinLauncherReleaseCairoCFLite.vsprops
index 351ac49..58aef68 100644
--- a/Tools/WinLauncher/WinLauncherReleaseCairoCFLite.vsprops
+++ b/Tools/WinLauncher/WinLauncherReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="WinLauncherReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\WinLauncherCommon.vsprops"
diff --git a/Tools/record-memory-win/record-memory-winProduction.vsprops b/Tools/record-memory-win/record-memory-winProduction.vsprops
index 4eb90f4..c8520f9 100644
--- a/Tools/record-memory-win/record-memory-winProduction.vsprops
+++ b/Tools/record-memory-win/record-memory-winProduction.vsprops
@@ -5,7 +5,7 @@
 	Name="record-memory-winProduction"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
-      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
       .\record-memory-win-common.vsprops"
 	>
diff --git a/Tools/record-memory-win/record-memory-winRelease.vsprops b/Tools/record-memory-win/record-memory-winRelease.vsprops
index f38d7d7..1f43758 100644
--- a/Tools/record-memory-win/record-memory-winRelease.vsprops
+++ b/Tools/record-memory-win/record-memory-winRelease.vsprops
@@ -5,6 +5,7 @@
 	Name="record-memory-winRelease"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       .\record-memory-win-common.vsprops"
 	>
diff --git a/Tools/record-memory-win/record-memory-winReleaseCairoCFLite.vsprops b/Tools/record-memory-win/record-memory-winReleaseCairoCFLite.vsprops
index 8ce466f..8de269c 100644
--- a/Tools/record-memory-win/record-memory-winReleaseCairoCFLite.vsprops
+++ b/Tools/record-memory-win/record-memory-winReleaseCairoCFLite.vsprops
@@ -5,6 +5,7 @@
 	Name="record-memory-winReleaseCairoCFLite"
 	InheritedPropertySheets="
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
       $(WebKitVSPropsRedirectionDir)..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
       .\record-memory-win-common.vsprops"
diff --git a/Tools/wx/build/settings.py b/Tools/wx/build/settings.py
index 6d7a7a5..8186d16 100644
--- a/Tools/wx/build/settings.py
+++ b/Tools/wx/build/settings.py
@@ -83,6 +83,7 @@ jscore_dirs = [
     'bytecompiler',
     'debugger',
     'DerivedSources',
+    'heap',
     'interpreter',
     'jit',
     'parser',
diff --git a/Tools/wx/build/wxpresets.py b/Tools/wx/build/wxpresets.py
index 3d6b693..f5181b1 100644
--- a/Tools/wx/build/wxpresets.py
+++ b/Tools/wx/build/wxpresets.py
@@ -53,8 +53,12 @@ def get_wx_version(wx_root):
     
     majorVersion = re.search("#define\swxMAJOR_VERSION\s+(\d+)", versionText).group(1)
     minorVersion = re.search("#define\swxMINOR_VERSION\s+(\d+)", versionText).group(1)
+    releaseVersion = re.search("#define\swxRELEASE_NUMBER\s+(\d+)", versionText).group(1)
     
-    return (majorVersion, minorVersion)
+    release = [majorVersion, minorVersion]
+    if int(minorVersion) % 2 == 1:
+        release.append(releaseVersion)
+    return release
 
 def get_wxmsw_settings(wx_root, shared = False, unicode = False, debug = False, wxPython=False):
     if not os.path.exists(wx_root):
@@ -71,7 +75,7 @@ def get_wxmsw_settings(wx_root, shared = False, unicode = False, debug = False,
     ext = ''
     postfix = 'vc'
     
-    version_str_nodot = ''.join(get_wx_version(wx_root))
+    version_str_nodot = ''.join(get_wx_version(wx_root)[0:2])
     
     if shared:
         defines.append('WXUSINGDLL')
@@ -84,7 +88,7 @@ def get_wxmsw_settings(wx_root, shared = False, unicode = False, debug = False,
         ext += 'u'
     
     depext = ''
-    if wxPython:
+    if wxPython and not version_str_nodot.startswith('29'):
         ext += 'h'
         depext += 'h'
     elif debug:
diff --git a/Tools/wx/install-unix-extras b/Tools/wx/install-unix-extras
index 00c936c..1f14294 100755
--- a/Tools/wx/install-unix-extras
+++ b/Tools/wx/install-unix-extras
@@ -80,6 +80,18 @@ LIBCURL_URL="http://curl.haxx.se/download/$LIBCURL_TARBALL"
 
 export MAC_OS_X_DEPLOYMENT_TARGET=10.4
 
+ARCH_FLAGS="-arch i386 -arch ppc -arch x86_64"
+SDK="/Developer/SDKs/MacOSX10.4u.sdk"
+
+if [ ! -d $SDK ]; then
+    SDK="/Developer/SDKs/MacOSX10.5.sdk"
+fi
+
+if [ "${OSTYPE:0:6}" == "darwin" ]; then  
+    export CC="gcc-4.0"
+    export CXX="g++-4.0"
+fi
+
 cd $DL_DIR
 # build ICU
 if [ `which icu-config >/dev/null 2>&1` ]; then
@@ -92,8 +104,8 @@ if [ `which icu-config >/dev/null 2>&1` ]; then
 
   if [ "${OSTYPE:0:6}" == "darwin" ]; then  
     ./configure --prefix=$DEPS_PREFIX --disable-dependency-tracking
-    make CFLAGS="-O -g -isysroot /Developer/SDKs/MacOSX10.4u.sdk -arch i386 -arch ppc" \
-    LDFLAGS="-arch i386 -arch ppc"
+    make CFLAGS="-O -g -isysroot $SDK $ARCH_FLAGS" \
+    LDFLAGS=$ARCH_FLAGS
     make install
   else
     ./configure --prefix=$DEPS_PREFIX
@@ -115,8 +127,8 @@ if [ ! -f $DEPS_PREFIX/lib/libiconv.$DLLEXT ]; then
 
   if [ "${OSTYPE:0:6}" == "darwin" ]; then  
     ./configure --prefix=$DEPS_PREFIX --disable-dependency-tracking
-    make CFLAGS="-O -g -isysroot /Developer/SDKs/MacOSX10.4u.sdk -arch i386 -arch ppc" \
-    LDFLAGS="-arch i386 -arch ppc"
+    make CFLAGS="-O -g -isysroot $SDK $ARCH_FLAGS" \
+    LDFLAGS="$ARCH_FLAGS"
     make install
   else
     ./configure --prefix=$DEPS_PREFIX
@@ -139,8 +151,8 @@ if [ ! -f $DEPS_PREFIX/lib/libjpeg.a ]; then
 
   if [ "${OSTYPE:0:6}" == "darwin" ]; then
     ./configure --prefix=$DEPS_PREFIX --disable-dependency-tracking
-    make CFLAGS="-O -g -isysroot /Developer/SDKs/MacOSX10.4u.sdk -arch i386 -arch ppc" \
-    LDFLAGS="-arch i386 -arch ppc"
+    make CFLAGS="-O -g -isysroot $SDK $ARCH_FLAGS" \
+    LDFLAGS="$ARCH_FLAGS"
     make install
   else
     ./configure --prefix=$DEPS_PREFIX
@@ -163,8 +175,8 @@ if [ ! -f $DEPS_PREFIX/lib/libpng.a ]; then
 
   if [ "${OSTYPE:0:6}" == "darwin" ]; then
     ./configure --prefix=$DEPS_PREFIX --disable-dependency-tracking
-    make CFLAGS="-O -g -isysroot /Developer/SDKs/MacOSX10.4u.sdk -arch i386 -arch ppc" \
-    LDFLAGS="-arch i386 -arch ppc"
+    make CFLAGS="-O -g -isysroot $SDK $ARCH_FLAGS" \
+    LDFLAGS="$ARCH_FLAGS"
     make install
   else
     ./configure --prefix=$DEPS_PREFIX
@@ -184,9 +196,40 @@ if [ ! -f $DEPS_PREFIX/lib/libcurl.$DLLEXT ]; then
   cd $DL_DIR/curl-$LIBCURL_VERSION
 
   if [ "${OSTYPE:0:6}" == "darwin" ]; then
+    # CURL creates different build headers for 32 and 64 bit, so to get a universal build,
+    # we must first create a 32 bit version of the header, then a 64 bit version, and
+    # have the original header simply decide which to use.
+    export CFLAGS="-O -g -isysroot $SDK -mmacosx-version-min=10.4 -arch i386 -arch ppc"
+    ./configure --prefix=$DEPS_PREFIX --disable-dependency-tracking
+    
+    mkdir -p $DEPS_PREFIX/include/curl
+    
+    cp include/curl/curlbuild.h include/curl/curlbuild32.h
+    cp include/curl/curlbuild.h $DEPS_PREFIX/include/curl/curlbuild32.h
+    
+    make distclean
+    
+    export CFLAGS="-O -g -isysroot $SDK -mmacosx-version-min=10.4 -arch x86_64 -arch ppc64"
+    ./configure --prefix=$DEPS_PREFIX --disable-dependency-tracking
+    
+    cp include/curl/curlbuild.h include/curl/curlbuild64.h
+    cp include/curl/curlbuild.h $DEPS_PREFIX/include/curl/curlbuild64.h
+    
+    make distclean
+    
+    export CFLAGS="-O -g -isysroot $SDK -mmacosx-version-min=10.4 $ARCH_FLAGS"
     ./configure --prefix=$DEPS_PREFIX --disable-dependency-tracking
-    make CFLAGS="-O -g -isysroot /Developer/SDKs/MacOSX10.4u.sdk -arch i386 -arch ppc" \
-    LDFLAGS="-arch i386 -arch ppc"
+    
+    cat > include/curl/curlbuild.h <<EOF
+#ifdef __LP64__
+#include "curlbuild64.h"
+#else
+#include "curlbuild32.h"
+#endif 
+EOF
+
+    make CFLAGS="-O -g -isysroot $SDK $ARCH_FLAGS" \
+    LDFLAGS="$ARCH_FLAGS"
     make install
   else
     ./configure --prefix=$DEPS_PREFIX
diff --git a/Tools/wx/packaging/build-mac-installer.py b/Tools/wx/packaging/build-mac-installer.py
index d0ef945..8231049 100644
--- a/Tools/wx/packaging/build-mac-installer.py
+++ b/Tools/wx/packaging/build-mac-installer.py
@@ -70,7 +70,7 @@ if sys.platform.startswith("darwin"):
     wx_root = "/usr/local/lib/wxPython-unicode-%s" % wx.__version__
     sp_root = "%s/lib/python%s/site-packages" % (wx_root, py_version)
 sitepackages = "%s/wx-%s-mac-unicode/wx" % (sp_root, wx_version[:3])
-prefix = wxroot + "/lib"
+prefix = wx_root + "/lib"
 
 def mac_update_dependencies(dylib, prefix):
     """
@@ -131,7 +131,7 @@ try:
             shutil.copy(afile, wxroot)
     
     if sys.platform.startswith("darwin"):
-        dylib_path = os.path.join(wxpythonroot, "libwxwebkit.dylib")
+        dylib_path = os.path.join(wxroot, "libwxwebkit.dylib")
         os.system("install_name_tool -id %s %s" % (os.path.join(prefix, "libwxwebkit.dylib"), dylib_path))
         mac_update_dependencies(dylib_path, prefix)
         mac_update_dependencies(os.path.join(wxpythonroot, "_webview.so"), prefix)
@@ -140,7 +140,7 @@ try:
         if not os.path.exists(demodir):
             os.makedirs(demodir)
             
-        shutil.copy(os.path.join(wxwk_root, "WebKit", "wx", "bindings", "python", "samples", "simple.py"), demodir)
+        shutil.copy(os.path.join(wxwk_root, "Source", "WebKit", "wx", "bindings", "python", "samples", "simple.py"), demodir)
         
         if os.path.exists(pkgname + ".pkg"):
             shutil.rmtree(pkgname + ".pkg")
@@ -152,7 +152,6 @@ try:
                     '--domain system',
                     '--root-volume-only',
                     '--root ' + installroot,
-                    '--resources %s/mac/resources' % script_dir,
                     '--verbose'
                     ]
     
diff --git a/Tools/wx/packaging/build-win-installer.py b/Tools/wx/packaging/build-win-installer.py
index ffbdd19..553d1b3 100644
--- a/Tools/wx/packaging/build-win-installer.py
+++ b/Tools/wx/packaging/build-win-installer.py
@@ -31,6 +31,8 @@ import datetime
 import glob
 from subprocess import *
 
+import wx
+
 script_dir = os.path.abspath(os.path.dirname(__file__))
 sys.path.append(os.path.abspath(os.path.join(script_dir, "..", "build")))
 
@@ -85,7 +87,13 @@ CopyMode: alwaysoverwrite; Source: *.py;        DestDir: "{app}"
 
     installerTemplate = open("wxWebKitInstaller.iss.in", "r").read()
 
+    wx_version = '%d.%d' % (wx.MAJOR_VERSION, wx.MINOR_VERSION)
+    if wx.MINOR_VERSION % 2 == 1:
+        wx_version += ".%d" % wx.RELEASE_VERSION
+        installerTemplate = installerTemplate.replace("msw-unicode", "msw")
+        
     installerTemplate = installerTemplate.replace("<<VERSION>>", date)
+    installerTemplate = installerTemplate.replace("<<WXVERSION>>", wx_version)
     installerTemplate = installerTemplate.replace("<<ROOTDIR>>", wxwebkit_dir )
     installerTemplate = installerTemplate.replace("<<PYTHONVER>>", sys.version[0:3] )
     installerTemplate = installerTemplate.replace("<<FILES>>", fileList )
diff --git a/Tools/wx/packaging/wxWebKitInstaller.iss.in b/Tools/wx/packaging/wxWebKitInstaller.iss.in
index ebc89d4..2312474 100644
--- a/Tools/wx/packaging/wxWebKitInstaller.iss.in
+++ b/Tools/wx/packaging/wxWebKitInstaller.iss.in
@@ -17,7 +17,7 @@ UninstallFilesDir={app}\Uninstall
 Compression=bzip/9
 SourceDir=<<ROOTDIR>>
 OutputDir=win-installer
-OutputBaseFilename=wxWebKit-wx2.8-Py<<PYTHONVER>>-<<VERSION>>
+OutputBaseFilename=wxWebKit-wx<<WXVERSION>>-Py<<PYTHONVER>>-<<VERSION>>
 DisableStartupPrompt=yes
 AllowNoIcons=yes
 DisableProgramGroupPage=yes
@@ -57,7 +57,7 @@ begin
             PythonDir := 'C:\Put a directory on PYTHONPATH here\';
         end;
     end;
-    InstallDir := PythonDir + '\Lib\site-packages\wx-2.8-msw-unicode\wx\';
+    InstallDir := PythonDir + '\Lib\site-packages\wx-<<WXVERSION>>-msw-unicode\wx\';
     Result := True;
 end;
 
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index fa1e8e1..0fe2800 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,159 @@
+2011-04-19  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Roll r81683 back in.
+
+        Going to certain pages causes a download of "st.html" or "jsp.html" (news.yahoo.com, etc.)
+        <rdar://problem/9139245>
+
+        "Windows edition".
+
+        * win/lib/WebKitSystemInterface.lib:
+
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+
+2011-04-14  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Set minimum priority for fast lane connections
+        https://bugs.webkit.org/show_bug.cgi?id=58353
+
+        Add WKSetHTTPPipeliningMinimumFastLanePriority.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops:
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops:
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops:
+
+2011-04-06  Dai Mikurube  <dmikurube@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add QUOTA build flag for unified quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57918
+
+        * win/tools/vsprops/FeatureDefines.vsprops: Added QUOTA build flag
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops: Added QUOTA build flag
+
+2011-04-04  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/57384> CFNetwork and WebCore load priorities should match
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebKitSystemInterface.h:
+        (WKSetHTTPPipeliningMaximumPriority): Added declaration.
+        (WKExtractWordDefinitionTokenRangeFromContextualString): Added
+        missing declaration from r81890.
+        (WKShowWordDefinitionWindow): Ditto.
+        (WKHideWordDefinitionWindow): Ditto.
+        * libWebKitSystemInterfaceLeopard.a: Updated.
+        * libWebKitSystemInterfaceSnowLeopard.a: Updated.
+
+2011-04-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove unused AnalyzeWithLargeStack code from Windows build files
+        https://bugs.webkit.org/show_bug.cgi?id=57771
+        
+        This was used for us to build with prefast automatically,
+        but it is out-of-date and hasn't been used for some time.
+        Removing completely for now.
+
+        * win/tools/vsprops/common.vsprops:
+
+2011-04-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Brian Weinstein.
+
+        Fix Windows build warning.
+        https://bugs.webkit.org/show_bug.cgi?id=57767
+
+        * win/tools/vsprops/common.vsprops:
+
+2011-04-01  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Unreviewed build fix.
+
+        Define DEBUG_ALL for WinCairo debug builds so that the correct
+        labeled DLLs ("*_debug.dll") are linked for testing runs.
+
+        * win/tools/vsprops/debug_wincairo.vsprops:
+
+2011-04-01  Timothy Hatcher  <timothy@apple.com>
+
+        Make momentum scroll event latching work in WebKit2 on Mac.
+
+        <rdar://problem/8751861>
+
+        Reviewed by Darin Adler.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a: Updated to remove WKIsLatchingWheelEvent and add WKGetNSEventMomentumPhase.
+        * libWebKitSystemInterfaceSnowLeopard.a: Ditto.
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Should turn off frame pointer omission (FPO) for Release (not Production) builds
+        https://bugs.webkit.org/show_bug.cgi?id=54403
+
+        Leave it enabled for Windows Production builds.
+        Disabling this optimization improves stack traces for memory and performance tools like umdh and xperf.
+        
+        We use both /Oy- and OmitFramePointers="false" since OmitFramePointers="false" isnt' enough
+        to override /O2.
+
+        * win/tools/vsprops/release.vsprops:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Share most vsprops between Release and Production builds in releaseproduction.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=57508
+
+        * win/tools/vsprops/release.vsprops:
+        * win/tools/vsprops/releaseproduction.vsprops: Copied from WebKitLibraries/win/tools/vsprops/release.vsprops.
+
 2011-03-30  Steve Falkenburg  <sfalken@apple.com>
 
         Rubber stamped by Adam Roben.
diff --git a/WebKitLibraries/WebKitSystemInterface.h b/WebKitLibraries/WebKitSystemInterface.h
index 3f3c049..9079919 100644
--- a/WebKitLibraries/WebKitSystemInterface.h
+++ b/WebKitLibraries/WebKitSystemInterface.h
@@ -352,13 +352,24 @@ void WKSetCAAnimationValueFunction(CAPropertyAnimation*, NSString* function);
 
 unsigned WKInitializeMaximumHTTPConnectionCountPerHost(unsigned preferredConnectionCount);
 int WKGetHTTPPipeliningPriority(NSURLRequest *);
+void WKSetHTTPPipeliningMaximumPriority(int maximumPriority);
 void WKSetHTTPPipeliningPriority(NSMutableURLRequest *, int priority);
+void WKSetHTTPPipeliningMinimumFastLanePriority(int priority);
 
 void WKSetCONNECTProxyForStream(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
 void WKSetCONNECTProxyAuthorizationForStream(CFReadStreamRef, CFStringRef proxyAuthorizationString);
 CFHTTPMessageRef WKCopyCONNECTProxyResponse(CFReadStreamRef, CFURLRef responseURL);
 
-BOOL WKIsLatchingWheelEvent(NSEvent *);
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+typedef enum {
+    WKEventPhaseNone = 0,
+    WKEventPhaseBegan = 1,
+    WKEventPhaseChanged = 2,
+    WKEventPhaseEnded = 3,
+} WKEventPhase;
+
+int WKGetNSEventMomentumPhase(NSEvent *);
+#endif
 
 #ifndef BUILDING_ON_TIGER
 void WKWindowSetAlpha(NSWindow *window, float alphaValue);
@@ -448,6 +459,10 @@ void WKContentAreaDidHide(WKScrollbarPainterControllerRef);
 
 bool WKScrollbarPainterUsesOverlayScrollers(void);
 
+NSRange WKExtractWordDefinitionTokenRangeFromContextualString(NSString *contextString, NSRange range, NSDictionary **options);
+void WKShowWordDefinitionWindow(NSAttributedString *term, NSPoint screenPoint, NSDictionary *options);
+void WKHideWordDefinitionWindow(void);
+
 #endif
 
 #ifdef __cplusplus
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
index 886d78a..6cd6976 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
index d55a694..e7e3872 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface.lib b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
index d212612..d4ab213 100644
--- a/WebKitLibraries/win/lib/WebKitSystemInterface.lib
+++ b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
index 6bea548..f4329a2 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
@@ -9,7 +9,7 @@
 	>
   <Tool
 		Name="VCCLCompilerTool"
-		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_ACCELERATED_2D_CANVAS);$(ENABLE_BLOB);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CLIENT_BASED_GEOLOCATION);$(ENABLE_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DATA_TRANSFER_ITEMS);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_DOM_STORAGE);$(ENABLE_EVENTSOURCE);$(ENABLE_FILTERS);$(ENABLE_FILE_SYSTEM);$(ENABLE_FULLSCREEN_API);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_IMAGE_RESIZER);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_SPEECH);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_LINK_PREFETCH);$(ENABLE_MATHML);$(ENABLE_METER_TAG);$(ENABLE_NOTIFICATIONS);$(ENABLE_OFFLINE_WEB_APPLICATIONS);$(ENABLE_PROGRESS_TAG);$(ENABLE_REGISTER_PROTOCOL_HANDLER);$(ENABLE_SHARED_WORKERS);$(ENABLE_SVG);$(ENABLE_SVG_ANIMATION);$(ENABLE_SVG_AS_IMAGE);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_SVG_FOREIGN_OBJECT);$(ENABLE_SVG_USE);$(ENABLE_VIDEO);$(ENABLE_MEDIA_STATISTICS);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WML);$(ENABLE_WORKERS);$(ENABLE_XHTMLMP);$(ENABLE_XPATH);$(ENABLE_XSLT)"
+		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_ACCELERATED_2D_CANVAS);$(ENABLE_BLOB);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CLIENT_BASED_GEOLOCATION);$(ENABLE_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DATA_TRANSFER_ITEMS);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_DOM_STORAGE);$(ENABLE_EVENTSOURCE);$(ENABLE_FILTERS);$(ENABLE_FILE_SYSTEM);$(ENABLE_FULLSCREEN_API);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_IMAGE_RESIZER);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_SPEECH);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_LINK_PREFETCH);$(ENABLE_MATHML);$(ENABLE_METER_TAG);$(ENABLE_NOTIFICATIONS);$(ENABLE_OFFLINE_WEB_APPLICATIONS);$(ENABLE_PAGE_VISIBILITY_API);$(ENABLE_PROGRESS_TAG);$(ENABLE_QUOTA);$(ENABLE_REGISTER_PROTOCOL_HANDLER);$(ENABLE_SHARED_WORKERS);$(ENABLE_SVG);$(ENABLE_SVG_ANIMATION);$(ENABLE_SVG_AS_IMAGE);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_SVG_FOREIGN_OBJECT);$(ENABLE_SVG_USE);$(ENABLE_VIDEO);$(ENABLE_MEDIA_STATISTICS);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WML);$(ENABLE_WORKERS);$(ENABLE_XHTMLMP);$(ENABLE_XPATH);$(ENABLE_XSLT)"
 	/>
   <UserMacro
 		Name="ENABLE_3D_CANVAS"
@@ -67,10 +67,10 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
-                Name="ENABLE_DIRECTORY_UPLOAD"
-                Value=""
-                PerformEnvironmentSet="true"
-        />
+        Name="ENABLE_DIRECTORY_UPLOAD"
+        Value=""
+        PerformEnvironmentSet="true"
+    />
   <UserMacro
 		Name="ENABLE_DOM_STORAGE"
 		Value="ENABLE_DOM_STORAGE"
@@ -152,11 +152,21 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_PAGE_VISIBILITY_API"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_PROGRESS_TAG"
 		Value=""
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_QUOTA"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_REGISTER_PROTOCOL_HANDLER"
 		Value=""
 		PerformEnvironmentSet="true"
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
index 32664b8..45693d6 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
@@ -9,7 +9,7 @@
 	>
   <Tool
 		Name="VCCLCompilerTool"
-		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_ACCELERATED_2D_CANVAS);$(ENABLE_BLOB);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CLIENT_BASED_GEOLOCATION);$(ENABLE_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(DATA_TRANSFER_ITEMS);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_DOM_STORAGE);$(ENABLE_EVENTSOURCE);$(ENABLE_FILTERS);$(ENABLE_FILE_SYSTEM);$(ENABLE_FULLSCREEN_API);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_IMAGE_RESIZER);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_SPEECH);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_LINK_PREFETCH);$(ENABLE_MATHML);$(ENABLE_METER_TAG);$(ENABLE_NOTIFICATIONS);$(ENABLE_OFFLINE_WEB_APPLICATIONS);$(ENABLE_PROGRESS_TAG);$(ENABLE_REGISTER_PROTOCOL_HANDLER);$(ENABLE_SHARED_WORKERS);$(ENABLE_SVG);$(ENABLE_SVG_ANIMATION);$(ENABLE_SVG_AS_IMAGE);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_SVG_FOREIGN_OBJECT);$(ENABLE_SVG_USE);$(ENABLE_VIDEO);$(ENABLE_MEDIA_STATISTICS);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WML);$(ENABLE_WORKERS);$(ENABLE_XHTMLMP);$(ENABLE_XPATH);$(ENABLE_XSLT)"
+		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_ACCELERATED_2D_CANVAS);$(ENABLE_BLOB);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CLIENT_BASED_GEOLOCATION);$(ENABLE_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(DATA_TRANSFER_ITEMS);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_DOM_STORAGE);$(ENABLE_EVENTSOURCE);$(ENABLE_FILTERS);$(ENABLE_FILE_SYSTEM);$(ENABLE_FULLSCREEN_API);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_IMAGE_RESIZER);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_SPEECH);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_LINK_PREFETCH);$(ENABLE_MATHML);$(ENABLE_METER_TAG);$(ENABLE_NOTIFICATIONS);$(ENABLE_OFFLINE_WEB_APPLICATIONS);$(ENABLE_PROGRESS_TAG);$(ENABLE_QUOTA);$(ENABLE_REGISTER_PROTOCOL_HANDLER);$(ENABLE_SHARED_WORKERS);$(ENABLE_SVG);$(ENABLE_SVG_ANIMATION);$(ENABLE_SVG_AS_IMAGE);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_SVG_FOREIGN_OBJECT);$(ENABLE_SVG_USE);$(ENABLE_VIDEO);$(ENABLE_MEDIA_STATISTICS);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WML);$(ENABLE_WORKERS);$(ENABLE_XHTMLMP);$(ENABLE_XPATH);$(ENABLE_XSLT)"
 	/>
   <UserMacro
 		Name="ENABLE_3D_CANVAS"
@@ -157,6 +157,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_QUOTA"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_REGISTER_PROTOCOL_HANDLER"
 		Value=""
 		PerformEnvironmentSet="true"
diff --git a/WebKitLibraries/win/tools/vsprops/common.vsprops b/WebKitLibraries/win/tools/vsprops/common.vsprops
index d5889de..c2c419c 100644
--- a/WebKitLibraries/win/tools/vsprops/common.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/common.vsprops
@@ -59,9 +59,9 @@
 		Name="ConfigurationBuildDir"
 		Value="$(WebKitOutputDir)\$(ConfigurationName)"
 	/>
-  <UserMacro
-		Name="AnalyzeWithLargeStack"
-		Value=""
+	<UserMacro
+		Name="ProductionBuild"
+		Value="0"
 	/>
 </VisualStudioPropertySheet>
 
diff --git a/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops b/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops
index c9f5722..e9052fd 100644
--- a/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops
@@ -7,10 +7,11 @@
 	<Tool
 		Name="VCCLCompilerTool"
 		Optimization="0"
+		AdditionalIncludeDirectories="&quot;$(WebKitLibrariesDir)\include\cairo&quot;"
+		PreprocessorDefinitions="DEBUG_ALL"
 		MinimalRebuild="true"
 		BasicRuntimeChecks="3"
 		RuntimeLibrary="2"
-		AdditionalIncludeDirectories="&quot;$(WebKitLibrariesDir)\include\cairo&quot;"
 	/>
 	<Tool
 		Name="VCLinkerTool"
diff --git a/WebKitLibraries/win/tools/vsprops/release.vsprops b/WebKitLibraries/win/tools/vsprops/release.vsprops
index 6416e3f..881de70 100644
--- a/WebKitLibraries/win/tools/vsprops/release.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/release.vsprops
@@ -6,33 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		Optimization="2"
-		PreprocessorDefinitions="NDEBUG"
-		RuntimeLibrary="2"
-	/>
-	<Tool
-		Name="VCLinkerTool"
-		LinkIncremental="1"
-		OptimizeReferences="2"
-		EnableCOMDATFolding="2"
-		OptimizeForWindows98="1"
-	/>
-	<Tool
-		Name="VCResourceCompilerTool"
-		PreprocessorDefinitions="NDEBUG"
-	/>
-	<UserMacro
-		Name="WebKitConfigSuffix"
-		Value=""
-		PerformEnvironmentSet="true"
-	/>
-	<UserMacro
-		Name="LibraryConfigSuffix"
-		Value=""
-		PerformEnvironmentSet="true"
-	/>
-	<UserMacro
-		Name="WebKitDLLConfigSuffix"
-		Value=""
+		AdditionalOptions="/Oy-"
+		OmitFramePointers="false"
 	/>
 </VisualStudioPropertySheet>
diff --git a/WebKitLibraries/win/tools/vsprops/releaseproduction.vsprops b/WebKitLibraries/win/tools/vsprops/releaseproduction.vsprops
new file mode 100644
index 0000000..df182ee
--- /dev/null
+++ b/WebKitLibraries/win/tools/vsprops/releaseproduction.vsprops
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="releaseproduction"
+	>
+	<Tool
+		Name="VCCLCompilerTool"
+		Optimization="2"
+		PreprocessorDefinitions="NDEBUG"
+		RuntimeLibrary="2"
+	/>
+	<Tool
+		Name="VCLinkerTool"
+		LinkIncremental="1"
+		OptimizeReferences="2"
+		EnableCOMDATFolding="2"
+		OptimizeForWindows98="1"
+	/>
+	<Tool
+		Name="VCResourceCompilerTool"
+		PreprocessorDefinitions="NDEBUG"
+	/>
+	<UserMacro
+		Name="WebKitConfigSuffix"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+	<UserMacro
+		Name="LibraryConfigSuffix"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+	<UserMacro
+		Name="WebKitDLLConfigSuffix"
+		Value=""
+	/>
+</VisualStudioPropertySheet>